7 #define RSA_EXPONENT 37 /* we like this prime */
9 static void diagbn(char *prefix
, Bignum md
) {
10 int i
, nibbles
, morenibbles
;
11 static const char hex
[] = "0123456789ABCDEF";
13 printf("%s0x", prefix ? prefix
: "");
15 nibbles
= (3 + ssh1_bignum_bitcount(md
))/4; if (nibbles
<1) nibbles
=1;
16 morenibbles
= 4*md
[0] - nibbles
;
17 for (i
=0; i
<morenibbles
; i
++) putchar('-');
18 for (i
=nibbles
; i
-- ;)
19 putchar(hex
[(bignum_byte(md
, i
/2) >> (4*(i
%2))) & 0xF]);
21 if (prefix
) putchar('\n');
24 int rsa_generate(struct RSAKey
*key
, struct RSAAux
*aux
, int bits
,
25 progfn_t pfn
, void *pfnparam
) {
26 Bignum pm1
, qm1
, phi_n
;
29 * Set up the phase limits for the progress report. We do this
30 * by passing minus the phase number.
32 * For prime generation: our initial filter finds things
33 * coprime to everything below 2^16. Computing the product of
34 * (p-1)/p for all prime p below 2^16 gives about 20.33; so
35 * among B-bit integers, one in every 20.33 will get through
36 * the initial filter to be a candidate prime.
38 * Meanwhile, we are searching for primes in the region of 2^B;
39 * since pi(x) ~ x/log(x), when x is in the region of 2^B, the
40 * prime density will be d/dx pi(x) ~ 1/log(B), i.e. about
41 * 1/0.6931B. So the chance of any given candidate being prime
42 * is 20.33/0.6931B, which is roughly 29.34 divided by B.
44 * So now we have this probability P, we're looking at an
45 * exponential distribution with parameter P: we will manage in
46 * one attempt with probability P, in two with probability
47 * P(1-P), in three with probability P(1-P)^2, etc. The
48 * probability that we have still not managed to find a prime
49 * after N attempts is (1-P)^N.
51 * We therefore inform the progress indicator of the number B
52 * (29.34/B), so that it knows how much to increment by each
53 * time. We do this in 16-bit fixed point, so 29.34 becomes
56 pfn(pfnparam
, -1, -0x1D57C4/(bits
/2));
57 pfn(pfnparam
, -2, -0x1D57C4/(bits
-bits
/2));
61 * We don't generate e; we just use a standard one always.
63 key
->exponent
= bignum_from_short(RSA_EXPONENT
);
64 diagbn("e = ",key
->exponent
);
67 * Generate p and q: primes with combined length `bits', not
68 * congruent to 1 modulo e. (Strictly speaking, we wanted (p-1)
69 * and e to be coprime, and (q-1) and e to be coprime, but in
70 * general that's slightly more fiddly to arrange. By choosing
71 * a prime e, we can simplify the criterion.)
73 aux
->p
= primegen(bits
/2, RSA_EXPONENT
, 1, 1, pfn
, pfnparam
);
74 aux
->q
= primegen(bits
- bits
/2, RSA_EXPONENT
, 1, 2, pfn
, pfnparam
);
77 * Ensure p > q, by swapping them if not.
79 if (bignum_cmp(aux
->p
, aux
->q
) < 0) {
86 * Now we have p, q and e. All we need to do now is work out
87 * the other helpful quantities: n=pq, d=e^-1 mod (p-1)(q-1),
91 key
->modulus
= bigmul(aux
->p
, aux
->q
);
97 phi_n
= bigmul(pm1
, qm1
);
101 diagbn("p = ", aux
->p
);
102 diagbn("q = ", aux
->q
);
103 diagbn("e = ", key
->exponent
);
104 diagbn("n = ", key
->modulus
);
105 diagbn("phi(n) = ", phi_n
);
106 key
->private_exponent
= modinv(key
->exponent
, phi_n
);
108 diagbn("d = ", key
->private_exponent
);
109 aux
->iqmp
= modinv(aux
->q
, aux
->p
);
111 diagbn("iqmp = ", aux
->iqmp
);
114 * Clean up temporary numbers.