pub/rsa-gen.c: Don't leak `t'.

[catacomb] / pub / rsa-gen.c

/* -*-c-*-
 *
 * RSA parameter generation
 *
 * (c) 1999 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 *
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#include <mLib/dstr.h>

#include "grand.h"
#include "mp.h"
#include "mpint.h"
#include "pgen.h"
#include "rsa.h"
#include "strongprime.h"

/*----- Main code ---------------------------------------------------------*/

/* --- @rsa_gen@ --- *
 *
 * Arguments:	@rsa_priv *rp@ = pointer to block to be filled in
 *		@unsigned nbits@ = required modulus size in bits
 *		@grand *r@ = random number source
 *		@unsigned n@ = number of attempts to make
 *		@pgen_proc *event@ = event handler function
 *		@void *ectx@ = argument for the event handler
 *
 * Returns:	Zero if all went well, nonzero otherwise.
 *
 * Use:		Constructs a pair of strong RSA primes and other useful RSA
 *		parameters.  A small encryption exponent is chosen if
 *		possible.
 */

int rsa_gen(rsa_priv *rp, unsigned nbits, grand *r, unsigned n,
	    pgen_proc *event, void *ectx)
{
  pgen_gcdstepctx g;
  mp *phi = MP_NEW;

  /* --- Bits of initialization --- */

  rp->e = mp_fromulong(MP_NEW, 0x10001);
  rp->d = MP_NEW;

  /* --- Generate strong primes %$p$% and %$q$% --- *
   *
   * Constrain the GCD of @q@ to ensure that overly small private exponents
   * are impossible.  Current results suggest that if %$d < n^{0.29}$% then
   * it can be guessed fairly easily.  This implementation is rather more
   * conservative about that sort of thing.
   */

again:
  if ((rp->p = strongprime("p", MP_NEWSEC, nbits/2, r, n, event, ectx)) == 0)
    goto fail_p;

  /* --- Do painful fiddling with GCD steppers --- *
   *
   * Also, arrange that %$q \ge \lceil 2^{N-1}/p \rceil$%, so that %$p q$%
   * has the right length.
   */

  {
    mp *q;
    mp *t = MP_NEW, *u = MP_NEW;
    rabin rb;

    if ((q = strongprime_setup("q", MP_NEWSEC, &g.jp, nbits / 2,
			       r, n, event, ectx)) == 0)
      goto fail_q;
    t = mp_lsl(t, MP_ONE, nbits - 1);
    mp_div(&t, &u, t, rp->p);
    if (!MP_ZEROP(u)) t = mp_add(t, t, MP_ONE);
    if (MP_CMP(q, <, t)) q = mp_leastcongruent(q, t, q, g.jp.m);
    mp_drop(t);

    g.r = mp_lsr(MP_NEW, rp->p, 1);
    g.g = MP_NEW;
    g.max = MP_256;
    q = pgen("q", q, q, event, ectx, n, pgen_gcdstep, &g,
	     rabin_iters(nbits/2), pgen_test, &rb);
    pfilt_destroy(&g.jp);
    mp_drop(g.r);
    if (!q) {
      mp_drop(g.g);
      if (n)
	goto fail_q;
      mp_drop(rp->p);
      goto again;
    }
    rp->q = q;
  }

  /* --- Ensure that %$p > q$% --- *
   *
   * Also ensure that %$p$% and %$q$% are sufficiently different to deter
   * square-root-based factoring methods.
   */

  phi = mp_sub(phi, rp->p, rp->q);
  if (MP_LEN(phi) * 4 < MP_LEN(rp->p) * 3 ||
      MP_LEN(phi) * 4 < MP_LEN(rp->q) * 3) {
    mp_drop(rp->p);
    mp_drop(g.g);
    if (n)
      goto fail_q;
    mp_drop(rp->q);
    goto again;
  }

  if (MP_NEGP(phi)) {
    mp *z = rp->p;
    rp->p = rp->q;
    rp->q = z;
  }

  /* --- Work out the modulus and the CRT coefficient --- */

  rp->n = mp_mul(MP_NEW, rp->p, rp->q);
  rp->q_inv = mp_modinv(MP_NEW, rp->q, rp->p);

  /* --- Work out %$\varphi(n) = (p - 1)(q - 1)$% --- *
   *
   * Save on further multiplications by noting that %$n = pq$% is known and
   * that %$(p - 1)(q - 1) = pq - p - q + 1$%.  To minimize the size of @d@
   * (useful for performance reasons, although not very because an overly
   * small @d@ will be rejected for security reasons) this is then divided by
   * %$\gcd(p - 1, q - 1)$%.
   */

  phi = mp_sub(phi, rp->n, rp->p);
  phi = mp_sub(phi, phi, rp->q);
  phi = mp_add(phi, phi, MP_ONE);
  phi = mp_lsr(phi, phi, 1);
  mp_div(&phi, 0, phi, g.g);

  /* --- Decide on a public exponent --- *
   *
   * Simultaneously compute the private exponent.
   */

  mp_gcd(&g.g, 0, &rp->d, phi, rp->e);
  if (!MP_EQ(g.g, MP_ONE) && MP_LEN(rp->d) * 4 > MP_LEN(rp->n) * 3)
    goto fail_e;

  /* --- Work out exponent residues --- */

  rp->dp = MP_NEW; phi = mp_sub(phi, rp->p, MP_ONE);
  mp_div(0, &rp->dp, rp->d, phi);

  rp->dq = MP_NEW; phi = mp_sub(phi, rp->q, MP_ONE);
  mp_div(0, &rp->dq, rp->d, phi);

  /* --- Done --- */

  mp_drop(phi);
  mp_drop(g.g);
  return (0);

  /* --- Tidy up when something goes wrong --- */

fail_e:
  mp_drop(g.g);
  mp_drop(phi);
  mp_drop(rp->n);
  mp_drop(rp->q_inv);
  mp_drop(rp->q);
fail_q:
  mp_drop(rp->p);
fail_p:
  mp_drop(rp->e);
  if (rp->d)
    mp_drop(rp->d);
  return (-1);
}

/*----- That's all, folks -------------------------------------------------*/