3 * $Id: rsa-recover.c,v 1.5 2000/10/08 12:11:22 mdw Exp $
5 * Recover RSA parameters
7 * (c) 1999 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
32 * $Log: rsa-recover.c,v $
33 * Revision 1.5 2000/10/08 12:11:22 mdw
34 * Use @MP_EQ@ instead of @MP_CMP@.
36 * Revision 1.4 2000/07/01 11:22:22 mdw
37 * Remove bad type name `rsa_param'.
39 * Revision 1.3 2000/06/22 19:03:14 mdw
40 * Use the new @mp_odd@ function.
42 * Revision 1.2 2000/06/17 12:07:19 mdw
43 * Fix a bug in argument validation. Force %$p > q$% in output. Use
44 * %$\lambda(n) = \lcm(p - 1, q - 1)$% rather than the more traditional
45 * %$\phi(n) = (p - 1)(q - 1)$% when computing the decryption exponent.
47 * Revision 1.1 1999/12/22 15:50:45 mdw
48 * Initial RSA support.
52 /*----- Header files ------------------------------------------------------*/
58 /*----- Main code ---------------------------------------------------------*/
60 /* --- @rsa_recover@ --- *
62 * Arguments: @rsa_priv *rp@ = pointer to parameter block
64 * Returns: Zero if all went well, nonzero if the parameters make no
67 * Use: Derives the full set of RSA parameters given a minimal set.
70 int rsa_recover(rsa_priv
*rp
)
72 /* --- If there is no modulus, calculate it --- */
77 rp
->n
= mp_mul(MP_NEW
, rp
->p
, rp
->q
);
80 /* --- If there are no factors, compute them --- */
82 else if (!rp
->p
|| !rp
->q
) {
84 /* --- If one is missing, use simple division to recover the other --- */
89 mp_div(&rp
->q
, &r
, rp
->n
, rp
->p
);
91 mp_div(&rp
->p
, &r
, rp
->n
, rp
->q
);
92 if (!MP_EQ(r
, MP_ZERO
)) {
99 /* --- Otherwise use the public and private moduli --- */
101 else if (!rp
->e
|| !rp
->d
)
112 /* --- Work out the appropriate exponent --- *
114 * I need to compute %$s$% and %$t$% such that %$2^s t = e d - 1$%, and
118 t
= mp_mul(MP_NEW
, rp
->e
, rp
->d
);
119 t
= mp_sub(t
, t
, MP_ONE
);
120 t
= mp_odd(t
, t
, &s
);
122 /* --- Set up for the exponentiation --- */
124 mpmont_create(&mm
, rp
->n
);
125 m1
= mp_sub(MP_NEW
, rp
->n
, mm
.r
);
127 /* --- Now for the main loop --- *
129 * Choose candidate integers and attempt to factor the modulus.
132 mp_build(&a
, &aw
, &aw
+ 1);
137 /* --- Choose a random %$a$% and calculate %$z = a^t \bmod n$% --- *
139 * If %$z \equiv 1$% or %$z \equiv -1 \pmod n$% then this iteration
144 z
= mpmont_expr(&mm
, z
, &a
, t
);
145 if (MP_EQ(z
, mm
.r
) || MP_EQ(z
, m1
))
148 /* --- Now square until something interesting happens --- *
150 * Compute %$z^{2i} \bmod n$%. Eventually, I'll either get %$-1$% or
151 * %$1$%. If the former, the number is uninteresting, and I need to
152 * restart. If the latter, the previous number minus 1 has a common
157 mp
*zz
= mp_sqr(MP_NEW
, z
);
158 zz
= mpmont_reduce(&mm
, zz
, zz
);
159 if (MP_EQ(zz
, mm
.r
)) {
162 } else if (MP_EQ(zz
, m1
)) {
171 /* --- Do the factoring --- *
173 * Here's how it actually works. I've found an interesting square
174 * root of %$1 \pmod n$%. Any square root of 1 must be congruent to
175 * %$\pm 1$% modulo both %$p$% and %$q$%. Both congruent to %$1$% is
176 * boring, as is both congruent to %$-1$%. Subtracting one from the
177 * result makes it congruent to %$0$% modulo %$p$% or %$q$% (and
178 * nobody cares which), and hence can be extracted by a GCD
183 z
= mpmont_reduce(&mm
, z
, z
);
184 z
= mp_sub(z
, z
, MP_ONE
);
186 mp_gcd(&rp
->p
, 0, 0, rp
->n
, z
);
188 mp_div(&rp
->q
, 0, rp
->n
, rp
->p
);
192 if (MP_CMP(rp
->p
, <, rp
->q
)) {
201 /* --- If %$e$% or %$d$% is missing, recalculate it --- */
203 if (!rp
->e
|| !rp
->d
) {
208 /* --- Compute %$\varphi(n)$% --- */
210 phi
= mp_sub(MP_NEW
, rp
->n
, rp
->p
);
211 phi
= mp_sub(phi
, phi
, rp
->q
);
212 phi
= mp_add(phi
, phi
, MP_ONE
);
213 p1
= mp_sub(MP_NEW
, rp
->p
, MP_ONE
);
214 q1
= mp_sub(MP_NEW
, rp
->q
, MP_ONE
);
215 mp_gcd(&g
, 0, 0, p1
, q1
);
216 mp_div(&phi
, 0, phi
, g
);
220 /* --- Recover the other exponent --- */
223 mp_gcd(&g
, 0, &rp
->d
, phi
, rp
->e
);
225 mp_gcd(&g
, 0, &rp
->e
, phi
, rp
->d
);
233 if (!MP_EQ(g
, MP_ONE
)) {
240 /* --- Compute %$q^{-1} \bmod p$% --- */
243 mp_gcd(0, 0, &rp
->q_inv
, rp
->p
, rp
->q
);
245 /* --- Compute %$d \bmod (p - 1)$% and %$d \bmod (q - 1)$% --- */
248 mp
*p1
= mp_sub(MP_NEW
, rp
->p
, MP_ONE
);
249 mp_div(0, &rp
->dp
, rp
->d
, p1
);
253 mp
*q1
= mp_sub(MP_NEW
, rp
->q
, MP_ONE
);
254 mp_div(0, &rp
->dq
, rp
->d
, q1
);
263 /*----- That's all, folks -------------------------------------------------*/