openbsd/src/lib/libcrypto/bn/bn_prime.c, branch OPENBSD_7_9

bn_prime.c: fix includes

2025-11-08T16:27:33+00:00

Use BN_ULONG in probable_prime_dh()

2025-11-06T09:04:14+00:00

This was the last user of BN_LONG in code. It had no reason to do so. BN_mod_word() returns a BN_ULONG and since the largest prime in the small primes table primes[] is well below 20000, the only return value that could cause 'mod' to be negative was the error sentinel (BN_ULONG)-1. ok jsing kenjiro

Use err_local.h rather than err.h in most places

2025-05-10T05:54:39+00:00

ok jsing

Cap the size of numbers we check for primality

2023-07-20T06:26:27+00:00

We refuse to generate RSA keys larger than 16k and DH keys larger than 10k. Primality checking with adversarial input is a DoS vector, so simply don't do this. Introduce a cap of 32k for numbers we try to test for primality, which should be more than large enough for use withing a non-toolkit crypto library. This is one way of mitigating the DH_check()/EVP_PKEY_param_check() issue. ok jsing miod

Hide symbols in bn

2023-07-08T12:21:58+00:00

ok tb@

Add Miller-Rabin test for random bases to BPSW

2023-05-10T12:21:55+00:00

The behavior of the BPSW primality test for numbers > 2^64 is not very well understood. While there is no known composite that passes the test, there are heuristics that indicate that there are likely infinitely many. Therefore it seems appropriate to harden the test. Having a settable number of MR rounds before doing a version of BPSW is also the approach taken by Go's primality check in math/big. This adds a new implementation of the old MR test that runs before running the strong Lucas test. I like to imagine that it's slightly cleaner code. We're effectively at about twice the cost of what we had a year ago. In addition, it adds some non-determinism in case there actually are false positives for the BPSW test. The implementation is straightforward. It could easily be tweaked to use the additional gcds in the "enhanced" MR test of FIPS 186-5, but as long as we are only going to throw away the additional info, that's not worth much. This is a first step towards incorporating some of the considerations in "A performant misuse-resistant API for Primality Testing" by Massimo and Paterson. Further work will happen in tree. In particular, there are plans to crank the number of Miller-Rabin tests considerably so as to have a guaranteed baseline. The manual will be updated shortly. positive feedback beck ok jsing

Remove the deprecated API from BN

2023-04-25T19:57:59+00:00

Remove comment referencing bn_depr.c.

2023-01-28T17:13:26+00:00

Move the three functions that are in bn_depr.c back to bn_prime.c.

2023-01-28T17:09:00+00:00

They should go away, but they have not yet disappeared and this consolidates the source files. Discussed with tb@

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook