summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/rsa/rsa_gen.c
diff options
context:
space:
mode:
authormiod <>2014-07-09 08:20:08 +0000
committermiod <>2014-07-09 08:20:08 +0000
commit8cbe58f0d357b14b0ce292d336469d0554a567bc (patch)
tree07872a7ef59da8cea3b3b4a101fa3580e4d658c0 /src/lib/libcrypto/rsa/rsa_gen.c
parentbc1209e388500a20f5e75cab35d1b543ce0bbe74 (diff)
downloadopenbsd-8cbe58f0d357b14b0ce292d336469d0554a567bc.tar.gz
openbsd-8cbe58f0d357b14b0ce292d336469d0554a567bc.tar.bz2
openbsd-8cbe58f0d357b14b0ce292d336469d0554a567bc.zip
KNF
Diffstat (limited to 'src/lib/libcrypto/rsa/rsa_gen.c')
-rw-r--r--src/lib/libcrypto/rsa/rsa_gen.c204
1 files changed, 111 insertions, 93 deletions
diff --git a/src/lib/libcrypto/rsa/rsa_gen.c b/src/lib/libcrypto/rsa/rsa_gen.c
index 9745b6d6ed..3a6aa1ca7a 100644
--- a/src/lib/libcrypto/rsa/rsa_gen.c
+++ b/src/lib/libcrypto/rsa/rsa_gen.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: rsa_gen.c,v 1.13 2014/06/12 15:49:30 deraadt Exp $ */ 1/* $OpenBSD: rsa_gen.c,v 1.14 2014/07/09 08:20:08 miod Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -70,150 +70,168 @@
70 70
71static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb); 71static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb);
72 72
73/* NB: this wrapper would normally be placed in rsa_lib.c and the static 73/*
74 * NB: this wrapper would normally be placed in rsa_lib.c and the static
74 * implementation would probably be in rsa_eay.c. Nonetheless, is kept here so 75 * implementation would probably be in rsa_eay.c. Nonetheless, is kept here so
75 * that we don't introduce a new linker dependency. Eg. any application that 76 * that we don't introduce a new linker dependency. Eg. any application that
76 * wasn't previously linking object code related to key-generation won't have to 77 * wasn't previously linking object code related to key-generation won't have to
77 * now just because key-generation is part of RSA_METHOD. */ 78 * now just because key-generation is part of RSA_METHOD.
78int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) 79 */
79 { 80int
80 if(rsa->meth->rsa_keygen) 81RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
82{
83 if (rsa->meth->rsa_keygen)
81 return rsa->meth->rsa_keygen(rsa, bits, e_value, cb); 84 return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
82 return rsa_builtin_keygen(rsa, bits, e_value, cb); 85 return rsa_builtin_keygen(rsa, bits, e_value, cb);
83 } 86}
84 87
85static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) 88static int
86 { 89rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
87 BIGNUM *r0=NULL,*r1=NULL,*r2=NULL,*r3=NULL,*tmp; 90{
88 BIGNUM local_r0,local_d,local_p; 91 BIGNUM *r0 = NULL, *r1 = NULL, *r2 = NULL, *r3 = NULL, *tmp;
89 BIGNUM *pr0,*d,*p; 92 BIGNUM local_r0, local_d, local_p;
90 int bitsp,bitsq,ok= -1,n=0; 93 BIGNUM *pr0, *d, *p;
91 BN_CTX *ctx=NULL; 94 int bitsp, bitsq, ok = -1, n = 0;
92 95 BN_CTX *ctx = NULL;
93 ctx=BN_CTX_new(); 96
94 if (ctx == NULL) goto err; 97 ctx = BN_CTX_new();
98 if (ctx == NULL)
99 goto err;
95 BN_CTX_start(ctx); 100 BN_CTX_start(ctx);
96 r0 = BN_CTX_get(ctx); 101 r0 = BN_CTX_get(ctx);
97 r1 = BN_CTX_get(ctx); 102 r1 = BN_CTX_get(ctx);
98 r2 = BN_CTX_get(ctx); 103 r2 = BN_CTX_get(ctx);
99 r3 = BN_CTX_get(ctx); 104 r3 = BN_CTX_get(ctx);
100 if (r3 == NULL) goto err; 105 if (r3 == NULL)
106 goto err;
101 107
102 bitsp=(bits+1)/2; 108 bitsp = (bits + 1) / 2;
103 bitsq=bits-bitsp; 109 bitsq = bits - bitsp;
104 110
105 /* We need the RSA components non-NULL */ 111 /* We need the RSA components non-NULL */
106 if(!rsa->n && ((rsa->n=BN_new()) == NULL)) goto err; 112 if (!rsa->n && ((rsa->n = BN_new()) == NULL))
107 if(!rsa->d && ((rsa->d=BN_new()) == NULL)) goto err; 113 goto err;
108 if(!rsa->e && ((rsa->e=BN_new()) == NULL)) goto err; 114 if (!rsa->d && ((rsa->d = BN_new()) == NULL))
109 if(!rsa->p && ((rsa->p=BN_new()) == NULL)) goto err; 115 goto err;
110 if(!rsa->q && ((rsa->q=BN_new()) == NULL)) goto err; 116 if (!rsa->e && ((rsa->e = BN_new()) == NULL))
111 if(!rsa->dmp1 && ((rsa->dmp1=BN_new()) == NULL)) goto err; 117 goto err;
112 if(!rsa->dmq1 && ((rsa->dmq1=BN_new()) == NULL)) goto err; 118 if (!rsa->p && ((rsa->p = BN_new()) == NULL))
113 if(!rsa->iqmp && ((rsa->iqmp=BN_new()) == NULL)) goto err; 119 goto err;
120 if (!rsa->q && ((rsa->q = BN_new()) == NULL))
121 goto err;
122 if (!rsa->dmp1 && ((rsa->dmp1 = BN_new()) == NULL))
123 goto err;
124 if (!rsa->dmq1 && ((rsa->dmq1 = BN_new()) == NULL))
125 goto err;
126 if (!rsa->iqmp && ((rsa->iqmp = BN_new()) == NULL))
127 goto err;
114 128
115 BN_copy(rsa->e, e_value); 129 BN_copy(rsa->e, e_value);
116 130
117 /* generate p and q */ 131 /* generate p and q */
118 for (;;) 132 for (;;) {
119 { 133 if (!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL, NULL, cb))
120 if(!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL, NULL, cb))
121 goto err; 134 goto err;
122 if (!BN_sub(r2,rsa->p,BN_value_one())) goto err; 135 if (!BN_sub(r2, rsa->p, BN_value_one()))
123 if (!BN_gcd(r1,r2,rsa->e,ctx)) goto err;
124 if (BN_is_one(r1)) break;
125 if(!BN_GENCB_call(cb, 2, n++))
126 goto err; 136 goto err;
127 } 137 if (!BN_gcd(r1, r2, rsa->e, ctx))
128 if(!BN_GENCB_call(cb, 3, 0)) 138 goto err;
139 if (BN_is_one(r1))
140 break;
141 if (!BN_GENCB_call(cb, 2, n++))
142 goto err;
143 }
144 if (!BN_GENCB_call(cb, 3, 0))
129 goto err; 145 goto err;
130 for (;;) 146 for (;;) {
131 { 147 /*
132 /* When generating ridiculously small keys, we can get stuck 148 * When generating ridiculously small keys, we can get stuck
133 * continually regenerating the same prime values. Check for 149 * continually regenerating the same prime values. Check for
134 * this and bail if it happens 3 times. */ 150 * this and bail if it happens 3 times.
151 */
135 unsigned int degenerate = 0; 152 unsigned int degenerate = 0;
136 do 153 do {
137 { 154 if (!BN_generate_prime_ex(rsa->q, bitsq, 0, NULL, NULL,
138 if(!BN_generate_prime_ex(rsa->q, bitsq, 0, NULL, NULL, cb)) 155 cb))
139 goto err; 156 goto err;
140 } while((BN_cmp(rsa->p, rsa->q) == 0) && (++degenerate < 3)); 157 } while (BN_cmp(rsa->p, rsa->q) == 0 &&
141 if(degenerate == 3) 158 ++degenerate < 3);
142 { 159 if (degenerate == 3) {
143 ok = 0; /* we set our own err */ 160 ok = 0; /* we set our own err */
144 RSAerr(RSA_F_RSA_BUILTIN_KEYGEN,RSA_R_KEY_SIZE_TOO_SMALL); 161 RSAerr(RSA_F_RSA_BUILTIN_KEYGEN,
162 RSA_R_KEY_SIZE_TOO_SMALL);
163 goto err;
164 }
165 if (!BN_sub(r2, rsa->q, BN_value_one()))
166 goto err;
167 if (!BN_gcd(r1, r2, rsa->e, ctx))
145 goto err; 168 goto err;
146 }
147 if (!BN_sub(r2,rsa->q,BN_value_one())) goto err;
148 if (!BN_gcd(r1,r2,rsa->e,ctx)) goto err;
149 if (BN_is_one(r1)) 169 if (BN_is_one(r1))
150 break; 170 break;
151 if(!BN_GENCB_call(cb, 2, n++)) 171 if (!BN_GENCB_call(cb, 2, n++))
152 goto err; 172 goto err;
153 } 173 }
154 if(!BN_GENCB_call(cb, 3, 1)) 174 if (!BN_GENCB_call(cb, 3, 1))
155 goto err; 175 goto err;
156 if (BN_cmp(rsa->p,rsa->q) < 0) 176 if (BN_cmp(rsa->p,rsa->q) < 0) {
157 { 177 tmp = rsa->p;
158 tmp=rsa->p; 178 rsa->p = rsa->q;
159 rsa->p=rsa->q; 179 rsa->q = tmp;
160 rsa->q=tmp; 180 }
161 }
162 181
163 /* calculate n */ 182 /* calculate n */
164 if (!BN_mul(rsa->n,rsa->p,rsa->q,ctx)) goto err; 183 if (!BN_mul(rsa->n, rsa->p, rsa->q, ctx))
184 goto err;
165 185
166 /* calculate d */ 186 /* calculate d */
167 if (!BN_sub(r1,rsa->p,BN_value_one())) goto err; /* p-1 */ 187 if (!BN_sub(r1, rsa->p, BN_value_one())) /* p-1 */
168 if (!BN_sub(r2,rsa->q,BN_value_one())) goto err; /* q-1 */ 188 goto err;
169 if (!BN_mul(r0,r1,r2,ctx)) goto err; /* (p-1)(q-1) */ 189 if (!BN_sub(r2, rsa->q, BN_value_one())) /* q-1 */
170 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 190 goto err;
171 { 191 if (!BN_mul(r0, r1, r2, ctx)) /* (p-1)(q-1) */
192 goto err;
193 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
172 pr0 = &local_r0; 194 pr0 = &local_r0;
173 BN_with_flags(pr0, r0, BN_FLG_CONSTTIME); 195 BN_with_flags(pr0, r0, BN_FLG_CONSTTIME);
174 } 196 } else
175 else 197 pr0 = r0;
176 pr0 = r0; 198 if (!BN_mod_inverse(rsa->d, rsa->e, pr0, ctx)) /* d */
177 if (!BN_mod_inverse(rsa->d,rsa->e,pr0,ctx)) goto err; /* d */ 199 goto err;
178 200
179 /* set up d for correct BN_FLG_CONSTTIME flag */ 201 /* set up d for correct BN_FLG_CONSTTIME flag */
180 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 202 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
181 {
182 d = &local_d; 203 d = &local_d;
183 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME); 204 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
184 } 205 } else
185 else
186 d = rsa->d; 206 d = rsa->d;
187 207
188 /* calculate d mod (p-1) */ 208 /* calculate d mod (p-1) */
189 if (!BN_mod(rsa->dmp1,d,r1,ctx)) goto err; 209 if (!BN_mod(rsa->dmp1, d, r1, ctx))
210 goto err;
190 211
191 /* calculate d mod (q-1) */ 212 /* calculate d mod (q-1) */
192 if (!BN_mod(rsa->dmq1,d,r2,ctx)) goto err; 213 if (!BN_mod(rsa->dmq1, d, r2, ctx))
214 goto err;
193 215
194 /* calculate inverse of q mod p */ 216 /* calculate inverse of q mod p */
195 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 217 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
196 {
197 p = &local_p; 218 p = &local_p;
198 BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME); 219 BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
199 } 220 } else
200 else
201 p = rsa->p; 221 p = rsa->p;
202 if (!BN_mod_inverse(rsa->iqmp,rsa->q,p,ctx)) goto err; 222 if (!BN_mod_inverse(rsa->iqmp, rsa->q, p, ctx))
223 goto err;
203 224
204 ok=1; 225 ok = 1;
205err: 226err:
206 if (ok == -1) 227 if (ok == -1) {
207 { 228 RSAerr(RSA_F_RSA_BUILTIN_KEYGEN, ERR_LIB_BN);
208 RSAerr(RSA_F_RSA_BUILTIN_KEYGEN,ERR_LIB_BN); 229 ok = 0;
209 ok=0; 230 }
210 } 231 if (ctx != NULL) {
211 if (ctx != NULL)
212 {
213 BN_CTX_end(ctx); 232 BN_CTX_end(ctx);
214 BN_CTX_free(ctx); 233 BN_CTX_free(ctx);
215 }
216
217 return ok;
218 } 234 }
219 235
236 return ok;
237}