diff options
author | tb <> | 2022-07-29 08:32:20 +0000 |
---|---|---|
committer | tb <> | 2022-07-29 08:32:20 +0000 |
commit | f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b (patch) | |
tree | 43b1789f10c3f3491b753658e449230746b5a057 /src | |
parent | d67fc64fc55ee8aa419a5e587c2e3da51c225384 (diff) | |
download | openbsd-f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b.tar.gz openbsd-f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b.tar.bz2 openbsd-f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b.zip |
Tweak some comments and whitespace around comments
Diffstat (limited to 'src')
-rw-r--r-- | src/lib/libcrypto/bn/bn_bpsw.c | 41 |
1 files changed, 32 insertions, 9 deletions
diff --git a/src/lib/libcrypto/bn/bn_bpsw.c b/src/lib/libcrypto/bn/bn_bpsw.c index ca63410373..ef3b829cad 100644 --- a/src/lib/libcrypto/bn/bn_bpsw.c +++ b/src/lib/libcrypto/bn/bn_bpsw.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: bn_bpsw.c,v 1.3 2022/07/15 06:19:27 tb Exp $ */ | 1 | /* $OpenBSD: bn_bpsw.c,v 1.4 2022/07/29 08:32:20 tb Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2022 Martin Grenouilloux <martin.grenouilloux@lse.epita.fr> | 3 | * Copyright (c) 2022 Martin Grenouilloux <martin.grenouilloux@lse.epita.fr> |
4 | * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> | 4 | * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> |
@@ -25,6 +25,7 @@ | |||
25 | * For an odd n compute a / 2 (mod n). If a is even, we can do a plain | 25 | * For an odd n compute a / 2 (mod n). If a is even, we can do a plain |
26 | * division, otherwise calculate (a + n) / 2. Then reduce (mod n). | 26 | * division, otherwise calculate (a + n) / 2. Then reduce (mod n). |
27 | */ | 27 | */ |
28 | |||
28 | static int | 29 | static int |
29 | bn_div_by_two_mod_odd_n(BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) | 30 | bn_div_by_two_mod_odd_n(BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) |
30 | { | 31 | { |
@@ -57,6 +58,7 @@ bn_div_by_two_mod_odd_n(BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) | |||
57 | * | 58 | * |
58 | * Compare with FIPS 186-4, Appendix C.3.3, step 6. | 59 | * Compare with FIPS 186-4, Appendix C.3.3, step 6. |
59 | */ | 60 | */ |
61 | |||
60 | static int | 62 | static int |
61 | bn_lucas_step(BIGNUM *U, BIGNUM *V, int digit, const BIGNUM *D, | 63 | bn_lucas_step(BIGNUM *U, BIGNUM *V, int digit, const BIGNUM *D, |
62 | const BIGNUM *n, BN_CTX *ctx) | 64 | const BIGNUM *n, BN_CTX *ctx) |
@@ -116,6 +118,7 @@ bn_lucas_step(BIGNUM *U, BIGNUM *V, int digit, const BIGNUM *D, | |||
116 | /* | 118 | /* |
117 | * Compute the Lucas terms U_k, V_k, see FIPS 186-4, Appendix C.3.3, steps 4-6. | 119 | * Compute the Lucas terms U_k, V_k, see FIPS 186-4, Appendix C.3.3, steps 4-6. |
118 | */ | 120 | */ |
121 | |||
119 | static int | 122 | static int |
120 | bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, | 123 | bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, |
121 | const BIGNUM *n, BN_CTX *ctx) | 124 | const BIGNUM *n, BN_CTX *ctx) |
@@ -132,6 +135,7 @@ bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, | |||
132 | * Iterate over the digits of k from MSB to LSB. Start at digit 2 | 135 | * Iterate over the digits of k from MSB to LSB. Start at digit 2 |
133 | * since the first digit is dealt with by setting U = 1 and V = 1. | 136 | * since the first digit is dealt with by setting U = 1 and V = 1. |
134 | */ | 137 | */ |
138 | |||
135 | for (i = BN_num_bits(k) - 2; i >= 0; i--) { | 139 | for (i = BN_num_bits(k) - 2; i >= 0; i--) { |
136 | digit = BN_is_bit_set(k, i); | 140 | digit = BN_is_bit_set(k, i); |
137 | 141 | ||
@@ -150,6 +154,7 @@ bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, | |||
150 | * Every strong Lucas pseudoprime n is also a Lucas pseudoprime since | 154 | * Every strong Lucas pseudoprime n is also a Lucas pseudoprime since |
151 | * U_{n+1} == 0 follows from U_k == 0 or V_{k * 2^r} == 0 for 0 <= r < s. | 155 | * U_{n+1} == 0 follows from U_k == 0 or V_{k * 2^r} == 0 for 0 <= r < s. |
152 | */ | 156 | */ |
157 | |||
153 | static int | 158 | static int |
154 | bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | 159 | bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, |
155 | BN_CTX *ctx) | 160 | BN_CTX *ctx) |
@@ -171,6 +176,7 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
171 | * Factorize n + 1 = k * 2^s with odd k: shift away the s trailing ones | 176 | * Factorize n + 1 = k * 2^s with odd k: shift away the s trailing ones |
172 | * of n and set the lowest bit of the resulting number k. | 177 | * of n and set the lowest bit of the resulting number k. |
173 | */ | 178 | */ |
179 | |||
174 | s = 0; | 180 | s = 0; |
175 | while (BN_is_bit_set(n, s)) | 181 | while (BN_is_bit_set(n, s)) |
176 | s++; | 182 | s++; |
@@ -183,6 +189,7 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
183 | * Calculate the Lucas terms U_k and V_k. If either of them is zero, | 189 | * Calculate the Lucas terms U_k and V_k. If either of them is zero, |
184 | * then n is a strong Lucas pseudoprime. | 190 | * then n is a strong Lucas pseudoprime. |
185 | */ | 191 | */ |
192 | |||
186 | if (!bn_lucas(U, V, k, D, n, ctx)) | 193 | if (!bn_lucas(U, V, k, D, n, ctx)) |
187 | goto err; | 194 | goto err; |
188 | 195 | ||
@@ -195,6 +202,7 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
195 | * Calculate the Lucas terms U_{k * 2^r}, V_{k * 2^r} for 1 <= r < s. | 202 | * Calculate the Lucas terms U_{k * 2^r}, V_{k * 2^r} for 1 <= r < s. |
196 | * If any V_{k * 2^r} is zero then n is a strong Lucas pseudoprime. | 203 | * If any V_{k * 2^r} is zero then n is a strong Lucas pseudoprime. |
197 | */ | 204 | */ |
205 | |||
198 | for (r = 1; r < s; r++) { | 206 | for (r = 1; r < s; r++) { |
199 | if (!bn_lucas_step(U, V, 0, D, n, ctx)) | 207 | if (!bn_lucas_step(U, V, 0, D, n, ctx)) |
200 | goto err; | 208 | goto err; |
@@ -205,7 +213,10 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
205 | } | 213 | } |
206 | } | 214 | } |
207 | 215 | ||
208 | /* If we got here, n is definitely composite. */ | 216 | /* |
217 | * If we got here, n is definitely composite. | ||
218 | */ | ||
219 | |||
209 | *is_prime = 0; | 220 | *is_prime = 0; |
210 | 221 | ||
211 | done: | 222 | done: |
@@ -218,10 +229,11 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
218 | } | 229 | } |
219 | 230 | ||
220 | /* | 231 | /* |
221 | * Test n for primality using the strong Lucas test with Selfridge's | 232 | * Test n for primality using the strong Lucas test with Selfridge's Method A. |
222 | * parameters. Returns 1 if n is prime or a strong Lucas-Selfridge | 233 | * Returns 1 if n is prime or a strong Lucas-Selfridge pseudoprime. |
223 | * pseudoprime. Returns 0 if n is definitely composite. | 234 | * If it returns 0 then n is definitely composite. |
224 | */ | 235 | */ |
236 | |||
225 | static int | 237 | static int |
226 | bn_strong_lucas_selfridge(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | 238 | bn_strong_lucas_selfridge(int *is_prime, const BIGNUM *n, BN_CTX *ctx) |
227 | { | 239 | { |
@@ -243,6 +255,7 @@ bn_strong_lucas_selfridge(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
243 | * Find the first D in the Selfridge sequence 5, -7, 9, -11, 13, ... | 255 | * Find the first D in the Selfridge sequence 5, -7, 9, -11, 13, ... |
244 | * such that the Jacobi symbol (D/n) is -1. | 256 | * such that the Jacobi symbol (D/n) is -1. |
245 | */ | 257 | */ |
258 | |||
246 | if ((D = BN_CTX_get(ctx)) == NULL) | 259 | if ((D = BN_CTX_get(ctx)) == NULL) |
247 | goto err; | 260 | goto err; |
248 | if ((two = BN_CTX_get(ctx)) == NULL) | 261 | if ((two = BN_CTX_get(ctx)) == NULL) |
@@ -319,14 +332,20 @@ bn_miller_rabin_base_2(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
319 | if (!BN_sub(n_minus_one, n, BN_value_one())) | 332 | if (!BN_sub(n_minus_one, n, BN_value_one())) |
320 | goto err; | 333 | goto err; |
321 | 334 | ||
322 | /* Factorize n - 1 = k * 2^s. */ | 335 | /* |
336 | * Factorize n - 1 = k * 2^s. | ||
337 | */ | ||
338 | |||
323 | s = 0; | 339 | s = 0; |
324 | while (!BN_is_bit_set(n_minus_one, s)) | 340 | while (!BN_is_bit_set(n_minus_one, s)) |
325 | s++; | 341 | s++; |
326 | if (!BN_rshift(k, n_minus_one, s)) | 342 | if (!BN_rshift(k, n_minus_one, s)) |
327 | goto err; | 343 | goto err; |
328 | 344 | ||
329 | /* If 2^k is 1 or -1 (mod n) then n is a 2-pseudoprime. */ | 345 | /* |
346 | * If 2^k is 1 or -1 (mod n) then n is a 2-pseudoprime. | ||
347 | */ | ||
348 | |||
330 | if (!BN_set_word(x, 2)) | 349 | if (!BN_set_word(x, 2)) |
331 | goto err; | 350 | goto err; |
332 | if (!BN_mod_exp_ct(x, x, k, n, ctx)) | 351 | if (!BN_mod_exp_ct(x, x, k, n, ctx)) |
@@ -341,6 +360,7 @@ bn_miller_rabin_base_2(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
341 | * If 2^{2^i k} == -1 (mod n) for some 1 <= i < s, then n is a | 360 | * If 2^{2^i k} == -1 (mod n) for some 1 <= i < s, then n is a |
342 | * 2-pseudoprime | 361 | * 2-pseudoprime |
343 | */ | 362 | */ |
363 | |||
344 | for (i = 1; i < s; i++) { | 364 | for (i = 1; i < s; i++) { |
345 | if (!BN_mod_sqr(x, x, n, ctx)) | 365 | if (!BN_mod_sqr(x, x, n, ctx)) |
346 | goto err; | 366 | goto err; |
@@ -350,7 +370,10 @@ bn_miller_rabin_base_2(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
350 | } | 370 | } |
351 | } | 371 | } |
352 | 372 | ||
353 | /* If we got here, n is definitely composite. */ | 373 | /* |
374 | * If we got here, n is definitely composite. | ||
375 | */ | ||
376 | |||
354 | *is_prime = 0; | 377 | *is_prime = 0; |
355 | 378 | ||
356 | done: | 379 | done: |
@@ -405,7 +428,7 @@ bn_is_prime_bpsw(int *is_prime, const BIGNUM *n, BN_CTX *in_ctx) | |||
405 | if (!*is_prime) | 428 | if (!*is_prime) |
406 | goto done; | 429 | goto done; |
407 | 430 | ||
408 | /* XXX - Miller-Rabin for random bases? - see FIPS 186-4, Table C.1. */ | 431 | /* XXX - Miller-Rabin for random bases? See FIPS 186-4, Table C.1. */ |
409 | 432 | ||
410 | if (!bn_strong_lucas_selfridge(is_prime, n, ctx)) | 433 | if (!bn_strong_lucas_selfridge(is_prime, n, ctx)) |
411 | goto err; | 434 | goto err; |