diff options
| author | tb <> | 2022-07-29 08:32:20 +0000 |
|---|---|---|
| committer | tb <> | 2022-07-29 08:32:20 +0000 |
| commit | f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b (patch) | |
| tree | 43b1789f10c3f3491b753658e449230746b5a057 /src | |
| parent | d67fc64fc55ee8aa419a5e587c2e3da51c225384 (diff) | |
| download | openbsd-f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b.tar.gz openbsd-f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b.tar.bz2 openbsd-f77e3e4e56676ad31b3ba549cf5f382c7d01ce2b.zip | |
Tweak some comments and whitespace around comments
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/libcrypto/bn/bn_bpsw.c | 41 |
1 files changed, 32 insertions, 9 deletions
diff --git a/src/lib/libcrypto/bn/bn_bpsw.c b/src/lib/libcrypto/bn/bn_bpsw.c index ca63410373..ef3b829cad 100644 --- a/src/lib/libcrypto/bn/bn_bpsw.c +++ b/src/lib/libcrypto/bn/bn_bpsw.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: bn_bpsw.c,v 1.3 2022/07/15 06:19:27 tb Exp $ */ | 1 | /* $OpenBSD: bn_bpsw.c,v 1.4 2022/07/29 08:32:20 tb Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2022 Martin Grenouilloux <martin.grenouilloux@lse.epita.fr> | 3 | * Copyright (c) 2022 Martin Grenouilloux <martin.grenouilloux@lse.epita.fr> |
| 4 | * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> | 4 | * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> |
| @@ -25,6 +25,7 @@ | |||
| 25 | * For an odd n compute a / 2 (mod n). If a is even, we can do a plain | 25 | * For an odd n compute a / 2 (mod n). If a is even, we can do a plain |
| 26 | * division, otherwise calculate (a + n) / 2. Then reduce (mod n). | 26 | * division, otherwise calculate (a + n) / 2. Then reduce (mod n). |
| 27 | */ | 27 | */ |
| 28 | |||
| 28 | static int | 29 | static int |
| 29 | bn_div_by_two_mod_odd_n(BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) | 30 | bn_div_by_two_mod_odd_n(BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) |
| 30 | { | 31 | { |
| @@ -57,6 +58,7 @@ bn_div_by_two_mod_odd_n(BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) | |||
| 57 | * | 58 | * |
| 58 | * Compare with FIPS 186-4, Appendix C.3.3, step 6. | 59 | * Compare with FIPS 186-4, Appendix C.3.3, step 6. |
| 59 | */ | 60 | */ |
| 61 | |||
| 60 | static int | 62 | static int |
| 61 | bn_lucas_step(BIGNUM *U, BIGNUM *V, int digit, const BIGNUM *D, | 63 | bn_lucas_step(BIGNUM *U, BIGNUM *V, int digit, const BIGNUM *D, |
| 62 | const BIGNUM *n, BN_CTX *ctx) | 64 | const BIGNUM *n, BN_CTX *ctx) |
| @@ -116,6 +118,7 @@ bn_lucas_step(BIGNUM *U, BIGNUM *V, int digit, const BIGNUM *D, | |||
| 116 | /* | 118 | /* |
| 117 | * Compute the Lucas terms U_k, V_k, see FIPS 186-4, Appendix C.3.3, steps 4-6. | 119 | * Compute the Lucas terms U_k, V_k, see FIPS 186-4, Appendix C.3.3, steps 4-6. |
| 118 | */ | 120 | */ |
| 121 | |||
| 119 | static int | 122 | static int |
| 120 | bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, | 123 | bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, |
| 121 | const BIGNUM *n, BN_CTX *ctx) | 124 | const BIGNUM *n, BN_CTX *ctx) |
| @@ -132,6 +135,7 @@ bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, | |||
| 132 | * Iterate over the digits of k from MSB to LSB. Start at digit 2 | 135 | * Iterate over the digits of k from MSB to LSB. Start at digit 2 |
| 133 | * since the first digit is dealt with by setting U = 1 and V = 1. | 136 | * since the first digit is dealt with by setting U = 1 and V = 1. |
| 134 | */ | 137 | */ |
| 138 | |||
| 135 | for (i = BN_num_bits(k) - 2; i >= 0; i--) { | 139 | for (i = BN_num_bits(k) - 2; i >= 0; i--) { |
| 136 | digit = BN_is_bit_set(k, i); | 140 | digit = BN_is_bit_set(k, i); |
| 137 | 141 | ||
| @@ -150,6 +154,7 @@ bn_lucas(BIGNUM *U, BIGNUM *V, const BIGNUM *k, const BIGNUM *D, | |||
| 150 | * Every strong Lucas pseudoprime n is also a Lucas pseudoprime since | 154 | * Every strong Lucas pseudoprime n is also a Lucas pseudoprime since |
| 151 | * U_{n+1} == 0 follows from U_k == 0 or V_{k * 2^r} == 0 for 0 <= r < s. | 155 | * U_{n+1} == 0 follows from U_k == 0 or V_{k * 2^r} == 0 for 0 <= r < s. |
| 152 | */ | 156 | */ |
| 157 | |||
| 153 | static int | 158 | static int |
| 154 | bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | 159 | bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, |
| 155 | BN_CTX *ctx) | 160 | BN_CTX *ctx) |
| @@ -171,6 +176,7 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
| 171 | * Factorize n + 1 = k * 2^s with odd k: shift away the s trailing ones | 176 | * Factorize n + 1 = k * 2^s with odd k: shift away the s trailing ones |
| 172 | * of n and set the lowest bit of the resulting number k. | 177 | * of n and set the lowest bit of the resulting number k. |
| 173 | */ | 178 | */ |
| 179 | |||
| 174 | s = 0; | 180 | s = 0; |
| 175 | while (BN_is_bit_set(n, s)) | 181 | while (BN_is_bit_set(n, s)) |
| 176 | s++; | 182 | s++; |
| @@ -183,6 +189,7 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
| 183 | * Calculate the Lucas terms U_k and V_k. If either of them is zero, | 189 | * Calculate the Lucas terms U_k and V_k. If either of them is zero, |
| 184 | * then n is a strong Lucas pseudoprime. | 190 | * then n is a strong Lucas pseudoprime. |
| 185 | */ | 191 | */ |
| 192 | |||
| 186 | if (!bn_lucas(U, V, k, D, n, ctx)) | 193 | if (!bn_lucas(U, V, k, D, n, ctx)) |
| 187 | goto err; | 194 | goto err; |
| 188 | 195 | ||
| @@ -195,6 +202,7 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
| 195 | * Calculate the Lucas terms U_{k * 2^r}, V_{k * 2^r} for 1 <= r < s. | 202 | * Calculate the Lucas terms U_{k * 2^r}, V_{k * 2^r} for 1 <= r < s. |
| 196 | * If any V_{k * 2^r} is zero then n is a strong Lucas pseudoprime. | 203 | * If any V_{k * 2^r} is zero then n is a strong Lucas pseudoprime. |
| 197 | */ | 204 | */ |
| 205 | |||
| 198 | for (r = 1; r < s; r++) { | 206 | for (r = 1; r < s; r++) { |
| 199 | if (!bn_lucas_step(U, V, 0, D, n, ctx)) | 207 | if (!bn_lucas_step(U, V, 0, D, n, ctx)) |
| 200 | goto err; | 208 | goto err; |
| @@ -205,7 +213,10 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
| 205 | } | 213 | } |
| 206 | } | 214 | } |
| 207 | 215 | ||
| 208 | /* If we got here, n is definitely composite. */ | 216 | /* |
| 217 | * If we got here, n is definitely composite. | ||
| 218 | */ | ||
| 219 | |||
| 209 | *is_prime = 0; | 220 | *is_prime = 0; |
| 210 | 221 | ||
| 211 | done: | 222 | done: |
| @@ -218,10 +229,11 @@ bn_strong_lucas_test(int *is_prime, const BIGNUM *n, const BIGNUM *D, | |||
| 218 | } | 229 | } |
| 219 | 230 | ||
| 220 | /* | 231 | /* |
| 221 | * Test n for primality using the strong Lucas test with Selfridge's | 232 | * Test n for primality using the strong Lucas test with Selfridge's Method A. |
| 222 | * parameters. Returns 1 if n is prime or a strong Lucas-Selfridge | 233 | * Returns 1 if n is prime or a strong Lucas-Selfridge pseudoprime. |
| 223 | * pseudoprime. Returns 0 if n is definitely composite. | 234 | * If it returns 0 then n is definitely composite. |
| 224 | */ | 235 | */ |
| 236 | |||
| 225 | static int | 237 | static int |
| 226 | bn_strong_lucas_selfridge(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | 238 | bn_strong_lucas_selfridge(int *is_prime, const BIGNUM *n, BN_CTX *ctx) |
| 227 | { | 239 | { |
| @@ -243,6 +255,7 @@ bn_strong_lucas_selfridge(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
| 243 | * Find the first D in the Selfridge sequence 5, -7, 9, -11, 13, ... | 255 | * Find the first D in the Selfridge sequence 5, -7, 9, -11, 13, ... |
| 244 | * such that the Jacobi symbol (D/n) is -1. | 256 | * such that the Jacobi symbol (D/n) is -1. |
| 245 | */ | 257 | */ |
| 258 | |||
| 246 | if ((D = BN_CTX_get(ctx)) == NULL) | 259 | if ((D = BN_CTX_get(ctx)) == NULL) |
| 247 | goto err; | 260 | goto err; |
| 248 | if ((two = BN_CTX_get(ctx)) == NULL) | 261 | if ((two = BN_CTX_get(ctx)) == NULL) |
| @@ -319,14 +332,20 @@ bn_miller_rabin_base_2(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
| 319 | if (!BN_sub(n_minus_one, n, BN_value_one())) | 332 | if (!BN_sub(n_minus_one, n, BN_value_one())) |
| 320 | goto err; | 333 | goto err; |
| 321 | 334 | ||
| 322 | /* Factorize n - 1 = k * 2^s. */ | 335 | /* |
| 336 | * Factorize n - 1 = k * 2^s. | ||
| 337 | */ | ||
| 338 | |||
| 323 | s = 0; | 339 | s = 0; |
| 324 | while (!BN_is_bit_set(n_minus_one, s)) | 340 | while (!BN_is_bit_set(n_minus_one, s)) |
| 325 | s++; | 341 | s++; |
| 326 | if (!BN_rshift(k, n_minus_one, s)) | 342 | if (!BN_rshift(k, n_minus_one, s)) |
| 327 | goto err; | 343 | goto err; |
| 328 | 344 | ||
| 329 | /* If 2^k is 1 or -1 (mod n) then n is a 2-pseudoprime. */ | 345 | /* |
| 346 | * If 2^k is 1 or -1 (mod n) then n is a 2-pseudoprime. | ||
| 347 | */ | ||
| 348 | |||
| 330 | if (!BN_set_word(x, 2)) | 349 | if (!BN_set_word(x, 2)) |
| 331 | goto err; | 350 | goto err; |
| 332 | if (!BN_mod_exp_ct(x, x, k, n, ctx)) | 351 | if (!BN_mod_exp_ct(x, x, k, n, ctx)) |
| @@ -341,6 +360,7 @@ bn_miller_rabin_base_2(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
| 341 | * If 2^{2^i k} == -1 (mod n) for some 1 <= i < s, then n is a | 360 | * If 2^{2^i k} == -1 (mod n) for some 1 <= i < s, then n is a |
| 342 | * 2-pseudoprime | 361 | * 2-pseudoprime |
| 343 | */ | 362 | */ |
| 363 | |||
| 344 | for (i = 1; i < s; i++) { | 364 | for (i = 1; i < s; i++) { |
| 345 | if (!BN_mod_sqr(x, x, n, ctx)) | 365 | if (!BN_mod_sqr(x, x, n, ctx)) |
| 346 | goto err; | 366 | goto err; |
| @@ -350,7 +370,10 @@ bn_miller_rabin_base_2(int *is_prime, const BIGNUM *n, BN_CTX *ctx) | |||
| 350 | } | 370 | } |
| 351 | } | 371 | } |
| 352 | 372 | ||
| 353 | /* If we got here, n is definitely composite. */ | 373 | /* |
| 374 | * If we got here, n is definitely composite. | ||
| 375 | */ | ||
| 376 | |||
| 354 | *is_prime = 0; | 377 | *is_prime = 0; |
| 355 | 378 | ||
| 356 | done: | 379 | done: |
| @@ -405,7 +428,7 @@ bn_is_prime_bpsw(int *is_prime, const BIGNUM *n, BN_CTX *in_ctx) | |||
| 405 | if (!*is_prime) | 428 | if (!*is_prime) |
| 406 | goto done; | 429 | goto done; |
| 407 | 430 | ||
| 408 | /* XXX - Miller-Rabin for random bases? - see FIPS 186-4, Table C.1. */ | 431 | /* XXX - Miller-Rabin for random bases? See FIPS 186-4, Table C.1. */ |
| 409 | 432 | ||
| 410 | if (!bn_strong_lucas_selfridge(is_prime, n, ctx)) | 433 | if (!bn_strong_lucas_selfridge(is_prime, n, ctx)) |
| 411 | goto err; | 434 | goto err; |
