diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/libcrypto/bn/bn_prime.c | 137 |
1 files changed, 1 insertions, 136 deletions
diff --git a/src/lib/libcrypto/bn/bn_prime.c b/src/lib/libcrypto/bn/bn_prime.c index e9a7335861..ea0733b674 100644 --- a/src/lib/libcrypto/bn/bn_prime.c +++ b/src/lib/libcrypto/bn/bn_prime.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: bn_prime.c,v 1.22 2022/07/19 16:19:19 tb Exp $ */ | 1 | /* $OpenBSD: bn_prime.c,v 1.23 2022/11/09 02:01:13 tb Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -129,8 +129,6 @@ | |||
| 129 | */ | 129 | */ |
| 130 | #include "bn_prime.h" | 130 | #include "bn_prime.h" |
| 131 | 131 | ||
| 132 | static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1, | ||
| 133 | const BIGNUM *a1_odd, int k, BN_CTX *ctx, BN_MONT_CTX *mont); | ||
| 134 | static int probable_prime(BIGNUM *rnd, int bits); | 132 | static int probable_prime(BIGNUM *rnd, int bits); |
| 135 | static int probable_prime_dh(BIGNUM *rnd, int bits, | 133 | static int probable_prime_dh(BIGNUM *rnd, int bits, |
| 136 | const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx); | 134 | const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx); |
| @@ -263,14 +261,6 @@ int | |||
| 263 | BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed, | 261 | BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed, |
| 264 | int do_trial_division, BN_GENCB *cb) | 262 | int do_trial_division, BN_GENCB *cb) |
| 265 | { | 263 | { |
| 266 | BN_CTX *ctx = NULL; | ||
| 267 | BIGNUM *A1, *A1_odd, *check; /* taken from ctx */ | ||
| 268 | BN_MONT_CTX *mont = NULL; | ||
| 269 | const BIGNUM *A = NULL; | ||
| 270 | int i, j, k; | ||
| 271 | int ret = -1; | ||
| 272 | |||
| 273 | #ifdef LIBRESSL_HAS_BPSW | ||
| 274 | int is_prime; | 264 | int is_prime; |
| 275 | 265 | ||
| 276 | /* XXX - tickle BN_GENCB in bn_is_prime_bpsw(). */ | 266 | /* XXX - tickle BN_GENCB in bn_is_prime_bpsw(). */ |
| @@ -278,131 +268,6 @@ BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed, | |||
| 278 | return -1; | 268 | return -1; |
| 279 | 269 | ||
| 280 | return is_prime; | 270 | return is_prime; |
| 281 | #endif | ||
| 282 | |||
| 283 | if (BN_cmp(a, BN_value_one()) <= 0) | ||
| 284 | return 0; | ||
| 285 | |||
| 286 | if (checks == BN_prime_checks) | ||
| 287 | checks = BN_prime_checks_for_size(BN_num_bits(a)); | ||
| 288 | |||
| 289 | /* first look for small factors */ | ||
| 290 | if (!BN_is_odd(a)) | ||
| 291 | /* a is even => a is prime if and only if a == 2 */ | ||
| 292 | return BN_is_word(a, 2); | ||
| 293 | if (do_trial_division) { | ||
| 294 | for (i = 1; i < NUMPRIMES; i++) { | ||
| 295 | BN_ULONG mod = BN_mod_word(a, primes[i]); | ||
| 296 | if (mod == (BN_ULONG)-1) | ||
| 297 | goto err; | ||
| 298 | if (mod == 0) | ||
| 299 | return BN_is_word(a, primes[i]); | ||
| 300 | } | ||
| 301 | if (!BN_GENCB_call(cb, 1, -1)) | ||
| 302 | goto err; | ||
| 303 | } | ||
| 304 | |||
| 305 | if (ctx_passed != NULL) | ||
| 306 | ctx = ctx_passed; | ||
| 307 | else if ((ctx = BN_CTX_new()) == NULL) | ||
| 308 | goto err; | ||
| 309 | BN_CTX_start(ctx); | ||
| 310 | |||
| 311 | /* A := abs(a) */ | ||
| 312 | if (a->neg) { | ||
| 313 | BIGNUM *t; | ||
| 314 | if ((t = BN_CTX_get(ctx)) == NULL) | ||
| 315 | goto err; | ||
| 316 | BN_copy(t, a); | ||
| 317 | t->neg = 0; | ||
| 318 | A = t; | ||
| 319 | } else | ||
| 320 | A = a; | ||
| 321 | if ((A1 = BN_CTX_get(ctx)) == NULL) | ||
| 322 | goto err; | ||
| 323 | if ((A1_odd = BN_CTX_get(ctx)) == NULL) | ||
| 324 | goto err; | ||
| 325 | if ((check = BN_CTX_get(ctx)) == NULL) | ||
| 326 | goto err; | ||
| 327 | |||
| 328 | /* compute A1 := A - 1 */ | ||
| 329 | if (!BN_copy(A1, A)) | ||
| 330 | goto err; | ||
| 331 | if (!BN_sub_word(A1, 1)) | ||
| 332 | goto err; | ||
| 333 | if (BN_is_zero(A1)) { | ||
| 334 | ret = 0; | ||
| 335 | goto err; | ||
| 336 | } | ||
| 337 | |||
| 338 | /* write A1 as A1_odd * 2^k */ | ||
| 339 | k = 1; | ||
| 340 | while (!BN_is_bit_set(A1, k)) | ||
| 341 | k++; | ||
| 342 | if (!BN_rshift(A1_odd, A1, k)) | ||
| 343 | goto err; | ||
| 344 | |||
| 345 | /* Montgomery setup for computations mod A */ | ||
| 346 | mont = BN_MONT_CTX_new(); | ||
| 347 | if (mont == NULL) | ||
| 348 | goto err; | ||
| 349 | if (!BN_MONT_CTX_set(mont, A, ctx)) | ||
| 350 | goto err; | ||
| 351 | |||
| 352 | for (i = 0; i < checks; i++) { | ||
| 353 | if (!BN_pseudo_rand_range(check, A1)) | ||
| 354 | goto err; | ||
| 355 | if (!BN_add_word(check, 1)) | ||
| 356 | goto err; | ||
| 357 | /* now 1 <= check < A */ | ||
| 358 | |||
| 359 | j = witness(check, A, A1, A1_odd, k, ctx, mont); | ||
| 360 | if (j == -1) | ||
| 361 | goto err; | ||
| 362 | if (j) { | ||
| 363 | ret = 0; | ||
| 364 | goto err; | ||
| 365 | } | ||
| 366 | if (!BN_GENCB_call(cb, 1, i)) | ||
| 367 | goto err; | ||
| 368 | } | ||
| 369 | ret = 1; | ||
| 370 | |||
| 371 | err: | ||
| 372 | if (ctx != NULL) { | ||
| 373 | BN_CTX_end(ctx); | ||
| 374 | if (ctx_passed == NULL) | ||
| 375 | BN_CTX_free(ctx); | ||
| 376 | } | ||
| 377 | BN_MONT_CTX_free(mont); | ||
| 378 | |||
| 379 | return (ret); | ||
| 380 | } | ||
| 381 | |||
| 382 | static int | ||
| 383 | witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1, const BIGNUM *a1_odd, | ||
| 384 | int k, BN_CTX *ctx, BN_MONT_CTX *mont) | ||
| 385 | { | ||
| 386 | if (!BN_mod_exp_mont_ct(w, w, a1_odd, a, ctx, mont)) | ||
| 387 | /* w := w^a1_odd mod a */ | ||
| 388 | return -1; | ||
| 389 | if (BN_is_one(w)) | ||
| 390 | return 0; /* probably prime */ | ||
| 391 | if (BN_cmp(w, a1) == 0) | ||
| 392 | return 0; /* w == -1 (mod a), 'a' is probably prime */ | ||
| 393 | while (--k) { | ||
| 394 | if (!BN_mod_mul(w, w, w, a, ctx)) /* w := w^2 mod a */ | ||
| 395 | return -1; | ||
| 396 | if (BN_is_one(w)) | ||
| 397 | return 1; /* 'a' is composite, otherwise a previous 'w' would | ||
| 398 | * have been == -1 (mod 'a') */ | ||
| 399 | if (BN_cmp(w, a1) == 0) | ||
| 400 | return 0; /* w == -1 (mod a), 'a' is probably prime */ | ||
| 401 | } | ||
| 402 | /* If we get here, 'w' is the (a-1)/2-th power of the original 'w', | ||
| 403 | * and it is neither -1 nor +1 -- so 'a' cannot be prime */ | ||
| 404 | bn_check_top(w); | ||
| 405 | return 1; | ||
| 406 | } | 271 | } |
| 407 | 272 | ||
| 408 | static int | 273 | static int |
