From 796d609550df3a33fc11468741c5d2f6d3df4c11 Mon Sep 17 00:00:00 2001 From: beck <> Date: Sun, 19 Mar 2000 11:13:58 +0000 Subject: OpenSSL 0.9.5 merge *warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2 if you are using the ssl26 packages for ssh and other things to work you will need to get new ones (see ~beck/libsslsnap/) on cvs or ~beck/src-patent.tar.gz on cvs --- src/lib/libcrypto/dsa/dsa_gen.c | 171 ++++++++++++++++------------------------ 1 file changed, 66 insertions(+), 105 deletions(-) (limited to 'src/lib/libcrypto/dsa/dsa_gen.c') diff --git a/src/lib/libcrypto/dsa/dsa_gen.c b/src/lib/libcrypto/dsa/dsa_gen.c index b5e5ec06e5..2294a362d9 100644 --- a/src/lib/libcrypto/dsa/dsa_gen.c +++ b/src/lib/libcrypto/dsa/dsa_gen.c @@ -59,12 +59,18 @@ #undef GENUINE_DSA #ifdef GENUINE_DSA +/* Parameter generation follows the original release of FIPS PUB 186, + * Appendix 2.2 (i.e. use SHA as defined in FIPS PUB 180) */ #define HASH SHA #else +/* Parameter generation follows the updated Appendix 2.2 for FIPS PUB 186, + * also Appendix 2.2 of FIPS PUB 186-1 (i.e. use SHA as defined in + * FIPS PUB 180-1) */ #define HASH SHA1 #endif #ifndef NO_SHA + #include #include #include "cryptlib.h" @@ -74,8 +80,9 @@ #include DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len, - int *counter_ret, unsigned long *h_ret, void (*callback)(), - char *cb_arg) + int *counter_ret, unsigned long *h_ret, + void (*callback)(int, int, void *), + void *cb_arg) { int ok=0; unsigned char seed[SHA_DIGEST_LENGTH]; @@ -86,47 +93,63 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len, BN_MONT_CTX *mont=NULL; int k,n=0,i,b,m=0; int counter=0; - BN_CTX *ctx=NULL,*ctx2=NULL; + int r=0; + BN_CTX *ctx=NULL,*ctx2=NULL,*ctx3=NULL; unsigned int h=2; DSA *ret=NULL; if (bits < 512) bits=512; bits=(bits+63)/64*64; + if (seed_len < 20) + seed_in = NULL; /* seed buffer too small -- ignore */ + if (seed_len > 20) + seed_len = 20; /* App. 2.2 of FIPS PUB 186 allows larger SEED, + * but our internal buffers are restricted to 160 bits*/ if ((seed_in != NULL) && (seed_len == 20)) memcpy(seed,seed_in,seed_len); if ((ctx=BN_CTX_new()) == NULL) goto err; if ((ctx2=BN_CTX_new()) == NULL) goto err; + if ((ctx3=BN_CTX_new()) == NULL) goto err; if ((ret=DSA_new()) == NULL) goto err; if ((mont=BN_MONT_CTX_new()) == NULL) goto err; - r0= &(ctx2->bn[0]); - g= &(ctx2->bn[1]); - W= &(ctx2->bn[2]); - q= &(ctx2->bn[3]); - X= &(ctx2->bn[4]); - c= &(ctx2->bn[5]); - p= &(ctx2->bn[6]); - test= &(ctx2->bn[7]); + BN_CTX_start(ctx2); + r0 = BN_CTX_get(ctx2); + g = BN_CTX_get(ctx2); + W = BN_CTX_get(ctx2); + q = BN_CTX_get(ctx2); + X = BN_CTX_get(ctx2); + c = BN_CTX_get(ctx2); + p = BN_CTX_get(ctx2); + test = BN_CTX_get(ctx2); BN_lshift(test,BN_value_one(),bits-1); for (;;) { - for (;;) + for (;;) /* find q */ { + int seed_is_random; + /* step 1 */ if (callback != NULL) callback(0,m++,cb_arg); if (!seed_len) - RAND_bytes(seed,SHA_DIGEST_LENGTH); + { + RAND_pseudo_bytes(seed,SHA_DIGEST_LENGTH); + seed_is_random = 1; + } else - seed_len=0; - + { + seed_is_random = 0; + seed_len=0; /* use random seed if 'seed_in' turns out to be bad*/ + } memcpy(buf,seed,SHA_DIGEST_LENGTH); memcpy(buf2,seed,SHA_DIGEST_LENGTH); + /* precompute "SEED + 1" for step 7: */ for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--) { buf[i]++; @@ -142,10 +165,15 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len, /* step 3 */ md[0]|=0x80; md[SHA_DIGEST_LENGTH-1]|=0x01; - if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) abort(); + if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) goto err; /* step 4 */ - if (DSA_is_prime(q,callback,cb_arg) > 0) break; + r = BN_is_prime_fasttest(q, DSS_prime_checks, callback, ctx3, cb_arg, seed_is_random); + if (r > 0) + break; + if (r != 0) + goto err; + /* do a callback call */ /* step 5 */ } @@ -155,16 +183,22 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len, /* step 6 */ counter=0; + /* "offset = 2" */ n=(bits-1)/160; b=(bits-1)-n*160; for (;;) { + if (callback != NULL && counter != 0) + callback(0,counter,cb_arg); + /* step 7 */ BN_zero(W); + /* now 'buf' contains "SEED + offset - 1" */ for (k=0; k<=n; k++) { + /* obtain "SEED + offset + k" by incrementing: */ for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--) { buf[i]++; @@ -174,7 +208,8 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len, HASH(buf,SHA_DIGEST_LENGTH,md); /* step 8 */ - if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0)) abort(); + if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0)) + goto err; BN_lshift(r0,r0,160*k); BN_add(W,W,r0); } @@ -194,23 +229,25 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len, if (BN_cmp(p,test) >= 0) { /* step 11 */ - if (DSA_is_prime(p,callback,cb_arg) > 0) - goto end; + r = BN_is_prime_fasttest(p, DSS_prime_checks, callback, ctx3, cb_arg, 1); + if (r > 0) + goto end; /* found it */ + if (r != 0) + goto err; } /* step 13 */ counter++; + /* "offset = offset + n + 1" */ /* step 14 */ if (counter >= 4096) break; - - if (callback != NULL) callback(0,counter,cb_arg); } } end: if (callback != NULL) callback(2,1,cb_arg); - /* We now need to gernerate g */ + /* We now need to generate g */ /* Set r0=(p-1)/q */ BN_sub(test,p,BN_value_one()); BN_div(r0,NULL,test,q,ctx); @@ -245,89 +282,13 @@ err: if (h_ret != NULL) *h_ret=h; } if (ctx != NULL) BN_CTX_free(ctx); - if (ctx != NULL) BN_CTX_free(ctx2); - if (mont != NULL) BN_MONT_CTX_free(mont); - return(ok?ret:NULL); - } - -int DSA_is_prime(BIGNUM *w, void (*callback)(), char *cb_arg) - { - int ok= -1,j,i,n; - BN_CTX *ctx=NULL,*ctx2=NULL; - BIGNUM *w_1,*b,*m,*z,*tmp,*mont_1; - int a; - BN_MONT_CTX *mont=NULL; - - if (!BN_is_bit_set(w,0)) return(0); - - if ((ctx=BN_CTX_new()) == NULL) goto err; - if ((ctx2=BN_CTX_new()) == NULL) goto err; - if ((mont=BN_MONT_CTX_new()) == NULL) goto err; - - m= &(ctx2->bn[2]); - b= &(ctx2->bn[3]); - z= &(ctx2->bn[4]); - w_1= &(ctx2->bn[5]); - tmp= &(ctx2->bn[6]); - mont_1= &(ctx2->bn[7]); - - /* step 1 */ - n=50; - - /* step 2 */ - if (!BN_sub(w_1,w,BN_value_one())) goto err; - for (a=1; !BN_is_bit_set(w_1,a); a++) - ; - if (!BN_rshift(m,w_1,a)) goto err; - - BN_MONT_CTX_set(mont,w,ctx); - BN_to_montgomery(mont_1,BN_value_one(),mont,ctx); - BN_to_montgomery(w_1,w_1,mont,ctx); - for (i=1; i < n; i++) + if (ctx2 != NULL) { - /* step 3 */ - BN_rand(b,BN_num_bits(w)-2/*-1*/,0,0); - /* BN_set_word(b,0x10001L); */ - - /* step 4 */ - j=0; - if (!BN_mod_exp_mont(z,b,m,w,ctx,mont)) goto err; - - if (!BN_to_montgomery(z,z,mont,ctx)) goto err; - - /* step 5 */ - for (;;) - { - if (((j == 0) && (BN_cmp(z,mont_1) == 0)) || - (BN_cmp(z,w_1) == 0)) - break; - - /* step 6 */ - if ((j > 0) && (BN_cmp(z,mont_1) == 0)) - { - ok=0; - goto err; - } - - j++; - if (j >= a) - { - ok=0; - goto err; - } - - if (!BN_mod_mul_montgomery(z,z,z,mont,ctx)) goto err; - if (callback != NULL) callback(1,j,cb_arg); - } + BN_CTX_end(ctx2); + BN_CTX_free(ctx2); } - - ok=1; -err: - if (ok == -1) DSAerr(DSA_F_DSA_IS_PRIME,ERR_R_BN_LIB); - BN_CTX_free(ctx); - BN_CTX_free(ctx2); - BN_MONT_CTX_free(mont); - - return(ok); + if (ctx3 != NULL) BN_CTX_free(ctx3); + if (mont != NULL) BN_MONT_CTX_free(mont); + return(ok?ret:NULL); } #endif -- cgit v1.2.3-55-g6feb