2 * Copyright (c) 2006 - 2007, 2010 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 #include <krb5-types.h>
45 #ifdef USE_HCRYPTO_TFM
50 BN2mpz(fp_int
*s
, const BIGNUM
*bn
)
57 len
= BN_num_bytes(bn
);
60 fp_read_unsigned_bin(s
, p
, len
);
65 tfm_rsa_private_calculate(fp_int
* in
, fp_int
* p
, fp_int
* q
,
66 fp_int
* dmp1
, fp_int
* dmq1
, fp_int
* iqmp
,
71 fp_init_multi(&vp
, &vq
, &u
, NULL
);
73 /* vq = c ^ (d mod (q - 1)) mod q */
74 /* vp = c ^ (d mod (p - 1)) mod p */
76 fp_exptmod(&u
, dmp1
, p
, &vp
);
78 fp_exptmod(&u
, dmq1
, q
, &vq
);
80 /* C2 = 1/q mod p (iqmp) */
81 /* u = (vp - vq)C2 mod p. */
88 /* c ^ d mod n = vq + u q */
92 fp_zero_multi(&vp
, &vq
, &u
, NULL
);
102 tfm_rsa_public_encrypt(int flen
, const unsigned char* from
,
103 unsigned char* to
, RSA
* rsa
, int padding
)
105 unsigned char *p
, *p0
;
108 fp_int enc
, dec
, n
, e
;
110 if (padding
!= RSA_PKCS1_PADDING
)
113 size
= RSA_size(rsa
);
115 if (size
< RSA_PKCS1_PADDING_SIZE
|| size
- RSA_PKCS1_PADDING_SIZE
< flen
)
121 p
= p0
= malloc(size
- 1);
123 fp_zero_multi(&e
, &n
, NULL
);
127 padlen
= size
- flen
- 3;
130 if (RAND_bytes(p
, padlen
) != 1) {
131 fp_zero_multi(&e
, &n
, NULL
);
142 memcpy(p
, from
, flen
);
144 assert((p
- p0
) == size
- 1);
146 fp_init_multi(&enc
, &dec
, NULL
);
147 fp_read_unsigned_bin(&dec
, p0
, size
- 1);
150 res
= fp_exptmod(&dec
, &e
, &n
, &enc
);
152 fp_zero_multi(&dec
, &e
, &n
, NULL
);
159 ssize
= fp_unsigned_bin_size(&enc
);
160 assert(size
>= ssize
);
161 fp_to_unsigned_bin(&enc
, to
);
170 tfm_rsa_public_decrypt(int flen
, const unsigned char* from
,
171 unsigned char* to
, RSA
* rsa
, int padding
)
178 if (padding
!= RSA_PKCS1_PADDING
)
181 if (flen
> RSA_size(rsa
))
188 /* Check that the exponent is larger then 3 */
189 if (mp_int_compare_value(&e
, 3) <= 0) {
190 fp_zero_multi(&e
, &n
, NULL
);
195 fp_init_multi(&s
, &us
, NULL
);
196 fp_read_unsigned_bin(&s
, rk_UNCONST(from
), flen
);
198 if (fp_cmp(&s
, &n
) >= 0) {
199 fp_zero_multi(&e
, &n
, NULL
);
203 res
= fp_exptmod(&s
, &e
, &n
, &us
);
205 fp_zero_multi(&s
, &e
, &n
, NULL
);
212 size
= fp_unsigned_bin_size(&us
);
213 assert(size
<= RSA_size(rsa
));
214 fp_to_unsigned_bin(&us
, p
);
218 /* head zero was skipped by fp_to_unsigned_bin */
224 while (size
&& *p
== 0xff) {
227 if (size
== 0 || *p
!= 0)
231 memmove(to
, p
, size
);
237 tfm_rsa_private_encrypt(int flen
, const unsigned char* from
,
238 unsigned char* to
, RSA
* rsa
, int padding
)
240 unsigned char *p
, *p0
;
243 fp_int in
, out
, n
, e
;
245 if (padding
!= RSA_PKCS1_PADDING
)
248 size
= RSA_size(rsa
);
250 if (size
< RSA_PKCS1_PADDING_SIZE
|| size
- RSA_PKCS1_PADDING_SIZE
< flen
)
253 p0
= p
= malloc(size
);
256 memset(p
, 0xff, size
- flen
- 3);
257 p
+= size
- flen
- 3;
259 memcpy(p
, from
, flen
);
261 assert((p
- p0
) == size
);
266 fp_init_multi(&in
, &out
, NULL
);
267 fp_read_unsigned_bin(&in
, p0
, size
);
270 if(fp_isneg(&in
) || fp_cmp(&in
, &n
) >= 0) {
275 if (rsa
->p
&& rsa
->q
&& rsa
->dmp1
&& rsa
->dmq1
&& rsa
->iqmp
) {
276 fp_int p
, q
, dmp1
, dmq1
, iqmp
;
280 BN2mpz(&dmp1
, rsa
->dmp1
);
281 BN2mpz(&dmq1
, rsa
->dmq1
);
282 BN2mpz(&iqmp
, rsa
->iqmp
);
284 res
= tfm_rsa_private_calculate(&in
, &p
, &q
, &dmp1
, &dmq1
, &iqmp
, &out
);
286 fp_zero_multi(&p
, &q
, &dmp1
, &dmq1
, &iqmp
, NULL
);
296 res
= fp_exptmod(&in
, &d
, &n
, &out
);
306 ssize
= fp_unsigned_bin_size(&out
);
307 assert(size
>= ssize
);
308 fp_to_unsigned_bin(&out
, to
);
313 fp_zero_multi(&e
, &n
, &in
, &out
, NULL
);
319 tfm_rsa_private_decrypt(int flen
, const unsigned char* from
,
320 unsigned char* to
, RSA
* rsa
, int padding
)
325 fp_int in
, out
, n
, e
;
327 if (padding
!= RSA_PKCS1_PADDING
)
330 size
= RSA_size(rsa
);
334 fp_init_multi(&in
, &out
, NULL
);
339 fp_read_unsigned_bin(&in
, rk_UNCONST(from
), flen
);
341 if(fp_isneg(&in
) || fp_cmp(&in
, &n
) >= 0) {
346 if (rsa
->p
&& rsa
->q
&& rsa
->dmp1
&& rsa
->dmq1
&& rsa
->iqmp
) {
347 fp_int p
, q
, dmp1
, dmq1
, iqmp
;
351 BN2mpz(&dmp1
, rsa
->dmp1
);
352 BN2mpz(&dmq1
, rsa
->dmq1
);
353 BN2mpz(&iqmp
, rsa
->iqmp
);
355 res
= tfm_rsa_private_calculate(&in
, &p
, &q
, &dmp1
, &dmq1
, &iqmp
, &out
);
357 fp_zero_multi(&p
, &q
, &dmp1
, &dmq1
, &iqmp
, NULL
);
367 if(fp_isneg(&in
) || fp_cmp(&in
, &n
) >= 0)
371 res
= fp_exptmod(&in
, &d
, &n
, &out
);
382 ssize
= fp_unsigned_bin_size(&out
);
383 assert(size
>= ssize
);
384 fp_to_unsigned_bin(&out
, ptr
);
388 /* head zero was skipped by mp_int_to_unsigned */
394 while (size
&& *ptr
!= 0) {
401 memmove(to
, ptr
, size
);
404 fp_zero_multi(&e
, &n
, &in
, &out
, NULL
);
416 size
= fp_unsigned_bin_size(s
);
418 if (p
== NULL
&& size
!= 0)
421 fp_to_unsigned_bin(s
, p
);
423 bn
= BN_bin2bn(p
, size
, NULL
);
429 random_num(fp_int
*num
, size_t len
)
437 if (RAND_bytes(p
, len
) != 1) {
441 fp_read_unsigned_bin(num
, p
, len
);
446 #define CHECK(f, v) if ((f) != (v)) { goto out; }
449 tfm_rsa_generate_key(RSA
*rsa
, int bits
, BIGNUM
*e
, BN_GENCB
*cb
)
451 fp_int el
, p
, q
, n
, d
, dmp1
, dmq1
, iqmp
, t1
, t2
, t3
;
452 int counter
, ret
, bitsp
;
457 bitsp
= (bits
+ 1) / 2;
461 fp_init_multi(&el
, &p
, &q
, &n
, &n
, &d
, &dmp1
, &dmq1
, &iqmp
, &t1
, &t2
, &t3
, NULL
);
465 /* generate p and q so that p != q and bits(pq) ~ bits */
468 BN_GENCB_call(cb
, 2, counter
++);
469 CHECK(random_num(&p
, bitsp
), 0);
470 CHECK(fp_find_prime(&p
), FP_YES
);
472 fp_sub_d(&p
, 1, &t1
);
473 fp_gcd(&t1
, &el
, &t2
);
474 } while(fp_cmp_d(&t2
, 1) != 0);
476 BN_GENCB_call(cb
, 3, 0);
480 BN_GENCB_call(cb
, 2, counter
++);
481 CHECK(random_num(&q
, bits
- bitsp
), 0);
482 CHECK(fp_find_prime(&q
), FP_YES
);
484 if (fp_cmp(&p
, &q
) == 0) /* don't let p and q be the same */
487 fp_sub_d(&q
, 1, &t1
);
488 fp_gcd(&t1
, &el
, &t2
);
489 } while(fp_cmp_d(&t2
, 1) != 0);
492 if (fp_cmp(&p
, &q
) < 0) {
499 BN_GENCB_call(cb
, 3, 1);
501 /* calculate n, n = p * q */
504 /* calculate d, d = 1/e mod (p - 1)(q - 1) */
505 fp_sub_d(&p
, 1, &t1
);
506 fp_sub_d(&q
, 1, &t2
);
507 fp_mul(&t1
, &t2
, &t3
);
508 fp_invmod(&el
, &t3
, &d
);
510 /* calculate dmp1 dmp1 = d mod (p-1) */
511 fp_mod(&d
, &t1
, &dmp1
);
512 /* calculate dmq1 dmq1 = d mod (q-1) */
513 fp_mod(&d
, &t2
, &dmq1
);
514 /* calculate iqmp iqmp = 1/q mod p */
515 fp_invmod(&q
, &p
, &iqmp
);
517 /* fill in RSA key */
519 rsa
->e
= mpz2BN(&el
);
524 rsa
->dmp1
= mpz2BN(&dmp1
);
525 rsa
->dmq1
= mpz2BN(&dmq1
);
526 rsa
->iqmp
= mpz2BN(&iqmp
);
531 fp_zero_multi(&el
, &p
, &q
, &n
, &d
, &dmp1
,
532 &dmq1
, &iqmp
, &t1
, &t2
, &t3
, NULL
);
538 tfm_rsa_init(RSA
*rsa
)
544 tfm_rsa_finish(RSA
*rsa
)
549 const RSA_METHOD hc_rsa_tfm_method
= {
551 tfm_rsa_public_encrypt
,
552 tfm_rsa_public_decrypt
,
553 tfm_rsa_private_encrypt
,
554 tfm_rsa_private_decrypt
,
571 #ifdef USE_HCRYPTO_TFM
572 return &hc_rsa_tfm_method
;