2 * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42 #include <krb5-types.h>
49 #include "imath/imath.h"
50 #include "imath/iprime.h"
53 BN2mpz(mpz_t
*s
, const BIGNUM
*bn
)
60 len
= BN_num_bytes(bn
);
63 mp_int_read_unsigned(s
, p
, len
);
74 size
= mp_int_unsigned_len(s
);
76 if (p
== NULL
&& size
!= 0)
78 mp_int_to_unsigned(s
, p
, size
);
80 bn
= BN_bin2bn(p
, size
, NULL
);
85 static int random_num(mp_int
, size_t);
88 setup_blind(mp_int n
, mp_int b
, mp_int bi
)
92 random_num(b
, mp_int_count_bits(n
));
94 mp_int_invmod(b
, n
, bi
);
98 blind(mp_int in
, mp_int b
, mp_int e
, mp_int n
)
102 /* in' = (in * b^e) mod n */
103 mp_int_exptmod(b
, e
, n
, &t1
);
104 mp_int_mul(&t1
, in
, in
);
105 mp_int_mod(in
, n
, in
);
110 unblind(mp_int out
, mp_int bi
, mp_int n
)
112 /* out' = (out * 1/b) mod n */
113 mp_int_mul(out
, bi
, out
);
114 mp_int_mod(out
, n
, out
);
118 rsa_private_calculate(mp_int in
, mp_int p
, mp_int q
,
119 mp_int dmp1
, mp_int dmq1
, mp_int iqmp
,
123 mp_int_init(&vp
); mp_int_init(&vq
); mp_int_init(&u
);
125 /* vq = c ^ (d mod (q - 1)) mod q */
126 /* vp = c ^ (d mod (p - 1)) mod p */
127 mp_int_mod(in
, p
, &u
);
128 mp_int_exptmod(&u
, dmp1
, p
, &vp
);
129 mp_int_mod(in
, q
, &u
);
130 mp_int_exptmod(&u
, dmq1
, q
, &vq
);
132 /* C2 = 1/q mod p (iqmp) */
133 /* u = (vp - vq)C2 mod p. */
134 mp_int_sub(&vp
, &vq
, &u
);
135 if (mp_int_compare_zero(&u
) < 0)
136 mp_int_add(&u
, p
, &u
);
137 mp_int_mul(&u
, iqmp
, &u
);
138 mp_int_mod(&u
, p
, &u
);
140 /* c ^ d mod n = vq + u q */
141 mp_int_mul(&u
, q
, &u
);
142 mp_int_add(&u
, &vq
, out
);
156 imath_rsa_public_encrypt(int flen
, const unsigned char* from
,
157 unsigned char* to
, RSA
* rsa
, int padding
)
159 unsigned char *p
, *p0
;
162 mpz_t enc
, dec
, n
, e
;
164 if (padding
!= RSA_PKCS1_PADDING
)
167 size
= RSA_size(rsa
);
169 if (size
< RSA_PKCS1_PADDING_SIZE
|| size
- RSA_PKCS1_PADDING_SIZE
< flen
)
175 p
= p0
= malloc(size
- 1);
182 padlen
= size
- flen
- 3;
185 if (RAND_bytes(p
, padlen
) != 1) {
198 memcpy(p
, from
, flen
);
200 assert((p
- p0
) == size
- 1);
204 mp_int_read_unsigned(&dec
, p0
, size
- 1);
207 res
= mp_int_exptmod(&dec
, &e
, &n
, &enc
);
214 ssize
= mp_int_unsigned_len(&enc
);
215 assert(size
>= ssize
);
216 mp_int_to_unsigned(&enc
, to
, ssize
);
225 imath_rsa_public_decrypt(int flen
, const unsigned char* from
,
226 unsigned char* to
, RSA
* rsa
, int padding
)
233 if (padding
!= RSA_PKCS1_PADDING
)
236 if (flen
> RSA_size(rsa
))
243 /* Check that the exponent is larger then 3 */
244 if (mp_int_compare_value(&e
, 3) <= 0) {
253 mp_int_read_unsigned(&s
, rk_UNCONST(from
), flen
);
255 if (mp_int_compare(&s
, &n
) >= 0) {
261 res
= mp_int_exptmod(&s
, &e
, &n
, &us
);
272 size
= mp_int_unsigned_len(&us
);
273 assert(size
<= RSA_size(rsa
));
274 mp_int_to_unsigned(&us
, p
, size
);
278 /* head zero was skipped by mp_int_to_unsigned */
284 while (size
&& *p
== 0xff) {
287 if (size
== 0 || *p
!= 0)
291 memmove(to
, p
, size
);
297 imath_rsa_private_encrypt(int flen
, const unsigned char* from
,
298 unsigned char* to
, RSA
* rsa
, int padding
)
300 unsigned char *p
, *p0
;
303 mpz_t in
, out
, n
, e
, b
, bi
;
304 int blinding
= (rsa
->flags
& RSA_FLAG_NO_BLINDING
) == 0;
306 if (padding
!= RSA_PKCS1_PADDING
)
309 size
= RSA_size(rsa
);
311 if (size
< RSA_PKCS1_PADDING_SIZE
|| size
- RSA_PKCS1_PADDING_SIZE
< flen
)
314 p0
= p
= malloc(size
);
317 memset(p
, 0xff, size
- flen
- 3);
318 p
+= size
- flen
- 3;
320 memcpy(p
, from
, flen
);
322 assert((p
- p0
) == size
);
329 mp_int_read_unsigned(&in
, p0
, size
);
332 if(mp_int_compare_zero(&in
) < 0 ||
333 mp_int_compare(&in
, &n
) >= 0) {
339 setup_blind(&n
, &b
, &bi
);
340 blind(&in
, &b
, &e
, &n
);
343 if (rsa
->p
&& rsa
->q
&& rsa
->dmp1
&& rsa
->dmq1
&& rsa
->iqmp
) {
344 mpz_t p
, q
, dmp1
, dmq1
, iqmp
;
348 BN2mpz(&dmp1
, rsa
->dmp1
);
349 BN2mpz(&dmq1
, rsa
->dmq1
);
350 BN2mpz(&iqmp
, rsa
->iqmp
);
352 res
= rsa_private_calculate(&in
, &p
, &q
, &dmp1
, &dmq1
, &iqmp
, &out
);
363 res
= mp_int_exptmod(&in
, &d
, &n
, &out
);
372 unblind(&out
, &bi
, &n
);
379 ssize
= mp_int_unsigned_len(&out
);
380 assert(size
>= ssize
);
381 mp_int_to_unsigned(&out
, to
, size
);
395 imath_rsa_private_decrypt(int flen
, const unsigned char* from
,
396 unsigned char* to
, RSA
* rsa
, int padding
)
401 mpz_t in
, out
, n
, e
, b
, bi
;
402 int blinding
= (rsa
->flags
& RSA_FLAG_NO_BLINDING
) == 0;
404 if (padding
!= RSA_PKCS1_PADDING
)
407 size
= RSA_size(rsa
);
417 res
= mp_int_read_unsigned(&in
, rk_UNCONST(from
), flen
);
423 if(mp_int_compare_zero(&in
) < 0 ||
424 mp_int_compare(&in
, &n
) >= 0) {
430 setup_blind(&n
, &b
, &bi
);
431 blind(&in
, &b
, &e
, &n
);
434 if (rsa
->p
&& rsa
->q
&& rsa
->dmp1
&& rsa
->dmq1
&& rsa
->iqmp
) {
435 mpz_t p
, q
, dmp1
, dmq1
, iqmp
;
439 BN2mpz(&dmp1
, rsa
->dmp1
);
440 BN2mpz(&dmq1
, rsa
->dmq1
);
441 BN2mpz(&iqmp
, rsa
->iqmp
);
443 res
= rsa_private_calculate(&in
, &p
, &q
, &dmp1
, &dmq1
, &iqmp
, &out
);
453 if(mp_int_compare_zero(&in
) < 0 ||
454 mp_int_compare(&in
, &n
) >= 0)
458 res
= mp_int_exptmod(&in
, &d
, &n
, &out
);
467 unblind(&out
, &bi
, &n
);
475 ssize
= mp_int_unsigned_len(&out
);
476 assert(size
>= ssize
);
477 mp_int_to_unsigned(&out
, ptr
, ssize
);
481 /* head zero was skipped by mp_int_to_unsigned */
485 while (size
&& *ptr
!= 0) {
492 memmove(to
, ptr
, size
);
504 random_num(mp_int num
, size_t len
)
513 if (RAND_bytes(p
, len
) != 1) {
517 res
= mp_int_read_unsigned(num
, p
, len
);
524 #define CHECK(f, v) if ((f) != (v)) { goto out; }
527 imath_rsa_generate_key(RSA
*rsa
, int bits
, BIGNUM
*e
, BN_GENCB
*cb
)
529 mpz_t el
, p
, q
, n
, d
, dmp1
, dmq1
, iqmp
, t1
, t2
, t3
;
551 /* generate p and q so that p != q and bits(pq) ~ bits */
554 BN_GENCB_call(cb
, 2, counter
++);
555 CHECK(random_num(&p
, bits
/ 2 + 1), 0);
556 CHECK(mp_int_find_prime(&p
), MP_TRUE
);
558 CHECK(mp_int_sub_value(&p
, 1, &t1
), MP_OK
);
559 CHECK(mp_int_gcd(&t1
, &el
, &t2
), MP_OK
);
560 } while(mp_int_compare_value(&t2
, 1) != 0);
562 BN_GENCB_call(cb
, 3, 0);
566 BN_GENCB_call(cb
, 2, counter
++);
567 CHECK(random_num(&q
, bits
/ 2 + 1), 0);
568 CHECK(mp_int_find_prime(&q
), MP_TRUE
);
570 if (mp_int_compare(&p
, &q
) == 0) /* don't let p and q be the same */
573 CHECK(mp_int_sub_value(&q
, 1, &t1
), MP_OK
);
574 CHECK(mp_int_gcd(&t1
, &el
, &t2
), MP_OK
);
575 } while(mp_int_compare_value(&t2
, 1) != 0);
578 if (mp_int_compare(&p
, &q
) < 0)
581 BN_GENCB_call(cb
, 3, 1);
583 /* calculate n, n = p * q */
584 CHECK(mp_int_mul(&p
, &q
, &n
), MP_OK
);
586 /* calculate d, d = 1/e mod (p - 1)(q - 1) */
587 CHECK(mp_int_sub_value(&p
, 1, &t1
), MP_OK
);
588 CHECK(mp_int_sub_value(&q
, 1, &t2
), MP_OK
);
589 CHECK(mp_int_mul(&t1
, &t2
, &t3
), MP_OK
);
590 CHECK(mp_int_invmod(&el
, &t3
, &d
), MP_OK
);
592 /* calculate dmp1 dmp1 = d mod (p-1) */
593 CHECK(mp_int_mod(&d
, &t1
, &dmp1
), MP_OK
);
594 /* calculate dmq1 dmq1 = d mod (q-1) */
595 CHECK(mp_int_mod(&d
, &t2
, &dmq1
), MP_OK
);
596 /* calculate iqmp iqmp = 1/q mod p */
597 CHECK(mp_int_invmod(&q
, &p
, &iqmp
), MP_OK
);
599 /* fill in RSA key */
601 rsa
->e
= mpz2BN(&el
);
606 rsa
->dmp1
= mpz2BN(&dmp1
);
607 rsa
->dmq1
= mpz2BN(&dmq1
);
608 rsa
->iqmp
= mpz2BN(&iqmp
);
628 imath_rsa_init(RSA
*rsa
)
634 imath_rsa_finish(RSA
*rsa
)
639 const RSA_METHOD hc_rsa_imath_method
= {
641 imath_rsa_public_encrypt
,
642 imath_rsa_public_decrypt
,
643 imath_rsa_private_encrypt
,
644 imath_rsa_private_decrypt
,
653 imath_rsa_generate_key
657 RSA_imath_method(void)
659 return &hc_rsa_imath_method
;