3 * $Id: rsa-recover.c,v 1.4 2000/07/01 11:22:22 mdw Exp $
5 * Recover RSA parameters
7 * (c) 1999 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
32 * $Log: rsa-recover.c,v $
33 * Revision 1.4 2000/07/01 11:22:22 mdw
34 * Remove bad type name `rsa_param'.
36 * Revision 1.3 2000/06/22 19:03:14 mdw
37 * Use the new @mp_odd@ function.
39 * Revision 1.2 2000/06/17 12:07:19 mdw
40 * Fix a bug in argument validation. Force %$p > q$% in output. Use
41 * %$\lambda(n) = \lcm(p - 1, q - 1)$% rather than the more traditional
42 * %$\phi(n) = (p - 1)(q - 1)$% when computing the decryption exponent.
44 * Revision 1.1 1999/12/22 15:50:45 mdw
45 * Initial RSA support.
49 /*----- Header files ------------------------------------------------------*/
55 /*----- Main code ---------------------------------------------------------*/
57 /* --- @rsa_recover@ --- *
59 * Arguments: @rsa_priv *rp@ = pointer to parameter block
61 * Returns: Zero if all went well, nonzero if the parameters make no
64 * Use: Derives the full set of RSA parameters given a minimal set.
67 int rsa_recover(rsa_priv *rp)
69 /* --- If there is no modulus, calculate it --- */
74 rp->n = mp_mul(MP_NEW, rp->p, rp->q);
77 /* --- If there are no factors, compute them --- */
79 else if (!rp->p || !rp->q) {
81 /* --- If one is missing, use simple division to recover the other --- */
86 mp_div(&rp->q, &r, rp->n, rp->p);
88 mp_div(&rp->p, &r, rp->n, rp->q);
89 if (MP_CMP(r, !=, MP_ZERO)) {
96 /* --- Otherwise use the public and private moduli --- */
98 else if (!rp->e || !rp->d)
109 /* --- Work out the appropriate exponent --- *
111 * I need to compute %$s$% and %$t$% such that %$2^s t = e d - 1$%, and
115 t = mp_mul(MP_NEW, rp->e, rp->d);
116 t = mp_sub(t, t, MP_ONE);
117 t = mp_odd(t, t, &s);
119 /* --- Set up for the exponentiation --- */
121 mpmont_create(&mm, rp->n);
122 m1 = mp_sub(MP_NEW, rp->n, mm.r);
124 /* --- Now for the main loop --- *
126 * Choose candidate integers and attempt to factor the modulus.
129 mp_build(&a, &aw, &aw + 1);
134 /* --- Choose a random %$a$% and calculate %$z = a^t \bmod n$% --- *
136 * If %$z \equiv 1$% or %$z \equiv -1 \pmod n$% then this iteration
141 z = mpmont_expr(&mm, z, &a, t);
142 if (MP_CMP(z, ==, mm.r) || MP_CMP(z, ==, m1))
145 /* --- Now square until something interesting happens --- *
147 * Compute %$z^{2i} \bmod n$%. Eventually, I'll either get %$-1$% or
148 * %$1$%. If the former, the number is uninteresting, and I need to
149 * restart. If the latter, the previous number minus 1 has a common
154 mp *zz = mp_sqr(MP_NEW, z);
155 zz = mpmont_reduce(&mm, zz, zz);
156 if (MP_CMP(zz, ==, mm.r)) {
159 } else if (MP_CMP(zz, ==, m1)) {
168 /* --- Do the factoring --- *
170 * Here's how it actually works. I've found an interesting square
171 * root of %$1 \pmod n$%. Any square root of 1 must be congruent to
172 * %$\pm 1$% modulo both %$p$% and %$q$%. Both congruent to %$1$% is
173 * boring, as is both congruent to %$-1$%. Subtracting one from the
174 * result makes it congruent to %$0$% modulo %$p$% or %$q$% (and
175 * nobody cares which), and hence can be extracted by a GCD
180 z = mpmont_reduce(&mm, z, z);
181 z = mp_sub(z, z, MP_ONE);
183 mp_gcd(&rp->p, 0, 0, rp->n, z);
185 mp_div(&rp->q, 0, rp->n, rp->p);
189 if (MP_CMP(rp->p, <, rp->q)) {
198 /* --- If %$e$% or %$d$% is missing, recalculate it --- */
200 if (!rp->e || !rp->d) {
205 /* --- Compute %$\varphi(n)$% --- */
207 phi = mp_sub(MP_NEW, rp->n, rp->p);
208 phi = mp_sub(phi, phi, rp->q);
209 phi = mp_add(phi, phi, MP_ONE);
210 p1 = mp_sub(MP_NEW, rp->p, MP_ONE);
211 q1 = mp_sub(MP_NEW, rp->q, MP_ONE);
212 mp_gcd(&g, 0, 0, p1, q1);
213 mp_div(&phi, 0, phi, g);
217 /* --- Recover the other exponent --- */
220 mp_gcd(&g, 0, &rp->d, phi, rp->e);
222 mp_gcd(&g, 0, &rp->e, phi, rp->d);
230 if (MP_CMP(g, !=, MP_ONE)) {
237 /* --- Compute %$q^{-1} \bmod p$% --- */
240 mp_gcd(0, 0, &rp->q_inv, rp->p, rp->q);
242 /* --- Compute %$d \bmod (p - 1)$% and %$d \bmod (q - 1)$% --- */
245 mp *p1 = mp_sub(MP_NEW, rp->p, MP_ONE);
246 mp_div(0, &rp->dp, rp->d, p1);
250 mp *q1 = mp_sub(MP_NEW, rp->q, MP_ONE);
251 mp_div(0, &rp->dq, rp->d, q1);
260 /*----- That's all, folks -------------------------------------------------*/