3 * RSA parameter generation
5 * (c) 1999 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
30 #include <mLib/dstr.h>
37 #include "strongprime.h"
39 /*----- Main code ---------------------------------------------------------*/
41 /* --- @rsa_gen@ --- *
43 * Arguments: @rsa_priv *rp@ = pointer to block to be filled in
44 * @unsigned nbits@ = required modulus size in bits
45 * @grand *r@ = random number source
46 * @unsigned n@ = number of attempts to make
47 * @pgen_proc *event@ = event handler function
48 * @void *ectx@ = argument for the event handler
50 * Returns: Zero if all went well, nonzero otherwise.
52 * Use: Constructs a pair of strong RSA primes and other useful RSA
53 * parameters. A small encryption exponent is chosen if
57 int rsa_gen(rsa_priv *rp, unsigned nbits, grand *r, unsigned n,
58 pgen_proc *event, void *ectx)
63 /* --- Bits of initialization --- */
65 rp->e = mp_fromulong(MP_NEW, 0x10001);
68 /* --- Generate strong primes %$p$% and %$q$% --- *
70 * Constrain the GCD of @q@ to ensure that overly small private exponents
71 * are impossible. Current results suggest that if %$d < n^{0.29}$% then
72 * it can be guessed fairly easily. This implementation is rather more
73 * conservative about that sort of thing.
76 if ((rp->p = strongprime("p", MP_NEWSEC, nbits/2, r, n, event, ectx)) == 0)
79 /* --- Do painful fiddling with GCD steppers --- *
81 * Also, arrange that %$q \ge \lceil 2^{N-1}/p \rceil$%, so that %$p q$%
82 * has the right length.
87 mp *t = MP_NEW, *u = MP_NEW;
90 if ((q = strongprime_setup("q", MP_NEWSEC, &g.jp, nbits / 2,
91 r, n, event, ectx)) == 0)
93 t = mp_lsl(t, MP_ONE, nbits - 1);
94 mp_div(&t, &u, t, rp->p);
95 if (!MP_ZEROP(u)) t = mp_add(t, t, MP_ONE);
96 if (MP_CMP(q, <, t)) q = mp_leastcongruent(q, t, q, g.jp.m);
99 g.r = mp_lsr(MP_NEW, rp->p, 1);
102 q = pgen("q", q, q, event, ectx, n, pgen_gcdstep, &g,
103 rabin_iters(nbits/2), pgen_test, &rb);
104 pfilt_destroy(&g.jp);
113 /* --- Ensure that %$p > q$% --- *
115 * Also ensure that %$p$% and %$q$% are sufficiently different to deter
116 * square-root-based factoring methods.
119 phi = mp_sub(phi, rp->p, rp->q);
120 if (MP_LEN(phi) * 4 < MP_LEN(rp->p) * 3 ||
121 MP_LEN(phi) * 4 < MP_LEN(rp->q) * 3) {
133 /* --- Work out the modulus and the CRT coefficient --- */
135 rp->n = mp_mul(MP_NEW, rp->p, rp->q);
136 rp->q_inv = mp_modinv(MP_NEW, rp->q, rp->p);
138 /* --- Work out %$\varphi(n) = (p - 1)(q - 1)$% --- *
140 * Save on further multiplications by noting that %$n = pq$% is known and
141 * that %$(p - 1)(q - 1) = pq - p - q + 1$%. To minimize the size of @d@
142 * (useful for performance reasons, although not very because an overly
143 * small @d@ will be rejected for security reasons) this is then divided by
144 * %$\gcd(p - 1, q - 1)$%.
147 phi = mp_sub(phi, rp->n, rp->p);
148 phi = mp_sub(phi, phi, rp->q);
149 phi = mp_add(phi, phi, MP_ONE);
150 phi = mp_lsr(phi, phi, 1);
151 mp_div(&phi, 0, phi, g.g);
153 /* --- Decide on a public exponent --- *
155 * Simultaneously compute the private exponent.
158 mp_gcd(&g.g, 0, &rp->d, phi, rp->e);
159 if (!MP_EQ(g.g, MP_ONE) && MP_LEN(rp->d) * 4 > MP_LEN(rp->n) * 3)
161 if (mp_bits(rp->n) != nbits)
164 /* --- Work out exponent residues --- */
166 rp->dp = MP_NEW; phi = mp_sub(phi, rp->p, MP_ONE);
167 mp_div(0, &rp->dp, rp->d, phi);
169 rp->dq = MP_NEW; phi = mp_sub(phi, rp->q, MP_ONE);
170 mp_div(0, &rp->dq, rp->d, phi);
178 /* --- Tidy up when something goes wrong --- */
195 /*----- That's all, folks -------------------------------------------------*/