Add RSA to FIPS.
This commit is contained in:
Ben Laurie
parent
f29f610bf5
commit
52fc641da0
@ -62,7 +62,7 @@
|
||||
#include <openssl/rsa.h>
|
||||
#include <openssl/rand.h>
|
||||
|
||||
#ifndef RSA_NULL
|
||||
#if !defined(RSA_NULL) && !defined(OPENSSL_FIPS)
|
||||
|
||||
static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa,int padding);
|
||||
|
||||
@ -62,6 +62,8 @@
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/rsa.h>
|
||||
|
||||
#ifndef OPENSSL_FIPS
|
||||
|
||||
RSA *RSA_generate_key(int bits, unsigned long e_value,
|
||||
void (*callback)(int,int,void *), void *cb_arg)
|
||||
{
|
||||
@ -195,3 +197,4 @@ err:
|
||||
return(rsa);
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
@ -102,14 +102,7 @@ sha1_one.o: ../../include/openssl/opensslconf.h
|
||||
sha1_one.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
|
||||
sha1_one.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
|
||||
sha1_one.o: ../../include/openssl/symhacks.h sha1_one.c
|
||||
sha1dgst.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
|
||||
sha1dgst.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
|
||||
sha1dgst.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
|
||||
sha1dgst.o: ../../include/openssl/opensslconf.h
|
||||
sha1dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
|
||||
sha1dgst.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
|
||||
sha1dgst.o: ../../include/openssl/symhacks.h ../md32_common.h sha1dgst.c
|
||||
sha1dgst.o: sha_locl.h
|
||||
sha1dgst.o: ../../include/openssl/opensslv.h sha1dgst.c
|
||||
sha_dgst.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
|
||||
sha_dgst.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
|
||||
sha_dgst.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
|
||||
|
||||
@ -26,7 +26,7 @@ CFLAGS= $(INCLUDE) $(CFLAG)
|
||||
|
||||
LIBS=
|
||||
|
||||
FDIRS=sha1 rand des aes dsa
|
||||
FDIRS=sha1 rand des aes dsa rsa
|
||||
|
||||
GENERAL=Makefile README fips-lib.com install.com
|
||||
|
||||
@ -186,4 +186,10 @@ fips.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
|
||||
fips.o: ../include/openssl/sha.h ../include/openssl/stack.h
|
||||
fips.o: ../include/openssl/symhacks.h ../include/openssl/ui.h
|
||||
fips.o: ../include/openssl/ui_compat.h fips.c
|
||||
fips_err_wrapper.o: fips_err_wrapper.c
|
||||
fips_err_wrapper.o: ../include/openssl/bio.h ../include/openssl/crypto.h
|
||||
fips_err_wrapper.o: ../include/openssl/e_os2.h ../include/openssl/err.h
|
||||
fips_err_wrapper.o: ../include/openssl/fips.h ../include/openssl/lhash.h
|
||||
fips_err_wrapper.o: ../include/openssl/opensslconf.h
|
||||
fips_err_wrapper.o: ../include/openssl/opensslv.h
|
||||
fips_err_wrapper.o: ../include/openssl/safestack.h ../include/openssl/stack.h
|
||||
fips_err_wrapper.o: ../include/openssl/symhacks.h fips_err.h fips_err_wrapper.c
|
||||
|
||||
@ -22,3 +22,6 @@ $S fips_dsa_ossl.c fips_dsa_gen.c > fingerprint.sha1
|
||||
|
||||
cd ../des
|
||||
$S fips_des_enc.c fips_des_selftest.c fips_des_locl.h > fingerprint.sha1
|
||||
|
||||
cd ../rsa
|
||||
$S fips_rsa_eay.c fips_rsa_gen.c > fingerprint.sha1
|
||||
|
||||
102
fips/rsa/Makefile.ssl
Normal file
102
fips/rsa/Makefile.ssl
Normal file
@ -0,0 +1,102 @@
|
||||
#
|
||||
# SSLeay/fips/rsa/Makefile
|
||||
#
|
||||
|
||||
DIR= rsa
|
||||
TOP= ../..
|
||||
CC= cc
|
||||
INCLUDES=
|
||||
CFLAG=-g
|
||||
INSTALL_PREFIX=
|
||||
OPENSSLDIR= /usr/local/ssl
|
||||
INSTALLTOP=/usr/local/ssl
|
||||
MAKE= make -f Makefile.ssl
|
||||
MAKEDEPPROG= makedepend
|
||||
MAKEDEPEND= $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
|
||||
MAKEFILE= Makefile.ssl
|
||||
AR= ar r
|
||||
|
||||
CFLAGS= $(INCLUDES) $(CFLAG)
|
||||
|
||||
GENERAL=Makefile
|
||||
TEST=fips_dsatest.c
|
||||
APPS=
|
||||
|
||||
LIB=$(TOP)/libcrypto.a
|
||||
LIBSRC=fips_rsa_eay.c fips_rsa_gen.c
|
||||
LIBOBJ=fips_rsa_eay.o fips_rsa_gen.o
|
||||
|
||||
SRC= $(LIBSRC)
|
||||
|
||||
EXHEADER=
|
||||
HEADER= $(EXHEADER)
|
||||
|
||||
ALL= $(GENERAL) $(SRC) $(HEADER)
|
||||
|
||||
top:
|
||||
(cd $(TOP); $(MAKE) DIRS=fips FDIRS=$(DIR) sub_all)
|
||||
|
||||
all: check lib
|
||||
|
||||
lib: $(LIBOBJ)
|
||||
$(AR) $(LIB) $(LIBOBJ)
|
||||
$(RANLIB) $(LIB) || echo Never mind.
|
||||
@touch lib
|
||||
|
||||
check:
|
||||
TOP=`pwd`/$(TOP) ../fips_check_sha1 fingerprint.sha1 $(SRC) $(HEADER)
|
||||
|
||||
files:
|
||||
$(PERL) $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO
|
||||
|
||||
links:
|
||||
@$(TOP)/util/point.sh Makefile.ssl Makefile
|
||||
@$(PERL) $(TOP)/util/mklink.pl $(TOP)/include/openssl $(EXHEADER)
|
||||
@$(PERL) $(TOP)/util/mklink.pl $(TOP)/test $(TEST)
|
||||
@$(PERL) $(TOP)/util/mklink.pl $(TOP)/apps $(APPS)
|
||||
|
||||
install:
|
||||
@for i in $(EXHEADER) ; \
|
||||
do \
|
||||
(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
|
||||
chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
|
||||
done;
|
||||
|
||||
tags:
|
||||
ctags $(SRC)
|
||||
|
||||
tests:
|
||||
|
||||
lint:
|
||||
lint -DLINT $(INCLUDES) $(SRC)>fluff
|
||||
|
||||
depend:
|
||||
$(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
|
||||
|
||||
dclean:
|
||||
$(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
|
||||
mv -f Makefile.new $(MAKEFILE)
|
||||
|
||||
clean:
|
||||
rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
|
||||
# DO NOT DELETE THIS LINE -- make depend depends on it.
|
||||
|
||||
fips_rsa_eay.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
|
||||
fips_rsa_eay.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
|
||||
fips_rsa_eay.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
|
||||
fips_rsa_eay.o: ../../include/openssl/lhash.h
|
||||
fips_rsa_eay.o: ../../include/openssl/opensslconf.h
|
||||
fips_rsa_eay.o: ../../include/openssl/opensslv.h
|
||||
fips_rsa_eay.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rand.h
|
||||
fips_rsa_eay.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
|
||||
fips_rsa_eay.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
|
||||
fips_rsa_eay.o: fips_rsa_eay.c
|
||||
fips_rsa_gen.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
|
||||
fips_rsa_gen.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
|
||||
fips_rsa_gen.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
|
||||
fips_rsa_gen.o: ../../include/openssl/lhash.h
|
||||
fips_rsa_gen.o: ../../include/openssl/opensslconf.h
|
||||
fips_rsa_gen.o: ../../include/openssl/opensslv.h
|
||||
fips_rsa_gen.o: ../../include/openssl/ossl_typ.h ../../include/openssl/rsa.h
|
||||
fips_rsa_gen.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
|
||||
fips_rsa_gen.o: ../../include/openssl/symhacks.h fips_rsa_gen.c
|
||||
2
fips/rsa/fingerprint.sha1
Normal file
2
fips/rsa/fingerprint.sha1
Normal file
@ -0,0 +1,2 @@
|
||||
SHA1(fips_rsa_eay.c)= 945cac757aecfad5a3c6bfcd4db7c384e51342f5
|
||||
SHA1(fips_rsa_gen.c)= 4367cb3840db0df5b50846a198c33911c28ab2f4
|
||||
727
fips/rsa/fips_rsa_eay.c
Normal file
727
fips/rsa/fips_rsa_eay.c
Normal file
@ -0,0 +1,727 @@
|
||||
/* crypto/rsa/rsa_eay.c */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
* This package is an SSL implementation written
|
||||
* by Eric Young (eay@cryptsoft.com).
|
||||
* The implementation was written so as to conform with Netscapes SSL.
|
||||
*
|
||||
* This library is free for commercial and non-commercial use as long as
|
||||
* the following conditions are aheared to. The following conditions
|
||||
* apply to all code found in this distribution, be it the RC4, RSA,
|
||||
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
|
||||
* included with this distribution is covered by the same copyright terms
|
||||
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
* Copyright remains Eric Young's, and as such any Copyright notices in
|
||||
* the code are not to be removed.
|
||||
* If this package is used in a product, Eric Young should be given attribution
|
||||
* as the author of the parts of the library used.
|
||||
* This can be in the form of a textual message at program startup or
|
||||
* in documentation (online or textual) provided with the package.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* "This product includes cryptographic software written by
|
||||
* Eric Young (eay@cryptsoft.com)"
|
||||
* The word 'cryptographic' can be left out if the rouines from the library
|
||||
* being used are not cryptographic related :-).
|
||||
* 4. If you include any Windows specific code (or a derivative thereof) from
|
||||
* the apps directory (application code) you must include an acknowledgement:
|
||||
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* The licence and distribution terms for any publically available version or
|
||||
* derivative of this code cannot be changed. i.e. this code cannot simply be
|
||||
* copied and put under another distribution licence
|
||||
* [including the GNU Public Licence.]
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/rsa.h>
|
||||
#include <openssl/rand.h>
|
||||
|
||||
#if !defined(RSA_NULL) && defined(OPENSSL_FIPS)
|
||||
|
||||
static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa,int padding);
|
||||
static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa,int padding);
|
||||
static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa,int padding);
|
||||
static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa,int padding);
|
||||
static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa);
|
||||
static int RSA_eay_init(RSA *rsa);
|
||||
static int RSA_eay_finish(RSA *rsa);
|
||||
static RSA_METHOD rsa_pkcs1_eay_meth={
|
||||
"Eric Young's PKCS#1 RSA",
|
||||
RSA_eay_public_encrypt,
|
||||
RSA_eay_public_decrypt, /* signature verification */
|
||||
RSA_eay_private_encrypt, /* signing */
|
||||
RSA_eay_private_decrypt,
|
||||
RSA_eay_mod_exp,
|
||||
BN_mod_exp_mont, /* XXX probably we should not use Montgomery if e == 3 */
|
||||
RSA_eay_init,
|
||||
RSA_eay_finish,
|
||||
0, /* flags */
|
||||
NULL,
|
||||
0, /* rsa_sign */
|
||||
0 /* rsa_verify */
|
||||
};
|
||||
|
||||
const RSA_METHOD *RSA_PKCS1_SSLeay(void)
|
||||
{
|
||||
return(&rsa_pkcs1_eay_meth);
|
||||
}
|
||||
|
||||
static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa, int padding)
|
||||
{
|
||||
BIGNUM f,ret;
|
||||
int i,j,k,num=0,r= -1;
|
||||
unsigned char *buf=NULL;
|
||||
BN_CTX *ctx=NULL;
|
||||
|
||||
BN_init(&f);
|
||||
BN_init(&ret);
|
||||
if ((ctx=BN_CTX_new()) == NULL) goto err;
|
||||
num=BN_num_bytes(rsa->n);
|
||||
if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
switch (padding)
|
||||
{
|
||||
case RSA_PKCS1_PADDING:
|
||||
i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen);
|
||||
break;
|
||||
#ifndef OPENSSL_NO_SHA
|
||||
case RSA_PKCS1_OAEP_PADDING:
|
||||
i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0);
|
||||
break;
|
||||
#endif
|
||||
case RSA_SSLV23_PADDING:
|
||||
i=RSA_padding_add_SSLv23(buf,num,from,flen);
|
||||
break;
|
||||
case RSA_NO_PADDING:
|
||||
i=RSA_padding_add_none(buf,num,from,flen);
|
||||
break;
|
||||
default:
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
|
||||
goto err;
|
||||
}
|
||||
if (i <= 0) goto err;
|
||||
|
||||
if (BN_bin2bn(buf,num,&f) == NULL) goto err;
|
||||
|
||||
if (BN_ucmp(&f, rsa->n) >= 0)
|
||||
{
|
||||
/* usually the padding functions would catch this */
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))
|
||||
{
|
||||
BN_MONT_CTX* bn_mont_ctx;
|
||||
if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
|
||||
goto err;
|
||||
if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx))
|
||||
{
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
goto err;
|
||||
}
|
||||
if (rsa->_method_mod_n == NULL) /* other thread may have finished first */
|
||||
{
|
||||
CRYPTO_w_lock(CRYPTO_LOCK_RSA);
|
||||
if (rsa->_method_mod_n == NULL)
|
||||
{
|
||||
rsa->_method_mod_n = bn_mont_ctx;
|
||||
bn_mont_ctx = NULL;
|
||||
}
|
||||
CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
|
||||
}
|
||||
if (bn_mont_ctx)
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
}
|
||||
|
||||
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
|
||||
rsa->_method_mod_n)) goto err;
|
||||
|
||||
/* put in leading 0 bytes if the number is less than the
|
||||
* length of the modulus */
|
||||
j=BN_num_bytes(&ret);
|
||||
i=BN_bn2bin(&ret,&(to[num-j]));
|
||||
for (k=0; k<(num-i); k++)
|
||||
to[k]=0;
|
||||
|
||||
r=num;
|
||||
err:
|
||||
if (ctx != NULL) BN_CTX_free(ctx);
|
||||
BN_clear_free(&f);
|
||||
BN_clear_free(&ret);
|
||||
if (buf != NULL)
|
||||
{
|
||||
OPENSSL_cleanse(buf,num);
|
||||
OPENSSL_free(buf);
|
||||
}
|
||||
return(r);
|
||||
}
|
||||
|
||||
static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx)
|
||||
{
|
||||
int ret = 1;
|
||||
CRYPTO_w_lock(CRYPTO_LOCK_RSA);
|
||||
/* Check again inside the lock - the macro's check is racey */
|
||||
if(rsa->blinding == NULL)
|
||||
ret = RSA_blinding_on(rsa, ctx);
|
||||
CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
|
||||
return ret;
|
||||
}
|
||||
|
||||
#define BLINDING_HELPER(rsa, ctx, err_instr) \
|
||||
do { \
|
||||
if((!((rsa)->flags & RSA_FLAG_NO_BLINDING)) && \
|
||||
((rsa)->blinding == NULL) && \
|
||||
!rsa_eay_blinding(rsa, ctx)) \
|
||||
err_instr \
|
||||
} while(0)
|
||||
|
||||
static BN_BLINDING *setup_blinding(RSA *rsa, BN_CTX *ctx)
|
||||
{
|
||||
BIGNUM *A, *Ai;
|
||||
BN_BLINDING *ret = NULL;
|
||||
|
||||
/* added in OpenSSL 0.9.6j and 0.9.7b */
|
||||
|
||||
/* NB: similar code appears in RSA_blinding_on (rsa_lib.c);
|
||||
* this should be placed in a new function of its own, but for reasons
|
||||
* of binary compatibility can't */
|
||||
|
||||
BN_CTX_start(ctx);
|
||||
A = BN_CTX_get(ctx);
|
||||
if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL)
|
||||
{
|
||||
/* if PRNG is not properly seeded, resort to secret exponent as unpredictable seed */
|
||||
RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0);
|
||||
if (!BN_pseudo_rand_range(A,rsa->n)) goto err;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (!BN_rand_range(A,rsa->n)) goto err;
|
||||
}
|
||||
if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err;
|
||||
|
||||
if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n))
|
||||
goto err;
|
||||
ret = BN_BLINDING_new(A,Ai,rsa->n);
|
||||
BN_free(Ai);
|
||||
err:
|
||||
BN_CTX_end(ctx);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* signing */
|
||||
static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa, int padding)
|
||||
{
|
||||
BIGNUM f,ret;
|
||||
int i,j,k,num=0,r= -1;
|
||||
unsigned char *buf=NULL;
|
||||
BN_CTX *ctx=NULL;
|
||||
int local_blinding = 0;
|
||||
BN_BLINDING *blinding = NULL;
|
||||
|
||||
BN_init(&f);
|
||||
BN_init(&ret);
|
||||
|
||||
if ((ctx=BN_CTX_new()) == NULL) goto err;
|
||||
num=BN_num_bytes(rsa->n);
|
||||
if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
switch (padding)
|
||||
{
|
||||
case RSA_PKCS1_PADDING:
|
||||
i=RSA_padding_add_PKCS1_type_1(buf,num,from,flen);
|
||||
break;
|
||||
case RSA_NO_PADDING:
|
||||
i=RSA_padding_add_none(buf,num,from,flen);
|
||||
break;
|
||||
case RSA_SSLV23_PADDING:
|
||||
default:
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
|
||||
goto err;
|
||||
}
|
||||
if (i <= 0) goto err;
|
||||
|
||||
if (BN_bin2bn(buf,num,&f) == NULL) goto err;
|
||||
|
||||
if (BN_ucmp(&f, rsa->n) >= 0)
|
||||
{
|
||||
/* usually the padding functions would catch this */
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
|
||||
goto err;
|
||||
}
|
||||
|
||||
BLINDING_HELPER(rsa, ctx, goto err;);
|
||||
blinding = rsa->blinding;
|
||||
|
||||
/* Now unless blinding is disabled, 'blinding' is non-NULL.
|
||||
* But the BN_BLINDING object may be owned by some other thread
|
||||
* (we don't want to keep it constant and we don't want to use
|
||||
* lots of locking to avoid race conditions, so only a single
|
||||
* thread can use it; other threads have to use local blinding
|
||||
* factors) */
|
||||
if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
|
||||
{
|
||||
if (blinding == NULL)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (blinding != NULL)
|
||||
{
|
||||
if (blinding->thread_id != CRYPTO_thread_id())
|
||||
{
|
||||
/* we need a local one-time blinding factor */
|
||||
|
||||
blinding = setup_blinding(rsa, ctx);
|
||||
if (blinding == NULL)
|
||||
goto err;
|
||||
local_blinding = 1;
|
||||
}
|
||||
}
|
||||
|
||||
if (blinding)
|
||||
if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err;
|
||||
|
||||
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
|
||||
((rsa->p != NULL) &&
|
||||
(rsa->q != NULL) &&
|
||||
(rsa->dmp1 != NULL) &&
|
||||
(rsa->dmq1 != NULL) &&
|
||||
(rsa->iqmp != NULL)) )
|
||||
{ if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; }
|
||||
else
|
||||
{
|
||||
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) goto err;
|
||||
}
|
||||
|
||||
if (blinding)
|
||||
if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err;
|
||||
|
||||
/* put in leading 0 bytes if the number is less than the
|
||||
* length of the modulus */
|
||||
j=BN_num_bytes(&ret);
|
||||
i=BN_bn2bin(&ret,&(to[num-j]));
|
||||
for (k=0; k<(num-i); k++)
|
||||
to[k]=0;
|
||||
|
||||
r=num;
|
||||
err:
|
||||
if (ctx != NULL) BN_CTX_free(ctx);
|
||||
BN_clear_free(&ret);
|
||||
BN_clear_free(&f);
|
||||
if (local_blinding)
|
||||
BN_BLINDING_free(blinding);
|
||||
if (buf != NULL)
|
||||
{
|
||||
OPENSSL_cleanse(buf,num);
|
||||
OPENSSL_free(buf);
|
||||
}
|
||||
return(r);
|
||||
}
|
||||
|
||||
static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa, int padding)
|
||||
{
|
||||
BIGNUM f,ret;
|
||||
int j,num=0,r= -1;
|
||||
unsigned char *p;
|
||||
unsigned char *buf=NULL;
|
||||
BN_CTX *ctx=NULL;
|
||||
int local_blinding = 0;
|
||||
BN_BLINDING *blinding = NULL;
|
||||
|
||||
BN_init(&f);
|
||||
BN_init(&ret);
|
||||
ctx=BN_CTX_new();
|
||||
if (ctx == NULL) goto err;
|
||||
|
||||
num=BN_num_bytes(rsa->n);
|
||||
|
||||
if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* This check was for equality but PGP does evil things
|
||||
* and chops off the top '0' bytes */
|
||||
if (flen > num)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* make data into a big number */
|
||||
if (BN_bin2bn(from,(int)flen,&f) == NULL) goto err;
|
||||
|
||||
if (BN_ucmp(&f, rsa->n) >= 0)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
|
||||
goto err;
|
||||
}
|
||||
|
||||
BLINDING_HELPER(rsa, ctx, goto err;);
|
||||
blinding = rsa->blinding;
|
||||
|
||||
/* Now unless blinding is disabled, 'blinding' is non-NULL.
|
||||
* But the BN_BLINDING object may be owned by some other thread
|
||||
* (we don't want to keep it constant and we don't want to use
|
||||
* lots of locking to avoid race conditions, so only a single
|
||||
* thread can use it; other threads have to use local blinding
|
||||
* factors) */
|
||||
if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
|
||||
{
|
||||
if (blinding == NULL)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
}
|
||||
|
||||
if (blinding != NULL)
|
||||
{
|
||||
if (blinding->thread_id != CRYPTO_thread_id())
|
||||
{
|
||||
/* we need a local one-time blinding factor */
|
||||
|
||||
blinding = setup_blinding(rsa, ctx);
|
||||
if (blinding == NULL)
|
||||
goto err;
|
||||
local_blinding = 1;
|
||||
}
|
||||
}
|
||||
|
||||
if (blinding)
|
||||
if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err;
|
||||
|
||||
/* do the decrypt */
|
||||
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
|
||||
((rsa->p != NULL) &&
|
||||
(rsa->q != NULL) &&
|
||||
(rsa->dmp1 != NULL) &&
|
||||
(rsa->dmq1 != NULL) &&
|
||||
(rsa->iqmp != NULL)) )
|
||||
{ if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; }
|
||||
else
|
||||
{
|
||||
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL))
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (blinding)
|
||||
if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err;
|
||||
|
||||
p=buf;
|
||||
j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */
|
||||
|
||||
switch (padding)
|
||||
{
|
||||
case RSA_PKCS1_PADDING:
|
||||
r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num);
|
||||
break;
|
||||
#ifndef OPENSSL_NO_SHA
|
||||
case RSA_PKCS1_OAEP_PADDING:
|
||||
r=RSA_padding_check_PKCS1_OAEP(to,num,buf,j,num,NULL,0);
|
||||
break;
|
||||
#endif
|
||||
case RSA_SSLV23_PADDING:
|
||||
r=RSA_padding_check_SSLv23(to,num,buf,j,num);
|
||||
break;
|
||||
case RSA_NO_PADDING:
|
||||
r=RSA_padding_check_none(to,num,buf,j,num);
|
||||
break;
|
||||
default:
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
|
||||
goto err;
|
||||
}
|
||||
if (r < 0)
|
||||
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
|
||||
|
||||
err:
|
||||
if (ctx != NULL) BN_CTX_free(ctx);
|
||||
BN_clear_free(&f);
|
||||
BN_clear_free(&ret);
|
||||
if (local_blinding)
|
||||
BN_BLINDING_free(blinding);
|
||||
if (buf != NULL)
|
||||
{
|
||||
OPENSSL_cleanse(buf,num);
|
||||
OPENSSL_free(buf);
|
||||
}
|
||||
return(r);
|
||||
}
|
||||
|
||||
/* signature verification */
|
||||
static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
|
||||
unsigned char *to, RSA *rsa, int padding)
|
||||
{
|
||||
BIGNUM f,ret;
|
||||
int i,num=0,r= -1;
|
||||
unsigned char *p;
|
||||
unsigned char *buf=NULL;
|
||||
BN_CTX *ctx=NULL;
|
||||
|
||||
BN_init(&f);
|
||||
BN_init(&ret);
|
||||
ctx=BN_CTX_new();
|
||||
if (ctx == NULL) goto err;
|
||||
|
||||
num=BN_num_bytes(rsa->n);
|
||||
buf=(unsigned char *)OPENSSL_malloc(num);
|
||||
if (buf == NULL)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* This check was for equality but PGP does evil things
|
||||
* and chops off the top '0' bytes */
|
||||
if (flen > num)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (BN_bin2bn(from,flen,&f) == NULL) goto err;
|
||||
|
||||
if (BN_ucmp(&f, rsa->n) >= 0)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* do the decrypt */
|
||||
if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))
|
||||
{
|
||||
BN_MONT_CTX* bn_mont_ctx;
|
||||
if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
|
||||
goto err;
|
||||
if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx))
|
||||
{
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
goto err;
|
||||
}
|
||||
if (rsa->_method_mod_n == NULL) /* other thread may have finished first */
|
||||
{
|
||||
CRYPTO_w_lock(CRYPTO_LOCK_RSA);
|
||||
if (rsa->_method_mod_n == NULL)
|
||||
{
|
||||
rsa->_method_mod_n = bn_mont_ctx;
|
||||
bn_mont_ctx = NULL;
|
||||
}
|
||||
CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
|
||||
}
|
||||
if (bn_mont_ctx)
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
}
|
||||
|
||||
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
|
||||
rsa->_method_mod_n)) goto err;
|
||||
|
||||
p=buf;
|
||||
i=BN_bn2bin(&ret,p);
|
||||
|
||||
switch (padding)
|
||||
{
|
||||
case RSA_PKCS1_PADDING:
|
||||
r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num);
|
||||
break;
|
||||
case RSA_NO_PADDING:
|
||||
r=RSA_padding_check_none(to,num,buf,i,num);
|
||||
break;
|
||||
default:
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
|
||||
goto err;
|
||||
}
|
||||
if (r < 0)
|
||||
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
|
||||
|
||||
err:
|
||||
if (ctx != NULL) BN_CTX_free(ctx);
|
||||
BN_clear_free(&f);
|
||||
BN_clear_free(&ret);
|
||||
if (buf != NULL)
|
||||
{
|
||||
OPENSSL_cleanse(buf,num);
|
||||
OPENSSL_free(buf);
|
||||
}
|
||||
return(r);
|
||||
}
|
||||
|
||||
static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
|
||||
{
|
||||
BIGNUM r1,m1,vrfy;
|
||||
int ret=0;
|
||||
BN_CTX *ctx;
|
||||
|
||||
BN_init(&m1);
|
||||
BN_init(&r1);
|
||||
BN_init(&vrfy);
|
||||
if ((ctx=BN_CTX_new()) == NULL) goto err;
|
||||
|
||||
if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
|
||||
{
|
||||
if (rsa->_method_mod_p == NULL)
|
||||
{
|
||||
BN_MONT_CTX* bn_mont_ctx;
|
||||
if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
|
||||
goto err;
|
||||
if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->p,ctx))
|
||||
{
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
goto err;
|
||||
}
|
||||
if (rsa->_method_mod_p == NULL) /* other thread may have finished first */
|
||||
{
|
||||
CRYPTO_w_lock(CRYPTO_LOCK_RSA);
|
||||
if (rsa->_method_mod_p == NULL)
|
||||
{
|
||||
rsa->_method_mod_p = bn_mont_ctx;
|
||||
bn_mont_ctx = NULL;
|
||||
}
|
||||
CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
|
||||
}
|
||||
if (bn_mont_ctx)
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
}
|
||||
|
||||
if (rsa->_method_mod_q == NULL)
|
||||
{
|
||||
BN_MONT_CTX* bn_mont_ctx;
|
||||
if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
|
||||
goto err;
|
||||
if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->q,ctx))
|
||||
{
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
goto err;
|
||||
}
|
||||
if (rsa->_method_mod_q == NULL) /* other thread may have finished first */
|
||||
{
|
||||
CRYPTO_w_lock(CRYPTO_LOCK_RSA);
|
||||
if (rsa->_method_mod_q == NULL)
|
||||
{
|
||||
rsa->_method_mod_q = bn_mont_ctx;
|
||||
bn_mont_ctx = NULL;
|
||||
}
|
||||
CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
|
||||
}
|
||||
if (bn_mont_ctx)
|
||||
BN_MONT_CTX_free(bn_mont_ctx);
|
||||
}
|
||||
}
|
||||
|
||||
if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
|
||||
if (!rsa->meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,
|
||||
rsa->_method_mod_q)) goto err;
|
||||
|
||||
if (!BN_mod(&r1,I,rsa->p,ctx)) goto err;
|
||||
if (!rsa->meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx,
|
||||
rsa->_method_mod_p)) goto err;
|
||||
|
||||
if (!BN_sub(r0,r0,&m1)) goto err;
|
||||
/* This will help stop the size of r0 increasing, which does
|
||||
* affect the multiply if it optimised for a power of 2 size */
|
||||
if (r0->neg)
|
||||
if (!BN_add(r0,r0,rsa->p)) goto err;
|
||||
|
||||
if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err;
|
||||
if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err;
|
||||
/* If p < q it is occasionally possible for the correction of
|
||||
* adding 'p' if r0 is negative above to leave the result still
|
||||
* negative. This can break the private key operations: the following
|
||||
* second correction should *always* correct this rare occurrence.
|
||||
* This will *never* happen with OpenSSL generated keys because
|
||||
* they ensure p > q [steve]
|
||||
*/
|
||||
if (r0->neg)
|
||||
if (!BN_add(r0,r0,rsa->p)) goto err;
|
||||
if (!BN_mul(&r1,r0,rsa->q,ctx)) goto err;
|
||||
if (!BN_add(r0,&r1,&m1)) goto err;
|
||||
|
||||
if (rsa->e && rsa->n)
|
||||
{
|
||||
if (!rsa->meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,NULL)) goto err;
|
||||
/* If 'I' was greater than (or equal to) rsa->n, the operation
|
||||
* will be equivalent to using 'I mod n'. However, the result of
|
||||
* the verify will *always* be less than 'n' so we don't check
|
||||
* for absolute equality, just congruency. */
|
||||
if (!BN_sub(&vrfy, &vrfy, I)) goto err;
|
||||
if (!BN_mod(&vrfy, &vrfy, rsa->n, ctx)) goto err;
|
||||
if (vrfy.neg)
|
||||
if (!BN_add(&vrfy, &vrfy, rsa->n)) goto err;
|
||||
if (!BN_is_zero(&vrfy))
|
||||
/* 'I' and 'vrfy' aren't congruent mod n. Don't leak
|
||||
* miscalculated CRT output, just do a raw (slower)
|
||||
* mod_exp and return that instead. */
|
||||
if (!rsa->meth->bn_mod_exp(r0,I,rsa->d,rsa->n,ctx,NULL)) goto err;
|
||||
}
|
||||
ret=1;
|
||||
err:
|
||||
BN_clear_free(&m1);
|
||||
BN_clear_free(&r1);
|
||||
BN_clear_free(&vrfy);
|
||||
BN_CTX_free(ctx);
|
||||
return(ret);
|
||||
}
|
||||
|
||||
static int RSA_eay_init(RSA *rsa)
|
||||
{
|
||||
rsa->flags|=RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE;
|
||||
return(1);
|
||||
}
|
||||
|
||||
static int RSA_eay_finish(RSA *rsa)
|
||||
{
|
||||
if (rsa->_method_mod_n != NULL)
|
||||
BN_MONT_CTX_free(rsa->_method_mod_n);
|
||||
if (rsa->_method_mod_p != NULL)
|
||||
BN_MONT_CTX_free(rsa->_method_mod_p);
|
||||
if (rsa->_method_mod_q != NULL)
|
||||
BN_MONT_CTX_free(rsa->_method_mod_q);
|
||||
return(1);
|
||||
}
|
||||
|
||||
#endif
|
||||
200
fips/rsa/fips_rsa_gen.c
Normal file
200
fips/rsa/fips_rsa_gen.c
Normal file
@ -0,0 +1,200 @@
|
||||
/* crypto/rsa/rsa_gen.c */
|
||||
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
||||
* All rights reserved.
|
||||
*
|
||||
* This package is an SSL implementation written
|
||||
* by Eric Young (eay@cryptsoft.com).
|
||||
* The implementation was written so as to conform with Netscapes SSL.
|
||||
*
|
||||
* This library is free for commercial and non-commercial use as long as
|
||||
* the following conditions are aheared to. The following conditions
|
||||
* apply to all code found in this distribution, be it the RC4, RSA,
|
||||
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
|
||||
* included with this distribution is covered by the same copyright terms
|
||||
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
* Copyright remains Eric Young's, and as such any Copyright notices in
|
||||
* the code are not to be removed.
|
||||
* If this package is used in a product, Eric Young should be given attribution
|
||||
* as the author of the parts of the library used.
|
||||
* This can be in the form of a textual message at program startup or
|
||||
* in documentation (online or textual) provided with the package.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* "This product includes cryptographic software written by
|
||||
* Eric Young (eay@cryptsoft.com)"
|
||||
* The word 'cryptographic' can be left out if the rouines from the library
|
||||
* being used are not cryptographic related :-).
|
||||
* 4. If you include any Windows specific code (or a derivative thereof) from
|
||||
* the apps directory (application code) you must include an acknowledgement:
|
||||
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* The licence and distribution terms for any publically available version or
|
||||
* derivative of this code cannot be changed. i.e. this code cannot simply be
|
||||
* copied and put under another distribution licence
|
||||
* [including the GNU Public Licence.]
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <time.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/rsa.h>
|
||||
|
||||
#ifdef OPENSSL_FIPS
|
||||
|
||||
RSA *RSA_generate_key(int bits, unsigned long e_value,
|
||||
void (*callback)(int,int,void *), void *cb_arg)
|
||||
{
|
||||
RSA *rsa=NULL;
|
||||
BIGNUM *r0=NULL,*r1=NULL,*r2=NULL,*r3=NULL,*tmp;
|
||||
int bitsp,bitsq,ok= -1,n=0,i;
|
||||
BN_CTX *ctx=NULL,*ctx2=NULL;
|
||||
|
||||
ctx=BN_CTX_new();
|
||||
if (ctx == NULL) goto err;
|
||||
ctx2=BN_CTX_new();
|
||||
if (ctx2 == NULL) goto err;
|
||||
BN_CTX_start(ctx);
|
||||
r0 = BN_CTX_get(ctx);
|
||||
r1 = BN_CTX_get(ctx);
|
||||
r2 = BN_CTX_get(ctx);
|
||||
r3 = BN_CTX_get(ctx);
|
||||
if (r3 == NULL) goto err;
|
||||
|
||||
bitsp=(bits+1)/2;
|
||||
bitsq=bits-bitsp;
|
||||
rsa=RSA_new();
|
||||
if (rsa == NULL) goto err;
|
||||
|
||||
/* set e */
|
||||
rsa->e=BN_new();
|
||||
if (rsa->e == NULL) goto err;
|
||||
|
||||
#if 1
|
||||
/* The problem is when building with 8, 16, or 32 BN_ULONG,
|
||||
* unsigned long can be larger */
|
||||
for (i=0; i<sizeof(unsigned long)*8; i++)
|
||||
{
|
||||
if (e_value & (1UL<<i))
|
||||
BN_set_bit(rsa->e,i);
|
||||
}
|
||||
#else
|
||||
if (!BN_set_word(rsa->e,e_value)) goto err;
|
||||
#endif
|
||||
|
||||
/* generate p and q */
|
||||
for (;;)
|
||||
{
|
||||
rsa->p=BN_generate_prime(NULL,bitsp,0,NULL,NULL,callback,cb_arg);
|
||||
if (rsa->p == NULL) goto err;
|
||||
if (!BN_sub(r2,rsa->p,BN_value_one())) goto err;
|
||||
if (!BN_gcd(r1,r2,rsa->e,ctx)) goto err;
|
||||
if (BN_is_one(r1)) break;
|
||||
if (callback != NULL) callback(2,n++,cb_arg);
|
||||
BN_free(rsa->p);
|
||||
}
|
||||
if (callback != NULL) callback(3,0,cb_arg);
|
||||
for (;;)
|
||||
{
|
||||
rsa->q=BN_generate_prime(NULL,bitsq,0,NULL,NULL,callback,cb_arg);
|
||||
if (rsa->q == NULL) goto err;
|
||||
if (!BN_sub(r2,rsa->q,BN_value_one())) goto err;
|
||||
if (!BN_gcd(r1,r2,rsa->e,ctx)) goto err;
|
||||
if (BN_is_one(r1) && (BN_cmp(rsa->p,rsa->q) != 0))
|
||||
break;
|
||||
if (callback != NULL) callback(2,n++,cb_arg);
|
||||
BN_free(rsa->q);
|
||||
}
|
||||
if (callback != NULL) callback(3,1,cb_arg);
|
||||
if (BN_cmp(rsa->p,rsa->q) < 0)
|
||||
{
|
||||
tmp=rsa->p;
|
||||
rsa->p=rsa->q;
|
||||
rsa->q=tmp;
|
||||
}
|
||||
|
||||
/* calculate n */
|
||||
rsa->n=BN_new();
|
||||
if (rsa->n == NULL) goto err;
|
||||
if (!BN_mul(rsa->n,rsa->p,rsa->q,ctx)) goto err;
|
||||
|
||||
/* calculate d */
|
||||
if (!BN_sub(r1,rsa->p,BN_value_one())) goto err; /* p-1 */
|
||||
if (!BN_sub(r2,rsa->q,BN_value_one())) goto err; /* q-1 */
|
||||
if (!BN_mul(r0,r1,r2,ctx)) goto err; /* (p-1)(q-1) */
|
||||
|
||||
/* should not be needed, since gcd(p-1,e) == 1 and gcd(q-1,e) == 1 */
|
||||
/* for (;;)
|
||||
{
|
||||
if (!BN_gcd(r3,r0,rsa->e,ctx)) goto err;
|
||||
if (BN_is_one(r3)) break;
|
||||
|
||||
if (1)
|
||||
{
|
||||
if (!BN_add_word(rsa->e,2L)) goto err;
|
||||
continue;
|
||||
}
|
||||
RSAerr(RSA_F_RSA_GENERATE_KEY,RSA_R_BAD_E_VALUE);
|
||||
goto err;
|
||||
}
|
||||
*/
|
||||
rsa->d=BN_mod_inverse(NULL,rsa->e,r0,ctx2); /* d */
|
||||
if (rsa->d == NULL) goto err;
|
||||
|
||||
/* calculate d mod (p-1) */
|
||||
rsa->dmp1=BN_new();
|
||||
if (rsa->dmp1 == NULL) goto err;
|
||||
if (!BN_mod(rsa->dmp1,rsa->d,r1,ctx)) goto err;
|
||||
|
||||
/* calculate d mod (q-1) */
|
||||
rsa->dmq1=BN_new();
|
||||
if (rsa->dmq1 == NULL) goto err;
|
||||
if (!BN_mod(rsa->dmq1,rsa->d,r2,ctx)) goto err;
|
||||
|
||||
/* calculate inverse of q mod p */
|
||||
rsa->iqmp=BN_mod_inverse(NULL,rsa->q,rsa->p,ctx2);
|
||||
if (rsa->iqmp == NULL) goto err;
|
||||
|
||||
ok=1;
|
||||
err:
|
||||
if (ok == -1)
|
||||
{
|
||||
RSAerr(RSA_F_RSA_GENERATE_KEY,ERR_LIB_BN);
|
||||
ok=0;
|
||||
}
|
||||
BN_CTX_end(ctx);
|
||||
BN_CTX_free(ctx);
|
||||
BN_CTX_free(ctx2);
|
||||
|
||||
if (!ok)
|
||||
{
|
||||
if (rsa != NULL) RSA_free(rsa);
|
||||
return(NULL);
|
||||
}
|
||||
else
|
||||
return(rsa);
|
||||
}
|
||||
|
||||
#endif
|
||||
@ -114,7 +114,10 @@ fips_sha1_selftest.o: ../../include/openssl/opensslv.h
|
||||
fips_sha1_selftest.o: ../../include/openssl/safestack.h
|
||||
fips_sha1_selftest.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
|
||||
fips_sha1_selftest.o: ../../include/openssl/symhacks.h fips_sha1_selftest.c
|
||||
fips_sha1dgst.o: ../../include/openssl/opensslv.h fips_sha1dgst.c
|
||||
fips_sha1dgst.o: ../../include/openssl/e_os2.h
|
||||
fips_sha1dgst.o: ../../include/openssl/opensslconf.h
|
||||
fips_sha1dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/sha.h
|
||||
fips_sha1dgst.o: fips_md32_common.h fips_sha1dgst.c fips_sha_locl.h
|
||||
fips_standalone_sha1.o: ../../include/openssl/e_os2.h
|
||||
fips_standalone_sha1.o: ../../include/openssl/opensslconf.h
|
||||
fips_standalone_sha1.o: ../../include/openssl/sha.h fips_standalone_sha1.c
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user