File: | src/lib/libcrypto/rsa/rsa_gen.c |
Warning: | line 110, column 7 Although the value stored to 'r3' is used in the enclosing expression, the value is never actually read from 'r3' |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: rsa_gen.c,v 1.24 2022/01/07 09:55:32 tb Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. |
4 | * |
5 | * This package is an SSL implementation written |
6 | * by Eric Young (eay@cryptsoft.com). |
7 | * The implementation was written so as to conform with Netscapes SSL. |
8 | * |
9 | * This library is free for commercial and non-commercial use as long as |
10 | * the following conditions are aheared to. The following conditions |
11 | * apply to all code found in this distribution, be it the RC4, RSA, |
12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
13 | * included with this distribution is covered by the same copyright terms |
14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
15 | * |
16 | * Copyright remains Eric Young's, and as such any Copyright notices in |
17 | * the code are not to be removed. |
18 | * If this package is used in a product, Eric Young should be given attribution |
19 | * as the author of the parts of the library used. |
20 | * This can be in the form of a textual message at program startup or |
21 | * in documentation (online or textual) provided with the package. |
22 | * |
23 | * Redistribution and use in source and binary forms, with or without |
24 | * modification, are permitted provided that the following conditions |
25 | * are met: |
26 | * 1. Redistributions of source code must retain the copyright |
27 | * notice, this list of conditions and the following disclaimer. |
28 | * 2. Redistributions in binary form must reproduce the above copyright |
29 | * notice, this list of conditions and the following disclaimer in the |
30 | * documentation and/or other materials provided with the distribution. |
31 | * 3. All advertising materials mentioning features or use of this software |
32 | * must display the following acknowledgement: |
33 | * "This product includes cryptographic software written by |
34 | * Eric Young (eay@cryptsoft.com)" |
35 | * The word 'cryptographic' can be left out if the rouines from the library |
36 | * being used are not cryptographic related :-). |
37 | * 4. If you include any Windows specific code (or a derivative thereof) from |
38 | * the apps directory (application code) you must include an acknowledgement: |
39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
40 | * |
41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
51 | * SUCH DAMAGE. |
52 | * |
53 | * The licence and distribution terms for any publically available version or |
54 | * derivative of this code cannot be changed. i.e. this code cannot simply be |
55 | * copied and put under another distribution licence |
56 | * [including the GNU Public Licence.] |
57 | */ |
58 | |
59 | |
60 | /* NB: these functions have been "upgraded", the deprecated versions (which are |
61 | * compatibility wrappers using these functions) are in rsa_depr.c. |
62 | * - Geoff |
63 | */ |
64 | |
65 | #include <stdio.h> |
66 | #include <time.h> |
67 | |
68 | #include <openssl/bn.h> |
69 | #include <openssl/err.h> |
70 | #include <openssl/rsa.h> |
71 | |
72 | #include "bn_lcl.h" |
73 | #include "rsa_locl.h" |
74 | |
75 | static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb); |
76 | |
77 | /* |
78 | * NB: this wrapper would normally be placed in rsa_lib.c and the static |
79 | * implementation would probably be in rsa_eay.c. Nonetheless, is kept here so |
80 | * that we don't introduce a new linker dependency. Eg. any application that |
81 | * wasn't previously linking object code related to key-generation won't have to |
82 | * now just because key-generation is part of RSA_METHOD. |
83 | */ |
84 | int |
85 | RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) |
86 | { |
87 | if (rsa->meth->rsa_keygen) |
88 | return rsa->meth->rsa_keygen(rsa, bits, e_value, cb); |
89 | return rsa_builtin_keygen(rsa, bits, e_value, cb); |
90 | } |
91 | |
92 | static int |
93 | rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) |
94 | { |
95 | BIGNUM *r0 = NULL((void *)0), *r1 = NULL((void *)0), *r2 = NULL((void *)0), *r3 = NULL((void *)0), *tmp; |
96 | BIGNUM pr0, d, p; |
97 | int bitsp, bitsq, ok = -1, n = 0; |
98 | BN_CTX *ctx = NULL((void *)0); |
99 | |
100 | ctx = BN_CTX_new(); |
101 | if (ctx == NULL((void *)0)) |
102 | goto err; |
103 | BN_CTX_start(ctx); |
104 | if ((r0 = BN_CTX_get(ctx)) == NULL((void *)0)) |
105 | goto err; |
106 | if ((r1 = BN_CTX_get(ctx)) == NULL((void *)0)) |
107 | goto err; |
108 | if ((r2 = BN_CTX_get(ctx)) == NULL((void *)0)) |
109 | goto err; |
110 | if ((r3 = BN_CTX_get(ctx)) == NULL((void *)0)) |
Although the value stored to 'r3' is used in the enclosing expression, the value is never actually read from 'r3' | |
111 | goto err; |
112 | |
113 | bitsp = (bits + 1) / 2; |
114 | bitsq = bits - bitsp; |
115 | |
116 | /* We need the RSA components non-NULL */ |
117 | if (!rsa->n && ((rsa->n = BN_new()) == NULL((void *)0))) |
118 | goto err; |
119 | if (!rsa->d && ((rsa->d = BN_new()) == NULL((void *)0))) |
120 | goto err; |
121 | if (!rsa->e && ((rsa->e = BN_new()) == NULL((void *)0))) |
122 | goto err; |
123 | if (!rsa->p && ((rsa->p = BN_new()) == NULL((void *)0))) |
124 | goto err; |
125 | if (!rsa->q && ((rsa->q = BN_new()) == NULL((void *)0))) |
126 | goto err; |
127 | if (!rsa->dmp1 && ((rsa->dmp1 = BN_new()) == NULL((void *)0))) |
128 | goto err; |
129 | if (!rsa->dmq1 && ((rsa->dmq1 = BN_new()) == NULL((void *)0))) |
130 | goto err; |
131 | if (!rsa->iqmp && ((rsa->iqmp = BN_new()) == NULL((void *)0))) |
132 | goto err; |
133 | |
134 | BN_copy(rsa->e, e_value); |
135 | |
136 | /* generate p and q */ |
137 | for (;;) { |
138 | if (!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL((void *)0), NULL((void *)0), cb)) |
139 | goto err; |
140 | if (!BN_sub(r2, rsa->p, BN_value_one())) |
141 | goto err; |
142 | if (!BN_gcd_ct(r1, r2, rsa->e, ctx)) |
143 | goto err; |
144 | if (BN_is_one(r1)) |
145 | break; |
146 | if (!BN_GENCB_call(cb, 2, n++)) |
147 | goto err; |
148 | } |
149 | if (!BN_GENCB_call(cb, 3, 0)) |
150 | goto err; |
151 | for (;;) { |
152 | /* |
153 | * When generating ridiculously small keys, we can get stuck |
154 | * continually regenerating the same prime values. Check for |
155 | * this and bail if it happens 3 times. |
156 | */ |
157 | unsigned int degenerate = 0; |
158 | do { |
159 | if (!BN_generate_prime_ex(rsa->q, bitsq, 0, NULL((void *)0), NULL((void *)0), |
160 | cb)) |
161 | goto err; |
162 | } while (BN_cmp(rsa->p, rsa->q) == 0 && |
163 | ++degenerate < 3); |
164 | if (degenerate == 3) { |
165 | ok = 0; /* we set our own err */ |
166 | RSAerror(RSA_R_KEY_SIZE_TOO_SMALL)ERR_put_error(4,(0xfff),(120),"/usr/src/lib/libcrypto/rsa/rsa_gen.c" ,166); |
167 | goto err; |
168 | } |
169 | if (!BN_sub(r2, rsa->q, BN_value_one())) |
170 | goto err; |
171 | if (!BN_gcd_ct(r1, r2, rsa->e, ctx)) |
172 | goto err; |
173 | if (BN_is_one(r1)) |
174 | break; |
175 | if (!BN_GENCB_call(cb, 2, n++)) |
176 | goto err; |
177 | } |
178 | if (!BN_GENCB_call(cb, 3, 1)) |
179 | goto err; |
180 | if (BN_cmp(rsa->p, rsa->q) < 0) { |
181 | tmp = rsa->p; |
182 | rsa->p = rsa->q; |
183 | rsa->q = tmp; |
184 | } |
185 | |
186 | /* calculate n */ |
187 | if (!BN_mul(rsa->n, rsa->p, rsa->q, ctx)) |
188 | goto err; |
189 | |
190 | /* calculate d */ |
191 | if (!BN_sub(r1, rsa->p, BN_value_one())) /* p-1 */ |
192 | goto err; |
193 | if (!BN_sub(r2, rsa->q, BN_value_one())) /* q-1 */ |
194 | goto err; |
195 | if (!BN_mul(r0, r1, r2, ctx)) /* (p-1)(q-1) */ |
196 | goto err; |
197 | |
198 | BN_init(&pr0); |
199 | BN_with_flags(&pr0, r0, BN_FLG_CONSTTIME0x04); |
200 | |
201 | if (!BN_mod_inverse_ct(rsa->d, rsa->e, &pr0, ctx)) /* d */ |
202 | goto err; |
203 | |
204 | /* set up d for correct BN_FLG_CONSTTIME flag */ |
205 | BN_init(&d); |
206 | BN_with_flags(&d, rsa->d, BN_FLG_CONSTTIME0x04); |
207 | |
208 | /* calculate d mod (p-1) */ |
209 | if (!BN_mod_ct(rsa->dmp1, &d, r1, ctx)BN_div_ct(((void *)0),(rsa->dmp1),(&d),(r1),(ctx))) |
210 | goto err; |
211 | |
212 | /* calculate d mod (q-1) */ |
213 | if (!BN_mod_ct(rsa->dmq1, &d, r2, ctx)BN_div_ct(((void *)0),(rsa->dmq1),(&d),(r2),(ctx))) |
214 | goto err; |
215 | |
216 | /* calculate inverse of q mod p */ |
217 | BN_init(&p); |
218 | BN_with_flags(&p, rsa->p, BN_FLG_CONSTTIME0x04); |
219 | if (!BN_mod_inverse_ct(rsa->iqmp, rsa->q, &p, ctx)) |
220 | goto err; |
221 | |
222 | ok = 1; |
223 | err: |
224 | if (ok == -1) { |
225 | RSAerror(ERR_LIB_BN)ERR_put_error(4,(0xfff),(3),"/usr/src/lib/libcrypto/rsa/rsa_gen.c" ,225); |
226 | ok = 0; |
227 | } |
228 | if (ctx != NULL((void *)0)) { |
229 | BN_CTX_end(ctx); |
230 | BN_CTX_free(ctx); |
231 | } |
232 | |
233 | return ok; |
234 | } |