File: | src/lib/libcrypto/rsa/rsa_gen.c |
Warning: | line 98, column 7 Although the value stored to 'r3' is used in the enclosing expression, the value is never actually read from 'r3' |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: rsa_gen.c,v 1.30 2023/07/08 12:26:45 beck Exp $ */ |
2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 | * All rights reserved. |
4 | * |
5 | * This package is an SSL implementation written |
6 | * by Eric Young (eay@cryptsoft.com). |
7 | * The implementation was written so as to conform with Netscapes SSL. |
8 | * |
9 | * This library is free for commercial and non-commercial use as long as |
10 | * the following conditions are aheared to. The following conditions |
11 | * apply to all code found in this distribution, be it the RC4, RSA, |
12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
13 | * included with this distribution is covered by the same copyright terms |
14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
15 | * |
16 | * Copyright remains Eric Young's, and as such any Copyright notices in |
17 | * the code are not to be removed. |
18 | * If this package is used in a product, Eric Young should be given attribution |
19 | * as the author of the parts of the library used. |
20 | * This can be in the form of a textual message at program startup or |
21 | * in documentation (online or textual) provided with the package. |
22 | * |
23 | * Redistribution and use in source and binary forms, with or without |
24 | * modification, are permitted provided that the following conditions |
25 | * are met: |
26 | * 1. Redistributions of source code must retain the copyright |
27 | * notice, this list of conditions and the following disclaimer. |
28 | * 2. Redistributions in binary form must reproduce the above copyright |
29 | * notice, this list of conditions and the following disclaimer in the |
30 | * documentation and/or other materials provided with the distribution. |
31 | * 3. All advertising materials mentioning features or use of this software |
32 | * must display the following acknowledgement: |
33 | * "This product includes cryptographic software written by |
34 | * Eric Young (eay@cryptsoft.com)" |
35 | * The word 'cryptographic' can be left out if the rouines from the library |
36 | * being used are not cryptographic related :-). |
37 | * 4. If you include any Windows specific code (or a derivative thereof) from |
38 | * the apps directory (application code) you must include an acknowledgement: |
39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
40 | * |
41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
51 | * SUCH DAMAGE. |
52 | * |
53 | * The licence and distribution terms for any publically available version or |
54 | * derivative of this code cannot be changed. i.e. this code cannot simply be |
55 | * copied and put under another distribution licence |
56 | * [including the GNU Public Licence.] |
57 | */ |
58 | |
59 | #include <stdio.h> |
60 | #include <time.h> |
61 | |
62 | #include <openssl/bn.h> |
63 | #include <openssl/err.h> |
64 | #include <openssl/rsa.h> |
65 | |
66 | #include "bn_local.h" |
67 | #include "rsa_local.h" |
68 | |
69 | static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb); |
70 | |
71 | int |
72 | RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) |
73 | { |
74 | if (rsa->meth->rsa_keygen) |
75 | return rsa->meth->rsa_keygen(rsa, bits, e_value, cb); |
76 | return rsa_builtin_keygen(rsa, bits, e_value, cb); |
77 | } |
78 | LCRYPTO_ALIAS(RSA_generate_key_ex)asm(""); |
79 | |
80 | static int |
81 | rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) |
82 | { |
83 | BIGNUM *r0 = NULL((void *)0), *r1 = NULL((void *)0), *r2 = NULL((void *)0), *r3 = NULL((void *)0), *tmp; |
84 | BIGNUM pr0, d, p; |
85 | int bitsp, bitsq, ok = -1, n = 0; |
86 | BN_CTX *ctx = NULL((void *)0); |
87 | |
88 | ctx = BN_CTX_new(); |
89 | if (ctx == NULL((void *)0)) |
90 | goto err; |
91 | BN_CTX_start(ctx); |
92 | if ((r0 = BN_CTX_get(ctx)) == NULL((void *)0)) |
93 | goto err; |
94 | if ((r1 = BN_CTX_get(ctx)) == NULL((void *)0)) |
95 | goto err; |
96 | if ((r2 = BN_CTX_get(ctx)) == NULL((void *)0)) |
97 | goto err; |
98 | if ((r3 = BN_CTX_get(ctx)) == NULL((void *)0)) |
Although the value stored to 'r3' is used in the enclosing expression, the value is never actually read from 'r3' | |
99 | goto err; |
100 | |
101 | bitsp = (bits + 1) / 2; |
102 | bitsq = bits - bitsp; |
103 | |
104 | /* We need the RSA components non-NULL */ |
105 | if (!rsa->n && ((rsa->n = BN_new()) == NULL((void *)0))) |
106 | goto err; |
107 | if (!rsa->d && ((rsa->d = BN_new()) == NULL((void *)0))) |
108 | goto err; |
109 | if (!rsa->e && ((rsa->e = BN_new()) == NULL((void *)0))) |
110 | goto err; |
111 | if (!rsa->p && ((rsa->p = BN_new()) == NULL((void *)0))) |
112 | goto err; |
113 | if (!rsa->q && ((rsa->q = BN_new()) == NULL((void *)0))) |
114 | goto err; |
115 | if (!rsa->dmp1 && ((rsa->dmp1 = BN_new()) == NULL((void *)0))) |
116 | goto err; |
117 | if (!rsa->dmq1 && ((rsa->dmq1 = BN_new()) == NULL((void *)0))) |
118 | goto err; |
119 | if (!rsa->iqmp && ((rsa->iqmp = BN_new()) == NULL((void *)0))) |
120 | goto err; |
121 | |
122 | if (!bn_copy(rsa->e, e_value)) |
123 | goto err; |
124 | |
125 | /* generate p and q */ |
126 | for (;;) { |
127 | if (!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL((void *)0), NULL((void *)0), cb)) |
128 | goto err; |
129 | if (!BN_sub(r2, rsa->p, BN_value_one())) |
130 | goto err; |
131 | if (!BN_gcd_ct(r1, r2, rsa->e, ctx)) |
132 | goto err; |
133 | if (BN_is_one(r1)) |
134 | break; |
135 | if (!BN_GENCB_call(cb, 2, n++)) |
136 | goto err; |
137 | } |
138 | if (!BN_GENCB_call(cb, 3, 0)) |
139 | goto err; |
140 | for (;;) { |
141 | /* |
142 | * When generating ridiculously small keys, we can get stuck |
143 | * continually regenerating the same prime values. Check for |
144 | * this and bail if it happens 3 times. |
145 | */ |
146 | unsigned int degenerate = 0; |
147 | do { |
148 | if (!BN_generate_prime_ex(rsa->q, bitsq, 0, NULL((void *)0), NULL((void *)0), |
149 | cb)) |
150 | goto err; |
151 | } while (BN_cmp(rsa->p, rsa->q) == 0 && |
152 | ++degenerate < 3); |
153 | if (degenerate == 3) { |
154 | ok = 0; /* we set our own err */ |
155 | RSAerror(RSA_R_KEY_SIZE_TOO_SMALL)ERR_put_error(4,(0xfff),(120),"/usr/src/lib/libcrypto/rsa/rsa_gen.c" ,155); |
156 | goto err; |
157 | } |
158 | if (!BN_sub(r2, rsa->q, BN_value_one())) |
159 | goto err; |
160 | if (!BN_gcd_ct(r1, r2, rsa->e, ctx)) |
161 | goto err; |
162 | if (BN_is_one(r1)) |
163 | break; |
164 | if (!BN_GENCB_call(cb, 2, n++)) |
165 | goto err; |
166 | } |
167 | if (!BN_GENCB_call(cb, 3, 1)) |
168 | goto err; |
169 | if (BN_cmp(rsa->p, rsa->q) < 0) { |
170 | tmp = rsa->p; |
171 | rsa->p = rsa->q; |
172 | rsa->q = tmp; |
173 | } |
174 | |
175 | /* calculate n */ |
176 | if (!BN_mul(rsa->n, rsa->p, rsa->q, ctx)) |
177 | goto err; |
178 | |
179 | /* calculate d */ |
180 | if (!BN_sub(r1, rsa->p, BN_value_one())) /* p-1 */ |
181 | goto err; |
182 | if (!BN_sub(r2, rsa->q, BN_value_one())) /* q-1 */ |
183 | goto err; |
184 | if (!BN_mul(r0, r1, r2, ctx)) /* (p-1)(q-1) */ |
185 | goto err; |
186 | |
187 | BN_init(&pr0); |
188 | BN_with_flags(&pr0, r0, BN_FLG_CONSTTIME0x04); |
189 | |
190 | if (BN_mod_inverse_ct(rsa->d, rsa->e, &pr0, ctx) == NULL((void *)0)) /* d */ |
191 | goto err; |
192 | |
193 | /* set up d for correct BN_FLG_CONSTTIME flag */ |
194 | BN_init(&d); |
195 | BN_with_flags(&d, rsa->d, BN_FLG_CONSTTIME0x04); |
196 | |
197 | /* calculate d mod (p-1) */ |
198 | if (!BN_mod_ct(rsa->dmp1, &d, r1, ctx)) |
199 | goto err; |
200 | |
201 | /* calculate d mod (q-1) */ |
202 | if (!BN_mod_ct(rsa->dmq1, &d, r2, ctx)) |
203 | goto err; |
204 | |
205 | /* calculate inverse of q mod p */ |
206 | BN_init(&p); |
207 | BN_with_flags(&p, rsa->p, BN_FLG_CONSTTIME0x04); |
208 | if (BN_mod_inverse_ct(rsa->iqmp, rsa->q, &p, ctx) == NULL((void *)0)) |
209 | goto err; |
210 | |
211 | ok = 1; |
212 | err: |
213 | if (ok == -1) { |
214 | RSAerror(ERR_LIB_BN)ERR_put_error(4,(0xfff),(3),"/usr/src/lib/libcrypto/rsa/rsa_gen.c" ,214); |
215 | ok = 0; |
216 | } |
217 | if (ctx != NULL((void *)0)) { |
218 | BN_CTX_end(ctx); |
219 | BN_CTX_free(ctx); |
220 | } |
221 | |
222 | return ok; |
223 | } |
224 | |
225 | RSA * |
226 | RSA_generate_key(int bits, unsigned long e_value, |
227 | void (*callback)(int, int, void *), void *cb_arg) |
228 | { |
229 | BN_GENCB cb; |
230 | int i; |
231 | RSA *rsa = RSA_new(); |
232 | BIGNUM *e = BN_new(); |
233 | |
234 | if (!rsa || !e) |
235 | goto err; |
236 | |
237 | /* The problem is when building with 8, 16, or 32 BN_ULONG, |
238 | * unsigned long can be larger */ |
239 | for (i = 0; i < (int)sizeof(unsigned long) * 8; i++) { |
240 | if (e_value & (1UL << i)) |
241 | if (BN_set_bit(e, i) == 0) |
242 | goto err; |
243 | } |
244 | |
245 | BN_GENCB_set_old(&cb, callback, cb_arg); |
246 | |
247 | if (RSA_generate_key_ex(rsa, bits, e, &cb)) { |
248 | BN_free(e); |
249 | return rsa; |
250 | } |
251 | err: |
252 | BN_free(e); |
253 | RSA_free(rsa); |
254 | |
255 | return 0; |
256 | } |
257 | LCRYPTO_ALIAS(RSA_generate_key)asm(""); |