Skip to content

Commit 673f5ce

Browse files
sjaeckelsjaeckel
authored
Merge pull request #569 from cneveux/rsa_public_exponent
rsa: add rsa key generate with bignumber public exponent
2 parents 165c795 + 75cfdaa commit 673f5ce

File tree

5 files changed

+160
-25
lines changed

5 files changed

+160
-25
lines changed

‎doc/crypt.tex

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4326,10 +4326,27 @@ \subsection{RSA Key Generation}
43264326
trivial math attacks, and not super slow. The \textit{key} parameter is where the constructed key is placed. All keys must be at
43274327
least 128 bytes, and no more than 512 bytes in size (\textit{that is from 1024 to 4096 bits}).
43284328

4329+
\index{rsa\_make\_key\_ubin\_e()}
4330+
\begin{verbatim}
4331+
int rsa_make_key_ubin_e(
4332+
prng_state *prng,
4333+
int wprng,
4334+
int size,
4335+
const unsigned char *e,
4336+
unsigned long elen,
4337+
rsa_key *key);
4338+
\end{verbatim}
4339+
4340+
Where \textit{wprng} is the index into the PRNG descriptor array. The \textit{size} parameter is the size in bytes of the RSA modulus desired.
4341+
The \textit{e} parameter is the hexadecimal buffer of the encryption exponent desired, from 3 upto 255 bits value. Stick with 65537 since it is big enough
4342+
to prevent trivial math attacks, and not super slow. The \textit{elen} parameter is the size in bytes of the encryption exponent \textit{e}.
4343+
The \textit{key} parameter is where the constructed key is placed. All keys must be at
4344+
least 128 bytes, and no more than 512 bytes in size (\textit{that is from 1024 to 4096 bits}).
4345+
43294346
\index{rsa\_free()}
4330-
Note: the \textit{rsa\_make\_key()} function allocates memory at run--time when you make the key. Make sure to call
4331-
\textit{rsa\_free()} (see below) when you are finished with the key. If \textit{rsa\_make\_key()} fails it will automatically
4332-
free the memory allocated.
4347+
Note: the \textit{rsa\_make\_key()} and \textit{rsa\_make\_key\_ubin\_e()} functions allocates memory at run--time when you make the key.
4348+
Make sure to call \textit{rsa\_free()} (see below) when you are finished with the key. If \textit{rsa\_make\_key()} or \textit{rsa\_make\_key\_ubin\_e()}
4349+
fails it will automatically free the memory allocated.
43334350

43344351
\index{PK\_PRIVATE} \index{PK\_PUBLIC}
43354352
There are two types of RSA keys. The types are {\bf PK\_PRIVATE} and {\bf PK\_PUBLIC}. The first type is a private

‎src/headers/tomcrypt_pk.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,8 @@ typedef struct Rsa_key {
4545
} rsa_key;
4646

4747
int rsa_make_key(prng_state *prng, int wprng, int size, long e, rsa_key *key);
48-
48+
int rsa_make_key_ubin_e(prng_state *prng, int wprng, int size,
49+
const unsigned char *e, unsigned long elen, rsa_key *key);
4950
int rsa_get_size(const rsa_key *key);
5051

5152
int rsa_exptmod(const unsigned char *in, unsigned long inlen,

‎src/headers/tomcrypt_private.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,8 @@ int pk_oid_num_to_str(const unsigned long *oid, unsigned long oidlen, char *OID,
223223
#ifdef LTC_MRSA
224224
int rsa_init(rsa_key *key);
225225
void rsa_shrink_key(rsa_key *key);
226+
int rsa_make_key_bn_e(prng_state *prng, int wprng, int size, void *e,
227+
rsa_key *key); /* used by op-tee */
226228
#endif /* LTC_MRSA */
227229

228230
/* ---- DH Routines ---- */

‎src/pk/rsa/rsa_make_key.c

Lines changed: 89 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,51 +9,37 @@
99

1010
#ifdef LTC_MRSA
1111

12-
/**
13-
Create an RSA key
14-
@param prng An active PRNG state
15-
@param wprng The index of the PRNG desired
16-
@param size The size of the modulus (key size) desired (octets)
17-
@param e The "e" value (public key). e==65537 is a good choice
18-
@param key [out] Destination of a newly created private key pair
19-
@return CRYPT_OK if successful, upon error all allocated ram is freed
20-
*/
21-
int rsa_make_key(prng_state *prng, int wprng, int size, long e, rsa_key *key)
12+
static int s_rsa_make_key(prng_state *prng, int wprng, int size, void *e, rsa_key *key)
2213
{
23-
void *p, *q, *tmp1, *tmp2, *tmp3;
14+
void *p, *q, *tmp1, *tmp2;
2415
int err;
2516

2617
LTC_ARGCHK(ltc_mp.name != NULL);
2718
LTC_ARGCHK(key != NULL);
2819
LTC_ARGCHK(size > 0);
2920

30-
if ((e < 3) || ((e & 1) == 0)) {
31-
return CRYPT_INVALID_ARG;
32-
}
33-
3421
if ((err = prng_is_valid(wprng)) != CRYPT_OK) {
3522
return err;
3623
}
3724

38-
if ((err = mp_init_multi(&p, &q, &tmp1, &tmp2, &tmp3, NULL)) != CRYPT_OK) {
25+
if ((err = mp_init_multi(&p, &q, &tmp1, &tmp2, NULL)) != CRYPT_OK) {
3926
return err;
4027
}
4128

4229
/* make primes p and q (optimization provided by Wayne Scott) */
43-
if ((err = mp_set_int(tmp3, e)) != CRYPT_OK) { goto cleanup; } /* tmp3 = e */
4430

4531
/* make prime "p" */
4632
do {
4733
if ((err = rand_prime( p, size/2, prng, wprng)) != CRYPT_OK) { goto cleanup; }
4834
if ((err = mp_sub_d( p, 1, tmp1)) != CRYPT_OK) { goto cleanup; } /* tmp1 = p-1 */
49-
if ((err = mp_gcd( tmp1, tmp3, tmp2)) != CRYPT_OK) { goto cleanup; } /* tmp2 = gcd(p-1, e) */
35+
if ((err = mp_gcd( tmp1, e, tmp2)) != CRYPT_OK) { goto cleanup; } /* tmp2 = gcd(p-1, e) */
5036
} while (mp_cmp_d( tmp2, 1) != 0); /* while e divides p-1 */
5137

5238
/* make prime "q" */
5339
do {
5440
if ((err = rand_prime( q, size/2, prng, wprng)) != CRYPT_OK) { goto cleanup; }
5541
if ((err = mp_sub_d( q, 1, tmp1)) != CRYPT_OK) { goto cleanup; } /* tmp1 = q-1 */
56-
if ((err = mp_gcd( tmp1, tmp3, tmp2)) != CRYPT_OK) { goto cleanup; } /* tmp2 = gcd(q-1, e) */
42+
if ((err = mp_gcd( tmp1, e, tmp2)) != CRYPT_OK) { goto cleanup; } /* tmp2 = gcd(q-1, e) */
5743
} while (mp_cmp_d( tmp2, 1) != 0); /* while e divides q-1 */
5844

5945
/* tmp1 = lcm(p-1, q-1) */
@@ -66,7 +52,7 @@ int rsa_make_key(prng_state *prng, int wprng, int size, long e, rsa_key *key)
6652
goto errkey;
6753
}
6854

69-
if ((err = mp_set_int( key->e, e)) != CRYPT_OK) { goto errkey; } /* key->e = e */
55+
if ((err = mp_copy( e, key->e)) != CRYPT_OK) { goto errkey; } /* key->e = e */
7056
if ((err = mp_invmod( key->e, tmp1, key->d)) != CRYPT_OK) { goto errkey; } /* key->d = 1/e mod lcm(p-1,q-1) */
7157
if ((err = mp_mul( p, q, key->N)) != CRYPT_OK) { goto errkey; } /* key->N = pq */
7258

@@ -90,7 +76,89 @@ int rsa_make_key(prng_state *prng, int wprng, int size, long e, rsa_key *key)
9076
errkey:
9177
rsa_free(key);
9278
cleanup:
93-
mp_clear_multi(tmp3, tmp2, tmp1, q, p, NULL);
79+
mp_clear_multi(tmp2, tmp1, q, p, NULL);
80+
return err;
81+
}
82+
83+
/**
84+
Create an RSA key based on a long public exponent type
85+
@param prng An active PRNG state
86+
@param wprng The index of the PRNG desired
87+
@param size The size of the modulus (key size) desired (octets)
88+
@param e The "e" value (public key). e==65537 is a good choice
89+
@param key [out] Destination of a newly created private key pair
90+
@return CRYPT_OK if successful, upon error all allocated ram is freed
91+
*/
92+
int rsa_make_key(prng_state *prng, int wprng, int size, long e, rsa_key *key)
93+
{
94+
void *tmp_e;
95+
int err;
96+
97+
if ((e < 3) || ((e & 1) == 0)) {
98+
return CRYPT_INVALID_ARG;
99+
}
100+
101+
if ((err = mp_init(&tmp_e)) != CRYPT_OK) {
102+
return err;
103+
}
104+
105+
if ((err = mp_set_int(tmp_e, e)) == CRYPT_OK)
106+
err = s_rsa_make_key(prng, wprng, size, tmp_e, key);
107+
108+
mp_clear(tmp_e);
109+
110+
return err;
111+
}
112+
113+
/**
114+
Create an RSA key based on a hexadecimal public exponent type
115+
@param prng An active PRNG state
116+
@param wprng The index of the PRNG desired
117+
@param size The size of the modulus (key size) desired (octets)
118+
@param e The "e" value (public key). e==65537 is a good choice
119+
@param elen The length of e (octets)
120+
@param key [out] Destination of a newly created private key pair
121+
@return CRYPT_OK if successful, upon error all allocated ram is freed
122+
*/
123+
int rsa_make_key_ubin_e(prng_state *prng, int wprng, int size,
124+
const unsigned char *e, unsigned long elen, rsa_key *key)
125+
{
126+
int err;
127+
void *tmp_e;
128+
129+
if ((err = mp_init(&tmp_e)) != CRYPT_OK) {
130+
return err;
131+
}
132+
133+
if ((err = mp_read_unsigned_bin(tmp_e, (unsigned char *)e, elen)) == CRYPT_OK)
134+
err = rsa_make_key_bn_e(prng, wprng, size, tmp_e, key);
135+
136+
mp_clear(tmp_e);
137+
138+
return err;
139+
}
140+
141+
/**
142+
Create an RSA key based on a bignumber public exponent type
143+
@param prng An active PRNG state
144+
@param wprng The index of the PRNG desired
145+
@param size The size of the modulus (key size) desired (octets)
146+
@param e The "e" value (public key). e==65537 is a good choice
147+
@param key [out] Destination of a newly created private key pair
148+
@return CRYPT_OK if successful, upon error all allocated ram is freed
149+
*/
150+
int rsa_make_key_bn_e(prng_state *prng, int wprng, int size, void *e, rsa_key *key)
151+
{
152+
int err;
153+
int e_bits;
154+
155+
e_bits = mp_count_bits(e);
156+
if ((e_bits > 1 && e_bits < 256) && (mp_get_digit(e, 0) & 1)) {
157+
err = s_rsa_make_key(prng, wprng, size, e, key);
158+
} else {
159+
err = CRYPT_INVALID_ARG;
160+
}
161+
94162
return err;
95163
}
96164

‎tests/rsa_test.c

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -369,6 +369,52 @@ static int s_rsa_issue_301(int prng_idx)
369369
return CRYPT_OK;
370370
}
371371

372+
static int s_rsa_public_ubin_e(int prng_idx)
373+
{
374+
rsa_key key;
375+
unsigned char e[32] = {0};
376+
unsigned long elen = sizeof(e);
377+
378+
/* Check public exponent too small */
379+
e[elen - 1] = 1;
380+
SHOULD_FAIL_WITH(rsa_make_key_ubin_e(&yarrow_prng, prng_idx, 128, e, elen, &key),
381+
CRYPT_INVALID_ARG);
382+
383+
/*
384+
* Generate about 256 bits to check error when public exponent
385+
* overflow.
386+
*/
387+
DO(rng_make_prng(elen * 8, prng_idx, &yarrow_prng, NULL));
388+
LTC_ARGCHK(yarrow_read(e, elen, &yarrow_prng) == elen);
389+
390+
/* Ensure that public exponent is:
391+
* - odd value
392+
* - MSB is even
393+
*/
394+
e[elen - 1] |= 0x1;
395+
e[0] &= ~0x1;
396+
397+
/* Check public exponent overflow */
398+
/* Set high bit of MSB set to get 256 bits, to get e overflow */
399+
e[0] |= 0x80;
400+
SHOULD_FAIL_WITH(rsa_make_key_ubin_e(&yarrow_prng, prng_idx, 128, e, elen, &key),
401+
CRYPT_INVALID_ARG);
402+
403+
404+
/* Check public exponent not odd but e value < 256 bits */
405+
e[elen - 1] &= ~0x1;
406+
e[0] &= ~0x80;
407+
SHOULD_FAIL_WITH(rsa_make_key_ubin_e(&yarrow_prng, prng_idx, 128, e, elen, &key),
408+
CRYPT_INVALID_ARG);
409+
410+
/* Ensure that public exponent is odd value and e value < 256 bits */
411+
e[elen - 1] |= 0x1;
412+
DO(rsa_make_key_ubin_e(&yarrow_prng, prng_idx, 128, e, elen, &key));
413+
rsa_free(&key);
414+
415+
return CRYPT_OK;
416+
}
417+
372418
#ifdef LTC_TEST_READDIR
373419
static int s_rsa_import_x509(const void *in, unsigned long inlen, void *key)
374420
{
@@ -426,6 +472,7 @@ int rsa_test(void)
426472

427473
DO(s_rsa_cryptx_issue_69());
428474
DO(s_rsa_issue_301(prng_idx));
475+
DO(s_rsa_public_ubin_e(prng_idx));
429476

430477
/* make 10 random key */
431478
for (cnt = 0; cnt < 10; cnt++) {

0 commit comments

Comments
 (0)