Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2019-10-17 23:54:38 +09:00
parent 41a23ae6f6
commit ee84d0dd84
1357 changed files with 41111 additions and 9603 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/bn/README.pod
+1 -1
View File
@@ -188,7 +188,7 @@ B<a> and the 2*B<n> word arrays B<tmp> and B<r>.
The implementations use the following macros which, depending on the
architecture, may use "long long" C operations or inline assembler.
They are defined in C<bn_lcl.h>.
They are defined in C<bn_local.h>.
mul(B<r>, B<a>, B<w>, B<c>) computes B<w>*B<a>+B<c> and places the
low word of the result in B<r> and the high word in B<c>.
crypto/bn/asm/x86_64-gcc.c
+1 -1
View File
@@ -7,7 +7,7 @@
* https://www.openssl.org/source/license.html
*/
#include "../bn_lcl.h"
#include "../bn_local.h"
#if !(defined(__GNUC__) && __GNUC__>=2)
# include "../bn_asm.c" /* kind of dirty hack for Sun Studio */
#else
crypto/bn/bn_add.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
/* signed add of b to a. */
int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
crypto/bn/bn_asm.c
+1 -1
View File
@@ -10,7 +10,7 @@
#include <assert.h>
#include <openssl/crypto.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
#if defined(BN_LLONG) || defined(BN_UMULT_HIGH)
crypto/bn/bn_blind.c
+1 -1
View File
@@ -9,7 +9,7 @@
#include <openssl/opensslconf.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
#define BN_BLINDING_COUNTER 32
crypto/bn/bn_conv.c
+2 -2
View File
@@ -8,8 +8,8 @@
*/
#include <openssl/err.h>
#include "internal/ctype.h"
#include "bn_lcl.h"
#include "crypto/ctype.h"
#include "bn_local.h"
static const char Hex[] = "0123456789ABCDEF";
crypto/bn/bn_ctx.c
+1 -1
View File
@@ -9,7 +9,7 @@
#include <openssl/trace.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
/*-
* TODO list
crypto/bn/bn_depr.c
+4 -4
View File
@@ -20,7 +20,7 @@ NON_EMPTY_TRANSLATION_UNIT
# include <stdio.h>
# include <time.h>
# include "internal/cryptlib.h"
# include "bn_lcl.h"
# include "bn_local.h"
BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe,
const BIGNUM *add, const BIGNUM *rem,
@@ -52,7 +52,7 @@ int BN_is_prime(const BIGNUM *a, int checks,
{
BN_GENCB cb;
BN_GENCB_set_old(&cb, callback, cb_arg);
return BN_is_prime_ex(a, checks, ctx_passed, &cb);
return bn_check_prime_int(a, checks, ctx_passed, 0, &cb);
}
int BN_is_prime_fasttest(const BIGNUM *a, int checks,
@@ -62,7 +62,7 @@ int BN_is_prime_fasttest(const BIGNUM *a, int checks,
{
BN_GENCB cb;
BN_GENCB_set_old(&cb, callback, cb_arg);
return BN_is_prime_fasttest_ex(a, checks, ctx_passed,
do_trial_division, &cb);
return bn_check_prime_int(a, checks, ctx_passed, do_trial_division, &cb);
}
#endif
crypto/bn/bn_dh.c
+2 -2
View File
@@ -7,12 +7,12 @@
* https://www.openssl.org/source/license.html
*/
#include "bn_lcl.h"
#include "bn_local.h"
#include "internal/nelem.h"
#ifndef OPENSSL_NO_DH
#include <openssl/dh.h>
#include "internal/bn_dh.h"
#include "crypto/bn_dh.h"
/* DH parameters from RFC5114 */
# if BN_BITS2 == 64
crypto/bn/bn_div.c
+1 -1
View File
@@ -10,7 +10,7 @@
#include <assert.h>
#include <openssl/bn.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
/* The old slow way */
#if 0
crypto/bn/bn_exp.c
+2 -2
View File
@@ -8,8 +8,8 @@
*/
#include "internal/cryptlib.h"
#include "internal/constant_time_locl.h"
#include "bn_lcl.h"
#include "internal/constant_time.h"
#include "bn_local.h"
#include <stdlib.h>
#ifdef _WIN32
crypto/bn/bn_exp2.c
+1 -1
View File
@@ -9,7 +9,7 @@
#include <stdio.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
#define TABLE_SIZE 32
crypto/bn/bn_gcd.c
+108 -107
View File
@@ -8,113 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
static BIGNUM *euclid(BIGNUM *a, BIGNUM *b);
int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)
{
BIGNUM *a, *b, *t;
int ret = 0;
bn_check_top(in_a);
bn_check_top(in_b);
BN_CTX_start(ctx);
a = BN_CTX_get(ctx);
b = BN_CTX_get(ctx);
if (b == NULL)
goto err;
if (BN_copy(a, in_a) == NULL)
goto err;
if (BN_copy(b, in_b) == NULL)
goto err;
a->neg = 0;
b->neg = 0;
if (BN_cmp(a, b) < 0) {
t = a;
a = b;
b = t;
}
t = euclid(a, b);
if (t == NULL)
goto err;
if (BN_copy(r, t) == NULL)
goto err;
ret = 1;
err:
BN_CTX_end(ctx);
bn_check_top(r);
return ret;
}
static BIGNUM *euclid(BIGNUM *a, BIGNUM *b)
{
BIGNUM *t;
int shifts = 0;
bn_check_top(a);
bn_check_top(b);
/* 0 <= b <= a */
while (!BN_is_zero(b)) {
/* 0 < b <= a */
if (BN_is_odd(a)) {
if (BN_is_odd(b)) {
if (!BN_sub(a, a, b))
goto err;
if (!BN_rshift1(a, a))
goto err;
if (BN_cmp(a, b) < 0) {
t = a;
a = b;
b = t;
}
} else { /* a odd - b even */
if (!BN_rshift1(b, b))
goto err;
if (BN_cmp(a, b) < 0) {
t = a;
a = b;
b = t;
}
}
} else { /* a is even */
if (BN_is_odd(b)) {
if (!BN_rshift1(a, a))
goto err;
if (BN_cmp(a, b) < 0) {
t = a;
a = b;
b = t;
}
} else { /* a even - b even */
if (!BN_rshift1(a, a))
goto err;
if (!BN_rshift1(b, b))
goto err;
shifts++;
}
}
/* 0 <= b <= a */
}
if (shifts) {
if (!BN_lshift(a, a, shifts))
goto err;
}
bn_check_top(a);
return a;
err:
return NULL;
}
#include "bn_local.h"
/* solves ax == 1 (mod n) */
static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
@@ -621,3 +515,110 @@ static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
bn_check_top(ret);
return ret;
}
/*-
* This function is based on the constant-time GCD work by Bernstein and Yang:
* https://eprint.iacr.org/2019/266
* Generalized fast GCD function to allow even inputs.
* The algorithm first finds the shared powers of 2 between
* the inputs, and removes them, reducing at least one of the
* inputs to an odd value. Then it proceeds to calculate the GCD.
* Before returning the resulting GCD, we take care of adding
* back the powers of two removed at the beginning.
* Note 1: we assume the bit length of both inputs is public information,
* since access to top potentially leaks this information.
*/
int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)
{
BIGNUM *g, *temp = NULL;
BN_ULONG mask = 0;
int i, j, top, rlen, glen, m, bit = 1, delta = 1, cond = 0, shifts = 0, ret = 0;
/* Note 2: zero input corner cases are not constant-time since they are
* handled immediately. An attacker can run an attack under this
* assumption without the need of side-channel information. */
if (BN_is_zero(in_b)) {
ret = BN_copy(r, in_a) != NULL;
r->neg = 0;
return ret;
}
if (BN_is_zero(in_a)) {
ret = BN_copy(r, in_b) != NULL;
r->neg = 0;
return ret;
}
bn_check_top(in_a);
bn_check_top(in_b);
BN_CTX_start(ctx);
temp = BN_CTX_get(ctx);
g = BN_CTX_get(ctx);
/* make r != 0, g != 0 even, so BN_rshift is not a potential nop */
if (g == NULL
|| !BN_lshift1(g, in_b)
|| !BN_lshift1(r, in_a))
goto err;
/* find shared powers of two, i.e. "shifts" >= 1 */
for (i = 0; i < r->dmax && i < g->dmax; i++) {
mask = ~(r->d[i] | g->d[i]);
for (j = 0; j < BN_BITS2; j++) {
bit &= mask;
shifts += bit;
mask >>= 1;
}
}
/* subtract shared powers of two; shifts >= 1 */
if (!BN_rshift(r, r, shifts)
|| !BN_rshift(g, g, shifts))
goto err;
/* expand to biggest nword, with room for a possible extra word */
top = 1 + ((r->top >= g->top) ? r->top : g->top);
if (bn_wexpand(r, top) == NULL
|| bn_wexpand(g, top) == NULL
|| bn_wexpand(temp, top) == NULL)
goto err;
/* re arrange inputs s.t. r is odd */
BN_consttime_swap((~r->d[0]) & 1, r, g, top);
/* compute the number of iterations */
rlen = BN_num_bits(r);
glen = BN_num_bits(g);
m = 4 + 3 * ((rlen >= glen) ? rlen : glen);
for (i = 0; i < m; i++) {
/* conditionally flip signs if delta is positive and g is odd */
cond = (-delta >> (8 * sizeof(delta) - 1)) & g->d[0] & 1;
delta = (-cond & -delta) | ((cond - 1) & delta);
r->neg ^= cond;
/* swap */
BN_consttime_swap(cond, r, g, top);
/* elimination step */
delta++;
if (!BN_add(temp, g, r))
goto err;
BN_consttime_swap(g->d[0] & 1, g, temp, top);
if (!BN_rshift1(g, g))
goto err;
}
/* remove possible negative sign */
r->neg = 0;
/* add powers of 2 removed, then correct the artificial shift */
if (!BN_lshift(r, r, shifts)
|| !BN_rshift1(r, r))
goto err;
ret = 1;
err:
BN_CTX_end(ctx);
bn_check_top(r);
return ret;
}
crypto/bn/bn_gf2m.c
+4 -4
View File
@@ -12,7 +12,7 @@
#include <limits.h>
#include <stdio.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
#ifndef OPENSSL_NO_EC2M
@@ -297,7 +297,7 @@ int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const int p[])
bn_check_top(a);
if (!p[0]) {
if (p[0] == 0) {
/* reduction mod 1 => return 0 */
BN_zero(r);
return 1;
@@ -929,7 +929,7 @@ int BN_GF2m_mod_sqrt_arr(BIGNUM *r, const BIGNUM *a, const int p[],
bn_check_top(a);
if (!p[0]) {
if (p[0] == 0) {
/* reduction mod 1 => return 0 */
BN_zero(r);
return 1;
@@ -988,7 +988,7 @@ int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const int p[],
bn_check_top(a_);
if (!p[0]) {
if (p[0] == 0) {
/* reduction mod 1 => return 0 */
BN_zero(r);
return 1;
crypto/bn/bn_intern.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
/*
* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'.
crypto/bn/bn_kron.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
/* least significant word */
#define BN_lsw(n) (((n)->top == 0) ? (BN_ULONG) 0 : (n)->d[0])
crypto/bn/bn_lib.c
+2 -2
View File
@@ -10,9 +10,9 @@
#include <assert.h>
#include <limits.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
#include <openssl/opensslconf.h>
#include "internal/constant_time_locl.h"
#include "internal/constant_time.h"
/* This stuff appears to be completely unused, so is deprecated */
#if !OPENSSL_API_0_9_8
crypto/bn/bn_lcl.h → crypto/bn/bn_local.h
+7 -4
View File
@@ -7,8 +7,8 @@
* https://www.openssl.org/source/license.html
*/
#ifndef HEADER_BN_LCL_H
# define HEADER_BN_LCL_H
#ifndef OSSL_CRYPTO_BN_LOCAL_H
# define OSSL_CRYPTO_BN_LOCAL_H
/*
* The EDK2 build doesn't use bn_conf.h; it sets THIRTY_TWO_BIT or
@@ -18,10 +18,10 @@
# include <openssl/opensslconf.h>
# if !defined(OPENSSL_SYS_UEFI)
# include "internal/bn_conf.h"
# include "crypto/bn_conf.h"
# endif
# include "internal/bn_int.h"
# include "crypto/bn.h"
/*
* These preprocessor symbols control various aspects of the bignum headers
@@ -665,4 +665,7 @@ static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);
}
int bn_check_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx,
int do_trial_division, BN_GENCB *cb);
#endif
crypto/bn/bn_mod.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
{
crypto/bn/bn_mont.c
+1 -1
View File
@@ -15,7 +15,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
#define MONT_WORD /* use the faster word-based algorithm */
crypto/bn/bn_mpi.c
+1 -1
View File
@@ -9,7 +9,7 @@
#include <stdio.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
int BN_bn2mpi(const BIGNUM *a, unsigned char *d)
{
crypto/bn/bn_mul.c
+1 -1
View File
@@ -9,7 +9,7 @@
#include <assert.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
#if defined(OPENSSL_NO_ASM) || !defined(OPENSSL_BN_ASM_PART_WORDS)
/*
crypto/bn/bn_nist.c
+1 -1
View File
@@ -7,7 +7,7 @@
* https://www.openssl.org/source/license.html
*/
#include "bn_lcl.h"
#include "bn_local.h"
#include "internal/cryptlib.h"
#define BN_NIST_192_TOP (192+BN_BITS2-1)/BN_BITS2
crypto/bn/bn_prime.c
+100 -16
View File
@@ -10,7 +10,7 @@
#include <stdio.h>
#include <time.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
/*
* The quick sieve algorithm approach to weeding out primes is Philip
@@ -24,6 +24,8 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods,
static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods,
const BIGNUM *add, const BIGNUM *rem,
BN_CTX *ctx);
static int bn_is_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx,
int do_trial_division, BN_GENCB *cb);
#define square(x) ((BN_ULONG)(x) * (BN_ULONG)(x))
@@ -65,6 +67,37 @@ const BIGNUM *bn_get0_small_factors(void)
return &_bignum_small_prime_factors;
}
/*
* Calculate the number of trial divisions that gives the best speed in
* combination with Miller-Rabin prime test, based on the sized of the prime.
*/
static int calc_trial_divisions(int bits)
{
if (bits <= 512)
return 64;
else if (bits <= 1024)
return 128;
else if (bits <= 2048)
return 384;
else if (bits <= 4096)
return 1024;
return NUMPRIMES;
}
/*
* Use a minimum of 64 rounds of Miller-Rabin, which should give a false
* positive rate of 2^-128. If the size of the prime is larger than 2048
* the user probably wants a higher security level than 128, so switch
* to 128 rounds giving a false positive rate of 2^-256.
* Returns the number of rounds.
*/
static int bn_mr_min_checks(int bits)
{
if (bits > 2048)
return 128;
return 64;
}
int BN_GENCB_call(BN_GENCB *cb, int a, int b)
{
/* No callback means continue */
@@ -95,7 +128,7 @@ int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe,
int found = 0;
int i, j, c1 = 0;
prime_t *mods = NULL;
int checks = BN_prime_checks_for_size(bits);
int checks = bn_mr_min_checks(bits);
if (bits < 2) {
/* There are no prime numbers this small. */
@@ -134,7 +167,7 @@ int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe,
goto err;
if (!safe) {
i = BN_is_prime_fasttest_ex(ret, checks, ctx, 0, cb);
i = bn_is_prime_int(ret, checks, ctx, 0, cb);
if (i == -1)
goto err;
if (i == 0)
@@ -148,13 +181,13 @@ int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe,
goto err;
for (i = 0; i < checks; i++) {
j = BN_is_prime_fasttest_ex(ret, 1, ctx, 0, cb);
j = bn_is_prime_int(ret, 1, ctx, 0, cb);
if (j == -1)
goto err;
if (j == 0)
goto loop;
j = BN_is_prime_fasttest_ex(t, 1, ctx, 0, cb);
j = bn_is_prime_int(t, 1, ctx, 0, cb);
if (j == -1)
goto err;
if (j == 0)
@@ -191,15 +224,45 @@ int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
}
#endif
#if !OPENSSL_API_3
int BN_is_prime_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
BN_GENCB *cb)
{
return BN_is_prime_fasttest_ex(a, checks, ctx_passed, 0, cb);
return bn_check_prime_int(a, checks, ctx_passed, 0, cb);
}
/* See FIPS 186-4 C.3.1 Miller Rabin Probabilistic Primality Test. */
int BN_is_prime_fasttest_ex(const BIGNUM *w, int checks, BN_CTX *ctx,
int do_trial_division, BN_GENCB *cb)
{
return bn_check_prime_int(w, checks, ctx, do_trial_division, cb);
}
#endif
/* Wrapper around bn_is_prime_int that sets the minimum number of checks */
int bn_check_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx,
int do_trial_division, BN_GENCB *cb)
{
int min_checks = bn_mr_min_checks(BN_num_bits(w));
if (checks < min_checks)
checks = min_checks;
return bn_is_prime_int(w, checks, ctx, do_trial_division, cb);
}
int BN_check_prime(const BIGNUM *p, BN_CTX *ctx, BN_GENCB *cb)
{
return bn_check_prime_int(p, 0, ctx, 1, cb);
}
/*
* Tests that |w| is probably prime
* See FIPS 186-4 C.3.1 Miller Rabin Probabilistic Primality Test.
*
* Returns 0 when composite, 1 when probable prime, -1 on error.
*/
static int bn_is_prime_int(const BIGNUM *w, int checks, BN_CTX *ctx,
int do_trial_division, BN_GENCB *cb)
{
int i, status, ret = -1;
#ifndef FIPS_MODE
@@ -226,7 +289,9 @@ int BN_is_prime_fasttest_ex(const BIGNUM *w, int checks, BN_CTX *ctx,
/* first look for small factors */
if (do_trial_division) {
for (i = 1; i < NUMPRIMES; i++) {
int trial_divisions = calc_trial_divisions(BN_num_bits(w));
for (i = 1; i < trial_divisions; i++) {
BN_ULONG mod = BN_mod_word(w, primes[i]);
if (mod == (BN_ULONG)-1)
return -1;
@@ -313,8 +378,8 @@ int bn_miller_rabin_is_prime(const BIGNUM *w, int iterations, BN_CTX *ctx,
if (mont == NULL || !BN_MONT_CTX_set(mont, w, ctx))
goto err;
if (iterations == BN_prime_checks)
iterations = BN_prime_checks_for_size(BN_num_bits(w));
if (iterations == 0)
iterations = bn_mr_min_checks(BN_num_bits(w));
/* (Step 4) */
for (i = 0; i < iterations; ++i) {
@@ -398,12 +463,22 @@ err:
return ret;
}
/*
* Generate a random number of |bits| bits that is probably prime by sieving.
* If |safe| != 0, it generates a safe prime.
* |mods| is a preallocated array that gets reused when called again.
*
* The probably prime is saved in |rnd|.
*
* Returns 1 on success and 0 on error.
*/
static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods,
BN_CTX *ctx)
{
int i;
BN_ULONG delta;
BN_ULONG maxdelta = BN_MASK2 - primes[NUMPRIMES - 1];
int trial_divisions = calc_trial_divisions(bits);
BN_ULONG maxdelta = BN_MASK2 - primes[trial_divisions - 1];
again:
/* TODO: Not all primes are private */
@@ -412,7 +487,7 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods,
if (safe && !BN_set_bit(rnd, 1))
return 0;
/* we now have a random number 'rnd' to test. */
for (i = 1; i < NUMPRIMES; i++) {
for (i = 1; i < trial_divisions; i++) {
BN_ULONG mod = BN_mod_word(rnd, (BN_ULONG)primes[i]);
if (mod == (BN_ULONG)-1)
return 0;
@@ -420,7 +495,7 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods,
}
delta = 0;
loop:
for (i = 1; i < NUMPRIMES; i++) {
for (i = 1; i < trial_divisions; i++) {
/*
* check that rnd is a prime and also that
* gcd(rnd-1,primes) == 1 (except for 2)
@@ -447,6 +522,14 @@ static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods,
return 1;
}
/*
* Generate a random number |rnd| of |bits| bits that is probably prime
* and satisfies |rnd| % |add| == |rem| by sieving.
* If |safe| != 0, it generates a safe prime.
* |mods| is a preallocated array that gets reused when called again.
*
* Returns 1 on success and 0 on error.
*/
static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods,
const BIGNUM *add, const BIGNUM *rem,
BN_CTX *ctx)
@@ -454,7 +537,8 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods,
int i, ret = 0;
BIGNUM *t1;
BN_ULONG delta;
BN_ULONG maxdelta = BN_MASK2 - primes[NUMPRIMES - 1];
int trial_divisions = calc_trial_divisions(bits);
BN_ULONG maxdelta = BN_MASK2 - primes[trial_divisions - 1];
BN_CTX_start(ctx);
if ((t1 = BN_CTX_get(ctx)) == NULL)
@@ -488,7 +572,7 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods,
}
/* we now have a random number 'rnd' to test. */
for (i = 1; i < NUMPRIMES; i++) {
for (i = 1; i < trial_divisions; i++) {
BN_ULONG mod = BN_mod_word(rnd, (BN_ULONG)primes[i]);
if (mod == (BN_ULONG)-1)
goto err;
@@ -496,7 +580,7 @@ static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods,
}
delta = 0;
loop:
for (i = 1; i < NUMPRIMES; i++) {
for (i = 1; i < trial_divisions; i++) {
/* check that rnd is a prime */
if (bits <= 31 && delta <= 0x7fffffff
&& square(primes[i]) > BN_get_word(rnd) + delta)
crypto/bn/bn_print.c
+1 -1
View File
@@ -9,7 +9,7 @@
#include <stdio.h>
#include <openssl/bio.h>
#include "bn_lcl.h"
#include "bn_local.h"
static const char Hex[] = "0123456789ABCDEF";
crypto/bn/bn_rand.c
+2 -2
View File
@@ -10,8 +10,8 @@
#include <stdio.h>
#include <time.h>
#include "internal/cryptlib.h"
#include "internal/rand_int.h"
#include "bn_lcl.h"
#include "crypto/rand.h"
#include "bn_local.h"
#include <openssl/rand.h>
#include <openssl/sha.h>
#include <openssl/evp.h>
crypto/bn/bn_recp.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
void BN_RECP_CTX_init(BN_RECP_CTX *recp)
{
crypto/bn/bn_rsa_fips186_4.c
+5 -48
View File
@@ -29,8 +29,8 @@
*/
#include <stdio.h>
#include <openssl/bn.h>
#include "bn_lcl.h"
#include "internal/bn_int.h"
#include "bn_local.h"
#include "crypto/bn.h"
/*
* FIPS 186-4 Table B.1. "Min length of auxiliary primes p1, p2, q1, q2".
@@ -67,44 +67,6 @@ static int bn_rsa_fips186_4_aux_prime_max_sum_size_for_prob_primes(int nbits)
return 0;
}
/*
* FIPS 186-4 Table C.3 for error probability of 2^-100
* Minimum number of Miller Rabin Rounds for p1, p2, q1 & q2.
*
* Params:
* aux_prime_bits The auxiliary prime size in bits.
* Returns:
* The minimum number of Miller Rabin Rounds for an auxiliary prime, or
* 0 if aux_prime_bits is invalid.
*/
static int bn_rsa_fips186_4_aux_prime_MR_min_checks(int aux_prime_bits)
{
if (aux_prime_bits > 170)
return 27;
if (aux_prime_bits > 140)
return 32;
return 0; /* Error case */
}
/*
* FIPS 186-4 Table C.3 for error probability of 2^-100
* Minimum number of Miller Rabin Rounds for p, q.
*
* Params:
* nbits The key size in bits.
* Returns:
* The minimum number of Miller Rabin Rounds required,
* or 0 if nbits is invalid.
*/
int bn_rsa_fips186_4_prime_MR_min_checks(int nbits)
{
if (nbits >= 3072) /* > 170 */
return 3;
if (nbits == 2048) /* > 140 */
return 4;
return 0; /* Error case */
}
/*
* Find the first odd integer that is a probable prime.
*
@@ -123,9 +85,8 @@ static int bn_rsa_fips186_4_find_aux_prob_prime(const BIGNUM *Xp1,
{
int ret = 0;
int i = 0;
int checks = bn_rsa_fips186_4_aux_prime_MR_min_checks(BN_num_bits(Xp1));
if (checks == 0 || BN_copy(p1, Xp1) == NULL)
if (BN_copy(p1, Xp1) == NULL)
return 0;
/* Find the first odd number >= Xp1 that is probably prime */
@@ -133,7 +94,7 @@ static int bn_rsa_fips186_4_find_aux_prob_prime(const BIGNUM *Xp1,
i++;
BN_GENCB_call(cb, 0, i);
/* MR test with trial division */
if (BN_is_prime_fasttest_ex(p1, checks, ctx, 1, cb))
if (BN_check_prime(p1, ctx, cb))
break;
/* Get next odd number */
if (!BN_add_word(p1, 2))
@@ -259,11 +220,8 @@ int bn_rsa_fips186_4_derive_prime(BIGNUM *Y, BIGNUM *X, const BIGNUM *Xin,
int ret = 0;
int i, imax;
int bits = nlen >> 1;
int checks = bn_rsa_fips186_4_prime_MR_min_checks(nlen);
BIGNUM *tmp, *R, *r1r2x2, *y1, *r1x2;
if (checks == 0)
return 0;
BN_CTX_start(ctx);
R = BN_CTX_get(ctx);
@@ -331,8 +289,7 @@ int bn_rsa_fips186_4_derive_prime(BIGNUM *Y, BIGNUM *X, const BIGNUM *Xin,
|| !BN_sub_word(y1, 1)
|| !BN_gcd(tmp, y1, e, ctx))
goto err;
if (BN_is_one(tmp)
&& BN_is_prime_fasttest_ex(Y, checks, ctx, 1, cb))
if (BN_is_one(tmp) && BN_check_prime(Y, ctx, cb))
goto end;
/* (Step 8-10) */
if (++i >= imax || !BN_add(Y, Y, r1r2x2))
crypto/bn/bn_shift.c
+6 -44
View File
@@ -9,7 +9,7 @@
#include <assert.h>
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
int BN_lshift1(BIGNUM *r, const BIGNUM *a)
{
@@ -152,57 +152,19 @@ int bn_lshift_fixed_top(BIGNUM *r, const BIGNUM *a, int n)
int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
{
int i, j, nw, lb, rb;
BN_ULONG *t, *f;
BN_ULONG l, tmp;
bn_check_top(r);
bn_check_top(a);
int ret = 0;
if (n < 0) {
BNerr(BN_F_BN_RSHIFT, BN_R_INVALID_SHIFT);
return 0;
}
nw = n / BN_BITS2;
rb = n % BN_BITS2;
lb = BN_BITS2 - rb;
if (nw >= a->top || a->top == 0) {
BN_zero(r);
return 1;
}
i = (BN_num_bits(a) - n + (BN_BITS2 - 1)) / BN_BITS2;
if (r != a) {
if (bn_wexpand(r, i) == NULL)
return 0;
r->neg = a->neg;
} else {
if (n == 0)
return 1; /* or the copying loop will go berserk */
}
ret = bn_rshift_fixed_top(r, a, n);
f = &(a->d[nw]);
t = r->d;
j = a->top - nw;
r->top = i;
if (rb == 0) {
for (i = j; i != 0; i--)
*(t++) = *(f++);
} else {
l = *(f++);
for (i = j - 1; i != 0; i--) {
tmp = (l >> rb) & BN_MASK2;
l = *(f++);
*(t++) = (tmp | (l << lb)) & BN_MASK2;
}
if ((l = (l >> rb) & BN_MASK2))
*(t) = l;
}
if (!r->top)
r->neg = 0; /* don't allow negative zero */
bn_correct_top(r);
bn_check_top(r);
return 1;
return ret;
}
/*
crypto/bn/bn_sqr.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
/* r must not be a */
/*
crypto/bn/bn_sqrt.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
/*
crypto/bn/bn_srp.c
+2 -2
View File
@@ -7,13 +7,13 @@
* https://www.openssl.org/source/license.html
*/
#include "bn_lcl.h"
#include "bn_local.h"
#include "internal/nelem.h"
#ifndef OPENSSL_NO_SRP
#include <openssl/srp.h>
#include "internal/bn_srp.h"
#include "crypto/bn_srp.h"
# if (BN_BYTES == 8)
# if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
crypto/bn/bn_word.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#include "internal/cryptlib.h"
#include "bn_lcl.h"
#include "bn_local.h"
BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w)
{
crypto/bn/bn_x931p.c
+3 -3
View File
@@ -9,7 +9,7 @@
#include <stdio.h>
#include <openssl/bn.h>
#include "bn_lcl.h"
#include "bn_local.h"
/* X9.31 routines for prime derivation */
@@ -30,7 +30,7 @@ static int bn_x931_derive_pi(BIGNUM *pi, const BIGNUM *Xpi, BN_CTX *ctx,
i++;
BN_GENCB_call(cb, 0, i);
/* NB 27 MR is specified in X9.31 */
is_prime = BN_is_prime_fasttest_ex(pi, 27, ctx, 1, cb);
is_prime = BN_check_prime(pi, ctx, cb);
if (is_prime < 0)
return 0;
if (is_prime)
@@ -131,7 +131,7 @@ int BN_X931_derive_prime_ex(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
* offering similar or better guarantees 50 MR is considerably
* better.
*/
int r = BN_is_prime_fasttest_ex(p, 50, ctx, 1, cb);
int r = BN_check_prime(p, ctx, cb);
if (r < 0)
goto err;
if (r)
crypto/bn/build.info
+5 -2
View File
@@ -108,9 +108,12 @@ $COMMON=bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c \
bn_const.c bn_x931p.c bn_intern.c bn_dh.c \
bn_rsa_fips186_4.c $BNASM
SOURCE[../../libcrypto]=$COMMON bn_print.c bn_err.c bn_depr.c bn_srp.c
SOURCE[../../providers/libfips.a]=$COMMON
# Implementations are now spread across several libraries, so the defines
# need to be applied to all affected libraries and modules.
DEFINE[../../libcrypto]=$BNDEF
SOURCE[../../providers/fips]=$COMMON
DEFINE[../../providers/fips]=$BNDEF
DEFINE[../../providers/libfips.a]=$BNDEF
DEFINE[../../providers/libimplementations.a]=$BNDEF
INCLUDE[../../libcrypto]=../../crypto/include
crypto/bn/rsaz_exp.h
+2 -2
View File
@@ -12,8 +12,8 @@
* (2) University of Haifa, Israel
*/
#ifndef RSAZ_EXP_H
# define RSAZ_EXP_H
#ifndef OSSL_CRYPTO_BN_RSAZ_EXP_H
# define OSSL_CRYPTO_BN_RSAZ_EXP_H
# undef RSAZ_ENABLED
# if defined(OPENSSL_BN_ASM_MONT) && \