1 | /*
|
---|
2 | * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
3 | *
|
---|
4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
5 | * this file except in compliance with the License. You can obtain a copy
|
---|
6 | * in the file LICENSE in the source distribution or at
|
---|
7 | * https://www.openssl.org/source/license.html
|
---|
8 | */
|
---|
9 |
|
---|
10 | #include <openssl/bn.h>
|
---|
11 | #include <openssl/err.h>
|
---|
12 | #include "rsa_locl.h"
|
---|
13 |
|
---|
14 | int RSA_check_key(const RSA *key)
|
---|
15 | {
|
---|
16 | return RSA_check_key_ex(key, NULL);
|
---|
17 | }
|
---|
18 |
|
---|
19 | int RSA_check_key_ex(const RSA *key, BN_GENCB *cb)
|
---|
20 | {
|
---|
21 | BIGNUM *i, *j, *k, *l, *m;
|
---|
22 | BN_CTX *ctx;
|
---|
23 | int ret = 1;
|
---|
24 |
|
---|
25 | if (key->p == NULL || key->q == NULL || key->n == NULL
|
---|
26 | || key->e == NULL || key->d == NULL) {
|
---|
27 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_VALUE_MISSING);
|
---|
28 | return 0;
|
---|
29 | }
|
---|
30 |
|
---|
31 | i = BN_new();
|
---|
32 | j = BN_new();
|
---|
33 | k = BN_new();
|
---|
34 | l = BN_new();
|
---|
35 | m = BN_new();
|
---|
36 | ctx = BN_CTX_new();
|
---|
37 | if (i == NULL || j == NULL || k == NULL || l == NULL
|
---|
38 | || m == NULL || ctx == NULL) {
|
---|
39 | ret = -1;
|
---|
40 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, ERR_R_MALLOC_FAILURE);
|
---|
41 | goto err;
|
---|
42 | }
|
---|
43 |
|
---|
44 | if (BN_is_one(key->e)) {
|
---|
45 | ret = 0;
|
---|
46 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_BAD_E_VALUE);
|
---|
47 | }
|
---|
48 | if (!BN_is_odd(key->e)) {
|
---|
49 | ret = 0;
|
---|
50 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_BAD_E_VALUE);
|
---|
51 | }
|
---|
52 |
|
---|
53 | /* p prime? */
|
---|
54 | if (BN_is_prime_ex(key->p, BN_prime_checks, NULL, cb) != 1) {
|
---|
55 | ret = 0;
|
---|
56 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_P_NOT_PRIME);
|
---|
57 | }
|
---|
58 |
|
---|
59 | /* q prime? */
|
---|
60 | if (BN_is_prime_ex(key->q, BN_prime_checks, NULL, cb) != 1) {
|
---|
61 | ret = 0;
|
---|
62 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_Q_NOT_PRIME);
|
---|
63 | }
|
---|
64 |
|
---|
65 | /* n = p*q? */
|
---|
66 | if (!BN_mul(i, key->p, key->q, ctx)) {
|
---|
67 | ret = -1;
|
---|
68 | goto err;
|
---|
69 | }
|
---|
70 | if (BN_cmp(i, key->n) != 0) {
|
---|
71 | ret = 0;
|
---|
72 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_N_DOES_NOT_EQUAL_P_Q);
|
---|
73 | }
|
---|
74 |
|
---|
75 | /* d*e = 1 mod lcm(p-1,q-1)? */
|
---|
76 | if (!BN_sub(i, key->p, BN_value_one())) {
|
---|
77 | ret = -1;
|
---|
78 | goto err;
|
---|
79 | }
|
---|
80 | if (!BN_sub(j, key->q, BN_value_one())) {
|
---|
81 | ret = -1;
|
---|
82 | goto err;
|
---|
83 | }
|
---|
84 |
|
---|
85 | /* now compute k = lcm(i,j) */
|
---|
86 | if (!BN_mul(l, i, j, ctx)) {
|
---|
87 | ret = -1;
|
---|
88 | goto err;
|
---|
89 | }
|
---|
90 | if (!BN_gcd(m, i, j, ctx)) {
|
---|
91 | ret = -1;
|
---|
92 | goto err;
|
---|
93 | }
|
---|
94 | if (!BN_div(k, NULL, l, m, ctx)) { /* remainder is 0 */
|
---|
95 | ret = -1;
|
---|
96 | goto err;
|
---|
97 | }
|
---|
98 | if (!BN_mod_mul(i, key->d, key->e, k, ctx)) {
|
---|
99 | ret = -1;
|
---|
100 | goto err;
|
---|
101 | }
|
---|
102 |
|
---|
103 | if (!BN_is_one(i)) {
|
---|
104 | ret = 0;
|
---|
105 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_D_E_NOT_CONGRUENT_TO_1);
|
---|
106 | }
|
---|
107 |
|
---|
108 | if (key->dmp1 != NULL && key->dmq1 != NULL && key->iqmp != NULL) {
|
---|
109 | /* dmp1 = d mod (p-1)? */
|
---|
110 | if (!BN_sub(i, key->p, BN_value_one())) {
|
---|
111 | ret = -1;
|
---|
112 | goto err;
|
---|
113 | }
|
---|
114 | if (!BN_mod(j, key->d, i, ctx)) {
|
---|
115 | ret = -1;
|
---|
116 | goto err;
|
---|
117 | }
|
---|
118 | if (BN_cmp(j, key->dmp1) != 0) {
|
---|
119 | ret = 0;
|
---|
120 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_DMP1_NOT_CONGRUENT_TO_D);
|
---|
121 | }
|
---|
122 |
|
---|
123 | /* dmq1 = d mod (q-1)? */
|
---|
124 | if (!BN_sub(i, key->q, BN_value_one())) {
|
---|
125 | ret = -1;
|
---|
126 | goto err;
|
---|
127 | }
|
---|
128 | if (!BN_mod(j, key->d, i, ctx)) {
|
---|
129 | ret = -1;
|
---|
130 | goto err;
|
---|
131 | }
|
---|
132 | if (BN_cmp(j, key->dmq1) != 0) {
|
---|
133 | ret = 0;
|
---|
134 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_DMQ1_NOT_CONGRUENT_TO_D);
|
---|
135 | }
|
---|
136 |
|
---|
137 | /* iqmp = q^-1 mod p? */
|
---|
138 | if (!BN_mod_inverse(i, key->q, key->p, ctx)) {
|
---|
139 | ret = -1;
|
---|
140 | goto err;
|
---|
141 | }
|
---|
142 | if (BN_cmp(i, key->iqmp) != 0) {
|
---|
143 | ret = 0;
|
---|
144 | RSAerr(RSA_F_RSA_CHECK_KEY_EX, RSA_R_IQMP_NOT_INVERSE_OF_Q);
|
---|
145 | }
|
---|
146 | }
|
---|
147 |
|
---|
148 | err:
|
---|
149 | BN_free(i);
|
---|
150 | BN_free(j);
|
---|
151 | BN_free(k);
|
---|
152 | BN_free(l);
|
---|
153 | BN_free(m);
|
---|
154 | BN_CTX_free(ctx);
|
---|
155 | return ret;
|
---|
156 | }
|
---|