1 | /*
|
---|
2 | * Helper functions for the RSA module
|
---|
3 | *
|
---|
4 | * Copyright (C) 2006-2017, ARM Limited, All Rights Reserved
|
---|
5 | * SPDX-License-Identifier: Apache-2.0
|
---|
6 | *
|
---|
7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may
|
---|
8 | * not use this file except in compliance with the License.
|
---|
9 | * You may obtain a copy of the License at
|
---|
10 | *
|
---|
11 | * http://www.apache.org/licenses/LICENSE-2.0
|
---|
12 | *
|
---|
13 | * Unless required by applicable law or agreed to in writing, software
|
---|
14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
---|
15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
---|
16 | * See the License for the specific language governing permissions and
|
---|
17 | * limitations under the License.
|
---|
18 | *
|
---|
19 | * This file is part of mbed TLS (https://tls.mbed.org)
|
---|
20 | *
|
---|
21 | */
|
---|
22 |
|
---|
23 | #if !defined(MBEDTLS_CONFIG_FILE)
|
---|
24 | #include "mbedtls/config.h"
|
---|
25 | #else
|
---|
26 | #include MBEDTLS_CONFIG_FILE
|
---|
27 | #endif
|
---|
28 |
|
---|
29 | #if defined(MBEDTLS_RSA_C)
|
---|
30 |
|
---|
31 | #include "mbedtls/rsa.h"
|
---|
32 | #include "mbedtls/bignum.h"
|
---|
33 | #include "mbedtls/rsa_internal.h"
|
---|
34 |
|
---|
35 | /*
|
---|
36 | * Compute RSA prime factors from public and private exponents
|
---|
37 | *
|
---|
38 | * Summary of algorithm:
|
---|
39 | * Setting F := lcm(P-1,Q-1), the idea is as follows:
|
---|
40 | *
|
---|
41 | * (a) For any 1 <= X < N with gcd(X,N)=1, we have X^F = 1 modulo N, so X^(F/2)
|
---|
42 | * is a square root of 1 in Z/NZ. Since Z/NZ ~= Z/PZ x Z/QZ by CRT and the
|
---|
43 | * square roots of 1 in Z/PZ and Z/QZ are +1 and -1, this leaves the four
|
---|
44 | * possibilities X^(F/2) = (+-1, +-1). If it happens that X^(F/2) = (-1,+1)
|
---|
45 | * or (+1,-1), then gcd(X^(F/2) + 1, N) will be equal to one of the prime
|
---|
46 | * factors of N.
|
---|
47 | *
|
---|
48 | * (b) If we don't know F/2 but (F/2) * K for some odd (!) K, then the same
|
---|
49 | * construction still applies since (-)^K is the identity on the set of
|
---|
50 | * roots of 1 in Z/NZ.
|
---|
51 | *
|
---|
52 | * The public and private key primitives (-)^E and (-)^D are mutually inverse
|
---|
53 | * bijections on Z/NZ if and only if (-)^(DE) is the identity on Z/NZ, i.e.
|
---|
54 | * if and only if DE - 1 is a multiple of F, say DE - 1 = F * L.
|
---|
55 | * Splitting L = 2^t * K with K odd, we have
|
---|
56 | *
|
---|
57 | * DE - 1 = FL = (F/2) * (2^(t+1)) * K,
|
---|
58 | *
|
---|
59 | * so (F / 2) * K is among the numbers
|
---|
60 | *
|
---|
61 | * (DE - 1) >> 1, (DE - 1) >> 2, ..., (DE - 1) >> ord
|
---|
62 | *
|
---|
63 | * where ord is the order of 2 in (DE - 1).
|
---|
64 | * We can therefore iterate through these numbers apply the construction
|
---|
65 | * of (a) and (b) above to attempt to factor N.
|
---|
66 | *
|
---|
67 | */
|
---|
68 | int mbedtls_rsa_deduce_primes( mbedtls_mpi const *N,
|
---|
69 | mbedtls_mpi const *E, mbedtls_mpi const *D,
|
---|
70 | mbedtls_mpi *P, mbedtls_mpi *Q )
|
---|
71 | {
|
---|
72 | int ret = 0;
|
---|
73 |
|
---|
74 | uint16_t attempt; /* Number of current attempt */
|
---|
75 | uint16_t iter; /* Number of squares computed in the current attempt */
|
---|
76 |
|
---|
77 | uint16_t order; /* Order of 2 in DE - 1 */
|
---|
78 |
|
---|
79 | mbedtls_mpi T; /* Holds largest odd divisor of DE - 1 */
|
---|
80 | mbedtls_mpi K; /* Temporary holding the current candidate */
|
---|
81 |
|
---|
82 | const unsigned char primes[] = { 2,
|
---|
83 | 3, 5, 7, 11, 13, 17, 19, 23,
|
---|
84 | 29, 31, 37, 41, 43, 47, 53, 59,
|
---|
85 | 61, 67, 71, 73, 79, 83, 89, 97,
|
---|
86 | 101, 103, 107, 109, 113, 127, 131, 137,
|
---|
87 | 139, 149, 151, 157, 163, 167, 173, 179,
|
---|
88 | 181, 191, 193, 197, 199, 211, 223, 227,
|
---|
89 | 229, 233, 239, 241, 251
|
---|
90 | };
|
---|
91 |
|
---|
92 | const size_t num_primes = sizeof( primes ) / sizeof( *primes );
|
---|
93 |
|
---|
94 | if( P == NULL || Q == NULL || P->p != NULL || Q->p != NULL )
|
---|
95 | return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
|
---|
96 |
|
---|
97 | if( mbedtls_mpi_cmp_int( N, 0 ) <= 0 ||
|
---|
98 | mbedtls_mpi_cmp_int( D, 1 ) <= 0 ||
|
---|
99 | mbedtls_mpi_cmp_mpi( D, N ) >= 0 ||
|
---|
100 | mbedtls_mpi_cmp_int( E, 1 ) <= 0 ||
|
---|
101 | mbedtls_mpi_cmp_mpi( E, N ) >= 0 )
|
---|
102 | {
|
---|
103 | return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
|
---|
104 | }
|
---|
105 |
|
---|
106 | /*
|
---|
107 | * Initializations and temporary changes
|
---|
108 | */
|
---|
109 |
|
---|
110 | mbedtls_mpi_init( &K );
|
---|
111 | mbedtls_mpi_init( &T );
|
---|
112 |
|
---|
113 | /* T := DE - 1 */
|
---|
114 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, D, E ) );
|
---|
115 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &T, &T, 1 ) );
|
---|
116 |
|
---|
117 | if( ( order = (uint16_t) mbedtls_mpi_lsb( &T ) ) == 0 )
|
---|
118 | {
|
---|
119 | ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
|
---|
120 | goto cleanup;
|
---|
121 | }
|
---|
122 |
|
---|
123 | /* After this operation, T holds the largest odd divisor of DE - 1. */
|
---|
124 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &T, order ) );
|
---|
125 |
|
---|
126 | /*
|
---|
127 | * Actual work
|
---|
128 | */
|
---|
129 |
|
---|
130 | /* Skip trying 2 if N == 1 mod 8 */
|
---|
131 | attempt = 0;
|
---|
132 | if( N->p[0] % 8 == 1 )
|
---|
133 | attempt = 1;
|
---|
134 |
|
---|
135 | for( ; attempt < num_primes; ++attempt )
|
---|
136 | {
|
---|
137 | mbedtls_mpi_lset( &K, primes[attempt] );
|
---|
138 |
|
---|
139 | /* Check if gcd(K,N) = 1 */
|
---|
140 | MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( P, &K, N ) );
|
---|
141 | if( mbedtls_mpi_cmp_int( P, 1 ) != 0 )
|
---|
142 | continue;
|
---|
143 |
|
---|
144 | /* Go through K^T + 1, K^(2T) + 1, K^(4T) + 1, ...
|
---|
145 | * and check whether they have nontrivial GCD with N. */
|
---|
146 | MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &K, &K, &T, N,
|
---|
147 | Q /* temporarily use Q for storing Montgomery
|
---|
148 | * multiplication helper values */ ) );
|
---|
149 |
|
---|
150 | for( iter = 1; iter <= order; ++iter )
|
---|
151 | {
|
---|
152 | /* If we reach 1 prematurely, there's no point
|
---|
153 | * in continuing to square K */
|
---|
154 | if( mbedtls_mpi_cmp_int( &K, 1 ) == 0 )
|
---|
155 | break;
|
---|
156 |
|
---|
157 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &K, &K, 1 ) );
|
---|
158 | MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( P, &K, N ) );
|
---|
159 |
|
---|
160 | if( mbedtls_mpi_cmp_int( P, 1 ) == 1 &&
|
---|
161 | mbedtls_mpi_cmp_mpi( P, N ) == -1 )
|
---|
162 | {
|
---|
163 | /*
|
---|
164 | * Have found a nontrivial divisor P of N.
|
---|
165 | * Set Q := N / P.
|
---|
166 | */
|
---|
167 |
|
---|
168 | MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( Q, NULL, N, P ) );
|
---|
169 | goto cleanup;
|
---|
170 | }
|
---|
171 |
|
---|
172 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, &K, 1 ) );
|
---|
173 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &K, &K, &K ) );
|
---|
174 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &K, &K, N ) );
|
---|
175 | }
|
---|
176 |
|
---|
177 | /*
|
---|
178 | * If we get here, then either we prematurely aborted the loop because
|
---|
179 | * we reached 1, or K holds primes[attempt]^(DE - 1) mod N, which must
|
---|
180 | * be 1 if D,E,N were consistent.
|
---|
181 | * Check if that's the case and abort if not, to avoid very long,
|
---|
182 | * yet eventually failing, computations if N,D,E were not sane.
|
---|
183 | */
|
---|
184 | if( mbedtls_mpi_cmp_int( &K, 1 ) != 0 )
|
---|
185 | {
|
---|
186 | break;
|
---|
187 | }
|
---|
188 | }
|
---|
189 |
|
---|
190 | ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
|
---|
191 |
|
---|
192 | cleanup:
|
---|
193 |
|
---|
194 | mbedtls_mpi_free( &K );
|
---|
195 | mbedtls_mpi_free( &T );
|
---|
196 | return( ret );
|
---|
197 | }
|
---|
198 |
|
---|
199 | /*
|
---|
200 | * Given P, Q and the public exponent E, deduce D.
|
---|
201 | * This is essentially a modular inversion.
|
---|
202 | */
|
---|
203 | int mbedtls_rsa_deduce_private_exponent( mbedtls_mpi const *P,
|
---|
204 | mbedtls_mpi const *Q,
|
---|
205 | mbedtls_mpi const *E,
|
---|
206 | mbedtls_mpi *D )
|
---|
207 | {
|
---|
208 | int ret = 0;
|
---|
209 | mbedtls_mpi K, L;
|
---|
210 |
|
---|
211 | if( D == NULL || mbedtls_mpi_cmp_int( D, 0 ) != 0 )
|
---|
212 | return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
|
---|
213 |
|
---|
214 | if( mbedtls_mpi_cmp_int( P, 1 ) <= 0 ||
|
---|
215 | mbedtls_mpi_cmp_int( Q, 1 ) <= 0 ||
|
---|
216 | mbedtls_mpi_cmp_int( E, 0 ) == 0 )
|
---|
217 | {
|
---|
218 | return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
|
---|
219 | }
|
---|
220 |
|
---|
221 | mbedtls_mpi_init( &K );
|
---|
222 | mbedtls_mpi_init( &L );
|
---|
223 |
|
---|
224 | /* Temporarily put K := P-1 and L := Q-1 */
|
---|
225 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, P, 1 ) );
|
---|
226 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &L, Q, 1 ) );
|
---|
227 |
|
---|
228 | /* Temporarily put D := gcd(P-1, Q-1) */
|
---|
229 | MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( D, &K, &L ) );
|
---|
230 |
|
---|
231 | /* K := LCM(P-1, Q-1) */
|
---|
232 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &K, &K, &L ) );
|
---|
233 | MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &K, NULL, &K, D ) );
|
---|
234 |
|
---|
235 | /* Compute modular inverse of E in LCM(P-1, Q-1) */
|
---|
236 | MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( D, E, &K ) );
|
---|
237 |
|
---|
238 | cleanup:
|
---|
239 |
|
---|
240 | mbedtls_mpi_free( &K );
|
---|
241 | mbedtls_mpi_free( &L );
|
---|
242 |
|
---|
243 | return( ret );
|
---|
244 | }
|
---|
245 |
|
---|
246 | /*
|
---|
247 | * Check that RSA CRT parameters are in accordance with core parameters.
|
---|
248 | */
|
---|
249 | int mbedtls_rsa_validate_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q,
|
---|
250 | const mbedtls_mpi *D, const mbedtls_mpi *DP,
|
---|
251 | const mbedtls_mpi *DQ, const mbedtls_mpi *QP )
|
---|
252 | {
|
---|
253 | int ret = 0;
|
---|
254 |
|
---|
255 | mbedtls_mpi K, L;
|
---|
256 | mbedtls_mpi_init( &K );
|
---|
257 | mbedtls_mpi_init( &L );
|
---|
258 |
|
---|
259 | /* Check that DP - D == 0 mod P - 1 */
|
---|
260 | if( DP != NULL )
|
---|
261 | {
|
---|
262 | if( P == NULL )
|
---|
263 | {
|
---|
264 | ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
|
---|
265 | goto cleanup;
|
---|
266 | }
|
---|
267 |
|
---|
268 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, P, 1 ) );
|
---|
269 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &L, DP, D ) );
|
---|
270 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &L, &L, &K ) );
|
---|
271 |
|
---|
272 | if( mbedtls_mpi_cmp_int( &L, 0 ) != 0 )
|
---|
273 | {
|
---|
274 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
275 | goto cleanup;
|
---|
276 | }
|
---|
277 | }
|
---|
278 |
|
---|
279 | /* Check that DQ - D == 0 mod Q - 1 */
|
---|
280 | if( DQ != NULL )
|
---|
281 | {
|
---|
282 | if( Q == NULL )
|
---|
283 | {
|
---|
284 | ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
|
---|
285 | goto cleanup;
|
---|
286 | }
|
---|
287 |
|
---|
288 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, Q, 1 ) );
|
---|
289 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &L, DQ, D ) );
|
---|
290 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &L, &L, &K ) );
|
---|
291 |
|
---|
292 | if( mbedtls_mpi_cmp_int( &L, 0 ) != 0 )
|
---|
293 | {
|
---|
294 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
295 | goto cleanup;
|
---|
296 | }
|
---|
297 | }
|
---|
298 |
|
---|
299 | /* Check that QP * Q - 1 == 0 mod P */
|
---|
300 | if( QP != NULL )
|
---|
301 | {
|
---|
302 | if( P == NULL || Q == NULL )
|
---|
303 | {
|
---|
304 | ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
|
---|
305 | goto cleanup;
|
---|
306 | }
|
---|
307 |
|
---|
308 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &K, QP, Q ) );
|
---|
309 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, &K, 1 ) );
|
---|
310 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &K, &K, P ) );
|
---|
311 | if( mbedtls_mpi_cmp_int( &K, 0 ) != 0 )
|
---|
312 | {
|
---|
313 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
314 | goto cleanup;
|
---|
315 | }
|
---|
316 | }
|
---|
317 |
|
---|
318 | cleanup:
|
---|
319 |
|
---|
320 | /* Wrap MPI error codes by RSA check failure error code */
|
---|
321 | if( ret != 0 &&
|
---|
322 | ret != MBEDTLS_ERR_RSA_KEY_CHECK_FAILED &&
|
---|
323 | ret != MBEDTLS_ERR_RSA_BAD_INPUT_DATA )
|
---|
324 | {
|
---|
325 | ret += MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
326 | }
|
---|
327 |
|
---|
328 | mbedtls_mpi_free( &K );
|
---|
329 | mbedtls_mpi_free( &L );
|
---|
330 |
|
---|
331 | return( ret );
|
---|
332 | }
|
---|
333 |
|
---|
334 | /*
|
---|
335 | * Check that core RSA parameters are sane.
|
---|
336 | */
|
---|
337 | int mbedtls_rsa_validate_params( const mbedtls_mpi *N, const mbedtls_mpi *P,
|
---|
338 | const mbedtls_mpi *Q, const mbedtls_mpi *D,
|
---|
339 | const mbedtls_mpi *E,
|
---|
340 | int (*f_rng)(void *, unsigned char *, size_t),
|
---|
341 | void *p_rng )
|
---|
342 | {
|
---|
343 | int ret = 0;
|
---|
344 | mbedtls_mpi K, L;
|
---|
345 |
|
---|
346 | mbedtls_mpi_init( &K );
|
---|
347 | mbedtls_mpi_init( &L );
|
---|
348 |
|
---|
349 | /*
|
---|
350 | * Step 1: If PRNG provided, check that P and Q are prime
|
---|
351 | */
|
---|
352 |
|
---|
353 | #if defined(MBEDTLS_GENPRIME)
|
---|
354 | /*
|
---|
355 | * When generating keys, the strongest security we support aims for an error
|
---|
356 | * rate of at most 2^-100 and we are aiming for the same certainty here as
|
---|
357 | * well.
|
---|
358 | */
|
---|
359 | if( f_rng != NULL && P != NULL &&
|
---|
360 | ( ret = mbedtls_mpi_is_prime_ext( P, 50, f_rng, p_rng ) ) != 0 )
|
---|
361 | {
|
---|
362 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
363 | goto cleanup;
|
---|
364 | }
|
---|
365 |
|
---|
366 | if( f_rng != NULL && Q != NULL &&
|
---|
367 | ( ret = mbedtls_mpi_is_prime_ext( Q, 50, f_rng, p_rng ) ) != 0 )
|
---|
368 | {
|
---|
369 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
370 | goto cleanup;
|
---|
371 | }
|
---|
372 | #else
|
---|
373 | ((void) f_rng);
|
---|
374 | ((void) p_rng);
|
---|
375 | #endif /* MBEDTLS_GENPRIME */
|
---|
376 |
|
---|
377 | /*
|
---|
378 | * Step 2: Check that 1 < N = P * Q
|
---|
379 | */
|
---|
380 |
|
---|
381 | if( P != NULL && Q != NULL && N != NULL )
|
---|
382 | {
|
---|
383 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &K, P, Q ) );
|
---|
384 | if( mbedtls_mpi_cmp_int( N, 1 ) <= 0 ||
|
---|
385 | mbedtls_mpi_cmp_mpi( &K, N ) != 0 )
|
---|
386 | {
|
---|
387 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
388 | goto cleanup;
|
---|
389 | }
|
---|
390 | }
|
---|
391 |
|
---|
392 | /*
|
---|
393 | * Step 3: Check and 1 < D, E < N if present.
|
---|
394 | */
|
---|
395 |
|
---|
396 | if( N != NULL && D != NULL && E != NULL )
|
---|
397 | {
|
---|
398 | if ( mbedtls_mpi_cmp_int( D, 1 ) <= 0 ||
|
---|
399 | mbedtls_mpi_cmp_int( E, 1 ) <= 0 ||
|
---|
400 | mbedtls_mpi_cmp_mpi( D, N ) >= 0 ||
|
---|
401 | mbedtls_mpi_cmp_mpi( E, N ) >= 0 )
|
---|
402 | {
|
---|
403 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
404 | goto cleanup;
|
---|
405 | }
|
---|
406 | }
|
---|
407 |
|
---|
408 | /*
|
---|
409 | * Step 4: Check that D, E are inverse modulo P-1 and Q-1
|
---|
410 | */
|
---|
411 |
|
---|
412 | if( P != NULL && Q != NULL && D != NULL && E != NULL )
|
---|
413 | {
|
---|
414 | if( mbedtls_mpi_cmp_int( P, 1 ) <= 0 ||
|
---|
415 | mbedtls_mpi_cmp_int( Q, 1 ) <= 0 )
|
---|
416 | {
|
---|
417 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
418 | goto cleanup;
|
---|
419 | }
|
---|
420 |
|
---|
421 | /* Compute DE-1 mod P-1 */
|
---|
422 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &K, D, E ) );
|
---|
423 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, &K, 1 ) );
|
---|
424 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &L, P, 1 ) );
|
---|
425 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &K, &K, &L ) );
|
---|
426 | if( mbedtls_mpi_cmp_int( &K, 0 ) != 0 )
|
---|
427 | {
|
---|
428 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
429 | goto cleanup;
|
---|
430 | }
|
---|
431 |
|
---|
432 | /* Compute DE-1 mod Q-1 */
|
---|
433 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &K, D, E ) );
|
---|
434 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, &K, 1 ) );
|
---|
435 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &L, Q, 1 ) );
|
---|
436 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &K, &K, &L ) );
|
---|
437 | if( mbedtls_mpi_cmp_int( &K, 0 ) != 0 )
|
---|
438 | {
|
---|
439 | ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
440 | goto cleanup;
|
---|
441 | }
|
---|
442 | }
|
---|
443 |
|
---|
444 | cleanup:
|
---|
445 |
|
---|
446 | mbedtls_mpi_free( &K );
|
---|
447 | mbedtls_mpi_free( &L );
|
---|
448 |
|
---|
449 | /* Wrap MPI error codes by RSA check failure error code */
|
---|
450 | if( ret != 0 && ret != MBEDTLS_ERR_RSA_KEY_CHECK_FAILED )
|
---|
451 | {
|
---|
452 | ret += MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
|
---|
453 | }
|
---|
454 |
|
---|
455 | return( ret );
|
---|
456 | }
|
---|
457 |
|
---|
458 | int mbedtls_rsa_deduce_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q,
|
---|
459 | const mbedtls_mpi *D, mbedtls_mpi *DP,
|
---|
460 | mbedtls_mpi *DQ, mbedtls_mpi *QP )
|
---|
461 | {
|
---|
462 | int ret = 0;
|
---|
463 | mbedtls_mpi K;
|
---|
464 | mbedtls_mpi_init( &K );
|
---|
465 |
|
---|
466 | /* DP = D mod P-1 */
|
---|
467 | if( DP != NULL )
|
---|
468 | {
|
---|
469 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, P, 1 ) );
|
---|
470 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( DP, D, &K ) );
|
---|
471 | }
|
---|
472 |
|
---|
473 | /* DQ = D mod Q-1 */
|
---|
474 | if( DQ != NULL )
|
---|
475 | {
|
---|
476 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &K, Q, 1 ) );
|
---|
477 | MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( DQ, D, &K ) );
|
---|
478 | }
|
---|
479 |
|
---|
480 | /* QP = Q^{-1} mod P */
|
---|
481 | if( QP != NULL )
|
---|
482 | {
|
---|
483 | MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( QP, Q, P ) );
|
---|
484 | }
|
---|
485 |
|
---|
486 | cleanup:
|
---|
487 | mbedtls_mpi_free( &K );
|
---|
488 |
|
---|
489 | return( ret );
|
---|
490 | }
|
---|
491 |
|
---|
492 | #endif /* MBEDTLS_RSA_C */
|
---|