kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
978169951f
boringssl/crypto/fipsmodule/bn/prime.c

1110 lines
41 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* ====================================================================
* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
#include <openssl/bn.h>
#include <openssl/err.h>
#include <openssl/mem.h>
#include "internal.h"
Don't leak |a| in the primality test. (This is actually slightly silly as |a|'s probability distribution falls off exponentially, but it's easy enough to do right.) Instead, we run the loop to the end. This is still performant because we can, as before, return early on composite numbers. Only two calls actually run to the end. Moreover, running to the end has comparable cost to BN_mod_exp_mont_consttime. Median time goes from 0.140s to 0.231s. That cost some, but we're still faster than the original implementation. We're down to one more leak, which is that the BN_rand_range_ex call does not hide |w1|. That one may only be solved probabilistically... Median of 29 RSA keygens: 0m0.123s -> 0m0.145s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I4847cb0053118c572d2dd5f855388b5199fa6ce2 Reviewed-on: https://boringssl-review.googlesource.com/25888 Reviewed-by: Adam Langley <agl@google.com>
2018-02-04 03:39:35 +00:00
#include "../../internal.h"
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// The quick sieve algorithm approach to weeding out primes is Philip
// Zimmermann's, as implemented in PGP. I have had a read of his comments and
// implemented my own version.
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
// kPrimes contains the first 2048 primes.
static const uint16_t kPrimes[] = {
Enable more warnings & treat warnings as errors on Windows. Change-Id: I2bf0144aaa8b670ff00b8e8dfe36bd4d237b9a8a Reviewed-on: https://boringssl-review.googlesource.com/3140 Reviewed-by: Adam Langley <agl@google.com>
2015-01-29 00:20:02 +00:00
2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31,
37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79,
83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137,
139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193,
197, 199, 211, 223, 227, 229, 233, 239, 241, 251, 257,
263, 269, 271, 277, 281, 283, 293, 307, 311, 313, 317,
331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389,
397, 401, 409, 419, 421, 431, 433, 439, 443, 449, 457,
461, 463, 467, 479, 487, 491, 499, 503, 509, 521, 523,
541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601,
607, 613, 617, 619, 631, 641, 643, 647, 653, 659, 661,
673, 677, 683, 691, 701, 709, 719, 727, 733, 739, 743,
751, 757, 761, 769, 773, 787, 797, 809, 811, 821, 823,
827, 829, 839, 853, 857, 859, 863, 877, 881, 883, 887,
907, 911, 919, 929, 937, 941, 947, 953, 967, 971, 977,
983, 991, 997, 1009, 1013, 1019, 1021, 1031, 1033, 1039, 1049,
1051, 1061, 1063, 1069, 1087, 1091, 1093, 1097, 1103, 1109, 1117,
1123, 1129, 1151, 1153, 1163, 1171, 1181, 1187, 1193, 1201, 1213,
1217, 1223, 1229, 1231, 1237, 1249, 1259, 1277, 1279, 1283, 1289,
1291, 1297, 1301, 1303, 1307, 1319, 1321, 1327, 1361, 1367, 1373,
1381, 1399, 1409, 1423, 1427, 1429, 1433, 1439, 1447, 1451, 1453,
1459, 1471, 1481, 1483, 1487, 1489, 1493, 1499, 1511, 1523, 1531,
1543, 1549, 1553, 1559, 1567, 1571, 1579, 1583, 1597, 1601, 1607,
1609, 1613, 1619, 1621, 1627, 1637, 1657, 1663, 1667, 1669, 1693,
1697, 1699, 1709, 1721, 1723, 1733, 1741, 1747, 1753, 1759, 1777,
1783, 1787, 1789, 1801, 1811, 1823, 1831, 1847, 1861, 1867, 1871,
1873, 1877, 1879, 1889, 1901, 1907, 1913, 1931, 1933, 1949, 1951,
1973, 1979, 1987, 1993, 1997, 1999, 2003, 2011, 2017, 2027, 2029,
2039, 2053, 2063, 2069, 2081, 2083, 2087, 2089, 2099, 2111, 2113,
2129, 2131, 2137, 2141, 2143, 2153, 2161, 2179, 2203, 2207, 2213,
2221, 2237, 2239, 2243, 2251, 2267, 2269, 2273, 2281, 2287, 2293,
2297, 2309, 2311, 2333, 2339, 2341, 2347, 2351, 2357, 2371, 2377,
2381, 2383, 2389, 2393, 2399, 2411, 2417, 2423, 2437, 2441, 2447,
2459, 2467, 2473, 2477, 2503, 2521, 2531, 2539, 2543, 2549, 2551,
2557, 2579, 2591, 2593, 2609, 2617, 2621, 2633, 2647, 2657, 2659,
2663, 2671, 2677, 2683, 2687, 2689, 2693, 2699, 2707, 2711, 2713,
2719, 2729, 2731, 2741, 2749, 2753, 2767, 2777, 2789, 2791, 2797,
2801, 2803, 2819, 2833, 2837, 2843, 2851, 2857, 2861, 2879, 2887,
2897, 2903, 2909, 2917, 2927, 2939, 2953, 2957, 2963, 2969, 2971,
2999, 3001, 3011, 3019, 3023, 3037, 3041, 3049, 3061, 3067, 3079,
3083, 3089, 3109, 3119, 3121, 3137, 3163, 3167, 3169, 3181, 3187,
3191, 3203, 3209, 3217, 3221, 3229, 3251, 3253, 3257, 3259, 3271,
3299, 3301, 3307, 3313, 3319, 3323, 3329, 3331, 3343, 3347, 3359,
3361, 3371, 3373, 3389, 3391, 3407, 3413, 3433, 3449, 3457, 3461,
3463, 3467, 3469, 3491, 3499, 3511, 3517, 3527, 3529, 3533, 3539,
3541, 3547, 3557, 3559, 3571, 3581, 3583, 3593, 3607, 3613, 3617,
3623, 3631, 3637, 3643, 3659, 3671, 3673, 3677, 3691, 3697, 3701,
3709, 3719, 3727, 3733, 3739, 3761, 3767, 3769, 3779, 3793, 3797,
3803, 3821, 3823, 3833, 3847, 3851, 3853, 3863, 3877, 3881, 3889,
3907, 3911, 3917, 3919, 3923, 3929, 3931, 3943, 3947, 3967, 3989,
4001, 4003, 4007, 4013, 4019, 4021, 4027, 4049, 4051, 4057, 4073,
4079, 4091, 4093, 4099, 4111, 4127, 4129, 4133, 4139, 4153, 4157,
4159, 4177, 4201, 4211, 4217, 4219, 4229, 4231, 4241, 4243, 4253,
4259, 4261, 4271, 4273, 4283, 4289, 4297, 4327, 4337, 4339, 4349,
4357, 4363, 4373, 4391, 4397, 4409, 4421, 4423, 4441, 4447, 4451,
4457, 4463, 4481, 4483, 4493, 4507, 4513, 4517, 4519, 4523, 4547,
4549, 4561, 4567, 4583, 4591, 4597, 4603, 4621, 4637, 4639, 4643,
4649, 4651, 4657, 4663, 4673, 4679, 4691, 4703, 4721, 4723, 4729,
4733, 4751, 4759, 4783, 4787, 4789, 4793, 4799, 4801, 4813, 4817,
4831, 4861, 4871, 4877, 4889, 4903, 4909, 4919, 4931, 4933, 4937,
4943, 4951, 4957, 4967, 4969, 4973, 4987, 4993, 4999, 5003, 5009,
5011, 5021, 5023, 5039, 5051, 5059, 5077, 5081, 5087, 5099, 5101,
5107, 5113, 5119, 5147, 5153, 5167, 5171, 5179, 5189, 5197, 5209,
5227, 5231, 5233, 5237, 5261, 5273, 5279, 5281, 5297, 5303, 5309,
5323, 5333, 5347, 5351, 5381, 5387, 5393, 5399, 5407, 5413, 5417,
5419, 5431, 5437, 5441, 5443, 5449, 5471, 5477, 5479, 5483, 5501,
5503, 5507, 5519, 5521, 5527, 5531, 5557, 5563, 5569, 5573, 5581,
5591, 5623, 5639, 5641, 5647, 5651, 5653, 5657, 5659, 5669, 5683,
5689, 5693, 5701, 5711, 5717, 5737, 5741, 5743, 5749, 5779, 5783,
5791, 5801, 5807, 5813, 5821, 5827, 5839, 5843, 5849, 5851, 5857,
5861, 5867, 5869, 5879, 5881, 5897, 5903, 5923, 5927, 5939, 5953,
5981, 5987, 6007, 6011, 6029, 6037, 6043, 6047, 6053, 6067, 6073,
6079, 6089, 6091, 6101, 6113, 6121, 6131, 6133, 6143, 6151, 6163,
6173, 6197, 6199, 6203, 6211, 6217, 6221, 6229, 6247, 6257, 6263,
6269, 6271, 6277, 6287, 6299, 6301, 6311, 6317, 6323, 6329, 6337,
6343, 6353, 6359, 6361, 6367, 6373, 6379, 6389, 6397, 6421, 6427,
6449, 6451, 6469, 6473, 6481, 6491, 6521, 6529, 6547, 6551, 6553,
6563, 6569, 6571, 6577, 6581, 6599, 6607, 6619, 6637, 6653, 6659,
6661, 6673, 6679, 6689, 6691, 6701, 6703, 6709, 6719, 6733, 6737,
6761, 6763, 6779, 6781, 6791, 6793, 6803, 6823, 6827, 6829, 6833,
6841, 6857, 6863, 6869, 6871, 6883, 6899, 6907, 6911, 6917, 6947,
6949, 6959, 6961, 6967, 6971, 6977, 6983, 6991, 6997, 7001, 7013,
7019, 7027, 7039, 7043, 7057, 7069, 7079, 7103, 7109, 7121, 7127,
7129, 7151, 7159, 7177, 7187, 7193, 7207, 7211, 7213, 7219, 7229,
7237, 7243, 7247, 7253, 7283, 7297, 7307, 7309, 7321, 7331, 7333,
7349, 7351, 7369, 7393, 7411, 7417, 7433, 7451, 7457, 7459, 7477,
7481, 7487, 7489, 7499, 7507, 7517, 7523, 7529, 7537, 7541, 7547,
7549, 7559, 7561, 7573, 7577, 7583, 7589, 7591, 7603, 7607, 7621,
7639, 7643, 7649, 7669, 7673, 7681, 7687, 7691, 7699, 7703, 7717,
7723, 7727, 7741, 7753, 7757, 7759, 7789, 7793, 7817, 7823, 7829,
7841, 7853, 7867, 7873, 7877, 7879, 7883, 7901, 7907, 7919, 7927,
7933, 7937, 7949, 7951, 7963, 7993, 8009, 8011, 8017, 8039, 8053,
8059, 8069, 8081, 8087, 8089, 8093, 8101, 8111, 8117, 8123, 8147,
8161, 8167, 8171, 8179, 8191, 8209, 8219, 8221, 8231, 8233, 8237,
8243, 8263, 8269, 8273, 8287, 8291, 8293, 8297, 8311, 8317, 8329,
8353, 8363, 8369, 8377, 8387, 8389, 8419, 8423, 8429, 8431, 8443,
8447, 8461, 8467, 8501, 8513, 8521, 8527, 8537, 8539, 8543, 8563,
8573, 8581, 8597, 8599, 8609, 8623, 8627, 8629, 8641, 8647, 8663,
8669, 8677, 8681, 8689, 8693, 8699, 8707, 8713, 8719, 8731, 8737,
8741, 8747, 8753, 8761, 8779, 8783, 8803, 8807, 8819, 8821, 8831,
8837, 8839, 8849, 8861, 8863, 8867, 8887, 8893, 8923, 8929, 8933,
8941, 8951, 8963, 8969, 8971, 8999, 9001, 9007, 9011, 9013, 9029,
9041, 9043, 9049, 9059, 9067, 9091, 9103, 9109, 9127, 9133, 9137,
9151, 9157, 9161, 9173, 9181, 9187, 9199, 9203, 9209, 9221, 9227,
9239, 9241, 9257, 9277, 9281, 9283, 9293, 9311, 9319, 9323, 9337,
9341, 9343, 9349, 9371, 9377, 9391, 9397, 9403, 9413, 9419, 9421,
9431, 9433, 9437, 9439, 9461, 9463, 9467, 9473, 9479, 9491, 9497,
9511, 9521, 9533, 9539, 9547, 9551, 9587, 9601, 9613, 9619, 9623,
9629, 9631, 9643, 9649, 9661, 9677, 9679, 9689, 9697, 9719, 9721,
9733, 9739, 9743, 9749, 9767, 9769, 9781, 9787, 9791, 9803, 9811,
9817, 9829, 9833, 9839, 9851, 9857, 9859, 9871, 9883, 9887, 9901,
9907, 9923, 9929, 9931, 9941, 9949, 9967, 9973, 10007, 10009, 10037,
10039, 10061, 10067, 10069, 10079, 10091, 10093, 10099, 10103, 10111, 10133,
10139, 10141, 10151, 10159, 10163, 10169, 10177, 10181, 10193, 10211, 10223,
10243, 10247, 10253, 10259, 10267, 10271, 10273, 10289, 10301, 10303, 10313,
10321, 10331, 10333, 10337, 10343, 10357, 10369, 10391, 10399, 10427, 10429,
10433, 10453, 10457, 10459, 10463, 10477, 10487, 10499, 10501, 10513, 10529,
10531, 10559, 10567, 10589, 10597, 10601, 10607, 10613, 10627, 10631, 10639,
10651, 10657, 10663, 10667, 10687, 10691, 10709, 10711, 10723, 10729, 10733,
10739, 10753, 10771, 10781, 10789, 10799, 10831, 10837, 10847, 10853, 10859,
10861, 10867, 10883, 10889, 10891, 10903, 10909, 10937, 10939, 10949, 10957,
10973, 10979, 10987, 10993, 11003, 11027, 11047, 11057, 11059, 11069, 11071,
11083, 11087, 11093, 11113, 11117, 11119, 11131, 11149, 11159, 11161, 11171,
11173, 11177, 11197, 11213, 11239, 11243, 11251, 11257, 11261, 11273, 11279,
11287, 11299, 11311, 11317, 11321, 11329, 11351, 11353, 11369, 11383, 11393,
11399, 11411, 11423, 11437, 11443, 11447, 11467, 11471, 11483, 11489, 11491,
11497, 11503, 11519, 11527, 11549, 11551, 11579, 11587, 11593, 11597, 11617,
11621, 11633, 11657, 11677, 11681, 11689, 11699, 11701, 11717, 11719, 11731,
11743, 11777, 11779, 11783, 11789, 11801, 11807, 11813, 11821, 11827, 11831,
11833, 11839, 11863, 11867, 11887, 11897, 11903, 11909, 11923, 11927, 11933,
11939, 11941, 11953, 11959, 11969, 11971, 11981, 11987, 12007, 12011, 12037,
12041, 12043, 12049, 12071, 12073, 12097, 12101, 12107, 12109, 12113, 12119,
12143, 12149, 12157, 12161, 12163, 12197, 12203, 12211, 12227, 12239, 12241,
12251, 12253, 12263, 12269, 12277, 12281, 12289, 12301, 12323, 12329, 12343,
12347, 12373, 12377, 12379, 12391, 12401, 12409, 12413, 12421, 12433, 12437,
12451, 12457, 12473, 12479, 12487, 12491, 12497, 12503, 12511, 12517, 12527,
12539, 12541, 12547, 12553, 12569, 12577, 12583, 12589, 12601, 12611, 12613,
12619, 12637, 12641, 12647, 12653, 12659, 12671, 12689, 12697, 12703, 12713,
12721, 12739, 12743, 12757, 12763, 12781, 12791, 12799, 12809, 12821, 12823,
12829, 12841, 12853, 12889, 12893, 12899, 12907, 12911, 12917, 12919, 12923,
12941, 12953, 12959, 12967, 12973, 12979, 12983, 13001, 13003, 13007, 13009,
13033, 13037, 13043, 13049, 13063, 13093, 13099, 13103, 13109, 13121, 13127,
13147, 13151, 13159, 13163, 13171, 13177, 13183, 13187, 13217, 13219, 13229,
13241, 13249, 13259, 13267, 13291, 13297, 13309, 13313, 13327, 13331, 13337,
13339, 13367, 13381, 13397, 13399, 13411, 13417, 13421, 13441, 13451, 13457,
13463, 13469, 13477, 13487, 13499, 13513, 13523, 13537, 13553, 13567, 13577,
13591, 13597, 13613, 13619, 13627, 13633, 13649, 13669, 13679, 13681, 13687,
13691, 13693, 13697, 13709, 13711, 13721, 13723, 13729, 13751, 13757, 13759,
13763, 13781, 13789, 13799, 13807, 13829, 13831, 13841, 13859, 13873, 13877,
13879, 13883, 13901, 13903, 13907, 13913, 13921, 13931, 13933, 13963, 13967,
13997, 13999, 14009, 14011, 14029, 14033, 14051, 14057, 14071, 14081, 14083,
14087, 14107, 14143, 14149, 14153, 14159, 14173, 14177, 14197, 14207, 14221,
14243, 14249, 14251, 14281, 14293, 14303, 14321, 14323, 14327, 14341, 14347,
14369, 14387, 14389, 14401, 14407, 14411, 14419, 14423, 14431, 14437, 14447,
14449, 14461, 14479, 14489, 14503, 14519, 14533, 14537, 14543, 14549, 14551,
14557, 14561, 14563, 14591, 14593, 14621, 14627, 14629, 14633, 14639, 14653,
14657, 14669, 14683, 14699, 14713, 14717, 14723, 14731, 14737, 14741, 14747,
14753, 14759, 14767, 14771, 14779, 14783, 14797, 14813, 14821, 14827, 14831,
14843, 14851, 14867, 14869, 14879, 14887, 14891, 14897, 14923, 14929, 14939,
14947, 14951, 14957, 14969, 14983, 15013, 15017, 15031, 15053, 15061, 15073,
15077, 15083, 15091, 15101, 15107, 15121, 15131, 15137, 15139, 15149, 15161,
15173, 15187, 15193, 15199, 15217, 15227, 15233, 15241, 15259, 15263, 15269,
15271, 15277, 15287, 15289, 15299, 15307, 15313, 15319, 15329, 15331, 15349,
15359, 15361, 15373, 15377, 15383, 15391, 15401, 15413, 15427, 15439, 15443,
15451, 15461, 15467, 15473, 15493, 15497, 15511, 15527, 15541, 15551, 15559,
15569, 15581, 15583, 15601, 15607, 15619, 15629, 15641, 15643, 15647, 15649,
15661, 15667, 15671, 15679, 15683, 15727, 15731, 15733, 15737, 15739, 15749,
15761, 15767, 15773, 15787, 15791, 15797, 15803, 15809, 15817, 15823, 15859,
15877, 15881, 15887, 15889, 15901, 15907, 15913, 15919, 15923, 15937, 15959,
15971, 15973, 15991, 16001, 16007, 16033, 16057, 16061, 16063, 16067, 16069,
16073, 16087, 16091, 16097, 16103, 16111, 16127, 16139, 16141, 16183, 16187,
16189, 16193, 16217, 16223, 16229, 16231, 16249, 16253, 16267, 16273, 16301,
16319, 16333, 16339, 16349, 16361, 16363, 16369, 16381, 16411, 16417, 16421,
16427, 16433, 16447, 16451, 16453, 16477, 16481, 16487, 16493, 16519, 16529,
16547, 16553, 16561, 16567, 16573, 16603, 16607, 16619, 16631, 16633, 16649,
16651, 16657, 16661, 16673, 16691, 16693, 16699, 16703, 16729, 16741, 16747,
16759, 16763, 16787, 16811, 16823, 16829, 16831, 16843, 16871, 16879, 16883,
16889, 16901, 16903, 16921, 16927, 16931, 16937, 16943, 16963, 16979, 16981,
16987, 16993, 17011, 17021, 17027, 17029, 17033, 17041, 17047, 17053, 17077,
17093, 17099, 17107, 17117, 17123, 17137, 17159, 17167, 17183, 17189, 17191,
17203, 17207, 17209, 17231, 17239, 17257, 17291, 17293, 17299, 17317, 17321,
17327, 17333, 17341, 17351, 17359, 17377, 17383, 17387, 17389, 17393, 17401,
17417, 17419, 17431, 17443, 17449, 17467, 17471, 17477, 17483, 17489, 17491,
17497, 17509, 17519, 17539, 17551, 17569, 17573, 17579, 17581, 17597, 17599,
17609, 17623, 17627, 17657, 17659, 17669, 17681, 17683, 17707, 17713, 17729,
17737, 17747, 17749, 17761, 17783, 17789, 17791, 17807, 17827, 17837, 17839,
17851, 17863,
};
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// BN_prime_checks_for_size returns the number of Miller-Rabin iterations
// necessary for a 'bits'-bit prime, in order to maintain an error rate greater
// than the security level for an RSA prime of that many bits (calculated using
// the FIPS SP 800-57 security level and 186-4 Section F.1; original paper:
// Damgaard, Landrock, Pomerance: Average case error estimates for the strong
// probable prime test. -- Math. Comp. 61 (1993) 177-194)
Update Miller-Rabin iterations to use FIPS specification. Change-Id: I73213b5d9f3ac67bab70e3d9a36a4b67c558f3f5 Reviewed-on: https://boringssl-review.googlesource.com/15044 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-13 21:23:45 +01:00
static int BN_prime_checks_for_size(int bits) {
if (bits >= 3747) {
return 3;
}
if (bits >= 1345) {
return 4;
}
if (bits >= 476) {
return 5;
}
if (bits >= 400) {
return 6;
}
if (bits >= 308) {
return 8;
}
if (bits >= 205) {
return 13;
}
if (bits >= 155) {
return 19;
}
return 28;
}
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
// num_trial_division_primes returns the number of primes to try with trial
// division before using more expensive checks. For larger numbers, the value
// of excluding a candidate with trial division is larger.
static size_t num_trial_division_primes(const BIGNUM *n) {
if (n->width * BN_BITS2 > 1024) {
return OPENSSL_ARRAY_SIZE(kPrimes);
}
return OPENSSL_ARRAY_SIZE(kPrimes) / 4;
}
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
// BN_PRIME_CHECKS_BLINDED is the iteration count for blinding the constant-time
// primality test. See |BN_primality_test| for details. This number is selected
// so that, for a candidate N-bit RSA prime, picking |BN_PRIME_CHECKS_BLINDED|
// random N-bit numbers will have at least |BN_prime_checks_for_size(N)| values
// in range with high probability.
//
// The following Python script computes the blinding factor needed for the
// corresponding iteration count.
/*
import math
# We choose candidate RSA primes between sqrt(2)/2 * 2^N and 2^N and select
# witnesses by generating random N-bit numbers. Thus the probability of
# selecting one in range is at least sqrt(2)/2.
p = math.sqrt(2) / 2
Only do 16 iterations to blind the primality test. With this, in 0.02% of 1024-bit primes (which is what's used with an RSA 2048 generation), we'll leak that we struggled to generate values less than the prime. I.e. that there's a greater likelihood of zero bits after the leading 1 bit in the prime. But this recovers all the speed loss from making key generation constant-time, and then some. Did 273 RSA 2048 key-gen operations in 30023223us (9.1 ops/sec) min: 23867us, median: 93688us, max: 421466us Did 66 RSA 3072 key-gen operations in 30041763us (2.2 ops/sec) min: 117044us, median: 402095us, max: 1096538us Did 31 RSA 4096 key-gen operations in 31673405us (1.0 ops/sec) min: 245109us, median: 769480us, max: 2659386us Change-Id: Id82dedde35f5fbb36b278189c0685a13c7824590 Reviewed-on: https://boringssl-review.googlesource.com/26924 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-03-30 23:11:47 +01:00
# Target around 2^-8 probability of the blinding being insufficient given that
# key generation is a one-time, noisy operation.
epsilon = 2**-8
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
def choose(a, b):
r = 1
for i in xrange(b):
r *= a - i
r /= (i + 1)
return r
def failure_rate(min_uniform, iterations):
""" Returns the probability that, for |iterations| candidate witnesses, fewer
than |min_uniform| of them will be uniform. """
prob = 0.0
for i in xrange(min_uniform):
prob += (choose(iterations, i) *
p**i * (1-p)**(iterations - i))
return prob
for min_uniform in (3, 4, 5, 6, 8, 13, 19, 28):
# Find the smallest number of iterations under the target failure rate.
iterations = min_uniform
while True:
prob = failure_rate(min_uniform, iterations)
if prob < epsilon:
print min_uniform, iterations, prob
break
iterations += 1
Output:
Only do 16 iterations to blind the primality test. With this, in 0.02% of 1024-bit primes (which is what's used with an RSA 2048 generation), we'll leak that we struggled to generate values less than the prime. I.e. that there's a greater likelihood of zero bits after the leading 1 bit in the prime. But this recovers all the speed loss from making key generation constant-time, and then some. Did 273 RSA 2048 key-gen operations in 30023223us (9.1 ops/sec) min: 23867us, median: 93688us, max: 421466us Did 66 RSA 3072 key-gen operations in 30041763us (2.2 ops/sec) min: 117044us, median: 402095us, max: 1096538us Did 31 RSA 4096 key-gen operations in 31673405us (1.0 ops/sec) min: 245109us, median: 769480us, max: 2659386us Change-Id: Id82dedde35f5fbb36b278189c0685a13c7824590 Reviewed-on: https://boringssl-review.googlesource.com/26924 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-03-30 23:11:47 +01:00
3 9 0.00368894873911
4 11 0.00363319494662
5 13 0.00336215573898
6 15 0.00300145783158
8 19 0.00225214119331
13 27 0.00385610026955
19 38 0.0021410539126
28 52 0.00325405801769
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
Only do 16 iterations to blind the primality test. With this, in 0.02% of 1024-bit primes (which is what's used with an RSA 2048 generation), we'll leak that we struggled to generate values less than the prime. I.e. that there's a greater likelihood of zero bits after the leading 1 bit in the prime. But this recovers all the speed loss from making key generation constant-time, and then some. Did 273 RSA 2048 key-gen operations in 30023223us (9.1 ops/sec) min: 23867us, median: 93688us, max: 421466us Did 66 RSA 3072 key-gen operations in 30041763us (2.2 ops/sec) min: 117044us, median: 402095us, max: 1096538us Did 31 RSA 4096 key-gen operations in 31673405us (1.0 ops/sec) min: 245109us, median: 769480us, max: 2659386us Change-Id: Id82dedde35f5fbb36b278189c0685a13c7824590 Reviewed-on: https://boringssl-review.googlesource.com/26924 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-03-30 23:11:47 +01:00
16 iterations suffices for 400-bit primes and larger (6 uniform samples needed),
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
which is already well below the minimum acceptable key size for RSA.
*/
Only do 16 iterations to blind the primality test. With this, in 0.02% of 1024-bit primes (which is what's used with an RSA 2048 generation), we'll leak that we struggled to generate values less than the prime. I.e. that there's a greater likelihood of zero bits after the leading 1 bit in the prime. But this recovers all the speed loss from making key generation constant-time, and then some. Did 273 RSA 2048 key-gen operations in 30023223us (9.1 ops/sec) min: 23867us, median: 93688us, max: 421466us Did 66 RSA 3072 key-gen operations in 30041763us (2.2 ops/sec) min: 117044us, median: 402095us, max: 1096538us Did 31 RSA 4096 key-gen operations in 31673405us (1.0 ops/sec) min: 245109us, median: 769480us, max: 2659386us Change-Id: Id82dedde35f5fbb36b278189c0685a13c7824590 Reviewed-on: https://boringssl-review.googlesource.com/26924 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-03-30 23:11:47 +01:00
#define BN_PRIME_CHECKS_BLINDED 16
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
static int probable_prime(BIGNUM *rnd, int bits);
static int probable_prime_dh(BIGNUM *rnd, int bits, const BIGNUM *add,
const BIGNUM *rem, BN_CTX *ctx);
static int probable_prime_dh_safe(BIGNUM *rnd, int bits, const BIGNUM *add,
const BIGNUM *rem, BN_CTX *ctx);
void BN_GENCB_set(BN_GENCB *callback,
int (*f)(int event, int n, struct bn_gencb_st *),
void *arg) {
callback->callback = f;
callback->arg = arg;
}
int BN_GENCB_call(BN_GENCB *callback, int event, int n) {
if (!callback) {
return 1;
}
return callback->callback(event, n, callback);
}
int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add,
const BIGNUM *rem, BN_GENCB *cb) {
BIGNUM *t;
int found = 0;
int i, j, c1 = 0;
BN_CTX *ctx;
int checks = BN_prime_checks_for_size(bits);
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
if (bits < 2) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// There are no prime numbers this small.
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(BN, BN_R_BITS_TOO_SMALL);
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
return 0;
} else if (bits == 2 && safe) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// The smallest safe prime (7) is three bits.
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(BN, BN_R_BITS_TOO_SMALL);
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
return 0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
ctx = BN_CTX_new();
if (ctx == NULL) {
goto err;
}
BN_CTX_start(ctx);
t = BN_CTX_get(ctx);
if (!t) {
goto err;
}
loop:
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// make a random number and set the top and bottom bits
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (add == NULL) {
if (!probable_prime(ret, bits)) {
goto err;
}
} else {
if (safe) {
if (!probable_prime_dh_safe(ret, bits, add, rem, ctx)) {
goto err;
}
} else {
if (!probable_prime_dh(ret, bits, add, rem, ctx)) {
goto err;
}
}
}
if (!BN_GENCB_call(cb, BN_GENCB_GENERATED, c1++)) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// aborted
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
if (!safe) {
i = BN_is_prime_fasttest_ex(ret, checks, ctx, 0, cb);
if (i == -1) {
goto err;
} else if (i == 0) {
goto loop;
}
} else {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// for "safe prime" generation, check that (p-1)/2 is prime. Since a prime
// is odd, We just need to divide by 2
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (!BN_rshift1(t, ret)) {
goto err;
}
for (i = 0; i < checks; i++) {
j = BN_is_prime_fasttest_ex(ret, 1, ctx, 0, NULL);
if (j == -1) {
goto err;
} else if (j == 0) {
goto loop;
}
j = BN_is_prime_fasttest_ex(t, 1, ctx, 0, NULL);
if (j == -1) {
goto err;
} else if (j == 0) {
goto loop;
}
if (!BN_GENCB_call(cb, i, c1 - 1)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// We have a safe prime test pass
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// we have a prime :-)
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
found = 1;
err:
if (ctx != NULL) {
BN_CTX_end(ctx);
BN_CTX_free(ctx);
}
return found;
}
Change the order of GCD and trial division. RSA key generation currently does the GCD check before the primality test, in hopes of discarding things invalid by other means before running the expensive primality check. However, GCD is about to get a bit more expensive to clear the timing leak, and the trial division part of primality testing is quite fast. Thus, split that portion out via a new bn_is_obviously_composite and call it before GCD. Median of 29 RSA keygens: 0m0.252s -> 0m0.207s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I3999771fb73cca16797cab9332d14c4ebeb02046 Reviewed-on: https://boringssl-review.googlesource.com/26366 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-02-06 23:32:30 +00:00
static int bn_trial_division(uint16_t *out, const BIGNUM *bn) {
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
const size_t num_primes = num_trial_division_primes(bn);
for (size_t i = 1; i < num_primes; i++) {
if (bn_mod_u16_consttime(bn, kPrimes[i]) == 0) {
*out = kPrimes[i];
Change the order of GCD and trial division. RSA key generation currently does the GCD check before the primality test, in hopes of discarding things invalid by other means before running the expensive primality check. However, GCD is about to get a bit more expensive to clear the timing leak, and the trial division part of primality testing is quite fast. Thus, split that portion out via a new bn_is_obviously_composite and call it before GCD. Median of 29 RSA keygens: 0m0.252s -> 0m0.207s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I3999771fb73cca16797cab9332d14c4ebeb02046 Reviewed-on: https://boringssl-review.googlesource.com/26366 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-02-06 23:32:30 +00:00
return 1;
}
}
return 0;
}
int bn_odd_number_is_obviously_composite(const BIGNUM *bn) {
uint16_t prime;
return bn_trial_division(&prime, bn) && !BN_is_word(bn, prime);
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
int BN_primality_test(int *is_probably_prime, const BIGNUM *w,
int iterations, BN_CTX *ctx, int do_trial_division,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
BN_GENCB *cb) {
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
*is_probably_prime = 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// To support RSA key generation, this function should treat |w| as secret if
// it is a large prime. Composite numbers are discarded, so they may return
// early.
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
if (BN_cmp(w, BN_value_one()) <= 0) {
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
if (!BN_is_odd(w)) {
// The only even prime is two.
*is_probably_prime = BN_is_word(w, 2);
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// Miller-Rabin does not work for three.
if (BN_is_word(w, 3)) {
*is_probably_prime = 1;
Update BN_enhanced_miller_rabin_primality_test to enforce preconditions and accept BN_prime_checks. Change-Id: Ie4ac57d39bca46db33280c500a2092350ccdae67 Reviewed-on: https://boringssl-review.googlesource.com/15371 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-21 20:29:45 +01:00
return 1;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (do_trial_division) {
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// Perform additional trial division checks to discard small primes.
Change the order of GCD and trial division. RSA key generation currently does the GCD check before the primality test, in hopes of discarding things invalid by other means before running the expensive primality check. However, GCD is about to get a bit more expensive to clear the timing leak, and the trial division part of primality testing is quite fast. Thus, split that portion out via a new bn_is_obviously_composite and call it before GCD. Median of 29 RSA keygens: 0m0.252s -> 0m0.207s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I3999771fb73cca16797cab9332d14c4ebeb02046 Reviewed-on: https://boringssl-review.googlesource.com/26366 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-02-06 23:32:30 +00:00
uint16_t prime;
if (bn_trial_division(&prime, w)) {
*is_probably_prime = BN_is_word(w, prime);
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
if (!BN_GENCB_call(cb, 1, -1)) {
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
if (iterations == BN_prime_checks) {
iterations = BN_prime_checks_for_size(BN_num_bits(w));
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Tolerate a null BN_CTX in BN_primality_test. This used to work, but I broke it on accident in the recent rewrite. Change-Id: I06ab5e06eb0c0a6b67ecc97919654e386f3c2198 Reviewed-on: https://boringssl-review.googlesource.com/26984 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Martin Kreichgauer <martinkr@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-04-03 19:01:12 +01:00
BN_CTX *new_ctx = NULL;
if (ctx == NULL) {
new_ctx = BN_CTX_new();
if (new_ctx == NULL) {
return 0;
}
ctx = new_ctx;
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// See C.3.1 from FIPS 186-4.
int ret = 0;
BN_MONT_CTX *mont = NULL;
BN_CTX_start(ctx);
BIGNUM *w1 = BN_CTX_get(ctx);
if (w1 == NULL ||
Name constant-time functions more consistently. I'm not sure why I separated "fixed" and "quick_ctx" names. That's annoying and doesn't generalize well to, say, adding a bn_div_consttime function for RSA keygen. Change-Id: I751d52b30e079de2f0d37a952de380fbf2c1e6b7 Reviewed-on: https://boringssl-review.googlesource.com/26364 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-06 23:56:10 +00:00
!bn_usub_consttime(w1, w, BN_value_one())) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// Write w1 as m * 2^a (Steps 1 and 2).
Don't leak |a| in the primality test. (This is actually slightly silly as |a|'s probability distribution falls off exponentially, but it's easy enough to do right.) Instead, we run the loop to the end. This is still performant because we can, as before, return early on composite numbers. Only two calls actually run to the end. Moreover, running to the end has comparable cost to BN_mod_exp_mont_consttime. Median time goes from 0.140s to 0.231s. That cost some, but we're still faster than the original implementation. We're down to one more leak, which is that the BN_rand_range_ex call does not hide |w1|. That one may only be solved probabilistically... Median of 29 RSA keygens: 0m0.123s -> 0m0.145s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I4847cb0053118c572d2dd5f855388b5199fa6ce2 Reviewed-on: https://boringssl-review.googlesource.com/25888 Reviewed-by: Adam Langley <agl@google.com>
2018-02-04 03:39:35 +00:00
int w_len = BN_num_bits(w);
int a = BN_count_low_zero_bits(w1);
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
BIGNUM *m = BN_CTX_get(ctx);
if (m == NULL ||
Don't leak |a| in the primality test. (This is actually slightly silly as |a|'s probability distribution falls off exponentially, but it's easy enough to do right.) Instead, we run the loop to the end. This is still performant because we can, as before, return early on composite numbers. Only two calls actually run to the end. Moreover, running to the end has comparable cost to BN_mod_exp_mont_consttime. Median time goes from 0.140s to 0.231s. That cost some, but we're still faster than the original implementation. We're down to one more leak, which is that the BN_rand_range_ex call does not hide |w1|. That one may only be solved probabilistically... Median of 29 RSA keygens: 0m0.123s -> 0m0.145s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I4847cb0053118c572d2dd5f855388b5199fa6ce2 Reviewed-on: https://boringssl-review.googlesource.com/25888 Reviewed-by: Adam Langley <agl@google.com>
2018-02-04 03:39:35 +00:00
!bn_rshift_secret_shift(m, w1, a, ctx)) {
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
goto err;
}
// Montgomery setup for computations mod w. Additionally, compute 1 and w - 1
// in the Montgomery domain for later comparisons.
BIGNUM *b = BN_CTX_get(ctx);
BIGNUM *z = BN_CTX_get(ctx);
BIGNUM *one_mont = BN_CTX_get(ctx);
BIGNUM *w1_mont = BN_CTX_get(ctx);
Restore the BN_mod codepath for public Montgomery moduli. https://boringssl-review.googlesource.com/10520 and then later https://boringssl-review.googlesource.com/25285 made BN_MONT_CTX_set constant-time, which is necessary for RSA's mont_p and mont_q. However, due to a typo in the benchmark, they did not correctly measure. Split BN_MONT_CTX creation into a constant-time and variable-time one. The constant-time one uses our current algorithm and the latter restores the original BN_mod codepath. Should we wish to avoid BN_mod, I have an alternate version lying around: First, BN_set_bit + bn_mod_lshift1_consttime as now to count up to 2*R. Next, observe that 2*R = BN_to_montgomery(2) and R*R = BN_to_montgomery(R) = BN_to_montgomery(2^r_bits) Also observe that BN_mod_mul_montgomery only needs n0, not RR. Split the core of BN_mod_exp_mont into its own function so the caller handles conversion. Raise 2*R to the r_bits power to get 2^r_bits*R = R*R. The advantage of that algorithm is that it is still constant-time, so we only need one BN_MONT_CTX_new. Additionally, it avoids BN_mod which is otherwise (almost, but the remaining links should be easy to cut) out of the critical path for correctness. One less operation to worry about. The disadvantage is that it is gives a 25% (RSA-2048) or 32% (RSA-4096) slower RSA verification speed. I went with the BN_mod one for the time being. Before: Did 9204 RSA 2048 signing operations in 10052053us (915.6 ops/sec) Did 326000 RSA 2048 verify (same key) operations in 10028823us (32506.3 ops/sec) Did 50830 RSA 2048 verify (fresh key) operations in 10033794us (5065.9 ops/sec) Did 1269 RSA 4096 signing operations in 10019204us (126.7 ops/sec) Did 88435 RSA 4096 verify (same key) operations in 10031129us (8816.1 ops/sec) Did 14552 RSA 4096 verify (fresh key) operations in 10053411us (1447.5 ops/sec) After: Did 9150 RSA 2048 signing operations in 10022831us (912.9 ops/sec) Did 322000 RSA 2048 verify (same key) operations in 10028604us (32108.2 ops/sec) Did 289000 RSA 2048 verify (fresh key) operations in 10017205us (28850.4 ops/sec) Did 1270 RSA 4096 signing operations in 10072950us (126.1 ops/sec) Did 87480 RSA 4096 verify (same key) operations in 10036328us (8716.3 ops/sec) Did 80730 RSA 4096 verify (fresh key) operations in 10073614us (8014.0 ops/sec) Change-Id: Ie8916d1634ccf8513ceda458fa302f09f3e93c07 Reviewed-on: https://boringssl-review.googlesource.com/27287 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-04-10 21:46:33 +01:00
mont = BN_MONT_CTX_new_consttime(w, ctx);
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
if (b == NULL || z == NULL || one_mont == NULL || w1_mont == NULL ||
mont == NULL ||
!bn_one_to_montgomery(one_mont, mont, ctx) ||
// w - 1 is -1 mod w, so we can compute it in the Montgomery domain, -R,
// with a subtraction. (|one_mont| cannot be zero.)
Name constant-time functions more consistently. I'm not sure why I separated "fixed" and "quick_ctx" names. That's annoying and doesn't generalize well to, say, adding a bn_div_consttime function for RSA keygen. Change-Id: I751d52b30e079de2f0d37a952de380fbf2c1e6b7 Reviewed-on: https://boringssl-review.googlesource.com/26364 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-06 23:56:10 +00:00
!bn_usub_consttime(w1_mont, w, one_mont)) {
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
goto err;
}
// The following loop performs in inner iteration of the Miller-Rabin
// Primality test (Step 4).
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
//
// The algorithm as specified in FIPS 186-4 leaks information on |w|, the RSA
// private key. Instead, we run through each iteration unconditionally,
// performing modular multiplications, masking off any effects to behave
// equivalently to the specified algorithm.
//
// We also blind the number of values of |b| we try. Steps 4.1–4.2 say to
// discard out-of-range values. To avoid leaking information on |w|, we use
// |bn_rand_secret_range| which, rather than discarding bad values, adjusts
// them to be in range. Though not uniformly selected, these adjusted values
// are still usable as Rabin-Miller checks.
//
// Rabin-Miller is already probabilistic, so we could reach the desired
// confidence levels by just suitably increasing the iteration count. However,
// to align with FIPS 186-4, we use a more pessimal analysis: we do not count
// the non-uniform values towards the iteration count. As a result, this
// function is more complex and has more timing risk than necessary.
//
// We count both total iterations and uniform ones and iterate until we've
// reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively.
// If the latter is large enough, it will be the limiting factor with high
// probability and we won't leak information.
//
// Note this blinding does not impact most calls when picking primes because
// composites are rejected early. Only the two secret primes see extra work.
crypto_word_t uniform_iterations = 0;
// Using |constant_time_lt_w| seems to prevent the compiler from optimizing
// this into two jumps.
for (int i = 1; (i <= BN_PRIME_CHECKS_BLINDED) |
constant_time_lt_w(uniform_iterations, iterations);
i++) {
int is_uniform;
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
if (// Step 4.1-4.2
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
!bn_rand_secret_range(b, &is_uniform, 2, w1) ||
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// Step 4.3
!BN_mod_exp_mont_consttime(z, b, m, w, ctx, mont)) {
goto err;
}
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
uniform_iterations += is_uniform;
Don't leak |a| in the primality test. (This is actually slightly silly as |a|'s probability distribution falls off exponentially, but it's easy enough to do right.) Instead, we run the loop to the end. This is still performant because we can, as before, return early on composite numbers. Only two calls actually run to the end. Moreover, running to the end has comparable cost to BN_mod_exp_mont_consttime. Median time goes from 0.140s to 0.231s. That cost some, but we're still faster than the original implementation. We're down to one more leak, which is that the BN_rand_range_ex call does not hide |w1|. That one may only be solved probabilistically... Median of 29 RSA keygens: 0m0.123s -> 0m0.145s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I4847cb0053118c572d2dd5f855388b5199fa6ce2 Reviewed-on: https://boringssl-review.googlesource.com/25888 Reviewed-by: Adam Langley <agl@google.com>
2018-02-04 03:39:35 +00:00
// loop_done is all ones if the loop has completed and all zeros otherwise.
crypto_word_t loop_done = 0;
// next_iteration is all ones if we should continue to the next iteration
// (|b| is not a composite witness for |w|). This is equivalent to going to
// step 4.7 in the original algorithm.
crypto_word_t next_iteration = 0;
// Step 4.4. If z = 1 or z = w-1, mask off the loop and continue to the next
// iteration (go to step 4.7).
loop_done = BN_equal_consttime(z, BN_value_one()) |
BN_equal_consttime(z, w1);
loop_done = 0 - loop_done; // Make it all zeros or all ones.
next_iteration = loop_done; // Go to step 4.7 if |loop_done|.
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// Step 4.5. We use Montgomery-encoding for better performance and to avoid
// timing leaks.
if (!BN_to_montgomery(z, z, mont, ctx)) {
goto err;
}
Don't leak |a| in the primality test. (This is actually slightly silly as |a|'s probability distribution falls off exponentially, but it's easy enough to do right.) Instead, we run the loop to the end. This is still performant because we can, as before, return early on composite numbers. Only two calls actually run to the end. Moreover, running to the end has comparable cost to BN_mod_exp_mont_consttime. Median time goes from 0.140s to 0.231s. That cost some, but we're still faster than the original implementation. We're down to one more leak, which is that the BN_rand_range_ex call does not hide |w1|. That one may only be solved probabilistically... Median of 29 RSA keygens: 0m0.123s -> 0m0.145s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I4847cb0053118c572d2dd5f855388b5199fa6ce2 Reviewed-on: https://boringssl-review.googlesource.com/25888 Reviewed-by: Adam Langley <agl@google.com>
2018-02-04 03:39:35 +00:00
// To avoid leaking |a|, we run the loop to |w_len| and mask off all
// iterations once |j| = |a|.
for (int j = 1; j < w_len; j++) {
loop_done |= constant_time_eq_int(j, a);
// Step 4.5.1.
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
if (!BN_mod_mul_montgomery(z, z, z, mont, ctx)) {
goto err;
}
Don't leak |a| in the primality test. (This is actually slightly silly as |a|'s probability distribution falls off exponentially, but it's easy enough to do right.) Instead, we run the loop to the end. This is still performant because we can, as before, return early on composite numbers. Only two calls actually run to the end. Moreover, running to the end has comparable cost to BN_mod_exp_mont_consttime. Median time goes from 0.140s to 0.231s. That cost some, but we're still faster than the original implementation. We're down to one more leak, which is that the BN_rand_range_ex call does not hide |w1|. That one may only be solved probabilistically... Median of 29 RSA keygens: 0m0.123s -> 0m0.145s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I4847cb0053118c572d2dd5f855388b5199fa6ce2 Reviewed-on: https://boringssl-review.googlesource.com/25888 Reviewed-by: Adam Langley <agl@google.com>
2018-02-04 03:39:35 +00:00
// Step 4.5.2. If z = w-1 and the loop is not done, run through the next
// iteration.
crypto_word_t z_is_w1_mont = BN_equal_consttime(z, w1_mont) & ~loop_done;
z_is_w1_mont = 0 - z_is_w1_mont; // Make it all zeros or all ones.
loop_done |= z_is_w1_mont;
next_iteration |= z_is_w1_mont; // Go to step 4.7 if |z_is_w1_mont|.
// Step 4.5.3. If z = 1 and the loop is not done, w is composite and we
// may exit in variable time.
if (BN_equal_consttime(z, one_mont) & ~loop_done) {
assert(!next_iteration);
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
break;
}
}
Don't leak |a| in the primality test. (This is actually slightly silly as |a|'s probability distribution falls off exponentially, but it's easy enough to do right.) Instead, we run the loop to the end. This is still performant because we can, as before, return early on composite numbers. Only two calls actually run to the end. Moreover, running to the end has comparable cost to BN_mod_exp_mont_consttime. Median time goes from 0.140s to 0.231s. That cost some, but we're still faster than the original implementation. We're down to one more leak, which is that the BN_rand_range_ex call does not hide |w1|. That one may only be solved probabilistically... Median of 29 RSA keygens: 0m0.123s -> 0m0.145s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I4847cb0053118c572d2dd5f855388b5199fa6ce2 Reviewed-on: https://boringssl-review.googlesource.com/25888 Reviewed-by: Adam Langley <agl@google.com>
2018-02-04 03:39:35 +00:00
if (!next_iteration) {
// Step 4.6. We did not see z = w-1 before z = 1, so w must be composite.
// (For any prime, the value of z immediately preceding 1 must be -1.
// There are no non-trivial square roots of 1 modulo a prime.)
*is_probably_prime = 0;
ret = 1;
goto err;
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// Step 4.7
if (!BN_GENCB_call(cb, 1, i)) {
goto err;
}
}
Blind the range check for finding a Rabin-Miller witness. Rabin-Miller requires selecting a random number from 2 to |w|-1. This is done by picking an N-bit number and discarding out-of-range values. This leaks information about |w|, so apply blinding. Rather than discard bad values, adjust them to be in range. Though not uniformly selected, these adjusted values are still usable as Rabin-Miller checks. Rabin-Miller is already probabilistic, so we could reach the desired confidence levels by just suitably increasing the iteration count. However, to align with FIPS 186-4, we use a more pessimal analysis: we do not count the non-uniform values towards the iteration count. As a result, this function is more complex and has more timing risk than necessary. We count both total iterations and uniform ones and iterate until we've reached at least |BN_PRIME_CHECKS_BLINDED| and |iterations|, respectively. If the latter is large enough, it will be the limiting factor with high probability and we won't leak information. Note this blinding does not impact most calls when picking primes because composites are rejected early. Only the two secret primes see extra work. So while this does make the BNTest.PrimeChecking test take about 2x longer to run on debug mode, RSA key generation time is fine. Another, perhaps simpler, option here would have to run bn_rand_range_words to the full 100 count, select an arbitrary successful try, and declare failure of the entire keygen process (as we do already) if all tries failed. I went with the option in this CL because I happened to come up with it first, and because the failure probability decreases much faster. Additionally, the option in this CL does not affect composite numbers, while the alternate would. This gives a smaller multiplier on our entropy draw. We also continue to use the "wasted" work for stronger assurance on primality. FIPS' numbers are remarkably low, considering the increase has negligible cost. Thanks to Nathan Benjamin for helping me explore the failure rate as the target count and blinding count change. Now we're down to the rest of RSA keygen, which will require all the operations we've traditionally just avoided in constant-time code! Median of 29 RSA keygens: 0m0.169s -> 0m0.298s (Accuracy beyond 0.1s is questionable. The runs at subsequent test- and rename-only CLs were 0m0.217s, 0m0.245s, 0m0.244s, 0m0.247s.) Bug: 238 Change-Id: Id6406c3020f2585b86946eb17df64ac42f30ebab Reviewed-on: https://boringssl-review.googlesource.com/25890 Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-02-05 04:48:36 +00:00
assert(uniform_iterations >= (crypto_word_t)iterations);
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
*is_probably_prime = 1;
ret = 1;
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
err:
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
BN_MONT_CTX_free(mont);
BN_CTX_end(ctx);
Tolerate a null BN_CTX in BN_primality_test. This used to work, but I broke it on accident in the recent rewrite. Change-Id: I06ab5e06eb0c0a6b67ecc97919654e386f3c2198 Reviewed-on: https://boringssl-review.googlesource.com/26984 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Martin Kreichgauer <martinkr@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-04-03 19:01:12 +01:00
BN_CTX_free(new_ctx);
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
return ret;
}
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
int BN_is_prime_ex(const BIGNUM *candidate, int checks, BN_CTX *ctx,
BN_GENCB *cb) {
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
return BN_is_prime_fasttest_ex(candidate, checks, ctx, 0, cb);
}
int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx,
int do_trial_division, BN_GENCB *cb) {
int is_probably_prime;
if (!BN_primality_test(&is_probably_prime, a, checks, ctx, do_trial_division,
cb)) {
return -1;
}
return is_probably_prime;
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
int BN_enhanced_miller_rabin_primality_test(
enum bn_primality_result_t *out_result, const BIGNUM *w, int iterations,
BN_CTX *ctx, BN_GENCB *cb) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Enhanced Miller-Rabin is only valid on odd integers greater than 3.
Update BN_enhanced_miller_rabin_primality_test to enforce preconditions and accept BN_prime_checks. Change-Id: Ie4ac57d39bca46db33280c500a2092350ccdae67 Reviewed-on: https://boringssl-review.googlesource.com/15371 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-21 20:29:45 +01:00
if (!BN_is_odd(w) || BN_cmp_word(w, 3) <= 0) {
OPENSSL_PUT_ERROR(BN, BN_R_INVALID_INPUT);
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
Update BN_enhanced_miller_rabin_primality_test to enforce preconditions and accept BN_prime_checks. Change-Id: Ie4ac57d39bca46db33280c500a2092350ccdae67 Reviewed-on: https://boringssl-review.googlesource.com/15371 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-21 20:29:45 +01:00
if (iterations == BN_prime_checks) {
iterations = BN_prime_checks_for_size(BN_num_bits(w));
Fix several issues with prime numbers. Firstly, FIPS 186-4 C.3.2 is broken for w=3. In step 4.1 it generates a random, 2-bit number but in step 4.2 it rejects all four possible values and loops forever. Secondly, BN_is_prime_fasttext_ex is broken when trial division is requested and the prime is small. It finds that the prime is a multiple of a known prime and rejects it. We inherited this from OpenSSL. Thirdly, we were missing a BN_CTX_start/end in BN_enhanced_miller_rabin_primality_test, which didn't matter but could have mattered in the future. Change-Id: Ie988e37b14bb22acb005fc0652860be6bbd2a55f Reviewed-on: https://boringssl-review.googlesource.com/15264 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-20 00:40:08 +01:00
}
Update BN_enhanced_miller_rabin_primality_test to enforce preconditions and accept BN_prime_checks. Change-Id: Ie4ac57d39bca46db33280c500a2092350ccdae67 Reviewed-on: https://boringssl-review.googlesource.com/15371 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-21 20:29:45 +01:00
int ret = 0;
BN_MONT_CTX *mont = NULL;
Fix several issues with prime numbers. Firstly, FIPS 186-4 C.3.2 is broken for w=3. In step 4.1 it generates a random, 2-bit number but in step 4.2 it rejects all four possible values and loops forever. Secondly, BN_is_prime_fasttext_ex is broken when trial division is requested and the prime is small. It finds that the prime is a multiple of a known prime and rejects it. We inherited this from OpenSSL. Thirdly, we were missing a BN_CTX_start/end in BN_enhanced_miller_rabin_primality_test, which didn't matter but could have mattered in the future. Change-Id: Ie988e37b14bb22acb005fc0652860be6bbd2a55f Reviewed-on: https://boringssl-review.googlesource.com/15264 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-20 00:40:08 +01:00
BN_CTX_start(ctx);
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
BIGNUM *w1 = BN_CTX_get(ctx);
if (w1 == NULL ||
!BN_copy(w1, w) ||
!BN_sub_word(w1, 1)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Write w1 as m*2^a (Steps 1 and 2).
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
int a = 0;
while (!BN_is_bit_set(w1, a)) {
a++;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
BIGNUM *m = BN_CTX_get(ctx);
if (m == NULL ||
!BN_rshift(m, w1, a)) {
goto err;
}
BIGNUM *b = BN_CTX_get(ctx);
BIGNUM *g = BN_CTX_get(ctx);
BIGNUM *z = BN_CTX_get(ctx);
BIGNUM *x = BN_CTX_get(ctx);
BIGNUM *x1 = BN_CTX_get(ctx);
if (b == NULL ||
g == NULL ||
z == NULL ||
x == NULL ||
x1 == NULL) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Make primality testing mostly constant-time. The extra details in Enhanced Rabin-Miller are only used in RSA_check_key_fips, on the public RSA modulus, which the static linker will drop in most of our consumers anyway. Implement normal Rabin-Miller for RSA keygen and use Montgomery reduction so it runs in constant-time. Note that we only need to avoid leaking information about the input if it's a large prime. If the number ends up composite, or we find it in our table of small primes, we can return immediately. The leaks not addressed by this CL are: - The difficulty of selecting |b| leaks information about |w|. - The distribution of whether step 4.4 runs leaks information about w. - We leak |a| (the largest power of two which divides w) everywhere. - BN_mod_word in the trial division is not constant-time. These will be resolved in follow-up changes. Median of 29 RSA keygens: 0m0.521 -> 0m0.621s (Accuracy beyond 0.1s is questionable.) Bug: 238 Change-Id: I0cf0ff22079732a0a3ababfe352bb4327e95b879 Reviewed-on: https://boringssl-review.googlesource.com/25886 Reviewed-by: Adam Langley <agl@google.com>
2018-01-27 23:49:02 +00:00
// Montgomery setup for computations mod w
Add a function which folds BN_MONT_CTX_{new,set} together. These empty states aren't any use to either caller or implementor. Change-Id: If0b748afeeb79e4a1386182e61c5b5ecf838de62 Reviewed-on: https://boringssl-review.googlesource.com/25254 Reviewed-by: Adam Langley <agl@google.com>
2018-01-23 22:03:26 +00:00
mont = BN_MONT_CTX_new_for_modulus(w, ctx);
if (mont == NULL) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// The following loop performs in inner iteration of the Enhanced Miller-Rabin
// Primality test (Step 4).
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
for (int i = 1; i <= iterations; i++) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.1-4.2
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (!BN_rand_range_ex(b, 2, w1)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.3-4.4
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (!BN_gcd(g, b, w, ctx)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (BN_cmp_word(g, 1) > 0) {
*out_result = bn_composite;
ret = 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.5
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (!BN_mod_exp_mont(z, b, m, w, ctx, mont)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.6
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (BN_is_one(z) || BN_cmp(z, w1) == 0) {
goto loop;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.7
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
for (int j = 1; j < a; j++) {
if (!BN_copy(x, z) || !BN_mod_mul(z, x, x, w, ctx)) {
goto err;
}
if (BN_cmp(z, w1) == 0) {
goto loop;
}
if (BN_is_one(z)) {
goto composite;
}
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.8-4.9
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (!BN_copy(x, z) || !BN_mod_mul(z, x, x, w, ctx)) {
goto err;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.10-4.11
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (!BN_is_one(z) && !BN_copy(x, z)) {
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
composite:
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.12-4.14
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (!BN_copy(x1, x) ||
!BN_sub_word(x1, 1) ||
!BN_gcd(g, x1, w, ctx)) {
goto err;
}
if (BN_cmp_word(g, 1) > 0) {
*out_result = bn_composite;
} else {
*out_result = bn_non_prime_power_composite;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
ret = 1;
goto err;
loop:
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Step 4.15
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
if (!BN_GENCB_call(cb, 1, i)) {
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
*out_result = bn_probably_prime;
ret = 1;
err:
Fix several issues with prime numbers. Firstly, FIPS 186-4 C.3.2 is broken for w=3. In step 4.1 it generates a random, 2-bit number but in step 4.2 it rejects all four possible values and loops forever. Secondly, BN_is_prime_fasttext_ex is broken when trial division is requested and the prime is small. It finds that the prime is a multiple of a known prime and rejects it. We inherited this from OpenSSL. Thirdly, we were missing a BN_CTX_start/end in BN_enhanced_miller_rabin_primality_test, which didn't matter but could have mattered in the future. Change-Id: Ie988e37b14bb22acb005fc0652860be6bbd2a55f Reviewed-on: https://boringssl-review.googlesource.com/15264 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-20 00:40:08 +01:00
BN_MONT_CTX_free(mont);
BN_CTX_end(ctx);
Implement Enhanced Miller-Rabin primality test for FIPS. Change-Id: I4968df9f37b450f0799ac7ca19900c7b909e7f6d Reviewed-on: https://boringssl-review.googlesource.com/15127 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 21:03:38 +01:00
return ret;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
static int probable_prime(BIGNUM *rnd, int bits) {
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
uint16_t mods[OPENSSL_ARRAY_SIZE(kPrimes)];
const size_t num_primes = num_trial_division_primes(rnd);
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
BN_ULONG delta;
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
BN_ULONG maxdelta = BN_MASK2 - kPrimes[num_primes - 1];
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
char is_single_word = bits <= BN_BITS2;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
again:
Add constants for BN_rand and use them. See upstream's f67cbb74437842a0f88f84f43a0faa968ca77b35 and 2301d91dd58d9827865e360d616291f2549ec5bf. Change-Id: I3b79323847a7610143a9dfb9b5b45bf7a33d8690 Reviewed-on: https://boringssl-review.googlesource.com/10369 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-16 15:03:45 +01:00
if (!BN_rand(rnd, bits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ODD)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// we now have a random number 'rnd' to test.
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
for (size_t i = 1; i < num_primes; i++) {
mods[i] = bn_mod_u16_consttime(rnd, kPrimes[i]);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// If bits is so small that it fits into a single word then we
// additionally don't want to exceed that many bits.
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
if (is_single_word) {
Avoid undefined behavior in probable_prime. (Imported from upstream's e4676e900f165f5272991443225813002300b09b.) Change-Id: I678e158c223daf2f7f9114f4e743d531fe2e2a93 Reviewed-on: https://boringssl-review.googlesource.com/4044 Reviewed-by: Adam Langley <agl@google.com>
2015-03-19 00:37:12 +00:00
BN_ULONG size_limit;
if (bits == BN_BITS2) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Avoid undefined behavior.
Use BN_get_word in probable_prime. These two functions behave identically if the input is a word, which is true if bits <= BN_BITS2. This also matches upstream's version of the function. I'm guessing the patch was originally submitted as we have it, perhaps because we didn't notice BN_get_word at the time, and it got switched to the existing BN_get_word function in review. Change-Id: I7847e3086aab871c5aa28e15fae6f89c964862d1 Reviewed-on: https://boringssl-review.googlesource.com/14331 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-23 19:10:10 +00:00
size_limit = ~((BN_ULONG)0) - BN_get_word(rnd);
Avoid undefined behavior in probable_prime. (Imported from upstream's e4676e900f165f5272991443225813002300b09b.) Change-Id: I678e158c223daf2f7f9114f4e743d531fe2e2a93 Reviewed-on: https://boringssl-review.googlesource.com/4044 Reviewed-by: Adam Langley <agl@google.com>
2015-03-19 00:37:12 +00:00
} else {
Use BN_get_word in probable_prime. These two functions behave identically if the input is a word, which is true if bits <= BN_BITS2. This also matches upstream's version of the function. I'm guessing the patch was originally submitted as we have it, perhaps because we didn't notice BN_get_word at the time, and it got switched to the existing BN_get_word function in review. Change-Id: I7847e3086aab871c5aa28e15fae6f89c964862d1 Reviewed-on: https://boringssl-review.googlesource.com/14331 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-23 19:10:10 +00:00
size_limit = (((BN_ULONG)1) << bits) - BN_get_word(rnd) - 1;
Avoid undefined behavior in probable_prime. (Imported from upstream's e4676e900f165f5272991443225813002300b09b.) Change-Id: I678e158c223daf2f7f9114f4e743d531fe2e2a93 Reviewed-on: https://boringssl-review.googlesource.com/4044 Reviewed-by: Adam Langley <agl@google.com>
2015-03-19 00:37:12 +00:00
}
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
if (size_limit < maxdelta) {
maxdelta = size_limit;
}
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
delta = 0;
loop:
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
if (is_single_word) {
Use BN_get_word in probable_prime. These two functions behave identically if the input is a word, which is true if bits <= BN_BITS2. This also matches upstream's version of the function. I'm guessing the patch was originally submitted as we have it, perhaps because we didn't notice BN_get_word at the time, and it got switched to the existing BN_get_word function in review. Change-Id: I7847e3086aab871c5aa28e15fae6f89c964862d1 Reviewed-on: https://boringssl-review.googlesource.com/14331 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-23 19:10:10 +00:00
BN_ULONG rnd_word = BN_get_word(rnd);
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// In the case that the candidate prime is a single word then
// we check that:
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
// 1) It's greater than kPrimes[i] because we shouldn't reject
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// 3 as being a prime number because it's a multiple of
// three.
// 2) That it's not a multiple of a known prime. We don't
// check that rnd-1 is also coprime to all the known
// primes because there aren't many small primes where
// that's true.
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
for (size_t i = 1; i < num_primes && kPrimes[i] < rnd_word; i++) {
if ((mods[i] + delta) % kPrimes[i] == 0) {
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
delta += 2;
Add in missing curly braces part 1. Everything before crypto/ec. Change-Id: Icbfab8e4ffe5cc56bf465eb57d3fdad3959a085c Reviewed-on: https://boringssl-review.googlesource.com/3401 Reviewed-by: Adam Langley <agl@google.com>
2015-02-11 06:16:26 +00:00
if (delta > maxdelta) {
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
goto again;
Add in missing curly braces part 1. Everything before crypto/ec. Change-Id: Icbfab8e4ffe5cc56bf465eb57d3fdad3959a085c Reviewed-on: https://boringssl-review.googlesource.com/3401 Reviewed-by: Adam Langley <agl@google.com>
2015-02-11 06:16:26 +00:00
}
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
goto loop;
}
}
} else {
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
for (size_t i = 1; i < num_primes; i++) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// check that rnd is not a prime and also
// that gcd(rnd-1,primes) == 1 (except for 2)
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
if (((mods[i] + delta) % kPrimes[i]) <= 1) {
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
delta += 2;
Add in missing curly braces part 1. Everything before crypto/ec. Change-Id: Icbfab8e4ffe5cc56bf465eb57d3fdad3959a085c Reviewed-on: https://boringssl-review.googlesource.com/3401 Reviewed-by: Adam Langley <agl@google.com>
2015-02-11 06:16:26 +00:00
if (delta > maxdelta) {
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
goto again;
Add in missing curly braces part 1. Everything before crypto/ec. Change-Id: Icbfab8e4ffe5cc56bf465eb57d3fdad3959a085c Reviewed-on: https://boringssl-review.googlesource.com/3401 Reviewed-by: Adam Langley <agl@google.com>
2015-02-11 06:16:26 +00:00
}
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
goto loop;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
}
if (!BN_add_word(rnd, delta)) {
return 0;
}
Avoid signed/unsigned comparison in crypto/bn's |probable_prime|. Change-Id: I768a348e1e34207bca55c7d093c1ba8975e304ab Reviewed-on: https://boringssl-review.googlesource.com/6213 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-12 23:39:14 +01:00
if (BN_num_bits(rnd) != (unsigned)bits) {
Small prime generation. Ensure that, when generating small primes, the result is actually of the requested size. Fixes OpenSSL #2701. This change does not address the cases of generating safe primes, or where the |add| parameter is non-NULL.
2014-06-20 20:00:00 +01:00
goto again;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 1;
}
static int probable_prime_dh(BIGNUM *rnd, int bits, const BIGNUM *add,
const BIGNUM *rem, BN_CTX *ctx) {
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
int ret = 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
BIGNUM *t1;
BN_CTX_start(ctx);
if ((t1 = BN_CTX_get(ctx)) == NULL) {
goto err;
}
Add constants for BN_rand and use them. See upstream's f67cbb74437842a0f88f84f43a0faa968ca77b35 and 2301d91dd58d9827865e360d616291f2549ec5bf. Change-Id: I3b79323847a7610143a9dfb9b5b45bf7a33d8690 Reviewed-on: https://boringssl-review.googlesource.com/10369 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-16 15:03:45 +01:00
if (!BN_rand(rnd, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// we need ((rnd-rem) % add) == 0
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (!BN_mod(t1, rnd, add, ctx)) {
goto err;
}
if (!BN_sub(rnd, rnd, t1)) {
goto err;
}
if (rem == NULL) {
if (!BN_add_word(rnd, 1)) {
goto err;
}
} else {
if (!BN_add(rnd, rnd, rem)) {
goto err;
}
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// we now have a random number 'rand' to test.
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
const size_t num_primes = num_trial_division_primes(rnd);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
loop:
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
for (size_t i = 1; i < num_primes; i++) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// check that rnd is a prime
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
if (bn_mod_u16_consttime(rnd, kPrimes[i]) <= 1) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (!BN_add(rnd, rnd, add)) {
goto err;
}
goto loop;
}
}
ret = 1;
err:
BN_CTX_end(ctx);
return ret;
}
static int probable_prime_dh_safe(BIGNUM *p, int bits, const BIGNUM *padd,
const BIGNUM *rem, BN_CTX *ctx) {
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
int ret = 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
BIGNUM *t1, *qadd, *q;
bits--;
BN_CTX_start(ctx);
t1 = BN_CTX_get(ctx);
q = BN_CTX_get(ctx);
qadd = BN_CTX_get(ctx);
if (qadd == NULL) {
goto err;
}
if (!BN_rshift1(qadd, padd)) {
goto err;
}
Add constants for BN_rand and use them. See upstream's f67cbb74437842a0f88f84f43a0faa968ca77b35 and 2301d91dd58d9827865e360d616291f2549ec5bf. Change-Id: I3b79323847a7610143a9dfb9b5b45bf7a33d8690 Reviewed-on: https://boringssl-review.googlesource.com/10369 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-16 15:03:45 +01:00
if (!BN_rand(q, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// we need ((rnd-rem) % add) == 0
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (!BN_mod(t1, q, qadd, ctx)) {
goto err;
}
if (!BN_sub(q, q, t1)) {
goto err;
}
if (rem == NULL) {
if (!BN_add_word(q, 1)) {
goto err;
}
} else {
if (!BN_rshift1(t1, rem)) {
goto err;
}
if (!BN_add(q, q, t1)) {
goto err;
}
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// we now have a random number 'rand' to test.
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (!BN_lshift1(p, q)) {
goto err;
}
if (!BN_add_word(p, 1)) {
goto err;
}
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
const size_t num_primes = num_trial_division_primes(p);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
loop:
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
for (size_t i = 1; i < num_primes; i++) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// check that p and q are prime
// check that for p and q
// gcd(p-1,primes) == 1 (except for 2)
Drop some trial-division primes for 1024-bit candidates. This is helpful at smaller sizes because the benefits of an unlikely hit by trival-division are smaller. The full set of kPrimes eliminates about 94.3% of random numbers. The first quarter eliminates about 93.2% of them. But the little extra power of the full set seems to be borderline for RSA 3072 and clearly positive for RSA 4096. Did 316 RSA 2048 key-gen operations in 30035598us (10.5 ops/sec) min: 19423us, median: 80448us, max: 394265us Change-Id: Iee53f721329674ae7a08fabd85b4f645c24e119d Reviewed-on: https://boringssl-review.googlesource.com/26944 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2018-03-31 00:18:54 +01:00
if (bn_mod_u16_consttime(p, kPrimes[i]) == 0 ||
bn_mod_u16_consttime(q, kPrimes[i]) == 0) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (!BN_add(p, p, padd)) {
goto err;
}
if (!BN_add(q, q, qadd)) {
goto err;
}
goto loop;
}
}
ret = 1;
err:
BN_CTX_end(ctx);
return ret;
}
Reference in New Issue Copy Permalink