+++ /dev/null
-/*\r
- * RSA key generation.\r
- */\r
-\r
-#include "ssh.h"\r
-\r
-#define RSA_EXPONENT 37 /* we like this prime */\r
-\r
-int rsa_generate(struct RSAKey *key, int bits, progfn_t pfn,\r
- void *pfnparam)\r
-{\r
- Bignum pm1, qm1, phi_n;\r
-\r
- /*\r
- * Set up the phase limits for the progress report. We do this\r
- * by passing minus the phase number.\r
- *\r
- * For prime generation: our initial filter finds things\r
- * coprime to everything below 2^16. Computing the product of\r
- * (p-1)/p for all prime p below 2^16 gives about 20.33; so\r
- * among B-bit integers, one in every 20.33 will get through\r
- * the initial filter to be a candidate prime.\r
- *\r
- * Meanwhile, we are searching for primes in the region of 2^B;\r
- * since pi(x) ~ x/log(x), when x is in the region of 2^B, the\r
- * prime density will be d/dx pi(x) ~ 1/log(B), i.e. about\r
- * 1/0.6931B. So the chance of any given candidate being prime\r
- * is 20.33/0.6931B, which is roughly 29.34 divided by B.\r
- *\r
- * So now we have this probability P, we're looking at an\r
- * exponential distribution with parameter P: we will manage in\r
- * one attempt with probability P, in two with probability\r
- * P(1-P), in three with probability P(1-P)^2, etc. The\r
- * probability that we have still not managed to find a prime\r
- * after N attempts is (1-P)^N.\r
- * \r
- * We therefore inform the progress indicator of the number B\r
- * (29.34/B), so that it knows how much to increment by each\r
- * time. We do this in 16-bit fixed point, so 29.34 becomes\r
- * 0x1D.57C4.\r
- */\r
- pfn(pfnparam, PROGFN_PHASE_EXTENT, 1, 0x10000);\r
- pfn(pfnparam, PROGFN_EXP_PHASE, 1, -0x1D57C4 / (bits / 2));\r
- pfn(pfnparam, PROGFN_PHASE_EXTENT, 2, 0x10000);\r
- pfn(pfnparam, PROGFN_EXP_PHASE, 2, -0x1D57C4 / (bits - bits / 2));\r
- pfn(pfnparam, PROGFN_PHASE_EXTENT, 3, 0x4000);\r
- pfn(pfnparam, PROGFN_LIN_PHASE, 3, 5);\r
- pfn(pfnparam, PROGFN_READY, 0, 0);\r
-\r
- /*\r
- * We don't generate e; we just use a standard one always.\r
- */\r
- key->exponent = bignum_from_long(RSA_EXPONENT);\r
-\r
- /*\r
- * Generate p and q: primes with combined length `bits', not\r
- * congruent to 1 modulo e. (Strictly speaking, we wanted (p-1)\r
- * and e to be coprime, and (q-1) and e to be coprime, but in\r
- * general that's slightly more fiddly to arrange. By choosing\r
- * a prime e, we can simplify the criterion.)\r
- */\r
- key->p = primegen(bits / 2, RSA_EXPONENT, 1, NULL,\r
- 1, pfn, pfnparam);\r
- key->q = primegen(bits - bits / 2, RSA_EXPONENT, 1, NULL,\r
- 2, pfn, pfnparam);\r
-\r
- /*\r
- * Ensure p > q, by swapping them if not.\r
- */\r
- if (bignum_cmp(key->p, key->q) < 0) {\r
- Bignum t = key->p;\r
- key->p = key->q;\r
- key->q = t;\r
- }\r
-\r
- /*\r
- * Now we have p, q and e. All we need to do now is work out\r
- * the other helpful quantities: n=pq, d=e^-1 mod (p-1)(q-1),\r
- * and (q^-1 mod p).\r
- */\r
- pfn(pfnparam, PROGFN_PROGRESS, 3, 1);\r
- key->modulus = bigmul(key->p, key->q);\r
- pfn(pfnparam, PROGFN_PROGRESS, 3, 2);\r
- pm1 = copybn(key->p);\r
- decbn(pm1);\r
- qm1 = copybn(key->q);\r
- decbn(qm1);\r
- phi_n = bigmul(pm1, qm1);\r
- pfn(pfnparam, PROGFN_PROGRESS, 3, 3);\r
- freebn(pm1);\r
- freebn(qm1);\r
- key->private_exponent = modinv(key->exponent, phi_n);\r
- pfn(pfnparam, PROGFN_PROGRESS, 3, 4);\r
- key->iqmp = modinv(key->q, key->p);\r
- pfn(pfnparam, PROGFN_PROGRESS, 3, 5);\r
-\r
- /*\r
- * Clean up temporary numbers.\r
- */\r
- freebn(phi_n);\r
-\r
- return 1;\r
-}\r
OSDN Git Service
