mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-07-09 23:33:46 -05:00
Whitespace rationalisation of entire code base.
The number of people has been steadily increasing who read our source
code with an editor that thinks tab stops are 4 spaces apart, as
opposed to the traditional tty-derived 8 that the PuTTY code expects.
So I've been wondering for ages about just fixing it, and switching to
a spaces-only policy throughout the code. And I recently found out
about 'git blame -w', which should make this change not too disruptive
for the purposes of source-control archaeology; so perhaps now is the
time.
While I'm at it, I've also taken the opportunity to remove all the
trailing spaces from source lines (on the basis that git dislikes
them, and is the only thing that seems to have a strong opinion one
way or the other).
Apologies to anyone downstream of this code who has complicated patch
sets to rebase past this change. I don't intend it to be needed again.
This commit is contained in:
Simon Tatham
102
sshprime.c
102
sshprime.c
@ -9,18 +9,18 @@
|
||||
/*
|
||||
* This prime generation algorithm is pretty much cribbed from
|
||||
* OpenSSL. The algorithm is:
|
||||
*
|
||||
*
|
||||
* - invent a B-bit random number and ensure the top and bottom
|
||||
* bits are set (so it's definitely B-bit, and it's definitely
|
||||
* odd)
|
||||
*
|
||||
*
|
||||
* - see if it's coprime to all primes below 2^16; increment it by
|
||||
* two until it is (this shouldn't take long in general)
|
||||
*
|
||||
*
|
||||
* - perform the Miller-Rabin primality test enough times to
|
||||
* ensure the probability of it being composite is 2^-80 or
|
||||
* less
|
||||
*
|
||||
*
|
||||
* - go back to square one if any M-R test fails.
|
||||
*/
|
||||
|
||||
@ -29,30 +29,30 @@
|
||||
* test. The Fermat test just checks that a^(p-1) == 1 mod p; this
|
||||
* is vulnerable to Carmichael numbers. Miller-Rabin considers how
|
||||
* that 1 is derived as well.
|
||||
*
|
||||
*
|
||||
* Lemma: if a^2 == 1 (mod p), and p is prime, then either a == 1
|
||||
* or a == -1 (mod p).
|
||||
*
|
||||
*
|
||||
* Proof: p divides a^2-1, i.e. p divides (a+1)(a-1). Hence,
|
||||
* since p is prime, either p divides (a+1) or p divides (a-1).
|
||||
* But this is the same as saying that either a is congruent to
|
||||
* -1 mod p or a is congruent to +1 mod p. []
|
||||
*
|
||||
*
|
||||
* Comment: This fails when p is not prime. Consider p=mn, so
|
||||
* that mn divides (a+1)(a-1). Now we could have m dividing (a+1)
|
||||
* and n dividing (a-1), without the whole of mn dividing either.
|
||||
* For example, consider a=10 and p=99. 99 = 9 * 11; 9 divides
|
||||
* 10-1 and 11 divides 10+1, so a^2 is congruent to 1 mod p
|
||||
* without a having to be congruent to either 1 or -1.
|
||||
*
|
||||
*
|
||||
* So the Miller-Rabin test, as well as considering a^(p-1),
|
||||
* considers a^((p-1)/2), a^((p-1)/4), and so on as far as it can
|
||||
* go. In other words. we write p-1 as q * 2^k, with k as large as
|
||||
* possible (i.e. q must be odd), and we consider the powers
|
||||
*
|
||||
*
|
||||
* a^(q*2^0) a^(q*2^1) ... a^(q*2^(k-1)) a^(q*2^k)
|
||||
* i.e. a^((n-1)/2^k) a^((n-1)/2^(k-1)) ... a^((n-1)/2) a^(n-1)
|
||||
*
|
||||
*
|
||||
* If p is to be prime, the last of these must be 1. Therefore, by
|
||||
* the above lemma, the one before it must be either 1 or -1. And
|
||||
* _if_ it's 1, then the one before that must be either 1 or -1,
|
||||
@ -61,27 +61,27 @@
|
||||
* 1s will be as long as the list so we'll never get to see what
|
||||
* lies before it. This doesn't count as a test failure because it
|
||||
* hasn't _proved_ that p is not prime.)
|
||||
*
|
||||
*
|
||||
* For example, consider a=2 and p=1729. 1729 is a Carmichael
|
||||
* number: although it's not prime, it satisfies a^(p-1) == 1 mod p
|
||||
* for any a coprime to it. So the Fermat test wouldn't have a
|
||||
* problem with it at all, unless we happened to stumble on an a
|
||||
* which had a common factor.
|
||||
*
|
||||
*
|
||||
* So. 1729 - 1 equals 27 * 2^6. So we look at
|
||||
*
|
||||
*
|
||||
* 2^27 mod 1729 == 645
|
||||
* 2^108 mod 1729 == 1065
|
||||
* 2^216 mod 1729 == 1
|
||||
* 2^432 mod 1729 == 1
|
||||
* 2^864 mod 1729 == 1
|
||||
* 2^1728 mod 1729 == 1
|
||||
*
|
||||
*
|
||||
* We do have a trailing string of 1s, so the Fermat test would
|
||||
* have been happy. But this trailing string of 1s is preceded by
|
||||
* 1065; whereas if 1729 were prime, we'd expect to see it preceded
|
||||
* by -1 (i.e. 1728.). Guards! Seize this impostor.
|
||||
*
|
||||
*
|
||||
* (If we were unlucky, we might have tried a=16 instead of a=2;
|
||||
* now 16^27 mod 1729 == 1, so we would have seen a long string of
|
||||
* 1s and wouldn't have seen the thing _before_ the 1s. So, just
|
||||
@ -89,16 +89,16 @@
|
||||
* of a which fail to show up its compositeness. So we try several,
|
||||
* just like the Fermat test. The difference is that Miller-Rabin
|
||||
* is not _in general_ fooled by Carmichael numbers.)
|
||||
*
|
||||
*
|
||||
* Put simply, then, the Miller-Rabin test requires us to:
|
||||
*
|
||||
*
|
||||
* 1. write p-1 as q * 2^k, with q odd
|
||||
* 2. compute z = (a^q) mod p.
|
||||
* 3. report success if z == 1 or z == -1.
|
||||
* 4. square z at most k-1 times, and report success if it becomes
|
||||
* -1 at any point.
|
||||
* 5. report failure otherwise.
|
||||
*
|
||||
*
|
||||
* (We expect z to become -1 after at most k-1 squarings, because
|
||||
* if it became -1 after k squarings then a^(p-1) would fail to be
|
||||
* 1. And we don't need to investigate what happens after we see a
|
||||
@ -155,10 +155,10 @@ static unsigned short mp_mod_short(mp_int *x, unsigned short modulus)
|
||||
/*
|
||||
* Generate a prime. We can deal with various extra properties of
|
||||
* the prime:
|
||||
*
|
||||
*
|
||||
* - to speed up use in RSA, we can arrange to select a prime with
|
||||
* the property (prime % modulus) != residue.
|
||||
*
|
||||
*
|
||||
* - for use in DSA, we can arrange to select a prime which is one
|
||||
* more than a multiple of a dirty great bignum. In this case
|
||||
* `bits' gives the size of the factor by which we _multiply_
|
||||
@ -204,10 +204,10 @@ mp_int *primegen(
|
||||
mp_set_bit(p, bits-fbsize + i, 1 & (firstbits >> i));
|
||||
|
||||
if (factor) {
|
||||
mp_int *tmp = p;
|
||||
p = mp_mul(tmp, factor);
|
||||
mp_free(tmp);
|
||||
assert(mp_get_bit(p, 0) == 0);
|
||||
mp_int *tmp = p;
|
||||
p = mp_mul(tmp, factor);
|
||||
mp_free(tmp);
|
||||
assert(mp_get_bit(p, 0) == 0);
|
||||
mp_set_bit(p, 0, 1);
|
||||
}
|
||||
|
||||
@ -222,7 +222,7 @@ mp_int *primegen(
|
||||
/* List the moduli */
|
||||
unsigned long moduli[NPRIMES + 1];
|
||||
for (size_t i = 0; i < NPRIMES; i++)
|
||||
moduli[i] = primes[i];
|
||||
moduli[i] = primes[i];
|
||||
moduli[NPRIMES] = modulus;
|
||||
|
||||
/* Find the residue of our starting number mod each of them. Also
|
||||
@ -231,11 +231,11 @@ mp_int *primegen(
|
||||
* we're incrementing by multiples of factor). */
|
||||
unsigned long residues[NPRIMES + 1], multipliers[NPRIMES + 1];
|
||||
for (size_t i = 0; i < lenof(moduli); i++) {
|
||||
residues[i] = mp_mod_short(p, moduli[i]);
|
||||
if (factor)
|
||||
multipliers[i] = mp_mod_short(factor, moduli[i]);
|
||||
else
|
||||
multipliers[i] = 1;
|
||||
residues[i] = mp_mod_short(p, moduli[i]);
|
||||
if (factor)
|
||||
multipliers[i] = mp_mod_short(factor, moduli[i]);
|
||||
else
|
||||
multipliers[i] = 1;
|
||||
}
|
||||
|
||||
/* Adjust the last entry so that it avoids a residue other than zero */
|
||||
@ -249,9 +249,9 @@ mp_int *primegen(
|
||||
*/
|
||||
unsigned delta = 0;
|
||||
while (1) {
|
||||
for (size_t i = 0; i < lenof(moduli); i++)
|
||||
if (!((residues[i] + delta * multipliers[i]) % moduli[i]))
|
||||
goto found_a_zero;
|
||||
for (size_t i = 0; i < lenof(moduli); i++)
|
||||
if (!((residues[i] + delta * multipliers[i]) % moduli[i]))
|
||||
goto found_a_zero;
|
||||
|
||||
/* If we didn't exit that loop by goto, we've got our candidate. */
|
||||
break;
|
||||
@ -268,7 +268,7 @@ mp_int *primegen(
|
||||
* Having found a plausible increment, actually add it on.
|
||||
*/
|
||||
if (factor) {
|
||||
mp_int *d = mp_from_integer(delta);
|
||||
mp_int *d = mp_from_integer(delta);
|
||||
mp_int *df = mp_mul(d, factor);
|
||||
mp_add_into(p, p, df);
|
||||
mp_free(d);
|
||||
@ -292,7 +292,7 @@ mp_int *primegen(
|
||||
*/
|
||||
size_t k;
|
||||
for (k = 0; mp_get_bit(p, k) == !k; k++)
|
||||
continue; /* find first 1 bit in p-1 */
|
||||
continue; /* find first 1 bit in p-1 */
|
||||
mp_int *q = mp_rshift_safe(p, k);
|
||||
|
||||
/*
|
||||
@ -310,27 +310,27 @@ mp_int *primegen(
|
||||
* Now, for each check ...
|
||||
*/
|
||||
for (unsigned check = 0; check < checks && !known_bad; check++) {
|
||||
/*
|
||||
* Invent a random number between 1 and p-1.
|
||||
*/
|
||||
/*
|
||||
* Invent a random number between 1 and p-1.
|
||||
*/
|
||||
mp_int *w = mp_random_in_range(two, pm1);
|
||||
monty_import_into(mc, w, w);
|
||||
|
||||
pfn(pfnparam, PROGFN_PROGRESS, phase, ++progress);
|
||||
pfn(pfnparam, PROGFN_PROGRESS, phase, ++progress);
|
||||
|
||||
/*
|
||||
* Compute w^q mod p.
|
||||
*/
|
||||
mp_int *wqp = monty_pow(mc, w, q);
|
||||
mp_free(w);
|
||||
/*
|
||||
* Compute w^q mod p.
|
||||
*/
|
||||
mp_int *wqp = monty_pow(mc, w, q);
|
||||
mp_free(w);
|
||||
|
||||
/*
|
||||
* See if this is 1, or if it is -1, or if it becomes -1
|
||||
* when squared at most k-1 times.
|
||||
*/
|
||||
/*
|
||||
* See if this is 1, or if it is -1, or if it becomes -1
|
||||
* when squared at most k-1 times.
|
||||
*/
|
||||
bool passed = false;
|
||||
|
||||
if (mp_cmp_eq(wqp, monty_identity(mc)) || mp_cmp_eq(wqp, m_pm1)) {
|
||||
if (mp_cmp_eq(wqp, monty_identity(mc)) || mp_cmp_eq(wqp, m_pm1)) {
|
||||
passed = true;
|
||||
} else {
|
||||
for (size_t i = 0; i < k - 1; i++) {
|
||||
@ -340,12 +340,12 @@ mp_int *primegen(
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!passed)
|
||||
known_bad = true;
|
||||
|
||||
mp_free(wqp);
|
||||
mp_free(wqp);
|
||||
}
|
||||
|
||||
mp_free(q);
|
||||
|
||||
Reference in New Issue
Block a user