nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-07-01 11:32:48 -05:00
Code Issues Projects Releases Wiki Activity

RSA generation: option to generate strong primes.

Browse Source 
A 'strong' prime, as defined by the Handbook of Applied Cryptography,
is a prime p such that each of p-1 and p+1 has a large prime factor,
and that the large factor q of p-1 is such that q-1 in turn _also_ has
a large prime factor.

HoAC says that making your RSA key using primes of this form defeats
some factoring algorithms - but there are other faster algorithms to
which it makes no difference. So this is probably not a useful
precaution in practice. However, it has been recommended in the past
by some official standards, and it's easy to implement given the new
general facility in PrimeCandidateSource that lets you ask for your
prime to satisfy an arbitrary modular congruence. (And HoAC also says
there's no particular reason _not_ to use strong primes.) So I provide
it as an option, just in case anyone wants to select it.

The change to the key generation algorithm is entirely in sshrsag.c,
and is neatly independent of the prime-generation system in use. If
you're using Maurer provable prime generation, then the known factor q
of p-1 can be used to help certify p, and the one for q-1 to help with
q in turn; if you switch to probabilistic prime generation then you
still get an RSA key with the right structure, except that every time
the definition says 'prime factor' you just append '(probably)'.

(The probabilistic version of this procedure is described as 'Gordon's
algorithm' in HoAC section 4.4.2.)
This commit is contained in:
Simon Tatham
2020-03-02 06:52:09 +00:00
parent 365c1d2df7
commit 844e766b03
10 changed files with 151 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
windows/winpgen.c
View File

@ -65,7 +65,6 @@ void nonfatal(const char *fmt, ...)
*/
#define PROGRESSRANGE 65535
#define MAXPHASE 5
struct progressphase {
double startpoint, total;
@ -74,8 +73,8 @@ struct progressphase {
};
struct progress {
int nphases;
struct progressphase phases[MAXPHASE], *currphase;
size_t nphases, phasessize;
struct progressphase *phases, *currphase;
double scale;
HWND progbar;
@ -87,7 +86,7 @@ static ProgressPhase win_progress_add_linear(
ProgressReceiver *prog, double overall_cost) {
struct progress *p = container_of(prog, struct progress, rec);
assert(p->nphases < MAXPHASE);
sgrowarray(p->phases, p->phasessize, p->nphases);
int phase = p->nphases++;
p->phases[phase].total = overall_cost;
@ -100,7 +99,7 @@ static ProgressPhase win_progress_add_probabilistic(
ProgressReceiver *prog, double cost_per_attempt, double probability) {
struct progress *p = container_of(prog, struct progress, rec);
assert(p->nphases < MAXPHASE);
sgrowarray(p->phases, p->phasessize, p->nphases);
int phase = p->nphases++;
p->phases[phase].exp_probability = 1.0 - probability;
@ -182,10 +181,16 @@ static const ProgressReceiverVtable win_progress_vt = {
static void win_progress_initialise(struct progress *p)
{
p->nphases = 0;
p->nphases = p->phasessize = 0;
p->phases = p->currphase = NULL;
p->rec.vt = &win_progress_vt;
}
static void win_progress_cleanup(struct progress *p)
{
sfree(p->phases);
}
struct PassphraseProcStruct {
char **passphrase;
char *comment;
@ -395,6 +400,7 @@ struct rsa_key_thread_params {
int curve_bits; /* bits in elliptic curve (ECDSA) */
keytype keytype;
const PrimeGenerationPolicy *primepolicy;
bool rsa_strong;
union {
RSAKey *key;
struct dss_key *dsskey;
@ -420,12 +426,15 @@ static DWORD WINAPI generate_key_thread(void *param)
else if (params->keytype == EDDSA)
eddsa_generate(params->edkey, params->curve_bits);
else
rsa_generate(params->key, params->key_bits, pgc, &prog.rec);
rsa_generate(params->key, params->key_bits, params->rsa_strong,
pgc, &prog.rec);
primegen_free_context(pgc);
PostMessage(params->dialog, WM_DONEKEY, 0, 0);
win_progress_cleanup(&prog);
sfree(params);
return 0;
}
@ -439,6 +448,7 @@ struct MainDlgState {
bool ssh2;
keytype keytype;
const PrimeGenerationPolicy *primepolicy;
bool rsa_strong;
char **commentptr; /* points to key.comment or ssh2key.comment */
ssh2_userkey ssh2key;
unsigned *entropy;
@ -518,6 +528,7 @@ enum {
IDC_TYPESTATIC, IDC_KEYSSH1, IDC_KEYSSH2RSA, IDC_KEYSSH2DSA,
IDC_KEYSSH2ECDSA, IDC_KEYSSH2EDDSA,
IDC_PRIMEGEN_PROB, IDC_PRIMEGEN_MAURER_SIMPLE, IDC_PRIMEGEN_MAURER_COMPLEX,
IDC_RSA_STRONG,
IDC_BITSSTATIC, IDC_BITS,
IDC_ECCURVESTATIC, IDC_ECCURVE,
IDC_EDCURVESTATIC, IDC_EDCURVE,
@ -720,6 +731,12 @@ void ui_set_primepolicy(HWND hwnd, struct MainDlgState *state, int option)
break;
}
}
void ui_set_rsa_strong(HWND hwnd, struct MainDlgState *state, bool enable)
{
state->rsa_strong = enable;
CheckMenuItem(state->keymenu, IDC_RSA_STRONG,
(enable ? MF_CHECKED : 0) | MF_BYCOMMAND);
}
void load_key_file(HWND hwnd, struct MainDlgState *state,
Filename *filename, bool was_import_cmd)
@ -911,6 +928,7 @@ static void start_generating_key(HWND hwnd, struct MainDlgState *state)
params->curve_bits = state->curve_bits;
params->keytype = state->keytype;
params->primepolicy = state->primepolicy;
params->rsa_strong = state->rsa_strong;
params->key = &state->key;
params->dsskey = &state->dsskey;
@ -985,6 +1003,9 @@ static INT_PTR CALLBACK MainDlgProc(HWND hwnd, UINT msg,
"Use proven primes (slower)");
AppendMenu(menu1, MF_ENABLED, IDC_PRIMEGEN_MAURER_COMPLEX,
"Use proven primes with even distribution (slowest)");
AppendMenu(menu1, MF_SEPARATOR, 0, 0);
AppendMenu(menu1, MF_ENABLED, IDC_RSA_STRONG,
"Use \"strong\" primes as RSA key factors");
AppendMenu(menu, MF_POPUP | MF_ENABLED, (UINT_PTR) menu1, "&Key");
state->keymenu = menu1;
@ -1120,6 +1141,7 @@ static INT_PTR CALLBACK MainDlgProc(HWND hwnd, UINT msg,
}
ui_set_key_type(hwnd, state, IDC_KEYSSH2RSA);
ui_set_primepolicy(hwnd, state, IDC_PRIMEGEN_PROB);
ui_set_rsa_strong(hwnd, state, false);
SetDlgItemInt(hwnd, IDC_BITS, DEFAULT_KEY_BITS, false);
SendDlgItemMessage(hwnd, IDC_ECCURVE, CB_SETCURSEL,
DEFAULT_ECCURVE_INDEX, 0);
@ -1186,6 +1208,12 @@ static INT_PTR CALLBACK MainDlgProc(HWND hwnd, UINT msg,
ui_set_primepolicy(hwnd, state, LOWORD(wParam));
break;
}
case IDC_RSA_STRONG: {
state = (struct MainDlgState *)
GetWindowLongPtr(hwnd, GWLP_USERDATA);
ui_set_rsa_strong(hwnd, state, !state->rsa_strong);
break;
}
case IDC_QUIT:
PostMessage(hwnd, WM_CLOSE, 0, 0);
break;