mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-07-15 01:57:40 -05:00
RSA key generation routines, and the bignum enhancements required to
support them. A key generation tool will be forthcoming soon. [originally from svn r712]
This commit is contained in:
Simon Tatham
415
sshbn.c
415
sshbn.c
@ -43,14 +43,14 @@ void freebn(Bignum b) {
|
||||
* Input is in the first len words of a and b.
|
||||
* Result is returned in the first 2*len words of c.
|
||||
*/
|
||||
static void bigmul(unsigned short *a, unsigned short *b, unsigned short *c,
|
||||
int len)
|
||||
static void internal_mul(unsigned short *a, unsigned short *b,
|
||||
unsigned short *c, int len)
|
||||
{
|
||||
int i, j;
|
||||
unsigned long ai, t;
|
||||
|
||||
for (j = len - 1; j >= 0; j--)
|
||||
c[j+len] = 0;
|
||||
for (j = 0; j < 2*len; j++)
|
||||
c[j] = 0;
|
||||
|
||||
for (i = len - 1; i >= 0; i--) {
|
||||
ai = a[i];
|
||||
@ -65,33 +65,49 @@ static void bigmul(unsigned short *a, unsigned short *b, unsigned short *c,
|
||||
}
|
||||
}
|
||||
|
||||
static int internal_add_shifted(unsigned short *number,
|
||||
unsigned short n, int shift) {
|
||||
int word = 1 + (shift / 16);
|
||||
int bshift = shift % 16;
|
||||
unsigned long carry, addend;
|
||||
|
||||
addend = n << bshift;
|
||||
|
||||
while (addend) {
|
||||
addend += number[word];
|
||||
number[word] = addend & 0xFFFF;
|
||||
addend >>= 16;
|
||||
word++;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Compute a = a % m.
|
||||
* Input in first len2 words of a and first len words of m.
|
||||
* Output in first len2 words of a
|
||||
* (of which first len2-len words will be zero).
|
||||
* Input in first alen words of a and first mlen words of m.
|
||||
* Output in first alen words of a
|
||||
* (of which first alen-mlen words will be zero).
|
||||
* The MSW of m MUST have its high bit set.
|
||||
* Quotient is accumulated in the `quotient' array, which is a Bignum
|
||||
* rather than the internal bigendian format. Quotient parts are shifted
|
||||
* left by `qshift' before adding into quot.
|
||||
*/
|
||||
static void bigmod(unsigned short *a, unsigned short *m,
|
||||
int len, int len2)
|
||||
static void internal_mod(unsigned short *a, int alen,
|
||||
unsigned short *m, int mlen,
|
||||
unsigned short *quot, int qshift)
|
||||
{
|
||||
unsigned short m0, m1;
|
||||
unsigned int h;
|
||||
int i, k;
|
||||
|
||||
/* Special case for len == 1 */
|
||||
if (len == 1) {
|
||||
a[1] = (((long) a[0] << 16) + a[1]) % m[0];
|
||||
a[0] = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
m0 = m[0];
|
||||
m1 = m[1];
|
||||
if (mlen > 1)
|
||||
m1 = m[1];
|
||||
else
|
||||
m1 = 0;
|
||||
|
||||
for (i = 0; i <= len2-len; i++) {
|
||||
for (i = 0; i <= alen-mlen; i++) {
|
||||
unsigned long t;
|
||||
unsigned int q, r, c;
|
||||
unsigned int q, r, c, ai1;
|
||||
|
||||
if (i == 0) {
|
||||
h = 0;
|
||||
@ -100,6 +116,11 @@ static void bigmod(unsigned short *a, unsigned short *m,
|
||||
a[i-1] = 0;
|
||||
}
|
||||
|
||||
if (i == alen-1)
|
||||
ai1 = 0;
|
||||
else
|
||||
ai1 = a[i+1];
|
||||
|
||||
/* Find q = h:a[i] / m0 */
|
||||
t = ((unsigned long) h << 16) + a[i];
|
||||
q = t / m0;
|
||||
@ -108,18 +129,18 @@ static void bigmod(unsigned short *a, unsigned short *m,
|
||||
/* Refine our estimate of q by looking at
|
||||
h:a[i]:a[i+1] / m0:m1 */
|
||||
t = (long) m1 * (long) q;
|
||||
if (t > ((unsigned long) r << 16) + a[i+1]) {
|
||||
if (t > ((unsigned long) r << 16) + ai1) {
|
||||
q--;
|
||||
t -= m1;
|
||||
r = (r + m0) & 0xffff; /* overflow? */
|
||||
if (r >= (unsigned long)m0 &&
|
||||
t > ((unsigned long) r << 16) + a[i+1])
|
||||
t > ((unsigned long) r << 16) + ai1)
|
||||
q--;
|
||||
}
|
||||
|
||||
/* Substract q * m from a[i...] */
|
||||
/* Subtract q * m from a[i...] */
|
||||
c = 0;
|
||||
for (k = len - 1; k >= 0; k--) {
|
||||
for (k = mlen - 1; k >= 0; k--) {
|
||||
t = (long) q * (long) m[k];
|
||||
t += c;
|
||||
c = t >> 16;
|
||||
@ -130,13 +151,16 @@ static void bigmod(unsigned short *a, unsigned short *m,
|
||||
/* Add back m in case of borrow */
|
||||
if (c != h) {
|
||||
t = 0;
|
||||
for (k = len - 1; k >= 0; k--) {
|
||||
for (k = mlen - 1; k >= 0; k--) {
|
||||
t += m[k];
|
||||
t += a[i+k];
|
||||
a[i+k] = (unsigned short)t;
|
||||
t = t >> 16;
|
||||
}
|
||||
q--;
|
||||
}
|
||||
if (quot)
|
||||
internal_add_shifted(quot, q, qshift + 16 * (alen-mlen-i));
|
||||
}
|
||||
}
|
||||
|
||||
@ -189,11 +213,11 @@ void modpow(Bignum base, Bignum exp, Bignum mod, Bignum result)
|
||||
/* Main computation */
|
||||
while (i < exp[0]) {
|
||||
while (j >= 0) {
|
||||
bigmul(a + mlen, a + mlen, b, mlen);
|
||||
bigmod(b, m, mlen, mlen*2);
|
||||
internal_mul(a + mlen, a + mlen, b, mlen);
|
||||
internal_mod(b, mlen*2, m, mlen, NULL, 0);
|
||||
if ((exp[exp[0] - i] & (1 << j)) != 0) {
|
||||
bigmul(b + mlen, n, a, mlen);
|
||||
bigmod(a, m, mlen, mlen*2);
|
||||
internal_mul(b + mlen, n, a, mlen);
|
||||
internal_mod(a, mlen*2, m, mlen, NULL, 0);
|
||||
} else {
|
||||
unsigned short *t;
|
||||
t = a; a = b; b = t;
|
||||
@ -208,7 +232,7 @@ void modpow(Bignum base, Bignum exp, Bignum mod, Bignum result)
|
||||
for (i = mlen - 1; i < 2*mlen - 1; i++)
|
||||
a[i] = (a[i] << mshift) | (a[i+1] >> (16-mshift));
|
||||
a[2*mlen-1] = a[2*mlen-1] << mshift;
|
||||
bigmod(a, m, mlen, mlen*2);
|
||||
internal_mod(a, mlen*2, m, mlen, NULL, 0);
|
||||
for (i = 2*mlen - 1; i >= mlen; i--)
|
||||
a[i] = (a[i] >> mshift) | (a[i-1] << (16-mshift));
|
||||
}
|
||||
@ -268,15 +292,15 @@ void modmul(Bignum p, Bignum q, Bignum mod, Bignum result)
|
||||
a = malloc(2 * pqlen * sizeof(unsigned short));
|
||||
|
||||
/* Main computation */
|
||||
bigmul(n, o, a, pqlen);
|
||||
bigmod(a, m, mlen, 2*pqlen);
|
||||
internal_mul(n, o, a, pqlen);
|
||||
internal_mod(a, pqlen*2, m, mlen, NULL, 0);
|
||||
|
||||
/* Fixup result in case the modulus was shifted */
|
||||
if (mshift) {
|
||||
for (i = 2*pqlen - mlen - 1; i < 2*pqlen - 1; i++)
|
||||
a[i] = (a[i] << mshift) | (a[i+1] >> (16-mshift));
|
||||
a[2*pqlen-1] = a[2*pqlen-1] << mshift;
|
||||
bigmod(a, m, mlen, pqlen*2);
|
||||
internal_mod(a, pqlen*2, m, mlen, NULL, 0);
|
||||
for (i = 2*pqlen - 1; i >= 2*pqlen - mlen; i--)
|
||||
a[i] = (a[i] >> mshift) | (a[i-1] << (16-mshift));
|
||||
}
|
||||
@ -292,6 +316,66 @@ void modmul(Bignum p, Bignum q, Bignum mod, Bignum result)
|
||||
for (i = 0; i < pqlen; i++) o[i] = 0; free(o);
|
||||
}
|
||||
|
||||
/*
|
||||
* Compute p % mod.
|
||||
* The most significant word of mod MUST be non-zero.
|
||||
* We assume that the result array is the same size as the mod array.
|
||||
* We optionally write out a quotient.
|
||||
*/
|
||||
void bigmod(Bignum p, Bignum mod, Bignum result, Bignum quotient)
|
||||
{
|
||||
unsigned short *n, *m;
|
||||
int mshift;
|
||||
int plen, mlen, i, j;
|
||||
|
||||
/* Allocate m of size mlen, copy mod to m */
|
||||
/* We use big endian internally */
|
||||
mlen = mod[0];
|
||||
m = malloc(mlen * sizeof(unsigned short));
|
||||
for (j = 0; j < mlen; j++) m[j] = mod[mod[0] - j];
|
||||
|
||||
/* Shift m left to make msb bit set */
|
||||
for (mshift = 0; mshift < 15; mshift++)
|
||||
if ((m[0] << mshift) & 0x8000) break;
|
||||
if (mshift) {
|
||||
for (i = 0; i < mlen - 1; i++)
|
||||
m[i] = (m[i] << mshift) | (m[i+1] >> (16-mshift));
|
||||
m[mlen-1] = m[mlen-1] << mshift;
|
||||
}
|
||||
|
||||
plen = p[0];
|
||||
/* Ensure plen > mlen */
|
||||
if (plen <= mlen) plen = mlen+1;
|
||||
|
||||
/* Allocate n of size plen, copy p to n */
|
||||
n = malloc(plen * sizeof(unsigned short));
|
||||
for (j = 0; j < plen; j++) n[j] = 0;
|
||||
for (j = 1; j <= p[0]; j++) n[plen-j] = p[j];
|
||||
|
||||
/* Main computation */
|
||||
internal_mod(n, plen, m, mlen, quotient, mshift);
|
||||
|
||||
/* Fixup result in case the modulus was shifted */
|
||||
if (mshift) {
|
||||
for (i = plen - mlen - 1; i < plen - 1; i++)
|
||||
n[i] = (n[i] << mshift) | (n[i+1] >> (16-mshift));
|
||||
n[plen-1] = n[plen-1] << mshift;
|
||||
internal_mod(n, plen, m, mlen, quotient, 0);
|
||||
for (i = plen - 1; i >= plen - mlen; i--)
|
||||
n[i] = (n[i] >> mshift) | (n[i-1] << (16-mshift));
|
||||
}
|
||||
|
||||
/* Copy result to buffer */
|
||||
for (i = 1; i <= result[0]; i++) {
|
||||
int j = plen-i;
|
||||
result[i] = j>=0 ? n[j] : 0;
|
||||
}
|
||||
|
||||
/* Free temporary arrays */
|
||||
for (i = 0; i < mlen; i++) m[i] = 0; free(m);
|
||||
for (i = 0; i < plen; i++) n[i] = 0; free(n);
|
||||
}
|
||||
|
||||
/*
|
||||
* Decrement a number.
|
||||
*/
|
||||
@ -369,6 +453,32 @@ int bignum_byte(Bignum bn, int i) {
|
||||
return (bn[i/2+1] ) & 0xFF;
|
||||
}
|
||||
|
||||
/*
|
||||
* Return a bit from a bignum; 0 is least significant, etc.
|
||||
*/
|
||||
int bignum_bit(Bignum bn, int i) {
|
||||
if (i >= 16*bn[0])
|
||||
return 0; /* beyond the end */
|
||||
else
|
||||
return (bn[i/16+1] >> (i%16)) & 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Set a bit in a bignum; 0 is least significant, etc.
|
||||
*/
|
||||
void bignum_set_bit(Bignum bn, int bitnum, int value) {
|
||||
if (bitnum >= 16*bn[0])
|
||||
abort(); /* beyond the end */
|
||||
else {
|
||||
int v = bitnum/16+1;
|
||||
int mask = 1 << (bitnum%16);
|
||||
if (value)
|
||||
bn[v] |= mask;
|
||||
else
|
||||
bn[v] &= ~mask;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Write a ssh1-format bignum into a buffer. It is assumed the
|
||||
* buffer is big enough. Returns the number of bytes used.
|
||||
@ -385,3 +495,244 @@ int ssh1_write_bignum(void *data, Bignum bn) {
|
||||
*p++ = bignum_byte(bn, i);
|
||||
return len;
|
||||
}
|
||||
|
||||
/*
|
||||
* Compare two bignums. Returns like strcmp.
|
||||
*/
|
||||
int bignum_cmp(Bignum a, Bignum b) {
|
||||
int amax = a[0], bmax = b[0];
|
||||
int i = (amax > bmax ? amax : bmax);
|
||||
while (i) {
|
||||
unsigned short aval = (i > amax ? 0 : a[i]);
|
||||
unsigned short bval = (i > bmax ? 0 : b[i]);
|
||||
if (aval < bval) return -1;
|
||||
if (aval > bval) return +1;
|
||||
i--;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Right-shift one bignum to form another.
|
||||
*/
|
||||
Bignum bignum_rshift(Bignum a, int shift) {
|
||||
Bignum ret;
|
||||
int i, shiftw, shiftb, shiftbb, bits;
|
||||
unsigned short ai, ai1;
|
||||
|
||||
bits = ssh1_bignum_bitcount(a) - shift;
|
||||
ret = newbn((bits+15)/16);
|
||||
|
||||
if (ret) {
|
||||
shiftw = shift / 16;
|
||||
shiftb = shift % 16;
|
||||
shiftbb = 16 - shiftb;
|
||||
|
||||
ai1 = a[shiftw+1];
|
||||
for (i = 1; i <= ret[0]; i++) {
|
||||
ai = ai1;
|
||||
ai1 = (i+shiftw+1 <= a[0] ? a[i+shiftw+1] : 0);
|
||||
ret[i] = ((ai >> shiftb) | (ai1 << shiftbb)) & 0xFFFF;
|
||||
}
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Non-modular multiplication and addition.
|
||||
*/
|
||||
Bignum bigmuladd(Bignum a, Bignum b, Bignum addend) {
|
||||
int alen = a[0], blen = b[0];
|
||||
int mlen = (alen > blen ? alen : blen);
|
||||
int rlen, i, maxspot;
|
||||
unsigned short *workspace;
|
||||
Bignum ret;
|
||||
|
||||
/* mlen space for a, mlen space for b, 2*mlen for result */
|
||||
workspace = malloc(mlen * 4 * sizeof(unsigned short));
|
||||
for (i = 0; i < mlen; i++) {
|
||||
workspace[0*mlen + i] = (mlen-i <= a[0] ? a[mlen-i] : 0);
|
||||
workspace[1*mlen + i] = (mlen-i <= b[0] ? b[mlen-i] : 0);
|
||||
}
|
||||
|
||||
internal_mul(workspace+0*mlen, workspace+1*mlen, workspace+2*mlen, mlen);
|
||||
|
||||
/* now just copy the result back */
|
||||
rlen = alen + blen + 1;
|
||||
if (addend && rlen <= addend[0])
|
||||
rlen = addend[0] + 1;
|
||||
ret = newbn(rlen);
|
||||
maxspot = 0;
|
||||
for (i = 1; i <= ret[0]; i++) {
|
||||
ret[i] = (i <= 2*mlen ? workspace[4*mlen - i] : 0);
|
||||
if (ret[i] != 0)
|
||||
maxspot = i;
|
||||
}
|
||||
ret[0] = maxspot;
|
||||
|
||||
/* now add in the addend, if any */
|
||||
if (addend) {
|
||||
unsigned long carry = 0;
|
||||
for (i = 1; i <= rlen; i++) {
|
||||
carry += (i <= ret[0] ? ret[i] : 0);
|
||||
carry += (i <= addend[0] ? addend[i] : 0);
|
||||
ret[i] = carry & 0xFFFF;
|
||||
carry >>= 16;
|
||||
if (ret[i] != 0 && i > maxspot)
|
||||
maxspot = i;
|
||||
}
|
||||
}
|
||||
ret[0] = maxspot;
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Non-modular multiplication.
|
||||
*/
|
||||
Bignum bigmul(Bignum a, Bignum b) {
|
||||
return bigmuladd(a, b, NULL);
|
||||
}
|
||||
|
||||
/*
|
||||
* Convert a (max 16-bit) short into a bignum.
|
||||
*/
|
||||
Bignum bignum_from_short(unsigned short n) {
|
||||
Bignum ret;
|
||||
|
||||
ret = newbn(2);
|
||||
ret[1] = n & 0xFFFF;
|
||||
ret[2] = (n >> 16) & 0xFFFF;
|
||||
ret[0] = (ret[2] ? 2 : 1);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Add a long to a bignum.
|
||||
*/
|
||||
Bignum bignum_add_long(Bignum number, unsigned long addend) {
|
||||
Bignum ret = newbn(number[0]+1);
|
||||
int i, maxspot = 0;
|
||||
unsigned long carry = 0;
|
||||
|
||||
for (i = 1; i <= ret[0]; i++) {
|
||||
carry += addend & 0xFFFF;
|
||||
carry += (i <= number[0] ? number[i] : 0);
|
||||
addend >>= 16;
|
||||
ret[i] = carry & 0xFFFF;
|
||||
carry >>= 16;
|
||||
if (ret[i] != 0)
|
||||
maxspot = i;
|
||||
}
|
||||
ret[0] = maxspot;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Compute the residue of a bignum, modulo a (max 16-bit) short.
|
||||
*/
|
||||
unsigned short bignum_mod_short(Bignum number, unsigned short modulus) {
|
||||
Bignum ret;
|
||||
unsigned long mod, r;
|
||||
int i;
|
||||
|
||||
r = 0;
|
||||
mod = modulus;
|
||||
for (i = number[0]; i > 0; i--)
|
||||
r = (r * 65536 + number[i]) % mod;
|
||||
return r;
|
||||
}
|
||||
|
||||
static void diagbn(char *prefix, Bignum md) {
|
||||
int i, nibbles, morenibbles;
|
||||
static const char hex[] = "0123456789ABCDEF";
|
||||
|
||||
printf("%s0x", prefix ? prefix : "");
|
||||
|
||||
nibbles = (3 + ssh1_bignum_bitcount(md))/4; if (nibbles<1) nibbles=1;
|
||||
morenibbles = 4*md[0] - nibbles;
|
||||
for (i=0; i<morenibbles; i++) putchar('-');
|
||||
for (i=nibbles; i-- ;)
|
||||
putchar(hex[(bignum_byte(md, i/2) >> (4*(i%2))) & 0xF]);
|
||||
|
||||
if (prefix) putchar('\n');
|
||||
}
|
||||
|
||||
/*
|
||||
* Greatest common divisor.
|
||||
*/
|
||||
Bignum biggcd(Bignum av, Bignum bv) {
|
||||
Bignum a = copybn(av);
|
||||
Bignum b = copybn(bv);
|
||||
|
||||
diagbn("a = ", a);
|
||||
diagbn("b = ", b);
|
||||
while (bignum_cmp(b, Zero) != 0) {
|
||||
Bignum t = newbn(b[0]);
|
||||
bigmod(a, b, t, NULL);
|
||||
diagbn("t = ", t);
|
||||
while (t[0] > 1 && t[t[0]] == 0) t[0]--;
|
||||
freebn(a);
|
||||
a = b;
|
||||
b = t;
|
||||
}
|
||||
|
||||
freebn(b);
|
||||
return a;
|
||||
}
|
||||
|
||||
/*
|
||||
* Modular inverse, using Euclid's extended algorithm.
|
||||
*/
|
||||
Bignum modinv(Bignum number, Bignum modulus) {
|
||||
Bignum a = copybn(modulus);
|
||||
Bignum b = copybn(number);
|
||||
Bignum xp = copybn(Zero);
|
||||
Bignum x = copybn(One);
|
||||
int sign = +1;
|
||||
|
||||
while (bignum_cmp(b, One) != 0) {
|
||||
Bignum t = newbn(b[0]);
|
||||
Bignum q = newbn(a[0]);
|
||||
bigmod(a, b, t, q);
|
||||
while (t[0] > 1 && t[t[0]] == 0) t[0]--;
|
||||
freebn(a);
|
||||
a = b;
|
||||
b = t;
|
||||
t = xp;
|
||||
xp = x;
|
||||
x = bigmuladd(q, xp, t);
|
||||
sign = -sign;
|
||||
freebn(t);
|
||||
}
|
||||
|
||||
freebn(b);
|
||||
freebn(a);
|
||||
freebn(xp);
|
||||
|
||||
/* now we know that sign * x == 1, and that x < modulus */
|
||||
if (sign < 0) {
|
||||
/* set a new x to be modulus - x */
|
||||
Bignum newx = newbn(modulus[0]);
|
||||
unsigned short carry = 0;
|
||||
int maxspot = 1;
|
||||
int i;
|
||||
|
||||
for (i = 1; i <= newx[0]; i++) {
|
||||
unsigned short aword = (i <= modulus[0] ? modulus[i] : 0);
|
||||
unsigned short bword = (i <= x[0] ? x[i] : 0);
|
||||
newx[i] = aword - bword - carry;
|
||||
bword = ~bword;
|
||||
carry = carry ? (newx[i] >= bword) : (newx[i] > bword);
|
||||
if (newx[i] != 0)
|
||||
maxspot = i;
|
||||
}
|
||||
newx[0] = maxspot;
|
||||
freebn(x);
|
||||
x = newx;
|
||||
}
|
||||
|
||||
/* and return. */
|
||||
return x;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user