summaryrefslogtreecommitdiff
path: root/src/pkg/crypto/rsa
diff options
context:
space:
mode:
Diffstat (limited to 'src/pkg/crypto/rsa')
-rw-r--r--src/pkg/crypto/rsa/pkcs1v15.go10
-rw-r--r--src/pkg/crypto/rsa/pkcs1v15_test.go6
-rw-r--r--src/pkg/crypto/rsa/rsa.go167
-rw-r--r--src/pkg/crypto/rsa/rsa_test.go94
4 files changed, 255 insertions, 22 deletions
diff --git a/src/pkg/crypto/rsa/pkcs1v15.go b/src/pkg/crypto/rsa/pkcs1v15.go
index 2eaadee24..3defa62ea 100644
--- a/src/pkg/crypto/rsa/pkcs1v15.go
+++ b/src/pkg/crypto/rsa/pkcs1v15.go
@@ -127,7 +127,7 @@ func nonZeroRandomBytes(s []byte, rand io.Reader) (err os.Error) {
for i := 0; i < len(s); i++ {
for s[i] == 0 {
- _, err = rand.Read(s[i : i+1])
+ _, err = io.ReadFull(rand, s[i:i+1])
if err != nil {
return
}
@@ -149,10 +149,10 @@ func nonZeroRandomBytes(s []byte, rand io.Reader) (err os.Error) {
// precompute a prefix of the digest value that makes a valid ASN1 DER string
// with the correct contents.
var hashPrefixes = map[crypto.Hash][]byte{
- crypto.MD5: []byte{0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10},
- crypto.SHA1: []byte{0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14},
- crypto.SHA256: []byte{0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20},
- crypto.SHA384: []byte{0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30},
+ crypto.MD5: {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10},
+ crypto.SHA1: {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14},
+ crypto.SHA256: {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20},
+ crypto.SHA384: {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30},
crypto.SHA512: {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40},
crypto.MD5SHA1: {}, // A special TLS case which doesn't use an ASN1 prefix.
crypto.RIPEMD160: {0x30, 0x20, 0x30, 0x08, 0x06, 0x06, 0x28, 0xcf, 0x06, 0x03, 0x00, 0x31, 0x04, 0x14},
diff --git a/src/pkg/crypto/rsa/pkcs1v15_test.go b/src/pkg/crypto/rsa/pkcs1v15_test.go
index 7b2ce08cb..30a4824a6 100644
--- a/src/pkg/crypto/rsa/pkcs1v15_test.go
+++ b/src/pkg/crypto/rsa/pkcs1v15_test.go
@@ -97,7 +97,11 @@ func TestEncryptPKCS1v15(t *testing.T) {
return true
}
- quick.Check(tryEncryptDecrypt, nil)
+ config := new(quick.Config)
+ if testing.Short() {
+ config.MaxCount = 10
+ }
+ quick.Check(tryEncryptDecrypt, config)
}
// These test vectors were generated with `openssl rsautl -pkcs -encrypt`
diff --git a/src/pkg/crypto/rsa/rsa.go b/src/pkg/crypto/rsa/rsa.go
index faf914991..b3b212c20 100644
--- a/src/pkg/crypto/rsa/rsa.go
+++ b/src/pkg/crypto/rsa/rsa.go
@@ -13,6 +13,7 @@ import (
"hash"
"io"
"os"
+ "sync"
)
var bigZero = big.NewInt(0)
@@ -91,15 +92,21 @@ type PublicKey struct {
type PrivateKey struct {
PublicKey // public part.
D *big.Int // private exponent
- P, Q *big.Int // prime factors of N
+ P, Q, R *big.Int // prime factors of N (R may be nil)
+
+ rwMutex sync.RWMutex // protects the following
+ dP, dQ, dR *big.Int // D mod (P-1) (or mod Q-1 etc)
+ qInv *big.Int // q^-1 mod p
+ pq *big.Int // P*Q
+ tr *big.Int // pq·tr ≡ 1 mod r
}
// Validate performs basic sanity checks on the key.
// It returns nil if the key is valid, or else an os.Error describing a problem.
-func (priv PrivateKey) Validate() os.Error {
- // Check that p and q are prime. Note that this is just a sanity
- // check. Since the random witnesses chosen by ProbablyPrime are
+func (priv *PrivateKey) Validate() os.Error {
+ // Check that p, q and, maybe, r are prime. Note that this is just a
+ // sanity check. Since the random witnesses chosen by ProbablyPrime are
// deterministic, given the candidate number, it's easy for an attack
// to generate composites that pass this test.
if !big.ProbablyPrime(priv.P, 20) {
@@ -108,16 +115,26 @@ func (priv PrivateKey) Validate() os.Error {
if !big.ProbablyPrime(priv.Q, 20) {
return os.ErrorString("Q is composite")
}
+ if priv.R != nil && !big.ProbablyPrime(priv.R, 20) {
+ return os.ErrorString("R is composite")
+ }
- // Check that p*q == n.
+ // Check that p*q*r == n.
modulus := new(big.Int).Mul(priv.P, priv.Q)
+ if priv.R != nil {
+ modulus.Mul(modulus, priv.R)
+ }
if modulus.Cmp(priv.N) != 0 {
return os.ErrorString("invalid modulus")
}
- // Check that e and totient(p, q) are coprime.
+ // Check that e and totient(p, q, r) are coprime.
pminus1 := new(big.Int).Sub(priv.P, bigOne)
qminus1 := new(big.Int).Sub(priv.Q, bigOne)
totient := new(big.Int).Mul(pminus1, qminus1)
+ if priv.R != nil {
+ rminus1 := new(big.Int).Sub(priv.R, bigOne)
+ totient.Mul(totient, rminus1)
+ }
e := big.NewInt(int64(priv.E))
gcd := new(big.Int)
x := new(big.Int)
@@ -126,7 +143,7 @@ func (priv PrivateKey) Validate() os.Error {
if gcd.Cmp(bigOne) != 0 {
return os.ErrorString("invalid public exponent E")
}
- // Check that de ≡ 1 (mod totient(p, q))
+ // Check that de ≡ 1 (mod totient(p, q, r))
de := new(big.Int).Mul(priv.D, e)
de.Mod(de, totient)
if de.Cmp(bigOne) != 0 {
@@ -135,7 +152,7 @@ func (priv PrivateKey) Validate() os.Error {
return nil
}
-// GenerateKeyPair generates an RSA keypair of the given bit size.
+// GenerateKey generates an RSA keypair of the given bit size.
func GenerateKey(rand io.Reader, bits int) (priv *PrivateKey, err os.Error) {
priv = new(PrivateKey)
// Smaller public exponents lead to faster public key
@@ -191,6 +208,77 @@ func GenerateKey(rand io.Reader, bits int) (priv *PrivateKey, err os.Error) {
return
}
+// Generate3PrimeKey generates a 3-prime RSA keypair of the given bit size, as
+// suggested in [1]. Although the public keys are compatible (actually,
+// indistinguishable) from the 2-prime case, the private keys are not. Thus it
+// may not be possible to export 3-prime private keys in certain formats or to
+// subsequently import them into other code.
+//
+// Table 1 in [2] suggests that size should be >= 1024 when using 3 primes.
+//
+// [1] US patent 4405829 (1972, expired)
+// [2] http://www.cacr.math.uwaterloo.ca/techreports/2006/cacr2006-16.pdf
+func Generate3PrimeKey(rand io.Reader, bits int) (priv *PrivateKey, err os.Error) {
+ priv = new(PrivateKey)
+ priv.E = 3
+
+ pminus1 := new(big.Int)
+ qminus1 := new(big.Int)
+ rminus1 := new(big.Int)
+ totient := new(big.Int)
+
+ for {
+ p, err := randomPrime(rand, bits/3)
+ if err != nil {
+ return nil, err
+ }
+
+ todo := bits - p.BitLen()
+ q, err := randomPrime(rand, todo/2)
+ if err != nil {
+ return nil, err
+ }
+
+ todo -= q.BitLen()
+ r, err := randomPrime(rand, todo)
+ if err != nil {
+ return nil, err
+ }
+
+ if p.Cmp(q) == 0 ||
+ q.Cmp(r) == 0 ||
+ r.Cmp(p) == 0 {
+ continue
+ }
+
+ n := new(big.Int).Mul(p, q)
+ n.Mul(n, r)
+ pminus1.Sub(p, bigOne)
+ qminus1.Sub(q, bigOne)
+ rminus1.Sub(r, bigOne)
+ totient.Mul(pminus1, qminus1)
+ totient.Mul(totient, rminus1)
+
+ g := new(big.Int)
+ priv.D = new(big.Int)
+ y := new(big.Int)
+ e := big.NewInt(int64(priv.E))
+ big.GcdInt(g, priv.D, y, e, totient)
+
+ if g.Cmp(bigOne) == 0 {
+ priv.D.Add(priv.D, totient)
+ priv.P = p
+ priv.Q = q
+ priv.R = r
+ priv.N = n
+
+ break
+ }
+ }
+
+ return
+}
+
// incCounter increments a four byte, big-endian counter.
func incCounter(c *[4]byte) {
if c[3]++; c[3] != 0 {
@@ -321,6 +409,26 @@ func modInverse(a, n *big.Int) (ia *big.Int, ok bool) {
return x, true
}
+// precompute performs some calculations that speed up private key operations
+// in the future.
+func (priv *PrivateKey) precompute() {
+ priv.dP = new(big.Int).Sub(priv.P, bigOne)
+ priv.dP.Mod(priv.D, priv.dP)
+
+ priv.dQ = new(big.Int).Sub(priv.Q, bigOne)
+ priv.dQ.Mod(priv.D, priv.dQ)
+
+ priv.qInv = new(big.Int).ModInverse(priv.Q, priv.P)
+
+ if priv.R != nil {
+ priv.dR = new(big.Int).Sub(priv.R, bigOne)
+ priv.dR.Mod(priv.D, priv.dR)
+
+ priv.pq = new(big.Int).Mul(priv.P, priv.Q)
+ priv.tr = new(big.Int).ModInverse(priv.pq, priv.R)
+ }
+}
+
// decrypt performs an RSA decryption, resulting in a plaintext integer. If a
// random source is given, RSA blinding is used.
func decrypt(rand io.Reader, priv *PrivateKey, c *big.Int) (m *big.Int, err os.Error) {
@@ -359,7 +467,48 @@ func decrypt(rand io.Reader, priv *PrivateKey, c *big.Int) (m *big.Int, err os.E
c.Mod(c, priv.N)
}
- m = new(big.Int).Exp(c, priv.D, priv.N)
+ priv.rwMutex.RLock()
+
+ if priv.dP == nil && priv.P != nil {
+ priv.rwMutex.RUnlock()
+ priv.rwMutex.Lock()
+ if priv.dP == nil && priv.P != nil {
+ priv.precompute()
+ }
+ priv.rwMutex.Unlock()
+ priv.rwMutex.RLock()
+ }
+
+ if priv.dP == nil {
+ m = new(big.Int).Exp(c, priv.D, priv.N)
+ } else {
+ // We have the precalculated values needed for the CRT.
+ m = new(big.Int).Exp(c, priv.dP, priv.P)
+ m2 := new(big.Int).Exp(c, priv.dQ, priv.Q)
+ m.Sub(m, m2)
+ if m.Sign() < 0 {
+ m.Add(m, priv.P)
+ }
+ m.Mul(m, priv.qInv)
+ m.Mod(m, priv.P)
+ m.Mul(m, priv.Q)
+ m.Add(m, m2)
+
+ if priv.dR != nil {
+ // 3-prime CRT.
+ m2.Exp(c, priv.dR, priv.R)
+ m2.Sub(m2, m)
+ m2.Mul(m2, priv.tr)
+ m2.Mod(m2, priv.R)
+ if m2.Sign() < 0 {
+ m2.Add(m2, priv.R)
+ }
+ m2.Mul(m2, priv.pq)
+ m.Add(m, m2)
+ }
+ }
+
+ priv.rwMutex.RUnlock()
if ir != nil {
// Unblind.
diff --git a/src/pkg/crypto/rsa/rsa_test.go b/src/pkg/crypto/rsa/rsa_test.go
index 22d4576e8..d8a936eb6 100644
--- a/src/pkg/crypto/rsa/rsa_test.go
+++ b/src/pkg/crypto/rsa/rsa_test.go
@@ -13,24 +13,48 @@ import (
)
func TestKeyGeneration(t *testing.T) {
- random := rand.Reader
+ size := 1024
+ if testing.Short() {
+ size = 128
+ }
+ priv, err := GenerateKey(rand.Reader, size)
+ if err != nil {
+ t.Errorf("failed to generate key")
+ }
+ testKeyBasics(t, priv)
+}
+
+func Test3PrimeKeyGeneration(t *testing.T) {
+ if testing.Short() {
+ return
+ }
- priv, err := GenerateKey(random, 1024)
+ size := 768
+ priv, err := Generate3PrimeKey(rand.Reader, size)
if err != nil {
t.Errorf("failed to generate key")
}
+ testKeyBasics(t, priv)
+}
+
+func testKeyBasics(t *testing.T, priv *PrivateKey) {
+ if err := priv.Validate(); err != nil {
+ t.Errorf("Validate() failed: %s", err)
+ }
+
pub := &priv.PublicKey
m := big.NewInt(42)
c := encrypt(new(big.Int), pub, m)
m2, err := decrypt(nil, priv, c)
if err != nil {
t.Errorf("error while decrypting: %s", err)
+ return
}
if m.Cmp(m2) != 0 {
- t.Errorf("got:%v, want:%v (%s)", m2, m, priv)
+ t.Errorf("got:%v, want:%v (%+v)", m2, m, priv)
}
- m3, err := decrypt(random, priv, c)
+ m3, err := decrypt(rand.Reader, priv, c)
if err != nil {
t.Errorf("error while decrypting (blind): %s", err)
}
@@ -39,6 +63,57 @@ func TestKeyGeneration(t *testing.T) {
}
}
+func fromBase10(base10 string) *big.Int {
+ i := new(big.Int)
+ i.SetString(base10, 10)
+ return i
+}
+
+func BenchmarkRSA2048Decrypt(b *testing.B) {
+ b.StopTimer()
+ priv := &PrivateKey{
+ PublicKey: PublicKey{
+ N: fromBase10("14314132931241006650998084889274020608918049032671858325988396851334124245188214251956198731333464217832226406088020736932173064754214329009979944037640912127943488972644697423190955557435910767690712778463524983667852819010259499695177313115447116110358524558307947613422897787329221478860907963827160223559690523660574329011927531289655711860504630573766609239332569210831325633840174683944553667352219670930408593321661375473885147973879086994006440025257225431977751512374815915392249179976902953721486040787792801849818254465486633791826766873076617116727073077821584676715609985777563958286637185868165868520557"),
+ E: 3,
+ },
+ D: fromBase10("9542755287494004433998723259516013739278699355114572217325597900889416163458809501304132487555642811888150937392013824621448709836142886006653296025093941418628992648429798282127303704957273845127141852309016655778568546006839666463451542076964744073572349705538631742281931858219480985907271975884773482372966847639853897890615456605598071088189838676728836833012254065983259638538107719766738032720239892094196108713378822882383694456030043492571063441943847195939549773271694647657549658603365629458610273821292232646334717612674519997533901052790334279661754176490593041941863932308687197618671528035670452762731"),
+ P: fromBase10("130903255182996722426771613606077755295583329135067340152947172868415809027537376306193179624298874215608270802054347609836776473930072411958753044562214537013874103802006369634761074377213995983876788718033850153719421695468704276694983032644416930879093914927146648402139231293035971427838068945045019075433"),
+ Q: fromBase10("109348945610485453577574767652527472924289229538286649661240938988020367005475727988253438647560958573506159449538793540472829815903949343191091817779240101054552748665267574271163617694640513549693841337820602726596756351006149518830932261246698766355347898158548465400674856021497190430791824869615170301029"),
+ }
+ priv.precompute()
+
+ c := fromBase10("1000")
+
+ b.StartTimer()
+
+ for i := 0; i < b.N; i++ {
+ decrypt(nil, priv, c)
+ }
+}
+
+func Benchmark3PrimeRSA2048Decrypt(b *testing.B) {
+ b.StopTimer()
+ priv := &PrivateKey{
+ PublicKey: PublicKey{
+ N: fromBase10("16346378922382193400538269749936049106320265317511766357599732575277382844051791096569333808598921852351577762718529818072849191122419410612033592401403764925096136759934497687765453905884149505175426053037420486697072448609022753683683718057795566811401938833367954642951433473337066311978821180526439641496973296037000052546108507805269279414789035461158073156772151892452251106173507240488993608650881929629163465099476849643165682709047462010581308719577053905787496296934240246311806555924593059995202856826239801816771116902778517096212527979497399966526283516447337775509777558018145573127308919204297111496233"),
+ E: 3,
+ },
+ D: fromBase10("10897585948254795600358846499957366070880176878341177571733155050184921896034527397712889205732614568234385175145686545381899460748279607074689061600935843283397424506622998458510302603922766336783617368686090042765718290914099334449154829375179958369993407724946186243249568928237086215759259909861748642124071874879861299389874230489928271621259294894142840428407196932444474088857746123104978617098858619445675532587787023228852383149557470077802718705420275739737958953794088728369933811184572620857678792001136676902250566845618813972833750098806496641114644760255910789397593428910198080271317419213080834885003"),
+ P: fromBase10("1025363189502892836833747188838978207017355117492483312747347695538428729137306368764177201532277413433182799108299960196606011786562992097313508180436744488171474690412562218914213688661311117337381958560443"),
+ Q: fromBase10("3467903426626310123395340254094941045497208049900750380025518552334536945536837294961497712862519984786362199788654739924501424784631315081391467293694361474867825728031147665777546570788493758372218019373"),
+ R: fromBase10("4597024781409332673052708605078359346966325141767460991205742124888960305710298765592730135879076084498363772408626791576005136245060321874472727132746643162385746062759369754202494417496879741537284589047"),
+ }
+ priv.precompute()
+
+ c := fromBase10("1000")
+
+ b.StartTimer()
+
+ for i := 0; i < b.N; i++ {
+ decrypt(nil, priv, c)
+ }
+}
+
type testEncryptOAEPMessage struct {
in []byte
seed []byte
@@ -81,10 +156,12 @@ func TestDecryptOAEP(t *testing.T) {
for i, test := range testEncryptOAEPData {
n.SetString(test.modulus, 16)
d.SetString(test.d, 16)
- private := PrivateKey{PublicKey{n, test.e}, d, nil, nil}
+ private := new(PrivateKey)
+ private.PublicKey = PublicKey{n, test.e}
+ private.D = d
for j, message := range test.msgs {
- out, err := DecryptOAEP(sha1, nil, &private, message.out, nil)
+ out, err := DecryptOAEP(sha1, nil, private, message.out, nil)
if err != nil {
t.Errorf("#%d,%d error: %s", i, j, err)
} else if bytes.Compare(out, message.in) != 0 {
@@ -92,13 +169,16 @@ func TestDecryptOAEP(t *testing.T) {
}
// Decrypt with blinding.
- out, err = DecryptOAEP(sha1, random, &private, message.out, nil)
+ out, err = DecryptOAEP(sha1, random, private, message.out, nil)
if err != nil {
t.Errorf("#%d,%d (blind) error: %s", i, j, err)
} else if bytes.Compare(out, message.in) != 0 {
t.Errorf("#%d,%d (blind) bad result: %#v (want %#v)", i, j, out, message.in)
}
}
+ if testing.Short() {
+ break
+ }
}
}
generated by cgit v1.2.3 (git 2.46.0) at 2025-11-02 10:21:05 +0000