123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265 |
- #include <stdio.h>
- #include <time.h>
- #include "internal/cryptlib.h"
- #include "bn_local.h"
- #include <openssl/rand.h>
- #include <openssl/sha.h>
- typedef enum bnrand_flag_e {
- NORMAL, TESTING, PRIVATE
- } BNRAND_FLAG;
- static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
- {
- unsigned char *buf = NULL;
- int b, ret = 0, bit, bytes, mask;
- if (bits == 0) {
- if (top != BN_RAND_TOP_ANY || bottom != BN_RAND_BOTTOM_ANY)
- goto toosmall;
- BN_zero(rnd);
- return 1;
- }
- if (bits < 0 || (bits == 1 && top > 0))
- goto toosmall;
- bytes = (bits + 7) / 8;
- bit = (bits - 1) % 8;
- mask = 0xff << (bit + 1);
- buf = OPENSSL_malloc(bytes);
- if (buf == NULL) {
- BNerr(BN_F_BNRAND, ERR_R_MALLOC_FAILURE);
- goto err;
- }
-
- b = flag == NORMAL ? RAND_bytes(buf, bytes) : RAND_priv_bytes(buf, bytes);
- if (b <= 0)
- goto err;
- if (flag == TESTING) {
-
- int i;
- unsigned char c;
- for (i = 0; i < bytes; i++) {
- if (RAND_bytes(&c, 1) <= 0)
- goto err;
- if (c >= 128 && i > 0)
- buf[i] = buf[i - 1];
- else if (c < 42)
- buf[i] = 0;
- else if (c < 84)
- buf[i] = 255;
- }
- }
- if (top >= 0) {
- if (top) {
- if (bit == 0) {
- buf[0] = 1;
- buf[1] |= 0x80;
- } else {
- buf[0] |= (3 << (bit - 1));
- }
- } else {
- buf[0] |= (1 << bit);
- }
- }
- buf[0] &= ~mask;
- if (bottom)
- buf[bytes - 1] |= 1;
- if (!BN_bin2bn(buf, bytes, rnd))
- goto err;
- ret = 1;
- err:
- OPENSSL_clear_free(buf, bytes);
- bn_check_top(rnd);
- return ret;
- toosmall:
- BNerr(BN_F_BNRAND, BN_R_BITS_TOO_SMALL);
- return 0;
- }
- int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
- {
- return bnrand(NORMAL, rnd, bits, top, bottom);
- }
- int BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom)
- {
- return bnrand(TESTING, rnd, bits, top, bottom);
- }
- int BN_priv_rand(BIGNUM *rnd, int bits, int top, int bottom)
- {
- return bnrand(PRIVATE, rnd, bits, top, bottom);
- }
- static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)
- {
- int n;
- int count = 100;
- if (range->neg || BN_is_zero(range)) {
- BNerr(BN_F_BNRAND_RANGE, BN_R_INVALID_RANGE);
- return 0;
- }
- n = BN_num_bits(range);
-
- if (n == 1)
- BN_zero(r);
- else if (!BN_is_bit_set(range, n - 2) && !BN_is_bit_set(range, n - 3)) {
-
- do {
- if (!bnrand(flag, r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))
- return 0;
-
- if (BN_cmp(r, range) >= 0) {
- if (!BN_sub(r, r, range))
- return 0;
- if (BN_cmp(r, range) >= 0)
- if (!BN_sub(r, r, range))
- return 0;
- }
- if (!--count) {
- BNerr(BN_F_BNRAND_RANGE, BN_R_TOO_MANY_ITERATIONS);
- return 0;
- }
- }
- while (BN_cmp(r, range) >= 0);
- } else {
- do {
-
- if (!bnrand(flag, r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))
- return 0;
- if (!--count) {
- BNerr(BN_F_BNRAND_RANGE, BN_R_TOO_MANY_ITERATIONS);
- return 0;
- }
- }
- while (BN_cmp(r, range) >= 0);
- }
- bn_check_top(r);
- return 1;
- }
- int BN_rand_range(BIGNUM *r, const BIGNUM *range)
- {
- return bnrand_range(NORMAL, r, range);
- }
- int BN_priv_rand_range(BIGNUM *r, const BIGNUM *range)
- {
- return bnrand_range(PRIVATE, r, range);
- }
- int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom)
- {
- return BN_rand(rnd, bits, top, bottom);
- }
- int BN_pseudo_rand_range(BIGNUM *r, const BIGNUM *range)
- {
- return BN_rand_range(r, range);
- }
- int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
- const BIGNUM *priv, const unsigned char *message,
- size_t message_len, BN_CTX *ctx)
- {
- SHA512_CTX sha;
-
- unsigned char random_bytes[64];
- unsigned char digest[SHA512_DIGEST_LENGTH];
- unsigned done, todo;
-
- const unsigned num_k_bytes = BN_num_bytes(range) + 8;
- unsigned char private_bytes[96];
- unsigned char *k_bytes;
- int ret = 0;
- k_bytes = OPENSSL_malloc(num_k_bytes);
- if (k_bytes == NULL)
- goto err;
-
- if (BN_bn2binpad(priv, private_bytes, sizeof(private_bytes)) < 0) {
-
- BNerr(BN_F_BN_GENERATE_DSA_NONCE, BN_R_PRIVATE_KEY_TOO_LARGE);
- goto err;
- }
- for (done = 0; done < num_k_bytes;) {
- if (RAND_priv_bytes(random_bytes, sizeof(random_bytes)) != 1)
- goto err;
- SHA512_Init(&sha);
- SHA512_Update(&sha, &done, sizeof(done));
- SHA512_Update(&sha, private_bytes, sizeof(private_bytes));
- SHA512_Update(&sha, message, message_len);
- SHA512_Update(&sha, random_bytes, sizeof(random_bytes));
- SHA512_Final(digest, &sha);
- todo = num_k_bytes - done;
- if (todo > SHA512_DIGEST_LENGTH)
- todo = SHA512_DIGEST_LENGTH;
- memcpy(k_bytes + done, digest, todo);
- done += todo;
- }
- if (!BN_bin2bn(k_bytes, num_k_bytes, out))
- goto err;
- if (BN_mod(out, out, range, ctx) != 1)
- goto err;
- ret = 1;
- err:
- OPENSSL_free(k_bytes);
- OPENSSL_cleanse(private_bytes, sizeof(private_bytes));
- return ret;
- }
|