[openssl] OpenSSL_1_1_1-stable update
bernd.edlinger at hotmail.de
bernd.edlinger at hotmail.de
Thu Mar 19 02:23:54 UTC 2020
The branch OpenSSL_1_1_1-stable has been updated
via c3074077136c698af05ebe57347c186ae15c910a (commit)
via 186b50d24e6603460b987a15b4c15782b836a9a8 (commit)
via 0032bfea12054da94be04ac26fd0ebcb955dbe67 (commit)
via 7eccef219714366d87fe847b105260a0fc84f464 (commit)
from 9e1eaa4a400633409322ed843ca63be799cad341 (commit)
- Log -----------------------------------------------------------------
commit c3074077136c698af05ebe57347c186ae15c910a
Author: Bernd Edlinger <bernd.edlinger at hotmail.de>
Date: Mon Jul 15 20:48:38 2019 +0200
Add a CHANGES entry for BN_generate_prime_ex
BN_generate_prime_ex no longer avoids factors 3..17863 in p-1
when not computing safe primes.
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9387)
commit 186b50d24e6603460b987a15b4c15782b836a9a8
Author: Bernd Edlinger <bernd.edlinger at hotmail.de>
Date: Wed Jul 10 21:33:48 2019 +0200
Update documentation of BN_generate_prime_ex
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9387)
commit 0032bfea12054da94be04ac26fd0ebcb955dbe67
Author: Bernd Edlinger <bernd.edlinger at hotmail.de>
Date: Fri Jul 5 11:55:56 2019 +0200
Merge probable_prime_dh_safe with bn_probable_prime_dh
This should avoid half of the trial divisions in probable_prime_dh_safe
and avoid bn_probable_prime_dh generating primes with special properties.
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9387)
commit 7eccef219714366d87fe847b105260a0fc84f464
Author: Bernd Edlinger <bernd.edlinger at hotmail.de>
Date: Thu Jul 4 14:52:41 2019 +0200
Add a parameter to probable_prime if we look for a safe prime
Currently probable_prime makes sure that p-1 does not have
any prime factors from 3..17863, which is useful for safe primes,
but not necessarily for the general case.
Issue was initially reported here:
MIRONOV, I. Factoring RSA Moduli II.
https://windowsontheory.org/2012/05/17/factoring-rsa-moduli-part-ii/
Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9387)
-----------------------------------------------------------------------
Summary of changes:
CHANGES | 9 +-
crypto/bn/bn_local.h | 3 -
crypto/bn/bn_prime.c | 199 ++++++++++++-----------------------------
doc/man3/BN_generate_prime.pod | 8 +-
4 files changed, 73 insertions(+), 146 deletions(-)
diff --git a/CHANGES b/CHANGES
index 2d1d13f7fb..ac6777eae8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,7 +9,14 @@
Changes between 1.1.1e and 1.1.1f [xx XXX xxxx]
- *)
+ *) Revised BN_generate_prime_ex to not avoid factors 3..17863 in p-1
+ when primes for RSA keys are computed.
+ Since we previously always generated primes == 2 (mod 3) for RSA keys,
+ the 2-prime and 3-prime RSA modules were easy to distinguish, since
+ N = p*q = 1 (mod 3), but N = p*q*r = 2 (mod 3). Therefore fingerprinting
+ 2-prime vs. 3-prime RSA keys was possible by computing N mod 3.
+ This avoids possible fingerprinting of newly generated RSA modules.
+ [Bernd Edlinger]
Changes between 1.1.1d and 1.1.1e [17 Mar 2020]
*) Properly detect EOF while reading in libssl. Previously if we hit an EOF
diff --git a/crypto/bn/bn_local.h b/crypto/bn/bn_local.h
index 37228104c6..051cdeb331 100644
--- a/crypto/bn/bn_local.h
+++ b/crypto/bn/bn_local.h
@@ -654,9 +654,6 @@ BIGNUM *int_bn_mod_inverse(BIGNUM *in,
const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx,
int *noinv);
-int bn_probable_prime_dh(BIGNUM *rnd, int bits,
- const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
-
static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
{
if (bits > (INT_MAX - BN_BITS2 + 1))
diff --git a/crypto/bn/bn_prime.c b/crypto/bn/bn_prime.c
index 6d74da26d3..a1f7da4abd 100644
--- a/crypto/bn/bn_prime.c
+++ b/crypto/bn/bn_prime.c
@@ -22,10 +22,12 @@
static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
const BIGNUM *a1_odd, int k, BN_CTX *ctx,
BN_MONT_CTX *mont);
-static int probable_prime(BIGNUM *rnd, int bits, prime_t *mods);
-static int probable_prime_dh_safe(BIGNUM *rnd, int bits,
- const BIGNUM *add, const BIGNUM *rem,
- BN_CTX *ctx);
+static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods);
+static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods,
+ const BIGNUM *add, const BIGNUM *rem,
+ BN_CTX *ctx);
+
+#define square(x) ((BN_ULONG)(x) * (BN_ULONG)(x))
int BN_GENCB_call(BN_GENCB *cb, int a, int b)
{
@@ -87,16 +89,11 @@ int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
loop:
/* make a random number and set the top and bottom bits */
if (add == NULL) {
- if (!probable_prime(ret, bits, mods))
+ if (!probable_prime(ret, bits, safe, mods))
goto err;
} else {
- if (safe) {
- if (!probable_prime_dh_safe(ret, bits, add, rem, ctx))
- goto err;
- } else {
- if (!bn_probable_prime_dh(ret, bits, add, rem, ctx))
- goto err;
- }
+ if (!probable_prime_dh(ret, bits, safe, mods, add, rem, ctx))
+ goto err;
}
if (!BN_GENCB_call(cb, 0, c1++))
@@ -272,17 +269,18 @@ static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
return 1;
}
-static int probable_prime(BIGNUM *rnd, int bits, prime_t *mods)
+static int probable_prime(BIGNUM *rnd, int bits, int safe, prime_t *mods)
{
int i;
BN_ULONG delta;
BN_ULONG maxdelta = BN_MASK2 - primes[NUMPRIMES - 1];
- char is_single_word = bits <= BN_BITS2;
again:
/* TODO: Not all primes are private */
if (!BN_priv_rand(rnd, bits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ODD))
return 0;
+ if (safe && !BN_set_bit(rnd, 1))
+ return 0;
/* we now have a random number 'rnd' to test. */
for (i = 1; i < NUMPRIMES; i++) {
BN_ULONG mod = BN_mod_word(rnd, (BN_ULONG)primes[i]);
@@ -290,61 +288,25 @@ static int probable_prime(BIGNUM *rnd, int bits, prime_t *mods)
return 0;
mods[i] = (prime_t) mod;
}
- /*
- * If bits is so small that it fits into a single word then we
- * additionally don't want to exceed that many bits.
- */
- if (is_single_word) {
- BN_ULONG size_limit;
-
- if (bits == BN_BITS2) {
- /*
- * Shifting by this much has undefined behaviour so we do it a
- * different way
- */
- size_limit = ~((BN_ULONG)0) - BN_get_word(rnd);
- } else {
- size_limit = (((BN_ULONG)1) << bits) - BN_get_word(rnd) - 1;
- }
- if (size_limit < maxdelta)
- maxdelta = size_limit;
- }
delta = 0;
loop:
- if (is_single_word) {
- BN_ULONG rnd_word = BN_get_word(rnd);
-
- /*-
- * In the case that the candidate prime is a single word then
- * we check that:
- * 1) It's greater than primes[i] because we shouldn't reject
- * 3 as being a prime number because it's a multiple of
- * three.
- * 2) That it's not a multiple of a known prime. We don't
- * check that rnd-1 is also coprime to all the known
- * primes because there aren't many small primes where
- * that's true.
+ for (i = 1; i < NUMPRIMES; i++) {
+ /*
+ * check that rnd is a prime and also that
+ * gcd(rnd-1,primes) == 1 (except for 2)
+ * do the second check only if we are interested in safe primes
+ * in the case that the candidate prime is a single word then
+ * we check only the primes up to sqrt(rnd)
*/
- for (i = 1; i < NUMPRIMES && primes[i] < rnd_word; i++) {
- if ((mods[i] + delta) % primes[i] == 0) {
- delta += 2;
- if (delta > maxdelta)
- goto again;
- goto loop;
- }
- }
- } else {
- for (i = 1; i < NUMPRIMES; i++) {
- /*
- * check that rnd is not a prime and also that gcd(rnd-1,primes)
- * == 1 (except for 2)
- */
- if (((mods[i] + delta) % primes[i]) <= 1) {
- delta += 2;
- if (delta > maxdelta)
- goto again;
- goto loop;
- }
+ if (bits <= 31 && delta <= 0x7fffffff
+ && square(primes[i]) > BN_get_word(rnd) + delta)
+ break;
+ if (safe ? (mods[i] + delta) % primes[i] <= 1
+ : (mods[i] + delta) % primes[i] == 0) {
+ delta += safe ? 4 : 2;
+ if (delta > maxdelta)
+ goto again;
+ goto loop;
}
}
if (!BN_add_word(rnd, delta))
@@ -355,16 +317,23 @@ static int probable_prime(BIGNUM *rnd, int bits, prime_t *mods)
return 1;
}
-int bn_probable_prime_dh(BIGNUM *rnd, int bits,
- const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx)
+static int probable_prime_dh(BIGNUM *rnd, int bits, int safe, prime_t *mods,
+ const BIGNUM *add, const BIGNUM *rem,
+ BN_CTX *ctx)
{
int i, ret = 0;
BIGNUM *t1;
+ BN_ULONG delta;
+ BN_ULONG maxdelta = BN_MASK2 - primes[NUMPRIMES - 1];
BN_CTX_start(ctx);
if ((t1 = BN_CTX_get(ctx)) == NULL)
goto err;
+ if (maxdelta > BN_MASK2 - BN_get_word(add))
+ maxdelta = BN_MASK2 - BN_get_word(add);
+
+ again:
if (!BN_rand(rnd, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD))
goto err;
@@ -375,98 +344,48 @@ int bn_probable_prime_dh(BIGNUM *rnd, int bits,
if (!BN_sub(rnd, rnd, t1))
goto err;
if (rem == NULL) {
- if (!BN_add_word(rnd, 1))
+ if (!BN_add_word(rnd, safe ? 3u : 1u))
goto err;
} else {
if (!BN_add(rnd, rnd, rem))
goto err;
}
- /* we now have a random number 'rand' to test. */
+ if (BN_num_bits(rnd) < bits
+ || BN_get_word(rnd) < (safe ? 5u : 3u)) {
+ if (!BN_add(rnd, rnd, add))
+ goto err;
+ }
- loop:
+ /* we now have a random number 'rnd' to test. */
for (i = 1; i < NUMPRIMES; i++) {
- /* check that rnd is a prime */
BN_ULONG mod = BN_mod_word(rnd, (BN_ULONG)primes[i]);
if (mod == (BN_ULONG)-1)
goto err;
- if (mod <= 1) {
- if (!BN_add(rnd, rnd, add))
- goto err;
- goto loop;
- }
- }
- ret = 1;
-
- err:
- BN_CTX_end(ctx);
- bn_check_top(rnd);
- return ret;
-}
-
-static int probable_prime_dh_safe(BIGNUM *p, int bits, const BIGNUM *padd,
- const BIGNUM *rem, BN_CTX *ctx)
-{
- int i, ret = 0;
- BIGNUM *t1, *qadd, *q;
-
- bits--;
- BN_CTX_start(ctx);
- t1 = BN_CTX_get(ctx);
- q = BN_CTX_get(ctx);
- qadd = BN_CTX_get(ctx);
- if (qadd == NULL)
- goto err;
-
- if (!BN_rshift1(qadd, padd))
- goto err;
-
- if (!BN_rand(q, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD))
- goto err;
-
- /* we need ((rnd-rem) % add) == 0 */
- if (!BN_mod(t1, q, qadd, ctx))
- goto err;
- if (!BN_sub(q, q, t1))
- goto err;
- if (rem == NULL) {
- if (!BN_add_word(q, 1))
- goto err;
- } else {
- if (!BN_rshift1(t1, rem))
- goto err;
- if (!BN_add(q, q, t1))
- goto err;
+ mods[i] = (prime_t) mod;
}
-
- /* we now have a random number 'rand' to test. */
- if (!BN_lshift1(p, q))
- goto err;
- if (!BN_add_word(p, 1))
- goto err;
-
+ delta = 0;
loop:
for (i = 1; i < NUMPRIMES; i++) {
- /* check that p and q are prime */
- /*
- * check that for p and q gcd(p-1,primes) == 1 (except for 2)
- */
- BN_ULONG pmod = BN_mod_word(p, (BN_ULONG)primes[i]);
- BN_ULONG qmod = BN_mod_word(q, (BN_ULONG)primes[i]);
- if (pmod == (BN_ULONG)-1 || qmod == (BN_ULONG)-1)
- goto err;
- if (pmod == 0 || qmod == 0) {
- if (!BN_add(p, p, padd))
- goto err;
- if (!BN_add(q, q, qadd))
- goto err;
+ /* check that rnd is a prime */
+ if (bits <= 31 && delta <= 0x7fffffff
+ && square(primes[i]) > BN_get_word(rnd) + delta)
+ break;
+ /* rnd mod p == 1 implies q = (rnd-1)/2 is divisible by p */
+ if (safe ? (mods[i] + delta) % primes[i] <= 1
+ : (mods[i] + delta) % primes[i] == 0) {
+ delta += BN_get_word(add);
+ if (delta > maxdelta)
+ goto again;
goto loop;
}
}
+ if (!BN_add_word(rnd, delta))
+ goto err;
ret = 1;
err:
BN_CTX_end(ctx);
- bn_check_top(p);
+ bn_check_top(rnd);
return ret;
}
diff --git a/doc/man3/BN_generate_prime.pod b/doc/man3/BN_generate_prime.pod
index 31fbc1ffa1..d26e0a99c8 100644
--- a/doc/man3/BN_generate_prime.pod
+++ b/doc/man3/BN_generate_prime.pod
@@ -52,7 +52,9 @@ Deprecated:
BN_generate_prime_ex() generates a pseudo-random prime number of
at least bit length B<bits>. The returned number is probably prime
-with a negligible error.
+with a negligible error. If B<add> is B<NULL> the returned prime
+number will have exact bit length B<bits> with the top most two
+bits set.
If B<ret> is not B<NULL>, it will be used to store the number.
@@ -89,7 +91,9 @@ If B<add> is not B<NULL>, the prime will fulfill the condition p % B<add>
generator.
If B<safe> is true, it will be a safe prime (i.e. a prime p so
-that (p-1)/2 is also prime).
+that (p-1)/2 is also prime). If B<safe> is true, and B<rem> == B<NULL>
+the condition will be p % B<add> == 3.
+It is recommended that B<add> is a multiple of 4.
The random generator must be seeded prior to calling BN_generate_prime_ex().
If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to
More information about the openssl-commits
mailing list