aboutsummaryrefslogtreecommitdiff
path: root/crypto/bn/bn_prime.c
AgeCommit message (Collapse)AuthorFilesLines
2022-11-23Improve FIPS RSA keygen performance.slontis1-0/+11
Reduce the Miller Rabin counts to the values specified by FIPS 186-5. The old code was using a fixed value of 64. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19579) (cherry picked from commit d2f6e66d2837bff1f5f7636bb2118e3a45c9df61)
2022-10-11Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19382)
2022-10-04Fix error propagatation in BN_check_prime()Kazuki Yamaguchi1-2/+3
BN_check_prime() is supposed to return 0 for a composite number and -1 on error. Properly translate the return value of the internal function ossl_bn_miller_rabin_is_prime(), where 0 means an error. The confusion prevented BN_GENCB callbacks from aborting the primality test or key generation routines utilizing this. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19314) (cherry picked from commit 0b3867634f74f6cb7b60b3a0adde396421207214)
2021-06-02bn: remove TODOsPauli1-1/+0
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15539)
2021-05-29add zero strenght arguments to BN and RAND RNG callsPauli1-3/+4
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-27bn: rename bn_check_prime_int -> ossl_bn_check_primtPauli1-5/+5
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15445)
2021-02-26Fix external symbols for bnShane Lontis1-4/+4
Partial fix for #12964 This adds ossl_ names for symbols related to bn_* Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14296)
2021-01-28Update copyright yearRichard Levitte1-1/+1
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
2021-01-13Fix incorrect use of BN_CTX APIAgustin Gianni1-2/+4
In some edge cases BN_CTX_end was being called without first calling BN_CTX_start. This creates a situation where the state of the big number allocator is corrupted and may lead to crashes. Fixes #13812 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13813)
2020-11-13Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte1-2/+2
This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-05-15Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11839)
2020-04-28Rename FIPS_MODE to FIPS_MODULERichard Levitte1-4/+4
This macro is used to determine if certain pieces of code should become part of the FIPS module or not. The old name was confusing. Fixes #11538 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11539)
2019-11-07Update source files for deprecation at 3.0Richard Levitte1-1/+1
Previous macros suggested that from 3.0, we're only allowed to deprecate things at a major version. However, there's no policy stating this, but there is for removal, saying that to remove something, it must have been deprecated for 5 years, and that removal can only happen at a major version. Meanwhile, the semantic versioning rule is that deprecation should trigger a MINOR version update, which is reflected in the macro names as of this change. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-10-14Add BN_check_prime()Kurt Roeckx1-8/+54
Add a new API to test for primes that can't be misused, deprecated the old APIs. Suggested by Jake Massimo and Kenneth Paterson Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #9272
2019-10-14Use fewer primes for the trial divisionKurt Roeckx1-7/+45
When using Miller-Rabin to test for primes, it's can be faster to first do trial divisions, but when doing too many trial divisions it gets slower again. We reduce the number of trial divisions to a point that gives better performance. Based on research by Jake Massimo and Kenneth Paterson Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #9272
2019-09-28Reorganize local header filesDr. Matthias St. Pierre1-1/+1
Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-08-09Merge probable_prime_dh_safe with bn_probable_prime_dhBernd Edlinger1-84/+36
This should avoid half of the trial divisions in probable_prime_dh_safe and avoid bn_probable_prime_dh generating primes with special properties. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9309)
2019-08-09Add a parameter to probable_prime if we look for a safe primeBernd Edlinger1-56/+25
Currently probable_prime makes sure that p-1 does not have any prime factors from 3..17863, which is useful for safe primes, but not necessarily for the general case. Issue was initially reported here: MIRONOV, I. Factoring RSA Moduli II. https://windowsontheory.org/2012/05/17/factoring-rsa-moduli-part-ii/ Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9309)
2019-07-15Make sure all BIGNUM operations work within the FIPS providerMatt Caswell1-23/+44
The FIPS provider does not have a default OPENSSL_CTX so, where necessary, we need to ensure we can always access an explicit OPENSSL_CTX. We remove functions from the FIPS provider that use the default OPENSSL_CTX, and fixup some places which were using those removed functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9310)
2019-07-07Fix an endless loop in BN_generate_prime_exBernd Edlinger1-2/+6
Happens when trying to generate 4 or 5 bit safe primes. [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9311)
2019-04-15Call RSA generation callback at the correct time.Kurt Roeckx1-2/+2
The callback should be called with 1 when a Miller-Rabin round marked the candidate as probably prime. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> GH: #8742
2019-03-19Added NULL check to BN_clear() & BN_CTX_end()Shane Lontis1-2/+1
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8518)
2019-03-12FIPS 186-4 RSA Generation & ValidationShane Lontis1-82/+189
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6652)
2018-12-06Following the license change, modify the boilerplates in crypto/bn/Richard Levitte1-1/+1
[skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7777)
2018-06-22Fixed range of random produced in BN_is_prime_fasttest_ex() to be 1 < rand < ↵Shane Lontis1-15/+13
w-1. It was using 1<= rand < w (which is wrong by 1 on both ends) Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6547)
2018-04-03Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5851)
2018-04-02Use the private RNG for data that is not publicKurt Roeckx1-2/+3
Reviewed-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Fixes: #4641 GH: #4665
2017-10-18Remove parentheses of return.KaoruToda1-5/+5
Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-09Since return is inconsistent, I removed unnecessary parentheses andKaoruToda1-1/+1
unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-08-03Add RAND_priv_bytes() for private keysRich Salz1-4/+4
Add a new global DRBG for private keys used by RAND_priv_bytes. Add BN_priv_rand() and BN_priv_rand_range() which use RAND_priv_bytes(). Change callers to use the appropriate BN_priv... function. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4076)
2017-07-03BN_pseudo_rand is really BN_randRich Salz1-1/+1
And BN_pseudo_rand_range is really BN_rand_range. Document that we might deprecate those functions. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3743)
2017-06-26Fix inaccurate comments in bn_prime.cPaul Yang1-4/+2
As well as a coding style nit is fixed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3763)
2017-04-21Numbers greater than 1 are usually non-negative.David Benjamin1-18/+6
BN_is_prime_fasttest_ex begins by rejecting if a <= 1. Then it goes to set A := abs(a), but a cannot be negative at this point. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3275)
2017-04-20Small primes are primes too.Adam Langley1-1/+1
Previously, BN_is_prime_fasttest_ex, when doing trial-division, would check whether the candidate is a multiple of a number of small primes and, if so, reject it. However, three is a multiple of three yet is still a prime number. This change accepts small primes as prime when doing trial-division. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3264)
2017-02-28Remove dead code in bnMatt Caswell1-124/+0
There are a number of symbols in bn which are internal only and never used by anything. They should be removed. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2766)
2016-11-15Check return value of some BN functions.Rich Salz1-1/+2
Factorise multiple bn_get_top(group->field) calls Add missing checks on some conditional BN_copy return value Add missing checks on some BN_copy return value Add missing checks on a few bn_wexpand return value Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1626)
2016-08-10Change callers to use the new constants.Rich Salz1-5/+6
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1429)
2016-06-29Whitespace cleanup in cryptoFdaSilvaYY1-1/+1
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1264)
2016-06-25Handle BN_mod_word failures.David Benjamin1-11/+30
As of 37258dadaa9e36db4b96a3aa54aa6c67136160cc and the corresponding upstream change, BN_mod_word may fail, like BN_div_word. Handle this properly. Thanks to Brian Smith for pointing this out. See BoringSSL's 44bedc348d9491e63c7ed1438db100a4b8a830be. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1251
2016-06-18Useless header include of openssl/rand.hFdaSilvaYY1-1/+0
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1168)
2016-06-13Add some missing return value checksMatt Caswell1-3/+5
Some misc return value checks Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-17Copyright consolidation 06/10Rich Salz1-107/+8
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-28Don't leak memory on error in BN_generate_prime_exMatt Caswell1-3/+4
In BN_generate_prime_ex() we do some sanity checks first and return with an error if they fail. We should do that *before* allocating any resources to avoid a memory leak. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-28Restore NUMPRIMES as a numeric literalViktor Dukhovni1-2/+0
This fixes clang compilation problem with size_t NUMPRIMES and int loop counters. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-27Remove EIGHT_BIT and SIXTEEN_BITRich Salz1-6/+2
Also cleaned up bn_prime.pl to current coding style. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-26Remove /* foo.c */ commentsRich Salz1-1/+0
This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-09-05RT3955: Reduce some stack usageRich Salz1-5/+9
Use malloc/free instead of big onstack buffers. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-14Identify and move common internal libcrypto header filesRichard Levitte1-1/+1
There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-30free NULL cleanup 7Rich Salz1-5/+3
This gets BN_.*free: BN_BLINDING_free BN_CTX_free BN_FLG_FREE BN_GENCB_free BN_MONT_CTX_free BN_RECP_CTX_free BN_clear_free BN_free BUF_MEM_free Also fix a call to DSA_SIG_free to ccgost engine and remove some #ifdef'd dead code in engines/e_ubsec. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-17Fix probable_prime over large shiftMatt Caswell1-1/+11
In the probable_prime() function we behave slightly different if the number of bits we are interested in is <= BN_BITS2 (the num of bits in a BN_ULONG). As part of the calculation we work out a size_limit as follows: size_limit = (((BN_ULONG)1) << bits) - BN_get_word(rnd) - 1; There is a problem though if bits == BN_BITS2. Shifting by that much causes undefined behaviour. I did some tests. On my system BN_BITS2 == 64. So I set bits to 64 and calculated the result of: (((BN_ULONG)1) << bits) I was expecting to get the result 0. I actually got 1! Strangely this... (((BN_ULONG)0) << BN_BITS2) ...does equal 0! This means that, on my system at least, size_limit will be off by 1 when bits == BN_BITS2. This commit fixes the behaviour so that we always get consistent results. Reviewed-by: Andy Polyakov <appro@openssl.org>
generated by cgit v1.1 at 2024-09-14 10:57:13 +0000