7 #define RSA_EXPONENT 37 /* we like this prime */
9 #if 0 /* bignum diagnostic function */
10 static void diagbn(char *prefix, Bignum md) {
11 int i, nibbles, morenibbles;
12 static const char hex[] = "0123456789ABCDEF";
14 printf("%s0x", prefix ? prefix : "");
16 nibbles = (3 + ssh1_bignum_bitcount(md))/4; if (nibbles<1) nibbles=1;
17 morenibbles = 4*md[0] - nibbles;
18 for (i=0; i<morenibbles; i++) putchar('-');
19 for (i=nibbles; i-- ;)
20 putchar(hex[(bignum_byte(md, i/2) >> (4*(i%2))) & 0xF]);
22 if (prefix) putchar('\n');
26 int rsa_generate(struct RSAKey *key, int bits, progfn_t pfn, void *pfnparam) {
27 Bignum pm1, qm1, phi_n;
30 * Set up the phase limits for the progress report. We do this
31 * by passing minus the phase number.
33 * For prime generation: our initial filter finds things
34 * coprime to everything below 2^16. Computing the product of
35 * (p-1)/p for all prime p below 2^16 gives about 20.33; so
36 * among B-bit integers, one in every 20.33 will get through
37 * the initial filter to be a candidate prime.
39 * Meanwhile, we are searching for primes in the region of 2^B;
40 * since pi(x) ~ x/log(x), when x is in the region of 2^B, the
41 * prime density will be d/dx pi(x) ~ 1/log(B), i.e. about
42 * 1/0.6931B. So the chance of any given candidate being prime
43 * is 20.33/0.6931B, which is roughly 29.34 divided by B.
45 * So now we have this probability P, we're looking at an
46 * exponential distribution with parameter P: we will manage in
47 * one attempt with probability P, in two with probability
48 * P(1-P), in three with probability P(1-P)^2, etc. The
49 * probability that we have still not managed to find a prime
50 * after N attempts is (1-P)^N.
52 * We therefore inform the progress indicator of the number B
53 * (29.34/B), so that it knows how much to increment by each
54 * time. We do this in 16-bit fixed point, so 29.34 becomes
57 pfn(pfnparam, -1, -0x1D57C4/(bits/2));
58 pfn(pfnparam, -2, -0x1D57C4/(bits-bits/2));
62 * We don't generate e; we just use a standard one always.
64 key->exponent = bignum_from_short(RSA_EXPONENT);
67 * Generate p and q: primes with combined length `bits', not
68 * congruent to 1 modulo e. (Strictly speaking, we wanted (p-1)
69 * and e to be coprime, and (q-1) and e to be coprime, but in
70 * general that's slightly more fiddly to arrange. By choosing
71 * a prime e, we can simplify the criterion.)
73 key->p = primegen(bits/2, RSA_EXPONENT, 1, 1, pfn, pfnparam);
74 key->q = primegen(bits - bits/2, RSA_EXPONENT, 1, 2, pfn, pfnparam);
77 * Ensure p > q, by swapping them if not.
79 if (bignum_cmp(key->p, key->q) < 0) {
86 * Now we have p, q and e. All we need to do now is work out
87 * the other helpful quantities: n=pq, d=e^-1 mod (p-1)(q-1),
91 key->modulus = bigmul(key->p, key->q);
97 phi_n = bigmul(pm1, qm1);
101 key->private_exponent = modinv(key->exponent, phi_n);
103 key->iqmp = modinv(key->q, key->p);
107 * Clean up temporary numbers.