rsa_internal.h 8.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226
  1. /**
  2. * \file rsa_internal.h
  3. *
  4. * \brief Context-independent RSA helper functions
  5. *
  6. * This module declares some RSA-related helper functions useful when
  7. * implementing the RSA interface. These functions are provided in a separate
  8. * compilation unit in order to make it easy for designers of alternative RSA
  9. * implementations to use them in their own code, as it is conceived that the
  10. * functionality they provide will be necessary for most complete
  11. * implementations.
  12. *
  13. * End-users of Mbed TLS who are not providing their own alternative RSA
  14. * implementations should not use these functions directly, and should instead
  15. * use only the functions declared in rsa.h.
  16. *
  17. * The interface provided by this module will be maintained through LTS (Long
  18. * Term Support) branches of Mbed TLS, but may otherwise be subject to change,
  19. * and must be considered an internal interface of the library.
  20. *
  21. * There are two classes of helper functions:
  22. *
  23. * (1) Parameter-generating helpers. These are:
  24. * - mbedtls_rsa_deduce_primes
  25. * - mbedtls_rsa_deduce_private_exponent
  26. * - mbedtls_rsa_deduce_crt
  27. * Each of these functions takes a set of core RSA parameters and
  28. * generates some other, or CRT related parameters.
  29. *
  30. * (2) Parameter-checking helpers. These are:
  31. * - mbedtls_rsa_validate_params
  32. * - mbedtls_rsa_validate_crt
  33. * They take a set of core or CRT related RSA parameters and check their
  34. * validity.
  35. *
  36. */
  37. /*
  38. * Copyright (C) 2006-2017, ARM Limited, All Rights Reserved
  39. * SPDX-License-Identifier: Apache-2.0
  40. *
  41. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  42. * not use this file except in compliance with the License.
  43. * You may obtain a copy of the License at
  44. *
  45. * http://www.apache.org/licenses/LICENSE-2.0
  46. *
  47. * Unless required by applicable law or agreed to in writing, software
  48. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  49. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  50. * See the License for the specific language governing permissions and
  51. * limitations under the License.
  52. *
  53. * This file is part of mbed TLS (https://tls.mbed.org)
  54. *
  55. */
  56. #ifndef MBEDTLS_RSA_INTERNAL_H
  57. #define MBEDTLS_RSA_INTERNAL_H
  58. #if !defined(MBEDTLS_CONFIG_FILE)
  59. #include "config.h"
  60. #else
  61. #include MBEDTLS_CONFIG_FILE
  62. #endif
  63. #include "bignum.h"
  64. #ifdef __cplusplus
  65. extern "C" {
  66. #endif
  67. /**
  68. * \brief Compute RSA prime moduli P, Q from public modulus N=PQ
  69. * and a pair of private and public key.
  70. *
  71. * \note This is a 'static' helper function not operating on
  72. * an RSA context. Alternative implementations need not
  73. * overwrite it.
  74. *
  75. * \param N RSA modulus N = PQ, with P, Q to be found
  76. * \param E RSA public exponent
  77. * \param D RSA private exponent
  78. * \param P Pointer to MPI holding first prime factor of N on success
  79. * \param Q Pointer to MPI holding second prime factor of N on success
  80. *
  81. * \return
  82. * - 0 if successful. In this case, P and Q constitute a
  83. * factorization of N.
  84. * - A non-zero error code otherwise.
  85. *
  86. * \note It is neither checked that P, Q are prime nor that
  87. * D, E are modular inverses wrt. P-1 and Q-1. For that,
  88. * use the helper function \c mbedtls_rsa_validate_params.
  89. *
  90. */
  91. int mbedtls_rsa_deduce_primes( mbedtls_mpi const *N, mbedtls_mpi const *E,
  92. mbedtls_mpi const *D,
  93. mbedtls_mpi *P, mbedtls_mpi *Q );
  94. /**
  95. * \brief Compute RSA private exponent from
  96. * prime moduli and public key.
  97. *
  98. * \note This is a 'static' helper function not operating on
  99. * an RSA context. Alternative implementations need not
  100. * overwrite it.
  101. *
  102. * \param P First prime factor of RSA modulus
  103. * \param Q Second prime factor of RSA modulus
  104. * \param E RSA public exponent
  105. * \param D Pointer to MPI holding the private exponent on success.
  106. *
  107. * \return
  108. * - 0 if successful. In this case, D is set to a simultaneous
  109. * modular inverse of E modulo both P-1 and Q-1.
  110. * - A non-zero error code otherwise.
  111. *
  112. * \note This function does not check whether P and Q are primes.
  113. *
  114. */
  115. int mbedtls_rsa_deduce_private_exponent( mbedtls_mpi const *P,
  116. mbedtls_mpi const *Q,
  117. mbedtls_mpi const *E,
  118. mbedtls_mpi *D );
  119. /**
  120. * \brief Generate RSA-CRT parameters
  121. *
  122. * \note This is a 'static' helper function not operating on
  123. * an RSA context. Alternative implementations need not
  124. * overwrite it.
  125. *
  126. * \param P First prime factor of N
  127. * \param Q Second prime factor of N
  128. * \param D RSA private exponent
  129. * \param DP Output variable for D modulo P-1
  130. * \param DQ Output variable for D modulo Q-1
  131. * \param QP Output variable for the modular inverse of Q modulo P.
  132. *
  133. * \return 0 on success, non-zero error code otherwise.
  134. *
  135. * \note This function does not check whether P, Q are
  136. * prime and whether D is a valid private exponent.
  137. *
  138. */
  139. int mbedtls_rsa_deduce_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q,
  140. const mbedtls_mpi *D, mbedtls_mpi *DP,
  141. mbedtls_mpi *DQ, mbedtls_mpi *QP );
  142. /**
  143. * \brief Check validity of core RSA parameters
  144. *
  145. * \note This is a 'static' helper function not operating on
  146. * an RSA context. Alternative implementations need not
  147. * overwrite it.
  148. *
  149. * \param N RSA modulus N = PQ
  150. * \param P First prime factor of N
  151. * \param Q Second prime factor of N
  152. * \param D RSA private exponent
  153. * \param E RSA public exponent
  154. * \param f_rng PRNG to be used for primality check, or NULL
  155. * \param p_rng PRNG context for f_rng, or NULL
  156. *
  157. * \return
  158. * - 0 if the following conditions are satisfied
  159. * if all relevant parameters are provided:
  160. * - P prime if f_rng != NULL (%)
  161. * - Q prime if f_rng != NULL (%)
  162. * - 1 < N = P * Q
  163. * - 1 < D, E < N
  164. * - D and E are modular inverses modulo P-1 and Q-1
  165. * (%) This is only done if MBEDTLS_GENPRIME is defined.
  166. * - A non-zero error code otherwise.
  167. *
  168. * \note The function can be used with a restricted set of arguments
  169. * to perform specific checks only. E.g., calling it with
  170. * (-,P,-,-,-) and a PRNG amounts to a primality check for P.
  171. */
  172. int mbedtls_rsa_validate_params( const mbedtls_mpi *N, const mbedtls_mpi *P,
  173. const mbedtls_mpi *Q, const mbedtls_mpi *D,
  174. const mbedtls_mpi *E,
  175. int (*f_rng)(void *, unsigned char *, size_t),
  176. void *p_rng );
  177. /**
  178. * \brief Check validity of RSA CRT parameters
  179. *
  180. * \note This is a 'static' helper function not operating on
  181. * an RSA context. Alternative implementations need not
  182. * overwrite it.
  183. *
  184. * \param P First prime factor of RSA modulus
  185. * \param Q Second prime factor of RSA modulus
  186. * \param D RSA private exponent
  187. * \param DP MPI to check for D modulo P-1
  188. * \param DQ MPI to check for D modulo P-1
  189. * \param QP MPI to check for the modular inverse of Q modulo P.
  190. *
  191. * \return
  192. * - 0 if the following conditions are satisfied:
  193. * - D = DP mod P-1 if P, D, DP != NULL
  194. * - Q = DQ mod P-1 if P, D, DQ != NULL
  195. * - QP = Q^-1 mod P if P, Q, QP != NULL
  196. * - \c MBEDTLS_ERR_RSA_KEY_CHECK_FAILED if check failed,
  197. * potentially including \c MBEDTLS_ERR_MPI_XXX if some
  198. * MPI calculations failed.
  199. * - \c MBEDTLS_ERR_RSA_BAD_INPUT_DATA if insufficient
  200. * data was provided to check DP, DQ or QP.
  201. *
  202. * \note The function can be used with a restricted set of arguments
  203. * to perform specific checks only. E.g., calling it with the
  204. * parameters (P, -, D, DP, -, -) will check DP = D mod P-1.
  205. */
  206. int mbedtls_rsa_validate_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q,
  207. const mbedtls_mpi *D, const mbedtls_mpi *DP,
  208. const mbedtls_mpi *DQ, const mbedtls_mpi *QP );
  209. #ifdef __cplusplus
  210. }
  211. #endif
  212. #endif /* rsa_internal.h */