aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/bn/bn_prime.c
Commit message (Collapse)AuthorAgeFilesLines
* Improve FIPS RSA keygen performance.slontis2022-11-231-0/+11
| | | | | | | | | Reduce the Miller Rabin counts to the values specified by FIPS 186-5. The old code was using a fixed value of 64. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19579)
* Stop raising ERR_R_MALLOC_FAILURE in most placesRichard Levitte2022-10-051-3/+1
| | | | | | | | | | | | | | | | | | | | | | | Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
* Fix error propagatation in BN_check_prime()Kazuki Yamaguchi2022-10-041-2/+3
| | | | | | | | | | | | | | BN_check_prime() is supposed to return 0 for a composite number and -1 on error. Properly translate the return value of the internal function ossl_bn_miller_rabin_is_prime(), where 0 means an error. The confusion prevented BN_GENCB callbacks from aborting the primality test or key generation routines utilizing this. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19314)
* bn: remove TODOsPauli2021-06-021-1/+0
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15539)
* add zero strenght arguments to BN and RAND RNG callsPauli2021-05-291-3/+4
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15513)
* bn: rename bn_check_prime_int -> ossl_bn_check_primtPauli2021-05-271-5/+5
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15445)
* Fix external symbols for bnShane Lontis2021-02-261-4/+4
| | | | | | | | | Partial fix for #12964 This adds ossl_ names for symbols related to bn_* Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14296)
* Update copyright yearRichard Levitte2021-01-281-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
* Fix incorrect use of BN_CTX APIAgustin Gianni2021-01-131-2/+4
| | | | | | | | | | | | In some edge cases BN_CTX_end was being called without first calling BN_CTX_start. This creates a situation where the state of the big number allocator is corrupted and may lead to crashes. Fixes #13812 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13813)
* Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte2020-11-131-2/+2
| | | | | | | | | | This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
* Update copyright yearMatt Caswell2020-05-151-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11839)
* Rename FIPS_MODE to FIPS_MODULERichard Levitte2020-04-281-4/+4
| | | | | | | | | | This macro is used to determine if certain pieces of code should become part of the FIPS module or not. The old name was confusing. Fixes #11538 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11539)
* Update source files for deprecation at 3.0Richard Levitte2019-11-071-1/+1
| | | | | | | | | | | | | | | Previous macros suggested that from 3.0, we're only allowed to deprecate things at a major version. However, there's no policy stating this, but there is for removal, saying that to remove something, it must have been deprecated for 5 years, and that removal can only happen at a major version. Meanwhile, the semantic versioning rule is that deprecation should trigger a MINOR version update, which is reflected in the macro names as of this change. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
* Add BN_check_prime()Kurt Roeckx2019-10-141-8/+54
| | | | | | | | | | Add a new API to test for primes that can't be misused, deprecated the old APIs. Suggested by Jake Massimo and Kenneth Paterson Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #9272
* Use fewer primes for the trial divisionKurt Roeckx2019-10-141-7/+45
| | | | | | | | | | | | When using Miller-Rabin to test for primes, it's can be faster to first do trial divisions, but when doing too many trial divisions it gets slower again. We reduce the number of trial divisions to a point that gives better performance. Based on research by Jake Massimo and Kenneth Paterson Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #9272
* Reorganize local header filesDr. Matthias St. Pierre2019-09-281-1/+1
| | | | | | | | | | | | | Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
* Merge probable_prime_dh_safe with bn_probable_prime_dhBernd Edlinger2019-08-091-84/+36
| | | | | | | | This should avoid half of the trial divisions in probable_prime_dh_safe and avoid bn_probable_prime_dh generating primes with special properties. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9309)
* Add a parameter to probable_prime if we look for a safe primeBernd Edlinger2019-08-091-56/+25
| | | | | | | | | | | | | Currently probable_prime makes sure that p-1 does not have any prime factors from 3..17863, which is useful for safe primes, but not necessarily for the general case. Issue was initially reported here: MIRONOV, I. Factoring RSA Moduli II. https://windowsontheory.org/2012/05/17/factoring-rsa-moduli-part-ii/ Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9309)
* Make sure all BIGNUM operations work within the FIPS providerMatt Caswell2019-07-151-23/+44
| | | | | | | | | | | The FIPS provider does not have a default OPENSSL_CTX so, where necessary, we need to ensure we can always access an explicit OPENSSL_CTX. We remove functions from the FIPS provider that use the default OPENSSL_CTX, and fixup some places which were using those removed functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9310)
* Fix an endless loop in BN_generate_prime_exBernd Edlinger2019-07-071-2/+6
| | | | | | | | | Happens when trying to generate 4 or 5 bit safe primes. [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9311)
* Call RSA generation callback at the correct time.Kurt Roeckx2019-04-151-2/+2
| | | | | | | | The callback should be called with 1 when a Miller-Rabin round marked the candidate as probably prime. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> GH: #8742
* Added NULL check to BN_clear() & BN_CTX_end()Shane Lontis2019-03-191-2/+1
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8518)
* FIPS 186-4 RSA Generation & ValidationShane Lontis2019-03-121-82/+189
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6652)
* Following the license change, modify the boilerplates in crypto/bn/Richard Levitte2018-12-061-1/+1
| | | | | | | [skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7777)
* Fixed range of random produced in BN_is_prime_fasttest_ex() to be 1 < rand < ↵Shane Lontis2018-06-221-15/+13
| | | | | | | | w-1. It was using 1<= rand < w (which is wrong by 1 on both ends) Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6547)
* Update copyright yearMatt Caswell2018-04-031-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5851)
* Use the private RNG for data that is not publicKurt Roeckx2018-04-021-2/+3
| | | | | | | | Reviewed-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Fixes: #4641 GH: #4665
* Remove parentheses of return.KaoruToda2017-10-181-5/+5
| | | | | | | | | Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
* Since return is inconsistent, I removed unnecessary parentheses andKaoruToda2017-10-091-1/+1
| | | | | | | | | | | unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
* Add RAND_priv_bytes() for private keysRich Salz2017-08-031-4/+4
| | | | | | | | | | Add a new global DRBG for private keys used by RAND_priv_bytes. Add BN_priv_rand() and BN_priv_rand_range() which use RAND_priv_bytes(). Change callers to use the appropriate BN_priv... function. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4076)
* BN_pseudo_rand is really BN_randRich Salz2017-07-031-1/+1
| | | | | | | | And BN_pseudo_rand_range is really BN_rand_range. Document that we might deprecate those functions. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3743)
* Fix inaccurate comments in bn_prime.cPaul Yang2017-06-261-4/+2
| | | | | | | | As well as a coding style nit is fixed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3763)
* Numbers greater than 1 are usually non-negative.David Benjamin2017-04-211-18/+6
| | | | | | | | BN_is_prime_fasttest_ex begins by rejecting if a <= 1. Then it goes to set A := abs(a), but a cannot be negative at this point. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3275)
* Small primes are primes too.Adam Langley2017-04-201-1/+1
| | | | | | | | | | | | Previously, BN_is_prime_fasttest_ex, when doing trial-division, would check whether the candidate is a multiple of a number of small primes and, if so, reject it. However, three is a multiple of three yet is still a prime number. This change accepts small primes as prime when doing trial-division. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3264)
* Remove dead code in bnMatt Caswell2017-02-281-124/+0
| | | | | | | There are a number of symbols in bn which are internal only and never used by anything. They should be removed. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2766)
* Check return value of some BN functions.Rich Salz2016-11-151-1/+2
| | | | | | | | | | | Factorise multiple bn_get_top(group->field) calls Add missing checks on some conditional BN_copy return value Add missing checks on some BN_copy return value Add missing checks on a few bn_wexpand return value Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1626)
* Change callers to use the new constants.Rich Salz2016-08-101-5/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1429)
* Whitespace cleanup in cryptoFdaSilvaYY2016-06-291-1/+1
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1264)
* Handle BN_mod_word failures.David Benjamin2016-06-251-11/+30
| | | | | | | | | | | | As of 37258dadaa9e36db4b96a3aa54aa6c67136160cc and the corresponding upstream change, BN_mod_word may fail, like BN_div_word. Handle this properly. Thanks to Brian Smith for pointing this out. See BoringSSL's 44bedc348d9491e63c7ed1438db100a4b8a830be. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1251
* Useless header include of openssl/rand.hFdaSilvaYY2016-06-181-1/+0
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1168)
* Add some missing return value checksMatt Caswell2016-06-131-3/+5
| | | | | | Some misc return value checks Reviewed-by: Rich Salz <rsalz@openssl.org>
* Copyright consolidation 06/10Rich Salz2016-05-171-107/+8
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Don't leak memory on error in BN_generate_prime_exMatt Caswell2016-04-281-3/+4
| | | | | | | | In BN_generate_prime_ex() we do some sanity checks first and return with an error if they fail. We should do that *before* allocating any resources to avoid a memory leak. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Restore NUMPRIMES as a numeric literalViktor Dukhovni2016-01-281-2/+0
| | | | | | | This fixes clang compilation problem with size_t NUMPRIMES and int loop counters. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove EIGHT_BIT and SIXTEEN_BITRich Salz2016-01-271-6/+2
| | | | | | Also cleaned up bn_prime.pl to current coding style. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* RT3955: Reduce some stack usageRich Salz2015-09-051-5/+9
| | | | | | Use malloc/free instead of big onstack buffers. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Identify and move common internal libcrypto header filesRichard Levitte2015-05-141-1/+1
| | | | | | | | | | | | | There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
* free NULL cleanup 7Rich Salz2015-04-301-5/+3
| | | | | | | | | | | This gets BN_.*free: BN_BLINDING_free BN_CTX_free BN_FLG_FREE BN_GENCB_free BN_MONT_CTX_free BN_RECP_CTX_free BN_clear_free BN_free BUF_MEM_free Also fix a call to DSA_SIG_free to ccgost engine and remove some #ifdef'd dead code in engines/e_ubsec. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix probable_prime over large shiftMatt Caswell2015-03-171-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | In the probable_prime() function we behave slightly different if the number of bits we are interested in is <= BN_BITS2 (the num of bits in a BN_ULONG). As part of the calculation we work out a size_limit as follows: size_limit = (((BN_ULONG)1) << bits) - BN_get_word(rnd) - 1; There is a problem though if bits == BN_BITS2. Shifting by that much causes undefined behaviour. I did some tests. On my system BN_BITS2 == 64. So I set bits to 64 and calculated the result of: (((BN_ULONG)1) << bits) I was expecting to get the result 0. I actually got 1! Strangely this... (((BN_ULONG)0) << BN_BITS2) ...does equal 0! This means that, on my system at least, size_limit will be off by 1 when bits == BN_BITS2. This commit fixes the behaviour so that we always get consistent results. Reviewed-by: Andy Polyakov <appro@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-13 09:59:21 +0000