1*b077aed3SPierre Pronchery /*
2*b077aed3SPierre Pronchery * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
3*b077aed3SPierre Pronchery *
4*b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*b077aed3SPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*b077aed3SPierre Pronchery * in the file LICENSE in the source distribution or at
7*b077aed3SPierre Pronchery * https://www.openssl.org/source/license.html
8*b077aed3SPierre Pronchery */
9*b077aed3SPierre Pronchery
10*b077aed3SPierre Pronchery #include "internal/ffc.h"
11*b077aed3SPierre Pronchery
12*b077aed3SPierre Pronchery /*
13*b077aed3SPierre Pronchery * SP800-56Ar3 5.6.1.1.4 Key pair generation by testing candidates.
14*b077aed3SPierre Pronchery * Generates a private key in the interval [1, min(2 ^ N - 1, q - 1)].
15*b077aed3SPierre Pronchery *
16*b077aed3SPierre Pronchery * ctx must be set up with a libctx (for fips mode).
17*b077aed3SPierre Pronchery * params contains the FFC domain parameters p, q and g (for DH or DSA).
18*b077aed3SPierre Pronchery * N is the maximum bit length of the generated private key,
19*b077aed3SPierre Pronchery * s is the security strength.
20*b077aed3SPierre Pronchery * priv_key is the returned private key,
21*b077aed3SPierre Pronchery */
ossl_ffc_generate_private_key(BN_CTX * ctx,const FFC_PARAMS * params,int N,int s,BIGNUM * priv)22*b077aed3SPierre Pronchery int ossl_ffc_generate_private_key(BN_CTX *ctx, const FFC_PARAMS *params,
23*b077aed3SPierre Pronchery int N, int s, BIGNUM *priv)
24*b077aed3SPierre Pronchery {
25*b077aed3SPierre Pronchery int ret = 0, qbits = BN_num_bits(params->q);
26*b077aed3SPierre Pronchery BIGNUM *m, *two_powN = NULL;
27*b077aed3SPierre Pronchery
28*b077aed3SPierre Pronchery /* Deal with the edge cases where the value of N and/or s is not set */
29*b077aed3SPierre Pronchery if (s == 0)
30*b077aed3SPierre Pronchery goto err;
31*b077aed3SPierre Pronchery if (N == 0)
32*b077aed3SPierre Pronchery N = params->keylength ? params->keylength : 2 * s;
33*b077aed3SPierre Pronchery
34*b077aed3SPierre Pronchery /* Step (2) : check range of N */
35*b077aed3SPierre Pronchery if (N < 2 * s || N > qbits)
36*b077aed3SPierre Pronchery return 0;
37*b077aed3SPierre Pronchery
38*b077aed3SPierre Pronchery two_powN = BN_new();
39*b077aed3SPierre Pronchery /* 2^N */
40*b077aed3SPierre Pronchery if (two_powN == NULL || !BN_lshift(two_powN, BN_value_one(), N))
41*b077aed3SPierre Pronchery goto err;
42*b077aed3SPierre Pronchery
43*b077aed3SPierre Pronchery /* Step (5) : M = min(2 ^ N, q) */
44*b077aed3SPierre Pronchery m = (BN_cmp(two_powN, params->q) > 0) ? params->q : two_powN;
45*b077aed3SPierre Pronchery
46*b077aed3SPierre Pronchery do {
47*b077aed3SPierre Pronchery /* Steps (3, 4 & 7) : c + 1 = 1 + random[0..2^N - 1] */
48*b077aed3SPierre Pronchery if (!BN_priv_rand_range_ex(priv, two_powN, 0, ctx)
49*b077aed3SPierre Pronchery || !BN_add_word(priv, 1))
50*b077aed3SPierre Pronchery goto err;
51*b077aed3SPierre Pronchery /* Step (6) : loop if c > M - 2 (i.e. c + 1 >= M) */
52*b077aed3SPierre Pronchery if (BN_cmp(priv, m) < 0)
53*b077aed3SPierre Pronchery break;
54*b077aed3SPierre Pronchery } while (1);
55*b077aed3SPierre Pronchery
56*b077aed3SPierre Pronchery ret = 1;
57*b077aed3SPierre Pronchery err:
58*b077aed3SPierre Pronchery BN_free(two_powN);
59*b077aed3SPierre Pronchery return ret;
60*b077aed3SPierre Pronchery }
61