Commit 4f6235f7 authored by Ulf Möller's avatar Ulf Möller
Browse files

RSA private keys without dmp1/dmq1/iqmp are also valid (but slower).

parent 9a3bbbce

crypto/rsa/rsa_chk.c

+45 −35
Original line number Diff line number Diff line
@@ -104,6 +104,32 @@ int RSA_check_key(RSA *key) 
		RSAerr(RSA_F_RSA_CHECK_KEY, RSA_R_N_DOES_NOT_EQUAL_P_Q);

		}

	

	/* d*e = 1  mod lcm(p-1,q-1)? */



	r = BN_sub(i, key->p, BN_value_one());

	if (!r) { ret = -1; goto err; }

	r = BN_sub(j, key->q, BN_value_one());

	if (!r) { ret = -1; goto err; }



	/* now compute k = lcm(i,j) */

	r = BN_mul(l, i, j, ctx);

	if (!r) { ret = -1; goto err; }

	r = BN_gcd(m, i, j, ctx);

	if (!r) { ret = -1; goto err; }

	r = BN_div(k, NULL, l, m, ctx); /* remainder is 0 */

	if (!r) { ret = -1; goto err; }



	r = BN_mod_mul(i, key->d, key->e, k, ctx);

	if (!r) { ret = -1; goto err; }



	if (!BN_is_one(i))

		{

		ret = 0;

		RSAerr(RSA_F_RSA_CHECK_KEY, RSA_R_D_E_NOT_CONGRUENT_TO_1);

		}

	

	if (key->dmp1 != NULL && key->dmq1 != NULL && key->iqmp != NULL)

		{

		/* dmp1 = d mod (p-1)? */

		r = BN_sub(i, key->p, BN_value_one());

		if (!r) { ret = -1; goto err; }
@@ -114,7 +140,8 @@ int RSA_check_key(RSA *key) 
		if (BN_cmp(j, key->dmp1) != 0)

			{

			ret = 0;

		RSAerr(RSA_F_RSA_CHECK_KEY, RSA_R_DMP1_NOT_CONGRUENT_TO_D);

			RSAerr(RSA_F_RSA_CHECK_KEY,

				RSA_R_DMP1_NOT_CONGRUENT_TO_D);

			}

	

		/* dmq1 = d mod (q-1)? */
@@ -127,40 +154,23 @@ int RSA_check_key(RSA *key) 
		if (BN_cmp(j, key->dmq1) != 0)

			{

			ret = 0;

		RSAerr(RSA_F_RSA_CHECK_KEY, RSA_R_DMQ1_NOT_CONGRUENT_TO_D);

			RSAerr(RSA_F_RSA_CHECK_KEY,

				RSA_R_DMQ1_NOT_CONGRUENT_TO_D);

			}

	

		/* iqmp = q^-1 mod p? */

	if(!BN_mod_inverse(i, key->q, key->p, ctx)) { ret = -1; goto err; }



	if (BN_cmp(i, key->iqmp) != 0)

		if(!BN_mod_inverse(i, key->q, key->p, ctx))

			{

		ret = 0;

		RSAerr(RSA_F_RSA_CHECK_KEY, RSA_R_IQMP_NOT_INVERSE_OF_Q);

			ret = -1;

			goto err;

			}



	/* d*e = 1  mod lcm(p-1,q-1)? */



	r = BN_sub(i, key->p, BN_value_one());

	if (!r) { ret = -1; goto err; }

	r = BN_sub(j, key->q, BN_value_one());

	if (!r) { ret = -1; goto err; }



	/* now compute k = lcm(i,j) */

	r = BN_mul(l, i, j, ctx);

	if (!r) { ret = -1; goto err; }

	r = BN_gcd(m, i, j, ctx);

	if (!r) { ret = -1; goto err; }

	r = BN_div(k, NULL, l, m, ctx); /* remainder is 0 */

	if (!r) { ret = -1; goto err; }



	r = BN_mod_mul(i, key->d, key->e, k, ctx);

	if (!r) { ret = -1; goto err; }



	if (!BN_is_one(i))

		if (BN_cmp(i, key->iqmp) != 0)

			{

			ret = 0;

		RSAerr(RSA_F_RSA_CHECK_KEY, RSA_R_D_E_NOT_CONGRUENT_TO_1);

			RSAerr(RSA_F_RSA_CHECK_KEY,

				RSA_R_IQMP_NOT_INVERSE_OF_Q);

			}

		}



 err: