def check_integrity(self, msg=12345678987654321): # Assert gcd(e, phi(n)) == 1 phi_n = (self.p - 1) * (self.q - 1) gcd = NumberTheory.gcd(phi_n, self.e) if gcd != 1: raise KeyCorruptException( "Expected gcd(phi(n), e) to be 1, but was %d." % (gcd)) # Truncate msg if too large for exponent msg = msg % self.n # Calculate normale signature and verify sig = pow(msg, self.d, self.n) verify = pow(sig, self.e, self.n) if verify != msg: raise KeyCorruptException("Expected verify value %d, but got %d." % (msg, verify)) # Test that RSA-CRT constants work m1 = pow(msg, self.dmp1, self.p) m2 = pow(msg, self.dmq1, self.q) sig_crt = (((self.iqmp * (m1 - m2)) % self.p) * self.q) + m2 if sig != sig_crt: raise KeyCorruptException( "Expected same signature for naive signature as RSA-CRT signature, but former was 0x%x and latter 0x%x." % (sig, sig_crt))
def test_gcd_n_phi_n(self): with tempfile.TemporaryDirectory() as tempdir, WorkDir(tempdir): PrimeDB().add(0x1fd22b50d1e28365855635, 0x3af25062dcf148b85084f5).write() output = self._run_x509sak( ["genbrokenrsa", "--bitlen", "257", "--gcd-n-phi-n", "-v"]).stdout key = RSAPrivateKey.read_pemfile("broken_rsa.key")[0] self.assertEqual(key.n.bit_length(), 257) self.assertEqual(key.p, 0x1fd22b50d1e28365855635) self.assertEqual(key.q, 0xea778f672d05715314fd556a2667dca7743e33da973) self.assertEqual((key.q - 1) % (2 * key.p), 0) self.assertNotEqual(NumberTheory.gcd(key.n, key.phi_n), 1) self.assertEqual(key.e, 0x10001) self.assertIn(b"gcd(n, phi(n)) = p", output) key.check_integrity()
def create(cls, p, q, e=0x10001, swap_e_d=False, valid_only=True, carmichael_totient=False): n = p * q if not carmichael_totient: totient = (p - 1) * (q - 1) else: totient = NumberTheory.lcm(p - 1, q - 1) gcd = NumberTheory.gcd(e, totient) if (gcd != 1) and valid_only: raise KeyCorruptException( "e = 0x%x isnt't relative prime to totient, gcd = 0x%x. Either accept broken keys or fix e." % (e, gcd)) d = NumberTheory.modinv(e, totient) if swap_e_d: (e, d) = (d, e) dmp1 = d % (p - 1) dmq1 = d % (q - 1) iqmp = NumberTheory.modinv(q, p) asn1 = cls._ASN1_MODEL() asn1["version"] = 0 asn1["modulus"] = n asn1["publicExponent"] = e asn1["privateExponent"] = d asn1["prime1"] = p asn1["prime2"] = q asn1["exponent1"] = dmp1 asn1["exponent2"] = dmq1 asn1["coefficient"] = iqmp der = pyasn1.codec.der.encoder.encode(asn1) return cls(der)
def __init__(self, cmdname, args): BaseAction.__init__(self, cmdname, args) if (not self._args.force) and os.path.exists(self._args.outfile): raise UnfulfilledPrerequisitesException( "File/directory %s already exists. Remove it first or use --force." % (self._args.outfile)) if not self._args.gcd_n_phi_n: self._primetype = "2msb" self._p_bitlen = self._args.bitlen // 2 self._q_bitlen = self._args.bitlen - self._p_bitlen else: self._primetype = "3msb" self._p_bitlen = self._args.bitlen // 3 self._q_bitlen = self._args.bitlen - (2 * self._p_bitlen) - 1 if (self._args.close_q) and (self._p_bitlen != self._q_bitlen): raise UnfulfilledPrerequisitesException( "Generating a close-q keypair with a %d modulus does't work, because p would have to be %d bit and q %d bit. Choose an even modulus bitlength." % (self._args.bitlen, self._p_bitlen, self._q_bitlen)) if self._args.q_stepping < 1: raise InvalidInputException( "q-stepping value must be greater or equal to 1, was %d." % (self._args.q_stepping)) self._log.debug("Selecting %s primes with p = %d bit and q = %d bit.", self._primetype, self._p_bitlen, self._q_bitlen) self._prime_db = PrimeDB(self._args.prime_db, generator_program=self._args.generator) p = None q = None while True: if p is None: p = self._prime_db.get(bitlen=self._p_bitlen, primetype=self._primetype) q_generator = self._select_q(p) if q is None: q = next(q_generator) if self._args.gcd_n_phi_n: # q = (2 * r * p) + 1 r = q q = 2 * r * p + 1 if not NumberTheory.is_probable_prime(q): q = None continue # Always make p the smaller factor if p > q: (p, q) = (q, p) n = p * q if self._args.public_exponent == -1: e = random.randint(2, n - 1) else: e = self._args.public_exponent if self._args.carmichael_totient: totient = NumberTheory.lcm(p - 1, q - 1) else: totient = (p - 1) * (q - 1) gcd = NumberTheory.gcd(totient, e) if self._args.accept_unusable_key or (gcd == 1): break else: # Pair (phi(n), e) wasn't acceptable. self._log.debug("gcd(totient, e) was %d, retrying.", gcd) if self._args.public_exponent != -1: # Public exponent e is fixed, need to choose another q. if p.bit_length() == q.bit_length(): # Can re-use q as next p (p, q) = (q, None) q_generator = self._select_q(p) else: # When they differ in length, need to re-choose both values (p, q) = (None, None) rsa_keypair = RSAPrivateKey.create( p=p, q=q, e=e, swap_e_d=self._args.switch_e_d, valid_only=not self._args.accept_unusable_key, carmichael_totient=self._args.carmichael_totient) rsa_keypair.write_pemfile(self._args.outfile) if self._args.verbose >= 1: diff = q - p print("Generated %d bit RSA key:" % (rsa_keypair.n.bit_length())) print("p = 0x%x" % (rsa_keypair.p)) if not self._args.gcd_n_phi_n: print("q = 0x%x" % (rsa_keypair.q)) else: print("q = 2 * r * p + 1 = 0x%x" % (rsa_keypair.q)) print("r = 0x%x" % (r)) print("phi(n) = 0x%x" % (rsa_keypair.phi_n)) print("lambda(n) = 0x%x" % (rsa_keypair.lambda_n)) print("phi(n) / lambda(n) = gcd(p - 1, q - 1) = %d" % (rsa_keypair.phi_n // rsa_keypair.lambda_n)) gcd_n_phin = NumberTheory.gcd(rsa_keypair.n, rsa_keypair.phi_n) if gcd_n_phin == rsa_keypair.p: print("gcd(n, phi(n)) = p") else: print("gcd(n, phi(n)) = 0x%x" % (gcd_n_phin)) if self._args.close_q: print("q - p = %d (%d bit)" % (diff, diff.bit_length())) print("n = 0x%x" % (rsa_keypair.n)) print("d = 0x%x" % (rsa_keypair.d)) print("e = 0x%x" % (rsa_keypair.e))