1 /* crypto/dsa/dsa_gen.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59 #undef GENUINE_DSA
60
61 #ifdef GENUINE_DSA
62 /*
63 * Parameter generation follows the original release of FIPS PUB 186,
64 * Appendix 2.2 (i.e. use SHA as defined in FIPS PUB 180)
65 */
66 # define HASH EVP_sha()
67 #else
68 /*
69 * Parameter generation follows the updated Appendix 2.2 for FIPS PUB 186,
70 * also Appendix 2.2 of FIPS PUB 186-1 (i.e. use SHA as defined in FIPS PUB
71 * 180-1)
72 */
73 # define HASH EVP_sha1()
74 #endif
75
76 #include <openssl/opensslconf.h> /* To see if OPENSSL_NO_SHA is defined */
77
78 #ifndef OPENSSL_NO_SHA
79
80 # include <stdio.h>
81 # include "cryptlib.h"
82 # include <openssl/evp.h>
83 # include <openssl/bn.h>
84 # include <openssl/rand.h>
85 # include <openssl/sha.h>
86 # include "dsa_locl.h"
87
88 # ifdef OPENSSL_FIPS
89 /* Workaround bug in prototype */
90 # define fips_dsa_builtin_paramgen2 fips_dsa_paramgen_bad
91 # include <openssl/fips.h>
92 # endif
93
DSA_generate_parameters_ex(DSA * ret,int bits,const unsigned char * seed_in,int seed_len,int * counter_ret,unsigned long * h_ret,BN_GENCB * cb)94 int DSA_generate_parameters_ex(DSA *ret, int bits,
95 const unsigned char *seed_in, int seed_len,
96 int *counter_ret, unsigned long *h_ret,
97 BN_GENCB *cb)
98 {
99 # ifdef OPENSSL_FIPS
100 if (FIPS_mode() && !(ret->meth->flags & DSA_FLAG_FIPS_METHOD)
101 && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW)) {
102 DSAerr(DSA_F_DSA_GENERATE_PARAMETERS_EX, DSA_R_NON_FIPS_DSA_METHOD);
103 return 0;
104 }
105 # endif
106 if (ret->meth->dsa_paramgen)
107 return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
108 counter_ret, h_ret, cb);
109 # ifdef OPENSSL_FIPS
110 else if (FIPS_mode()) {
111 return FIPS_dsa_generate_parameters_ex(ret, bits,
112 seed_in, seed_len,
113 counter_ret, h_ret, cb);
114 }
115 # endif
116 else {
117 const EVP_MD *evpmd = bits >= 2048 ? EVP_sha256() : EVP_sha1();
118 size_t qbits = EVP_MD_size(evpmd) * 8;
119
120 return dsa_builtin_paramgen(ret, bits, qbits, evpmd,
121 seed_in, seed_len, NULL, counter_ret,
122 h_ret, cb);
123 }
124 }
125
dsa_builtin_paramgen(DSA * ret,size_t bits,size_t qbits,const EVP_MD * evpmd,const unsigned char * seed_in,size_t seed_len,unsigned char * seed_out,int * counter_ret,unsigned long * h_ret,BN_GENCB * cb)126 int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
127 const EVP_MD *evpmd, const unsigned char *seed_in,
128 size_t seed_len, unsigned char *seed_out,
129 int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
130 {
131 int ok = 0;
132 unsigned char seed[SHA256_DIGEST_LENGTH];
133 unsigned char md[SHA256_DIGEST_LENGTH];
134 unsigned char buf[SHA256_DIGEST_LENGTH], buf2[SHA256_DIGEST_LENGTH];
135 BIGNUM *r0, *W, *X, *c, *test;
136 BIGNUM *g = NULL, *q = NULL, *p = NULL;
137 BN_MONT_CTX *mont = NULL;
138 int i, k, n = 0, m = 0, qsize = qbits >> 3;
139 int counter = 0;
140 int r = 0;
141 BN_CTX *ctx = NULL;
142 unsigned int h = 2;
143
144 if (qsize != SHA_DIGEST_LENGTH && qsize != SHA224_DIGEST_LENGTH &&
145 qsize != SHA256_DIGEST_LENGTH)
146 /* invalid q size */
147 return 0;
148
149 if (evpmd == NULL)
150 /* use SHA1 as default */
151 evpmd = EVP_sha1();
152
153 if (bits < 512)
154 bits = 512;
155
156 bits = (bits + 63) / 64 * 64;
157
158 /*
159 * NB: seed_len == 0 is special case: copy generated seed to seed_in if
160 * it is not NULL.
161 */
162 if (seed_len && (seed_len < (size_t)qsize))
163 seed_in = NULL; /* seed buffer too small -- ignore */
164 if (seed_len > (size_t)qsize)
165 seed_len = qsize; /* App. 2.2 of FIPS PUB 186 allows larger
166 * SEED, but our internal buffers are
167 * restricted to 160 bits */
168 if (seed_in != NULL)
169 memcpy(seed, seed_in, seed_len);
170
171 if ((mont = BN_MONT_CTX_new()) == NULL)
172 goto err;
173
174 if ((ctx = BN_CTX_new()) == NULL)
175 goto err;
176
177 BN_CTX_start(ctx);
178
179 r0 = BN_CTX_get(ctx);
180 g = BN_CTX_get(ctx);
181 W = BN_CTX_get(ctx);
182 q = BN_CTX_get(ctx);
183 X = BN_CTX_get(ctx);
184 c = BN_CTX_get(ctx);
185 p = BN_CTX_get(ctx);
186 test = BN_CTX_get(ctx);
187
188 if (!BN_lshift(test, BN_value_one(), bits - 1))
189 goto err;
190
191 for (;;) {
192 for (;;) { /* find q */
193 int seed_is_random;
194
195 /* step 1 */
196 if (!BN_GENCB_call(cb, 0, m++))
197 goto err;
198
199 if (!seed_len || !seed_in) {
200 if (RAND_pseudo_bytes(seed, qsize) < 0)
201 goto err;
202 seed_is_random = 1;
203 } else {
204 seed_is_random = 0;
205 seed_len = 0; /* use random seed if 'seed_in' turns out to
206 * be bad */
207 }
208 memcpy(buf, seed, qsize);
209 memcpy(buf2, seed, qsize);
210 /* precompute "SEED + 1" for step 7: */
211 for (i = qsize - 1; i >= 0; i--) {
212 buf[i]++;
213 if (buf[i] != 0)
214 break;
215 }
216
217 /* step 2 */
218 if (!EVP_Digest(seed, qsize, md, NULL, evpmd, NULL))
219 goto err;
220 if (!EVP_Digest(buf, qsize, buf2, NULL, evpmd, NULL))
221 goto err;
222 for (i = 0; i < qsize; i++)
223 md[i] ^= buf2[i];
224
225 /* step 3 */
226 md[0] |= 0x80;
227 md[qsize - 1] |= 0x01;
228 if (!BN_bin2bn(md, qsize, q))
229 goto err;
230
231 /* step 4 */
232 r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx,
233 seed_is_random, cb);
234 if (r > 0)
235 break;
236 if (r != 0)
237 goto err;
238
239 /* do a callback call */
240 /* step 5 */
241 }
242
243 if (!BN_GENCB_call(cb, 2, 0))
244 goto err;
245 if (!BN_GENCB_call(cb, 3, 0))
246 goto err;
247
248 /* step 6 */
249 counter = 0;
250 /* "offset = 2" */
251
252 n = (bits - 1) / 160;
253
254 for (;;) {
255 if ((counter != 0) && !BN_GENCB_call(cb, 0, counter))
256 goto err;
257
258 /* step 7 */
259 BN_zero(W);
260 /* now 'buf' contains "SEED + offset - 1" */
261 for (k = 0; k <= n; k++) {
262 /*
263 * obtain "SEED + offset + k" by incrementing:
264 */
265 for (i = qsize - 1; i >= 0; i--) {
266 buf[i]++;
267 if (buf[i] != 0)
268 break;
269 }
270
271 if (!EVP_Digest(buf, qsize, md, NULL, evpmd, NULL))
272 goto err;
273
274 /* step 8 */
275 if (!BN_bin2bn(md, qsize, r0))
276 goto err;
277 if (!BN_lshift(r0, r0, (qsize << 3) * k))
278 goto err;
279 if (!BN_add(W, W, r0))
280 goto err;
281 }
282
283 /* more of step 8 */
284 if (!BN_mask_bits(W, bits - 1))
285 goto err;
286 if (!BN_copy(X, W))
287 goto err;
288 if (!BN_add(X, X, test))
289 goto err;
290
291 /* step 9 */
292 if (!BN_lshift1(r0, q))
293 goto err;
294 if (!BN_mod(c, X, r0, ctx))
295 goto err;
296 if (!BN_sub(r0, c, BN_value_one()))
297 goto err;
298 if (!BN_sub(p, X, r0))
299 goto err;
300
301 /* step 10 */
302 if (BN_cmp(p, test) >= 0) {
303 /* step 11 */
304 r = BN_is_prime_fasttest_ex(p, DSS_prime_checks, ctx, 1, cb);
305 if (r > 0)
306 goto end; /* found it */
307 if (r != 0)
308 goto err;
309 }
310
311 /* step 13 */
312 counter++;
313 /* "offset = offset + n + 1" */
314
315 /* step 14 */
316 if (counter >= 4096)
317 break;
318 }
319 }
320 end:
321 if (!BN_GENCB_call(cb, 2, 1))
322 goto err;
323
324 /* We now need to generate g */
325 /* Set r0=(p-1)/q */
326 if (!BN_sub(test, p, BN_value_one()))
327 goto err;
328 if (!BN_div(r0, NULL, test, q, ctx))
329 goto err;
330
331 if (!BN_set_word(test, h))
332 goto err;
333 if (!BN_MONT_CTX_set(mont, p, ctx))
334 goto err;
335
336 for (;;) {
337 /* g=test^r0%p */
338 if (!BN_mod_exp_mont(g, test, r0, p, ctx, mont))
339 goto err;
340 if (!BN_is_one(g))
341 break;
342 if (!BN_add(test, test, BN_value_one()))
343 goto err;
344 h++;
345 }
346
347 if (!BN_GENCB_call(cb, 3, 1))
348 goto err;
349
350 ok = 1;
351 err:
352 if (ok) {
353 if (ret->p)
354 BN_free(ret->p);
355 if (ret->q)
356 BN_free(ret->q);
357 if (ret->g)
358 BN_free(ret->g);
359 ret->p = BN_dup(p);
360 ret->q = BN_dup(q);
361 ret->g = BN_dup(g);
362 if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
363 ok = 0;
364 goto err;
365 }
366 if (counter_ret != NULL)
367 *counter_ret = counter;
368 if (h_ret != NULL)
369 *h_ret = h;
370 if (seed_out)
371 memcpy(seed_out, seed, qsize);
372 }
373 if (ctx) {
374 BN_CTX_end(ctx);
375 BN_CTX_free(ctx);
376 }
377 if (mont != NULL)
378 BN_MONT_CTX_free(mont);
379 return ok;
380 }
381
382 # ifdef OPENSSL_FIPS
383 # undef fips_dsa_builtin_paramgen2
384 extern int fips_dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
385 const EVP_MD *evpmd,
386 const unsigned char *seed_in,
387 size_t seed_len, int idx,
388 unsigned char *seed_out,
389 int *counter_ret, unsigned long *h_ret,
390 BN_GENCB *cb);
391 # endif
392
393 /*
394 * This is a parameter generation algorithm for the DSA2 algorithm as
395 * described in FIPS 186-3.
396 */
397
dsa_builtin_paramgen2(DSA * ret,size_t L,size_t N,const EVP_MD * evpmd,const unsigned char * seed_in,size_t seed_len,int idx,unsigned char * seed_out,int * counter_ret,unsigned long * h_ret,BN_GENCB * cb)398 int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
399 const EVP_MD *evpmd, const unsigned char *seed_in,
400 size_t seed_len, int idx, unsigned char *seed_out,
401 int *counter_ret, unsigned long *h_ret,
402 BN_GENCB *cb)
403 {
404 int ok = -1;
405 unsigned char *seed = NULL, *seed_tmp = NULL;
406 unsigned char md[EVP_MAX_MD_SIZE];
407 int mdsize;
408 BIGNUM *r0, *W, *X, *c, *test;
409 BIGNUM *g = NULL, *q = NULL, *p = NULL;
410 BN_MONT_CTX *mont = NULL;
411 int i, k, n = 0, m = 0, qsize = N >> 3;
412 int counter = 0;
413 int r = 0;
414 BN_CTX *ctx = NULL;
415 EVP_MD_CTX mctx;
416 unsigned int h = 2;
417
418 # ifdef OPENSSL_FIPS
419
420 if (FIPS_mode())
421 return fips_dsa_builtin_paramgen2(ret, L, N, evpmd,
422 seed_in, seed_len, idx,
423 seed_out, counter_ret, h_ret, cb);
424 # endif
425
426 EVP_MD_CTX_init(&mctx);
427
428 if (evpmd == NULL) {
429 if (N == 160)
430 evpmd = EVP_sha1();
431 else if (N == 224)
432 evpmd = EVP_sha224();
433 else
434 evpmd = EVP_sha256();
435 }
436
437 mdsize = EVP_MD_size(evpmd);
438 /* If unverificable g generation only don't need seed */
439 if (!ret->p || !ret->q || idx >= 0) {
440 if (seed_len == 0)
441 seed_len = mdsize;
442
443 seed = OPENSSL_malloc(seed_len);
444
445 if (seed_out)
446 seed_tmp = seed_out;
447 else
448 seed_tmp = OPENSSL_malloc(seed_len);
449
450 if (!seed || !seed_tmp)
451 goto err;
452
453 if (seed_in)
454 memcpy(seed, seed_in, seed_len);
455
456 }
457
458 if ((ctx = BN_CTX_new()) == NULL)
459 goto err;
460
461 if ((mont = BN_MONT_CTX_new()) == NULL)
462 goto err;
463
464 BN_CTX_start(ctx);
465 r0 = BN_CTX_get(ctx);
466 g = BN_CTX_get(ctx);
467 W = BN_CTX_get(ctx);
468 X = BN_CTX_get(ctx);
469 c = BN_CTX_get(ctx);
470 test = BN_CTX_get(ctx);
471
472 /* if p, q already supplied generate g only */
473 if (ret->p && ret->q) {
474 p = ret->p;
475 q = ret->q;
476 if (idx >= 0)
477 memcpy(seed_tmp, seed, seed_len);
478 goto g_only;
479 } else {
480 p = BN_CTX_get(ctx);
481 q = BN_CTX_get(ctx);
482 }
483
484 if (!BN_lshift(test, BN_value_one(), L - 1))
485 goto err;
486 for (;;) {
487 for (;;) { /* find q */
488 unsigned char *pmd;
489 /* step 1 */
490 if (!BN_GENCB_call(cb, 0, m++))
491 goto err;
492
493 if (!seed_in) {
494 if (RAND_pseudo_bytes(seed, seed_len) < 0)
495 goto err;
496 }
497 /* step 2 */
498 if (!EVP_Digest(seed, seed_len, md, NULL, evpmd, NULL))
499 goto err;
500 /* Take least significant bits of md */
501 if (mdsize > qsize)
502 pmd = md + mdsize - qsize;
503 else
504 pmd = md;
505
506 if (mdsize < qsize)
507 memset(md + mdsize, 0, qsize - mdsize);
508
509 /* step 3 */
510 pmd[0] |= 0x80;
511 pmd[qsize - 1] |= 0x01;
512 if (!BN_bin2bn(pmd, qsize, q))
513 goto err;
514
515 /* step 4 */
516 r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx,
517 seed_in ? 1 : 0, cb);
518 if (r > 0)
519 break;
520 if (r != 0)
521 goto err;
522 /* Provided seed didn't produce a prime: error */
523 if (seed_in) {
524 ok = 0;
525 DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_Q_NOT_PRIME);
526 goto err;
527 }
528
529 /* do a callback call */
530 /* step 5 */
531 }
532 /* Copy seed to seed_out before we mess with it */
533 if (seed_out)
534 memcpy(seed_out, seed, seed_len);
535
536 if (!BN_GENCB_call(cb, 2, 0))
537 goto err;
538 if (!BN_GENCB_call(cb, 3, 0))
539 goto err;
540
541 /* step 6 */
542 counter = 0;
543 /* "offset = 1" */
544
545 n = (L - 1) / (mdsize << 3);
546
547 for (;;) {
548 if ((counter != 0) && !BN_GENCB_call(cb, 0, counter))
549 goto err;
550
551 /* step 7 */
552 BN_zero(W);
553 /* now 'buf' contains "SEED + offset - 1" */
554 for (k = 0; k <= n; k++) {
555 /*
556 * obtain "SEED + offset + k" by incrementing:
557 */
558 for (i = seed_len - 1; i >= 0; i--) {
559 seed[i]++;
560 if (seed[i] != 0)
561 break;
562 }
563
564 if (!EVP_Digest(seed, seed_len, md, NULL, evpmd, NULL))
565 goto err;
566
567 /* step 8 */
568 if (!BN_bin2bn(md, mdsize, r0))
569 goto err;
570 if (!BN_lshift(r0, r0, (mdsize << 3) * k))
571 goto err;
572 if (!BN_add(W, W, r0))
573 goto err;
574 }
575
576 /* more of step 8 */
577 if (!BN_mask_bits(W, L - 1))
578 goto err;
579 if (!BN_copy(X, W))
580 goto err;
581 if (!BN_add(X, X, test))
582 goto err;
583
584 /* step 9 */
585 if (!BN_lshift1(r0, q))
586 goto err;
587 if (!BN_mod(c, X, r0, ctx))
588 goto err;
589 if (!BN_sub(r0, c, BN_value_one()))
590 goto err;
591 if (!BN_sub(p, X, r0))
592 goto err;
593
594 /* step 10 */
595 if (BN_cmp(p, test) >= 0) {
596 /* step 11 */
597 r = BN_is_prime_fasttest_ex(p, DSS_prime_checks, ctx, 1, cb);
598 if (r > 0)
599 goto end; /* found it */
600 if (r != 0)
601 goto err;
602 }
603
604 /* step 13 */
605 counter++;
606 /* "offset = offset + n + 1" */
607
608 /* step 14 */
609 if (counter >= (int)(4 * L))
610 break;
611 }
612 if (seed_in) {
613 ok = 0;
614 DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN2, DSA_R_INVALID_PARAMETERS);
615 goto err;
616 }
617 }
618 end:
619 if (!BN_GENCB_call(cb, 2, 1))
620 goto err;
621
622 g_only:
623
624 /* We now need to generate g */
625 /* Set r0=(p-1)/q */
626 if (!BN_sub(test, p, BN_value_one()))
627 goto err;
628 if (!BN_div(r0, NULL, test, q, ctx))
629 goto err;
630
631 if (idx < 0) {
632 if (!BN_set_word(test, h))
633 goto err;
634 } else
635 h = 1;
636 if (!BN_MONT_CTX_set(mont, p, ctx))
637 goto err;
638
639 for (;;) {
640 static const unsigned char ggen[4] = { 0x67, 0x67, 0x65, 0x6e };
641 if (idx >= 0) {
642 md[0] = idx & 0xff;
643 md[1] = (h >> 8) & 0xff;
644 md[2] = h & 0xff;
645 if (!EVP_DigestInit_ex(&mctx, evpmd, NULL))
646 goto err;
647 if (!EVP_DigestUpdate(&mctx, seed_tmp, seed_len))
648 goto err;
649 if (!EVP_DigestUpdate(&mctx, ggen, sizeof(ggen)))
650 goto err;
651 if (!EVP_DigestUpdate(&mctx, md, 3))
652 goto err;
653 if (!EVP_DigestFinal_ex(&mctx, md, NULL))
654 goto err;
655 if (!BN_bin2bn(md, mdsize, test))
656 goto err;
657 }
658 /* g=test^r0%p */
659 if (!BN_mod_exp_mont(g, test, r0, p, ctx, mont))
660 goto err;
661 if (!BN_is_one(g))
662 break;
663 if (idx < 0 && !BN_add(test, test, BN_value_one()))
664 goto err;
665 h++;
666 if (idx >= 0 && h > 0xffff)
667 goto err;
668 }
669
670 if (!BN_GENCB_call(cb, 3, 1))
671 goto err;
672
673 ok = 1;
674 err:
675 if (ok == 1) {
676 if (p != ret->p) {
677 if (ret->p)
678 BN_free(ret->p);
679 ret->p = BN_dup(p);
680 }
681 if (q != ret->q) {
682 if (ret->q)
683 BN_free(ret->q);
684 ret->q = BN_dup(q);
685 }
686 if (ret->g)
687 BN_free(ret->g);
688 ret->g = BN_dup(g);
689 if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
690 ok = -1;
691 goto err;
692 }
693 if (counter_ret != NULL)
694 *counter_ret = counter;
695 if (h_ret != NULL)
696 *h_ret = h;
697 }
698 if (seed)
699 OPENSSL_free(seed);
700 if (seed_out != seed_tmp)
701 OPENSSL_free(seed_tmp);
702 if (ctx) {
703 BN_CTX_end(ctx);
704 BN_CTX_free(ctx);
705 }
706 if (mont != NULL)
707 BN_MONT_CTX_free(mont);
708 EVP_MD_CTX_cleanup(&mctx);
709 return ok;
710 }
711
dsa_paramgen_check_g(DSA * dsa)712 int dsa_paramgen_check_g(DSA *dsa)
713 {
714 BN_CTX *ctx;
715 BIGNUM *tmp;
716 BN_MONT_CTX *mont = NULL;
717 int rv = -1;
718 ctx = BN_CTX_new();
719 if (!ctx)
720 return -1;
721 BN_CTX_start(ctx);
722 if (BN_cmp(dsa->g, BN_value_one()) <= 0)
723 return 0;
724 if (BN_cmp(dsa->g, dsa->p) >= 0)
725 return 0;
726 tmp = BN_CTX_get(ctx);
727 if (!tmp)
728 goto err;
729 if ((mont = BN_MONT_CTX_new()) == NULL)
730 goto err;
731 if (!BN_MONT_CTX_set(mont, dsa->p, ctx))
732 goto err;
733 /* Work out g^q mod p */
734 if (!BN_mod_exp_mont(tmp, dsa->g, dsa->q, dsa->p, ctx, mont))
735 goto err;
736 if (!BN_cmp(tmp, BN_value_one()))
737 rv = 1;
738 else
739 rv = 0;
740 err:
741 BN_CTX_end(ctx);
742 if (mont)
743 BN_MONT_CTX_free(mont);
744 BN_CTX_free(ctx);
745 return rv;
746
747 }
748 #endif
749