public RsaPrivateCrtKeyParameters(
BigInteger modulus,
BigInteger publicExponent,
BigInteger privateExponent,
BigInteger p,
BigInteger q,
BigInteger dP,
BigInteger dQ,
BigInteger qInv)
: base(true, modulus, privateExponent)
{
ValidateValue(publicExponent, "publicExponent", "exponent");
ValidateValue(p, "p", "P value");
ValidateValue(q, "q", "Q value");
ValidateValue(dP, "dP", "DP value");
ValidateValue(dQ, "dQ", "DQ value");
ValidateValue(qInv, "qInv", "InverseQ value");
this.e = publicExponent;
this.p = p;
this.q = q;
this.dP = dP;
this.dQ = dQ;
this.qInv = qInv;
}
public DerInteger(
BigInteger value)
{
if (value == null)
throw new ArgumentNullException("value");
bytes = value.ToByteArray();
}
private RsaPublicKeyStructure(
Asn1Sequence seq)
{
if (seq.Count != 2)
throw new ArgumentException("Bad sequence size: " + seq.Count);
// Note: we are accepting technically incorrect (i.e. negative) values here
modulus = DerInteger.GetInstance(seq[0]).PositiveValue;
publicExponent = DerInteger.GetInstance(seq[1]).PositiveValue;
}
public RsaPublicKeyStructure(
BigInteger modulus,
BigInteger publicExponent)
{
if (modulus == null)
throw new ArgumentNullException("modulus");
if (publicExponent == null)
throw new ArgumentNullException("publicExponent");
if (modulus.SignValue <= 0)
throw new ArgumentException("Not a valid RSA modulus", "modulus");
if (publicExponent.SignValue <= 0)
throw new ArgumentException("Not a valid RSA public exponent", "publicExponent");
this.modulus = modulus;
this.publicExponent = publicExponent;
}
public RsaPrivateKeyStructure(
Asn1Sequence seq)
{
BigInteger version = ((DerInteger) seq[0]).Value;
if (version.IntValue != 0)
throw new ArgumentException("wrong version for RSA private key");
modulus = ((DerInteger) seq[1]).Value;
publicExponent = ((DerInteger) seq[2]).Value;
privateExponent = ((DerInteger) seq[3]).Value;
prime1 = ((DerInteger) seq[4]).Value;
prime2 = ((DerInteger) seq[5]).Value;
exponent1 = ((DerInteger) seq[6]).Value;
exponent2 = ((DerInteger) seq[7]).Value;
coefficient = ((DerInteger) seq[8]).Value;
}
public BigInteger ConvertInput(
byte[] inBuf,
int inOff,
int inLen)
{
int maxLength = (bitSize + 7) / 8;
if (inLen > maxLength)
throw new DataLengthException("input too large for RSA cipher.");
BigInteger input = new BigInteger(1, inBuf, inOff, inLen);
if (input.CompareTo(key.Modulus) >= 0)
throw new DataLengthException("input too large for RSA cipher.");
return input;
}
public RsaKeyParameters(
bool isPrivate,
BigInteger modulus,
BigInteger exponent)
: base(isPrivate)
{
if (modulus == null)
throw new ArgumentNullException("modulus");
if (exponent == null)
throw new ArgumentNullException("exponent");
if (modulus.SignValue <= 0)
throw new ArgumentException("Not a valid RSA modulus", "modulus");
if (exponent.SignValue <= 0)
throw new ArgumentException("Not a valid RSA exponent", "exponent");
this.modulus = modulus;
this.exponent = exponent;
}
public RsaPrivateKeyStructure(
BigInteger modulus,
BigInteger publicExponent,
BigInteger privateExponent,
BigInteger prime1,
BigInteger prime2,
BigInteger exponent1,
BigInteger exponent2,
BigInteger coefficient)
{
this.modulus = modulus;
this.publicExponent = publicExponent;
this.privateExponent = privateExponent;
this.prime1 = prime1;
this.prime2 = prime2;
this.exponent1 = exponent1;
this.exponent2 = exponent2;
this.coefficient = coefficient;
}
public byte[] ConvertOutput(
BigInteger result)
{
byte[] output = result.ToByteArrayUnsigned();
if (forEncryption)
{
int outSize = GetOutputBlockSize();
// TODO To avoid this, create version of BigInteger.ToByteArray that
// writes to an existing array
if (output.Length < outSize) // have ended up with less bytes than normal, lengthen
{
byte[] tmp = new byte[outSize];
output.CopyTo(tmp, tmp.Length - output.Length);
output = tmp;
}
}
return output;
}
public BigInteger Mod(
BigInteger m)
{
if (m.sign < 1)
throw new ArithmeticException("Modulus must be positive");
BigInteger biggie = Remainder(m);
return (biggie.sign >= 0 ? biggie : biggie.Add(m));
}
public BigInteger Min(
BigInteger value)
{
return CompareTo(value) < 0 ? this : value;
}
/**
* Calculate the numbers u1, u2, and u3 such that:
*
* u1 * a + u2 * b = u3
*
* where u3 is the greatest common divider of a and b.
* a and b using the extended Euclid algorithm (refer p. 323
* of The Art of Computer Programming vol 2, 2nd ed).
* This also seems to have the side effect of calculating
* some form of multiplicative inverse.
*
* @param a First number to calculate gcd for
* @param b Second number to calculate gcd for
* @param u1Out the return object for the u1 value
* @param u2Out the return object for the u2 value
* @return The greatest common divisor of a and b
*/
private static BigInteger ExtEuclid(
BigInteger a,
BigInteger b,
BigInteger u1Out,
BigInteger u2Out)
{
BigInteger u1 = One;
BigInteger u3 = a;
BigInteger v1 = Zero;
BigInteger v3 = b;
while (v3.sign > 0)
{
BigInteger[] q = u3.DivideAndRemainder(v3);
BigInteger tmp = v1.Multiply(q[0]);
BigInteger tn = u1.Subtract(tmp);
u1 = v1;
v1 = tn;
u3 = v3;
v3 = q[1];
}
if (u1Out != null)
{
u1Out.sign = u1.sign;
u1Out.magnitude = u1.magnitude;
}
if (u2Out != null)
{
BigInteger tmp = u1.Multiply(a);
tmp = u3.Subtract(tmp);
BigInteger res = tmp.Divide(b);
u2Out.sign = res.sign;
u2Out.magnitude = res.magnitude;
}
return u3;
}
public BigInteger ModInverse(
BigInteger m)
{
if (m.sign < 1)
throw new ArithmeticException("Modulus must be positive");
// TODO Too slow at the moment
// // "Fast Key Exchange with Elliptic Curve Systems" R.Schoeppel
// if (m.TestBit(0))
// {
// //The Almost Inverse Algorithm
// int k = 0;
// BigInteger B = One, C = Zero, F = this, G = m, tmp;
//
// for (;;)
// {
// // While F is even, do F=F/u, C=C*u, k=k+1.
// int zeroes = F.GetLowestSetBit();
// if (zeroes > 0)
// {
// F = F.ShiftRight(zeroes);
// C = C.ShiftLeft(zeroes);
// k += zeroes;
// }
//
// // If F = 1, then return B,k.
// if (F.Equals(One))
// {
// BigInteger half = m.Add(One).ShiftRight(1);
// BigInteger halfK = half.ModPow(BigInteger.ValueOf(k), m);
// return B.Multiply(halfK).Mod(m);
// }
//
// if (F.CompareTo(G) < 0)
// {
// tmp = G; G = F; F = tmp;
// tmp = B; B = C; C = tmp;
// }
//
// F = F.Add(G);
// B = B.Add(C);
// }
// }
BigInteger x = new BigInteger();
BigInteger gcd = ExtEuclid(this.Mod(m), m, x, null);
if (!gcd.Equals(One))
throw new ArithmeticException("Numbers not relatively prime.");
if (x.sign < 0)
{
x.sign = 1;
//x = m.Subtract(x);
x.magnitude = doSubBigLil(m.magnitude, x.magnitude);
}
return x;
}
private void WriteField(
Stream outputStream,
BigInteger fieldValue)
{
int byteCount = (fieldValue.BitLength + 6) / 7;
if (byteCount == 0)
{
outputStream.WriteByte(0);
}
else
{
BigInteger tmpValue = fieldValue;
byte[] tmp = new byte[byteCount];
for (int i = byteCount-1; i >= 0; i--)
{
tmp[i] = (byte) ((tmpValue.IntValue & 0x7f) | 0x80);
tmpValue = tmpValue.ShiftRight(7);
}
tmp[byteCount-1] &= 0x7f;
outputStream.Write(tmp, 0, tmp.Length);
}
}
private static void ValidateValue(BigInteger x, string name, string desc)
{
if (x == null)
throw new ArgumentNullException(name);
if (x.SignValue <= 0)
throw new ArgumentException("Not a valid RSA " + desc, name);
}
public int CompareTo(
BigInteger value)
{
return sign < value.sign ? -1
: sign > value.sign ? 1
: sign == 0 ? 0
: sign * CompareNoLeadingZeroes(0, magnitude, 0, value.magnitude);
}
public BigInteger ShiftLeft(
int n)
{
if (sign == 0 || magnitude.Length == 0)
return Zero;
if (n == 0)
return this;
if (n < 0)
return ShiftRight(-n);
BigInteger result = new BigInteger(sign, ShiftLeft(magnitude, n), true);
if (this.nBits != -1)
{
result.nBits = sign > 0
? this.nBits
: this.nBits + n;
}
if (this.nBitLength != -1)
{
result.nBitLength = this.nBitLength + n;
}
return result;
}
public BigInteger ModPow(
BigInteger exponent,
BigInteger m)
{
if (m.sign < 1)
throw new ArithmeticException("Modulus must be positive");
if (m.Equals(One))
return Zero;
if (exponent.sign == 0)
return One;
if (sign == 0)
return Zero;
int[] zVal = null;
int[] yAccum = null;
int[] yVal;
// Montgomery exponentiation is only possible if the modulus is odd,
// but AFAIK, this is always the case for crypto algo's
bool useMonty = ((m.magnitude[m.magnitude.Length - 1] & 1) == 1);
long mQ = 0;
if (useMonty)
{
mQ = m.GetMQuote();
// tmp = this * R mod m
BigInteger tmp = ShiftLeft(32 * m.magnitude.Length).Mod(m);
zVal = tmp.magnitude;
useMonty = (zVal.Length <= m.magnitude.Length);
if (useMonty)
{
yAccum = new int[m.magnitude.Length + 1];
if (zVal.Length < m.magnitude.Length)
{
int[] longZ = new int[m.magnitude.Length];
zVal.CopyTo(longZ, longZ.Length - zVal.Length);
zVal = longZ;
}
}
}
if (!useMonty)
{
if (magnitude.Length <= m.magnitude.Length)
{
//zAccum = new int[m.magnitude.Length * 2];
zVal = new int[m.magnitude.Length];
magnitude.CopyTo(zVal, zVal.Length - magnitude.Length);
}
else
{
//
// in normal practice we'll never see this...
//
BigInteger tmp = Remainder(m);
//zAccum = new int[m.magnitude.Length * 2];
zVal = new int[m.magnitude.Length];
tmp.magnitude.CopyTo(zVal, zVal.Length - tmp.magnitude.Length);
}
yAccum = new int[m.magnitude.Length * 2];
}
yVal = new int[m.magnitude.Length];
//
// from LSW to MSW
//
for (int i = 0; i < exponent.magnitude.Length; i++)
{
int v = exponent.magnitude[i];
int bits = 0;
if (i == 0)
{
while (v > 0)
{
v <<= 1;
bits++;
}
//
// first time in initialise y
//
zVal.CopyTo(yVal, 0);
v <<= 1;
bits++;
}
while (v != 0)
{
if (useMonty)
{
// Montgomery square algo doesn't exist, and a normal
// square followed by a Montgomery reduction proved to
// be almost as heavy as a Montgomery mulitply.
MultiplyMonty(yAccum, yVal, yVal, m.magnitude, mQ);
}
else
{
Square(yAccum, yVal);
Remainder(yAccum, m.magnitude);
Array.Copy(yAccum, yAccum.Length - yVal.Length, yVal, 0, yVal.Length);
ZeroOut(yAccum);
}
bits++;
if (v < 0)
{
if (useMonty)
{
MultiplyMonty(yAccum, yVal, zVal, m.magnitude, mQ);
}
else
{
Multiply(yAccum, yVal, zVal);
Remainder(yAccum, m.magnitude);
Array.Copy(yAccum, yAccum.Length - yVal.Length, yVal, 0,
yVal.Length);
ZeroOut(yAccum);
}
}
v <<= 1;
}
while (bits < 32)
{
if (useMonty)
{
MultiplyMonty(yAccum, yVal, yVal, m.magnitude, mQ);
}
else
{
Square(yAccum, yVal);
Remainder(yAccum, m.magnitude);
Array.Copy(yAccum, yAccum.Length - yVal.Length, yVal, 0, yVal.Length);
ZeroOut(yAccum);
}
bits++;
}
}
if (useMonty)
{
// Return y * R^(-1) mod m by doing y * 1 * R^(-1) mod m
ZeroOut(zVal);
zVal[zVal.Length - 1] = 1;
MultiplyMonty(yAccum, yVal, zVal, m.magnitude, mQ);
}
BigInteger result = new BigInteger(1, yVal, true);
return exponent.sign > 0
? result
: result.ModInverse(m);
}
internal bool RabinMillerTest(
int certainty,
Random random)
{
Debug.Assert(certainty > 0);
Debug.Assert(BitLength > 2);
Debug.Assert(TestBit(0));
// let n = 1 + d . 2^s
BigInteger n = this;
BigInteger nMinusOne = n.Subtract(One);
int s = nMinusOne.GetLowestSetBit();
BigInteger r = nMinusOne.ShiftRight(s);
Debug.Assert(s >= 1);
do
{
// TODO Make a method for random BigIntegers in range 0 < x < n)
// - Method can be optimized by only replacing examined bits at each trial
BigInteger a;
do
{
a = new BigInteger(n.BitLength, random);
}
while (a.CompareTo(One) <= 0 || a.CompareTo(nMinusOne) >= 0);
BigInteger y = a.ModPow(r, n);
if (!y.Equals(One))
{
int j = 0;
while (!y.Equals(nMinusOne))
{
if (++j == s)
return false;
y = y.ModPow(Two, n);
if (y.Equals(One))
return false;
}
}
certainty -= 2; // composites pass for only 1/4 possible 'a'
}
while (certainty > 0);
return true;
}
public BigInteger Multiply(
BigInteger val)
{
if (sign == 0 || val.sign == 0)
return Zero;
if (val.QuickPow2Check()) // val is power of two
{
BigInteger result = this.ShiftLeft(val.Abs().BitLength - 1);
return val.sign > 0 ? result : result.Negate();
}
if (this.QuickPow2Check()) // this is power of two
{
BigInteger result = val.ShiftLeft(this.Abs().BitLength - 1);
return this.sign > 0 ? result : result.Negate();
}
int resLength = (this.BitLength + val.BitLength) / BitsPerInt + 1;
int[] res = new int[resLength];
if (val == this)
{
Square(res, this.magnitude);
}
else
{
Multiply(res, this.magnitude, val.magnitude);
}
return new BigInteger(sign * val.sign, res, true);
}
private static BigInteger createUValueOf(
ulong value)
{
int msw = (int)(value >> 32);
int lsw = (int)value;
if (msw != 0)
return new BigInteger(1, new int[] { msw, lsw }, false);
if (lsw != 0)
{
BigInteger n = new BigInteger(1, new int[] { lsw }, false);
// Check for a power of two
if ((lsw & -lsw) == lsw)
{
n.nBits = 1;
}
return n;
}
return Zero;
}
public BigInteger Subtract(
BigInteger n)
{
if (n.sign == 0)
return this;
if (this.sign == 0)
return n.Negate();
if (this.sign != n.sign)
return Add(n.Negate());
int compare = CompareNoLeadingZeroes(0, magnitude, 0, n.magnitude);
if (compare == 0)
return Zero;
BigInteger bigun, lilun;
if (compare < 0)
{
bigun = n;
lilun = this;
}
else
{
bigun = this;
lilun = n;
}
return new BigInteger(this.sign * compare, doSubBigLil(bigun.magnitude, lilun.magnitude), true);
}
public BigInteger Max(
BigInteger value)
{
return CompareTo(value) > 0 ? this : value;
}
public DerEnumerated(
BigInteger val)
{
bytes = val.ToByteArray();
}
public BigInteger Add(
BigInteger value)
{
if (this.sign == 0)
return value;
if (this.sign != value.sign)
{
if (value.sign == 0)
return this;
if (value.sign < 0)
return Subtract(value.Negate());
return value.Subtract(Negate());
}
return AddToMagnitude(value.magnitude);
}
public BigInteger Remainder(
BigInteger n)
{
if (n.sign == 0)
throw new ArithmeticException("Division by zero error");
if (this.sign == 0)
return Zero;
// For small values, use fast remainder method
if (n.magnitude.Length == 1)
{
int val = n.magnitude[0];
if (val > 0)
{
if (val == 1)
return Zero;
// TODO Make this func work on uint, and handle val == 1?
int rem = Remainder(val);
return rem == 0
? Zero
: new BigInteger(sign, new int[]{ rem }, false);
}
}
if (CompareNoLeadingZeroes(0, magnitude, 0, n.magnitude) < 0)
return this;
int[] result;
if (n.QuickPow2Check()) // n is power of two
{
// TODO Move before small values branch above?
result = LastNBits(n.Abs().BitLength - 1);
}
else
{
result = (int[]) this.magnitude.Clone();
result = Remainder(result, n.magnitude);
}
return new BigInteger(sign, result, true);
}
public BigInteger ProcessBlock(
BigInteger input)
{
if (key is RsaPrivateCrtKeyParameters)
{
//
// we have the extra factors, use the Chinese Remainder Theorem - the author
// wishes to express his thanks to Dirk Bonekaemper at rtsffm.com for
// advice regarding the expression of this.
//
RsaPrivateCrtKeyParameters crtKey = (RsaPrivateCrtKeyParameters)key;
BigInteger p = crtKey.P;;
BigInteger q = crtKey.Q;
BigInteger dP = crtKey.DP;
BigInteger dQ = crtKey.DQ;
BigInteger qInv = crtKey.QInv;
BigInteger mP, mQ, h, m;
// mP = ((input Mod p) ^ dP)) Mod p
mP = (input.Remainder(p)).ModPow(dP, p);
// mQ = ((input Mod q) ^ dQ)) Mod q
mQ = (input.Remainder(q)).ModPow(dQ, q);
// h = qInv * (mP - mQ) Mod p
h = mP.Subtract(mQ);
h = h.Multiply(qInv);
h = h.Mod(p); // Mod (in Java) returns the positive residual
// m = h * q + mQ
m = h.Multiply(q);
m = m.Add(mQ);
return m;
}
return input.ModPow(key.Exponent, key.Modulus);
}
public BigInteger And(
BigInteger value)
{
if (this.sign == 0 || value.sign == 0)
{
return Zero;
}
int[] aMag = this.sign > 0
? this.magnitude
: Add(One).magnitude;
int[] bMag = value.sign > 0
? value.magnitude
: value.Add(One).magnitude;
bool resultNeg = sign < 0 && value.sign < 0;
int resultLength = System.Math.Max(aMag.Length, bMag.Length);
int[] resultMag = new int[resultLength];
int aStart = resultMag.Length - aMag.Length;
int bStart = resultMag.Length - bMag.Length;
for (int i = 0; i < resultMag.Length; ++i)
{
int aWord = i >= aStart ? aMag[i - aStart] : 0;
int bWord = i >= bStart ? bMag[i - bStart] : 0;
if (this.sign < 0)
{
aWord = ~aWord;
}
if (value.sign < 0)
{
bWord = ~bWord;
}
resultMag[i] = aWord & bWord;
if (resultNeg)
{
resultMag[i] = ~resultMag[i];
}
}
BigInteger result = new BigInteger(1, resultMag, true);
// TODO Optimise this case
if (resultNeg)
{
result = result.Not();
}
return result;
}
public BigInteger AndNot(
BigInteger val)
{
return And(val.Not());
}
public BigInteger Gcd(
BigInteger value)
{
if (value.sign == 0)
return Abs();
if (sign == 0)
return value.Abs();
BigInteger r;
BigInteger u = this;
BigInteger v = value;
while (v.sign != 0)
{
r = u.Mod(v);
u = v;
v = r;
}
return u;
}
