1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
|
//
// RSAManaged.cs - Implements the RSA algorithm.
//
// Authors:
// Sebastien Pouliot (sebastien@ximian.com)
// Ben Maurer (bmaurer@users.sf.net)
//
// (C) 2002, 2003 Motus Technologies Inc. (http://www.motus.com)
// Portions (C) 2003 Ben Maurer
// (C) 2004 Novell (http://www.novell.com)
//
// Key generation translated from Bouncy Castle JCE (http://www.bouncycastle.org/)
// See bouncycastle.txt for license.
//
using System;
using System.Security.Cryptography;
using Mono.Math;
// Big chunks of code are coming from the original RSACryptoServiceProvider class.
// The class was refactored to :
// a. ease integration of new hash algorithm (like MD2, RIPEMD160, ...);
// b. provide better support for the coming SSL implementation (requires
// EncryptValue/DecryptValue) with, or without, Mono runtime/corlib;
// c. provide an alternative RSA implementation for all Windows (like using
// OAEP without Windows XP).
namespace Mono.Security.Cryptography {
#if INSIDE_CORLIB
internal
#else
public
#endif
class RSAManaged : RSA {
private const int defaultKeySize = 1024;
private bool isCRTpossible = false;
private bool keypairGenerated = false;
private bool m_disposed = false;
private BigInteger d;
private BigInteger p;
private BigInteger q;
private BigInteger dp;
private BigInteger dq;
private BigInteger qInv;
private BigInteger n; // modulus
private BigInteger e;
public RSAManaged () : this (defaultKeySize)
{
}
public RSAManaged (int keySize)
{
KeySizeValue = keySize;
LegalKeySizesValue = new KeySizes [1];
LegalKeySizesValue [0] = new KeySizes (384, 16384, 8);
}
~RSAManaged ()
{
// Zeroize private key
Dispose (false);
}
private void GenerateKeyPair ()
{
// p and q values should have a length of half the strength in bits
int pbitlength = ((KeySize + 1) >> 1);
int qbitlength = (KeySize - pbitlength);
const uint uint_e = 17;
e = uint_e; // fixed
// generate p, prime and (p-1) relatively prime to e
for (;;) {
p = BigInteger.GeneratePseudoPrime (pbitlength);
if (p % uint_e != 1)
break;
}
// generate a modulus of the required length
for (;;) {
// generate q, prime and (q-1) relatively prime to e,
// and not equal to p
for (;;) {
q = BigInteger.GeneratePseudoPrime (qbitlength);
if ((q % uint_e != 1) && (p != q))
break;
}
// calculate the modulus
n = p * q;
if (n.BitCount () == KeySize)
break;
// if we get here our primes aren't big enough, make the largest
// of the two p and try again
if (p < q)
p = q;
}
BigInteger pSub1 = (p - 1);
BigInteger qSub1 = (q - 1);
BigInteger phi = pSub1 * qSub1;
// calculate the private exponent
d = e.ModInverse (phi);
// calculate the CRT factors
dp = d % pSub1;
dq = d % qSub1;
qInv = q.ModInverse (p);
keypairGenerated = true;
isCRTpossible = true;
if (KeyGenerated != null)
KeyGenerated (this, null);
}
// overrides from RSA class
public override int KeySize {
get {
// in case keypair hasn't been (yet) generated
if (keypairGenerated)
return n.BitCount ();
else
return base.KeySize;
}
}
public override string KeyExchangeAlgorithm {
get { return "RSA-PKCS1-KeyEx"; }
}
// note: this property will exist in RSACryptoServiceProvider in
// version 1.2 of the framework
public bool PublicOnly {
get { return ((d == null) || (n == null)); }
}
public override string SignatureAlgorithm {
get { return "http://www.w3.org/2000/09/xmldsig#rsa-sha1"; }
}
public override byte[] DecryptValue (byte[] rgb)
{
if (m_disposed)
throw new ObjectDisposedException ("private key");
// decrypt operation is used for signature
if (!keypairGenerated)
GenerateKeyPair ();
BigInteger input = new BigInteger (rgb);
BigInteger output;
// decrypt (which uses the private key) can be
// optimized by using CRT (Chinese Remainder Theorem)
if (isCRTpossible) {
// m1 = c^dp mod p
BigInteger m1 = input.ModPow (dp, p);
// m2 = c^dq mod q
BigInteger m2 = input.ModPow (dq, q);
BigInteger h;
if (m2 > m1) {
// thanks to benm!
h = p - ((m2 - m1) * qInv % p);
output = m2 + q * h;
}
else {
// h = (m1 - m2) * qInv mod p
h = (m1 - m2) * qInv % p;
// m = m2 + q * h;
output = m2 + q * h;
}
}
else {
// m = c^d mod n
output = input.ModPow (d, n);
}
byte[] result = output.GetBytes ();
// zeroize value
input.Clear ();
output.Clear ();
return result;
}
public override byte[] EncryptValue (byte[] rgb)
{
if (m_disposed)
throw new ObjectDisposedException ("public key");
if (!keypairGenerated)
GenerateKeyPair ();
BigInteger input = new BigInteger (rgb);
BigInteger output = input.ModPow (e, n);
byte[] result = output.GetBytes ();
// zeroize value
input.Clear ();
output.Clear ();
return result;
}
public override RSAParameters ExportParameters (bool includePrivateParameters)
{
if (m_disposed)
throw new ObjectDisposedException ("");
if (!keypairGenerated)
GenerateKeyPair ();
RSAParameters param = new RSAParameters ();
param.Exponent = e.GetBytes ();
param.Modulus = n.GetBytes ();
if (includePrivateParameters) {
// some parameters are required for exporting the private key
if ((d == null) || (p == null) || (q == null))
throw new CryptographicException ("Missing private key");
param.D = d.GetBytes ();
// hack for bugzilla #57941 where D wasn't provided
if (param.D.Length != param.Modulus.Length) {
byte[] normalizedD = new byte [param.Modulus.Length];
Buffer.BlockCopy (param.D, 0, normalizedD, (normalizedD.Length - param.D.Length), param.D.Length);
param.D = normalizedD;
}
param.P = p.GetBytes ();
param.Q = q.GetBytes ();
// but CRT parameters are optionals
if ((dp != null) && (dq != null) && (qInv != null)) {
// and we include them only if we have them all
param.DP = dp.GetBytes ();
param.DQ = dq.GetBytes ();
param.InverseQ = qInv.GetBytes ();
}
}
return param;
}
public override void ImportParameters (RSAParameters parameters)
{
if (m_disposed)
throw new ObjectDisposedException ("");
// if missing "mandatory" parameters
if (parameters.Exponent == null)
throw new CryptographicException ("Missing Exponent");
if (parameters.Modulus == null)
throw new CryptographicException ("Missing Modulus");
e = new BigInteger (parameters.Exponent);
n = new BigInteger (parameters.Modulus);
// only if the private key is present
if (parameters.D != null)
d = new BigInteger (parameters.D);
if (parameters.DP != null)
dp = new BigInteger (parameters.DP);
if (parameters.DQ != null)
dq = new BigInteger (parameters.DQ);
if (parameters.InverseQ != null)
qInv = new BigInteger (parameters.InverseQ);
if (parameters.P != null)
p = new BigInteger (parameters.P);
if (parameters.Q != null)
q = new BigInteger (parameters.Q);
// we now have a keypair
keypairGenerated = true;
isCRTpossible = ((p != null) && (q != null) && (dp != null) && (dq != null) && (qInv != null));
}
protected override void Dispose (bool disposing)
{
if (!m_disposed) {
// Always zeroize private key
if (d != null) {
d.Clear ();
d = null;
}
if (p != null) {
p.Clear ();
p = null;
}
if (q != null) {
q.Clear ();
q = null;
}
if (dp != null) {
dp.Clear ();
dp = null;
}
if (dq != null) {
dq.Clear ();
dq = null;
}
if (qInv != null) {
qInv.Clear ();
qInv = null;
}
if (disposing) {
// clear public key
if (e != null) {
e.Clear ();
e = null;
}
if (n != null) {
n.Clear ();
n = null;
}
}
}
// call base class
// no need as they all are abstract before us
m_disposed = true;
}
public delegate void KeyGeneratedEventHandler (object sender, EventArgs e);
public event KeyGeneratedEventHandler KeyGenerated;
}
}
|