C++ BN_sub_word函数代码示例

int main(int argc, char ** argv) {
	/* Generate 2 big random numbers (512 bits) */
	primitive_p = initialize("1011011");
	initialize_rand(SEED);
	BIGNUM *p = get_long_prime_number(RSA_KEY_LENGTH);
	printf("p=%s\n", BN_bn2hex(p));
	BIGNUM *q = get_long_prime_number(RSA_KEY_LENGTH);
	printf("q=%s\n", BN_bn2hex(q));
	/* Compute phi = (p-1)*(q-1) and n = p*q */
	BIGNUM *phi, *n;
	BN_CTX *tmp;
	tmp = BN_CTX_new();
	n = BN_new();
	phi = BN_new();
	BN_copy(n, p);
	BN_mul(n, n, q, tmp);
	printf("n=%s\n", BN_bn2dec(n));
	BN_sub_word(p, 1);
	printf("p-1=%s\n", BN_bn2dec(p));
	BN_sub_word(q, 1);
	printf("q-1=%s\n", BN_bn2dec(q));
	phi = BN_new();
	BN_init(tmp);
	BN_mul(phi, p, q, tmp);
	printf("(p-1)(q-1)=%s\n", BN_bn2dec(phi));
	/* Find the smallest integer coprime with phi */
	BIGNUM * e = BN_new();
	BIGNUM *gcd = BN_new();
	BN_add_word(e, 3);
	for ( ; ; BN_add_word(e, 2)) {
		tmp = BN_CTX_new();
		BN_gcd(gcd, e, phi, tmp);
		if (BN_is_one(gcd))
			break;
	}
	printf("e=%s\n", BN_bn2dec(e));
	/* Find d, the inverse of e in Z_phi */
	BIGNUM * d = BN_new();
	BIGNUM * i = BN_new();
	BIGNUM * rem = BN_new();
	BIGNUM * prod = BN_new();
	BN_add_word(i, 1);
	for ( ; ; BN_add_word(i, 1)) {
		BN_copy(prod, phi);
		tmp = BN_CTX_new();
		BN_mul(prod, prod, i, tmp);
		BN_add_word(prod, 1);
		BN_div(d, rem, prod, e, tmp);
		if (BN_is_zero(rem)) {
			break;
		}
	}
	printf("d=%s\n", BN_bn2dec(d));
	return 0;
}

// Generate each party's random numbers. xa is in [0, q), xb is in [1, q).
static void genrand(JPakeUser * user, const JPakeParameters * params)
{
    BIGNUM *qm1;

    // xa in [0, q)
    user->xa = BN_new();
    BN_rand_range(user->xa, params->q);

    // q-1
    qm1 = BN_new();
    BN_copy(qm1, params->q);
    BN_sub_word(qm1, 1);

    // ... and xb in [0, q-1)
    user->xb = BN_new();
    BN_rand_range(user->xb, qm1);
    // [1, q)
    BN_add_word(user->xb, 1);

    // cleanup
    BN_free(qm1);

    // Show
    printf("x%d", user->p.base);
    showbn("", user->xa);
    printf("x%d", user->p.base + 1);
    showbn("", user->xb);
}

int BN_add_word(BIGNUM *a, BN_ULONG w)
	{
	BN_ULONG l;
	int i;

	if (a->neg)
		{
		a->neg=0;
		i=BN_sub_word(a,w);
		if (!BN_is_zero(a))
			a->neg=!(a->neg);
		return(i);
		}
	w&=BN_MASK2;
	if (bn_wexpand(a,a->top+1) == NULL) return(0);
	i=0;
	for (;;)
		{
		l=(a->d[i]+(BN_ULONG)w)&BN_MASK2;
		a->d[i]=l;
		if (w > l)
			w=1;
		else
			break;
		i++;
		}
	if (i >= a->top)
		a->top++;
	return(1);
	}

int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret) {
  int ok = 0;
  BIGNUM q;

  *ret = 0;
  BN_init(&q);
  if (!BN_set_word(&q, 1)) {
    goto err;
  }

  if (BN_cmp(pub_key, &q) <= 0) {
    *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
  }
  if (!BN_copy(&q, dh->p) ||
      !BN_sub_word(&q, 1)) {
    goto err;
  }
  if (BN_cmp(pub_key, &q) >= 0) {
    *ret |= DH_CHECK_PUBKEY_TOO_LARGE;
  }

  ok = 1;

err:
  BN_free(&q);
  return ok;
}

int BN_add_word(BIGNUM *a, BN_ULONG w)
	{
	BN_ULONG l;
	int i;

	bn_check_top(a);
	w &= BN_MASK2;

	/* degenerate case: w is zero */
	if (!w) return 1;
	/* degenerate case: a is zero */
	if(BN_is_zero(a)) return BN_set_word(a, w);
	/* handle 'a' when negative */
	if (a->neg)
		{
		a->neg=0;
		i=BN_sub_word(a,w);
		if (!BN_is_zero(a))
			a->neg=!(a->neg);
		return(i);
		}
	for (i=0;w!=0 && i<a->top;i++)
		{
		a->d[i] = l = (a->d[i]+w)&BN_MASK2;
		w = (w>l)?1:0;
		}
	if (w && i==a->top)
		{
		if (bn_wexpand(a,a->top+1) == NULL) return 0;
		a->top++;
		a->d[i]=w;
		}
	bn_check_top(a);
	return(1);
	}

int Lfast(BIGNUM *res, const BIGNUM *u, const BIGNUM *ninv, const BIGNUM *two_n, const BIGNUM *n) {
	BN_CTX *ctx = BN_CTX_new();
	BN_copy(res, u);
	BN_sub_word(res, 1);
	BN_mod_mul(res, res, ninv, two_n, ctx);
	BN_mod(res, res, n, ctx);
}

int gost_do_verify (const unsigned char *dgst, int dgst_len, DSA_SIG * sig, DSA * dsa)
{
    BIGNUM *md, *tmp = NULL;

    BIGNUM *q2 = NULL;

    BIGNUM *u = NULL, *v = NULL, *z1 = NULL, *z2 = NULL;

    BIGNUM *tmp2 = NULL, *tmp3 = NULL;

    int ok;

    BN_CTX *ctx = BN_CTX_new ();

    BN_CTX_start (ctx);
    if (BN_cmp (sig->s, dsa->q) >= 1 || BN_cmp (sig->r, dsa->q) >= 1)
    {
        GOSTerr (GOST_F_GOST_DO_VERIFY, GOST_R_SIGNATURE_PARTS_GREATER_THAN_Q);
        return 0;
    }
    md = hashsum2bn (dgst);

    tmp = BN_CTX_get (ctx);
    v = BN_CTX_get (ctx);
    q2 = BN_CTX_get (ctx);
    z1 = BN_CTX_get (ctx);
    z2 = BN_CTX_get (ctx);
    tmp2 = BN_CTX_get (ctx);
    tmp3 = BN_CTX_get (ctx);
    u = BN_CTX_get (ctx);

    BN_mod (tmp, md, dsa->q, ctx);
    if (BN_is_zero (tmp))
    {
        BN_one (md);
    }
    BN_copy (q2, dsa->q);
    BN_sub_word (q2, 2);
    BN_mod_exp (v, md, q2, dsa->q, ctx);
    BN_mod_mul (z1, sig->s, v, dsa->q, ctx);
    BN_sub (tmp, dsa->q, sig->r);
    BN_mod_mul (z2, tmp, v, dsa->p, ctx);
    BN_mod_exp (tmp, dsa->g, z1, dsa->p, ctx);
    BN_mod_exp (tmp2, dsa->pub_key, z2, dsa->p, ctx);
    BN_mod_mul (tmp3, tmp, tmp2, dsa->p, ctx);
    BN_mod (u, tmp3, dsa->q, ctx);
    ok = BN_cmp (u, sig->r);

    BN_free (md);
    BN_CTX_end (ctx);
    BN_CTX_free (ctx);
    if (ok != 0)
    {
        GOSTerr (GOST_F_GOST_DO_VERIFY, GOST_R_SIGNATURE_MISMATCH);
    }
    return (ok == 0);
}

/**
  https://core.telegram.org/api/end-to-end says:
  "Both clients in a secret chat creation are to check that g, g_a and g_b are greater than one and smaller than p-1.
  Recommented checking that g_a and g_b are between 2^{2048-64} and p - 2^{2048-64} as well."
*/
qint32 CryptoUtils::checkCalculatedParams(const BIGNUM *gAOrB, const BIGNUM *g, const BIGNUM *p) {
    ASSERT(gAOrB);
    ASSERT(g);
    ASSERT(p);

    // 1) gAOrB and g greater than one and smaller than p-1
    BIGNUM one;
    BN_init(&one);
    Utils::ensure(BN_one(&one));

    BIGNUM *pMinusOne = BN_dup(p);
    Utils::ensure(BN_sub_word(pMinusOne, 1));

    // check params greater than one
    if (BN_cmp(gAOrB, &one) <= 0) return -1;
    if (BN_cmp(g, &one) <= 0) return -1;

    // check params <= p-1
    if (BN_cmp(gAOrB, pMinusOne) >= 0) return -1;
    if (BN_cmp(g, pMinusOne) >= 0) return -1;

    // 2) gAOrB between 2^{2048-64} and p - 2^{2048-64}
    quint64 expWord = 2048 - 64;
    BIGNUM exp;
    BN_init(&exp);
    Utils::ensure(BN_set_word(&exp, expWord));

    BIGNUM base;
    BN_init(&base);
    Utils::ensure(BN_set_word(&base, 2));

    // lowLimit = base ^ exp
    BIGNUM lowLimit;
    BN_init(&lowLimit);
    Utils::ensure(BN_exp(&lowLimit, &base, &exp, BN_ctx));

    // highLimit = p - lowLimit
    BIGNUM highLimit;
    BN_init(&highLimit);
    BN_sub(&highLimit, p, &lowLimit);

    if (BN_cmp(gAOrB, &lowLimit) < 0) return -1;
    if (BN_cmp(gAOrB, &highLimit) > 0) return -1;

    BN_free(&one);
    BN_free(pMinusOne);
    BN_free(&exp);
    BN_free(&lowLimit);
    BN_free(&highLimit);
    delete g;
    delete gAOrB;
    delete p;

    return 0;
}

/*	
 *	prime_totient(p,q,totient)
 *	Euler totient function of n, under the assumption
 *	that n = pq and p and q are prime
 *	inputs: BIGNUM* p
 *		BIGNUM* q
 *	output: BIGNUM* totient
 *
 *	return value: 	0 if failure
 *			1 if success
 */
int prime_totient(BIGNUM* p, BIGNUM* q, BIGNUM* totient){
	BIGNUM one;
	BN_init(&one);
	BN_one(&one);

	BIGNUM* temp_p = BN_dup(p);
	BIGNUM* temp_q = BN_dup(q);

	BN_sub_word(temp_p, 1);
	BN_sub_word(temp_q, 1);

	BN_CTX* ctx = BN_CTX_new();

	BN_mul(totient, temp_p, temp_q, ctx);

	BN_free(temp_p);
	BN_free(temp_q);
	BN_CTX_free(ctx);

	return 1;
}

static int test_check_public_key(void)
{
    int ret = 0;
    BIGNUM *n = NULL, *e = NULL;
    RSA *key = NULL;

    ret = TEST_ptr(key = RSA_new())
          /* check NULL pointers fail */
          && TEST_false(rsa_sp800_56b_check_public(key))
          /* load public key */
          && TEST_ptr(e = bn_load_new(cav_e, sizeof(cav_e)))
          && TEST_ptr(n = bn_load_new(cav_n, sizeof(cav_n)))
          && TEST_true(RSA_set0_key(key, n, e, NULL));
    if (!ret) {
        BN_free(e);
        BN_free(n);
        goto end;
    }
    /* check public key is valid */
    ret = TEST_true(rsa_sp800_56b_check_public(key))
          /* check fail if n is even */
          && TEST_true(BN_add_word(n, 1))
          && TEST_false(rsa_sp800_56b_check_public(key))
          && TEST_true(BN_sub_word(n, 1))
          /* check fail if n is wrong number of bits */
          && TEST_true(BN_lshift1(n, n))
          && TEST_false(rsa_sp800_56b_check_public(key))
          && TEST_true(BN_rshift1(n, n))
          /* test odd exponent fails */
          && TEST_true(BN_add_word(e, 1))
          && TEST_false(rsa_sp800_56b_check_public(key))
          && TEST_true(BN_sub_word(e, 1))
          /* modulus fails composite check */
          && TEST_true(BN_add_word(n, 2))
          && TEST_false(rsa_sp800_56b_check_public(key));
end:
    RSA_free(key);
    return ret;
}

/* pollard p-1, algorithm from Jim Gillogly, May 2000 */
static void
pollard_pminus1(BIGNUM *val)
{
	BIGNUM *base, *rbase, *num, *i, *x;

	base = BN_new();
	rbase = BN_new();
	num = BN_new();
	i = BN_new();
	x = BN_new();

	BN_set_word(rbase, 1);
newbase:
	if (!BN_add_word(rbase, 1))
		errx(1, "error in BN_add_word()");
	BN_set_word(i, 2);
	BN_copy(base, rbase);

	for (;;) {
		BN_mod_exp(base, base, i, val, ctx);
		if (BN_is_one(base))
			goto newbase;

		BN_copy(x, base);
		BN_sub_word(x, 1);
		if (!BN_gcd(x, x, val, ctx))
			errx(1, "error in BN_gcd()");

		if (!BN_is_one(x)) {
			if (BN_is_prime(x, PRIME_CHECKS, NULL, NULL,
			    NULL) == 1)
				pr_print(x);
			else
				pollard_pminus1(x);
			fflush(stdout);

			BN_div(num, NULL, val, x, ctx);
			if (BN_is_one(num))
				return;
			if (BN_is_prime(num, PRIME_CHECKS, NULL, NULL,
			    NULL) == 1) {
				pr_print(num);
				fflush(stdout);
				return;
			}
			BN_copy(val, num);
		}
		if (!BN_add_word(i, 1))
			errx(1, "error in BN_add_word()");
	}
}

int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret) {
  *ret = 0;

  BN_CTX *ctx = BN_CTX_new();
  if (ctx == NULL) {
    return 0;
  }
  BN_CTX_start(ctx);

  int ok = 0;

  /* Check |pub_key| is greater than 1. */
  BIGNUM *tmp = BN_CTX_get(ctx);
  if (tmp == NULL ||
      !BN_set_word(tmp, 1)) {
    goto err;
  }
  if (BN_cmp(pub_key, tmp) <= 0) {
    *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
  }

  /* Check |pub_key| is less than |dh->p| - 1. */
  if (!BN_copy(tmp, dh->p) ||
      !BN_sub_word(tmp, 1)) {
    goto err;
  }
  if (BN_cmp(pub_key, tmp) >= 0) {
    *ret |= DH_CHECK_PUBKEY_TOO_LARGE;
  }

  if (dh->q != NULL) {
    /* Check |pub_key|^|dh->q| is 1 mod |dh->p|. This is necessary for RFC 5114
     * groups which are not safe primes but pick a generator on a prime-order
     * subgroup of size |dh->q|. */
    if (!BN_mod_exp(tmp, pub_key, dh->q, dh->p, ctx)) {
      goto err;
    }
    if (!BN_is_one(tmp)) {
      *ret |= DH_CHECK_PUBKEY_INVALID;
    }
  }

  ok = 1;

err:
  BN_CTX_end(ctx);
  BN_CTX_free(ctx);
  return ok;
}

// http://stackoverflow.com/questions/356090/how-to-compute-the-nth-root-of-a-very-big-integer
static BIGNUM *nearest_cuberoot(BIGNUM *in)
{
    BN_CTX *ctx = BN_CTX_new();
    BN_CTX_start(ctx);

    BIGNUM *three = BN_CTX_get(ctx);
    BIGNUM *high = BN_CTX_get(ctx);
    BIGNUM *mid = BN_CTX_get(ctx);
    BIGNUM *low = BN_CTX_get(ctx);
    BIGNUM *tmp = BN_CTX_get(ctx);

    BN_set_word(three, 3);                                         // Create the constant 3
    BN_set_word(high, 1);                                          // high = 1

    do
    {
        BN_lshift1(high, high);                                    // high = high << 1 (high * 2)
        BN_exp(tmp, high, three, ctx);                             // tmp = high^3
    } while (BN_ucmp(tmp, in) <= -1);                              // while (tmp < in)

    BN_rshift1(low, high);                                         // low = high >> 1 (high / 2)

    while (BN_ucmp(low, high) <= -1)                               // while (low < high)
    {
        BN_add(tmp, low, high);                                    // tmp = low + high
        BN_rshift1(mid, tmp);                                      // mid = tmp >> 1 (tmp / 2)
        BN_exp(tmp, mid, three, ctx);                              // tmp = mid^3
        if (BN_ucmp(low, mid) <= -1 && BN_ucmp(tmp, in) <= -1)     // if (low < mid && tmp < in)
            BN_copy(low, mid);                                     // low = mid
        else if (BN_ucmp(high, mid) >= 1 && BN_ucmp(tmp, in) >= 1) // else if (high > mid && tmp > in)
            BN_copy(high, mid);                                    // high = mid
        else
        {
            // subtract 1 from mid because 1 will be added after the loop
            BN_sub_word(mid, 1);                                   // mid -= 1
            break;
        }
    }

    BN_add_word(mid, 1);                                           // mid += 1

    BIGNUM *result = BN_dup(mid);

    BN_CTX_end(ctx);
    BN_CTX_free(ctx);

    return result;
}

int BN_add_word(BIGNUM *a, BN_ULONG w)
  {
  BN_ULONG l;
  int i;

  bn_check_top(a);
  w &= BN_MASK2;

  /* degenerate case: w is zero */
  if (!w) return 1;
  /* degenerate case: a is zero */
  if(BN_is_zero(a)) return BN_set_word(a, w);
  /* handle 'a' when negative */
  if (a->neg)
    {
    a->neg=0;
    i=BN_sub_word(a,w);
    if (!BN_is_zero(a))
      a->neg=!(a->neg);
    return(i);
    }
  /* Only expand (and risk failing) if it's possibly necessary */
  if (((BN_ULONG)(a->d[a->top - 1] + 1) == 0) &&
      (bn_wexpand(a,a->top+1) == NULL))
    return(0);
  i=0;
  for (;;)
    {
    if (i >= a->top)
      l=w;
    else
      l=(a->d[i]+w)&BN_MASK2;
    a->d[i]=l;
    if (w > l)
      w=1;
    else
      break;
    i++;
    }
  if (i >= a->top)
    a->top++;
  bn_check_top(a);
  return(1);
  }

/* Generate each party's random numbers. xa is in [0, q), xb is in [1, q). */
static void genrand(JPAKE_CTX *ctx)
    {
    BIGNUM *qm1;

   /* xa in [0, q) */
    BN_rand_range(ctx->xa, ctx->p.q);

   /* q-1 */
    qm1 = BN_new();
    BN_copy(qm1, ctx->p.q);
    BN_sub_word(qm1, 1);

   /* ... and xb in [0, q-1) */
    BN_rand_range(ctx->xb, qm1);
   /* [1, q) */
    BN_add_word(ctx->xb, 1);

   /* cleanup */
    BN_free(qm1);
    }