C++ BN_rand_range函數代碼示例

int compute_scalar_element (pwd_session_t *sess, BN_CTX *bnctx) {
	BIGNUM *mask = NULL;
	int ret = -1;

	if (((sess->private_value = BN_new()) == NULL) ||
	    ((sess->my_element = EC_POINT_new(sess->group)) == NULL) ||
	    ((sess->my_scalar = BN_new()) == NULL) ||
	    ((mask = BN_new()) == NULL)) {
		DEBUG2("server scalar allocation failed");
		goto fail;
	}

	BN_rand_range(sess->private_value, sess->order);
	BN_rand_range(mask, sess->order);
	BN_add(sess->my_scalar, sess->private_value, mask);
	BN_mod(sess->my_scalar, sess->my_scalar, sess->order, bnctx);

	if (!EC_POINT_mul(sess->group, sess->my_element, NULL, sess->pwe, mask, bnctx)) {
		DEBUG2("server element allocation failed");
		goto fail;
	}

	if (!EC_POINT_invert(sess->group, sess->my_element, bnctx)) {
		DEBUG2("server element inversion failed");
		goto fail;
	}

	ret = 0;

fail:
	BN_free(mask);

	return ret;
}

// Generate each party's random numbers. xa is in [0, q), xb is in [1, q).
static void genrand(JPakeUser * user, const JPakeParameters * params)
{
    BIGNUM *qm1;

    // xa in [0, q)
    user->xa = BN_new();
    BN_rand_range(user->xa, params->q);

    // q-1
    qm1 = BN_new();
    BN_copy(qm1, params->q);
    BN_sub_word(qm1, 1);

    // ... and xb in [0, q-1)
    user->xb = BN_new();
    BN_rand_range(user->xb, qm1);
    // [1, q)
    BN_add_word(user->xb, 1);

    // cleanup
    BN_free(qm1);

    // Show
    printf("x%d", user->p.base);
    showbn("", user->xa);
    printf("x%d", user->p.base + 1);
    showbn("", user->xb);
}

static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
	{
	BN_CTX *ctx;
	BIGNUM k,*kinv=NULL,*r=NULL;
	int ret=0;

	if (!dsa->p || !dsa->q || !dsa->g)
		{
		DSAerr(DSA_F_DSA_SIGN_SETUP,DSA_R_MISSING_PARAMETERS);
		return 0;
		}
	if (ctx_in == NULL)
		{
		if ((ctx=BN_CTX_new()) == NULL) goto err;
		}
	else
		ctx=ctx_in;

	BN_init(&k);
	if ((r=BN_new()) == NULL) goto err;
	kinv=NULL;

	/* Get random k */
	do
		if (!BN_rand_range(&k, dsa->q)) goto err;
	while (BN_is_zero(&k));

	if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
		{
		if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
			if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
				dsa->p,ctx)) goto err;
		}

	/* Compute r = (g^k mod p) mod q */
	if (!dsa->meth->bn_mod_exp(dsa, r,dsa->g,&k,dsa->p,ctx,
		(BN_MONT_CTX *)dsa->method_mont_p)) goto err;
	if (!BN_mod(r,r,dsa->q,ctx)) goto err;

	/* Compute  part of 's = inv(k) (m + xr) mod q' */
	if ((kinv=BN_mod_inverse(NULL,&k,dsa->q,ctx)) == NULL) goto err;

	if (*kinvp != NULL) BN_clear_free(*kinvp);
	*kinvp=kinv;
	kinv=NULL;
	if (*rp != NULL) BN_clear_free(*rp);
	*rp=r;
	ret=1;
err:
	if (!ret)
		{
		DSAerr(DSA_F_DSA_SIGN_SETUP,ERR_R_BN_LIB);
		if (kinv != NULL) BN_clear_free(kinv);
		if (r != NULL) BN_clear_free(r);
		}
	if (ctx_in == NULL) BN_CTX_free(ctx);
	if (kinv != NULL) BN_clear_free(kinv);
	BN_clear_free(&k);
	return(ret);
	}

int
gost2001_keygen(GOST_KEY *ec)
{
	BIGNUM *order = BN_new(), *d = BN_new();
	const EC_GROUP *group = GOST_KEY_get0_group(ec);
	int rc = 0;

	if (order == NULL || d == NULL)
		goto err;
	if (EC_GROUP_get_order(group, order, NULL) == 0)
		goto err;

	do {
		if (BN_rand_range(d, order) == 0) {
			GOSTerr(GOST_F_GOST2001_KEYGEN,
				GOST_R_RANDOM_NUMBER_GENERATOR_FAILED);
			goto err;
		}
	} while (BN_is_zero(d));

	if (GOST_KEY_set_private_key(ec, d) == 0)
		goto err;
	rc = gost2001_compute_public(ec);

err:
	BN_free(d);
	BN_free(order);
	return rc;
}

void PSPAKE_Message_generate(PSPAKE_Message *message, PSPAKE_CTX *ctx)
{
    BIGNUM *t1 = BN_new();
    BIGNUM *t2 = BN_new();

    /* just for debugging */
    static int cnt = 0;
    cnt++;

    /* r belongs to [0, q) */
    BN_rand_range(ctx->r, ctx->q);

    /* t1 = g^r mod q */
    BN_mod_exp(t1, ctx->g, ctx->r, ctx->q, ctx->ctx);

    /* t2 = h^secret mod q */
    BN_mod_exp(t2, ctx->h, ctx->secret, ctx->q, ctx->ctx);

    /* ctx->y = t1 * t2 mod q */
    BN_mod_mul(ctx->y, t1, t2, ctx->q, ctx->ctx);

    /* message->y = ctx->y */
    message->y = BN_dup(ctx->y);

    /* print the random number r generated (just for debugging) */
    if (cnt == 1)
    {
        print_bn("alice's r", ctx->r);
    }
    else
    {
        print_bn("bob's r", ctx->r);
    }
}

static int bn_blinding_create_param(BN_BLINDING *b, BN_CTX *ctx,
                                    const BN_MONT_CTX *mont_ctx) {
  int retry_counter = 32;

  do {
    if (!BN_rand_range(b->A, b->mod)) {
      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
      return 0;
    }

    int no_inverse;
    if (BN_mod_inverse_ex(b->Ai, &no_inverse, b->A, b->mod, ctx) == NULL) {
      /* this should almost never happen for good RSA keys */
      if (no_inverse) {
        if (retry_counter-- == 0) {
          OPENSSL_PUT_ERROR(RSA, RSA_R_TOO_MANY_ITERATIONS);
          return 0;
        }
        ERR_clear_error();
      } else {
        OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
        return 0;
      }
    } else {
      break;
    }
  } while (1);

  if (!BN_mod_exp_mont(b->A, b->A, b->e, b->mod, ctx, mont_ctx)) {
    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
    return 0;
  }

  return 1;
}

EC_KEY *EC_KEY_generate_key_ex(const EC_GROUP *group) {
  EC_KEY *eckey = ec_key_new_ex(group);
  if (!eckey) {
    return NULL;
  }

  assert(eckey->priv_key == NULL);
  eckey->priv_key = BN_new();
  if (eckey->priv_key == NULL) {
    goto err;
  }

  do {
    if (!BN_rand_range(eckey->priv_key, &eckey->group->order)) {
      goto err;
    }
  } while (BN_is_zero(eckey->priv_key));

  assert(eckey->pub_key == NULL);
  eckey->pub_key = EC_POINT_new(eckey->group);
  if (eckey->pub_key == NULL) {
    goto err;
  }

  if (!eckey->group->meth->mul_private(eckey->group, eckey->pub_key,
                                       eckey->priv_key, NULL, NULL, NULL)) {
    goto err;
  }

  return eckey;

err:
  EC_KEY_free(eckey);
  return NULL;
}

/* The secret integers s0 and s1 must be in the range 0 < s < n for
   some n, and must be relatively prime to that n.  We know a priori
   that n is of the form 2**k * p for some small integer k and prime
   p.  Therefore, it suffices to choose a random integer in the range
   [0, n/2), multiply by two and add one (enforcing oddness), and then
   reject values which are divisible by p.  */
static BIGNUM *
random_s(const BIGNUM *n, const BIGNUM *p, BN_CTX *c)
{
  BIGNUM h, m, *r;

  BN_init(&h);
  BN_init(&m);
  FAILZ(r = BN_new());
  FAILZ(BN_copy(&h, n));
  FAILZ(BN_rshift1(&h, &h));

  do {
    FAILZ(BN_rand_range(r, &h));
    FAILZ(BN_lshift1(r, r));
    FAILZ(BN_add(r, r, BN_value_one()));
    FAILZ(BN_nnmod(&m, r, p, c));
  } while (BN_is_zero(&m));

  BN_clear(&h);
  BN_clear(&m);
  return r;

 fail:
  BN_clear(&h);
  BN_clear(&m);
  if (r) BN_clear_free(r);
  return 0;
}

/*
 * Prove knowledge of x
 * Note that p->gx has already been calculated
 */
static void generate_zkp(JPAKE_STEP_PART *p, const BIGNUM *x,
			 const BIGNUM *zkpg, JPAKE_CTX *ctx)
    {
    BIGNUM *r = BN_new();
    BIGNUM *h = BN_new();
    BIGNUM *t = BN_new();

   /*
    * r in [0,q)
    * XXX: Java chooses r in [0, 2^160) - i.e. distribution not uniform
    */
    BN_rand_range(r, ctx->p.q);
   /* g^r */
    BN_mod_exp(p->zkpx.gr, zkpg, r, ctx->p.p, ctx->ctx);

   /* h=hash... */
    zkp_hash(h, zkpg, p, ctx->p.name);

   /* b = r - x*h */
    BN_mod_mul(t, x, h, ctx->p.q, ctx->ctx);
    BN_mod_sub(p->zkpx.b, r, t, ctx->p.q, ctx->ctx);

   /* cleanup */
    BN_free(t);
    BN_free(h);
    BN_free(r);
    }

/*
 *
 * Generates GOST R 34.10-2001 keypair
 *
 *
 */
int gost2001_keygen(EC_KEY *ec)
{
    BIGNUM *order = BN_new(), *d = BN_new();
    const EC_GROUP *group = EC_KEY_get0_group(ec);

    if (!group || !EC_GROUP_get_order(group, order, NULL)) {
        GOSTerr(GOST_F_GOST2001_KEYGEN, ERR_R_INTERNAL_ERROR);
        BN_free(d);
        BN_free(order);
        return 0;
    }

    do {
        if (!BN_rand_range(d, order)) {
            GOSTerr(GOST_F_GOST2001_KEYGEN,
                    GOST_R_RANDOM_NUMBER_GENERATOR_FAILED);
            BN_free(d);
            BN_free(order);
            return 0;
        }
    }
    while (BN_is_zero(d));

    if (!EC_KEY_set_private_key(ec, d)) {
        GOSTerr(GOST_F_GOST2001_KEYGEN, ERR_R_INTERNAL_ERROR);
        BN_free(d);
        BN_free(order);
        return 0;
    }
    BN_free(d);
    BN_free(order);
    return gost2001_compute_public(ec);
}

int EC_KEY_generate_key(EC_KEY *eckey)
{
    int ok = 0;
    BN_CTX *ctx = NULL;
    BIGNUM *priv_key = NULL, *order = NULL;
    EC_POINT *pub_key = NULL;

    if (!eckey || !eckey->group) {
        ECerr(EC_F_EC_KEY_GENERATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
        return 0;
    }

    if ((order = BN_new()) == NULL)
        goto err;
    if ((ctx = BN_CTX_new()) == NULL)
        goto err;

    if (eckey->priv_key == NULL) {
        priv_key = BN_new();
        if (priv_key == NULL)
            goto err;
    } else
        priv_key = eckey->priv_key;

    if (!EC_GROUP_get_order(eckey->group, order, ctx))
        goto err;

    do
        if (!BN_rand_range(priv_key, order))
            goto err;
    while (BN_is_zero(priv_key)) ;

    if (eckey->pub_key == NULL) {
        pub_key = EC_POINT_new(eckey->group);
        if (pub_key == NULL)
            goto err;
    } else
        pub_key = eckey->pub_key;

    if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, ctx))
        goto err;

    eckey->priv_key = priv_key;
    eckey->pub_key = pub_key;

    ok = 1;

err:
    if (order)
        BN_free(order);
    if (pub_key != NULL && eckey->pub_key == NULL)
        EC_POINT_free(pub_key);
    if (priv_key != NULL && eckey->priv_key == NULL)
        BN_free(priv_key);
    if (ctx != NULL)
        BN_CTX_free(ctx);
    return (ok);
}

void Person::set_keys() {
  a = BN_new();
  BN_rand_range(a, p);
  A = BN_new();
  BN_CTX *ctx = BN_CTX_new();
  BN_mod_exp(A, g, a, p, ctx);

  if (ctx) BN_CTX_free(ctx);
}

static int dsa_builtin_keygen(DSA *dsa)
{
    int ok = 0;
    BN_CTX *ctx = NULL;
    BIGNUM *pub_key = NULL, *priv_key = NULL;

    if ((ctx = BN_CTX_new()) == NULL)
        goto err;

    if (dsa->priv_key == NULL) {
        if ((priv_key = BN_secure_new()) == NULL)
            goto err;
    } else
        priv_key = dsa->priv_key;

    do
        if (!BN_rand_range(priv_key, dsa->q))
            goto err;
    while (BN_is_zero(priv_key)) ;

    if (dsa->pub_key == NULL) {
        if ((pub_key = BN_new()) == NULL)
            goto err;
    } else
        pub_key = dsa->pub_key;

    {
        BIGNUM *local_prk = NULL;
        BIGNUM *prk;

        if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
            local_prk = prk = BN_new();
            if (!local_prk)
                goto err;
            BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
        } else
            prk = priv_key;

        if (!BN_mod_exp(pub_key, dsa->g, prk, dsa->p, ctx)) {
            BN_free(local_prk);
            goto err;
        }
        BN_free(local_prk);
    }

    dsa->priv_key = priv_key;
    dsa->pub_key = pub_key;
    ok = 1;

 err:
    if (pub_key != dsa->pub_key)
        BN_free(pub_key);
    if (priv_key != dsa->priv_key)
        BN_free(priv_key);
    BN_CTX_free(ctx);
    return (ok);
}

CSignerECDSA::CSignerECDSA(const uint8_t PrivData[32], unsigned char Signature[65])
{
    order.setuint256(g_Order);

    EC_KEY* pkey = EC_KEY_new_by_curve_name(NID_secp256k1);
    const EC_GROUP *group = EC_KEY_get0_group(pkey);

    CBigNum privkey;
    BN_bin2bn(PrivData, 32, &privkey);
    EC_KEY_regenerate_key(pkey, &privkey);

    EC_POINT *tmp_point = EC_POINT_new(group);
    EC_POINT *test_point = EC_POINT_new(group);

    CBigNum r, X, Y;
    bool which = false;
    do
    {
        // get random k
        do
            BN_rand_range(&kinv, &order);
        while (!kinv);

        /* We do not want timing information to leak the length of k,
         * so we compute G*k using an equivalent scalar of fixed
         * bit-length. */
        kinv += order;
        if (BN_num_bits(&kinv) <= 256)
            kinv += order;

        // compute r the x-coordinate of generator * k
        EC_POINT_mul(group, tmp_point, &kinv, NULL, NULL, ctx);
        EC_POINT_get_affine_coordinates_GFp(group, tmp_point, &X, &Y, ctx);
        EC_POINT_set_compressed_coordinates_GFp(group, test_point, &X, 0, ctx);
        which = !!EC_POINT_cmp(group, tmp_point, test_point, ctx);
        BN_nnmod(&r, &X, &order, ctx);
    }
    while (!r);

    // compute the inverse of k
    BN_mod_inverse(&kinv, &kinv, &order, ctx);

    BN_mod_mul(&pmr, &privkey, &r, &order, ctx);

    BN_mod_mul(&prk, &pmr, &kinv, &order, ctx);

    memset(Signature, 0, 65);
    int nBitsR = BN_num_bits(&r);
    BN_bn2bin(&r, &Signature[33-(nBitsR+7)/8]);
    Signature[0] = 27 + which;

    EC_POINT_free(tmp_point);
    EC_POINT_free(test_point);
    EC_KEY_free(pkey);
}

/* Generate each party's random numbers. xa is in [0, q), xb is in [1, q). */
static void genrand(JPAKE_CTX *ctx)
    {
    BIGNUM *qm1;

   /* xa in [0, q) */
    BN_rand_range(ctx->xa, ctx->p.q);

   /* q-1 */
    qm1 = BN_new();
    BN_copy(qm1, ctx->p.q);
    BN_sub_word(qm1, 1);

   /* ... and xb in [0, q-1) */
    BN_rand_range(ctx->xb, qm1);
   /* [1, q) */
    BN_add_word(ctx->xb, 1);

   /* cleanup */
    BN_free(qm1);
    }