89
ctx BN_mod_mulr, a, b, m,
ctx r = absa x b m r may be the same as a or b.
BN_mod_sqrr, a, m, ctx
r = abspowa, 2 m BN_expr, a, p, ctx
r = powa, p BN_mod_expr, a, p, m,
ctx r = powa, 2 m
BN_gcdr, a, b, ctx Finds the greatest common divisor of a and b. r may be the same as a or
b.
4.5.3 Generating Prime Numbers
One of the functions provided by the BN package that is most import to public key cryptography is
BN_generate_prime
. As its name implies, the function generates prime numbers, but more importantly, it generates pseudorandom primes. In other words, it repeatedly chooses numbers at
random until one of the choices it makes is a prime number. Such a function can be quite useful for other applications as well, which is one of the reasons why weve chosen to pay so much
attention to it in this chapter. Another reason is because its parameter list is rather large and complex, which can make using the function seem to be a daunting task.
BIGNUM BN_generate_primeBIGNUM ret, int bits, int safe, BIGNUM add, BIGNUM rem, void callbackint,
int, void , void cb_arg;
ret Used to receive the prime number that is generated. If it is specified as
NULL
, a new
BIGNUM
will be created, initialized with
BN_new
, and returned. bits
The number of bits that should be used to represent the generated prime. safe
Either zero or nonzero, indicating whether the generated prime should be safe or not. A safe prime is defined as a prime, p, in which p-12 is also prime.
add Used to specify additional properties that the generated prime should have. If it is
specified as
NULL
, no additional properties will be required. Otherwise, the generated prime must satisfy the condition that when divided by this value, the remainder is one.
rem Used to specify additional properties that the generated prime should have. If it is
specified as
NULL
, no additional properties will be required. Otherwise, the generated prime must satisfy the condition that when divided by
add
, the remainder must be this value. If add is specified as
NULL
, this argument is ignored. callback
TE AM
FL Y
Team-Fly
®
90
A function that is called during the generation of the prime to report the status of the operation. Generating a prime can often be a rather time-consuming task, so this provides
some means of advising a user that work is being done and that the program hasnt crashed or hung.
cb_arg A value that is used only to pass to the callback function if one is specified. OpenSSL
does not use this argument for anything else and will never attempt to interpret its value or meaning.
If one is used, the callback function should accept three arguments and return no value. The third argument to the callback function is always the
cb_arg
argument to
BN_generate_prime
. The first argument passed to the callback function is a status code indicating which phase of the
prime generation has just completed. The status code will always be 0, 1, or 2. The meaning of the second argument depends on the status code. When the status code is 0, it indicates that a potential
prime has been found, but it has not yet been tested to ensure that it conforms to the criteria specified in the call to
BN_generate_prime
. The callback can be called with a status code of 0 many times, and each time the second argument will contain a counter of the number of primes
that have been found so far, not including the current one. When the status code is 1, the second argument indicates the number of Miller-Rabin probabilistic primality tests that have been
completed. Finally, when the status code is 2, a conforming prime has been found, and the second argument indicates the number of candidates that were tested before it.
Example 4-16 demonstrates how to use the
BN_generate_prime
function with a callback for displaying the status of the process.
Example 4-16. Generating a pseudorandom prime number with BN_generate_prime
static void prime_statusint code, int arg, void cb_arg {
if code == 0 printf\n Found potential prime d ..., arg + 1;
else if code == 1 arg arg 10 printf.;
else printf\n Got one\n;
} BIGNUM generate_primeint bits, int safe
{ char str;
BIGNUM prime; printfSearching for a sprime d bits in size ..., safe ?
safe : , bits;
prime = BN_generate_primeNULL, bits, safe, NULL, NULL, prime_status, NULL;
if prime return NULL;
str = BN_bn2decprime; if str
{ printfFound prime: s\n, str;
OPENSSL_freestr;
91
} return prime;
}
4.6 Using Engines
