116f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giropackage org.bouncycastle.crypto.generators; 216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giroimport java.math.BigInteger; 416f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giroimport java.security.SecureRandom; 516f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 6c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro// BEGIN android-added 7c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giroimport java.util.logging.Logger; 8c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro// END android-added 953b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giroimport org.bouncycastle.math.ec.WNafUtil; 1016f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giroimport org.bouncycastle.util.BigIntegers; 1116f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 1216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giroclass DHParametersHelper 1316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro{ 14c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // BEGIN android-added 15c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro private static final Logger logger = Logger.getLogger(DHParametersHelper.class.getName()); 16c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // END android-added 17c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro 1816f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro private static final BigInteger ONE = BigInteger.valueOf(1); 1916f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro private static final BigInteger TWO = BigInteger.valueOf(2); 2016f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 2116f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro /* 2216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * Finds a pair of prime BigInteger's {p, q: p = 2q + 1} 2316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * 2416f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * (see: Handbook of Applied Cryptography 4.86) 2516f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro */ 2616f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro static BigInteger[] generateSafePrimes(int size, int certainty, SecureRandom random) 2716f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro { 28c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // BEGIN android-added 29c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro logger.info("Generating safe primes. This may take a long time."); 30c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro long start = System.currentTimeMillis(); 31c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro int tries = 0; 32c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // END android-added 3316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro BigInteger p, q; 3416f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro int qLength = size - 1; 3553b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro int minWeight = size >>> 2; 3616f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 3716f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro for (;;) 3816f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro { 39c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // BEGIN android-added 40c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro tries++; 41c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // END android-added 4216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro q = new BigInteger(qLength, 2, random); 4316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 4416f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro // p <- 2q + 1 4516f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro p = q.shiftLeft(1).add(ONE); 4616f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 4753b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro if (!p.isProbablePrime(certainty)) 4816f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro { 4953b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro continue; 5016f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro } 5153b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro 5253b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro if (certainty > 2 && !q.isProbablePrime(certainty - 2)) 5353b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro { 5453b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro continue; 5553b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro } 5653b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro 5753b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro /* 5853b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro * Require a minimum weight of the NAF representation, since low-weight primes may be 5953b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro * weak against a version of the number-field-sieve for the discrete-logarithm-problem. 6053b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro * 6153b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro * See "The number field sieve for integers of low weight", Oliver Schirokauer. 6253b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro */ 6353b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro if (WNafUtil.getNafWeight(p) < minWeight) 6453b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro { 6553b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro continue; 6653b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro } 6753b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro 6853b61f9fe9d58034fcc7021137e92460f91b70ceSergio Giro break; 6916f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro } 70c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // BEGIN android-added 71c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro long end = System.currentTimeMillis(); 72c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro long duration = end - start; 73c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro logger.info("Generated safe primes: " + tries + " tries took " + duration + "ms"); 74c1040cb5656c3299f1c2d0fe0bd7c44b10466aafSergio Giro // END android-added 7516f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 7616f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro return new BigInteger[] { p, q }; 7716f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro } 7816f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 7916f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro /* 8016f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * Select a high order element of the multiplicative group Zp* 8116f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * 8216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * p and q must be s.t. p = 2*q + 1, where p and q are prime (see generateSafePrimes) 8316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro */ 8416f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro static BigInteger selectGenerator(BigInteger p, BigInteger q, SecureRandom random) 8516f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro { 8616f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro BigInteger pMinusTwo = p.subtract(TWO); 8716f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro BigInteger g; 8816f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 8916f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro /* 9016f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * (see: Handbook of Applied Cryptography 4.80) 9116f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro */ 9216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro// do 9316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro// { 9416f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro// g = BigIntegers.createRandomInRange(TWO, pMinusTwo, random); 9516f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro// } 9616f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro// while (g.modPow(TWO, p).equals(ONE) || g.modPow(q, p).equals(ONE)); 9716f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 9816f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 9916f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro /* 10016f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro * RFC 2631 2.2.1.2 (and see: Handbook of Applied Cryptography 4.81) 10116f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro */ 10216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro do 10316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro { 10416f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro BigInteger h = BigIntegers.createRandomInRange(TWO, pMinusTwo, random); 10516f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 10616f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro g = h.modPow(TWO, p); 10716f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro } 10816f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro while (g.equals(ONE)); 10916f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 11016f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro 11116f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro return g; 11216f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro } 11316f9ee464b68937f45d009d9c1b0eb9b544a8deeSergio Giro} 114