src/java.base/share/classes/sun/security/provider/DSAParameterGenerator.java - platform/libcore - Git at Google

 /*
  * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this
  * particular file as subject to the "Classpath" exception as provided
  * by Oracle in the LICENSE file that accompanied this code.
  *
  * This code is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * version 2 for more details (a copy is included in the LICENSE file that
  * accompanied this code).
  *
  * You should have received a copy of the GNU General Public License version
  * 2 along with this work; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  * or visit www.oracle.com if you need additional information or have any
  * questions.
  */

 package sun.security.provider;

 import java.math.BigInteger;
 import java.security.AlgorithmParameterGeneratorSpi;
 import java.security.AlgorithmParameters;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.InvalidParameterException;
 import java.security.MessageDigest;
 import java.security.SecureRandom;
 import java.security.ProviderException;
 import java.security.spec.AlgorithmParameterSpec;
 import java.security.spec.InvalidParameterSpecException;
 import java.security.spec.DSAParameterSpec;
 import java.security.spec.DSAGenParameterSpec;

 import static sun.security.util.SecurityProviderConstants.DEF_DSA_KEY_SIZE;
 import static sun.security.util.SecurityProviderConstants.getDefDSASubprimeSize;


 /**
  * This class generates parameters for the DSA algorithm.
  *
  * @author Jan Luehe
  *
  *
  * @see java.security.AlgorithmParameters
  * @see java.security.spec.AlgorithmParameterSpec
  * @see DSAParameters
  *
  * @since 1.2
  */

 public class DSAParameterGenerator extends AlgorithmParameterGeneratorSpi {

     // the length of prime P, subPrime Q, and seed in bits
     private int valueL = -1;
     private int valueN = -1;
     private int seedLen = -1;

     // the source of randomness
     private SecureRandom random;

     public DSAParameterGenerator() {
     }

     /**
      * Initializes this parameter generator for a certain strength
      * and source of randomness.
      *
      * @param strength the strength (size of prime) in bits
      * @param random the source of randomness
      */
     @Override
     protected void engineInit(int strength, SecureRandom random) {
         if ((strength != 2048) && (strength != 3072) &&
             ((strength < 512) || (strength > 1024) || (strength % 64 != 0))) {
             throw new InvalidParameterException(
                 "Unexpected strength (size of prime): " + strength +
                 ". Prime size should be 512-1024, 2048, or 3072");
         }
         this.valueL = strength;
         this.valueN = getDefDSASubprimeSize(strength);
         this.seedLen = valueN;
         this.random = random;
     }

     /**
      * Initializes this parameter generator with a set of
      * algorithm-specific parameter generation values.
      *
      * @param genParamSpec the set of algorithm-specific parameter
      *        generation values
      * @param random the source of randomness
      *
      * @exception InvalidAlgorithmParameterException if the given parameter
      * generation values are inappropriate for this parameter generator
      */
     @Override
     protected void engineInit(AlgorithmParameterSpec genParamSpec,
             SecureRandom random) throws InvalidAlgorithmParameterException {
         if (!(genParamSpec instanceof DSAGenParameterSpec)) {
             throw new InvalidAlgorithmParameterException("Invalid parameter");
         }
         DSAGenParameterSpec dsaGenParams = (DSAGenParameterSpec)genParamSpec;

         // directly initialize using the already validated values
         this.valueL = dsaGenParams.getPrimePLength();
         this.valueN = dsaGenParams.getSubprimeQLength();
         this.seedLen = dsaGenParams.getSeedLength();
         this.random = random;
     }

     /**
      * Generates the parameters.
      *
      * @return the new AlgorithmParameters object
      */
     @Override
     protected AlgorithmParameters engineGenerateParameters() {
         AlgorithmParameters algParams = null;
         try {
             if (this.random == null) {
                 this.random = new SecureRandom();
             }
             if (valueL == -1) {
                 engineInit(DEF_DSA_KEY_SIZE, this.random);
             }
             BigInteger[] pAndQ = generatePandQ(this.random, valueL,
                                                valueN, seedLen);
             BigInteger paramP = pAndQ[0];
             BigInteger paramQ = pAndQ[1];
             BigInteger paramG = generateG(paramP, paramQ);

             DSAParameterSpec dsaParamSpec =
                 new DSAParameterSpec(paramP, paramQ, paramG);
             algParams = AlgorithmParameters.getInstance("DSA", "SUN");
             algParams.init(dsaParamSpec);
         } catch (InvalidParameterSpecException e) {
             // this should never happen
             throw new RuntimeException(e.getMessage());
         } catch (NoSuchAlgorithmException e) {
             // this should never happen, because we provide it
             throw new RuntimeException(e.getMessage());
         } catch (NoSuchProviderException e) {
             // this should never happen, because we provide it
             throw new RuntimeException(e.getMessage());
         }

         return algParams;
     }

     /*
      * Generates the prime and subprime parameters for DSA,
      * using the provided source of randomness.
      * This method will generate new seeds until a suitable
      * seed has been found.
      *
      * @param random the source of randomness to generate the
      * seed
      * @param valueL the size of <code>p</code>, in bits.
      * @param valueN the size of <code>q</code>, in bits.
      * @param seedLen the length of <code>seed</code>, in bits.
      *
      * @return an array of BigInteger, with <code>p</code> at index 0 and
      * <code>q</code> at index 1, the seed at index 2, and the counter value
      * at index 3.
      */
     private static BigInteger[] generatePandQ(SecureRandom random, int valueL,
                                               int valueN, int seedLen) {
         String hashAlg = null;
         if (valueN == 160) {
             hashAlg = "SHA";
         } else if (valueN == 224) {
             hashAlg = "SHA-224";
         } else if (valueN == 256) {
             hashAlg = "SHA-256";
         }
         MessageDigest hashObj = null;
         try {
             hashObj = MessageDigest.getInstance(hashAlg);
         } catch (NoSuchAlgorithmException nsae) {
             // should never happen
             nsae.printStackTrace();
         }

         /* Step 3, 4: Useful variables */
         int outLen = hashObj.getDigestLength()*8;
         int n = (valueL - 1) / outLen;
         int b = (valueL - 1) % outLen;
         byte[] seedBytes = new byte[seedLen/8];
         BigInteger twoSl = BigInteger.TWO.pow(seedLen);
         int primeCertainty = -1;
         if (valueL <= 1024) {
             primeCertainty = 80;
         } else if (valueL == 2048) {
             primeCertainty = 112;
         } else if (valueL == 3072) {
             primeCertainty = 128;
         }
         if (primeCertainty < 0) {
             throw new ProviderException("Invalid valueL: " + valueL);
         }
         BigInteger resultP, resultQ, seed = null;
         int counter;
         while (true) {
             do {
                 /* Step 5 */
                 random.nextBytes(seedBytes);
                 seed = new BigInteger(1, seedBytes);

                 /* Step 6 */
                 BigInteger U = new BigInteger(1, hashObj.digest(seedBytes)).
                     mod(BigInteger.TWO.pow(valueN - 1));

                 /* Step 7 */
                 resultQ = BigInteger.TWO.pow(valueN - 1)
                             .add(U)
                             .add(BigInteger.ONE)
                             .subtract(U.mod(BigInteger.TWO));
             } while (!resultQ.isProbablePrime(primeCertainty));

             /* Step 10 */
             BigInteger offset = BigInteger.ONE;
             /* Step 11 */
             for (counter = 0; counter < 4*valueL; counter++) {
                 BigInteger[] V = new BigInteger[n + 1];
                 /* Step 11.1 */
                 for (int j = 0; j <= n; j++) {
                     BigInteger J = BigInteger.valueOf(j);
                     BigInteger tmp = (seed.add(offset).add(J)).mod(twoSl);
                     byte[] vjBytes = hashObj.digest(toByteArray(tmp));
                     V[j] = new BigInteger(1, vjBytes);
                 }
                 /* Step 11.2 */
                 BigInteger W = V[0];
                 for (int i = 1; i < n; i++) {
                     W = W.add(V[i].multiply(BigInteger.TWO.pow(i * outLen)));
                 }
                 W = W.add((V[n].mod(BigInteger.TWO.pow(b)))
                                .multiply(BigInteger.TWO.pow(n * outLen)));
                 /* Step 11.3 */
                 BigInteger twoLm1 = BigInteger.TWO.pow(valueL - 1);
                 BigInteger X = W.add(twoLm1);
                 /* Step 11.4, 11.5 */
                 BigInteger c = X.mod(resultQ.multiply(BigInteger.TWO));
                 resultP = X.subtract(c.subtract(BigInteger.ONE));
                 /* Step 11.6, 11.7 */
                 if (resultP.compareTo(twoLm1) > -1
                     && resultP.isProbablePrime(primeCertainty)) {
                     /* Step 11.8 */
                     BigInteger[] result = {resultP, resultQ, seed,
                                            BigInteger.valueOf(counter)};
                     return result;
                 }
                 /* Step 11.9 */
                 offset = offset.add(BigInteger.valueOf(n)).add(BigInteger.ONE);
              }
         }

     }

     /*
      * Generates the <code>g</code> parameter for DSA.
      *
      * @param p the prime, <code>p</code>.
      * @param q the subprime, <code>q</code>.
      *
      * @param the <code>g</code>
      */
     private static BigInteger generateG(BigInteger p, BigInteger q) {
         BigInteger h = BigInteger.ONE;
         /* Step 1 */
         BigInteger pMinusOneOverQ = (p.subtract(BigInteger.ONE)).divide(q);
         BigInteger resultG = BigInteger.ONE;
         while (resultG.compareTo(BigInteger.TWO) < 0) {
             /* Step 3 */
             resultG = h.modPow(pMinusOneOverQ, p);
             h = h.add(BigInteger.ONE);
         }
         return resultG;
     }

     /*
      * Converts the result of a BigInteger.toByteArray call to an exact
      * signed magnitude representation for any positive number.
      */
     private static byte[] toByteArray(BigInteger bigInt) {
         byte[] result = bigInt.toByteArray();
         if (result[0] == 0) {
             byte[] tmp = new byte[result.length - 1];
             System.arraycopy(result, 1, tmp, 0, tmp.length);
             result = tmp;
         }
         return result;
     }
 }
	/*
	* Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package sun.security.provider;

	import java.math.BigInteger;
	import java.security.AlgorithmParameterGeneratorSpi;
	import java.security.AlgorithmParameters;
	import java.security.InvalidAlgorithmParameterException;
	import java.security.NoSuchAlgorithmException;
	import java.security.NoSuchProviderException;
	import java.security.InvalidParameterException;
	import java.security.MessageDigest;
	import java.security.SecureRandom;
	import java.security.ProviderException;
	import java.security.spec.AlgorithmParameterSpec;
	import java.security.spec.InvalidParameterSpecException;
	import java.security.spec.DSAParameterSpec;
	import java.security.spec.DSAGenParameterSpec;

	import static sun.security.util.SecurityProviderConstants.DEF_DSA_KEY_SIZE;
	import static sun.security.util.SecurityProviderConstants.getDefDSASubprimeSize;


	/**
	* This class generates parameters for the DSA algorithm.
	*
	* @author Jan Luehe
	*
	*
	* @see java.security.AlgorithmParameters
	* @see java.security.spec.AlgorithmParameterSpec
	* @see DSAParameters
	*
	* @since 1.2
	*/

	public class DSAParameterGenerator extends AlgorithmParameterGeneratorSpi {

	// the length of prime P, subPrime Q, and seed in bits
	private int valueL = -1;
	private int valueN = -1;
	private int seedLen = -1;

	// the source of randomness
	private SecureRandom random;

	public DSAParameterGenerator() {
	}

	/**
	* Initializes this parameter generator for a certain strength
	* and source of randomness.
	*
	* @param strength the strength (size of prime) in bits
	* @param random the source of randomness
	*/
	@Override
	protected void engineInit(int strength, SecureRandom random) {
	if ((strength != 2048) && (strength != 3072) &&
	((strength < 512) \|\| (strength > 1024) \|\| (strength % 64 != 0))) {
	throw new InvalidParameterException(
	"Unexpected strength (size of prime): " + strength +
	". Prime size should be 512-1024, 2048, or 3072");
	}
	this.valueL = strength;
	this.valueN = getDefDSASubprimeSize(strength);
	this.seedLen = valueN;
	this.random = random;
	}

	/**
	* Initializes this parameter generator with a set of
	* algorithm-specific parameter generation values.
	*
	* @param genParamSpec the set of algorithm-specific parameter
	* generation values
	* @param random the source of randomness
	*
	* @exception InvalidAlgorithmParameterException if the given parameter
	* generation values are inappropriate for this parameter generator
	*/
	@Override
	protected void engineInit(AlgorithmParameterSpec genParamSpec,
	SecureRandom random) throws InvalidAlgorithmParameterException {
	if (!(genParamSpec instanceof DSAGenParameterSpec)) {
	throw new InvalidAlgorithmParameterException("Invalid parameter");
	}
	DSAGenParameterSpec dsaGenParams = (DSAGenParameterSpec)genParamSpec;

	// directly initialize using the already validated values
	this.valueL = dsaGenParams.getPrimePLength();
	this.valueN = dsaGenParams.getSubprimeQLength();
	this.seedLen = dsaGenParams.getSeedLength();
	this.random = random;
	}

	/**
	* Generates the parameters.
	*
	* @return the new AlgorithmParameters object
	*/
	@Override
	protected AlgorithmParameters engineGenerateParameters() {
	AlgorithmParameters algParams = null;
	try {
	if (this.random == null) {
	this.random = new SecureRandom();
	}
	if (valueL == -1) {
	engineInit(DEF_DSA_KEY_SIZE, this.random);
	}
	BigInteger[] pAndQ = generatePandQ(this.random, valueL,
	valueN, seedLen);
	BigInteger paramP = pAndQ[0];
	BigInteger paramQ = pAndQ[1];
	BigInteger paramG = generateG(paramP, paramQ);

	DSAParameterSpec dsaParamSpec =
	new DSAParameterSpec(paramP, paramQ, paramG);
	algParams = AlgorithmParameters.getInstance("DSA", "SUN");
	algParams.init(dsaParamSpec);
	} catch (InvalidParameterSpecException e) {
	// this should never happen
	throw new RuntimeException(e.getMessage());
	} catch (NoSuchAlgorithmException e) {
	// this should never happen, because we provide it
	throw new RuntimeException(e.getMessage());
	} catch (NoSuchProviderException e) {
	// this should never happen, because we provide it
	throw new RuntimeException(e.getMessage());
	}

	return algParams;
	}

	/*
	* Generates the prime and subprime parameters for DSA,
	* using the provided source of randomness.
	* This method will generate new seeds until a suitable
	* seed has been found.
	*
	* @param random the source of randomness to generate the
	* seed
	* @param valueL the size of <code>p</code>, in bits.
	* @param valueN the size of <code>q</code>, in bits.
	* @param seedLen the length of <code>seed</code>, in bits.
	*
	* @return an array of BigInteger, with <code>p</code> at index 0 and
	* <code>q</code> at index 1, the seed at index 2, and the counter value
	* at index 3.
	*/
	private static BigInteger[] generatePandQ(SecureRandom random, int valueL,
	int valueN, int seedLen) {
	String hashAlg = null;
	if (valueN == 160) {
	hashAlg = "SHA";
	} else if (valueN == 224) {
	hashAlg = "SHA-224";
	} else if (valueN == 256) {
	hashAlg = "SHA-256";
	}
	MessageDigest hashObj = null;
	try {
	hashObj = MessageDigest.getInstance(hashAlg);
	} catch (NoSuchAlgorithmException nsae) {
	// should never happen
	nsae.printStackTrace();
	}

	/* Step 3, 4: Useful variables */
	int outLen = hashObj.getDigestLength()*8;
	int n = (valueL - 1) / outLen;
	int b = (valueL - 1) % outLen;
	byte[] seedBytes = new byte[seedLen/8];
	BigInteger twoSl = BigInteger.TWO.pow(seedLen);
	int primeCertainty = -1;
	if (valueL <= 1024) {
	primeCertainty = 80;
	} else if (valueL == 2048) {
	primeCertainty = 112;
	} else if (valueL == 3072) {
	primeCertainty = 128;
	}
	if (primeCertainty < 0) {
	throw new ProviderException("Invalid valueL: " + valueL);
	}
	BigInteger resultP, resultQ, seed = null;
	int counter;
	while (true) {
	do {
	/* Step 5 */
	random.nextBytes(seedBytes);
	seed = new BigInteger(1, seedBytes);

	/* Step 6 */
	BigInteger U = new BigInteger(1, hashObj.digest(seedBytes)).
	mod(BigInteger.TWO.pow(valueN - 1));

	/* Step 7 */
	resultQ = BigInteger.TWO.pow(valueN - 1)
	.add(U)
	.add(BigInteger.ONE)
	.subtract(U.mod(BigInteger.TWO));
	} while (!resultQ.isProbablePrime(primeCertainty));

	/* Step 10 */
	BigInteger offset = BigInteger.ONE;
	/* Step 11 */
	for (counter = 0; counter < 4*valueL; counter++) {
	BigInteger[] V = new BigInteger[n + 1];
	/* Step 11.1 */
	for (int j = 0; j <= n; j++) {
	BigInteger J = BigInteger.valueOf(j);
	BigInteger tmp = (seed.add(offset).add(J)).mod(twoSl);
	byte[] vjBytes = hashObj.digest(toByteArray(tmp));
	V[j] = new BigInteger(1, vjBytes);
	}
	/* Step 11.2 */
	BigInteger W = V[0];
	for (int i = 1; i < n; i++) {
	W = W.add(V[i].multiply(BigInteger.TWO.pow(i * outLen)));
	}
	W = W.add((V[n].mod(BigInteger.TWO.pow(b)))
	.multiply(BigInteger.TWO.pow(n * outLen)));
	/* Step 11.3 */
	BigInteger twoLm1 = BigInteger.TWO.pow(valueL - 1);
	BigInteger X = W.add(twoLm1);
	/* Step 11.4, 11.5 */
	BigInteger c = X.mod(resultQ.multiply(BigInteger.TWO));
	resultP = X.subtract(c.subtract(BigInteger.ONE));
	/* Step 11.6, 11.7 */
	if (resultP.compareTo(twoLm1) > -1
	&& resultP.isProbablePrime(primeCertainty)) {
	/* Step 11.8 */
	BigInteger[] result = {resultP, resultQ, seed,
	BigInteger.valueOf(counter)};
	return result;
	}
	/* Step 11.9 */
	offset = offset.add(BigInteger.valueOf(n)).add(BigInteger.ONE);
	}
	}

	}

	/*
	* Generates the <code>g</code> parameter for DSA.
	*
	* @param p the prime, <code>p</code>.
	* @param q the subprime, <code>q</code>.
	*
	* @param the <code>g</code>
	*/
	private static BigInteger generateG(BigInteger p, BigInteger q) {
	BigInteger h = BigInteger.ONE;
	/* Step 1 */
	BigInteger pMinusOneOverQ = (p.subtract(BigInteger.ONE)).divide(q);
	BigInteger resultG = BigInteger.ONE;
	while (resultG.compareTo(BigInteger.TWO) < 0) {
	/* Step 3 */
	resultG = h.modPow(pMinusOneOverQ, p);
	h = h.add(BigInteger.ONE);
	}
	return resultG;
	}

	/*
	* Converts the result of a BigInteger.toByteArray call to an exact
	* signed magnitude representation for any positive number.
	*/
	private static byte[] toByteArray(BigInteger bigInt) {
	byte[] result = bigInt.toByteArray();
	if (result[0] == 0) {
	byte[] tmp = new byte[result.length - 1];
	System.arraycopy(result, 1, tmp, 0, tmp.length);
	result = tmp;
	}
	return result;
	}
	}