package org.bouncycastle.crypto.generators;
import java.math.BigInteger;
import java.security.SecureRandom;
import org.bouncycastle.crypto.digests.SHA1Digest;
import org.bouncycastle.crypto.params.DSAParameters;
import org.bouncycastle.crypto.params.DSAValidationParameters;
/**
* generate suitable parameters for DSA, in line with FIPS 186-2.
*/
public class DSAParametersGenerator
{
private int size;
private int certainty;
private SecureRandom random;
private static BigInteger ONE = BigInteger.valueOf(1);
private static BigInteger TWO = BigInteger.valueOf(2);
/**
* initialise the key generator.
*
* @param size size of the key (range 2^512 -> 2^1024 - 64 bit increments)
* @param certainty measure of robustness of prime (for FIPS 186-2 compliance this should be at least 80).
* @param random random byte source.
*/
public void init(
int size,
int certainty,
SecureRandom random)
{
this.size = size;
this.certainty = certainty;
this.random = random;
}
/**
* add value to b, returning the result in a. The a value is treated
* as a BigInteger of length (a.length * 8) bits. The result is
* modulo 2^a.length in case of overflow.
*/
private void add(
byte[] a,
byte[] b,
int value)
{
int x = (b[b.length - 1] & 0xff) + value;
a[b.length - 1] = (byte)x;
x >>>= 8;
for (int i = b.length - 2; i >= 0; i--)
{
x += (b[i] & 0xff);
a[i] = (byte)x;
x >>>= 8;
}
}
/**
* which generates the p and g values from the given parameters,
* returning the DSAParameters object.
* <p>
* Note: can take a while...
*/
public DSAParameters generateParameters()
{
byte[] seed = new byte[20];
byte[] part1 = new byte[20];
byte[] part2 = new byte[20];
byte[] u = new byte[20];
SHA1Digest sha1 = new SHA1Digest();
int n = (size - 1) / 160;
byte[] w = new byte[size / 8];
BigInteger q = null, p = null, g = null;
int counter = 0;
boolean primesFound = false;
while (!primesFound)
{
do
{
random.nextBytes(seed);
sha1.update(seed, 0, seed.length);
sha1.doFinal(part1, 0);
System.arraycopy(seed, 0, part2, 0, seed.length);
add(part2, seed, 1);
sha1.update(part2, 0, part2.length);
sha1.doFinal(part2, 0);
for (int i = 0; i != u.length; i++)
{
u[i] = (byte)(part1[i] ^ part2[i]);
}
u[0] |= (byte)0x80;
u[19] |= (byte)0x01;
q = new BigInteger(1, u);
}
while (!q.isProbablePrime(certainty));
counter = 0;
int offset = 2;
while (counter < 4096)
{
for (int k = 0; k < n; k++)
{
add(part1, seed, offset + k);
sha1.update(part1, 0, part1.length);
sha1.doFinal(part1, 0);
System.arraycopy(part1, 0, w, w.length - (k + 1) * part1.length, part1.length);
}
add(part1, seed, offset + n);
sha1.update(part1, 0, part1.length);
sha1.doFinal(part1, 0);
System.arraycopy(part1, part1.length - ((w.length - (n) * part1.length)), w, 0, w.length - n * part1.length);
w[0] |= (byte)0x80;
BigInteger x = new BigInteger(1, w);
BigInteger c = x.mod(q.multiply(TWO));
p = x.subtract(c.subtract(ONE));
if (p.testBit(size - 1))
{
if (p.isProbablePrime(certainty))
{
primesFound = true;
break;
}
}
counter += 1;
offset += n + 1;
}
}
//
// calculate the generator g
//
BigInteger pMinusOneOverQ = p.subtract(ONE).divide(q);
for (;;)
{
BigInteger h = new BigInteger(size, random);
if (h.compareTo(ONE) <= 0 || h.compareTo(p.subtract(ONE)) >= 0)
{
continue;
}
g = h.modPow(pMinusOneOverQ, p);
if (g.compareTo(ONE) <= 0)
{
continue;
}
break;
}
return new DSAParameters(p, q, g, new DSAValidationParameters(seed, counter));
}
}