cryptoutil

Documentation

Index

• func GenerateRSAKey(randomSource io.Reader, bits int) (*rsa.PrivateKey, error)
• func GenerateRSAKeyWithHMACDRBG(rand io.Reader, bits int) (*rsa.PrivateKey, error)

Functions

func GenerateRSAKey

func GenerateRSAKey(randomSource io.Reader, bits int) (*rsa.PrivateKey, error)

GenerateRSAKey tests whether the random source is rand.Reader, and uses it directly if so (as it will be a platform RNG and fast). If not, we assume it's some other slower source and use the HmacDRBG version.

func GenerateRSAKeyWithHMACDRBG

func GenerateRSAKeyWithHMACDRBG(rand io.Reader, bits int) (*rsa.PrivateKey, error)

GenerateRSAKeyWithHMACDRBG generates an RSA key with a deterministic random bit generator, seeded with entropy from the provided random source. Some random bit sources are quite slow, for example HSMs with true RNGs can take 500ms to produce enough bits to generate a single number to test for primality, taking literally minutes to succeed in generating a key. As an example, when testing this function, one run took 921 attempts to generate a 2048 bit RSA key, which would have taken over 7 minutes on the HSM of the reporting customer.

Instead, this function seeds a DRBG (specifically HMAC-DRBG from NIST SP800-90a) with entropy from a random source, then uses the output of that DRBG to generate candidate primes. This is still secure as the output of a DRBG is secure if the seed is sufficiently random, and an attacker cannot predict which numbers are chosen for primes if they don't have access to the seed. Additionally, the seed in this case is quite large indeed, 512 bits, well above what could be brute forced.

This is a sanctioned approach from FIPS 186-5 (A.1.2)