xref: /openssl/apps/genrsa.c (revision 556009c5)
1 /*
2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <openssl/opensslconf.h>
11 
12 #include <stdio.h>
13 #include <string.h>
14 #include <sys/types.h>
15 #include <sys/stat.h>
16 #include "apps.h"
17 #include "progs.h"
18 #include <openssl/bio.h>
19 #include <openssl/err.h>
20 #include <openssl/bn.h>
21 #include <openssl/rsa.h>
22 #include <openssl/evp.h>
23 #include <openssl/x509.h>
24 #include <openssl/pem.h>
25 #include <openssl/rand.h>
26 
27 #define DEFBITS 2048
28 #define DEFPRIMES 2
29 
30 static int verbose = 0;
31 
32 typedef enum OPTION_choice {
33     OPT_COMMON,
34 #ifndef OPENSSL_NO_DEPRECATED_3_0
35     OPT_3,
36 #endif
37     OPT_F4, OPT_ENGINE,
38     OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE, OPT_QUIET,
39     OPT_R_ENUM, OPT_PROV_ENUM, OPT_TRADITIONAL
40 } OPTION_CHOICE;
41 
42 const OPTIONS genrsa_options[] = {
43     {OPT_HELP_STR, 1, '-', "Usage: %s [options] numbits\n"},
44 
45     OPT_SECTION("General"),
46     {"help", OPT_HELP, '-', "Display this summary"},
47 #ifndef OPENSSL_NO_ENGINE
48     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
49 #endif
50 
51     OPT_SECTION("Input"),
52 #ifndef OPENSSL_NO_DEPRECATED_3_0
53     {"3", OPT_3, '-', "(deprecated) Use 3 for the E value"},
54 #endif
55     {"F4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
56     {"f4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
57 
58     OPT_SECTION("Output"),
59     {"out", OPT_OUT, '>', "Output the key to specified file"},
60     {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
61     {"primes", OPT_PRIMES, 'p', "Specify number of primes"},
62     {"verbose", OPT_VERBOSE, '-', "Verbose output"},
63     {"quiet", OPT_QUIET, '-', "Terse output"},
64     {"traditional", OPT_TRADITIONAL, '-',
65      "Use traditional format for private keys"},
66     {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
67 
68     OPT_R_OPTIONS,
69     OPT_PROV_OPTIONS,
70 
71     OPT_PARAMETERS(),
72     {"numbits", 0, 0, "Size of key in bits"},
73     {NULL}
74 };
75 
genrsa_main(int argc,char ** argv)76 int genrsa_main(int argc, char **argv)
77 {
78     BN_GENCB *cb = BN_GENCB_new();
79     ENGINE *eng = NULL;
80     BIGNUM *bn = BN_new();
81     BIO *out = NULL;
82     EVP_PKEY *pkey = NULL;
83     EVP_PKEY_CTX *ctx = NULL;
84     EVP_CIPHER *enc = NULL;
85     int ret = 1, num = DEFBITS, private = 0, primes = DEFPRIMES;
86     unsigned long f4 = RSA_F4;
87     char *outfile = NULL, *passoutarg = NULL, *passout = NULL;
88     char *prog, *hexe, *dece, *ciphername = NULL;
89     OPTION_CHOICE o;
90     int traditional = 0;
91 
92     if (bn == NULL || cb == NULL)
93         goto end;
94 
95     opt_set_unknown_name("cipher");
96     prog = opt_init(argc, argv, genrsa_options);
97     while ((o = opt_next()) != OPT_EOF) {
98         switch (o) {
99         case OPT_EOF:
100         case OPT_ERR:
101 opthelp:
102             BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
103             goto end;
104         case OPT_HELP:
105             ret = 0;
106             opt_help(genrsa_options);
107             goto end;
108 #ifndef OPENSSL_NO_DEPRECATED_3_0
109         case OPT_3:
110             f4 = RSA_3;
111             break;
112 #endif
113         case OPT_F4:
114             f4 = RSA_F4;
115             break;
116         case OPT_OUT:
117             outfile = opt_arg();
118             break;
119         case OPT_ENGINE:
120             eng = setup_engine(opt_arg(), 0);
121             break;
122         case OPT_R_CASES:
123             if (!opt_rand(o))
124                 goto end;
125             break;
126         case OPT_PROV_CASES:
127             if (!opt_provider(o))
128                 goto end;
129             break;
130         case OPT_PASSOUT:
131             passoutarg = opt_arg();
132             break;
133         case OPT_CIPHER:
134             ciphername = opt_unknown();
135             break;
136         case OPT_PRIMES:
137             primes = opt_int_arg();
138             break;
139         case OPT_VERBOSE:
140             verbose = 1;
141             break;
142         case OPT_QUIET:
143             verbose = 0;
144             break;
145         case OPT_TRADITIONAL:
146             traditional = 1;
147             break;
148         }
149     }
150 
151     /* One optional argument, the bitsize. */
152     argc = opt_num_rest();
153     argv = opt_rest();
154 
155     if (argc == 1) {
156         if (!opt_int(argv[0], &num) || num <= 0)
157             goto end;
158         if (num > OPENSSL_RSA_MAX_MODULUS_BITS)
159             BIO_printf(bio_err,
160                        "Warning: It is not recommended to use more than %d bit for RSA keys.\n"
161                        "         Your key size is %d! Larger key size may behave not as expected.\n",
162                        OPENSSL_RSA_MAX_MODULUS_BITS, num);
163     } else if (!opt_check_rest_arg(NULL)) {
164         goto opthelp;
165     }
166 
167     if (!app_RAND_load())
168         goto end;
169 
170     private = 1;
171     if (!opt_cipher(ciphername, &enc))
172         goto end;
173     if (!app_passwd(NULL, passoutarg, NULL, &passout)) {
174         BIO_printf(bio_err, "Error getting password\n");
175         goto end;
176     }
177 
178     out = bio_open_owner(outfile, FORMAT_PEM, private);
179     if (out == NULL)
180         goto end;
181 
182     if (!init_gen_str(&ctx, "RSA", eng, 0, app_get0_libctx(),
183                       app_get0_propq()))
184         goto end;
185 
186     if (verbose)
187         EVP_PKEY_CTX_set_cb(ctx, progress_cb);
188     EVP_PKEY_CTX_set_app_data(ctx, bio_err);
189 
190     if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, num) <= 0) {
191         BIO_printf(bio_err, "Error setting RSA length\n");
192         goto end;
193     }
194     if (!BN_set_word(bn, f4)) {
195         BIO_printf(bio_err, "Error allocating RSA public exponent\n");
196         goto end;
197     }
198     if (EVP_PKEY_CTX_set1_rsa_keygen_pubexp(ctx, bn) <= 0) {
199         BIO_printf(bio_err, "Error setting RSA public exponent\n");
200         goto end;
201     }
202     if (EVP_PKEY_CTX_set_rsa_keygen_primes(ctx, primes) <= 0) {
203         BIO_printf(bio_err, "Error setting number of primes\n");
204         goto end;
205     }
206     pkey = app_keygen(ctx, "RSA", num, verbose);
207     if (pkey == NULL)
208         goto end;
209 
210     if (verbose) {
211         BIGNUM *e = NULL;
212 
213         /* Every RSA key has an 'e' */
214         EVP_PKEY_get_bn_param(pkey, "e", &e);
215         if (e == NULL) {
216             BIO_printf(bio_err, "Error cannot access RSA e\n");
217             goto end;
218         }
219         hexe = BN_bn2hex(e);
220         dece = BN_bn2dec(e);
221         if (hexe && dece) {
222             BIO_printf(bio_err, "e is %s (0x%s)\n", dece, hexe);
223         }
224         OPENSSL_free(hexe);
225         OPENSSL_free(dece);
226         BN_free(e);
227     }
228     if (traditional) {
229         if (!PEM_write_bio_PrivateKey_traditional(out, pkey, enc, NULL, 0,
230                                                   NULL, passout))
231             goto end;
232     } else {
233         if (!PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, passout))
234             goto end;
235     }
236 
237     ret = 0;
238  end:
239     BN_free(bn);
240     BN_GENCB_free(cb);
241     EVP_PKEY_CTX_free(ctx);
242     EVP_PKEY_free(pkey);
243     EVP_CIPHER_free(enc);
244     BIO_free_all(out);
245     release_engine(eng);
246     OPENSSL_free(passout);
247     if (ret != 0)
248         ERR_print_errors(bio_err);
249     return ret;
250 }
251 
252