recover (p, q) given (n, e, d)

[reaperhulk]

The core function is directly adapted from https://github.com/dlitz/pycrypto/blob/7acba5f3a6ff10f1424c309d0d34d2b713233019/lib/Crypto/PublicKey/_slowmath.py#L100, which is public domain.

Fixes #975

[alex]

Note should go after the description IMO.

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: https://jenkins.cryptography.io/job/cryptography-pr-experimental/2861/

[alex]

Should 1000 be extrated into a constant so it's obvious what it means.

[reaperhulk]

Not sure what we should call this. Ideas? It's the base for the candidate number and the value 1000 means we're willing to perform up to 500 iterations (since a += 2 in the loop)

[public]

attempts?

FYI 500 attempts has like a 1 in 1.5 Googol chance of failure.

[reaperhulk]

It does += 2 so 1000 only means 500 attempts. And yeah 2**-500 probability of failure.

[alex]

_MAX_ATTEMPTS or something?

On Sun Jan 18 2015 at 12:08:39 PM Paul Kehrer notifications@github.com
wrote:

In src/cryptography/hazmat/primitives/asymmetric/rsa.py
#1633 (diff):

• """

• See 8.2.2(i) in Handbook of Applied Cryptography.

• ktot = d * e - 1

• The quantity d*e-1 is a multiple of phi(n), even,

• and can be represented as t*2^s.

• t = ktot
• while t % 2 == 0:

•    t = t // 2
  

• Cycle through all multiplicative inverses in Zn.

• The algorithm is non-deterministic, but there is a 50% chance

• any candidate a leads to successful factoring.

• See "Digitalized Signatures and Public Key Functions as Intractable

• as Factorization", M. Rabin, 1979

• spotted = False
• a = 2
• while not spotted and a < 1000:

It does += 2 so 1000 only means 500 attempts. And yeah 2**-500 probability
of failure.

—
Reply to this email directly or view it on GitHub
https://github.com/pyca/cryptography/pull/1633/files#r23134808.

[reaperhulk]

Okay, moved it out and added a comment to explain what it is.

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: https://jenkins.cryptography.io/job/cryptography-pr-experimental/2863/

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: https://jenkins.cryptography.io/job/cryptography-pr-experimental/2866/

[alex]

lgtm, will merge assuming tests+coverage

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: https://jenkins.cryptography.io/job/cryptography-pr-experimental/2870/

[coveralls]

Coverage remained the same when pulling 65637eb on reaperhulk:fix-975 into 2ca4a77 on pyca:master.