2
$\begingroup$

In NIST 800-56B publishing, this is done with the $(p, q) = RecoverPrimeFactors (n, e, d)$ function. I don't understand why is necessary if $p$ and $q$ are known during in generation. In my opinion, validation without the RecoverPrimeFactors function checks the required criteria.

$\endgroup$
1
  • $\begingroup$ Possibly the primes are probabilistic so that it is another way to see that they are prime. $\endgroup$ – kelalaka May 6 at 15:52
3
$\begingroup$

I don't understand why is necessary if $p$ and $q$ are known during in generation.

Because rsakpv1-basic may be run by something that's not the key generation process; it is there to allow this second party entity to validate things.

We generally keep $p$ and $q$ in the private key (along with the other CRT parameters); 800-56B is apparently envisioning scenarios where we don't.

$\endgroup$
1
  • 2
    $\begingroup$ Yes. Addition: HSMs often have a function that allows import of an RSA private key. If it's in the basic format $(n,e,d)$, the procedure allows the checks of 6.4.1.2.1, steps 5 and 6 (page 48) which check various conditions on $p$, $q$ deemed important by NIST, and (perhaps more critically) are assumptions in validation of correctness of the implementation of the private key function. Also, in practice, most such implementations use CRT arithmetic, thus need $p$ and $q$ anyway. $\endgroup$ – fgrieu May 6 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.