In NIST 800-56B publishing, this is done with the $(p, q) = RecoverPrimeFactors (n, e, d)$ function. I don't understand why is necessary if $p$ and $q$ are known during in generation. In my opinion, validation without the RecoverPrimeFactors function checks the required criteria.
$\begingroup$
$\endgroup$
1
-
$\begingroup$ Possibly the primes are probabilistic so that it is another way to see that they are prime. $\endgroup$– kelalakaMay 6, 2021 at 15:52
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
I don't understand why is necessary if $p$ and $q$ are known during in generation.
Because rsakpv1-basic may be run by something that's not the key generation process; it is there to allow this second party entity to validate things.
We generally keep $p$ and $q$ in the private key (along with the other CRT parameters); 800-56B is apparently envisioning scenarios where we don't.
-
2$\begingroup$ Yes. Addition: HSMs often have a function that allows import of an RSA private key. If it's in the basic format $(n,e,d)$, the procedure allows the checks of 6.4.1.2.1, steps 5 and 6 (page 48) which check various conditions on $p$, $q$ deemed important by NIST, and (perhaps more critically) are assumptions in validation of correctness of the implementation of the private key function. Also, in practice, most such implementations use CRT arithmetic, thus need $p$ and $q$ anyway. $\endgroup$– fgrieu ♦May 6, 2021 at 16:56