From cda64b65166cef5a4ac61f764164718ea8c2a191 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Mon, 18 Jan 2021 23:03:58 -0800
Subject: [PATCH] crypto: add randomPrime/randomPrimeSync/checkPrime

APIs for generating and checking pseudo-random primes

Signed-off-by: James M Snell <jasnell@gmail.com>
---
 doc/api/crypto.md                  |  65 ++++++++++++
 lib/crypto.js                      |   6 ++
 lib/internal/crypto/random.js      | 117 ++++++++++++++++++++
 src/crypto/crypto_random.cc        | 120 +++++++++++++++++++++
 src/crypto/crypto_random.h         |  37 +++++++
 src/crypto/crypto_util.h           |   2 +
 test/parallel/test-crypto-prime.js | 164 +++++++++++++++++++++++++++++
 7 files changed, 511 insertions(+)
 create mode 100644 test/parallel/test-crypto-prime.js

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index e43f3fa5dafc43..b731d8cfabe7ce 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -1961,6 +1961,25 @@ is currently in use. Setting to true requires a FIPS build of Node.js.
 This property is deprecated. Please use `crypto.setFips()` and
 `crypto.getFips()` instead.
 
+### `crypto.checkPrime(candidate[, options])`
+<!-- YAML
+added: REPLACEME
+-->
+
+* `candidate` {ArrayBuffer|SharedArrayBuffer|TypedArray|Buffer|DataView} A
+  possible prime encoded as a sequence of big endian octets of arbitrary
+  length.
+* `options` {Object}
+  * `checks` {number} The number of primality checks to perform.
+    **Defaults**: `1`
+  * `fast` {boolean} `true` to use the fast check algorithm.
+  * `trialDivision` {boolean} When using the fast check algorithm, `true`
+    to enable trial division.
+* Returns: {boolean} `true` if the number is prime with an error probability
+  less than `0.25^options.checks`.
+
+Checks the primality of the `candidate`.
+
 ### `crypto.createCipher(algorithm, password[, options])`
 <!-- YAML
 added: v0.1.94
@@ -3432,6 +3451,52 @@ const n = crypto.randomInt(1, 7);
 console.log(`The dice rolled: ${n}`);
 ```
 
+### `crypto.randomPrime(size[, options[, callback]])`
+<!-- YAML
+added: REPLACEME
+-->
+
+* `size` {number} The size (in bytes) of the prime to generate.
+* `options` {Object}
+  * `add` {ArrayBuffer|SharedArrayBuffer|TypedArray|Buffer|DataView}
+  * `rem` {ArrayBuffer|SharedArrayBuffer|TypedArray|Buffer|DataView}
+  * `safe` {boolean}
+* `callback` {Function}
+  * `err` {Error}
+  * `prime` {ArrayBuffer}
+
+Generates a pseudo-random prime of `size` bytes.
+
+If `options.safe` is true, the prime will be a safe prime -- that is,
+prime - 1 / 2 will also be a prime.
+
+If `options.add` and `options.rem` are set, the prime will satisfy the
+condition that prime % add = rem.
+
+The prime is encoded as a big-endian sequence of octets in an {ArrayBuffer}.
+
+### `crypto.randomPrimeSync(size[, options])`
+<!-- YAML
+added: REPLACEME
+-->
+
+* `size` {number} The size (in bytes) of the prime to generate.
+* `options` {Object}
+  * `add` {ArrayBuffer|SharedArrayBuffer|TypedArray|Buffer|DataView}
+  * `rem` {ArrayBuffer|SharedArrayBuffer|TypedArray|Buffer|DataView}
+  * `safe` {boolean}
+* Returns: {ArrayBuffer}
+
+Generates a pseudo-random prime of `size` bytes.
+
+If `options.safe` is true, the prime will be a safe prime -- that is,
+prime - 1 / 2 will also be a prime.
+
+If `options.add` and `options.rem` are set, the prime will satisfy the
+condition that prime % add = rem.
+
+The prime is encoded as a big-endian sequence of octets in an {ArrayBuffer}.
+
 ### `crypto.randomUUID([options])`
 <!-- YAML
 added: v15.6.0
diff --git a/lib/crypto.js b/lib/crypto.js
index de21ef76f9ad94..ab4ff1add2fd79 100644
--- a/lib/crypto.js
+++ b/lib/crypto.js
@@ -50,10 +50,13 @@ const {
   timingSafeEqual,
 } = internalBinding('crypto');
 const {
+  checkPrime,
   randomBytes,
   randomFill,
   randomFillSync,
   randomInt,
+  randomPrime,
+  randomPrimeSync,
   randomUUID,
 } = require('internal/crypto/random');
 const {
@@ -170,6 +173,7 @@ function createVerify(algorithm, options) {
 
 module.exports = {
   // Methods
+  checkPrime,
   createCipheriv,
   createDecipheriv,
   createDiffieHellman,
@@ -204,6 +208,8 @@ module.exports = {
   randomFill,
   randomFillSync,
   randomInt,
+  randomPrime,
+  randomPrimeSync,
   randomUUID,
   scrypt,
   scryptSync,
diff --git a/lib/internal/crypto/random.js b/lib/internal/crypto/random.js
index 3a11a74648ff05..de2185d0a59437 100644
--- a/lib/internal/crypto/random.js
+++ b/lib/internal/crypto/random.js
@@ -10,9 +10,11 @@ const {
 
 const {
   RandomBytesJob,
+  RandomPrimeJob,
   kCryptoJobAsync,
   kCryptoJobSync,
   secureBuffer,
+  checkPrime: _checkPrime,
 } = internalBinding('crypto');
 
 const {
@@ -34,6 +36,7 @@ const {
   validateBoolean,
   validateCallback,
   validateObject,
+  validateUint32,
 } = require('internal/validators');
 
 const {
@@ -387,11 +390,125 @@ function randomUUID(options) {
   return uuid.latin1Slice(0, 36);
 }
 
+function randomPrime(size, options, callback) {
+  validateUint32(size, 'size', true);
+  if (typeof options === 'function') {
+    callback = options;
+    options = {};
+  }
+  validateCallback(callback);
+  validateObject(options, 'options');
+  const {
+    safe = false,
+    add,
+    rem,
+  } = options;
+  validateBoolean(safe, 'options.safe');
+
+  if (add !== undefined && !isAnyArrayBuffer(add) && !isArrayBufferView(add)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.add',
+      [
+        'ArrayBuffer',
+        'TypedArray',
+        'Buffer',
+        'DataView'
+      ],
+      add);
+  }
+
+  if (rem !== undefined && !isAnyArrayBuffer(rem) && !isArrayBufferView(rem)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.rem',
+      [
+        'ArrayBuffer',
+        'TypedArray',
+        'Buffer',
+        'DataView'
+      ],
+      rem);
+  }
+
+  const job = new RandomPrimeJob(kCryptoJobAsync, size, safe, add, rem);
+  job.ondone = callback;
+  job.run();
+}
+
+function randomPrimeSync(size, options = {}) {
+  validateUint32(size, 'size', true);
+  validateObject(options, 'options');
+  const {
+    safe = false,
+    add,
+    rem,
+  } = options;
+  validateBoolean(safe, 'options.safe');
+
+  if (add !== undefined && !isAnyArrayBuffer(add) && !isArrayBufferView(add)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.add',
+      [
+        'ArrayBuffer',
+        'TypedArray',
+        'Buffer',
+        'DataView'
+      ],
+      add);
+  }
+
+  if (rem !== undefined && !isAnyArrayBuffer(rem) && !isArrayBufferView(rem)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.rem',
+      [
+        'ArrayBuffer',
+        'TypedArray',
+        'Buffer',
+        'DataView'
+      ],
+      rem);
+  }
+
+  const job = new RandomPrimeJob(kCryptoJobSync, size, safe, add, rem);
+  const [err, prime] = job.run();
+  if (err)
+    throw err;
+
+  return prime;
+}
+
+function checkPrime(candidate, options = {}) {
+  if (!isAnyArrayBuffer(candidate) && !isArrayBufferView(candidate)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'candidate',
+      [
+        'ArrayBuffer',
+        'TypedArray',
+        'Buffer',
+        'DataView'
+      ],
+      candidate
+    );
+  }
+  validateObject(options, 'options');
+  const {
+    fast = false,
+    checks = 1,
+    trialDivision = false
+  } = options;
+  validateBoolean(fast, 'options.fast');
+  validateBoolean(trialDivision, 'options.trialDivision');
+  validateUint32(checks, 'options.checks', true);
+  return _checkPrime(candidate, fast, checks, trialDivision);
+}
+
 module.exports = {
+  checkPrime,
   randomBytes,
   randomFill,
   randomFillSync,
   randomInt,
   getRandomValues,
   randomUUID,
+  randomPrime,
+  randomPrimeSync,
 };
diff --git a/src/crypto/crypto_random.cc b/src/crypto/crypto_random.cc
index bad2edfed3062e..861c78c20b4d7f 100644
--- a/src/crypto/crypto_random.cc
+++ b/src/crypto/crypto_random.cc
@@ -7,8 +7,12 @@
 #include "threadpoolwork-inl.h"
 #include "v8.h"
 
+#include <openssl/bn.h>
+
 namespace node {
 
+using v8::ArrayBuffer;
+using v8::BackingStore;
 using v8::FunctionCallbackInfo;
 using v8::Just;
 using v8::Local;
@@ -64,9 +68,125 @@ bool RandomBytesTraits::DeriveBits(
   return RAND_bytes(params.buffer, params.size) != 0;
 }
 
+void RandomPrimeConfig::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("prime", prime ? bits * 8 : 0);
+}
+
+Maybe<bool> RandomPrimeTraits::EncodeOutput(
+    Environment* env,
+    const RandomPrimeConfig& params,
+    ByteSource* unused,
+    v8::Local<v8::Value>* result) {
+  size_t size = BN_num_bytes(params.prime.get());
+  std::shared_ptr<BackingStore> store =
+      ArrayBuffer::NewBackingStore(env->isolate(), size);
+  BN_bn2binpad(
+      params.prime.get(),
+      reinterpret_cast<unsigned char*>(store->Data()),
+      size);
+  *result = ArrayBuffer::New(env->isolate(), store);
+  return Just(true);
+}
+
+Maybe<bool> RandomPrimeTraits::AdditionalConfig(
+    CryptoJobMode mode,
+    const FunctionCallbackInfo<Value>& args,
+    unsigned int offset,
+    RandomPrimeConfig* params) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args[offset]->IsUint32());  // Size
+  CHECK(args[offset + 1]->IsBoolean());  // Safe
+
+  const uint32_t size = args[offset].As<Uint32>()->Value();
+  bool safe = args[offset + 1]->IsTrue();
+
+  if (!args[offset + 2]->IsUndefined()) {
+    params->add.reset(BN_new());
+    ArrayBufferOrViewContents<unsigned char> add(args[offset + 2]);
+    BN_bin2bn(add.data(), add.size(), params->add.get());
+    if (!params->add) {
+      THROW_ERR_INVALID_ARG_VALUE(env, "invalid options.add");
+      return Nothing<bool>();
+    }
+  }
+
+  if (!args[offset + 3]->IsUndefined()) {
+    params->rem.reset(BN_new());
+    ArrayBufferOrViewContents<unsigned char> rem(args[offset + 3]);
+    BN_bin2bn(rem.data(), rem.size(), params->rem.get());
+    if (!params->rem) {
+      THROW_ERR_INVALID_ARG_VALUE(env, "invalid options.rem");
+      return Nothing<bool>();
+    }
+  }
+
+  int bits = static_cast<int>(size * 8);
+  if (bits < 0) {
+    THROW_ERR_OUT_OF_RANGE(env, "invalid size");
+    return Nothing<bool>();
+  }
+
+  params->bits = bits;
+  params->safe = safe;
+  params->prime.reset(BN_new());
+
+  return Just(true);
+}
+
+bool RandomPrimeTraits::DeriveBits(
+    Environment* env,
+    const RandomPrimeConfig& params,
+    ByteSource* unused) {
+
+  CheckEntropy();
+
+  if (BN_generate_prime_ex(
+          params.prime.get(),
+          params.bits,
+          params.safe ? 1 : 0,
+          params.add.get(),
+          params.rem.get(),
+          nullptr) == 0) {
+    return false;
+  }
+
+  return true;
+}
+
+void CheckPrime(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  ArrayBufferOrViewContents<unsigned char> candidate(args[0]);
+  bool fast = args[1]->IsTrue();
+  int checks = static_cast<int>(args[2].As<Uint32>()->Value());
+  CHECK_GE(checks, 1);
+  bool trial_division = args[3]->IsTrue();
+
+  BignumCtxPointer ctx(BN_CTX_new());
+  BignumPointer check(BN_bin2bn(candidate.data(), candidate.size(), nullptr));
+
+  int ret = fast
+      ? BN_is_prime_fasttest_ex(
+            check.get(),
+            checks,
+            ctx.get(),
+            trial_division ? 1 : 0,
+            nullptr)
+      : BN_is_prime_ex(check.get(), checks, ctx.get(), nullptr);
+  switch (ret) {
+    case -1:
+      return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Error checking the prime");
+    case 0:
+      return args.GetReturnValue().Set(false);
+    default:
+      return args.GetReturnValue().Set(true);
+  }
+}
+
 namespace Random {
 void Initialize(Environment* env, Local<Object> target) {
   RandomBytesJob::Initialize(env, target);
+  RandomPrimeJob::Initialize(env, target);
+  env->SetMethod(target, "checkPrime", CheckPrime);
 }
 }  // namespace Random
 }  // namespace crypto
diff --git a/src/crypto/crypto_random.h b/src/crypto/crypto_random.h
index b9171c83d33e21..108dde8b3640d2 100644
--- a/src/crypto/crypto_random.h
+++ b/src/crypto/crypto_random.h
@@ -47,6 +47,43 @@ struct RandomBytesTraits final {
 
 using RandomBytesJob = DeriveBitsJob<RandomBytesTraits>;
 
+struct RandomPrimeConfig final : public MemoryRetainer {
+  BignumPointer prime;
+  BignumPointer rem;
+  BignumPointer add;
+  int bits;
+  bool safe;
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(RandomPrimeConfig);
+  SET_SELF_SIZE(RandomPrimeConfig);
+};
+
+struct RandomPrimeTraits final {
+  using AdditionalParameters = RandomPrimeConfig;
+  static constexpr const char* JobName = "RandomPrimeJob";
+  static constexpr AsyncWrap::ProviderType Provider =
+      AsyncWrap::PROVIDER_RANDOMBYTESREQUEST;
+
+  static v8::Maybe<bool> AdditionalConfig(
+      CryptoJobMode mode,
+      const v8::FunctionCallbackInfo<v8::Value>& args,
+      unsigned int offset,
+      RandomPrimeConfig* params);
+
+  static bool DeriveBits(
+      Environment* env,
+      const RandomPrimeConfig& params,
+      ByteSource* out_);
+
+  static v8::Maybe<bool> EncodeOutput(
+      Environment* env,
+      const RandomPrimeConfig& params,
+      ByteSource* unused,
+      v8::Local<v8::Value>* result);
+};
+
+using RandomPrimeJob = DeriveBitsJob<RandomPrimeTraits>;
+
 namespace Random {
 void Initialize(Environment* env, v8::Local<v8::Object> target);
 }  // namespace Random
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index 3f245910ed83d1..7e6e4c02b4992c 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -59,6 +59,7 @@ using EVPMDPointer = DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free>;
 using RSAPointer = DeleteFnPtr<RSA, RSA_free>;
 using ECPointer = DeleteFnPtr<EC_KEY, EC_KEY_free>;
 using BignumPointer = DeleteFnPtr<BIGNUM, BN_free>;
+using BignumCtxPointer = DeleteFnPtr<BN_CTX, BN_CTX_free>;
 using NetscapeSPKIPointer = DeleteFnPtr<NETSCAPE_SPKI, NETSCAPE_SPKI_free>;
 using ECGroupPointer = DeleteFnPtr<EC_GROUP, EC_GROUP_free>;
 using ECPointPointer = DeleteFnPtr<EC_POINT, EC_POINT_free>;
@@ -648,6 +649,7 @@ std::vector<T> CopyBuffer(v8::Local<v8::Value> buf) {
 v8::MaybeLocal<v8::Value> EncodeBignum(
     Environment* env,
     const BIGNUM* bn,
+    int size,
     v8::Local<v8::Value>* error);
 
 v8::Maybe<bool> SetEncodedValue(
diff --git a/test/parallel/test-crypto-prime.js b/test/parallel/test-crypto-prime.js
new file mode 100644
index 00000000000000..6bc03453ffdeec
--- /dev/null
+++ b/test/parallel/test-crypto-prime.js
@@ -0,0 +1,164 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+
+const {
+  randomPrime,
+  randomPrimeSync,
+  checkPrime,
+} = require('crypto');
+
+['hello', false, {}, []].forEach((i) => {
+  assert.throws(() => randomPrime(i), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => randomPrimeSync(i), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+});
+
+['hello', false, 123].forEach((i) => {
+  assert.throws(() => randomPrime(10, i, common.mustNotCall()), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => randomPrimeSync(10, i), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+});
+
+['hello', false, 123].forEach((i) => {
+  assert.throws(() => randomPrime(10, {}), {
+    code: 'ERR_INVALID_CALLBACK'
+  });
+});
+
+[-1, 0].forEach((i) => {
+  assert.throws(() => randomPrime(i, common.mustNotCall()), {
+    code: 'ERR_OUT_OF_RANGE'
+  });
+  assert.throws(() => randomPrimeSync(i), {
+    code: 'ERR_OUT_OF_RANGE'
+  });
+});
+
+['test', -1, {}, []].forEach((i) => {
+  assert.throws(() => randomPrime(1, { safe: i }, common.mustNotCall()), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => randomPrime(1, { rem: i }, common.mustNotCall()), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => randomPrime(1, { add: i }, common.mustNotCall()), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => randomPrimeSync(1, { safe: i }), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => randomPrimeSync(1, { rem: i }), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => randomPrimeSync(1, { add: i }), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+});
+
+randomPrime(10, common.mustSucceed((prime) => {
+  assert(checkPrime(prime));
+}));
+
+assert(checkPrime(randomPrimeSync(10)));
+
+randomPrime(10, {}, common.mustSucceed((prime) => {
+  assert(checkPrime(prime));
+}));
+
+assert(checkPrime(randomPrimeSync(10, {})));
+
+randomPrime(4, { safe: true }, common.mustSucceed((prime) => {
+  assert(checkPrime(prime));
+  const buf = Buffer.from(prime);
+  const val = buf.readUInt32BE();
+  const check = (val - 1) / 2;
+  buf.writeUInt32BE(check);
+  assert(checkPrime(buf));
+}));
+
+{
+  const prime = randomPrimeSync(4, { safe: true });
+  assert(checkPrime(prime));
+  const buf = Buffer.from(prime);
+  const val = buf.readUInt32BE();
+  const check = (val - 1) / 2;
+  buf.writeUInt32BE(check);
+  assert(checkPrime(buf));
+}
+
+const add = 12;
+const rem = 11;
+const add_buf = Buffer.alloc(4);
+const rem_buf = Buffer.alloc(4);
+add_buf.writeUInt32BE(add);
+rem_buf.writeUInt32BE(rem);
+randomPrime(
+  4,
+  { add: add_buf, rem: rem_buf },
+  common.mustSucceed((prime) => {
+    assert(checkPrime(prime));
+    const buf = Buffer.from(prime);
+    const val = buf.readUInt32BE();
+    assert.strictEqual(val % add, rem);
+  }));
+
+{
+  const prime = randomPrimeSync(4, { add: add_buf, rem: rem_buf });
+  assert(checkPrime(prime));
+  const buf = Buffer.from(prime);
+  const val = buf.readUInt32BE();
+  assert.strictEqual(val % add, rem);
+}
+
+[1, 'hello', {}, []].forEach((i) => {
+  assert.throws(() => checkPrime(i), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+});
+
+['hello', {}, []].forEach((i) => {
+  assert.throws(() => checkPrime(2, { fast: i }), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => checkPrime(2, { checks: i }), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+  assert.throws(() => checkPrime(2, { trialDivision: 1 }), {
+    code: 'ERR_INVALID_ARG_TYPE'
+  });
+});
+
+assert(!checkPrime(Buffer.from([0x1])));
+assert(checkPrime(Buffer.from([0x2])));
+assert(checkPrime(Buffer.from([0x3])));
+assert(!checkPrime(Buffer.from([0x4])));
+
+assert(!checkPrime(Buffer.from([0x1]), { fast: true }));
+assert(checkPrime(Buffer.from([0x2]), { fast: true }));
+assert(checkPrime(Buffer.from([0x3]), { fast: true }));
+assert(!checkPrime(Buffer.from([0x4]), { fast: true }));
+
+assert(!checkPrime(Buffer.from([0x1]), { fast: true, trialDivision: true }));
+assert(checkPrime(Buffer.from([0x2]), { fast: true, trialDivision: true }));
+assert(checkPrime(Buffer.from([0x3]), { fast: true, trialDivision: true }));
+assert(!checkPrime(Buffer.from([0x4]), { fast: true, trialDivision: true }));
+
+assert(
+  !checkPrime(
+    Buffer.from([0x1]),
+    {
+      fast: true,
+      trialDivision: true,
+      checks: 10
+    }));