RSA Security 5.2.2 manual Sample

MultiPrime

does not allow you to generate an RSA key pair if the number of primes is more than three. Furthermore, the toolkit will not allow you to generate 3-prime RSA key pairs of less than 1024 bits. In the future, as more research is published, we may adjust these limits and allow you to generate key pairs of more than three primes at more key lengths.

Sample

MultiPrime RSA differs from classic 2-prime RSA in only two areas: key pair generation and the makeup of the private key. Once you generate your key pair, signing and verification is exactly the same as before. It's just that the private key looks different.

In the following example, key pair generation is similar to regular key-pair generation, except you use a different AI and the info passed in is a different struct. Notice that the chooser contains the same AM you used when generating two-prime RSA key pairs.

Once you have the key objects, signing, verifying, encrypting, and decrypting is the same. If you want to save the private key, you can get the key data out of the object using the existing BER KI. If you decoded the BER encoding, you would find three primes instead of two, three prime exponents instead of two, and two CRT coefficients instead of one.

If you set a key object using the BER KI, Crypto-C will recognize whether it is made up of two primes or three, and will build the object appropriately.

There is a new KI that separates the components: KI_PKCS_RSAMultiPrimePrivate. Using this KI, you can see the individual primes without having to bother with the BER encoding.

2 2 0 R S A B S A F E C r y p t o - C D e v e l o p e r ’s G u i d e