MultiPrime
220 RSA BSAFE Crypto-C Developer’s Guide
does not allow you to generate an RSA key pair if the number of primes is more than
three. Furthermore, the toolkit will not allow you to generate 3-prime RSA key pairs
of less than 1024 bits. In the future, as more research is published, we may adjust these
limits and allow you to generate key pairs of more than three primes at more key
lengths.
Sample
MultiPrime RSA differs from classic 2-prime RSA in only two areas: key pair
generation and the makeup of the private key. Once you generate your key pair,
signing and verification is exactly the same as before. It's just that the private key
looks different.
In the following example, key pair generation is similar to regular key-pair
generation, except you use a different AI and the info passed in is a different struct.
Notice that the chooser contains the same AM you used when generating two-prime
RSA key pairs.
Once you have the key objects, signing, verifying, encrypting, and decrypting is the
same. If you want to save the private key, you can get the key data out of the object
using the existing BER KI. If you decoded the BER encoding, you would find three
primes instead of two, three prime exponents instead of two, and two CRT
coefficients instead of one.
If you set a key object using the BER KI, Crypto-C will recognize whether it is made
up of two primes or three, and will build the object appropriately.
There is a new KI that separates the components: KI_PKCS_RSAMultiPrimePrivate.
Using this KI, you can see the individual primes without having to bother with the
BER encoding.