php下的RSA算法实现

<一>基础

RSA算法非常简单，概述如下：
找两素数p和q
取n=p*q
取t=(p-1)*(q-1)
取任何一个数e,要求满足e<t并且e与t互素（就是最大公因数为1）
取d*e%t==1

这样最终得到三个数： n  d  e

设消息为数M (M <n)
设c=(M**d)%n就得到了加密后的消息c
设m=(c**e)%n则 m == M，从而完成对c的解密。
注：**表示次方,上面两式中的d和e可以互换。

在对称加密中：
n d两个数构成公钥，可以告诉别人；
n e两个数构成私钥，e自己保留，不让任何人知道。
给别人发送的信息使用e加密，只要别人能用d解开就证明信息是由你发送的，构成了签名机制。
别人给你发送信息时使用d加密，这样只有拥有e的你能够对其解密。

rsa的安全性在于对于一个大数n，没有有效的方法能够将其分解
从而在已知n d的情况下无法获得e；同样在已知n e的情况下无法
求得d。



<二>实践

接下来我们来一个实践，看看实际的操作：
找两个素数：
p=47
q=59
这样
n=p*q=2773
t=(p-1)*(q-1)=2668
取e=63，满足e<t并且e和t互素
用perl简单穷举可以获得满主 e*d%t ==1的数d：
C:\Temp>perl -e "foreach $i (1..9999){ print($i),last if $i*63%2668==1 }"
847
即d＝847

最终我们获得关键的
n=2773
d=847
e=63

取消息M=244我们看看

加密：

c=M**d%n = 244**847%2773
用perl的大数计算来算一下：
C:\Temp>perl -Mbigint -e "print 244**847%2773"
465
即用d对M加密后获得加密信息c＝465

解密：

我们可以用e来对加密后的c进行解密，还原M：
m=c**e%n=465**63%2773 ：
C:\Temp>perl -Mbigint -e "print 465**63%2773"
244
即用e对c解密后获得m=244 , 该值和原始信息M相等。
<三>php代码实现
    首先声明，以下代码不是我自己写的，我只是做了下转载而已。不过我相信这对很多初学php的coder们很有用，当然我也在其列。同时也向Ireland 的Edsko de Vries致以最崇高的敬意。

<?php
/*
 * PHP implementation of the RSA algorithm
 * (C) Copyright 2004 Edsko de Vries, Ireland
 *
 * Licensed under the GNU Public License (GPL)
 *
 * This implementation has been verified against [3]
 * (tested Java/PHP interoperability).
 *
 * References:
 * [1] "Applied Cryptography", Bruce Schneier, John Wiley & Sons, 1996
 * [2] "Prime Number Hide-and-Seek", Brian Raiter, Muppetlabs (online)
 * [3] "The Bouncy Castle Crypto Package", Legion of the Bouncy Castle,
 *      (open source cryptography library for Java, online)
 * [4] "PKCS #1: RSA Encryption Standard", RSA Laboratories Technical Note,
 *      version 1.5, revised November 1, 1993
 */

/*
 * Functions that are meant to be used by the user of this PHP module.
 *
 * Notes:
 * - $key and $modulus should be numbers in (decimal) string format
 * - $message is expected to be binary data
 * - $keylength should be a multiple of 8, and should be in bits
 * - For rsa_encrypt/rsa_sign, the length of $message should not exceed
 *   ($keylength / 8) - 11 (as mandated by [4]).
 * - rsa_encrypt and rsa_sign will automatically add padding to the message.
 *   For rsa_encrypt, this padding will consist of random values; for rsa_sign,
 *   padding will consist of the appropriate number of 0xFF values (see [4])
 * - rsa_decrypt and rsa_verify will automatically remove message padding.
 * - Blocks for decoding (rsa_decrypt, rsa_verify) should be exactly
 *   ($keylength / 8) bytes long.
 * - rsa_encrypt and rsa_verify expect a public key; rsa_decrypt and rsa_sign
 *   expect a private key.
 */
//openssl_csr_get_public_key()
function rsa_encrypt($message, $public_key, $modulus, $keylength)
{
    $padded = add_PKCS1_padding($message, true, $keylength / 8);
    $number = binary_to_number($padded);
    $encrypted = pow_mod($number, $public_key, $modulus);
    $result = number_to_binary($encrypted, $keylength / 8);
   
    return $result;
}

function rsa_decrypt($message, $private_key, $modulus, $keylength)
{
    $number = binary_to_number($message);
    $decrypted = pow_mod($number, $private_key, $modulus);
    $result = number_to_binary($decrypted, $keylength / 8);

    return remove_PKCS1_padding($result, $keylength / 8);
}

function rsa_sign($message, $private_key, $modulus, $keylength)
{
    $padded = add_PKCS1_padding($message, false, $keylength / 8);
    $number = binary_to_number($padded);
    $signed = pow_mod($number, $private_key, $modulus);
    $result = number_to_binary($signed, $keylength / 8);

    return $result;
}

function rsa_verify($message, $public_key, $modulus, $keylength)
{
    return rsa_decrypt($message, $public_key, $modulus, $keylength);
}

function rsa_kyp_verify($message, $public_key, $modulus, $keylength)
{
    $number = binary_to_number($message);
    $decrypted = pow_mod($number, $public_key, $modulus);
    $result = number_to_binary($decrypted, $keylength / 8);

    return remove_KYP_padding($result, $keylength / 8);
}

/*
 * Some constants
 */

define("BCCOMP_LARGER", 1);

/*
 * The actual implementation.
 * Requires BCMath support in PHP (compile with --enable-bcmath)
 */

//--
// Calculate (p ^ q) mod r
//
// We need some trickery to [2]:
//   (a) Avoid calculating (p ^ q) before (p ^ q) mod r, because for typical RSA
//       applications, (p ^ q) is going to be _WAY_ too large.
//       (I mean, __WAY__ too large - won't fit in your computer's memory.)
//   (b) Still be reasonably efficient.
//
// We assume p, q and r are all positive, and that r is non-zero.
//
// Note that the more simple algorithm of multiplying $p by itself $q times, and
// applying "mod $r" at every step is also valid, but is O($q), whereas this
// algorithm is O(log $q). Big difference.
//
// As far as I can see, the algorithm I use is optimal; there is no redundancy
// in the calculation of the partial results.
//--
function pow_mod($p, $q, $r)
{
    // Extract powers of 2 from $q
    $factors = array();
    $div = $q;
    $power_of_two = 0;
    while(bccomp($div, "0") == BCCOMP_LARGER)
    {
        $rem = bcmod($div, 2);
        $div = bcdiv($div, 2);
   
        if($rem) array_push($factors, $power_of_two);
        $power_of_two++;
    }

    // Calculate partial results for each factor, using each partial result as a
    // starting point for the next. This depends of the factors of two being
    // generated in increasing order.
    $partial_results = array();
    $part_res = $p;
    $idx = 0;
    foreach($factors as $factor)
    {
        while($idx < $factor)
        {
            $part_res = bcpow($part_res, "2");
            $part_res = bcmod($part_res, $r);

            $idx++;
        }
        
        array_push($partial_results, $part_res);
    }

    // Calculate final result
    $result = "1";
    foreach($partial_results as $part_res)
    {
        $result = bcmul($result, $part_res);
        $result = bcmod($result, $r);
    }

    return $result;
}

//--
// Function to add padding to a decrypted string
// We need to know if this is a private or a public key operation [4]
//--
function add_PKCS1_padding($data, $isPublicKey, $blocksize)
{
    $pad_length = $blocksize - 3 - strlen($data);

    if($isPublicKey)
    {
        $block_type = "\x02";
   
        $padding = "";
        for($i = 0; $i < $pad_length; $i++)
        {
            $rnd = mt_rand(1, 255);
            $padding .= chr($rnd);
        }
    }
    else
    {
        $block_type = "\x01";
        $padding = str_repeat("\xFF", $pad_length);
    }
   
    return "\x00" . $block_type . $padding . "\x00" . $data;
}

//--
// Remove padding from a decrypted string
// See [4] for more details.
//--
function remove_PKCS1_padding($data, $blocksize)
{
    assert(strlen($data) == $blocksize);
    $data = substr($data, 1);

    // We cannot deal with block type 0
    if($data{0} == '\0')
        die("Block type 0 not implemented.");

    // Then the block type must be 1 or 2
    assert(($data{0} == "\x01") || ($data{0} == "\x02"));

    // Remove the padding
    $offset = strpos($data, "\0", 1);
    return substr($data, $offset + 1);
}

//--
// Remove "kyp" padding
// (Non standard)
//--
function remove_KYP_padding($data, $blocksize)
{
    assert(strlen($data) == $blocksize);
   
    $offset = strpos($data, "\0");
    return substr($data, 0, $offset);
}

//--
// Convert binary data to a decimal number
//--
function binary_to_number($data)
{
    $base = "256";
    $radix = "1";
    $result = "0";

    for($i = strlen($data) - 1; $i >= 0; $i--)
    {
        $digit = ord($data{$i});
        $part_res = bcmul($digit, $radix);
        $result = bcadd($result, $part_res);
        $radix = bcmul($radix, $base);
    }

    return $result;
}

//--
// Convert a number back into binary form
//--
function number_to_binary($number, $blocksize)
{
    $base = "256";
    $result = "";

    $div = $number;
    while($div > 0)
    {
        $mod = bcmod($div, $base);
        $div = bcdiv($div, $base);
        
        $result = chr($mod) . $result;
    }

    return str_pad($result, $blocksize, "\x00", STR_PAD_LEFT);
}
?>
   

 

<?php /* * Implementation of the RSA algorithm * (C) Copyright 2004 Edsko de Vries, Ireland * * Licensed under the GNU Public License (GPL) * * This implementation has been verified against [3] * (tested Java/PHP interoperability). * * References: * [1] "Applied Cryptography", Bruce Schneier, John Wiley & Sons, 1996 * [2] "Prime Number Hide-and-Seek", Brian Raiter, Muppetlabs (online) * [3] "The Bouncy Castle Crypto Package", Legion of the Bouncy Castle, * (open source cryptography library for Java, online) * [4] "PKCS #1: RSA Encryption Standard", RSA Laboratories Technical Note, * version 1.5, revised November 1, 1993 */ /* * Functions that are meant to be used by the user of this PHP module. * * Notes: * - $key and $modulus should be numbers in (decimal) string format * - $message is expected to be binary data * - $keylength should be a multiple of 8, and should be in bits * - For rsa_encrypt/rsa_sign, the length of $message should not exceed * ($keylength / 8) - 11 (as mandated by [4]). * - rsa_encrypt and rsa_sign will automatically add padding to the message. * For rsa_encrypt, this padding will consist of random values; for rsa_sign, * padding will consist of the appropriate number of 0xFF values (see [4]) * - rsa_decrypt and rsa_verify will automatically remove message padding. * - Blocks for decoding (rsa_decrypt, rsa_verify) should be exactly * ($keylength / 8) bytes long. * - rsa_encrypt and rsa_verify expect a public key; rsa_decrypt and rsa_sign * expect a private key. */ function rsa_encrypt($message, $public_key, $modulus, $keylength) { $padded = add_PKCS1_padding($message, true, $keylength / 8); $number = binary_to_number($padded); $encrypted = pow_mod($number, $public_key, $modulus); $result = number_to_binary($encrypted, $keylength / 8); return $result; } function rsa_decrypt($message, $private_key, $modulus, $keylength) { $number = binary_to_number($message); $decrypted = pow_mod($number, $private_key, $modulus); $result = number_to_binary($decrypted, $keylength / 8); return remove_PKCS1_padding($result, $keylength / 8); } function rsa_sign($message, $private_key, $modulus, $keylength) { $padded = add_PKCS1_padding($message, false, $keylength / 8); $number = binary_to_number($padded); $signed = pow_mod($number, $private_key, $modulus); $result = number_to_binary($signed, $keylength / 8); return $result; } function rsa_verify($message, $public_key, $modulus, $keylength) { return rsa_decrypt($message, $public_key, $modulus, $keylength); } /* * Some constants */ define("BCCOMP_LARGER", 1); /* * The actual implementation. * Requires BCMath support in PHP (compile with --enable-bcmath) */ //-- // Calculate (p ^ q) mod r // // We need some trickery to [2]: // (a) Avoid calculating (p ^ q) before (p ^ q) mod r, because for typical RSA // applications, (p ^ q) is going to be _WAY_ too large. // (I mean, __WAY__ too large - won't fit in your computer's memory.) // (b) Still be reasonably efficient. // // We assume p, q and r are all positive, and that r is non-zero. // // Note that the more simple algorithm of multiplying $p by itself $q times, and // applying "mod $r" at every step is also valid, but is O($q), whereas this // algorithm is O(log $q). Big difference. // // As far as I can see, the algorithm I use is optimal; there is no redundancy // in the calculation of the partial results. //-- function pow_mod($p, $q, $r) { // Extract powers of 2 from $q $factors = array(); $div = $q; $power_of_two = 0; while(bccomp($div, "0") == BCCOMP_LARGER) { $rem = bcmod($div, 2); $div = bcdiv($div, 2); if($rem) array_push($factors, $power_of_two); $power_of_two++; } // Calculate partial results for each factor, using each partial result as a // starting point for the next. This depends of the factors of two being // generated in increasing order. $partial_results = array(); $part_res = $p; $idx = 0; foreach($factors as $factor) { while($idx < $factor) { $part_res = bcpow($part_res, "2"); $part_res = bcmod($part_res, $r); $idx++; } array_pus($partial_results, $part_res); } // Calculate final result $result = "1"; foreach($partial_results as $part_res) { $result = bcmul($result, $part_res); $result = bcmod($result, $r); } return $result; } //-- // Function to add padding to a decrypted string // We need to know if this is a private or a public key operation [4] //-- function add_PKCS1_padding($data, $isPublicKey, $blocksize) { $pad_length = $blocksize - 3 - strlen($data); if($isPublicKey) { $block_type = "\x02"; $padding = ""; for($i = 0; $i < $pad_length; $i++) { $rnd = mt_rand(1, 255); $padding .= chr($rnd); } } else { $block_type = "\x01"; $padding = str_repeat("\xFF", $pad_length); } return "\x00" . $block_type . $padding . "\x00" . $data; } //-- // Remove padding from a decrypted string // See [4] for more details. //-- function remove_PKCS1_padding($data, $blocksize) { assert(strlen($data) == $blocksize); $data = substr($data, 1); // We cannot deal with block type 0 if($data{0} == '\0') die("Block type 0 not implemented."); // Then the block type must be 1 or 2 assert(($data{0} == "\x01") || ($data{0} == "\x02")); // Remove the padding $offset = strpos($data, "\0", 1); return substr($data, $offset + 1); } //-- // Convert binary data to a decimal number //-- function binary_to_number($data) { $base = "256"; $radix = "1"; $result = "0"; for($i = strlen($data) - 1; $i >= 0; $i--) { $digit = ord($data{$i}); $part_res = bcmul($digit, $radix); $result = bcadd($result, $part_res); $radix = bcmul($radix, $base); } return $result; } //-- // Convert a number back into binary form //-- function number_to_binary($number, $blocksize) { $base = "256"; $result = ""; $div = $number; while($div > 0) { $mod = bcmod($div, $base); $div = bcdiv($div, $base); $result = chr($mod) . $result; } return str_pad($result, $blocksize, "\x00", STR_PAD_LEFT); } ?>