Security Scol plugin
fhmqv.h
Go to the documentation of this file.
1// fhmqv.h - written and placed in the public domain by Jeffrey Walton, Ray Clayton and Uri Blumenthal
2// Shamelessly based upon Wei Dai's MQV source files
3
4#ifndef CRYPTOPP_FHMQV_H
5#define CRYPTOPP_FHMQV_H
6
10
11#include "gfpcrypt.h"
12#include "algebra.h"
13#include "sha.h"
14
15NAMESPACE_BEGIN(CryptoPP)
16
17
23template <class GROUP_PARAMETERS, class COFACTOR_OPTION = typename GROUP_PARAMETERS::DefaultCofactorOption, class HASH = SHA512>
25{
26public:
27 typedef GROUP_PARAMETERS GroupParameters;
28 typedef typename GroupParameters::Element Element;
30
31 virtual ~FHMQV_Domain() {}
32
37 FHMQV_Domain(bool clientRole = true)
38 : m_role(clientRole ? RoleClient : RoleServer) {}
39
45 FHMQV_Domain(const GroupParameters &params, bool clientRole = true)
46 : m_role(clientRole ? RoleClient : RoleServer), m_groupParameters(params) {}
47
53 FHMQV_Domain(BufferedTransformation &bt, bool clientRole = true)
54 : m_role(clientRole ? RoleClient : RoleServer)
55 {m_groupParameters.BERDecode(bt);}
56
64 template <class T1>
65 FHMQV_Domain(T1 v1, bool clientRole = true)
66 : m_role(clientRole ? RoleClient : RoleServer)
67 {m_groupParameters.Initialize(v1);}
68
78 template <class T1, class T2>
79 FHMQV_Domain(T1 v1, T2 v2, bool clientRole = true)
80 : m_role(clientRole ? RoleClient : RoleServer)
81 {m_groupParameters.Initialize(v1, v2);}
82
94 template <class T1, class T2, class T3>
95 FHMQV_Domain(T1 v1, T2 v2, T3 v3, bool clientRole = true)
96 : m_role(clientRole ? RoleClient : RoleServer)
97 {m_groupParameters.Initialize(v1, v2, v3);}
98
112 template <class T1, class T2, class T3, class T4>
113 FHMQV_Domain(T1 v1, T2 v2, T3 v3, T4 v4, bool clientRole = true)
114 : m_role(clientRole ? RoleClient : RoleServer)
115 {m_groupParameters.Initialize(v1, v2, v3, v4);}
116
117public:
118
121 const GroupParameters & GetGroupParameters() const {return m_groupParameters;}
122
125 GroupParameters & AccessGroupParameters() {return m_groupParameters;}
126
129 CryptoParameters & AccessCryptoParameters() {return AccessAbstractGroupParameters();}
130
137 unsigned int AgreedValueLength() const
138 {return GetAbstractGroupParameters().GetEncodedElementSize(false);}
139
143 unsigned int StaticPrivateKeyLength() const
144 {return GetAbstractGroupParameters().GetSubgroupOrder().ByteCount();}
145
152 unsigned int StaticPublicKeyLength() const
153 {return GetAbstractGroupParameters().GetEncodedElementSize(true);}
154
161 void GenerateStaticPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
162 {
163 Integer x(rng, Integer::One(), GetAbstractGroupParameters().GetMaxExponent());
164 x.Encode(privateKey, StaticPrivateKeyLength());
165 }
166
175 void GenerateStaticPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
176 {
177 CRYPTOPP_UNUSED(rng);
178 const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
179 Integer x(privateKey, StaticPrivateKeyLength());
180 Element y = params.ExponentiateBase(x);
181 params.EncodeElement(true, y, publicKey);
182 }
183
189
194 unsigned int EphemeralPublicKeyLength() const{return StaticPublicKeyLength();}
195
200 void GenerateEphemeralPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
201 {
202 const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
203 Integer x(rng, Integer::One(), params.GetMaxExponent());
204 x.Encode(privateKey, StaticPrivateKeyLength());
205 Element y = params.ExponentiateBase(x);
206 params.EncodeElement(true, y, privateKey+StaticPrivateKeyLength());
207 }
208
214 void GenerateEphemeralPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
215 {
216 CRYPTOPP_UNUSED(rng);
217 memcpy(publicKey, privateKey+StaticPrivateKeyLength(), EphemeralPublicKeyLength());
218 }
219
243 bool Agree(byte *agreedValue,
244 const byte *staticPrivateKey, const byte *ephemeralPrivateKey,
245 const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey,
246 bool validateStaticOtherPublicKey=true) const
247 {
248 const byte *XX = NULLPTR, *YY = NULLPTR, *AA = NULLPTR, *BB = NULLPTR;
249 size_t xxs = 0, yys = 0, aas = 0, bbs = 0;
250
251 // Depending on the role, this will hold either A's or B's static
252 // (long term) public key. AA or BB will then point into tt.
254
255 try
256 {
258 const DL_GroupParameters<Element> &params = GetAbstractGroupParameters();
259
260 if(m_role == RoleServer)
261 {
262 Integer b(staticPrivateKey, StaticPrivateKeyLength());
263 Element B = params.ExponentiateBase(b);
264 params.EncodeElement(true, B, tt);
265
266 XX = ephemeralOtherPublicKey;
268 YY = ephemeralPrivateKey + StaticPrivateKeyLength();
270 AA = staticOtherPublicKey;
271 aas = StaticPublicKeyLength();
272 BB = tt.BytePtr();
273 bbs = tt.SizeInBytes();
274 }
275 else
276 {
277 Integer a(staticPrivateKey, StaticPrivateKeyLength());
278 Element A = params.ExponentiateBase(a);
279 params.EncodeElement(true, A, tt);
280
281 XX = ephemeralPrivateKey + StaticPrivateKeyLength();
283 YY = ephemeralOtherPublicKey;
285 AA = tt.BytePtr();
286 aas = tt.SizeInBytes();
287 BB = staticOtherPublicKey;
288 bbs = StaticPublicKeyLength();
289 }
290
291 Element VV1 = params.DecodeElement(staticOtherPublicKey, validateStaticOtherPublicKey);
292 Element VV2 = params.DecodeElement(ephemeralOtherPublicKey, true);
293
294 const Integer& q = params.GetSubgroupOrder();
295 const unsigned int len /*bytes*/ = (((q.BitCount()+1)/2 +7)/8);
296 SecByteBlock dd(len), ee(len);
297
298 Hash(NULLPTR, XX, xxs, YY, yys, AA, aas, BB, bbs, dd.BytePtr(), dd.SizeInBytes());
299 Integer d(dd.BytePtr(), dd.SizeInBytes());
300
301 Hash(NULLPTR, YY, yys, XX, xxs, AA, aas, BB, bbs, ee.BytePtr(), ee.SizeInBytes());
302 Integer e(ee.BytePtr(), ee.SizeInBytes());
303
304 Element sigma;
305 if(m_role == RoleServer)
306 {
307 Integer y(ephemeralPrivateKey, StaticPrivateKeyLength());
308 Integer b(staticPrivateKey, StaticPrivateKeyLength());
309 Integer s_B = (y + e * b) % q;
310
311 Element A = params.DecodeElement(AA, false);
312 Element X = params.DecodeElement(XX, false);
313
314 Element t1 = params.ExponentiateElement(A, d);
315 Element t2 = m_groupParameters.MultiplyElements(X, t1);
316
317 sigma = params.ExponentiateElement(t2, s_B);
318 }
319 else
320 {
321 Integer x(ephemeralPrivateKey, StaticPrivateKeyLength());
322 Integer a(staticPrivateKey, StaticPrivateKeyLength());
323 Integer s_A = (x + d * a) % q;
324
325 Element B = params.DecodeElement(BB, false);
326 Element Y = params.DecodeElement(YY, false);
327
328 Element t1 = params.ExponentiateElement(B, e);
329 Element t2 = m_groupParameters.MultiplyElements(Y, t1);
330
331 sigma = params.ExponentiateElement(t2, s_A);
332 }
333
334 Hash(&sigma, XX, xxs, YY, yys, AA, aas, BB, bbs, agreedValue, AgreedValueLength());
335 }
336 catch (DL_BadElement &)
337 {
338 CRYPTOPP_ASSERT(0);
339 return false;
340 }
341 return true;
342 }
343
344protected:
345
346 inline void Hash(const Element* sigma,
347 const byte* e1, size_t e1len, const byte* e2, size_t e2len,
348 const byte* s1, size_t s1len, const byte* s2, size_t s2len,
349 byte* digest, size_t dlen) const
350 {
351 HASH hash;
352 size_t idx = 0, req = dlen;
353 size_t blk = STDMIN(dlen, (size_t)HASH::DIGESTSIZE);
354
355 if(sigma)
356 {
357 //Integer x = GetAbstractGroupParameters().ConvertElementToInteger(*sigma);
358 //SecByteBlock sbb(x.MinEncodedSize());
359 //x.Encode(sbb.BytePtr(), sbb.SizeInBytes());
360 SecByteBlock sbb(GetAbstractGroupParameters().GetEncodedElementSize(false));
361 GetAbstractGroupParameters().EncodeElement(false, *sigma, sbb);
362 hash.Update(sbb.BytePtr(), sbb.SizeInBytes());
363 }
364
365 hash.Update(e1, e1len);
366 hash.Update(e2, e2len);
367 hash.Update(s1, s1len);
368 hash.Update(s2, s2len);
369
370 hash.TruncatedFinal(digest, blk);
371 req -= blk;
372
373 // All this to catch tail bytes for large curves and small hashes
374 while(req != 0)
375 {
376 hash.Update(&digest[idx], (size_t)HASH::DIGESTSIZE);
377
378 idx += (size_t)HASH::DIGESTSIZE;
379 blk = STDMIN(req, (size_t)HASH::DIGESTSIZE);
380 hash.TruncatedFinal(&digest[idx], blk);
381
382 req -= blk;
383 }
384 }
385
386private:
387
388 // The paper uses Initiator and Recipient - make it classical.
389 enum KeyAgreementRole { RoleServer = 1, RoleClient };
390
391 DL_GroupParameters<Element> & AccessAbstractGroupParameters() {return m_groupParameters;}
392 const DL_GroupParameters<Element> & GetAbstractGroupParameters() const{return m_groupParameters;}
393
394 GroupParameters m_groupParameters;
395 KeyAgreementRole m_role;
396};
397
405
406NAMESPACE_END
407
408#endif
Classes for performing mathematics over different fields.
Interface for domains of authenticated key agreement protocols.
Definition cryptlib.h:3072
Interface for buffered transformations.
Definition cryptlib.h:1652
void DoQuickSanityCheck() const
Perform a quick sanity check.
Definition cryptlib.h:2493
Interface for crypto parameters.
Definition cryptlib.h:2546
Exception thrown when an invalid group element is encountered.
Definition pubkey.h:772
Interface for Discrete Log (DL) group parameters.
Definition pubkey.h:782
virtual Element ExponentiateElement(const Element &base, const Integer &exponent) const
Exponentiates an element.
Definition pubkey.h:879
virtual void EncodeElement(bool reversible, const Element &element, byte *encoded) const =0
Encodes the element.
virtual Integer GetMaxExponent() const =0
Retrieves the maximum exponent for the group.
virtual const Integer & GetSubgroupOrder() const =0
Retrieves the subgroup order.
virtual Element ExponentiateBase(const Integer &exponent) const
Exponentiates the base.
Definition pubkey.h:869
virtual Element DecodeElement(const byte *encoded, bool checkForGroupMembership) const =0
Decodes the element.
Fully Hashed Menezes-Qu-Vanstone in GF(p)
Definition fhmqv.h:25
FHMQV_Domain(bool clientRole=true)
Construct a FHMQV domain.
Definition fhmqv.h:37
unsigned int AgreedValueLength() const
Provides the size of the agreed value.
Definition fhmqv.h:137
FHMQV_Domain(const GroupParameters &params, bool clientRole=true)
Construct a FHMQV domain.
Definition fhmqv.h:45
unsigned int EphemeralPublicKeyLength() const
Provides the size of the ephemeral public key.
Definition fhmqv.h:194
FHMQV_Domain(T1 v1, T2 v2, T3 v3, bool clientRole=true)
Construct a FHMQV domain.
Definition fhmqv.h:95
CryptoParameters & AccessCryptoParameters()
Retrieves the crypto parameters for this domain.
Definition fhmqv.h:129
void GenerateStaticPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
Generate a static public key from a private key in this domain.
Definition fhmqv.h:175
unsigned int EphemeralPrivateKeyLength() const
Provides the size of the ephemeral private key.
Definition fhmqv.h:188
FHMQV_Domain(BufferedTransformation &bt, bool clientRole=true)
Construct a FHMQV domain.
Definition fhmqv.h:53
FHMQV_Domain(T1 v1, T2 v2, T3 v3, T4 v4, bool clientRole=true)
Construct a FHMQV domain.
Definition fhmqv.h:113
const GroupParameters & GetGroupParameters() const
Retrieves the group parameters for this domain.
Definition fhmqv.h:121
GroupParameters & AccessGroupParameters()
Retrieves the group parameters for this domain.
Definition fhmqv.h:125
void GenerateEphemeralPublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
Generate ephemeral public key from a private key in this domain.
Definition fhmqv.h:214
void GenerateStaticPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
Generate static private key in this domain.
Definition fhmqv.h:161
bool Agree(byte *agreedValue, const byte *staticPrivateKey, const byte *ephemeralPrivateKey, const byte *staticOtherPublicKey, const byte *ephemeralOtherPublicKey, bool validateStaticOtherPublicKey=true) const
Derive agreed value or shared secret.
Definition fhmqv.h:243
void GenerateEphemeralPrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
Generate ephemeral private key in this domain.
Definition fhmqv.h:200
FHMQV_Domain(T1 v1, bool clientRole=true)
Construct a FHMQV domain.
Definition fhmqv.h:65
unsigned int StaticPrivateKeyLength() const
Provides the size of the static private key.
Definition fhmqv.h:143
FHMQV_Domain(T1 v1, T2 v2, bool clientRole=true)
Construct a FHMQV domain.
Definition fhmqv.h:79
unsigned int StaticPublicKeyLength() const
Provides the size of the static public key.
Definition fhmqv.h:152
Multiple precision integer with arithmetic operations.
Definition integer.h:50
unsigned int BitCount() const
Determines the number of bits required to represent the Integer.
Definition integer.cpp:3364
static const Integer &CRYPTOPP_API One()
Integer representing 1.
Definition integer.cpp:4920
const CryptoMaterial & GetMaterial() const
Retrieves a reference to Crypto Parameters.
Definition cryptlib.h:2647
Interface for random number generators.
Definition cryptlib.h:1435
size_type SizeInBytes() const
Provides the number of bytes in the SecBlock.
Definition secblock.h:885
byte * BytePtr()
Provides a byte pointer to the first element in the memory block.
Definition secblock.h:876
FHMQV_Domain< DL_GroupParameters_GFP_DefaultSafePrime > FHMQV
Fully Hashed Menezes-Qu-Vanstone in GF(p)
Definition fhmqv.h:404
Classes and functions for schemes based on Discrete Logs (DL) over GF(p)
const T & STDMIN(const T &a, const T &b)
Replacement function for std::min.
Definition misc.h:655
Classes for SHA-1 and SHA-2 family of message digests.