gfpcrypt.h

Go to the documentation of this file.

// gfpcrypt.h - originally written and placed in the public domain by Wei Dai
//              RFC6979 deterministic signatures added by Douglas Roark
//              ECGDSA added by Jeffrey Walton
 
 
#ifndef CRYPTOPP_GFPCRYPT_H
#define CRYPTOPP_GFPCRYPT_H
 
#include "config.h"
 
#if CRYPTOPP_MSC_VERSION
# pragma warning(push)
# pragma warning(disable: 4189 4231 4275)
#endif
 
#include "cryptlib.h"
#include "pubkey.h"
#include "integer.h"
#include "modexppc.h"
#include "algparam.h"
#include "smartptr.h"
#include "sha.h"
#include "asn.h"
#include "hmac.h"
#include "misc.h"
 
NAMESPACE_BEGIN(CryptoPP)
 
CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupParameters<Integer>;
 
class CRYPTOPP_DLL CRYPTOPP_NO_VTABLE DL_GroupParameters_IntegerBased : public ASN1CryptoMaterial<DL_GroupParameters<Integer> >
{
    typedef DL_GroupParameters_IntegerBased ThisClass;
 
public:
    virtual ~DL_GroupParameters_IntegerBased() {}
 
    void Initialize(const DL_GroupParameters_IntegerBased &params)
        {Initialize(params.GetModulus(), params.GetSubgroupOrder(), params.GetSubgroupGenerator());}
 
    void Initialize(RandomNumberGenerator &rng, unsigned int pbits)
        {GenerateRandom(rng, MakeParameters("ModulusSize", (int)pbits));}
 
    void Initialize(const Integer &p, const Integer &g)
        {SetModulusAndSubgroupGenerator(p, g); SetSubgroupOrder(ComputeGroupOrder(p)/2);}
 
    void Initialize(const Integer &p, const Integer &q, const Integer &g)
        {SetModulusAndSubgroupGenerator(p, g); SetSubgroupOrder(q);}
 
    // ASN1Object interface
    void BERDecode(BufferedTransformation &bt);
    void DEREncode(BufferedTransformation &bt) const;
 
    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
 
    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
 
    void AssignFrom(const NameValuePairs &source);
 
    // DL_GroupParameters
    const Integer & GetSubgroupOrder() const {return m_q;}
    Integer GetGroupOrder() const {return GetFieldType() == 1 ? GetModulus()-Integer::One() : GetModulus()+Integer::One();}
    bool ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const;
    bool ValidateElement(unsigned int level, const Integer &element, const DL_FixedBasePrecomputation<Integer> *precomp) const;
 
    bool FastSubgroupCheckAvailable() const {return GetCofactor() == 2;}
 
    void EncodeElement(bool reversible, const Element &element, byte *encoded) const;
 
    unsigned int GetEncodedElementSize(bool reversible) const;
 
    Integer DecodeElement(const byte *encoded, bool checkForGroupMembership) const;
 
    Integer ConvertElementToInteger(const Element &element) const
        {return element;}
 
    Integer GetMaxExponent() const;
 
    OID GetAlgorithmID() const;
 
    virtual const Integer & GetModulus() const =0;
 
    virtual void SetModulusAndSubgroupGenerator(const Integer &p, const Integer &g) =0;
 
    void SetSubgroupOrder(const Integer &q)
        {m_q = q; ParametersChanged();}
 
    static std::string CRYPTOPP_API StaticAlgorithmNamePrefix() {return "";}
 
protected:
    Integer ComputeGroupOrder(const Integer &modulus) const
        {return modulus-(GetFieldType() == 1 ? 1 : -1);}
 
    // GF(p) = 1, GF(p^2) = 2
    virtual int GetFieldType() const =0;
    virtual unsigned int GetDefaultSubgroupOrderSize(unsigned int modulusSize) const;
 
private:
    Integer m_q;
};
 
template <class GROUP_PRECOMP, class BASE_PRECOMP = DL_FixedBasePrecomputationImpl<typename GROUP_PRECOMP::Element> >
class CRYPTOPP_NO_VTABLE DL_GroupParameters_IntegerBasedImpl : public DL_GroupParametersImpl<GROUP_PRECOMP, BASE_PRECOMP, DL_GroupParameters_IntegerBased>
{
    typedef DL_GroupParameters_IntegerBasedImpl<GROUP_PRECOMP, BASE_PRECOMP> ThisClass;
 
public:
    typedef typename GROUP_PRECOMP::Element Element;
 
    virtual ~DL_GroupParameters_IntegerBasedImpl() {}
 
    // GeneratibleCryptoMaterial interface
    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
        {return GetValueHelper<DL_GroupParameters_IntegerBased>(this, name, valueType, pValue).Assignable();}
 
    void AssignFrom(const NameValuePairs &source)
        {AssignFromHelper<DL_GroupParameters_IntegerBased>(this, source);}
 
    // DL_GroupParameters
    const DL_FixedBasePrecomputation<Element> & GetBasePrecomputation() const {return this->m_gpc;}
    DL_FixedBasePrecomputation<Element> & AccessBasePrecomputation() {return this->m_gpc;}
 
    // IntegerGroupParameters
    const Integer & GetModulus() const {return this->m_groupPrecomputation.GetModulus();}
 
    const Integer & GetGenerator() const {return this->m_gpc.GetBase(this->GetGroupPrecomputation());}
 
    void SetModulusAndSubgroupGenerator(const Integer &p, const Integer &g)        // these have to be set together
        {this->m_groupPrecomputation.SetModulus(p); this->m_gpc.SetBase(this->GetGroupPrecomputation(), g); this->ParametersChanged();}
 
    // non-inherited
    bool operator==(const DL_GroupParameters_IntegerBasedImpl<GROUP_PRECOMP, BASE_PRECOMP> &rhs) const
        {return GetModulus() == rhs.GetModulus() && GetGenerator() == rhs.GetGenerator() && this->GetSubgroupOrder() == rhs.GetSubgroupOrder();}
    bool operator!=(const DL_GroupParameters_IntegerBasedImpl<GROUP_PRECOMP, BASE_PRECOMP> &rhs) const
        {return !operator==(rhs);}
};
 
CRYPTOPP_DLL_TEMPLATE_CLASS DL_GroupParameters_IntegerBasedImpl<ModExpPrecomputation>;
 
class CRYPTOPP_DLL DL_GroupParameters_GFP : public DL_GroupParameters_IntegerBasedImpl<ModExpPrecomputation>
{
public:
    virtual ~DL_GroupParameters_GFP() {}
 
    bool IsIdentity(const Integer &element) const {return element == Integer::One();}
 
    void SimultaneousExponentiate(Element *results, const Element &base, const Integer *exponents, unsigned int exponentsCount) const;
 
    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
    {
        return GetValueHelper<DL_GroupParameters_IntegerBased>(this, name, valueType, pValue).Assignable();
    }
 
    // used by MQV
    Element MultiplyElements(const Element &a, const Element &b) const;
    Element CascadeExponentiate(const Element &element1, const Integer &exponent1, const Element &element2, const Integer &exponent2) const;
 
protected:
    int GetFieldType() const {return 1;}
};
 
class CRYPTOPP_DLL DL_GroupParameters_GFP_DefaultSafePrime : public DL_GroupParameters_GFP
{
public:
    typedef NoCofactorMultiplication DefaultCofactorOption;
 
    virtual ~DL_GroupParameters_GFP_DefaultSafePrime() {}
 
protected:
    unsigned int GetDefaultSubgroupOrderSize(unsigned int modulusSize) const {return modulusSize-1;}
};
 
class CRYPTOPP_DLL DL_GroupParameters_ElGamal : public DL_GroupParameters_GFP_DefaultSafePrime
{
public:
    typedef NoCofactorMultiplication DefaultCofactorOption;
 
    virtual ~DL_GroupParameters_ElGamal() {}
 
        Integer GetMaxExponent() const
        {
                return GetSubgroupOrder()-1;
        }
};
 
template <class T>
class DL_Algorithm_GDSA : public DL_ElgamalLikeSignatureAlgorithm<T>
{
public:
    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "DSA-1363";}
 
    virtual ~DL_Algorithm_GDSA() {}
 
    void Sign(const DL_GroupParameters<T> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const
    {
        const Integer &q = params.GetSubgroupOrder();
        r %= q;
        Integer kInv = k.InverseMod(q);
        s = (kInv * (x*r + e)) % q;
        CRYPTOPP_ASSERT(!!r && !!s);
    }
 
    bool Verify(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &e, const Integer &r, const Integer &s) const
    {
        const Integer &q = params.GetSubgroupOrder();
        if (r>=q || r<1 || s>=q || s<1)
            return false;
 
        Integer w = s.InverseMod(q);
        Integer u1 = (e * w) % q;
        Integer u2 = (r * w) % q;
        // verify r == (g^u1 * y^u2 mod p) mod q
        return r == params.ConvertElementToInteger(publicKey.CascadeExponentiateBaseAndPublicElement(u1, u2)) % q;
    }
};
 
template <class T, class H>
class DL_Algorithm_DSA_RFC6979 : public DL_Algorithm_GDSA<T>, public DeterministicSignatureAlgorithm
{
public:
    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "DSA-RFC6979";}
 
    virtual ~DL_Algorithm_DSA_RFC6979() {}
 
    bool IsProbabilistic() const
        {return false;}
    bool IsDeterministic() const
        {return true;}
 
    // Deterministic K
    Integer GenerateRandom(const Integer &x, const Integer &q, const Integer &e) const
    {
        static const byte zero = 0, one = 1;
        const size_t qlen = q.BitCount();
        const size_t rlen = BitsToBytes(qlen);
 
        // Step (a) - formatted E(m)
        SecByteBlock BH(e.MinEncodedSize());
        e.Encode(BH, BH.size());
        BH = bits2octets(BH, q);
 
        // Step (a) - private key to byte array
        SecByteBlock BX(STDMAX(rlen, x.MinEncodedSize()));
        x.Encode(BX, BX.size());
 
        // Step (b)
        SecByteBlock V(H::DIGESTSIZE);
        std::fill(V.begin(), V.begin()+H::DIGESTSIZE, one);
 
        // Step (c)
        SecByteBlock K(H::DIGESTSIZE);
        std::fill(K.begin(), K.begin()+H::DIGESTSIZE, zero);
 
        // Step (d)
        m_hmac.SetKey(K, K.size());
        m_hmac.Update(V, V.size());
        m_hmac.Update(&zero, 1);
        m_hmac.Update(BX, BX.size());
        m_hmac.Update(BH, BH.size());
        m_hmac.TruncatedFinal(K, K.size());
 
        // Step (e)
        m_hmac.SetKey(K, K.size());
        m_hmac.Update(V, V.size());
        m_hmac.TruncatedFinal(V, V.size());
 
        // Step (f)
        m_hmac.SetKey(K, K.size());
        m_hmac.Update(V, V.size());
        m_hmac.Update(&one, 1);
        m_hmac.Update(BX, BX.size());
        m_hmac.Update(BH, BH.size());
        m_hmac.TruncatedFinal(K, K.size());
 
        // Step (g)
        m_hmac.SetKey(K, K.size());
        m_hmac.Update(V, V.size());
        m_hmac.TruncatedFinal(V, V.size());
 
        Integer k;
        SecByteBlock temp(rlen);
        for (;;)
        {
            // We want qlen bits, but we support only hash functions with an output length
            //   multiple of 8; hence, we will gather rlen bits, i.e., rolen octets.
            size_t toff = 0;
            while (toff < rlen)
            {
                m_hmac.Update(V, V.size());
                m_hmac.TruncatedFinal(V, V.size());
 
                size_t cc = STDMIN(V.size(), temp.size() - toff);
                memcpy_s(temp+toff, temp.size() - toff, V, cc);
                toff += cc;
            }
 
            k = bits2int(temp, qlen);
            if (k > 0 && k < q)
                break;
 
            // k is not in the proper range; update K and V, and loop.
            m_hmac.Update(V, V.size());
            m_hmac.Update(&zero, 1);
            m_hmac.TruncatedFinal(K, K.size());
 
            m_hmac.SetKey(K, K.size());
            m_hmac.Update(V, V.size());
            m_hmac.TruncatedFinal(V, V.size());
        }
 
        return k;
    }
 
protected:
 
    Integer bits2int(const SecByteBlock& bits, size_t qlen) const
    {
        Integer ret(bits, bits.size());
        size_t blen = bits.size()*8;
 
        if (blen > qlen)
            ret >>= blen - qlen;
 
        return ret;
    }
 
    // RFC 6979 support function. Takes an integer and converts it into bytes that
    // are the same length as an elliptic curve's order.
    SecByteBlock int2octets(const Integer& val, size_t rlen) const
    {
        SecByteBlock block(val.MinEncodedSize());
        val.Encode(block, val.MinEncodedSize());
 
        if (block.size() == rlen)
            return block;
 
        // The least significant bytes are the ones we need to preserve.
        SecByteBlock t(rlen);
        if (block.size() > rlen)
        {
            size_t offset = block.size() - rlen;
            std::memcpy(t, block + offset, rlen);
        }
        else // block.size() < rlen
        {
            size_t offset = rlen - block.size();
            memset(t, '\x00', offset);
            std::memcpy(t + offset, block, rlen - offset);
        }
 
        return t;
    }
 
    // Turn a stream of bits into a set of bytes with the same length as an elliptic
    // curve's order.
    SecByteBlock bits2octets(const SecByteBlock& in, const Integer& q) const
    {
        Integer b2 = bits2int(in, q.BitCount());
        Integer b1 = b2 - q;
        return int2octets(b1.IsNegative() ? b2 : b1, q.ByteCount());
    }
 
private:
    mutable H m_hash;
    mutable HMAC<H> m_hmac;
};
 
template <class T>
class DL_Algorithm_GDSA_ISO15946 : public DL_ElgamalLikeSignatureAlgorithm<T>
{
public:
    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "GDSA-ISO15946";}
 
    virtual ~DL_Algorithm_GDSA_ISO15946() {}
 
    void Sign(const DL_GroupParameters<T> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const
    {
        const Integer &q = params.GetSubgroupOrder();
        // r = x(k * G) mod q
        r = params.ConvertElementToInteger(params.ExponentiateBase(k)) % q;
        // s = (k * r - h(m)) * d_A mod q
        s = (k * r - e) * x % q;
        CRYPTOPP_ASSERT(!!r && !!s);
    }
 
    bool Verify(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &e, const Integer &r, const Integer &s) const
    {
        const Integer &q = params.GetSubgroupOrder();
        if (r>=q || r<1 || s>=q || s<1)
            return false;
 
        const Integer& rInv = r.InverseMod(q);
        const Integer u1 = (rInv * e) % q;
        const Integer u2 = (rInv * s) % q;
        // verify x(G^u1 + P_A^u2) mod q
        return r == params.ConvertElementToInteger(publicKey.CascadeExponentiateBaseAndPublicElement(u1, u2)) % q;
    }
};
 
CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_GDSA<Integer>;
CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA1>;
CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA224>;
CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA256>;
CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA384>;
CRYPTOPP_DLL_TEMPLATE_CLASS DL_Algorithm_DSA_RFC6979<Integer, SHA512>;
 
template <class T>
class DL_Algorithm_NR : public DL_ElgamalLikeSignatureAlgorithm<T>
{
public:
    CRYPTOPP_STATIC_CONSTEXPR const char* CRYPTOPP_API StaticAlgorithmName() {return "NR";}
 
    virtual ~DL_Algorithm_NR() {}
 
    void Sign(const DL_GroupParameters<T> &params, const Integer &x, const Integer &k, const Integer &e, Integer &r, Integer &s) const
    {
        const Integer &q = params.GetSubgroupOrder();
        r = (r + e) % q;
        s = (k - x*r) % q;
        CRYPTOPP_ASSERT(!!r);
    }
 
    bool Verify(const DL_GroupParameters<T> &params, const DL_PublicKey<T> &publicKey, const Integer &e, const Integer &r, const Integer &s) const
    {
        const Integer &q = params.GetSubgroupOrder();
        if (r>=q || r<1 || s>=q)
            return false;
 
        // check r == (m_g^s * m_y^r + m) mod m_q
        return r == (params.ConvertElementToInteger(publicKey.CascadeExponentiateBaseAndPublicElement(s, r)) + e) % q;
    }
};
 
template <class GP>
class DL_PublicKey_GFP : public DL_PublicKeyImpl<GP>
{
public:
    virtual ~DL_PublicKey_GFP() {}
 
    void Initialize(const DL_GroupParameters_IntegerBased &params, const Integer &y)
        {this->AccessGroupParameters().Initialize(params); this->SetPublicElement(y);}
 
    void Initialize(const Integer &p, const Integer &g, const Integer &y)
        {this->AccessGroupParameters().Initialize(p, g); this->SetPublicElement(y);}
 
    void Initialize(const Integer &p, const Integer &q, const Integer &g, const Integer &y)
        {this->AccessGroupParameters().Initialize(p, q, g); this->SetPublicElement(y);}
 
    // X509PublicKey
    void BERDecodePublicKey(BufferedTransformation &bt, bool, size_t)
        {this->SetPublicElement(Integer(bt));}
    void DEREncodePublicKey(BufferedTransformation &bt) const
        {this->GetPublicElement().DEREncode(bt);}
};
 
template <class GP>
class DL_PrivateKey_GFP : public DL_PrivateKeyImpl<GP>
{
public:
    virtual ~DL_PrivateKey_GFP();
 
    void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits)
        {this->GenerateRandomWithKeySize(rng, modulusBits);}
 
    void Initialize(RandomNumberGenerator &rng, const Integer &p, const Integer &g)
        {this->GenerateRandom(rng, MakeParameters("Modulus", p)("SubgroupGenerator", g));}
 
    void Initialize(RandomNumberGenerator &rng, const Integer &p, const Integer &q, const Integer &g)
        {this->GenerateRandom(rng, MakeParameters("Modulus", p)("SubgroupOrder", q)("SubgroupGenerator", g));}
 
    void Initialize(const DL_GroupParameters_IntegerBased &params, const Integer &x)
        {this->AccessGroupParameters().Initialize(params); this->SetPrivateExponent(x);}
 
    void Initialize(const Integer &p, const Integer &g, const Integer &x)
        {this->AccessGroupParameters().Initialize(p, g); this->SetPrivateExponent(x);}
 
    void Initialize(const Integer &p, const Integer &q, const Integer &g, const Integer &x)
        {this->AccessGroupParameters().Initialize(p, q, g); this->SetPrivateExponent(x);}
};
 
// Out-of-line dtor due to AIX and GCC, http://github.com/weidai11/cryptopp/issues/499
template <class GP>
DL_PrivateKey_GFP<GP>::~DL_PrivateKey_GFP() {}
 
struct DL_SignatureKeys_GFP
{
    typedef DL_GroupParameters_GFP GroupParameters;
    typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
    typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
};
 
struct DL_CryptoKeys_GFP
{
    typedef DL_GroupParameters_GFP_DefaultSafePrime GroupParameters;
    typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
    typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
};
 
struct DL_CryptoKeys_ElGamal
{
    typedef DL_GroupParameters_ElGamal GroupParameters;
    typedef DL_PublicKey_GFP<GroupParameters> PublicKey;
    typedef DL_PrivateKey_GFP<GroupParameters> PrivateKey;
};
 
template <class H>
struct GDSA : public DL_SS<
    DL_SignatureKeys_GFP,
    DL_Algorithm_GDSA<Integer>,
    DL_SignatureMessageEncodingMethod_DSA,
    H>
{
};
 
template <class H>
struct NR : public DL_SS<
    DL_SignatureKeys_GFP,
    DL_Algorithm_NR<Integer>,
    DL_SignatureMessageEncodingMethod_NR,
    H>
{
};
 
class CRYPTOPP_DLL DL_GroupParameters_DSA : public DL_GroupParameters_GFP
{
public:
    virtual ~DL_GroupParameters_DSA() {}
 
    bool ValidateGroup(RandomNumberGenerator &rng, unsigned int level) const;
 
    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &alg);
 
    static bool CRYPTOPP_API IsValidPrimeLength(unsigned int pbits)
        {return pbits >= MIN_PRIME_LENGTH && pbits <= MAX_PRIME_LENGTH && pbits % PRIME_LENGTH_MULTIPLE == 0;}
 
    enum {
        MIN_PRIME_LENGTH = 1024,
        MAX_PRIME_LENGTH = 3072,
        PRIME_LENGTH_MULTIPLE = 1024
    };
};
 
template <class H>
class DSA2;
 
struct DL_Keys_DSA
{
    typedef DL_PublicKey_GFP<DL_GroupParameters_DSA> PublicKey;
    typedef DL_PrivateKey_WithSignaturePairwiseConsistencyTest<DL_PrivateKey_GFP<DL_GroupParameters_DSA>, DSA2<SHA1> > PrivateKey;
};
 
template <class H>
class DSA2 : public DL_SS<
    DL_Keys_DSA,
    DL_Algorithm_GDSA<Integer>,
    DL_SignatureMessageEncodingMethod_DSA,
    H,
    DSA2<H> >
{
public:
    static std::string CRYPTOPP_API StaticAlgorithmName() {return "DSA/" + (std::string)H::StaticAlgorithmName();}
};
 
template <class H>
struct DSA_RFC6979 : public DL_SS<
    DL_SignatureKeys_GFP,
    DL_Algorithm_DSA_RFC6979<Integer, H>,
    DL_SignatureMessageEncodingMethod_DSA,
    H,
    DSA_RFC6979<H> >
{
    static std::string CRYPTOPP_API StaticAlgorithmName() {return std::string("DSA-RFC6979/") + H::StaticAlgorithmName();}
};
 
typedef DSA2<SHA1> DSA;
 
CRYPTOPP_DLL_TEMPLATE_CLASS DL_PublicKey_GFP<DL_GroupParameters_DSA>;
CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_GFP<DL_GroupParameters_DSA>;
CRYPTOPP_DLL_TEMPLATE_CLASS DL_PrivateKey_WithSignaturePairwiseConsistencyTest<DL_PrivateKey_GFP<DL_GroupParameters_DSA>, DSA2<SHA1> >;
 
template <class MAC, bool DHAES_MODE, bool LABEL_OCTETS=false>
class DL_EncryptionAlgorithm_Xor : public DL_SymmetricEncryptionAlgorithm
{
public:
    virtual ~DL_EncryptionAlgorithm_Xor() {}
 
    bool ParameterSupported(const char *name) const {return strcmp(name, Name::EncodingParameters()) == 0;}
    size_t GetSymmetricKeyLength(size_t plaintextLength) const
        {return plaintextLength + static_cast<size_t>(MAC::DEFAULT_KEYLENGTH);}
    size_t GetSymmetricCiphertextLength(size_t plaintextLength) const
        {return plaintextLength + static_cast<size_t>(MAC::DIGESTSIZE);}
    size_t GetMaxSymmetricPlaintextLength(size_t ciphertextLength) const
        {return SaturatingSubtract(ciphertextLength, static_cast<size_t>(MAC::DIGESTSIZE));}
    void SymmetricEncrypt(RandomNumberGenerator &rng, const byte *key, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters) const
    {
        CRYPTOPP_UNUSED(rng);
        const byte *cipherKey = NULLPTR, *macKey = NULLPTR;
        if (DHAES_MODE)
        {
            macKey = key;
            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
        }
        else
        {
            cipherKey = key;
            macKey = key + plaintextLength;
        }
 
        ConstByteArrayParameter encodingParameters;
        parameters.GetValue(Name::EncodingParameters(), encodingParameters);
 
        if (plaintextLength)    // Coverity finding
            xorbuf(ciphertext, plaintext, cipherKey, plaintextLength);
 
        MAC mac(macKey);
        mac.Update(ciphertext, plaintextLength);
        mac.Update(encodingParameters.begin(), encodingParameters.size());
        if (DHAES_MODE)
        {
            byte L[8];
            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
            mac.Update(L, 8);
        }
        mac.Final(ciphertext + plaintextLength);
    }
    DecodingResult SymmetricDecrypt(const byte *key, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters) const
    {
        size_t plaintextLength = GetMaxSymmetricPlaintextLength(ciphertextLength);
        const byte *cipherKey, *macKey;
        if (DHAES_MODE)
        {
            macKey = key;
            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
        }
        else
        {
            cipherKey = key;
            macKey = key + plaintextLength;
        }
 
        ConstByteArrayParameter encodingParameters;
        parameters.GetValue(Name::EncodingParameters(), encodingParameters);
 
        MAC mac(macKey);
        mac.Update(ciphertext, plaintextLength);
        mac.Update(encodingParameters.begin(), encodingParameters.size());
        if (DHAES_MODE)
        {
            byte L[8];
            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
            mac.Update(L, 8);
        }
        if (!mac.Verify(ciphertext + plaintextLength))
            return DecodingResult();
 
        if (plaintextLength)    // Coverity finding
            xorbuf(plaintext, ciphertext, cipherKey, plaintextLength);
 
        return DecodingResult(plaintextLength);
    }
};
 
template <class T, bool DHAES_MODE, class KDF>
class DL_KeyDerivationAlgorithm_P1363 : public DL_KeyDerivationAlgorithm<T>
{
public:
    virtual ~DL_KeyDerivationAlgorithm_P1363() {}
 
    bool ParameterSupported(const char *name) const {return strcmp(name, Name::KeyDerivationParameters()) == 0;}
    void Derive(const DL_GroupParameters<T> &params, byte *derivedKey, size_t derivedLength, const T &agreedElement, const T &ephemeralPublicKey, const NameValuePairs &parameters) const
    {
        SecByteBlock agreedSecret;
        if (DHAES_MODE)
        {
            agreedSecret.New(params.GetEncodedElementSize(true) + params.GetEncodedElementSize(false));
            params.EncodeElement(true, ephemeralPublicKey, agreedSecret);
            params.EncodeElement(false, agreedElement, agreedSecret + params.GetEncodedElementSize(true));
        }
        else
        {
            agreedSecret.New(params.GetEncodedElementSize(false));
            params.EncodeElement(false, agreedElement, agreedSecret);
        }
 
        ConstByteArrayParameter derivationParameters;
        parameters.GetValue(Name::KeyDerivationParameters(), derivationParameters);
        KDF::DeriveKey(derivedKey, derivedLength, agreedSecret, agreedSecret.size(), derivationParameters.begin(), derivationParameters.size());
    }
};
 
template <class HASH = SHA1, class COFACTOR_OPTION = NoCofactorMultiplication, bool DHAES_MODE = true, bool LABEL_OCTETS=false>
struct DLIES
    : public DL_ES<
        DL_CryptoKeys_GFP,
        DL_KeyAgreementAlgorithm_DH<Integer, COFACTOR_OPTION>,
        DL_KeyDerivationAlgorithm_P1363<Integer, DHAES_MODE, P1363_KDF2<HASH> >,
        DL_EncryptionAlgorithm_Xor<HMAC<HASH>, DHAES_MODE, LABEL_OCTETS>,
        DLIES<> >
{
    static std::string CRYPTOPP_API StaticAlgorithmName() {return "DLIES";}    // TODO: fix this after name is standardized
};
 
NAMESPACE_END
 
#if CRYPTOPP_MSC_VERSION
# pragma warning(pop)
#endif
 
#endif