diff options
| -rw-r--r-- | Makefile.am | 3 | ||||
| -rw-r--r-- | configure.ac | 2 | ||||
| -rw-r--r-- | crypto.c | 485 | ||||
| -rw-r--r-- | crypto.h | 78 | ||||
| -rw-r--r-- | smc.c | 403 | ||||
| -rw-r--r-- | smc.h | 83 | ||||
| -rw-r--r-- | test_crypto.c | 45 |
7 files changed, 539 insertions, 560 deletions
diff --git a/Makefile.am b/Makefile.am index 76820c6..0f9dd23 100644 --- a/Makefile.am +++ b/Makefile.am @@ -7,8 +7,7 @@ lib_LTLIBRARIES = \ libbrandt_la_SOURCES = \ brandt.c \ crypto.c \ - util.c \ - smc.c + util.c libbrandt_la_LIBADD = \ -lgcrypt -lgpg-error diff --git a/configure.ac b/configure.ac index 14b04b4..7045a2f 100644 --- a/configure.ac +++ b/configure.ac @@ -6,7 +6,7 @@ AC_INIT([libbrandt], [0.1], [teichm@net.in.tum.de]) AM_INIT_AUTOMAKE([1.15]) -AC_CONFIG_SRCDIR([smc.c]) +AC_CONFIG_SRCDIR([brandt.c]) #AC_CONFIG_HEADERS([config.h]) # Checks for programs. @@ -19,25 +19,22 @@ * @brief Implementation of the crypto primitives. */ + #include <arpa/inet.h> +#include <gcrypt.h> #include "crypto.h" +#include "internals.h" #include "util.h" #define CURVE "Ed25519" -struct brandt_ec_skey { - unsigned char d[256 / 8]; -}; -struct brandt_ec_pkey { - unsigned char q_y[256 / 8]; -}; +static gcry_ctx_t ec_ctx; +static gcry_mpi_point_t ec_gen; +static gcry_mpi_point_t ec_zero; +static gcry_mpi_t ec_n; -gcry_ctx_t ec_ctx; -gcry_mpi_point_t ec_gen; -gcry_mpi_point_t ec_zero; -gcry_mpi_t ec_n; /** * brandt_crypto_init @@ -175,39 +172,16 @@ brandt_mpi_scan_unsigned (gcry_mpi_t *result, const void *data, size_t size) } -//gcry_mpi_point_t -//deserialize_point(const struct brandt_point* data, const int len) -//{ -// gcry_sexp_t s; -// gcry_ctx_t ctx; -// gcry_mpi_point_t ret; -// gcry_error_t rc; -// -// rc = gcry_sexp_build(&s, NULL, "(public-key(ecc(curve " CURVE ")(q %b)))", -// len, data); -// brandt_assert_gpgerr(rc); -// -// rc = gcry_mpi_ec_new(&ctx, s, NULL); -// brandt_assert_gpgerr(rc); -// gcry_sexp_release(s); -// -// ret = gcry_mpi_ec_get_point("q", ctx, 0); -// brandt_assert(ret); -// gcry_ctx_release(ctx); -// return ret; -//} - - /* --- EC --- */ /** - * brandt_ec_skey_create + * ec_skey_create * * @param[out] skey where to store the generated secret key. This has to be an * already initialized mpi. */ void -brandt_ec_skey_create (gcry_mpi_t skey) +ec_skey_create (gcry_mpi_t skey) { gcry_mpi_t ret; gcry_sexp_t s_keyparam; @@ -241,45 +215,45 @@ brandt_ec_skey_create (gcry_mpi_t skey) /** - * brandt_ec_keypair_create + * ec_keypair_create * * @param[out] pkey where to store the generated public key * @param[out] skey where to store the generated secret key */ void -brandt_ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey) +ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey) { brandt_assert (NULL != pkey); brandt_assert (NULL != skey); - brandt_ec_skey_create (skey); + ec_skey_create (skey); gcry_mpi_ec_mul (pkey, skey, ec_gen, ec_ctx); } /** - * brandt_ec_keypair_create_base + * ec_keypair_create_base * * @param[out] pkey where to store the generated public key * @param[out] skey where to store the generated secret key * @param[in] base which base point should be used to calculate the public key */ void -brandt_ec_keypair_create_base (gcry_mpi_point_t pkey, - gcry_mpi_t skey, - const gcry_mpi_point_t base) +ec_keypair_create_base (gcry_mpi_point_t pkey, + gcry_mpi_t skey, + const gcry_mpi_point_t base) { brandt_assert (NULL != pkey); brandt_assert (NULL != skey); brandt_assert (NULL != base); - brandt_ec_skey_create (skey); + ec_skey_create (skey); gcry_mpi_ec_mul (pkey, skey, base, ec_ctx); } /** - * brandt_ec_point_cmp compares two curve points + * ec_point_cmp compares two curve points * * @param[in] a the first point * @param[in] b the second point @@ -287,7 +261,7 @@ brandt_ec_keypair_create_base (gcry_mpi_point_t pkey, * else otherwise */ int -brandt_ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b) +ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b) { int ret = 1; gcry_mpi_t ax = gcry_mpi_new (0); @@ -316,24 +290,431 @@ brandt_ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b) } +static gcry_mpi_point_t ** +smc_init2 (uint16_t size1, uint16_t size2) +{ + uint16_t i, j; + gcry_mpi_point_t **ret; + gcry_mpi_point_t *data; + + ret = calloc (size1, sizeof (*ret) + (size2 * sizeof (**ret))); + brandt_assert (NULL != ret); + data = (gcry_mpi_point_t *)&ret[size1]; + for (i = 0; i < size1; i++) + { + ret[i] = &data[i * size2]; + for (j = 0; j < size2; j++) + ret[i][j] = gcry_mpi_point_new (0); + } + return ret; +} + + +static void +smc_free2 (gcry_mpi_point_t **dst, uint16_t size1, uint16_t size2) +{ + uint16_t i, j; + + for (i = 0; i < size1; i++) + for (j = 0; j < size2; j++) + gcry_mpi_point_release (dst[i][j]); + free (dst); +} + + +/** + * smc_sums_partial calculates sums up until the current index and stores them + * in @a out. @$f\forall i \leq len: out_i=sum_{h=1}^iin_h@$f + * + * @param[out] out Where to store the resulting sums. Points may be given + * uninitialized, but the appropriate amount of memory has to be allocated + * beforehand. + * @param[in] in Input points. + * @param[in] len The length of both @a out and @a in. + */ +static void +smc_sums_partial (gcry_mpi_point_t out[], gcry_mpi_point_t in[], uint16_t len) +{ + uint16_t i; + + for (i = 0; i < len; i++) + { + out[i] = gcry_mpi_point_new (0); + gcry_mpi_ec_add (out[i], in[i], (i ? out[i - 1] : ec_zero), ec_ctx); + brandt_assert (NULL != out[i]); + } +} + + /** - * Clear memory that was used to store a private key. + * smc_sum calculates the sum of all input points. @$fout=sum_{i=1}^{len}in_i@$f * - * @param skey location of the key + * @param[out] out Where to store the result + * @param[in] in Input points. + * @param[in] len The length of @a in. + */ +static void +smc_sum (gcry_mpi_point_t out, gcry_mpi_point_t in[], uint16_t len) +{ + uint16_t i; + + brandt_assert (NULL != out); + /**TODO: how to copy a point more efficiently? */ + gcry_mpi_ec_add (out, ec_zero, ec_zero, ec_ctx); + for (i = 0; i < len; i++) + gcry_mpi_ec_add (out, out, in[i], ec_ctx); +} + + +/** + * smc_compute_pkey calculates the shared public key + * + * @param[in,out] ad The struct AuctionData used */ void -brandt_ec_key_clear (struct brandt_ec_skey *skey) +smc_compute_pkey (struct AuctionData *ad) { - memset (skey, 0, sizeof (struct brandt_ec_skey)); + ad->Y = gcry_mpi_point_new (0); + smc_sum (ad->Y, ad->y, ad->n); +} + + +/** + * smc_zkp_dl + * + * @param v TODO + * @param g TODO + * @param x TODO + * @param a TODO + * @param c TODO + * @param r TODO + */ +void +smc_zkp_dl (const gcry_mpi_point_t v, + const gcry_mpi_point_t g, + const gcry_mpi_t x, + const gcry_mpi_point_t a, + gcry_mpi_t c, + gcry_mpi_t r) +{ + gcry_mpi_t z = gcry_mpi_new (0); + + ec_keypair_create_base (a, z, g); + + /* compute challange c */ + /**TODO: generate c from HASH(g,v,a) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + gcry_mpi_mulm (r, c, x, ec_n); + gcry_mpi_addm (r, r, z, ec_n); + + gcry_mpi_release (z); } /** - * Generate a random value mod n. + * smc_zkp_dl_check * - * @param edc ECC context - * @return random value mod n. + * @param v TODO + * @param g TODO + * @param a TODO + * @param c TODO + * @param r TODO + * @return 0 if the proof is correct, something else otherwise */ +int +smc_zkp_dl_check (const gcry_mpi_point_t v, + const gcry_mpi_point_t g, + const gcry_mpi_point_t a, + const gcry_mpi_t c, + const gcry_mpi_t r) +{ + int ret; + gcry_mpi_point_t left = gcry_mpi_point_new (0); + gcry_mpi_point_t right = gcry_mpi_point_new (0); + + gcry_mpi_ec_mul (left, r, g, ec_ctx); + gcry_mpi_ec_mul (right, c, v, ec_ctx); + gcry_mpi_ec_add (right, a, right, ec_ctx); + + ret = ec_point_cmp (left, right); + gcry_mpi_point_release (left); + gcry_mpi_point_release (right); + + return ret; +} + + +void +smc_zkp_2dle (const gcry_mpi_point_t v, + const gcry_mpi_point_t w, + const gcry_mpi_point_t g1, + const gcry_mpi_point_t g2, + const gcry_mpi_t x, + gcry_mpi_point_t a, + gcry_mpi_point_t b, + gcry_mpi_t c, + gcry_mpi_t r) +{ + gcry_mpi_t z = gcry_mpi_new (0); + + ec_keypair_create_base (a, z, g1); + gcry_mpi_ec_mul (b, z, g2, ec_ctx); + + /* compute challange c */ + /**TODO: generate c from HASH(g1,g2,v,w,a,b) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + gcry_mpi_mulm (r, c, x, ec_n); + gcry_mpi_addm (r, r, z, ec_n); + + gcry_mpi_release (z); +} + + +int +smc_zkp_2dle_check (const gcry_mpi_point_t v, + const gcry_mpi_point_t w, + const gcry_mpi_point_t g1, + const gcry_mpi_point_t g2, + const gcry_mpi_point_t a, + const gcry_mpi_point_t b, + const gcry_mpi_t c, + const gcry_mpi_t r) +{ + int ret; + gcry_mpi_point_t left = gcry_mpi_point_new (0); + gcry_mpi_point_t right = gcry_mpi_point_new (0); + + gcry_mpi_ec_mul (left, r, g1, ec_ctx); + gcry_mpi_ec_mul (right, c, v, ec_ctx); + gcry_mpi_ec_add (right, a, right, ec_ctx); + ret = ec_point_cmp (left, right); + + gcry_mpi_ec_mul (left, r, g2, ec_ctx); + gcry_mpi_ec_mul (right, c, w, ec_ctx); + gcry_mpi_ec_add (right, b, right, ec_ctx); + ret |= ec_point_cmp (left, right); + + gcry_mpi_point_release (left); + gcry_mpi_point_release (right); + + return ret; +} + + +void +smc_zkp_0og (gcry_mpi_point_t alpha, + const gcry_mpi_point_t m, + const gcry_mpi_point_t y, + gcry_mpi_point_t beta, + gcry_mpi_point_t a1, + gcry_mpi_point_t a2, + gcry_mpi_point_t b1, + gcry_mpi_point_t b2, + gcry_mpi_t c, + gcry_mpi_t d1, + gcry_mpi_t d2, + gcry_mpi_t r1, + gcry_mpi_t r2) +{ + gcry_mpi_t r = gcry_mpi_new (0); + gcry_mpi_t w = gcry_mpi_new (0); + int eq0 = !ec_point_cmp (m, ec_zero); + int eqg = !ec_point_cmp (m, ec_gen); + + if (!(eq0 ^ eqg)) + eprintf ("zero knowledge proof: m is neither 0 nor g"); + + /* beta = r*g */ + ec_keypair_create (beta, r); + gcry_mpi_mod (r, r, ec_n); + + /* alpha = m + r*y */ + gcry_mpi_ec_mul (alpha, r, y, ec_ctx); + gcry_mpi_ec_add (alpha, m, alpha, ec_ctx); + + if (eq0) + { /* m == 0 */ + ec_keypair_create_base (a1, d1, beta); + gcry_mpi_mod (d1, d1, ec_n); + ec_keypair_create_base (b1, r1, y); + gcry_mpi_mod (r1, r1, ec_n); + + /* a1 = r1*g + d1*beta */ + gcry_mpi_ec_mul (a2, r1, ec_gen, ec_ctx); + gcry_mpi_ec_add (a1, a2, a1, ec_ctx); + + /* b1 = r1*y + d1*(alpha-g) */ + gcry_mpi_ec_sub (b2, alpha, ec_gen, ec_ctx); + gcry_mpi_ec_mul (a2, d1, b2, ec_ctx); + gcry_mpi_ec_add (b1, b1, a2, ec_ctx); + + /* a2 = w * g */ + ec_keypair_create_base (a2, w, ec_gen); + gcry_mpi_mod (w, w, ec_n); + + /* b2 = w * y */ + gcry_mpi_ec_mul (b2, w, y, ec_ctx); + + /* compute challange c */ + /**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + /* d2 = c - d1 */ + gcry_mpi_subm (d2, c, d1, ec_n); + + /* r2 = w - r*d2 */ + gcry_mpi_mulm (r2, r, d2, ec_n); + gcry_mpi_subm (r2, w, r2, ec_n); + } + else + { /* m == g */ + ec_keypair_create_base (a2, d2, beta); + gcry_mpi_mod (d2, d2, ec_n); + ec_keypair_create_base (b2, r2, y); + gcry_mpi_mod (r2, r2, ec_n); + + /* a2 = r2*g + d2*beta */ + gcry_mpi_ec_mul (a1, r2, ec_gen, ec_ctx); + gcry_mpi_ec_add (a2, a1, a2, ec_ctx); + + /* b2 = r2*y + d2*(alpha-0) */ + /* useless subtraction to have same amount of operations as in m == 0 */ + gcry_mpi_ec_sub (b1, alpha, ec_zero, ec_ctx); + gcry_mpi_ec_mul (a1, d2, b1, ec_ctx); + gcry_mpi_ec_add (b2, b2, a1, ec_ctx); + + /* a1 = w * g */ + ec_keypair_create_base (a1, w, ec_gen); + gcry_mpi_mod (w, w, ec_n); + + /* b1 = w * y */ + gcry_mpi_ec_mul (b1, w, y, ec_ctx); + + /* compute challange c */ + /**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + /* d1 = c - d2 */ + gcry_mpi_subm (d1, c, d2, ec_n); + + /* r1 = w - r*d1 */ + gcry_mpi_mulm (r1, r, d1, ec_n); + gcry_mpi_subm (r1, w, r1, ec_n); + } + + gcry_mpi_release (r); + gcry_mpi_release (w); +} + + +int +smc_zkp_0og_check (const gcry_mpi_point_t alpha, + const gcry_mpi_point_t y, + const gcry_mpi_point_t beta, + const gcry_mpi_point_t a1, + const gcry_mpi_point_t a2, + const gcry_mpi_point_t b1, + const gcry_mpi_point_t b2, + const gcry_mpi_t c, + const gcry_mpi_t d1, + const gcry_mpi_t d2, + const gcry_mpi_t r1, + const gcry_mpi_t r2) +{ + int ret; + gcry_mpi_t sum = gcry_mpi_new (0); + gcry_mpi_point_t right = gcry_mpi_point_new (0); + gcry_mpi_point_t tmp = gcry_mpi_point_new (0); + + /* c == d1 + d2 */ + gcry_mpi_addm (sum, d1, d2, ec_n); + ret = gcry_mpi_cmp (c, sum); + + /* a1 == r1*g + d1*beta */ + gcry_mpi_ec_mul (tmp, r1, ec_gen, ec_ctx); + gcry_mpi_ec_mul (right, d1, beta, ec_ctx); + gcry_mpi_ec_add (right, tmp, right, ec_ctx); + ret |= ec_point_cmp (a1, right) << 1; + + /* b1 == r1*y + d1*(alpha-g) */ + gcry_mpi_ec_sub (right, alpha, ec_gen, ec_ctx); + gcry_mpi_ec_mul (tmp, d1, right, ec_ctx); + gcry_mpi_ec_mul (right, r1, y, ec_ctx); + gcry_mpi_ec_add (right, right, tmp, ec_ctx); + ret |= ec_point_cmp (b1, right) << 2; + + /* a2 == r2*g + d2*beta */ + gcry_mpi_ec_mul (tmp, d2, beta, ec_ctx); + gcry_mpi_ec_mul (right, r2, ec_gen, ec_ctx); + gcry_mpi_ec_add (right, right, tmp, ec_ctx); + ret |= ec_point_cmp (a2, right) << 3; + + /* b2 == r2*y + d2*alpha */ + gcry_mpi_ec_mul (tmp, d2, alpha, ec_ctx); + gcry_mpi_ec_mul (right, r2, y, ec_ctx); + gcry_mpi_ec_add (right, right, tmp, ec_ctx); + ret |= ec_point_cmp (b2, right) << 4; + + gcry_mpi_release (sum); + gcry_mpi_point_release (right); + gcry_mpi_point_release (tmp); + + if (ret) + weprintf ("ret: 0x%x", ret); + return ret; +} + + +/* --- unused stuff, might become useful later --- */ + +///** +// * Clear memory that was used to store a private key. +// * +// * @param skey the key +// */ +//void +//brandt_ec_key_clear (gcry_mpi_t skey) +//{ +// gcry_mpi_randomize (skey, 256, GCRY_WEAK_RANDOM); +// gcry_mpi_release (skey); +//} + + +//gcry_mpi_point_t +//deserialize_point(const struct brandt_point* data, const int len) +//{ +// gcry_sexp_t s; +// gcry_ctx_t ctx; +// gcry_mpi_point_t ret; +// gcry_error_t rc; +// +// rc = gcry_sexp_build(&s, NULL, "(public-key(ecc(curve " CURVE ")(q %b)))", +// len, data); +// brandt_assert_gpgerr(rc); +// +// rc = gcry_mpi_ec_new(&ctx, s, NULL); +// brandt_assert_gpgerr(rc); +// gcry_sexp_release(s); +// +// ret = gcry_mpi_ec_get_point("q", ctx, 0); +// brandt_assert(ret); +// gcry_ctx_release(ctx); +// return ret; +//} + + +///** +// * Generate a random value mod n. +// * +// * @param edc ECC context +// * @return random value mod n. +// */ //gcry_mpi_t //GNUNET_CRYPTO_ecc_random_mod_n (struct GNUNET_CRYPTO_EccDlogContext *edc) //{ @@ -52,12 +52,76 @@ void brandt_mpi_scan_unsigned (gcry_mpi_t *result, /* --- EC --- */ -void brandt_ec_skey_create (gcry_mpi_t skey); -void brandt_ec_pkey_compute (gcry_mpi_point_t *pkey, const gcry_mpi_t skey); -void brandt_ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey); -void brandt_ec_keypair_create_base (gcry_mpi_point_t pkey, - gcry_mpi_t skey, - const gcry_mpi_point_t base); -int brandt_ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b); +struct ec_point { + unsigned char data[256 / 8]; +}; + +int ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b); +void ec_skey_create (gcry_mpi_t skey); +void ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey); +void ec_keypair_create_base (gcry_mpi_point_t pkey, + gcry_mpi_t skey, + const gcry_mpi_point_t base); + + + + +/* --- Zero knowledge proofs --- */ + +void smc_zkp_dl (const gcry_mpi_point_t v, + const gcry_mpi_point_t g, + const gcry_mpi_t x, + const gcry_mpi_point_t a, + gcry_mpi_t c, + gcry_mpi_t r); +int smc_zkp_dl_check (const gcry_mpi_point_t v, + const gcry_mpi_point_t g, + const gcry_mpi_point_t a, + const gcry_mpi_t c, + const gcry_mpi_t r); + +void smc_zkp_2dle (const gcry_mpi_point_t v, + const gcry_mpi_point_t w, + const gcry_mpi_point_t g1, + const gcry_mpi_point_t g2, + const gcry_mpi_t x, + gcry_mpi_point_t a, + gcry_mpi_point_t b, + gcry_mpi_t c, + gcry_mpi_t r); +int smc_zkp_2dle_check (const gcry_mpi_point_t v, + const gcry_mpi_point_t w, + const gcry_mpi_point_t g1, + const gcry_mpi_point_t g2, + const gcry_mpi_point_t a, + const gcry_mpi_point_t b, + const gcry_mpi_t c, + const gcry_mpi_t r); + +void smc_zkp_0og (gcry_mpi_point_t alpha, + const gcry_mpi_point_t m, + const gcry_mpi_point_t y, + gcry_mpi_point_t beta, + gcry_mpi_point_t a1, + gcry_mpi_point_t a2, + gcry_mpi_point_t b1, + gcry_mpi_point_t b2, + gcry_mpi_t c, + gcry_mpi_t d1, + gcry_mpi_t d2, + gcry_mpi_t r1, + gcry_mpi_t r2); +int smc_zkp_0og_check (const gcry_mpi_point_t alpha, + const gcry_mpi_point_t y, + const gcry_mpi_point_t beta, + const gcry_mpi_point_t a1, + const gcry_mpi_point_t a2, + const gcry_mpi_point_t b1, + const gcry_mpi_point_t b2, + const gcry_mpi_t c, + const gcry_mpi_t d1, + const gcry_mpi_t d2, + const gcry_mpi_t r1, + const gcry_mpi_t r2); #endif /* ifndef _BRANDT_CRYPTO_H */ @@ -1,403 +0,0 @@ -/* This file is part of libbrandt. - * Copyright (C) 2016 GNUnet e.V. - * - * libbrandt is free software: you can redistribute it and/or modify it under - * the terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libbrandt is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR - * A PARTICULAR PURPOSE. See the GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License along with - * libbrandt. If not, see <http://www.gnu.org/licenses/>. - */ - -/** - * @file smc.c - * @brief Implementation of the smc primitives. - */ - -#include <gcrypt.h> - -#include "crypto.h" -#include "internals.h" -#include "smc.h" -#include "util.h" - -extern gcry_ctx_t ec_ctx; -extern gcry_mpi_point_t ec_gen; -extern gcry_mpi_point_t ec_zero; -extern gcry_mpi_t ec_n; - - -/** - * smc_sums_partial calculates sums up until the current index and stores them - * in @a out. @$f\forall i \leq len: out_i=sum_{h=1}^iin_h@$f - * - * @param[out] out Where to store the resulting sums. Points may be given - * uninitialized, but the appropriate amount of memory has to be allocated - * beforehand. - * @param[in] in Input points. - * @param[in] len The length of both @a out and @a in. - */ -static void -smc_sums_partial (gcry_mpi_point_t out[], gcry_mpi_point_t in[], uint16_t len) -{ - uint16_t i; - - for (i = 0; i < len; i++) - { - out[i] = gcry_mpi_point_new (0); - gcry_mpi_ec_add (out[i], in[i], (i ? out[i - 1] : ec_zero), ec_ctx); - brandt_assert (NULL != out[i]); - } -} - - -/** - * smc_sum calculates the sum of all input points. @$fout=sum_{i=1}^{len}in_i@$f - * - * @param[out] out Where to store the result - * @param[in] in Input points. - * @param[in] len The length of @a in. - */ -static void -smc_sum (gcry_mpi_point_t out, gcry_mpi_point_t in[], uint16_t len) -{ - uint16_t i; - - brandt_assert (NULL != out); - /**TODO: how to copy a point more efficiently? */ - gcry_mpi_ec_add (out, ec_zero, ec_zero, ec_ctx); - for (i = 0; i < len; i++) - gcry_mpi_ec_add (out, out, in[i], ec_ctx); -} - - -/** - * smc_compute_pkey calculates the shared public key - * - * @param[in,out] ad The struct AuctionData used - */ -void -smc_compute_pkey (struct AuctionData *ad) -{ - ad->Y = gcry_mpi_point_new (0); - smc_sum (ad->Y, ad->y, ad->n); -} - - -/** - * smc_zkp_dl - * - * @param v TODO - * @param g TODO - * @param x TODO - * @param a TODO - * @param c TODO - * @param r TODO - */ -void -smc_zkp_dl (const gcry_mpi_point_t v, - const gcry_mpi_point_t g, - const gcry_mpi_t x, - const gcry_mpi_point_t a, - gcry_mpi_t c, - gcry_mpi_t r) -{ - gcry_mpi_t z = gcry_mpi_new (0); - - brandt_ec_keypair_create_base (a, z, g); - - /* compute challange c */ - /**TODO: generate c from HASH(g,v,a) and don't output it */ - brandt_ec_skey_create (c); - gcry_mpi_mod (c, c, ec_n); - - gcry_mpi_mulm (r, c, x, ec_n); - gcry_mpi_addm (r, r, z, ec_n); - - gcry_mpi_release (z); -} - - -/** - * smc_zkp_dl_check - * - * @param v TODO - * @param g TODO - * @param a TODO - * @param c TODO - * @param r TODO - * @return 0 if the proof is correct, something else otherwise - */ -int -smc_zkp_dl_check (const gcry_mpi_point_t v, - const gcry_mpi_point_t g, - const gcry_mpi_point_t a, - const gcry_mpi_t c, - const gcry_mpi_t r) -{ - int ret; - gcry_mpi_point_t left = gcry_mpi_point_new (0); - gcry_mpi_point_t right = gcry_mpi_point_new (0); - - gcry_mpi_ec_mul (left, r, g, ec_ctx); - gcry_mpi_ec_mul (right, c, v, ec_ctx); - gcry_mpi_ec_add (right, a, right, ec_ctx); - - ret = brandt_ec_point_cmp (left, right); - gcry_mpi_point_release (left); - gcry_mpi_point_release (right); - - return ret; -} - - -void -smc_zkp_2dle (const gcry_mpi_point_t v, - const gcry_mpi_point_t w, - const gcry_mpi_point_t g1, - const gcry_mpi_point_t g2, - const gcry_mpi_t x, - gcry_mpi_point_t a, - gcry_mpi_point_t b, - gcry_mpi_t c, - gcry_mpi_t r) -{ - gcry_mpi_t z = gcry_mpi_new (0); - - brandt_ec_keypair_create_base (a, z, g1); - gcry_mpi_ec_mul (b, z, g2, ec_ctx); - - /* compute challange c */ - /**TODO: generate c from HASH(g1,g2,v,w,a,b) and don't output it */ - brandt_ec_skey_create (c); - gcry_mpi_mod (c, c, ec_n); - - gcry_mpi_mulm (r, c, x, ec_n); - gcry_mpi_addm (r, r, z, ec_n); - - gcry_mpi_release (z); -} - - -int -smc_zkp_2dle_check (const gcry_mpi_point_t v, - const gcry_mpi_point_t w, - const gcry_mpi_point_t g1, - const gcry_mpi_point_t g2, - const gcry_mpi_point_t a, - const gcry_mpi_point_t b, - const gcry_mpi_t c, - const gcry_mpi_t r) -{ - int ret; - gcry_mpi_point_t left = gcry_mpi_point_new (0); - gcry_mpi_point_t right = gcry_mpi_point_new (0); - - gcry_mpi_ec_mul (left, r, g1, ec_ctx); - gcry_mpi_ec_mul (right, c, v, ec_ctx); - gcry_mpi_ec_add (right, a, right, ec_ctx); - ret = brandt_ec_point_cmp (left, right); - - gcry_mpi_ec_mul (left, r, g2, ec_ctx); - gcry_mpi_ec_mul (right, c, w, ec_ctx); - gcry_mpi_ec_add (right, b, right, ec_ctx); - ret |= brandt_ec_point_cmp (left, right); - - gcry_mpi_point_release (left); - gcry_mpi_point_release (right); - - return ret; -} - - -void -smc_zkp_0og (gcry_mpi_point_t alpha, - const gcry_mpi_point_t m, - const gcry_mpi_point_t y, - gcry_mpi_point_t beta, - gcry_mpi_point_t a1, - gcry_mpi_point_t a2, - gcry_mpi_point_t b1, - gcry_mpi_point_t b2, - gcry_mpi_t c, - gcry_mpi_t d1, - gcry_mpi_t d2, - gcry_mpi_t r1, - gcry_mpi_t r2) -{ - gcry_mpi_t r = gcry_mpi_new (0); - gcry_mpi_t w = gcry_mpi_new (0); - int eq0 = !brandt_ec_point_cmp (m, ec_zero); - int eqg = !brandt_ec_point_cmp (m, ec_gen); - - if (!(eq0 ^ eqg)) - eprintf ("zero knowledge proof: m is neither 0 nor g"); - - /* beta = r*g */ - brandt_ec_keypair_create (beta, r); - gcry_mpi_mod (r, r, ec_n); - - /* alpha = m + r*y */ - gcry_mpi_ec_mul (alpha, r, y, ec_ctx); - gcry_mpi_ec_add (alpha, m, alpha, ec_ctx); - - if (eq0) - { /* m == 0 */ - brandt_ec_keypair_create_base (a1, d1, beta); - gcry_mpi_mod (d1, d1, ec_n); - brandt_ec_keypair_create_base (b1, r1, y); - gcry_mpi_mod (r1, r1, ec_n); - - /* a1 = r1*g + d1*beta */ - gcry_mpi_ec_mul (a2, r1, ec_gen, ec_ctx); - gcry_mpi_ec_add (a1, a2, a1, ec_ctx); - - /* b1 = r1*y + d1*(alpha-g) */ - gcry_mpi_ec_sub (b2, alpha, ec_gen, ec_ctx); - gcry_mpi_ec_mul (a2, d1, b2, ec_ctx); - gcry_mpi_ec_add (b1, b1, a2, ec_ctx); - - /* a2 = w * g */ - brandt_ec_keypair_create_base (a2, w, ec_gen); - gcry_mpi_mod (w, w, ec_n); - - /* b2 = w * y */ - gcry_mpi_ec_mul (b2, w, y, ec_ctx); - - /* compute challange c */ - /**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */ - brandt_ec_skey_create (c); - gcry_mpi_mod (c, c, ec_n); - - /* d2 = c - d1 */ - gcry_mpi_subm (d2, c, d1, ec_n); - - /* r2 = w - r*d2 */ - gcry_mpi_mulm (r2, r, d2, ec_n); - gcry_mpi_subm (r2, w, r2, ec_n); - } - else - { /* m == g */ - brandt_ec_keypair_create_base (a2, d2, beta); - gcry_mpi_mod (d2, d2, ec_n); - brandt_ec_keypair_create_base (b2, r2, y); - gcry_mpi_mod (r2, r2, ec_n); - - /* a2 = r2*g + d2*beta */ - gcry_mpi_ec_mul (a1, r2, ec_gen, ec_ctx); - gcry_mpi_ec_add (a2, a1, a2, ec_ctx); - - /* b2 = r2*y + d2*(alpha-0) */ - /* useless subtraction to have same amount of operations as in m == 0 */ - gcry_mpi_ec_sub (b1, alpha, ec_zero, ec_ctx); - gcry_mpi_ec_mul (a1, d2, b1, ec_ctx); - gcry_mpi_ec_add (b2, b2, a1, ec_ctx); - - /* a1 = w * g */ - brandt_ec_keypair_create_base (a1, w, ec_gen); - gcry_mpi_mod (w, w, ec_n); - - /* b1 = w * y */ - gcry_mpi_ec_mul (b1, w, y, ec_ctx); - - /* compute challange c */ - /**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */ - brandt_ec_skey_create (c); - gcry_mpi_mod (c, c, ec_n); - - /* d1 = c - d2 */ - gcry_mpi_subm (d1, c, d2, ec_n); - - /* r1 = w - r*d1 */ - gcry_mpi_mulm (r1, r, d1, ec_n); - gcry_mpi_subm (r1, w, r1, ec_n); - } - - gcry_mpi_release (r); - gcry_mpi_release (w); -} - - -int -smc_zkp_0og_check (const gcry_mpi_point_t alpha, - const gcry_mpi_point_t y, - const gcry_mpi_point_t beta, - const gcry_mpi_point_t a1, - const gcry_mpi_point_t a2, - const gcry_mpi_point_t b1, - const gcry_mpi_point_t b2, - const gcry_mpi_t c, - const gcry_mpi_t d1, - const gcry_mpi_t d2, - const gcry_mpi_t r1, - const gcry_mpi_t r2) -{ - int ret; - gcry_mpi_t sum = gcry_mpi_new (0); - gcry_mpi_point_t right = gcry_mpi_point_new (0); - gcry_mpi_point_t tmp = gcry_mpi_point_new (0); - - /* c == d1 + d2 */ - gcry_mpi_addm (sum, d1, d2, ec_n); - ret = gcry_mpi_cmp (c, sum); - - /* a1 == r1*g + d1*beta */ - gcry_mpi_ec_mul (tmp, r1, ec_gen, ec_ctx); - gcry_mpi_ec_mul (right, d1, beta, ec_ctx); - gcry_mpi_ec_add (right, tmp, right, ec_ctx); - ret |= brandt_ec_point_cmp (a1, right) << 1; - - /* b1 == r1*y + d1*(alpha-g) */ - gcry_mpi_ec_sub (right, alpha, ec_gen, ec_ctx); - gcry_mpi_ec_mul (tmp, d1, right, ec_ctx); - gcry_mpi_ec_mul (right, r1, y, ec_ctx); - gcry_mpi_ec_add (right, right, tmp, ec_ctx); - ret |= brandt_ec_point_cmp (b1, right) << 2; - - /* a2 == r2*g + d2*beta */ - gcry_mpi_ec_mul (tmp, d2, beta, ec_ctx); - gcry_mpi_ec_mul (right, r2, ec_gen, ec_ctx); - gcry_mpi_ec_add (right, right, tmp, ec_ctx); - ret |= brandt_ec_point_cmp (a2, right) << 3; - - /* b2 == r2*y + d2*alpha */ - gcry_mpi_ec_mul (tmp, d2, alpha, ec_ctx); - gcry_mpi_ec_mul (right, r2, y, ec_ctx); - gcry_mpi_ec_add (right, right, tmp, ec_ctx); - ret |= brandt_ec_point_cmp (b2, right) << 4; - - gcry_mpi_release (sum); - gcry_mpi_point_release (right); - gcry_mpi_point_release (tmp); - - if (ret) - weprintf ("ret: 0x%x", ret); - return ret; -} - - -//GEN -//smc_hextodec (const char *s) -//{ -// size_t i; -// char c; -// pari_sp ltop = avma; -// GEN ret = gen_0; -// -// for (i = 0; i < strlen (s); i++) -// { -// errno = 0; -// if (1 != sscanf (&s[i], "%1hhx", &c)) -// { -// brandt_eprintf ("failed to parse hex (\"%s\") to decimal:", s); -// return NULL; -// } -// ret = addis (shifti (ret, 4), c); -// } -// return gerepilecopy (ltop, ret); -//} @@ -1,83 +0,0 @@ -/* This file is part of libbrandt. - * Copyright (C) 2016 GNUnet e.V. - * - * libbrandt is free software: you can redistribute it and/or modify it under - * the terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libbrandt is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR - * A PARTICULAR PURPOSE. See the GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License along with - * libbrandt. If not, see <http://www.gnu.org/licenses/>. - */ - -/** - * @file smc.h - * @brief describes the secure multiparty computation interface. - */ - -#ifndef _BRANDT_SMC_H -#define _BRANDT_SMC_H - -#include <gcrypt.h> - -void smc_zkp_dl (const gcry_mpi_point_t v, - const gcry_mpi_point_t g, - const gcry_mpi_t x, - const gcry_mpi_point_t a, - gcry_mpi_t c, - gcry_mpi_t r); -int smc_zkp_dl_check (const gcry_mpi_point_t v, - const gcry_mpi_point_t g, - const gcry_mpi_point_t a, - const gcry_mpi_t c, - const gcry_mpi_t r); - -void smc_zkp_2dle (const gcry_mpi_point_t v, - const gcry_mpi_point_t w, - const gcry_mpi_point_t g1, - const gcry_mpi_point_t g2, - const gcry_mpi_t x, - gcry_mpi_point_t a, - gcry_mpi_point_t b, - gcry_mpi_t c, - gcry_mpi_t r); -int smc_zkp_2dle_check (const gcry_mpi_point_t v, - const gcry_mpi_point_t w, - const gcry_mpi_point_t g1, - const gcry_mpi_point_t g2, - const gcry_mpi_point_t a, - const gcry_mpi_point_t b, - const gcry_mpi_t c, - const gcry_mpi_t r); - -void smc_zkp_0og (gcry_mpi_point_t alpha, - const gcry_mpi_point_t m, - const gcry_mpi_point_t y, - gcry_mpi_point_t beta, - gcry_mpi_point_t a1, - gcry_mpi_point_t a2, - gcry_mpi_point_t b1, - gcry_mpi_point_t b2, - gcry_mpi_t c, - gcry_mpi_t d1, - gcry_mpi_t d2, - gcry_mpi_t r1, - gcry_mpi_t r2); -int smc_zkp_0og_check (const gcry_mpi_point_t alpha, - const gcry_mpi_point_t y, - const gcry_mpi_point_t beta, - const gcry_mpi_point_t a1, - const gcry_mpi_point_t a2, - const gcry_mpi_point_t b1, - const gcry_mpi_point_t b2, - const gcry_mpi_t c, - const gcry_mpi_t d1, - const gcry_mpi_t d2, - const gcry_mpi_t r1, - const gcry_mpi_t r2); - -#endif // ifndef _BRANDT_SMC_H diff --git a/test_crypto.c b/test_crypto.c index 5cc2ed1..a42a643 100644 --- a/test_crypto.c +++ b/test_crypto.c @@ -18,15 +18,33 @@ * @file test_crypto.c * @brief testing crypto and smc functions. */ + +/* For testing static functions and variables we include the whole source */ +#include "crypto.c" + #include "brandt.h" #include "crypto.h" -#include "smc.h" #include "test.h" -extern gcry_ctx_t ec_ctx; -extern gcry_mpi_point_t ec_gen; -extern gcry_mpi_point_t ec_zero; -extern gcry_mpi_t ec_n; + +int +test_smc_2d_array () +{ + gcry_mpi_point_t **array; + uint16_t size1 = 3; + uint16_t size2 = 7; + uint16_t i, j; + + array = smc_init2 (size1, size2); + check (array, "memory allocation failed"); + + for (i = 0; i < size1; i++) + for (j = 0; j < size2; j++) + check (array[i][j], "point has not been initialized"); + + smc_free2 (array, size1, size2); +} + int test_smc_zkp_dl () @@ -38,7 +56,7 @@ test_smc_zkp_dl () gcry_mpi_point_t g = gcry_mpi_point_new (0); gcry_mpi_point_t v = gcry_mpi_point_new (0); - brandt_ec_keypair_create (g, c); + ec_keypair_create (g, c); if (0 == tests_run) { @@ -46,7 +64,7 @@ test_smc_zkp_dl () gcry_mpi_ec_mul (g, GCRYMPI_CONST_ONE, ec_gen, ec_ctx); } - brandt_ec_keypair_create_base (v, x, g); + ec_keypair_create_base (v, x, g); smc_zkp_dl (v, g, x, a, c, r); check (!smc_zkp_dl_check (v, g, a, c, r), "zkp dl wrong"); @@ -77,8 +95,8 @@ test_smc_zkp_2dle () gcry_mpi_point_t v = gcry_mpi_point_new (0); gcry_mpi_point_t w = gcry_mpi_point_new (0); - brandt_ec_keypair_create (g1, c); - brandt_ec_keypair_create (g2, c); + ec_keypair_create (g1, c); + ec_keypair_create (g2, c); if (0 == tests_run) { @@ -87,7 +105,7 @@ test_smc_zkp_2dle () gcry_mpi_ec_mul (g2, GCRYMPI_CONST_ONE, ec_gen, ec_ctx); } - brandt_ec_keypair_create_base (v, x, g1); + ec_keypair_create_base (v, x, g1); gcry_mpi_ec_mul (w, x, g2, ec_ctx); smc_zkp_2dle (v, w, g1, g2, x, a, b, c, r); @@ -128,7 +146,7 @@ test_smc_zkp_0og () gcry_mpi_point_t b1 = gcry_mpi_point_new (0); gcry_mpi_point_t b2 = gcry_mpi_point_new (0); - brandt_ec_keypair_create (y, c); + ec_keypair_create (y, c); smc_zkp_0og (alpha, (tests_run % 2 ? ec_zero : ec_gen), y, beta, a1, a2, b1, b2, c, d1, d2, r1, r2); @@ -161,10 +179,13 @@ test_smc_zkp_0og () int main (int argc, char *argv[]) { - int repeat = 32; + int repeat = 8; BRANDT_init (); + /* tests that need to run only once */ + run (test_smc_2d_array); + for (tests_run = 0; tests_run < repeat; tests_run++) { run (test_smc_zkp_dl); |