diff options
Diffstat (limited to 'crypto.c')
| -rw-r--r-- | crypto.c | 485 |
1 files changed, 433 insertions, 52 deletions
@@ -19,25 +19,22 @@ * @brief Implementation of the crypto primitives. */ + #include <arpa/inet.h> +#include <gcrypt.h> #include "crypto.h" +#include "internals.h" #include "util.h" #define CURVE "Ed25519" -struct brandt_ec_skey { - unsigned char d[256 / 8]; -}; -struct brandt_ec_pkey { - unsigned char q_y[256 / 8]; -}; +static gcry_ctx_t ec_ctx; +static gcry_mpi_point_t ec_gen; +static gcry_mpi_point_t ec_zero; +static gcry_mpi_t ec_n; -gcry_ctx_t ec_ctx; -gcry_mpi_point_t ec_gen; -gcry_mpi_point_t ec_zero; -gcry_mpi_t ec_n; /** * brandt_crypto_init @@ -175,39 +172,16 @@ brandt_mpi_scan_unsigned (gcry_mpi_t *result, const void *data, size_t size) } -//gcry_mpi_point_t -//deserialize_point(const struct brandt_point* data, const int len) -//{ -// gcry_sexp_t s; -// gcry_ctx_t ctx; -// gcry_mpi_point_t ret; -// gcry_error_t rc; -// -// rc = gcry_sexp_build(&s, NULL, "(public-key(ecc(curve " CURVE ")(q %b)))", -// len, data); -// brandt_assert_gpgerr(rc); -// -// rc = gcry_mpi_ec_new(&ctx, s, NULL); -// brandt_assert_gpgerr(rc); -// gcry_sexp_release(s); -// -// ret = gcry_mpi_ec_get_point("q", ctx, 0); -// brandt_assert(ret); -// gcry_ctx_release(ctx); -// return ret; -//} - - /* --- EC --- */ /** - * brandt_ec_skey_create + * ec_skey_create * * @param[out] skey where to store the generated secret key. This has to be an * already initialized mpi. */ void -brandt_ec_skey_create (gcry_mpi_t skey) +ec_skey_create (gcry_mpi_t skey) { gcry_mpi_t ret; gcry_sexp_t s_keyparam; @@ -241,45 +215,45 @@ brandt_ec_skey_create (gcry_mpi_t skey) /** - * brandt_ec_keypair_create + * ec_keypair_create * * @param[out] pkey where to store the generated public key * @param[out] skey where to store the generated secret key */ void -brandt_ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey) +ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey) { brandt_assert (NULL != pkey); brandt_assert (NULL != skey); - brandt_ec_skey_create (skey); + ec_skey_create (skey); gcry_mpi_ec_mul (pkey, skey, ec_gen, ec_ctx); } /** - * brandt_ec_keypair_create_base + * ec_keypair_create_base * * @param[out] pkey where to store the generated public key * @param[out] skey where to store the generated secret key * @param[in] base which base point should be used to calculate the public key */ void -brandt_ec_keypair_create_base (gcry_mpi_point_t pkey, - gcry_mpi_t skey, - const gcry_mpi_point_t base) +ec_keypair_create_base (gcry_mpi_point_t pkey, + gcry_mpi_t skey, + const gcry_mpi_point_t base) { brandt_assert (NULL != pkey); brandt_assert (NULL != skey); brandt_assert (NULL != base); - brandt_ec_skey_create (skey); + ec_skey_create (skey); gcry_mpi_ec_mul (pkey, skey, base, ec_ctx); } /** - * brandt_ec_point_cmp compares two curve points + * ec_point_cmp compares two curve points * * @param[in] a the first point * @param[in] b the second point @@ -287,7 +261,7 @@ brandt_ec_keypair_create_base (gcry_mpi_point_t pkey, * else otherwise */ int -brandt_ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b) +ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b) { int ret = 1; gcry_mpi_t ax = gcry_mpi_new (0); @@ -316,24 +290,431 @@ brandt_ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b) } +static gcry_mpi_point_t ** +smc_init2 (uint16_t size1, uint16_t size2) +{ + uint16_t i, j; + gcry_mpi_point_t **ret; + gcry_mpi_point_t *data; + + ret = calloc (size1, sizeof (*ret) + (size2 * sizeof (**ret))); + brandt_assert (NULL != ret); + data = (gcry_mpi_point_t *)&ret[size1]; + for (i = 0; i < size1; i++) + { + ret[i] = &data[i * size2]; + for (j = 0; j < size2; j++) + ret[i][j] = gcry_mpi_point_new (0); + } + return ret; +} + + +static void +smc_free2 (gcry_mpi_point_t **dst, uint16_t size1, uint16_t size2) +{ + uint16_t i, j; + + for (i = 0; i < size1; i++) + for (j = 0; j < size2; j++) + gcry_mpi_point_release (dst[i][j]); + free (dst); +} + + +/** + * smc_sums_partial calculates sums up until the current index and stores them + * in @a out. @$f\forall i \leq len: out_i=sum_{h=1}^iin_h@$f + * + * @param[out] out Where to store the resulting sums. Points may be given + * uninitialized, but the appropriate amount of memory has to be allocated + * beforehand. + * @param[in] in Input points. + * @param[in] len The length of both @a out and @a in. + */ +static void +smc_sums_partial (gcry_mpi_point_t out[], gcry_mpi_point_t in[], uint16_t len) +{ + uint16_t i; + + for (i = 0; i < len; i++) + { + out[i] = gcry_mpi_point_new (0); + gcry_mpi_ec_add (out[i], in[i], (i ? out[i - 1] : ec_zero), ec_ctx); + brandt_assert (NULL != out[i]); + } +} + + /** - * Clear memory that was used to store a private key. + * smc_sum calculates the sum of all input points. @$fout=sum_{i=1}^{len}in_i@$f * - * @param skey location of the key + * @param[out] out Where to store the result + * @param[in] in Input points. + * @param[in] len The length of @a in. + */ +static void +smc_sum (gcry_mpi_point_t out, gcry_mpi_point_t in[], uint16_t len) +{ + uint16_t i; + + brandt_assert (NULL != out); + /**TODO: how to copy a point more efficiently? */ + gcry_mpi_ec_add (out, ec_zero, ec_zero, ec_ctx); + for (i = 0; i < len; i++) + gcry_mpi_ec_add (out, out, in[i], ec_ctx); +} + + +/** + * smc_compute_pkey calculates the shared public key + * + * @param[in,out] ad The struct AuctionData used */ void -brandt_ec_key_clear (struct brandt_ec_skey *skey) +smc_compute_pkey (struct AuctionData *ad) { - memset (skey, 0, sizeof (struct brandt_ec_skey)); + ad->Y = gcry_mpi_point_new (0); + smc_sum (ad->Y, ad->y, ad->n); +} + + +/** + * smc_zkp_dl + * + * @param v TODO + * @param g TODO + * @param x TODO + * @param a TODO + * @param c TODO + * @param r TODO + */ +void +smc_zkp_dl (const gcry_mpi_point_t v, + const gcry_mpi_point_t g, + const gcry_mpi_t x, + const gcry_mpi_point_t a, + gcry_mpi_t c, + gcry_mpi_t r) +{ + gcry_mpi_t z = gcry_mpi_new (0); + + ec_keypair_create_base (a, z, g); + + /* compute challange c */ + /**TODO: generate c from HASH(g,v,a) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + gcry_mpi_mulm (r, c, x, ec_n); + gcry_mpi_addm (r, r, z, ec_n); + + gcry_mpi_release (z); } /** - * Generate a random value mod n. + * smc_zkp_dl_check * - * @param edc ECC context - * @return random value mod n. + * @param v TODO + * @param g TODO + * @param a TODO + * @param c TODO + * @param r TODO + * @return 0 if the proof is correct, something else otherwise */ +int +smc_zkp_dl_check (const gcry_mpi_point_t v, + const gcry_mpi_point_t g, + const gcry_mpi_point_t a, + const gcry_mpi_t c, + const gcry_mpi_t r) +{ + int ret; + gcry_mpi_point_t left = gcry_mpi_point_new (0); + gcry_mpi_point_t right = gcry_mpi_point_new (0); + + gcry_mpi_ec_mul (left, r, g, ec_ctx); + gcry_mpi_ec_mul (right, c, v, ec_ctx); + gcry_mpi_ec_add (right, a, right, ec_ctx); + + ret = ec_point_cmp (left, right); + gcry_mpi_point_release (left); + gcry_mpi_point_release (right); + + return ret; +} + + +void +smc_zkp_2dle (const gcry_mpi_point_t v, + const gcry_mpi_point_t w, + const gcry_mpi_point_t g1, + const gcry_mpi_point_t g2, + const gcry_mpi_t x, + gcry_mpi_point_t a, + gcry_mpi_point_t b, + gcry_mpi_t c, + gcry_mpi_t r) +{ + gcry_mpi_t z = gcry_mpi_new (0); + + ec_keypair_create_base (a, z, g1); + gcry_mpi_ec_mul (b, z, g2, ec_ctx); + + /* compute challange c */ + /**TODO: generate c from HASH(g1,g2,v,w,a,b) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + gcry_mpi_mulm (r, c, x, ec_n); + gcry_mpi_addm (r, r, z, ec_n); + + gcry_mpi_release (z); +} + + +int +smc_zkp_2dle_check (const gcry_mpi_point_t v, + const gcry_mpi_point_t w, + const gcry_mpi_point_t g1, + const gcry_mpi_point_t g2, + const gcry_mpi_point_t a, + const gcry_mpi_point_t b, + const gcry_mpi_t c, + const gcry_mpi_t r) +{ + int ret; + gcry_mpi_point_t left = gcry_mpi_point_new (0); + gcry_mpi_point_t right = gcry_mpi_point_new (0); + + gcry_mpi_ec_mul (left, r, g1, ec_ctx); + gcry_mpi_ec_mul (right, c, v, ec_ctx); + gcry_mpi_ec_add (right, a, right, ec_ctx); + ret = ec_point_cmp (left, right); + + gcry_mpi_ec_mul (left, r, g2, ec_ctx); + gcry_mpi_ec_mul (right, c, w, ec_ctx); + gcry_mpi_ec_add (right, b, right, ec_ctx); + ret |= ec_point_cmp (left, right); + + gcry_mpi_point_release (left); + gcry_mpi_point_release (right); + + return ret; +} + + +void +smc_zkp_0og (gcry_mpi_point_t alpha, + const gcry_mpi_point_t m, + const gcry_mpi_point_t y, + gcry_mpi_point_t beta, + gcry_mpi_point_t a1, + gcry_mpi_point_t a2, + gcry_mpi_point_t b1, + gcry_mpi_point_t b2, + gcry_mpi_t c, + gcry_mpi_t d1, + gcry_mpi_t d2, + gcry_mpi_t r1, + gcry_mpi_t r2) +{ + gcry_mpi_t r = gcry_mpi_new (0); + gcry_mpi_t w = gcry_mpi_new (0); + int eq0 = !ec_point_cmp (m, ec_zero); + int eqg = !ec_point_cmp (m, ec_gen); + + if (!(eq0 ^ eqg)) + eprintf ("zero knowledge proof: m is neither 0 nor g"); + + /* beta = r*g */ + ec_keypair_create (beta, r); + gcry_mpi_mod (r, r, ec_n); + + /* alpha = m + r*y */ + gcry_mpi_ec_mul (alpha, r, y, ec_ctx); + gcry_mpi_ec_add (alpha, m, alpha, ec_ctx); + + if (eq0) + { /* m == 0 */ + ec_keypair_create_base (a1, d1, beta); + gcry_mpi_mod (d1, d1, ec_n); + ec_keypair_create_base (b1, r1, y); + gcry_mpi_mod (r1, r1, ec_n); + + /* a1 = r1*g + d1*beta */ + gcry_mpi_ec_mul (a2, r1, ec_gen, ec_ctx); + gcry_mpi_ec_add (a1, a2, a1, ec_ctx); + + /* b1 = r1*y + d1*(alpha-g) */ + gcry_mpi_ec_sub (b2, alpha, ec_gen, ec_ctx); + gcry_mpi_ec_mul (a2, d1, b2, ec_ctx); + gcry_mpi_ec_add (b1, b1, a2, ec_ctx); + + /* a2 = w * g */ + ec_keypair_create_base (a2, w, ec_gen); + gcry_mpi_mod (w, w, ec_n); + + /* b2 = w * y */ + gcry_mpi_ec_mul (b2, w, y, ec_ctx); + + /* compute challange c */ + /**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + /* d2 = c - d1 */ + gcry_mpi_subm (d2, c, d1, ec_n); + + /* r2 = w - r*d2 */ + gcry_mpi_mulm (r2, r, d2, ec_n); + gcry_mpi_subm (r2, w, r2, ec_n); + } + else + { /* m == g */ + ec_keypair_create_base (a2, d2, beta); + gcry_mpi_mod (d2, d2, ec_n); + ec_keypair_create_base (b2, r2, y); + gcry_mpi_mod (r2, r2, ec_n); + + /* a2 = r2*g + d2*beta */ + gcry_mpi_ec_mul (a1, r2, ec_gen, ec_ctx); + gcry_mpi_ec_add (a2, a1, a2, ec_ctx); + + /* b2 = r2*y + d2*(alpha-0) */ + /* useless subtraction to have same amount of operations as in m == 0 */ + gcry_mpi_ec_sub (b1, alpha, ec_zero, ec_ctx); + gcry_mpi_ec_mul (a1, d2, b1, ec_ctx); + gcry_mpi_ec_add (b2, b2, a1, ec_ctx); + + /* a1 = w * g */ + ec_keypair_create_base (a1, w, ec_gen); + gcry_mpi_mod (w, w, ec_n); + + /* b1 = w * y */ + gcry_mpi_ec_mul (b1, w, y, ec_ctx); + + /* compute challange c */ + /**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */ + ec_skey_create (c); + gcry_mpi_mod (c, c, ec_n); + + /* d1 = c - d2 */ + gcry_mpi_subm (d1, c, d2, ec_n); + + /* r1 = w - r*d1 */ + gcry_mpi_mulm (r1, r, d1, ec_n); + gcry_mpi_subm (r1, w, r1, ec_n); + } + + gcry_mpi_release (r); + gcry_mpi_release (w); +} + + +int +smc_zkp_0og_check (const gcry_mpi_point_t alpha, + const gcry_mpi_point_t y, + const gcry_mpi_point_t beta, + const gcry_mpi_point_t a1, + const gcry_mpi_point_t a2, + const gcry_mpi_point_t b1, + const gcry_mpi_point_t b2, + const gcry_mpi_t c, + const gcry_mpi_t d1, + const gcry_mpi_t d2, + const gcry_mpi_t r1, + const gcry_mpi_t r2) +{ + int ret; + gcry_mpi_t sum = gcry_mpi_new (0); + gcry_mpi_point_t right = gcry_mpi_point_new (0); + gcry_mpi_point_t tmp = gcry_mpi_point_new (0); + + /* c == d1 + d2 */ + gcry_mpi_addm (sum, d1, d2, ec_n); + ret = gcry_mpi_cmp (c, sum); + + /* a1 == r1*g + d1*beta */ + gcry_mpi_ec_mul (tmp, r1, ec_gen, ec_ctx); + gcry_mpi_ec_mul (right, d1, beta, ec_ctx); + gcry_mpi_ec_add (right, tmp, right, ec_ctx); + ret |= ec_point_cmp (a1, right) << 1; + + /* b1 == r1*y + d1*(alpha-g) */ + gcry_mpi_ec_sub (right, alpha, ec_gen, ec_ctx); + gcry_mpi_ec_mul (tmp, d1, right, ec_ctx); + gcry_mpi_ec_mul (right, r1, y, ec_ctx); + gcry_mpi_ec_add (right, right, tmp, ec_ctx); + ret |= ec_point_cmp (b1, right) << 2; + + /* a2 == r2*g + d2*beta */ + gcry_mpi_ec_mul (tmp, d2, beta, ec_ctx); + gcry_mpi_ec_mul (right, r2, ec_gen, ec_ctx); + gcry_mpi_ec_add (right, right, tmp, ec_ctx); + ret |= ec_point_cmp (a2, right) << 3; + + /* b2 == r2*y + d2*alpha */ + gcry_mpi_ec_mul (tmp, d2, alpha, ec_ctx); + gcry_mpi_ec_mul (right, r2, y, ec_ctx); + gcry_mpi_ec_add (right, right, tmp, ec_ctx); + ret |= ec_point_cmp (b2, right) << 4; + + gcry_mpi_release (sum); + gcry_mpi_point_release (right); + gcry_mpi_point_release (tmp); + + if (ret) + weprintf ("ret: 0x%x", ret); + return ret; +} + + +/* --- unused stuff, might become useful later --- */ + +///** +// * Clear memory that was used to store a private key. +// * +// * @param skey the key +// */ +//void +//brandt_ec_key_clear (gcry_mpi_t skey) +//{ +// gcry_mpi_randomize (skey, 256, GCRY_WEAK_RANDOM); +// gcry_mpi_release (skey); +//} + + +//gcry_mpi_point_t +//deserialize_point(const struct brandt_point* data, const int len) +//{ +// gcry_sexp_t s; +// gcry_ctx_t ctx; +// gcry_mpi_point_t ret; +// gcry_error_t rc; +// +// rc = gcry_sexp_build(&s, NULL, "(public-key(ecc(curve " CURVE ")(q %b)))", +// len, data); +// brandt_assert_gpgerr(rc); +// +// rc = gcry_mpi_ec_new(&ctx, s, NULL); +// brandt_assert_gpgerr(rc); +// gcry_sexp_release(s); +// +// ret = gcry_mpi_ec_get_point("q", ctx, 0); +// brandt_assert(ret); +// gcry_ctx_release(ctx); +// return ret; +//} + + +///** +// * Generate a random value mod n. +// * +// * @param edc ECC context +// * @return random value mod n. +// */ //gcry_mpi_t //GNUNET_CRYPTO_ecc_random_mod_n (struct GNUNET_CRYPTO_EccDlogContext *edc) //{ |