1064 lines
26 KiB
C
1064 lines
26 KiB
C
/* This file is part of libbrandt.
|
|
* Copyright (C) 2016 GNUnet e.V.
|
|
*
|
|
* libbrandt is free software: you can redistribute it and/or modify it under
|
|
* the terms of the GNU General Public License as published by the Free Software
|
|
* Foundation, either version 3 of the License, or (at your option) any later
|
|
* version.
|
|
*
|
|
* libbrandt is distributed in the hope that it will be useful, but WITHOUT ANY
|
|
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
|
|
* A PARTICULAR PURPOSE. See the GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along with
|
|
* libbrandt. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
/**
|
|
* @file crypto.c
|
|
* @brief Implementation of the crypto primitives.
|
|
*/
|
|
|
|
|
|
#include <arpa/inet.h>
|
|
#include <gcrypt.h>
|
|
|
|
#include "crypto.h"
|
|
#include "internals.h"
|
|
#include "util.h"
|
|
|
|
#define CURVE "Ed25519"
|
|
|
|
|
|
struct zkp_challenge_dl {
|
|
struct ec_mpi g;
|
|
struct ec_mpi v;
|
|
struct ec_mpi a;
|
|
};
|
|
|
|
struct zkp_challenge_2dle {
|
|
struct ec_mpi g1;
|
|
struct ec_mpi g2;
|
|
struct ec_mpi v;
|
|
struct ec_mpi w;
|
|
struct ec_mpi a;
|
|
struct ec_mpi b;
|
|
};
|
|
|
|
struct zkp_challenge_0og {
|
|
struct ec_mpi g;
|
|
struct ec_mpi alpha;
|
|
struct ec_mpi beta;
|
|
struct ec_mpi a1;
|
|
struct ec_mpi a2;
|
|
struct ec_mpi b1;
|
|
struct ec_mpi b2;
|
|
};
|
|
|
|
|
|
static gcry_ctx_t ec_ctx;
|
|
static gcry_mpi_point_t ec_gen;
|
|
static gcry_mpi_point_t ec_zero;
|
|
static gcry_mpi_t ec_n;
|
|
|
|
|
|
/**
|
|
* brandt_crypto_init initializes the crypto system and must be called before
|
|
* any other function from this file.
|
|
*/
|
|
void
|
|
brandt_crypto_init ()
|
|
{
|
|
gcry_error_t rc;
|
|
|
|
rc = gcry_mpi_ec_new (&ec_ctx, NULL, CURVE);
|
|
brandt_assert_gpgerr (rc);
|
|
|
|
ec_gen = gcry_mpi_ec_get_point ("g", ec_ctx, 0);
|
|
brandt_assert (NULL != ec_gen);
|
|
|
|
ec_zero = gcry_mpi_point_new (0);
|
|
brandt_assert (NULL != ec_zero);
|
|
gcry_mpi_ec_sub (ec_zero, ec_gen, ec_gen, ec_ctx);
|
|
|
|
ec_n = gcry_mpi_ec_get_mpi ("n", ec_ctx, 1);
|
|
brandt_assert (NULL != ec_n);
|
|
}
|
|
|
|
|
|
/* --- RANDOM --- */
|
|
|
|
void
|
|
brandt_rand_poll ()
|
|
{
|
|
static unsigned char rand_amount = 255;
|
|
|
|
if (!(rand_amount--))
|
|
gcry_fast_random_poll ();
|
|
}
|
|
|
|
|
|
/* --- HASHING --- */
|
|
|
|
/**
|
|
* Hash block of given size.
|
|
*
|
|
* @param block the data to #brandt_hash, length is given as a second argument
|
|
* @param size the length of the data to #brandt_hash in @a block
|
|
* @param ret pointer to where to write the hashcode
|
|
*/
|
|
void
|
|
brandt_hash (const void *block, size_t size, struct brandt_hash_code *ret)
|
|
{
|
|
gcry_md_hash_buffer (GCRY_MD_SHA512, ret, block, size);
|
|
}
|
|
|
|
|
|
/* --- EC --- */
|
|
|
|
/**
|
|
* ec_skey_create
|
|
*
|
|
* @param[out] skey where to store the generated secret key. This has to be an
|
|
* already initialized mpi.
|
|
*/
|
|
void
|
|
ec_skey_create (gcry_mpi_t skey)
|
|
{
|
|
gcry_mpi_t ret;
|
|
gcry_sexp_t s_keyparam;
|
|
gcry_sexp_t priv_sexp;
|
|
gcry_sexp_t priv_key;
|
|
gcry_sexp_t priv_key2;
|
|
gcry_error_t rc;
|
|
|
|
rc = gcry_sexp_build (&s_keyparam, NULL, "(genkey(ecc(curve \"" CURVE "\")"
|
|
"(flags)))");
|
|
brandt_assert_gpgerr (rc);
|
|
|
|
rc = gcry_pk_genkey (&priv_sexp, s_keyparam);
|
|
brandt_assert_gpgerr (rc);
|
|
gcry_sexp_release (s_keyparam);
|
|
|
|
priv_key = gcry_sexp_find_token (priv_sexp, "private-key", 11);
|
|
brandt_assert (NULL != priv_key);
|
|
gcry_sexp_release (priv_sexp);
|
|
|
|
priv_key2 = gcry_sexp_find_token (priv_key, "d", 1);
|
|
brandt_assert (NULL != priv_key2);
|
|
gcry_sexp_release (priv_key);
|
|
|
|
ret = gcry_sexp_nth_mpi (priv_key2, 1, GCRYMPI_FMT_USG);
|
|
brandt_assert (NULL != ret);
|
|
gcry_sexp_release (priv_key2);
|
|
|
|
gcry_mpi_snatch (skey, ret);
|
|
}
|
|
|
|
|
|
/**
|
|
* ec_keypair_create
|
|
*
|
|
* @param[out] pkey where to store the generated public key
|
|
* @param[out] skey where to store the generated secret key
|
|
*/
|
|
void
|
|
ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey)
|
|
{
|
|
brandt_assert (NULL != pkey);
|
|
brandt_assert (NULL != skey);
|
|
|
|
ec_skey_create (skey);
|
|
gcry_mpi_ec_mul (pkey, skey, ec_gen, ec_ctx);
|
|
}
|
|
|
|
|
|
/**
|
|
* ec_keypair_create_base
|
|
*
|
|
* @param[out] pkey where to store the generated public key
|
|
* @param[out] skey where to store the generated secret key
|
|
* @param[in] base which base point should be used to calculate the public key
|
|
*/
|
|
void
|
|
ec_keypair_create_base (gcry_mpi_point_t pkey,
|
|
gcry_mpi_t skey,
|
|
const gcry_mpi_point_t base)
|
|
{
|
|
brandt_assert (NULL != pkey);
|
|
brandt_assert (NULL != skey);
|
|
brandt_assert (NULL != base);
|
|
|
|
ec_skey_create (skey);
|
|
gcry_mpi_ec_mul (pkey, skey, base, ec_ctx);
|
|
}
|
|
|
|
|
|
/**
|
|
* ec_point_cmp compares two curve points
|
|
*
|
|
* @param[in] a the first point
|
|
* @param[in] b the second point
|
|
* @return 0 if @a a and @a b represent the same point on the curve, something
|
|
* else otherwise
|
|
*/
|
|
int
|
|
ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b)
|
|
{
|
|
int ret = 1;
|
|
gcry_mpi_t ax = gcry_mpi_new (0);
|
|
gcry_mpi_t bx = gcry_mpi_new (0);
|
|
gcry_mpi_t ay = gcry_mpi_new (0);
|
|
gcry_mpi_t by = gcry_mpi_new (0);
|
|
|
|
brandt_assert (a && b);
|
|
if (!ax || !bx || !ay || !by)
|
|
{
|
|
weprintf ("could not init point in point_cmp");
|
|
return 1;
|
|
}
|
|
|
|
if (!gcry_mpi_ec_get_affine (ax, ay, a, ec_ctx) &&
|
|
!gcry_mpi_ec_get_affine (bx, by, b, ec_ctx))
|
|
{
|
|
ret = gcry_mpi_cmp (ax, bx) || gcry_mpi_cmp (ay, by);
|
|
}
|
|
|
|
gcry_mpi_release (ax);
|
|
gcry_mpi_release (bx);
|
|
gcry_mpi_release (ay);
|
|
gcry_mpi_release (by);
|
|
return ret;
|
|
}
|
|
|
|
|
|
/**
|
|
* mpi_serialize outputs the given MPI value to the given destination buffer in
|
|
* network byte order. The MPI @a src may not be negative.
|
|
*
|
|
* @param[out] dst where to output to
|
|
* @param[in] src value to write to @a dst
|
|
*/
|
|
void
|
|
mpi_serialize (struct ec_mpi *dst, gcry_mpi_t src)
|
|
{
|
|
size_t rsize = 0;
|
|
unsigned int nbits;
|
|
const void *p;
|
|
gcry_error_t rc;
|
|
|
|
if (gcry_mpi_get_flag (src, GCRYMPI_FLAG_OPAQUE))
|
|
{
|
|
/* Store opaque MPIs left aligned into the buffer. Used by Ed25519 point
|
|
* compression */
|
|
p = gcry_mpi_get_opaque (src, &nbits);
|
|
brandt_assert (p);
|
|
rsize = (nbits + 7) / 8;
|
|
if (rsize > sizeof (struct ec_mpi))
|
|
rsize = sizeof (struct ec_mpi);
|
|
memcpy (dst, p, rsize);
|
|
if (rsize < sizeof (struct ec_mpi))
|
|
memset (((char *)dst) + rsize, 0, sizeof (struct ec_mpi) - rsize);
|
|
}
|
|
else
|
|
{
|
|
/* Store regular MPIs as unsigned ints right aligned into the buffer. */
|
|
rc = gcry_mpi_print (GCRYMPI_FMT_USG, (void *)dst,
|
|
sizeof (struct ec_mpi), &rsize, src);
|
|
brandt_assert_gpgerr (rc);
|
|
|
|
/* Shift the output to the right, if shorter than available space */
|
|
if (rsize && rsize < sizeof (struct ec_mpi))
|
|
{
|
|
memmove (&dst[sizeof (struct ec_mpi) - rsize], dst, rsize);
|
|
memset (dst, 0, sizeof (struct ec_mpi) - rsize);
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
/**
|
|
* mpi_parse converts src buffer into MPI value.
|
|
* The buffer is interpreted as network byte order, unsigned integer.
|
|
*
|
|
* @param[out] dst where to store MPI value. Must be initialized.
|
|
* @param[in] src raw data source (GCRYMPI_FMT_USG)
|
|
*/
|
|
void
|
|
mpi_parse (gcry_mpi_t dst, const struct ec_mpi *src)
|
|
{
|
|
gcry_mpi_t ret;
|
|
gcry_error_t rc;
|
|
|
|
rc = gcry_mpi_scan (&ret, GCRYMPI_FMT_USG,
|
|
src, sizeof (struct ec_mpi), NULL);
|
|
brandt_assert_gpgerr (rc);
|
|
|
|
gcry_mpi_snatch (dst, ret);
|
|
}
|
|
|
|
|
|
/**
|
|
* ec_point_serialize outputs the given curve point to the @a dst buffer.
|
|
*
|
|
* @param[out] dst where to write the raw data to
|
|
* @param[in] src curve point to write to @a dst
|
|
*/
|
|
void
|
|
ec_point_serialize (struct ec_mpi *dst, const gcry_mpi_point_t src)
|
|
{
|
|
gcry_sexp_t s;
|
|
gcry_ctx_t ctx;
|
|
gcry_error_t rc;
|
|
gcry_mpi_t q;
|
|
|
|
brandt_assert (dst);
|
|
|
|
rc = gcry_sexp_build (&s, NULL, "(public-key(ecc(curve " CURVE ")))");
|
|
brandt_assert_gpgerr (rc);
|
|
brandt_assert (NULL != s);
|
|
|
|
rc = gcry_mpi_ec_new (&ctx, s, NULL);
|
|
brandt_assert_gpgerr (rc);
|
|
gcry_sexp_release (s);
|
|
|
|
rc = gcry_mpi_ec_set_point ("q", src, ctx);
|
|
brandt_assert_gpgerr (rc);
|
|
|
|
q = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
|
|
brandt_assert (NULL != q);
|
|
gcry_ctx_release (ctx);
|
|
|
|
mpi_serialize (dst, q);
|
|
gcry_mpi_release (q);
|
|
}
|
|
|
|
|
|
/**
|
|
* ec_point_parse parses a point on the Ed25519 curve from @a src into @a dst.
|
|
*
|
|
* @param[out] dst where to store the curve point. Must be initialized
|
|
* @param[in] src raw data source
|
|
*/
|
|
void
|
|
ec_point_parse (gcry_mpi_point_t dst, const struct ec_mpi *src)
|
|
{
|
|
gcry_sexp_t s;
|
|
gcry_ctx_t ctx;
|
|
gcry_mpi_point_t ret;
|
|
gcry_error_t rc;
|
|
|
|
rc = gcry_sexp_build (&s, NULL, "(public-key(ecc(curve " CURVE ")(q %b)))",
|
|
sizeof (struct ec_mpi), src);
|
|
brandt_assert_gpgerr (rc);
|
|
|
|
rc = gcry_mpi_ec_new (&ctx, s, NULL);
|
|
brandt_assert_gpgerr (rc);
|
|
gcry_sexp_release (s);
|
|
|
|
ret = gcry_mpi_ec_get_point ("q", ctx, 0);
|
|
brandt_assert (ret);
|
|
gcry_ctx_release (ctx);
|
|
gcry_mpi_ec_mul (dst, GCRYMPI_CONST_ONE, ret, ec_ctx);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_init2 creates a 2 dimensional array of curve points
|
|
*
|
|
* @param[in] size1 size of the first dimension
|
|
* @param[in] size2 size of the second dimension
|
|
* @return a pointer to the array. If not used anymore use smc_free2 to reclaim
|
|
* the memory.
|
|
*/
|
|
static gcry_mpi_point_t **
|
|
smc_init2 (uint16_t size1, uint16_t size2)
|
|
{
|
|
uint16_t i, j;
|
|
gcry_mpi_point_t **ret;
|
|
gcry_mpi_point_t *data;
|
|
|
|
ret = calloc (size1, sizeof (*ret) + size2 * sizeof (**ret));
|
|
brandt_assert (NULL != ret);
|
|
|
|
data = (gcry_mpi_point_t *)&ret[size1];
|
|
for (i = 0; i < size1; i++)
|
|
{
|
|
ret[i] = &data[i * size2];
|
|
for (j = 0; j < size2; j++)
|
|
ret[i][j] = gcry_mpi_point_new (0);
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_free2 releases all points in @a dst and frees the memory
|
|
*
|
|
* @param[in,out] dst The 2 dimensional array to clean up
|
|
* @param[in] size1 size of the first dimension
|
|
* @param[in] size2 size of the second dimension
|
|
*/
|
|
static void
|
|
smc_free2 (gcry_mpi_point_t **dst, uint16_t size1, uint16_t size2)
|
|
{
|
|
uint16_t i, j;
|
|
|
|
for (i = 0; i < size1; i++)
|
|
for (j = 0; j < size2; j++)
|
|
gcry_mpi_point_release (dst[i][j]);
|
|
free (dst);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_init3 creates a 3 dimensional array of curve points
|
|
*
|
|
* @param[in] size1 size of the first dimension
|
|
* @param[in] size2 size of the second dimension
|
|
* @param[in] size3 size of the third dimension
|
|
* @return a pointer to the array. If not used anymore use smc_free3 to reclaim
|
|
* the memory.
|
|
*/
|
|
static gcry_mpi_point_t ***
|
|
smc_init3 (uint16_t size1, uint16_t size2, uint16_t size3)
|
|
{
|
|
uint16_t i, j, k;
|
|
gcry_mpi_point_t ***ret;
|
|
gcry_mpi_point_t **layer1;
|
|
gcry_mpi_point_t *layer2;
|
|
|
|
ret = calloc (size1, sizeof (*ret) +
|
|
size2 * sizeof (**ret) +
|
|
size2 * size3 * sizeof (***ret));
|
|
brandt_assert (NULL != ret);
|
|
|
|
layer1 = (gcry_mpi_point_t **)&ret[size1];
|
|
layer2 = (gcry_mpi_point_t *)&layer1[size1 * size2];
|
|
for (i = 0; i < size1; i++)
|
|
{
|
|
ret[i] = &layer1[i * size2];
|
|
for (j = 0; j < size2; j++)
|
|
{
|
|
layer1[i * size2 + j] = &layer2[(i * size2 + j) * size3];
|
|
for (k = 0; k < size3; k++)
|
|
ret[i][j][k] = gcry_mpi_point_new (0);
|
|
}
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_free3 releases all points in @a dst and frees the memory
|
|
*
|
|
* @param[in,out] dst The 3 dimensional array to clean up
|
|
* @param[in] size1 size of the first dimension
|
|
* @param[in] size2 size of the second dimension
|
|
* @param[in] size3 size of the third dimension
|
|
*/
|
|
static void
|
|
smc_free3 (gcry_mpi_point_t ***dst,
|
|
uint16_t size1,
|
|
uint16_t size2,
|
|
uint16_t size3)
|
|
{
|
|
uint16_t i, j, k;
|
|
|
|
for (i = 0; i < size1; i++)
|
|
for (j = 0; j < size2; j++)
|
|
for (k = 0; k < size3; k++)
|
|
gcry_mpi_point_release (dst[i][j][k]);
|
|
free (dst);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_sums_partial calculates sums up until the current index and stores them
|
|
* in @a out. \f$\forall i \leq len: out_i=\sum_{h=1}^iin_h\f$
|
|
*
|
|
* @param[out] out Where to store the resulting sums. Points may be given
|
|
* uninitialized, but the appropriate amount of memory has to be allocated
|
|
* beforehand.
|
|
* @param[in] in Input points.
|
|
* @param[in] len The length of both @a out and @a in.
|
|
*/
|
|
static void
|
|
smc_sums_partial (gcry_mpi_point_t out[], gcry_mpi_point_t in[], uint16_t len)
|
|
{
|
|
uint16_t i;
|
|
|
|
for (i = 0; i < len; i++)
|
|
{
|
|
out[i] = gcry_mpi_point_new (0);
|
|
gcry_mpi_ec_add (out[i], in[i], (i ? out[i - 1] : ec_zero), ec_ctx);
|
|
brandt_assert (NULL != out[i]);
|
|
}
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_sum calculates the sum of all input points.
|
|
* \f$out=\sum_{i=1}^{len}in_i\f$
|
|
*
|
|
* @param[out] out Where to store the result
|
|
* @param[in] in Input points.
|
|
* @param[in] len The length of @a in.
|
|
*/
|
|
static void
|
|
smc_sum (gcry_mpi_point_t out, gcry_mpi_point_t in[], uint16_t len)
|
|
{
|
|
uint16_t i;
|
|
|
|
brandt_assert (NULL != out);
|
|
/**\todo: how to copy a point more efficiently? */
|
|
gcry_mpi_ec_add (out, ec_zero, ec_zero, ec_ctx);
|
|
for (i = 0; i < len; i++)
|
|
gcry_mpi_ec_add (out, out, in[i], ec_ctx);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_compute_pkey calculates the shared public key
|
|
*
|
|
* @param[in,out] ad The struct AuctionData used
|
|
*/
|
|
void
|
|
smc_compute_pkey (struct AuctionData *ad)
|
|
{
|
|
ad->Y = gcry_mpi_point_new (0);
|
|
smc_sum (ad->Y, ad->y, ad->n);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_gen_keyshare creates the private additive keyshare and computes the
|
|
* public multiplicative key share
|
|
*
|
|
* @param[in,out] ad Pointer to the AuctionData struct to operate on
|
|
*/
|
|
void
|
|
smc_gen_keyshare (struct AuctionData *ad)
|
|
{
|
|
uint16_t i;
|
|
|
|
ad->y = calloc (ad->n, sizeof (*ad->y));
|
|
for (i = 0; i < ad->n; i++)
|
|
ad->y[0] = gcry_mpi_point_new (0);
|
|
|
|
ad->x = gcry_mpi_new (0);
|
|
ec_keypair_create (ad->y[ad->i], ad->x);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_encrypt_bid \todo
|
|
*
|
|
* @param ad TODO
|
|
* @param j TODO
|
|
* @param a1 TODO
|
|
* @param a2 TODO
|
|
* @param b1 TODO
|
|
* @param b2 TODO
|
|
* @param d1 TODO
|
|
* @param d2 TODO
|
|
* @param r1 TODO
|
|
* @param r2 TODO
|
|
*/
|
|
void
|
|
smc_encrypt_bid (struct AuctionData *ad,
|
|
uint16_t j,
|
|
gcry_mpi_point_t a1,
|
|
gcry_mpi_point_t a2,
|
|
gcry_mpi_point_t b1,
|
|
gcry_mpi_point_t b2,
|
|
gcry_mpi_t d1,
|
|
gcry_mpi_t d2,
|
|
gcry_mpi_t r1,
|
|
gcry_mpi_t r2)
|
|
{
|
|
smc_zkp_0og (ad->alpha[ad->i][j], (j == ad->b ? ec_gen : ec_zero), ad->Y,
|
|
ad->beta[ad->i][j], a1, a2, b1, b2, d1, d2, r1, r2);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_compute_outcome \todo
|
|
*
|
|
* @param ad TODO
|
|
*/
|
|
void
|
|
smc_compute_outcome (struct AuctionData *ad)
|
|
{
|
|
uint16_t i, j;
|
|
|
|
// create temporary table with partial sums
|
|
|
|
|
|
for (i = 0; i < ad->n; i++)
|
|
{
|
|
|
|
}
|
|
/*\todo ZKP*/
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_zkp_dl
|
|
*
|
|
* @param v \todo
|
|
* @param g \todo
|
|
* @param x \todo
|
|
* @param a \todo
|
|
* @param r \todo
|
|
*/
|
|
void
|
|
smc_zkp_dl (const gcry_mpi_point_t v,
|
|
const gcry_mpi_point_t g,
|
|
const gcry_mpi_t x,
|
|
const gcry_mpi_point_t a,
|
|
gcry_mpi_t r)
|
|
{
|
|
struct zkp_challenge_dl challenge;
|
|
struct brandt_hash_code challhash;
|
|
gcry_mpi_t c = gcry_mpi_new (0);
|
|
gcry_mpi_t z = gcry_mpi_new (0);
|
|
|
|
ec_keypair_create_base (a, z, g);
|
|
|
|
/* compute challenge c */
|
|
ec_point_serialize (&challenge.g, ec_gen);
|
|
ec_point_serialize (&challenge.v, v);
|
|
ec_point_serialize (&challenge.a, a);
|
|
brandt_hash (&challenge, sizeof (struct zkp_challenge_dl), &challhash);
|
|
mpi_parse (c, (struct ec_mpi *)&challhash);
|
|
gcry_mpi_mod (c, c, ec_n);
|
|
|
|
gcry_mpi_mulm (r, c, x, ec_n);
|
|
gcry_mpi_addm (r, r, z, ec_n);
|
|
|
|
gcry_mpi_release (c);
|
|
gcry_mpi_release (z);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_zkp_dl_check
|
|
*
|
|
* @param v \todo
|
|
* @param g \todo
|
|
* @param a \todo
|
|
* @param r \todo
|
|
* @return 0 if the proof is correct, something else otherwise
|
|
*/
|
|
int
|
|
smc_zkp_dl_check (const gcry_mpi_point_t v,
|
|
const gcry_mpi_point_t g,
|
|
const gcry_mpi_point_t a,
|
|
const gcry_mpi_t r)
|
|
{
|
|
int ret;
|
|
struct zkp_challenge_dl challenge;
|
|
struct brandt_hash_code challhash;
|
|
gcry_mpi_t c = gcry_mpi_new (0);
|
|
gcry_mpi_point_t left = gcry_mpi_point_new (0);
|
|
gcry_mpi_point_t right = gcry_mpi_point_new (0);
|
|
|
|
/* compute challenge c */
|
|
ec_point_serialize (&challenge.g, ec_gen);
|
|
ec_point_serialize (&challenge.v, v);
|
|
ec_point_serialize (&challenge.a, a);
|
|
brandt_hash (&challenge, sizeof (struct zkp_challenge_dl), &challhash);
|
|
mpi_parse (c, (struct ec_mpi *)&challhash);
|
|
gcry_mpi_mod (c, c, ec_n);
|
|
|
|
gcry_mpi_ec_mul (left, r, g, ec_ctx);
|
|
gcry_mpi_ec_mul (right, c, v, ec_ctx);
|
|
gcry_mpi_ec_add (right, a, right, ec_ctx);
|
|
|
|
ret = ec_point_cmp (left, right);
|
|
gcry_mpi_release (c);
|
|
gcry_mpi_point_release (left);
|
|
gcry_mpi_point_release (right);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_zkp_2dle \todo
|
|
*
|
|
* @param v TODO
|
|
* @param w TODO
|
|
* @param g1 TODO
|
|
* @param g2 TODO
|
|
* @param x TODO
|
|
* @param a TODO
|
|
* @param b TODO
|
|
* @param r TODO
|
|
*/
|
|
void
|
|
smc_zkp_2dle (const gcry_mpi_point_t v,
|
|
const gcry_mpi_point_t w,
|
|
const gcry_mpi_point_t g1,
|
|
const gcry_mpi_point_t g2,
|
|
const gcry_mpi_t x,
|
|
gcry_mpi_point_t a,
|
|
gcry_mpi_point_t b,
|
|
gcry_mpi_t r)
|
|
{
|
|
struct zkp_challenge_2dle challenge;
|
|
struct brandt_hash_code challhash;
|
|
gcry_mpi_t c = gcry_mpi_new (0);
|
|
gcry_mpi_t z = gcry_mpi_new (0);
|
|
|
|
ec_keypair_create_base (a, z, g1);
|
|
gcry_mpi_ec_mul (b, z, g2, ec_ctx);
|
|
|
|
/* compute challenge c */
|
|
ec_point_serialize (&challenge.g1, g1);
|
|
ec_point_serialize (&challenge.g2, g2);
|
|
ec_point_serialize (&challenge.v, v);
|
|
ec_point_serialize (&challenge.w, w);
|
|
ec_point_serialize (&challenge.a, a);
|
|
ec_point_serialize (&challenge.b, b);
|
|
brandt_hash (&challenge, sizeof (struct zkp_challenge_dl), &challhash);
|
|
mpi_parse (c, (struct ec_mpi *)&challhash);
|
|
gcry_mpi_mod (c, c, ec_n);
|
|
|
|
gcry_mpi_mulm (r, c, x, ec_n);
|
|
gcry_mpi_addm (r, r, z, ec_n);
|
|
|
|
gcry_mpi_release (c);
|
|
gcry_mpi_release (z);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_zkp_2dle_check \todo
|
|
*
|
|
* @param v TODO
|
|
* @param w TODO
|
|
* @param g1 TODO
|
|
* @param g2 TODO
|
|
* @param a TODO
|
|
* @param b TODO
|
|
* @param r TODO
|
|
* @return TODO
|
|
*/
|
|
int
|
|
smc_zkp_2dle_check (const gcry_mpi_point_t v,
|
|
const gcry_mpi_point_t w,
|
|
const gcry_mpi_point_t g1,
|
|
const gcry_mpi_point_t g2,
|
|
const gcry_mpi_point_t a,
|
|
const gcry_mpi_point_t b,
|
|
const gcry_mpi_t r)
|
|
{
|
|
int ret;
|
|
struct zkp_challenge_2dle challenge;
|
|
struct brandt_hash_code challhash;
|
|
gcry_mpi_t c = gcry_mpi_new (0);
|
|
gcry_mpi_point_t left = gcry_mpi_point_new (0);
|
|
gcry_mpi_point_t right = gcry_mpi_point_new (0);
|
|
|
|
/* compute challenge c */
|
|
ec_point_serialize (&challenge.g1, g1);
|
|
ec_point_serialize (&challenge.g2, g2);
|
|
ec_point_serialize (&challenge.v, v);
|
|
ec_point_serialize (&challenge.w, w);
|
|
ec_point_serialize (&challenge.a, a);
|
|
ec_point_serialize (&challenge.b, b);
|
|
brandt_hash (&challenge, sizeof (struct zkp_challenge_dl), &challhash);
|
|
mpi_parse (c, (struct ec_mpi *)&challhash);
|
|
gcry_mpi_mod (c, c, ec_n);
|
|
|
|
gcry_mpi_ec_mul (left, r, g1, ec_ctx);
|
|
gcry_mpi_ec_mul (right, c, v, ec_ctx);
|
|
gcry_mpi_ec_add (right, a, right, ec_ctx);
|
|
ret = ec_point_cmp (left, right);
|
|
|
|
gcry_mpi_ec_mul (left, r, g2, ec_ctx);
|
|
gcry_mpi_ec_mul (right, c, w, ec_ctx);
|
|
gcry_mpi_ec_add (right, b, right, ec_ctx);
|
|
ret |= ec_point_cmp (left, right);
|
|
|
|
gcry_mpi_release (c);
|
|
gcry_mpi_point_release (left);
|
|
gcry_mpi_point_release (right);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_zkp_0og \todo
|
|
*
|
|
* @param alpha TODO
|
|
* @param m TODO
|
|
* @param y TODO
|
|
* @param beta TODO
|
|
* @param a1 TODO
|
|
* @param a2 TODO
|
|
* @param b1 TODO
|
|
* @param b2 TODO
|
|
* @param d1 TODO
|
|
* @param d2 TODO
|
|
* @param r1 TODO
|
|
* @param r2 TODO
|
|
*/
|
|
void
|
|
smc_zkp_0og (gcry_mpi_point_t alpha,
|
|
const gcry_mpi_point_t m,
|
|
const gcry_mpi_point_t y,
|
|
gcry_mpi_point_t beta,
|
|
gcry_mpi_point_t a1,
|
|
gcry_mpi_point_t a2,
|
|
gcry_mpi_point_t b1,
|
|
gcry_mpi_point_t b2,
|
|
gcry_mpi_t d1,
|
|
gcry_mpi_t d2,
|
|
gcry_mpi_t r1,
|
|
gcry_mpi_t r2)
|
|
{
|
|
struct zkp_challenge_0og challenge;
|
|
struct brandt_hash_code challhash;
|
|
gcry_mpi_t c = gcry_mpi_new (0);
|
|
gcry_mpi_t r = gcry_mpi_new (0);
|
|
gcry_mpi_t w = gcry_mpi_new (0);
|
|
int eq0 = !ec_point_cmp (m, ec_zero);
|
|
int eqg = !ec_point_cmp (m, ec_gen);
|
|
|
|
if (!(eq0 ^ eqg))
|
|
eprintf ("zero knowledge proof: m is neither 0 nor g");
|
|
|
|
/* beta = r*g */
|
|
ec_keypair_create (beta, r);
|
|
gcry_mpi_mod (r, r, ec_n);
|
|
|
|
/* alpha = m + r*y */
|
|
gcry_mpi_ec_mul (alpha, r, y, ec_ctx);
|
|
gcry_mpi_ec_add (alpha, m, alpha, ec_ctx);
|
|
|
|
if (eq0)
|
|
{ /* m == 0 */
|
|
ec_keypair_create_base (a1, d1, beta);
|
|
gcry_mpi_mod (d1, d1, ec_n);
|
|
ec_keypair_create_base (b1, r1, y);
|
|
gcry_mpi_mod (r1, r1, ec_n);
|
|
|
|
/* a1 = r1*g + d1*beta */
|
|
gcry_mpi_ec_mul (a2, r1, ec_gen, ec_ctx);
|
|
gcry_mpi_ec_add (a1, a2, a1, ec_ctx);
|
|
|
|
/* b1 = r1*y + d1*(alpha-g) */
|
|
gcry_mpi_ec_sub (b2, alpha, ec_gen, ec_ctx);
|
|
gcry_mpi_ec_mul (a2, d1, b2, ec_ctx);
|
|
gcry_mpi_ec_add (b1, b1, a2, ec_ctx);
|
|
|
|
/* a2 = w * g */
|
|
ec_keypair_create_base (a2, w, ec_gen);
|
|
gcry_mpi_mod (w, w, ec_n);
|
|
|
|
/* b2 = w * y */
|
|
gcry_mpi_ec_mul (b2, w, y, ec_ctx);
|
|
}
|
|
else
|
|
{ /* m == g */
|
|
ec_keypair_create_base (a2, d2, beta);
|
|
gcry_mpi_mod (d2, d2, ec_n);
|
|
ec_keypair_create_base (b2, r2, y);
|
|
gcry_mpi_mod (r2, r2, ec_n);
|
|
|
|
/* a2 = r2*g + d2*beta */
|
|
gcry_mpi_ec_mul (a1, r2, ec_gen, ec_ctx);
|
|
gcry_mpi_ec_add (a2, a1, a2, ec_ctx);
|
|
|
|
/* b2 = r2*y + d2*(alpha-0) */
|
|
/* useless subtraction to have same amount of operations as in m == 0 */
|
|
gcry_mpi_ec_sub (b1, alpha, ec_zero, ec_ctx);
|
|
gcry_mpi_ec_mul (a1, d2, b1, ec_ctx);
|
|
gcry_mpi_ec_add (b2, b2, a1, ec_ctx);
|
|
|
|
/* a1 = w * g */
|
|
ec_keypair_create_base (a1, w, ec_gen);
|
|
gcry_mpi_mod (w, w, ec_n);
|
|
|
|
/* b1 = w * y */
|
|
gcry_mpi_ec_mul (b1, w, y, ec_ctx);
|
|
}
|
|
|
|
/* compute challenge c */
|
|
ec_point_serialize (&challenge.g, ec_gen);
|
|
ec_point_serialize (&challenge.alpha, alpha);
|
|
ec_point_serialize (&challenge.beta, beta);
|
|
ec_point_serialize (&challenge.a1, a1);
|
|
ec_point_serialize (&challenge.a2, a2);
|
|
ec_point_serialize (&challenge.b1, b1);
|
|
ec_point_serialize (&challenge.b2, b2);
|
|
brandt_hash (&challenge, sizeof (struct zkp_challenge_dl), &challhash);
|
|
mpi_parse (c, (struct ec_mpi *)&challhash);
|
|
gcry_mpi_mod (c, c, ec_n);
|
|
|
|
if (eq0)
|
|
{ /* m == 0 */
|
|
/* d2 = c - d1 */
|
|
gcry_mpi_subm (d2, c, d1, ec_n);
|
|
|
|
/* r2 = w - r*d2 */
|
|
gcry_mpi_mulm (r2, r, d2, ec_n);
|
|
gcry_mpi_subm (r2, w, r2, ec_n);
|
|
}
|
|
else
|
|
{ /* m == g */
|
|
/* d1 = c - d2 */
|
|
gcry_mpi_subm (d1, c, d2, ec_n);
|
|
|
|
/* r1 = w - r*d1 */
|
|
gcry_mpi_mulm (r1, r, d1, ec_n);
|
|
gcry_mpi_subm (r1, w, r1, ec_n);
|
|
}
|
|
|
|
gcry_mpi_release (c);
|
|
gcry_mpi_release (r);
|
|
gcry_mpi_release (w);
|
|
}
|
|
|
|
|
|
/**
|
|
* smc_zkp_0og_check \todo
|
|
*
|
|
* @param alpha TODO
|
|
* @param y TODO
|
|
* @param beta TODO
|
|
* @param a1 TODO
|
|
* @param a2 TODO
|
|
* @param b1 TODO
|
|
* @param b2 TODO
|
|
* @param d1 TODO
|
|
* @param d2 TODO
|
|
* @param r1 TODO
|
|
* @param r2 TODO
|
|
* @return TODO
|
|
*/
|
|
int
|
|
smc_zkp_0og_check (const gcry_mpi_point_t alpha,
|
|
const gcry_mpi_point_t y,
|
|
const gcry_mpi_point_t beta,
|
|
const gcry_mpi_point_t a1,
|
|
const gcry_mpi_point_t a2,
|
|
const gcry_mpi_point_t b1,
|
|
const gcry_mpi_point_t b2,
|
|
const gcry_mpi_t d1,
|
|
const gcry_mpi_t d2,
|
|
const gcry_mpi_t r1,
|
|
const gcry_mpi_t r2)
|
|
{
|
|
int ret;
|
|
struct zkp_challenge_0og challenge;
|
|
struct brandt_hash_code challhash;
|
|
gcry_mpi_t c = gcry_mpi_new (0);
|
|
gcry_mpi_t sum = gcry_mpi_new (0);
|
|
gcry_mpi_point_t right = gcry_mpi_point_new (0);
|
|
gcry_mpi_point_t tmp = gcry_mpi_point_new (0);
|
|
|
|
/* compute challenge c */
|
|
ec_point_serialize (&challenge.g, ec_gen);
|
|
ec_point_serialize (&challenge.alpha, alpha);
|
|
ec_point_serialize (&challenge.beta, beta);
|
|
ec_point_serialize (&challenge.a1, a1);
|
|
ec_point_serialize (&challenge.a2, a2);
|
|
ec_point_serialize (&challenge.b1, b1);
|
|
ec_point_serialize (&challenge.b2, b2);
|
|
brandt_hash (&challenge, sizeof (struct zkp_challenge_dl), &challhash);
|
|
mpi_parse (c, (struct ec_mpi *)&challhash);
|
|
gcry_mpi_mod (c, c, ec_n);
|
|
|
|
/* c == d1 + d2 */
|
|
gcry_mpi_addm (sum, d1, d2, ec_n);
|
|
ret = gcry_mpi_cmp (c, sum);
|
|
|
|
/* a1 == r1*g + d1*beta */
|
|
gcry_mpi_ec_mul (tmp, r1, ec_gen, ec_ctx);
|
|
gcry_mpi_ec_mul (right, d1, beta, ec_ctx);
|
|
gcry_mpi_ec_add (right, tmp, right, ec_ctx);
|
|
ret |= ec_point_cmp (a1, right) << 1;
|
|
|
|
/* b1 == r1*y + d1*(alpha-g) */
|
|
gcry_mpi_ec_sub (right, alpha, ec_gen, ec_ctx);
|
|
gcry_mpi_ec_mul (tmp, d1, right, ec_ctx);
|
|
gcry_mpi_ec_mul (right, r1, y, ec_ctx);
|
|
gcry_mpi_ec_add (right, right, tmp, ec_ctx);
|
|
ret |= ec_point_cmp (b1, right) << 2;
|
|
|
|
/* a2 == r2*g + d2*beta */
|
|
gcry_mpi_ec_mul (tmp, d2, beta, ec_ctx);
|
|
gcry_mpi_ec_mul (right, r2, ec_gen, ec_ctx);
|
|
gcry_mpi_ec_add (right, right, tmp, ec_ctx);
|
|
ret |= ec_point_cmp (a2, right) << 3;
|
|
|
|
/* b2 == r2*y + d2*alpha */
|
|
gcry_mpi_ec_mul (tmp, d2, alpha, ec_ctx);
|
|
gcry_mpi_ec_mul (right, r2, y, ec_ctx);
|
|
gcry_mpi_ec_add (right, right, tmp, ec_ctx);
|
|
ret |= ec_point_cmp (b2, right) << 4;
|
|
|
|
gcry_mpi_release (c);
|
|
gcry_mpi_release (sum);
|
|
gcry_mpi_point_release (right);
|
|
gcry_mpi_point_release (tmp);
|
|
|
|
if (ret)
|
|
weprintf ("ret: 0x%x", ret);
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* --- unused stuff, might become useful later --- */
|
|
|
|
///**
|
|
// * Clear memory that was used to store a private key.
|
|
// *
|
|
// * @param skey the key
|
|
// */
|
|
//void
|
|
//brandt_ec_key_clear (gcry_mpi_t skey)
|
|
//{
|
|
// gcry_mpi_randomize (skey, 256, GCRY_WEAK_RANDOM);
|
|
// gcry_mpi_release (skey);
|
|
//}
|
|
|
|
|
|
///**
|
|
// * Generate a random value mod n.
|
|
// *
|
|
// * @param edc ECC context
|
|
// * @return random value mod n.
|
|
// */
|
|
//gcry_mpi_t
|
|
//GNUNET_CRYPTO_ecc_random_mod_n (struct GNUNET_CRYPTO_EccDlogContext *edc)
|
|
//{
|
|
// gcry_mpi_t n;
|
|
// unsigned int highbit;
|
|
// gcry_mpi_t r;
|
|
//
|
|
// n = gcry_mpi_ec_get_mpi ("n", edc->ctx, 1);
|
|
//
|
|
// /* check public key for number of bits, bail out if key is all zeros */
|
|
// highbit = 256; /* Curve25519 */
|
|
// while ( (! gcry_mpi_test_bit (n, highbit)) &&
|
|
// (0 != highbit) )
|
|
// highbit--;
|
|
// GNUNET_assert (0 != highbit);
|
|
// /* generate fact < n (without bias) */
|
|
// GNUNET_assert (NULL != (r = gcry_mpi_new (0)));
|
|
// do {
|
|
// gcry_mpi_randomize (r,
|
|
// highbit + 1,
|
|
// GCRY_STRONG_RANDOM);
|
|
// }
|
|
// while (gcry_mpi_cmp (r, n) >= 0);
|
|
// gcry_mpi_release (n);
|
|
// return r;
|
|
//}
|