oec/libbrandt
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
977de77474
libbrandt/crypto.c

744 lines
18 KiB
C
Raw Blame History

/* This file is part of libbrandt.
* Copyright (C) 2016 GNUnet e.V.
*
* libbrandt is free software: you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by the Free Software
* Foundation, either version 3 of the License, or (at your option) any later
* version.
*
* libbrandt is distributed in the hope that it will be useful, but WITHOUT ANY
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
* A PARTICULAR PURPOSE. See the GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along with
* libbrandt. If not, see <http://www.gnu.org/licenses/>.
*/
/**
* @file crypto.c
* @brief Implementation of the crypto primitives.
*/
#include <arpa/inet.h>
#include <gcrypt.h>
#include "crypto.h"
#include "internals.h"
#include "util.h"
#define CURVE "Ed25519"
static gcry_ctx_t ec_ctx;
static gcry_mpi_point_t ec_gen;
static gcry_mpi_point_t ec_zero;
static gcry_mpi_t ec_n;
/**
* brandt_crypto_init
*
*
*/
void
brandt_crypto_init ()
{
gcry_error_t rc;
rc = gcry_mpi_ec_new (&ec_ctx, NULL, CURVE);
brandt_assert_gpgerr (rc);
ec_gen = gcry_mpi_ec_get_point ("g", ec_ctx, 0);
brandt_assert (NULL != ec_gen);
ec_zero = gcry_mpi_point_new (0);
brandt_assert (NULL != ec_zero);
gcry_mpi_ec_sub (ec_zero, ec_gen, ec_gen, ec_ctx);
ec_n = gcry_mpi_ec_get_mpi ("n", ec_ctx, 1);
brandt_assert (NULL != ec_n);
}
/* --- RANDOM --- */
void
brandt_rand_poll ()
{
static unsigned char rand_amount = 255;
if (!(rand_amount--))
gcry_fast_random_poll ();
}
/* --- HASHING --- */
/**
* Hash block of given size.
*
* @param block the data to #brandt_hash, length is given as a second argument
* @param size the length of the data to #brandt_hash in @a block
* @param ret pointer to where to write the hashcode
*/
void
brandt_hash (const void *block, size_t size, struct brandt_hash_code *ret)
{
gcry_md_hash_buffer (GCRY_MD_SHA512, ret, block, size);
}
/* --- MPI --- */
/**
* If target != size, move @a target bytes to the end of the size-sized
* buffer and zero out the first @a target - @a size bytes.
*
* @param buf original buffer
* @param size number of bytes in @a buf
* @param target target size of the buffer
*/
static void
adjust (void *buf, size_t size, size_t target)
{
char *p = buf;
if (size < target)
{
memmove (&p[target - size], buf, size);
memset (buf, 0, target - size);
}
}
/**
* Output the given MPI value to the given buffer in
* network byte order.
* The MPI @a val may not be negative.
*
* @param buf where to output to
* @param size number of bytes in @a buf
* @param val value to write to @a buf
*/
void
brandt_mpi_print_unsigned (void *buf, size_t size, gcry_mpi_t val)
{
size_t rsize;
gcry_error_t rc;
if (gcry_mpi_get_flag (val, GCRYMPI_FLAG_OPAQUE))
{
/* Store opaque MPIs left aligned into the buffer. */
unsigned int nbits;
const void *p;
p = gcry_mpi_get_opaque (val, &nbits);
brandt_assert (NULL != p);
rsize = (nbits + 7) / 8;
if (rsize > size)
rsize = size;
memcpy (buf, p, rsize);
if (rsize < size)
memset (((char *)buf) + rsize, 0, size - rsize);
}
else
{
/* Store regular MPIs as unsigned integers right aligned into the buffer. */
rsize = size;
rc = gcry_mpi_print (GCRYMPI_FMT_USG, buf, rsize, &rsize, val);
brandt_assert_gpgerr (rc);
adjust (buf, rsize, size);
}
}
/**
* Convert data buffer into MPI value.
* The buffer is interpreted as network
* byte order, unsigned integer.
*
* @param result where to store MPI value (allocated)
* @param data raw data (GCRYMPI_FMT_USG)
* @param size number of bytes in @a data
*/
void
brandt_mpi_scan_unsigned (gcry_mpi_t *result, const void *data, size_t size)
{
gcry_error_t rc;
rc = gcry_mpi_scan (result, GCRYMPI_FMT_USG, data, size, &size);
brandt_assert_gpgerr (rc);
}
/* --- EC --- */
/**
* ec_skey_create
*
* @param[out] skey where to store the generated secret key. This has to be an
* already initialized mpi.
*/
void
ec_skey_create (gcry_mpi_t skey)
{
gcry_mpi_t ret;
gcry_sexp_t s_keyparam;
gcry_sexp_t priv_sexp;
gcry_sexp_t priv_key;
gcry_sexp_t priv_key2;
gcry_error_t rc;
rc = gcry_sexp_build (&s_keyparam, NULL, "(genkey(ecc(curve \"" CURVE "\")"
"(flags)))");
brandt_assert_gpgerr (rc);
rc = gcry_pk_genkey (&priv_sexp, s_keyparam);
brandt_assert_gpgerr (rc);
gcry_sexp_release (s_keyparam);
priv_key = gcry_sexp_find_token (priv_sexp, "private-key", 11);
brandt_assert (NULL != priv_key);
gcry_sexp_release (priv_sexp);
priv_key2 = gcry_sexp_find_token (priv_key, "d", 1);
brandt_assert (NULL != priv_key2);
gcry_sexp_release (priv_key);
ret = gcry_sexp_nth_mpi (priv_key2, 1, GCRYMPI_FMT_USG);
brandt_assert (NULL != ret);
gcry_sexp_release (priv_key2);
gcry_mpi_snatch (skey, ret);
}
/**
* ec_keypair_create
*
* @param[out] pkey where to store the generated public key
* @param[out] skey where to store the generated secret key
*/
void
ec_keypair_create (gcry_mpi_point_t pkey, gcry_mpi_t skey)
{
brandt_assert (NULL != pkey);
brandt_assert (NULL != skey);
ec_skey_create (skey);
gcry_mpi_ec_mul (pkey, skey, ec_gen, ec_ctx);
}
/**
* ec_keypair_create_base
*
* @param[out] pkey where to store the generated public key
* @param[out] skey where to store the generated secret key
* @param[in] base which base point should be used to calculate the public key
*/
void
ec_keypair_create_base (gcry_mpi_point_t pkey,
gcry_mpi_t skey,
const gcry_mpi_point_t base)
{
brandt_assert (NULL != pkey);
brandt_assert (NULL != skey);
brandt_assert (NULL != base);
ec_skey_create (skey);
gcry_mpi_ec_mul (pkey, skey, base, ec_ctx);
}
/**
* ec_point_cmp compares two curve points
*
* @param[in] a the first point
* @param[in] b the second point
* @return 0 if @a a and @a b represent the same point on the curve, something
* else otherwise
*/
int
ec_point_cmp (const gcry_mpi_point_t a, const gcry_mpi_point_t b)
{
int ret = 1;
gcry_mpi_t ax = gcry_mpi_new (0);
gcry_mpi_t bx = gcry_mpi_new (0);
gcry_mpi_t ay = gcry_mpi_new (0);
gcry_mpi_t by = gcry_mpi_new (0);
brandt_assert (a && b);
if (!ax || !bx || !ay || !by)
{
weprintf ("could not init point in point_cmp");
return 1;
}
if (!gcry_mpi_ec_get_affine (ax, ay, a, ec_ctx) &&
!gcry_mpi_ec_get_affine (bx, by, b, ec_ctx))
{
ret = gcry_mpi_cmp (ax, bx) || gcry_mpi_cmp (ay, by);
}
gcry_mpi_release (ax);
gcry_mpi_release (bx);
gcry_mpi_release (ay);
gcry_mpi_release (by);
return ret;
}
static gcry_mpi_point_t **
smc_init2 (uint16_t size1, uint16_t size2)
{
uint16_t i, j;
gcry_mpi_point_t **ret;
gcry_mpi_point_t *data;
ret = calloc (size1, sizeof (*ret) + (size2 * sizeof (**ret)));
brandt_assert (NULL != ret);
data = (gcry_mpi_point_t *)&ret[size1];
for (i = 0; i < size1; i++)
{
ret[i] = &data[i * size2];
for (j = 0; j < size2; j++)
ret[i][j] = gcry_mpi_point_new (0);
}
return ret;
}
static void
smc_free2 (gcry_mpi_point_t **dst, uint16_t size1, uint16_t size2)
{
uint16_t i, j;
for (i = 0; i < size1; i++)
for (j = 0; j < size2; j++)
gcry_mpi_point_release (dst[i][j]);
free (dst);
}
/**
* smc_sums_partial calculates sums up until the current index and stores them
* in @a out. @$f\forall i \leq len: out_i=sum_{h=1}^iin_h@$f
*
* @param[out] out Where to store the resulting sums. Points may be given
* uninitialized, but the appropriate amount of memory has to be allocated
* beforehand.
* @param[in] in Input points.
* @param[in] len The length of both @a out and @a in.
*/
static void
smc_sums_partial (gcry_mpi_point_t out[], gcry_mpi_point_t in[], uint16_t len)
{
uint16_t i;
for (i = 0; i < len; i++)
{
out[i] = gcry_mpi_point_new (0);
gcry_mpi_ec_add (out[i], in[i], (i ? out[i - 1] : ec_zero), ec_ctx);
brandt_assert (NULL != out[i]);
}
}
/**
* smc_sum calculates the sum of all input points. @$fout=sum_{i=1}^{len}in_i@$f
*
* @param[out] out Where to store the result
* @param[in] in Input points.
* @param[in] len The length of @a in.
*/
static void
smc_sum (gcry_mpi_point_t out, gcry_mpi_point_t in[], uint16_t len)
{
uint16_t i;
brandt_assert (NULL != out);
/**TODO: how to copy a point more efficiently? */
gcry_mpi_ec_add (out, ec_zero, ec_zero, ec_ctx);
for (i = 0; i < len; i++)
gcry_mpi_ec_add (out, out, in[i], ec_ctx);
}
/**
* smc_compute_pkey calculates the shared public key
*
* @param[in,out] ad The struct AuctionData used
*/
void
smc_compute_pkey (struct AuctionData *ad)
{
ad->Y = gcry_mpi_point_new (0);
smc_sum (ad->Y, ad->y, ad->n);
}
/**
* smc_zkp_dl
*
* @param v TODO
* @param g TODO
* @param x TODO
* @param a TODO
* @param c TODO
* @param r TODO
*/
void
smc_zkp_dl (const gcry_mpi_point_t v,
const gcry_mpi_point_t g,
const gcry_mpi_t x,
const gcry_mpi_point_t a,
gcry_mpi_t c,
gcry_mpi_t r)
{
gcry_mpi_t z = gcry_mpi_new (0);
ec_keypair_create_base (a, z, g);
/* compute challange c */
/**TODO: generate c from HASH(g,v,a) and don't output it */
ec_skey_create (c);
gcry_mpi_mod (c, c, ec_n);
gcry_mpi_mulm (r, c, x, ec_n);
gcry_mpi_addm (r, r, z, ec_n);
gcry_mpi_release (z);
}
/**
* smc_zkp_dl_check
*
* @param v TODO
* @param g TODO
* @param a TODO
* @param c TODO
* @param r TODO
* @return 0 if the proof is correct, something else otherwise
*/
int
smc_zkp_dl_check (const gcry_mpi_point_t v,
const gcry_mpi_point_t g,
const gcry_mpi_point_t a,
const gcry_mpi_t c,
const gcry_mpi_t r)
{
int ret;
gcry_mpi_point_t left = gcry_mpi_point_new (0);
gcry_mpi_point_t right = gcry_mpi_point_new (0);
gcry_mpi_ec_mul (left, r, g, ec_ctx);
gcry_mpi_ec_mul (right, c, v, ec_ctx);
gcry_mpi_ec_add (right, a, right, ec_ctx);
ret = ec_point_cmp (left, right);
gcry_mpi_point_release (left);
gcry_mpi_point_release (right);
return ret;
}
void
smc_zkp_2dle (const gcry_mpi_point_t v,
const gcry_mpi_point_t w,
const gcry_mpi_point_t g1,
const gcry_mpi_point_t g2,
const gcry_mpi_t x,
gcry_mpi_point_t a,
gcry_mpi_point_t b,
gcry_mpi_t c,
gcry_mpi_t r)
{
gcry_mpi_t z = gcry_mpi_new (0);
ec_keypair_create_base (a, z, g1);
gcry_mpi_ec_mul (b, z, g2, ec_ctx);
/* compute challange c */
/**TODO: generate c from HASH(g1,g2,v,w,a,b) and don't output it */
ec_skey_create (c);
gcry_mpi_mod (c, c, ec_n);
gcry_mpi_mulm (r, c, x, ec_n);
gcry_mpi_addm (r, r, z, ec_n);
gcry_mpi_release (z);
}
int
smc_zkp_2dle_check (const gcry_mpi_point_t v,
const gcry_mpi_point_t w,
const gcry_mpi_point_t g1,
const gcry_mpi_point_t g2,
const gcry_mpi_point_t a,
const gcry_mpi_point_t b,
const gcry_mpi_t c,
const gcry_mpi_t r)
{
int ret;
gcry_mpi_point_t left = gcry_mpi_point_new (0);
gcry_mpi_point_t right = gcry_mpi_point_new (0);
gcry_mpi_ec_mul (left, r, g1, ec_ctx);
gcry_mpi_ec_mul (right, c, v, ec_ctx);
gcry_mpi_ec_add (right, a, right, ec_ctx);
ret = ec_point_cmp (left, right);
gcry_mpi_ec_mul (left, r, g2, ec_ctx);
gcry_mpi_ec_mul (right, c, w, ec_ctx);
gcry_mpi_ec_add (right, b, right, ec_ctx);
ret |= ec_point_cmp (left, right);
gcry_mpi_point_release (left);
gcry_mpi_point_release (right);
return ret;
}
void
smc_zkp_0og (gcry_mpi_point_t alpha,
const gcry_mpi_point_t m,
const gcry_mpi_point_t y,
gcry_mpi_point_t beta,
gcry_mpi_point_t a1,
gcry_mpi_point_t a2,
gcry_mpi_point_t b1,
gcry_mpi_point_t b2,
gcry_mpi_t c,
gcry_mpi_t d1,
gcry_mpi_t d2,
gcry_mpi_t r1,
gcry_mpi_t r2)
{
gcry_mpi_t r = gcry_mpi_new (0);
gcry_mpi_t w = gcry_mpi_new (0);
int eq0 = !ec_point_cmp (m, ec_zero);
int eqg = !ec_point_cmp (m, ec_gen);
if (!(eq0 ^ eqg))
eprintf ("zero knowledge proof: m is neither 0 nor g");
/* beta = r*g */
ec_keypair_create (beta, r);
gcry_mpi_mod (r, r, ec_n);
/* alpha = m + r*y */
gcry_mpi_ec_mul (alpha, r, y, ec_ctx);
gcry_mpi_ec_add (alpha, m, alpha, ec_ctx);
if (eq0)
{ /* m == 0 */
ec_keypair_create_base (a1, d1, beta);
gcry_mpi_mod (d1, d1, ec_n);
ec_keypair_create_base (b1, r1, y);
gcry_mpi_mod (r1, r1, ec_n);
/* a1 = r1*g + d1*beta */
gcry_mpi_ec_mul (a2, r1, ec_gen, ec_ctx);
gcry_mpi_ec_add (a1, a2, a1, ec_ctx);
/* b1 = r1*y + d1*(alpha-g) */
gcry_mpi_ec_sub (b2, alpha, ec_gen, ec_ctx);
gcry_mpi_ec_mul (a2, d1, b2, ec_ctx);
gcry_mpi_ec_add (b1, b1, a2, ec_ctx);
/* a2 = w * g */
ec_keypair_create_base (a2, w, ec_gen);
gcry_mpi_mod (w, w, ec_n);
/* b2 = w * y */
gcry_mpi_ec_mul (b2, w, y, ec_ctx);
/* compute challange c */
/**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */
ec_skey_create (c);
gcry_mpi_mod (c, c, ec_n);
/* d2 = c - d1 */
gcry_mpi_subm (d2, c, d1, ec_n);
/* r2 = w - r*d2 */
gcry_mpi_mulm (r2, r, d2, ec_n);
gcry_mpi_subm (r2, w, r2, ec_n);
}
else
{ /* m == g */
ec_keypair_create_base (a2, d2, beta);
gcry_mpi_mod (d2, d2, ec_n);
ec_keypair_create_base (b2, r2, y);
gcry_mpi_mod (r2, r2, ec_n);
/* a2 = r2*g + d2*beta */
gcry_mpi_ec_mul (a1, r2, ec_gen, ec_ctx);
gcry_mpi_ec_add (a2, a1, a2, ec_ctx);
/* b2 = r2*y + d2*(alpha-0) */
/* useless subtraction to have same amount of operations as in m == 0 */
gcry_mpi_ec_sub (b1, alpha, ec_zero, ec_ctx);
gcry_mpi_ec_mul (a1, d2, b1, ec_ctx);
gcry_mpi_ec_add (b2, b2, a1, ec_ctx);
/* a1 = w * g */
ec_keypair_create_base (a1, w, ec_gen);
gcry_mpi_mod (w, w, ec_n);
/* b1 = w * y */
gcry_mpi_ec_mul (b1, w, y, ec_ctx);
/* compute challange c */
/**TODO: generate c from HASH(alpha,beta,a1,b1,a2,b2) and don't output it */
ec_skey_create (c);
gcry_mpi_mod (c, c, ec_n);
/* d1 = c - d2 */
gcry_mpi_subm (d1, c, d2, ec_n);
/* r1 = w - r*d1 */
gcry_mpi_mulm (r1, r, d1, ec_n);
gcry_mpi_subm (r1, w, r1, ec_n);
}
gcry_mpi_release (r);
gcry_mpi_release (w);
}
int
smc_zkp_0og_check (const gcry_mpi_point_t alpha,
const gcry_mpi_point_t y,
const gcry_mpi_point_t beta,
const gcry_mpi_point_t a1,
const gcry_mpi_point_t a2,
const gcry_mpi_point_t b1,
const gcry_mpi_point_t b2,
const gcry_mpi_t c,
const gcry_mpi_t d1,
const gcry_mpi_t d2,
const gcry_mpi_t r1,
const gcry_mpi_t r2)
{
int ret;
gcry_mpi_t sum = gcry_mpi_new (0);
gcry_mpi_point_t right = gcry_mpi_point_new (0);
gcry_mpi_point_t tmp = gcry_mpi_point_new (0);
/* c == d1 + d2 */
gcry_mpi_addm (sum, d1, d2, ec_n);
ret = gcry_mpi_cmp (c, sum);
/* a1 == r1*g + d1*beta */
gcry_mpi_ec_mul (tmp, r1, ec_gen, ec_ctx);
gcry_mpi_ec_mul (right, d1, beta, ec_ctx);
gcry_mpi_ec_add (right, tmp, right, ec_ctx);
ret |= ec_point_cmp (a1, right) << 1;
/* b1 == r1*y + d1*(alpha-g) */
gcry_mpi_ec_sub (right, alpha, ec_gen, ec_ctx);
gcry_mpi_ec_mul (tmp, d1, right, ec_ctx);
gcry_mpi_ec_mul (right, r1, y, ec_ctx);
gcry_mpi_ec_add (right, right, tmp, ec_ctx);
ret |= ec_point_cmp (b1, right) << 2;
/* a2 == r2*g + d2*beta */
gcry_mpi_ec_mul (tmp, d2, beta, ec_ctx);
gcry_mpi_ec_mul (right, r2, ec_gen, ec_ctx);
gcry_mpi_ec_add (right, right, tmp, ec_ctx);
ret |= ec_point_cmp (a2, right) << 3;
/* b2 == r2*y + d2*alpha */
gcry_mpi_ec_mul (tmp, d2, alpha, ec_ctx);
gcry_mpi_ec_mul (right, r2, y, ec_ctx);
gcry_mpi_ec_add (right, right, tmp, ec_ctx);
ret |= ec_point_cmp (b2, right) << 4;
gcry_mpi_release (sum);
gcry_mpi_point_release (right);
gcry_mpi_point_release (tmp);
if (ret)
weprintf ("ret: 0x%x", ret);
return ret;
}
/* --- unused stuff, might become useful later --- */
///**
// * Clear memory that was used to store a private key.
// *
// * @param skey the key
// */
//void
//brandt_ec_key_clear (gcry_mpi_t skey)
//{
// gcry_mpi_randomize (skey, 256, GCRY_WEAK_RANDOM);
// gcry_mpi_release (skey);
//}
//gcry_mpi_point_t
//deserialize_point(const struct brandt_point* data, const int len)
//{
// gcry_sexp_t s;
// gcry_ctx_t ctx;
// gcry_mpi_point_t ret;
// gcry_error_t rc;
//
// rc = gcry_sexp_build(&s, NULL, "(public-key(ecc(curve " CURVE ")(q %b)))",
// len, data);
// brandt_assert_gpgerr(rc);
//
// rc = gcry_mpi_ec_new(&ctx, s, NULL);
// brandt_assert_gpgerr(rc);
// gcry_sexp_release(s);
//
// ret = gcry_mpi_ec_get_point("q", ctx, 0);
// brandt_assert(ret);
// gcry_ctx_release(ctx);
// return ret;
//}
///**
// * Generate a random value mod n.
// *
// * @param edc ECC context
// * @return random value mod n.
// */
//gcry_mpi_t
//GNUNET_CRYPTO_ecc_random_mod_n (struct GNUNET_CRYPTO_EccDlogContext *edc)
//{
// gcry_mpi_t n;
// unsigned int highbit;
// gcry_mpi_t r;
//
// n = gcry_mpi_ec_get_mpi ("n", edc->ctx, 1);
//
// /* check public key for number of bits, bail out if key is all zeros */
// highbit = 256; /* Curve25519 */
// while ( (! gcry_mpi_test_bit (n, highbit)) &&
// (0 != highbit) )
// highbit--;
// GNUNET_assert (0 != highbit);
// /* generate fact < n (without bias) */
// GNUNET_assert (NULL != (r = gcry_mpi_new (0)));
// do {
// gcry_mpi_randomize (r,
// highbit + 1,
// GCRY_STRONG_RANDOM);
// }
// while (gcry_mpi_cmp (r, n) >= 0);
// gcry_mpi_release (n);
// return r;
//}
Reference in New Issue View Git Blame Copy Permalink