git.distorted.org.uk Git - u/mdw/catacomb/blob - cc-kem.c

   1 /* -*-c-*-
   2  *
   3  * $Id: cc-kem.c,v 1.1 2004/04/17 09:58:37 mdw Exp $
   4  *
   5  * Catcrypt key-encapsulation
   6  *
   7  * (c) 2004 Straylight/Edgeware
   8  */
   9
  10 /*----- Licensing notice --------------------------------------------------*
  11  *
  12  * This file is part of Catacomb.
  13  *
  14  * Catacomb is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU Library General Public License as
  16  * published by the Free Software Foundation; either version 2 of the
  17  * License, or (at your option) any later version.
  18  *
  19  * Catacomb is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU Library General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU Library General Public
  25  * License along with Catacomb; if not, write to the Free
  26  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  27  * MA 02111-1307, USA.
  28  */
  29
  30 /*----- Header files ------------------------------------------------------*/
  31
  32 #include <stdlib.h>
  33
  34 #include <mLib/alloc.h>
  35 #include <mLib/dstr.h>
  36 #include <mLib/report.h>
  37 #include <mLib/sub.h>
  38
  39 #include "mprand.h"
  40 #include "rand.h"
  41
  42 #include "ec.h"
  43 #include "ec-keys.h"
  44 #include "dh.h"
  45 #include "rsa.h"
  46
  47 #include "rmd160.h"
  48 #include "blowfish-cbc.h"
  49
  50 #include "cc.h"
  51
  52 /*----- Key encapsulation -------------------------------------------------*/
  53
  54 /* --- RSA --- */
  55
  56 typedef struct rsa_encctx {
  57   kem k;
  58   rsa_pubctx rp;
  59 } rsa_encctx;
  60
  61 static kem *rsa_encinit(key *k, void *kd)
  62 {
  63   rsa_encctx *re = CREATE(rsa_encctx);
  64   rsa_pubcreate(&re->rp, kd);
  65   return (&re->k);
  66 }
  67
  68 static int rsa_encdoit(kem *k, dstr *d, ghash *h)
  69 {
  70   rsa_encctx *re = (rsa_encctx *)k;
  71   mp *x = mprand_range(MP_NEW, re->rp.rp->n, &rand_global, 0);
  72   mp *y = rsa_pubop(&re->rp, MP_NEW, x);
  73   size_t n = mp_octets(re->rp.rp->n);
  74   dstr_ensure(d, n);
  75   mp_storeb(x, d->buf, n);
  76   GH_HASH(h, d->buf, n);
  77   mp_storeb(y, d->buf, n);
  78   d->len += n;
  79   mp_drop(x);
  80   mp_drop(y);
  81   return (0);
  82 }
  83
  84 static const char *rsa_lengthcheck(mp *n)
  85 {
  86   if (mp_bits(n) < 1020) return ("key too short");
  87   return (0);
  88 }
  89
  90 static const char *rsa_enccheck(kem *k)
  91 {
  92   rsa_encctx *re = (rsa_encctx *)k;
  93   const char *e;
  94   if ((e = rsa_lengthcheck(re->rp.rp->n)) != 0) return (e);
  95   return (0);
  96 }
  97
  98 static void rsa_encdestroy(kem *k)
  99 {
 100   rsa_encctx *re = (rsa_encctx *)k;
 101   rsa_pubdestroy(&re->rp);
 102   DESTROY(re);
 103 }
 104
 105 static const kemops rsa_encops = {
 106   rsa_pubfetch, sizeof(rsa_pub),
 107   rsa_encinit, rsa_encdoit, rsa_enccheck, rsa_encdestroy
 108 };
 109
 110 typedef struct rsa_decctx {
 111   kem k;
 112   rsa_privctx rp;
 113 } rsa_decctx;
 114
 115 static kem *rsa_decinit(key *k, void *kd)
 116 {
 117   rsa_decctx *rd = CREATE(rsa_decctx);
 118   rsa_privcreate(&rd->rp, kd, &rand_global);
 119   return (&rd->k);
 120 }
 121
 122 static int rsa_decdoit(kem *k, dstr *d, ghash *h)
 123 {
 124   rsa_decctx *rd = (rsa_decctx *)k;
 125   mp *x = mp_loadb(MP_NEW, d->buf, d->len);
 126   size_t n;
 127   char *p;
 128
 129   if (MP_CMP(x, >=, rd->rp.rp->n)) {
 130     mp_drop(x);
 131     return (-1);
 132   }
 133   n = mp_octets(rd->rp.rp->n);
 134   p = xmalloc(n);
 135   x = rsa_privop(&rd->rp, x, x);
 136   mp_storeb(x, p, n);
 137   GH_HASH(h, p, n);
 138   mp_drop(x);
 139   xfree(p);
 140   return (0);
 141 }
 142
 143 static const char *rsa_deccheck(kem *k)
 144 {
 145   rsa_decctx *rd = (rsa_decctx *)k;
 146   const char *e;
 147   if ((e = rsa_lengthcheck(rd->rp.rp->n)) != 0) return (e);
 148   return (0);
 149 }
 150
 151 static void rsa_decdestroy(kem *k)
 152 {
 153   rsa_decctx *rd = (rsa_decctx *)k;
 154   rsa_privdestroy(&rd->rp);
 155   DESTROY(rd);
 156 }
 157
 158 static const kemops rsa_decops = {
 159   rsa_privfetch, sizeof(rsa_priv),
 160   rsa_decinit, rsa_decdoit, rsa_deccheck, rsa_decdestroy
 161 };
 162
 163 /* --- DH and EC --- */
 164
 165 typedef struct dh_encctx {
 166   kem k;
 167   group *g;
 168   mp *x;
 169   ge *y;
 170 } dh_encctx;
 171
 172 static dh_encctx *dh_doinit(key *k, const gprime_param *gp, mp *y)
 173 {
 174   dh_encctx *de = CREATE(dh_encctx);
 175   dstr t = DSTR_INIT;
 176
 177   key_fulltag(k, &t);
 178   if ((de->g = group_prime(gp)) == 0)
 179     die(EXIT_FAILURE, "bad prime group in key `%s'", t.buf);
 180   de->x = MP_NEW;
 181   de->y = G_CREATE(de->g);
 182   if (G_FROMINT(de->g, de->y, y))
 183     die(EXIT_FAILURE, "bad public key `%s'", t.buf);
 184   dstr_destroy(&t);
 185   return (de);
 186 }
 187
 188 static dh_encctx *ec_doinit(key *k, const char *cstr, const ec *y)
 189 {
 190   dh_encctx *de = CREATE(dh_encctx);
 191   ec_info ei;
 192   const char *e;
 193   dstr t = DSTR_INIT;
 194
 195   key_fulltag(k, &t);
 196   if ((e = ec_getinfo(&ei, cstr)) != 0 ||
 197       (de->g = group_ec(&ei)) == 0)
 198     die(EXIT_FAILURE, "bad elliptic curve spec in key `%s': %s", t.buf, e);
 199   de->x = MP_NEW;
 200   de->y = G_CREATE(de->g);
 201   if (G_FROMEC(de->g, de->y, y))
 202     die(EXIT_FAILURE, "bad public curve point `%s'", t.buf);
 203   dstr_destroy(&t);
 204   return (de);
 205 }
 206
 207 static kem *dh_encinit(key *k, void *kd)
 208 {
 209   dh_pub *dp = kd;
 210   dh_encctx *de = dh_doinit(k, &dp->dp, dp->y);
 211   return (&de->k);
 212 }
 213
 214 static kem *ec_encinit(key *k, void *kd)
 215 {
 216   ec_pub *ep = kd;
 217   dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
 218   return (&de->k);
 219 }
 220
 221 static int dh_encdoit(kem *k, dstr *d, ghash *h)
 222 {
 223   dh_encctx *de = (dh_encctx *)k;
 224   mp *r = mprand_range(MP_NEW, de->g->r, &rand_global, 0);
 225   ge *x = G_CREATE(de->g);
 226   ge *y = G_CREATE(de->g);
 227   size_t n = de->g->noctets;
 228   buf b;
 229
 230   G_EXP(de->g, x, de->g->g, r);
 231   G_EXP(de->g, y, de->y, r);
 232   dstr_ensure(d, n);
 233   buf_init(&b, d->buf, n);
 234   G_TORAW(de->g, &b, y);
 235   GH_HASH(h, BBASE(&b), BLEN(&b));
 236   buf_init(&b, d->buf, n);
 237   G_TORAW(de->g, &b, x);
 238   GH_HASH(h, BBASE(&b), BLEN(&b));
 239   d->len += BLEN(&b);
 240   mp_drop(r);
 241   G_DESTROY(de->g, x);
 242   G_DESTROY(de->g, y);
 243   return (0);
 244 }
 245
 246 static const char *dh_enccheck(kem *k)
 247 {
 248   dh_encctx *de = (dh_encctx *)k;
 249   const char *e;
 250   if ((e = G_CHECK(de->g, &rand_global)) != 0)
 251     return (0);
 252   if (group_check(de->g, de->y))
 253     return ("public key not in subgroup");
 254   return (0);
 255 }
 256
 257 static void dh_encdestroy(kem *k)
 258 {
 259   dh_encctx *de = (dh_encctx *)k;
 260   G_DESTROY(de->g, de->y);
 261   mp_drop(de->x);
 262   G_DESTROYGROUP(de->g);
 263 }
 264
 265 static const kemops dh_encops = {
 266   dh_pubfetch, sizeof(dh_pub),
 267   dh_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
 268 };
 269
 270 static const kemops ec_encops = {
 271   ec_pubfetch, sizeof(ec_pub),
 272   ec_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
 273 };
 274
 275 static kem *dh_decinit(key *k, void *kd)
 276 {
 277   dh_priv *dp = kd;
 278   dh_encctx *de = dh_doinit(k, &dp->dp, dp->y);
 279   de->x = MP_COPY(dp->x);
 280   return (&de->k);
 281 }
 282
 283 static kem *ec_decinit(key *k, void *kd)
 284 {
 285   ec_priv *ep = kd;
 286   dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
 287   de->x = MP_COPY(ep->x);
 288   return (&de->k);
 289 }
 290
 291 static int dh_decdoit(kem *k, dstr *d, ghash *h)
 292 {
 293   dh_encctx *de = (dh_encctx *)k;
 294   ge *x = G_CREATE(de->g);
 295   size_t n = de->g->noctets;
 296   void *p = xmalloc(n);
 297   buf b;
 298   int rc = -1;
 299
 300   buf_init(&b, d->buf, d->len);
 301   if (G_FROMRAW(de->g, &b, x) || group_check(de->g, x))
 302     goto done;
 303   G_EXP(de->g, x, x, de->x);
 304   buf_init(&b, p, n);
 305   G_TORAW(de->g, &b, x);
 306   GH_HASH(h, BBASE(&b), BLEN(&b));
 307   GH_HASH(h, d->buf, d->len);
 308   rc = 0;
 309 done:
 310   G_DESTROY(de->g, x);
 311   xfree(p);
 312   return (rc);
 313 }
 314
 315 static const kemops dh_decops = {
 316   dh_privfetch, sizeof(dh_priv),
 317   dh_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
 318 };
 319
 320 static const kemops ec_decops = {
 321   ec_privfetch, sizeof(ec_priv),
 322   ec_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
 323 };
 324
 325 /* --- The switch table --- */
 326
 327 static const struct kemtab {
 328   const char *name;
 329   const kemops *encops;
 330   const kemops *decops;
 331 } kemtab[] = {
 332   { "rsa",      &rsa_encops,    &rsa_decops },
 333   { "dh",       &dh_encops,     &dh_decops },
 334   { "ec",       &ec_encops,     &ec_decops },
 335   { 0,          0,              0 }
 336 };
 337
 338 /* --- @getkem@ --- *
 339  *
 340  * Arguments:   @key *k@ = the key to load
 341  *              @const char *app@ = application name
 342  *              @int wantpriv@ = nonzero if we want to decrypt
 343  *
 344  * Returns:     A key-encapsulating thing.
 345  *
 346  * Use:         Loads a key.
 347  */
 348
 349 kem *getkem(key *k, const char *app, int wantpriv)
 350 {
 351   const char *kalg, *halg = 0, *calg = 0;
 352   dstr d = DSTR_INIT;
 353   dstr t = DSTR_INIT;
 354   size_t n;
 355   char *p = 0;
 356   const char *q;
 357   kem *kk;
 358   const struct kemtab *kt;
 359   const kemops *ko;
 360   void *kd;
 361   int e;
 362   key_packdef *kp;
 363
 364   /* --- Setup stuff --- */
 365
 366   key_fulltag(k, &t);
 367
 368   /* --- Get the KEM name --- *
 369    *
 370    * Take the attribute if it's there; otherwise use the key type.
 371    */
 372
 373   n = strlen(app);
 374   if ((q = key_getattr(0, k, "kem")) != 0) {
 375     dstr_puts(&d, q);
 376     p = d.buf;
 377   } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
 378     dstr_puts(&d, k->type);
 379     p = d.buf + n + 1;
 380   } else
 381     die(EXIT_FAILURE, "no KEM for key `%s'", t.buf);
 382   kalg = p;
 383
 384   /* --- Grab the encryption scheme --- *
 385    *
 386    * Grab it from the KEM if it's there, but override it from the attribute.
 387    */
 388
 389   if (p && (p = strchr(p, '/')) != 0) {
 390     *p++ = 0;
 391     calg = p;
 392   }
 393   if ((q = key_getattr(0, k, "cipher")) != 0)
 394     calg = q;
 395
 396   /* --- Grab the hash function --- */
 397
 398   if (p && (p = strchr(p, '/')) != 0) {
 399     *p++ = 0;
 400     halg = p;
 401   }
 402   if ((q = key_getattr(0, k, "hash")) != 0)
 403     halg = q;
 404
 405   /* --- Instantiate the KEM --- */
 406
 407   for (kt = kemtab; kt->name; kt++) {
 408     if (strcmp(kt->name, kalg) == 0)
 409       goto k_found;
 410   }
 411   die(EXIT_FAILURE, "key encapsulation mechanism `%s' not found in key `%s'",
 412       kalg, t.buf);
 413 k_found:;
 414   ko = wantpriv ? kt->decops : kt->encops;
 415   kd = xmalloc(ko->kdsz);
 416   kp = key_fetchinit(ko->kf, 0, kd);
 417   if ((e = key_fetch(kp, k)) != 0)
 418     die(EXIT_FAILURE, "error fetching key `%s': %s", t.buf, key_strerror(e));
 419   kk = ko->init(k, kd);
 420   kk->kp = kp;
 421   kk->ops = ko;
 422   kk->kd = kd;
 423
 424   /* --- Set up the algorithms --- */
 425
 426   if (!halg)
 427     kk->h = &rmd160;
 428   else if ((kk->h = ghash_byname(halg)) == 0) {
 429     die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
 430         halg, t.buf);
 431   }
 432
 433   if (!calg)
 434     kk->c = &blowfish_cbc;
 435   else if ((kk->c = gcipher_byname(calg)) == 0) {
 436     die(EXIT_FAILURE, "encryption scheme `%s' not found in key `%s'",
 437         calg, t.buf);
 438   }
 439
 440   dstr_reset(&d);
 441   if ((q = key_getattr(0, k, "kdf")) == 0) {
 442     dstr_putf(&d, "%s-mgf", kk->h->name);
 443     q = d.buf;
 444   }
 445   if ((kk->cx = gcipher_byname(q)) == 0) {
 446     die(EXIT_FAILURE, "encryption scheme (KDF) `%s' not found in key `%s'",
 447         q, t.buf);
 448   }
 449
 450   dstr_reset(&d);
 451   if ((q = key_getattr(0, k, "mac")) == 0) {
 452     dstr_putf(&d, "%s-hmac", kk->h->name);
 453     q = d.buf;
 454   }
 455   if ((kk->m = gmac_byname(q)) == 0) {
 456     die(EXIT_FAILURE,
 457         "message authentication code `%s' not found in key `%s'",
 458         q, t.buf);
 459   }
 460
 461   /* --- Tidy up --- */
 462
 463   dstr_destroy(&d);
 464   dstr_destroy(&t);
 465   return (kk);
 466 }
 467
 468 /* --- @setupkem@ --- *
 469  *
 470  * Arguments:   @kem *k@ = key-encapsulation thing
 471  *              @dstr *d@ = key-encapsulation data
 472  *              @gcipher **cx@ = key-expansion function (for IVs)
 473  *              @gcipher **c@ = where to put initialized encryption scheme
 474  *              @gmac **m@ = where to put initialized MAC
 475  *
 476  * Returns:     Zero on success, nonzero on failure.
 477  *
 478  * Use:         Initializes all the various symmetric things from a KEM.
 479  */
 480
 481 int setupkem(kem *k, dstr *d, gcipher **cx, gcipher **c, gmac **m)
 482 {
 483   octet *kd;
 484   size_t n, cn, mn;
 485   ghash *h;
 486   int rc = 0;
 487
 488   h = GH_INIT(k->h);
 489   if (k->ops->doit(k, d, h))
 490     goto done;
 491   n = keysz(GH_CLASS(h)->hashsz, k->cx->keysz);
 492   if (!n)
 493     goto done;
 494   kd = GH_DONE(h, 0);
 495   *cx = GC_INIT(k->cx, kd, n);
 496
 497   cn = keysz(0, k->c->keysz); n = cn;
 498   mn = keysz(0, k->m->keysz); if (mn > n) n = mn;
 499   kd = xmalloc(n);
 500   GC_ENCRYPT(*cx, 0, kd, cn);
 501   *c = GC_INIT(k->c, kd, cn);
 502   GC_ENCRYPT(*cx, 0, kd, mn);
 503   *m = GM_KEY(k->m, kd, mn);
 504   xfree(kd);
 505
 506   rc = 0;
 507 done:
 508   GH_DESTROY(h);
 509   return (rc);
 510 }
 511
 512 /* --- @freekem@ --- *
 513  *
 514  * Arguments:   @kem *k@ = key-encapsulation thing
 515  *
 516  * Returns:     ---
 517  *
 518  * Use:         Frees up a key-encapsulation thing.
 519  */
 520
 521 void freekem(kem *k)
 522 {
 523   key_fetchdone(k->kp);
 524   xfree(k->kd);
 525   k->ops->destroy(k);
 526 }
 527
 528 /*----- That's all, folks -------------------------------------------------*/