projects / u / mdw / catacomb / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Change secret sharing interface: present the secret at share
[u/mdw/catacomb] / share.c
1 /* -*-c-*-
2 *
3 * $Id: share.c,v 1.5 2000/12/06 20:30:10 mdw Exp $
4 *
5 * Shamir's secret sharing
6 *
7 * (c) 2000 Straylight/Edgeware
8 */
9
10 /*----- Licensing notice --------------------------------------------------*
11 *
12 * This file is part of Catacomb.
13 *
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
18 *
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
23 *
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
27 * MA 02111-1307, USA.
28 */
29
30 /*----- Revision history --------------------------------------------------*
31 *
32 * $Log: share.c,v $
33 * Revision 1.5 2000/12/06 20:30:10 mdw
34 * Change secret sharing interface: present the secret at share
35 * construction time.
36 *
37 * Revision 1.4 2000/10/08 12:16:17 mdw
38 * Use @MP_EQ@ instead of @MP_CMP@.
39 *
40 * Revision 1.3 2000/06/24 18:29:05 mdw
41 * Interface change: allow shares to be extracted from a context on demand,
42 * rather than building them all up-front.
43 *
44 * Revision 1.2 2000/06/18 23:05:19 mdw
45 * Minor performance tweak: use Barrett reduction rather than Montgomery.
46 * Fast secret sharing isn't done here, though: see `gfshare' instead.
47 *
48 * Revision 1.1 2000/06/17 12:09:38 mdw
49 * Shamir's secret sharing system.
50 *
51 */
52
53 /*----- Header files ------------------------------------------------------*/
54
55 #include <stdio.h>
56 #include <stdlib.h>
57 #include <string.h>
58
59 #include "grand.h"
60 #include "mp.h"
61 #include "mpint.h"
62 #include "mpbarrett.h"
63 #include "mprand.h"
64 #include "pgen.h"
65 #include "rabin.h"
66 #include "share.h"
67
68 /*----- Main code ---------------------------------------------------------*/
69
70 /* --- @share_create@ --- *
71 *
72 * Arguments: @share *s@ = pointer to share context to initialize
73 * @unsigned t@ = threshold for the system
74 *
75 * Returns: ---
76 *
77 * Use: Initializes a sharing context.
78 */
79
80 void share_create(share *s, unsigned t)
81 {
82 s->t = t;
83 s->i = 0;
84 s->p = 0;
85 s->v = 0;
86 }
87
88 /* --- @share_destroy@ --- *
89 *
90 * Arguments: @share *s@ = pointer to share context to destroy
91 *
92 * Returns: ---
93 *
94 * Use: Disposes of a sharing context. All memory is freed, all
95 * integers are dropped.
96 */
97
98 void share_destroy(share *s)
99 {
100 unsigned i;
101
102 /* --- Dispose of the share vector --- */
103
104 if (s->v) {
105 for (i = 0; i < s->t; i++) {
106 if (s->v[i].y)
107 mp_drop(s->v[i].y);
108 }
109 xfree(s->v);
110 }
111
112 /* --- Other stuff --- */
113
114 if (s->p)
115 mp_drop(s->p);
116 }
117
118 /* --- @share_mkshares@ --- *
119 *
120 * Arguments: @share *s@ = pointer to share context to fill in
121 * @grand *r@ = pointer to random number source
122 * @mp *n@ = the secret to share
123 *
124 * Returns: ---
125 *
126 * Use: Initializes a sharing context to be able to create shares.
127 * The context structure is expected to be mostly filled in. In
128 * particular, @t@ must be initialized. If @p@ is zero, a prime
129 * number of appropriate size is generated automatically. If
130 * @v@ is zero, a vector of appropriate size is allocated. You
131 * should use the macro @SHARE_INIT@ or @share_create@ to
132 * construct sharing contexts.
133 */
134
135 void share_mkshares(share *s, grand *r, mp *n)
136 {
137 unsigned i;
138
139 /* --- If there's no prime, construct one --- */
140
141 if (!s->p) {
142 pgen_filterctx pf;
143 rabin pr;
144 mp *p;
145 unsigned bits = (mp_octets(n) + 1) * 8;
146
147 pf.step = 2;
148 p = mprand(MP_NEW, bits, r, 1);
149 s->p = pgen("p", p, p, 0, 0, 0, pgen_filter, &pf,
150 rabin_iters(bits), pgen_test, &pr);
151 }
152
153 /* --- Construct the polynomial --- */
154
155 if (!s->v)
156 s->v = xmalloc(s->t * sizeof(share_pt));
157 for (i = 0; i < s->t - 1; i++)
158 s->v[i].y = mprand_range(MP_NEWSEC, s->p, r, 0);
159 s->v[s->t - 1].y = mp_copy(n);
160 }
161
162 /* --- @share_get@ --- *
163 *
164 * Arguments: @share *s@ = pointer to share conext
165 * @mp *d@ = destination for the share
166 * @unsigned x@ = share index to fetch
167 *
168 * Returns: The share, as requested.
169 *
170 * Use: Extracts a share from the system. You may extract @MPW_MAX@
171 * shares, or @s->p@ shares from the system, whichever is
172 * smaller. Shares are indexed from 0.
173 */
174
175 mp *share_get(share *s, mp *d, unsigned x)
176 {
177 mpbarrett mb;
178 mpw uw = x + 1;
179 mp u;
180 unsigned i;
181
182 /* --- Various bits of initialization --- */
183
184 mp_build(&u, &uw, &uw + 1);
185 if (d)
186 mp_drop(d);
187
188 /* --- Evaluate the polynomial at %$x = i + 1$% --- */
189
190 d = MP_ZERO;
191 mpbarrett_create(&mb, s->p);
192 for (i = 0; i < s->t; i++) {
193 d = mp_mul(d, d, &u);
194 d = mp_add(d, d, s->v[i].y);
195 d = mpbarrett_reduce(&mb, d, d);
196 }
197 mpbarrett_destroy(&mb);
198
199 return (d);
200 }
201
202 /* --- @share_add@ --- *
203 *
204 * Arguments: @share *s@ = pointer to sharing context
205 * @unsigned x@ = which share number this is
206 * @mp *y@ = the share value
207 *
208 * Returns: Number of shares required before recovery may be performed.
209 *
210 * Use: Adds a share to the context. The context must have been
211 * initialized with the correct prime @p@ and threshold @t@.
212 */
213
214 unsigned share_add(share *s, unsigned x, mp *y)
215 {
216 /* --- If no vector has been allocated, create one --- */
217
218 if (!s->v) {
219 unsigned i;
220 s->v = xmalloc(s->t * sizeof(share_pt));
221 s->i = 0;
222 for (i = 0; i < s->t; i++)
223 s->v[i].y = 0;
224 }
225
226 assert(((void)"Share context is full", s->i < s->t));
227
228 /* --- Store the share in the vector --- */
229
230 s->v[s->i].x = x + 1;
231 s->v[s->i].y = mp_copy(y);
232 s->i++;
233
234 /* --- Done --- */
235
236 return (s->t - s->i);
237 }
238
239 /* --- @share_combine@ --- *
240 *
241 * Arguments: @share *s@ = pointer to share context
242 *
243 * Returns: The secret, as a multiprecision integer.
244 *
245 * Use: Reconstructs a secret, given enough shares.
246 */
247
248 mp *share_combine(share *s)
249 {
250 mp *a = MP_ZERO;
251 mpbarrett mb;
252 unsigned i, j;
253 mp ii, jj;
254 mpw iiw, jjw;
255 mp *m = MP_NEW;
256
257 /* --- Sanity checking --- */
258
259 assert(((void)"Not enough shares yet", s->i == s->t));
260
261 /* --- Initialization --- */
262
263 mpbarrett_create(&mb, s->p);
264 mp_build(&ii, &iiw, &iiw + 1);
265 mp_build(&jj, &jjw, &jjw + 1);
266
267 /* --- Grind through the shares --- */
268
269 for (i = 0; i < s->t; i++) {
270 mp *c = MP_ONE;
271
272 iiw = s->v[i].x;
273 for (j = 0; j < s->t; j++) {
274 if (i == j)
275 continue;
276 jjw = s->v[j].x;
277 if (s->v[j].x >= s->v[i].x)
278 m = mp_sub(m, &jj, &ii);
279 else {
280 m = mp_sub(m, &ii, &jj);
281 m = mp_sub(m, s->p, m);
282 }
283 mp_gcd(0, 0, &m, s->p, m);
284 c = mp_mul(c, c, &jj);
285 c = mpbarrett_reduce(&mb, c, c);
286 c = mp_mul(c, c, m);
287 c = mpbarrett_reduce(&mb, c, c);
288 }
289 c = mp_mul(c, c, s->v[i].y);
290 c = mpbarrett_reduce(&mb, c, c);
291 a = mp_add(a, a, c);
292 mp_drop(c);
293 }
294
295 a = mpbarrett_reduce(&mb, a, a);
296 if (m)
297 mp_drop(m);
298 mpbarrett_destroy(&mb);
299 return (a);
300 }
301
302 /*----- Test rig ----------------------------------------------------------*/
303
304 #ifdef TEST_RIG
305
306 #include "fibrand.h"
307
308 static int verify(grand *r)
309 {
310 unsigned n = r->ops->range(r, 16) + 8;
311 unsigned t = r->ops->range(r, n - 1) + 1;
312 unsigned len = r->ops->range(r, 160);
313
314 mp **v = xmalloc(t * sizeof(mp *));
315 unsigned *p = xmalloc(n * sizeof(unsigned));
316 mp *sec = mprand(MP_NEW, len, r, 0);
317 share s;
318 mp *pp;
319 mp *ss;
320 unsigned i;
321
322 int ok = 1;
323
324 for (i = 0; i < n; i++)
325 p[i] = i;
326 for (i = 0; i < t; i++) {
327 unsigned long j = r->ops->range(r, n - i);
328 unsigned x = p[i];
329 p[i] = p[i + j];
330 p[i + j] = x;
331 }
332
333 share_create(&s, t);
334 share_mkshares(&s, r, sec);
335 for (i = 0; i < t; i++)
336 v[i] = share_get(&s, MP_NEW, p[i]);
337 pp = mp_copy(s.p);
338 share_destroy(&s);
339 assert(mparena_count(MPARENA_GLOBAL) + mparena_count(MPARENA_SECURE) == t + 2);
340
341 share_create(&s, t);
342 s.p = pp;
343 for (i = 0; i < t; i++)
344 share_add(&s, p[i], v[i]);
345 ss = share_combine(&s);
346 share_destroy(&s);
347
348 if (!MP_EQ(sec, ss)) {
349 ok = 0;
350 fprintf(stderr, "\nbad recombination of shares\n");
351 };
352
353 mp_drop(sec);
354 mp_drop(ss);
355
356 for (i = 0; i < t; i++)
357 mp_drop(v[i]);
358
359 xfree(v);
360 xfree(p);
361
362 assert(mparena_count(MPARENA_GLOBAL) + mparena_count(MPARENA_SECURE) == 0);
363 return (ok);
364 }
365
366 int main(void)
367 {
368 grand *r = fibrand_create(0);
369 unsigned i;
370 int ok = 1;
371
372 fputs("share: ", stdout);
373 for (i = 0; i < 40; i++) {
374 if (!verify(r))
375 ok = 0;
376 fputc('.', stdout);
377 fflush(stdout);
378 }
379
380 if (ok)
381 fputs(" ok\n", stdout);
382 else
383 fputs(" failed\n", stdout);
384 return (ok ? EXIT_SUCCESS : EXIT_FAILURE);
385 }
386
387 #endif
388
389 /*----- That's all, folks -------------------------------------------------*/
Catacomb cryptographic library (downstream of http://git.distorted.org.uk/~mdw/catacomb/)