[catacomb] / progs / cc-kem.c

/* -*-c-*-
 *
 * Catcrypt key-encapsulation
 *
 * (c) 2004 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 *
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#define _FILE_OFFSET_BITS 64

#include <stdlib.h>

#include <mLib/alloc.h>
#include <mLib/dstr.h>
#include <mLib/report.h>
#include <mLib/sub.h>

#include "gaead.h"
#include "mprand.h"
#include "rand.h"

#include "ec.h"
#include "ec-keys.h"
#include "dh.h"
#include "rsa.h"
#include "x25519.h"
#include "x448.h"

#include "rmd160.h"
#include "blowfish-cbc.h"
#include "chacha20-poly1305.h"
#include "poly1305.h"
#include "salsa20.h"
#include "chacha.h"

#include "cc.h"

/*----- Bulk crypto -------------------------------------------------------*/

/* --- NaCl `secretbox' --- */

typedef struct naclbox_encctx {
  bulk b;
  const gccipher *cc;
  gcipher *c;
} naclbox_encctx;

static bulk *naclbox_init(key *k, const char *calg, const char *halg)
{
  naclbox_encctx *ctx = CREATE(naclbox_encctx);
  dstr t = DSTR_INIT;
  const char *q;

  key_fulltag(k, &t);

  if ((q = key_getattr(0, k, "cipher")) != 0) calg = q;
  if (!calg || strcmp(calg, "salsa20") == 0) ctx->cc = &salsa20;
  else if (strcmp(calg, "salsa20/12") == 0) ctx->cc = &salsa2012;
  else if (strcmp(calg, "salsa20/8") == 0) ctx->cc = &salsa208;
  else if (strcmp(calg, "chacha20") == 0) ctx->cc = &chacha20;
  else if (strcmp(calg, "chacha12") == 0) ctx->cc = &chacha12;
  else if (strcmp(calg, "chacha8") == 0) ctx->cc = &chacha8;
  else {
    die(EXIT_FAILURE,
        "unknown or inappropriate encryption scheme `%s' in key `%s'",
        calg, t.buf);
  }

  dstr_destroy(&t);
  return (&ctx->b);
}

static int naclbox_setup(bulk *b, gcipher *cx)
{
  naclbox_encctx *ctx = (naclbox_encctx *)b;
  octet k[SALSA20_KEYSZ];

  GC_ENCRYPT(cx, 0, k, sizeof(k));
  ctx->c = GC_INIT(ctx->cc, k, sizeof(k));
  return (0);
}

static size_t naclbox_overhead(bulk *b) { return (POLY1305_TAGSZ); }

static void naclbox_destroy(bulk *b)
{
  naclbox_encctx *ctx = (naclbox_encctx *)b;

  GC_DESTROY(ctx->c);
  DESTROY(ctx);
}

static const char *naclbox_encdoit(bulk *b, uint32 seq, buf *bb,
                                   const void *p, size_t sz)
{
  naclbox_encctx *ctx = (naclbox_encctx *)b;
  octet t[32];
  poly1305_key ak;
  poly1305_ctx a;
  octet *tag, *ct;

  STORE32(t, seq); STORE32(t + 4, 0); GC_SETIV(ctx->c, t);
  GC_ENCRYPT(ctx->c, 0, t, POLY1305_KEYSZ + POLY1305_MASKSZ);
  poly1305_keyinit(&ak, t, POLY1305_KEYSZ);
  poly1305_macinit(&a, &ak, t + POLY1305_KEYSZ);

  tag = buf_get(bb, POLY1305_TAGSZ); assert(tag);
  ct = buf_get(bb, sz); assert(ct);
  GC_ENCRYPT(ctx->c, p, ct, sz);
  poly1305_hash(&a, ct, sz);
  poly1305_done(&a, tag);
  return (0);
}

static const char *naclbox_decdoit(bulk *b, uint32 seq, buf *bb,
                                   const void *p, size_t sz)
{
  naclbox_encctx *ctx = (naclbox_encctx *)b;
  buf bin;
  octet t[32];
  poly1305_key ak;
  poly1305_ctx a;
  octet *tag, *ct, *pt;

  STORE32(t, seq); STORE32(t + 4, 0); GC_SETIV(ctx->c, t);
  GC_ENCRYPT(ctx->c, 0, t, POLY1305_KEYSZ + POLY1305_MASKSZ);
  poly1305_keyinit(&ak, t, POLY1305_KEYSZ);
  poly1305_macinit(&a, &ak, t + POLY1305_KEYSZ);

  buf_init(&bin, (/*unconst*/ void *)p, sz);
  if ((tag = buf_get(&bin, POLY1305_TAGSZ)) == 0) return ("no tag");
  ct = BCUR(&bin); sz = BLEFT(&bin);
  poly1305_hash(&a, ct, sz);
  poly1305_done(&a, t);
  if (!ct_memeq(t, tag, POLY1305_TAGSZ)) return ("authentication failure");
  pt = buf_get(bb, sz); assert(pt);
  GC_DECRYPT(ctx->c, ct, pt, sz);
  return (0);
}

static const bulkops naclbox_encops = {
  naclbox_init, naclbox_setup, naclbox_overhead,
  naclbox_encdoit, naclbox_destroy
}, naclbox_decops = {
  naclbox_init, naclbox_setup, naclbox_overhead,
  naclbox_decdoit, naclbox_destroy
};

/* --- Authenticated encryption schemes --- */

typedef struct aead_encctx {
  bulk b;
  const gcaead *aec;
  gaead_key *key;
  union { gaead_enc *enc; gaead_dec *dec; } ed;
  octet *t;
  size_t nsz, tsz;
} aead_encctx;

static bulk *aead_internalinit(key *k, const gcaead *aec)
{
  aead_encctx *ctx = CREATE(aead_encctx);

  ctx->key = 0;
  ctx->aec = aec;
  if ((ctx->nsz = keysz_pad(4, aec->noncesz)) == 0)
    die(EXIT_FAILURE, "no suitable nonce size for `%s'", aec->name);
  ctx->tsz = keysz(0, ctx->aec->tagsz);

  return (&ctx->b);
}

static bulk *aead_init(key *k, const char *calg, const char *halg)
{
  const gcaead *aec;
  const char *q;
  dstr t = DSTR_INIT;

  key_fulltag(k, &t);

  if ((q = key_getattr(0, k, "cipher")) != 0) calg = q;
  if (!calg) aec = &chacha20_poly1305;
  else if ((aec = gaead_byname(calg)) == 0)
    die(EXIT_FAILURE, "AEAD scheme `%s' not found in key `%s'",
        calg, t.buf);

  dstr_destroy(&t);
  return (aead_internalinit(k, aec));
}

static int aead_commonsetup(aead_encctx *ctx, gcipher *cx)
{
  size_t ksz, n;

  n = ksz = keysz(0, ctx->aec->keysz);
  if (n < ctx->nsz) n = ctx->nsz;
  if (n < ctx->tsz) n = ctx->tsz;
  ctx->t = xmalloc(n);

  GC_ENCRYPT(cx, 0, ctx->t, ksz);
  ctx->key = GAEAD_KEY(ctx->aec, ctx->t, ksz);
  return (0);
}

static size_t aead_overhead(bulk *b)
  { aead_encctx *ctx = (aead_encctx *)b; return (ctx->aec->ohd + ctx->tsz); }

static void aead_commondestroy(aead_encctx *ctx)
{
  if (ctx->key) GAEAD_DESTROY(ctx->key);
  xfree(ctx->t);
  DESTROY(ctx);
}

static int aead_encsetup(bulk *b, gcipher *cx)
{
  aead_encctx *ctx = (aead_encctx *)b;
  ctx->ed.enc = 0; return (aead_commonsetup(ctx, cx));
}

static const char *aead_encdoit(bulk *b, uint32 seq, buf *bb,
                                const void *p, size_t sz)
{
  aead_encctx *ctx = (aead_encctx *)b;
  octet *t;
  int rc;

  memset(ctx->t + 4, 0, ctx->nsz - 4); STORE32_B(ctx->t, seq);
  if (!ctx->ed.enc)
    ctx->ed.enc = GAEAD_ENC(ctx->key, ctx->t, ctx->nsz, 0, sz, ctx->tsz);
  else
    GAEAD_REINIT(ctx->ed.enc, ctx->t, ctx->nsz, 0, sz, ctx->tsz);
  t = buf_get(bb, ctx->tsz); assert(t);
  rc = GAEAD_ENCRYPT(ctx->ed.enc, p, sz, bb); assert(rc >= 0);
  rc = GAEAD_DONE(ctx->ed.enc, 0, bb, t, ctx->tsz); assert(rc >= 0);
  return (0);
}

static void aead_encdestroy(bulk *b)
{
  aead_encctx *ctx = (aead_encctx *)b;
  if (ctx->ed.enc) GAEAD_DESTROY(ctx->ed.enc);
  aead_commondestroy(ctx);
}

static int aead_decsetup(bulk *b, gcipher *cx)
{
  aead_encctx *ctx = (aead_encctx *)b;
  ctx->ed.dec = 0; return (aead_commonsetup(ctx, cx));
}

static const char *aead_decdoit(bulk *b, uint32 seq, buf *bb,
                                const void *p, size_t sz)
{
  aead_encctx *ctx = (aead_encctx *)b;
  buf bin;
  const octet *t;
  int rc;

  memset(ctx->t + 4, 0, ctx->nsz - 4); STORE32_B(ctx->t, seq);
  if (!ctx->ed.dec)
    ctx->ed.dec = GAEAD_DEC(ctx->key, ctx->t, ctx->nsz, 0, sz, ctx->tsz);
  else
    GAEAD_REINIT(ctx->ed.enc, ctx->t, ctx->nsz, 0, sz, ctx->tsz);

  buf_init(&bin, (/*unconst*/ void *)p, sz);
  t = buf_get(&bin, ctx->tsz); if (!t) return ("no tag");
  rc = GAEAD_DECRYPT(ctx->ed.dec, BCUR(&bin), BLEFT(&bin), bb);
  assert(rc >= 0);
  rc = GAEAD_DONE(ctx->ed.dec, 0, bb, t, ctx->tsz); assert(rc >= 0);
  if (!rc) return ("authentication failure");
  return (0);
}

static void aead_decdestroy(bulk *b)
{
  aead_encctx *ctx = (aead_encctx *)b;
  if (ctx->ed.dec) GAEAD_DESTROY(ctx->ed.dec);
  aead_commondestroy(ctx);
}

static const struct bulkops aead_encops = {
  aead_init, aead_encsetup, aead_overhead,
  aead_encdoit, aead_encdestroy
}, aead_decops = {
  aead_init, aead_decsetup, aead_overhead,
  aead_decdoit, aead_decdestroy
};

/* --- Generic composition --- */

typedef struct gencomp_encctx {
  bulk b;
  const gccipher *cc;
  const gcmac *mc;
  gcipher *c, *cx;
  gmac *m;
  octet *t; size_t tsz;
} gencomp_encctx;

static bulk *gencomp_init(key *k, const char *calg, const char *halg)
{
  gencomp_encctx *ctx = CREATE(gencomp_encctx);
  const char *q;
  dstr d = DSTR_INIT, t = DSTR_INIT;

  key_fulltag(k, &t);

  if ((q = key_getattr(0, k, "cipher")) != 0) calg = q;
  if (!calg) ctx->cc = &blowfish_cbc;
  else if ((ctx->cc = gcipher_byname(calg)) == 0) {
    die(EXIT_FAILURE, "encryption scheme `%s' not found in key `%s'",
        calg, t.buf);
  }

  dstr_reset(&d);
  if ((q = key_getattr(0, k, "mac")) == 0) {
    dstr_putf(&d, "%s-hmac", halg);
    q = d.buf;
  }
  if ((ctx->mc = gmac_byname(q)) == 0) {
    die(EXIT_FAILURE,
        "message authentication code `%s' not found in key `%s'",
        q, t.buf);
  }

  return (&ctx->b);
}

static int gencomp_setup(bulk *b, gcipher *cx)
{
  gencomp_encctx *ctx = (gencomp_encctx *)b;
  size_t cn, mn, n;
  octet *kd;

  ctx->cx = cx;
  n = ctx->cc->blksz;
  cn = keysz(0, ctx->cc->keysz); if (cn > n) n = cn;
  mn = keysz(0, ctx->mc->keysz); if (mn > n) n = mn;
  ctx->t = kd = xmalloc(n); ctx->tsz = n;
  GC_ENCRYPT(cx, 0, kd, cn);
  ctx->c = GC_INIT(ctx->cc, kd, cn);
  GC_ENCRYPT(cx, 0, kd, mn);
  ctx->m = GM_KEY(ctx->mc, kd, mn);
  return (0);
}

static size_t gencomp_overhead(bulk *b)
{
  gencomp_encctx *ctx = (gencomp_encctx *)b;
  return (ctx->cc->blksz + ctx->mc->hashsz); }

static void gencomp_destroy(bulk *b)
{
  gencomp_encctx *ctx = (gencomp_encctx *)b;

  GC_DESTROY(ctx->c);
  GC_DESTROY(ctx->m);
  xfree(ctx->t);
  DESTROY(ctx);
}

static const char *gencomp_encdoit(bulk *b, uint32 seq, buf *bb,
                                   const void *p, size_t sz)
{
  gencomp_encctx *ctx = (gencomp_encctx *)b;
  octet *tag, *ct;
  ghash *h = GM_INIT(ctx->m);

  GH_HASHU32(h, seq);
  if (ctx->cc->blksz) {
    GC_ENCRYPT(ctx->cx, 0, ctx->t, ctx->cc->blksz);
    GC_SETIV(ctx->c, ctx->t);
  }
  tag = buf_get(bb, ctx->mc->hashsz); assert(tag);
  ct = buf_get(bb, sz); assert(ct);
  GC_ENCRYPT(ctx->c, p, ct, sz);
  GH_HASH(h, ct, sz);
  GH_DONE(h, tag);
  GH_DESTROY(h);
  return (0);
}

static const char *gencomp_decdoit(bulk *b, uint32 seq, buf *bb,
                                   const void *p, size_t sz)
{
  gencomp_encctx *ctx = (gencomp_encctx *)b;
  buf bin;
  const octet *tag, *ct;
  octet *pt;
  ghash *h;
  int ok;

  buf_init(&bin, (/*unconst*/ void *)p, sz);
  if ((tag = buf_get(&bin, ctx->mc->hashsz)) == 0) return ("no tag");
  ct = BCUR(&bin); sz = BLEFT(&bin);
  pt = buf_get(bb, sz); assert(pt);

  h = GM_INIT(ctx->m);
  GH_HASHU32(h, seq);
  GH_HASH(h, ct, sz);
  ok = ct_memeq(tag, GH_DONE(h, 0), ctx->mc->hashsz);
  GH_DESTROY(h);
  if (!ok) return ("authentication failure");

  if (ctx->cc->blksz) {
    GC_ENCRYPT(ctx->cx, 0, ctx->t, ctx->cc->blksz);
    GC_SETIV(ctx->c, ctx->t);
  }
  GC_DECRYPT(ctx->c, ct, pt, sz);
  return (0);
}

static const bulkops gencomp_encops = {
  gencomp_init, gencomp_setup, gencomp_overhead,
  gencomp_encdoit, gencomp_destroy
}, gencomp_decops = {
  gencomp_init, gencomp_setup, gencomp_overhead,
  gencomp_decdoit, gencomp_destroy
};

const struct bulktab bulktab[] = {
  { "gencomp",  &gencomp_encops,        &gencomp_decops },
  { "naclbox",  &naclbox_encops,        &naclbox_decops },
  { "aead",     &aead_encops,           &aead_decops },
  { 0,          0,                      0 }
};

/*----- Key encapsulation -------------------------------------------------*/

/* --- RSA --- */

typedef struct rsa_encctx {
  kem k;
  rsa_pubctx rp;
} rsa_encctx;

static kem *rsa_encinit(key *k, void *kd)
{
  rsa_encctx *re = CREATE(rsa_encctx);
  rsa_pubcreate(&re->rp, kd);
  return (&re->k);
}

static int rsa_encdoit(kem *k, dstr *d, ghash *h)
{
  rsa_encctx *re = (rsa_encctx *)k;
  mp *x = mprand_range(MP_NEW, re->rp.rp->n, &rand_global, 0);
  mp *y = rsa_pubop(&re->rp, MP_NEW, x);
  size_t n = mp_octets(re->rp.rp->n);
  dstr_ensure(d, n);
  mp_storeb(x, d->buf, n);
  GH_HASH(h, d->buf, n);
  mp_storeb(y, d->buf, n);
  d->len += n;
  mp_drop(x);
  mp_drop(y);
  return (0);
}

static const char *rsa_lengthcheck(mp *n)
{
  if (mp_bits(n) < 1020) return ("key too short");
  return (0);
}

static const char *rsa_enccheck(kem *k)
{
  rsa_encctx *re = (rsa_encctx *)k;
  const char *e;
  if ((e = rsa_lengthcheck(re->rp.rp->n)) != 0) return (e);
  return (0);
}

static void rsa_encdestroy(kem *k)
{
  rsa_encctx *re = (rsa_encctx *)k;
  rsa_pubdestroy(&re->rp);
  DESTROY(re);
}

static const kemops rsa_encops = {
  rsa_pubfetch, sizeof(rsa_pub),
  rsa_encinit, rsa_encdoit, rsa_enccheck, rsa_encdestroy
};

typedef struct rsa_decctx {
  kem k;
  rsa_privctx rp;
} rsa_decctx;

static kem *rsa_decinit(key *k, void *kd)
{
  rsa_decctx *rd = CREATE(rsa_decctx);
  rsa_privcreate(&rd->rp, kd, &rand_global);
  return (&rd->k);
}

static int rsa_decdoit(kem *k, dstr *d, ghash *h)
{
  rsa_decctx *rd = (rsa_decctx *)k;
  mp *x = mp_loadb(MP_NEW, d->buf, d->len);
  size_t n;
  char *p;

  if (MP_CMP(x, >=, rd->rp.rp->n)) {
    mp_drop(x);
    return (-1);
  }
  n = mp_octets(rd->rp.rp->n);
  p = xmalloc(n);
  x = rsa_privop(&rd->rp, x, x);
  mp_storeb(x, p, n);
  GH_HASH(h, p, n);
  mp_drop(x);
  xfree(p);
  return (0);
}

static const char *rsa_deccheck(kem *k)
{
  rsa_decctx *rd = (rsa_decctx *)k;
  const char *e;
  if ((e = rsa_lengthcheck(rd->rp.rp->n)) != 0) return (e);
  return (0);
}

static void rsa_decdestroy(kem *k)
{
  rsa_decctx *rd = (rsa_decctx *)k;
  rsa_privdestroy(&rd->rp);
  DESTROY(rd);
}

static const kemops rsa_decops = {
  rsa_privfetch, sizeof(rsa_priv),
  rsa_decinit, rsa_decdoit, rsa_deccheck, rsa_decdestroy
};

/* --- DH and EC --- */

typedef struct dh_encctx {
  kem k;
  group *g;
  mp *x;
  ge *y;
} dh_encctx;

static dh_encctx *dh_doinit(key *k, const gprime_param *gp, mp *y,
                            group *(*makegroup)(const gprime_param *),
                            const char *what)
{
  dh_encctx *de = CREATE(dh_encctx);
  dstr t = DSTR_INIT;

  key_fulltag(k, &t);
  if ((de->g = makegroup(gp)) == 0)
    die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
  de->x = MP_NEW;
  de->y = G_CREATE(de->g);
  if (G_FROMINT(de->g, de->y, y))
    die(EXIT_FAILURE, "bad public key `%s'", t.buf);
  dstr_destroy(&t);
  return (de);
}

static dh_encctx *ec_doinit(key *k, const char *cstr, const ec *y)
{
  dh_encctx *de = CREATE(dh_encctx);
  ec_info ei;
  const char *e;
  dstr t = DSTR_INIT;

  key_fulltag(k, &t);
  if ((e = ec_getinfo(&ei, cstr)) != 0 ||
      (de->g = group_ec(&ei)) == 0)
    die(EXIT_FAILURE, "bad elliptic curve spec in key `%s': %s", t.buf, e);
  de->x = MP_NEW;
  de->y = G_CREATE(de->g);
  if (G_FROMEC(de->g, de->y, y))
    die(EXIT_FAILURE, "bad public curve point `%s'", t.buf);
  dstr_destroy(&t);
  return (de);
}

static kem *dh_encinit(key *k, void *kd)
{
  dh_pub *dp = kd;
  dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_prime, "prime");
  return (&de->k);
}

static kem *bindh_encinit(key *k, void *kd)
{
  dh_pub *dp = kd;
  dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_binary, "binary");
  return (&de->k);
}

static kem *ec_encinit(key *k, void *kd)
{
  ec_pub *ep = kd;
  dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
  return (&de->k);
}

static int dh_encdoit(kem *k, dstr *d, ghash *h)
{
  dh_encctx *de = (dh_encctx *)k;
  mp *r = mprand_range(MP_NEW, de->g->r, &rand_global, 0);
  ge *x = G_CREATE(de->g);
  ge *y = G_CREATE(de->g);
  size_t n = de->g->noctets;
  buf b;

  G_EXP(de->g, x, de->g->g, r);
  G_EXP(de->g, y, de->y, r);
  dstr_ensure(d, n);
  buf_init(&b, d->buf, n);
  G_TORAW(de->g, &b, y);
  GH_HASH(h, BBASE(&b), BLEN(&b));
  buf_init(&b, d->buf, n);
  G_TORAW(de->g, &b, x);
  GH_HASH(h, BBASE(&b), BLEN(&b));
  d->len += BLEN(&b);
  mp_drop(r);
  G_DESTROY(de->g, x);
  G_DESTROY(de->g, y);
  return (0);
}

static const char *dh_enccheck(kem *k)
{
  dh_encctx *de = (dh_encctx *)k;
  const char *e;
  if ((e = G_CHECK(de->g, &rand_global)) != 0)
    return (0);
  if (group_check(de->g, de->y))
    return ("public key not in subgroup");
  return (0);
}

static void dh_encdestroy(kem *k)
{
  dh_encctx *de = (dh_encctx *)k;
  G_DESTROY(de->g, de->y);
  mp_drop(de->x);
  G_DESTROYGROUP(de->g);
  DESTROY(de);
}

static const kemops dh_encops = {
  dh_pubfetch, sizeof(dh_pub),
  dh_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
};

static const kemops bindh_encops = {
  dh_pubfetch, sizeof(dh_pub),
  bindh_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
};

static const kemops ec_encops = {
  ec_pubfetch, sizeof(ec_pub),
  ec_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
};

static kem *dh_decinit(key *k, void *kd)
{
  dh_priv *dp = kd;
  dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_prime, "prime");
  de->x = MP_COPY(dp->x);
  return (&de->k);
}

static kem *bindh_decinit(key *k, void *kd)
{
  dh_priv *dp = kd;
  dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_binary, "binary");
  de->x = MP_COPY(dp->x);
  return (&de->k);
}

static kem *ec_decinit(key *k, void *kd)
{
  ec_priv *ep = kd;
  dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
  de->x = MP_COPY(ep->x);
  return (&de->k);
}

static int dh_decdoit(kem *k, dstr *d, ghash *h)
{
  dh_encctx *de = (dh_encctx *)k;
  ge *x = G_CREATE(de->g);
  size_t n = de->g->noctets;
  void *p = xmalloc(n);
  buf b;
  int rc = -1;

  buf_init(&b, d->buf, d->len);
  if (G_FROMRAW(de->g, &b, x) || group_check(de->g, x))
    goto done;
  G_EXP(de->g, x, x, de->x);
  buf_init(&b, p, n);
  G_TORAW(de->g, &b, x);
  GH_HASH(h, BBASE(&b), BLEN(&b));
  GH_HASH(h, d->buf, d->len);
  rc = 0;
done:
  G_DESTROY(de->g, x);
  xfree(p);
  return (rc);
}

static const kemops dh_decops = {
  dh_privfetch, sizeof(dh_priv),
  dh_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
};

static const kemops bindh_decops = {
  dh_privfetch, sizeof(dh_priv),
  bindh_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
};

static const kemops ec_decops = {
  ec_privfetch, sizeof(ec_priv),
  ec_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
};

/* --- X25519 and similar schemes --- */

#define XDHS(_)                                                         \
  _(x25519, X25519)                                                     \
  _(x448, X448)

#define XDHDEF(xdh, XDH)                                                \
                                                                        \
  static kem *xdh##_encinit(key *k, void *kd) { return (CREATE(kem)); } \
  static void xdh##_encdestroy(kem *k) { DESTROY(k); }                  \
                                                                        \
  static const char *xdh##_enccheck(kem *k)                             \
  {                                                                     \
    xdh##_pub *kd = k->kd;                                              \
                                                                        \
    if (kd->pub.sz != XDH##_PUBSZ)                                      \
      return ("incorrect " #XDH "public key length");                   \
    return (0);                                                         \
  }                                                                     \
                                                                        \
  static int xdh##_encdoit(kem *k, dstr *d, ghash *h)                   \
  {                                                                     \
    octet t[XDH##_KEYSZ], z[XDH##_OUTSZ];                               \
    xdh##_pub *kd = k->kd;                                              \
                                                                        \
    rand_get(RAND_GLOBAL, t, sizeof(t));                                \
    dstr_ensure(d, XDH##_PUBSZ);                                        \
    xdh((octet *)d->buf, t, xdh##_base);                                \
    xdh(z, t, kd->pub.k);                                               \
    d->len += XDH##_PUBSZ;                                              \
    GH_HASH(h, d->buf, XDH##_PUBSZ);                                    \
    GH_HASH(h, z, XDH##_OUTSZ);                                         \
    return (0);                                                         \
  }                                                                     \
                                                                        \
  static const char *xdh##_deccheck(kem *k)                             \
  {                                                                     \
    xdh##_priv *kd = k->kd;                                             \
                                                                        \
    if (kd->priv.sz != XDH##_KEYSZ)                                     \
      return ("incorrect " #XDH " private key length");                 \
    if (kd->pub.sz != XDH##_PUBSZ)                                      \
      return ("incorrect " #XDH " public key length");                  \
    return (0);                                                         \
  }                                                                     \
                                                                        \
  static int xdh##_decdoit(kem *k, dstr *d, ghash *h)                   \
  {                                                                     \
    octet z[XDH##_OUTSZ];                                               \
    xdh##_priv *kd = k->kd;                                             \
    int rc = -1;                                                        \
                                                                        \
    if (d->len != XDH##_PUBSZ) goto done;                               \
    xdh(z, kd->priv.k, (const octet *)d->buf);                          \
    GH_HASH(h, d->buf, XDH##_PUBSZ);                                    \
    GH_HASH(h, z, XDH##_OUTSZ);                                         \
    rc = 0;                                                             \
  done:                                                                 \
    return (rc);                                                        \
  }                                                                     \
                                                                        \
  static const kemops xdh##_encops = {                                  \
    xdh##_pubfetch, sizeof(xdh##_pub),                                  \
    xdh##_encinit, xdh##_encdoit, xdh##_enccheck, xdh##_encdestroy      \
  };                                                                    \
                                                                        \
  static const kemops xdh##_decops = {                                  \
    xdh##_privfetch, sizeof(xdh##_priv),                                \
    xdh##_encinit, xdh##_decdoit, xdh##_deccheck, xdh##_encdestroy      \
  };

XDHS(XDHDEF)
#undef XDHDEF

/* --- Symmetric --- */

typedef struct symm_ctx {
  kem k;
  key_packdef kp;
  key_bin kb;
} symm_ctx;

static kem *symm_init(key *k, void *kd)
{
  symm_ctx *s;
  dstr d = DSTR_INIT;
  int err;

  s = CREATE(symm_ctx);

  key_fulltag(k, &d);
  s->kp.e = KENC_BINARY;
  s->kp.p = &s->kb;
  s->kp.kd = 0;

  if ((err = key_unpack(&s->kp, kd, &d)) != 0) {
    die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
        d.buf, key_strerror(err));
  }
  dstr_destroy(&d);
  return (&s->k);
}

static int symm_decdoit(kem *k, dstr *d, ghash *h)
{
  symm_ctx *s = (symm_ctx *)k;

  GH_HASH(h, s->kb.k, s->kb.sz);
  GH_HASH(h, d->buf, d->len);
  return (0);
}

static int symm_encdoit(kem *k, dstr *d, ghash *h)
{
  dstr_ensure(d, h->ops->c->hashsz);
  d->len += h->ops->c->hashsz;
  rand_get(RAND_GLOBAL, d->buf, d->len);
  return (symm_decdoit(k, d, h));
}

static const char *symm_check(kem *k) { return (0); }

static void symm_destroy(kem *k)
  { symm_ctx *s = (symm_ctx *)k; key_unpackdone(&s->kp); }

static const kemops symm_encops = {
  0, 0,
  symm_init, symm_encdoit, symm_check, symm_destroy
};

static const kemops symm_decops = {
  0, 0,
  symm_init, symm_decdoit, symm_check, symm_destroy
};

/* --- The switch table --- */

const struct kemtab kemtab[] = {
  { "rsa",      &rsa_encops,    &rsa_decops },
  { "dh",       &dh_encops,     &dh_decops },
  { "bindh",    &bindh_encops,  &bindh_decops },
  { "ec",       &ec_encops,     &ec_decops },
#define XDHTAB(xdh, XDH)                                                \
  { #xdh,       &xdh##_encops,  &xdh##_decops },
  XDHS(XDHTAB)
#undef XDHTAB
  { "symm",     &symm_encops,   &symm_decops },
  { 0,          0,              0 }
};

/* --- @getkem@ --- *
 *
 * Arguments:   @key *k@ = the key to load
 *              @const char *app@ = application name
 *              @int wantpriv@ = nonzero if we want to decrypt
 *              @bulk **bc@ = bulk crypto context to set up
 *
 * Returns:     A key-encapsulating thing.
 *
 * Use:         Loads a key.
 */

kem *getkem(key *k, const char *app, int wantpriv, bulk **bc)
{
  const char *kalg, *halg = 0, *balg = 0;
  dstr d = DSTR_INIT;
  dstr t = DSTR_INIT;
  size_t n;
  char *p = 0;
  const char *q;
  kem *kk;
  const struct kemtab *kt;
  const kemops *ko;
  const struct bulktab *bt;
  const bulkops *bo;
  void *kd;
  int e;
  key_packdef *kp;

  /* --- Setup stuff --- */

  key_fulltag(k, &t);

  /* --- Get the KEM name --- *
   *
   * Take the attribute if it's there; otherwise use the key type.
   */

  n = strlen(app);
  if ((q = key_getattr(0, k, "kem")) != 0) {
    dstr_puts(&d, q);
    p = d.buf;
  } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
    dstr_puts(&d, k->type);
    p = d.buf + n + 1;
  } else
    die(EXIT_FAILURE, "no KEM for key `%s'", t.buf);
  kalg = p;

  /* --- Grab the bulk encryption scheme --- *
   *
   * Grab it from the KEM if it's there, but override it from the attribute.
   */

  if (p && (p = strchr(p, '/')) != 0) {
    *p++ = 0;
    balg = p;
  }
  if ((q = key_getattr(0, k, "bulk")) != 0)
    balg = q;

  /* --- Grab the hash function --- */

  if (p && (p = strchr(p, '/')) != 0) {
    *p++ = 0;
    halg = p;
  }
  if ((q = key_getattr(0, k, "hash")) != 0)
    halg = q;

  /* --- Instantiate the KEM --- */

  for (kt = kemtab; kt->name; kt++) {
    if (strcmp(kt->name, kalg) == 0)
      goto k_found;
  }
  die(EXIT_FAILURE, "key encapsulation mechanism `%s' not found in key `%s'",
      kalg, t.buf);
k_found:;
  ko = wantpriv ? kt->decops : kt->encops;
  if (!ko->kf) {
    kd = k->k;
    key_incref(kd);
    kp = 0;
  } else {
    kd = xmalloc(ko->kdsz);
    kp = key_fetchinit(ko->kf, 0, kd);
    if ((e = key_fetch(kp, k)) != 0) {
      die(EXIT_FAILURE, "error fetching key `%s': %s",
          t.buf, key_strerror(e));
    }
  }
  kk = ko->init(k, kd);
  kk->kp = kp;
  kk->ops = ko;
  kk->kd = kd;

  /* --- Set up the bulk crypto --- */

  if (!halg)
    kk->hc = &rmd160;
  else if ((kk->hc = ghash_byname(halg)) == 0) {
    die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
        halg, t.buf);
  }

  if (!balg)
    bt = bulktab;
  else {
    for (bt = bulktab, bo = 0; bt->name; bt++) {
      if (strcmp(balg, bt->name) == 0)
        { balg = 0; goto b_found; }
      n = strlen(bt->name);
      if (strncmp(balg, bt->name, n) == 0 && balg[n] == '-')
        { balg += n + 1; goto b_found; }
    }
    bt = bulktab;
  b_found:;
  }
  bo = wantpriv ? bt->decops : bt->encops;
  *bc = bo->init(k, balg, kk->hc->name);
  (*bc)->ops = bo;

  dstr_reset(&d);
  if ((q = key_getattr(0, k, "kdf")) == 0) {
    dstr_putf(&d, "%s-mgf", kk->hc->name);
    q = d.buf;
  }
  if ((kk->cxc = gcipher_byname(q)) == 0) {
    die(EXIT_FAILURE, "encryption scheme (KDF) `%s' not found in key `%s'",
        q, t.buf);
  }

  /* --- Tidy up --- */

  dstr_destroy(&d);
  dstr_destroy(&t);
  return (kk);
}

/* --- @setupkem@ --- *
 *
 * Arguments:   @kem *k@ = key-encapsulation thing
 *              @dstr *d@ = key-encapsulation data
 *              @bulk *bc@ = bulk crypto context to set up
 *
 * Returns:     Zero on success, nonzero on failure.
 *
 * Use:         Initializes all the various symmetric things from a KEM.
 */

int setupkem(kem *k, dstr *d, bulk *bc)
{
  octet *kd;
  size_t n;
  ghash *h;
  int rc = -1;

  h = GH_INIT(k->hc);
  if (k->ops->doit(k, d, h))
    goto done;
  n = keysz(GH_CLASS(h)->hashsz, k->cxc->keysz);
  if (!n)
    goto done;
  kd = GH_DONE(h, 0);
  k->cx = GC_INIT(k->cxc, kd, n);
  bc->ops->setup(bc, k->cx);

  rc = 0;
done:
  GH_DESTROY(h);
  return (rc);
}

/* --- @freekem@ --- *
 *
 * Arguments:   @kem *k@ = key-encapsulation thing
 *
 * Returns:     ---
 *
 * Use:         Frees up a key-encapsulation thing.
 */

void freekem(kem *k)
{
  if (!k->ops->kf)
    key_drop(k->kd);
  else {
    key_fetchdone(k->kp);
    xfree(k->kd);
  }
  GC_DESTROY(k->cx);
  k->ops->destroy(k);
}

/*----- That's all, folks -------------------------------------------------*/