mdw@git.distorted.org.uk Git - catacomb/blob - progs/cc-kem.c

   1 /* -*-c-*-
   2  *
   3  * Catcrypt key-encapsulation
   4  *
   5  * (c) 2004 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of Catacomb.
  11  *
  12  * Catacomb is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU Library General Public License as
  14  * published by the Free Software Foundation; either version 2 of the
  15  * License, or (at your option) any later version.
  16  *
  17  * Catacomb is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU Library General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU Library General Public
  23  * License along with Catacomb; if not, write to the Free
  24  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  25  * MA 02111-1307, USA.
  26  */
  27
  28 /*----- Header files ------------------------------------------------------*/
  29
  30 #define _FILE_OFFSET_BITS 64
  31
  32 #include <stdlib.h>
  33
  34 #include <mLib/alloc.h>
  35 #include <mLib/dstr.h>
  36 #include <mLib/report.h>
  37 #include <mLib/sub.h>
  38
  39 #include "mprand.h"
  40 #include "rand.h"
  41
  42 #include "ec.h"
  43 #include "ec-keys.h"
  44 #include "dh.h"
  45 #include "rsa.h"
  46
  47 #include "rmd160.h"
  48 #include "blowfish-cbc.h"
  49
  50 #include "cc.h"
  51
  52 /*----- Bulk crypto -------------------------------------------------------*/
  53
  54 /* --- Generic composition --- */
  55
  56 typedef struct gencomp_encctx {
  57   bulk b;
  58   const gccipher *cc;
  59   const gcmac *mc;
  60   gcipher *c, *cx;
  61   gmac *m;
  62   octet *t; size_t tsz;
  63 } gencomp_encctx;
  64
  65 static bulk *gencomp_init(key *k, const char *calg, const char *halg)
  66 {
  67   gencomp_encctx *ctx = CREATE(gencomp_encctx);
  68   const char *q;
  69   dstr d = DSTR_INIT, t = DSTR_INIT;
  70
  71   key_fulltag(k, &t);
  72
  73   if ((q = key_getattr(0, k, "cipher")) != 0) calg = q;
  74   if (!calg) ctx->cc = &blowfish_cbc;
  75   else if ((ctx->cc = gcipher_byname(calg)) == 0) {
  76     die(EXIT_FAILURE, "encryption scheme `%s' not found in key `%s'",
  77         calg, t.buf);
  78   }
  79
  80   dstr_reset(&d);
  81   if ((q = key_getattr(0, k, "mac")) == 0) {
  82     dstr_putf(&d, "%s-hmac", halg);
  83     q = d.buf;
  84   }
  85   if ((ctx->mc = gmac_byname(q)) == 0) {
  86     die(EXIT_FAILURE,
  87         "message authentication code `%s' not found in key `%s'",
  88         q, t.buf);
  89   }
  90
  91   return (&ctx->b);
  92 }
  93
  94 static int gencomp_setup(bulk *b, gcipher *cx)
  95 {
  96   gencomp_encctx *ctx = (gencomp_encctx *)b;
  97   size_t cn, mn, n;
  98   octet *kd;
  99
 100   ctx->cx = cx;
 101   n = ctx->cc->blksz;
 102   cn = keysz(0, ctx->cc->keysz); if (cn > n) n = cn;
 103   mn = keysz(0, ctx->mc->keysz); if (mn > n) n = mn;
 104   ctx->t = kd = xmalloc(n); ctx->tsz = n;
 105   GC_ENCRYPT(cx, 0, kd, cn);
 106   ctx->c = GC_INIT(ctx->cc, kd, cn);
 107   GC_ENCRYPT(cx, 0, kd, mn);
 108   ctx->m = GM_KEY(ctx->mc, kd, mn);
 109   return (0);
 110 }
 111
 112 static size_t gencomp_overhead(bulk *b)
 113 {
 114   gencomp_encctx *ctx = (gencomp_encctx *)b;
 115   return (ctx->cc->blksz + ctx->mc->hashsz); }
 116
 117 static void gencomp_destroy(bulk *b)
 118 {
 119   gencomp_encctx *ctx = (gencomp_encctx *)b;
 120
 121   GC_DESTROY(ctx->c);
 122   GC_DESTROY(ctx->m);
 123   xfree(ctx->t);
 124   DESTROY(ctx);
 125 }
 126
 127 static const char *gencomp_encdoit(bulk *b, uint32 seq, buf *bb,
 128                                    const void *p, size_t sz)
 129 {
 130   gencomp_encctx *ctx = (gencomp_encctx *)b;
 131   octet *tag, *ct;
 132   ghash *h = GM_INIT(ctx->m);
 133
 134   GH_HASHU32(h, seq);
 135   if (ctx->cc->blksz) {
 136     GC_ENCRYPT(ctx->cx, 0, ctx->t, ctx->cc->blksz);
 137     GC_SETIV(ctx->c, ctx->t);
 138   }
 139   tag = buf_get(bb, ctx->mc->hashsz); assert(tag);
 140   ct = buf_get(bb, sz); assert(ct);
 141   GC_ENCRYPT(ctx->c, p, ct, sz);
 142   GH_HASH(h, ct, sz);
 143   GH_DONE(h, tag);
 144   GH_DESTROY(h);
 145   return (0);
 146 }
 147
 148 static const char *gencomp_decdoit(bulk *b, uint32 seq, buf *bb,
 149                                    const void *p, size_t sz)
 150 {
 151   gencomp_encctx *ctx = (gencomp_encctx *)b;
 152   buf bin;
 153   const octet *tag, *ct;
 154   octet *pt;
 155   ghash *h;
 156   int ok;
 157
 158   buf_init(&bin, (/*unconst*/ void *)p, sz);
 159   if ((tag = buf_get(&bin, ctx->mc->hashsz)) == 0) return ("no tag");
 160   ct = BCUR(&bin); sz = BLEFT(&bin);
 161   pt = buf_get(bb, sz); assert(pt);
 162
 163   h = GM_INIT(ctx->m);
 164   GH_HASHU32(h, seq);
 165   GH_HASH(h, ct, sz);
 166   ok = ct_memeq(tag, GH_DONE(h, 0), ctx->mc->hashsz);
 167   GH_DESTROY(h);
 168   if (!ok) return ("authentication failure");
 169
 170   if (ctx->cc->blksz) {
 171     GC_ENCRYPT(ctx->cx, 0, ctx->t, ctx->cc->blksz);
 172     GC_SETIV(ctx->c, ctx->t);
 173   }
 174   GC_DECRYPT(ctx->c, ct, pt, sz);
 175   return (0);
 176 }
 177
 178 static const bulkops gencomp_encops = {
 179   gencomp_init, gencomp_setup, gencomp_overhead,
 180   gencomp_encdoit, gencomp_destroy
 181 }, gencomp_decops = {
 182   gencomp_init, gencomp_setup, gencomp_overhead,
 183   gencomp_decdoit, gencomp_destroy
 184 };
 185
 186 const struct bulktab bulktab[] = {
 187   { "gencomp",  &gencomp_encops,        &gencomp_decops },
 188   { 0,          0,                      0 }
 189 };
 190
 191 /*----- Key encapsulation -------------------------------------------------*/
 192
 193 /* --- RSA --- */
 194
 195 typedef struct rsa_encctx {
 196   kem k;
 197   rsa_pubctx rp;
 198 } rsa_encctx;
 199
 200 static kem *rsa_encinit(key *k, void *kd)
 201 {
 202   rsa_encctx *re = CREATE(rsa_encctx);
 203   rsa_pubcreate(&re->rp, kd);
 204   return (&re->k);
 205 }
 206
 207 static int rsa_encdoit(kem *k, dstr *d, ghash *h)
 208 {
 209   rsa_encctx *re = (rsa_encctx *)k;
 210   mp *x = mprand_range(MP_NEW, re->rp.rp->n, &rand_global, 0);
 211   mp *y = rsa_pubop(&re->rp, MP_NEW, x);
 212   size_t n = mp_octets(re->rp.rp->n);
 213   dstr_ensure(d, n);
 214   mp_storeb(x, d->buf, n);
 215   GH_HASH(h, d->buf, n);
 216   mp_storeb(y, d->buf, n);
 217   d->len += n;
 218   mp_drop(x);
 219   mp_drop(y);
 220   return (0);
 221 }
 222
 223 static const char *rsa_lengthcheck(mp *n)
 224 {
 225   if (mp_bits(n) < 1020) return ("key too short");
 226   return (0);
 227 }
 228
 229 static const char *rsa_enccheck(kem *k)
 230 {
 231   rsa_encctx *re = (rsa_encctx *)k;
 232   const char *e;
 233   if ((e = rsa_lengthcheck(re->rp.rp->n)) != 0) return (e);
 234   return (0);
 235 }
 236
 237 static void rsa_encdestroy(kem *k)
 238 {
 239   rsa_encctx *re = (rsa_encctx *)k;
 240   rsa_pubdestroy(&re->rp);
 241   DESTROY(re);
 242 }
 243
 244 static const kemops rsa_encops = {
 245   rsa_pubfetch, sizeof(rsa_pub),
 246   rsa_encinit, rsa_encdoit, rsa_enccheck, rsa_encdestroy
 247 };
 248
 249 typedef struct rsa_decctx {
 250   kem k;
 251   rsa_privctx rp;
 252 } rsa_decctx;
 253
 254 static kem *rsa_decinit(key *k, void *kd)
 255 {
 256   rsa_decctx *rd = CREATE(rsa_decctx);
 257   rsa_privcreate(&rd->rp, kd, &rand_global);
 258   return (&rd->k);
 259 }
 260
 261 static int rsa_decdoit(kem *k, dstr *d, ghash *h)
 262 {
 263   rsa_decctx *rd = (rsa_decctx *)k;
 264   mp *x = mp_loadb(MP_NEW, d->buf, d->len);
 265   size_t n;
 266   char *p;
 267
 268   if (MP_CMP(x, >=, rd->rp.rp->n)) {
 269     mp_drop(x);
 270     return (-1);
 271   }
 272   n = mp_octets(rd->rp.rp->n);
 273   p = xmalloc(n);
 274   x = rsa_privop(&rd->rp, x, x);
 275   mp_storeb(x, p, n);
 276   GH_HASH(h, p, n);
 277   mp_drop(x);
 278   xfree(p);
 279   return (0);
 280 }
 281
 282 static const char *rsa_deccheck(kem *k)
 283 {
 284   rsa_decctx *rd = (rsa_decctx *)k;
 285   const char *e;
 286   if ((e = rsa_lengthcheck(rd->rp.rp->n)) != 0) return (e);
 287   return (0);
 288 }
 289
 290 static void rsa_decdestroy(kem *k)
 291 {
 292   rsa_decctx *rd = (rsa_decctx *)k;
 293   rsa_privdestroy(&rd->rp);
 294   DESTROY(rd);
 295 }
 296
 297 static const kemops rsa_decops = {
 298   rsa_privfetch, sizeof(rsa_priv),
 299   rsa_decinit, rsa_decdoit, rsa_deccheck, rsa_decdestroy
 300 };
 301
 302 /* --- DH and EC --- */
 303
 304 typedef struct dh_encctx {
 305   kem k;
 306   group *g;
 307   mp *x;
 308   ge *y;
 309 } dh_encctx;
 310
 311 static dh_encctx *dh_doinit(key *k, const gprime_param *gp, mp *y,
 312                             group *(*makegroup)(const gprime_param *),
 313                             const char *what)
 314 {
 315   dh_encctx *de = CREATE(dh_encctx);
 316   dstr t = DSTR_INIT;
 317
 318   key_fulltag(k, &t);
 319   if ((de->g = makegroup(gp)) == 0)
 320     die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
 321   de->x = MP_NEW;
 322   de->y = G_CREATE(de->g);
 323   if (G_FROMINT(de->g, de->y, y))
 324     die(EXIT_FAILURE, "bad public key `%s'", t.buf);
 325   dstr_destroy(&t);
 326   return (de);
 327 }
 328
 329 static dh_encctx *ec_doinit(key *k, const char *cstr, const ec *y)
 330 {
 331   dh_encctx *de = CREATE(dh_encctx);
 332   ec_info ei;
 333   const char *e;
 334   dstr t = DSTR_INIT;
 335
 336   key_fulltag(k, &t);
 337   if ((e = ec_getinfo(&ei, cstr)) != 0 ||
 338       (de->g = group_ec(&ei)) == 0)
 339     die(EXIT_FAILURE, "bad elliptic curve spec in key `%s': %s", t.buf, e);
 340   de->x = MP_NEW;
 341   de->y = G_CREATE(de->g);
 342   if (G_FROMEC(de->g, de->y, y))
 343     die(EXIT_FAILURE, "bad public curve point `%s'", t.buf);
 344   dstr_destroy(&t);
 345   return (de);
 346 }
 347
 348 static kem *dh_encinit(key *k, void *kd)
 349 {
 350   dh_pub *dp = kd;
 351   dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_prime, "prime");
 352   return (&de->k);
 353 }
 354
 355 static kem *bindh_encinit(key *k, void *kd)
 356 {
 357   dh_pub *dp = kd;
 358   dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_binary, "binary");
 359   return (&de->k);
 360 }
 361
 362 static kem *ec_encinit(key *k, void *kd)
 363 {
 364   ec_pub *ep = kd;
 365   dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
 366   return (&de->k);
 367 }
 368
 369 static int dh_encdoit(kem *k, dstr *d, ghash *h)
 370 {
 371   dh_encctx *de = (dh_encctx *)k;
 372   mp *r = mprand_range(MP_NEW, de->g->r, &rand_global, 0);
 373   ge *x = G_CREATE(de->g);
 374   ge *y = G_CREATE(de->g);
 375   size_t n = de->g->noctets;
 376   buf b;
 377
 378   G_EXP(de->g, x, de->g->g, r);
 379   G_EXP(de->g, y, de->y, r);
 380   dstr_ensure(d, n);
 381   buf_init(&b, d->buf, n);
 382   G_TORAW(de->g, &b, y);
 383   GH_HASH(h, BBASE(&b), BLEN(&b));
 384   buf_init(&b, d->buf, n);
 385   G_TORAW(de->g, &b, x);
 386   GH_HASH(h, BBASE(&b), BLEN(&b));
 387   d->len += BLEN(&b);
 388   mp_drop(r);
 389   G_DESTROY(de->g, x);
 390   G_DESTROY(de->g, y);
 391   return (0);
 392 }
 393
 394 static const char *dh_enccheck(kem *k)
 395 {
 396   dh_encctx *de = (dh_encctx *)k;
 397   const char *e;
 398   if ((e = G_CHECK(de->g, &rand_global)) != 0)
 399     return (0);
 400   if (group_check(de->g, de->y))
 401     return ("public key not in subgroup");
 402   return (0);
 403 }
 404
 405 static void dh_encdestroy(kem *k)
 406 {
 407   dh_encctx *de = (dh_encctx *)k;
 408   G_DESTROY(de->g, de->y);
 409   mp_drop(de->x);
 410   G_DESTROYGROUP(de->g);
 411   DESTROY(de);
 412 }
 413
 414 static const kemops dh_encops = {
 415   dh_pubfetch, sizeof(dh_pub),
 416   dh_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
 417 };
 418
 419 static const kemops bindh_encops = {
 420   dh_pubfetch, sizeof(dh_pub),
 421   bindh_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
 422 };
 423
 424 static const kemops ec_encops = {
 425   ec_pubfetch, sizeof(ec_pub),
 426   ec_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
 427 };
 428
 429 static kem *dh_decinit(key *k, void *kd)
 430 {
 431   dh_priv *dp = kd;
 432   dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_prime, "prime");
 433   de->x = MP_COPY(dp->x);
 434   return (&de->k);
 435 }
 436
 437 static kem *bindh_decinit(key *k, void *kd)
 438 {
 439   dh_priv *dp = kd;
 440   dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_binary, "binary");
 441   de->x = MP_COPY(dp->x);
 442   return (&de->k);
 443 }
 444
 445 static kem *ec_decinit(key *k, void *kd)
 446 {
 447   ec_priv *ep = kd;
 448   dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
 449   de->x = MP_COPY(ep->x);
 450   return (&de->k);
 451 }
 452
 453 static int dh_decdoit(kem *k, dstr *d, ghash *h)
 454 {
 455   dh_encctx *de = (dh_encctx *)k;
 456   ge *x = G_CREATE(de->g);
 457   size_t n = de->g->noctets;
 458   void *p = xmalloc(n);
 459   buf b;
 460   int rc = -1;
 461
 462   buf_init(&b, d->buf, d->len);
 463   if (G_FROMRAW(de->g, &b, x) || group_check(de->g, x))
 464     goto done;
 465   G_EXP(de->g, x, x, de->x);
 466   buf_init(&b, p, n);
 467   G_TORAW(de->g, &b, x);
 468   GH_HASH(h, BBASE(&b), BLEN(&b));
 469   GH_HASH(h, d->buf, d->len);
 470   rc = 0;
 471 done:
 472   G_DESTROY(de->g, x);
 473   xfree(p);
 474   return (rc);
 475 }
 476
 477 static const kemops dh_decops = {
 478   dh_privfetch, sizeof(dh_priv),
 479   dh_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
 480 };
 481
 482 static const kemops bindh_decops = {
 483   dh_privfetch, sizeof(dh_priv),
 484   bindh_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
 485 };
 486
 487 static const kemops ec_decops = {
 488   ec_privfetch, sizeof(ec_priv),
 489   ec_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
 490 };
 491
 492 /* --- Symmetric --- */
 493
 494 typedef struct symm_ctx {
 495   kem k;
 496   key_packdef kp;
 497   key_bin kb;
 498 } symm_ctx;
 499
 500 static kem *symm_init(key *k, void *kd)
 501 {
 502   symm_ctx *s;
 503   dstr d = DSTR_INIT;
 504   int err;
 505
 506   s = CREATE(symm_ctx);
 507
 508   key_fulltag(k, &d);
 509   s->kp.e = KENC_BINARY;
 510   s->kp.p = &s->kb;
 511   s->kp.kd = 0;
 512
 513   if ((err = key_unpack(&s->kp, kd, &d)) != 0) {
 514     die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
 515         d.buf, key_strerror(err));
 516   }
 517   dstr_destroy(&d);
 518   return (&s->k);
 519 }
 520
 521 static int symm_decdoit(kem *k, dstr *d, ghash *h)
 522 {
 523   symm_ctx *s = (symm_ctx *)k;
 524
 525   GH_HASH(h, s->kb.k, s->kb.sz);
 526   GH_HASH(h, d->buf, d->len);
 527   return (0);
 528 }
 529
 530 static int symm_encdoit(kem *k, dstr *d, ghash *h)
 531 {
 532   dstr_ensure(d, h->ops->c->hashsz);
 533   d->len += h->ops->c->hashsz;
 534   rand_get(RAND_GLOBAL, d->buf, d->len);
 535   return (symm_decdoit(k, d, h));
 536 }
 537
 538 static const char *symm_check(kem *k) { return (0); }
 539
 540 static void symm_destroy(kem *k)
 541   { symm_ctx *s = (symm_ctx *)k; key_unpackdone(&s->kp); }
 542
 543 static const kemops symm_encops = {
 544   0, 0,
 545   symm_init, symm_encdoit, symm_check, symm_destroy
 546 };
 547
 548 static const kemops symm_decops = {
 549   0, 0,
 550   symm_init, symm_decdoit, symm_check, symm_destroy
 551 };
 552
 553 /* --- The switch table --- */
 554
 555 const struct kemtab kemtab[] = {
 556   { "rsa",      &rsa_encops,    &rsa_decops },
 557   { "dh",       &dh_encops,     &dh_decops },
 558   { "bindh",    &bindh_encops,  &bindh_decops },
 559   { "ec",       &ec_encops,     &ec_decops },
 560   { "symm",     &symm_encops,   &symm_decops },
 561   { 0,          0,              0 }
 562 };
 563
 564 /* --- @getkem@ --- *
 565  *
 566  * Arguments:   @key *k@ = the key to load
 567  *              @const char *app@ = application name
 568  *              @int wantpriv@ = nonzero if we want to decrypt
 569  *              @bulk **bc@ = bulk crypto context to set up
 570  *
 571  * Returns:     A key-encapsulating thing.
 572  *
 573  * Use:         Loads a key.
 574  */
 575
 576 kem *getkem(key *k, const char *app, int wantpriv, bulk **bc)
 577 {
 578   const char *kalg, *halg = 0, *balg = 0;
 579   dstr d = DSTR_INIT;
 580   dstr t = DSTR_INIT;
 581   size_t n;
 582   char *p = 0;
 583   const char *q;
 584   kem *kk;
 585   const struct kemtab *kt;
 586   const kemops *ko;
 587   const struct bulktab *bt;
 588   const bulkops *bo;
 589   void *kd;
 590   int e;
 591   key_packdef *kp;
 592
 593   /* --- Setup stuff --- */
 594
 595   key_fulltag(k, &t);
 596
 597   /* --- Get the KEM name --- *
 598    *
 599    * Take the attribute if it's there; otherwise use the key type.
 600    */
 601
 602   n = strlen(app);
 603   if ((q = key_getattr(0, k, "kem")) != 0) {
 604     dstr_puts(&d, q);
 605     p = d.buf;
 606   } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
 607     dstr_puts(&d, k->type);
 608     p = d.buf + n + 1;
 609   } else
 610     die(EXIT_FAILURE, "no KEM for key `%s'", t.buf);
 611   kalg = p;
 612
 613   /* --- Grab the bulk encryption scheme --- *
 614    *
 615    * Grab it from the KEM if it's there, but override it from the attribute.
 616    */
 617
 618   if (p && (p = strchr(p, '/')) != 0) {
 619     *p++ = 0;
 620     balg = p;
 621   }
 622   if ((q = key_getattr(0, k, "bulk")) != 0)
 623     balg = q;
 624
 625   /* --- Grab the hash function --- */
 626
 627   if (p && (p = strchr(p, '/')) != 0) {
 628     *p++ = 0;
 629     halg = p;
 630   }
 631   if ((q = key_getattr(0, k, "hash")) != 0)
 632     halg = q;
 633
 634   /* --- Instantiate the KEM --- */
 635
 636   for (kt = kemtab; kt->name; kt++) {
 637     if (strcmp(kt->name, kalg) == 0)
 638       goto k_found;
 639   }
 640   die(EXIT_FAILURE, "key encapsulation mechanism `%s' not found in key `%s'",
 641       kalg, t.buf);
 642 k_found:;
 643   ko = wantpriv ? kt->decops : kt->encops;
 644   if (!ko->kf) {
 645     kd = k->k;
 646     key_incref(kd);
 647     kp = 0;
 648   } else {
 649     kd = xmalloc(ko->kdsz);
 650     kp = key_fetchinit(ko->kf, 0, kd);
 651     if ((e = key_fetch(kp, k)) != 0) {
 652       die(EXIT_FAILURE, "error fetching key `%s': %s",
 653           t.buf, key_strerror(e));
 654     }
 655   }
 656   kk = ko->init(k, kd);
 657   kk->kp = kp;
 658   kk->ops = ko;
 659   kk->kd = kd;
 660
 661   /* --- Set up the bulk crypto --- */
 662
 663   if (!halg)
 664     kk->hc = &rmd160;
 665   else if ((kk->hc = ghash_byname(halg)) == 0) {
 666     die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
 667         halg, t.buf);
 668   }
 669
 670   dstr_reset(&d);
 671   if ((q = key_getattr(0, k, "kdf")) == 0) {
 672     dstr_putf(&d, "%s-mgf", kk->hc->name);
 673     q = d.buf;
 674   }
 675   if ((kk->cxc = gcipher_byname(q)) == 0) {
 676     die(EXIT_FAILURE, "encryption scheme (KDF) `%s' not found in key `%s'",
 677         q, t.buf);
 678   }
 679
 680   if (!balg)
 681     bt = bulktab;
 682   else {
 683     for (bt = bulktab, bo = 0; bt->name; bt++) {
 684       if (strcmp(balg, bt->name) == 0)
 685         { balg = 0; goto b_found; }
 686       n = strlen(bt->name);
 687       if (strncmp(balg, bt->name, n) == 0 && balg[n] == '-')
 688         { balg += n + 1; goto b_found; }
 689     }
 690     bt = bulktab;
 691   b_found:;
 692   }
 693   bo = wantpriv ? bt->decops : bt->encops;
 694   *bc = bo->init(k, balg, kk->hc->name);
 695   (*bc)->ops = bo;
 696
 697   /* --- Tidy up --- */
 698
 699   dstr_destroy(&d);
 700   dstr_destroy(&t);
 701   return (kk);
 702 }
 703
 704 /* --- @setupkem@ --- *
 705  *
 706  * Arguments:   @kem *k@ = key-encapsulation thing
 707  *              @dstr *d@ = key-encapsulation data
 708  *              @bulk *bc@ = bulk crypto context to set up
 709  *
 710  * Returns:     Zero on success, nonzero on failure.
 711  *
 712  * Use:         Initializes all the various symmetric things from a KEM.
 713  */
 714
 715 int setupkem(kem *k, dstr *d, bulk *bc)
 716 {
 717   octet *kd;
 718   size_t n;
 719   ghash *h;
 720   int rc = -1;
 721
 722   h = GH_INIT(k->hc);
 723   if (k->ops->doit(k, d, h))
 724     goto done;
 725   n = keysz(GH_CLASS(h)->hashsz, k->cxc->keysz);
 726   if (!n)
 727     goto done;
 728   kd = GH_DONE(h, 0);
 729   k->cx = GC_INIT(k->cxc, kd, n);
 730   bc->ops->setup(bc, k->cx);
 731
 732   rc = 0;
 733 done:
 734   GH_DESTROY(h);
 735   return (rc);
 736 }
 737
 738 /* --- @freekem@ --- *
 739  *
 740  * Arguments:   @kem *k@ = key-encapsulation thing
 741  *
 742  * Returns:     ---
 743  *
 744  * Use:         Frees up a key-encapsulation thing.
 745  */
 746
 747 void freekem(kem *k)
 748 {
 749   if (!k->ops->kf)
 750     key_drop(k->kd);
 751   else {
 752     key_fetchdone(k->kp);
 753     xfree(k->kd);
 754   }
 755   GC_DESTROY(k->cx);
 756   k->ops->destroy(k);
 757 }
 758
 759 /*----- That's all, folks -------------------------------------------------*/