3 * Catcrypt key-encapsulation
5 * (c) 2004 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
30 #define _FILE_OFFSET_BITS 64
34 #include <mLib/alloc.h>
35 #include <mLib/dstr.h>
36 #include <mLib/report.h>
48 #include "blowfish-cbc.h"
52 /*----- Key encapsulation -------------------------------------------------*/
56 typedef struct rsa_encctx {
61 static kem *rsa_encinit(key *k, void *kd)
63 rsa_encctx *re = CREATE(rsa_encctx);
64 rsa_pubcreate(&re->rp, kd);
68 static int rsa_encdoit(kem *k, dstr *d, ghash *h)
70 rsa_encctx *re = (rsa_encctx *)k;
71 mp *x = mprand_range(MP_NEW, re->rp.rp->n, &rand_global, 0);
72 mp *y = rsa_pubop(&re->rp, MP_NEW, x);
73 size_t n = mp_octets(re->rp.rp->n);
75 mp_storeb(x, d->buf, n);
76 GH_HASH(h, d->buf, n);
77 mp_storeb(y, d->buf, n);
84 static const char *rsa_lengthcheck(mp *n)
86 if (mp_bits(n) < 1020) return ("key too short");
90 static const char *rsa_enccheck(kem *k)
92 rsa_encctx *re = (rsa_encctx *)k;
94 if ((e = rsa_lengthcheck(re->rp.rp->n)) != 0) return (e);
98 static void rsa_encdestroy(kem *k)
100 rsa_encctx *re = (rsa_encctx *)k;
101 rsa_pubdestroy(&re->rp);
105 static const kemops rsa_encops = {
106 rsa_pubfetch, sizeof(rsa_pub),
107 rsa_encinit, rsa_encdoit, rsa_enccheck, rsa_encdestroy
110 typedef struct rsa_decctx {
115 static kem *rsa_decinit(key *k, void *kd)
117 rsa_decctx *rd = CREATE(rsa_decctx);
118 rsa_privcreate(&rd->rp, kd, &rand_global);
122 static int rsa_decdoit(kem *k, dstr *d, ghash *h)
124 rsa_decctx *rd = (rsa_decctx *)k;
125 mp *x = mp_loadb(MP_NEW, d->buf, d->len);
129 if (MP_CMP(x, >=, rd->rp.rp->n)) {
133 n = mp_octets(rd->rp.rp->n);
135 x = rsa_privop(&rd->rp, x, x);
143 static const char *rsa_deccheck(kem *k)
145 rsa_decctx *rd = (rsa_decctx *)k;
147 if ((e = rsa_lengthcheck(rd->rp.rp->n)) != 0) return (e);
151 static void rsa_decdestroy(kem *k)
153 rsa_decctx *rd = (rsa_decctx *)k;
154 rsa_privdestroy(&rd->rp);
158 static const kemops rsa_decops = {
159 rsa_privfetch, sizeof(rsa_priv),
160 rsa_decinit, rsa_decdoit, rsa_deccheck, rsa_decdestroy
163 /* --- DH and EC --- */
165 typedef struct dh_encctx {
172 static dh_encctx *dh_doinit(key *k, const gprime_param *gp, mp *y,
173 group *(*makegroup)(const gprime_param *),
176 dh_encctx *de = CREATE(dh_encctx);
180 if ((de->g = makegroup(gp)) == 0)
181 die(EXIT_FAILURE, "bad %s group in key `%s'", what, t.buf);
183 de->y = G_CREATE(de->g);
184 if (G_FROMINT(de->g, de->y, y))
185 die(EXIT_FAILURE, "bad public key `%s'", t.buf);
190 static dh_encctx *ec_doinit(key *k, const char *cstr, const ec *y)
192 dh_encctx *de = CREATE(dh_encctx);
198 if ((e = ec_getinfo(&ei, cstr)) != 0 ||
199 (de->g = group_ec(&ei)) == 0)
200 die(EXIT_FAILURE, "bad elliptic curve spec in key `%s': %s", t.buf, e);
202 de->y = G_CREATE(de->g);
203 if (G_FROMEC(de->g, de->y, y))
204 die(EXIT_FAILURE, "bad public curve point `%s'", t.buf);
209 static kem *dh_encinit(key *k, void *kd)
212 dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_prime, "prime");
216 static kem *bindh_encinit(key *k, void *kd)
219 dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_binary, "binary");
223 static kem *ec_encinit(key *k, void *kd)
226 dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
230 static int dh_encdoit(kem *k, dstr *d, ghash *h)
232 dh_encctx *de = (dh_encctx *)k;
233 mp *r = mprand_range(MP_NEW, de->g->r, &rand_global, 0);
234 ge *x = G_CREATE(de->g);
235 ge *y = G_CREATE(de->g);
236 size_t n = de->g->noctets;
239 G_EXP(de->g, x, de->g->g, r);
240 G_EXP(de->g, y, de->y, r);
242 buf_init(&b, d->buf, n);
243 G_TORAW(de->g, &b, y);
244 GH_HASH(h, BBASE(&b), BLEN(&b));
245 buf_init(&b, d->buf, n);
246 G_TORAW(de->g, &b, x);
247 GH_HASH(h, BBASE(&b), BLEN(&b));
255 static const char *dh_enccheck(kem *k)
257 dh_encctx *de = (dh_encctx *)k;
259 if ((e = G_CHECK(de->g, &rand_global)) != 0)
261 if (group_check(de->g, de->y))
262 return ("public key not in subgroup");
266 static void dh_encdestroy(kem *k)
268 dh_encctx *de = (dh_encctx *)k;
269 G_DESTROY(de->g, de->y);
271 G_DESTROYGROUP(de->g);
275 static const kemops dh_encops = {
276 dh_pubfetch, sizeof(dh_pub),
277 dh_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
280 static const kemops bindh_encops = {
281 dh_pubfetch, sizeof(dh_pub),
282 bindh_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
285 static const kemops ec_encops = {
286 ec_pubfetch, sizeof(ec_pub),
287 ec_encinit, dh_encdoit, dh_enccheck, dh_encdestroy
290 static kem *dh_decinit(key *k, void *kd)
293 dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_prime, "prime");
294 de->x = MP_COPY(dp->x);
298 static kem *bindh_decinit(key *k, void *kd)
301 dh_encctx *de = dh_doinit(k, &dp->dp, dp->y, group_binary, "binary");
302 de->x = MP_COPY(dp->x);
306 static kem *ec_decinit(key *k, void *kd)
309 dh_encctx *de = ec_doinit(k, ep->cstr, &ep->p);
310 de->x = MP_COPY(ep->x);
314 static int dh_decdoit(kem *k, dstr *d, ghash *h)
316 dh_encctx *de = (dh_encctx *)k;
317 ge *x = G_CREATE(de->g);
318 size_t n = de->g->noctets;
319 void *p = xmalloc(n);
323 buf_init(&b, d->buf, d->len);
324 if (G_FROMRAW(de->g, &b, x) || group_check(de->g, x))
326 G_EXP(de->g, x, x, de->x);
328 G_TORAW(de->g, &b, x);
329 GH_HASH(h, BBASE(&b), BLEN(&b));
330 GH_HASH(h, d->buf, d->len);
338 static const kemops dh_decops = {
339 dh_privfetch, sizeof(dh_priv),
340 dh_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
343 static const kemops bindh_decops = {
344 dh_privfetch, sizeof(dh_priv),
345 bindh_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
348 static const kemops ec_decops = {
349 ec_privfetch, sizeof(ec_priv),
350 ec_decinit, dh_decdoit, dh_enccheck, dh_encdestroy
353 /* --- Symmetric --- */
355 typedef struct symm_ctx {
361 static kem *symm_init(key *k, void *kd)
367 s = CREATE(symm_ctx);
370 s->kp.e = KENC_BINARY;
374 if ((err = key_unpack(&s->kp, kd, &d)) != 0) {
375 die(EXIT_FAILURE, "failed to unpack symmetric key `%s': %s",
376 d.buf, key_strerror(err));
382 static int symm_decdoit(kem *k, dstr *d, ghash *h)
384 symm_ctx *s = (symm_ctx *)k;
386 GH_HASH(h, s->kb.k, s->kb.sz);
387 GH_HASH(h, d->buf, d->len);
391 static int symm_encdoit(kem *k, dstr *d, ghash *h)
393 dstr_ensure(d, h->ops->c->hashsz);
394 d->len += h->ops->c->hashsz;
395 rand_get(RAND_GLOBAL, d->buf, d->len);
396 return (symm_decdoit(k, d, h));
399 static const char *symm_check(kem *k) { return (0); }
401 static void symm_destroy(kem *k)
402 { symm_ctx *s = (symm_ctx *)k; key_unpackdone(&s->kp); }
404 static const kemops symm_encops = {
406 symm_init, symm_encdoit, symm_check, symm_destroy
409 static const kemops symm_decops = {
411 symm_init, symm_decdoit, symm_check, symm_destroy
414 /* --- The switch table --- */
416 const struct kemtab kemtab[] = {
417 { "rsa", &rsa_encops, &rsa_decops },
418 { "dh", &dh_encops, &dh_decops },
419 { "bindh", &bindh_encops, &bindh_decops },
420 { "ec", &ec_encops, &ec_decops },
421 { "symm", &symm_encops, &symm_decops },
425 /* --- @getkem@ --- *
427 * Arguments: @key *k@ = the key to load
428 * @const char *app@ = application name
429 * @int wantpriv@ = nonzero if we want to decrypt
431 * Returns: A key-encapsulating thing.
436 kem *getkem(key *k, const char *app, int wantpriv)
438 const char *kalg, *halg = 0, *calg = 0;
445 const struct kemtab *kt;
451 /* --- Setup stuff --- */
455 /* --- Get the KEM name --- *
457 * Take the attribute if it's there; otherwise use the key type.
461 if ((q = key_getattr(0, k, "kem")) != 0) {
464 } else if (strncmp(k->type, app, n) == 0 && k->type[n] == '-') {
465 dstr_puts(&d, k->type);
468 die(EXIT_FAILURE, "no KEM for key `%s'", t.buf);
471 /* --- Grab the encryption scheme --- *
473 * Grab it from the KEM if it's there, but override it from the attribute.
476 if (p && (p = strchr(p, '/')) != 0) {
480 if ((q = key_getattr(0, k, "cipher")) != 0)
483 /* --- Grab the hash function --- */
485 if (p && (p = strchr(p, '/')) != 0) {
489 if ((q = key_getattr(0, k, "hash")) != 0)
492 /* --- Instantiate the KEM --- */
494 for (kt = kemtab; kt->name; kt++) {
495 if (strcmp(kt->name, kalg) == 0)
498 die(EXIT_FAILURE, "key encapsulation mechanism `%s' not found in key `%s'",
501 ko = wantpriv ? kt->decops : kt->encops;
507 kd = xmalloc(ko->kdsz);
508 kp = key_fetchinit(ko->kf, 0, kd);
509 if ((e = key_fetch(kp, k)) != 0) {
510 die(EXIT_FAILURE, "error fetching key `%s': %s",
511 t.buf, key_strerror(e));
514 kk = ko->init(k, kd);
519 /* --- Set up the algorithms --- */
523 else if ((kk->h = ghash_byname(halg)) == 0) {
524 die(EXIT_FAILURE, "hash algorithm `%s' not found in key `%s'",
529 kk->c = &blowfish_cbc;
530 else if ((kk->c = gcipher_byname(calg)) == 0) {
531 die(EXIT_FAILURE, "encryption scheme `%s' not found in key `%s'",
536 if ((q = key_getattr(0, k, "kdf")) == 0) {
537 dstr_putf(&d, "%s-mgf", kk->h->name);
540 if ((kk->cx = gcipher_byname(q)) == 0) {
541 die(EXIT_FAILURE, "encryption scheme (KDF) `%s' not found in key `%s'",
546 if ((q = key_getattr(0, k, "mac")) == 0) {
547 dstr_putf(&d, "%s-hmac", kk->h->name);
550 if ((kk->m = gmac_byname(q)) == 0) {
552 "message authentication code `%s' not found in key `%s'",
556 /* --- Tidy up --- */
563 /* --- @setupkem@ --- *
565 * Arguments: @kem *k@ = key-encapsulation thing
566 * @dstr *d@ = key-encapsulation data
567 * @gcipher **cx@ = key-expansion function (for IVs)
568 * @gcipher **c@ = where to put initialized encryption scheme
569 * @gmac **m@ = where to put initialized MAC
571 * Returns: Zero on success, nonzero on failure.
573 * Use: Initializes all the various symmetric things from a KEM.
576 int setupkem(kem *k, dstr *d, gcipher **cx, gcipher **c, gmac **m)
584 if (k->ops->doit(k, d, h))
586 n = keysz(GH_CLASS(h)->hashsz, k->cx->keysz);
590 *cx = GC_INIT(k->cx, kd, n);
592 cn = keysz(0, k->c->keysz); n = cn;
593 mn = keysz(0, k->m->keysz); if (mn > n) n = mn;
595 GC_ENCRYPT(*cx, 0, kd, cn);
596 *c = GC_INIT(k->c, kd, cn);
597 GC_ENCRYPT(*cx, 0, kd, mn);
598 *m = GM_KEY(k->m, kd, mn);
607 /* --- @freekem@ --- *
609 * Arguments: @kem *k@ = key-encapsulation thing
613 * Use: Frees up a key-encapsulation thing.
621 key_fetchdone(k->kp);
627 /*----- That's all, folks -------------------------------------------------*/