1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
/*
* Diffie-Hellman
* (C) 1999-2007,2016 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#include <botan/dh.h>
#include <botan/internal/pk_ops_impl.h>
#include <botan/workfactor.h>
#include <botan/pow_mod.h>
#include <botan/blinding.h>
namespace Botan {
/*
* DH_PublicKey Constructor
*/
DH_PublicKey::DH_PublicKey(const DL_Group& grp, const BigInt& y1)
{
m_group = grp;
m_y = y1;
}
/*
* Return the public value for key agreement
*/
std::vector<byte> DH_PublicKey::public_value() const
{
return unlock(BigInt::encode_1363(m_y, group_p().bytes()));
}
/*
* Create a DH private key
*/
DH_PrivateKey::DH_PrivateKey(RandomNumberGenerator& rng,
const DL_Group& grp,
const BigInt& x_arg)
{
const bool generate = (x_arg == 0) ? true : false;
m_group = grp;
m_x = x_arg;
if(generate)
{
const BigInt& p = group_p();
m_x.randomize(rng, dl_exponent_size(p.bits()));
}
if(m_y == 0)
{
m_y = power_mod(group_g(), m_x, group_p());
}
if(generate)
{
gen_check(rng);
}
else
{
load_check(rng);
}
}
/*
* Load a DH private key
*/
DH_PrivateKey::DH_PrivateKey(const AlgorithmIdentifier& alg_id,
const secure_vector<byte>& key_bits,
RandomNumberGenerator& rng) :
DL_Scheme_PrivateKey(alg_id, key_bits, DL_Group::ANSI_X9_42)
{
if(m_y == 0)
m_y = power_mod(group_g(), m_x, group_p());
load_check(rng);
}
/*
* Return the public value for key agreement
*/
std::vector<byte> DH_PrivateKey::public_value() const
{
return DH_PublicKey::public_value();
}
namespace {
/**
* DH operation
*/
class DH_KA_Operation : public PK_Ops::Key_Agreement_with_KDF
{
public:
typedef DH_PrivateKey Key_Type;
DH_KA_Operation(const DH_PrivateKey& key, const std::string& kdf, RandomNumberGenerator& rng) :
PK_Ops::Key_Agreement_with_KDF(kdf),
m_p(key.group_p()),
m_powermod_x_p(key.get_x(), m_p),
m_blinder(m_p,
rng,
[](const BigInt& k) { return k; },
[this](const BigInt& k) { return m_powermod_x_p(inverse_mod(k, m_p)); })
{}
secure_vector<byte> raw_agree(const byte w[], size_t w_len) override;
private:
const BigInt& m_p;
Fixed_Exponent_Power_Mod m_powermod_x_p;
Blinder m_blinder;
};
secure_vector<byte> DH_KA_Operation::raw_agree(const byte w[], size_t w_len)
{
BigInt input = BigInt::decode(w, w_len);
if(input <= 1 || input >= m_p - 1)
throw Invalid_Argument("DH agreement - invalid key provided");
BigInt r = m_blinder.unblind(m_powermod_x_p(m_blinder.blind(input)));
return BigInt::encode_1363(r, m_p.bytes());
}
}
std::unique_ptr<PK_Ops::Key_Agreement>
DH_PrivateKey::create_key_agreement_op(RandomNumberGenerator& rng,
const std::string& params,
const std::string& provider) const
{
if(provider == "base" || provider.empty())
return std::unique_ptr<PK_Ops::Key_Agreement>(new DH_KA_Operation(*this, params, rng));
throw Provider_Not_Found(algo_name(), provider);
}
}
|
