Botan 3.8.1
Crypto and TLS for C&
Botan::Classic_McEliece_PrivateKeyInternal Class Reference

Representation of a Classic McEliece private key. More...

#include <cmce_keys_internal.h>

Public Member Functions

constexpr void _const_time_poison () const
 
constexpr void _const_time_unpoison () const
 
const CmceColumnSelectionc () const
 The column selection pivot vector c as defined in Classic McEliece ISO Section 9.2.11.
 
bool check_key () const
 Checks the private key for consistency with the first component delta, i.e., recomputes s as a hash of delta and checks equivalence with sk.s, checks the weight of c, and checks the control bits. It also recomputes beta based on delta and recomputes g based on beta, checking that g is equal to the value sk.s.
 
 Classic_McEliece_PrivateKeyInternal (const Classic_McEliece_Parameters &params, CmceKeyGenSeed delta, CmceColumnSelection c, Classic_McEliece_Minimal_Polynomial g, Classic_McEliece_Field_Ordering alpha, CmceRejectionSeed s)
 Construct a Classic McEliece private key.
 
const CmceKeyGenSeeddelta () const
 The seed delta that was used to create the private key.
 
const Classic_McEliece_Field_Orderingfield_ordering () const
 The field ordering alpha.
 
const Classic_McEliece_Minimal_Polynomialg () const
 The minimal polynomial g.
 
const Classic_McEliece_Parametersparams () const
 The Classic McEliece parameters.
 
const CmceRejectionSeeds () const
 The seed s for implicit rejection on decryption failure.
 
secure_vector< uint8_t > serialize () const
 Serializes the Classic McEliece private key as defined in Classic McEliece ISO Section 9.2.12.
 

Static Public Member Functions

static Classic_McEliece_PrivateKeyInternal from_bytes (const Classic_McEliece_Parameters &params, std::span< const uint8_t > sk_bytes)
 Parses a Classic McEliece private key from a byte sequence.
 

Detailed Description

Representation of a Classic McEliece private key.

This class represents a Classic McEliece private key. It is used internally by the Classic McEliece private key class and contains the following data (see Classic McEliece ISO Section 9.2.12):

  • The Classic McEliece parameters
  • The seed delta
  • The column selection pivot vector c
  • The minimal polynomial g
  • The field ordering alpha
  • The seed s for implicit rejection

Definition at line 89 of file cmce_keys_internal.h.

Constructor & Destructor Documentation

◆ Classic_McEliece_PrivateKeyInternal()

Botan::Classic_McEliece_PrivateKeyInternal::Classic_McEliece_PrivateKeyInternal ( const Classic_McEliece_Parameters & params,
CmceKeyGenSeed delta,
CmceColumnSelection c,
Classic_McEliece_Minimal_Polynomial g,
Classic_McEliece_Field_Ordering alpha,
CmceRejectionSeed s )
inline

Construct a Classic McEliece private key.

Parameters
paramsThe Classic McEliece parameters
deltaThe seed delta
cThe column selection pivot vector c
gThe minimal polynomial g
alphaThe field ordering alpha
sThe seed s for implicit rejection

Definition at line 101 of file cmce_keys_internal.h.

106 :
107 m_params(params),
108 m_delta(std::move(delta)),
109 m_c(std::move(c)),
110 m_g(std::move(g)),
111 m_field_ordering(std::move(alpha)),
112 m_s(std::move(s)) {}
const CmceRejectionSeed & s() const
The seed s for implicit rejection on decryption failure.
const CmceKeyGenSeed & delta() const
The seed delta that was used to create the private key.
const Classic_McEliece_Parameters & params() const
The Classic McEliece parameters.
const CmceColumnSelection & c() const
The column selection pivot vector c as defined in Classic McEliece ISO Section 9.2....
const Classic_McEliece_Minimal_Polynomial & g() const
The minimal polynomial g.

References c(), delta(), g(), params(), and s().

Referenced by from_bytes().

Member Function Documentation

◆ _const_time_poison()

void Botan::Classic_McEliece_PrivateKeyInternal::_const_time_poison ( ) const
inlineconstexpr

Definition at line 173 of file cmce_keys_internal.h.

173{ CT::poison_all(m_delta, m_c, m_g, m_field_ordering, m_s); }
constexpr void poison_all(Ts &&... ts)
Definition ct_utils.h:196

References Botan::CT::poison_all().

◆ _const_time_unpoison()

void Botan::Classic_McEliece_PrivateKeyInternal::_const_time_unpoison ( ) const
inlineconstexpr

Definition at line 175 of file cmce_keys_internal.h.

175{ CT::unpoison_all(m_delta, m_c, m_g, m_field_ordering, m_s); }
constexpr void unpoison_all(Ts &&... ts)
Definition ct_utils.h:202

References Botan::CT::unpoison_all().

◆ c()

const CmceColumnSelection & Botan::Classic_McEliece_PrivateKeyInternal::c ( ) const
inline

The column selection pivot vector c as defined in Classic McEliece ISO Section 9.2.11.

Definition at line 141 of file cmce_keys_internal.h.

141{ return m_c; }

Referenced by check_key(), Classic_McEliece_PrivateKeyInternal(), and from_bytes().

◆ check_key()

bool Botan::Classic_McEliece_PrivateKeyInternal::check_key ( ) const

Checks the private key for consistency with the first component delta, i.e., recomputes s as a hash of delta and checks equivalence with sk.s, checks the weight of c, and checks the control bits. It also recomputes beta based on delta and recomputes g based on beta, checking that g is equal to the value sk.s.

See NIST Impl. guide 6.3 Double-Checks on Private Keys.

Definition at line 100 of file cmce_keys_internal.cpp.

100 {
101 auto prg = m_params.prg(m_delta);
102
103 const auto s = prg->output<CmceRejectionSeed>(m_params.n() / 8);
104 const auto ordering_bits = prg->output<CmceOrderingBits>((m_params.sigma2() * m_params.q()) / 8);
105 const auto irreducible_bits = prg->output<CmceIrreducibleBits>((m_params.sigma1() * m_params.t()) / 8);
106
107 // Recomputing s as hash of delta
108 auto ret = CT::Mask<size_t>::expand(CT::is_equal<uint8_t>(s.data(), m_s.data(), m_params.n() / 8));
109
110 // Checking weight of c
111 ret &= CT::Mask<size_t>::is_equal(c().hamming_weight(), 32);
112
113 if(auto g = m_params.poly_ring().compute_minimal_polynomial(irreducible_bits)) {
114 for(size_t i = 0; i < g->degree() - 1; ++i) {
115 ret &= CT::Mask<size_t>::expand(GF_Mask::is_equal(g->coef_at(i), m_g.coef_at(i)).elem_mask());
116 }
117 } else {
119 }
120
121 // Check alpha control bits
122 if(auto field_ord_from_seed = Classic_McEliece_Field_Ordering::create_field_ordering(m_params, ordering_bits)) {
123 field_ord_from_seed->permute_with_pivots(m_params, c());
124 ret &= CT::Mask<size_t>::expand(field_ord_from_seed->ct_is_equal(field_ordering()));
125 } else {
127 }
128
129 return ret.as_bool();
130}
static constexpr Mask< T > expand(T v)
Definition ct_utils.h:409
static constexpr Mask< T > is_equal(T x, T y)
Definition ct_utils.h:454
static constexpr Mask< T > cleared()
Definition ct_utils.h:404
static std::optional< Classic_McEliece_Field_Ordering > create_field_ordering(const Classic_McEliece_Parameters &params, StrongSpan< const CmceOrderingBits > random_bits)
Creates a field ordering from a random bit sequence. Corresponds to the algorithm described in Classi...
const Classic_McEliece_Field_Ordering & field_ordering() const
The field ordering alpha.
static GF_Mask is_equal(Classic_McEliece_GF a, Classic_McEliece_GF b)
Definition cmce_gf.h:168
CT::Mask< uint16_t > & elem_mask()
Definition cmce_gf.h:197
constexpr CT::Mask< T > is_equal(const T x[], const T y[], size_t len)
Definition ct_utils.h:789
Strong< secure_vector< uint8_t >, struct CmceOrderingBits_ > CmceOrderingBits
Definition cmce_types.h:37
Strong< secure_vector< uint8_t >, struct CmceIrreducibleBits_ > CmceIrreducibleBits
Definition cmce_types.h:40
Strong< secure_vector< uint8_t >, struct CmceRejectionSeed_ > CmceRejectionSeed
Represents s of private key.
Definition cmce_types.h:43

References c(), Botan::CT::Mask< T >::cleared(), Botan::Classic_McEliece_Field_Ordering::create_field_ordering(), Botan::CT::Mask< T >::expand(), field_ordering(), g(), Botan::CT::is_equal(), Botan::CT::Mask< T >::is_equal(), Botan::GF_Mask::is_equal(), and s().

◆ delta()

const CmceKeyGenSeed & Botan::Classic_McEliece_PrivateKeyInternal::delta ( ) const
inline

The seed delta that was used to create the private key.

Definition at line 136 of file cmce_keys_internal.h.

136{ return m_delta; }

Referenced by Classic_McEliece_PrivateKeyInternal(), and from_bytes().

◆ field_ordering()

const Classic_McEliece_Field_Ordering & Botan::Classic_McEliece_PrivateKeyInternal::field_ordering ( ) const
inline

The field ordering alpha.

Definition at line 151 of file cmce_keys_internal.h.

151{ return m_field_ordering; }

Referenced by check_key(), Botan::Classic_McEliece_PublicKeyInternal::create_from_private_key(), and from_bytes().

◆ from_bytes()

Classic_McEliece_PrivateKeyInternal Botan::Classic_McEliece_PrivateKeyInternal::from_bytes ( const Classic_McEliece_Parameters & params,
std::span< const uint8_t > sk_bytes )
static

Parses a Classic McEliece private key from a byte sequence.

It also creates the field ordering from the control bits in sk_bytes.

Parameters
paramsThe Classic McEliece parameters
sk_bytesThe secret key byte sequence
Returns
the Classic McEliece private key

Definition at line 65 of file cmce_keys_internal.cpp.

66 {
67 BOTAN_ASSERT(sk_bytes.size() == params.sk_size_bytes(), "Valid private key size");
68 BufferSlicer sk_slicer(sk_bytes);
69
70 auto delta = sk_slicer.copy<CmceKeyGenSeed>(params.seed_len());
71 auto c = CmceColumnSelection(sk_slicer.take(params.sk_c_bytes()));
72 auto g = Classic_McEliece_Minimal_Polynomial::from_bytes(sk_slicer.take(params.sk_poly_g_bytes()), params.poly_f());
74 params, secure_bitvector(sk_slicer.take(params.sk_alpha_control_bytes())));
75 auto s = sk_slicer.copy<CmceRejectionSeed>(params.sk_s_bytes());
76 BOTAN_ASSERT_NOMSG(sk_slicer.empty());
77
79 params, std::move(delta), std::move(c), std::move(g), std::move(field_ordering), std::move(s));
80}
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:61
#define BOTAN_ASSERT(expr, assertion_made)
Definition assert.h:52
static Classic_McEliece_Field_Ordering create_from_control_bits(const Classic_McEliece_Parameters &params, const secure_bitvector &control_bits)
Create the field ordering from the control bits of a benes network.
static Classic_McEliece_Minimal_Polynomial from_bytes(std::span< const uint8_t > bytes, CmceGfMod poly_f)
Create a polynomial from bytes according to ISO Section 9.2.9.
Classic_McEliece_PrivateKeyInternal(const Classic_McEliece_Parameters &params, CmceKeyGenSeed delta, CmceColumnSelection c, Classic_McEliece_Minimal_Polynomial g, Classic_McEliece_Field_Ordering alpha, CmceRejectionSeed s)
Construct a Classic McEliece private key.
bitvector_base< secure_allocator > secure_bitvector
Definition bitvector.h:1298
Strong< secure_bitvector, struct CmceColumnSelection_ > CmceColumnSelection
Represents c of private key.
Definition cmce_types.h:46
Strong< secure_vector< uint8_t >, struct CmceKeyGenSeed_ > CmceKeyGenSeed
Represents a delta (can be altered; final value stored in private key)
Definition cmce_types.h:34

References BOTAN_ASSERT, BOTAN_ASSERT_NOMSG, c(), Classic_McEliece_PrivateKeyInternal(), Botan::BufferSlicer::copy(), Botan::Classic_McEliece_Field_Ordering::create_from_control_bits(), delta(), Botan::BufferSlicer::empty(), field_ordering(), Botan::Classic_McEliece_Minimal_Polynomial::from_bytes(), g(), params(), s(), and Botan::BufferSlicer::take().

Referenced by Botan::Classic_McEliece_PrivateKey::Classic_McEliece_PrivateKey().

◆ g()

const Classic_McEliece_Minimal_Polynomial & Botan::Classic_McEliece_PrivateKeyInternal::g ( ) const
inline

The minimal polynomial g.

Definition at line 146 of file cmce_keys_internal.h.

146{ return m_g; }

Referenced by check_key(), Classic_McEliece_PrivateKeyInternal(), Botan::Classic_McEliece_PublicKeyInternal::create_from_private_key(), and from_bytes().

◆ params()

const Classic_McEliece_Parameters & Botan::Classic_McEliece_PrivateKeyInternal::params ( ) const
inline

The Classic McEliece parameters.

Definition at line 161 of file cmce_keys_internal.h.

161{ return m_params; }

Referenced by Classic_McEliece_PrivateKeyInternal(), Botan::Classic_McEliece_PublicKeyInternal::create_from_private_key(), and from_bytes().

◆ s()

const CmceRejectionSeed & Botan::Classic_McEliece_PrivateKeyInternal::s ( ) const
inline

The seed s for implicit rejection on decryption failure.

Definition at line 156 of file cmce_keys_internal.h.

156{ return m_s; }

Referenced by check_key(), Classic_McEliece_PrivateKeyInternal(), and from_bytes().

◆ serialize()

secure_vector< uint8_t > Botan::Classic_McEliece_PrivateKeyInternal::serialize ( ) const

Serializes the Classic McEliece private key as defined in Classic McEliece ISO Section 9.2.12.

Returns
the serialized Classic McEliece private key

Definition at line 82 of file cmce_keys_internal.cpp.

82 {
83 auto control_bits = m_field_ordering.alphas_control_bits();
84
85 /* NIST Impl. guide 6.1 Control-Bit Gen:
86 * As low-cost protection against faults in the control-bit computation, implementors are advised
87 * to check after the computation that applying the Benes network produces pi, and to
88 * restart key generation if this test fails; applying the Benes network is very fast.
89 *
90 * Here, we just assert that applying the Benes network produces pi.
91 */
93 .ct_is_equal(m_field_ordering)
94 .as_bool(),
95 "Control Bit Computation Check");
96
97 return concat(m_delta.get(), m_c.get().to_bytes(), m_g.serialize(), control_bits.to_bytes(), m_s);
98}
constexpr auto concat(Rs &&... ranges)
Definition stl_util.h:264

References BOTAN_ASSERT, Botan::concat(), and Botan::Classic_McEliece_Field_Ordering::create_from_control_bits().


The documentation for this class was generated from the following files: