Botan 3.5.0
Crypto and TLS for C&
Botan::PK_Decryptor_EME Class Referencefinal

#include <pubkey.h>

Inheritance diagram for Botan::PK_Decryptor_EME:
Botan::PK_Decryptor

Public Member Functions

secure_vector< uint8_t > decrypt (const uint8_t in[], size_t length) const
 
secure_vector< uint8_t > decrypt (std::span< const uint8_t > in) const
 
secure_vector< uint8_t > decrypt_or_random (const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng) const
 
secure_vector< uint8_t > decrypt_or_random (const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng, const uint8_t required_content_bytes[], const uint8_t required_content_offsets[], size_t required_contents) const
 
PK_Decryptor_EMEoperator= (const PK_Decryptor_EME &)=delete
 
PK_Decryptor_EMEoperator= (PK_Decryptor_EME &&) noexcept
 
 PK_Decryptor_EME (const PK_Decryptor_EME &)=delete
 
 PK_Decryptor_EME (const Private_Key &key, RandomNumberGenerator &rng, std::string_view eme, std::string_view provider="")
 
 PK_Decryptor_EME (PK_Decryptor_EME &&) noexcept
 
size_t plaintext_length (size_t ptext_len) const override
 
 ~PK_Decryptor_EME () override
 

Detailed Description

Decryption with an MR algorithm and an EME.

Definition at line 515 of file pubkey.h.

Constructor & Destructor Documentation

◆ PK_Decryptor_EME() [1/3]

Botan::PK_Decryptor_EME::PK_Decryptor_EME ( const Private_Key & key,
RandomNumberGenerator & rng,
std::string_view eme,
std::string_view provider = "" )

Construct an instance.

Parameters
keythe key to use inside the decryptor
rngthe random generator to use
emethe EME to use
providerthe provider to use

Definition at line 114 of file pubkey.cpp.

117 {
118 m_op = key.create_decryption_op(rng, padding, provider);
119 if(!m_op) {
120 throw Invalid_Argument(fmt("Key type {} does not support decryption", key.algo_name()));
121 }
122}
std::string fmt(std::string_view format, const T &... args)
Definition fmt.h:53

References Botan::Asymmetric_Key::algo_name(), Botan::Private_Key::create_decryption_op(), and Botan::fmt().

◆ ~PK_Decryptor_EME()

Botan::PK_Decryptor_EME::~PK_Decryptor_EME ( )
overridedefault

◆ PK_Decryptor_EME() [2/3]

Botan::PK_Decryptor_EME::PK_Decryptor_EME ( const PK_Decryptor_EME & )
delete

◆ PK_Decryptor_EME() [3/3]

Botan::PK_Decryptor_EME::PK_Decryptor_EME ( PK_Decryptor_EME && )
defaultnoexcept

Member Function Documentation

◆ decrypt() [1/2]

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt ( const uint8_t in[],
size_t length ) const
inherited

Decrypt a ciphertext, throwing an exception if the input seems to be invalid (eg due to an accidental or malicious error in the ciphertext).

Parameters
inthe ciphertext as a byte array
lengththe length of the above byte array
Returns
decrypted message

Definition at line 23 of file pubkey.cpp.

23 {
24 uint8_t valid_mask = 0;
25
26 secure_vector<uint8_t> decoded = do_decrypt(valid_mask, in, length);
27
28 if(valid_mask == 0) {
29 throw Decoding_Error("Invalid public key ciphertext, cannot decrypt");
30 }
31
32 return decoded;
33}
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:61

Referenced by Botan::KeyPair::encryption_consistency_check().

◆ decrypt() [2/2]

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt ( std::span< const uint8_t > in) const
inlineinherited

Same as above, but taking a vector

Parameters
inthe ciphertext
Returns
decrypted message

Definition at line 96 of file pubkey.h.

96{ return decrypt(in.data(), in.size()); }
secure_vector< uint8_t > decrypt(const uint8_t in[], size_t length) const
Definition pubkey.cpp:23

References Botan::PK_Decryptor::decrypt().

Referenced by Botan::PK_Decryptor::decrypt().

◆ decrypt_or_random() [1/2]

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt_or_random ( const uint8_t in[],
size_t length,
size_t expected_pt_len,
RandomNumberGenerator & rng ) const
inherited

Decrypt a ciphertext. If the ciphertext is invalid (eg due to invalid padding) or is not the expected length, instead returns a random string of the expected length. Use to avoid oracle attacks, especially against PKCS #1 v1.5 decryption.

Definition at line 80 of file pubkey.cpp.

83 {
84 return decrypt_or_random(in, length, expected_pt_len, rng, nullptr, nullptr, 0);
85}
secure_vector< uint8_t > decrypt_or_random(const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng) const
Definition pubkey.cpp:80

References Botan::PK_Decryptor::decrypt_or_random().

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), and Botan::PK_Decryptor::decrypt_or_random().

◆ decrypt_or_random() [2/2]

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt_or_random ( const uint8_t in[],
size_t length,
size_t expected_pt_len,
RandomNumberGenerator & rng,
const uint8_t required_content_bytes[],
const uint8_t required_content_offsets[],
size_t required_contents ) const
inherited

Decrypt a ciphertext. If the ciphertext is invalid (eg due to invalid padding) or is not the expected length, instead returns a random string of the expected length. Use to avoid oracle attacks, especially against PKCS #1 v1.5 decryption.

Additionally checks (also in const time) that: contents[required_content_offsets[i]] == required_content_bytes[i] for 0 <= i < required_contents

Used for example in TLS, which encodes the client version in the content bytes: if there is any timing variation the version check can be used as an oracle to recover the key.

Definition at line 35 of file pubkey.cpp.

41 {
42 const secure_vector<uint8_t> fake_pms = rng.random_vec(expected_pt_len);
43
44 uint8_t decrypt_valid = 0;
45 secure_vector<uint8_t> decoded = do_decrypt(decrypt_valid, in, length);
46
47 auto valid_mask = CT::Mask<uint8_t>::is_equal(decrypt_valid, 0xFF);
48 valid_mask &= CT::Mask<uint8_t>(CT::Mask<size_t>::is_zero(decoded.size() ^ expected_pt_len));
49
50 decoded.resize(expected_pt_len);
51
52 for(size_t i = 0; i != required_contents_length; ++i) {
53 /*
54 These values are chosen by the application and for TLS are constants,
55 so this early failure via assert is fine since we know 0,1 < 48
56
57 If there is a protocol that has content checks on the key where
58 the expected offsets are controllable by the attacker this could
59 still leak.
60
61 Alternately could always reduce the offset modulo the length?
62 */
63
64 const uint8_t exp = required_content_bytes[i];
65 const uint8_t off = required_content_offsets[i];
66
67 BOTAN_ASSERT(off < expected_pt_len, "Offset in range of plaintext");
68
69 auto eq = CT::Mask<uint8_t>::is_equal(decoded[off], exp);
70
71 valid_mask &= eq;
72 }
73
74 // If valid_mask is false, assign fake pre master instead
75 valid_mask.select_n(decoded.data(), decoded.data(), fake_pms.data(), expected_pt_len);
76
77 return decoded;
78}
#define BOTAN_ASSERT(expr, assertion_made)
Definition assert.h:50
static constexpr Mask< T > is_equal(T x, T y)
Definition ct_utils.h:250
static constexpr Mask< T > is_zero(T x)
Definition ct_utils.h:245

References BOTAN_ASSERT, Botan::CT::Mask< T >::is_equal(), and Botan::RandomNumberGenerator::random_vec().

◆ operator=() [1/2]

PK_Decryptor_EME & Botan::PK_Decryptor_EME::operator= ( const PK_Decryptor_EME & )
delete

◆ operator=() [2/2]

PK_Decryptor_EME & Botan::PK_Decryptor_EME::operator= ( PK_Decryptor_EME && )
defaultnoexcept

◆ plaintext_length()

size_t Botan::PK_Decryptor_EME::plaintext_length ( size_t ctext_len) const
overridevirtual

Return an upper bound on the plaintext length for a particular ciphertext input length

Implements Botan::PK_Decryptor.

Definition at line 129 of file pubkey.cpp.

129 {
130 return m_op->plaintext_length(ctext_len);
131}

References plaintext_length().

Referenced by plaintext_length().


The documentation for this class was generated from the following files: