Botan::RTSS_Share Class Reference

#include <tss.h>

Public Member Functions
const secure_vector< uint8_t > &	data () const
bool	initialized () const
	RTSS_Share ()=default
	RTSS_Share (const uint8_t data[], size_t len)
	RTSS_Share (std::string_view hex_input)
uint8_t	share_id () const
size_t	size () const
std::string	to_string () const

Static Public Member Functions
static secure_vector< uint8_t >	reconstruct (const std::vector< RTSS_Share > &shares)
static std::vector< RTSS_Share >	split (uint8_t M, uint8_t N, const uint8_t secret[], uint16_t secret_len, const std::vector< uint8_t > &identifier, std::string_view hash_fn, RandomNumberGenerator &rng)
static std::vector< RTSS_Share >	split (uint8_t M, uint8_t N, const uint8_t secret[], uint16_t secret_len, const uint8_t identifier[16], RandomNumberGenerator &rng)

Detailed Description

A split secret, using the format from draft-mcgrew-tss-03

Definition at line 22 of file tss.h.

Constructor & Destructor Documentation

RTSS_Share() [1/3]

Botan::RTSS_Share::RTSS_Share ( )

default

Create an uninitialized share

References data(), and RTSS_Share().

Referenced by RTSS_Share().

RTSS_Share() [2/3]

Botan::RTSS_Share::RTSS_Share ( std::string_view hex_input )

explicit

Decode a share from its hex representation

Parameters

hex_input

the share encoded in hexadecimal

Definition at line 85 of file tss.cpp.

                                               {
   m_contents = hex_decode_locked(hex_input);
}

References Botan::hex_decode_locked().

RTSS_Share() [3/3]

Botan::RTSS_Share::RTSS_Share	(	const uint8_t	data[],
		size_t	len )

Create a share from its binary representation

Parameters

data	the shared data
len	the length of data

Definition at line 89 of file tss.cpp.

                                                      {
   m_contents.assign(bin, bin + len);
}

Member Function Documentation

data()

const secure_vector< uint8_t > & Botan::RTSS_Share::data ( ) const

inline

Access the binary representation of this share

Returns

binary representation

Definition at line 86 of file tss.h.

{ return m_contents; }

Referenced by RTSS_Share().

initialized()

bool Botan::RTSS_Share::initialized ( ) const

inline

Test whether this share was initialized

Returns

if this TSS share was initialized or not

Definition at line 110 of file tss.h.

{ return (!m_contents.empty()); }

Referenced by share_id().

reconstruct()

secure_vector< uint8_t > Botan::RTSS_Share::reconstruct ( const std::vector< RTSS_Share > & shares )

static

Reconstruct a secret from a set of shares

Parameters

shares

the list of shares

Definition at line 191 of file tss.cpp.

                                                                                  {
   if(shares.size() <= 1) {
      throw Decoding_Error("Insufficient shares to do TSS reconstruction");
   }
 
   for(size_t i = 0; i != shares.size(); ++i) {
      if(shares[i].size() < RTSS_HEADER_SIZE + 1) {
         throw Decoding_Error("Missing or malformed RTSS header");
      }
 
      if(shares[i].share_id() == 0) {
         throw Decoding_Error("Invalid (id = 0) RTSS share detected");
      }
 
      if(i > 0) {
         if(shares[i].size() != shares[0].size()) {
            throw Decoding_Error("Different sized RTSS shares detected");
         }
 
         if(!CT::is_equal(shares[0].m_contents.data(), shares[i].m_contents.data(), RTSS_HEADER_SIZE).as_bool()) {
            throw Decoding_Error("Different RTSS headers detected");
         }
      }
   }
 
   const uint8_t N = shares[0].m_contents[17];
 
   if(shares.size() < N) {
      throw Decoding_Error("Insufficient shares to do TSS reconstruction");
   }
 
   const uint16_t share_len = make_uint16(shares[0].m_contents[18], shares[0].m_contents[19]);
 
   const uint8_t hash_id = shares[0].m_contents[16];
   auto hash = get_rtss_hash_by_id(hash_id);
   const size_t hash_len = (hash ? hash->output_length() : 0);
 
   if(shares[0].size() != RTSS_HEADER_SIZE + share_len) {
      /*
      * This second (laxer) check accommodates a bug in TSS that was
      * fixed in 2.9.0 - previous versions used the length of the
      * *secret* here, instead of the length of the *share*, which is
      * precisely 1 + hash_len longer.
      */
      if(shares[0].size() <= RTSS_HEADER_SIZE + 1 + hash_len) {
         throw Decoding_Error("Bad RTSS length field in header");
      }
   }
 
   std::vector<uint8_t> V(shares.size());
   secure_vector<uint8_t> recovered;
 
   // Compute the Lagrange coefficients
   std::vector<uint8_t> lagrange_coeffs(shares.size());
   for(size_t k = 0; k != shares.size(); ++k) {
      uint8_t coeff = 1;
      for(size_t l = 0; l != shares.size(); ++l) {
         if(k == l) {
            continue;
         }
         const uint8_t share_k = shares[k].share_id();
         const uint8_t share_l = shares[l].share_id();
         if(share_k == share_l) {
            throw Decoding_Error("Duplicate shares found in RTSS recovery");
         }
         // We already verified this earlier in the function
         BOTAN_ASSERT_NOMSG(share_k > 0 && share_l > 0);
         const uint8_t div = tss_gf_mul(share_l, tss_gf_inv(share_k ^ share_l));
         coeff = tss_gf_mul(coeff, div);
      }
      lagrange_coeffs[k] = coeff;
   }
 
   for(size_t i = RTSS_HEADER_SIZE + 1; i != shares[0].size(); ++i) {
      for(size_t j = 0; j != V.size(); ++j) {
         V[j] = shares[j].m_contents[i];
      }
 
      /*
      * Interpolation step
      *
      * This is effectively a multi-scalar multiplication (aka sum-of-products)
      * where one of the inputs, namely the Lagrange coefficients, are public.
      * If optimizing this function further was useful, this would be the place
      * to start, for example by using Pippeneger's algorithm.
      */
      uint8_t r = 0;
      for(size_t k = 0; k != shares.size(); ++k) {
         r ^= tss_gf_mul(V[k], lagrange_coeffs[k]);
      }
      recovered.push_back(r);
   }
 
   if(hash) {
      if(recovered.size() < hash->output_length()) {
         throw Decoding_Error("RTSS recovered value too short to be valid");
      }
 
      const size_t secret_len = recovered.size() - hash->output_length();
 
      hash->update(recovered.data(), secret_len);
      secure_vector<uint8_t> hash_check = hash->final();
 
      if(!CT::is_equal(hash_check.data(), &recovered[secret_len], hash->output_length()).as_bool()) {
         throw Decoding_Error("RTSS hash check failed");
      }
 
      // remove the trailing hash value
      recovered.resize(secret_len);
   }
 
   return recovered;
}

References BOTAN_ASSERT_NOMSG, Botan::CT::is_equal(), Botan::make_uint16(), share_id(), and size().

share_id()

uint8_t Botan::RTSS_Share::share_id

(

)

const

Return the identifier of this share

Returns

share identifier

Definition at line 93 of file tss.cpp.

                                   {
   if(!initialized()) {
      throw Invalid_State("RTSS_Share::share_id not initialized");
   }
 
   if(m_contents.size() < RTSS_HEADER_SIZE + 1) {
      throw Decoding_Error("RTSS_Share::share_id invalid share data");
   }
 
   return m_contents[20];
}

References initialized().

Referenced by reconstruct().

size()

size_t Botan::RTSS_Share::size ( ) const

inline

Return the size of this share

Returns

size of this share in bytes

Definition at line 104 of file tss.h.

{ return m_contents.size(); }

Referenced by reconstruct().

split() [1/2]

std::vector< RTSS_Share > Botan::RTSS_Share::split ( uint8_t M, uint8_t N, const uint8_t secret[], uint16_t secret_len, const std::vector< uint8_t > & identifier, std::string_view hash_fn, RandomNumberGenerator & rng )

static

Split a secret into shares

Parameters

M	the number of shares needed to reconstruct
N	the number of shares generated
secret	the secret to split
secret_len	the length of the secret
identifier	the share identifier
hash_fn	the hash function to use for a checksum ("None", "SHA-1", "SHA-256")
Random Number Generators	the random number generator to use

Definition at line 114 of file tss.cpp.

                                                                      {
   if(M <= 1 || N <= 1 || M > N || N >= 255) {
      throw Invalid_Argument("RTSS_Share::split: Invalid N or M");
   }
 
   if(identifier.size() > 16) {
      throw Invalid_Argument("RTSS_Share::split Invalid identifier size");
   }
 
   const uint8_t hash_id = rtss_hash_id(hash_fn);
 
   std::unique_ptr<HashFunction> hash;
   if(hash_id > 0) {
      hash = HashFunction::create_or_throw(hash_fn);
   }
 
   // secret = S || H(S)
   secure_vector<uint8_t> secret(S, S + S_len);
   if(hash) {
      secret += hash->process(S, S_len);
   }
 
   if(secret.size() >= 0xFFFE) {
      throw Encoding_Error("RTSS_Share::split secret too large for TSS format");
   }
 
   // +1 byte for the share ID
   const uint16_t share_len = static_cast<uint16_t>(secret.size() + 1);
 
   secure_vector<uint8_t> share_header(RTSS_HEADER_SIZE);
   copy_mem(share_header.data(), identifier.data(), identifier.size());
   share_header[16] = hash_id;
   share_header[17] = M;
   share_header[18] = get_byte<0>(share_len);
   share_header[19] = get_byte<1>(share_len);
 
   // Create RTSS header in each share
   std::vector<RTSS_Share> shares(N);
 
   for(uint8_t i = 0; i != N; ++i) {
      shares[i].m_contents.reserve(share_header.size() + share_len);
      shares[i].m_contents = share_header;
   }
 
   // Choose sequential values for X starting from 1
   for(uint8_t i = 0; i != N; ++i) {
      shares[i].m_contents.push_back(i + 1);
   }
 
   for(const uint8_t secret_byte : secret) {
      std::vector<uint8_t> coefficients(M - 1);
      rng.randomize(coefficients.data(), coefficients.size());
 
      for(uint8_t j = 0; j != N; ++j) {
         const uint8_t X = j + 1;
 
         uint8_t sum = secret_byte;
         uint8_t X_i = X;
 
         for(const uint8_t cb : coefficients) {
            sum ^= tss_gf_mul(X_i, cb);
            X_i = tss_gf_mul(X_i, X);
         }
 
         shares[j].m_contents.push_back(sum);
      }
   }
 
   return shares;
}

References Botan::copy_mem(), Botan::HashFunction::create_or_throw(), Botan::get_byte(), and Botan::RandomNumberGenerator::randomize().

split() [2/2]

std::vector< RTSS_Share > Botan::RTSS_Share::split ( uint8_t M, uint8_t N, const uint8_t secret[], uint16_t secret_len, const uint8_t identifier[16], RandomNumberGenerator & rng )

static

Split a secret into shares

Parameters

M	the number of shares needed to reconstruct
N	the number of shares generated
secret	the secret to split
secret_len	the length of the secret
identifier	the 16 byte share identifier
Random Number Generators	the random number generator to use

Definition at line 109 of file tss.cpp.

                                                                                                                      {
   return RTSS_Share::split(M, N, S, S_len, std::vector<uint8_t>(identifier, identifier + 16), "SHA-256", rng);
}

References split().

Referenced by split().

to_string()

std::string Botan::RTSS_Share::to_string

(

)

const

Format this share as a hex string

Returns

hex representation

Definition at line 105 of file tss.cpp.

                                      {
   return hex_encode(m_contents.data(), m_contents.size());
}

References Botan::hex_encode().

---

The documentation for this class was generated from the following files:

• src/lib/misc/tss/tss.h
• src/lib/misc/tss/tss.cpp