Botan 3.0.0-alpha0
Crypto and TLS for C&
dh.cpp
Go to the documentation of this file.
1/*
2* Diffie-Hellman
3* (C) 1999-2007,2016,2019 Jack Lloyd
4*
5* Botan is released under the Simplified BSD License (see license.txt)
6*/
7
8#include <botan/dh.h>
9#include <botan/internal/pk_ops_impl.h>
10#include <botan/internal/monty_exp.h>
11#include <botan/internal/blinding.h>
12
13namespace Botan {
14
15/*
16* DH_PublicKey Constructor
17*/
19 {
20 m_group = grp;
21 m_y = y1;
22 }
23
24/*
25* Return the public value for key agreement
26*/
27std::vector<uint8_t> DH_PublicKey::public_value() const
28 {
29 return unlock(BigInt::encode_1363(m_y, group_p().bytes()));
30 }
31
32/*
33* Create a DH private key
34*/
36 const DL_Group& grp,
37 const BigInt& x_arg)
38 {
39 m_group = grp;
40
41 if(x_arg == 0)
42 {
43 const size_t exp_bits = grp.exponent_bits();
44 m_x.randomize(rng, exp_bits);
45 m_y = m_group.power_g_p(m_x, exp_bits);
46 }
47 else
48 {
49 m_x = x_arg;
50
51 if(m_y == 0)
52 m_y = m_group.power_g_p(m_x, grp.p_bits());
53 }
54 }
55
56/*
57* Load a DH private key
58*/
60 const secure_vector<uint8_t>& key_bits) :
62 {
63 if(m_y.is_zero())
64 {
66 }
67 }
68
69std::unique_ptr<Public_Key> DH_PrivateKey::public_key() const
70 {
71 return std::make_unique<DH_PublicKey>(get_group(), get_y());
72 }
73
74/*
75* Return the public value for key agreement
76*/
77std::vector<uint8_t> DH_PrivateKey::public_value() const
78 {
80 }
81
82namespace {
83
84/**
85* DH operation
86*/
87class DH_KA_Operation final : public PK_Ops::Key_Agreement_with_KDF
88 {
89 public:
90
91 DH_KA_Operation(const DH_PrivateKey& key, const std::string& kdf, RandomNumberGenerator& rng) :
92 PK_Ops::Key_Agreement_with_KDF(kdf),
93 m_p(key.group_p()),
94 m_x(key.get_x()),
95 m_x_bits(m_x.bits()),
96 m_monty_p(key.get_group().monty_params_p()),
97 m_blinder(m_p,
98 rng,
99 [](const BigInt& k) { return k; },
100 [this](const BigInt& k) { return powermod_x_p(inverse_mod(k, m_p)); })
101 {}
102
103 size_t agreed_value_size() const override { return m_p.bytes(); }
104
105 secure_vector<uint8_t> raw_agree(const uint8_t w[], size_t w_len) override;
106 private:
107 BigInt powermod_x_p(const BigInt& v) const
108 {
109 const size_t powm_window = 4;
110 auto powm_v_p = monty_precompute(m_monty_p, v, powm_window);
111 return monty_execute(*powm_v_p, m_x, m_x_bits);
112 }
113
114 const BigInt& m_p;
115 const BigInt& m_x;
116 const size_t m_x_bits;
117 std::shared_ptr<const Montgomery_Params> m_monty_p;
118 Blinder m_blinder;
119 };
120
121secure_vector<uint8_t> DH_KA_Operation::raw_agree(const uint8_t w[], size_t w_len)
122 {
123 BigInt v = BigInt::decode(w, w_len);
124
125 if(v <= 1 || v >= m_p - 1)
126 throw Invalid_Argument("DH agreement - invalid key provided");
127
128 v = m_blinder.blind(v);
129 v = powermod_x_p(v);
130 v = m_blinder.unblind(v);
131
132 return BigInt::encode_1363(v, m_p.bytes());
133 }
134
135}
136
137std::unique_ptr<PK_Ops::Key_Agreement>
139 const std::string& params,
140 const std::string& provider) const
141 {
142 if(provider == "base" || provider.empty())
143 return std::make_unique<DH_KA_Operation>(*this, params, rng);
144 throw Provider_Not_Found(algo_name(), provider);
145 }
146
147}
static BigInt decode(const uint8_t buf[], size_t length)
Definition: bigint.h:790
void randomize(RandomNumberGenerator &rng, size_t bitsize, bool set_high_bit=true)
Definition: big_rand.cpp:17
static secure_vector< uint8_t > encode_1363(const BigInt &n, size_t bytes)
Definition: big_code.cpp:106
bool is_zero() const
Definition: bigint.h:430
size_t bytes() const
Definition: bigint.cpp:294
BigInt blind(const BigInt &x) const
Definition: blinding.cpp:35
BigInt unblind(const BigInt &x) const
Definition: blinding.cpp:58
std::vector< uint8_t > public_value() const override
Definition: dh.cpp:77
std::unique_ptr< PK_Ops::Key_Agreement > create_key_agreement_op(RandomNumberGenerator &rng, const std::string &params, const std::string &provider) const override
Definition: dh.cpp:138
DH_PrivateKey(const AlgorithmIdentifier &alg_id, const secure_vector< uint8_t > &key_bits)
Definition: dh.cpp:59
std::unique_ptr< Public_Key > public_key() const override
Definition: dh.cpp:69
DH_PublicKey()=default
std::vector< uint8_t > public_value() const
Definition: dh.cpp:27
std::string algo_name() const override
Definition: dh.h:21
BigInt power_g_p(const BigInt &x) const
Definition: dl_group.cpp:571
size_t p_bits() const
Definition: dl_group.cpp:487
size_t exponent_bits() const
Definition: dl_group.cpp:514
const BigInt & group_p() const
Definition: dl_algo.h:49
const DL_Group & get_group() const
Definition: dl_algo.h:38
const BigInt & get_y() const
Definition: dl_algo.h:43
int(* final)(unsigned char *, CTX *)
Polynomial v
Definition: kyber.cpp:822
Definition: alg_id.cpp:13
DL_Group_Format
Definition: dl_group.h:27
std::vector< T > unlock(const secure_vector< T > &in)
Definition: secmem.h:72
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: mod_inv.cpp:177
BigInt monty_execute(const Montgomery_Exponentation_State &precomputed_state, const BigInt &k, size_t max_k_bits)
Definition: monty_exp.cpp:162
std::vector< T, secure_allocator< T > > secure_vector
Definition: secmem.h:65
std::shared_ptr< const Montgomery_Exponentation_State > monty_precompute(const std::shared_ptr< const Montgomery_Params > &params, const BigInt &g, size_t window_bits, bool const_time)
Definition: monty_exp.cpp:154