11#include <botan/internal/hybrid_public_key.h>
13#include <botan/pk_algs.h>
15#include <botan/internal/fmt.h>
16#include <botan/internal/kex_to_kem_adapter.h>
17#include <botan/internal/pk_ops_impl.h>
18#include <botan/internal/stl_util.h>
24std::vector<std::pair<std::string, std::string>> algorithm_specs_for_group(Group_Params group) {
27 switch(group.code()) {
39 case Group_Params::HYBRID_X25519_ML_KEM_768:
40 return {{
"ML-KEM",
"ML-KEM-768"}, {
"X25519",
"X25519"}};
41 case Group_Params::HYBRID_SECP256R1_ML_KEM_768:
42 return {{
"ECDH",
"secp256r1"}, {
"ML-KEM",
"ML-KEM-768"}};
44 case Group_Params::HYBRID_X25519_eFRODOKEM_640_SHAKE_OQS:
45 return {{
"X25519",
"X25519"}, {
"FrodoKEM",
"eFrodoKEM-640-SHAKE"}};
46 case Group_Params::HYBRID_X25519_eFRODOKEM_640_AES_OQS:
47 return {{
"X25519",
"X25519"}, {
"FrodoKEM",
"eFrodoKEM-640-AES"}};
48 case Group_Params::HYBRID_X448_eFRODOKEM_976_SHAKE_OQS:
49 return {{
"X448",
"X448"}, {
"FrodoKEM",
"eFrodoKEM-976-SHAKE"}};
50 case Group_Params::HYBRID_X448_eFRODOKEM_976_AES_OQS:
51 return {{
"X448",
"X448"}, {
"FrodoKEM",
"eFrodoKEM-976-AES"}};
53 case Group_Params::HYBRID_SECP256R1_eFRODOKEM_640_SHAKE_OQS:
54 return {{
"ECDH",
"secp256r1"}, {
"FrodoKEM",
"eFrodoKEM-640-SHAKE"}};
55 case Group_Params::HYBRID_SECP256R1_eFRODOKEM_640_AES_OQS:
56 return {{
"ECDH",
"secp256r1"}, {
"FrodoKEM",
"eFrodoKEM-640-AES"}};
58 case Group_Params::HYBRID_SECP384R1_eFRODOKEM_976_SHAKE_OQS:
59 return {{
"ECDH",
"secp384r1"}, {
"FrodoKEM",
"eFrodoKEM-976-SHAKE"}};
60 case Group_Params::HYBRID_SECP384R1_eFRODOKEM_976_AES_OQS:
61 return {{
"ECDH",
"secp384r1"}, {
"FrodoKEM",
"eFrodoKEM-976-AES"}};
63 case Group_Params::HYBRID_SECP521R1_eFRODOKEM_1344_SHAKE_OQS:
64 return {{
"ECDH",
"secp521r1"}, {
"FrodoKEM",
"eFrodoKEM-1344-SHAKE"}};
65 case Group_Params::HYBRID_SECP521R1_eFRODOKEM_1344_AES_OQS:
66 return {{
"ECDH",
"secp521r1"}, {
"FrodoKEM",
"eFrodoKEM-1344-AES"}};
73std::vector<AlgorithmIdentifier> algorithm_identifiers_for_group(Group_Params group) {
76 const auto specs = algorithm_specs_for_group(group);
77 std::vector<AlgorithmIdentifier> result;
78 result.reserve(specs.size());
87 for(
const auto& spec : specs) {
94std::vector<size_t> public_value_lengths_for_group(Group_Params group) {
101 switch(group.code()) {
102 case Group_Params::HYBRID_X25519_ML_KEM_768:
104 case Group_Params::HYBRID_SECP256R1_ML_KEM_768:
107 case Group_Params::HYBRID_X25519_eFRODOKEM_640_SHAKE_OQS:
109 case Group_Params::HYBRID_X25519_eFRODOKEM_640_AES_OQS:
111 case Group_Params::HYBRID_X448_eFRODOKEM_976_SHAKE_OQS:
113 case Group_Params::HYBRID_X448_eFRODOKEM_976_AES_OQS:
116 case Group_Params::HYBRID_SECP256R1_eFRODOKEM_640_SHAKE_OQS:
118 case Group_Params::HYBRID_SECP256R1_eFRODOKEM_640_AES_OQS:
121 case Group_Params::HYBRID_SECP384R1_eFRODOKEM_976_SHAKE_OQS:
123 case Group_Params::HYBRID_SECP384R1_eFRODOKEM_976_AES_OQS:
126 case Group_Params::HYBRID_SECP521R1_eFRODOKEM_1344_SHAKE_OQS:
128 case Group_Params::HYBRID_SECP521R1_eFRODOKEM_1344_AES_OQS:
139 Group_Params group, std::span<const uint8_t> concatenated_public_values) {
140 const auto public_value_lengths = public_value_lengths_for_group(group);
141 auto alg_ids = algorithm_identifiers_for_group(group);
144 const auto expected_public_values_length =
145 reduce(public_value_lengths,
size_t(0), [](
size_t acc,
size_t len) {
return acc + len; });
146 if(expected_public_values_length != concatenated_public_values.size()) {
147 throw Decoding_Error(
"Concatenated public values have an unexpected length");
150 BufferSlicer public_value_slicer(concatenated_public_values);
151 std::vector<std::unique_ptr<Public_Key>> pks;
152 pks.reserve(alg_ids.size());
153 for(
size_t idx = 0; idx < alg_ids.size(); ++idx) {
154 pks.emplace_back(
load_public_key(alg_ids[idx], public_value_slicer.
take(public_value_lengths[idx])));
157 return std::make_unique<Hybrid_KEM_PublicKey>(std::move(pks));
161 BOTAN_ARG_CHECK(pks.size() >= 2,
"List of public keys must include at least two keys");
162 BOTAN_ARG_CHECK(std::all_of(pks.begin(), pks.end(), [](
const auto& pk) { return pk != nullptr; }),
163 "List of public keys contains a nullptr");
167 return pk->supports_operation(PublicKeyOperation::KeyEncapsulation) ||
168 pk->supports_operation(PublicKeyOperation::KeyAgreement);
170 "Some provided public key is not compatible with this hybrid wrapper");
173 pks.begin(), pks.end(), std::back_inserter(
m_public_keys), [](
auto& key) -> std::unique_ptr<Public_Key> {
174 if(key->supports_operation(PublicKeyOperation::KeyAgreement) &&
175 !key->supports_operation(PublicKeyOperation::KeyEncapsulation)) {
176 return std::make_unique<KEX_to_KEM_Adapter_PublicKey>(std::move(key));
178 return std::move(key);
183 reduce(m_public_keys,
size_t(0), [](
size_t kl,
const auto& key) {
return std::max(kl, key->key_length()); });
184 m_estimated_strength =
reduce(
185 m_public_keys,
size_t(0), [](
size_t es,
const auto& key) {
return std::max(es, key->estimated_strength()); });
188std::string Hybrid_KEM_PublicKey::algo_name()
const {
189 std::ostringstream algo_name(
"Hybrid(");
190 for(
size_t i = 0; i < m_public_keys.size(); ++i) {
194 algo_name << m_public_keys[i]->algo_name();
197 return algo_name.str();
188std::string Hybrid_KEM_PublicKey::algo_name()
const {
…}
200size_t Hybrid_KEM_PublicKey::estimated_strength()
const {
201 return m_estimated_strength;
200size_t Hybrid_KEM_PublicKey::estimated_strength()
const {
…}
204size_t Hybrid_KEM_PublicKey::key_length()
const {
204size_t Hybrid_KEM_PublicKey::key_length()
const {
…}
209 return reduce(m_public_keys,
true, [&](
bool ckr,
const auto& key) {
return ckr && key->check_key(rng, strong); });
216std::vector<uint8_t> Hybrid_KEM_PublicKey::public_key_bits()
const {
217 return raw_public_key_bits();
216std::vector<uint8_t> Hybrid_KEM_PublicKey::public_key_bits()
const {
…}
220std::vector<uint8_t> Hybrid_KEM_PublicKey::raw_public_key_bits()
const {
228 return reduce(m_public_keys, std::vector<uint8_t>(), [](
auto pkb,
const auto& key) {
229 return concat(pkb, key->raw_public_key_bits());
220std::vector<uint8_t> Hybrid_KEM_PublicKey::raw_public_key_bits()
const {
…}
234 std::vector<std::unique_ptr<Private_Key>> new_private_keys;
236 m_public_keys.begin(), m_public_keys.end(), std::back_inserter(new_private_keys), [&](
const auto& public_key) {
237 return public_key->generate_another(rng);
239 return std::make_unique<Hybrid_KEM_PrivateKey>(std::move(new_private_keys));
251 std::string_view kdf,
252 std::string_view provider) :
253 PK_Ops::KEM_Encryption_with_KDF(kdf), m_raw_kem_shared_key_length(0), m_encapsulated_key_length(0) {
254 m_kem_encryptors.reserve(key.
public_keys().size());
256 const auto& newenc = m_kem_encryptors.emplace_back(*k,
"Raw", provider);
257 m_raw_kem_shared_key_length += newenc.shared_key_length(0 );
258 m_encapsulated_key_length += newenc.encapsulated_key_length();
262 size_t raw_kem_shared_key_length()
const override {
return m_raw_kem_shared_key_length; }
264 size_t encapsulated_key_length()
const override {
return m_encapsulated_key_length; }
266 void raw_kem_encrypt(std::span<uint8_t> out_encapsulated_key,
267 std::span<uint8_t> raw_shared_key,
272 BufferStuffer encaps_key_stuffer(out_encapsulated_key);
273 BufferStuffer shared_key_stuffer(raw_shared_key);
275 for(
auto& kem_enc : m_kem_encryptors) {
276 kem_enc.encrypt(encaps_key_stuffer.next(kem_enc.encapsulated_key_length()),
277 shared_key_stuffer.next(kem_enc.shared_key_length(0 )),
283 std::vector<PK_KEM_Encryptor> m_kem_encryptors;
284 size_t m_raw_kem_shared_key_length;
285 size_t m_encapsulated_key_length;
290std::unique_ptr<Botan::PK_Ops::KEM_Encryption> Hybrid_KEM_PublicKey::create_kem_encryption_op(
291 std::string_view kdf, std::string_view provider)
const {
292 return std::make_unique<Hybrid_KEM_Encryption_Operation>(*
this, kdf, provider);
290std::unique_ptr<Botan::PK_Ops::KEM_Encryption> Hybrid_KEM_PublicKey::create_kem_encryption_op( {
…}
297auto extract_public_keys(
const std::vector<std::unique_ptr<Private_Key>>& private_keys) {
298 std::vector<std::unique_ptr<Public_Key>> public_keys;
299 public_keys.reserve(private_keys.size());
300 for(
const auto& private_key : private_keys) {
301 BOTAN_ARG_CHECK(private_key !=
nullptr,
"List of private keys contains a nullptr");
302 public_keys.push_back(private_key->public_key());
309std::unique_ptr<Hybrid_KEM_PrivateKey> Hybrid_KEM_PrivateKey::generate_from_group(
Group_Params group,
311 const auto algo_spec = algorithm_specs_for_group(group);
312 std::vector<std::unique_ptr<Private_Key>> private_keys;
313 private_keys.reserve(algo_spec.size());
314 for(
const auto& spec : algo_spec) {
317 return std::make_unique<Hybrid_KEM_PrivateKey>(std::move(private_keys));
309std::unique_ptr<Hybrid_KEM_PrivateKey> Hybrid_KEM_PrivateKey::generate_from_group(
Group_Params group, {
…}
320Hybrid_KEM_PrivateKey::Hybrid_KEM_PrivateKey(std::vector<std::unique_ptr<Private_Key>> sks) :
322 BOTAN_ARG_CHECK(sks.size() >= 2,
"List of private keys must include at least two keys");
326 return sk->supports_operation(PublicKeyOperation::KeyEncapsulation) ||
327 sk->supports_operation(PublicKeyOperation::KeyAgreement);
329 "Some provided private key is not compatible with this hybrid wrapper");
332 sks.begin(), sks.end(), std::back_inserter(m_private_keys), [](
auto& key) -> std::unique_ptr<Private_Key> {
333 if(key->supports_operation(PublicKeyOperation::KeyAgreement) &&
334 !key->supports_operation(PublicKeyOperation::KeyEncapsulation)) {
335 auto ka_key = dynamic_cast<PK_Key_Agreement_Key*>(key.get());
336 BOTAN_ASSERT_NONNULL(ka_key);
338 return std::make_unique<KEX_to_KEM_Adapter_PrivateKey>(std::unique_ptr<PK_Key_Agreement_Key>(ka_key));
340 return std::move(key);
320Hybrid_KEM_PrivateKey::Hybrid_KEM_PrivateKey(std::vector<std::unique_ptr<Private_Key>> sks) : {
…}
350 return std::make_unique<Hybrid_KEM_PublicKey>(extract_public_keys(m_private_keys));
363 const std::string_view kdf,
364 const std::string_view provider) :
365 PK_Ops::KEM_Decryption_with_KDF(kdf), m_encapsulated_key_length(0), m_raw_kem_shared_key_length(0) {
368 const auto& newdec = m_decryptors.emplace_back(*private_key, rng,
"Raw", provider);
369 m_encapsulated_key_length += newdec.encapsulated_key_length();
370 m_raw_kem_shared_key_length += newdec.shared_key_length(0 );
374 void raw_kem_decrypt(std::span<uint8_t> out_shared_key, std::span<const uint8_t> encap_key)
override {
381 for(
auto& decryptor : m_decryptors) {
382 decryptor.decrypt(shared_secret_stuffer.next(decryptor.shared_key_length(0 )),
383 encap_key_slicer.take(decryptor.encapsulated_key_length()));
387 size_t encapsulated_key_length()
const override {
return m_encapsulated_key_length; }
389 size_t raw_kem_shared_key_length()
const override {
return m_raw_kem_shared_key_length; }
392 std::vector<PK_KEM_Decryptor> m_decryptors;
393 size_t m_encapsulated_key_length;
394 size_t m_raw_kem_shared_key_length;
401 return std::make_unique<Hybrid_KEM_Decryption>(*
this, rng, kdf, provider);
#define BOTAN_ASSERT_NOMSG(expr)
#define BOTAN_ARG_CHECK(expr, msg)
std::span< const uint8_t > take(const size_t count)
Helper class to ease in-place marshalling of concatenated fixed-length values.
bool check_key(RandomNumberGenerator &rng, bool strong) const override
std::unique_ptr< Public_Key > public_key() const override
std::unique_ptr< PK_Ops::KEM_Decryption > create_kem_decryption_op(RandomNumberGenerator &rng, std::string_view kdf, std::string_view provider="base") const override
const auto & private_keys() const
secure_vector< uint8_t > private_key_bits() const override
std::vector< std::unique_ptr< Public_Key > > m_public_keys
const auto & public_keys() const
Hybrid_KEM_PublicKey(std::vector< std::unique_ptr< Public_Key > > pks)
bool check_key(RandomNumberGenerator &rng, bool strong) const override
static std::unique_ptr< Hybrid_KEM_PublicKey > load_for_group(Group_Params group, std::span< const uint8_t > concatenated_public_values)
int(* final)(unsigned char *, CTX *)
std::unique_ptr< Private_Key > create_private_key(std::string_view alg_name, RandomNumberGenerator &rng, std::string_view params, std::string_view provider)
RetT reduce(const std::vector< KeyT > &keys, RetT acc, ReducerT reducer)
constexpr auto concat(Rs &&... ranges)
std::vector< T, secure_allocator< T > > secure_vector
std::unique_ptr< Public_Key > load_public_key(const AlgorithmIdentifier &alg_id, std::span< const uint8_t > key_bits)