1
/* LibTomCrypt, modular cryptographic library -- Tom St Denis
3
* LibTomCrypt is a library that provides various cryptographic
4
* algorithms in a highly modular and flexible manner.
6
* The library is free for all purposes without any express
9
* Tom St Denis, tomstdenis@iahu.ca, http://libtomcrypt.org
11
int dh_encrypt_key(const unsigned char *inkey, unsigned long keylen,
12
unsigned char *out, unsigned long *len,
13
prng_state *prng, int wprng, int hash,
16
unsigned char pub_expt[768], dh_shared[768], skey[MAXBLOCKSIZE];
18
unsigned long x, y, z, hashsize, pubkeysize;
21
_ARGCHK(inkey != NULL);
26
/* check that wprng/hash are not invalid */
27
if ((err = prng_is_valid(wprng)) != CRYPT_OK) {
31
if ((err = hash_is_valid(hash)) != CRYPT_OK) {
35
if (keylen > hash_descriptor[hash].hashsize) {
36
return CRYPT_INVALID_HASH;
39
/* make a random key and export the public copy */
40
if ((err = dh_make_key(prng, wprng, dh_get_size(key), &pubkey)) != CRYPT_OK) {
44
pubkeysize = sizeof(pub_expt);
45
if ((err = dh_export(pub_expt, &pubkeysize, PK_PUBLIC, &pubkey)) != CRYPT_OK) {
50
/* now check if the out buffer is big enough */
51
if (*len < (1 + 4 + 4 + PACKET_SIZE + pubkeysize + keylen)) {
53
return CRYPT_BUFFER_OVERFLOW;
57
hashsize = hash_descriptor[hash].hashsize;
59
x = (unsigned long)sizeof(dh_shared);
60
if ((err = dh_shared_secret(&pubkey, key, dh_shared, &x)) != CRYPT_OK) {
67
if ((err = hash_memory(hash, dh_shared, x, skey, &z)) != CRYPT_OK) {
72
packet_store_header(out, PACKET_SECT_DH, PACKET_SUB_ENC_KEY);
77
/* size of hash name and the name itself */
78
out[y++] = hash_descriptor[hash].ID;
80
/* length of DH pubkey and the key itself */
81
STORE32L(pubkeysize, out+y);
83
for (x = 0; x < pubkeysize; x++, y++) {
87
/* Store the encrypted key */
88
STORE32L(keylen, out+y);
91
for (x = 0; x < keylen; x++, y++) {
92
out[y] = skey[x] ^ inkey[x];
98
zeromem(pub_expt, sizeof(pub_expt));
99
zeromem(dh_shared, sizeof(dh_shared));
100
zeromem(skey, sizeof(skey));
106
int dh_decrypt_key(const unsigned char *in, unsigned long inlen,
107
unsigned char *outkey, unsigned long *keylen,
110
unsigned char shared_secret[768], skey[MAXBLOCKSIZE];
111
unsigned long x, y, z,hashsize, keysize;
116
_ARGCHK(outkey != NULL);
117
_ARGCHK(keylen != NULL);
118
_ARGCHK(key != NULL);
120
/* right key type? */
121
if (key->type != PK_PRIVATE) {
122
return CRYPT_PK_NOT_PRIVATE;
125
/* check if initial header should fit */
126
if (inlen < PACKET_SIZE+1+4+4) {
127
return CRYPT_INVALID_PACKET;
129
inlen -= PACKET_SIZE+1+4+4;
132
/* is header correct? */
133
if ((err = packet_valid_header((unsigned char *)in, PACKET_SECT_DH, PACKET_SUB_ENC_KEY)) != CRYPT_OK) {
137
/* now lets get the hash name */
139
hash = find_hash_id(in[y++]);
141
return CRYPT_INVALID_HASH;
145
hashsize = hash_descriptor[hash].hashsize;
150
/* now check if the imported key will fit */
152
return CRYPT_INVALID_PACKET;
158
if ((err = dh_import(in+y, x, &pubkey)) != CRYPT_OK) {
163
/* make shared key */
164
x = (unsigned long)sizeof(shared_secret);
165
if ((err = dh_shared_secret(key, &pubkey, shared_secret, &x)) != CRYPT_OK) {
172
if ((err = hash_memory(hash, shared_secret, x, skey, &z)) != CRYPT_OK) {
176
/* load in the encrypted key */
177
LOAD32L(keysize, in+y);
179
/* will the outkey fit as part of the input */
180
if (inlen < keysize) {
181
return CRYPT_INVALID_PACKET;
186
if (keysize > *keylen) {
187
err = CRYPT_BUFFER_OVERFLOW;
194
for (x = 0; x < keysize; x++, y++) {
195
outkey[x] = skey[x] ^ in[y];
201
zeromem(shared_secret, sizeof(shared_secret));
202
zeromem(skey, sizeof(skey));
207
/* perform an ElGamal Signature of a hash
209
* The math works as follows. x is the private key, M is the message to sign
212
2. compute a = g^k mod p
213
3. compute b = (M - xa)/k mod p
216
Now to verify with y=g^x mod p, a and b
218
1. compute y^a * a^b = g^(xa) * g^(k*(M-xa)/k)
222
2. Compare against g^M mod p [based on input hash].
223
3. If result of #2 == result of #1 then signature valid
225
int dh_sign_hash(const unsigned char *in, unsigned long inlen,
226
unsigned char *out, unsigned long *outlen,
227
prng_state *prng, int wprng, dh_key *key)
229
mp_int a, b, k, m, g, p, p1, tmp;
230
unsigned char buf[520];
235
_ARGCHK(out != NULL);
236
_ARGCHK(outlen != NULL);
237
_ARGCHK(key != NULL);
239
/* check parameters */
240
if (key->type != PK_PRIVATE) {
241
return CRYPT_PK_NOT_PRIVATE;
244
if ((err = prng_is_valid(wprng)) != CRYPT_OK) {
248
/* is the IDX valid ? */
249
if (is_valid_idx(key->idx) != 1) {
250
return CRYPT_PK_INVALID_TYPE;
253
/* make up a random value k,
254
* since the order of the group is prime
255
* we need not check if gcd(k, r) is 1
257
if (prng_descriptor[wprng].read(buf, sets[key->idx].size, prng) !=
258
(unsigned long)(sets[key->idx].size)) {
259
return CRYPT_ERROR_READPRNG;
263
if ((err = mp_init_multi(&a, &b, &k, &m, &p, &g, &p1, &tmp, NULL)) != MP_OKAY) {
264
return mpi_to_ltc_error(err);
268
if ((err = mp_read_unsigned_bin(&m, (unsigned char *)in, inlen)) != MP_OKAY) { goto error; }
270
if ((err = mp_read_unsigned_bin(&k, buf, MIN(32,sets[key->idx].size))) != MP_OKAY) { goto error; }
272
if ((err = mp_read_unsigned_bin(&k, buf, sets[key->idx].size)) != MP_OKAY) { goto error; }
275
/* load g, p and p1 */
276
if ((err = mp_read_radix(&g, sets[key->idx].base, 64)) != MP_OKAY) { goto error; }
277
if ((err = mp_read_radix(&p, sets[key->idx].prime, 64)) != MP_OKAY) { goto error; }
278
if ((err = mp_sub_d(&p, 1, &p1)) != MP_OKAY) { goto error; }
279
if ((err = mp_div_2(&p1, &p1)) != MP_OKAY) { goto error; } /* p1 = (p-1)/2 */
281
/* now get a = g^k mod p */
282
if ((err = mp_exptmod(&g, &k, &p, &a)) != MP_OKAY) { goto error; }
284
/* now find M = xa + kb mod p1 or just b = (M - xa)/k mod p1 */
285
if ((err = mp_invmod(&k, &p1, &k)) != MP_OKAY) { goto error; } /* k = 1/k mod p1 */
286
if ((err = mp_mulmod(&a, &key->x, &p1, &tmp)) != MP_OKAY) { goto error; } /* tmp = xa */
287
if ((err = mp_submod(&m, &tmp, &p1, &tmp)) != MP_OKAY) { goto error; } /* tmp = M - xa */
288
if ((err = mp_mulmod(&k, &tmp, &p1, &b)) != MP_OKAY) { goto error; } /* b = (M - xa)/k */
290
/* check for overflow */
291
if ((unsigned long)(PACKET_SIZE + 4 + 4 + mp_unsigned_bin_size(&a) + mp_unsigned_bin_size(&b)) > *outlen) {
292
err = CRYPT_BUFFER_OVERFLOW;
299
/* now store them both (a,b) */
300
x = (unsigned long)mp_unsigned_bin_size(&a);
301
STORE32L(x, out+y); y += 4;
302
if ((err = mp_to_unsigned_bin(&a, out+y)) != MP_OKAY) { goto error; }
305
x = (unsigned long)mp_unsigned_bin_size(&b);
306
STORE32L(x, out+y); y += 4;
307
if ((err = mp_to_unsigned_bin(&b, out+y)) != MP_OKAY) { goto error; }
310
/* check if size too big */
312
err = CRYPT_BUFFER_OVERFLOW;
317
packet_store_header(out, PACKET_SECT_DH, PACKET_SUB_SIGNED);
323
err = mpi_to_ltc_error(err);
325
mp_clear_multi(&tmp, &p1, &g, &p, &m, &k, &b, &a, NULL);
330
/* verify the signature in sig of the given hash */
331
int dh_verify_hash(const unsigned char *sig, unsigned long siglen,
332
const unsigned char *hash, unsigned long hashlen,
333
int *stat, dh_key *key)
335
mp_int a, b, p, g, m, tmp;
339
_ARGCHK(sig != NULL);
340
_ARGCHK(hash != NULL);
341
_ARGCHK(stat != NULL);
342
_ARGCHK(key != NULL);
344
/* default to invalid */
347
/* check initial input length */
348
if (siglen < PACKET_SIZE+4+4) {
349
return CRYPT_INVALID_PACKET;
353
if ((err = packet_valid_header((unsigned char *)sig, PACKET_SECT_DH, PACKET_SUB_SIGNED)) != CRYPT_OK) {
357
/* get hash out of packet */
360
/* init all bignums */
361
if ((err = mp_init_multi(&a, &p, &b, &g, &m, &tmp, NULL)) != MP_OKAY) {
362
return mpi_to_ltc_error(err);
366
INPUT_BIGNUM(&a, sig, x, y, siglen);
367
INPUT_BIGNUM(&b, sig, x, y, siglen);
370
if ((err = mp_read_radix(&p, sets[key->idx].prime, 64)) != MP_OKAY) { goto error1; }
371
if ((err = mp_read_radix(&g, sets[key->idx].base, 64)) != MP_OKAY) { goto error1; }
374
if ((err = mp_read_unsigned_bin(&m, (unsigned char *)hash, hashlen)) != MP_OKAY) { goto error1; }
377
if ((err = mp_exptmod(&g, &m, &p, &m)) != MP_OKAY) { goto error1; } /* m = g^m mod p */
380
if ((err = mp_exptmod(&key->y, &a, &p, &tmp)) != MP_OKAY) { goto error1; } /* tmp = y^a mod p */
381
if ((err = mp_exptmod(&a, &b, &p, &a)) != MP_OKAY) { goto error1; } /* a = a^b mod p */
382
if ((err = mp_mulmod(&a, &tmp, &p, &a)) != MP_OKAY) { goto error1; } /* a = y^a * a^b mod p */
384
/* y^a * a^b == g^m ??? */
385
if (mp_cmp(&a, &m) == 0) {
393
err = mpi_to_ltc_error(err);
396
mp_clear_multi(&tmp, &m, &g, &p, &b, &a, NULL);