|
1 /* |
|
2 * Copyright (c) 2003-2009 Nokia Corporation and/or its subsidiary(-ies). |
|
3 * All rights reserved. |
|
4 * This component and the accompanying materials are made available |
|
5 * under the terms of the License "Eclipse Public License v1.0" |
|
6 * which accompanies this distribution, and is available |
|
7 * at the URL "http://www.eclipse.org/legal/epl-v10.html". |
|
8 * |
|
9 * Initial Contributors: |
|
10 * Nokia Corporation - initial contribution. |
|
11 * |
|
12 * Contributors: |
|
13 * |
|
14 * Description: |
|
15 * |
|
16 */ |
|
17 |
|
18 |
|
19 #include <asymmetrickeys.h> |
|
20 #include <bigint.h> |
|
21 #include <random.h> |
|
22 #include <hash.h> |
|
23 #include "../common/inlines.h" |
|
24 #include "../bigint/mont.h" |
|
25 |
|
26 const TUint SHASIZE = 20; |
|
27 const TUint KMinPrimeLength = 512; |
|
28 const TUint KMaxPrimeLength = 1024; |
|
29 const TUint KPrimeLengthMultiple = 64; |
|
30 |
|
31 /* CDSAParameters */ |
|
32 |
|
33 EXPORT_C const TInteger& CDSAParameters::P(void) const |
|
34 { |
|
35 return iP; |
|
36 } |
|
37 |
|
38 EXPORT_C const TInteger& CDSAParameters::Q(void) const |
|
39 { |
|
40 return iQ; |
|
41 } |
|
42 |
|
43 EXPORT_C const TInteger& CDSAParameters::G(void) const |
|
44 { |
|
45 return iG; |
|
46 } |
|
47 |
|
48 EXPORT_C CDSAParameters::~CDSAParameters(void) |
|
49 { |
|
50 iP.Close(); |
|
51 iQ.Close(); |
|
52 iG.Close(); |
|
53 } |
|
54 |
|
55 EXPORT_C CDSAParameters* CDSAParameters::NewL(RInteger& aP, RInteger& aQ, |
|
56 RInteger& aG) |
|
57 { |
|
58 CDSAParameters* me = new (ELeave) CDSAParameters(aP, aQ, aG); |
|
59 return (me); |
|
60 } |
|
61 |
|
62 EXPORT_C TBool CDSAParameters::ValidatePrimesL(const CDSAPrimeCertificate& aCert) |
|
63 const |
|
64 { |
|
65 TBool result = EFalse; |
|
66 RInteger p; |
|
67 RInteger q; |
|
68 //Regenerate primes using aCert's seed and counter |
|
69 TUint counter = aCert.Counter(); |
|
70 if(!CDSAParameters::GeneratePrimesL(aCert.Seed(), counter, p, |
|
71 P().BitCount(), q, ETrue)) |
|
72 { |
|
73 return result; |
|
74 } |
|
75 //this doesn't leave, no need to push p and q |
|
76 if(p == P() && q == Q() && counter == aCert.Counter()) |
|
77 { |
|
78 result = ETrue; |
|
79 } |
|
80 p.Close(); |
|
81 q.Close(); |
|
82 return result; |
|
83 } |
|
84 |
|
85 EXPORT_C TBool CDSAParameters::ValidPrimeLength(TUint aPrimeBits) |
|
86 { |
|
87 return (aPrimeBits >= KMinPrimeLength && |
|
88 aPrimeBits <= KMaxPrimeLength && |
|
89 aPrimeBits % KPrimeLengthMultiple == 0); |
|
90 } |
|
91 |
|
92 EXPORT_C CDSAParameters::CDSAParameters(RInteger& aP, RInteger& aQ, |
|
93 RInteger& aG) : iP(aP), iQ(aQ), iG(aG) |
|
94 { |
|
95 } |
|
96 |
|
97 EXPORT_C CDSAParameters::CDSAParameters(void) |
|
98 { |
|
99 } |
|
100 |
|
101 TBool CDSAParameters::GeneratePrimesL(const TDesC8& aSeed, TUint& aCounter, |
|
102 RInteger& aP, TUint aL, RInteger& aQ, TBool aUseInputCounter) |
|
103 { |
|
104 //This follows the steps in FIPS 186-2 |
|
105 //See DSS Appendix 2.2 |
|
106 //Note. Step 1 is performed prior to calling GeneratePrimesL, so that this |
|
107 //routine can be used for both generation and validation. |
|
108 //Step 1. Choose an arbitrary sequence of at least 160 bits and call it |
|
109 //SEED. Let g be the length of SEED in bits. |
|
110 |
|
111 if(!CDSAParameters::ValidPrimeLength(aL)) |
|
112 { |
|
113 User::Leave(KErrNotSupported); |
|
114 } |
|
115 |
|
116 CSHA1* sha1 = CSHA1::NewL(); |
|
117 CleanupStack::PushL(sha1); |
|
118 |
|
119 HBufC8* seedBuf = aSeed.AllocLC(); |
|
120 TPtr8 seed = seedBuf->Des(); |
|
121 TUint gBytes = aSeed.Size(); |
|
122 //Note that the DSS's g = BytesToBits(gBytes) ie. the number of random bits |
|
123 //in the seed. |
|
124 //This function has made the assumption (for ease of computation) that g%8 |
|
125 //is 0. Ie the seed is a whole number of random bytes. |
|
126 TBuf8<SHASIZE> U; |
|
127 TBuf8<SHASIZE> temp; |
|
128 const TUint n = (aL-1)/160; |
|
129 const TUint b = (aL-1)%160; |
|
130 HBufC8* Wbuf = HBufC8::NewMaxLC((n+1) * SHASIZE); |
|
131 TUint8* W = const_cast<TUint8*>(Wbuf->Ptr()); |
|
132 |
|
133 U.Copy(sha1->Final(seed)); |
|
134 |
|
135 //Step 2. U = SHA-1[SEED] XOR SHA-1[(SEED+1) mod 2^g] |
|
136 for(TInt i=gBytes - 1, carry=ETrue; i>=0 && carry; i--) |
|
137 { |
|
138 //!++(TUint) adds one to the current word which if it overflows to zero |
|
139 //sets carry to 1 thus letting the loop continue. It's a poor man's |
|
140 //multi-word addition. Swift eh? |
|
141 carry = !++(seed[i]); |
|
142 } |
|
143 |
|
144 temp.Copy(sha1->Final(seed)); |
|
145 XorBuf(const_cast<TUint8*>(U.Ptr()), temp.Ptr(), SHASIZE); |
|
146 |
|
147 //Step 3. Form q from U by setting the most significant bit (2^159) |
|
148 //and the least significant bit to 1. |
|
149 U[0] |= 0x80; |
|
150 U[SHASIZE-1] |= 1; |
|
151 |
|
152 aQ = RInteger::NewL(U); |
|
153 CleanupStack::PushL(aQ); |
|
154 |
|
155 //Step 4. Use a robust primality testing algo to test if q is prime |
|
156 //The robust part is the calling codes problem. This will use whatever |
|
157 //random number generator you set for the thread. To attempt FIPS 186-2 |
|
158 //compliance, set a FIPS 186-2 compliant RNG. |
|
159 if( !aQ.IsPrimeL() ) |
|
160 { |
|
161 //Step 5. If not exit and get a new seed |
|
162 CleanupStack::PopAndDestroy(&aQ); |
|
163 CleanupStack::PopAndDestroy(Wbuf); |
|
164 CleanupStack::PopAndDestroy(seedBuf); |
|
165 CleanupStack::PopAndDestroy(sha1); |
|
166 return EFalse; |
|
167 } |
|
168 |
|
169 TUint counterEnd = aUseInputCounter ? aCounter+1 : 4096; |
|
170 |
|
171 //Step 6. Let counter = 0 and offset = 2 |
|
172 //Note 1. that the DSS speaks of SEED + offset + k because they always |
|
173 //refer to a constant SEED. We update our seed as we go so the offset |
|
174 //variable has already been added to seed in the previous iterations. |
|
175 //Note 2. We've already added 1 to our seed, so the first time through this |
|
176 //the offset in DSS speak will be 2. |
|
177 for(TUint counter=0; counter < counterEnd; counter++) |
|
178 { |
|
179 //Step 7. For k=0, ..., n let |
|
180 // Vk = SHA-1[(SEED + offset + k) mod 2^g] |
|
181 //I'm storing the Vk's inside of a big W buffer. |
|
182 for(TUint k=0; k<=n; k++) |
|
183 { |
|
184 for(TInt i=gBytes-1, carry=ETrue; i>=0 && carry; i--) |
|
185 { |
|
186 carry = !++(seed[i]); |
|
187 } |
|
188 if(!aUseInputCounter || counter == aCounter) |
|
189 { |
|
190 TPtr8 Wptr(W+(n-k)*SHASIZE, gBytes); |
|
191 Wptr.Copy(sha1->Final(seed)); |
|
192 } |
|
193 } |
|
194 if(!aUseInputCounter || counter == aCounter) |
|
195 { |
|
196 //Step 8. Let W be the integer... and let X = W + 2^(L-1) |
|
197 const_cast<TUint8&>((*Wbuf)[SHASIZE - 1 - b/8]) |= 0x80; |
|
198 TPtr8 Wptr(W + SHASIZE - 1 - b/8, aL/8, aL/8); |
|
199 RInteger X = RInteger::NewL(Wptr); |
|
200 CleanupStack::PushL(X); |
|
201 //Step 9. Let c = X mod 2q and set p = X - (c-1) |
|
202 RInteger twoQ = aQ.TimesL(TInteger::Two()); |
|
203 CleanupStack::PushL(twoQ); |
|
204 RInteger c = X.ModuloL(twoQ); |
|
205 CleanupStack::PushL(c); |
|
206 --c; |
|
207 aP = X.MinusL(c); |
|
208 CleanupStack::PopAndDestroy(3, &X); //twoQ, c, X |
|
209 CleanupStack::PushL(aP); |
|
210 |
|
211 //Step 10 and 11: if p >= 2^(L-1) and p is prime |
|
212 if( aP.Bit(aL-1) && aP.IsPrimeL() ) |
|
213 { |
|
214 aCounter = counter; |
|
215 CleanupStack::Pop(&aP); |
|
216 CleanupStack::Pop(&aQ); |
|
217 CleanupStack::PopAndDestroy(Wbuf); |
|
218 CleanupStack::PopAndDestroy(seedBuf); |
|
219 CleanupStack::PopAndDestroy(sha1); |
|
220 return ETrue; |
|
221 } |
|
222 CleanupStack::PopAndDestroy(&aP); |
|
223 } |
|
224 } |
|
225 CleanupStack::PopAndDestroy(&aQ); |
|
226 CleanupStack::PopAndDestroy(Wbuf); |
|
227 CleanupStack::PopAndDestroy(seedBuf); |
|
228 CleanupStack::PopAndDestroy(sha1); |
|
229 return EFalse; |
|
230 } |
|
231 |
|
232 /* CDSAPublicKey */ |
|
233 |
|
234 EXPORT_C CDSAPublicKey* CDSAPublicKey::NewL(RInteger& aP, RInteger& aQ, |
|
235 RInteger& aG, RInteger& aY) |
|
236 { |
|
237 CDSAPublicKey* self = new(ELeave) CDSAPublicKey(aP, aQ, aG, aY); |
|
238 return self; |
|
239 } |
|
240 |
|
241 EXPORT_C CDSAPublicKey* CDSAPublicKey::NewLC(RInteger& aP, RInteger& aQ, |
|
242 RInteger& aG, RInteger& aY) |
|
243 { |
|
244 CDSAPublicKey* self = NewL(aP, aQ, aG, aY); |
|
245 CleanupStack::PushL(self); |
|
246 return self; |
|
247 } |
|
248 |
|
249 EXPORT_C const TInteger& CDSAPublicKey::Y(void) const |
|
250 { |
|
251 return iY; |
|
252 } |
|
253 |
|
254 EXPORT_C CDSAPublicKey::CDSAPublicKey(void) |
|
255 { |
|
256 } |
|
257 |
|
258 EXPORT_C CDSAPublicKey::CDSAPublicKey(RInteger& aP, RInteger& aQ, RInteger& aG, |
|
259 RInteger& aY) : CDSAParameters(aP, aQ, aG), iY(aY) |
|
260 { |
|
261 } |
|
262 |
|
263 EXPORT_C CDSAPublicKey::~CDSAPublicKey(void) |
|
264 { |
|
265 iY.Close(); |
|
266 } |
|
267 |
|
268 /* CDSAPrivateKey */ |
|
269 |
|
270 EXPORT_C CDSAPrivateKey* CDSAPrivateKey::NewL(RInteger& aP, RInteger& aQ, |
|
271 RInteger& aG, RInteger& aX) |
|
272 { |
|
273 CDSAPrivateKey* self = new(ELeave) CDSAPrivateKey(aP, aQ, aG, aX); |
|
274 return self; |
|
275 } |
|
276 |
|
277 EXPORT_C CDSAPrivateKey* CDSAPrivateKey::NewLC(RInteger& aP, RInteger& aQ, |
|
278 RInteger& aG, RInteger& aX) |
|
279 { |
|
280 CDSAPrivateKey* self = NewL(aP, aQ, aG, aX); |
|
281 CleanupStack::PushL(self); |
|
282 return self; |
|
283 } |
|
284 |
|
285 EXPORT_C const TInteger& CDSAPrivateKey::X(void) const |
|
286 { |
|
287 return iX; |
|
288 } |
|
289 |
|
290 CDSAPrivateKey::CDSAPrivateKey(RInteger& aP, RInteger& aQ, RInteger& aG, |
|
291 RInteger& aX) : CDSAParameters(aP, aQ, aG), iX(aX) |
|
292 { |
|
293 } |
|
294 |
|
295 EXPORT_C CDSAPrivateKey::CDSAPrivateKey(void) |
|
296 { |
|
297 } |
|
298 |
|
299 EXPORT_C CDSAPrivateKey::~CDSAPrivateKey(void) |
|
300 { |
|
301 iX.Close(); |
|
302 } |
|
303 |
|
304 /* CDSAKeyPair */ |
|
305 |
|
306 EXPORT_C CDSAKeyPair* CDSAKeyPair::NewL(TUint aKeyBits) |
|
307 { |
|
308 CDSAKeyPair* self = NewLC(aKeyBits); |
|
309 CleanupStack::Pop(); |
|
310 return self; |
|
311 } |
|
312 |
|
313 EXPORT_C CDSAKeyPair* CDSAKeyPair::NewLC(TUint aKeyBits) |
|
314 { |
|
315 CDSAKeyPair* self = new(ELeave) CDSAKeyPair(); |
|
316 CleanupStack::PushL(self); |
|
317 self->ConstructL(aKeyBits); |
|
318 return self; |
|
319 } |
|
320 |
|
321 EXPORT_C const CDSAPublicKey& CDSAKeyPair::PublicKey(void) const |
|
322 { |
|
323 return *iPublic; |
|
324 } |
|
325 |
|
326 EXPORT_C const CDSAPrivateKey& CDSAKeyPair::PrivateKey(void) const |
|
327 { |
|
328 return *iPrivate; |
|
329 } |
|
330 |
|
331 EXPORT_C CDSAKeyPair::~CDSAKeyPair(void) |
|
332 { |
|
333 delete iPublic; |
|
334 delete iPrivate; |
|
335 delete iPrimeCertificate; |
|
336 } |
|
337 |
|
338 EXPORT_C CDSAKeyPair::CDSAKeyPair(void) |
|
339 { |
|
340 } |
|
341 |
|
342 EXPORT_C const CDSAPrimeCertificate& CDSAKeyPair::PrimeCertificate(void) const |
|
343 { |
|
344 return *iPrimeCertificate; |
|
345 } |
|
346 |
|
347 void CDSAKeyPair::ConstructL(TUint aPBits) |
|
348 { |
|
349 //This is the first step of DSA prime generation. The remaining steps are |
|
350 //performed in CDSAParameters::GeneratePrimesL |
|
351 //Step 1. Choose an arbitrary sequence of at least 160 bits and call it |
|
352 //SEED. Let g be the length of SEED in bits. |
|
353 TBuf8<SHASIZE> seed(SHASIZE); |
|
354 TUint c; |
|
355 RInteger p; |
|
356 RInteger q; |
|
357 do |
|
358 { |
|
359 GenerateRandomBytesL(seed); |
|
360 } |
|
361 while(!CDSAParameters::GeneratePrimesL(seed, c, p, aPBits, q)); |
|
362 //Double PushL will not fail as GeneratePrimesL uses the CleanupStack |
|
363 //(at least one push and pop ;) |
|
364 CleanupStack::PushL(p); |
|
365 CleanupStack::PushL(q); |
|
366 iPrimeCertificate = CDSAPrimeCertificate::NewL(seed, c); |
|
367 |
|
368 CMontgomeryStructure* montP = CMontgomeryStructure::NewLC(p); |
|
369 |
|
370 --p; |
|
371 |
|
372 // e = (p-1)/q |
|
373 RInteger e = p.DividedByL(q); |
|
374 CleanupStack::PushL(e); |
|
375 |
|
376 --p; //now it's p-2 :) |
|
377 |
|
378 RInteger h; |
|
379 const TInteger* g = 0; |
|
380 do |
|
381 { |
|
382 // find a random h | 1 < h < p-1 |
|
383 h = RInteger::NewRandomL(TInteger::Two(), p); |
|
384 CleanupStack::PushL(h); |
|
385 // g = h^e mod p |
|
386 g = &(montP->ExponentiateL(h, e)); |
|
387 CleanupStack::PopAndDestroy(&h); |
|
388 } |
|
389 while( *g <= TInteger::One() ); |
|
390 CleanupStack::PopAndDestroy(&e); |
|
391 |
|
392 ++p; //reincrement p to original value |
|
393 ++p; |
|
394 |
|
395 RInteger g1 = RInteger::NewL(*g); //take a copy of montP's g |
|
396 CleanupStack::PushL(g1); |
|
397 RInteger p1 = RInteger::NewL(p); |
|
398 CleanupStack::PushL(p1); |
|
399 RInteger q1 = RInteger::NewL(q); |
|
400 CleanupStack::PushL(q1); |
|
401 |
|
402 --q; |
|
403 // select random x | 0 < x < q |
|
404 RInteger x = RInteger::NewRandomL(TInteger::One(), q); |
|
405 CleanupStack::PushL(x); |
|
406 ++q; |
|
407 |
|
408 iPrivate = CDSAPrivateKey::NewL(p1, q1, g1, x); |
|
409 CleanupStack::Pop(4, &g1); //x,q1,p1,g1 -- all owned by iPrivate |
|
410 |
|
411 RInteger y = RInteger::NewL(montP->ExponentiateL(*g, iPrivate->X())); |
|
412 CleanupStack::PushL(y); |
|
413 RInteger g2 = RInteger::NewL(iPrivate->G()); |
|
414 CleanupStack::PushL(g2); |
|
415 iPublic = CDSAPublicKey::NewL(p, q, g2, y); |
|
416 CleanupStack::Pop(2, &y); //g2, y |
|
417 CleanupStack::PopAndDestroy(montP); |
|
418 CleanupStack::Pop(2, &p); //q, p |
|
419 } |
|
420 |
|
421 |
|
422 /* CDSAPrimeCertificate */ |
|
423 |
|
424 EXPORT_C CDSAPrimeCertificate* CDSAPrimeCertificate::NewL(const TDesC8& aSeed, |
|
425 TUint aCounter) |
|
426 { |
|
427 CDSAPrimeCertificate* self = NewLC(aSeed, aCounter); |
|
428 CleanupStack::Pop(); |
|
429 return self; |
|
430 } |
|
431 |
|
432 EXPORT_C CDSAPrimeCertificate* CDSAPrimeCertificate::NewLC(const TDesC8& aSeed, |
|
433 TUint aCounter) |
|
434 { |
|
435 CDSAPrimeCertificate* self = new(ELeave) CDSAPrimeCertificate(aCounter); |
|
436 CleanupStack::PushL(self); |
|
437 self->ConstructL(aSeed); |
|
438 return self; |
|
439 } |
|
440 |
|
441 EXPORT_C const TDesC8& CDSAPrimeCertificate::Seed(void) const |
|
442 { |
|
443 return *iSeed; |
|
444 } |
|
445 |
|
446 EXPORT_C TUint CDSAPrimeCertificate::Counter(void) const |
|
447 { |
|
448 return iCounter; |
|
449 } |
|
450 |
|
451 EXPORT_C CDSAPrimeCertificate::~CDSAPrimeCertificate(void) |
|
452 { |
|
453 delete const_cast<HBufC8*>(iSeed); |
|
454 } |
|
455 |
|
456 void CDSAPrimeCertificate::ConstructL(const TDesC8& aSeed) |
|
457 { |
|
458 iSeed = aSeed.AllocL(); |
|
459 } |
|
460 |
|
461 EXPORT_C CDSAPrimeCertificate::CDSAPrimeCertificate(TUint aCounter) |
|
462 : iCounter(aCounter) |
|
463 { |
|
464 } |
|
465 |
|
466 EXPORT_C CDSAPrimeCertificate::CDSAPrimeCertificate(void) |
|
467 { |
|
468 } |