kris/go-sike
1
0
Fork 0
程式碼 問題 合併請求 版本發布 Wiki 動態

WIP

瀏覽代碼
This commit is contained in:
Henry Case 2019-05-17 20:40:22 +01:00
父節點 bbec636c3e
當前提交 8379648ba4
共有 4 個檔案被更改，包括 160 行新增 和 162 行删除
顯示統計資料 下載 Patch 檔 下載差異檔 展開所有檔案 折疊所有檔案

116
consts.go
查看文件

@ -1,122 +1,6 @@
package sike
// I keep it bool in order to be able to apply logical NOT
type KeyVariant uint
// Representation of an element of the base field F_p.
//
// No particular meaning is assigned to the representation -- it could represent
// an element in Montgomery form, or not. Tracking the meaning of the field
// element is left to higher types.
type Fp [FP_WORDS]uint64
// Represents an intermediate product of two elements of the base field F_p.
type FpX2 [2 * FP_WORDS]uint64
// Represents an element of the extended field Fp^2 = Fp(x+i)
type Fp2 struct {
A Fp
B Fp
}
type DomainParams struct {
// P, Q and R=P-Q base points
Affine_P, Affine_Q, Affine_R Fp2
// Size of a compuatation strategy for x-torsion group
IsogenyStrategy []uint32
// Max size of secret key for x-torsion group
SecretBitLen uint
// Max size of secret key for x-torsion group
SecretByteLen uint
}
type SidhParams struct {
Id uint8
// Bytelen of P
Bytelen int
// The public key size, in bytes.
PublicKeySize int
// The shared secret size, in bytes.
SharedSecretSize int
// 2- and 3-torsion group parameter definitions
A, B DomainParams
// Precomputed identity element in the Fp2 in Montgomery domain
OneFp2 Fp2
// Precomputed 1/2 in the Fp2 in Montgomery domain
HalfFp2 Fp2
// Length of SIKE secret message. Must be one of {24,32,40},
// depending on size of prime field used (see [SIKE], 1.4 and 5.1)
MsgLen int
// Length of SIKE ephemeral KEM key (see [SIKE], 1.4 and 5.1)
KemSize int
// Size of a ciphertext returned by encapsulation in bytes
CiphertextSize int
}
// Stores curve projective parameters equivalent to A/C. Meaning of the
// values depends on the context. When working with isogenies over
// subgroup that are powers of:
// * three then (A:C) ~ (A+2C:A-2C)
// * four then (A:C) ~ (A+2C: 4C)
// See Appendix A of SIKE for more details
type CurveCoefficientsEquiv struct {
A Fp2
C Fp2
}
// A point on the projective line P^1(F_{p^2}).
//
// This represents a point on the Kummer line of a Montgomery curve. The
// curve is specified by a ProjectiveCurveParameters struct.
type ProjectivePoint struct {
X Fp2
Z Fp2
}
// Base type for public and private key. Used mainly to carry domain
// parameters.
type key struct {
// Domain parameters of the algorithm to be used with a key
params *SidhParams
// Flag indicates wether corresponds to 2-, 3-torsion group or SIKE
keyVariant KeyVariant
}
// Defines operations on private key
type PrivateKey struct {
key
// Secret key
Scalar []byte
// Used only by KEM
S []byte
}
// Defines operations on public key
type PublicKey struct {
key
affine_xP Fp2
affine_xQ Fp2
affine_xQmP Fp2
}
// A point on the projective line P^1(F_{p^2}).
//
// This is used to work projectively with the curve coefficients.
type ProjectiveCurveParameters struct {
A Fp2
C Fp2
}
const (
// First 2 bits identify SIDH variant third bit indicates
// wether key is a SIKE variant (set) or SIDH (not set)
// 001 - SIDH: corresponds to 2-torsion group
KeyVariant_SIDH_A KeyVariant = 1 << 0
// 010 - SIDH: corresponds to 3-torsion group
KeyVariant_SIDH_B = 1 << 1
// 110 - SIKE
KeyVariant_SIKE = 1<<2 | KeyVariant_SIDH_B
// Number of uint64 limbs used to store field element
FP_WORDS = 8
)

80
sike.go
查看文件

@ -7,6 +7,13 @@ import (
"io"
)
const (
// n can is max 320-bit (see 1.4 of [SIKE])
MaxMsgLen = 40
MaxSharedSecretSize = 188
MaxSecretByteLenA = 47
)
var cshakeG, cshakeH, cshakeF *shake.CShake
func init() {
@ -52,7 +59,7 @@ func zeroize(fp *Fp2) {
//
// The output byte slice must be at least 2*bytelen(p) bytes long.
func convFp2ToBytes(output []byte, fp2 *Fp2) {
if len(output) < 2*Params.Bytelen {
if len(output) < Params.SharedSecretSize {
panic("output byte slice too short")
}
var a Fp2
@ -72,7 +79,7 @@ func convFp2ToBytes(output []byte, fp2 *Fp2) {
//
// It is an error to call this function if the input byte slice is less than 2*bytelen(p) bytes long.
func convBytesToFp2(fp2 *Fp2, input []byte) {
if len(input) < 2*Params.Bytelen {
if len(input) < Params.SharedSecretSize {
panic("input byte slice too short")
}
@ -369,8 +376,8 @@ func deriveSecretB(ss []byte, prv *PrivateKey, pub *PublicKey) {
}
func generateCiphertext(ctext []byte, skA *PrivateKey, pkA, pkB *PublicKey, ptext []byte) error {
var n [40]byte // OZAPTF n can is max 320-bit (see 1.4 of [SIKE])
var j [126]byte
var n [MaxMsgLen]byte
var j [MaxSharedSecretSize]byte
var ptextLen = len(ptext)
if pkB.keyVariant != KeyVariant_SIKE {
@ -383,7 +390,7 @@ func generateCiphertext(ctext []byte, skA *PrivateKey, pkA, pkB *PublicKey, ptex
}
cshakeF.Reset()
cshakeF.Write(j[:2*Params.Bytelen])
cshakeF.Write(j[:Params.SharedSecretSize])
cshakeF.Read(n[:ptextLen])
for i, _ := range ptext {
n[i] ^= ptext[i]
@ -447,12 +454,9 @@ func (pub *PublicKey) Size() int {
// Exports currently stored key. In case structure hasn't been filled with key data
// returned byte string is filled with zeros.
func (prv *PrivateKey) Export() []byte {
// OZAPTF
ret := make([]byte, len(prv.Scalar)+len(prv.S))
copy(ret, prv.S)
copy(ret[len(prv.S):], prv.Scalar)
return ret
func (prv *PrivateKey) Export(out []byte) {
copy(out, prv.S)
copy(out[len(prv.S):], prv.Scalar)
}
// Size returns size of the private key in bytes
@ -579,7 +583,7 @@ func encrypt(ctext []byte, rng io.Reader, pub *PublicKey, ptext []byte) error {
// Constant time
func decrypt(n []byte, prv *PrivateKey, ctext []byte) (int, error) {
var c1_len int
var j [2 * 63]byte // OZAPTF: 63
var j [MaxSharedSecretSize]byte
var pk_len = prv.params.PublicKeySize
if prv.keyVariant != KeyVariant_SIKE {
@ -604,7 +608,7 @@ func decrypt(n []byte, prv *PrivateKey, ctext []byte) (int, error) {
}
cshakeF.Reset()
cshakeF.Write(j[:2*Params.Bytelen])
cshakeF.Write(j[:Params.SharedSecretSize])
cshakeF.Read(n[:c1_len])
for i, _ := range n[:c1_len] {
n[i] ^= ctext[pk_len+i]
@ -616,8 +620,8 @@ func decrypt(n []byte, prv *PrivateKey, ctext []byte) (int, error) {
func (kem *KEM) Allocate(rng io.Reader) {
kem.allocated = true
kem.rng = rng
kem.msg = make([]byte, 24)
kem.secretBytes = make([]byte, 32)
kem.msg = make([]byte, Params.MsgLen)
kem.secretBytes = make([]byte, Params.A.SecretByteLen)
}
func (kem *KEM) Reset() {
@ -638,30 +642,22 @@ func (kem *KEM) SharedSecretSize() int {
return Params.KemSize
}
const (
// See [SIKE], 1.4
MaxMsgLen = 40
MaxPublicKey = 378
)
// Encapsulation receives the public key and generates SIKE ciphertext and shared secret.
// The generated ciphertext is used for authentication.
// The rng must be cryptographically secure PRNG.
// Error is returned in case PRNG fails or wrongly formated input was provided.
func (kem *KEM) Encapsulate(ciphertext, secret []byte, pub *PublicKey) error {
if !kem.allocated {
panic("KEM unallocated")
}
// OZAPTF: MaxBuf: 3*SharedSecretSize
var buf [3 * 126]byte
var buf [3 * MaxSharedSecretSize]byte
var skA = PrivateKey{
key: key{
params: &Params,
keyVariant: KeyVariant_SIDH_A},
Scalar: kem.secretBytes}
if !kem.allocated {
panic("KEM unallocated")
}
// Generate ephemeral value
_, err := io.ReadFull(kem.rng, kem.msg[:])
if err != nil {
@ -671,7 +667,7 @@ func (kem *KEM) Encapsulate(ciphertext, secret []byte, pub *PublicKey) error {
pub.Export(buf[:])
cshakeG.Reset()
cshakeG.Write(kem.msg)
cshakeG.Write(buf[:])
cshakeG.Write(buf[:3*Params.SharedSecretSize])
cshakeG.Read(skA.Scalar)
// Ensure bitlength is not bigger then to 2^e2-1
@ -696,16 +692,15 @@ func (kem *KEM) Encapsulate(ciphertext, secret []byte, pub *PublicKey) error {
// Decapsulation may fail in case input is wrongly formated.
// Constant time for properly initialized input.
func (kem *KEM) Decapsulate(secret []byte, prv *PrivateKey, pub *PublicKey, ctext []byte) error {
// Resulting shared secret
var c0 [3 * 126]byte
var r [32]byte // OZAPTF: to change
var keyBuf [3 * 126]byte
var m [40]byte // OZAPTF: to change
var m [MaxMsgLen]byte
var r [MaxSecretByteLenA]byte
var pkBytes [3 * MaxSharedSecretSize]byte
var skA = PrivateKey{
key: key{
params: &Params,
keyVariant: KeyVariant_SIDH_A},
Scalar: kem.secretBytes}
var pkA = NewPublicKey(KeyVariant_SIDH_A)
c1_len, err := decrypt(m[:], prv, ctext)
if err != nil {
@ -714,21 +709,18 @@ func (kem *KEM) Decapsulate(secret []byte, prv *PrivateKey, pub *PublicKey, ctex
// r' = G(m'||pub)
//var key = make([]byte, pub.Size()+2*Params.MsgLen)
pub.Export(keyBuf[:])
pub.Export(pkBytes[:])
cshakeG.Reset()
cshakeG.Write(m[:c1_len])
cshakeG.Write(keyBuf[:])
cshakeG.Read(r[:])
cshakeG.Write(pkBytes[:3*pub.params.SharedSecretSize])
cshakeG.Read(r[:pub.params.A.SecretByteLen])
// Ensure bitlength is not bigger than 2^e2-1
r[len(r)-1] &= (1 << (pub.params.A.SecretBitLen % 8)) - 1
r[pub.params.A.SecretByteLen-1] &= (1 << (pub.params.A.SecretBitLen % 8)) - 1
// Never fails
skA.Import(r[:])
// Never fails
pkA := NewPublicKey(KeyVariant_SIDH_A)
skA.Import(r[:pub.params.A.SecretByteLen])
skA.GeneratePublicKey(pkA)
pkA.Export(c0[:])
pkA.Export(pkBytes[:])
// S is chosen at random when generating a key and unknown to other party. It
// may seem weird, but it's correct. It is important that S is unpredictable
@ -737,7 +729,7 @@ func (kem *KEM) Decapsulate(secret []byte, prv *PrivateKey, pub *PublicKey, ctex
//
// See more details in "On the security of supersingular isogeny cryptosystems"
// (S. Galbraith, et al., 2016, ePrint #859).
mask := subtle.ConstantTimeCompare(c0[:pub.params.PublicKeySize], ctext[:pub.params.PublicKeySize])
mask := subtle.ConstantTimeCompare(pkBytes[:pub.params.PublicKeySize], ctext[:pub.params.PublicKeySize])
cpick(mask, m[:c1_len], m[:c1_len], prv.S)
cshakeH.Reset()
cshakeH.Write(m[:c1_len])

6
sike_test.go
查看文件

@ -172,6 +172,7 @@ func testPrivateKeyBelowMax(t testing.TB) {
func(v KeyVariant, dp *DomainParams) {
var blen = int(dp.SecretByteLen)
var prv = NewPrivateKey(v)
var secretBytes = make([]byte, prv.Size())
// Calculate either (2^e2 - 1) or (2^s - 1); where s=ceil(log_2(3^e3)))
maxSecertVal := big.NewInt(int64(dp.SecretBitLen))
@ -184,7 +185,7 @@ func testPrivateKeyBelowMax(t testing.TB) {
checkErr(t, err, "Private key generation")
// Convert to big-endian, as that's what expected by (*Int)SetBytes()
secretBytes := prv.Export()
prv.Export(secretBytes)
for i := 0; i < int(blen/2); i++ {
tmp := secretBytes[i] ^ secretBytes[blen-i-1]
secretBytes[i] = tmp ^ secretBytes[i]
@ -484,7 +485,8 @@ func TestNegativeKEMSameWrongResult(t *testing.T) {
"pre-requisite for a test failed")
// second decapsulation must be done with same, but imported private key
expSk := sk.Export()
var expSk = make([]byte, sk.Size())
sk.Export(expSk)
// creat new private key
sk = NewPrivateKey(KeyVariant_SIKE)

120
types.go Normal file
查看文件

@ -0,0 +1,120 @@
package sike
// I keep it bool in order to be able to apply logical NOT
type KeyVariant uint
// Representation of an element of the base field F_p.
//
// No particular meaning is assigned to the representation -- it could represent
// an element in Montgomery form, or not. Tracking the meaning of the field
// element is left to higher types.
type Fp [FP_WORDS]uint64
// Represents an intermediate product of two elements of the base field F_p.
type FpX2 [2 * FP_WORDS]uint64
// Represents an element of the extended field Fp^2 = Fp(x+i)
type Fp2 struct {
A Fp
B Fp
}
type DomainParams struct {
// P, Q and R=P-Q base points
Affine_P, Affine_Q, Affine_R Fp2
// Size of a compuatation strategy for x-torsion group
IsogenyStrategy []uint32
// Max size of secret key for x-torsion group
SecretBitLen uint
// Max size of secret key for x-torsion group
SecretByteLen uint
}
type SidhParams struct {
Id uint8
// Bytelen of P
Bytelen int
// The public key size, in bytes.
PublicKeySize int
// The shared secret size, in bytes.
SharedSecretSize int
// 2- and 3-torsion group parameter definitions
A, B DomainParams
// Precomputed identity element in the Fp2 in Montgomery domain
OneFp2 Fp2
// Precomputed 1/2 in the Fp2 in Montgomery domain
HalfFp2 Fp2
// Length of SIKE secret message. Must be one of {24,32,40},
// depending on size of prime field used (see [SIKE], 1.4 and 5.1)
MsgLen int
// Length of SIKE ephemeral KEM key (see [SIKE], 1.4 and 5.1)
KemSize int
// Size of a ciphertext returned by encapsulation in bytes
CiphertextSize int
}
// Stores curve projective parameters equivalent to A/C. Meaning of the
// values depends on the context. When working with isogenies over
// subgroup that are powers of:
// * three then (A:C) ~ (A+2C:A-2C)
// * four then (A:C) ~ (A+2C: 4C)
// See Appendix A of SIKE for more details
type CurveCoefficientsEquiv struct {
A Fp2
C Fp2
}
// A point on the projective line P^1(F_{p^2}).
//
// This represents a point on the Kummer line of a Montgomery curve. The
// curve is specified by a ProjectiveCurveParameters struct.
type ProjectivePoint struct {
X Fp2
Z Fp2
}
// Base type for public and private key. Used mainly to carry domain
// parameters.
type key struct {
// Domain parameters of the algorithm to be used with a key
params *SidhParams
// Flag indicates wether corresponds to 2-, 3-torsion group or SIKE
keyVariant KeyVariant
}
// Defines operations on private key
type PrivateKey struct {
key
// Secret key
Scalar []byte
// Used only by KEM
S []byte
}
// Defines operations on public key
type PublicKey struct {
key
affine_xP Fp2
affine_xQ Fp2
affine_xQmP Fp2
}
// A point on the projective line P^1(F_{p^2}).
//
// This is used to work projectively with the curve coefficients.
type ProjectiveCurveParameters struct {
A Fp2
C Fp2
}
const (
// First 2 bits identify SIDH variant third bit indicates
// wether key is a SIKE variant (set) or SIDH (not set)
// 001 - SIDH: corresponds to 2-torsion group
KeyVariant_SIDH_A KeyVariant = 1 << 0
// 010 - SIDH: corresponds to 3-torsion group
KeyVariant_SIDH_B = 1 << 1
// 110 - SIKE
KeyVariant_SIKE = 1<<2 | KeyVariant_SIDH_B
)