From eb8ff0931f00304b0ad437961a9c3003c3bcc1ed Mon Sep 17 00:00:00 2001 From: Rudolf Polzer Date: Sun, 25 Apr 2010 15:52:09 +0200 Subject: [PATCH] embed a diffie hellmann key exchange --- d0_blind_id.c | 122 ++++++++++++++++++++++++++++++++++---------------- d0_blind_id.h | 5 ++- main.c | 20 ++++++--- 3 files changed, 101 insertions(+), 46 deletions(-) diff --git a/d0_blind_id.c b/d0_blind_id.c index 6732455..aa38d45 100644 --- a/d0_blind_id.c +++ b/d0_blind_id.c @@ -60,6 +60,7 @@ struct d0_blind_id_s d0_bignum_t *e; // challenge char msg[MSGSIZE]; // message size_t msglen; // message length + d0_bignum_t *other_4_to_r; // for DH key exchange }; #define CHECK(x) do { if(!(x)) goto fail; } while(0) @@ -220,6 +221,7 @@ void d0_blind_id_copy(d0_blind_id_t *ctx, const d0_blind_id_t *src) if(src->rn) ctx->rn = d0_bignum_mov(NULL, src->rn); if(src->r) ctx->r = d0_bignum_mov(NULL, src->r); if(src->e) ctx->e = d0_bignum_mov(NULL, src->e); + if(src->other_4_to_r) ctx->other_4_to_r = d0_bignum_mov(NULL, src->other_4_to_r); // TODO xnbh, msg, msglen? } @@ -265,7 +267,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_key(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *out; + d0_iobuf_t *out = NULL; USING(rsa_n); USING(rsa_e); USING(rsa_d); @@ -282,7 +284,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_write_public_key(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *out; + d0_iobuf_t *out = NULL; USING(rsa_n); USING(rsa_e); @@ -322,7 +324,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_id_modulus(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *out; + d0_iobuf_t *out = NULL; USING(schnorr_G); @@ -353,7 +355,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_generate_private_id_request(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *out; + d0_iobuf_t *out = NULL; // temps: temp0 temp1 USING(rsa_n); USING(rsa_e); USING(schnorr_4_to_s); @@ -374,8 +376,8 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_answer_private_id_request(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *in; - d0_iobuf_t *out; + d0_iobuf_t *in = NULL; + d0_iobuf_t *out = NULL; // temps: temp0 temp1 USING(rsa_d); USING(rsa_n); @@ -398,7 +400,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_finish_private_id_request(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen) { - d0_iobuf_t *in; + d0_iobuf_t *in = NULL; // temps: temp0 temp1 USING(rn); USING(rsa_n); @@ -419,7 +421,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_read_private_id(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen) { - d0_iobuf_t *in; + d0_iobuf_t *in = NULL; REPLACING(schnorr_s); REPLACING(schnorr_4_to_s); REPLACING(schnorr_4_to_s_signature); @@ -438,7 +440,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_read_public_id(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen) { - d0_iobuf_t *in; + d0_iobuf_t *in = NULL; REPLACING(schnorr_4_to_s); REPLACING(schnorr_4_to_s_signature); @@ -456,7 +458,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *out; + d0_iobuf_t *out = NULL; USING(schnorr_s); USING(schnorr_4_to_s); USING(schnorr_4_to_s_signature); @@ -475,7 +477,7 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_write_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *out; + d0_iobuf_t *out = NULL; USING(schnorr_4_to_s); USING(schnorr_4_to_s_signature); @@ -496,9 +498,9 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_start(d0_blind_ // first run: send 4^s, 4^s signature // 1. get random r, send HASH(4^r) { - d0_iobuf_t *out; - unsigned char convbuf[1024]; - d0_iobuf_t *conv; + d0_iobuf_t *out = NULL; + static unsigned char convbuf[1024]; + d0_iobuf_t *conv = NULL; size_t sz; if(is_first) @@ -548,8 +550,8 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_challenge(d0_bl // 2. save HASH(4^r) // 3. send challenge e of SCHNORR_BITS { - d0_iobuf_t *in; - d0_iobuf_t *out; + d0_iobuf_t *in = NULL; + d0_iobuf_t *out = NULL; if(is_first) { @@ -602,6 +604,15 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_challenge(d0_bl CHECK(d0_iobuf_write_bignum(out, ctx->e)); + if(is_first) + { + // Diffie Hellmann + CHECK(d0_dl_get_order(temp0, ctx->schnorr_G)); + CHECK_ASSIGN(ctx->r, d0_bignum_rand_range(ctx->r, zero, temp0)); + CHECK(d0_bignum_mod_pow(temp0, four, ctx->r, ctx->schnorr_G)); + CHECK(d0_iobuf_write_bignum(out, temp0)); + } + if(status) *status = !!d0_bignum_cmp(ctx->schnorr_4_to_s_signature, zero); @@ -614,12 +625,12 @@ fail: return 0; } -WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen) +WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, BOOL is_first, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen) // 1. read challenge e of SCHNORR_BITS // 2. reply with r + s * e mod order { - d0_iobuf_t *in; - d0_iobuf_t *out; + d0_iobuf_t *in = NULL; + d0_iobuf_t *out = NULL; // temps: 0 order, 1 prod, 2 y, 3 e USING(schnorr_G); USING(schnorr_s); USING(r); @@ -628,10 +639,17 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_bli out = d0_iobuf_open_write(outbuf, *outbuflen); CHECK(d0_iobuf_read_bignum(in, temp3)); - // TODO check if >= 2^SCHNORR_BITS or < 0, if yes, then fail (needed for zero knowledge) CHECK(d0_bignum_cmp(temp3, zero) >= 0); CHECK(d0_bignum_size(temp3) <= SCHNORR_BITS); + if(is_first) + { + // Diffie Hellmann + CHECK_ASSIGN(ctx->other_4_to_r, d0_iobuf_read_bignum(in, ctx->other_4_to_r)); + CHECK(d0_bignum_cmp(ctx->other_4_to_r, zero) > 0); + CHECK(d0_bignum_cmp(ctx->other_4_to_r, ctx->schnorr_G) < 0); + } + // send response for schnorr ID scheme // i.e. r + ctx->schnorr_s * temp3 CHECK(d0_dl_get_order(temp0, ctx->schnorr_G)); @@ -648,14 +666,14 @@ fail: return 0; } -WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, ssize_t *msglen, BOOL *status) +WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, size_t *msglen, BOOL *status) // 1. read y = r + s * e mod order // 2. verify: g^y (g^s)^-e = g^(r+s*e-s*e) = g^r // (check using H(g^r) which we know) { - d0_iobuf_t *in; - unsigned char convbuf[1024]; - d0_iobuf_t *conv; + d0_iobuf_t *in = NULL; + static unsigned char convbuf[1024]; + d0_iobuf_t *conv = NULL; size_t sz; // temps: 0 y 1 order @@ -663,7 +681,6 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind in = d0_iobuf_open_read(inbuf, inbuflen); - *msglen = -1; CHECK(d0_dl_get_order(temp1, ctx->schnorr_G)); CHECK(d0_iobuf_read_bignum(in, temp0)); CHECK(d0_bignum_cmp(temp0, zero) >= 0); @@ -674,14 +691,14 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind CHECK(d0_bignum_neg(temp1, ctx->e)); CHECK(d0_bignum_mod_pow(temp2, ctx->schnorr_4_to_s, temp1, ctx->schnorr_G)); CHECK(d0_bignum_mod_pow(temp1, four, temp0, ctx->schnorr_G)); - CHECK(d0_bignum_mod_mul(temp3, temp1, temp2, ctx->schnorr_G)); + CHECK_ASSIGN(ctx->other_4_to_r, d0_bignum_mod_mul(ctx->other_4_to_r, temp1, temp2, ctx->schnorr_G)); // hash must be equal to xnbh // hash it, hash it, everybody hash it conv = d0_iobuf_open_write(convbuf, sizeof(convbuf)); - CHECK(d0_iobuf_write_bignum(conv, temp3)); + CHECK(d0_iobuf_write_bignum(conv, ctx->other_4_to_r)); CHECK(d0_iobuf_write_packet(conv, ctx->msg, ctx->msglen)); - CHECK(d0_iobuf_write_bignum(conv, temp3)); + CHECK(d0_iobuf_write_bignum(conv, ctx->other_4_to_r)); d0_iobuf_close(conv, &sz); conv = NULL; if(memcmp(sha(convbuf, sz), ctx->xnbh, SCHNORR_HASHSIZE)) @@ -693,7 +710,7 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind if(status) *status = !!d0_bignum_cmp(ctx->schnorr_4_to_s_signature, zero); - if(ctx->msglen <= (size_t) *msglen) + if(ctx->msglen <= *msglen) memcpy(msg, ctx->msg, ctx->msglen); else memcpy(msg, ctx->msg, *msglen); @@ -709,9 +726,9 @@ fail: WARN_UNUSED_RESULT BOOL d0_blind_id_fingerprint64_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) { - d0_iobuf_t *out; - d0_iobuf_t *conv; + d0_iobuf_t *out = NULL; static unsigned char convbuf[1024]; + d0_iobuf_t *conv = NULL; size_t sz, n; USING(schnorr_4_to_s); @@ -726,18 +743,47 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_fingerprint64_public_id(d0_blind_id_t *ctx, n = (*outbuflen / 4) * 3; if(n > SHA_DIGESTSIZE) n = SHA_DIGESTSIZE; - if(d0_iobuf_write_raw(out, sha(convbuf, sz), n) != n) - goto fail; - if(!d0_iobuf_conv_base64_out(out)) - goto fail; + CHECK(d0_iobuf_write_raw(out, sha(convbuf, sz), n) == n); + CHECK(d0_iobuf_conv_base64_out(out)); return d0_iobuf_close(out, outbuflen); fail: if(conv) - if(!d0_iobuf_close(conv, &sz)) { } - if(!d0_iobuf_close(out, outbuflen)) - return 0; + d0_iobuf_close(conv, &sz); + d0_iobuf_close(out, outbuflen); + return 0; +} + +BOOL d0_blind_id_sessionkey_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen) +{ + d0_iobuf_t *out = NULL; + static unsigned char convbuf[1024]; + d0_iobuf_t *conv = NULL; + size_t n, sz; + + USING(r); USING(other_4_to_r); + + out = d0_iobuf_open_write(outbuf, *outbuflen); + conv = d0_iobuf_open_write(convbuf, sizeof(convbuf)); + + // temps: temp0 result + CHECK(d0_bignum_mod_pow(temp0, ctx->other_4_to_r, ctx->r, ctx->schnorr_G)); + CHECK(d0_iobuf_write_bignum(conv, temp0)); + CHECK(d0_iobuf_close(conv, &sz)); + conv = NULL; + + n = *outbuflen; + if(n > SHA_DIGESTSIZE) + n = SHA_DIGESTSIZE; + CHECK(d0_iobuf_write_raw(out, sha(convbuf, sz), n) == n); + + return d0_iobuf_close(out, outbuflen); + +fail: + if(conv) + d0_iobuf_close(conv, &sz); + d0_iobuf_close(out, outbuflen); return 0; } diff --git a/d0_blind_id.h b/d0_blind_id.h index e962a47..e84d4b8 100644 --- a/d0_blind_id.h +++ b/d0_blind_id.h @@ -27,9 +27,10 @@ EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_id(d0_blind_id_t *ctx, EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_write_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen); EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_start(d0_blind_id_t *ctx, BOOL is_first, BOOL send_modulus, char *message, size_t msglen, char *outbuf, size_t *outbuflen); EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_challenge(d0_blind_id_t *ctx, BOOL is_first, BOOL recv_modulus, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen, BOOL *status); -EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen); -EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, ssize_t *msglen, BOOL *status); +EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, BOOL is_first, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen); +EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, size_t *msglen, BOOL *status); EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_fingerprint64_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen); +EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_sessionkey_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen); // can only be done after successful key exchange, this performs a modpow; key length is limited by SHA_DIGESTSIZE for now EXPORT void d0_blind_id_INITIALIZE(void); EXPORT void d0_blind_id_SHUTDOWN(void); diff --git a/main.c b/main.c index 5da16d0..249e604 100644 --- a/main.c +++ b/main.c @@ -46,7 +46,7 @@ void mysignal(int signo) int main(int argc, char **argv) { char buf[65536]; size_t bufsize; - char buf2[65536]; size_t buf2size; ssize_t buf2ssize; + char buf2[65536]; size_t buf2size; d0_blind_id_t *ctx_self, *ctx_other; d0_blind_id_INITIALIZE(); @@ -106,7 +106,7 @@ int main(int argc, char **argv) errx(8, "readpub2 fail"); n = 0; - double bench_auth = 0, bench_chall = 0, bench_resp = 0, bench_verify = 0; + double bench_auth = 0, bench_chall = 0, bench_resp = 0, bench_verify = 0, bench_dhkey1 = 0, bench_dhkey2 = 0; BOOL status; while(!quit) { @@ -117,19 +117,27 @@ int main(int argc, char **argv) buf2size = sizeof(buf2); if(!d0_blind_id_authenticate_with_private_id_challenge(ctx_self, 1, 1, buf, bufsize, buf2, &buf2size, NULL)) errx(10, "challenge fail"); bench(&bench_resp); - bufsize = sizeof(buf); if(!d0_blind_id_authenticate_with_private_id_response(ctx_other, buf2, buf2size, buf, &bufsize)) + bufsize = sizeof(buf); if(!d0_blind_id_authenticate_with_private_id_response(ctx_other, 1, buf2, buf2size, buf, &bufsize)) errx(11, "response fail"); bench(&bench_verify); - buf2ssize = sizeof(buf2); if(!d0_blind_id_authenticate_with_private_id_verify(ctx_self, buf, bufsize, buf2, &buf2ssize, &status)) + buf2size = sizeof(buf2); if(!d0_blind_id_authenticate_with_private_id_verify(ctx_self, buf, bufsize, buf2, &buf2size, &status)) errx(12, "verify fail"); - if(buf2ssize != 11 || memcmp(buf2, "hello world", 11)) + if(buf2size != 11 || memcmp(buf2, "hello world", 11)) errx(13, "hello fail"); if(!status) errx(14, "signature fail"); + bench(&bench_dhkey1); + bufsize = sizeof(buf); if(!d0_blind_id_sessionkey_public_id(ctx_self, buf, &bufsize)) + errx(15, "dhkey1 fail"); + bench(&bench_dhkey2); + buf2size = sizeof(buf2); if(!d0_blind_id_sessionkey_public_id(ctx_other, buf2, &buf2size)) + errx(16, "dhkey2 fail"); bench(&bench_stop); + if(bufsize != buf2size || memcmp(buf, buf2, bufsize)) + errx(17, "dhkey match fail"); ++n; if(n % 1024 == 0) - printf("auth=%f chall=%f resp=%f verify=%f\n", n/bench_auth, n/bench_chall, n/bench_resp, n/bench_verify); + printf("auth=%f chall=%f resp=%f verify=%f dh1=%f dh2=%f\n", n/bench_auth, n/bench_chall, n/bench_resp, n/bench_verify, n/bench_dhkey1, n/bench_dhkey2); } return 0; -- 2.39.2