comm-central/third_party/rnp/src/lib/key_material.cpp

Source code

Revision control

Copy as Markdown

Other Tools

/*
* Copyright (c) 2024 [Ribose Inc](https://www.ribose.com).
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification,
* are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "key_material.hpp"
#include "librepgp/stream-packet.h"
#include "logging.h"
#include "utils.h"
#include "config.h"
#include <cassert>
namespace {
void
grip_hash_mpi(rnp::Hash &hash, const pgp::mpi &val, const char name, bool lzero = true)
{
size_t len = val.size();
size_t idx = 0;
for (idx = 0; (idx < len) && !val[idx]; idx++)
;
if (name) {
size_t hlen = idx >= len ? 0 : len - idx;
if ((len > idx) && lzero && (val[idx] & 0x80)) {
hlen++;
}
char buf[26] = {0};
snprintf(buf, sizeof(buf), "(1:%c%zu:", name, hlen);
hash.add(buf, strlen(buf));
}
if (idx < len) {
/* gcrypt prepends mpis with zero if higher bit is set */
if (lzero && (val[idx] & 0x80)) {
uint8_t zero = 0;
hash.add(&zero, 1);
}
hash.add(val.data() + idx, len - idx);
}
if (name) {
hash.add(")", 1);
}
}
void
grip_hash_ecc_hex(rnp::Hash &hash, const char *hex, char name)
{
auto bin = rnp::hex_to_bin(hex);
if (bin.empty()) {
RNP_LOG("wrong hex mpi");
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
pgp::mpi mpi;
mpi.assign(bin.data(), bin.size());
/* libgcrypt doesn't add leading zero when hashes ecc mpis */
return grip_hash_mpi(hash, mpi, name, false);
}
void
grip_hash_ec(rnp::Hash &hash, const pgp::ec::Key &key)
{
auto desc = pgp::ec::Curve::get(key.curve);
if (!desc) {
RNP_LOG("unknown curve %d", (int) key.curve);
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
/* build uncompressed point from gx and gy */
auto gxbin = rnp::hex_to_bin(desc->gx);
auto gybin = rnp::hex_to_bin(desc->gy);
assert(!gxbin.empty());
assert(!gybin.empty());
pgp::mpi g;
g.resize(1 + gxbin.size() + gybin.size());
g[0] = 0x04;
memcpy(g.data() + 1, gxbin.data(), gxbin.size());
memcpy(g.data() + 1 + gxbin.size(), gybin.data(), gybin.size());
/* p, a, b, g, n, q */
grip_hash_ecc_hex(hash, desc->p, 'p');
grip_hash_ecc_hex(hash, desc->a, 'a');
grip_hash_ecc_hex(hash, desc->b, 'b');
grip_hash_mpi(hash, g, 'g', false);
grip_hash_ecc_hex(hash, desc->n, 'n');
if ((key.curve == PGP_CURVE_ED25519) || (key.curve == PGP_CURVE_25519)) {
if (g.size() < 1) {
RNP_LOG("wrong 25519 p");
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
g.resize(key.p.size() - 1);
memcpy(g.data(), key.p.data() + 1, g.size());
grip_hash_mpi(hash, g, 'q', false);
} else {
grip_hash_mpi(hash, key.p, 'q', false);
}
}
} // namespace
namespace pgp {
KeyParams::~KeyParams()
{
}
std::unique_ptr<KeyParams>
KeyParams::create(pgp_pubkey_alg_t alg)
{
switch (alg) {
case PGP_PKA_RSA:
case PGP_PKA_RSA_ENCRYPT_ONLY:
case PGP_PKA_RSA_SIGN_ONLY:
return std::unique_ptr<KeyParams>(new RSAKeyParams());
case PGP_PKA_ECDSA:
return std::unique_ptr<KeyParams>(new ECDSAKeyParams());
case PGP_PKA_ECDH:
return std::unique_ptr<KeyParams>(new ECCKeyParams());
case PGP_PKA_EDDSA:
return std::unique_ptr<KeyParams>(new ECCKeyParams(PGP_CURVE_ED25519));
case PGP_PKA_SM2:
return std::unique_ptr<KeyParams>(new ECCKeyParams(PGP_CURVE_SM2_P_256));
#if defined(ENABLE_CRYPTO_REFRESH)
case PGP_PKA_ED25519:
return std::unique_ptr<KeyParams>(new ECCKeyParams(PGP_CURVE_ED25519));
case PGP_PKA_X25519:
return std::unique_ptr<KeyParams>(new ECCKeyParams(PGP_CURVE_25519));
#endif
case PGP_PKA_DSA:
return std::unique_ptr<KeyParams>(new DSAKeyParams());
case PGP_PKA_ELGAMAL:
case PGP_PKA_ELGAMAL_ENCRYPT_OR_SIGN:
return std::unique_ptr<KeyParams>(new EGKeyParams());
#if defined(ENABLE_PQC)
case PGP_PKA_KYBER768_X25519:
FALLTHROUGH_STATEMENT;
// TODO: Add case for PGP_PKA_KYBER1024_X448 with FALLTHROUGH_STATEMENT;
case PGP_PKA_KYBER768_P256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_KYBER1024_P384:
FALLTHROUGH_STATEMENT;
case PGP_PKA_KYBER768_BP256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_KYBER1024_BP384:
return std::unique_ptr<KeyParams>(new MlkemEcdhKeyParams(alg));
case PGP_PKA_DILITHIUM3_ED25519:
FALLTHROUGH_STATEMENT;
// TODO: Add case for PGP_PKA_DILITHIUM5_ED448 with FALLTHROUGH_STATEMENT;
case PGP_PKA_DILITHIUM3_P256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_DILITHIUM5_P384:
FALLTHROUGH_STATEMENT;
case PGP_PKA_DILITHIUM3_BP256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_DILITHIUM5_BP384:
return std::unique_ptr<KeyParams>(new DilithiumEccKeyParams(alg));
case PGP_PKA_SPHINCSPLUS_SHA2:
FALLTHROUGH_STATEMENT;
case PGP_PKA_SPHINCSPLUS_SHAKE:
return std::unique_ptr<KeyParams>(new SlhdsaKeyParams());
#endif
default:
throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
}
}
void
DSAKeyParams::check_defaults() noexcept
{
if (!qbits_) {
qbits_ = dsa::Key::choose_qsize(bits());
}
}
pgp_hash_alg_t
DSAKeyParams::min_hash() const noexcept
{
return dsa::Key::get_min_hash(qbits_);
}
size_t
ECCKeyParams::bits() const noexcept
{
auto curve = ec::Curve::get(curve_);
return curve ? curve->bitlen : 0;
}
pgp_hash_alg_t
ECDSAKeyParams::min_hash() const noexcept
{
return ecdsa::get_min_hash(curve());
}
#if defined(ENABLE_PQC)
size_t
MlkemEcdhKeyParams::bits() const noexcept
{
return pgp_kyber_ecdh_composite_public_key_t::encoded_size(alg_) * 8;
}
size_t
DilithiumEccKeyParams::bits() const noexcept
{
return pgp_dilithium_exdsa_composite_public_key_t::encoded_size(alg_) * 8;
}
size_t
SlhdsaKeyParams::bits() const noexcept
{
return sphincsplus_pubkey_size(param_) * 8;
}
#endif
KeyMaterial::~KeyMaterial()
{
}
pgp_pubkey_alg_t
KeyMaterial::alg() const noexcept
{
return alg_;
}
bool
KeyMaterial::secret() const noexcept
{
return secret_;
}
bool
KeyMaterial::valid() const
{
return validity_.validated && validity_.valid;
}
void
KeyMaterial::validate(rnp::SecurityContext &ctx, bool reset)
{
if (!reset && validity_.validated) {
return;
}
validity_.reset();
#ifdef FUZZERS_ENABLED
/* do not timeout on large keys during fuzzing */
validity_.valid = true;
#else
validity_.valid = validate_material(ctx, reset);
#endif
validity_.validated = true;
}
const pgp_validity_t &
KeyMaterial::validity() const noexcept
{
return validity_;
}
void
KeyMaterial::set_validity(const pgp_validity_t &val)
{
validity_ = val;
}
void
KeyMaterial::reset_validity()
{
validity_.reset();
}
void
KeyMaterial::clear_secret() noexcept
{
secret_ = false;
}
bool
KeyMaterial::finish_generate()
{
validity_.mark_valid();
secret_ = true;
return true;
}
bool
KeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
RNP_LOG("key generation not implemented for PK alg: %d", alg_);
return false;
}
rnp_result_t
KeyMaterial::encrypt(rnp::SecurityContext & ctx,
EncMaterial & out,
const rnp::secure_bytes &data) const
{
return RNP_ERROR_NOT_SUPPORTED;
}
rnp_result_t
KeyMaterial::decrypt(rnp::SecurityContext &ctx,
rnp::secure_bytes & out,
const EncMaterial & in) const
{
return RNP_ERROR_NOT_SUPPORTED;
}
rnp_result_t
KeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
return RNP_ERROR_NOT_SUPPORTED;
}
rnp_result_t
KeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
return RNP_ERROR_NOT_SUPPORTED;
}
pgp_hash_alg_t
KeyMaterial::adjust_hash(pgp_hash_alg_t hash) const
{
return hash;
}
bool
KeyMaterial::sig_hash_allowed(pgp_hash_alg_t hash) const
{
return true;
}
pgp_curve_t
KeyMaterial::curve() const noexcept
{
return PGP_CURVE_UNKNOWN;
}
KeyGrip
KeyMaterial::grip() const
{
auto hash = rnp::Hash::create(PGP_HASH_SHA1);
grip_update(*hash);
KeyGrip res{};
hash->finish(res.data());
return res;
}
std::unique_ptr<KeyMaterial>
KeyMaterial::create(pgp_pubkey_alg_t alg)
{
switch (alg) {
case PGP_PKA_RSA:
case PGP_PKA_RSA_ENCRYPT_ONLY:
case PGP_PKA_RSA_SIGN_ONLY:
return std::unique_ptr<KeyMaterial>(new RSAKeyMaterial(alg));
case PGP_PKA_ELGAMAL:
case PGP_PKA_ELGAMAL_ENCRYPT_OR_SIGN:
return std::unique_ptr<KeyMaterial>(new EGKeyMaterial(alg));
case PGP_PKA_DSA:
return std::unique_ptr<KeyMaterial>(new DSAKeyMaterial());
case PGP_PKA_ECDH:
return std::unique_ptr<KeyMaterial>(new ECDHKeyMaterial());
case PGP_PKA_ECDSA:
return std::unique_ptr<KeyMaterial>(new ECDSAKeyMaterial());
case PGP_PKA_EDDSA:
return std::unique_ptr<KeyMaterial>(new EDDSAKeyMaterial());
#if defined(ENABLE_CRYPTO_REFRESH)
case PGP_PKA_ED25519:
return std::unique_ptr<KeyMaterial>(new Ed25519KeyMaterial());
case PGP_PKA_X25519:
return std::unique_ptr<KeyMaterial>(new X25519KeyMaterial());
#endif
case PGP_PKA_SM2:
return std::unique_ptr<KeyMaterial>(new SM2KeyMaterial());
#if defined(ENABLE_PQC)
case PGP_PKA_KYBER768_X25519:
FALLTHROUGH_STATEMENT;
// TODO: Add case for PGP_PKA_KYBER1024_X448
case PGP_PKA_KYBER768_P256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_KYBER1024_P384:
FALLTHROUGH_STATEMENT;
case PGP_PKA_KYBER768_BP256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_KYBER1024_BP384:
return std::unique_ptr<KeyMaterial>(new MlkemEcdhKeyMaterial(alg));
case PGP_PKA_DILITHIUM3_ED25519:
FALLTHROUGH_STATEMENT;
// TODO: Add case for PGP_PKA_DILITHIUM5_ED448
case PGP_PKA_DILITHIUM3_P256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_DILITHIUM5_P384:
FALLTHROUGH_STATEMENT;
case PGP_PKA_DILITHIUM3_BP256:
FALLTHROUGH_STATEMENT;
case PGP_PKA_DILITHIUM5_BP384:
return std::unique_ptr<KeyMaterial>(new DilithiumEccKeyMaterial(alg));
case PGP_PKA_SPHINCSPLUS_SHA2:
FALLTHROUGH_STATEMENT;
case PGP_PKA_SPHINCSPLUS_SHAKE:
return std::unique_ptr<KeyMaterial>(new SlhdsaKeyMaterial(alg));
#endif
default:
return nullptr;
}
}
std::unique_ptr<KeyMaterial>
KeyMaterial::create(pgp_pubkey_alg_t alg, const rsa::Key &key)
{
return std::unique_ptr<KeyMaterial>(new RSAKeyMaterial(alg, key));
}
std::unique_ptr<KeyMaterial>
KeyMaterial::create(const dsa::Key &key)
{
return std::unique_ptr<KeyMaterial>(new DSAKeyMaterial(key));
}
std::unique_ptr<KeyMaterial>
KeyMaterial::create(pgp_pubkey_alg_t alg, const eg::Key &key)
{
return std::unique_ptr<KeyMaterial>(new EGKeyMaterial(alg, key));
}
std::unique_ptr<KeyMaterial>
KeyMaterial::create(pgp_pubkey_alg_t alg, const ec::Key &key)
{
switch (alg) {
case PGP_PKA_ECDSA:
return std::unique_ptr<KeyMaterial>(new ECDSAKeyMaterial(key));
case PGP_PKA_ECDH:
return std::unique_ptr<KeyMaterial>(new ECDHKeyMaterial(key));
case PGP_PKA_EDDSA:
return std::unique_ptr<KeyMaterial>(new EDDSAKeyMaterial(key));
case PGP_PKA_SM2:
return std::unique_ptr<KeyMaterial>(new SM2KeyMaterial(key));
default:
throw std::invalid_argument("Invalid EC algorithm.");
}
}
std::unique_ptr<KeyMaterial>
RSAKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new RSAKeyMaterial(*this));
}
void
RSAKeyMaterial::grip_update(rnp::Hash &hash) const
{
/* keygrip is subjectKeyHash from pkcs#15 for RSA. */
grip_hash_mpi(hash, key_.n, '\0');
}
bool
RSAKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !key_.validate(ctx.rng, secret_);
}
void
RSAKeyMaterial::clear_secret() noexcept
{
key_.clear_secret();
KeyMaterial::clear_secret();
}
bool
RSAKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
return pkt.get(key_.n) && pkt.get(key_.e);
}
bool
RSAKeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
if (!pkt.get(key_.d) || !pkt.get(key_.p) || !pkt.get(key_.q) || !pkt.get(key_.u)) {
RNP_LOG("failed to parse rsa secret key data");
return false;
}
secret_ = true;
return true;
}
void
RSAKeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.n);
pkt.add(key_.e);
}
void
RSAKeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.d);
pkt.add(key_.p);
pkt.add(key_.q);
pkt.add(key_.u);
}
bool
RSAKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
/* We do not generate PGP_PKA_RSA_ENCRYPT_ONLY or PGP_PKA_RSA_SIGN_ONLY keys */
if (alg_ != PGP_PKA_RSA) {
RNP_LOG("Unsupported algorithm for key generation: %d", alg_);
return false;
}
if (key_.generate(ctx.rng, params.bits())) {
RNP_LOG("failed to generate RSA key");
return false;
}
return finish_generate();
}
rnp_result_t
RSAKeyMaterial::encrypt(rnp::SecurityContext & ctx,
EncMaterial & out,
const rnp::secure_bytes &data) const
{
auto rsa = dynamic_cast<RSAEncMaterial *>(&out);
if (!rsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.encrypt_pkcs1(ctx.rng, rsa->enc, data);
}
rnp_result_t
RSAKeyMaterial::decrypt(rnp::SecurityContext &ctx,
rnp::secure_bytes & out,
const EncMaterial & in) const
{
auto rsa = dynamic_cast<const RSAEncMaterial *>(&in);
if (!rsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.decrypt_pkcs1(ctx.rng, out, rsa->enc);
}
rnp_result_t
RSAKeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
if (alg() == PGP_PKA_RSA_ENCRYPT_ONLY) {
RNP_LOG("RSA encrypt-only signature considered as invalid.");
return RNP_ERROR_SIGNATURE_INVALID;
}
auto rsa = dynamic_cast<const RSASigMaterial *>(&sig);
if (!rsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.verify_pkcs1(rsa->sig, rsa->halg, hash);
}
rnp_result_t
RSAKeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
auto rsa = dynamic_cast<RSASigMaterial *>(&sig);
if (!rsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.sign_pkcs1(ctx.rng, rsa->sig, rsa->halg, hash);
}
void
RSAKeyMaterial::set_secret(const mpi &d, const mpi &p, const mpi &q, const mpi &u)
{
key_.d = d;
key_.p = p;
key_.q = q;
key_.u = u;
secret_ = true;
}
size_t
RSAKeyMaterial::bits() const noexcept
{
return 8 * key_.n.size();
}
const mpi &
RSAKeyMaterial::n() const noexcept
{
return key_.n;
}
const mpi &
RSAKeyMaterial::e() const noexcept
{
return key_.e;
}
const mpi &
RSAKeyMaterial::d() const noexcept
{
return key_.d;
}
const mpi &
RSAKeyMaterial::p() const noexcept
{
return key_.p;
}
const mpi &
RSAKeyMaterial::q() const noexcept
{
return key_.q;
}
const mpi &
RSAKeyMaterial::u() const noexcept
{
return key_.u;
}
std::unique_ptr<KeyMaterial>
DSAKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new DSAKeyMaterial(*this));
}
void
DSAKeyMaterial::grip_update(rnp::Hash &hash) const
{
grip_hash_mpi(hash, key_.p, 'p');
grip_hash_mpi(hash, key_.q, 'q');
grip_hash_mpi(hash, key_.g, 'g');
grip_hash_mpi(hash, key_.y, 'y');
}
bool
DSAKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !key_.validate(ctx.rng, secret_);
}
void
DSAKeyMaterial::clear_secret() noexcept
{
key_.clear_secret();
KeyMaterial::clear_secret();
}
bool
DSAKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
return pkt.get(key_.p) && pkt.get(key_.q) && pkt.get(key_.g) && pkt.get(key_.y);
}
bool
DSAKeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
if (!pkt.get(key_.x)) {
RNP_LOG("failed to parse dsa secret key data");
return false;
}
secret_ = true;
return true;
}
void
DSAKeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.p);
pkt.add(key_.q);
pkt.add(key_.g);
pkt.add(key_.y);
}
void
DSAKeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.x);
}
bool
DSAKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
auto &dsa = dynamic_cast<const DSAKeyParams &>(params);
if (key_.generate(ctx.rng, dsa.bits(), dsa.qbits())) {
RNP_LOG("failed to generate DSA key");
return false;
}
return finish_generate();
}
rnp_result_t
DSAKeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
auto dsa = dynamic_cast<const DSASigMaterial *>(&sig);
if (!dsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.verify(dsa->sig, hash);
}
rnp_result_t
DSAKeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
auto dsa = dynamic_cast<DSASigMaterial *>(&sig);
if (!dsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.sign(ctx.rng, dsa->sig, hash);
}
pgp_hash_alg_t
DSAKeyMaterial::adjust_hash(pgp_hash_alg_t hash) const
{
pgp_hash_alg_t hash_min = dsa::Key::get_min_hash(key_.q.bits());
if (rnp::Hash::size(hash) < rnp::Hash::size(hash_min)) {
return hash_min;
}
return hash;
}
void
DSAKeyMaterial::set_secret(const mpi &x)
{
key_.x = x;
secret_ = true;
}
size_t
DSAKeyMaterial::bits() const noexcept
{
return 8 * key_.p.size();
}
size_t
DSAKeyMaterial::qbits() const noexcept
{
return 8 * key_.q.size();
}
const mpi &
DSAKeyMaterial::p() const noexcept
{
return key_.p;
}
const mpi &
DSAKeyMaterial::q() const noexcept
{
return key_.q;
}
const mpi &
DSAKeyMaterial::g() const noexcept
{
return key_.g;
}
const mpi &
DSAKeyMaterial::y() const noexcept
{
return key_.y;
}
const mpi &
DSAKeyMaterial::x() const noexcept
{
return key_.x;
}
std::unique_ptr<KeyMaterial>
EGKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new EGKeyMaterial(*this));
}
void
EGKeyMaterial::grip_update(rnp::Hash &hash) const
{
grip_hash_mpi(hash, key_.p, 'p');
grip_hash_mpi(hash, key_.g, 'g');
grip_hash_mpi(hash, key_.y, 'y');
}
bool
EGKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return key_.validate(secret_);
}
void
EGKeyMaterial::clear_secret() noexcept
{
key_.clear_secret();
KeyMaterial::clear_secret();
}
bool
EGKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
return pkt.get(key_.p) && pkt.get(key_.g) && pkt.get(key_.y);
}
bool
EGKeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
if (!pkt.get(key_.x)) {
RNP_LOG("failed to parse eg secret key data");
return false;
}
secret_ = true;
return true;
}
void
EGKeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.p);
pkt.add(key_.g);
pkt.add(key_.y);
}
void
EGKeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.x);
}
bool
EGKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
/* We do not generate PGP_PKA_ELGAMAL_ENCRYPT_OR_SIGN keys */
if (alg_ != PGP_PKA_ELGAMAL) {
RNP_LOG("Unsupported algorithm for key generation: %d", alg_);
return false;
}
if (key_.generate(ctx.rng, params.bits())) {
RNP_LOG("failed to generate ElGamal key");
return false;
}
return finish_generate();
}
rnp_result_t
EGKeyMaterial::encrypt(rnp::SecurityContext & ctx,
EncMaterial & out,
const rnp::secure_bytes &data) const
{
auto eg = dynamic_cast<EGEncMaterial *>(&out);
if (!eg) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.encrypt_pkcs1(ctx.rng, eg->enc, data);
}
rnp_result_t
EGKeyMaterial::decrypt(rnp::SecurityContext &ctx,
rnp::secure_bytes & out,
const EncMaterial & in) const
{
auto eg = dynamic_cast<const EGEncMaterial *>(&in);
if (!eg) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.decrypt_pkcs1(ctx.rng, out, eg->enc);
}
rnp_result_t
EGKeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
RNP_LOG("ElGamal signatures are considered as invalid.");
return RNP_ERROR_SIGNATURE_INVALID;
}
void
EGKeyMaterial::set_secret(const mpi &x)
{
key_.x = x;
secret_ = true;
}
size_t
EGKeyMaterial::bits() const noexcept
{
return 8 * key_.y.size();
}
const mpi &
EGKeyMaterial::p() const noexcept
{
return key_.p;
}
const mpi &
EGKeyMaterial::g() const noexcept
{
return key_.g;
}
const mpi &
EGKeyMaterial::y() const noexcept
{
return key_.y;
}
const mpi &
EGKeyMaterial::x() const noexcept
{
return key_.x;
}
void
ECKeyMaterial::grip_update(rnp::Hash &hash) const
{
grip_hash_ec(hash, key_);
}
void
ECKeyMaterial::clear_secret() noexcept
{
key_.clear_secret();
KeyMaterial::clear_secret();
}
rnp_result_t
ECKeyMaterial::check_curve(size_t hash_len) const
{
auto curve = ec::Curve::get(key_.curve);
if (!curve) {
RNP_LOG("Unknown curve");
return RNP_ERROR_BAD_PARAMETERS;
}
if (!curve->supported) {
RNP_LOG("EC sign: curve %s is not supported.", curve->pgp_name);
return RNP_ERROR_NOT_SUPPORTED;
}
/* "-2" because ECDSA on P-521 must work with SHA-512 digest */
if (curve->bytes() - 2 > hash_len) {
RNP_LOG("Message hash too small");
return RNP_ERROR_BAD_PARAMETERS;
}
return RNP_SUCCESS;
}
bool
ECKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
if (!pkt.get(key_.curve) || !pkt.get(key_.p)) {
return false;
}
return true;
}
bool
ECKeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
if (!pkt.get(key_.x)) {
RNP_LOG("failed to parse ecc secret key data");
return false;
}
secret_ = true;
return true;
}
void
ECKeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.curve);
pkt.add(key_.p);
}
void
ECKeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.x);
}
bool
ECKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
auto &ecc = dynamic_cast<const ECCKeyParams &>(params);
if (!ec::Curve::is_supported(ecc.curve())) {
RNP_LOG("EC generate: curve %d is not supported.", ecc.curve());
return false;
}
if (key_.generate(ctx.rng, alg_, ecc.curve())) {
RNP_LOG("failed to generate EC key");
return false;
}
key_.curve = ecc.curve();
return finish_generate();
}
void
ECKeyMaterial::set_secret(const mpi &x)
{
key_.x = x;
secret_ = true;
}
size_t
ECKeyMaterial::bits() const noexcept
{
auto curve_desc = ec::Curve::get(key_.curve);
return curve_desc ? curve_desc->bitlen : 0;
}
pgp_curve_t
ECKeyMaterial::curve() const noexcept
{
return key_.curve;
}
const mpi &
ECKeyMaterial::p() const noexcept
{
return key_.p;
}
const mpi &
ECKeyMaterial::x() const noexcept
{
return key_.x;
}
bool
ECDSAKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
if (!ec::Curve::is_supported(key_.curve)) {
/* allow to import key if curve is not supported */
RNP_LOG("ECDSA validate: curve %d is not supported.", key_.curve);
return true;
}
return !ecdsa::validate_key(ctx.rng, key_, secret_);
}
std::unique_ptr<KeyMaterial>
ECDSAKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new ECDSAKeyMaterial(*this));
}
rnp_result_t
ECDSAKeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
if (!ec::Curve::is_supported(key_.curve)) {
RNP_LOG("Curve %d is not supported.", key_.curve);
return RNP_ERROR_NOT_SUPPORTED;
}
auto ec = dynamic_cast<const ECSigMaterial *>(&sig);
if (!ec) {
return RNP_ERROR_BAD_PARAMETERS;
}
return ecdsa::verify(ec->sig, ec->halg, hash, key_);
}
rnp_result_t
ECDSAKeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
auto ret = check_curve(hash.size());
if (ret) {
return ret;
}
auto ec = dynamic_cast<ECSigMaterial *>(&sig);
if (!ec) {
return RNP_ERROR_BAD_PARAMETERS;
}
return ecdsa::sign(ctx.rng, ec->sig, ec->halg, hash, key_);
}
pgp_hash_alg_t
ECDSAKeyMaterial::adjust_hash(pgp_hash_alg_t hash) const
{
pgp_hash_alg_t hash_min = ecdsa::get_min_hash(key_.curve);
if (rnp::Hash::size(hash) < rnp::Hash::size(hash_min)) {
return hash_min;
}
return hash;
}
bool
ECDHKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
if (!ec::Curve::is_supported(key_.curve)) {
/* allow to import key if curve is not supported */
RNP_LOG("ECDH validate: curve %d is not supported.", key_.curve);
return true;
}
return !ecdh::validate_key(ctx.rng, key_, secret_);
}
std::unique_ptr<KeyMaterial>
ECDHKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new ECDHKeyMaterial(*this));
}
bool
ECDHKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
if (!ECKeyMaterial::parse(pkt)) {
return false;
}
/* Additional ECDH fields */
/* Read KDF parameters. At the moment should be 0x03 0x01 halg ealg */
uint8_t len = 0, halg = 0, walg = 0;
if (!pkt.get(len) || (len != 3)) {
return false;
}
if (!pkt.get(len) || (len != 1)) {
return false;
}
if (!pkt.get(halg) || !pkt.get(walg)) {
return false;
}
key_.kdf_hash_alg = (pgp_hash_alg_t) halg;
key_.key_wrap_alg = (pgp_symm_alg_t) walg;
return true;
}
void
ECDHKeyMaterial::write(pgp_packet_body_t &pkt) const
{
ECKeyMaterial::write(pkt);
pkt.add_byte(3);
pkt.add_byte(1);
pkt.add_byte(key_.kdf_hash_alg);
pkt.add_byte(key_.key_wrap_alg);
}
bool
ECDHKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
auto &ecc = dynamic_cast<const ECCKeyParams &>(params);
if (!ecdh::set_params(key_, ecc.curve())) {
RNP_LOG("Unsupported curve [ID=%d]", ecc.curve());
return false;
}
/* Special case for x25519*/
if (ecc.curve() == PGP_CURVE_25519) {
if (key_.generate_x25519(ctx.rng)) {
RNP_LOG("failed to generate x25519 key");
return false;
}
key_.curve = ecc.curve();
return finish_generate();
}
/* Fallback to default EC generation for other cases */
return ECKeyMaterial::generate(ctx, params);
}
rnp_result_t
ECDHKeyMaterial::encrypt(rnp::SecurityContext & ctx,
EncMaterial & out,
const rnp::secure_bytes &data) const
{
if (!ec::Curve::is_supported(key_.curve)) {
RNP_LOG("ECDH encrypt: curve %d is not supported.", key_.curve);
return RNP_ERROR_NOT_SUPPORTED;
}
auto ecdh = dynamic_cast<ECDHEncMaterial *>(&out);
if (!ecdh) {
return RNP_ERROR_BAD_PARAMETERS;
}
return ecdh::encrypt_pkcs5(ctx.rng, ecdh->enc, data, key_);
}
rnp_result_t
ECDHKeyMaterial::decrypt(rnp::SecurityContext &ctx,
rnp::secure_bytes & out,
const EncMaterial & in) const
{
if (!ec::Curve::is_supported(key_.curve)) {
RNP_LOG("ECDH decrypt: curve %d is not supported.", key_.curve);
return RNP_ERROR_BAD_PARAMETERS;
}
if ((key_.curve == PGP_CURVE_25519) && !x25519_bits_tweaked()) {
RNP_LOG("Warning: bits of 25519 secret key are not tweaked.");
}
auto ecdh = dynamic_cast<const ECDHEncMaterial *>(&in);
if (!ecdh) {
return RNP_ERROR_BAD_PARAMETERS;
}
return ecdh::decrypt_pkcs5(out, ecdh->enc, key_);
}
pgp_hash_alg_t
ECDHKeyMaterial::kdf_hash_alg() const noexcept
{
return key_.kdf_hash_alg;
}
pgp_symm_alg_t
ECDHKeyMaterial::key_wrap_alg() const noexcept
{
return key_.key_wrap_alg;
}
bool
ECDHKeyMaterial::x25519_bits_tweaked() const noexcept
{
return (key_.curve == PGP_CURVE_25519) && ::x25519_bits_tweaked(key_);
}
bool
ECDHKeyMaterial::x25519_tweak_bits() noexcept
{
return (key_.curve == PGP_CURVE_25519) && ::x25519_tweak_bits(key_);
}
bool
EDDSAKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !eddsa::validate_key(ctx.rng, key_, secret_);
}
std::unique_ptr<KeyMaterial>
EDDSAKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new EDDSAKeyMaterial(*this));
}
bool
EDDSAKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
if (eddsa::generate(ctx.rng, key_)) {
RNP_LOG("failed to generate EDDSA key");
return false;
}
return finish_generate();
}
rnp_result_t
EDDSAKeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
auto ec = dynamic_cast<const ECSigMaterial *>(&sig);
if (!ec) {
return RNP_ERROR_BAD_PARAMETERS;
}
return eddsa::verify(ec->sig, hash, key_);
}
rnp_result_t
EDDSAKeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
auto ec = dynamic_cast<ECSigMaterial *>(&sig);
if (!ec) {
return RNP_ERROR_BAD_PARAMETERS;
}
return eddsa::sign(ctx.rng, ec->sig, hash, key_);
}
bool
SM2KeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
#if defined(ENABLE_SM2)
return !sm2::validate_key(ctx.rng, key_, secret_);
#else
RNP_LOG("SM2 key validation is not available.");
return false;
#endif
}
std::unique_ptr<KeyMaterial>
SM2KeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new SM2KeyMaterial(*this));
}
rnp_result_t
SM2KeyMaterial::encrypt(rnp::SecurityContext & ctx,
EncMaterial & out,
const rnp::secure_bytes &data) const
{
#if defined(ENABLE_SM2)
auto sm2 = dynamic_cast<SM2EncMaterial *>(&out);
if (!sm2) {
return RNP_ERROR_BAD_PARAMETERS;
}
return sm2::encrypt(ctx.rng, sm2->enc, data, PGP_HASH_SM3, key_);
#else
RNP_LOG("sm2_encrypt is not available");
return RNP_ERROR_NOT_IMPLEMENTED;
#endif
}
rnp_result_t
SM2KeyMaterial::decrypt(rnp::SecurityContext &ctx,
rnp::secure_bytes & out,
const EncMaterial & in) const
{
#if defined(ENABLE_SM2)
auto sm2 = dynamic_cast<const SM2EncMaterial *>(&in);
if (!sm2) {
return RNP_ERROR_BAD_PARAMETERS;
}
return sm2::decrypt(out, sm2->enc, key_);
#else
RNP_LOG("SM2 decryption is not available.");
return RNP_ERROR_NOT_IMPLEMENTED;
#endif
}
rnp_result_t
SM2KeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
#if defined(ENABLE_SM2)
auto ec = dynamic_cast<const ECSigMaterial *>(&sig);
if (!ec) {
return RNP_ERROR_BAD_PARAMETERS;
}
return sm2::verify(ec->sig, ec->halg, hash, key_);
#else
RNP_LOG("SM2 verification is not available.");
return RNP_ERROR_NOT_IMPLEMENTED;
#endif
}
rnp_result_t
SM2KeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
#if defined(ENABLE_SM2)
auto ret = check_curve(hash.size());
if (ret) {
return ret;
}
auto ec = dynamic_cast<ECSigMaterial *>(&sig);
if (!ec) {
return RNP_ERROR_BAD_PARAMETERS;
}
return sm2::sign(ctx.rng, ec->sig, ec->halg, hash, key_);
#else
RNP_LOG("SM2 signing is not available.");
return RNP_ERROR_NOT_IMPLEMENTED;
#endif
}
void
SM2KeyMaterial::compute_za(rnp::Hash &hash) const
{
#if defined(ENABLE_SM2)
auto res = sm2::compute_za(key_, hash);
if (res) {
RNP_LOG("failed to compute SM2 ZA field");
throw rnp::rnp_exception(res);
}
#else
RNP_LOG("SM2 ZA computation not available");
throw rnp::rnp_exception(RNP_ERROR_NOT_IMPLEMENTED);
#endif
}
#if defined(ENABLE_CRYPTO_REFRESH)
std::unique_ptr<KeyMaterial>
Ed25519KeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new Ed25519KeyMaterial(*this));
}
void
Ed25519KeyMaterial::grip_update(rnp::Hash &hash) const
{
// TODO: if GnuPG would ever support v6, check whether this works correctly.
hash.add(pub());
}
bool
Ed25519KeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !ed25519_validate_key_native(&ctx.rng, &key_, secret_);
}
void
Ed25519KeyMaterial::clear_secret() noexcept
{
key_.clear_secret();
KeyMaterial::clear_secret();
}
bool
Ed25519KeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
auto ec_desc = ec::Curve::get(PGP_CURVE_ED25519);
std::vector<uint8_t> buf(ec_desc->bytes());
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse Ed25519 public key data");
return false;
}
key_.pub = buf;
return true;
}
bool
Ed25519KeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
auto ec_desc = ec::Curve::get(PGP_CURVE_ED25519);
std::vector<uint8_t> buf(ec_desc->bytes());
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse Ed25519 secret key data");
return false;
}
key_.priv = buf;
secret_ = true;
return true;
}
void
Ed25519KeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.pub);
}
void
Ed25519KeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.priv);
}
bool
Ed25519KeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
if (generate_ed25519_native(&ctx.rng, key_.priv, key_.pub)) {
RNP_LOG("failed to generate ED25519 key");
return false;
}
return finish_generate();
}
rnp_result_t
Ed25519KeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
auto ed25519 = dynamic_cast<const Ed25519SigMaterial *>(&sig);
if (!ed25519) {
return RNP_ERROR_BAD_PARAMETERS;
}
return ed25519_verify_native(ed25519->sig.sig, key_.pub, hash.data(), hash.size());
}
rnp_result_t
Ed25519KeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
auto ed25519 = dynamic_cast<Ed25519SigMaterial *>(&sig);
if (!ed25519) {
return RNP_ERROR_BAD_PARAMETERS;
}
return ed25519_sign_native(
&ctx.rng, ed25519->sig.sig, key_.priv, hash.data(), hash.size());
}
size_t
Ed25519KeyMaterial::bits() const noexcept
{
return 255;
}
pgp_curve_t
Ed25519KeyMaterial::curve() const noexcept
{
return PGP_CURVE_ED25519;
}
const std::vector<uint8_t> &
Ed25519KeyMaterial::pub() const noexcept
{
return key_.pub;
}
const std::vector<uint8_t> &
Ed25519KeyMaterial::priv() const noexcept
{
return key_.priv;
}
std::unique_ptr<KeyMaterial>
X25519KeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new X25519KeyMaterial(*this));
}
void
X25519KeyMaterial::grip_update(rnp::Hash &hash) const
{
// TODO: if GnuPG would ever support v6, check whether this works correctly.
hash.add(pub());
}
bool
X25519KeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !x25519_validate_key_native(&ctx.rng, &key_, secret_);
}
void
X25519KeyMaterial::clear_secret() noexcept
{
key_.clear_secret();
KeyMaterial::clear_secret();
}
bool
X25519KeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
auto ec_desc = ec::Curve::get(PGP_CURVE_25519);
std::vector<uint8_t> buf(ec_desc->bytes());
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse X25519 public key data");
return false;
}
key_.pub = buf;
return true;
}
bool
X25519KeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
auto ec_desc = ec::Curve::get(PGP_CURVE_25519);
std::vector<uint8_t> buf(ec_desc->bytes());
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse X25519 secret key data");
return false;
}
key_.priv = buf;
secret_ = true;
return true;
}
void
X25519KeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.pub);
}
void
X25519KeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.priv);
}
bool
X25519KeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
if (generate_x25519_native(&ctx.rng, key_.priv, key_.pub)) {
RNP_LOG("failed to generate X25519 key");
return false;
}
return finish_generate();
}
rnp_result_t
X25519KeyMaterial::encrypt(rnp::SecurityContext & ctx,
EncMaterial & out,
const rnp::secure_bytes &data) const
{
auto x25519 = dynamic_cast<X25519EncMaterial *>(&out);
if (!x25519) {
return RNP_ERROR_BAD_PARAMETERS;
}
return x25519_native_encrypt(&ctx.rng, key_.pub, data.data(), data.size(), &x25519->enc);
}
rnp_result_t
X25519KeyMaterial::decrypt(rnp::SecurityContext &ctx,
rnp::secure_bytes & out,
const EncMaterial & in) const
{
auto x25519 = dynamic_cast<const X25519EncMaterial *>(&in);
if (!x25519) {
return RNP_ERROR_BAD_PARAMETERS;
}
out.resize(PGP_MPINT_SIZE);
size_t out_size = out.size();
auto ret = x25519_native_decrypt(&ctx.rng, key_, &x25519->enc, out.data(), &out_size);
if (!ret) {
out.resize(out_size);
}
return ret;
}
size_t
X25519KeyMaterial::bits() const noexcept
{
return 255;
}
pgp_curve_t
X25519KeyMaterial::curve() const noexcept
{
return PGP_CURVE_25519;
}
const std::vector<uint8_t> &
X25519KeyMaterial::pub() const noexcept
{
return key_.pub;
}
const std::vector<uint8_t> &
X25519KeyMaterial::priv() const noexcept
{
return key_.priv;
}
#endif
#if defined(ENABLE_PQC)
std::unique_ptr<KeyMaterial>
MlkemEcdhKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new MlkemEcdhKeyMaterial(*this));
}
void
MlkemEcdhKeyMaterial::grip_update(rnp::Hash &hash) const
{
hash.add(pub().get_encoded());
}
bool
MlkemEcdhKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !kyber_ecdh_validate_key(&ctx.rng, &key_, secret_);
}
void
MlkemEcdhKeyMaterial::clear_secret() noexcept
{
key_.priv.secure_clear();
KeyMaterial::clear_secret();
}
bool
MlkemEcdhKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
std::vector<uint8_t> buf(pgp_kyber_ecdh_composite_public_key_t::encoded_size(alg()));
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse mlkem-ecdh public key data");
return false;
}
key_.pub = pgp_kyber_ecdh_composite_public_key_t(buf, alg());
return true;
}
bool
MlkemEcdhKeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
std::vector<uint8_t> buf(pgp_kyber_ecdh_composite_private_key_t::encoded_size(alg()));
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse mkem-ecdh secret key data");
return false;
}
key_.priv = pgp_kyber_ecdh_composite_private_key_t(buf.data(), buf.size(), alg());
secret_ = true;
return true;
}
void
MlkemEcdhKeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.pub.get_encoded());
}
void
MlkemEcdhKeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.priv.get_encoded());
}
bool
MlkemEcdhKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
if (pgp_kyber_ecdh_composite_key_t::gen_keypair(&ctx.rng, &key_, alg_)) {
RNP_LOG("failed to generate MLKEM-ECDH-composite key for PK alg %d", alg_);
return false;
}
return finish_generate();
}
rnp_result_t
MlkemEcdhKeyMaterial::encrypt(rnp::SecurityContext & ctx,
EncMaterial & out,
const rnp::secure_bytes &data) const
{
auto mlkem = dynamic_cast<MlkemEcdhEncMaterial *>(&out);
if (!mlkem) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.pub.encrypt(&ctx.rng, &mlkem->enc, data.data(), data.size());
}
rnp_result_t
MlkemEcdhKeyMaterial::decrypt(rnp::SecurityContext &ctx,
rnp::secure_bytes & out,
const EncMaterial & in) const
{
auto mlkem = dynamic_cast<const MlkemEcdhEncMaterial *>(&in);
if (!mlkem) {
return RNP_ERROR_BAD_PARAMETERS;
}
out.resize(PGP_MPINT_SIZE);
size_t out_size = out.size();
auto ret = key_.priv.decrypt(&ctx.rng, out.data(), &out_size, &mlkem->enc);
if (!ret) {
out.resize(out_size);
}
return ret;
}
size_t
MlkemEcdhKeyMaterial::bits() const noexcept
{
return 8 * pub().get_encoded().size(); /* public key length */
}
const pgp_kyber_ecdh_composite_public_key_t &
MlkemEcdhKeyMaterial::pub() const noexcept
{
return key_.pub;
}
const pgp_kyber_ecdh_composite_private_key_t &
MlkemEcdhKeyMaterial::priv() const noexcept
{
return key_.priv;
}
std::unique_ptr<KeyMaterial>
DilithiumEccKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new DilithiumEccKeyMaterial(*this));
}
void
DilithiumEccKeyMaterial::grip_update(rnp::Hash &hash) const
{
hash.add(pub().get_encoded());
}
bool
DilithiumEccKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !dilithium_exdsa_validate_key(&ctx.rng, &key_, secret_);
}
void
DilithiumEccKeyMaterial::clear_secret() noexcept
{
key_.priv.secure_clear();
KeyMaterial::clear_secret();
}
bool
DilithiumEccKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
std::vector<uint8_t> buf(pgp_dilithium_exdsa_composite_public_key_t::encoded_size(alg()));
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse mldsa-ecdsa/eddsa public key data");
return false;
}
key_.pub = pgp_dilithium_exdsa_composite_public_key_t(buf, alg());
return true;
}
bool
DilithiumEccKeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
std::vector<uint8_t> buf(pgp_dilithium_exdsa_composite_private_key_t::encoded_size(alg()));
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse mldsa-ecdsa/eddsa secret key data");
return false;
}
key_.priv = pgp_dilithium_exdsa_composite_private_key_t(buf.data(), buf.size(), alg());
secret_ = true;
return true;
}
void
DilithiumEccKeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add(key_.pub.get_encoded());
}
void
DilithiumEccKeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add(key_.priv.get_encoded());
}
bool
DilithiumEccKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
if (pgp_dilithium_exdsa_composite_key_t::gen_keypair(&ctx.rng, &key_, alg_)) {
RNP_LOG("failed to generate mldsa-ecdsa/eddsa-composite key for PK alg %d", alg_);
return false;
}
return finish_generate();
}
rnp_result_t
DilithiumEccKeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
auto dilithium = dynamic_cast<const DilithiumSigMaterial *>(&sig);
if (!dilithium) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.pub.verify(&dilithium->sig, dilithium->halg, hash.data(), hash.size());
}
rnp_result_t
DilithiumEccKeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
auto dilithium = dynamic_cast<DilithiumSigMaterial *>(&sig);
if (!dilithium) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.priv.sign(
&ctx.rng, &dilithium->sig, dilithium->halg, hash.data(), hash.size());
}
pgp_hash_alg_t
DilithiumEccKeyMaterial::adjust_hash(pgp_hash_alg_t hash) const
{
return dilithium_default_hash_alg();
}
size_t
DilithiumEccKeyMaterial::bits() const noexcept
{
return 8 * pub().get_encoded().size(); /* public key length*/
}
const pgp_dilithium_exdsa_composite_public_key_t &
DilithiumEccKeyMaterial::pub() const noexcept
{
return key_.pub;
}
const pgp_dilithium_exdsa_composite_private_key_t &
DilithiumEccKeyMaterial::priv() const noexcept
{
return key_.priv;
}
std::unique_ptr<KeyMaterial>
SlhdsaKeyMaterial::clone()
{
return std::unique_ptr<KeyMaterial>(new SlhdsaKeyMaterial(*this));
}
void
SlhdsaKeyMaterial::grip_update(rnp::Hash &hash) const
{
hash.add(pub().get_encoded());
}
bool
SlhdsaKeyMaterial::validate_material(rnp::SecurityContext &ctx, bool reset)
{
return !sphincsplus_validate_key(&ctx.rng, &key_, secret_);
}
void
SlhdsaKeyMaterial::clear_secret() noexcept
{
key_.priv.secure_clear();
KeyMaterial::clear_secret();
}
bool
SlhdsaKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
{
secret_ = false;
uint8_t bt = 0;
if (!pkt.get(bt)) {
RNP_LOG("failed to parse SLH-DSA public key data");
return false;
}
sphincsplus_parameter_t param = (sphincsplus_parameter_t) bt;
auto size = sphincsplus_pubkey_size(param);
if (!size) {
RNP_LOG("invalid SLH-DSA param");
return false;
}
std::vector<uint8_t> buf(size);
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse SLH-DSA public key data");
return false;
}
key_.pub = pgp_sphincsplus_public_key_t(buf, param, alg());
return true;
}
bool
SlhdsaKeyMaterial::parse_secret(pgp_packet_body_t &pkt) noexcept
{
uint8_t bt = 0;
if (!pkt.get(bt)) {
RNP_LOG("failed to parse SLH-DSA secret key data");
return false;
}
sphincsplus_parameter_t param = (sphincsplus_parameter_t) bt;
std::vector<uint8_t> buf(sphincsplus_privkey_size(param));
if (!pkt.get(buf.data(), buf.size())) {
RNP_LOG("failed to parse SLH-DSA secret key data");
return false;
}
key_.priv = pgp_sphincsplus_private_key_t(buf, param, alg());
secret_ = true;
return true;
}
void
SlhdsaKeyMaterial::write(pgp_packet_body_t &pkt) const
{
pkt.add_byte((uint8_t) key_.pub.param());
pkt.add(key_.pub.get_encoded());
}
void
SlhdsaKeyMaterial::write_secret(pgp_packet_body_t &pkt) const
{
pkt.add_byte((uint8_t) key_.priv.param());
pkt.add(key_.priv.get_encoded());
}
bool
SlhdsaKeyMaterial::generate(rnp::SecurityContext &ctx, const KeyParams &params)
{
auto &slhdsa = dynamic_cast<const SlhdsaKeyParams &>(params);
if (pgp_sphincsplus_generate(&ctx.rng, &key_, slhdsa.param(), alg_)) {
RNP_LOG("failed to generate SLH-DSA key for PK alg %d", alg_);
return false;
}
return finish_generate();
}
rnp_result_t
SlhdsaKeyMaterial::verify(const rnp::SecurityContext &ctx,
const SigMaterial & sig,
const rnp::secure_bytes & hash) const
{
auto slhdsa = dynamic_cast<const SlhdsaSigMaterial *>(&sig);
if (!slhdsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.pub.verify(&slhdsa->sig, hash.data(), hash.size());
}
rnp_result_t
SlhdsaKeyMaterial::sign(rnp::SecurityContext & ctx,
SigMaterial & sig,
const rnp::secure_bytes &hash) const
{
auto slhdsa = dynamic_cast<SlhdsaSigMaterial *>(&sig);
if (!slhdsa) {
return RNP_ERROR_BAD_PARAMETERS;
}
return key_.priv.sign(&ctx.rng, &slhdsa->sig, hash.data(), hash.size());
}
pgp_hash_alg_t
SlhdsaKeyMaterial::adjust_hash(pgp_hash_alg_t hash) const
{
return sphincsplus_default_hash_alg(alg_, key_.pub.param());
}
bool
SlhdsaKeyMaterial::sig_hash_allowed(pgp_hash_alg_t hash) const
{
return key_.pub.validate_signature_hash_requirements(hash);
}
size_t
SlhdsaKeyMaterial::bits() const noexcept
{
return 8 * pub().get_encoded().size(); /* public key length */
}
const pgp_sphincsplus_public_key_t &
SlhdsaKeyMaterial::pub() const noexcept
{
return key_.pub;
}
const pgp_sphincsplus_private_key_t &
SlhdsaKeyMaterial::priv() const noexcept
{
return key_.priv;
}
#endif
} // namespace pgp