yydcaib
/
KGC_TEST
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
KGC_TEST/KGCAPP/3rdparty/miracl/source/curve/pairing/ake24blsa.cpp

712 lines
13 KiB
C++
Raw Blame History

/*
Scott's AKE Client/Server testbed
See http://eprint.iacr.org/2002/164
On Windows compile as
cl /O2 /GX /DZZNS=10 ake24blsa.cpp zzn24.cpp zzn8.cpp zzn4.cpp zzn2.cpp zzn.cpp ecn.cpp ecn4.cpp big.cpp miracl.lib
for 64-bit computer. Change to /DZZNS=20 for 32-bit computer
On Linux compile as
g++ -O2 -DZZNS=10 ake24blsa.cpp zzn24.cpp zzn8.cpp zzn4.cpp zzn2.cpp zzn.cpp ecn.cpp ecn4.cpp big.cpp miracl.a -o ake24blsa
Barreto-Lynn-Scott k=24 Curve - ate pairing
The BLS curve generated is generated from an x parameter
This version implements the ate pairing (which is optimal in this case)
See bls24.cpp for a program to generate suitable bls24 curves
Modified to prevent sub-group confinement attack
*/
#include <iostream>
#include <fstream>
#include <string.h>
#include "ecn.h"
#include <ctime>
#include "ecn4.h"
#include "zzn24.h"
using namespace std;
#ifdef MR_COUNT_OPS
extern "C"
{
int fpc=0;
int fpa=0;
int fpx=0;
int fpm2=0;
int fpi2=0;
int fpaq=0;
int fpsq=0;
int fpmq=0;
}
#endif
#if MIRACL==64
Miracl precision(10,0);
#else
Miracl precision(20,0);
#endif
// Using SHA-256 as basic hash algorithm
#define HASH_LEN 32
ZZn24 Frobenius(ZZn24 P, ZZn2 &X, int k)
{
ZZn24 Q=P;
for (int i=0; i<k; i++)
Q.powq(X);
return Q;
}
// Suitable for p=7 mod 12
void set_frobenius_constant(ZZn2 &X)
{
Big p=get_modulus();
X.set((Big)1,(Big)1); // p=3 mod 8
X=pow(X,(p-7)/12);
}
//
// Line from A to destination C. Let A=(x,y)
// Line Y-slope.X-c=0, through A, so intercept c=y-slope.x
// Line Y-slope.X-y+slope.x = (Y-y)-slope.(X-x) = 0
// Now evaluate at Q -> return (Qy-y)-slope.(Qx-x)
//
ZZn24 line(ECn4& A,ECn4& C,ZZn4& slope,ZZn& Qx,ZZn& Qy)
{
ZZn24 w;
ZZn8 nn,dd;
ZZn4 X,Y;
A.get(X,Y);
nn.set((ZZn4)-Qy,Y-slope*X);
dd.set(slope*Qx);
w.set(nn,dd);
return w;
}
//
// Add A=A+B (or A=A+A)
// Return line function value
//
ZZn24 g(ECn4& A,ECn4& B,ZZn& Qx,ZZn& Qy)
{
ZZn4 lam;
ZZn24 r;
ECn4 P=A;
// Evaluate line from A
A.add(B,lam);
if (A.iszero()) return (ZZn24)1;
r=line(P,A,lam,Qx,Qy);
return r;
}
//
// This calculates p.A = (X^p,Y^p) quickly using Frobenius
// 1. Extract A(x,y) from twisted curve to point on curve over full extension, as X=i^2.x and Y=i^3.y
// where i=NR^(1/k)
// 2. Using Frobenius calculate (X^p,Y^p)
// 3. map back to twisted curve
// Here we simplify things by doing whole calculation on the twisted curve
//
// Note we have to be careful as in detail it depends on w where p=w mod k
// Its simplest if w=1.
//
ECn4 psi(ECn4 &A,ZZn2 &F,int n)
{
int i;
ECn4 R;
ZZn4 X,Y;
ZZn2 FF,W;
// Fast multiplication of A by q^n
A.get(X,Y);
FF=F*F;
W=txx(txx(txx(FF*FF*FF)));
for (i=0;i<n;i++)
{ // assumes p=7 mod 12
X.powq(W); X=tx(tx(FF*X));
Y.powq(W); Y=tx(tx(tx(FF*F*Y)));
}
R.set(X,Y);
return R;
}
// Automatically generated by Luis Dominguez
ZZn24 HardExpo(ZZn24 &f3x0, ZZn2 &X, Big &x){
//vector=[ 1, 2, 3 ]
ZZn24 r;
ZZn24 xA;
ZZn24 xB;
ZZn24 t0;
ZZn24 t1;
ZZn24 f3x1;
ZZn24 f3x2;
ZZn24 f3x3;
ZZn24 f3x4;
ZZn24 f3x5;
ZZn24 f3x6;
ZZn24 f3x7;
ZZn24 f3x8;
ZZn24 f3x9;
f3x1=pow(f3x0,x);
f3x2=pow(f3x1,x);
f3x3=pow(f3x2,x);
f3x4=pow(f3x3,x);
f3x5=pow(f3x4,x);
f3x6=pow(f3x5,x);
f3x7=pow(f3x6,x);
f3x8=pow(f3x7,x);
f3x9=pow(f3x8,x);
xA=f3x4*inverse(f3x8)*Frobenius(f3x3,X,1)*Frobenius(inverse(f3x7),X,1)*Frobenius(f3x2,X,2)*Frobenius(inverse(f3x6),X,2)*Frobenius(f3x1,X,3)*Frobenius(inverse(f3x5),X,3)*Frobenius(inverse(f3x4),X,4)*Frobenius(inverse(f3x3),X,5)*Frobenius(inverse(f3x2),X,6)*Frobenius(inverse(f3x1),X,7);
xB=f3x0;
t0=xA*xB;
xA=inverse(f3x3)*inverse(f3x5)*f3x7*f3x9*Frobenius(inverse(f3x2),X,1)*Frobenius(inverse(f3x4),X,1)*Frobenius(f3x6,X,1)*Frobenius(f3x8,X,1)*Frobenius(inverse(f3x1),X,2)*Frobenius(inverse(f3x3),X,2)*Frobenius(f3x5,X,2)*Frobenius(f3x7,X,2)*Frobenius(inverse(f3x0),X,3)*Frobenius(inverse(f3x2),X,3)*Frobenius(f3x4,X,3)*Frobenius(f3x6,X,3)*Frobenius(f3x3,X,4)*Frobenius(f3x5,X,4)*Frobenius(f3x2,X,5)*Frobenius(f3x4,X,5)*Frobenius(f3x1,X,6)*Frobenius(f3x3,X,6)*Frobenius(f3x0,X,7)*Frobenius(f3x2,X,7);
xB=f3x0;
t1=xA*xB;
t0=t0*t0;
t0=t0*t1;
r=t0;
return r;
}
void SoftExpo(ZZn24 &f3, ZZn2 &X){
ZZn24 t0;
int i;
t0=f3; f3.conj(); f3/=t0;
f3.mark_as_regular();
t0=f3; for (i=1;i<=4;i++) f3.powq(X); f3*=t0;
f3.mark_as_unitary();
}
//
// R-ate Pairing - note denominator elimination has been applied
//
// P is a point of order q. Q(x,y) is a point of order q.
// Note that P is a point on the sextic twist of the curve over Fp^2, Q(x,y) is a point on the
// curve over the base field Fp
//
BOOL fast_pairing(ECn4& P,ZZn& Qx,ZZn& Qy,Big &x,ZZn2 &X,ZZn24& r)
{
ECn4 A;
Big n;
int i,nb;
#ifdef MR_COUNT_OPS
fpc=fpa=fpx=0;
#endif
n=x; // t-1
A=P; // remember A
nb=bits(n);
r=1;
r.mark_as_miller();
//fpc=fpa=fpx=0;
for (i=nb-2;i>=0;i--)
{
r*=r;
r*=g(A,A,Qx,Qy);
if (bit(n,i))
r*=g(A,P,Qx,Qy);
}
if (r.iszero()) return FALSE;
#ifdef MR_COUNT_OPS
cout << "Miller fpc= " << fpc << endl;
cout << "Miller fpa= " << fpa << endl;
cout << "Miller fpx= " << fpx << endl;
fpa=fpc=fpx=0;
#endif
SoftExpo(r,X);
r=HardExpo(r,X,x);
#ifdef MR_COUNT_OPS
cout << "FE fpc= " << fpc << endl;
cout << "FE fpa= " << fpa << endl;
cout << "FE fpx= " << fpx << endl;
fpa=fpc=fpx=0;
#endif
return TRUE;
}
//
// ecap(.) function
//
BOOL ecap(ECn4& P,ECn& Q,Big& x,ZZn2 &X,ZZn24& r)
{
BOOL Ok;
Big xx,yy;
ZZn Qx,Qy;
Q.get(xx,yy); Qx=xx; Qy=yy;
Ok=fast_pairing(P,Qx,Qy,x,X,r);
if (Ok) return TRUE;
return FALSE;
}
// Automatically generated by Luis Dominguez
ECn4 HashG2(ECn4& Qx0, Big& x, ZZn2& X){
//vector=[ 1, 2, 3, 4 ]
ECn4 r;
ECn4 xA;
ECn4 xB;
ECn4 xC;
ECn4 t0;
ECn4 t1;
ECn4 Qx0_;
ECn4 Qx1;
ECn4 Qx1_;
ECn4 Qx2;
ECn4 Qx2_;
ECn4 Qx3;
ECn4 Qx3_;
ECn4 Qx4;
ECn4 Qx4_;
ECn4 Qx5;
ECn4 Qx5_;
ECn4 Qx6;
ECn4 Qx6_;
ECn4 Qx7;
ECn4 Qx7_;
ECn4 Qx8;
ECn4 Qx8_;
Qx0_=-(Qx0);
Qx1=x*Qx0;
Qx1_=-(Qx1);
Qx2=x*Qx1;
Qx2_=-(Qx2);
Qx3=x*Qx2;
Qx3_=-(Qx3);
Qx4=x*Qx3;
Qx4_=-(Qx4);
Qx5=x*Qx4;
Qx5_=-(Qx5);
Qx6=x*Qx5;
Qx6_=-(Qx6);
Qx7=x*Qx6;
Qx7_=-(Qx7);
Qx8=x*Qx7;
Qx8_=-(Qx8);
xA=Qx0;
xC=Qx7;
xA+=xC;
xC=psi(Qx2,X,4);
xA+=xC;
xB=Qx0;
xC=Qx7;
xB+=xC;
xC=psi(Qx2,X,4);
xB+=xC;
t0=xA+xB;
xB=Qx2_;
xC=Qx3_;
xB+=xC;
xC=Qx8_;
xB+=xC;
xC=psi(Qx2,X,1);
xB+=xC;
xC=psi(Qx3_,X,1);
xB+=xC;
xC=psi(Qx1,X,6);
xB+=xC;
t0=t0+xB;
xB=Qx4;
xC=Qx5_;
xB+=xC;
xC=psi(Qx0_,X,4);
xB+=xC;
xC=psi(Qx4_,X,4);
xB+=xC;
xC=psi(Qx0,X,5);
xB+=xC;
xC=psi(Qx1_,X,5);
xB+=xC;
xC=psi(Qx2_,X,5);
xB+=xC;
xC=psi(Qx3,X,5);
xB+=xC;
t0=t0+xB;
xA=Qx1;
xC=psi(Qx0_,X,1);
xA+=xC;
xC=psi(Qx1,X,1);
xA+=xC;
xC=psi(Qx4_,X,1);
xA+=xC;
xC=psi(Qx5,X,1);
xA+=xC;
xC=psi(Qx0,X,2);
xA+=xC;
xC=psi(Qx1_,X,2);
xA+=xC;
xC=psi(Qx4_,X,2);
xA+=xC;
xC=psi(Qx5,X,2);
xA+=xC;
xC=psi(Qx0,X,3);
xA+=xC;
xC=psi(Qx1_,X,3);
xA+=xC;
xC=psi(Qx4_,X,3);
xA+=xC;
xC=psi(Qx5,X,3);
xA+=xC;
xC=psi(Qx1,X,4);
xA+=xC;
xC=psi(Qx3,X,4);
xA+=xC;
xC=psi(Qx0_,X,6);
xA+=xC;
xC=psi(Qx2_,X,6);
xA+=xC;
xB=Qx4;
xC=Qx5_;
xB+=xC;
xC=psi(Qx0_,X,4);
xB+=xC;
xC=psi(Qx4_,X,4);
xB+=xC;
xC=psi(Qx0,X,5);
xB+=xC;
xC=psi(Qx1_,X,5);
xB+=xC;
xC=psi(Qx2_,X,5);
xB+=xC;
xC=psi(Qx3,X,5);
xB+=xC;
t1=xA+xB;
t0=t0+t0;
t0=t0+t1;
r=t0;
return r;
}
//
// Hash functions
//
Big H2(ZZn24 x)
{ // Compress and hash an Fp24 to a big number
sha256 sh;
ZZn8 u;
ZZn4 h,l;
ZZn2 t,b;
Big a,hash,p;
ZZn xx[8];
char s[HASH_LEN];
int i,j,m;
shs256_init(&sh);
x.get(u); // compress to single ZZn4
u.get(l,h);
l.get(t,b);
t.get(xx[0],xx[1]);
b.get(xx[2],xx[3]);
h.get(t,b);
t.get(xx[4],xx[5]);
b.get(xx[6],xx[7]);
for (i=0;i<8;i++)
{
a=(Big)xx[i];
while (a>0)
{
m=a%256;
shs256_process(&sh,m);
a/=256;
}
}
shs256_hash(&sh,s);
hash=from_binary(HASH_LEN,s);
return hash;
}
Big H1(char *string)
{ // Hash a zero-terminated string to a number < modulus
Big h,p;
char s[HASH_LEN];
int i,j;
sha256 sh;
shs256_init(&sh);
for (i=0;;i++)
{
if (string[i]==0) break;
shs256_process(&sh,string[i]);
}
shs256_hash(&sh,s);
p=get_modulus();
h=1; j=0; i=1;
forever
{
h*=256;
if (j==HASH_LEN) {h+=i++; j=0;}
else h+=s[j++];
if (h>=p) break;
}
h%=p;
return h;
}
// Hash and map a Server Identity to a curve point E_(Fp4)
ECn4 hash_and_map4(char *ID)
{
int i;
ECn4 S;
ZZn4 X;
ZZn2 t;
Big x0=H1(ID);
forever
{
x0+=1;
t.set((ZZn)0,(ZZn)x0);
X.set(t,(ZZn2)0);
if (!S.set(X)) continue;
break;
}
return S;
}
// Hash and Map a Client Identity to a curve point E_(Fp) of order q
ECn hash_and_map(char *ID,Big cf)
{
ECn Q;
Big x0=H1(ID);
while (!Q.set(x0,x0)) x0+=1;
Q*=cf;
return Q;
}
void endomorph(ECn &A,ZZn &Beta)
{ // apply endomorphism P(x,y) = (Beta*x,y) where Beta is cube root of unity
// Actually (Beta*x,-y) = x^4.P
ZZn x,y;
x=(A.get_point())->X;
y=(A.get_point())->Y;
y=-y;
x*=Beta;
copy(getbig(x),(A.get_point())->X);
copy(getbig(y),(A.get_point())->Y);
}
// Use GLV endomorphism idea for multiplication in G1.
ECn G1_mult(ECn &P,Big &e,Big &x,ZZn &Beta)
{
// return e*P;
int i;
ECn Q;
Big x4,u[2];
x4=x*x; x4*=x4;
u[0]=e%x4; u[1]=e/x4;
Q=P;
endomorph(Q,Beta);
Q=mul(u[0],P,u[1],Q);
return Q;
}
//.. for multiplication in G2
ECn4 G2_mult(ECn4 &P,Big e,Big &x,ZZn2 &X)
{
// return e*P;
int i;
ECn4 Q[8];
Big u[8];
for (i=0;i<8;i++) {u[i]=e%x; e/=x;}
Q[0]=P;
for (i=1;i<8;i++)
Q[i]=psi(Q[i-1],X,1);
// simple multi-addition
return mul(8,Q,u);
}
//.. and for exponentiation in GT
ZZn24 GT_pow(ZZn24 &res,Big e,Big &x,ZZn2 &X)
{
// return pow(res,e);
int i,j;
ZZn24 Y[8];
Big u[8];
for (i=0;i<8;i++) {u[i]=e%x; e/=x;}
Y[0]=res;
for (i=1;i<8;i++)
{Y[i]=Y[i-1]; Y[i].powq(X);}
// simple multi-exponentiation
return pow(8,Y,u);
}
// Fast group membership check for GT
// check if r is of order q
// Test r^q=r^{(p+1-t)/cf}= 1
// so test r^p=r^x and r^cf !=1
// exploit cf=(x-1)*(x-1)/3
BOOL member(ZZn24 &r,Big &x,ZZn2 &X)
{
ZZn24 w=r;
ZZn24 rx;
if (r*conj(r)!=(ZZn24)1) return FALSE; // not unitary
w.powq(X);
rx=pow(r,x);
if (w!=rx) return FALSE;
if (r*pow(rx,x)==rx*rx) return FALSE;
return TRUE;
}
int main()
{
miracl* mip=&precision;
ZZn2 X;
ECn Alice,Bob,sA,sB;
ECn4 Server,sS;
ZZn24 sp,ap,bp,res;
Big a,b,s,ss,p,q,x,y,B,cf,t,n;
ZZn Beta;
int i;
time_t seed;
mip->IOBASE=16;
x="E000000000058400"; // low Hamming weight = 7
t=1+x;
p=(1+x+x*x-pow(x,4)+2*pow(x,5)-pow(x,6)+pow(x,8)-2*pow(x,9)+pow(x,10))/3;
q=1-pow(x,4)+pow(x,8);
n=p+1-t;
cf=(x-1)*(x-1)/3; //=n/q
cf=(x-1); // Neat trick! Whole group is non-cyclic - just has (x-1)^2 as a factor
// So multiplication by x-1 is sufficient to create a point of order q
ecurve((Big)0,(Big)6,p,MR_AFFINE);
set_frobenius_constant(X);
Beta=pow((ZZn)2,(p-1)/3);
Beta*=Beta; // right cube root of unity
time(&seed);
irand((long)seed);
ss=rand(q); // TA's super-secret
mip->TWIST=MR_SEXTIC_D; // map Server to point on twisted curve E(Fp4)
Server=hash_and_map4((char *)"Server");
Server=HashG2(Server,x,X); // fast multiplication by co-factor
// Should be point at infinity
// cout << "psi^2(Server-t*psi(Server)+p*Server= " << psi(Server,X,2)-t*psi(Server,X,1)+p*Server << endl;
Alice=hash_and_map((char *)"Alice",cf);
Bob= hash_and_map((char *)"Robert",cf);
cout << "Alice, Bob and the Server visit Trusted Authority" << endl;
sS=G2_mult(Server,ss,x,X);
sA=G1_mult(Alice,ss,x,Beta);
sB=G1_mult(Bob,ss,x,Beta);
cout << "Alice and Server Key Exchange" << endl;
a=rand(q); // Alice's random number
s=rand(q); // Server's random number
if (!ecap(Server,sA,x,X,res)) cout << "Trouble" << endl;
if (!member(res,x,X))
{
cout << "Wrong group order - aborting" << endl;
exit(0);
}
ap=GT_pow(res,a,x,X);
if (!ecap(sS,Alice,x,X,res)) cout << "Trouble" << endl;
if (!member(res,x,X))
{
cout << "Wrong group order - aborting" << endl;
exit(0);
}
sp=GT_pow(res,s,x,X);
cout << "Alice Key= " << H2(GT_pow(sp,a,x,X)) << endl;
cout << "Server Key= " << H2(GT_pow(ap,s,x,X)) << endl;
cout << "Bob and Server Key Exchange" << endl;
b=rand(q); // Bob's random number
s=rand(q); // Server's random number
if (!ecap(Server,sB,x,X,res)) cout << "Trouble" << endl;
if (!member(res,x,X))
{
cout << "Wrong group order - aborting" << endl;
exit(0);
}
bp=GT_pow(res,b,x,X);
if (!ecap(sS,Bob,x,X,res)) cout << "Trouble" << endl;
if (!member(res,x,X))
{
cout << "Wrong group order - aborting" << endl;
exit(0);
}
sp=GT_pow(res,s,x,X);
cout << "Bob's Key= " << H2(GT_pow(sp,b,x,X)) << endl;
cout << "Server Key= " << H2(GT_pow(bp,s,x,X)) << endl;
return 0;
}
Reference in New Issue View Git Blame Copy Permalink