447 lines
8.3 KiB
C++
447 lines
8.3 KiB
C++
/*
|
|
Scott's AKE Client/Server testbed
|
|
|
|
See http://eprint.iacr.org/2002/164
|
|
|
|
Compile as
|
|
cl /O2 /GX /DZZNS=16 ake4mnta.cpp zzn4.cpp zzn2.cpp ecn2.cpp big.cpp zzn.cpp
|
|
ecn.cpp miracl.lib
|
|
Fastest using COMBA build for 160-bit mod-mul
|
|
|
|
The file k4mnt.ecs is required
|
|
Security is G155/F640 (155-bit group, 640-bit field)
|
|
|
|
Speeded up using ideas from
|
|
"Efficient Computation of Tate Pairing in Projective Coordinate over General Characteristic Fields"
|
|
by Sanjit Chatterjee1, Palash Sarkar1 and Rana Barua1
|
|
|
|
Modified to prevent sub-group confinement attack
|
|
|
|
*/
|
|
|
|
#include <iostream>
|
|
#include <fstream>
|
|
#include <string.h>
|
|
#include "ecn.h"
|
|
#include <ctime>
|
|
#include "ecn2.h"
|
|
#include "zzn4.h"
|
|
|
|
using namespace std;
|
|
|
|
Miracl precision(10,0);
|
|
|
|
// Using SHA-1 as basic hash algorithm
|
|
|
|
#define HASH_LEN 20
|
|
#define COF 34
|
|
|
|
#ifdef MR_COUNT_OPS
|
|
extern "C"
|
|
{
|
|
int fpc,fpa,fpx;
|
|
}
|
|
#endif
|
|
|
|
//
|
|
// Define one or the other of these
|
|
//
|
|
// Which is faster depends on the I/M ratio - See imratio.c
|
|
// Roughly if I/M ratio > 16 use PROJECTIVE, otherwise use AFFINE
|
|
//
|
|
|
|
#ifdef MR_AFFINE_ONLY
|
|
#define AFFINE
|
|
#else
|
|
#define PROJECTIVE
|
|
#endif
|
|
|
|
//
|
|
// Tate Pairing Code
|
|
//
|
|
// Extract ECn point in internal ZZn format
|
|
//
|
|
|
|
void extract(ECn& A,ZZn& x,ZZn& y)
|
|
{
|
|
x=(A.get_point())->X;
|
|
y=(A.get_point())->Y;
|
|
}
|
|
|
|
ZZn4 line(ECn2& A,ECn2& C,ECn2& B,BOOL Doubling,ZZn2& lam,ZZn2& extra1,ZZn2& extra2,ZZn& Qx,ZZn& Qy)
|
|
{
|
|
ZZn4 w;
|
|
ZZn2 z3;
|
|
|
|
#ifdef AFFINE
|
|
|
|
ZZn2 x,y;
|
|
A.get(x,y);
|
|
w.set(ZZn2(0,Qy),lam*(tx(x)+Qx)-tx(y));
|
|
|
|
#endif
|
|
|
|
#ifdef PROJECTIVE
|
|
|
|
C.getZ(z3);
|
|
|
|
if (!Doubling)
|
|
{
|
|
ZZn2 x2,y2;
|
|
B.get(x2,y2);
|
|
w.set(tx(z3*Qy),lam*(tx(x2)+Qx)-z3*tx(y2));
|
|
}
|
|
else
|
|
{
|
|
ZZn2 x,y,z;
|
|
A.get(x,y,z);
|
|
w.set(tx(z3*extra2*Qy),lam*(extra2*Qx+tx(x))-tx(extra1));
|
|
}
|
|
/*
|
|
A.get(x,y,z);
|
|
x=tx(x); y=tx(y);
|
|
t=z; x*=z; z*=z; z*=t;
|
|
w.set(z3*z*ZZn2(0,Qy),lam*(x+z*Qx)-y*z3);
|
|
*/
|
|
#endif
|
|
|
|
return w;
|
|
}
|
|
|
|
ZZn4 g(ECn2& A,ECn2& B,ZZn& Qx,ZZn& Qy)
|
|
{
|
|
BOOL Doubling;
|
|
ZZn2 lam,extra1,extra2;
|
|
ECn2 P=A;
|
|
|
|
ZZn2 x,y,z;
|
|
|
|
// Evaluate line from A
|
|
|
|
Doubling=A.add(B,lam,extra1,extra2);
|
|
if (A.iszero()) return (ZZn4)1;
|
|
|
|
return line(P,A,B,Doubling,lam,extra1,extra2,Qx,Qy);
|
|
}
|
|
|
|
//
|
|
// Ate Pairing - note denominator elimination has been applied
|
|
//
|
|
// P is a point of order q. Q(x,y) is a point of order m.q.
|
|
// Note that P is a point on the curve over Fp, Q(x,y) a point on the
|
|
// extension field Fp^2
|
|
//
|
|
|
|
BOOL ate(ECn2& P,ECn Q,Big& t1,ZZn2 &Fr,Big cof,ZZn2& r)
|
|
{
|
|
int i,j,n,nb;
|
|
ECn2 A;
|
|
ZZn4 w,res;
|
|
ZZn Qx,Qy;
|
|
|
|
#ifdef MR_COUNT_OPS
|
|
fpc=fpa=fpx=0;
|
|
#endif
|
|
|
|
P.norm();
|
|
normalise(Q);
|
|
extract(Q,Qx,Qy);
|
|
|
|
Qx+=Qx; // because x^4+2 is irreducible..
|
|
Qy+=Qy;
|
|
|
|
res=1;
|
|
|
|
/* Miller loop - Left to right method */
|
|
A=P;
|
|
nb=bits(t1);
|
|
for (i=nb-2;i>=0;i--)
|
|
{
|
|
res*=res;
|
|
res*=g(A,A,Qx,Qy);
|
|
if (bit(t1,i))
|
|
res*=g(A,P,Qx,Qy);
|
|
}
|
|
|
|
#ifdef MR_COUNT_OPS
|
|
printf("After Miller fpc= %d fpa= %d fpx= %d\n",fpc,fpa,fpx);
|
|
fpa=fpc=fpx=0;
|
|
#endif
|
|
|
|
w=res;
|
|
w.powq(Fr); w.powq(Fr); // ^(p^2-1)
|
|
res=w/res;
|
|
|
|
res.mark_as_unitary();
|
|
|
|
res*=res; w=res; res*=res; res*=res; res*=res; res*=res; res*=w; // res=powu(res,34);
|
|
|
|
|
|
w=res;
|
|
res.powq(Fr);
|
|
res*=powu(w,cof);
|
|
|
|
#ifdef MR_COUNT_OPS
|
|
printf("After Final exp. fpc= %d fpa= %d fpx= %d\n",fpc,fpa,fpx);
|
|
fpa=fpc=fpx=0;
|
|
#endif
|
|
|
|
r=real(res);
|
|
|
|
if (r.isunity()) return FALSE;
|
|
return TRUE;
|
|
}
|
|
|
|
//
|
|
// Hash functions
|
|
//
|
|
|
|
Big H1(char *string)
|
|
{ // Hash a zero-terminated string to a number < modulus
|
|
Big h,p;
|
|
char s[HASH_LEN];
|
|
int i,j;
|
|
sha sh;
|
|
|
|
shs_init(&sh);
|
|
|
|
for (i=0;;i++)
|
|
{
|
|
if (string[i]==0) break;
|
|
shs_process(&sh,string[i]);
|
|
}
|
|
shs_hash(&sh,s);
|
|
p=get_modulus();
|
|
h=1; j=0; i=1;
|
|
forever
|
|
{
|
|
h*=256;
|
|
if (j==HASH_LEN) {h+=i++; j=0;}
|
|
else h+=s[j++];
|
|
if (h>=p) break;
|
|
}
|
|
h%=p;
|
|
return h;
|
|
}
|
|
|
|
Big H2(ZZn2 x)
|
|
{ // Hash an Fp2 to a big number
|
|
sha sh;
|
|
Big a,u,v;
|
|
char s[HASH_LEN];
|
|
int m;
|
|
|
|
shs_init(&sh);
|
|
x.get(u,v);
|
|
|
|
a=u;
|
|
while (a>0)
|
|
{
|
|
m=a%256;
|
|
shs_process(&sh,m);
|
|
a/=256;
|
|
}
|
|
a=v;
|
|
while (a>0)
|
|
{
|
|
m=a%256;
|
|
shs_process(&sh,m);
|
|
a/=256;
|
|
}
|
|
shs_hash(&sh,s);
|
|
a=from_binary(HASH_LEN,s);
|
|
return a;
|
|
}
|
|
|
|
// Hash and map a Server Identity to a curve point E(Fp2)
|
|
|
|
ECn2 hash2(char *ID)
|
|
{
|
|
ECn2 T;
|
|
ZZn2 x;
|
|
Big x0,y0=0;
|
|
|
|
x0=H1(ID);
|
|
do
|
|
{
|
|
x.set(x0,y0);
|
|
x0+=1;
|
|
}
|
|
while (!is_on_curve(x));
|
|
T.set(x);
|
|
|
|
// cout << "T= " << T << endl;
|
|
|
|
return T;
|
|
}
|
|
|
|
// Hash and map a Client Identity to a curve point E(Fp)
|
|
|
|
ECn hash_and_map(char *ID,Big cof)
|
|
{
|
|
ECn Q;
|
|
Big x0=H1(ID);
|
|
|
|
while (!is_on_curve(x0)) x0+=1;
|
|
Q.set(x0); // Make sure its on E(F_p)
|
|
|
|
Q*=cof;
|
|
return Q;
|
|
}
|
|
|
|
//
|
|
// fast multiplication by p-1+t
|
|
// We know F^2-tF+p = 0
|
|
// So p.S=t.F(S)-F^2(S), where F is Frobenius Endomorphism
|
|
// So (p-1+t).S = t(F(S)+S)-F^2(S)-S
|
|
// This is just multiplication by t, which is half size of (p-1+t)
|
|
//
|
|
|
|
void cofactor(ECn2& S,ZZn2& Fr,Big& t)
|
|
{
|
|
ECn2 T,K;
|
|
ZZn2 x,y,tx,tty;
|
|
|
|
K=S;
|
|
S.get(x,y);
|
|
x=txd(x);
|
|
y=txd(txd(y)); // untwist
|
|
|
|
x.conj();
|
|
y.conj(); y*=Fr; // ^p
|
|
|
|
tx=txx(x); tty=txx(txx(y));
|
|
S.set(tx,tty); // twist again
|
|
|
|
x.conj();
|
|
y.conj(); y*=Fr; // ^(p^2)
|
|
|
|
tx=txx(x); tty=txx(txx(y));
|
|
T.set(tx,tty); // twist
|
|
|
|
S+=K;
|
|
S*=t;
|
|
S-=T;
|
|
S-=K;
|
|
}
|
|
|
|
int main()
|
|
{
|
|
ifstream common("k4mnt.ecs"); // elliptic curve parameters
|
|
miracl* mip=&precision;
|
|
ECn Alice,Bob,sA,sB;
|
|
ECn2 Server,sS,tP;
|
|
ZZn2 res,sp,ap,bp,Fr,x,y;
|
|
ZZn4 X,Y,X2,Y2;
|
|
Big a,b,s,ss,p,q,r,B,delta,fr,t,t1;
|
|
|
|
int bits,A;
|
|
time_t seed;
|
|
|
|
cout << "Started" << endl;
|
|
common >> bits;
|
|
mip->IOBASE=16;
|
|
common >> p;
|
|
common >> A;
|
|
common >> B;
|
|
common >> q >> delta;
|
|
common >> fr;
|
|
|
|
cout << "Initialised... " << p%24 << endl;
|
|
|
|
t=p+1-COF*q;
|
|
t1=p-COF*q;
|
|
|
|
//cout << "p= " << p << endl;
|
|
//cout << "p%8= " << p%8 << endl;
|
|
cout << "t= " << t << endl;
|
|
//cout << "delta= " << delta << endl;
|
|
|
|
time(&seed);
|
|
irand((long)seed);
|
|
|
|
#ifdef AFFINE
|
|
ecurve(A,B,p,MR_AFFINE);
|
|
#endif
|
|
#ifdef PROJECTIVE
|
|
ecurve(A,B,p,MR_PROJECTIVE);
|
|
#endif
|
|
|
|
// Fr=get_frobenius_constant();
|
|
|
|
Fr=(ZZn2)fr;
|
|
mip->IOBASE=16;
|
|
mip->TWIST=MR_QUADRATIC; // map Server to point on twisted curve E(Fp2)
|
|
|
|
// hash Identities to curve point
|
|
|
|
ss=rand(q); // TA's super-secret
|
|
|
|
cout << "Mapping Server ID to point" << endl;
|
|
Server=hash2((char *)"Server");
|
|
cofactor(Server,Fr,t); // multiply by cofactor (p-1+t)
|
|
Server*=COF;
|
|
|
|
cout << "Mapping Alice & Bob ID's to points" << endl;
|
|
Alice=hash_and_map((char *)"Alice",COF);
|
|
|
|
Bob= hash_and_map((char *)"Robert",COF);
|
|
cout << "Alice, Bob and the Server visit Trusted Authority" << endl;
|
|
|
|
sS=ss*Server;
|
|
sA=ss*Alice;
|
|
sB=ss*Bob;
|
|
|
|
cout << "Alice and Server Key Exchange" << endl;
|
|
|
|
a=rand(q); // Alice's random number
|
|
s=rand(q); // Server's random number
|
|
|
|
if (!ate(Server,sA,t1,Fr,delta,res)) cout << "Trouble" << endl;
|
|
|
|
if (powl(res,q)!=(ZZn2)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
|
|
ap=powl(res,a);
|
|
|
|
if (!ate(sS,Alice,t1,Fr,delta,res)) cout << "Trouble" << endl;
|
|
if (powl(res,q)!=(ZZn2)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
sp=powl(res,s);
|
|
|
|
cout << "Alice Key= " << H2(powl(sp,a)) << endl;
|
|
cout << "Server Key= " << H2(powl(ap,s)) << endl;
|
|
|
|
cout << "Bob and Server Key Exchange" << endl;
|
|
|
|
b=rand(q); // Bob's random number
|
|
s=rand(q); // Server's random number
|
|
|
|
if (!ate(Server,sB,t1,Fr,delta,res)) cout << "Trouble" << endl;
|
|
if (powl(res,q)!=(ZZn2)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
bp=powl(res,b);
|
|
|
|
if (!ate(sS,Bob,t1,Fr,delta,res)) cout << "Trouble" << endl;
|
|
if (powl(res,q)!=(ZZn2)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
sp=powl(res,s);
|
|
|
|
cout << "Bob's Key= " << H2(powl(sp,b)) << endl;
|
|
cout << "Server Key= " << H2(powl(bp,s)) << endl;
|
|
|
|
return 0;
|
|
}
|