285 lines
5.7 KiB
C++
285 lines
5.7 KiB
C++
/*
|
|
Scott's AKE Client/Server testbed
|
|
|
|
See http://eprint.iacr.org/2002/164
|
|
|
|
Compile as
|
|
cl /O2 /GX /DBIGS=18 ake2cpw.cpp zzn2.cpp big.cpp monty.cpp elliptic.cpp miracl.lib
|
|
using COMBA build
|
|
|
|
Cocks-Pinch curve - Weil pairing
|
|
|
|
Requires file k2.ecs which contains details of non-supersingular
|
|
elliptic curve, with order divisible by q=2^159+2^17+1, and security
|
|
multiplier k=2. The prime p is 512 bits
|
|
|
|
NOTE: Key exchange bandwidth could be reduced by halve using ideas from
|
|
"Doing more with Fewer Bits", Brouwer, Pellikaan & Verheul, Asiacrypt
|
|
'99
|
|
|
|
*/
|
|
|
|
#include <iostream>
|
|
#include <fstream>
|
|
#include <ctime>
|
|
#include "ecn.h"
|
|
#include "zzn.h"
|
|
#include "zzn2.h"
|
|
|
|
using namespace std;
|
|
|
|
Miracl precision(34,0);
|
|
|
|
// Using SHA-512 as basic hash algorithm
|
|
|
|
#define HASH_LEN 64
|
|
|
|
//
|
|
// Weil Pairing Code
|
|
//
|
|
//
|
|
// Extract ECn point in internal ZZn format
|
|
//
|
|
|
|
void extract(ECn& A,ZZn& x,ZZn& y)
|
|
{
|
|
x=(A.get_point())->X;
|
|
y=(A.get_point())->Y;
|
|
}
|
|
|
|
ZZn2 g(ECn& A,ECn& B,ECn& C,ECn& D,ECn& P,ECn& Q)
|
|
{
|
|
ZZn x,y,Ax,Ay,Cx,Cy,lam1,lam2;
|
|
ZZn2 u,w;
|
|
big ptr1,ptr2;
|
|
|
|
extract(A,Ax,Ay);
|
|
extract(C,Cx,Cy);
|
|
|
|
double_add(B,A,D,C,ptr1,ptr2); // adds B to A and D to C
|
|
// uses Montgomery's trick
|
|
// returns line slopes in ptr1 and ptr2
|
|
|
|
if (A.iszero() || C.iszero()) return (ZZn2)1;
|
|
if (ptr1==NULL || ptr2==NULL) return (ZZn2)0;
|
|
|
|
//
|
|
// Recall that Q and C are "really" of the form [(-x,0),(0,y)]
|
|
// The slope of the real curve is -i*slope of the twist
|
|
// [(iQy-Ay) - m1(-Qx-Ax)]/(Py-iCy)+i.m2(Px+Cx)
|
|
// Instead of division, calculate conjugate and multiply (remember Fermat!)
|
|
//
|
|
|
|
lam1=ptr1;
|
|
lam2=ptr2;
|
|
|
|
extract(Q,x,y);
|
|
|
|
Ax+=x; // numerator
|
|
Ax*=lam1;
|
|
u.set(Ax-Ay,y);
|
|
|
|
extract(P,x,y);
|
|
|
|
Cx+=x; // denominator
|
|
Cx*=lam2;
|
|
|
|
w.set(y,Cy-Cx); // conjugate trick !
|
|
// and don't forget the -i on the slope!
|
|
return (w*u);
|
|
}
|
|
|
|
//
|
|
// New Weil Pairing - note denominator elimination has been applied
|
|
//
|
|
// nw(P,Q) = [m(P,Q)/m(Q,P)]^(p-1)
|
|
//
|
|
// P(x,y) is a point of order q. Q(x,y) is a point of order q.
|
|
//
|
|
|
|
BOOL nw(ECn& P,ECn& Q,Big& q,ZZn& r)
|
|
{
|
|
ZZn2 m=1;
|
|
int i,nb;
|
|
ECn A=P;
|
|
ECn B=Q;
|
|
|
|
nb=bits(q);
|
|
for (i=nb-2;i>=0;i--)
|
|
{ // one loop !
|
|
m*=m;
|
|
m*=g(A,A,B,B,P,Q);
|
|
if (bit(q,i))
|
|
m*=g(A,P,B,Q,P,Q);
|
|
}
|
|
|
|
m=conj(m)/m; // raise to power of (p-1)
|
|
|
|
if (!A.iszero() || m.iszero()) return FALSE;
|
|
if (m.isunity()) return FALSE;
|
|
|
|
r=real(m);
|
|
return TRUE;
|
|
}
|
|
|
|
//
|
|
// Hash functions
|
|
//
|
|
|
|
Big H1(char *string)
|
|
{ // Hash a zero-terminated string to a number < modulus
|
|
Big h,p;
|
|
char s[HASH_LEN];
|
|
int i,j;
|
|
sha512 sh;
|
|
|
|
shs512_init(&sh);
|
|
|
|
for (i=0;;i++)
|
|
{
|
|
if (string[i]==0) break;
|
|
shs512_process(&sh,string[i]);
|
|
}
|
|
shs512_hash(&sh,s);
|
|
p=get_modulus();
|
|
h=1; j=0; i=1;
|
|
forever
|
|
{
|
|
h*=256;
|
|
if (j==HASH_LEN) {h+=i++; j=0;}
|
|
else h+=s[j++];
|
|
if (h>=p) break;
|
|
}
|
|
h%=p;
|
|
return h;
|
|
}
|
|
|
|
Big H2(ZZn x)
|
|
{ // Hash an Fp to a big number
|
|
sha sh;
|
|
Big a,h,p;
|
|
char s[20];
|
|
int m;
|
|
|
|
shs_init(&sh);
|
|
a=(Big)x;
|
|
while (a>0)
|
|
{
|
|
m=a%256;
|
|
shs_process(&sh,m);
|
|
a/=256;
|
|
}
|
|
shs_hash(&sh,s);
|
|
h=from_binary(20,s);
|
|
return h;
|
|
}
|
|
|
|
// Hash and map a Client Identity to a curve point E_(Fp)
|
|
|
|
ECn hash_and_map(char *ID,Big cof)
|
|
{
|
|
ECn Q;
|
|
Big x0=H1(ID);
|
|
|
|
while (!Q.set(x0)) x0+=1;
|
|
Q*=cof;
|
|
|
|
return Q;
|
|
}
|
|
|
|
/* Note that if #E(Fp) = p+1-t
|
|
then #E(Fp2) = (p+1-t)(p+1+t) (a multiple of #E(Fp))
|
|
(Weil's Theorem)
|
|
*/
|
|
|
|
int main()
|
|
{
|
|
ifstream common("k2.ecs"); // elliptic curve parameters
|
|
miracl* mip=&precision;
|
|
ECn Alice,Bob,sA,sB;
|
|
ECn B2,Server,sS;
|
|
ZZn res,sp,ap,bp;
|
|
Big t,r,a,b,s,ss,p,q,x,y,B,cof,cf,cf2;
|
|
int bits,A;
|
|
time_t seed;
|
|
|
|
common >> bits;
|
|
mip->IOBASE=16;
|
|
common >> p;
|
|
common >> A;
|
|
common >> B;
|
|
common >> cof;
|
|
common >> q;
|
|
|
|
t=p+1-cof*q;
|
|
|
|
cf= (p+1-t)/q; // q divides p+1 (for k=2 condition)
|
|
cf2=(p+1+t)/q; // and therefore also divides t (as it divides r)
|
|
|
|
// this co-factor is in fact not needed....
|
|
|
|
time(&seed);
|
|
irand((long)seed);
|
|
|
|
|
|
mip->IOBASE=16;
|
|
|
|
// hash Identities to curve point
|
|
|
|
ss=rand(q); // TA's super-secret
|
|
|
|
cout << "Mapping Server ID to point" << endl;
|
|
|
|
ecurve(A,-B,p,MR_AFFINE); // twist curve
|
|
|
|
Server=hash_and_map((char *)"Server",cf2);
|
|
|
|
cout << "Mapping Alice & Bob ID's to points" << endl;
|
|
|
|
ecurve(A,B,p,MR_AFFINE);
|
|
|
|
Alice=hash_and_map((char *)"Alice",cf);
|
|
Bob= hash_and_map((char *)"Robert",cf);
|
|
|
|
// Alice, Bob are points of order q
|
|
// Server does not need to be (its order is a multiple of q)
|
|
|
|
cout << "Alice, Bob and the Server visit Trusted Authority" << endl;
|
|
|
|
sS=ss*Server;
|
|
sA=ss*Alice;
|
|
sB=ss*Bob;
|
|
|
|
cout << "Alice and Server Key exchange" << endl;
|
|
|
|
a=rand(q); // Alice's random number
|
|
s=rand(q); // Server's random number
|
|
|
|
if (!nw(sA,Server,q,res)) cout << "Trouble" << endl;
|
|
|
|
ap=powl(res,a);
|
|
|
|
if (!nw(Alice,sS,q,res)) cout << "Trouble" << endl;
|
|
sp=powl(res,s);
|
|
|
|
cout << "Alice Key= " << H2(powl(sp,a)) << endl;
|
|
cout << "Server Key= " << H2(powl(ap,s)) << endl;
|
|
|
|
cout << "Bob and Server Key exchange" << endl;
|
|
|
|
b=rand(q); // Bob's random number
|
|
s=rand(q); // Server's random number
|
|
|
|
if (!nw(sB,Server,q,res)) cout << "Trouble" << endl;
|
|
bp=powl(res,b);
|
|
|
|
if (!nw(Bob,sS,q,res)) cout << "Trouble" << endl;
|
|
sp=powl(res,s);
|
|
|
|
cout << "Bob's Key= " << H2(powl(sp,b)) << endl;
|
|
cout << "Server Key= " << H2(powl(bp,s)) << endl;
|
|
|
|
return 0;
|
|
}
|
|
|