425 lines
8.3 KiB
C++
425 lines
8.3 KiB
C++
/*
|
|
|
|
Scott's AKE Client/Server testbed
|
|
|
|
See http://eprint.iacr.org/2002/164
|
|
|
|
Compile as
|
|
cl /O2 /GX /DZZNS=16 ake6fsta.cpp zzn6a.cpp zzn2.cpp big.cpp zzn.cpp ecn.cpp miracl.lib
|
|
using COMBA build
|
|
|
|
Freeman-Scott-Teske curve - Ate pairing
|
|
|
|
This version uses the sextic twist and the Ate pairing
|
|
No elliptic curve operations over an extension field!
|
|
|
|
p=1+3*x+3*x*x+9*pow(x,3)+27*pow(x,4)
|
|
r=1+3*x+9*x*x
|
|
t=2+3*x
|
|
|
|
For this curve k=6, rho=2 (which is bad...)
|
|
p is 512 bits, 6p = 3072 bits, r is 256 bits
|
|
|
|
For this program p MUST be 13 mod 24
|
|
|
|
final exponent = (1+9*x^3)*p^0 + 3x^2*p^1
|
|
|
|
Modified to prevent sub-group confinement attack
|
|
|
|
*/
|
|
|
|
#include <iostream>
|
|
#include <fstream>
|
|
#include <string.h>
|
|
#include <ctime>
|
|
#include "ecn.h"
|
|
#include "zzn6a.h"
|
|
|
|
using namespace std;
|
|
|
|
Miracl precision(16,0);
|
|
|
|
// Using SHA-1 as basic hash algorithm
|
|
|
|
#define HASH_LEN 20
|
|
|
|
//
|
|
// Define one or the other of these
|
|
//
|
|
// Which is faster depends on the I/M ratio - See imratio.c
|
|
// Roughly if I/M ratio > 16 use PROJECTIVE, otherwise use AFFINE
|
|
//
|
|
|
|
#ifdef MR_AFFINE_ONLY
|
|
#define AFFINE
|
|
#else
|
|
#define PROJECTIVE
|
|
#endif
|
|
|
|
//
|
|
// Tate Pairing Code
|
|
//
|
|
// Extract ECn point in internal ZZn format
|
|
//
|
|
|
|
void extract(ECn& A,ZZn& x,ZZn& y)
|
|
{
|
|
x=(A.get_point())->X;
|
|
y=(A.get_point())->Y;
|
|
}
|
|
|
|
#ifdef PROJECTIVE
|
|
void extract(ECn& A,ZZn& x,ZZn& y,ZZn& z)
|
|
{
|
|
big t;
|
|
x=(A.get_point())->X;
|
|
y=(A.get_point())->Y;
|
|
t=(A.get_point())->Z;
|
|
if (A.get_status()!=MR_EPOINT_GENERAL) z=1;
|
|
else z=t;
|
|
}
|
|
#endif
|
|
|
|
void set_frobenius_constant(ZZn2 &X)
|
|
{
|
|
Big p=get_modulus();
|
|
switch (get_mip()->pmod8)
|
|
{
|
|
case 5:
|
|
X.set((Big)0,(Big)1); // = (sqrt(-2)^(p-1)/2
|
|
break;
|
|
case 3: // = (1+sqrt(-1))^(p-1)/2
|
|
X.set((Big)1,(Big)1);
|
|
break;
|
|
case 7:
|
|
X.set((Big)2,(Big)1); // = (2+sqrt(-1))^(p-1)/2
|
|
default: break;
|
|
}
|
|
X=pow(Fr,(p-1)/3);
|
|
}
|
|
|
|
//
|
|
// Line from A to destination C. Let A=(x,y)
|
|
// Line Y-slope.X-c=0, through A, so intercept c=y-slope.x
|
|
// Line Y-slope.X-y+slope.x = (Y-y)-slope.(X-x) = 0
|
|
// Now evaluate at Q -> return (Qy-y)-slope.(Qx-x)
|
|
//
|
|
|
|
ZZn6 line(ECn& A,ECn& C,ZZn& slope,ECn& Q)
|
|
{
|
|
ZZn6 n;
|
|
ZZn2 p;
|
|
ZZn x,y,z,t,Qx,Qy;
|
|
extract(Q,Qx,Qy);
|
|
#ifdef AFFINE
|
|
extract(A,x,y);
|
|
n.set(-Qx,0,x);
|
|
p.set(-Qy,y);
|
|
n*=slope; n=tx(n);
|
|
n-=p;
|
|
#endif
|
|
#ifdef PROJECTIVE
|
|
extract(A,x,y,z);
|
|
x*=z; t=z; z*=z; z*=t;
|
|
Qx*=z; Qy*=z;
|
|
p.set(-Qy,y);
|
|
t=-Qx*slope;
|
|
x*=slope;
|
|
n.set(t,0,x);
|
|
n=tx(n);
|
|
extract(C,x,y,z);
|
|
p*=z; n-=p;
|
|
#endif
|
|
return n;
|
|
}
|
|
|
|
//
|
|
// Add A=A+B (or A=A+A)
|
|
// Evaluate line function
|
|
//
|
|
|
|
ZZn6 g(ECn& A,ECn& B,ECn& Q)
|
|
{
|
|
int type;
|
|
ZZn lam;
|
|
big ptr;
|
|
ECn P=A;
|
|
|
|
// Evaluate line from A
|
|
type=A.add(B,&ptr);
|
|
if (!type) return (ZZn6)1;
|
|
else lam=ptr;
|
|
|
|
return line(P,A,lam,Q);
|
|
}
|
|
|
|
//
|
|
// Ate Pairing - note denominator elimination has been applied
|
|
//
|
|
// P is a point of order q. Q(x,y) is a point of order q.
|
|
// Note that P is a point on the sextic twist curve over Fp,
|
|
// Q(x,y) a point on the base curve
|
|
//
|
|
|
|
BOOL fast_pairing(ECn& P,ECn& Q,Big& q,Big &x,ZZn2 &X, ZZn6 &res)
|
|
{
|
|
int i,j,n,nb,nbw,nzs;
|
|
ECn A;
|
|
Big T=3*x+1;
|
|
ZZn6 w,t;
|
|
|
|
res=1;
|
|
A=P;
|
|
normalise(Q);
|
|
|
|
nb=bits(T);
|
|
|
|
// Miller Loop
|
|
for (i=nb-2;i>=0;i--)
|
|
{
|
|
res*=res;
|
|
t=g(A,A,Q);
|
|
res*=t;
|
|
if (bit(T,i))
|
|
{
|
|
t=g(A,P,Q);
|
|
res*=t;
|
|
}
|
|
}
|
|
|
|
if (res.iszero()) return FALSE;
|
|
|
|
// Final Exponentiation
|
|
w=res;
|
|
w.powq(X);
|
|
|
|
res*=w; // ^(p+1)
|
|
|
|
w=res;
|
|
|
|
w.conj();
|
|
res=w/res; // ^(p^3-1)
|
|
|
|
res.mark_as_unitary();
|
|
|
|
t=w=res;
|
|
w.powq(X);
|
|
|
|
res=pow(res,3*x); // specially tailored final exponentiation
|
|
res*=w;
|
|
res=pow(res,3*x);
|
|
res=pow(res,x);
|
|
res*=t;
|
|
|
|
if (res==(ZZn6)1) return FALSE;
|
|
return TRUE;
|
|
}
|
|
|
|
//
|
|
// Hash functions
|
|
//
|
|
|
|
Big H1(char *string)
|
|
{ // Hash a zero-terminated string to a number < modulus
|
|
Big h,p;
|
|
char s[HASH_LEN];
|
|
int i,j;
|
|
sha sh;
|
|
|
|
shs_init(&sh);
|
|
|
|
for (i=0;;i++)
|
|
{
|
|
if (string[i]==0) break;
|
|
shs_process(&sh,string[i]);
|
|
}
|
|
shs_hash(&sh,s);
|
|
p=get_modulus();
|
|
h=1; j=0; i=1;
|
|
forever
|
|
{
|
|
h*=256;
|
|
if (j==HASH_LEN) {h+=i++; j=0;}
|
|
else h+=s[j++];
|
|
if (h>=p) break;
|
|
}
|
|
h%=p;
|
|
return h;
|
|
}
|
|
|
|
Big H2(ZZn6 y)
|
|
{ // Compress and Hash an Fp6 to a big number
|
|
sha sh;
|
|
Big a,h,p,xx[2];
|
|
ZZn u,v,w;
|
|
ZZn2 x;
|
|
char s[HASH_LEN];
|
|
int i,j,m;
|
|
|
|
shs_init(&sh);
|
|
y.get(x);
|
|
x.get(u,v);
|
|
xx[0]=u; xx[1]=v;
|
|
for (i=0;i<2;i++)
|
|
{
|
|
a=xx[i];
|
|
while (a>0)
|
|
{
|
|
m=a%256;
|
|
shs_process(&sh,m);
|
|
a/=256;
|
|
}
|
|
}
|
|
shs_hash(&sh,s);
|
|
h=from_binary(HASH_LEN,s);
|
|
return h;
|
|
}
|
|
|
|
// Hash and map a Client Identity to a curve point E_(Fp)
|
|
|
|
ECn hash_and_map(char *ID,Big& cof)
|
|
{
|
|
ECn Q;
|
|
Big x0=H1(ID);
|
|
forever
|
|
{
|
|
while (!Q.set(x0)) x0+=1;
|
|
x0+=1;
|
|
Q*=cof;
|
|
if (!Q.iszero()) break;
|
|
}
|
|
return Q;
|
|
}
|
|
|
|
int main()
|
|
{
|
|
miracl* mip=&precision;
|
|
ECn Alice,Bob,sA,sB,Server,sS;
|
|
ZZn6 res,sp,ap,bp;
|
|
ZZn2 X;
|
|
Big a,b,s,ss,p,q,x,y,B,cof,t,cf,cof1;
|
|
int i,bits,A;
|
|
time_t seed;
|
|
|
|
mip->IOBASE=16;
|
|
x="60000000000000000000000000012014"; // Low Hamming weight
|
|
q=1+3*x+9*x*x;
|
|
p=1+3*x+3*x*x+9*pow(x,3)+27*pow(x,4);
|
|
t=2+3*x;
|
|
cof=(p+1-t)/q;
|
|
A=0; B=1;
|
|
|
|
cout << "Initialised... " << endl;
|
|
cout << "p%24= " << p%24 << endl;
|
|
|
|
time(&seed);
|
|
irand((long)seed);
|
|
mip->IOBASE=16;
|
|
cof1=cof+1;
|
|
|
|
ss=rand(q); // TA's super-secret
|
|
|
|
#ifdef AFFINE
|
|
ecurve(A,B,p,MR_AFFINE);
|
|
#endif
|
|
#ifdef PROJECTIVE
|
|
ecurve(A,B,p,MR_PROJECTIVE);
|
|
#endif
|
|
|
|
set_frobenius_constant(X);
|
|
|
|
cout << "Mapping Server ID to point" << endl;
|
|
Server=hash_and_map((char *)"Server",cof);
|
|
sS=ss*Server;
|
|
|
|
// sextic twist
|
|
|
|
#ifdef AFFINE
|
|
ecurve(A,B*(p-1)/2,p,MR_AFFINE);
|
|
#endif
|
|
#ifdef PROJECTIVE
|
|
ecurve(A,B*(p-1)/2,p,MR_PROJECTIVE);
|
|
#endif
|
|
|
|
cout << "Mapping Alice & Bob ID's to points" << endl;
|
|
Alice=hash_and_map((char *)"Alice",cof1); // cof+1 is the co-factor for the sextic twist (?)
|
|
Bob= hash_and_map((char *)"Robert",cof1);
|
|
|
|
cout << "Alice and Bob visit Trusted Authority" << endl;
|
|
|
|
sA=ss*Alice;
|
|
sB=ss*Bob;
|
|
|
|
cout << "Alice and Server Key Exchange" << endl;
|
|
|
|
a=rand(q); // Alice's random number
|
|
s=rand(q); // Server's random number
|
|
|
|
if (!fast_pairing(sA,Server,q,x,X,res)) cout << "Trouble" << endl;
|
|
if (pow(res,q)!=(ZZn6)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
ap=powu(res,a);
|
|
|
|
if (!fast_pairing(Alice,sS,q,x,X,res)) cout << "Trouble" << endl;
|
|
if (pow(res,q)!=(ZZn6)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
sp=powu(res,s);
|
|
|
|
cout << "Alice Key= " << H2(pow(sp,a)) << endl;
|
|
cout << "Server Key= " << H2(pow(ap,s)) << endl;
|
|
|
|
cout << "Bob and Server Key Exchange" << endl;
|
|
|
|
b=rand(q); // Bob's random number
|
|
s=rand(q); // Server's random number
|
|
|
|
if (!fast_pairing(sB,Server,q,x,X,res)) cout << "Trouble" << endl;
|
|
if (pow(res,q)!=(ZZn6)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
bp=powu(res,b);
|
|
|
|
if (!fast_pairing(Bob,sS,q,x,X,res)) cout << "Trouble" << endl;
|
|
if (pow(res,q)!=(ZZn6)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
sp=powu(res,s);
|
|
|
|
cout << "Bob's Key= " << H2(powu(sp,b)) << endl;
|
|
cout << "Server Key= " << H2(powu(bp,s)) << endl;
|
|
|
|
cout << "Alice and Bob's attempted Key exchange" << endl;
|
|
|
|
if (!fast_pairing(Alice,sB,q,x,X,res)) cout << "Trouble" << endl;
|
|
if (pow(res,q)!=(ZZn6)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
bp=powu(res,b);
|
|
|
|
if (!fast_pairing(sA,Bob,q,x,X,res)) cout << "Trouble" << endl;
|
|
if (pow(res,q)!=(ZZn6)1)
|
|
{
|
|
cout << "Wrong group order - aborting" << endl;
|
|
exit(0);
|
|
}
|
|
ap=powu(res,a);
|
|
|
|
cout << "Alice Key= " << H2(powu(ap,b)) << endl;
|
|
cout << "Bob's Key= " << H2(powu(bp,a)) << endl;
|
|
|
|
return 0;
|
|
}
|
|
|