embed a diffie hellmann key exchange

diff --git a/d0_blind_id.c b/d0_blind_id.c
index 673245525f1211f41a21a143656a0d0609b71d14..aa38d4535246e421404298d5d01a99891b778606 100644 (file)
--- a/d0_blind_id.c
+++ b/d0_blind_id.c
@@ -60,6 +60,7 @@ struct d0_blind_id_s
        d0_bignum_t *e; // challenge
        char msg[MSGSIZE]; // message
        size_t msglen; // message length
+       d0_bignum_t *other_4_to_r; // for DH key exchange
 };
 
 #define CHECK(x) do { if(!(x)) goto fail; } while(0)
@@ -220,6 +221,7 @@ void d0_blind_id_copy(d0_blind_id_t *ctx, const d0_blind_id_t *src)
        if(src->rn) ctx->rn = d0_bignum_mov(NULL, src->rn);
        if(src->r) ctx->r = d0_bignum_mov(NULL, src->r);
        if(src->e) ctx->e = d0_bignum_mov(NULL, src->e);
+       if(src->other_4_to_r) ctx->other_4_to_r = d0_bignum_mov(NULL, src->other_4_to_r);
        // TODO xnbh, msg, msglen?
 }
 
@@ -265,7 +267,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_key(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *out;
+       d0_iobuf_t *out = NULL;
 
        USING(rsa_n); USING(rsa_e); USING(rsa_d);
 
@@ -282,7 +284,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_write_public_key(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *out;
+       d0_iobuf_t *out = NULL;
 
        USING(rsa_n); USING(rsa_e);
 
@@ -322,7 +324,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_id_modulus(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *out;
+       d0_iobuf_t *out = NULL;
 
        USING(schnorr_G);
 
@@ -353,7 +355,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_generate_private_id_request(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *out;
+       d0_iobuf_t *out = NULL;
 
        // temps: temp0 temp1
        USING(rsa_n); USING(rsa_e); USING(schnorr_4_to_s);
@@ -374,8 +376,8 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_answer_private_id_request(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *in;
-       d0_iobuf_t *out;
+       d0_iobuf_t *in = NULL;
+       d0_iobuf_t *out = NULL;
 
        // temps: temp0 temp1
        USING(rsa_d); USING(rsa_n);
@@ -398,7 +400,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_finish_private_id_request(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen)
 {
-       d0_iobuf_t *in;
+       d0_iobuf_t *in = NULL;
 
        // temps: temp0 temp1
        USING(rn); USING(rsa_n);
@@ -419,7 +421,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_read_private_id(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen)
 {
-       d0_iobuf_t *in;
+       d0_iobuf_t *in = NULL;
 
        REPLACING(schnorr_s); REPLACING(schnorr_4_to_s); REPLACING(schnorr_4_to_s_signature);
 
@@ -438,7 +440,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_read_public_id(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen)
 {
-       d0_iobuf_t *in;
+       d0_iobuf_t *in = NULL;
 
        REPLACING(schnorr_4_to_s); REPLACING(schnorr_4_to_s_signature);
 
@@ -456,7 +458,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *out;
+       d0_iobuf_t *out = NULL;
 
        USING(schnorr_s); USING(schnorr_4_to_s); USING(schnorr_4_to_s_signature);
 
@@ -475,7 +477,7 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_write_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *out;
+       d0_iobuf_t *out = NULL;
 
        USING(schnorr_4_to_s); USING(schnorr_4_to_s_signature);
 
@@ -496,9 +498,9 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_start(d0_blind_
 //   first run: send 4^s, 4^s signature
 //   1. get random r, send HASH(4^r)
 {
-       d0_iobuf_t *out;
-       unsigned char convbuf[1024];
-       d0_iobuf_t *conv;
+       d0_iobuf_t *out = NULL;
+       static unsigned char convbuf[1024];
+       d0_iobuf_t *conv = NULL;
        size_t sz;
 
        if(is_first)
@@ -548,8 +550,8 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_challenge(d0_bl
 //   2. save HASH(4^r)
 //   3. send challenge e of SCHNORR_BITS
 {
-       d0_iobuf_t *in;
-       d0_iobuf_t *out;
+       d0_iobuf_t *in = NULL;
+       d0_iobuf_t *out = NULL;
 
        if(is_first)
        {
@@ -602,6 +604,15 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_challenge(d0_bl
 
        CHECK(d0_iobuf_write_bignum(out, ctx->e));
 
+       if(is_first)
+       {
+               // Diffie Hellmann
+               CHECK(d0_dl_get_order(temp0, ctx->schnorr_G));
+               CHECK_ASSIGN(ctx->r, d0_bignum_rand_range(ctx->r, zero, temp0));
+               CHECK(d0_bignum_mod_pow(temp0, four, ctx->r, ctx->schnorr_G));
+               CHECK(d0_iobuf_write_bignum(out, temp0));
+       }
+
        if(status)
                *status = !!d0_bignum_cmp(ctx->schnorr_4_to_s_signature, zero);
 
@@ -614,12 +625,12 @@ fail:
        return 0;
 }
 
-WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen)
+WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, BOOL is_first, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen)
 //   1. read challenge e of SCHNORR_BITS
 //   2. reply with r + s * e mod order
 {
-       d0_iobuf_t *in;
-       d0_iobuf_t *out;
+       d0_iobuf_t *in = NULL;
+       d0_iobuf_t *out = NULL;
 
        // temps: 0 order, 1 prod, 2 y, 3 e
        USING(schnorr_G); USING(schnorr_s); USING(r);
@@ -628,10 +639,17 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_bli
        out = d0_iobuf_open_write(outbuf, *outbuflen);
 
        CHECK(d0_iobuf_read_bignum(in, temp3));
-       // TODO check if >= 2^SCHNORR_BITS or < 0, if yes, then fail (needed for zero knowledge)
        CHECK(d0_bignum_cmp(temp3, zero) >= 0);
        CHECK(d0_bignum_size(temp3) <= SCHNORR_BITS);
 
+       if(is_first)
+       {
+               // Diffie Hellmann
+               CHECK_ASSIGN(ctx->other_4_to_r, d0_iobuf_read_bignum(in, ctx->other_4_to_r));
+               CHECK(d0_bignum_cmp(ctx->other_4_to_r, zero) > 0);
+               CHECK(d0_bignum_cmp(ctx->other_4_to_r, ctx->schnorr_G) < 0);
+       }
+
        // send response for schnorr ID scheme
        // i.e. r + ctx->schnorr_s * temp3
        CHECK(d0_dl_get_order(temp0, ctx->schnorr_G));
@@ -648,14 +666,14 @@ fail:
        return 0;
 }
 
-WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, ssize_t *msglen, BOOL *status)
+WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, size_t *msglen, BOOL *status)
 //   1. read y = r + s * e mod order
 //   2. verify: g^y (g^s)^-e = g^(r+s*e-s*e) = g^r
 //      (check using H(g^r) which we know)
 {
-       d0_iobuf_t *in;
-       unsigned char convbuf[1024];
-       d0_iobuf_t *conv;
+       d0_iobuf_t *in = NULL;
+       static unsigned char convbuf[1024];
+       d0_iobuf_t *conv = NULL;
        size_t sz;
 
        // temps: 0 y 1 order
@@ -663,7 +681,6 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind
 
        in = d0_iobuf_open_read(inbuf, inbuflen);
 
-       *msglen = -1;
        CHECK(d0_dl_get_order(temp1, ctx->schnorr_G));
        CHECK(d0_iobuf_read_bignum(in, temp0));
        CHECK(d0_bignum_cmp(temp0, zero) >= 0);
@@ -674,14 +691,14 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind
        CHECK(d0_bignum_neg(temp1, ctx->e));
        CHECK(d0_bignum_mod_pow(temp2, ctx->schnorr_4_to_s, temp1, ctx->schnorr_G));
        CHECK(d0_bignum_mod_pow(temp1, four, temp0, ctx->schnorr_G));
-       CHECK(d0_bignum_mod_mul(temp3, temp1, temp2, ctx->schnorr_G));
+       CHECK_ASSIGN(ctx->other_4_to_r, d0_bignum_mod_mul(ctx->other_4_to_r, temp1, temp2, ctx->schnorr_G));
        // hash must be equal to xnbh
 
        // hash it, hash it, everybody hash it
        conv = d0_iobuf_open_write(convbuf, sizeof(convbuf));
-       CHECK(d0_iobuf_write_bignum(conv, temp3));
+       CHECK(d0_iobuf_write_bignum(conv, ctx->other_4_to_r));
        CHECK(d0_iobuf_write_packet(conv, ctx->msg, ctx->msglen));
-       CHECK(d0_iobuf_write_bignum(conv, temp3));
+       CHECK(d0_iobuf_write_bignum(conv, ctx->other_4_to_r));
        d0_iobuf_close(conv, &sz);
        conv = NULL;
        if(memcmp(sha(convbuf, sz), ctx->xnbh, SCHNORR_HASHSIZE))
@@ -693,7 +710,7 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind
        if(status)
                *status = !!d0_bignum_cmp(ctx->schnorr_4_to_s_signature, zero);
 
-       if(ctx->msglen <= (size_t) *msglen)
+       if(ctx->msglen <= *msglen)
                memcpy(msg, ctx->msg, ctx->msglen);
        else
                memcpy(msg, ctx->msg, *msglen);
@@ -709,9 +726,9 @@ fail:
 
 WARN_UNUSED_RESULT BOOL d0_blind_id_fingerprint64_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
 {
-       d0_iobuf_t *out;
-       d0_iobuf_t *conv;
+       d0_iobuf_t *out = NULL;
        static unsigned char convbuf[1024];
+       d0_iobuf_t *conv = NULL;
        size_t sz, n;
 
        USING(schnorr_4_to_s);
@@ -726,18 +743,47 @@ WARN_UNUSED_RESULT BOOL d0_blind_id_fingerprint64_public_id(d0_blind_id_t *ctx,
        n = (*outbuflen / 4) * 3;
        if(n > SHA_DIGESTSIZE)
                n = SHA_DIGESTSIZE;
-       if(d0_iobuf_write_raw(out, sha(convbuf, sz), n) != n)
-               goto fail;
-       if(!d0_iobuf_conv_base64_out(out))
-               goto fail;
+       CHECK(d0_iobuf_write_raw(out, sha(convbuf, sz), n) == n);
+       CHECK(d0_iobuf_conv_base64_out(out));
 
        return d0_iobuf_close(out, outbuflen);
 
 fail:
        if(conv)
-               if(!d0_iobuf_close(conv, &sz)) { }
-       if(!d0_iobuf_close(out, outbuflen))
-               return 0;
+               d0_iobuf_close(conv, &sz);
+       d0_iobuf_close(out, outbuflen);
+       return 0;
+}
+
+BOOL d0_blind_id_sessionkey_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen)
+{
+       d0_iobuf_t *out = NULL;
+       static unsigned char convbuf[1024];
+       d0_iobuf_t *conv = NULL;
+       size_t n, sz;
+
+       USING(r); USING(other_4_to_r);
+
+       out = d0_iobuf_open_write(outbuf, *outbuflen);
+       conv = d0_iobuf_open_write(convbuf, sizeof(convbuf));
+
+       // temps: temp0 result
+       CHECK(d0_bignum_mod_pow(temp0, ctx->other_4_to_r, ctx->r, ctx->schnorr_G));
+       CHECK(d0_iobuf_write_bignum(conv, temp0));
+       CHECK(d0_iobuf_close(conv, &sz));
+       conv = NULL;
+
+       n = *outbuflen;
+       if(n > SHA_DIGESTSIZE)
+               n = SHA_DIGESTSIZE;
+       CHECK(d0_iobuf_write_raw(out, sha(convbuf, sz), n) == n);
+
+       return d0_iobuf_close(out, outbuflen);
+
+fail:
+       if(conv)
+               d0_iobuf_close(conv, &sz);
+       d0_iobuf_close(out, outbuflen);
        return 0;
 }
 

diff --git a/d0_blind_id.h b/d0_blind_id.h
index e962a476d53c6cb31e3c87909be6d5876b94b5e4..e84d4b80e0944f7e0e53e3f309d2dd805be3573b 100644 (file)
--- a/d0_blind_id.h
+++ b/d0_blind_id.h
@@ -27,9 +27,10 @@ EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_write_private_id(d0_blind_id_t *ctx,
 EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_write_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen);
 EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_start(d0_blind_id_t *ctx, BOOL is_first, BOOL send_modulus, char *message, size_t msglen, char *outbuf, size_t *outbuflen);
 EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_challenge(d0_blind_id_t *ctx, BOOL is_first, BOOL recv_modulus, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen, BOOL *status);
-EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen);
-EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, ssize_t *msglen, BOOL *status);
+EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_response(d0_blind_id_t *ctx, BOOL is_first, const char *inbuf, size_t inbuflen, char *outbuf, size_t *outbuflen);
+EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_authenticate_with_private_id_verify(d0_blind_id_t *ctx, const char *inbuf, size_t inbuflen, char *msg, size_t *msglen, BOOL *status);
 EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_fingerprint64_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen);
+EXPORT WARN_UNUSED_RESULT BOOL d0_blind_id_sessionkey_public_id(d0_blind_id_t *ctx, char *outbuf, size_t *outbuflen); // can only be done after successful key exchange, this performs a modpow; key length is limited by SHA_DIGESTSIZE for now
 
 EXPORT void d0_blind_id_INITIALIZE(void);
 EXPORT void d0_blind_id_SHUTDOWN(void);

diff --git a/main.c b/main.c
index 5da16d066629c4bdfdd085e38f8ef66288f1691d..249e60471c51b0bebe2297be1a2496985a677c62 100644 (file)
--- a/main.c
+++ b/main.c
@@ -46,7 +46,7 @@ void mysignal(int signo)
 int main(int argc, char **argv)
 {
        char buf[65536]; size_t bufsize;
-       char buf2[65536]; size_t buf2size; ssize_t buf2ssize;
+       char buf2[65536]; size_t buf2size;
        d0_blind_id_t *ctx_self, *ctx_other;
 
        d0_blind_id_INITIALIZE();
@@ -106,7 +106,7 @@ int main(int argc, char **argv)
                errx(8, "readpub2 fail");
 
        n = 0;
-       double bench_auth = 0, bench_chall = 0, bench_resp = 0, bench_verify = 0;
+       double bench_auth = 0, bench_chall = 0, bench_resp = 0, bench_verify = 0, bench_dhkey1 = 0, bench_dhkey2 = 0;
        BOOL status;
        while(!quit)
        {
@@ -117,19 +117,27 @@ int main(int argc, char **argv)
                buf2size = sizeof(buf2); if(!d0_blind_id_authenticate_with_private_id_challenge(ctx_self, 1, 1, buf, bufsize, buf2, &buf2size, NULL))
                        errx(10, "challenge fail");
                bench(&bench_resp);
-               bufsize = sizeof(buf); if(!d0_blind_id_authenticate_with_private_id_response(ctx_other, buf2, buf2size, buf, &bufsize))
+               bufsize = sizeof(buf); if(!d0_blind_id_authenticate_with_private_id_response(ctx_other, 1, buf2, buf2size, buf, &bufsize))
                        errx(11, "response fail");
                bench(&bench_verify);
-               buf2ssize = sizeof(buf2); if(!d0_blind_id_authenticate_with_private_id_verify(ctx_self, buf, bufsize, buf2, &buf2ssize, &status))
+               buf2size = sizeof(buf2); if(!d0_blind_id_authenticate_with_private_id_verify(ctx_self, buf, bufsize, buf2, &buf2size, &status))
                        errx(12, "verify fail");
-               if(buf2ssize != 11 || memcmp(buf2, "hello world", 11))
+               if(buf2size != 11 || memcmp(buf2, "hello world", 11))
                        errx(13, "hello fail");
                if(!status)
                        errx(14, "signature fail");
+               bench(&bench_dhkey1);
+               bufsize = sizeof(buf); if(!d0_blind_id_sessionkey_public_id(ctx_self, buf, &bufsize))
+                       errx(15, "dhkey1 fail");
+               bench(&bench_dhkey2);
+               buf2size = sizeof(buf2); if(!d0_blind_id_sessionkey_public_id(ctx_other, buf2, &buf2size))
+                       errx(16, "dhkey2 fail");
                bench(&bench_stop);
+               if(bufsize != buf2size || memcmp(buf, buf2, bufsize))
+                       errx(17, "dhkey match fail");
                ++n;
                if(n % 1024 == 0)
-                       printf("auth=%f chall=%f resp=%f verify=%f\n", n/bench_auth, n/bench_chall, n/bench_resp, n/bench_verify);
+                       printf("auth=%f chall=%f resp=%f verify=%f dh1=%f dh2=%f\n", n/bench_auth, n/bench_chall, n/bench_resp, n/bench_verify, n/bench_dhkey1, n/bench_dhkey2);
        }
 
        return 0;