1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-23 10:29:58 +01:00
gnupg/cipher/elgamal.c

334 lines
8.1 KiB
C
Raw Normal View History

1997-11-18 14:06:00 +00:00
/* elgamal.c - ElGamal Public Key encryption
* Copyright (c) 1997 by Werner Koch (dd9jn)
*
* For a description of the algorithm, see:
* Bruce Schneier: Applied Cryptography. John Wiley & Sons, 1996.
* ISBN 0-471-11709-9. Pages 476 ff.
*
* This file is part of G10.
*
* G10 is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* G10 is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
*/
#include <config.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "util.h"
#include "mpi.h"
1997-11-24 22:24:04 +00:00
#include "cipher.h"
1997-11-18 14:06:00 +00:00
#include "elgamal.h"
1997-11-24 22:24:04 +00:00
void
elg_free_public_key( ELG_public_key *pk )
{
mpi_free( pk->p ); pk->p = NULL;
mpi_free( pk->g ); pk->g = NULL;
mpi_free( pk->y ); pk->y = NULL;
}
void
elg_free_secret_key( ELG_secret_key *sk )
{
mpi_free( sk->p ); sk->p = NULL;
mpi_free( sk->g ); sk->g = NULL;
mpi_free( sk->y ); sk->y = NULL;
mpi_free( sk->x ); sk->x = NULL;
}
static void
test_keys( ELG_public_key *pk, ELG_secret_key *sk, unsigned nbits )
{
MPI test = mpi_alloc( nbits / BITS_PER_MPI_LIMB );
MPI out1_a = mpi_alloc( nbits / BITS_PER_MPI_LIMB );
MPI out1_b = mpi_alloc( nbits / BITS_PER_MPI_LIMB );
MPI out2 = mpi_alloc( nbits / BITS_PER_MPI_LIMB );
mpi_set_bytes( test, nbits, get_random_byte, 0 );
1997-12-12 12:03:58 +00:00
elg_encrypt( out1_a, out1_b, test, pk );
elg_decrypt( out2, out1_a, out1_b, sk );
1997-11-24 22:24:04 +00:00
if( mpi_cmp( test, out2 ) )
1997-12-12 12:03:58 +00:00
log_fatal("ElGamal operation: encrypt, decrypt failed\n");
1997-11-24 22:24:04 +00:00
elg_sign( out1_a, out1_b, test, sk );
if( !elg_verify( out1_a, out1_b, test, pk ) )
log_fatal("ElGamal operation: sign, verify failed\n");
mpi_free( test );
mpi_free( out1_a );
mpi_free( out1_b );
mpi_free( out2 );
}
1997-11-18 14:06:00 +00:00
/****************
1997-11-24 22:24:04 +00:00
* generate a random secret exponent k from prime p, so
* that k is relatively prime to p-1
*/
static MPI
gen_k( MPI p )
{
MPI k = mpi_alloc_secure( mpi_get_nlimbs(p) );
MPI temp = mpi_alloc( mpi_get_nlimbs(p) );
MPI p_1 = mpi_copy(p);
unsigned nbits = mpi_get_nbits(p);
if( DBG_CIPHER )
log_debug("choosing a random k ");
mpi_sub_ui( p_1, p, 1);
for(;;) {
if( DBG_CIPHER )
fputc('.', stderr);
mpi_set_bytes( k, nbits , get_random_byte, 1 );
1997-12-12 12:03:58 +00:00
if( !(mpi_cmp( k, p_1 ) < 0) ) /* check: k < (p-1) */
continue; /* no */
if( !(mpi_cmp_ui( k, 0 ) > 0) ) /* check: k > 0 */
continue; /* no */
1997-11-24 22:24:04 +00:00
if( mpi_gcd( temp, k, p_1 ) )
break; /* okay, k is relatively prime to (p-1) */
}
if( DBG_CIPHER )
fputc('\n', stderr);
mpi_free(p_1);
mpi_free(temp);
return k;
}
/****************
* Generate a key pair with a key of size NBITS
* Returns: 2 structures filles with all needed values
1997-11-18 14:06:00 +00:00
*/
void
1997-11-24 22:24:04 +00:00
elg_generate( ELG_public_key *pk, ELG_secret_key *sk, unsigned nbits )
1997-11-18 14:06:00 +00:00
{
1997-11-24 22:24:04 +00:00
MPI p; /* the prime */
1997-12-12 12:03:58 +00:00
MPI p_min1;
1997-11-24 22:24:04 +00:00
MPI g;
MPI x; /* the secret exponent */
MPI y;
1997-12-12 12:03:58 +00:00
MPI temp;
unsigned qbits;
1997-12-12 12:03:58 +00:00
p_min1 = mpi_alloc( (nbits+BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB );
temp = mpi_alloc( (nbits+BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB );
if( nbits < 512 )
qbits = 120;
else if( nbits <= 1024 )
qbits = 160;
else if( nbits <= 2048 )
qbits = 200;
else
qbits = 240;
g = mpi_alloc(1);
p = generate_elg_prime( nbits, qbits, g );
mpi_sub_ui(p_min1, p, 1);
1997-12-12 12:03:58 +00:00
/* select a random number which has these properties:
* 0 < x < p-1
1997-11-24 22:24:04 +00:00
*/
x = mpi_alloc_secure( nbits/BITS_PER_MPI_LIMB );
if( DBG_CIPHER )
log_debug("choosing a random x ");
do {
if( DBG_CIPHER )
fputc('.', stderr);
1997-12-20 17:23:29 +00:00
mpi_set_bytes( x, nbits, get_random_byte, 2 );
1997-12-12 12:03:58 +00:00
} while( !( mpi_cmp_ui( x, 0 )>0 && mpi_cmp( x, p_min1 )<0 ) );
1997-11-24 22:24:04 +00:00
y = mpi_alloc(nbits/BITS_PER_MPI_LIMB);
mpi_powm( y, g, x, p );
if( DBG_CIPHER ) {
fputc('\n', stderr);
log_mpidump("elg p= ", p );
log_mpidump("elg g= ", g );
log_mpidump("elg y= ", y );
log_mpidump("elg x= ", x );
}
/* copy the stuff to the key structures */
pk->p = mpi_copy(p);
pk->g = mpi_copy(g);
pk->y = mpi_copy(y);
sk->p = p;
sk->g = g;
sk->y = y;
sk->x = x;
/* now we can test our keys (this should never fail!) */
test_keys( pk, sk, nbits - 64 );
1997-12-12 12:03:58 +00:00
mpi_free( p_min1 );
mpi_free( temp );
1997-11-18 14:06:00 +00:00
}
1997-11-24 22:24:04 +00:00
1997-11-18 14:06:00 +00:00
/****************
1997-11-24 22:24:04 +00:00
* Test wether the secret key is valid.
* Returns: if this is a valid key.
*/
int
elg_check_secret_key( ELG_secret_key *sk )
{
int rc;
MPI y = mpi_alloc( mpi_get_nlimbs(sk->y) );
mpi_powm( y, sk->g, sk->x, sk->p );
rc = !mpi_cmp( y, sk->y );
mpi_free( y );
return rc;
}
void
1997-12-12 12:03:58 +00:00
elg_encrypt(MPI a, MPI b, MPI input, ELG_public_key *pkey )
1997-11-24 22:24:04 +00:00
{
MPI k;
k = gen_k( pkey->p );
mpi_powm( a, pkey->g, k, pkey->p );
/* b = (y^k * input) mod p
* = ((y^k mod p) * (input mod p)) mod p
* and because input is < p (FIXME: check this!)
* = ((y^k mod p) * input) mod p
*/
mpi_powm( b, pkey->y, k, pkey->p );
mpi_mulm( b, b, input, pkey->p );
#if 0
if( DBG_CIPHER ) {
1997-12-01 10:33:23 +00:00
log_mpidump("elg encrypted y= ", pkey->y);
log_mpidump("elg encrypted p= ", pkey->p);
log_mpidump("elg encrypted k= ", k);
log_mpidump("elg encrypted M= ", input);
log_mpidump("elg encrypted a= ", a);
log_mpidump("elg encrypted b= ", b);
1997-11-24 22:24:04 +00:00
}
#endif
mpi_free(k);
}
void
1997-12-12 12:03:58 +00:00
elg_decrypt(MPI output, MPI a, MPI b, ELG_secret_key *skey )
1997-11-24 22:24:04 +00:00
{
MPI t1 = mpi_alloc_secure( mpi_get_nlimbs( skey->p ) );
/* output = b/(a^x) mod p */
mpi_powm( t1, a, skey->x, skey->p );
mpi_invm( t1, t1, skey->p );
mpi_mulm( output, b, t1, skey->p );
#if 0
if( DBG_CIPHER ) {
1997-12-01 10:33:23 +00:00
log_mpidump("elg decrypted x= ", skey->x);
log_mpidump("elg decrypted p= ", skey->p);
log_mpidump("elg decrypted a= ", a);
log_mpidump("elg decrypted b= ", b);
log_mpidump("elg decrypted M= ", output);
1997-11-24 22:24:04 +00:00
}
#endif
mpi_free(t1);
}
/****************
* Make an Elgamal signature out of INPUT
1997-11-18 14:06:00 +00:00
*/
1997-11-24 22:24:04 +00:00
1997-11-18 14:06:00 +00:00
void
1997-11-24 22:24:04 +00:00
elg_sign(MPI a, MPI b, MPI input, ELG_secret_key *skey )
1997-11-18 14:06:00 +00:00
{
1997-11-24 22:24:04 +00:00
MPI k;
MPI t = mpi_alloc( mpi_get_nlimbs(a) );
MPI inv = mpi_alloc( mpi_get_nlimbs(a) );
MPI p_1 = mpi_copy(skey->p);
/*
* b = (t * inv) mod (p-1)
* b = (t * inv(k,(p-1),(p-1)) mod (p-1)
* b = (((M-x*a) mod (p-1)) * inv(k,(p-1),(p-1))) mod (p-1)
*
*/
mpi_sub_ui(p_1, p_1, 1);
k = gen_k( skey->p );
mpi_powm( a, skey->g, k, skey->p );
mpi_mul(t, skey->x, a );
mpi_subm(t, input, t, p_1 );
while( mpi_is_neg(t) )
mpi_add(t, t, p_1);
mpi_invm(inv, k, p_1 );
mpi_mulm(b, t, inv, p_1 );
1997-11-18 14:06:00 +00:00
1997-11-24 22:24:04 +00:00
#if 0
if( DBG_CIPHER ) {
log_mpidump("elg sign p= ", skey->p);
log_mpidump("elg sign g= ", skey->g);
log_mpidump("elg sign y= ", skey->y);
log_mpidump("elg sign x= ", skey->x);
log_mpidump("elg sign k= ", k);
log_mpidump("elg sign M= ", input);
log_mpidump("elg sign a= ", a);
log_mpidump("elg sign b= ", b);
}
#endif
mpi_free(k);
mpi_free(t);
mpi_free(inv);
mpi_free(p_1);
1997-11-18 14:06:00 +00:00
}
1997-11-24 22:24:04 +00:00
/****************
* Returns true if the signature composed from A and B is valid.
*/
int
elg_verify(MPI a, MPI b, MPI input, ELG_public_key *pkey )
{
int rc;
1997-12-12 12:03:58 +00:00
MPI t1;
MPI t2;
if( !(mpi_cmp_ui( a, 0 ) > 0 && mpi_cmp( a, pkey->p ) < 0) )
return 0; /* assertion 0 < a < p failed */
t1 = mpi_alloc( mpi_get_nlimbs(a) );
t2 = mpi_alloc( mpi_get_nlimbs(a) );
/* t1 = (y^a mod p) * (a^b mod p) mod p
* fixme: should be calculated by a call which evalutes
* t1 = y^a * a^b mod p
* direct.
*/
1997-11-24 22:24:04 +00:00
mpi_powm( t1, pkey->y, a, pkey->p );
mpi_powm( t2, a, b, pkey->p );
mpi_mulm( t1, t1, t2, pkey->p );
1997-12-12 12:03:58 +00:00
/* t2 = g ^ input mod p */
1997-11-24 22:24:04 +00:00
mpi_powm( t2, pkey->g, input, pkey->p );
rc = !mpi_cmp( t1, t2 );
mpi_free(t1);
mpi_free(t2);
return rc;
}
1997-11-18 14:06:00 +00:00