1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
|
package org.bouncycastle.crypto.prng.drbg;
import java.math.BigInteger;
import org.bouncycastle.asn1.nist.NISTNamedCurves;
import org.bouncycastle.crypto.Digest;
import org.bouncycastle.crypto.prng.EntropySource;
import org.bouncycastle.math.ec.ECCurve;
import org.bouncycastle.math.ec.ECMultiplier;
import org.bouncycastle.math.ec.ECPoint;
import org.bouncycastle.math.ec.FixedPointCombMultiplier;
import org.bouncycastle.util.Arrays;
import org.bouncycastle.util.BigIntegers;
/**
* A SP800-90A Dual EC DRBG.
*/
public class DualECSP800DRBG
implements SP80090DRBG
{
/*
* Default P, Q values for each curve
*/
private static final BigInteger p256_Px = new BigInteger("6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296", 16);
private static final BigInteger p256_Py = new BigInteger("4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5", 16);
private static final BigInteger p256_Qx = new BigInteger("c97445f45cdef9f0d3e05e1e585fc297235b82b5be8ff3efca67c59852018192", 16);
private static final BigInteger p256_Qy = new BigInteger("b28ef557ba31dfcbdd21ac46e2a91e3c304f44cb87058ada2cb815151e610046", 16);
private static final BigInteger p384_Px = new BigInteger("aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7", 16);
private static final BigInteger p384_Py = new BigInteger("3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f", 16);
private static final BigInteger p384_Qx = new BigInteger("8e722de3125bddb05580164bfe20b8b432216a62926c57502ceede31c47816edd1e89769124179d0b695106428815065", 16);
private static final BigInteger p384_Qy = new BigInteger("023b1660dd701d0839fd45eec36f9ee7b32e13b315dc02610aa1b636e346df671f790f84c5e09b05674dbb7e45c803dd", 16);
private static final BigInteger p521_Px = new BigInteger("c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66", 16);
private static final BigInteger p521_Py = new BigInteger("11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650", 16);
private static final BigInteger p521_Qx = new BigInteger("1b9fa3e518d683c6b65763694ac8efbaec6fab44f2276171a42726507dd08add4c3b3f4c1ebc5b1222ddba077f722943b24c3edfa0f85fe24d0c8c01591f0be6f63", 16);
private static final BigInteger p521_Qy = new BigInteger("1f3bdba585295d9a1110d1df1f9430ef8442c5018976ff3437ef91b81dc0b8132c8d5c39c32d0e004a3092b7d327c0e7a4d26d2c7b69b58f9066652911e457779de", 16);
private static final DualECPoints[] nistPoints;
static
{
nistPoints = new DualECPoints[3];
ECCurve.Fp curve = (ECCurve.Fp)NISTNamedCurves.getByName("P-256").getCurve();
nistPoints[0] = new DualECPoints(128, curve.createPoint(p256_Px, p256_Py), curve.createPoint(p256_Qx, p256_Qy), 1);
curve = (ECCurve.Fp)NISTNamedCurves.getByName("P-384").getCurve();
nistPoints[1] = new DualECPoints(192, curve.createPoint(p384_Px, p384_Py), curve.createPoint(p384_Qx, p384_Qy), 1);
curve = (ECCurve.Fp)NISTNamedCurves.getByName("P-521").getCurve();
nistPoints[2] = new DualECPoints(256, curve.createPoint(p521_Px, p521_Py), curve.createPoint(p521_Qx, p521_Qy), 1);
}
private static final long RESEED_MAX = 1L << (32 - 1);
private static final int MAX_ADDITIONAL_INPUT = 1 << (13 - 1);
private static final int MAX_ENTROPY_LENGTH = 1 << (13 - 1);
private static final int MAX_PERSONALIZATION_STRING = 1 << (13 -1);
private Digest _digest;
private long _reseedCounter;
private EntropySource _entropySource;
private int _securityStrength;
private int _seedlen;
private int _outlen;
private ECCurve.Fp _curve;
private ECPoint _P;
private ECPoint _Q;
private byte[] _s;
private int _sLength;
private ECMultiplier _fixedPointMultiplier = new FixedPointCombMultiplier();
/**
* Construct a SP800-90A Dual EC DRBG.
* <p>
* Minimum entropy requirement is the security strength requested.
* </p>
* @param digest source digest to use with the DRB stream.
* @param securityStrength security strength required (in bits)
* @param entropySource source of entropy to use for seeding/reseeding.
* @param personalizationString personalization string to distinguish this DRBG (may be null).
* @param nonce nonce to further distinguish this DRBG (may be null).
*/
public DualECSP800DRBG(Digest digest, int securityStrength, EntropySource entropySource, byte[] personalizationString, byte[] nonce)
{
this(nistPoints, digest, securityStrength, entropySource, personalizationString, nonce);
}
/**
* Construct a SP800-90A Dual EC DRBG.
* <p>
* Minimum entropy requirement is the security strength requested.
* </p>
* @param pointSet an array of points to choose from, in order of increasing security strength
* @param digest source digest to use with the DRB stream.
* @param securityStrength security strength required (in bits)
* @param entropySource source of entropy to use for seeding/reseeding.
* @param personalizationString personalization string to distinguish this DRBG (may be null).
* @param nonce nonce to further distinguish this DRBG (may be null).
*/
public DualECSP800DRBG(DualECPoints[] pointSet, Digest digest, int securityStrength, EntropySource entropySource, byte[] personalizationString, byte[] nonce)
{
_digest = digest;
_entropySource = entropySource;
_securityStrength = securityStrength;
if (Utils.isTooLarge(personalizationString, MAX_PERSONALIZATION_STRING / 8))
{
throw new IllegalArgumentException("Personalization string too large");
}
if (entropySource.entropySize() < securityStrength || entropySource.entropySize() > MAX_ENTROPY_LENGTH)
{
throw new IllegalArgumentException("EntropySource must provide between " + securityStrength + " and " + MAX_ENTROPY_LENGTH + " bits");
}
byte[] entropy = entropySource.getEntropy();
byte[] seedMaterial = Arrays.concatenate(entropy, nonce, personalizationString);
for (int i = 0; i != pointSet.length; i++)
{
if (securityStrength <= pointSet[i].getSecurityStrength())
{
if (Utils.getMaxSecurityStrength(digest) < pointSet[i].getSecurityStrength())
{
throw new IllegalArgumentException("Requested security strength is not supported by digest");
}
_seedlen = pointSet[i].getSeedLen();
_outlen = pointSet[i].getMaxOutlen() / 8;
_P = pointSet[i].getP();
_Q = pointSet[i].getQ();
break;
}
}
if (_P == null)
{
throw new IllegalArgumentException("security strength cannot be greater than 256 bits");
}
_s = Utils.hash_df(_digest, seedMaterial, _seedlen);
_sLength = _s.length;
_reseedCounter = 0;
}
/**
* Populate a passed in array with random data.
*
* @param output output array for generated bits.
* @param additionalInput additional input to be added to the DRBG in this step.
* @param predictionResistant true if a reseed should be forced, false otherwise.
*
* @return number of bits generated, -1 if a reseed required.
*/
public int generate(byte[] output, byte[] additionalInput, boolean predictionResistant)
{
int numberOfBits = output.length*8;
int m = output.length / _outlen;
if (Utils.isTooLarge(additionalInput, MAX_ADDITIONAL_INPUT / 8))
{
throw new IllegalArgumentException("Additional input too large");
}
if (_reseedCounter + m > RESEED_MAX)
{
return -1;
}
if (predictionResistant)
{
reseed(additionalInput);
additionalInput = null;
}
BigInteger s;
if (additionalInput != null)
{
// Note: we ignore the use of pad8 on the additional input as we mandate byte arrays for it.
additionalInput = Utils.hash_df(_digest, additionalInput, _seedlen);
s = new BigInteger(1, xor(_s, additionalInput));
}
else
{
s = new BigInteger(1, _s);
}
// make sure we start with a clean output array.
Arrays.fill(output, (byte)0);
int outOffset = 0;
for (int i = 0; i < m; i++)
{
s = getScalarMultipleXCoord(_P, s);
//System.err.println("S: " + new String(Hex.encode(_s)));
byte[] r = getScalarMultipleXCoord(_Q, s).toByteArray();
if (r.length > _outlen)
{
System.arraycopy(r, r.length - _outlen, output, outOffset, _outlen);
}
else
{
System.arraycopy(r, 0, output, outOffset + (_outlen - r.length), r.length);
}
//System.err.println("R: " + new String(Hex.encode(r)));
outOffset += _outlen;
_reseedCounter++;
}
if (outOffset < output.length)
{
s = getScalarMultipleXCoord(_P, s);
byte[] r = getScalarMultipleXCoord(_Q, s).toByteArray();
int required = output.length - outOffset;
if (r.length > _outlen)
{
System.arraycopy(r, r.length - _outlen, output, outOffset, required);
}
else
{
System.arraycopy(r, 0, output, outOffset + (_outlen - r.length), required);
}
_reseedCounter++;
}
// Need to preserve length of S as unsigned int.
_s = BigIntegers.asUnsignedByteArray(_sLength, getScalarMultipleXCoord(_P, s));
return numberOfBits;
}
/**
* Reseed the DRBG.
*
* @param additionalInput additional input to be added to the DRBG in this step.
*/
public void reseed(byte[] additionalInput)
{
if (Utils.isTooLarge(additionalInput, MAX_ADDITIONAL_INPUT / 8))
{
throw new IllegalArgumentException("Additional input string too large");
}
byte[] entropy = _entropySource.getEntropy();
byte[] seedMaterial = Arrays.concatenate(pad8(_s, _seedlen), entropy, additionalInput);
_s = Utils.hash_df(_digest, seedMaterial, _seedlen);
_reseedCounter = 0;
}
private byte[] xor(byte[] a, byte[] b)
{
if (b == null)
{
return a;
}
byte[] rv = new byte[a.length];
for (int i = 0; i != rv.length; i++)
{
rv[i] = (byte)(a[i] ^ b[i]);
}
return rv;
}
// Note: works in place
private byte[] pad8(byte[] s, int seedlen)
{
if (seedlen % 8 == 0)
{
return s;
}
int shift = 8 - (seedlen % 8);
int carry = 0;
for (int i = s.length - 1; i >= 0; i--)
{
int b = s[i] & 0xff;
s[i] = (byte)((b << shift) | (carry >> (8 - shift)));
carry = b;
}
return s;
}
private BigInteger getScalarMultipleXCoord(ECPoint p, BigInteger s)
{
return _fixedPointMultiplier.multiply(p, s).normalize().getAffineXCoord().toBigInteger();
}
}
|