1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
|
package org.spongycastle.pqc.crypto.mceliece;
import java.security.SecureRandom;
import org.spongycastle.crypto.CipherParameters;
import org.spongycastle.crypto.Digest;
import org.spongycastle.crypto.digests.SHA1Digest;
import org.spongycastle.crypto.params.ParametersWithRandom;
import org.spongycastle.crypto.prng.DigestRandomGenerator;
import org.spongycastle.pqc.crypto.MessageEncryptor;
import org.spongycastle.pqc.math.linearalgebra.ByteUtils;
import org.spongycastle.pqc.math.linearalgebra.GF2Vector;
/**
* This class implements the Fujisaki/Okamoto conversion of the McEliecePKCS.
* Fujisaki and Okamoto propose hybrid encryption that merges a symmetric
* encryption scheme which is secure in the find-guess model with an asymmetric
* one-way encryption scheme which is sufficiently probabilistic to obtain a
* public key cryptosystem which is CCA2-secure. For details, see D. Engelbert,
* R. Overbeck, A. Schmidt, "A summary of the development of the McEliece
* Cryptosystem", technical report.
*/
public class McElieceFujisakiCipher
implements MessageEncryptor
{
/**
* The OID of the algorithm.
*/
public static final String OID = "1.3.6.1.4.1.8301.3.1.3.4.2.1";
private static final String DEFAULT_PRNG_NAME = "SHA1PRNG";
private Digest messDigest;
private SecureRandom sr;
/**
* The McEliece main parameters
*/
private int n, k, t;
McElieceCCA2KeyParameters key;
public void init(boolean forSigning,
CipherParameters param)
{
if (forSigning)
{
if (param instanceof ParametersWithRandom)
{
ParametersWithRandom rParam = (ParametersWithRandom)param;
this.sr = rParam.getRandom();
this.key = (McElieceCCA2PublicKeyParameters)rParam.getParameters();
this.initCipherEncrypt((McElieceCCA2PublicKeyParameters)key);
}
else
{
this.sr = new SecureRandom();
this.key = (McElieceCCA2PublicKeyParameters)param;
this.initCipherEncrypt((McElieceCCA2PublicKeyParameters)key);
}
}
else
{
this.key = (McElieceCCA2PrivateKeyParameters)param;
this.initCipherDecrypt((McElieceCCA2PrivateKeyParameters)key);
}
}
public int getKeySize(McElieceCCA2KeyParameters key)
throws IllegalArgumentException
{
if (key instanceof McElieceCCA2PublicKeyParameters)
{
return ((McElieceCCA2PublicKeyParameters)key).getN();
}
if (key instanceof McElieceCCA2PrivateKeyParameters)
{
return ((McElieceCCA2PrivateKeyParameters)key).getN();
}
throw new IllegalArgumentException("unsupported type");
}
private void initCipherEncrypt(McElieceCCA2PublicKeyParameters pubKey)
{
this.sr = sr != null ? sr : new SecureRandom();
this.messDigest = pubKey.getParameters().getDigest();
n = pubKey.getN();
k = pubKey.getK();
t = pubKey.getT();
}
public void initCipherDecrypt(McElieceCCA2PrivateKeyParameters privKey)
{
this.messDigest = privKey.getParameters().getDigest();
n = privKey.getN();
t = privKey.getT();
}
public byte[] messageEncrypt(byte[] input)
throws Exception
{
// generate random vector r of length k bits
GF2Vector r = new GF2Vector(k, sr);
// convert r to byte array
byte[] rBytes = r.getEncoded();
// compute (r||input)
byte[] rm = ByteUtils.concatenate(rBytes, input);
// compute H(r||input)
messDigest.update(rm, 0, rm.length);
byte[] hrm = new byte[messDigest.getDigestSize()];
messDigest.doFinal(hrm, 0);
// convert H(r||input) to error vector z
GF2Vector z = Conversions.encode(n, t, hrm);
// compute c1 = E(r, z)
byte[] c1 = McElieceCCA2Primitives.encryptionPrimitive((McElieceCCA2PublicKeyParameters)key, r, z)
.getEncoded();
// get PRNG object
DigestRandomGenerator sr0 = new DigestRandomGenerator(new SHA1Digest());
// seed PRNG with r'
sr0.addSeedMaterial(rBytes);
// generate random c2
byte[] c2 = new byte[input.length];
sr0.nextBytes(c2);
// XOR with input
for (int i = 0; i < input.length; i++)
{
c2[i] ^= input[i];
}
// return (c1||c2)
return ByteUtils.concatenate(c1, c2);
}
public byte[] messageDecrypt(byte[] input)
throws Exception
{
int c1Len = (n + 7) >> 3;
int c2Len = input.length - c1Len;
// split ciphertext (c1||c2)
byte[][] c1c2 = ByteUtils.split(input, c1Len);
byte[] c1 = c1c2[0];
byte[] c2 = c1c2[1];
// decrypt c1 ...
GF2Vector hrmVec = GF2Vector.OS2VP(n, c1);
GF2Vector[] decC1 = McElieceCCA2Primitives.decryptionPrimitive((McElieceCCA2PrivateKeyParameters)key,
hrmVec);
byte[] rBytes = decC1[0].getEncoded();
// ... and obtain error vector z
GF2Vector z = decC1[1];
// get PRNG object
DigestRandomGenerator sr0 = new DigestRandomGenerator(new SHA1Digest());
// seed PRNG with r'
sr0.addSeedMaterial(rBytes);
// generate random sequence
byte[] mBytes = new byte[c2Len];
sr0.nextBytes(mBytes);
// XOR with c2 to obtain m
for (int i = 0; i < c2Len; i++)
{
mBytes[i] ^= c2[i];
}
// compute H(r||m)
byte[] rmBytes = ByteUtils.concatenate(rBytes, mBytes);
byte[] hrm = new byte[messDigest.getDigestSize()];
messDigest.update(rmBytes, 0, rmBytes.length);
messDigest.doFinal(hrm, 0);
// compute Conv(H(r||m))
hrmVec = Conversions.encode(n, t, hrm);
// check that Conv(H(m||r)) = z
if (!hrmVec.equals(z))
{
throw new Exception("Bad Padding: invalid ciphertext");
}
// return plaintext m
return mBytes;
}
}
|
