ElGamalPublicKey.cc

/*
 * Copyright 2003 Michael A. Marsh, Cornell University. All rights reserved.
 * This software is released under the modified BSD license.
 * See the file LICENSE in the top-level directory for details.
 */
//
// $Id: ElGamalPublicKey.cc,v 1.4 2004/05/19 15:56:47 mmarsh Exp $
//
// $Log: ElGamalPublicKey.cc,v $
// Revision 1.4  2004/05/19 15:56:47  mmarsh
// *** empty log message ***
//
// Revision 1.3  2003/11/04 22:31:47  mmarsh
// *** empty log message ***
//
//

#include <fstream>
#include "ElGamal.h"
#include "jacobi.h"
#include "CODEX_Exceptions/BignumExceptions.h"
#include "CODEX_Exceptions/FileExceptions.h"

using namespace CODEX_Ciphers;
using namespace CODEX_Exceptions;

ElGamalPublicKey::ElGamalPublicKey() :
   CODEX_ASN1::Base( false ),
   m_p1( 0 ),
   m_q( 0 )
{
}

ElGamalPublicKey::ElGamalPublicKey( BIGNUM * p,
                                    BIGNUM * g,
                                    BIGNUM * y ) :
   CODEX_ASN1::Base( true ),
   m_p( p ),
   m_g( g ),
   m_y( y ),
   m_p1( 0 ),
   m_q( 0 )
{
}

ElGamalPublicKey::ElGamalPublicKey( const CODEX_ASN1::BigNumber& p,
                                    const CODEX_ASN1::BigNumber& g,
                                    const CODEX_ASN1::BigNumber& y ) :
   CODEX_ASN1::Base( true ),
   m_p( p ),
   m_g( g ),
   m_y( y ),
   m_p1( 0 ),
   m_q( 0 )
{
}

ElGamalPublicKey::ElGamalPublicKey( const ElGamalPublicKey& aKey ) :
   CODEX_ASN1::Base( aKey.m_initialized ),
   m_p( aKey.m_p ),
   m_g( aKey.m_g ),
   m_y( aKey.m_y ),
   m_p1( 0 ),
   m_q( 0 )
{
   // We don't throw exceptions here because we don't necessarily need
   // these members.  The methods that construct them on the fly will
   // throw exceptions when appropriate.
   if ( 0 != aKey.m_p1 )
   {
      m_p1 = BN_dup( aKey.m_p1 );
   }
   if ( 0 != aKey.m_q )
   {
      m_q = BN_dup( aKey.m_q );
   }
}

ElGamalPublicKey::~ElGamalPublicKey()
{
   if ( 0 != m_p1 )
   {
      BN_free( m_p1 );
   }
   if ( 0 != m_q )
   {
      BN_free( m_q );
   }
}

void
ElGamalPublicKey::operator=( const ElGamalPublicKey& aKey )
{
   m_initialized = aKey.m_initialized;
   m_p           = aKey.m_p;
   m_g           = aKey.m_g;
   m_y           = aKey.m_y;
   m_p1          = 0;
   m_q           = 0;
   // We don't throw exceptions here because we don't necessarily need
   // these members.  The methods that construct them on the fly will
   // throw exceptions when appropriate.
   if ( 0 != aKey.m_p1 )
   {
      m_p1 = BN_dup( aKey.m_p1 );
   }
   if ( 0 != aKey.m_q )
   {
      m_q = BN_dup( aKey.m_q );
   }
}

const BIGNUM *
ElGamalPublicKey::p1() const
{
   if ( 0 == m_p1 )
   {
      m_p1 = BN_new();
      if ( 0 == m_p1 )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_sub( m_p1 , m_p.value() , BN_value_one() ) )
      {
         BN_free(m_p1);
         m_p1 = 0;
         throw BignumSubException( __FILE__ , __LINE__ );
      }
   }
   return m_p1;
}

const BIGNUM *
ElGamalPublicKey::q() const
{
   if ( 0 == m_q )
   {
      m_q = BN_new();
      if ( 0 == m_q )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_rshift1( m_q , (BIGNUM*)p1() ) )
      {
         BN_free(m_q);
         m_q = 0;
         throw BignumRshiftException( __FILE__ , __LINE__ );
      }
   }
   return m_q;
}

ElGamalCipherText*
ElGamalPublicKey::encrypt( const BIGNUM * message, BIGNUM * k ) const
{
   BIGNUM * c1 = 0;
   BIGNUM * c2 = 0;
   bool ownK = false;
   try
   {
      c1 = BN_new();
      if ( 0 == c1 )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }

      c2 = BN_new();
      if ( 0 == c2 )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }

      if ( 0 == k )
      {
         ownK = true;
         k = BN_new();
         if ( 0 == k )
         {
            throw BignumNullException( __FILE__ , __LINE__ );
         }
      }

      encryptVals( message, k, c1, c2 );
      if ( ownK ) BN_clear_free( k );
      return new ElGamalCipherText( c1, c2 );
   }
   catch ( ... )
   {
      if ( 0 != c1 ) BN_free( c1 );
      if ( 0 != c2 ) BN_free( c2 );
      if ( ownK && k ) BN_clear_free( k );
      throw;
   }
}

ElGamalSchnorrCipherText*
ElGamalPublicKey::encryptS( const BIGNUM * message,
                            const CODEX_ASN1::Base& id,
                            const HashFunction& hashFunc,
                            BIGNUM * k ) const
{
   BIGNUM *              c1   = 0;
   BIGNUM *              c2   = 0;
   BIGNUM *              h    = 0;
   BIGNUM *              z    = 0;
   BIGNUM *              s    = 0;
   BIGNUM *              gs   = 0;
   BN_CTX *              ctx  = 0;
   unsigned char*        buff = 0;
   CODEX_ASN1::ustring*  str  = 0;
   bool                  ownK = false;
   try
   {
      c1 = BN_new();
      if ( 0 == c1 )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }

      c2 = BN_new();
      if ( 0 == c2 )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }

      if ( 0 == k )
      {
         ownK = true;
         k = BN_new();
         if ( 0 == k )
         {
            throw BignumNullException( __FILE__ , __LINE__ );
         }
      }

      encryptVals( message, k, c1, c2 );

      // Now we need to create the Schnorr signature.
      //

      // First, choose a random exponent for the signature.
      CODEX_ASN1::BigNumber c1X( c1 ); c1 = 0;
      CODEX_ASN1::BigNumber c2X( c2 ); c2 = 0;

      s = BN_new();
      if ( 0 == s )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      do
      {
         if ( ! BN_rand_range( s, (BIGNUM*)q() ) )
         {
            throw BignumRandRangeException( __FILE__ , __LINE__ );
         }
      }
      while ( 0 >= BN_cmp( s, BN_value_one() ) ); // s=0,1 are detectable

      ctx = BN_CTX_new();
      if ( 0 == ctx )
      {
         throw BignumContextException( __FILE__ , __LINE__ );
      }

      // Now compute the exponentiation.
      gs = BN_new();
      if ( 0 == gs )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_mod_exp( gs, m_g.value(), s, m_p.value(), ctx ) )
      {
         throw BignumModExpException( __FILE__ , __LINE__ );
      }
      CODEX_ASN1::BigNumber gsX( gs ); gs = 0;

      // We need to hash the various pieces together.
      int length = gsX.marshal(0);
      length += c1X.marshal(0);
      length += c2X.marshal(0);
      length += id.marshal(0);
      buff = new unsigned char[length];
      unsigned char* pBuff = buff;
      gsX.marshal(&pBuff);
      c1X.marshal(&pBuff);
      c2X.marshal(&pBuff);
      id.marshal(&pBuff);
      str = hashFunc( CODEX_ASN1::ustring(buff,length) );
      delete [] buff;
      buff = 0;

      h = BN_new();
      if ( 0 == h )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( 0 == BN_bin2bn( str->data(), str->length(), h ) )
      {
         throw BignumBin2BNException( __FILE__ , __LINE__ );
      }
      delete str;
      str = 0;
      CODEX_ASN1::BigNumber hX( h ); h = 0;

      // Given the hash, the random signature exponent, and the random
      // encryption exponent, calculate the mixed exponent.
      h = BN_new(); // re-use h
      if ( 0 == h )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_mul( h, hX.value(), k, ctx ) )
      {
         throw BignumMulException( __FILE__ , __LINE__ );
      }

      z = BN_new();
      if ( 0 == z )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_add( z, s, h ) )
      {
         throw BignumAddException( __FILE__ , __LINE__ );
      }
      CODEX_ASN1::BigNumber zX( z ); z = 0;

      // Clean up temporary variables.
      if ( ownK ) BN_clear_free( k );
      BN_clear_free( s );
      BN_clear_free( h );
      BN_CTX_free( ctx );

      // Create the object to be returned.
      return new ElGamalSchnorrCipherText( c1X, c2X, hX, zX );
   }
   catch ( ... )
   {
      if ( 0 != c1 ) BN_free( c1 );
      if ( 0 != c2 ) BN_free( c2 );
      if ( ownK && k ) BN_clear_free( k );
      if ( 0 != h ) BN_clear_free( h );
      if ( 0 != z ) BN_free( z );
      if ( 0 != s ) BN_clear_free( s );
      if ( 0 != gs ) BN_free( gs );
      if ( 0 != ctx ) BN_CTX_free( ctx );
      throw;
   }
}

void
ElGamalPublicKey::encryptVals( const BIGNUM * message ,
                               BIGNUM * k ,
                               BIGNUM * c1 ,
                               BIGNUM * c2 ) const
{
   if ( 0 == message )
   {
      throw BignumNullException( __FILE__ , __LINE__ );
   }

   do
   {
      if ( ! BN_rand_range( k, (BIGNUM*)q() ) )
      {
         throw BignumRandRangeException( __FILE__ , __LINE__ );
      }
   }
   while ( 0 >= BN_cmp( k, BN_value_one() ) ); // k=0,1 are detectable

   BN_CTX * ctx = 0;
   BIGNUM * temp = 0;
   try
   {
      ctx = BN_CTX_new();
      if ( 0 == ctx )
      {
         throw BignumContextException( __FILE__ , __LINE__ );
      }

      if ( ! BN_mod_exp(c1,m_g.value(),k,m_p.value(),ctx) )
      {
         throw BignumModExpException( __FILE__ , __LINE__ );
      }
      try
      {
         if ( ! BN_mod_exp(c2,m_y.value(),k,m_p.value(),ctx) )
         {
            throw BignumModExpException( __FILE__ , __LINE__ );
         }

         // Multiplying the plaintext by its Jacobi symbol puts it in
         // the order-q subgroup of (Z_p)*
         temp = jacobi( message, m_p.value() );
         if ( 0 == temp )
         {
            throw BignumNullException( __FILE__ , __LINE__ );
         }
         if ( ! BN_mod_mul(temp,temp,message,m_p.value(),ctx) )
         {
            throw BignumModMulException( __FILE__ , __LINE__ );
         }
         if ( ! BN_mod_mul(c2,temp,c2,m_p.value(),ctx) )
         {
            throw BignumModMulException( __FILE__ , __LINE__ );
         }
         BN_clear_free(temp);
         temp = 0;
      }
      catch ( ... )
      {
         BN_clear( c2 );
         throw;
      }
      BN_CTX_free(ctx);
   }
   catch ( ... )
   {
      if ( 0 != ctx  ) BN_CTX_free( ctx );
      if ( 0 != temp ) BN_clear_free( temp );
      throw;
   }
}

bool
ElGamalPublicKey::verifySignature( const ElGamalSignature& signature,
                                   const BIGNUM * message ) const
{
   if ( 0 == message )
   {
      throw BignumNullException( __FILE__ , __LINE__ );
   }

   BN_CTX * ctx      = 0;
   BIGNUM * gm       = 0;
   BIGNUM * temp1    = 0;
   BIGNUM * temp2    = 0;

   try
   {
      /*
       * g^m == y^r r^s mod p
       */
      ctx = BN_CTX_new();
      if ( 0 == ctx )
      {
         throw BignumContextException( __FILE__ , __LINE__ );
      }

      gm = BN_new();
      if ( 0 == gm )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_mod_exp( gm, m_g.value(), message, m_p.value(), ctx ) )
      {
         throw BignumModExpException( __FILE__ , __LINE__ );
      }

      temp1 = BN_new();
      if ( 0 == temp1 )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_mod_exp( temp1,
                         m_y.value(),
                         signature.r().value(),
                         m_p.value(),
                         ctx ) )
      {
         throw BignumModExpException( __FILE__ , __LINE__ );
      }

      temp2 = BN_new();
      if ( 0 == temp2 )
      {
         throw BignumNullException( __FILE__ , __LINE__ );
      }
      if ( ! BN_mod_exp( temp2,
                         signature.r().value(),
                         signature.s().value(),
                         m_p.value(),
                         ctx ) )
      {
         throw BignumModExpException( __FILE__ , __LINE__ );
      }

      if ( ! BN_mod_mul(temp1,temp1,temp2,m_p.value(),ctx) )
      {
         throw BignumModMulException( __FILE__ , __LINE__ );
      }

      bool retVal = ( 0 == BN_cmp(gm,temp1) );

      BN_CTX_free(ctx);
      BN_free(gm);
      BN_free(temp1);
      BN_free(temp2);

      return retVal;
   }
   catch ( ... )
   {
      if ( 0 != ctx      ) BN_CTX_free( ctx );
      if ( 0 != gm       ) BN_free(gm);
      if ( 0 != temp1    ) BN_free( temp1 );
      if ( 0 != temp2    ) BN_free( temp2 );
      throw;
   }
}

int
ElGamalPublicKey::marshal( unsigned char ** pp ) const
{
   int r=0;
   int ret=0;
   unsigned char * p;

   ret += m_p.marshal(0);
   ret += m_g.marshal(0);
   ret += m_y.marshal(0);
   M_ASN1_I2D_seq_total();
   m_p.marshal(&p);
   m_g.marshal(&p);
   m_y.marshal(&p);
   M_ASN1_I2D_finish();
}

void*
ElGamalPublicKey::unmarshal( void* bogus,
                             unsigned char ** pp,
                             long length )
{
   if ( m_initialized )
   {
      return 0;
   }
   if ( (0 == pp) || (0 == *pp) )
   {
      return 0;
   }

   ASN1_CTX c;
   c.pp = pp;
   c.q = *pp;
   c.error = ERR_R_NESTED_ASN1_ERROR;
   int i;

   M_ASN1_D2I_Init();
   M_ASN1_D2I_start_sequence();
   M_ASN1_D2I_get(i, m_p.unmarshal);
   M_ASN1_D2I_get(i, m_g.unmarshal);
   M_ASN1_D2I_get(i, m_y.unmarshal);
   if ( !asn1_Finish(&c) )
   {
      return 0;
   }
   *pp=c.p;
   m_initialized = true;
   return this;
  err: // needed by ASN.1 macros
   return 0;
}

void
ElGamalPublicKey::toFile(const char* fname) const
{
   int length = marshal(0);
   if ( 0 == length ) return;
   unsigned char* buff = new unsigned char[length];
   unsigned char* p = buff;
   marshal(&p);
   ofstream os(fname);
   if ( ! os.is_open() )
   {
      delete [] buff;
      throw FileCannotCreateException( __FILE__ , __LINE__ , fname );
   }
   for ( int i = 0 ; i < length ; ++i )
   {
      os << buff[i];
   }
   os.close();
   delete [] buff;
}

void*
ElGamalPublicKey::fromFile(const char* fname)
{
   ifstream is(fname);
   if ( ! is.is_open() )
   {
      throw FileCannotOpenException( __FILE__ , __LINE__ , fname );
   }
   string s;
   char ch;
   while ( is.get(ch) )
   {
      s.push_back(ch);
   }
   //basic_string<unsigned char> s;
   //is >> s;
   unsigned int length = s.length();
   unsigned char* p = new unsigned char[ length ];
   unsigned char* pOrig = p;
   for ( unsigned int i = 0 ; i < length ; ++i )
   {
      p[i] = s.data()[i];
   }
   //unsigned char* p = (unsigned char*)s.data();
   void* retVal = unmarshal(0,&p,length);
   delete [] pOrig;
   return retVal;
}

---