mirror of
https://github.com/guanzhi/GmSSL.git
synced 2026-11-15 09:05:00 +08:00
Update SM9 key exchange
This commit is contained in:
Zhi Guan
223
src/sm9_exch.c
223
src/sm9_exch.c
@@ -20,6 +20,227 @@
|
||||
|
||||
|
||||
|
||||
static int sm9_key_exchange_compute_g(int is_initiator,
|
||||
const SM9_EXCH_MASTER_KEY *mpk,
|
||||
const SM9_EXCH_KEY *key,
|
||||
const sm9_z256_t r,
|
||||
const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
|
||||
uint8_t g1[32 * 12], uint8_t g2[32 * 12], uint8_t g3[32 * 12],
|
||||
uint8_t ra[65], uint8_t rb[65])
|
||||
{
|
||||
sm9_z256_fp12_t G1, G2, G3;
|
||||
const SM9_Z256_POINT *RA;
|
||||
const SM9_Z256_POINT *RB;
|
||||
const SM9_Z256_POINT *check_R;
|
||||
int ret = -1;
|
||||
|
||||
if (!mpk || !key || !r || !R || !peer_R || !g1 || !g2 || !g3 || !ra || !rb) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (is_initiator) {
|
||||
RA = R;
|
||||
RB = peer_R;
|
||||
check_R = RB;
|
||||
} else {
|
||||
RA = peer_R;
|
||||
RB = R;
|
||||
check_R = RA;
|
||||
}
|
||||
if (!sm9_z256_point_is_on_curve(RA) || !sm9_z256_point_is_on_curve(RB)) {
|
||||
error_print();
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (is_initiator) {
|
||||
sm9_z256_pairing(G1, sm9_z256_twist_generator(), &mpk->Ppube);
|
||||
sm9_z256_fp12_pow(G1, G1, r);
|
||||
sm9_z256_pairing(G2, &key->de, check_R);
|
||||
sm9_z256_fp12_pow(G3, G2, r);
|
||||
} else {
|
||||
sm9_z256_pairing(G1, &key->de, check_R);
|
||||
sm9_z256_pairing(G2, sm9_z256_twist_generator(), &mpk->Ppube);
|
||||
sm9_z256_fp12_pow(G2, G2, r);
|
||||
sm9_z256_fp12_pow(G3, G1, r);
|
||||
}
|
||||
|
||||
sm9_z256_point_to_uncompressed_octets(RA, ra);
|
||||
sm9_z256_point_to_uncompressed_octets(RB, rb);
|
||||
sm9_z256_fp12_to_bytes(G1, g1);
|
||||
sm9_z256_fp12_to_bytes(G2, g2);
|
||||
sm9_z256_fp12_to_bytes(G3, g3);
|
||||
|
||||
ret = 1;
|
||||
|
||||
end:
|
||||
gmssl_secure_clear(&G1, sizeof(G1));
|
||||
gmssl_secure_clear(&G2, sizeof(G2));
|
||||
gmssl_secure_clear(&G3, sizeof(G3));
|
||||
return ret;
|
||||
}
|
||||
|
||||
int sm9_key_exchange(int is_initiator,
|
||||
const SM9_EXCH_MASTER_KEY *mpk,
|
||||
const SM9_EXCH_KEY *key, const char *id, size_t idlen,
|
||||
const char *peer_id, size_t peer_idlen,
|
||||
const sm9_z256_t r,
|
||||
const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
|
||||
size_t shared_key_len, uint8_t *shared_key)
|
||||
{
|
||||
uint8_t g1[32 * 12], g2[32 * 12], g3[32 * 12];
|
||||
uint8_t ra[65], rb[65];
|
||||
const char *idA = is_initiator ? id : peer_id;
|
||||
const char *idB = is_initiator ? peer_id : id;
|
||||
size_t idAlen = is_initiator ? idlen : peer_idlen;
|
||||
size_t idBlen = is_initiator ? peer_idlen : idlen;
|
||||
SM3_KDF_CTX kdf_ctx;
|
||||
int ret = -1;
|
||||
|
||||
if (!id || !peer_id || !shared_key_len || !shared_key) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (idlen > SM9_MAX_ID_SIZE || peer_idlen > SM9_MAX_ID_SIZE) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (sm9_key_exchange_compute_g(is_initiator, mpk, key,
|
||||
r, R, peer_R, g1, g2, g3, ra, rb) != 1) {
|
||||
error_print();
|
||||
goto end;
|
||||
}
|
||||
|
||||
sm3_kdf_init(&kdf_ctx, shared_key_len);
|
||||
sm3_kdf_update(&kdf_ctx, (uint8_t *)idA, idAlen);
|
||||
sm3_kdf_update(&kdf_ctx, (uint8_t *)idB, idBlen);
|
||||
sm3_kdf_update(&kdf_ctx, ra + 1, 64);
|
||||
sm3_kdf_update(&kdf_ctx, rb + 1, 64);
|
||||
sm3_kdf_update(&kdf_ctx, g1, sizeof(g1));
|
||||
sm3_kdf_update(&kdf_ctx, g2, sizeof(g2));
|
||||
sm3_kdf_update(&kdf_ctx, g3, sizeof(g3));
|
||||
sm3_kdf_finish(&kdf_ctx, shared_key);
|
||||
|
||||
if (mem_is_zero(shared_key, shared_key_len)) {
|
||||
error_print();
|
||||
goto end;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
end:
|
||||
gmssl_secure_clear(g1, sizeof(g1));
|
||||
gmssl_secure_clear(g2, sizeof(g2));
|
||||
gmssl_secure_clear(g3, sizeof(g3));
|
||||
gmssl_secure_clear(ra, sizeof(ra));
|
||||
gmssl_secure_clear(rb, sizeof(rb));
|
||||
gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int sm9_key_exchange_compute_confirm_ex(int is_initiator,
|
||||
const SM9_EXCH_MASTER_KEY *mpk,
|
||||
const SM9_EXCH_KEY *key, const char *id, size_t idlen,
|
||||
const char *peer_id, size_t peer_idlen,
|
||||
const sm9_z256_t r,
|
||||
const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
|
||||
int is_initiator_confirm, uint8_t confirm[32])
|
||||
{
|
||||
uint8_t g1[32 * 12], g2[32 * 12], g3[32 * 12];
|
||||
uint8_t ra[65], rb[65];
|
||||
const char *idA = is_initiator ? id : peer_id;
|
||||
const char *idB = is_initiator ? peer_id : id;
|
||||
size_t idAlen = is_initiator ? idlen : peer_idlen;
|
||||
size_t idBlen = is_initiator ? peer_idlen : idlen;
|
||||
uint8_t hash[32];
|
||||
uint8_t prefix = is_initiator_confirm ? 0x83 : 0x82;
|
||||
SM3_CTX ctx;
|
||||
int ret = -1;
|
||||
|
||||
if (!id || !peer_id || !confirm) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (idlen > SM9_MAX_ID_SIZE || peer_idlen > SM9_MAX_ID_SIZE) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (sm9_key_exchange_compute_g(is_initiator, mpk, key,
|
||||
r, R, peer_R, g1, g2, g3, ra, rb) != 1) {
|
||||
error_print();
|
||||
goto end;
|
||||
}
|
||||
|
||||
sm3_init(&ctx);
|
||||
sm3_update(&ctx, g2, sizeof(g2));
|
||||
sm3_update(&ctx, g3, sizeof(g3));
|
||||
sm3_update(&ctx, (uint8_t *)idA, idAlen);
|
||||
sm3_update(&ctx, (uint8_t *)idB, idBlen);
|
||||
sm3_update(&ctx, ra + 1, 64);
|
||||
sm3_update(&ctx, rb + 1, 64);
|
||||
sm3_finish(&ctx, hash);
|
||||
|
||||
sm3_init(&ctx);
|
||||
sm3_update(&ctx, &prefix, sizeof(prefix));
|
||||
sm3_update(&ctx, g1, sizeof(g1));
|
||||
sm3_update(&ctx, hash, sizeof(hash));
|
||||
sm3_finish(&ctx, confirm);
|
||||
|
||||
ret = 1;
|
||||
|
||||
end:
|
||||
gmssl_secure_clear(g1, sizeof(g1));
|
||||
gmssl_secure_clear(g2, sizeof(g2));
|
||||
gmssl_secure_clear(g3, sizeof(g3));
|
||||
gmssl_secure_clear(ra, sizeof(ra));
|
||||
gmssl_secure_clear(rb, sizeof(rb));
|
||||
gmssl_secure_clear(hash, sizeof(hash));
|
||||
gmssl_secure_clear(&ctx, sizeof(ctx));
|
||||
return ret;
|
||||
}
|
||||
|
||||
int sm9_key_exchange_compute_confirm(int is_initiator,
|
||||
const SM9_EXCH_MASTER_KEY *mpk,
|
||||
const SM9_EXCH_KEY *key, const char *id, size_t idlen,
|
||||
const char *peer_id, size_t peer_idlen,
|
||||
const sm9_z256_t r,
|
||||
const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
|
||||
uint8_t confirm[32])
|
||||
{
|
||||
if (sm9_key_exchange_compute_confirm_ex(is_initiator, mpk, key, id, idlen,
|
||||
peer_id, peer_idlen, r, R, peer_R, is_initiator, confirm) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_key_exchange_verify_confirm(int is_initiator,
|
||||
const SM9_EXCH_MASTER_KEY *mpk,
|
||||
const SM9_EXCH_KEY *key, const char *id, size_t idlen,
|
||||
const char *peer_id, size_t peer_idlen,
|
||||
const sm9_z256_t r,
|
||||
const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
|
||||
const uint8_t confirm[32])
|
||||
{
|
||||
uint8_t expected[32];
|
||||
int ret;
|
||||
|
||||
if (!confirm) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
if (sm9_key_exchange_compute_confirm_ex(is_initiator, mpk, key, id, idlen,
|
||||
peer_id, peer_idlen, r, R, peer_R, !is_initiator, expected) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
ret = gmssl_secure_memcmp(expected, confirm, sizeof(expected)) == 0 ? 1 : 0;
|
||||
gmssl_secure_clear(expected, sizeof(expected));
|
||||
return ret;
|
||||
}
|
||||
|
||||
int sm9_exch_step_1A(const SM9_EXCH_MASTER_KEY *mpk, const char *idB, size_t idBlen, SM9_Z256_POINT *RA, sm9_z256_t rA)
|
||||
{
|
||||
// A1: Q = H1(ID_B||hid,N) * P1 + Ppube
|
||||
@@ -174,5 +395,3 @@ int sm9_exch_step_2B()
|
||||
// B8: S2 = Hash(0x83 || g1 || Hash(g2 || g3 || ID_A || ID_B || RA || RB)), check S2 = SA [optional]
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user