Hybrid Public Key Encryption (HPKE) and Key encapsulation mechanisms (KEMs) More...

#include "platform.h"
#include "gnunet_common.h"
#include <sodium.h>
#include <stdint.h>
#include "gnunet_util_lib.h"
#include "sodium/crypto_scalarmult.h"
#include "sodium/crypto_scalarmult_curve25519.h"
#include "sodium/utils.h"

Include dependency graph for crypto_hpke.c:

Functions
static enum GNUNET_GenericReturnValue	labeled_extract (const char ctx_str, const void salt, size_t salt_len, const void label, size_t label_len, const void ikm, size_t ikm_len, const uint8_t suite_id, size_t suite_id_len, struct GNUNET_ShortHashCode prk)
	A RFC9180 inspired labeled extract. More...

static enum GNUNET_GenericReturnValue	labeled_expand (const char ctx_str, const struct GNUNET_ShortHashCode prk, const char label, size_t label_len, const void info, size_t info_len, const uint8_t suite_id, size_t suite_id_len, void out_buf, uint16_t out_len)
	A RFC9180 inspired labeled extract. More...

static enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_labeled_extract_and_expand (const void dh, size_t dh_len, const char extract_ctx, const char expand_ctx, const void extract_lbl, size_t extract_lbl_len, const void expand_lbl, size_t expand_lbl_len, const uint8_t kem_context, size_t kem_context_len, const uint8_t suite_id, size_t suite_id_len, struct GNUNET_ShortHashCode shared_secret)

static enum GNUNET_GenericReturnValue	kem_encaps_norand (uint8_t suite_id, size_t suite_id_len, const struct GNUNET_CRYPTO_EcdhePublicKey pkR, const struct GNUNET_CRYPTO_HpkeEncapsulation c, const struct GNUNET_CRYPTO_EcdhePrivateKey skE, struct GNUNET_ShortHashCode *shared_secret)

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_encaps_norand (const struct GNUNET_CRYPTO_EcdhePublicKey pkR, struct GNUNET_CRYPTO_HpkeEncapsulation enc, const struct GNUNET_CRYPTO_EcdhePrivateKey skE, struct GNUNET_ShortHashCode shared_secret)
	Deterministic variant of GNUNET_CRYPTO_hpke_kem_encaps. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_encaps (const struct GNUNET_CRYPTO_EcdhePublicKey pub, struct GNUNET_CRYPTO_HpkeEncapsulation c, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate key material for a X25519 public key. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey pub, struct GNUNET_CRYPTO_HpkeEncapsulation c, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate key material for a EdDSA public key. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_decaps (const struct GNUNET_CRYPTO_EcdhePrivateKey skR, const struct GNUNET_CRYPTO_HpkeEncapsulation c, struct GNUNET_ShortHashCode *shared_secret)
	Decapsulate a key for a private X25519 key. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_decaps (const struct GNUNET_CRYPTO_EddsaPrivateKey priv, const struct GNUNET_CRYPTO_HpkeEncapsulation c, struct GNUNET_ShortHashCode *shared_secret)
	Decapsulate a key for a private EdDSA key. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand (uint8_t random_tweak, const struct GNUNET_CRYPTO_EcdhePublicKey pkR, struct GNUNET_CRYPTO_HpkeEncapsulation c, const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey skE, struct GNUNET_ShortHashCode shared_secret)
	Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_encaps (const struct GNUNET_CRYPTO_EcdhePublicKey pkR, struct GNUNET_CRYPTO_HpkeEncapsulation c, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_decaps (const struct GNUNET_CRYPTO_EcdhePrivateKey skR, const struct GNUNET_CRYPTO_HpkeEncapsulation c, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh decapsulation with own private key and the representative of the received public key. More...

static enum GNUNET_GenericReturnValue	verify_psk_inputs (enum GNUNET_CRYPTO_HpkeMode mode, const uint8_t psk, size_t psk_len, const uint8_t psk_id, size_t psk_id_len)

static enum GNUNET_GenericReturnValue	key_schedule (enum GNUNET_CRYPTO_HpkeRole role, enum GNUNET_CRYPTO_HpkeMode mode, const struct GNUNET_ShortHashCode shared_secret, const uint8_t info, size_t info_len, const uint8_t psk, size_t psk_len, const uint8_t psk_id, size_t psk_id_len, struct GNUNET_CRYPTO_HpkeContext *ctx)

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sender_setup2 (enum GNUNET_CRYPTO_HpkeKem kem, enum GNUNET_CRYPTO_HpkeMode mode, struct GNUNET_CRYPTO_EcdhePrivateKey skE, struct GNUNET_CRYPTO_EcdhePrivateKey skS, const struct GNUNET_CRYPTO_EcdhePublicKey pkR, const uint8_t info, size_t info_len, const uint8_t psk, size_t psk_len, const uint8_t psk_id, size_t psk_id_len, struct GNUNET_CRYPTO_HpkeEncapsulation enc, struct GNUNET_CRYPTO_HpkeContext ctx)
	RFC9180 HPKE encryption. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sender_setup (const struct GNUNET_CRYPTO_EcdhePublicKey pkR, const uint8_t info, size_t info_len, struct GNUNET_CRYPTO_HpkeEncapsulation enc, struct GNUNET_CRYPTO_HpkeContext ctx)
	RFC9180 HPKE encryption. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_receiver_setup2 (enum GNUNET_CRYPTO_HpkeKem kem, enum GNUNET_CRYPTO_HpkeMode mode, const struct GNUNET_CRYPTO_HpkeEncapsulation enc, const struct GNUNET_CRYPTO_EcdhePrivateKey skR, const struct GNUNET_CRYPTO_EcdhePublicKey pkS, const uint8_t info, size_t info_len, const uint8_t psk, size_t psk_len, const uint8_t psk_id, size_t psk_id_len, struct GNUNET_CRYPTO_HpkeContext *ctx)
	RFC9180 HPKE encryption. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_receiver_setup (const struct GNUNET_CRYPTO_HpkeEncapsulation enc, const struct GNUNET_CRYPTO_EcdhePrivateKey skR, const uint8_t info, size_t info_len, struct GNUNET_CRYPTO_HpkeContext ctx)
	RFC9180 HPKE encryption. More...

static enum GNUNET_GenericReturnValue	increment_seq (struct GNUNET_CRYPTO_HpkeContext *ctx)

static void	compute_nonce (struct GNUNET_CRYPTO_HpkeContext ctx, uint8_t nonce)

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_seal (struct GNUNET_CRYPTO_HpkeContext ctx, const uint8_t aad, size_t aad_len, const uint8_t pt, size_t pt_len, uint8_t ct, unsigned long long *ct_len_p)
	RFC9180 HPKE encryption. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_open (struct GNUNET_CRYPTO_HpkeContext ctx, const uint8_t aad, size_t aad_len, const uint8_t ct, size_t ct_len, uint8_t pt, unsigned long long *pt_len)
	RFC9180 HPKE encryption. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_seal_oneshot (const struct GNUNET_CRYPTO_EcdhePublicKey pkR, const uint8_t info, size_t info_len, const uint8_t aad, size_t aad_len, const uint8_t pt, size_t pt_len, uint8_t ct, unsigned long long ct_len_p)
	RFC9180 HPKE encryption. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_open_oneshot (const struct GNUNET_CRYPTO_EcdhePrivateKey skR, const uint8_t info, size_t info_len, const uint8_t aad, size_t aad_len, const uint8_t ct, size_t ct_len, uint8_t pt, unsigned long long pt_len_p)
	RFC9180 HPKE encryption. More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_pk_to_x25519 (const struct GNUNET_CRYPTO_PublicKey pk, struct GNUNET_CRYPTO_EcdhePublicKey x25519)
	Convert a GNUnet identity key to a key sutiable for HPKE (X25519) More...

enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sk_to_x25519 (const struct GNUNET_CRYPTO_PrivateKey sk, struct GNUNET_CRYPTO_EcdhePrivateKey x25519)
	Convert a GNUnet identity key to a key sutiable for HPKE (X25519) More...

Variables
static uint8_t	GNUNET_CRYPTO_HPKE_KEM_SUITE_ID []

static uint8_t	GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID []

Detailed Description

Hybrid Public Key Encryption (HPKE) and Key encapsulation mechanisms (KEMs)

Author: Martin Schanzenbach

Definition in file crypto_hpke.c.

Function Documentation

◆ labeled_extract()

static enum GNUNET_GenericReturnValue labeled_extract	(	const char *	ctx_str,
		const void *	salt,
		size_t	salt_len,
		const void *	label,
		size_t	label_len,
		const void *	ikm,
		size_t	ikm_len,
		const uint8_t *	suite_id,
		size_t	suite_id_len,
		struct GNUNET_ShortHashCode *	prk
	)

static

A RFC9180 inspired labeled extract.

Parameters

ctx_str	the context to label with (c string)
salt	the extract salt
salt_len	salt length in bytes
label	the label to label with
label_len	label length in bytes
ikm	initial keying material
ikm_len	ikm length in bytes
suite_id	the suite ID
suite_id_len	suite_id length in bytes
prk	the resulting extracted PRK

Returns: GNUNET_OK on success

Definition at line 51 of file crypto_hpke.c.

{
  size_t labeled_ikm_len = strlen (ctx_str) + suite_id_len
                           + label_len + ikm_len;
  uint8_t labeled_ikm[labeled_ikm_len];
  uint8_t *tmp = labeled_ikm;
 
  // labeled_ikm = concat("HPKE-v1", suite_id, label, ikm)
  memcpy (tmp, ctx_str, strlen (ctx_str));
  tmp += strlen (ctx_str);
  memcpy (tmp, suite_id, suite_id_len);
  tmp += suite_id_len;
  memcpy (tmp, label, label_len);
  tmp += label_len;
  memcpy (tmp, ikm, ikm_len);
  // return Extract(salt, labeled_ikm)
  return GNUNET_CRYPTO_hkdf_extract (prk,
                                     salt, salt_len,
                                     labeled_ikm, labeled_ikm_len);
}

References GNUNET_CRYPTO_hkdf_extract(), ikm, and salt.

Referenced by GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), and key_schedule().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ labeled_expand()

static enum GNUNET_GenericReturnValue labeled_expand	(	const char *	ctx_str,
		const struct GNUNET_ShortHashCode *	prk,
		const char *	label,
		size_t	label_len,
		const void *	info,
		size_t	info_len,
		const uint8_t *	suite_id,
		size_t	suite_id_len,
		void *	out_buf,
		uint16_t	out_len
	)

static

A RFC9180 inspired labeled extract.

Parameters

ctx_str	the context to label with (c string)
prk	the extracted PRK
label	the label to label with
label_len	label length in bytes
info	context info
info_len	info in bytes
suite_id	the suite ID
suite_id_len	suite_id length in bytes
out_buf	output buffer, must be allocated
out_len	out_buf length in bytes

Returns: GNUNET_OK on success

Definition at line 94 of file crypto_hpke.c.

{
  uint8_t labeled_info[2 + strlen (ctx_str) + suite_id_len + label_len
                       + info_len];
  uint8_t *tmp = labeled_info;
  uint16_t out_len_nbo = htons (out_len);
 
  // labeled_info = concat(I2OSP(L, 2), "HPKE-v1", suite_id,
  //                      label, info)
  memcpy (tmp, &out_len_nbo, 2);
  tmp += 2;
  memcpy (tmp, ctx_str, strlen (ctx_str));
  tmp += strlen (ctx_str);
  memcpy (tmp, suite_id, suite_id_len);
  tmp += suite_id_len;
  memcpy (tmp, label, label_len);
  tmp += label_len;
  memcpy (tmp, info, info_len);
  return GNUNET_CRYPTO_hkdf_expand (out_buf, out_len, prk,
                                    labeled_info, sizeof labeled_info, NULL);
}

References GNUNET_CRYPTO_hkdf_expand(), and info.

Referenced by GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), and key_schedule().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ GNUNET_CRYPTO_hpke_labeled_extract_and_expand()

static enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_labeled_extract_and_expand	(	const void *	dh,
		size_t	dh_len,
		const char *	extract_ctx,
		const char *	expand_ctx,
		const void *	extract_lbl,
		size_t	extract_lbl_len,
		const void *	expand_lbl,
		size_t	expand_lbl_len,
		const uint8_t *	kem_context,
		size_t	kem_context_len,
		const uint8_t *	suite_id,
		size_t	suite_id_len,
		struct GNUNET_ShortHashCode *	shared_secret
	)

static

Definition at line 124 of file crypto_hpke.c.

{
  struct GNUNET_ShortHashCode prk;
  // eae_prk = LabeledExtract("", "eae_prk", dh)
  labeled_extract (extract_ctx,
                   NULL, 0,
                   extract_lbl, extract_lbl_len,
                   dh, dh_len,
                   suite_id, suite_id_len,
                   &prk);
  return labeled_expand (expand_ctx,
                         &prk,
                         expand_lbl, expand_lbl_len,
                         kem_context, kem_context_len,
                         suite_id, suite_id_len,
                         shared_secret, sizeof *shared_secret);
}

References labeled_expand(), and labeled_extract().

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_decaps(), GNUNET_CRYPTO_hpke_kem_decaps(), and kem_encaps_norand().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ kem_encaps_norand()

static enum GNUNET_GenericReturnValue kem_encaps_norand	(	uint8_t *	suite_id,
		size_t	suite_id_len,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		const struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		const struct GNUNET_CRYPTO_EcdhePrivateKey *	skE,
		struct GNUNET_ShortHashCode *	shared_secret
	)

static

Definition at line 167 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey dh;
  uint8_t kem_context[sizeof *c + sizeof *pkR];
 
  // dh = DH(skE, pkR)
  if (GNUNET_OK != GNUNET_CRYPTO_ecdh_x25519 (skE, pkR,
                                              &dh))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "HPKE KEM encaps: Validation error\n");
    return GNUNET_SYSERR; // ValidationError
  }
  // enc = SerializePublicKey(pkE) is a NOP, see Section 7.1.1
  // pkRm = SerializePublicKey(pkR) is a NOP, see Section 7.1.1
  // kem_context = concat(enc, pkRm)
  memcpy (kem_context, c, sizeof *c);
  memcpy (kem_context + sizeof *c, pkR, sizeof *pkR);
  // shared_secret = ExtractAndExpand(dh, kem_context)
  return GNUNET_CRYPTO_hpke_labeled_extract_and_expand (
    &dh, sizeof dh,
    "HPKE-v1",
    "HPKE-v1",
    "eae_prk", strlen ("eae_prk"),
    "shared_secret", strlen ("shared_secret"),
    kem_context, sizeof kem_context,
    suite_id, suite_id_len,
    shared_secret);
}

References GNUNET_CRYPTO_ecdh_x25519(), GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), GNUNET_ERROR_TYPE_ERROR, GNUNET_log, GNUNET_OK, and GNUNET_SYSERR.

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand(), and GNUNET_CRYPTO_hpke_kem_encaps_norand().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ verify_psk_inputs()

static enum GNUNET_GenericReturnValue verify_psk_inputs	(	enum GNUNET_CRYPTO_HpkeMode	mode,
		const uint8_t *	psk,
		size_t	psk_len,
		const uint8_t *	psk_id,
		size_t	psk_id_len
	)

static

Definition at line 384 of file crypto_hpke.c.

{
  bool got_psk;
  bool got_psk_id;
 
  got_psk = (0 != psk_len);
  got_psk_id = (0 != psk_id_len);
 
  if (got_psk != got_psk_id)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Inconsistent PSK inputs\n");
    return GNUNET_SYSERR;
  }
 
  if (got_psk &&
      ((GNUNET_CRYPTO_HPKE_MODE_BASE == mode) ||
       (GNUNET_CRYPTO_HPKE_MODE_AUTH == mode)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "PSK input provided when not needed\n");
    return GNUNET_SYSERR;
  }
  if (! got_psk &&
      ((GNUNET_CRYPTO_HPKE_MODE_PSK == mode) ||
       (GNUNET_CRYPTO_HPKE_MODE_AUTH_PSK == mode)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Missing required PSK input\n");
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_CRYPTO_HPKE_MODE_AUTH, GNUNET_CRYPTO_HPKE_MODE_AUTH_PSK, GNUNET_CRYPTO_HPKE_MODE_BASE, GNUNET_CRYPTO_HPKE_MODE_PSK, GNUNET_ERROR_TYPE_ERROR, GNUNET_log, GNUNET_OK, GNUNET_SYSERR, and mode.

Referenced by key_schedule().

Here is the caller graph for this function:

◆ key_schedule()

static enum GNUNET_GenericReturnValue key_schedule	(	enum GNUNET_CRYPTO_HpkeRole	role,
		enum GNUNET_CRYPTO_HpkeMode	mode,
		const struct GNUNET_ShortHashCode *	shared_secret,
		const uint8_t *	info,
		size_t	info_len,
		const uint8_t *	psk,
		size_t	psk_len,
		const uint8_t *	psk_id,
		size_t	psk_id_len,
		struct GNUNET_CRYPTO_HpkeContext *	ctx
	)

static

Definition at line 422 of file crypto_hpke.c.

{
  struct GNUNET_ShortHashCode psk_id_hash;
  struct GNUNET_ShortHashCode info_hash;
  struct GNUNET_ShortHashCode secret;
  uint8_t key_schedule_context[1 + sizeof info_hash * 2];
  uint8_t suite_id[strlen ("HPKE") + 6];
  uint16_t kem_id = htons (32); // FIXME hardcode as constant
  uint16_t kdf_id = htons (1); // HKDF-256 FIXME hardcode as constant
  uint16_t aead_id = htons (3); // ChaCha20Poly1305 FIXME hardcode as constant
 
  // DHKEM(X25519, HKDF-256): kem_id = 32
  // concat("KEM", I2OSP(kem_id, 2))
  memcpy (suite_id, "HPKE", 4);
  memcpy (suite_id + 4, &kem_id, 2);
  memcpy (suite_id + 6, &kdf_id, 2);
  memcpy (suite_id + 8, &aead_id, 2);
 
  if (GNUNET_OK != verify_psk_inputs (mode, psk, psk_len, psk_id, psk_id_len))
    return GNUNET_SYSERR;
 
  if (GNUNET_OK != labeled_extract ("HPKE-v1", NULL, 0,
                                    "psk_id_hash", strlen ("psk_id_hash"),
                                    psk_id, psk_id_len,
                                    suite_id, sizeof suite_id, &psk_id_hash))
    return GNUNET_SYSERR;
  if (GNUNET_OK != labeled_extract ("HPKE-v1", NULL, 0,
                                    "info_hash", strlen ("info_hash"),
                                    info, info_len,
                                    suite_id, sizeof suite_id, &info_hash))
    return GNUNET_SYSERR;
  memcpy (key_schedule_context, &mode, 1);
  memcpy (key_schedule_context + 1, &psk_id_hash, sizeof psk_id_hash);
  memcpy (key_schedule_context + 1 + sizeof psk_id_hash,
          &info_hash, sizeof info_hash);
  if (GNUNET_OK != labeled_extract ("HPKE-v1",
                                    shared_secret, sizeof *shared_secret,
                                    "secret", strlen ("secret"),
                                    psk, psk_len,
                                    suite_id, sizeof suite_id, &secret))
    return GNUNET_SYSERR;
  // key = LabeledExpand(secret, "key", key_schedule_context, Nk)
  // Note: Nk == sizeof ctx->key
  if (GNUNET_OK != labeled_expand ("HPKE-v1",
                                   &secret,
                                   "key", strlen ("key"),
                                   &key_schedule_context,
                                   sizeof key_schedule_context,
                                   suite_id, sizeof suite_id,
                                   ctx->key, sizeof ctx->key))
    return GNUNET_SYSERR;
  // base_nonce = LabeledExpand(secret, "base_nonce",
  // key_schedule_context, Nn)
  if (GNUNET_OK != labeled_expand ("HPKE-v1",
                                   &secret,
                                   "base_nonce", strlen ("base_nonce"),
                                   &key_schedule_context,
                                   sizeof key_schedule_context,
                                   suite_id, sizeof suite_id,
                                   ctx->base_nonce, sizeof ctx->base_nonce))
    return GNUNET_SYSERR;
  // exporter_secret = LabeledExpand(secret, "exp",
  // key_schedule_context, Nh)
  if (GNUNET_OK != labeled_expand ("HPKE-v1",
                                   &secret,
                                   "exp", strlen ("exp"),
                                   &key_schedule_context,
                                   sizeof key_schedule_context,
                                   suite_id, sizeof suite_id,
                                   &ctx->exporter_secret,
                                   sizeof ctx->exporter_secret))
    return GNUNET_SYSERR;
  ctx->seq = 0;
  ctx->role = role;
  return GNUNET_OK;
}

References ctx, GNUNET_OK, GNUNET_SYSERR, info, labeled_expand(), labeled_extract(), mode, and verify_psk_inputs().

Referenced by GNUNET_CRYPTO_hpke_receiver_setup2(), and GNUNET_CRYPTO_hpke_sender_setup2().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ increment_seq()

static enum GNUNET_GenericReturnValue increment_seq ( struct GNUNET_CRYPTO_HpkeContext * ctx )

static

Definition at line 652 of file crypto_hpke.c.

{
  if (ctx->seq >= UINT64_MAX)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "MessageLimitReached\n");
    return GNUNET_SYSERR;
  }
  ctx->seq = GNUNET_htonll (GNUNET_ntohll (ctx->seq) + 1);
  return GNUNET_OK;
}

References ctx, GNUNET_ERROR_TYPE_ERROR, GNUNET_htonll(), GNUNET_log, GNUNET_ntohll(), GNUNET_OK, and GNUNET_SYSERR.

Referenced by GNUNET_CRYPTO_hpke_open(), and GNUNET_CRYPTO_hpke_seal().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ compute_nonce()

static void compute_nonce	(	struct GNUNET_CRYPTO_HpkeContext *	ctx,
		uint8_t *	nonce
	)

static

Definition at line 665 of file crypto_hpke.c.

{
  size_t offset = GNUNET_CRYPTO_HPKE_NONCE_LEN - sizeof ctx->seq;
  int j = 0;
  for (int i = 0; i < GNUNET_CRYPTO_HPKE_NONCE_LEN; i++)
  {
    // FIXME correct byte order?
    if (i < offset)
      memset (&nonce[i], ctx->base_nonce[i], 1);
    else
      nonce[i] = ctx->base_nonce[i] ^ ((uint8_t*) &ctx->seq)[j++];
  }
}

References ctx, and GNUNET_CRYPTO_HPKE_NONCE_LEN.

Referenced by GNUNET_CRYPTO_hpke_open(), and GNUNET_CRYPTO_hpke_seal().

Here is the caller graph for this function:

Variable Documentation

◆ GNUNET_CRYPTO_HPKE_KEM_SUITE_ID

uint8_t GNUNET_CRYPTO_HPKE_KEM_SUITE_ID[]

static

Initial value:

= { 'K', 'E', 'M',

0x00, 0x20 }

Definition at line 158 of file crypto_hpke.c.

Referenced by GNUNET_CRYPTO_hpke_kem_decaps(), and GNUNET_CRYPTO_hpke_kem_encaps_norand().

◆ GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID

uint8_t GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID[]

static

Initial value:

= { 'K', 'E', 'M',

0x00, 0x30 }

Definition at line 163 of file crypto_hpke.c.

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_decaps(), and GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand().

Functions

Variables

Detailed Description

Function Documentation

◆ labeled_extract()

◆ labeled_expand()

◆ GNUNET_CRYPTO_hpke_labeled_extract_and_expand()

◆ kem_encaps_norand()

◆ verify_psk_inputs()

◆ key_schedule()

◆ increment_seq()

◆ compute_nonce()

Variable Documentation

◆ GNUNET_CRYPTO_HPKE_KEM_SUITE_ID

◆ GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID