crypto_hpke.c File Reference

Hybrid Public Key Encryption (HPKE) and Key encapsulation mechanisms (KEMs) More...

#include "platform.h"
#include "gnunet_common.h"
#include <sodium.h>
#include <stdint.h>
#include "gnunet_util_lib.h"
#include "sodium/crypto_scalarmult.h"
#include "sodium/crypto_scalarmult_curve25519.h"
#include "sodium/utils.h"

Include dependency graph for crypto_hpke.c:

Go to the source code of this file.

Functions
static enum GNUNET_GenericReturnValue	labeled_extract (const char *ctx_str, const void *salt, size_t salt_len, const void *label, size_t label_len, const void *ikm, size_t ikm_len, const uint8_t *suite_id, size_t suite_id_len, struct GNUNET_ShortHashCode *prk)
	A RFC9180 inspired labeled extract.
static enum GNUNET_GenericReturnValue	labeled_expand (const char *ctx_str, const struct GNUNET_ShortHashCode *prk, const char *label, size_t label_len, const void *info, size_t info_len, const uint8_t *suite_id, size_t suite_id_len, void *out_buf, uint16_t out_len)
	A RFC9180 inspired labeled extract.
static enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_labeled_extract_and_expand (const void *dh, size_t dh_len, const char *extract_ctx, const char *expand_ctx, const void *extract_lbl, size_t extract_lbl_len, const void *expand_lbl, size_t expand_lbl_len, const uint8_t *kem_context, size_t kem_context_len, const uint8_t *suite_id, size_t suite_id_len, struct GNUNET_ShortHashCode *shared_secret)
static enum GNUNET_GenericReturnValue	kem_encaps_norand (uint8_t *suite_id, size_t suite_id_len, const struct GNUNET_CRYPTO_HpkePublicKey *pkR, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, const struct GNUNET_CRYPTO_HpkePrivateKey *skE, struct GNUNET_ShortHashCode *shared_secret)
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_encaps_norand (const struct GNUNET_CRYPTO_HpkePublicKey *pkR, struct GNUNET_CRYPTO_HpkeEncapsulation *enc, const struct GNUNET_CRYPTO_HpkePrivateKey *skE, struct GNUNET_ShortHashCode *shared_secret)
	Deterministic variant of GNUNET_CRYPTO_hpke_kem_encaps.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_encaps (const struct GNUNET_CRYPTO_HpkePublicKey *pub, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate key material for a X25519 public key.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey *pub, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate key material for a EdDSA public key.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_decaps (const struct GNUNET_CRYPTO_HpkePrivateKey *skR, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Decapsulate a key for a private X25519 key.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_decaps (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Decapsulate a key for a private EdDSA key.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand (uint8_t random_tweak, const struct GNUNET_CRYPTO_HpkePublicKey *pkR, struct GNUNET_CRYPTO_HpkeEncapsulation *c, const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *skE, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_encaps (const struct GNUNET_CRYPTO_HpkePublicKey *pkR, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_decaps (const struct GNUNET_CRYPTO_HpkePrivateKey *skR, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh decapsulation with own private key and the representative of the received public key.
static enum GNUNET_GenericReturnValue	verify_psk_inputs (enum GNUNET_CRYPTO_HpkeMode mode, const uint8_t *psk, size_t psk_len, const uint8_t *psk_id, size_t psk_id_len)
static enum GNUNET_GenericReturnValue	key_schedule (enum GNUNET_CRYPTO_HpkeRole role, enum GNUNET_CRYPTO_HpkeMode mode, const struct GNUNET_ShortHashCode *shared_secret, const uint8_t *info, size_t info_len, const uint8_t *psk, size_t psk_len, const uint8_t *psk_id, size_t psk_id_len, struct GNUNET_CRYPTO_HpkeContext *ctx)
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sender_setup2 (enum GNUNET_CRYPTO_HpkeKem kem, enum GNUNET_CRYPTO_HpkeMode mode, struct GNUNET_CRYPTO_HpkePrivateKey *skE, struct GNUNET_CRYPTO_HpkePrivateKey *skS, const struct GNUNET_CRYPTO_HpkePublicKey *pkR, const uint8_t *info, size_t info_len, const uint8_t *psk, size_t psk_len, const uint8_t *psk_id, size_t psk_id_len, struct GNUNET_CRYPTO_HpkeEncapsulation *enc, struct GNUNET_CRYPTO_HpkeContext *ctx)
	RFC9180 HPKE encryption.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sender_setup (const struct GNUNET_CRYPTO_HpkePublicKey *pkR, const uint8_t *info, size_t info_len, struct GNUNET_CRYPTO_HpkeEncapsulation *enc, struct GNUNET_CRYPTO_HpkeContext *ctx)
	RFC9180 HPKE encryption.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_receiver_setup2 (enum GNUNET_CRYPTO_HpkeKem kem, enum GNUNET_CRYPTO_HpkeMode mode, const struct GNUNET_CRYPTO_HpkeEncapsulation *enc, const struct GNUNET_CRYPTO_HpkePrivateKey *skR, const struct GNUNET_CRYPTO_HpkePublicKey *pkS, const uint8_t *info, size_t info_len, const uint8_t *psk, size_t psk_len, const uint8_t *psk_id, size_t psk_id_len, struct GNUNET_CRYPTO_HpkeContext *ctx)
	RFC9180 HPKE encryption.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_receiver_setup (const struct GNUNET_CRYPTO_HpkeEncapsulation *enc, const struct GNUNET_CRYPTO_HpkePrivateKey *skR, const uint8_t *info, size_t info_len, struct GNUNET_CRYPTO_HpkeContext *ctx)
	RFC9180 HPKE encryption.
static enum GNUNET_GenericReturnValue	increment_seq (struct GNUNET_CRYPTO_HpkeContext *ctx)
static void	compute_nonce (struct GNUNET_CRYPTO_HpkeContext *ctx, uint8_t *nonce)
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_seal (struct GNUNET_CRYPTO_HpkeContext *ctx, const uint8_t *aad, size_t aad_len, const uint8_t *pt, size_t pt_len, uint8_t *ct, unsigned long long *ct_len_p)
	RFC9180 HPKE encryption.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_open (struct GNUNET_CRYPTO_HpkeContext *ctx, const uint8_t *aad, size_t aad_len, const uint8_t *ct, size_t ct_len, uint8_t *pt, unsigned long long *pt_len)
	RFC9180 HPKE encryption.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_seal_oneshot (const struct GNUNET_CRYPTO_HpkePublicKey *pkR, const uint8_t *info, size_t info_len, const uint8_t *aad, size_t aad_len, const uint8_t *pt, size_t pt_len, uint8_t *ct, unsigned long long *ct_len_p)
	RFC9180 HPKE encryption.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_open_oneshot (const struct GNUNET_CRYPTO_HpkePrivateKey *skR, const uint8_t *info, size_t info_len, const uint8_t *aad, size_t aad_len, const uint8_t *ct, size_t ct_len, uint8_t *pt, unsigned long long *pt_len_p)
	RFC9180 HPKE encryption.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_pk_to_x25519 (const struct GNUNET_CRYPTO_BlindablePublicKey *pk, struct GNUNET_CRYPTO_HpkePublicKey *x25519)
	Convert a GNUnet identity key to a key sutiable for HPKE (X25519)
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sk_to_x25519 (const struct GNUNET_CRYPTO_BlindablePrivateKey *sk, struct GNUNET_CRYPTO_HpkePrivateKey *x25519)
	Convert a GNUnet identity key to a key sutiable for HPKE (X25519)
ssize_t	GNUNET_CRYPTO_hpke_pk_get_length (const struct GNUNET_CRYPTO_HpkePublicKey *key)
	Get the compacted length of a GNUNET_CRYPTO_HpkePublicKey.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_read_hpke_pk_from_buffer (const void *buffer, size_t len, struct GNUNET_CRYPTO_HpkePublicKey *key, size_t *read)
	Reads a GNUNET_CRYPTO_HpkePublicKey from a compact buffer.
ssize_t	GNUNET_CRYPTO_write_hpke_pk_to_buffer (const struct GNUNET_CRYPTO_HpkePublicKey *key, void *buffer, size_t len)
	Writes a GNUNET_CRYPTO_HpkePublicKey to a compact buffer.
void	GNUNET_CRYPTO_hpke_sk_clear (struct GNUNET_CRYPTO_HpkePrivateKey *key)
	Clear memory that was used to store a GNUNET_CRYPTO_HpkePrivateKey.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sk_create2 (enum GNUNET_CRYPTO_HpkeKeyType type, const char *ikm, size_t ikm_len, struct GNUNET_CRYPTO_HpkePrivateKey *sk)
	Create a new GNUNET_CRYPTO_HpkePrivateKey of specific type.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sk_create (enum GNUNET_CRYPTO_HpkeKeyType type, struct GNUNET_CRYPTO_HpkePrivateKey *pk)
	Create a new GNUNET_CRYPTO_HpkePrivateKey of specific type.
ssize_t	GNUNET_CRYPTO_hpke_sk_get_length (const struct GNUNET_CRYPTO_HpkePrivateKey *key)
	Get the compacted length of a GNUNET_CRYPTO_HpkePrivateKey.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_read_hpke_sk_from_buffer (const void *buffer, size_t len, struct GNUNET_CRYPTO_HpkePrivateKey *key, size_t *read)
	Reads a GNUNET_CRYPTO_HpkePrivateKey from a compact buffer.
ssize_t	GNUNET_CRYPTO_write_hpke_sk_to_buffer (const struct GNUNET_CRYPTO_HpkePrivateKey *key, void *buffer, size_t len)
	Writes a GNUNET_CRYPTO_HpkePrivateKey to a compact buffer.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_sk_get_public (const struct GNUNET_CRYPTO_HpkePrivateKey *privkey, struct GNUNET_CRYPTO_HpkePublicKey *key)
	Retrieves the GNUNET_CRYPTO_HpkePublicKey representation of a GNUNET_CRYPTO_HpkePrivateKey.

Variables
static uint8_t	GNUNET_CRYPTO_HPKE_KEM_SUITE_ID []
static uint8_t	GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID []

Detailed Description

Hybrid Public Key Encryption (HPKE) and Key encapsulation mechanisms (KEMs)

Author

Martin Schanzenbach

Definition in file crypto_hpke.c.

Function Documentation

labeled_extract()

static enum GNUNET_GenericReturnValue labeled_extract ( const char *  ctx_str, const void *  salt, size_t  salt_len, const void *  label, size_t  label_len, const void *  ikm, size_t  ikm_len, const uint8_t *  suite_id, size_t  suite_id_len, struct GNUNET_ShortHashCode *  prk  )

static

A RFC9180 inspired labeled extract.

Parameters

ctx_str	the context to label with (c string)
salt	the extract salt
salt_len	salt length in bytes
label	the label to label with
label_len	label length in bytes
ikm	initial keying material
ikm_len	ikm length in bytes
suite_id	the suite ID
suite_id_len	suite_id length in bytes
prk	the resulting extracted PRK

Returns

GNUNET_OK on success

Definition at line 51 of file crypto_hpke.c.

{
  size_t labeled_ikm_len = strlen (ctx_str) + suite_id_len
                           + label_len + ikm_len;
  uint8_t labeled_ikm[labeled_ikm_len];
  uint8_t *tmp = labeled_ikm;
 
  // labeled_ikm = concat("HPKE-v1", suite_id, label, ikm)
  memcpy (tmp, ctx_str, strlen (ctx_str));
  tmp += strlen (ctx_str);
  memcpy (tmp, suite_id, suite_id_len);
  tmp += suite_id_len;
  memcpy (tmp, label, label_len);
  tmp += label_len;
  memcpy (tmp, ikm, ikm_len);
  // return Extract(salt, labeled_ikm)
  return GNUNET_CRYPTO_hkdf_extract (prk,
                                     salt, salt_len,
                                     labeled_ikm, labeled_ikm_len);
}

References GNUNET_CRYPTO_hkdf_extract(), ikm, and salt.

Referenced by GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), GNUNET_CRYPTO_hpke_sk_create2(), and key_schedule().

Here is the call graph for this function:

Here is the caller graph for this function:

labeled_expand()

static enum GNUNET_GenericReturnValue labeled_expand ( const char *  ctx_str, const struct GNUNET_ShortHashCode *  prk, const char *  label, size_t  label_len, const void *  info, size_t  info_len, const uint8_t *  suite_id, size_t  suite_id_len, void *  out_buf, uint16_t  out_len  )

static

A RFC9180 inspired labeled extract.

Parameters

ctx_str	the context to label with (c string)
prk	the extracted PRK
label	the label to label with
label_len	label length in bytes
info	context info
info_len	info in bytes
suite_id	the suite ID
suite_id_len	suite_id length in bytes
out_buf	output buffer, must be allocated
out_len	out_buf length in bytes

Returns

GNUNET_OK on success

Definition at line 94 of file crypto_hpke.c.

{
  uint8_t labeled_info[2 + strlen (ctx_str) + suite_id_len + label_len
                       + info_len];
  uint8_t *tmp = labeled_info;
  uint16_t out_len_nbo = htons (out_len);
 
  // labeled_info = concat(I2OSP(L, 2), "HPKE-v1", suite_id,
  //                      label, info)
  memcpy (tmp, &out_len_nbo, 2);
  tmp += 2;
  memcpy (tmp, ctx_str, strlen (ctx_str));
  tmp += strlen (ctx_str);
  memcpy (tmp, suite_id, suite_id_len);
  tmp += suite_id_len;
  memcpy (tmp, label, label_len);
  tmp += label_len;
  memcpy (tmp, info, info_len);
  return GNUNET_CRYPTO_hkdf_expand (
    out_buf,
    out_len,
    prk,
    GNUNET_CRYPTO_kdf_arg (labeled_info,
                           sizeof labeled_info));
}

References GNUNET_CRYPTO_hkdf_expand, GNUNET_CRYPTO_kdf_arg, and info.

Referenced by GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), GNUNET_CRYPTO_hpke_sk_create2(), and key_schedule().

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_labeled_extract_and_expand()

static enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_labeled_extract_and_expand ( const void *  dh, size_t  dh_len, const char *  extract_ctx, const char *  expand_ctx, const void *  extract_lbl, size_t  extract_lbl_len, const void *  expand_lbl, size_t  expand_lbl_len, const uint8_t *  kem_context, size_t  kem_context_len, const uint8_t *  suite_id, size_t  suite_id_len, struct GNUNET_ShortHashCode *  shared_secret  )

static

Definition at line 128 of file crypto_hpke.c.

{
  struct GNUNET_ShortHashCode prk;
  // eae_prk = LabeledExtract("", "eae_prk", dh)
  labeled_extract (extract_ctx,
                   NULL, 0,
                   extract_lbl, extract_lbl_len,
                   dh, dh_len,
                   suite_id, suite_id_len,
                   &prk);
  return labeled_expand (expand_ctx,
                         &prk,
                         expand_lbl, expand_lbl_len,
                         kem_context, kem_context_len,
                         suite_id, suite_id_len,
                         shared_secret, sizeof *shared_secret);
}

References labeled_expand(), and labeled_extract().

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_decaps(), GNUNET_CRYPTO_hpke_kem_decaps(), and kem_encaps_norand().

Here is the call graph for this function:

Here is the caller graph for this function:

kem_encaps_norand()

static enum GNUNET_GenericReturnValue kem_encaps_norand ( uint8_t *  suite_id, size_t  suite_id_len, const struct GNUNET_CRYPTO_HpkePublicKey *  pkR, const struct GNUNET_CRYPTO_HpkeEncapsulation *  c, const struct GNUNET_CRYPTO_HpkePrivateKey *  skE, struct GNUNET_ShortHashCode *  shared_secret  )

static

Definition at line 171 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_HpkePublicKey dh;
  uint8_t kem_context[sizeof *c + sizeof pkR->ecdhe_key];
 
  // dh = DH(skE, pkR)
  if (GNUNET_OK != GNUNET_CRYPTO_ecdh_x25519 (
        &skE->ecdhe_key,
        &pkR->ecdhe_key,
        &dh.ecdhe_key))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "HPKE KEM encaps: Validation error\n");
    return GNUNET_SYSERR; // ValidationError
  }
  // enc = SerializePublicKey(pkE) is a NOP, see Section 7.1.1
  // pkRm = SerializePublicKey(pkR) is a NOP, see Section 7.1.1
  // kem_context = concat(enc, pkRm)
  memcpy (kem_context, c, sizeof *c);
  memcpy (kem_context + sizeof *c,
          &pkR->ecdhe_key,
          sizeof pkR->ecdhe_key);
  // shared_secret = ExtractAndExpand(dh, kem_context)
  return GNUNET_CRYPTO_hpke_labeled_extract_and_expand (
    &dh.ecdhe_key, sizeof dh.ecdhe_key,
    "HPKE-v1",
    "HPKE-v1",
    "eae_prk", strlen ("eae_prk"),
    "shared_secret", strlen ("shared_secret"),
    kem_context, sizeof kem_context,
    suite_id, suite_id_len,
    shared_secret);
}

References GNUNET_CRYPTO_HpkePrivateKey::ecdhe_key, GNUNET_CRYPTO_HpkePublicKey::ecdhe_key, GNUNET_CRYPTO_ecdh_x25519(), GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), GNUNET_ERROR_TYPE_ERROR, GNUNET_log, GNUNET_OK, and GNUNET_SYSERR.

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand(), and GNUNET_CRYPTO_hpke_kem_encaps_norand().

Here is the call graph for this function:

Here is the caller graph for this function:

verify_psk_inputs()

static enum GNUNET_GenericReturnValue verify_psk_inputs ( enum GNUNET_CRYPTO_HpkeMode  mode, const uint8_t *  psk, size_t  psk_len, const uint8_t *  psk_id, size_t  psk_id_len  )

static

Definition at line 412 of file crypto_hpke.c.

{
  bool got_psk;
  bool got_psk_id;
 
  got_psk = (0 != psk_len);
  got_psk_id = (0 != psk_id_len);
 
  if (got_psk != got_psk_id)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Inconsistent PSK inputs\n");
    return GNUNET_SYSERR;
  }
 
  if (got_psk &&
      ((GNUNET_CRYPTO_HPKE_MODE_BASE == mode) ||
       (GNUNET_CRYPTO_HPKE_MODE_AUTH == mode)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "PSK input provided when not needed\n");
    return GNUNET_SYSERR;
  }
  if (! got_psk &&
      ((GNUNET_CRYPTO_HPKE_MODE_PSK == mode) ||
       (GNUNET_CRYPTO_HPKE_MODE_AUTH_PSK == mode)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Missing required PSK input\n");
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_CRYPTO_HPKE_MODE_AUTH, GNUNET_CRYPTO_HPKE_MODE_AUTH_PSK, GNUNET_CRYPTO_HPKE_MODE_BASE, GNUNET_CRYPTO_HPKE_MODE_PSK, GNUNET_ERROR_TYPE_ERROR, GNUNET_log, GNUNET_OK, GNUNET_SYSERR, and mode.

Referenced by key_schedule().

Here is the caller graph for this function:

key_schedule()

static enum GNUNET_GenericReturnValue key_schedule ( enum GNUNET_CRYPTO_HpkeRole  role, enum GNUNET_CRYPTO_HpkeMode  mode, const struct GNUNET_ShortHashCode *  shared_secret, const uint8_t *  info, size_t  info_len, const uint8_t *  psk, size_t  psk_len, const uint8_t *  psk_id, size_t  psk_id_len, struct GNUNET_CRYPTO_HpkeContext *  ctx  )

static

Definition at line 450 of file crypto_hpke.c.

{
  struct GNUNET_ShortHashCode psk_id_hash;
  struct GNUNET_ShortHashCode info_hash;
  struct GNUNET_ShortHashCode secret;
  uint8_t key_schedule_context[1 + sizeof info_hash * 2];
  uint8_t suite_id[4 + 3 * 2];
  uint16_t kem_id = htons (32); // FIXME hardcode as constant
  uint16_t kdf_id = htons (1); // HKDF-256 FIXME hardcode as constant
  uint16_t aead_id = htons (3); // ChaCha20Poly1305 FIXME hardcode as constant
 
  // DHKEM(X25519, HKDF-256): kem_id = 32
  // concat("KEM", I2OSP(kem_id, 2))
  memcpy (suite_id, "HPKE", 4);
  memcpy (suite_id + 4, &kem_id, 2);
  memcpy (suite_id + 6, &kdf_id, 2);
  memcpy (suite_id + 8, &aead_id, 2);
 
  if (GNUNET_OK != verify_psk_inputs (mode, psk, psk_len, psk_id, psk_id_len))
    return GNUNET_SYSERR;
 
  if (GNUNET_OK != labeled_extract ("HPKE-v1", NULL, 0,
                                    "psk_id_hash", strlen ("psk_id_hash"),
                                    psk_id, psk_id_len,
                                    suite_id, sizeof suite_id, &psk_id_hash))
    return GNUNET_SYSERR;
  if (GNUNET_OK != labeled_extract ("HPKE-v1", NULL, 0,
                                    "info_hash", strlen ("info_hash"),
                                    info, info_len,
                                    suite_id, sizeof suite_id, &info_hash))
    return GNUNET_SYSERR;
  memcpy (key_schedule_context, &mode, 1);
  memcpy (key_schedule_context + 1, &psk_id_hash, sizeof psk_id_hash);
  memcpy (key_schedule_context + 1 + sizeof psk_id_hash,
          &info_hash, sizeof info_hash);
  if (GNUNET_OK != labeled_extract ("HPKE-v1",
                                    shared_secret, sizeof *shared_secret,
                                    "secret", strlen ("secret"),
                                    psk, psk_len,
                                    suite_id, sizeof suite_id, &secret))
    return GNUNET_SYSERR;
  // key = LabeledExpand(secret, "key", key_schedule_context, Nk)
  // Note: Nk == sizeof ctx->key
  if (GNUNET_OK != labeled_expand ("HPKE-v1",
                                   &secret,
                                   "key", strlen ("key"),
                                   &key_schedule_context,
                                   sizeof key_schedule_context,
                                   suite_id, sizeof suite_id,
                                   ctx->key, sizeof ctx->key))
    return GNUNET_SYSERR;
  // base_nonce = LabeledExpand(secret, "base_nonce",
  // key_schedule_context, Nn)
  if (GNUNET_OK != labeled_expand ("HPKE-v1",
                                   &secret,
                                   "base_nonce", strlen ("base_nonce"),
                                   &key_schedule_context,
                                   sizeof key_schedule_context,
                                   suite_id, sizeof suite_id,
                                   ctx->base_nonce, sizeof ctx->base_nonce))
    return GNUNET_SYSERR;
  // exporter_secret = LabeledExpand(secret, "exp",
  // key_schedule_context, Nh)
  if (GNUNET_OK != labeled_expand ("HPKE-v1",
                                   &secret,
                                   "exp", strlen ("exp"),
                                   &key_schedule_context,
                                   sizeof key_schedule_context,
                                   suite_id, sizeof suite_id,
                                   &ctx->exporter_secret,
                                   sizeof ctx->exporter_secret))
    return GNUNET_SYSERR;
  ctx->seq = 0;
  ctx->role = role;
  return GNUNET_OK;
}

References ctx, GNUNET_OK, GNUNET_SYSERR, info, labeled_expand(), labeled_extract(), mode, and verify_psk_inputs().

Referenced by GNUNET_CRYPTO_hpke_receiver_setup2(), and GNUNET_CRYPTO_hpke_sender_setup2().

Here is the call graph for this function:

Here is the caller graph for this function:

increment_seq()

static enum GNUNET_GenericReturnValue increment_seq ( struct GNUNET_CRYPTO_HpkeContext *  ctx )

static

Definition at line 681 of file crypto_hpke.c.

{
  if (ctx->seq >= UINT64_MAX)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "MessageLimitReached\n");
    return GNUNET_SYSERR;
  }
  ctx->seq = GNUNET_htonll (GNUNET_ntohll (ctx->seq) + 1);
  return GNUNET_OK;
}

References ctx, GNUNET_ERROR_TYPE_ERROR, GNUNET_htonll(), GNUNET_log, GNUNET_ntohll(), GNUNET_OK, and GNUNET_SYSERR.

Referenced by GNUNET_CRYPTO_hpke_open(), and GNUNET_CRYPTO_hpke_seal().

Here is the call graph for this function:

Here is the caller graph for this function:

compute_nonce()

static void compute_nonce ( struct GNUNET_CRYPTO_HpkeContext *  ctx, uint8_t *  nonce  )

static

Definition at line 694 of file crypto_hpke.c.

{
  size_t offset = GNUNET_CRYPTO_HPKE_NONCE_LEN - sizeof ctx->seq;
  int j = 0;
  for (int i = 0; i < GNUNET_CRYPTO_HPKE_NONCE_LEN; i++)
  {
    // FIXME correct byte order?
    if (i < offset)
      memset (&nonce[i], ctx->base_nonce[i], 1);
    else
      nonce[i] = ctx->base_nonce[i] ^ ((uint8_t*) &ctx->seq)[j++];
  }
}

References ctx, and GNUNET_CRYPTO_HPKE_NONCE_LEN.

Referenced by GNUNET_CRYPTO_hpke_open(), and GNUNET_CRYPTO_hpke_seal().

Here is the caller graph for this function:

Variable Documentation

GNUNET_CRYPTO_HPKE_KEM_SUITE_ID

uint8_t GNUNET_CRYPTO_HPKE_KEM_SUITE_ID[]

static

Initial value:

= { 'K', 'E', 'M',
                                                     0x00, 0x20 }

Definition at line 162 of file crypto_hpke.c.

                                                   { 'K', 'E', 'M',
                                                     0x00, 0x20 };

Referenced by GNUNET_CRYPTO_hpke_kem_decaps(), GNUNET_CRYPTO_hpke_kem_encaps_norand(), and GNUNET_CRYPTO_hpke_sk_create2().

GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID

uint8_t GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID[]

static

Initial value:

= { 'K', 'E', 'M',
                                                               0x00, 0x22 }

Definition at line 167 of file crypto_hpke.c.

                                                             { 'K', 'E', 'M',
                                                               0x00, 0x22 };

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_decaps(), and GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand().