gnunet-service-scalarproduct_bob.c

Go to the documentation of this file.

/*
     This file is part of GNUnet.
     Copyright (C) 2013, 2014, 2016 GNUnet e.V.
 
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
     by the Free Software Foundation, either version 3 of the License,
     or (at your option) any later version.
 
     GNUnet is distributed in the hope that it will be useful, but
     WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Affero General Public License for more details.
 
     You should have received a copy of the GNU Affero General Public License
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     SPDX-License-Identifier: AGPL3.0-or-later
 */
#include "platform.h"
#include <limits.h>
#include <gcrypt.h>
#include "gnunet_util_lib.h"
#include "gnunet_core_service.h"
#include "gnunet_cadet_service.h"
#include "gnunet_applications.h"
#include "gnunet_protocols.h"
#include "gnunet_scalarproduct_service.h"
#include "gnunet_seti_service.h"
#include "scalarproduct.h"
#include "gnunet-service-scalarproduct.h"
 
#define LOG(kind, ...) GNUNET_log_from (kind, "scalarproduct-bob", __VA_ARGS__)
 
 
struct MpiElement
{
  const struct GNUNET_HashCode *key;
 
  gcry_mpi_t value;
};
 
 
struct BobServiceSession
{
  struct GNUNET_HashCode session_id;
 
  struct GNUNET_SERVICE_Client *client;
 
  struct GNUNET_MQ_Handle *client_mq;
 
  struct GNUNET_CONTAINER_MultiHashMap *intersected_elements;
 
  struct GNUNET_SETI_Handle *intersection_set;
 
  struct GNUNET_SETI_OperationHandle *intersection_op;
 
  struct GNUNET_CADET_Port *port;
 
  struct MpiElement *sorted_elements;
 
  struct GNUNET_CRYPTO_PaillierCiphertext *e_a;
 
  struct GNUNET_CRYPTO_PaillierCiphertext *r;
 
  struct GNUNET_CRYPTO_PaillierCiphertext *r_prime;
 
  struct GNUNET_CRYPTO_PaillierCiphertext s;
 
  struct GNUNET_CRYPTO_PaillierCiphertext s_prime;
 
  struct CadetIncomingSession *cadet;
 
  uint32_t total;
 
  uint32_t client_received_element_count;
 
  uint32_t used_element_count;
 
  uint32_t cadet_received_element_count;
 
  uint32_t cadet_transmitted_element_count;
 
  enum GNUNET_SCALARPRODUCT_ResponseStatus status;
 
  int in_destroy;
 
  struct GNUNET_CADET_Channel *channel;
 
  struct GNUNET_PeerIdentity peer;
 
  struct GNUNET_CRYPTO_PaillierPublicKey remote_pubkey;
 
  struct GNUNET_MQ_Handle *cadet_mq;
};
 
 
static const struct GNUNET_CONFIGURATION_Handle *cfg;
 
static struct GNUNET_CRYPTO_PaillierPublicKey my_pubkey;
 
static struct GNUNET_CRYPTO_PaillierPrivateKey my_privkey;
 
static gcry_mpi_t my_offset;
 
static struct GNUNET_CADET_Handle *my_cadet;
 
 
static int
free_element_cb (void *cls,
                 const struct GNUNET_HashCode *key,
                 void *value)
{
  struct GNUNET_SCALARPRODUCT_Element *element = value;
 
  GNUNET_free (element);
  return GNUNET_OK;
}
 
 
static void
destroy_service_session (struct BobServiceSession *s)
{
  unsigned int i;
 
  if (GNUNET_YES == s->in_destroy)
    return;
  s->in_destroy = GNUNET_YES;
  if (NULL != s->client)
  {
    struct GNUNET_SERVICE_Client *c = s->client;
 
    s->client = NULL;
    GNUNET_SERVICE_client_drop (c);
  }
  if (NULL != s->intersected_elements)
  {
    GNUNET_CONTAINER_multihashmap_iterate (s->intersected_elements,
                                           &free_element_cb,
                                           NULL);
    GNUNET_CONTAINER_multihashmap_destroy (s->intersected_elements);
    s->intersected_elements = NULL;
  }
  if (NULL != s->intersection_op)
  {
    GNUNET_SETI_operation_cancel (s->intersection_op);
    s->intersection_op = NULL;
  }
  if (NULL != s->intersection_set)
  {
    GNUNET_SETI_destroy (s->intersection_set);
    s->intersection_set = NULL;
  }
  if (NULL != s->e_a)
  {
    GNUNET_free (s->e_a);
    s->e_a = NULL;
  }
  if (NULL != s->sorted_elements)
  {
    for (i = 0; i < s->used_element_count; i++)
      gcry_mpi_release (s->sorted_elements[i].value);
    GNUNET_free (s->sorted_elements);
    s->sorted_elements = NULL;
  }
  if (NULL != s->r)
  {
    GNUNET_free (s->r);
    s->r = NULL;
  }
  if (NULL != s->r_prime)
  {
    GNUNET_free (s->r_prime);
    s->r_prime = NULL;
  }
  if (NULL != s->port)
  {
    GNUNET_CADET_close_port (s->port);
    s->port = NULL;
  }
  if (NULL != s->channel)
  {
    GNUNET_CADET_channel_destroy (s->channel);
    s->channel = NULL;
  }
  GNUNET_free (s);
}
 
 
static void
prepare_client_end_notification (struct BobServiceSession *session)
{
  struct ClientResponseMessage *msg;
  struct GNUNET_MQ_Envelope *e;
 
  if (NULL == session->client_mq)
    return; /* no client left to be notified */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending session-end notification with status %d to client for session %s\n",
              session->status,
              GNUNET_h2s (&session->session_id));
  e = GNUNET_MQ_msg (msg,
                     GNUNET_MESSAGE_TYPE_SCALARPRODUCT_RESULT);
  msg->range = 0;
  msg->product_length = htonl (0);
  msg->status = htonl (session->status);
  GNUNET_MQ_send (session->client_mq,
                  e);
}
 
 
static void
cb_channel_destruction (void *cls,
                        const struct GNUNET_CADET_Channel *channel)
{
  struct BobServiceSession *s = cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Peer disconnected, terminating session %s with peer %s\n",
              GNUNET_h2s (&s->session_id),
              GNUNET_i2s (&s->peer));
  if (GNUNET_SCALARPRODUCT_STATUS_ACTIVE == s->status)
  {
    s->status = GNUNET_SCALARPRODUCT_STATUS_FAILURE;
    prepare_client_end_notification (s);
  }
  s->channel = NULL;
  destroy_service_session (s);
}
 
 
static void
bob_cadet_done_cb (void *cls)
{
  struct BobServiceSession *session = cls;
 
  session->status = GNUNET_SCALARPRODUCT_STATUS_SUCCESS;
  prepare_client_end_notification (session);
}
 
 
#define ELEMENT_CAPACITY ((GNUNET_CONSTANTS_MAX_CADET_MESSAGE_SIZE - 1 \
                           - sizeof(struct BobCryptodataMultipartMessage)) \
                          / sizeof(struct \
                                   GNUNET_CRYPTO_PaillierCiphertext))
 
 
static void
transmit_bobs_cryptodata_message_multipart (struct BobServiceSession *s)
{
  struct GNUNET_CRYPTO_PaillierCiphertext *payload;
  struct BobCryptodataMultipartMessage *msg;
  struct GNUNET_MQ_Envelope *e;
  unsigned int i;
  unsigned int j;
  uint32_t todo_count;
 
  while (s->cadet_transmitted_element_count != s->used_element_count)
  {
    todo_count = s->used_element_count - s->cadet_transmitted_element_count;
    if (todo_count > ELEMENT_CAPACITY / 2)
      todo_count = ELEMENT_CAPACITY / 2;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Sending %u additional crypto values to Alice\n",
                (unsigned int) todo_count);
    e = GNUNET_MQ_msg_extra (msg,
                             todo_count * sizeof(struct
                                                 GNUNET_CRYPTO_PaillierCiphertext)
                             * 2,
                             GNUNET_MESSAGE_TYPE_SCALARPRODUCT_BOB_CRYPTODATA_MULTIPART);
    msg->contained_element_count = htonl (todo_count);
    payload = (struct GNUNET_CRYPTO_PaillierCiphertext *) &msg[1];
    for (i = s->cadet_transmitted_element_count, j = 0; i <
         s->cadet_transmitted_element_count + todo_count; i++)
    {
      // r[i][p] and r[i][q]
      GNUNET_memcpy (&payload[j++],
                     &s->r[i],
                     sizeof(struct GNUNET_CRYPTO_PaillierCiphertext));
      GNUNET_memcpy (&payload[j++],
                     &s->r_prime[i],
                     sizeof(struct GNUNET_CRYPTO_PaillierCiphertext));
    }
    s->cadet_transmitted_element_count += todo_count;
    if (s->cadet_transmitted_element_count == s->used_element_count)
      GNUNET_MQ_notify_sent (e,
                             &bob_cadet_done_cb,
                             s);
    GNUNET_MQ_send (s->cadet_mq,
                    e);
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "All values queued for Alice, Bob is done\n");
}
 
 
static void
transmit_bobs_cryptodata_message (struct BobServiceSession *s)
{
  struct BobCryptodataMessage *msg;
  struct GNUNET_MQ_Envelope *e;
  struct GNUNET_CRYPTO_PaillierCiphertext *payload;
  unsigned int i;
 
  s->cadet_transmitted_element_count
    = ((GNUNET_CONSTANTS_MAX_CADET_MESSAGE_SIZE - 1 - sizeof(struct
                                                             BobCryptodataMessage))
       / sizeof(struct GNUNET_CRYPTO_PaillierCiphertext) / 2) - 1;
  if (s->cadet_transmitted_element_count > s->used_element_count)
    s->cadet_transmitted_element_count = s->used_element_count;
 
  e = GNUNET_MQ_msg_extra (msg,
                           (2 + s->cadet_transmitted_element_count * 2)
                           * sizeof(struct GNUNET_CRYPTO_PaillierCiphertext),
                           GNUNET_MESSAGE_TYPE_SCALARPRODUCT_BOB_CRYPTODATA);
  msg->contained_element_count = htonl (s->cadet_transmitted_element_count);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending %u/%u crypto values to Alice\n",
              (unsigned int) s->cadet_transmitted_element_count,
              (unsigned int) s->used_element_count);
 
  payload = (struct GNUNET_CRYPTO_PaillierCiphertext *) &msg[1];
  GNUNET_memcpy (&payload[0],
                 &s->s,
                 sizeof(struct GNUNET_CRYPTO_PaillierCiphertext));
  GNUNET_memcpy (&payload[1],
                 &s->s_prime,
                 sizeof(struct GNUNET_CRYPTO_PaillierCiphertext));
 
  payload = &payload[2];
  // convert k[][]
  for (i = 0; i < s->cadet_transmitted_element_count; i++)
  {
    // k[i][p] and k[i][q]
    GNUNET_memcpy (&payload[i * 2],
                   &s->r[i],
                   sizeof(struct GNUNET_CRYPTO_PaillierCiphertext));
    GNUNET_memcpy (&payload[i * 2 + 1],
                   &s->r_prime[i],
                   sizeof(struct GNUNET_CRYPTO_PaillierCiphertext));
  }
  if (s->cadet_transmitted_element_count == s->used_element_count)
    GNUNET_MQ_notify_sent (e,
                           &bob_cadet_done_cb,
                           s);
  GNUNET_MQ_send (s->cadet_mq,
                  e);
  transmit_bobs_cryptodata_message_multipart (s);
}
 
 
#undef ELEMENT_CAPACITY
 
 
static gcry_mpi_t
compute_square_sum (const gcry_mpi_t *vector,
                    uint32_t length)
{
  gcry_mpi_t elem;
  gcry_mpi_t sum;
  uint32_t i;
 
  GNUNET_assert (NULL != (sum = gcry_mpi_new (0)));
  GNUNET_assert (NULL != (elem = gcry_mpi_new (0)));
  for (i = 0; i < length; i++)
  {
    gcry_mpi_mul (elem, vector[i], vector[i]);
    gcry_mpi_add (sum, sum, elem);
  }
  gcry_mpi_release (elem);
  return sum;
}
 
 
static int
compute_service_response (struct BobServiceSession *session)
{
  uint32_t i;
  unsigned int *p;
  unsigned int *q;
  uint32_t count;
  gcry_mpi_t *rand;
  gcry_mpi_t tmp;
  const struct MpiElement *b;
  struct GNUNET_CRYPTO_PaillierCiphertext *a;
  struct GNUNET_CRYPTO_PaillierCiphertext *r;
  struct GNUNET_CRYPTO_PaillierCiphertext *r_prime;
 
  count = session->used_element_count;
  a = session->e_a;
  b = session->sorted_elements;
  q = GNUNET_CRYPTO_random_permute (GNUNET_CRYPTO_QUALITY_WEAK,
                                    count);
  p = GNUNET_CRYPTO_random_permute (GNUNET_CRYPTO_QUALITY_WEAK,
                                    count);
  rand = GNUNET_malloc (sizeof(gcry_mpi_t) * count);
  for (i = 0; i < count; i++)
    GNUNET_assert (NULL != (rand[i] = gcry_mpi_new (0)));
  r = GNUNET_malloc (sizeof(struct GNUNET_CRYPTO_PaillierCiphertext) * count);
  r_prime = GNUNET_malloc (sizeof(struct GNUNET_CRYPTO_PaillierCiphertext)
                           * count);
 
  for (i = 0; i < count; i++)
  {
    int32_t svalue;
 
    svalue = (int32_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
                                                 UINT32_MAX);
    // long to gcry_mpi_t
    if (svalue < 0)
      gcry_mpi_sub_ui (rand[i],
                       rand[i],
                       -svalue);
    else
      rand[i] = gcry_mpi_set_ui (rand[i], svalue);
  }
 
  tmp = gcry_mpi_new (0);
  // encrypt the element
  // for the sake of readability I decided to have dedicated permutation
  // vectors, which get rid of all the lookups in p/q.
  // however, ap/aq are not absolutely necessary but are just abstraction
  // Calculate Kp = E(S + a_pi) (+) E(S - r_pi - b_pi)
  for (i = 0; i < count; i++)
  {
    // E(S - r_pi - b_pi)
    gcry_mpi_sub (tmp, my_offset, rand[p[i]]);
    gcry_mpi_sub (tmp, tmp, b[p[i]].value);
    GNUNET_assert (2 ==
                   GNUNET_CRYPTO_paillier_encrypt (&session->remote_pubkey,
                                                   tmp,
                                                   2,
                                                   &r[i]));
 
    // E(S - r_pi - b_pi) * E(S + a_pi) ==  E(2*S + a - r - b)
    if (GNUNET_OK !=
        GNUNET_CRYPTO_paillier_hom_add (&session->remote_pubkey,
                                        &r[i],
                                        &a[p[i]],
                                        &r[i]))
    {
      GNUNET_break_op (0);
      goto error_cleanup;
    }
  }
 
  // Calculate Kq = E(S + a_qi) (+) E(S - r_qi)
  for (i = 0; i < count; i++)
  {
    // E(S - r_qi)
    gcry_mpi_sub (tmp, my_offset, rand[q[i]]);
    GNUNET_assert (2 ==
                   GNUNET_CRYPTO_paillier_encrypt (&session->remote_pubkey,
                                                   tmp,
                                                   2,
                                                   &r_prime[i]));
 
    // E(S - r_qi) * E(S + a_qi) == E(2*S + a_qi - r_qi)
    if (GNUNET_OK !=
        GNUNET_CRYPTO_paillier_hom_add (&session->remote_pubkey,
                                        &r_prime[i],
                                        &a[q[i]],
                                        &r_prime[i]))
    {
      GNUNET_break_op (0);
      goto error_cleanup;
    }
  }
  gcry_mpi_release (tmp);
 
  // Calculate S' =  E(SUM( r_i^2 ))
  tmp = compute_square_sum (rand, count);
  GNUNET_assert (1 ==
                 GNUNET_CRYPTO_paillier_encrypt (&session->remote_pubkey,
                                                 tmp,
                                                 1,
                                                 &session->s_prime));
  gcry_mpi_release (tmp);
 
  // Calculate S = E(SUM( (r_i + b_i)^2 ))
  for (i = 0; i < count; i++)
    gcry_mpi_add (rand[i], rand[i], b[i].value);
  tmp = compute_square_sum (rand, count);
  GNUNET_assert (1 ==
                 GNUNET_CRYPTO_paillier_encrypt (&session->remote_pubkey,
                                                 tmp,
                                                 1,
                                                 &session->s));
  gcry_mpi_release (tmp);
 
  session->r = r;
  session->r_prime = r_prime;
 
  for (i = 0; i < count; i++)
    gcry_mpi_release (rand[i]);
  GNUNET_free (session->e_a);
  session->e_a = NULL;
  GNUNET_free (p);
  GNUNET_free (q);
  GNUNET_free (rand);
  return GNUNET_OK;
 
error_cleanup:
  GNUNET_free (r);
  GNUNET_free (r_prime);
  gcry_mpi_release (tmp);
  GNUNET_free (p);
  GNUNET_free (q);
  for (i = 0; i < count; i++)
    gcry_mpi_release (rand[i]);
  GNUNET_free (rand);
  return GNUNET_SYSERR;
}
 
 
static int
copy_element_cb (void *cls,
                 const struct GNUNET_HashCode *key,
                 void *value)
{
  struct BobServiceSession *s = cls;
  struct GNUNET_SCALARPRODUCT_Element *e = value;
  gcry_mpi_t mval;
  int64_t val;
 
  mval = gcry_mpi_new (0);
  val = (int64_t) GNUNET_ntohll (e->value);
  if (0 > val)
    gcry_mpi_sub_ui (mval, mval, -val);
  else
    gcry_mpi_add_ui (mval, mval, val);
  s->sorted_elements [s->used_element_count].value = mval;
  s->sorted_elements [s->used_element_count].key = &e->key;
  s->used_element_count++;
  return GNUNET_OK;
}
 
 
static int
element_cmp (const void *a,
             const void *b)
{
  const struct MpiElement *ma = a;
  const struct MpiElement *mb = b;
 
  return GNUNET_CRYPTO_hash_cmp (ma->key,
                                 mb->key);
}
 
 
static void
transmit_cryptographic_reply (struct BobServiceSession *s)
{
  struct GNUNET_CADET_Channel *channel;
 
  /* TODO: code duplication with Alice! */
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received everything, building reply for Alice\n");
  s->sorted_elements
    = GNUNET_malloc (GNUNET_CONTAINER_multihashmap_size (
                       s->intersected_elements)
                     * sizeof(struct MpiElement));
  s->used_element_count = 0;
  GNUNET_CONTAINER_multihashmap_iterate (s->intersected_elements,
                                         &copy_element_cb,
                                         s);
  qsort (s->sorted_elements,
         s->used_element_count,
         sizeof(struct MpiElement),
         &element_cmp);
  if (GNUNET_OK !=
      compute_service_response (s))
  {
    channel = s->channel;
    s->channel = NULL;
    GNUNET_CADET_channel_destroy (channel);
    return;
  }
  transmit_bobs_cryptodata_message (s);
}
 
 
static int
check_alices_cryptodata_message (void *cls,
                                 const struct AliceCryptodataMessage *msg)
{
  struct BobServiceSession *s = cls;
  uint32_t contained_elements;
  size_t msg_length;
  uint16_t msize;
  unsigned int max;
 
  msize = ntohs (msg->header.size);
  contained_elements = ntohl (msg->contained_element_count);
  /* Our intersection may still be ongoing, but this is nevertheless
     an upper bound on the required array size */
  max = GNUNET_CONTAINER_multihashmap_size (s->intersected_elements);
  msg_length = sizeof(struct AliceCryptodataMessage)
               + contained_elements * sizeof(struct
                                             GNUNET_CRYPTO_PaillierCiphertext);
  if ((msize != msg_length) ||
      (0 == contained_elements) ||
      (contained_elements > UINT16_MAX) ||
      (max < contained_elements + s->cadet_received_element_count))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_alices_cryptodata_message (void *cls,
                                  const struct AliceCryptodataMessage *msg)
{
  struct BobServiceSession *s = cls;
  const struct GNUNET_CRYPTO_PaillierCiphertext *payload;
  uint32_t contained_elements;
  unsigned int max;
 
  contained_elements = ntohl (msg->contained_element_count);
  /* Our intersection may still be ongoing, but this is nevertheless
     an upper bound on the required array size */
  max = GNUNET_CONTAINER_multihashmap_size (s->intersected_elements);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received %u crypto values from Alice\n",
              (unsigned int) contained_elements);
 
  payload = (const struct GNUNET_CRYPTO_PaillierCiphertext *) &msg[1];
  if (NULL == s->e_a)
    s->e_a = GNUNET_new_array (max,
                               struct GNUNET_CRYPTO_PaillierCiphertext);
  GNUNET_memcpy (&s->e_a[s->cadet_received_element_count],
                 payload,
                 sizeof(struct GNUNET_CRYPTO_PaillierCiphertext)
                 * contained_elements);
  s->cadet_received_element_count += contained_elements;
 
  if ((s->cadet_received_element_count == max) &&
      (NULL == s->intersection_op))
  {
    /* intersection has finished also on our side, and
       we got the full set, so we can proceed with the
       CADET response(s) */
    transmit_cryptographic_reply (s);
  }
  GNUNET_CADET_receive_done (s->channel);
}
 
 
static void
cb_intersection_element_removed (void *cls,
                                 const struct GNUNET_SETI_Element *element,
                                 uint64_t current_size,
                                 enum GNUNET_SETI_Status status)
{
  struct BobServiceSession *s = cls;
  struct GNUNET_SCALARPRODUCT_Element *se;
 
  switch (status)
  {
  case GNUNET_SETI_STATUS_DEL_LOCAL:
    /* this element has been removed from the set */
    se = GNUNET_CONTAINER_multihashmap_get (s->intersected_elements,
                                            element->data);
    GNUNET_assert (NULL != se);
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Removed element with key %s and value %lld\n",
         GNUNET_h2s (&se->key),
         (long long) GNUNET_ntohll (se->value));
    GNUNET_assert (GNUNET_YES ==
                   GNUNET_CONTAINER_multihashmap_remove (
                     s->intersected_elements,
                     element->data,
                     se));
    GNUNET_free (se);
    return;
  case GNUNET_SETI_STATUS_DONE:
    s->intersection_op = NULL;
    GNUNET_break (NULL == s->intersection_set);
    GNUNET_CADET_receive_done (s->channel);
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Finished intersection, %d items remain\n",
         GNUNET_CONTAINER_multihashmap_size (s->intersected_elements));
    if (s->client_received_element_count ==
        GNUNET_CONTAINER_multihashmap_size (s->intersected_elements))
    {
      /* CADET transmission from Alice is also already done,
         start with our own reply */
      transmit_cryptographic_reply (s);
    }
    return;
  case GNUNET_SETI_STATUS_FAILURE:
    /* unhandled status code */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Set intersection failed!\n");
    s->intersection_op = NULL;
    if (NULL != s->intersection_set)
    {
      GNUNET_SETI_destroy (s->intersection_set);
      s->intersection_set = NULL;
    }
    s->status = GNUNET_SCALARPRODUCT_STATUS_FAILURE;
    prepare_client_end_notification (s);
    return;
  default:
    GNUNET_break (0);
    return;
  }
}
 
 
static void
start_intersection (struct BobServiceSession *s)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Got session with key %s and %u elements, starting intersection.\n",
              GNUNET_h2s (&s->session_id),
              (unsigned int) s->total);
 
  s->intersection_op
    = GNUNET_SETI_prepare (&s->peer,
                           &s->session_id,
                           NULL,
                           (struct GNUNET_SETI_Option[]) { { 0 } },
                           &cb_intersection_element_removed,
                           s);
  if (GNUNET_OK !=
      GNUNET_SETI_commit (s->intersection_op,
                          s->intersection_set))
  {
    GNUNET_break (0);
    s->status = GNUNET_SCALARPRODUCT_STATUS_FAILURE;
    prepare_client_end_notification (s);
    return;
  }
  GNUNET_SETI_destroy (s->intersection_set);
  s->intersection_set = NULL;
}
 
 
static void
handle_alices_computation_request (void *cls,
                                   const struct ServiceRequestMessage *msg)
{
  struct BobServiceSession *s = cls;
 
  s->session_id = msg->session_id; // ??
  s->remote_pubkey = msg->public_key;
  if (s->client_received_element_count == s->total)
    start_intersection (s);
}
 
 
static void *
cb_channel_incoming (void *cls,
                     struct GNUNET_CADET_Channel *channel,
                     const struct GNUNET_PeerIdentity *initiator)
{
  struct BobServiceSession *s = cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "New incoming channel from peer %s.\n",
              GNUNET_i2s (initiator));
  GNUNET_CADET_close_port (s->port);
  s->port = NULL;
  s->channel = channel;
  s->peer = *initiator;
  s->cadet_mq = GNUNET_CADET_get_mq (s->channel);
  return s;
}
 
 
static int
check_bob_client_message_multipart (void *cls,
                                    const struct
                                    ComputationBobCryptodataMultipartMessage *
                                    msg)
{
  struct BobServiceSession *s = cls;
  uint32_t contained_count;
  uint16_t msize;
 
  msize = ntohs (msg->header.size);
  contained_count = ntohl (msg->element_count_contained);
  if ((msize != (sizeof(struct ComputationBobCryptodataMultipartMessage)
                 + contained_count * sizeof(struct
                                            GNUNET_SCALARPRODUCT_Element))) ||
      (0 == contained_count) ||
      (UINT16_MAX < contained_count) ||
      (s->total == s->client_received_element_count) ||
      (s->total < s->client_received_element_count + contained_count))
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_bob_client_message_multipart (void *cls,
                                     const struct
                                     ComputationBobCryptodataMultipartMessage *
                                     msg)
{
  struct BobServiceSession *s = cls;
  uint32_t contained_count;
  const struct GNUNET_SCALARPRODUCT_Element *elements;
  struct GNUNET_SETI_Element set_elem;
  struct GNUNET_SCALARPRODUCT_Element *elem;
 
  contained_count = ntohl (msg->element_count_contained);
  elements = (const struct GNUNET_SCALARPRODUCT_Element *) &msg[1];
  for (uint32_t i = 0; i < contained_count; i++)
  {
    elem = GNUNET_new (struct GNUNET_SCALARPRODUCT_Element);
    GNUNET_memcpy (elem,
                   &elements[i],
                   sizeof(struct GNUNET_SCALARPRODUCT_Element));
    if (GNUNET_SYSERR ==
        GNUNET_CONTAINER_multihashmap_put (s->intersected_elements,
                                           &elem->key,
                                           elem,
                                           GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
    {
      GNUNET_break (0);
      GNUNET_free (elem);
      continue;
    }
    set_elem.data = &elem->key;
    set_elem.size = sizeof(elem->key);
    set_elem.element_type = 0;
    GNUNET_SETI_add_element (s->intersection_set,
                             &set_elem,
                             NULL, NULL);
  }
  s->client_received_element_count += contained_count;
  GNUNET_SERVICE_client_continue (s->client);
  if (s->total != s->client_received_element_count)
  {
    /* more to come */
    return;
  }
  if (NULL == s->channel)
  {
    /* no Alice waiting for this request, wait for Alice */
    return;
  }
  start_intersection (s);
}
 
 
static int
check_bob_client_message (void *cls,
                          const struct BobComputationMessage *msg)
{
  struct BobServiceSession *s = cls;
  uint32_t contained_count;
  uint32_t total_count;
  uint16_t msize;
 
  if (GNUNET_SCALARPRODUCT_STATUS_INIT != s->status)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  msize = ntohs (msg->header.size);
  total_count = ntohl (msg->element_count_total);
  contained_count = ntohl (msg->element_count_contained);
  if ((0 == total_count) ||
      (0 == contained_count) ||
      (UINT16_MAX < contained_count) ||
      (msize != (sizeof(struct BobComputationMessage)
                 + contained_count * sizeof(struct
                                            GNUNET_SCALARPRODUCT_Element))))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_bob_client_message (void *cls,
                           const struct BobComputationMessage *msg)
{
  struct BobServiceSession *s = cls;
  struct GNUNET_MQ_MessageHandler cadet_handlers[] = {
    GNUNET_MQ_hd_fixed_size (alices_computation_request,
                             GNUNET_MESSAGE_TYPE_SCALARPRODUCT_SESSION_INITIALIZATION,
                             struct ServiceRequestMessage,
                             NULL),
    GNUNET_MQ_hd_var_size (alices_cryptodata_message,
                           GNUNET_MESSAGE_TYPE_SCALARPRODUCT_ALICE_CRYPTODATA,
                           struct AliceCryptodataMessage,
                           NULL),
    GNUNET_MQ_handler_end ()
  };
  uint32_t contained_count;
  uint32_t total_count;
  const struct GNUNET_SCALARPRODUCT_Element *elements;
  struct GNUNET_SETI_Element set_elem;
  struct GNUNET_SCALARPRODUCT_Element *elem;
 
  total_count = ntohl (msg->element_count_total);
  contained_count = ntohl (msg->element_count_contained);
 
  s->status = GNUNET_SCALARPRODUCT_STATUS_ACTIVE;
  s->total = total_count;
  s->client_received_element_count = contained_count;
  s->session_id = msg->session_key;
  elements = (const struct GNUNET_SCALARPRODUCT_Element *) &msg[1];
  s->intersected_elements
    = GNUNET_CONTAINER_multihashmap_create (s->total,
                                            GNUNET_YES);
  s->intersection_set = GNUNET_SETI_create (cfg);
  for (uint32_t i = 0; i < contained_count; i++)
  {
    if (0 == GNUNET_ntohll (elements[i].value))
      continue;
    elem = GNUNET_new (struct GNUNET_SCALARPRODUCT_Element);
    GNUNET_memcpy (elem,
                   &elements[i],
                   sizeof(struct GNUNET_SCALARPRODUCT_Element));
    if (GNUNET_SYSERR ==
        GNUNET_CONTAINER_multihashmap_put (s->intersected_elements,
                                           &elem->key,
                                           elem,
                                           GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
    {
      GNUNET_break (0);
      GNUNET_free (elem);
      continue;
    }
    set_elem.data = &elem->key;
    set_elem.size = sizeof(elem->key);
    set_elem.element_type = 0;
    GNUNET_SETI_add_element (s->intersection_set,
                             &set_elem,
                             NULL, NULL);
    s->used_element_count++;
  }
  GNUNET_SERVICE_client_continue (s->client);
  /* We're ready, open the port */
  s->port = GNUNET_CADET_open_port (my_cadet,
                                    &msg->session_key,
                                    &cb_channel_incoming,
                                    s,
                                    NULL,
                                    &cb_channel_destruction,
                                    cadet_handlers);
  if (NULL == s->port)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (s->client);
    return;
  }
}
 
 
static void
shutdown_task (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Shutting down, initiating cleanup.\n");
  // FIXME: we have to cut our connections to CADET first!
  if (NULL != my_cadet)
  {
    GNUNET_CADET_disconnect (my_cadet);
    my_cadet = NULL;
  }
}
 
 
static void *
client_connect_cb (void *cls,
                   struct GNUNET_SERVICE_Client *client,
                   struct GNUNET_MQ_Handle *mq)
{
  struct BobServiceSession *s;
 
  s = GNUNET_new (struct BobServiceSession);
  s->client = client;
  s->client_mq = mq;
  return s;
}
 
 
static void
client_disconnect_cb (void *cls,
                      struct GNUNET_SERVICE_Client *client,
                      void *app_cls)
{
  struct BobServiceSession *s = app_cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Client disconnected from us.\n");
  s->client = NULL;
  destroy_service_session (s);
}
 
 
static void
run (void *cls,
     const struct GNUNET_CONFIGURATION_Handle *c,
     struct GNUNET_SERVICE_Handle *service)
{
  cfg = c;
  /*
     offset has to be sufficiently small to allow computation of:
     m1+m2 mod n == (S + a) + (S + b) mod n,
     if we have more complex operations, this factor needs to be lowered */
  my_offset = gcry_mpi_new (GNUNET_CRYPTO_PAILLIER_BITS / 3);
  gcry_mpi_set_bit (my_offset,
                    GNUNET_CRYPTO_PAILLIER_BITS / 3);
 
  GNUNET_CRYPTO_paillier_create (&my_pubkey,
                                 &my_privkey);
  my_cadet = GNUNET_CADET_connect (cfg);
  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
                                 NULL);
  if (NULL == my_cadet)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ ("Connect to CADET failed\n"));
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
}
 
 
GNUNET_SERVICE_MAIN
  ("scalarproduct-bob",
  GNUNET_SERVICE_OPTION_NONE,
  &run,
  &client_connect_cb,
  &client_disconnect_cb,
  NULL,
  GNUNET_MQ_hd_var_size (bob_client_message,
                         GNUNET_MESSAGE_TYPE_SCALARPRODUCT_CLIENT_TO_BOB,
                         struct BobComputationMessage,
                         NULL),
  GNUNET_MQ_hd_var_size (bob_client_message_multipart,
                         GNUNET_MESSAGE_TYPE_SCALARPRODUCT_CLIENT_MULTIPART_BOB,
                         struct ComputationBobCryptodataMultipartMessage,
                         NULL),
  GNUNET_MQ_handler_end ());
 
 
/* end of gnunet-service-scalarproduct_bob.c */