crypto_rsa.c File Reference

Chaum-style Blind signatures based on RSA. More...

#include "platform.h"
#include <gcrypt.h>
#include "gnunet_crypto_lib.h"
#include "benchmark.h"

Include dependency graph for crypto_rsa.c:

Go to the source code of this file.

Data Structures
struct	GNUNET_CRYPTO_RsaPrivateKey
	The private information of an RSA key pair. More...
struct	GNUNET_CRYPTO_RsaPublicKey
	The public information of an RSA key pair. More...
struct	GNUNET_CRYPTO_RsaSignature
	an RSA signature More...
struct	RsaBlindingKey
	RSA blinding key. More...
struct	GNUNET_CRYPTO_RsaPublicKeyHeaderP
	Format of the header of a serialized RSA public key. More...

Macros
#define	LOG(kind, ...)   GNUNET_log_from (kind, "util-crypto-rsa", __VA_ARGS__)

Functions
static int	key_from_sexp (gcry_mpi_t *array, gcry_sexp_t sexp, const char *topname, const char *elems)
	Extract values from an S-expression. More...
struct GNUNET_CRYPTO_RsaPrivateKey *	GNUNET_CRYPTO_rsa_private_key_create (unsigned int len)
	Create a new private key. More...
void	GNUNET_CRYPTO_rsa_private_key_free (struct GNUNET_CRYPTO_RsaPrivateKey *key)
	Free memory occupied by the private key. More...
size_t	GNUNET_CRYPTO_rsa_private_key_encode (const struct GNUNET_CRYPTO_RsaPrivateKey *key, void **buffer)
	Encode the private key in a format suitable for storing it into a file. More...
struct GNUNET_CRYPTO_RsaPrivateKey *	GNUNET_CRYPTO_rsa_private_key_decode (const void *buf, size_t buf_size)
	Decode the private key from the data-format back to the "normal", internal format. More...
struct GNUNET_CRYPTO_RsaPublicKey *	GNUNET_CRYPTO_rsa_private_key_get_public (const struct GNUNET_CRYPTO_RsaPrivateKey *priv)
	Extract the public key of the given private key. More...
void	GNUNET_CRYPTO_rsa_public_key_free (struct GNUNET_CRYPTO_RsaPublicKey *key)
	Free memory occupied by the public key. More...
GNUNET_NETWORK_STRUCT_END bool	GNUNET_CRYPTO_rsa_public_key_check (const struct GNUNET_CRYPTO_RsaPublicKey *key)
	Check if key is well-formed. More...
size_t	GNUNET_CRYPTO_rsa_public_key_encode (const struct GNUNET_CRYPTO_RsaPublicKey *key, void **buffer)
	Encode the public key in a format suitable for storing it into a file. More...
void	GNUNET_CRYPTO_rsa_public_key_hash (const struct GNUNET_CRYPTO_RsaPublicKey *key, struct GNUNET_HashCode *hc)
	Compute hash over the public key. More...
struct GNUNET_CRYPTO_RsaPublicKey *	GNUNET_CRYPTO_rsa_public_key_decode (const char *buf, size_t len)
	Decode the public key from the data-format back to the "normal", internal format. More...
static int	rsa_gcd_validate (gcry_mpi_t r, gcry_mpi_t n)
	Test for malicious RSA key. More...
static struct RsaBlindingKey *	rsa_blinding_key_derive (const struct GNUNET_CRYPTO_RsaPublicKey *pkey, const struct GNUNET_CRYPTO_RsaBlindingKeySecret *bks)
	Create a blinding key. More...
int	GNUNET_CRYPTO_rsa_signature_cmp (const struct GNUNET_CRYPTO_RsaSignature *s1, const struct GNUNET_CRYPTO_RsaSignature *s2)
	Compare the values of two signatures. More...
int	GNUNET_CRYPTO_rsa_public_key_cmp (const struct GNUNET_CRYPTO_RsaPublicKey *p1, const struct GNUNET_CRYPTO_RsaPublicKey *p2)
	Compare the values of two public keys. More...
int	GNUNET_CRYPTO_rsa_private_key_cmp (const struct GNUNET_CRYPTO_RsaPrivateKey *p1, const struct GNUNET_CRYPTO_RsaPrivateKey *p2)
	Compare the values of two private keys. More...
unsigned int	GNUNET_CRYPTO_rsa_public_key_len (const struct GNUNET_CRYPTO_RsaPublicKey *key)
	Obtain the length of the RSA key in bits. More...
static void	rsa_blinding_key_free (struct RsaBlindingKey *bkey)
	Destroy a blinding key. More...
static size_t	numeric_mpi_alloc_n_print (gcry_mpi_t v, char **buffer)
	Print an MPI to a newly created buffer. More...
static gcry_mpi_t	rsa_full_domain_hash (const struct GNUNET_CRYPTO_RsaPublicKey *pkey, const struct GNUNET_HashCode *hash)
	Computes a full domain hash seeded by the given public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_rsa_blind (const struct GNUNET_HashCode *hash, const struct GNUNET_CRYPTO_RsaBlindingKeySecret *bks, struct GNUNET_CRYPTO_RsaPublicKey *pkey, void **buf, size_t *buf_size)
	Blinds the given message with the given blinding key. More...
static gcry_sexp_t	mpi_to_sexp (gcry_mpi_t value)
	Convert an MPI to an S-expression suitable for signature operations. More...
static struct GNUNET_CRYPTO_RsaSignature *	rsa_sign_mpi (const struct GNUNET_CRYPTO_RsaPrivateKey *key, gcry_mpi_t value)
	Sign the given MPI. More...
struct GNUNET_CRYPTO_RsaSignature *	GNUNET_CRYPTO_rsa_sign_blinded (const struct GNUNET_CRYPTO_RsaPrivateKey *key, const void *msg, size_t msg_len)
	Sign a blinded value, which must be a full domain hash of a message. More...
struct GNUNET_CRYPTO_RsaSignature *	GNUNET_CRYPTO_rsa_sign_fdh (const struct GNUNET_CRYPTO_RsaPrivateKey *key, const struct GNUNET_HashCode *hash)
	Create and sign a full domain hash of a message. More...
void	GNUNET_CRYPTO_rsa_signature_free (struct GNUNET_CRYPTO_RsaSignature *sig)
	Free memory occupied by signature. More...
size_t	GNUNET_CRYPTO_rsa_signature_encode (const struct GNUNET_CRYPTO_RsaSignature *sig, void **buffer)
	Encode the given signature in a format suitable for storing it into a file. More...
struct GNUNET_CRYPTO_RsaSignature *	GNUNET_CRYPTO_rsa_signature_decode (const void *buf, size_t buf_size)
	Decode the signature from the data-format back to the "normal", internal format. More...
struct GNUNET_CRYPTO_RsaPublicKey *	GNUNET_CRYPTO_rsa_public_key_dup (const struct GNUNET_CRYPTO_RsaPublicKey *key)
	Duplicate the given public key. More...
struct GNUNET_CRYPTO_RsaSignature *	GNUNET_CRYPTO_rsa_unblind (const struct GNUNET_CRYPTO_RsaSignature *sig, const struct GNUNET_CRYPTO_RsaBlindingKeySecret *bks, struct GNUNET_CRYPTO_RsaPublicKey *pkey)
	Unblind a blind-signed signature. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_rsa_verify (const struct GNUNET_HashCode *hash, const struct GNUNET_CRYPTO_RsaSignature *sig, const struct GNUNET_CRYPTO_RsaPublicKey *pkey)
	Verify whether the given hash corresponds to the given signature and the signature is valid with respect to the given public key. More...
struct GNUNET_CRYPTO_RsaPrivateKey *	GNUNET_CRYPTO_rsa_private_key_dup (const struct GNUNET_CRYPTO_RsaPrivateKey *key)
	Duplicate the given private key. More...
struct GNUNET_CRYPTO_RsaSignature *	GNUNET_CRYPTO_rsa_signature_dup (const struct GNUNET_CRYPTO_RsaSignature *sig)
	Duplicate the given rsa signature. More...

Detailed Description

Chaum-style Blind signatures based on RSA.

Author

Sree Harsha Totakura sreeh.nosp@m.arsh.nosp@m.a@tot.nosp@m.akur.nosp@m.a.in

Christian Grothoff

Jeffrey Burdges burdg.nosp@m.es@g.nosp@m.nunet.nosp@m..org

Definition in file crypto_rsa.c.

Macro Definition Documentation

LOG

#define LOG	(		kind,
			...
	)		GNUNET_log_from (kind, "util-crypto-rsa", __VA_ARGS__)

Definition at line 33 of file crypto_rsa.c.

Function Documentation

key_from_sexp()

static int key_from_sexp ( gcry_mpi_t *  array, gcry_sexp_t  sexp, const char *  topname, const char *  elems  )

static

Extract values from an S-expression.

Parameters

array	where to store the result(s)
sexp	S-expression to parse
topname	top-level name in the S-expression that is of interest
elems	names of the elements to extract

Returns

0 on success

Definition at line 94 of file crypto_rsa.c.

{
  gcry_sexp_t list;
  gcry_sexp_t l2;
  const char *s;
  unsigned int idx;
 
  if (! (list = gcry_sexp_find_token (sexp, topname, 0)))
    return 1;
  l2 = gcry_sexp_cadr (list);
  gcry_sexp_release (list);
  list = l2;
  if (! list)
    return 2;
  idx = 0;
  for (s = elems; *s; s++, idx++)
  {
    if (! (l2 = gcry_sexp_find_token (list, s, 1)))
    {
      for (unsigned int i = 0; i < idx; i++)
      {
        gcry_free (array[i]);
        array[i] = NULL;
      }
      gcry_sexp_release (list);
      return 3;                 /* required parameter not found */
    }
    array[idx] = gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG);
    gcry_sexp_release (l2);
    if (! array[idx])
    {
      for (unsigned int i = 0; i < idx; i++)
      {
        gcry_free (array[i]);
        array[i] = NULL;
      }
      gcry_sexp_release (list);
      return 4;                 /* required parameter is invalid */
    }
  }
  gcry_sexp_release (list);
  return 0;
}

References list.

Referenced by GNUNET_CRYPTO_rsa_blind(), GNUNET_CRYPTO_rsa_private_key_get_public(), GNUNET_CRYPTO_rsa_public_key_check(), GNUNET_CRYPTO_rsa_public_key_encode(), GNUNET_CRYPTO_rsa_public_key_len(), GNUNET_CRYPTO_rsa_signature_dup(), GNUNET_CRYPTO_rsa_signature_encode(), GNUNET_CRYPTO_rsa_unblind(), and rsa_blinding_key_derive().

Here is the caller graph for this function:

rsa_gcd_validate()

static int rsa_gcd_validate ( gcry_mpi_t  r, gcry_mpi_t  n  )

static

Test for malicious RSA key.

Assuming n is an RSA modulous and r is generated using a call to GNUNET_CRYPTO_kdf_mod_mpi, if gcd(r,n) != 1 then n must be a malicious RSA key designed to deanomize the user.

Parameters

r	KDF result
n	RSA modulus

Returns

True if gcd(r,n) = 1, False means RSA key is malicious

Definition at line 500 of file crypto_rsa.c.

{
  gcry_mpi_t g;
  int t;
 
  g = gcry_mpi_new (0);
  t = gcry_mpi_gcd (g, r, n);
  gcry_mpi_release (g);
  return t;
}

References t.

Referenced by GNUNET_CRYPTO_rsa_blind(), and rsa_blinding_key_derive().

Here is the caller graph for this function:

rsa_blinding_key_derive()

static struct RsaBlindingKey* rsa_blinding_key_derive ( const struct GNUNET_CRYPTO_RsaPublicKey *  pkey, const struct GNUNET_CRYPTO_RsaBlindingKeySecret *  bks  )

static

Create a blinding key.

Parameters

len	length of the key in bits (e.g. 2048)
bks	pre-secret to use to derive the blinding key

Returns

the newly created blinding key, NULL if RSA key is malicious

Definition at line 521 of file crypto_rsa.c.

{
  const char *xts = "Blinding KDF extractor HMAC key";  /* Trusts bks' randomness more */
  struct RsaBlindingKey *blind;
  gcry_mpi_t n;
 
  blind = GNUNET_new (struct RsaBlindingKey);
 
  /* Extract the composite n from the RSA public key */
  GNUNET_assert (0 ==
                 key_from_sexp (&n,
                                pkey->sexp,
                                "rsa",
                                "n"));
  /* Assert that it at least looks like an RSA key */
  GNUNET_assert (0 ==
                 gcry_mpi_get_flag (n,
                                    GCRYMPI_FLAG_OPAQUE));
  GNUNET_CRYPTO_kdf_mod_mpi (&blind->r,
                             n,
                             xts, strlen (xts),
                             bks, sizeof(*bks),
                             "Blinding KDF");
  if (0 == rsa_gcd_validate (blind->r,
                             n))
  {
    gcry_mpi_release (blind->r);
    GNUNET_free (blind);
    blind = NULL;
  }
  gcry_mpi_release (n);
  return blind;
}

References GNUNET_assert, GNUNET_CRYPTO_kdf_mod_mpi(), GNUNET_free, GNUNET_new, key_from_sexp(), pkey, RsaBlindingKey::r, and rsa_gcd_validate().

Referenced by GNUNET_CRYPTO_rsa_unblind().

Here is the call graph for this function:

Here is the caller graph for this function:

rsa_blinding_key_free()

static void rsa_blinding_key_free ( struct RsaBlindingKey *  bkey )

static

Destroy a blinding key.

Parameters

bkey	the blinding key to destroy

Definition at line 701 of file crypto_rsa.c.

{
  gcry_mpi_release (bkey->r);
  GNUNET_free (bkey);
}

References GNUNET_free, and RsaBlindingKey::r.

Referenced by GNUNET_CRYPTO_rsa_unblind().

Here is the caller graph for this function:

numeric_mpi_alloc_n_print()

static size_t numeric_mpi_alloc_n_print ( gcry_mpi_t  v, char **  buffer  )

static

Print an MPI to a newly created buffer.

Parameters

	v	MPI to print.
[out]	newly	allocated buffer containing the result

Returns

number of bytes stored in buffer

Definition at line 716 of file crypto_rsa.c.

{
  size_t n;
  char *b;
  size_t rsize;
 
  gcry_mpi_print (GCRYMPI_FMT_USG,
                  NULL,
                  0,
                  &n,
                  v);
  b = GNUNET_malloc (n);
  GNUNET_assert (0 ==
                 gcry_mpi_print (GCRYMPI_FMT_USG,
                                 (unsigned char *) b,
                                 n,
                                 &rsize,
                                 v));
  *buffer = b;
  return n;
}

References GNUNET_assert, and GNUNET_malloc.

rsa_full_domain_hash()

static gcry_mpi_t rsa_full_domain_hash ( const struct GNUNET_CRYPTO_RsaPublicKey *  pkey, const struct GNUNET_HashCode *  hash  )

static

Computes a full domain hash seeded by the given public key.

This gives a measure of provable security to the Taler exchange against one-more forgery attacks. See: https://eprint.iacr.org/2001/002.pdf http://www.di.ens.fr/~pointche/Documents/Papers/2001_fcA.pdf

Parameters

hash	initial hash of the message to sign
pkey	the public key of the signer
rsize	If not NULL, the number of bytes actually stored in buffer

Returns

MPI value set to the FDH, NULL if RSA key is malicious

Definition at line 753 of file crypto_rsa.c.

{
  gcry_mpi_t r, n;
  void *xts;
  size_t xts_len;
  int ok;
 
  /* Extract the composite n from the RSA public key */
  GNUNET_assert (0 == key_from_sexp (&n, pkey->sexp, "rsa", "n"));
  /* Assert that it at least looks like an RSA key */
  GNUNET_assert (0 == gcry_mpi_get_flag (n, GCRYMPI_FLAG_OPAQUE));
 
  /* We key with the public denomination key as a homage to RSA-PSS by  *
  * Mihir Bellare and Phillip Rogaway.  Doing this lowers the degree   *
  * of the hypothetical polyomial-time attack on RSA-KTI created by a  *
  * polynomial-time one-more forgary attack.  Yey seeding!       */
  xts_len = GNUNET_CRYPTO_rsa_public_key_encode (pkey,
                                                 &xts);
 
  GNUNET_CRYPTO_kdf_mod_mpi (&r,
                             n,
                             xts, xts_len,
                             hash, sizeof(*hash),
                             "RSA-FDA FTpsW!");
  GNUNET_free (xts);
  ok = rsa_gcd_validate (r, n);
  gcry_mpi_release (n);
  if (ok)
    return r;
  gcry_mpi_release (r);
  return NULL;
}

Referenced by GNUNET_CRYPTO_rsa_sign_fdh().

Here is the caller graph for this function:

mpi_to_sexp()

static gcry_sexp_t mpi_to_sexp ( gcry_mpi_t  value )

static

Convert an MPI to an S-expression suitable for signature operations.

Parameters

value

pointer to the data to convert

Returns

converted s-expression

Definition at line 870 of file crypto_rsa.c.

{
  gcry_sexp_t data = NULL;
 
  GNUNET_assert (0 ==
                 gcry_sexp_build (&data,
                                  NULL,
                                  "(data (flags raw) (value %M))",
                                  value));
  return data;
}

References data, GNUNET_assert, and value.

Referenced by rsa_sign_mpi().

Here is the caller graph for this function:

rsa_sign_mpi()

static struct GNUNET_CRYPTO_RsaSignature* rsa_sign_mpi ( const struct GNUNET_CRYPTO_RsaPrivateKey *  key, gcry_mpi_t  value  )

static

Sign the given MPI.

Parameters

key	private key to use for the signing
value	the MPI to sign

Returns

NULL on error, signature on success

Definition at line 891 of file crypto_rsa.c.

{
  struct GNUNET_CRYPTO_RsaSignature *sig;
  gcry_sexp_t data;
  gcry_sexp_t result;
  int rc;
 
  data = mpi_to_sexp (value);
 
  if (0 !=
      (rc = gcry_pk_sign (&result,
                          data,
                          key->sexp)))
  {
    LOG (GNUNET_ERROR_TYPE_WARNING,
         _ ("RSA signing failed at %s:%d: %s\n"),
         __FILE__,
         __LINE__,
         gcry_strerror (rc));
    gcry_sexp_release (data);
    GNUNET_break (0);
    return NULL;
  }
 
  /* Lenstra protection was first added to libgcrypt 1.6.4
   * with commit c17f84bd02d7ee93845e92e20f6ddba814961588.
   */
#if GCRYPT_VERSION_NUMBER < 0x010604
  /* verify signature (guards against Lenstra's attack with fault injection...) */
  struct GNUNET_CRYPTO_RsaPublicKey *public_key =
    GNUNET_CRYPTO_rsa_private_key_get_public (key);
  if (0 !=
      gcry_pk_verify (result,
                      data,
                      public_key->sexp))
  {
    GNUNET_break (0);
    GNUNET_CRYPTO_rsa_public_key_free (public_key);
    gcry_sexp_release (data);
    gcry_sexp_release (result);
    return NULL;
  }
  GNUNET_CRYPTO_rsa_public_key_free (public_key);
#endif
 
  /* return signature */
  gcry_sexp_release (data);
  sig = GNUNET_new (struct GNUNET_CRYPTO_RsaSignature);
  sig->sexp = result;
  return sig;
}

References _, data, GNUNET_break, GNUNET_CRYPTO_rsa_private_key_get_public(), GNUNET_CRYPTO_rsa_public_key_free(), GNUNET_ERROR_TYPE_WARNING, GNUNET_new, key, LOG, mpi_to_sexp(), result, GNUNET_CRYPTO_RsaPublicKey::sexp, GNUNET_CRYPTO_RsaSignature::sexp, and value.

Referenced by GNUNET_CRYPTO_rsa_sign_blinded(), and GNUNET_CRYPTO_rsa_sign_fdh().

Here is the call graph for this function:

Here is the caller graph for this function: