The Tor Browser / file comparison
comparison: mobile/android/base/sync/jpake/JPakeCrypto.java
mobile/android/base/sync/jpake/JPakeCrypto.java
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:0cf444334af8 |
|---|---|
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 package org.mozilla.gecko.sync.jpake; | |
| 6 | |
| 7 import java.io.UnsupportedEncodingException; | |
| 8 import java.math.BigInteger; | |
| 9 import java.security.GeneralSecurityException; | |
| 10 import java.security.InvalidKeyException; | |
| 11 import java.security.MessageDigest; | |
| 12 import java.security.NoSuchAlgorithmException; | |
| 13 | |
| 14 import javax.crypto.Mac; | |
| 15 import javax.crypto.spec.SecretKeySpec; | |
| 16 | |
| 17 import org.mozilla.gecko.background.common.log.Logger; | |
| 18 import org.mozilla.gecko.sync.crypto.HKDF; | |
| 19 import org.mozilla.gecko.sync.crypto.KeyBundle; | |
| 20 | |
| 21 public class JPakeCrypto { | |
| 22 private static final String LOG_TAG = "JPakeCrypto"; | |
| 23 | |
| 24 /* | |
| 25 * Primes P and Q, and generator G - from original Mozilla J-PAKE | |
| 26 * implementation. | |
| 27 */ | |
| 28 public static final BigInteger P = new BigInteger( | |
| 29 "90066455B5CFC38F9CAA4A48B4281F292C260FEEF01FD61037E56258A7795A1C" + | |
| 30 "7AD46076982CE6BB956936C6AB4DCFE05E6784586940CA544B9B2140E1EB523F" + | |
| 31 "009D20A7E7880E4E5BFA690F1B9004A27811CD9904AF70420EEFD6EA11EF7DA1" + | |
| 32 "29F58835FF56B89FAA637BC9AC2EFAAB903402229F491D8D3485261CD068699B" + | |
| 33 "6BA58A1DDBBEF6DB51E8FE34E8A78E542D7BA351C21EA8D8F1D29F5D5D159394" + | |
| 34 "87E27F4416B0CA632C59EFD1B1EB66511A5A0FBF615B766C5862D0BD8A3FE7A0" + | |
| 35 "E0DA0FB2FE1FCB19E8F9996A8EA0FCCDE538175238FC8B0EE6F29AF7F642773E" + | |
| 36 "BE8CD5402415A01451A840476B2FCEB0E388D30D4B376C37FE401C2A2C2F941D" + | |
| 37 "AD179C540C1C8CE030D460C4D983BE9AB0B20F69144C1AE13F9383EA1C08504F" + | |
| 38 "B0BF321503EFE43488310DD8DC77EC5B8349B8BFE97C2C560EA878DE87C11E3D" + | |
| 39 "597F1FEA742D73EEC7F37BE43949EF1A0D15C3F3E3FC0A8335617055AC91328E" + | |
| 40 "C22B50FC15B941D3D1624CD88BC25F3E941FDDC6200689581BFEC416B4B2CB73", | |
| 41 16); | |
| 42 | |
| 43 public static final BigInteger Q = new BigInteger( | |
| 44 "CFA0478A54717B08CE64805B76E5B14249A77A4838469DF7F7DC987EFCCFB11D", | |
| 45 16); | |
| 46 | |
| 47 public static final BigInteger G = new BigInteger( | |
| 48 "5E5CBA992E0A680D885EB903AEA78E4A45A469103D448EDE3B7ACCC54D521E37" + | |
| 49 "F84A4BDD5B06B0970CC2D2BBB715F7B82846F9A0C393914C792E6A923E2117AB" + | |
| 50 "805276A975AADB5261D91673EA9AAFFEECBFA6183DFCB5D3B7332AA19275AFA1" + | |
| 51 "F8EC0B60FB6F66CC23AE4870791D5982AAD1AA9485FD8F4A60126FEB2CF05DB8" + | |
| 52 "A7F0F09B3397F3937F2E90B9E5B9C9B6EFEF642BC48351C46FB171B9BFA9EF17" + | |
| 53 "A961CE96C7E7A7CC3D3D03DFAD1078BA21DA425198F07D2481622BCE45969D9C" + | |
| 54 "4D6063D72AB7A0F08B2F49A7CC6AF335E08C4720E31476B67299E231F8BD90B3" + | |
| 55 "9AC3AE3BE0C6B6CACEF8289A2E2873D58E51E029CAFBD55E6841489AB66B5B4B" + | |
| 56 "9BA6E2F784660896AFF387D92844CCB8B69475496DE19DA2E58259B090489AC8" + | |
| 57 "E62363CDF82CFD8EF2A427ABCD65750B506F56DDE3B988567A88126B914D7828" + | |
| 58 "E2B63A6D7ED0747EC59E0E0A23CE7D8A74C1D2C2A7AFB6A29799620F00E11C33" + | |
| 59 "787F7DED3B30E1A22D09F1FBDA1ABBBFBF25CAE05A13F812E34563F99410E73B", | |
| 60 16); | |
| 61 | |
| 62 /** | |
| 63 * | |
| 64 * Round 1 of J-PAKE protocol. | |
| 65 * Generate x1, x2, and ZKP for other party. | |
| 66 */ | |
| 67 public static void round1(JPakeParty jp, JPakeNumGenerator gen) throws NoSuchAlgorithmException, UnsupportedEncodingException { | |
| 68 // Randomly select x1 from [0,q), x2 from [1,q). | |
| 69 BigInteger x1 = gen.generateFromRange(Q); // [0, q) | |
| 70 BigInteger x2 = jp.x2 = BigInteger.ONE.add(gen.generateFromRange(Q | |
| 71 .subtract(BigInteger.ONE))); // [1, q) | |
| 72 | |
| 73 BigInteger gx1 = G.modPow(x1, P); | |
| 74 BigInteger gx2 = G.modPow(x2, P); | |
| 75 | |
| 76 jp.gx1 = gx1; | |
| 77 jp.gx2 = gx2; | |
| 78 | |
| 79 // Generate and store zero knowledge proofs. | |
| 80 jp.zkp1 = createZkp(G, x1, gx1, jp.signerId, gen); | |
| 81 jp.zkp2 = createZkp(G, x2, gx2, jp.signerId, gen); | |
| 82 } | |
| 83 | |
| 84 /** | |
| 85 * Round 2 of J-PAKE protocol. | |
| 86 * Generate A and ZKP for A. | |
| 87 * Verify ZKP from other party. Does not check for replay ZKP. | |
| 88 */ | |
| 89 public static void round2(BigInteger secretValue, JPakeParty jp, JPakeNumGenerator gen) | |
| 90 throws IncorrectZkpException, NoSuchAlgorithmException, | |
| 91 Gx3OrGx4IsZeroOrOneException, UnsupportedEncodingException { | |
| 92 | |
| 93 Logger.debug(LOG_TAG, "round2 started."); | |
| 94 | |
| 95 // checkZkp does some additional checks, but we can throw a more informative exception here. | |
| 96 if (BigInteger.ZERO.compareTo(jp.gx3) == 0 || BigInteger.ONE.compareTo(jp.gx3) == 0 || | |
| 97 BigInteger.ZERO.compareTo(jp.gx4) == 0 || BigInteger.ONE.compareTo(jp.gx4) == 0) { | |
| 98 throw new Gx3OrGx4IsZeroOrOneException(); | |
| 99 } | |
| 100 | |
| 101 // Check ZKP. | |
| 102 checkZkp(G, jp.gx3, jp.zkp3); | |
| 103 checkZkp(G, jp.gx4, jp.zkp4); | |
| 104 | |
| 105 // Compute a = g^[(x1+x3+x4)*(x2*secret)]. | |
| 106 BigInteger y1 = jp.gx3.multiply(jp.gx4).mod(P).multiply(jp.gx1).mod(P); | |
| 107 BigInteger y2 = jp.x2.multiply(secretValue).mod(P); | |
| 108 | |
| 109 BigInteger a = y1.modPow(y2, P); | |
| 110 jp.thisZkpA = createZkp(y1, y2, a, jp.signerId, gen); | |
| 111 jp.thisA = a; | |
| 112 | |
| 113 Logger.debug(LOG_TAG, "round2 finished."); | |
| 114 } | |
| 115 | |
| 116 /** | |
| 117 * Final round of J-PAKE protocol. | |
| 118 */ | |
| 119 public static KeyBundle finalRound(BigInteger secretValue, JPakeParty jp) | |
| 120 throws IncorrectZkpException, NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException { | |
| 121 Logger.debug(LOG_TAG, "Final round started."); | |
| 122 BigInteger gb = jp.gx1.multiply(jp.gx2).mod(P).multiply(jp.gx3) | |
| 123 .mod(P); | |
| 124 checkZkp(gb, jp.otherA, jp.otherZkpA); | |
| 125 | |
| 126 // Calculate shared key g^(x1+x3)*x2*x4*secret, which is equivalent to | |
| 127 // (B/g^(x2*x4*s))^x2 = (B*(g^x4)^x2^s^-1)^2. | |
| 128 BigInteger k = jp.gx4.modPow(jp.x2.multiply(secretValue).negate().mod(Q), P).multiply(jp.otherA) | |
| 129 .modPow(jp.x2, P); | |
| 130 | |
| 131 byte[] enc = new byte[32]; | |
| 132 byte[] hmac = new byte[32]; | |
| 133 generateKeyAndHmac(k, enc, hmac); | |
| 134 | |
| 135 Logger.debug(LOG_TAG, "Final round finished; returning key."); | |
| 136 return new KeyBundle(enc, hmac); | |
| 137 } | |
| 138 | |
| 139 // TODO Replace this function with the one in the crypto library | |
| 140 private static byte[] HMACSHA256(byte[] data, byte[] key) { | |
| 141 byte[] result = null; | |
| 142 try { | |
| 143 Mac hmacSha256; | |
| 144 hmacSha256 = Mac.getInstance("HmacSHA256"); | |
| 145 SecretKeySpec secret_key = new SecretKeySpec(key, "HmacSHA256"); | |
| 146 hmacSha256.init(secret_key); | |
| 147 result = hmacSha256.doFinal(data); | |
| 148 } catch (GeneralSecurityException e) { | |
| 149 Logger.error(LOG_TAG, "Got exception calculating HMAC.", e); | |
| 150 } | |
| 151 return result; | |
| 152 } | |
| 153 | |
| 154 /* Helper Methods */ | |
| 155 | |
| 156 /* | |
| 157 * Generate the ZKP b = r - x*h, and g^r, where h = hash(g, g^r, g^x, id). (We | |
| 158 * pass in gx to save on an exponentiation of g^x) | |
| 159 */ | |
| 160 private static Zkp createZkp(BigInteger g, BigInteger x, BigInteger gx, | |
| 161 String id, JPakeNumGenerator gen) throws NoSuchAlgorithmException, UnsupportedEncodingException { | |
| 162 // Generate random r for exponent. | |
| 163 BigInteger r = gen.generateFromRange(Q); | |
| 164 | |
| 165 // Calculate g^r for ZKP. | |
| 166 BigInteger gr = g.modPow(r, P); | |
| 167 | |
| 168 // Calculate the ZKP b value = (r-x*h) % q. | |
| 169 BigInteger h = computeBHash(g, gr, gx, id); | |
| 170 Logger.debug(LOG_TAG, "myhash: " + h.toString(16)); | |
| 171 | |
| 172 // ZKP value = b = r-x*h | |
| 173 BigInteger b = r.subtract(x.multiply(h)).mod(Q); | |
| 174 | |
| 175 return new Zkp(gr, b, id); | |
| 176 } | |
| 177 | |
| 178 /* | |
| 179 * Verify ZKP. | |
| 180 */ | |
| 181 private static void checkZkp(BigInteger g, BigInteger gx, Zkp zkp) | |
| 182 throws IncorrectZkpException, NoSuchAlgorithmException, UnsupportedEncodingException { | |
| 183 | |
| 184 BigInteger h = computeBHash(g, zkp.gr, gx, zkp.id); | |
| 185 | |
| 186 // Check parameters of zkp, and compare to computed hash. These shouldn't | |
| 187 // fail. | |
| 188 if (gx.compareTo(BigInteger.ONE) < 1) { // g^x > 1. | |
| 189 Logger.error(LOG_TAG, "g^x > 1 fails."); | |
| 190 throw new IncorrectZkpException(); | |
| 191 } | |
| 192 if (gx.compareTo(P.subtract(BigInteger.ONE)) > -1) { // g^x < p-1 | |
| 193 Logger.error(LOG_TAG, "g^x < p-1 fails."); | |
| 194 throw new IncorrectZkpException(); | |
| 195 } | |
| 196 if (gx.modPow(Q, P).compareTo(BigInteger.ONE) != 0) { | |
| 197 Logger.error(LOG_TAG, "g^x^q % p = 1 fails."); | |
| 198 throw new IncorrectZkpException(); | |
| 199 } | |
| 200 if (zkp.gr.compareTo(g.modPow(zkp.b, P).multiply(gx.modPow(h, P)).mod(P)) != 0) { | |
| 201 // b = r-h*x ==> g^r = g^b*g^x^(h) | |
| 202 Logger.debug(LOG_TAG, "gb*g(xh) = " + g.modPow(zkp.b, P).multiply(gx.modPow(h, P)).mod(P).toString(16)); | |
| 203 Logger.debug(LOG_TAG, "gr = " + zkp.gr.toString(16)); | |
| 204 Logger.debug(LOG_TAG, "b = " + zkp.b.toString(16)); | |
| 205 Logger.debug(LOG_TAG, "g^b = " + g.modPow(zkp.b, P).toString(16)); | |
| 206 Logger.debug(LOG_TAG, "g^(xh) = " + gx.modPow(h, P).toString(16)); | |
| 207 Logger.debug(LOG_TAG, "gx = " + gx.toString(16)); | |
| 208 Logger.debug(LOG_TAG, "h = " + h.toString(16)); | |
| 209 Logger.error(LOG_TAG, "zkp calculation incorrect."); | |
| 210 throw new IncorrectZkpException(); | |
| 211 } | |
| 212 Logger.debug(LOG_TAG, "*** ZKP SUCCESS ***"); | |
| 213 } | |
| 214 | |
| 215 /* | |
| 216 * Use SHA-256 to compute a BigInteger hash of g, gr, gx values with | |
| 217 * mySignerId to prevent replay. Does not make a twos-complement BigInteger | |
| 218 * form hash. | |
| 219 */ | |
| 220 private static BigInteger computeBHash(BigInteger g, BigInteger gr, BigInteger gx, | |
| 221 String id) throws NoSuchAlgorithmException, UnsupportedEncodingException { | |
| 222 MessageDigest sha = MessageDigest.getInstance("SHA-256"); | |
| 223 sha.reset(); | |
| 224 | |
| 225 /* | |
| 226 * Note: you should ensure the items in H(...) have clear boundaries. It | |
| 227 * is simple if the other party knows sizes of g, gr, gx and signerID and | |
| 228 * hence the boundary is unambiguous. If not, you'd better prepend each | |
| 229 * item with its byte length, but I've omitted that here. | |
| 230 */ | |
| 231 | |
| 232 hashByteArrayWithLength(sha, BigIntegerHelper.BigIntegerToByteArrayWithoutSign(g)); | |
| 233 hashByteArrayWithLength(sha, BigIntegerHelper.BigIntegerToByteArrayWithoutSign(gr)); | |
| 234 hashByteArrayWithLength(sha, BigIntegerHelper.BigIntegerToByteArrayWithoutSign(gx)); | |
| 235 hashByteArrayWithLength(sha, id.getBytes("UTF-8")); | |
| 236 | |
| 237 byte[] hash = sha.digest(); | |
| 238 | |
| 239 return BigIntegerHelper.ByteArrayToBigIntegerWithoutSign(hash); | |
| 240 } | |
| 241 | |
| 242 /* | |
| 243 * Update a hash with a byte array's length and the byte array. | |
| 244 */ | |
| 245 private static void hashByteArrayWithLength(MessageDigest sha, byte[] data) { | |
| 246 int length = data.length; | |
| 247 byte[] b = new byte[] { (byte) (length >>> 8), (byte) (length & 0xff) }; | |
| 248 sha.update(b); | |
| 249 sha.update(data); | |
| 250 } | |
| 251 | |
| 252 /* | |
| 253 * Helper function to generate encryption key and HMAC from a byte array. | |
| 254 */ | |
| 255 public static void generateKeyAndHmac(BigInteger k, byte[] encOut, byte[] hmacOut) throws NoSuchAlgorithmException, InvalidKeyException { | |
| 256 // Generate HMAC and Encryption keys from synckey. | |
| 257 byte[] zerokey = new byte[32]; | |
| 258 byte[] prk = HMACSHA256(BigIntegerHelper.BigIntegerToByteArrayWithoutSign(k), zerokey); | |
| 259 | |
| 260 byte[] okm = HKDF.hkdfExpand(prk, HKDF.HMAC_INPUT, 32 * 2); | |
| 261 System.arraycopy(okm, 0, encOut, 0, 32); | |
| 262 System.arraycopy(okm, 32, hmacOut, 0, 32); | |
| 263 } | |
| 264 } |
