Skip to content

Commit 1c03754

Browse files
dghgitdghgit
committed
Merge branch 'main' into 1958-aead-parameters
# Conflicts: # core/src/test/java/org/bouncycastle/crypto/test/CipherTest.java
2 parents 0ea0a5e + b4fbdac commit 1c03754

File tree

55 files changed

+1055
-873
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1055
-873
lines changed

‎core/src/main/java/org/bouncycastle/crypto/agreement/ecjpake/ECJPAKECurve.java‎

Lines changed: 79 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,6 @@
1919
public class ECJPAKECurve
2020
{
2121
private final ECCurve.Fp curve;
22-
private final BigInteger a;
23-
private final BigInteger b;
24-
private final BigInteger q;
25-
private final BigInteger h;
26-
private final BigInteger n;
2722
private final ECPoint g;
2823

2924
/**
@@ -54,116 +49,123 @@ public class ECJPAKECurve
5449
* @throws NullPointerException if any argument is null
5550
* @throws IllegalArgumentException if any of the above validations fail
5651
*/
57-
public ECJPAKECurve(BigInteger a, BigInteger b, BigInteger q, BigInteger h, BigInteger n, ECPoint g, ECCurve.Fp curve)
52+
public ECJPAKECurve(BigInteger q, BigInteger a, BigInteger b, BigInteger n, BigInteger h, BigInteger g_x, BigInteger g_y)
5853
{
54+
ECJPAKEUtil.validateNotNull(a, "a");
55+
ECJPAKEUtil.validateNotNull(b, "b");
56+
ECJPAKEUtil.validateNotNull(q, "q");
57+
ECJPAKEUtil.validateNotNull(n, "n");
58+
ECJPAKEUtil.validateNotNull(h, "h");
59+
ECJPAKEUtil.validateNotNull(g_x, "g_x");
60+
ECJPAKEUtil.validateNotNull(g_y, "g_y");
61+
5962
/*
6063
* Don't skip the checks on user-specified groups.
6164
*/
62-
this(a, b, q, h, n, g, curve, false);
65+
66+
/*
67+
* Note that these checks do not guarantee that n and q are prime.
68+
* We just have reasonable certainty that they are prime.
69+
*/
70+
if (!q.isProbablePrime(20))
71+
{
72+
throw new IllegalArgumentException("Field size q must be prime");
73+
}
74+
75+
if (a.compareTo(BigInteger.ZERO) < 0 || a.compareTo(q) >= 0)
76+
{
77+
throw new IllegalArgumentException("The parameter 'a' is not in the field [0, q-1]");
78+
}
79+
80+
if (b.compareTo(BigInteger.ZERO) < 0 || b.compareTo(q) >= 0)
81+
{
82+
throw new IllegalArgumentException("The parameter 'b' is not in the field [0, q-1]");
83+
}
84+
85+
BigInteger d = calculateDeterminant(q, a, b);
86+
if (d.equals(BigInteger.ZERO))
87+
{
88+
throw new IllegalArgumentException("The curve is singular, i.e the discriminant is equal to 0 mod q.");
89+
}
90+
91+
if (!n.isProbablePrime(20))
92+
{
93+
throw new IllegalArgumentException("The order n must be prime");
94+
}
95+
96+
/*
97+
* TODO It's expensive to calculate the actual total number of points. Probably the best that could be done is
98+
* checking that the point count is within the Hasse bound?
99+
*/
100+
// BigInteger totalPoints = n.multiply(h);
101+
102+
ECCurve.Fp curve = new ECCurve.Fp(q, a, b, n, h);
103+
ECPoint g = curve.createPoint(g_x, g_y);
104+
105+
if (!g.isValid())
106+
{
107+
throw new IllegalArgumentException("The base point G does not lie on the curve.");
108+
}
109+
110+
this.curve = curve;
111+
this.g = g;
63112
}
64113

65114
/**
66115
* Internal package-private constructor used by the pre-approved
67116
* groups in {@link ECJPAKECurves}.
68117
* These pre-approved curves can avoid the expensive checks.
69118
*/
70-
ECJPAKECurve(BigInteger a, BigInteger b, BigInteger q, BigInteger h, BigInteger n, ECPoint g, ECCurve.Fp curve, boolean skipChecks)
119+
ECJPAKECurve(ECCurve.Fp curve, ECPoint g)
71120
{
72-
ECJPAKEUtil.validateNotNull(a, "a");
73-
ECJPAKEUtil.validateNotNull(b, "b");
74-
ECJPAKEUtil.validateNotNull(q, "q");
75-
ECJPAKEUtil.validateNotNull(h, "h");
76-
ECJPAKEUtil.validateNotNull(n, "n");
77-
ECJPAKEUtil.validateNotNull(g, "g");
78121
ECJPAKEUtil.validateNotNull(curve, "curve");
122+
ECJPAKEUtil.validateNotNull(g, "g");
123+
ECJPAKEUtil.validateNotNull(curve.getOrder(), "n");
124+
ECJPAKEUtil.validateNotNull(curve.getCofactor(), "h");
79125

80-
if (!skipChecks)
81-
{
126+
this.curve = curve;
127+
this.g = g;
128+
}
82129

83-
/*
84-
* Note that these checks do not guarantee that n and q are prime.
85-
* We just have reasonable certainty that they are prime.
86-
*/
87-
if (!q.isProbablePrime(20))
88-
{
89-
throw new IllegalArgumentException("Field size q must be prime");
90-
}
91-
92-
if (!n.isProbablePrime(20))
93-
{
94-
throw new IllegalArgumentException("The order n must be prime");
95-
}
96-
97-
if ((a.pow(3).multiply(BigInteger.valueOf(4)).add(b.pow(2).multiply(BigInteger.valueOf(27))).mod(q)) == BigInteger.valueOf(0))
98-
{
99-
throw new IllegalArgumentException("The curve is singular, i.e the discriminant is equal to 0 mod q.");
100-
}
101-
102-
if (!g.isValid())
103-
{
104-
throw new IllegalArgumentException("The base point G does not lie on the curve.");
105-
}
106-
107-
BigInteger totalPoints = n.multiply(h);
108-
if (!totalPoints.equals(curve.getOrder()))
109-
{
110-
throw new IllegalArgumentException("n is not equal to the order of your curve");
111-
}
112-
113-
if (a.compareTo(BigInteger.ZERO) == -1 || a.compareTo(q.subtract(BigInteger.ONE)) == 1)
114-
{
115-
throw new IllegalArgumentException("The parameter 'a' is not in the field [0, q-1]");
116-
}
117-
118-
if (b.compareTo(BigInteger.ZERO) == -1 || b.compareTo(q.subtract(BigInteger.ONE)) == 1)
119-
{
120-
throw new IllegalArgumentException("The parameter 'b' is not in the field [0, q-1]");
121-
}
122-
}
130+
public ECCurve.Fp getCurve()
131+
{
132+
return curve;
133+
}
123134

124-
this.a = a;
125-
this.b = b;
126-
this.h = h;
127-
this.n = n;
128-
this.q = q;
129-
this.g = g;
130-
this.curve = curve;
135+
public ECPoint getG()
136+
{
137+
return g;
131138
}
132139

133140
public BigInteger getA()
134141
{
135-
return a;
142+
return curve.getA().toBigInteger();
136143
}
137144

138145
public BigInteger getB()
139146
{
140-
return b;
147+
return curve.getB().toBigInteger();
141148
}
142149

143150
public BigInteger getN()
144151
{
145-
return n;
152+
return curve.getOrder();
146153
}
147154

148155
public BigInteger getH()
149156
{
150-
return h;
157+
return curve.getCofactor();
151158
}
152159

153160
public BigInteger getQ()
154161
{
155-
return q;
162+
return curve.getQ();
156163
}
157164

158-
public ECPoint getG()
165+
private static BigInteger calculateDeterminant(BigInteger q, BigInteger a, BigInteger b)
159166
{
160-
return g;
167+
BigInteger a3x4 = a.multiply(a).mod(q).multiply(a).mod(q).shiftLeft(2);
168+
BigInteger b2x27 = b.multiply(b).mod(q).multiply(BigInteger.valueOf(27));
169+
return a3x4.add(b2x27).mod(q);
161170
}
162-
163-
public ECCurve.Fp getCurve()
164-
{
165-
return curve;
166-
}
167-
168-
169171
}

‎core/src/main/java/org/bouncycastle/crypto/agreement/ecjpake/ECJPAKECurves.java‎

Lines changed: 10 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
package org.bouncycastle.crypto.agreement.ecjpake;
22

3-
import java.math.BigInteger;
4-
3+
import org.bouncycastle.asn1.nist.NISTNamedCurves;
4+
import org.bouncycastle.asn1.x9.X9ECParameters;
55
import org.bouncycastle.math.ec.ECCurve;
6-
import org.bouncycastle.math.ec.ECPoint;
76

87
/**
98
* Standard pre-computed elliptic curves for use by EC J-PAKE.
@@ -18,87 +17,33 @@
1817
*/
1918
public class ECJPAKECurves
2019
{
21-
2220
/**
2321
* From NIST.
2422
* 128-bit security.
2523
*/
2624
public static final ECJPAKECurve NIST_P256;
2725

28-
static
29-
{
30-
//a
31-
BigInteger a_p256 = new BigInteger("ffffffff00000001000000000000000000000000fffffffffffffffffffffffc", 16);
32-
//b
33-
BigInteger b_p256 = new BigInteger("5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b", 16);
34-
//q
35-
BigInteger q_p256 = new BigInteger("ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", 16);
36-
//h
37-
BigInteger h_p256 = BigInteger.ONE;
38-
//n
39-
BigInteger n_p256 = new BigInteger("ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", 16);
40-
//g
41-
ECCurve.Fp curve_p256 = new ECCurve.Fp(q_p256, a_p256, b_p256, n_p256, h_p256);
42-
ECPoint g_p256 = curve_p256.createPoint(
43-
new BigInteger("6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296", 16),
44-
new BigInteger("4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5", 16));
45-
46-
NIST_P256 = new ECJPAKECurve(a_p256, b_p256, q_p256, h_p256, n_p256, g_p256, curve_p256, true);
47-
}
48-
4926
/**
5027
* From NIST.
5128
* 192-bit security.
5229
*/
5330
public static final ECJPAKECurve NIST_P384;
5431

55-
static
56-
{
57-
//a
58-
BigInteger a_p384 = new BigInteger("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc", 16);
59-
//b
60-
BigInteger b_p384 = new BigInteger("b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef", 16);
61-
//q
62-
BigInteger q_p384 = new BigInteger("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff", 16);
63-
//h
64-
BigInteger h_p384 = BigInteger.ONE;
65-
//n
66-
BigInteger n_p384 = new BigInteger("ffffffffffffffffffffffffffffffffc7634d81581a0db248b0a77aecec196accc52973", 16);
67-
//g
68-
ECCurve.Fp curve_p384 = new ECCurve.Fp(q_p384, a_p384, b_p384, n_p384, h_p384);
69-
ECPoint g_p384 = curve_p384.createPoint(
70-
new BigInteger("aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7", 16),
71-
new BigInteger("3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f", 16));
72-
73-
NIST_P384 = new ECJPAKECurve(a_p384, b_p384, q_p384, h_p384, n_p384, g_p384, curve_p384, true);
74-
}
75-
7632
/**
7733
* From NIST.
78-
* 128-bit security.
34+
* 256-bit security.
7935
*/
8036
public static final ECJPAKECurve NIST_P521;
8137

8238
static
8339
{
84-
//a
85-
BigInteger a_p521 = new BigInteger("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc", 16);
86-
//b
87-
BigInteger b_p521 = new BigInteger("b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef", 16);
88-
//q
89-
BigInteger q_p521 = new BigInteger("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff", 16);
90-
//h
91-
BigInteger h_p521 = BigInteger.ONE;
92-
//n
93-
BigInteger n_p521 = new BigInteger("ffffffffffffffffffffffffffffffffc7634d81581a0db248b0a77aecec196accc52973", 16);
94-
//g
95-
ECCurve.Fp curve_p521 = new ECCurve.Fp(q_p521, a_p521, b_p521, n_p521, h_p521);
96-
ECPoint g_p521 = curve_p521.createPoint(
97-
new BigInteger("aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7", 16),
98-
new BigInteger("3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f", 16));
99-
100-
NIST_P521 = new ECJPAKECurve(a_p521, b_p521, q_p521, h_p521, n_p521, g_p521, curve_p521, true);
40+
NIST_P256 = fromX9ECParameters(NISTNamedCurves.getByName("P-256"));
41+
NIST_P384 = fromX9ECParameters(NISTNamedCurves.getByName("P-384"));
42+
NIST_P521 = fromX9ECParameters(NISTNamedCurves.getByName("P-521"));
10143
}
10244

103-
45+
private static ECJPAKECurve fromX9ECParameters(X9ECParameters x9)
46+
{
47+
return new ECJPAKECurve((ECCurve.Fp)x9.getCurve(), x9.getG());
48+
}
10449
}

‎core/src/main/java/org/bouncycastle/crypto/examples/ECJPAKEExample.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public static void main(String args[])
3939
*/
4040
ECJPAKECurve curve = ECJPAKECurves.NIST_P256;
4141

42-
ECCurve ecCurve = curve.getCurve();
42+
// ECCurve ecCurve = curve.getCurve();
4343
BigInteger a = curve.getA();
4444
BigInteger b = curve.getB();
4545
ECPoint g = curve.getG();

0 commit comments

Comments
 (0)