github #1664 - Abstract KEM functionality out of DHKEM

royb · royb · commit 8de3703f8dfc · 2024-07-17T11:53:37.000-04:00
diff --git a/core/src/main/java/org/bouncycastle/crypto/hpke/DHKEM.java b/core/src/main/java/org/bouncycastle/crypto/hpke/DHKEM.java
@@ -36,6 +36,7 @@
 
 
 class DHKEM
+    extends KEM
 {
     private AsymmetricCipherKeyPairGenerator kpGen;
 
@@ -48,6 +49,7 @@ class DHKEM
     private byte bitmask;
     private int Nsk;
     private int Nsecret;
+    private int Nenc;
 
     ECDomainParameters domainParams;
 
@@ -74,7 +76,7 @@ protected DHKEM(short kemid)
             bitmask = (byte)0xff;
             Nsk = 32;
             Nsecret = 32;
-
+            Nenc = 65;
             this.kpGen = new ECKeyPairGenerator();
             this.kpGen.init(new ECKeyGenerationParameters(domainParams, new SecureRandom()));
 
@@ -96,6 +98,7 @@ protected DHKEM(short kemid)
             bitmask = (byte)0xff;
             Nsk = 48;
             Nsecret = 48;
+            Nenc = 97;
 
             this.kpGen = new ECKeyPairGenerator();
             this.kpGen.init(new ECKeyGenerationParameters(domainParams, new SecureRandom()));
@@ -119,6 +122,7 @@ protected DHKEM(short kemid)
             bitmask = 0x01;
             Nsk = 66;
             Nsecret = 64;
+            Nenc = 133;
 
             this.kpGen = new ECKeyPairGenerator();
             this.kpGen.init(new ECKeyGenerationParameters(domainParams, new SecureRandom()));
@@ -129,6 +133,7 @@ protected DHKEM(short kemid)
             this.agreement = new XDHBasicAgreement();
             Nsecret = 32;
             Nsk = 32;
+            Nenc = 32;
             this.kpGen = new X25519KeyPairGenerator();
             this.kpGen.init(new X25519KeyGenerationParameters(new SecureRandom()));
 
@@ -138,6 +143,7 @@ protected DHKEM(short kemid)
             this.agreement = new XDHBasicAgreement();
             Nsecret = 64;
             Nsk = 56;
+            Nenc = 56;
 
             this.kpGen = new X448KeyPairGenerator();
             this.kpGen.init(new X448KeyGenerationParameters(new SecureRandom()));
@@ -242,6 +248,11 @@ public AsymmetricCipherKeyPair DeserializePrivateKey(byte[] skEncoded, byte[] pk
         }
     }
 
+    int getEncryptionSize()
+    {
+        return Nenc;
+    }
+
     private boolean ValidateSk(BigInteger d)
     {
         BigInteger n = domainParams.getN();
diff --git a/core/src/main/java/org/bouncycastle/crypto/hpke/HPKE.java b/core/src/main/java/org/bouncycastle/crypto/hpke/HPKE.java
@@ -40,7 +40,7 @@ public class HPKE
     private final short kemId;
     private final short kdfId;
     private final short aeadId;
-    private final DHKEM dhkem;
+    private final KEM kem;
     private final HKDF hkdf;
 
     short Nk;
@@ -58,7 +58,7 @@ public HPKE(byte mode, short kemId, short kdfId, short aeadId)
         this.kdfId = kdfId;
         this.aeadId = aeadId;
         this.hkdf = new HKDF(kdfId);
-        this.dhkem = new DHKEM(kemId);
+        this.kem = new DHKEM(kemId);
         if (aeadId == aead_AES_GCM128)
         {
             Nk = 16;
@@ -67,25 +67,12 @@ public HPKE(byte mode, short kemId, short kdfId, short aeadId)
         {
             Nk = 32;
         }
+
     }
 
     public int getEncSize()
     {
-        switch (kemId)
-        {
-            case HPKE.kem_P256_SHA256:
-                return 65;
-            case HPKE.kem_P384_SHA348:
-                return 97;
-            case HPKE.kem_P521_SHA512:
-                return 133;
-            case HPKE.kem_X25519_SHA256:
-                return 32;
-            case HPKE.kem_X448_SHA512:
-                return 56;
-            default:
-                throw new IllegalArgumentException("invalid kem id");
-        }
+        return kem.getEncryptionSize();
     }
     public short getAeadId()
     {
@@ -139,32 +126,32 @@ private HPKEContext keySchedule(byte mode, byte[] sharedSecret, byte[] info, byt
 
     public AsymmetricCipherKeyPair generatePrivateKey()
     {
-        return dhkem.GeneratePrivateKey();
+        return kem.GeneratePrivateKey();
     }
 
 
     public byte[] serializePublicKey(AsymmetricKeyParameter pk)
     {
-        return dhkem.SerializePublicKey(pk);
+        return kem.SerializePublicKey(pk);
     }
 
     public byte[] serializePrivateKey(AsymmetricKeyParameter sk)
     {
-        return dhkem.SerializePrivateKey(sk);
+        return kem.SerializePrivateKey(sk);
     }
     public AsymmetricKeyParameter deserializePublicKey(byte[] pkEncoded)
     {
-        return dhkem.DeserializePublicKey(pkEncoded);
+        return kem.DeserializePublicKey(pkEncoded);
     }
 
     public AsymmetricCipherKeyPair deserializePrivateKey(byte[] skEncoded, byte[] pkEncoded)
     {
-        return dhkem.DeserializePrivateKey(skEncoded, pkEncoded);
+        return kem.DeserializePrivateKey(skEncoded, pkEncoded);
     }
 
     public AsymmetricCipherKeyPair deriveKeyPair(byte[] ikm)
     {
-        return dhkem.DeriveKeyPair(ikm);
+        return kem.DeriveKeyPair(ikm);
     }
 
     public byte[][] sendExport(AsymmetricKeyParameter pkR, byte[] info, byte[] exporterContext, int L,
@@ -273,7 +260,7 @@ public byte[] open(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, byte[]
 
     public HPKEContextWithEncapsulation setupBaseS(AsymmetricKeyParameter pkR, byte[] info)
     {
-        byte[][] output = dhkem.Encap(pkR); // sharedSecret, enc
+        byte[][] output = kem.Encap(pkR); // sharedSecret, enc
         HPKEContext ctx = keySchedule(mode_base, output[0], info, default_psk, default_psk_id);
 
         return new HPKEContextWithEncapsulation(ctx, output[1]);
@@ -283,21 +270,21 @@ public HPKEContextWithEncapsulation setupBaseS(AsymmetricKeyParameter pkR, byte[
     // This should only be used to validate test vectors.
     public HPKEContextWithEncapsulation setupBaseS(AsymmetricKeyParameter pkR, byte[] info, AsymmetricCipherKeyPair kpE)
     {
-        byte[][] output = dhkem.Encap(pkR, kpE); // sharedSecret, enc
+        byte[][] output = kem.Encap(pkR, kpE); // sharedSecret, enc
         HPKEContext ctx = keySchedule(mode_base, output[0], info, default_psk, default_psk_id);
 
         return new HPKEContextWithEncapsulation(ctx, output[1]);
     }
 
     public HPKEContext setupBaseR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info)
     {
-        byte[] sharedSecret = dhkem.Decap(enc, skR);
+        byte[] sharedSecret = kem.Decap(enc, skR);
         return keySchedule(mode_base, sharedSecret, info, default_psk, default_psk_id);
     }
 
     public HPKEContextWithEncapsulation SetupPSKS(AsymmetricKeyParameter pkR, byte[] info, byte[] psk, byte[] psk_id)
     {
-        byte[][] output = dhkem.Encap(pkR); // sharedSecret, enc
+        byte[][] output = kem.Encap(pkR); // sharedSecret, enc
 
         HPKEContext ctx = keySchedule(mode_psk, output[0], info, psk, psk_id);
 
@@ -306,35 +293,35 @@ public HPKEContextWithEncapsulation SetupPSKS(AsymmetricKeyParameter pkR, byte[]
 
     public HPKEContext setupPSKR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, byte[] psk, byte[] psk_id)
     {
-        byte[] sharedSecret = dhkem.Decap(enc, skR);
+        byte[] sharedSecret = kem.Decap(enc, skR);
         return keySchedule(mode_psk, sharedSecret, info, psk, psk_id);
     }
 
     public HPKEContextWithEncapsulation setupAuthS(AsymmetricKeyParameter pkR, byte[] info, AsymmetricCipherKeyPair skS)
     {
-        byte[][] output = dhkem.AuthEncap(pkR, skS);
+        byte[][] output = kem.AuthEncap(pkR, skS);
         HPKEContext ctx = keySchedule(mode_auth, output[0], info, default_psk, default_psk_id);
 
         return new HPKEContextWithEncapsulation(ctx, output[1]);
     }
 
     public HPKEContext setupAuthR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, AsymmetricKeyParameter pkS)
     {
-        byte[] sharedSecret = dhkem.AuthDecap(enc, skR, pkS);
+        byte[] sharedSecret = kem.AuthDecap(enc, skR, pkS);
         return keySchedule(mode_auth, sharedSecret, info, default_psk, default_psk_id);
     }
 
     public HPKEContextWithEncapsulation setupAuthPSKS(AsymmetricKeyParameter pkR, byte[] info, byte[] psk, byte[] psk_id, AsymmetricCipherKeyPair skS)
     {
-        byte[][] output = dhkem.AuthEncap(pkR, skS);
+        byte[][] output = kem.AuthEncap(pkR, skS);
         HPKEContext ctx = keySchedule(mode_auth_psk, output[0], info, psk, psk_id);
 
         return new HPKEContextWithEncapsulation(ctx, output[1]);
     }
 
     public HPKEContext setupAuthPSKR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, byte[] psk, byte[] psk_id, AsymmetricKeyParameter pkS)
     {
-        byte[] sharedSecret = dhkem.AuthDecap(enc, skR, pkS);
+        byte[] sharedSecret = kem.AuthDecap(enc, skR, pkS);
         return keySchedule(mode_auth_psk, sharedSecret, info, psk, psk_id);
     }
 }
diff --git a/core/src/main/java/org/bouncycastle/crypto/hpke/KEM.java b/core/src/main/java/org/bouncycastle/crypto/hpke/KEM.java
@@ -0,0 +1,35 @@
+package org.bouncycastle.crypto.hpke;
+
+import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
+import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
+
+
+/**
+ * base class for HPKE KEM
+ */
+public abstract class KEM {
+
+    // Key Generation
+    abstract AsymmetricCipherKeyPair GeneratePrivateKey();
+    abstract AsymmetricCipherKeyPair DeriveKeyPair(byte[] ikm);
+
+    // Encapsulates a shared secret for a given public key and returns the encapsulated key and shared secret.
+    abstract byte[][] Encap(AsymmetricKeyParameter recipientPublicKey);
+    abstract byte[][] Encap(AsymmetricKeyParameter pkR, AsymmetricCipherKeyPair kpE);
+    abstract byte[][] AuthEncap(AsymmetricKeyParameter pkR, AsymmetricCipherKeyPair kpS);
+
+    // Decapsulates the given encapsulated key using the recipient's key pair and returns the shared secret.
+    abstract byte[] Decap(byte[] encapsulatedKey, AsymmetricCipherKeyPair recipientKeyPair);
+    abstract byte[] AuthDecap(byte[] enc, AsymmetricCipherKeyPair kpR, AsymmetricKeyParameter pkS);
+
+    // Serialization
+    abstract byte[] SerializePublicKey(AsymmetricKeyParameter publicKey);
+    abstract byte[] SerializePrivateKey(AsymmetricKeyParameter key);
+
+    // Deserialization
+    abstract AsymmetricKeyParameter DeserializePublicKey(byte[] encodedPublicKey);
+    abstract AsymmetricCipherKeyPair DeserializePrivateKey(byte[] skEncoded, byte[] pkEncoded);
+
+    abstract int getEncryptionSize();
+
+}

Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ public class HPKE`
`40`	`40`	`private final short kemId;`
`41`	`41`	`private final short kdfId;`
`42`	`42`	`private final short aeadId;`
`43`		`- private final DHKEM dhkem;`
	`43`	`+ private final KEM kem;`
`44`	`44`	`private final HKDF hkdf;`
`45`	`45`
`46`	`46`	`short Nk;`
`@@ -58,7 +58,7 @@ public HPKE(byte mode, short kemId, short kdfId, short aeadId)`
`58`	`58`	`this.kdfId = kdfId;`
`59`	`59`	`this.aeadId = aeadId;`
`60`	`60`	`this.hkdf = new HKDF(kdfId);`
`61`		`- this.dhkem = new DHKEM(kemId);`
	`61`	`+ this.kem = new DHKEM(kemId);`
`62`	`62`	`if (aeadId == aead_AES_GCM128)`
`63`	`63`	`{`
`64`	`64`	`Nk = 16;`
`@@ -67,25 +67,12 @@ public HPKE(byte mode, short kemId, short kdfId, short aeadId)`
`67`	`67`	`{`
`68`	`68`	`Nk = 32;`
`69`	`69`	`}`
	`70`	`+`
`70`	`71`	`}`
`71`	`72`
`72`	`73`	`public int getEncSize()`
`73`	`74`	`{`
`74`		`- switch (kemId)`
`75`		`- {`
`76`		`- case HPKE.kem_P256_SHA256:`
`77`		`- return 65;`
`78`		`- case HPKE.kem_P384_SHA348:`
`79`		`- return 97;`
`80`		`- case HPKE.kem_P521_SHA512:`
`81`		`- return 133;`
`82`		`- case HPKE.kem_X25519_SHA256:`
`83`		`- return 32;`
`84`		`- case HPKE.kem_X448_SHA512:`
`85`		`- return 56;`
`86`		`- default:`
`87`		`- throw new IllegalArgumentException("invalid kem id");`
`88`		`- }`
	`75`	`+ return kem.getEncryptionSize();`
`89`	`76`	`}`
`90`	`77`	`public short getAeadId()`
`91`	`78`	`{`
`@@ -139,32 +126,32 @@ private HPKEContext keySchedule(byte mode, byte[] sharedSecret, byte[] info, byt`
`139`	`126`
`140`	`127`	`public AsymmetricCipherKeyPair generatePrivateKey()`
`141`	`128`	`{`
`142`		`- return dhkem.GeneratePrivateKey();`
	`129`	`+ return kem.GeneratePrivateKey();`
`143`	`130`	`}`
`144`	`131`
`145`	`132`
`146`	`133`	`public byte[] serializePublicKey(AsymmetricKeyParameter pk)`
`147`	`134`	`{`
`148`		`- return dhkem.SerializePublicKey(pk);`
	`135`	`+ return kem.SerializePublicKey(pk);`
`149`	`136`	`}`
`150`	`137`
`151`	`138`	`public byte[] serializePrivateKey(AsymmetricKeyParameter sk)`
`152`	`139`	`{`
`153`		`- return dhkem.SerializePrivateKey(sk);`
	`140`	`+ return kem.SerializePrivateKey(sk);`
`154`	`141`	`}`
`155`	`142`	`public AsymmetricKeyParameter deserializePublicKey(byte[] pkEncoded)`
`156`	`143`	`{`
`157`		`- return dhkem.DeserializePublicKey(pkEncoded);`
	`144`	`+ return kem.DeserializePublicKey(pkEncoded);`
`158`	`145`	`}`
`159`	`146`
`160`	`147`	`public AsymmetricCipherKeyPair deserializePrivateKey(byte[] skEncoded, byte[] pkEncoded)`
`161`	`148`	`{`
`162`		`- return dhkem.DeserializePrivateKey(skEncoded, pkEncoded);`
	`149`	`+ return kem.DeserializePrivateKey(skEncoded, pkEncoded);`
`163`	`150`	`}`
`164`	`151`
`165`	`152`	`public AsymmetricCipherKeyPair deriveKeyPair(byte[] ikm)`
`166`	`153`	`{`
`167`		`- return dhkem.DeriveKeyPair(ikm);`
	`154`	`+ return kem.DeriveKeyPair(ikm);`
`168`	`155`	`}`
`169`	`156`
`170`	`157`	`public byte[][] sendExport(AsymmetricKeyParameter pkR, byte[] info, byte[] exporterContext, int L,`
`@@ -273,7 +260,7 @@ public byte[] open(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, byte[]`
`273`	`260`
`274`	`261`	`public HPKEContextWithEncapsulation setupBaseS(AsymmetricKeyParameter pkR, byte[] info)`
`275`	`262`	`{`
`276`		`- byte[][] output = dhkem.Encap(pkR); // sharedSecret, enc`
	`263`	`+ byte[][] output = kem.Encap(pkR); // sharedSecret, enc`
`277`	`264`	`HPKEContext ctx = keySchedule(mode_base, output[0], info, default_psk, default_psk_id);`
`278`	`265`
`279`	`266`	`return new HPKEContextWithEncapsulation(ctx, output[1]);`
`@@ -283,21 +270,21 @@ public HPKEContextWithEncapsulation setupBaseS(AsymmetricKeyParameter pkR, byte[`
`283`	`270`	`// This should only be used to validate test vectors.`
`284`	`271`	`public HPKEContextWithEncapsulation setupBaseS(AsymmetricKeyParameter pkR, byte[] info, AsymmetricCipherKeyPair kpE)`
`285`	`272`	`{`
`286`		`- byte[][] output = dhkem.Encap(pkR, kpE); // sharedSecret, enc`
	`273`	`+ byte[][] output = kem.Encap(pkR, kpE); // sharedSecret, enc`
`287`	`274`	`HPKEContext ctx = keySchedule(mode_base, output[0], info, default_psk, default_psk_id);`
`288`	`275`
`289`	`276`	`return new HPKEContextWithEncapsulation(ctx, output[1]);`
`290`	`277`	`}`
`291`	`278`
`292`	`279`	`public HPKEContext setupBaseR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info)`
`293`	`280`	`{`
`294`		`- byte[] sharedSecret = dhkem.Decap(enc, skR);`
	`281`	`+ byte[] sharedSecret = kem.Decap(enc, skR);`
`295`	`282`	`return keySchedule(mode_base, sharedSecret, info, default_psk, default_psk_id);`
`296`	`283`	`}`
`297`	`284`
`298`	`285`	`public HPKEContextWithEncapsulation SetupPSKS(AsymmetricKeyParameter pkR, byte[] info, byte[] psk, byte[] psk_id)`
`299`	`286`	`{`
`300`		`- byte[][] output = dhkem.Encap(pkR); // sharedSecret, enc`
	`287`	`+ byte[][] output = kem.Encap(pkR); // sharedSecret, enc`
`301`	`288`
`302`	`289`	`HPKEContext ctx = keySchedule(mode_psk, output[0], info, psk, psk_id);`
`303`	`290`
`@@ -306,35 +293,35 @@ public HPKEContextWithEncapsulation SetupPSKS(AsymmetricKeyParameter pkR, byte[]`
`306`	`293`
`307`	`294`	`public HPKEContext setupPSKR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, byte[] psk, byte[] psk_id)`
`308`	`295`	`{`
`309`		`- byte[] sharedSecret = dhkem.Decap(enc, skR);`
	`296`	`+ byte[] sharedSecret = kem.Decap(enc, skR);`
`310`	`297`	`return keySchedule(mode_psk, sharedSecret, info, psk, psk_id);`
`311`	`298`	`}`
`312`	`299`
`313`	`300`	`public HPKEContextWithEncapsulation setupAuthS(AsymmetricKeyParameter pkR, byte[] info, AsymmetricCipherKeyPair skS)`
`314`	`301`	`{`
`315`		`- byte[][] output = dhkem.AuthEncap(pkR, skS);`
	`302`	`+ byte[][] output = kem.AuthEncap(pkR, skS);`
`316`	`303`	`HPKEContext ctx = keySchedule(mode_auth, output[0], info, default_psk, default_psk_id);`
`317`	`304`
`318`	`305`	`return new HPKEContextWithEncapsulation(ctx, output[1]);`
`319`	`306`	`}`
`320`	`307`
`321`	`308`	`public HPKEContext setupAuthR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, AsymmetricKeyParameter pkS)`
`322`	`309`	`{`
`323`		`- byte[] sharedSecret = dhkem.AuthDecap(enc, skR, pkS);`
	`310`	`+ byte[] sharedSecret = kem.AuthDecap(enc, skR, pkS);`
`324`	`311`	`return keySchedule(mode_auth, sharedSecret, info, default_psk, default_psk_id);`
`325`	`312`	`}`
`326`	`313`
`327`	`314`	`public HPKEContextWithEncapsulation setupAuthPSKS(AsymmetricKeyParameter pkR, byte[] info, byte[] psk, byte[] psk_id, AsymmetricCipherKeyPair skS)`
`328`	`315`	`{`
`329`		`- byte[][] output = dhkem.AuthEncap(pkR, skS);`
	`316`	`+ byte[][] output = kem.AuthEncap(pkR, skS);`
`330`	`317`	`HPKEContext ctx = keySchedule(mode_auth_psk, output[0], info, psk, psk_id);`
`331`	`318`
`332`	`319`	`return new HPKEContextWithEncapsulation(ctx, output[1]);`
`333`	`320`	`}`
`334`	`321`
`335`	`322`	`public HPKEContext setupAuthPSKR(byte[] enc, AsymmetricCipherKeyPair skR, byte[] info, byte[] psk, byte[] psk_id, AsymmetricKeyParameter pkS)`
`336`	`323`	`{`
`337`		`- byte[] sharedSecret = dhkem.AuthDecap(enc, skR, pkS);`
	`324`	`+ byte[] sharedSecret = kem.AuthDecap(enc, skR, pkS);`
`338`	`325`	`return keySchedule(mode_auth_psk, sharedSecret, info, psk, psk_id);`
`339`	`326`	`}`
`340`	`327`	`}`