Merge branch 'main' into pg-synchronize-bc_csharp

Author: gefeili

core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.java

@@ -166,11 +166,29 @@ public ASN1ObjectIdentifier branch(String branchID)
     {
         ASN1RelativeOID.checkIdentifier(branchID);
 
-        byte[] branchContents = ASN1RelativeOID.parseIdentifier(branchID);
-        checkContentsLength(this.contents.length + branchContents.length);
+        byte[] contents;
+        if (branchID.length() <= 2)
+        {
+            checkContentsLength(this.contents.length + 1);
+            int subID = branchID.charAt(0) - '0';
+            if (branchID.length() == 2)
+            {
+                subID *= 10;
+                subID += branchID.charAt(1) - '0';
+            }
+
+            contents = Arrays.append(this.contents, (byte)subID);
+        }
+        else
+        {
+            byte[] branchContents = ASN1RelativeOID.parseIdentifier(branchID);
+            checkContentsLength(this.contents.length + branchContents.length);
+
+            contents = Arrays.concatenate(this.contents, branchContents);
+        }
 
-        byte[] contents = Arrays.concatenate(this.contents, branchContents);
-        String identifier = getId() + "." + branchID; 
+        String rootID = getId();
+        String identifier = rootID + "." + branchID;
 
         return new ASN1ObjectIdentifier(contents, identifier);
     }

core/src/main/java/org/bouncycastle/asn1/ASN1RelativeOID.java

@@ -122,11 +122,29 @@ public ASN1RelativeOID branch(String branchID)
     {
         checkIdentifier(branchID);
 
-        byte[] branchContents = parseIdentifier(branchID);
-        checkContentsLength(this.contents.length + branchContents.length);
+        byte[] contents;
+        if (branchID.length() <= 2)
+        {
+            checkContentsLength(this.contents.length + 1);
+            int subID = branchID.charAt(0) - '0';
+            if (branchID.length() == 2)
+            {
+                subID *= 10;
+                subID += branchID.charAt(1) - '0';
+            }
+
+            contents = Arrays.append(this.contents, (byte)subID);
+        }
+        else
+        {
+            byte[] branchContents = parseIdentifier(branchID);
+            checkContentsLength(this.contents.length + branchContents.length);
+
+            contents = Arrays.concatenate(this.contents, branchContents);
+        }
 
-        byte[] contents = Arrays.concatenate(this.contents, branchContents);
-        String identifier = getId() + "." + branchID;
+        String rootID = getId();
+        String identifier = rootID + "." + branchID;
 
         return new ASN1RelativeOID(contents, identifier);
     }

core/src/main/java/org/bouncycastle/asn1/gm/GMObjectIdentifiers.java

@@ -49,15 +49,15 @@ public interface GMObjectIdentifiers
     ASN1ObjectIdentifier sm2encrypt = sm_scheme.branch("301.3");
 
     /**
-     * <Information security technology — Cryptographic application identifier criterion specification>
-     * <url>http&#058;//c.gb688.cn/bzgk/gb/showGb&#63;type=online&hcno=252CF0F72A7BE339A56DEA7D774E8994</url>,
+     * &lt;Information security technology — Cryptographic application identifier criterion specification&gt;
+     * &lt;url&gt;http&#058;//c.gb688.cn/bzgk/gb/showGb&#63;type=online&hcno=252CF0F72A7BE339A56DEA7D774E8994&lt;/url&gt;,
      * Page 21 only cover from 301.1 to 301.3
      * */
     ASN1ObjectIdentifier wapip192v1 =  sm_scheme.branch("301.101");
     /**
-     * <WAPI certificate management—Part 5: Example of certificate format (draft)>
-     * <url>http&#058;//www.chinabwips.org.cn/zqyjgs1.htm</url> and
-     * <url>http&#058;//www.chinabwips.org.cn/doc/101.pdf</url>,
+     * &lt;WAPI certificate management—Part 5: Example of certificate format (draft)&gt;
+     * &lt;url&gt;http&#058;//www.chinabwips.org.cn/zqyjgs1.htm&lt;/url&gt; and
+     * &lt;url&gt;http&#058;//www.chinabwips.org.cn/doc/101.pdf&lt;/url&gt;,
      * Page 9 and page 10 states the OID of ECDSA-192 algorithm based on SHA-256 is 1.2.156.11235.1.1.1
      * */
     ASN1ObjectIdentifier wapi192v1 =  new ASN1ObjectIdentifier("1.2.156.11235.1.1.1");

core/src/main/java/org/bouncycastle/asn1/pkcs/EncryptionScheme.java

@@ -7,6 +7,7 @@
 import org.bouncycastle.asn1.ASN1Sequence;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 
+// TODO[api] This is not supposed to be a separate type; remove and use AlgorithmIdentifier
 public class EncryptionScheme
     extends ASN1Object
 {

core/src/main/java/org/bouncycastle/asn1/pkcs/KeyDerivationFunc.java

@@ -7,6 +7,7 @@
 import org.bouncycastle.asn1.ASN1Sequence;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 
+// TODO[api] This is not supposed to be a separate type; remove and use AlgorithmIdentifier
 public class KeyDerivationFunc
     extends ASN1Object
 {

core/src/main/java/org/bouncycastle/asn1/pkcs/RC2CBCParameter.java

@@ -72,6 +72,11 @@ public BigInteger getRC2ParameterVersion()
         return version.getValue();
     }
 
+    public ASN1Integer getRC2ParameterVersionData()
+    {
+        return version;
+    }
+
     public byte[] getIV()
     {
         return iv.getOctets();

core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java

@@ -2,6 +2,7 @@
 
 import java.io.OutputStream;
 
+import org.bouncycastle.asn1.ASN1Integer;
 import org.bouncycastle.asn1.ASN1Null;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.ASN1OctetString;
@@ -65,6 +66,24 @@ public class CipherFactory
         0x3b, 0x05, 0x03, 0x54, 0x60, 0x48, 0x65, 0x18, 0xd2, 0xcd, 0x5f, 0x32, 0x88, 0x0e, 0x35, 0xfd
     };
 
+    private static int getRC2EffectiveKeyBits(RC2CBCParameter rc2CbcParameter)
+    {
+        ASN1Integer version = rc2CbcParameter.getRC2ParameterVersionData();
+        if (version == null)
+        {
+            return 32;
+        }
+
+        int encoding = version.intPositiveValueExact();
+        if (encoding >= 256)
+        {
+            return encoding;
+        }
+
+        // TODO Why an entire table when RFC 8018 B.2.3. says only 160, 120, 58, 256+ are defined?
+        return rc2Ekb[encoding] & 0xFFFF;
+    }
+
     /**
      * Create a content cipher for encrypting bulk data.
      *
@@ -144,9 +163,12 @@ else if (encAlg.equals(AlgorithmIdentifierFactory.CAST5_CBC))
                 }
                 else if (encAlg.equals(PKCSObjectIdentifiers.RC2_CBC))
                 {
-                    RC2CBCParameter cbcParams = RC2CBCParameter.getInstance(sParams);
+                    RC2CBCParameter rc2CBCParameter = RC2CBCParameter.getInstance(sParams);
+                    RC2Parameters rc2Parameters = new RC2Parameters(
+                        ((KeyParameter)encKey).getKey(),
+                        getRC2EffectiveKeyBits(rc2CBCParameter));
 
-                    cipher.init(forEncryption, new ParametersWithIV(new RC2Parameters(((KeyParameter)encKey).getKey(), rc2Ekb[cbcParams.getRC2ParameterVersion().intValue()]), cbcParams.getIV()));
+                    cipher.init(forEncryption, new ParametersWithIV(rc2Parameters, rc2CBCParameter.getIV()));
                 }
                 else
                 {

core/src/main/java/org/bouncycastle/pqc/crypto/crystals/dilithium/DilithiumEngine.java

@@ -222,7 +222,8 @@ SHAKEDigest getShake128Digest()
         this.CryptoPublicKeyBytes = SeedBytes + this.DilithiumK * DilithiumPolyT1PackedBytes;
         this.CryptoSecretKeyBytes =
             (
-                3 * SeedBytes
+                2 * SeedBytes
+                    + TrBytes
                     + DilithiumL * this.DilithiumPolyEtaPackedBytes
                     + DilithiumK * this.DilithiumPolyEtaPackedBytes
                     + DilithiumK * DilithiumPolyT0PackedBytes
@@ -379,7 +380,7 @@ public byte[] signSignature(byte[] msg, int msglen, byte[] rho, byte[] key, byte
             shake256Digest.update(outSig, 0, DilithiumK * DilithiumPolyW1PackedBytes);
             shake256Digest.doFinal(outSig, 0, DilithiumCTilde);
 
-            cp.challenge(Arrays.copyOfRange(outSig, 0, SeedBytes));  // uses only the first SeedBytes bytes of sig
+            cp.challenge(Arrays.copyOfRange(outSig, 0, DilithiumCTilde));  // uses only the first DilithiumCTilde bytes of sig
             cp.polyNtt();
 
             // Compute z, reject if it reveals secret
@@ -483,7 +484,7 @@ public boolean signVerify(byte[] sig, int siglen, byte[] msg, int msglen, byte[]
         // Helper.printByteArray(mu);
 
         // Matrix-vector multiplication; compute Az - c2^dt1
-        cp.challenge(Arrays.copyOfRange(c, 0, SeedBytes));  // use only first SeedBytes of c.
+        cp.challenge(Arrays.copyOfRange(c, 0, DilithiumCTilde));  // use only first DilithiumCTilde of c.
         // System.out.println("cp = ");
         // System.out.println(cp.toString());
 

core/src/main/java/org/bouncycastle/pqc/crypto/crystals/dilithium/Poly.java

@@ -580,7 +580,7 @@ public void challenge(byte[] seed)
         byte[] buf = new byte[symmetric.stream256BlockBytes];
 
         SHAKEDigest shake256Digest = new SHAKEDigest(256);
-        shake256Digest.update(seed, 0, DilithiumEngine.SeedBytes);
+        shake256Digest.update(seed, 0, engine.getDilithiumCTilde());
         shake256Digest.doOutput(buf, 0, symmetric.stream256BlockBytes);
 
         signs = (long)0;

core/src/main/java/org/bouncycastle/pqc/crypto/crystals/kyber/Poly.java

@@ -261,6 +261,9 @@ public void fromBytes(byte[] inpBytes)
 
     public byte[] toMsg()
     {
+        int LOWER = KyberEngine.KyberQ >>> 2;
+        int UPPER = KyberEngine.KyberQ - LOWER;
+
         byte[] outMsg = new byte[KyberEngine.getKyberIndCpaMsgBytes()];
 
         this.conditionalSubQ();
@@ -270,16 +273,12 @@ public byte[] toMsg()
             outMsg[i] = 0;
             for (int j = 0; j < 8; j++)
             {
-//                short t = (short)(((((short)(this.getCoeffIndex(8 * i + j) << 1) + KyberEngine.KyberQ / 2) / KyberEngine.KyberQ) & 1));
-//                outMsg[i] |= (byte)(t << j);
-                // we've done it like this as there is a chance a division instruction might
-                // get generated introducing a timing signal on the secret input
-                int t = this.getCoeffIndex(8 * i + j) & 0xFFFF;
-                t <<= 1;
-                t += 1665;
-                t *= 80635;
-                t >>= 28;
-                t &= 1;
+                int c_j = this.getCoeffIndex(8 * i + j);
+
+                // KyberSlash: division by Q is not constant time.
+//                int t = (((c_j << 1) + (KyberEngine.KyberQ / 2)) / KyberEngine.KyberQ) & 1;
+                int t = ((LOWER - c_j) & (c_j - UPPER)) >>> 31;
+
                 outMsg[i] |= (byte)(t << j);
             }
         }