Botan  2.1.0
Crypto and TLS for C++11
Public Member Functions | List of all members
Botan::ECIES_Decryptor Class Reference

#include <ecies.h>

Inheritance diagram for Botan::ECIES_Decryptor:
Botan::PK_Decryptor

Public Member Functions

secure_vector< uint8_t > decrypt (const uint8_t in[], size_t length) const
 
template<typename Alloc >
secure_vector< uint8_t > decrypt (const std::vector< uint8_t, Alloc > &in) const
 
secure_vector< uint8_t > decrypt_or_random (const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng) const
 
secure_vector< uint8_t > decrypt_or_random (const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng, const uint8_t required_content_bytes[], const uint8_t required_content_offsets[], size_t required_contents) const
 
 ECIES_Decryptor (const PK_Key_Agreement_Key &private_key, const ECIES_System_Params &ecies_params, RandomNumberGenerator &rng)
 
void set_initialization_vector (const InitializationVector &iv)
 Set the initialization vector for the data encryption method. More...
 
void set_label (const std::string &label)
 Set the label which is appended to the input for the message authentication code. More...
 

Detailed Description

ECIES Decryption according to ISO 18033-2

Definition at line 274 of file ecies.h.

Constructor & Destructor Documentation

Botan::ECIES_Decryptor::ECIES_Decryptor ( const PK_Key_Agreement_Key private_key,
const ECIES_System_Params ecies_params,
RandomNumberGenerator rng 
)
Parameters
private_keythe private key which is used for the key agreement
ecies_paramssettings for ecies
rngthe random generator to use

Definition at line 301 of file ecies.cpp.

References Botan::ECIES_KA_Params::check_mode(), Botan::ECIES_KA_Params::domain(), Botan::gcd(), Botan::EC_Group::get_cofactor(), and Botan::EC_Group::get_order().

303  :
304  m_ka(key, ecies_params, false, rng),
305  m_params(ecies_params),
306  m_iv(),
307  m_label()
308  {
309  // ISO 18033: "If v > 1 and CheckMode = 0, then we must have gcd(u, v) = 1." (v = index, u= order)
310  if(!ecies_params.check_mode())
311  {
312  Botan::BigInt cofactor = m_params.domain().get_cofactor();
313  if(cofactor > 1 && Botan::gcd(cofactor, m_params.domain().get_order()) != 1)
314  {
315  throw Invalid_Argument("ECIES: gcd of cofactor and order must be 1 if check_mode is 0");
316  }
317  }
318  }
BigInt gcd(const BigInt &a, const BigInt &b)
Definition: numthry.cpp:46
const EC_Group & domain() const
Definition: ecies.h:75
const BigInt & get_order() const
Definition: ec_group.h:101
const BigInt & get_cofactor() const
Definition: ec_group.h:107

Member Function Documentation

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt ( const uint8_t  in[],
size_t  length 
) const
inherited

Decrypt a ciphertext, throwing an exception if the input seems to be invalid (eg due to an accidental or malicious error in the ciphertext).

Parameters
inthe ciphertext as a byte array
lengththe length of the above byte array
Returns
decrypted message

Definition at line 16 of file pubkey.cpp.

Referenced by Botan::KeyPair::encryption_consistency_check().

17  {
18  uint8_t valid_mask = 0;
19 
20  secure_vector<uint8_t> decoded = do_decrypt(valid_mask, in, length);
21 
22  if(valid_mask == 0)
23  throw Decoding_Error("Invalid public key ciphertext, cannot decrypt");
24 
25  return decoded;
26  }
template<typename Alloc >
secure_vector<uint8_t> Botan::PK_Decryptor::decrypt ( const std::vector< uint8_t, Alloc > &  in) const
inlineinherited

Same as above, but taking a vector

Parameters
inthe ciphertext
Returns
decrypted message

Definition at line 105 of file pubkey.h.

References Botan::CryptoBox::decrypt().

106  {
107  return decrypt(in.data(), in.size());
108  }
secure_vector< uint8_t > decrypt(const uint8_t in[], size_t length) const
Definition: pubkey.cpp:16
secure_vector< uint8_t > Botan::PK_Decryptor::decrypt_or_random ( const uint8_t  in[],
size_t  length,
size_t  expected_pt_len,
RandomNumberGenerator rng 
) const
inherited

Decrypt a ciphertext. If the ciphertext is invalid (eg due to invalid padding) or is not the expected length, instead returns a random string of the expected length. Use to avoid oracle attacks, especially against PKCS #1 v1.5 decryption.

Definition at line 77 of file pubkey.cpp.

81  {
82  return decrypt_or_random(in, length, expected_pt_len, rng,
83  nullptr, nullptr, 0);
84  }
secure_vector< uint8_t > decrypt_or_random(const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng) const
Definition: pubkey.cpp:77
secure_vector< uint8_t > Botan::PK_Decryptor::decrypt_or_random ( const uint8_t  in[],
size_t  length,
size_t  expected_pt_len,
RandomNumberGenerator rng,
const uint8_t  required_content_bytes[],
const uint8_t  required_content_offsets[],
size_t  required_contents 
) const
inherited

Decrypt a ciphertext. If the ciphertext is invalid (eg due to invalid padding) or is not the expected length, instead returns a random string of the expected length. Use to avoid oracle attacks, especially against PKCS #1 v1.5 decryption.

Additionally checks (also in const time) that: contents[required_content_offsets[i]] == required_content_bytes[i] for 0 <= i < required_contents

Used for example in TLS, which encodes the client version in the content bytes: if there is any timing variation the version check can be used as an oracle to recover the key.

Definition at line 29 of file pubkey.cpp.

References BOTAN_ASSERT, Botan::CT::conditional_copy_mem(), Botan::CT::is_equal(), and Botan::RandomNumberGenerator::random_vec().

36  {
37  const secure_vector<uint8_t> fake_pms = rng.random_vec(expected_pt_len);
38 
39  uint8_t valid_mask = 0;
40  secure_vector<uint8_t> decoded = do_decrypt(valid_mask, in, length);
41 
42  valid_mask &= CT::is_equal(decoded.size(), expected_pt_len);
43 
44  decoded.resize(expected_pt_len);
45 
46  for(size_t i = 0; i != required_contents_length; ++i)
47  {
48  /*
49  These values are chosen by the application and for TLS are constants,
50  so this early failure via assert is fine since we know 0,1 < 48
51 
52  If there is a protocol that has content checks on the key where
53  the expected offsets are controllable by the attacker this could
54  still leak.
55 
56  Alternately could always reduce the offset modulo the length?
57  */
58 
59  const uint8_t exp = required_content_bytes[i];
60  const uint8_t off = required_content_offsets[i];
61 
62  BOTAN_ASSERT(off < expected_pt_len, "Offset in range of plaintext");
63 
64  valid_mask &= CT::is_equal(decoded[off], exp);
65  }
66 
67  CT::conditional_copy_mem(valid_mask,
68  /*output*/decoded.data(),
69  /*from0*/decoded.data(),
70  /*from1*/fake_pms.data(),
71  expected_pt_len);
72 
73  return decoded;
74  }
void conditional_copy_mem(T value, T *to, const T *from0, const T *from1, size_t elems)
Definition: ct_utils.h:138
T is_equal(T x, T y)
Definition: ct_utils.h:116
#define BOTAN_ASSERT(expr, assertion_made)
Definition: assert.h:27
void Botan::ECIES_Decryptor::set_initialization_vector ( const InitializationVector iv)
inline

Set the initialization vector for the data encryption method.

Definition at line 287 of file ecies.h.

288  {
289  m_iv = iv;
290  }
void Botan::ECIES_Decryptor::set_label ( const std::string &  label)
inline

Set the label which is appended to the input for the message authentication code.

Definition at line 293 of file ecies.h.

294  {
295  m_label = std::vector<uint8_t>(label.begin(), label.end());
296  }

The documentation for this class was generated from the following files: