Botan 2.13.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- Class List
- Class Index
- Class Hierarchy
- Class Members

Public Types | Public Member Functions | Static Public Member Functions | List of all members
Botan::DL_Group Class Referencefinal

`#include <dl_group.h>`

## Public Types
enum | Format { ANSI_X9_42, ANSI_X9_57, PKCS_3, DSA_PARAMETERS = ANSI_X9_57, DH_PARAMETERS = ANSI_X9_42, ANSI_X9_42_DH_PARAMETERS = ANSI_X9_42, PKCS3_DH_PARAMETERS = PKCS_3 }
enum | PrimeType { Strong, Prime_Subgroup, DSA_Kosherizer }

## Public Member Functions
void | BER_decode (const std::vector< uint8_t > &ber, Format format)
std::vector< uint8_t > | DER_encode (Format format) const
| DL_Group ()=default
| DL_Group (const std::string &name)
| DL_Group (RandomNumberGenerator &rng, PrimeType type, size_t pbits, size_t qbits=0)
| DL_Group (RandomNumberGenerator &rng, const std::vector< uint8_t > &seed, size_t pbits=1024, size_t qbits=0)
| DL_Group (const BigInt &p, const BigInt &g)
| DL_Group (const BigInt &p, const BigInt &q, const BigInt &g)
| DL_Group (const uint8_t ber[], size_t ber_len, Format format)
template<typename Alloc >
| DL_Group (const std::vector< uint8_t, Alloc > &ber, Format format)
size_t | estimated_strength () const
size_t | exponent_bits () const
const BigInt & | get_g () const
const BigInt & | get_p () const
const BigInt & | get_q () const
BigInt | inverse_mod_p (const BigInt &x) const
BigInt | inverse_mod_q (const BigInt &x) const
BigInt | mod_p (const BigInt &x) const
BigInt | mod_q (const BigInt &x) const
std::shared_ptr< const Montgomery_Params > | monty_params_p () const
BigInt | multi_exponentiate (const BigInt &x, const BigInt &y, const BigInt &z) const
BigInt | multiply_mod_p (const BigInt &x, const BigInt &y) const
BigInt | multiply_mod_q (const BigInt &x, const BigInt &y) const
BigInt | multiply_mod_q (const BigInt &x, const BigInt &y, const BigInt &z) const
size_t | p_bits () const
size_t | p_bytes () const
void | PEM_decode (const std::string &pem)
std::string | PEM_encode (Format format) const
BigInt | power_g_p (const BigInt &x) const
BigInt | power_g_p (const BigInt &x, size_t max_x_bits) const
size_t | q_bits () const
size_t | q_bytes () const
BigInt | square_mod_q (const BigInt &x) const
bool | verify_element_pair (const BigInt &y, const BigInt &x) const
bool | verify_group (RandomNumberGenerator &rng, bool strong=true) const
bool | verify_public_element (const BigInt &y) const

## Static Public Member Functions
static std::shared_ptr< DL_Group_Data > | DL_group_info (const std::string &name)
static std::string | PEM_for_named_group (const std::string &name)

## Detailed Description

This class represents discrete logarithm groups. It holds a prime modulus p, a generator g, and (optionally) a prime q which is a factor of (p-1). In most cases g generates the order-q subgroup.

Definition at line 23 of file dl_group.h.

## Member Enumeration Documentation

enum Botan::DL_Group::Format

The DL group encoding format variants.

Enumerator
ANSI_X9_42 |
ANSI_X9_57 |
PKCS_3 |
DSA_PARAMETERS |
DH_PARAMETERS |
ANSI_X9_42_DH_PARAMETERS |
PKCS3_DH_PARAMETERS |

Definition at line 34 of file dl_group.h.

34 {
35 ANSI_X9_42,
36 ANSI_X9_57,
37 PKCS_3,
38
39 DSA_PARAMETERS = ANSI_X9_57,
40 DH_PARAMETERS = ANSI_X9_42,
41 ANSI_X9_42_DH_PARAMETERS = ANSI_X9_42,
42 PKCS3_DH_PARAMETERS = PKCS_3
43 };
Botan::DL_Group::PKCS3_DH_PARAMETERS
Definition: dl_group.h:42
Botan::DL_Group::PKCS_3
Definition: dl_group.h:37
Botan::DL_Group::ANSI_X9_57
Definition: dl_group.h:36
Botan::DL_Group::ANSI_X9_42_DH_PARAMETERS
Definition: dl_group.h:41
Botan::DL_Group::DH_PARAMETERS
Definition: dl_group.h:40
Botan::DL_Group::ANSI_X9_42
Definition: dl_group.h:35
Botan::DL_Group::DSA_PARAMETERS
Definition: dl_group.h:39

enum Botan::DL_Group::PrimeType

Determine the prime creation for DL groups.

Enumerator
Strong |
Prime_Subgroup |
DSA_Kosherizer |

Definition at line 29 of file dl_group.h.

29 { Strong, Prime_Subgroup, DSA_Kosherizer };
Botan::DL_Group::Prime_Subgroup
Definition: dl_group.h:29
Botan::DL_Group::Strong
Definition: dl_group.h:29
Botan::DL_Group::DSA_Kosherizer
Definition: dl_group.h:29

## Constructor & Destructor Documentation

Botan::DL_Group::DL_Group | ( |  | ) |
| default

Construct a DL group with uninitialized internal value. Use this constructor is you wish to set the groups values from a DER or PEM encoded group.

Botan::DL_Group::DL_Group | ( | const std::string & | name | ) |
| explicit

Construct a DL group that is registered in the configuration.

Parameters

  name | the name that is configured in the global configuration for the desired group. If no configuration file is specified, the default values from the file policy.cpp will be used. For instance, use "modp/ietf/3072".

Definition at line 182 of file dl_group.cpp.

References Botan::PEM_Code::decode(), DL_group_info(), and Botan::unlock().

183 {
184 // Either a name or a PEM block, try name first
185 m_data = DL_group_info(str);
186
187 if(m_data == nullptr)
188 {
189 try
190 {
191 std::string label;
192 const std::vector<uint8_t> ber = unlock(PEM_Code::decode(str, label));
193 Format format = pem_label_to_dl_format(label);
194
195 m_data = BER_decode_DL_group(ber.data(), ber.size(), format);
196 }
197 catch(...) {}
198 }
199
200 if(m_data == nullptr)
201 throw Invalid_Argument("DL_Group: Unknown group " + str);
202 }
Botan::DL_Group::DL_group_info
static std::shared_ptr< DL_Group_Data > DL_group_info(const std::string &name)
Definition: dl_named.cpp:13
Botan::DL_Group::Format
Format
Definition: dl_group.h:34
Botan::PEM_Code::decode
secure_vector< uint8_t > decode(DataSource &source, std::string &label)
Definition: pem.cpp:68
Botan::unlock
std::vector< T > unlock(const secure_vector< T > &in)
Definition: secmem.h:72

Botan::DL_Group::DL_Group | ( | RandomNumberGenerator & | rng,
|  | PrimeType | type,
|  | size_t | pbits,
|  | size_t | qbits = `0`
| ) |  |

Create a new group randomly.

Parameters

  rng | the random number generator to use
  type | specifies how the creation of primes p and q shall be performed. If type=Strong, then p will be determined as a safe prime, and q will be chosen as (p-1)/2. If type=Prime_Subgroup and qbits = 0, then the size of q will be determined according to the estimated difficulty of the DL problem. If type=DSA_Kosherizer, DSA primes will be created.
  pbits | the number of bits of p
  qbits | the number of bits of q. Leave it as 0 to have the value determined according to pbits.

Definition at line 232 of file dl_group.cpp.

References Botan::BigInt::bits(), Botan::dl_exponent_size(), DSA_Kosherizer, Botan::generate_dsa_primes(), Botan::is_prime(), Botan::jacobi(), Prime_Subgroup, Botan::PRIME_TABLE_SIZE, Botan::PRIMES, Botan::random_prime(), Botan::random_safe_prime(), Botan::BigInt::randomize(), Botan::Modular_Reducer::reduce(), Strong, Botan::ASN1::to_string(), and X.

234 {
235 if(pbits < 1024)
236 throw Invalid_Argument("DL_Group: prime size " + std::to_string(pbits) + " is too small");
237
238 if(type == Strong)
239 {
240 if(qbits != 0 && qbits != pbits - 1)
241 throw Invalid_Argument("Cannot create strong-prime DL_Group with specified q bits");
242
243 const BigInt p = random_safe_prime(rng, pbits);
244 const BigInt q = (p - 1) / 2;
245
246 /*
247 Always choose a generator that is quadratic reside mod p,
248 this forces g to be a generator of the subgroup of size q.
249 */
250 BigInt g = 2;
251 if(jacobi(g, p) != 1)
252 {
253 // prime table does not contain 2
254 for(size_t i = 0; i < PRIME_TABLE_SIZE; ++i)
255 {
256 g = PRIMES[i];
257 if(jacobi(g, p) == 1)
258 break;
259 }
260 }
261
262 m_data = std::make_shared<DL_Group_Data>(p, q, g);
263 }
264 else if(type == Prime_Subgroup)
265 {
266 if(qbits == 0)
267 qbits = dl_exponent_size(pbits);
268
269 const BigInt q = random_prime(rng, qbits);
270 Modular_Reducer mod_2q(2*q);
271 BigInt X;
272 BigInt p;
273 while(p.bits() != pbits || !is_prime(p, rng, 128, true))
274 {
275 X.randomize(rng, pbits);
276 p = X - mod_2q.reduce(X) + 1;
277 }
278
279 const BigInt g = make_dsa_generator(p, q);
280 m_data = std::make_shared<DL_Group_Data>(p, q, g);
281 }
282 else if(type == DSA_Kosherizer)
283 {
284 if(qbits == 0)
285 qbits = ((pbits <= 1024) ? 160 : 256);
286
287 BigInt p, q;
288 generate_dsa_primes(rng, p, q, pbits, qbits);
289 const BigInt g = make_dsa_generator(p, q);
290 m_data = std::make_shared<DL_Group_Data>(p, q, g);
291 }
292 else
293 {
294 throw Invalid_Argument("DL_Group unknown PrimeType");
295 }
296 }
Botan::PRIME_TABLE_SIZE
const size_t PRIME_TABLE_SIZE
Definition: numthry.h:276
X
fe X
Definition: ge.cpp:27
Botan::DL_Group::Prime_Subgroup
Definition: dl_group.h:29
Botan::PRIMES
const uint16_t PRIMES[]
Definition: primes.cpp:12
Botan::is_prime
bool is_prime(const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
Definition: numthry.cpp:528
Botan::DL_Group::Strong
Definition: dl_group.h:29
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213
type
MechanismType type
Definition: p11_mechanism.cpp:44
Botan::generate_dsa_primes
bool generate_dsa_primes(RandomNumberGenerator &rng, BigInt &p, BigInt &q, size_t pbits, size_t qbits, const std::vector< uint8_t > &seed_c, size_t offset)
Definition: dsa_gen.cpp:39
Botan::random_safe_prime
BigInt random_safe_prime(RandomNumberGenerator &rng, size_t bits)
Definition: make_prm.cpp:294
Botan::random_prime
BigInt random_prime(RandomNumberGenerator &rng, size_t bits, const BigInt &coprime, size_t equiv, size_t modulo, size_t prob)
Definition: make_prm.cpp:77
Botan::DL_Group::DSA_Kosherizer
Definition: dl_group.h:29
Botan::dl_exponent_size
size_t dl_exponent_size(size_t bits)
Definition: workfactor.cpp:51
Botan::jacobi
int32_t jacobi(const BigInt &a, const BigInt &n)
Definition: jacobi.cpp:15

Botan::DL_Group::DL_Group | ( | RandomNumberGenerator & | rng,
|  | const std::vector< uint8_t > & | seed,
|  | size_t | pbits = `1024`,
|  | size_t | qbits = `0`
| ) |  |

Create a DSA group with a given seed.

Parameters

  rng | the random number generator to use
  seed | the seed to use to create the random primes
  pbits | the desired bit size of the prime p
  qbits | the desired bit size of the prime q.

Definition at line 301 of file dl_group.cpp.

References Botan::generate_dsa_primes().

304 {
305 BigInt p, q;
306
307 if(!generate_dsa_primes(rng, p, q, pbits, qbits, seed))
308 throw Invalid_Argument("DL_Group: The seed given does not generate a DSA group");
309
310 BigInt g = make_dsa_generator(p, q);
311
312 m_data = std::make_shared<DL_Group_Data>(p, q, g);
313 }
Botan::generate_dsa_primes
bool generate_dsa_primes(RandomNumberGenerator &rng, BigInt &p, BigInt &q, size_t pbits, size_t qbits, const std::vector< uint8_t > &seed_c, size_t offset)
Definition: dsa_gen.cpp:39

Botan::DL_Group::DL_Group | ( | const BigInt & | p,
|  | const BigInt & | g
| ) |  |

Create a DL group.

Parameters

  p | the prime p
  g | the base g

Definition at line 318 of file dl_group.cpp.

319 {
320 m_data = std::make_shared<DL_Group_Data>(p, 0, g);
321 }

Botan::DL_Group::DL_Group | ( | const BigInt & | p,
|  | const BigInt & | q,
|  | const BigInt & | g
| ) |  |

Create a DL group.

Parameters

  p | the prime p
  q | the prime q
  g | the base g

Definition at line 326 of file dl_group.cpp.

327 {
328 m_data = std::make_shared<DL_Group_Data>(p, q, g);
329 }

Botan::DL_Group::DL_Group | ( | const uint8_t | ber[],
|  | size_t | ber_len,
|  | Format | format
| ) |  |

Decode a BER-encoded DL group param

Definition at line 587 of file dl_group.cpp.

588 {
589 m_data = BER_decode_DL_group(ber, ber_len, format);
590 }
template<typename Alloc >

Botan::DL_Group::DL_Group | ( | const std::vector< uint8_t, Alloc > & | ber,
|  | Format | format
| ) |  |
| inline

Decode a BER-encoded DL group param

Definition at line 112 of file dl_group.h.

112 :
113 DL_Group(ber.data(), ber.size(), format) {}
Botan::DL_Group::DL_Group
DL_Group()=default

## Member Function Documentation

void Botan::DL_Group::BER_decode | ( | const std::vector< uint8_t > & | ber,
|  | Format | format
| ) |  |

Decode a DER/BER encoded group into this instance.

Parameters

  ber | a vector containing the DER/BER encoded group
  format | the format of the encoded group

Definition at line 592 of file dl_group.cpp.

Referenced by Botan::DL_Scheme_PrivateKey::DL_Scheme_PrivateKey().

593 {
594 m_data = BER_decode_DL_group(ber.data(), ber.size(), format);
595 }

std::vector< uint8_t > Botan::DL_Group::DER_encode | ( | Format | format | ) | const

Encode this group into a string using DER encoding.

Parameters

  format | the encoding format

Returns
  string holding the DER encoded group

Definition at line 533 of file dl_group.cpp.

References ANSI_X9_42, ANSI_X9_57, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), get_g(), get_p(), get_q(), PKCS_3, Botan::SEQUENCE, Botan::DER_Encoder::start_cons(), and Botan::ASN1::to_string().

Referenced by Botan::DL_Scheme_PublicKey::algorithm_identifier(), and PEM_encode().

534 {
535 if(get_q().is_zero() && (format == ANSI_X9_57 || format == ANSI_X9_42))
536 throw Encoding_Error("Cannot encode DL_Group in ANSI formats when q param is missing");
537
538 std::vector<uint8_t> output;
539 DER_Encoder der(output);
540
541 if(format == ANSI_X9_57)
542 {
543 der.start_cons(SEQUENCE)
544 .encode(get_p())
545 .encode(get_q())
546 .encode(get_g())
547 .end_cons();
548 }
549 else if(format == ANSI_X9_42)
550 {
551 der.start_cons(SEQUENCE)
552 .encode(get_p())
553 .encode(get_g())
554 .encode(get_q())
555 .end_cons();
556 }
557 else if(format == PKCS_3)
558 {
559 der.start_cons(SEQUENCE)
560 .encode(get_p())
561 .encode(get_g())
562 .end_cons();
563 }
564 else
565 throw Invalid_Argument("Unknown DL_Group encoding " + std::to_string(format));
566
567 return output;
568 }
Botan::DL_Group::PKCS_3
Definition: dl_group.h:37
Botan::DL_Group::ANSI_X9_57
Definition: dl_group.h:36
Botan::DL_Group::get_q
const BigInt & get_q() const
Definition: dl_group.cpp:426
Botan::DL_Group::get_p
const BigInt & get_p() const
Definition: dl_group.cpp:410
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213
Botan::SEQUENCE
Definition: asn1_obj.h:40
Botan::DL_Group::get_g
const BigInt & get_g() const
Definition: dl_group.cpp:418
Botan::DL_Group::ANSI_X9_42
Definition: dl_group.h:35

std::shared_ptr< DL_Group_Data > Botan::DL_Group::DL_group_info | ( | const std::string & | name | ) |
| static

Definition at line 13 of file dl_named.cpp.

Referenced by DL_Group().

14 {
15 /* TLS FFDHE groups */
16
17 if(name == "ffdhe/ietf/2048")
18 {
19 return load_DL_group_info(" ",
20 "0x2");
21 }
22
23 if(name == "ffdhe/ietf/3072")
24 {
25 return load_DL_group_info(" ",
26 "0x2");
27 }
28
29 if(name == "ffdhe/ietf/4096")
30 {
31 return load_DL_group_info(" ",
32 "0x2");
33 }
34
35 if(name == "ffdhe/ietf/6144")
36 {
37 return load_DL_group_info(" ",
38 "0x2");
39 }
40
41 if(name == "ffdhe/ietf/8192")
42 {
43 return load_DL_group_info(" ",
44 "0x2");
45 }
46
47 /* IETF IPsec groups */
48
49 if(name == "modp/ietf/1024")
50 {
51 return load_DL_group_info("0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF",
52 "0x2");
53 }
54
55 if(name == "modp/ietf/1536")
56 {
57 return load_DL_group_info("0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA237327FFFFFFFFFFFFFFFF",
58 "0x2");
59 }
60
61 if(name == "modp/ietf/2048")
62 {
63 return load_DL_group_info(" ",
64 "0x2");
65 }
66
67 if(name == "modp/ietf/3072")
68 {
69 return load_DL_group_info(" ",
70 "0x2");
71 }
72
73 if(name == "modp/ietf/4096")
74 {
75 return load_DL_group_info(" ",
76 "0x2");
77 }
78
79 if(name == "modp/ietf/6144")
80 {
81 return load_DL_group_info(" ",
82 "0x2");
83 }
84
85 if(name == "modp/ietf/8192")
86 {
87 return load_DL_group_info(" ",
88 "0x2");
89 }
90
91 /* SRP groups
92
93 SRP groups have a p st (p-1)/2 is prime, but g is not a generator
94 of subgroup of size q, so set q == 0 to bypass generator check
95
96 Missing q doesn't matter for SRP, and nothing but SRP should be
97 using these parameters.
98 */
99
100 if(name == "modp/srp/1024")
101 {
102 return load_DL_group_info("0xEEAF0AB9ADB38DD69C33F80AFA8FC5E86072618775FF3C0B9EA2314C9C256576D674DF7496EA81D3383B4813D692C6E0E0D5D8E250B98BE48E495C1D6089DAD15DC7D7B46154D6B6CE8EF4AD69B15D4982559B297BCF1885C529F566660E57EC68EDBC3C05726CC02FD4CBF4976EAA9AFD5138FE8376435B9FC61D2FC0EB06E3",
103 "0",
104 "0x2");
105 }
106
107 if(name == "modp/srp/1536")
108 {
109 return load_DL_group_info("0x9DEF3CAFB939277AB1F12A8617A47BBBDBA51DF499AC4C80BEEEA9614B19CC4D5F4F5F556E27CBDE51C6A94BE4607A291558903BA0D0F84380B655BB9A22E8DCDF028A7CEC67F0D08134B1C8B97989149B609E0BE3BAB63D47548381DBC5B1FC764E3F4B53DD9DA1158BFD3E2B9C8CF56EDF019539349627DB2FD53D24B7C48665772E437D6C7F8CE442734AF7CCB7AE837C264AE3A9BEB87F8A2FE9B8B5292E5A021FFF5E91479E8CE7A28C2442C6F315180F93499A234DCF76E3FED135F9BB",
110 "0",
111 "0x2");
112 }
113
114 if(name == "modp/srp/2048")
115 {
116 return load_DL_group_info(" ",
117 "0",
118 "0x2");
119 }
120
121 if(name == "modp/srp/3072")
122 {
123 return load_DL_group_info(" ",
124 "0",
125 "0x5");
126 }
127
128 if(name == "modp/srp/4096")
129 {
130 return load_DL_group_info(" ",
131 "0",
132 "0x5");
133 }
134
135 if(name == "modp/srp/6144")
136 {
137 return load_DL_group_info(" ",
138 "0",
139 "0x5");
140 }
141
142 if(name == "modp/srp/8192")
143 {
144 return load_DL_group_info(" ",
145 "0",
146 "0x13");
147 }
148
149 /* DSA groups */
150
151 if(name == "dsa/jce/1024")
152 {
153 return load_DL_group_info("0xFD7F53811D75122952DF4A9C2EECE4E7F611B7523CEF4400C31E3F80B6512669455D402251FB593D8D58FABFC5F5BA30F6CB9B556CD7813B801D346FF26660B76B9950A5A49F9FE8047B1022C24FBBA9D7FEB7C61BF83B57E7C6A8A6150F04FB83F6D3C51EC3023554135A169132F675F3AE2B61D72AEFF22203199DD14801C7",
154 "0x9760508F15230BCCB292B982A2EB840BF0581CF5",
155 "0x469603512E30278CD3947595DB22EEC9826A6322ADC97344F41D740C325724C8F9EFBAA7D4D803FF8C609DCD100EBC5BDFCFAD7C6A425FAEA786EA2050EBE98351EA1FDA1FDF24D6947AA6B9AA23766953802F4D7D4A8ECBA06D19768A2491FFB16D0EF9C43A99B5F71672FF6F0A24B444D0736D04D38A1A1322DAF6CDD88C9D");
156 }
157
158 if(name == "dsa/botan/2048")
159 {
160 return load_DL_group_info(" ",
161 "0x8CD7D450F86F0AD94EEE4CE469A8756D1EBD1058241943EAFFB0B354585E924D",
162 " ");
163 }
164
165 if(name == "dsa/botan/3072")
166 {
167 return load_DL_group_info(" ",
168 "0xB3EBD364EC69EF8CF3BAF643B75734B16339B2E49E5CDE1B59C1E9FB40EE0C5B",
169 " ");
170 }
171
172 return std::shared_ptr<DL_Group_Data>();
173 }
name
std::string name
Definition: commoncrypto_hash.cpp:23

size_t Botan::DL_Group::estimated_strength | ( |  | ) | const

Return an estimate of the strength of this group against discrete logarithm attacks (eg NFS). Warning: since this only takes into account known attacks it is by necessity an overestimate of the actual strength.

Definition at line 458 of file dl_group.cpp.

Referenced by Botan::DL_Scheme_PublicKey::estimated_strength().

459 {
460 return data().estimated_strength();
461 }

size_t Botan::DL_Group::exponent_bits | ( |  | ) | const

Return size in bits of a secret exponent

This attempts to balance between the attack costs of NFS (which depends on the size of the modulus) and Pollard's rho (which depends on the size of the exponent).

It may vary over time for a particular group, if the attack costs change.

Definition at line 463 of file dl_group.cpp.

Referenced by Botan::DH_PrivateKey::DH_PrivateKey(), Botan::ElGamal_PrivateKey::ElGamal_PrivateKey(), Botan::srp6_client_agree(), and Botan::SRP6_Server_Session::step1().

464 {
465 return data().exponent_bits();
466 }

const BigInt & Botan::DL_Group::get_g | ( |  | ) | const

Get the base g.

Returns
  base g

Definition at line 418 of file dl_group.cpp.

Referenced by DER_encode(), multi_exponentiate(), Botan::TLS::Server_Key_Exchange::Server_Key_Exchange(), Botan::srp6_client_agree(), Botan::SRP6_Server_Session::step1(), and verify_group().

419 {
420 return data().g();
421 }

const BigInt & Botan::DL_Group::get_p | ( |  | ) | const

Get the prime p.

Returns
  prime p

Definition at line 410 of file dl_group.cpp.

Referenced by DER_encode(), inverse_mod_p(), Botan::TLS::Server_Key_Exchange::Server_Key_Exchange(), Botan::srp6_client_agree(), Botan::SRP6_Server_Session::step1(), verify_element_pair(), verify_group(), and verify_public_element().

411 {
412 return data().p();
413 }

const BigInt & Botan::DL_Group::get_q | ( |  | ) | const

Get the prime q, returns zero if q is not used

Returns
  prime q

Definition at line 426 of file dl_group.cpp.

Referenced by DER_encode(), inverse_mod_q(), PEM_for_named_group(), verify_group(), and verify_public_element().

427 {
428 return data().q();
429 }

BigInt Botan::DL_Group::inverse_mod_p | ( | const BigInt & | x | ) | const

Return the inverse of x mod p

Definition at line 468 of file dl_group.cpp.

References get_p(), and Botan::inverse_mod().

469 {
470 // precompute??
471 return inverse_mod(x, get_p());
472 }
Botan::DL_Group::get_p
const BigInt & get_p() const
Definition: dl_group.cpp:410
Botan::inverse_mod
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: numthry.cpp:325

BigInt Botan::DL_Group::inverse_mod_q | ( | const BigInt & | x | ) | const

Return the inverse of x mod q Throws if q is unset on this DL_Group

Definition at line 484 of file dl_group.cpp.

References get_q(), and Botan::inverse_mod().

485 {
486 data().assert_q_is_set("inverse_mod_q");
487 // precompute??
488 return inverse_mod(x, get_q());
489 }
Botan::DL_Group::get_q
const BigInt & get_q() const
Definition: dl_group.cpp:426
Botan::inverse_mod
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: numthry.cpp:325

BigInt Botan::DL_Group::mod_p | ( | const BigInt & | x | ) | const

Reduce an integer modulo p

Returns
  x % p

Definition at line 474 of file dl_group.cpp.

Referenced by Botan::srp6_client_agree(), and Botan::SRP6_Server_Session::step1().

475 {
476 return data().mod_p(x);
477 }

BigInt Botan::DL_Group::mod_q | ( | const BigInt & | x | ) | const

Reduce an integer modulo q Throws if q is unset on this DL_Group

Returns
  x % q

Definition at line 491 of file dl_group.cpp.

492 {
493 data().assert_q_is_set("mod_q");
494 return data().mod_q(x);
495 }

std::shared_ptr< const Montgomery_Params > Botan::DL_Group::monty_params_p | ( |  | ) | const

Return parameters for Montgomery reduction/exponentiation mod p

Definition at line 431 of file dl_group.cpp.

Referenced by multi_exponentiate().

432 {
433 return data().monty_params_p();
434 }

BigInt Botan::DL_Group::multi_exponentiate | ( | const BigInt & | x,
|  | const BigInt & | y,
|  | const BigInt & | z
| ) |  | const

Multi-exponentiate Return (g^x * y^z) % p

Definition at line 515 of file dl_group.cpp.

References get_g(), Botan::monty_multi_exp(), and monty_params_p().

516 {
517 return monty_multi_exp(data().monty_params_p(), get_g(), x, y, z);
518 }
Botan::DL_Group::monty_params_p
std::shared_ptr< const Montgomery_Params > monty_params_p() const
Definition: dl_group.cpp:431
Botan::monty_multi_exp
BigInt monty_multi_exp(std::shared_ptr< const Montgomery_Params > params_p, const BigInt &x_bn, const BigInt &z1, const BigInt &y_bn, const BigInt &z2)
Definition: monty_exp.cpp:177
Botan::DL_Group::get_g
const BigInt & get_g() const
Definition: dl_group.cpp:418

BigInt Botan::DL_Group::multiply_mod_p | ( | const BigInt & | x,
|  | const BigInt & | y
| ) |  | const

Multiply and reduce an integer modulo p

Returns
  (x*y) % p

Definition at line 479 of file dl_group.cpp.

480 {
481 return data().multiply_mod_p(x, y);
482 }

BigInt Botan::DL_Group::multiply_mod_q | ( | const BigInt & | x,
|  | const BigInt & | y
| ) |  | const

Multiply and reduce an integer modulo q Throws if q is unset on this DL_Group

Returns
  (x*y) % q

Definition at line 497 of file dl_group.cpp.

Referenced by multiply_mod_q().

498 {
499 data().assert_q_is_set("multiply_mod_q");
500 return data().multiply_mod_q(x, y);
501 }

BigInt Botan::DL_Group::multiply_mod_q | ( | const BigInt & | x,
|  | const BigInt & | y,
|  | const BigInt & | z
| ) |  | const

Multiply and reduce an integer modulo q Throws if q is unset on this DL_Group

Returns
  (x*y*z) % q

Definition at line 503 of file dl_group.cpp.

References multiply_mod_q().

504 {
505 data().assert_q_is_set("multiply_mod_q");
506 return data().multiply_mod_q(data().multiply_mod_q(x, y), z);
507 }
Botan::DL_Group::multiply_mod_q
BigInt multiply_mod_q(const BigInt &x, const BigInt &y) const
Definition: dl_group.cpp:497

size_t Botan::DL_Group::p_bits | ( |  | ) | const

Return the size of p in bits Same as get_p().bits()

Definition at line 436 of file dl_group.cpp.

Referenced by Botan::DH_PrivateKey::DH_PrivateKey(), Botan::ElGamal_PrivateKey::ElGamal_PrivateKey(), and Botan::DL_Scheme_PublicKey::key_length().

437 {
438 return data().p_bits();
439 }

size_t Botan::DL_Group::p_bytes | ( |  | ) | const

Return the size of p in bytes Same as get_p().bytes()

Definition at line 441 of file dl_group.cpp.

Referenced by Botan::srp6_client_agree().

442 {
443 return data().p_bytes();
444 }

void Botan::DL_Group::PEM_decode | ( | const std::string & | pem | ) |

Decode a PEM encoded group into this instance.

Parameters

  pem | the PEM encoding of the group

Definition at line 600 of file dl_group.cpp.

References Botan::PEM_Code::decode(), and Botan::unlock().

601 {
602 std::string label;
603 const std::vector<uint8_t> ber = unlock(PEM_Code::decode(pem, label));
604 Format format = pem_label_to_dl_format(label);
605
606 m_data = BER_decode_DL_group(ber.data(), ber.size(), format);
607 }
Botan::DL_Group::Format
Format
Definition: dl_group.h:34
Botan::PEM_Code::decode
secure_vector< uint8_t > decode(DataSource &source, std::string &label)
Definition: pem.cpp:68
Botan::unlock
std::vector< T > unlock(const secure_vector< T > &in)
Definition: secmem.h:72

std::string Botan::DL_Group::PEM_encode | ( | Format | format | ) | const

Encode this group into a string using PEM encoding.

Parameters

  format | the encoding format

Returns
  string holding the PEM encoded group

Definition at line 573 of file dl_group.cpp.

References ANSI_X9_42, ANSI_X9_57, DER_encode(), Botan::PEM_Code::encode(), PKCS_3, and Botan::ASN1::to_string().

Referenced by PEM_for_named_group().

574 {
575 const std::vector<uint8_t> encoding = DER_encode(format);
576
577 if(format == PKCS_3)
578 return PEM_Code::encode(encoding, "DH PARAMETERS");
579 else if(format == ANSI_X9_57)
580 return PEM_Code::encode(encoding, "DSA PARAMETERS");
581 else if(format == ANSI_X9_42)
582 return PEM_Code::encode(encoding, "X9.42 DH PARAMETERS");
583 else
584 throw Invalid_Argument("Unknown DL_Group encoding " + std::to_string(format));
585 }
Botan::DL_Group::PKCS_3
Definition: dl_group.h:37
Botan::DL_Group::ANSI_X9_57
Definition: dl_group.h:36
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213
Botan::DL_Group::DER_encode
std::vector< uint8_t > DER_encode(Format format) const
Definition: dl_group.cpp:533
Botan::PEM_Code::encode
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
Botan::DL_Group::ANSI_X9_42
Definition: dl_group.h:35

std::string Botan::DL_Group::PEM_for_named_group | ( | const std::string & | name | ) |
| static

Return PEM representation of named DL group

Definition at line 610 of file dl_group.cpp.

References ANSI_X9_42, get_q(), Botan::BigInt::is_zero(), PEM_encode(), and PKCS_3.

611 {
612 DL_Group group(name);
613 DL_Group::Format format = group.get_q().is_zero() ? DL_Group::PKCS_3 : DL_Group::ANSI_X9_42;
614 return group.PEM_encode(format);
615 }
Botan::DL_Group::PKCS_3
Definition: dl_group.h:37
name
std::string name
Definition: commoncrypto_hash.cpp:23
Botan::DL_Group::Format
Format
Definition: dl_group.h:34
Botan::DL_Group::DL_Group
DL_Group()=default
Botan::DL_Group::ANSI_X9_42
Definition: dl_group.h:35

BigInt Botan::DL_Group::power_g_p | ( | const BigInt & | x | ) | const

Modular exponentiation

Warning
  this function leaks the size of x via the number of loop iterations. Use the version taking the maximum size to avoid this.

Returns
  (g^x) % p

Definition at line 520 of file dl_group.cpp.

References Botan::BigInt::bits().

Referenced by Botan::DH_PrivateKey::DH_PrivateKey(), Botan::DSA_PrivateKey::DSA_PrivateKey(), Botan::ElGamal_PrivateKey::ElGamal_PrivateKey(), Botan::generate_srp6_verifier(), Botan::srp6_client_agree(), Botan::SRP6_Server_Session::step1(), verify_element_pair(), and verify_group().

521 {
522 return data().power_g_p(x, x.bits());
523 }

BigInt Botan::DL_Group::power_g_p | ( | const BigInt & | x,
|  | size_t | max_x_bits
| ) |  | const

Modular exponentiation

Parameters

  x | the exponent
  max_x_bits | x is assumed to be at most this many bits long.

Returns
  (g^x) % p

Definition at line 525 of file dl_group.cpp.

526 {
527 return data().power_g_p(x, max_x_bits);
528 }

size_t Botan::DL_Group::q_bits | ( |  | ) | const

Return the size of q in bits Same as get_q().bits() Throws if q is unset

Definition at line 446 of file dl_group.cpp.

Referenced by Botan::DSA_PrivateKey::DSA_PrivateKey().

447 {
448 data().assert_q_is_set("q_bits");
449 return data().q_bits();
450 }

size_t Botan::DL_Group::q_bytes | ( |  | ) | const

Return the size of q in bytes Same as get_q().bytes() Throws if q is unset

Definition at line 452 of file dl_group.cpp.

453 {
454 data().assert_q_is_set("q_bytes");
455 return data().q_bytes();
456 }

BigInt Botan::DL_Group::square_mod_q | ( | const BigInt & | x | ) | const

Square and reduce an integer modulo q Throws if q is unset on this DL_Group

Returns
  (x*x) % q

Definition at line 509 of file dl_group.cpp.

510 {
511 data().assert_q_is_set("square_mod_q");
512 return data().square_mod_q(x);
513 }

bool Botan::DL_Group::verify_element_pair | ( | const BigInt & | y,
|  | const BigInt & | x
| ) |  | const

Verify a pair of elements y = g^x

This verifies that 1 < x,y < p and that y=g^x mod p

Definition at line 356 of file dl_group.cpp.

References get_p(), and power_g_p().

Referenced by Botan::DL_Scheme_PrivateKey::check_key().

357 {
358 const BigInt& p = get_p();
359
360 if(y <= 1 || y >= p || x <= 1 || x >= p)
361 return false;
362
363 if(y != power_g_p(x))
364 return false;
365
366 return true;
367 }
Botan::DL_Group::get_p
const BigInt & get_p() const
Definition: dl_group.cpp:410
Botan::DL_Group::power_g_p
BigInt power_g_p(const BigInt &x) const
Definition: dl_group.cpp:520

bool Botan::DL_Group::verify_group | ( | RandomNumberGenerator & | rng,
|  | bool | strong = `true`
| ) |  | const

Perform validity checks on the group.

Parameters

  rng | the rng to use
  strong | whether to perform stronger by lengthier tests

Returns
  true if the object is consistent, false otherwise

Definition at line 372 of file dl_group.cpp.

References get_g(), get_p(), get_q(), Botan::is_prime(), and power_g_p().

Referenced by Botan::DL_Scheme_PublicKey::check_key(), Botan::DL_Scheme_PrivateKey::check_key(), and Botan::TLS::Callbacks::tls_dh_agree().

374 {
375 const BigInt& p = get_p();
376 const BigInt& q = get_q();
377 const BigInt& g = get_g();
378
379 if(g < 2 || p < 3 || q < 0)
380 return false;
381
382 const size_t prob = (strong) ? 128 : 10;
383
384 if(q != 0)
385 {
386 if((p - 1) % q != 0)
387 {
388 return false;
389 }
390 if(this->power_g_p(q) != 1)
391 {
392 return false;
393 }
394 if(!is_prime(q, rng, prob))
395 {
396 return false;
397 }
398 }
399
400 if(!is_prime(p, rng, prob))
401 {
402 return false;
403 }
404 return true;
405 }
Botan::is_prime
bool is_prime(const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
Definition: numthry.cpp:528
Botan::DL_Group::get_q
const BigInt & get_q() const
Definition: dl_group.cpp:426
Botan::DL_Group::get_p
const BigInt & get_p() const
Definition: dl_group.cpp:410
Botan::DL_Group::get_g
const BigInt & get_g() const
Definition: dl_group.cpp:418
Botan::DL_Group::power_g_p
BigInt power_g_p(const BigInt &x) const
Definition: dl_group.cpp:520

bool Botan::DL_Group::verify_public_element | ( | const BigInt & | y | ) | const

Verify a public element, ie check if y = g^x for some x.

This is not a perfect test. It verifies that 1 < y < p and (if q is set) that y is in the subgroup of size q.

Definition at line 339 of file dl_group.cpp.

References get_p(), get_q(), Botan::BigInt::is_zero(), and Botan::power_mod().

Referenced by Botan::DL_Scheme_PublicKey::check_key().

340 {
341 const BigInt& p = get_p();
342 const BigInt& q = get_q();
343
344 if(y <= 1 || y >= p)
345 return false;
346
347 if(q.is_zero() == false)
348 {
349 if(power_mod(y, q, p) != 1)
350 return false;
351 }
352
353 return true;
354 }
Botan::power_mod
BigInt power_mod(const BigInt &base, const BigInt &exp, const BigInt &mod)
Definition: numthry.cpp:451
Botan::DL_Group::get_q
const BigInt & get_q() const
Definition: dl_group.cpp:426
Botan::DL_Group::get_p
const BigInt & get_p() const
Definition: dl_group.cpp:410

The documentation for this class was generated from the following files:

- src/lib/pubkey/dl_group/dl_group.h
- src/lib/pubkey/dl_group/dl_group.cpp
- src/lib/pubkey/dl_group/dl_named.cpp