mirror of git://gcc.gnu.org/git/gcc.git
307 lines
13 KiB
Java
307 lines
13 KiB
Java
/* ICMGenerator.java --
|
|
Copyright (C) 2001, 2002, 2006 Free Software Foundation, Inc.
|
|
|
|
This file is a part of GNU Classpath.
|
|
|
|
GNU Classpath is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or (at
|
|
your option) any later version.
|
|
|
|
GNU Classpath is distributed in the hope that it will be useful, but
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with GNU Classpath; if not, write to the Free Software
|
|
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301
|
|
USA
|
|
|
|
Linking this library statically or dynamically with other modules is
|
|
making a combined work based on this library. Thus, the terms and
|
|
conditions of the GNU General Public License cover the whole
|
|
combination.
|
|
|
|
As a special exception, the copyright holders of this library give you
|
|
permission to link this library with independent modules to produce an
|
|
executable, regardless of the license terms of these independent
|
|
modules, and to copy and distribute the resulting executable under
|
|
terms of your choice, provided that you also meet, for each linked
|
|
independent module, the terms and conditions of the license of that
|
|
module. An independent module is a module which is not derived from
|
|
or based on this library. If you modify this library, you may extend
|
|
this exception to your version of the library, but you are not
|
|
obligated to do so. If you do not wish to do so, delete this
|
|
exception statement from your version. */
|
|
|
|
|
|
package gnu.javax.crypto.prng;
|
|
|
|
import gnu.java.security.Registry;
|
|
import gnu.java.security.prng.BasePRNG;
|
|
import gnu.java.security.prng.LimitReachedException;
|
|
import gnu.javax.crypto.cipher.CipherFactory;
|
|
import gnu.javax.crypto.cipher.IBlockCipher;
|
|
|
|
import java.math.BigInteger;
|
|
import java.security.InvalidKeyException;
|
|
import java.util.HashMap;
|
|
import java.util.Map;
|
|
|
|
/**
|
|
* Counter Mode is a way to define a pseudorandom keystream generator using a
|
|
* block cipher. The keystream can be used for additive encryption, key
|
|
* derivation, or any other application requiring pseudorandom data.
|
|
* <p>
|
|
* In ICM, the keystream is logically broken into segments. Each segment is
|
|
* identified with a segment index, and the segments have equal lengths. This
|
|
* segmentation makes ICM especially appropriate for securing packet-based
|
|
* protocols.
|
|
* <p>
|
|
* This implementation adheres to the definition of the ICM keystream generation
|
|
* function that allows for any symetric key block cipher algorithm
|
|
* (initialisation parameter <code>gnu.crypto.prng.icm.cipher.name</code>
|
|
* taken to be an instance of {@link java.lang.String}) to be used. If such a
|
|
* parameter is not defined/included in the initialisation <code>Map</code>,
|
|
* then the "Rijndael" algorithm is used. Furthermore, if the initialisation
|
|
* parameter <code>gnu.crypto.cipher.block.size</code> (taken to be a instance
|
|
* of {@link java.lang.Integer}) is missing or undefined in the initialisation
|
|
* <code>Map</code>, then the cipher's <em>default</em> block size is used.
|
|
* <p>
|
|
* The practical limits and constraints of such generator are:
|
|
* <ul>
|
|
* <li>The number of blocks in any segment <b>MUST NOT</b> exceed <code>
|
|
* 256 ** BLOCK_INDEX_LENGTH</code>.
|
|
* The number of segments <b>MUST NOT</b> exceed
|
|
* <code>256 ** SEGMENT_INDEX_LENGTH</code>. These restrictions ensure the
|
|
* uniqueness of each block cipher input.</li>
|
|
* <li>Each segment contains <code>SEGMENT_LENGTH</code> octets; this value
|
|
* <b>MUST NOT</b> exceed the value <code>(256 ** BLOCK_INDEX_LENGTH) *
|
|
* BLOCK_LENGTH</code>.</li>
|
|
* <li>The sum of <code>SEGMENT_INDEX_LENGTH</code> and
|
|
* <code>BLOCK_INDEX_LENGTH</code> <b>MUST NOT</b> exceed <code>BLOCK_LENGTH
|
|
* / 2</code>.
|
|
* This requirement protects the ICM keystream generator from potentially
|
|
* failing to be pseudorandom.</li>
|
|
* </ul>
|
|
* <p>
|
|
* <b>NOTE</b>: Rijndael is used as the default symmetric key block cipher
|
|
* algorithm because, with its default block and key sizes, it is the AES. Yet
|
|
* being Rijndael, the algorithm offers more versatile block and key sizes which
|
|
* may prove to be useful for generating <em>longer</em> key streams.
|
|
* <p>
|
|
* References:
|
|
* <ol>
|
|
* <li><a
|
|
* href="http://www.ietf.org/internet-drafts/draft-mcgrew-saag-icm-00.txt">
|
|
* Integer Counter Mode</a>, David A. McGrew.</li>
|
|
* </ol>
|
|
*/
|
|
public class ICMGenerator
|
|
extends BasePRNG
|
|
implements Cloneable
|
|
{
|
|
/** Property name of underlying block cipher for this ICM generator. */
|
|
public static final String CIPHER = "gnu.crypto.prng.icm.cipher.name";
|
|
/** Property name of ICM's block index length. */
|
|
public static final String BLOCK_INDEX_LENGTH =
|
|
"gnu.crypto.prng.icm.block.index.length";
|
|
/** Property name of ICM's segment index length. */
|
|
public static final String SEGMENT_INDEX_LENGTH =
|
|
"gnu.crypto.prng.icm.segment.index.length";
|
|
/** Property name of ICM's offset. */
|
|
public static final String OFFSET = "gnu.crypto.prng.icm.offset";
|
|
/** Property name of ICM's segment index. */
|
|
public static final String SEGMENT_INDEX = "gnu.crypto.prng.icm.segment.index";
|
|
/** The integer value 256 as a BigInteger. */
|
|
private static final BigInteger TWO_FIFTY_SIX = new BigInteger("256");
|
|
/** The underlying cipher implementation. */
|
|
private IBlockCipher cipher;
|
|
/** This keystream block index length in bytes. */
|
|
private int blockNdxLength = -1;
|
|
/** This keystream segment index length in bytes. */
|
|
private int segmentNdxLength = -1;
|
|
/** The index of the next block for a given keystream segment. */
|
|
private BigInteger blockNdx = BigInteger.ZERO;
|
|
/** The segment index for this keystream. */
|
|
private BigInteger segmentNdx;
|
|
/** The initial counter for a given keystream segment. */
|
|
private BigInteger C0;
|
|
|
|
/** Trivial 0-arguments constructor. */
|
|
public ICMGenerator()
|
|
{
|
|
super(Registry.ICM_PRNG);
|
|
}
|
|
|
|
// Conceptually, ICM is a keystream generator that takes a secret key and a
|
|
// segment index as an input and then outputs a keystream segment. The
|
|
// segmentation lends itself to packet encryption, as each keystream segment
|
|
// can be used to encrypt a distinct packet.
|
|
//
|
|
// An ICM key consists of the block cipher key and an Offset. The Offset is
|
|
// an integer with BLOCK_LENGTH octets...
|
|
public void setup(Map attributes)
|
|
{
|
|
// find out which cipher algorithm to use
|
|
boolean newCipher = true;
|
|
String underlyingCipher = (String) attributes.get(CIPHER);
|
|
if (underlyingCipher == null)
|
|
if (cipher == null) // happy birthday
|
|
// ensure we have a reliable implementation of this cipher
|
|
cipher = CipherFactory.getInstance(Registry.RIJNDAEL_CIPHER);
|
|
else
|
|
// we already have one. use it as is
|
|
newCipher = false;
|
|
else // ensure we have a reliable implementation of this cipher
|
|
cipher = CipherFactory.getInstance(underlyingCipher);
|
|
|
|
// find out what block size we should use it in
|
|
int cipherBlockSize = 0;
|
|
Integer bs = (Integer) attributes.get(IBlockCipher.CIPHER_BLOCK_SIZE);
|
|
if (bs != null)
|
|
cipherBlockSize = bs.intValue();
|
|
else
|
|
{
|
|
if (newCipher) // assume we'll use its default block size
|
|
cipherBlockSize = cipher.defaultBlockSize();
|
|
// else use as is
|
|
}
|
|
// get the key material
|
|
byte[] key = (byte[]) attributes.get(IBlockCipher.KEY_MATERIAL);
|
|
if (key == null)
|
|
throw new IllegalArgumentException(IBlockCipher.KEY_MATERIAL);
|
|
// now initialise the cipher
|
|
HashMap map = new HashMap();
|
|
if (cipherBlockSize != 0) // only needed if new or changed
|
|
map.put(IBlockCipher.CIPHER_BLOCK_SIZE, Integer.valueOf(cipherBlockSize));
|
|
map.put(IBlockCipher.KEY_MATERIAL, key);
|
|
try
|
|
{
|
|
cipher.init(map);
|
|
}
|
|
catch (InvalidKeyException x)
|
|
{
|
|
throw new IllegalArgumentException(IBlockCipher.KEY_MATERIAL);
|
|
}
|
|
// at this point we have an initialised (new or otherwise) cipher
|
|
// ensure that remaining params make sense
|
|
cipherBlockSize = cipher.currentBlockSize();
|
|
BigInteger counterRange = TWO_FIFTY_SIX.pow(cipherBlockSize);
|
|
// offset, like the underlying cipher key is not cloneable
|
|
// always look for it and throw an exception if it's not there
|
|
Object obj = attributes.get(OFFSET);
|
|
// allow either a byte[] or a BigInteger
|
|
BigInteger r;
|
|
if (obj instanceof BigInteger)
|
|
r = (BigInteger) obj;
|
|
else // assume byte[]. should be same length as cipher block size
|
|
{
|
|
byte[] offset = (byte[]) obj;
|
|
if (offset.length != cipherBlockSize)
|
|
throw new IllegalArgumentException(OFFSET);
|
|
r = new BigInteger(1, offset);
|
|
}
|
|
int wantBlockNdxLength = -1; // number of octets in the block index
|
|
Integer i = (Integer) attributes.get(BLOCK_INDEX_LENGTH);
|
|
if (i != null)
|
|
{
|
|
wantBlockNdxLength = i.intValue();
|
|
if (wantBlockNdxLength < 1)
|
|
throw new IllegalArgumentException(BLOCK_INDEX_LENGTH);
|
|
}
|
|
int wantSegmentNdxLength = -1; // number of octets in the segment index
|
|
i = (Integer) attributes.get(SEGMENT_INDEX_LENGTH);
|
|
if (i != null)
|
|
{
|
|
wantSegmentNdxLength = i.intValue();
|
|
if (wantSegmentNdxLength < 1)
|
|
throw new IllegalArgumentException(SEGMENT_INDEX_LENGTH);
|
|
}
|
|
// if both are undefined check if it's a reuse
|
|
if ((wantBlockNdxLength == -1) && (wantSegmentNdxLength == -1))
|
|
{
|
|
if (blockNdxLength == -1) // new instance
|
|
throw new IllegalArgumentException(BLOCK_INDEX_LENGTH + ", "
|
|
+ SEGMENT_INDEX_LENGTH);
|
|
// else reuse old values
|
|
}
|
|
else // only one is undefined, set it to BLOCK_LENGTH/2 minus the other
|
|
{
|
|
int limit = cipherBlockSize / 2;
|
|
if (wantBlockNdxLength == -1)
|
|
wantBlockNdxLength = limit - wantSegmentNdxLength;
|
|
else if (wantSegmentNdxLength == -1)
|
|
wantSegmentNdxLength = limit - wantBlockNdxLength;
|
|
else if ((wantSegmentNdxLength + wantBlockNdxLength) > limit)
|
|
throw new IllegalArgumentException(BLOCK_INDEX_LENGTH + ", "
|
|
+ SEGMENT_INDEX_LENGTH);
|
|
// save new values
|
|
blockNdxLength = wantBlockNdxLength;
|
|
segmentNdxLength = wantSegmentNdxLength;
|
|
}
|
|
// get the segment index as a BigInteger
|
|
BigInteger s = (BigInteger) attributes.get(SEGMENT_INDEX);
|
|
if (s == null)
|
|
{
|
|
if (segmentNdx == null) // segment index was never set
|
|
throw new IllegalArgumentException(SEGMENT_INDEX);
|
|
// reuse; check if still valid
|
|
if (segmentNdx.compareTo(TWO_FIFTY_SIX.pow(segmentNdxLength)) > 0)
|
|
throw new IllegalArgumentException(SEGMENT_INDEX);
|
|
}
|
|
else
|
|
{
|
|
if (s.compareTo(TWO_FIFTY_SIX.pow(segmentNdxLength)) > 0)
|
|
throw new IllegalArgumentException(SEGMENT_INDEX);
|
|
segmentNdx = s;
|
|
}
|
|
// The initial counter of the keystream segment with segment index s is
|
|
// defined as follows, where r denotes the Offset:
|
|
//
|
|
// C[0] = (s * (256^BLOCK_INDEX_LENGTH) + r) modulo (256^BLOCK_LENGTH)
|
|
C0 = segmentNdx.multiply(TWO_FIFTY_SIX.pow(blockNdxLength))
|
|
.add(r).modPow(BigInteger.ONE, counterRange);
|
|
try
|
|
{
|
|
fillBlock();
|
|
}
|
|
catch (LimitReachedException impossible)
|
|
{
|
|
throw (InternalError)
|
|
new InternalError().initCause(impossible);
|
|
}
|
|
}
|
|
|
|
public void fillBlock() throws LimitReachedException
|
|
{
|
|
if (C0 == null)
|
|
throw new IllegalStateException();
|
|
if (blockNdx.compareTo(TWO_FIFTY_SIX.pow(blockNdxLength)) >= 0)
|
|
throw new LimitReachedException();
|
|
int cipherBlockSize = cipher.currentBlockSize();
|
|
BigInteger counterRange = TWO_FIFTY_SIX.pow(cipherBlockSize);
|
|
// encrypt the counter for the current blockNdx
|
|
// C[i] = (C[0] + i) modulo (256^BLOCK_LENGTH).
|
|
BigInteger Ci = C0.add(blockNdx).modPow(BigInteger.ONE, counterRange);
|
|
buffer = Ci.toByteArray();
|
|
int limit = buffer.length;
|
|
if (limit < cipherBlockSize)
|
|
{
|
|
byte[] data = new byte[cipherBlockSize];
|
|
System.arraycopy(buffer, 0, data, cipherBlockSize - limit, limit);
|
|
buffer = data;
|
|
}
|
|
else if (limit > cipherBlockSize)
|
|
{
|
|
byte[] data = new byte[cipherBlockSize];
|
|
System.arraycopy(buffer, limit - cipherBlockSize, data, 0,
|
|
cipherBlockSize);
|
|
buffer = data;
|
|
}
|
|
cipher.encryptBlock(buffer, 0, buffer, 0);
|
|
blockNdx = blockNdx.add(BigInteger.ONE); // increment blockNdx
|
|
}
|
|
}
|