static ECIES_HMAC_TYPE makeHMAC (const ECIES_HMAC_KEY_TYPE& secret, Blob const& data) { HMAC_CTX ctx; HMAC_CTX_init (&ctx); if (HMAC_Init_ex (&ctx, secret.begin (), ECIES_HMAC_KEY_SIZE, ECIES_HMAC_ALGO, nullptr) != 1) { HMAC_CTX_cleanup (&ctx); throw std::runtime_error ("init hmac"); } if (HMAC_Update (&ctx, & (data.front ()), data.size ()) != 1) { HMAC_CTX_cleanup (&ctx); throw std::runtime_error ("update hmac"); } ECIES_HMAC_TYPE ret; unsigned int ml = ECIES_HMAC_SIZE; if (HMAC_Final (&ctx, ret.begin (), &ml) != 1) { HMAC_CTX_cleanup (&ctx); throw std::runtime_error ("finalize hmac"); } assert (ml == ECIES_HMAC_SIZE); HMAC_CTX_cleanup (&ctx); return ret; }
// returns a 32-byte secret unique to these two keys. At least one private key must be known. static void getECIESSecret (const openssl::ec_key& secretKey, const openssl::ec_key& publicKey, ECIES_ENC_KEY_TYPE& enc_key, ECIES_HMAC_KEY_TYPE& hmac_key) { EC_KEY* privkey = (EC_KEY*) secretKey.get(); EC_KEY* pubkey = (EC_KEY*) publicKey.get(); // Retrieve a secret generated from an EC key pair. At least one private key must be known. if (privkey == nullptr || pubkey == nullptr) throw std::runtime_error ("missing key"); if (! EC_KEY_get0_private_key (privkey)) { throw std::runtime_error ("not a private key"); } unsigned char rawbuf[512]; int buflen = ECDH_compute_key (rawbuf, 512, EC_KEY_get0_public_key (pubkey), privkey, nullptr); if (buflen < ECIES_MIN_SEC) throw std::runtime_error ("ecdh key failed"); unsigned char hbuf[ECIES_KEY_LENGTH]; ECIES_KEY_HASH (rawbuf, buflen, hbuf); memset (rawbuf, 0, ECIES_HMAC_KEY_SIZE); assert ((ECIES_ENC_KEY_SIZE + ECIES_HMAC_KEY_SIZE) >= ECIES_KEY_LENGTH); memcpy (enc_key.begin (), hbuf, ECIES_ENC_KEY_SIZE); memcpy (hmac_key.begin (), hbuf + ECIES_ENC_KEY_SIZE, ECIES_HMAC_KEY_SIZE); memset (hbuf, 0, ECIES_KEY_LENGTH); }
void CKey::getECIESSecret (CKey& otherKey, ECIES_ENC_KEY_TYPE& enc_key, ECIES_HMAC_KEY_TYPE& hmac_key) { // Retrieve a secret generated from an EC key pair. At least one private key must be known. if (!pkey || !otherKey.pkey) throw std::runtime_error ("missing key"); EC_KEY* pubkey, *privkey; if (EC_KEY_get0_private_key (pkey)) { privkey = pkey; pubkey = otherKey.pkey; } else if (EC_KEY_get0_private_key (otherKey.pkey)) { privkey = otherKey.pkey; pubkey = pkey; } else throw std::runtime_error ("no private key"); unsigned char rawbuf[512]; int buflen = ECDH_compute_key (rawbuf, 512, EC_KEY_get0_public_key (pubkey), privkey, NULL); if (buflen < ECIES_MIN_SEC) throw std::runtime_error ("ecdh key failed"); unsigned char hbuf[ECIES_KEY_LENGTH]; ECIES_KEY_HASH (rawbuf, buflen, hbuf); memset (rawbuf, 0, ECIES_HMAC_KEY_SIZE); assert ((ECIES_ENC_KEY_SIZE + ECIES_HMAC_KEY_SIZE) >= ECIES_KEY_LENGTH); memcpy (enc_key.begin (), hbuf, ECIES_ENC_KEY_SIZE); memcpy (hmac_key.begin (), hbuf + ECIES_ENC_KEY_SIZE, ECIES_HMAC_KEY_SIZE); memset (hbuf, 0, ECIES_KEY_LENGTH); }
Blob decryptECIES (const openssl::ec_key& secretKey, const openssl::ec_key& publicKey, Blob const& ciphertext) { // minimum ciphertext = IV + HMAC + 1 block if (ciphertext.size () < ((2 * ECIES_ENC_BLK_SIZE) + ECIES_HMAC_SIZE) ) throw std::runtime_error ("ciphertext too short"); // extract IV ECIES_ENC_IV_TYPE iv; memcpy (iv.begin (), & (ciphertext.front ()), ECIES_ENC_BLK_SIZE); // begin decrypting EVP_CIPHER_CTX ctx; EVP_CIPHER_CTX_init (&ctx); ECIES_ENC_KEY_TYPE secret; ECIES_HMAC_KEY_TYPE hmacKey; getECIESSecret (secretKey, publicKey, secret, hmacKey); if (EVP_DecryptInit_ex (&ctx, ECIES_ENC_ALGO, nullptr, secret.begin (), iv.begin ()) != 1) { secret.zero (); hmacKey.zero (); EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error ("unable to init cipher"); } // decrypt mac ECIES_HMAC_TYPE hmac; int outlen = ECIES_HMAC_SIZE; if ( (EVP_DecryptUpdate (&ctx, hmac.begin (), &outlen, & (ciphertext.front ()) + ECIES_ENC_BLK_SIZE, ECIES_HMAC_SIZE + 1) != 1) || (outlen != ECIES_HMAC_SIZE) ) { secret.zero (); hmacKey.zero (); EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error ("unable to extract hmac"); } // decrypt plaintext (after IV and encrypted mac) Blob plaintext (ciphertext.size () - ECIES_HMAC_SIZE - ECIES_ENC_BLK_SIZE); outlen = plaintext.size (); if (EVP_DecryptUpdate (&ctx, & (plaintext.front ()), &outlen, & (ciphertext.front ()) + ECIES_ENC_BLK_SIZE + ECIES_HMAC_SIZE + 1, ciphertext.size () - ECIES_ENC_BLK_SIZE - ECIES_HMAC_SIZE - 1) != 1) { secret.zero (); hmacKey.zero (); EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error ("unable to extract plaintext"); } // decrypt padding int flen = 0; if (EVP_DecryptFinal (&ctx, & (plaintext.front ()) + outlen, &flen) != 1) { secret.zero (); hmacKey.zero (); EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error ("plaintext had bad padding"); } plaintext.resize (flen + outlen); // verify integrity if (hmac != makeHMAC (hmacKey, plaintext)) { secret.zero (); hmacKey.zero (); EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error ("plaintext had bad hmac"); } secret.zero (); hmacKey.zero (); EVP_CIPHER_CTX_cleanup (&ctx); return plaintext; }
Blob encryptECIES (const openssl::ec_key& secretKey, const openssl::ec_key& publicKey, Blob const& plaintext) { ECIES_ENC_IV_TYPE iv; random_fill (iv.begin (), ECIES_ENC_BLK_SIZE); ECIES_ENC_KEY_TYPE secret; ECIES_HMAC_KEY_TYPE hmacKey; getECIESSecret (secretKey, publicKey, secret, hmacKey); ECIES_HMAC_TYPE hmac = makeHMAC (hmacKey, plaintext); hmacKey.zero (); EVP_CIPHER_CTX ctx; EVP_CIPHER_CTX_init (&ctx); if (EVP_EncryptInit_ex (&ctx, ECIES_ENC_ALGO, nullptr, secret.begin (), iv.begin ()) != 1) { EVP_CIPHER_CTX_cleanup (&ctx); secret.zero (); throw std::runtime_error ("init cipher ctx"); } secret.zero (); Blob out (plaintext.size () + ECIES_HMAC_SIZE + ECIES_ENC_KEY_SIZE + ECIES_ENC_BLK_SIZE, 0); int len = 0, bytesWritten; // output IV memcpy (& (out.front ()), iv.begin (), ECIES_ENC_BLK_SIZE); len = ECIES_ENC_BLK_SIZE; // Encrypt/output HMAC bytesWritten = out.capacity () - len; assert (bytesWritten > 0); if (EVP_EncryptUpdate (&ctx, & (out.front ()) + len, &bytesWritten, hmac.begin (), ECIES_HMAC_SIZE) < 0) { EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error (""); } len += bytesWritten; // encrypt/output plaintext bytesWritten = out.capacity () - len; assert (bytesWritten > 0); if (EVP_EncryptUpdate (&ctx, & (out.front ()) + len, &bytesWritten, & (plaintext.front ()), plaintext.size ()) < 0) { EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error (""); } len += bytesWritten; // finalize bytesWritten = out.capacity () - len; if (EVP_EncryptFinal_ex (&ctx, & (out.front ()) + len, &bytesWritten) < 0) { EVP_CIPHER_CTX_cleanup (&ctx); throw std::runtime_error ("encryption error"); } len += bytesWritten; // Output contains: IV, encrypted HMAC, encrypted data, encrypted padding assert (len <= (plaintext.size () + ECIES_HMAC_SIZE + (2 * ECIES_ENC_BLK_SIZE))); assert (len >= (plaintext.size () + ECIES_HMAC_SIZE + ECIES_ENC_BLK_SIZE)); // IV, HMAC, data out.resize (len); EVP_CIPHER_CTX_cleanup (&ctx); return out; }