def _decapsulate_reencrypted(pub_key: Point,
priv_key: BigNum,
orig_pub_key: Point,
capsule: Capsule,
key_length=32,
params: UmbralParameters = None) -> bytes:
"""Derive the same symmetric key"""
params = params if params is not None else default_params()
xcomp = capsule._point_noninteractive
d = BigNum.hash_to_bn(xcomp, pub_key, priv_key * xcomp, params=params)
e_prime = capsule._point_eph_e_prime
v_prime = capsule._point_eph_v_prime
shared_key = d * (e_prime + v_prime)
key = kdf(shared_key, key_length)
e = capsule._point_eph_e
v = capsule._point_eph_v
s = capsule._bn_sig
h = BigNum.hash_to_bn(e, v, params=params)
inv_d = ~d
if not (s * inv_d) * orig_pub_key == (h * e_prime) + v_prime:
raise GenericUmbralError()
return key
def _check_challenge(capsule: Capsule,
cfrag: CapsuleFrag,
challenge_resp: ChallengeResponse,
pub_a: Point,
pub_b: Point,
challenge_metadata: bytes = None,
params: UmbralParameters = None) -> bool:
params = params if params is not None else default_params()
e = capsule._point_eph_e
v = capsule._point_eph_v
e1 = cfrag.point_eph_e1
v1 = cfrag.point_eph_v1
xcomp = cfrag.point_eph_ni
kfrag_id = cfrag.bn_kfrag_id
e2 = challenge_resp.point_eph_e2
v2 = challenge_resp.point_eph_v2
g = params.g
u = params.u
u1 = challenge_resp.point_kfrag_commitment
u2 = challenge_resp.point_kfrag_pok
z1 = challenge_resp.bn_kfrag_sig1
z2 = challenge_resp.bn_kfrag_sig2
z3 = challenge_resp.bn_sig
g_y = (z2 * g) + (z1 * pub_a)
hash_input = [e, e1, e2, v, v1, v2, u, u1, u2]
if challenge_metadata is not None:
hash_input.append(challenge_metadata)
h = BigNum.hash_to_bn(*hash_input, params=params)
check31 = z1 == BigNum.hash_to_bn(g_y,
kfrag_id,
pub_a,
pub_b,
u1,
xcomp,
params=params)
check32 = z3 * e == e2 + (h * e1)
check33 = z3 * u == u2 + (h * u1)
check34 = z3 * v == v2 + (h * v1)
return check31 & check32 & check33 & check34
def _reconstruct_shamirs_secret(self,
pub_a: Union[UmbralPublicKey, Point],
priv_b: Union[UmbralPrivateKey, BigNum],
params: UmbralParameters = None) -> None:
params = params if params is not None else default_params()
if isinstance(priv_b, UmbralPrivateKey):
priv_b = priv_b.bn_key
if isinstance(pub_a, UmbralPublicKey):
pub_a = pub_a.point_key
g = params.g
pub_b = priv_b * g
g_ab = priv_b * pub_a
blake2b = hashes.Hash(hashes.BLAKE2b(64), backend=backend)
blake2b.update(pub_a.to_bytes())
blake2b.update(pub_b.to_bytes())
blake2b.update(g_ab.to_bytes())
hashed_dh_tuple = blake2b.finalize()
id_cfrag_pairs = list(self._attached_cfrags.items())
id_0, cfrag_0 = id_cfrag_pairs[0]
x_0 = BigNum.hash_to_bn(id_0, hashed_dh_tuple, params=params)
if len(id_cfrag_pairs) > 1:
xs = [
BigNum.hash_to_bn(_id, hashed_dh_tuple, params=params)
for _id in self._attached_cfrags.keys()
]
lambda_0 = lambda_coeff(x_0, xs)
e = lambda_0 * cfrag_0.point_eph_e1
v = lambda_0 * cfrag_0.point_eph_v1
for id_i, cfrag in id_cfrag_pairs[1:]:
x_i = BigNum.hash_to_bn(id_i, hashed_dh_tuple, params=params)
lambda_i = lambda_coeff(x_i, xs)
e = e + (lambda_i * cfrag.point_eph_e1)
v = v + (lambda_i * cfrag.point_eph_v1)
else:
e = cfrag_0.point_eph_e1
v = cfrag_0.point_eph_v1
self._point_eph_e_prime = e
self._point_eph_v_prime = v
self._point_noninteractive = cfrag_0.point_eph_ni
def verify(self, params: UmbralParameters = None) -> bool:
params = params if params is not None else default_params()
e = self._point_eph_e
v = self._point_eph_v
s = self._bn_sig
h = BigNum.hash_to_bn(e, v, params=params)
return s * params.g == v + (h * e)
def derive_privkey_by_label(self,
label: bytes,
salt: bytes = None,
params: UmbralParameters = None):
"""
Derives an UmbralPrivateKey using a KDF from this instance of
UmbralKeyingMaterial, a label, and an optional salt.
"""
params = params if params is not None else default_params()
key_material = HKDF(algorithm=hashes.BLAKE2b(64),
length=64,
salt=salt,
info=b"NuCypherKMS/KeyDerivation/" + label,
backend=default_backend()).derive(
self.keying_material)
bn_key = BigNum.hash_to_bn(key_material, params=params)
return UmbralPrivateKey(bn_key, params)
def _challenge(kfrag: KFrag,
capsule: Capsule,
cfrag: CapsuleFrag,
challenge_metadata: bytes = None,
params: UmbralParameters = None) -> ChallengeResponse:
params = params if params is not None else default_params()
e1 = cfrag.point_eph_e1
v1 = cfrag.point_eph_v1
e = capsule._point_eph_e
v = capsule._point_eph_v
u = params.u
u1 = kfrag.point_commitment
t = BigNum.gen_rand(params.curve)
e2 = t * e
v2 = t * v
u2 = t * u
hash_input = [e, e1, e2, v, v1, v2, u, u1, u2]
if challenge_metadata is not None:
hash_input.append(challenge_metadata)
h = BigNum.hash_to_bn(*hash_input, params=params)
z3 = t + h * kfrag.bn_key
ch_resp = ChallengeResponse(e2=e2,
v2=v2,
u1=u1,
u2=u2,
z1=kfrag.bn_sig1,
z2=kfrag.bn_sig2,
z3=z3)
# Check correctness of original ciphertext (check nº 2) at the end
# to avoid timing oracles
if not capsule.verify(params):
raise capsule.NotValid("Capsule verification failed.")
return ch_resp
def _encapsulate(alice_pub_key: Point,
key_length=32,
params: UmbralParameters = None) -> Tuple[bytes, Capsule]:
"""Generates a symmetric key and its associated KEM ciphertext"""
params = params if params is not None else default_params()
g = params.g
priv_r = BigNum.gen_rand(params.curve)
pub_r = priv_r * g
priv_u = BigNum.gen_rand(params.curve)
pub_u = priv_u * g
h = BigNum.hash_to_bn(pub_r, pub_u, params=params)
s = priv_u + (priv_r * h)
shared_key = (priv_r + priv_u) * alice_pub_key
# Key to be used for symmetric encryption
key = kdf(shared_key, key_length)
return key, Capsule(point_eph_e=pub_r, point_eph_v=pub_u, bn_sig=s)
def split_rekey(priv_a: Union[UmbralPrivateKey, BigNum],
pub_b: Union[UmbralPublicKey, Point],
threshold: int,
N: int,
params: UmbralParameters = None) -> List[KFrag]:
"""
Creates a re-encryption key from Alice to Bob and splits it in KFrags,
using Shamir's Secret Sharing. Requires a threshold number of KFrags
out of N to guarantee correctness of re-encryption.
Returns a list of KFrags.
"""
params = params if params is not None else default_params()
if isinstance(priv_a, UmbralPrivateKey):
priv_a = priv_a.bn_key
if isinstance(pub_b, UmbralPublicKey):
pub_b = pub_b.point_key
g = params.g
pub_a = priv_a * g
x = BigNum.gen_rand(params.curve)
xcomp = x * g
d = BigNum.hash_to_bn(xcomp, pub_b, pub_b * x, params=params)
coeffs = [priv_a * (~d)]
coeffs += [BigNum.gen_rand(params.curve) for _ in range(threshold - 1)]
u = params.u
g_ab = priv_a * pub_b
blake2b = hashes.Hash(hashes.BLAKE2b(64), backend=backend)
blake2b.update(pub_a.to_bytes())
blake2b.update(pub_b.to_bytes())
blake2b.update(g_ab.to_bytes())
hashed_dh_tuple = blake2b.finalize()
kfrags = []
for _ in range(N):
id_kfrag = BigNum.gen_rand(params.curve)
share_x = BigNum.hash_to_bn(id_kfrag, hashed_dh_tuple, params=params)
rk = poly_eval(coeffs, share_x)
u1 = rk * u
y = BigNum.gen_rand(params.curve)
z1 = BigNum.hash_to_bn(y * g,
id_kfrag,
pub_a,
pub_b,
u1,
xcomp,
params=params)
z2 = y - priv_a * z1
kfrag = KFrag(id_=id_kfrag, key=rk, x=xcomp, u1=u1, z1=z1, z2=z2)
kfrags.append(kfrag)
return kfrags