public class JPAKEUtil extends Object
The recommended way to perform a J-PAKE exchange is by using
two JPAKEParticipant
s. Internally, those participants
call these primitive operations in JPAKEUtil
.
The primitives, however, can be used without a JPAKEParticipant
if needed.
Constructor and Description |
---|
JPAKEUtil() |
Modifier and Type | Method and Description |
---|---|
static BigInteger |
calculateA(BigInteger p,
BigInteger q,
BigInteger gA,
BigInteger x2s)
Calculate A as done in round 2.
|
static BigInteger |
calculateGA(BigInteger p,
BigInteger gx1,
BigInteger gx3,
BigInteger gx4)
Calculate ga as done in round 2.
|
static BigInteger |
calculateGx(BigInteger p,
BigInteger g,
BigInteger x)
Calculate g^x mod p as done in round 1.
|
static BigInteger |
calculateKeyingMaterial(BigInteger p,
BigInteger q,
BigInteger gx4,
BigInteger x2,
BigInteger s,
BigInteger B)
Calculates the keying material, which can be done after round 2 has completed.
|
static BigInteger |
calculateMacTag(String participantId,
String partnerParticipantId,
BigInteger gx1,
BigInteger gx2,
BigInteger gx3,
BigInteger gx4,
BigInteger keyingMaterial,
Digest digest)
Calculates the MacTag (to be used for key confirmation), as defined by
NIST SP 800-56A Revision 1,
Section 8.2 Unilateral Key Confirmation for Key Agreement Schemes.
|
static BigInteger |
calculateS(char[] password)
Converts the given password to a
BigInteger
for use in arithmetic calculations. |
static BigInteger |
calculateX2s(BigInteger q,
BigInteger x2,
BigInteger s)
Calculate x2 * s as done in round 2.
|
static BigInteger[] |
calculateZeroKnowledgeProof(BigInteger p,
BigInteger q,
BigInteger g,
BigInteger gx,
BigInteger x,
String participantId,
Digest digest,
SecureRandom random)
Calculate a zero knowledge proof of x using Schnorr's signature.
|
static BigInteger |
generateX1(BigInteger q,
SecureRandom random)
Return a value that can be used as x1 or x3 during round 1.
|
static BigInteger |
generateX2(BigInteger q,
SecureRandom random)
Return a value that can be used as x2 or x4 during round 1.
|
static void |
validateGa(BigInteger ga)
Validates that ga is not 1.
|
static void |
validateGx4(BigInteger gx4)
Validates that g^x4 is not 1.
|
static void |
validateMacTag(String participantId,
String partnerParticipantId,
BigInteger gx1,
BigInteger gx2,
BigInteger gx3,
BigInteger gx4,
BigInteger keyingMaterial,
Digest digest,
BigInteger partnerMacTag)
Validates the MacTag received from the partner participant.
|
static void |
validateNotNull(Object object,
String description)
Validates that the given object is not null.
|
static void |
validateParticipantIdsDiffer(String participantId1,
String participantId2)
Validates that the given participant ids are not equal.
|
static void |
validateParticipantIdsEqual(String expectedParticipantId,
String actualParticipantId)
Validates that the given participant ids are equal.
|
static void |
validateZeroKnowledgeProof(BigInteger p,
BigInteger q,
BigInteger g,
BigInteger gx,
BigInteger[] zeroKnowledgeProof,
String participantId,
Digest digest)
Validates the zero knowledge proof (generated by
calculateZeroKnowledgeProof(BigInteger, BigInteger, BigInteger, BigInteger, BigInteger, String, Digest, SecureRandom) )
is correct. |
public static BigInteger generateX1(BigInteger q, SecureRandom random)
The returned value is a random value in the range [0, q-1].
public static BigInteger generateX2(BigInteger q, SecureRandom random)
The returned value is a random value in the range [1, q-1].
public static BigInteger calculateS(char[] password)
BigInteger
for use in arithmetic calculations.public static BigInteger calculateGx(BigInteger p, BigInteger g, BigInteger x)
public static BigInteger calculateGA(BigInteger p, BigInteger gx1, BigInteger gx3, BigInteger gx4)
public static BigInteger calculateX2s(BigInteger q, BigInteger x2, BigInteger s)
public static BigInteger calculateA(BigInteger p, BigInteger q, BigInteger gA, BigInteger x2s)
public static BigInteger[] calculateZeroKnowledgeProof(BigInteger p, BigInteger q, BigInteger g, BigInteger gx, BigInteger x, String participantId, Digest digest, SecureRandom random)
public static void validateGx4(BigInteger gx4) throws CryptoException
CryptoException
- if g^x4 is 1public static void validateGa(BigInteger ga) throws CryptoException
As described by Feng Hao...
Alice could simply check ga != 1 to ensure it is a generator. In fact, as we will explain in Section 3, (x1 + x3 + x4 ) is random over Zq even in the face of active attacks. Hence, the probability for ga = 1 is extremely small - on the order of 2^160 for 160-bit q.
CryptoException
- if ga is 1public static void validateZeroKnowledgeProof(BigInteger p, BigInteger q, BigInteger g, BigInteger gx, BigInteger[] zeroKnowledgeProof, String participantId, Digest digest) throws CryptoException
calculateZeroKnowledgeProof(BigInteger, BigInteger, BigInteger, BigInteger, BigInteger, String, Digest, SecureRandom)
)
is correct.CryptoException
- if the zero knowledge proof is not correctpublic static BigInteger calculateKeyingMaterial(BigInteger p, BigInteger q, BigInteger gx4, BigInteger x2, BigInteger s, BigInteger B)
JPAKEParticipant
).
KeyingMaterial = (B/g^{x2*x4*s})^x2
public static void validateParticipantIdsDiffer(String participantId1, String participantId2) throws CryptoException
CryptoException
- if the participantId strings are equal.public static void validateParticipantIdsEqual(String expectedParticipantId, String actualParticipantId) throws CryptoException
CryptoException
- if the participantId strings are equal.public static void validateNotNull(Object object, String description)
object
- object in questiondescription
- name of the object (to be used in exception message)NullPointerException
- if the object is null.public static BigInteger calculateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest)
MacTag = HMAC(MacKey, MacLen, MacData) MacKey = H(K || "JPAKE_KC") MacData = "KC_1_U" || participantId || partnerParticipantId || gx1 || gx2 || gx3 || gx4 Note that both participants use "KC_1_U" because the sender of the round 3 message is always the initiator for key confirmation. HMAC =HMac
used with the givenDigest
H = The givenDigest
MacLen = length of MacTag
public static void validateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest, BigInteger partnerMacTag) throws CryptoException
partnerMacTag
- the MacTag received from the partner.CryptoException
- if the participantId strings are equal.Copyright © 2020 BouncyCastle.org. All rights reserved.