1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
|
using System;
using Org.BouncyCastle.Crypto.Macs;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Math;
using Org.BouncyCastle.Security;
using Org.BouncyCastle.Utilities;
namespace Org.BouncyCastle.Crypto.Signers
{
/**
* A deterministic K calculator based on the algorithm in section 3.2 of RFC 6979.
*/
public class HMacDsaKCalculator
: IDsaKCalculator
{
private readonly HMac hMac;
private readonly byte[] K;
private readonly byte[] V;
private BigInteger n;
/**
* Base constructor.
*
* @param digest digest to build the HMAC on.
*/
public HMacDsaKCalculator(IDigest digest)
{
this.hMac = new HMac(digest);
this.V = new byte[hMac.GetMacSize()];
this.K = new byte[hMac.GetMacSize()];
}
public virtual bool IsDeterministic
{
get { return true; }
}
public virtual void Init(BigInteger n, SecureRandom random)
{
throw new InvalidOperationException("Operation not supported");
}
public void Init(BigInteger n, BigInteger d, byte[] message)
{
this.n = n;
Arrays.Fill(V, 0x01);
Arrays.Fill(K, 0);
BigInteger mInt = BitsToInt(message);
if (mInt.CompareTo(n) >= 0)
{
mInt = mInt.Subtract(n);
}
int size = BigIntegers.GetUnsignedByteLength(n);
#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER
int xmSize = size * 2;
Span<byte> xm = xmSize <= 512
? stackalloc byte[xmSize]
: new byte[xmSize];
BigIntegers.AsUnsignedByteArray(d, xm[..size]);
BigIntegers.AsUnsignedByteArray(mInt, xm[size..]);
#else
byte[] x = BigIntegers.AsUnsignedByteArray(size, d);
byte[] m = BigIntegers.AsUnsignedByteArray(size, mInt);
#endif
hMac.Init(new KeyParameter(K));
hMac.BlockUpdate(V, 0, V.Length);
hMac.Update(0x00);
#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER
hMac.BlockUpdate(xm);
#else
hMac.BlockUpdate(x, 0, x.Length);
hMac.BlockUpdate(m, 0, m.Length);
#endif
InitAdditionalInput0(hMac);
hMac.DoFinal(K, 0);
hMac.Init(new KeyParameter(K));
hMac.BlockUpdate(V, 0, V.Length);
hMac.DoFinal(V, 0);
hMac.BlockUpdate(V, 0, V.Length);
hMac.Update(0x01);
#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER
hMac.BlockUpdate(xm);
#else
hMac.BlockUpdate(x, 0, x.Length);
hMac.BlockUpdate(m, 0, m.Length);
#endif
hMac.DoFinal(K, 0);
hMac.Init(new KeyParameter(K));
hMac.BlockUpdate(V, 0, V.Length);
hMac.DoFinal(V, 0);
}
public virtual BigInteger NextK()
{
byte[] t = new byte[BigIntegers.GetUnsignedByteLength(n)];
for (;;)
{
int tOff = 0;
while (tOff < t.Length)
{
hMac.BlockUpdate(V, 0, V.Length);
hMac.DoFinal(V, 0);
int len = System.Math.Min(t.Length - tOff, V.Length);
Array.Copy(V, 0, t, tOff, len);
tOff += len;
}
BigInteger k = BitsToInt(t);
if (k.SignValue > 0 && k.CompareTo(n) < 0)
return k;
hMac.BlockUpdate(V, 0, V.Length);
hMac.Update(0x00);
hMac.DoFinal(K, 0);
hMac.Init(new KeyParameter(K));
hMac.BlockUpdate(V, 0, V.Length);
hMac.DoFinal(V, 0);
}
}
/// <summary>Supports use of additional input.</summary>
/// <remarks>
/// RFC 6979 3.6. Additional data may be added to the input of HMAC [..]. A use case may be a protocol that
/// requires a non-deterministic signature algorithm on a system that does not have access to a high-quality
/// random source. It suffices that the additional data[..] is non-repeating(e.g., a signature counter or a
/// monotonic clock) to ensure "random-looking" signatures are indistinguishable, in a cryptographic way, from
/// plain (EC)DSA signatures.
/// <para/>
/// By default there is no additional input. Override this method to supply additional input, bearing in mind
/// that this calculator may be used for many signatures.
/// </remarks>
/// <param name="hmac0">The <see cref="HMac"/> to which the additional input should be added.</param>
protected virtual void InitAdditionalInput0(HMac hmac0)
{
}
private BigInteger BitsToInt(byte[] t)
{
BigInteger v = new BigInteger(1, t);
if (t.Length * 8 > n.BitLength)
{
v = v.ShiftRight(t.Length * 8 - n.BitLength);
}
return v;
}
}
}
|
