<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/> <title>Crypto++: pssr.cpp Source File</title> <link href="tabs.css" rel="stylesheet" type="text/css"/> <link href="doxygen.css" rel="stylesheet" type="text/css"/> </head> <body> <!-- Generated by Doxygen 1.6.1 --> <div class="navigation" id="top"> <div class="tabs"> <ul> <li><a href="index.html"><span>Main Page</span></a></li> <li><a href="namespaces.html"><span>Namespaces</span></a></li> <li><a href="annotated.html"><span>Classes</span></a></li> <li class="current"><a href="files.html"><span>Files</span></a></li> </ul> </div> <div class="tabs"> <ul> <li><a href="files.html"><span>File List</span></a></li> <li><a href="globals.html"><span>File Members</span></a></li> </ul> </div> <h1>pssr.cpp</h1><div class="fragment"><pre class="fragment"><a name="l00001"></a>00001 <span class="comment">// pssr.cpp - written and placed in the public domain by Wei Dai</span> <a name="l00002"></a>00002 <a name="l00003"></a>00003 <span class="preprocessor">#include "pch.h"</span> <a name="l00004"></a>00004 <span class="preprocessor">#include "pssr.h"</span> <a name="l00005"></a>00005 <span class="preprocessor">#include <functional></span> <a name="l00006"></a>00006 <a name="l00007"></a>00007 NAMESPACE_BEGIN(CryptoPP) <a name="l00008"></a>00008 <a name="l00009"></a>00009 <span class="comment">// more in dll.cpp</span> <a name="l00010"></a>00010 template<> const byte <a class="code" href="class_e_m_s_a2_hash_id.html">EMSA2HashId</a><<a class="code" href="class_r_i_p_e_m_d160.html" title="RIPEMD-160">RIPEMD160</a>>::<span class="keywordtype">id</span> = 0x31; <a name="l00011"></a>00011 template<> const byte <a class="code" href="class_e_m_s_a2_hash_id.html">EMSA2HashId</a><<a class="code" href="class_r_i_p_e_m_d128.html">RIPEMD128</a>>::<span class="keywordtype">id</span> = 0x32; <a name="l00012"></a>00012 template<> const byte <a class="code" href="class_e_m_s_a2_hash_id.html">EMSA2HashId</a><<a class="code" href="class_whirlpool.html" title="Whirlpool">Whirlpool</a>>::<span class="keywordtype">id</span> = 0x37; <a name="l00013"></a>00013 <a name="l00014"></a>00014 <span class="preprocessor">#ifndef CRYPTOPP_IMPORTS</span> <a name="l00015"></a>00015 <span class="preprocessor"></span> <a name="l00016"></a>00016 <span class="keywordtype">size_t</span> PSSR_MEM_Base::MinRepresentativeBitLength(<span class="keywordtype">size_t</span> hashIdentifierLength, <span class="keywordtype">size_t</span> digestLength)<span class="keyword"> const</span> <a name="l00017"></a>00017 <span class="keyword"></span>{ <a name="l00018"></a>00018 <span class="keywordtype">size_t</span> saltLen = SaltLen(digestLength); <a name="l00019"></a>00019 <span class="keywordtype">size_t</span> minPadLen = MinPadLen(digestLength); <a name="l00020"></a>00020 <span class="keywordflow">return</span> 9 + 8*(minPadLen + saltLen + digestLength + hashIdentifierLength); <a name="l00021"></a>00021 } <a name="l00022"></a>00022 <a name="l00023"></a>00023 <span class="keywordtype">size_t</span> PSSR_MEM_Base::MaxRecoverableLength(<span class="keywordtype">size_t</span> representativeBitLength, <span class="keywordtype">size_t</span> hashIdentifierLength, <span class="keywordtype">size_t</span> digestLength)<span class="keyword"> const</span> <a name="l00024"></a>00024 <span class="keyword"></span>{ <a name="l00025"></a>00025 <span class="keywordflow">if</span> (AllowRecovery()) <a name="l00026"></a>00026 <span class="keywordflow">return</span> SaturatingSubtract(representativeBitLength, MinRepresentativeBitLength(hashIdentifierLength, digestLength)) / 8; <a name="l00027"></a>00027 <span class="keywordflow">return</span> 0; <a name="l00028"></a>00028 } <a name="l00029"></a>00029 <a name="l00030"></a>00030 <span class="keywordtype">bool</span> PSSR_MEM_Base::IsProbabilistic()<span class="keyword"> const </span> <a name="l00031"></a>00031 <span class="keyword"></span>{ <a name="l00032"></a>00032 <span class="keywordflow">return</span> SaltLen(1) > 0; <a name="l00033"></a>00033 } <a name="l00034"></a>00034 <a name="l00035"></a>00035 <span class="keywordtype">bool</span> PSSR_MEM_Base::AllowNonrecoverablePart()<span class="keyword"> const</span> <a name="l00036"></a>00036 <span class="keyword"></span>{ <a name="l00037"></a>00037 <span class="keywordflow">return</span> <span class="keyword">true</span>; <a name="l00038"></a>00038 } <a name="l00039"></a>00039 <a name="l00040"></a>00040 <span class="keywordtype">bool</span> PSSR_MEM_Base::RecoverablePartFirst()<span class="keyword"> const</span> <a name="l00041"></a>00041 <span class="keyword"></span>{ <a name="l00042"></a>00042 <span class="keywordflow">return</span> <span class="keyword">false</span>; <a name="l00043"></a>00043 } <a name="l00044"></a>00044 <a name="l00045"></a>00045 <span class="keywordtype">void</span> PSSR_MEM_Base::ComputeMessageRepresentative(<a class="code" href="class_random_number_generator.html" title="interface for random number generators">RandomNumberGenerator</a> &rng, <a name="l00046"></a>00046 <span class="keyword">const</span> byte *recoverableMessage, <span class="keywordtype">size_t</span> recoverableMessageLength, <a name="l00047"></a>00047 <a class="code" href="class_hash_transformation.html" title="interface for hash functions and data processing part of MACs">HashTransformation</a> &hash, HashIdentifier hashIdentifier, <span class="keywordtype">bool</span> messageEmpty, <a name="l00048"></a>00048 byte *representative, <span class="keywordtype">size_t</span> representativeBitLength)<span class="keyword"> const</span> <a name="l00049"></a>00049 <span class="keyword"></span>{ <a name="l00050"></a>00050 assert(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>())); <a name="l00051"></a>00051 <a name="l00052"></a>00052 <span class="keyword">const</span> <span class="keywordtype">size_t</span> u = hashIdentifier.second + 1; <a name="l00053"></a>00053 <span class="keyword">const</span> <span class="keywordtype">size_t</span> representativeByteLength = BitsToBytes(representativeBitLength); <a name="l00054"></a>00054 <span class="keyword">const</span> <span class="keywordtype">size_t</span> digestSize = hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>(); <a name="l00055"></a>00055 <span class="keyword">const</span> <span class="keywordtype">size_t</span> saltSize = SaltLen(digestSize); <a name="l00056"></a>00056 byte *<span class="keyword">const</span> h = representative + representativeByteLength - u - digestSize; <a name="l00057"></a>00057 <a name="l00058"></a>00058 <a class="code" href="class_sec_block.html" title="a block of memory allocated using A">SecByteBlock</a> digest(digestSize), salt(saltSize); <a name="l00059"></a>00059 hash.<a class="code" href="class_hash_transformation.html#aa0b8c7a110d8968268fd02ec32b9a8e8" title="compute hash for current message, then restart for a new message">Final</a>(digest); <a name="l00060"></a>00060 rng.<a class="code" href="class_random_number_generator.html#a497145546d24e6d4abaf10b7e0f1ba17" title="generate random array of bytes">GenerateBlock</a>(salt, saltSize); <a name="l00061"></a>00061 <a name="l00062"></a>00062 <span class="comment">// compute H = hash of M'</span> <a name="l00063"></a>00063 byte c[8]; <a name="l00064"></a>00064 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c, (word32)SafeRightShift<29>(recoverableMessageLength)); <a name="l00065"></a>00065 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c+4, word32(recoverableMessageLength << 3)); <a name="l00066"></a>00066 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(c, 8); <a name="l00067"></a>00067 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(recoverableMessage, recoverableMessageLength); <a name="l00068"></a>00068 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(digest, digestSize); <a name="l00069"></a>00069 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(salt, saltSize); <a name="l00070"></a>00070 hash.<a class="code" href="class_hash_transformation.html#aa0b8c7a110d8968268fd02ec32b9a8e8" title="compute hash for current message, then restart for a new message">Final</a>(h); <a name="l00071"></a>00071 <a name="l00072"></a>00072 <span class="comment">// compute representative</span> <a name="l00073"></a>00073 GetMGF().GenerateAndMask(hash, representative, representativeByteLength - u - digestSize, h, digestSize, <span class="keyword">false</span>); <a name="l00074"></a>00074 byte *xorStart = representative + representativeByteLength - u - digestSize - salt.size() - recoverableMessageLength - 1; <a name="l00075"></a>00075 xorStart[0] ^= 1; <a name="l00076"></a>00076 xorbuf(xorStart + 1, recoverableMessage, recoverableMessageLength); <a name="l00077"></a>00077 xorbuf(xorStart + 1 + recoverableMessageLength, salt, salt.size()); <a name="l00078"></a>00078 memcpy(representative + representativeByteLength - u, hashIdentifier.first, hashIdentifier.second); <a name="l00079"></a>00079 representative[representativeByteLength - 1] = hashIdentifier.second ? 0xcc : 0xbc; <a name="l00080"></a>00080 <span class="keywordflow">if</span> (representativeBitLength % 8 != 0) <a name="l00081"></a>00081 representative[0] = (byte)Crop(representative[0], representativeBitLength % 8); <a name="l00082"></a>00082 } <a name="l00083"></a>00083 <a name="l00084"></a>00084 <a class="code" href="struct_decoding_result.html" title="used to return decoding results">DecodingResult</a> PSSR_MEM_Base::RecoverMessageFromRepresentative( <a name="l00085"></a>00085 <a class="code" href="class_hash_transformation.html" title="interface for hash functions and data processing part of MACs">HashTransformation</a> &hash, HashIdentifier hashIdentifier, <span class="keywordtype">bool</span> messageEmpty, <a name="l00086"></a>00086 byte *representative, <span class="keywordtype">size_t</span> representativeBitLength, <a name="l00087"></a>00087 byte *recoverableMessage)<span class="keyword"> const</span> <a name="l00088"></a>00088 <span class="keyword"></span>{ <a name="l00089"></a>00089 assert(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>())); <a name="l00090"></a>00090 <a name="l00091"></a>00091 <span class="keyword">const</span> <span class="keywordtype">size_t</span> u = hashIdentifier.second + 1; <a name="l00092"></a>00092 <span class="keyword">const</span> <span class="keywordtype">size_t</span> representativeByteLength = BitsToBytes(representativeBitLength); <a name="l00093"></a>00093 <span class="keyword">const</span> <span class="keywordtype">size_t</span> digestSize = hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>(); <a name="l00094"></a>00094 <span class="keyword">const</span> <span class="keywordtype">size_t</span> saltSize = SaltLen(digestSize); <a name="l00095"></a>00095 <span class="keyword">const</span> byte *<span class="keyword">const</span> h = representative + representativeByteLength - u - digestSize; <a name="l00096"></a>00096 <a name="l00097"></a>00097 <a class="code" href="class_sec_block.html" title="a block of memory allocated using A">SecByteBlock</a> digest(digestSize); <a name="l00098"></a>00098 hash.<a class="code" href="class_hash_transformation.html#aa0b8c7a110d8968268fd02ec32b9a8e8" title="compute hash for current message, then restart for a new message">Final</a>(digest); <a name="l00099"></a>00099 <a name="l00100"></a>00100 <a class="code" href="struct_decoding_result.html" title="used to return decoding results">DecodingResult</a> result(0); <a name="l00101"></a>00101 <span class="keywordtype">bool</span> &valid = result.isValidCoding; <a name="l00102"></a>00102 <span class="keywordtype">size_t</span> &recoverableMessageLength = result.messageLength; <a name="l00103"></a>00103 <a name="l00104"></a>00104 valid = (representative[representativeByteLength - 1] == (hashIdentifier.second ? 0xcc : 0xbc)) && valid; <a name="l00105"></a>00105 valid = VerifyBufsEqual(representative + representativeByteLength - u, hashIdentifier.first, hashIdentifier.second) && valid; <a name="l00106"></a>00106 <a name="l00107"></a>00107 GetMGF().GenerateAndMask(hash, representative, representativeByteLength - u - digestSize, h, digestSize); <a name="l00108"></a>00108 <span class="keywordflow">if</span> (representativeBitLength % 8 != 0) <a name="l00109"></a>00109 representative[0] = (byte)Crop(representative[0], representativeBitLength % 8); <a name="l00110"></a>00110 <a name="l00111"></a>00111 <span class="comment">// extract salt and recoverableMessage from DB = 00 ... || 01 || M || salt</span> <a name="l00112"></a>00112 byte *salt = representative + representativeByteLength - u - digestSize - saltSize; <a name="l00113"></a>00113 byte *M = std::find_if(representative, salt-1, std::bind2nd(std::not_equal_to<byte>(), 0)); <a name="l00114"></a>00114 recoverableMessageLength = salt-M-1; <a name="l00115"></a>00115 <span class="keywordflow">if</span> (*M == 0x01 <a name="l00116"></a>00116 && (<span class="keywordtype">size_t</span>)(M - representative - (representativeBitLength % 8 != 0)) >= MinPadLen(digestSize) <a name="l00117"></a>00117 && recoverableMessageLength <= MaxRecoverableLength(representativeBitLength, hashIdentifier.second, digestSize)) <a name="l00118"></a>00118 { <a name="l00119"></a>00119 memcpy(recoverableMessage, M+1, recoverableMessageLength); <a name="l00120"></a>00120 } <a name="l00121"></a>00121 <span class="keywordflow">else</span> <a name="l00122"></a>00122 { <a name="l00123"></a>00123 recoverableMessageLength = 0; <a name="l00124"></a>00124 valid = <span class="keyword">false</span>; <a name="l00125"></a>00125 } <a name="l00126"></a>00126 <a name="l00127"></a>00127 <span class="comment">// verify H = hash of M'</span> <a name="l00128"></a>00128 byte c[8]; <a name="l00129"></a>00129 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c, (word32)SafeRightShift<29>(recoverableMessageLength)); <a name="l00130"></a>00130 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c+4, word32(recoverableMessageLength << 3)); <a name="l00131"></a>00131 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(c, 8); <a name="l00132"></a>00132 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(recoverableMessage, recoverableMessageLength); <a name="l00133"></a>00133 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(digest, digestSize); <a name="l00134"></a>00134 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(salt, saltSize); <a name="l00135"></a>00135 valid = hash.<a class="code" href="class_hash_transformation.html#a16c4aecd047015d513feef4ed5b929ba" title="verify that digest is a valid digest for the current message, then reinitialize the...">Verify</a>(h) && valid; <a name="l00136"></a>00136 <a name="l00137"></a>00137 <span class="keywordflow">if</span> (!AllowRecovery() && valid && recoverableMessageLength != 0) <a name="l00138"></a>00138 {<span class="keywordflow">throw</span> <a class="code" href="class_not_implemented.html" title="exception thrown by a class if a non-implemented method is called">NotImplemented</a>(<span class="stringliteral">"PSSR_MEM: message recovery disabled"</span>);} <a name="l00139"></a>00139 <a name="l00140"></a>00140 <span class="keywordflow">return</span> result; <a name="l00141"></a>00141 } <a name="l00142"></a>00142 <a name="l00143"></a>00143 <span class="preprocessor">#endif</span> <a name="l00144"></a>00144 <span class="preprocessor"></span> <a name="l00145"></a>00145 NAMESPACE_END </pre></div></div> <hr size="1"/><address style="text-align: right;"><small>Generated on 9 Dec 2009 for Crypto++ by <a href="http://www.doxygen.org/index.html"> <img class="footer" src="doxygen.png" alt="doxygen"/></a> 1.6.1 </small></address> </body> </html>