<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
<title>Crypto++: pssr.cpp Source File</title>
<link href="tabs.css" rel="stylesheet" type="text/css"/>
<link href="doxygen.css" rel="stylesheet" type="text/css"/>
</head>
<body>
<!-- Generated by Doxygen 1.7.4 -->
<div id="top">
<div id="titlearea">
<table cellspacing="0" cellpadding="0">
<tbody>
<tr style="height: 56px;">
<td style="padding-left: 0.5em;">
<div id="projectname">Crypto++</div>
</td>
</tr>
</tbody>
</table>
</div>
<div id="navrow1" class="tabs">
<ul class="tablist">
<li><a href="index.html"><span>Main Page</span></a></li>
<li><a href="namespaces.html"><span>Namespaces</span></a></li>
<li><a href="annotated.html"><span>Classes</span></a></li>
<li class="current"><a href="files.html"><span>Files</span></a></li>
</ul>
</div>
<div id="navrow2" class="tabs2">
<ul class="tablist">
<li><a href="files.html"><span>File List</span></a></li>
<li><a href="globals.html"><span>File Members</span></a></li>
</ul>
</div>
<div class="header">
<div class="headertitle">
<div class="title">pssr.cpp</div> </div>
</div>
<div class="contents">
<div class="fragment"><pre class="fragment"><a name="l00001"></a>00001 <span class="comment">// pssr.cpp - written and placed in the public domain by Wei Dai</span>
<a name="l00002"></a>00002
<a name="l00003"></a>00003 <span class="preprocessor">#include "pch.h"</span>
<a name="l00004"></a>00004 <span class="preprocessor">#include "pssr.h"</span>
<a name="l00005"></a>00005 <span class="preprocessor">#include <functional></span>
<a name="l00006"></a>00006
<a name="l00007"></a>00007 NAMESPACE_BEGIN(CryptoPP)
<a name="l00008"></a>00008
<a name="l00009"></a>00009 <span class="comment">// more in dll.cpp</span>
<a name="l00010"></a>00010 template<> const byte <a class="code" href="class_e_m_s_a2_hash_id.html">EMSA2HashId</a><<a class="code" href="class_r_i_p_e_m_d160.html" title="RIPEMD-160">RIPEMD160</a>>::<span class="keywordtype">id</span> = 0x31;
<a name="l00011"></a>00011 template<> const byte <a class="code" href="class_e_m_s_a2_hash_id.html">EMSA2HashId</a><<a class="code" href="class_r_i_p_e_m_d128.html">RIPEMD128</a>>::<span class="keywordtype">id</span> = 0x32;
<a name="l00012"></a>00012 template<> const byte <a class="code" href="class_e_m_s_a2_hash_id.html">EMSA2HashId</a><<a class="code" href="class_whirlpool.html" title="Whirlpool">Whirlpool</a>>::<span class="keywordtype">id</span> = 0x37;
<a name="l00013"></a>00013
<a name="l00014"></a>00014 <span class="preprocessor">#ifndef CRYPTOPP_IMPORTS</span>
<a name="l00015"></a>00015 <span class="preprocessor"></span>
<a name="l00016"></a>00016 <span class="keywordtype">size_t</span> PSSR_MEM_Base::MinRepresentativeBitLength(<span class="keywordtype">size_t</span> hashIdentifierLength, <span class="keywordtype">size_t</span> digestLength)<span class="keyword"> const</span>
<a name="l00017"></a>00017 <span class="keyword"></span>{
<a name="l00018"></a>00018 <span class="keywordtype">size_t</span> saltLen = SaltLen(digestLength);
<a name="l00019"></a>00019 <span class="keywordtype">size_t</span> minPadLen = MinPadLen(digestLength);
<a name="l00020"></a>00020 <span class="keywordflow">return</span> 9 + 8*(minPadLen + saltLen + digestLength + hashIdentifierLength);
<a name="l00021"></a>00021 }
<a name="l00022"></a>00022
<a name="l00023"></a>00023 <span class="keywordtype">size_t</span> PSSR_MEM_Base::MaxRecoverableLength(<span class="keywordtype">size_t</span> representativeBitLength, <span class="keywordtype">size_t</span> hashIdentifierLength, <span class="keywordtype">size_t</span> digestLength)<span class="keyword"> const</span>
<a name="l00024"></a>00024 <span class="keyword"></span>{
<a name="l00025"></a>00025 <span class="keywordflow">if</span> (AllowRecovery())
<a name="l00026"></a>00026 <span class="keywordflow">return</span> SaturatingSubtract(representativeBitLength, MinRepresentativeBitLength(hashIdentifierLength, digestLength)) / 8;
<a name="l00027"></a>00027 <span class="keywordflow">return</span> 0;
<a name="l00028"></a>00028 }
<a name="l00029"></a>00029
<a name="l00030"></a>00030 <span class="keywordtype">bool</span> PSSR_MEM_Base::IsProbabilistic()<span class="keyword"> const </span>
<a name="l00031"></a>00031 <span class="keyword"></span>{
<a name="l00032"></a>00032 <span class="keywordflow">return</span> SaltLen(1) > 0;
<a name="l00033"></a>00033 }
<a name="l00034"></a>00034
<a name="l00035"></a>00035 <span class="keywordtype">bool</span> PSSR_MEM_Base::AllowNonrecoverablePart()<span class="keyword"> const</span>
<a name="l00036"></a>00036 <span class="keyword"></span>{
<a name="l00037"></a>00037 <span class="keywordflow">return</span> <span class="keyword">true</span>;
<a name="l00038"></a>00038 }
<a name="l00039"></a>00039
<a name="l00040"></a>00040 <span class="keywordtype">bool</span> PSSR_MEM_Base::RecoverablePartFirst()<span class="keyword"> const</span>
<a name="l00041"></a>00041 <span class="keyword"></span>{
<a name="l00042"></a>00042 <span class="keywordflow">return</span> <span class="keyword">false</span>;
<a name="l00043"></a>00043 }
<a name="l00044"></a>00044
<a name="l00045"></a>00045 <span class="keywordtype">void</span> PSSR_MEM_Base::ComputeMessageRepresentative(<a class="code" href="class_random_number_generator.html" title="interface for random number generators">RandomNumberGenerator</a> &rng,
<a name="l00046"></a>00046 <span class="keyword">const</span> byte *recoverableMessage, <span class="keywordtype">size_t</span> recoverableMessageLength,
<a name="l00047"></a>00047 <a class="code" href="class_hash_transformation.html" title="interface for hash functions and data processing part of MACs">HashTransformation</a> &hash, HashIdentifier hashIdentifier, <span class="keywordtype">bool</span> messageEmpty,
<a name="l00048"></a>00048 byte *representative, <span class="keywordtype">size_t</span> representativeBitLength)<span class="keyword"> const</span>
<a name="l00049"></a>00049 <span class="keyword"></span>{
<a name="l00050"></a>00050 assert(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>()));
<a name="l00051"></a>00051
<a name="l00052"></a>00052 <span class="keyword">const</span> <span class="keywordtype">size_t</span> u = hashIdentifier.second + 1;
<a name="l00053"></a>00053 <span class="keyword">const</span> <span class="keywordtype">size_t</span> representativeByteLength = BitsToBytes(representativeBitLength);
<a name="l00054"></a>00054 <span class="keyword">const</span> <span class="keywordtype">size_t</span> digestSize = hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>();
<a name="l00055"></a>00055 <span class="keyword">const</span> <span class="keywordtype">size_t</span> saltSize = SaltLen(digestSize);
<a name="l00056"></a>00056 byte *<span class="keyword">const</span> h = representative + representativeByteLength - u - digestSize;
<a name="l00057"></a>00057
<a name="l00058"></a>00058 <a class="code" href="class_sec_block.html" title="a block of memory allocated using A">SecByteBlock</a> digest(digestSize), salt(saltSize);
<a name="l00059"></a>00059 hash.<a class="code" href="class_hash_transformation.html#aa0b8c7a110d8968268fd02ec32b9a8e8" title="compute hash for current message, then restart for a new message">Final</a>(digest);
<a name="l00060"></a>00060 rng.<a class="code" href="class_random_number_generator.html#a497145546d24e6d4abaf10b7e0f1ba17" title="generate random array of bytes">GenerateBlock</a>(salt, saltSize);
<a name="l00061"></a>00061
<a name="l00062"></a>00062 <span class="comment">// compute H = hash of M'</span>
<a name="l00063"></a>00063 byte c[8];
<a name="l00064"></a>00064 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c, (word32)SafeRightShift<29>(recoverableMessageLength));
<a name="l00065"></a>00065 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c+4, word32(recoverableMessageLength << 3));
<a name="l00066"></a>00066 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(c, 8);
<a name="l00067"></a>00067 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(recoverableMessage, recoverableMessageLength);
<a name="l00068"></a>00068 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(digest, digestSize);
<a name="l00069"></a>00069 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(salt, saltSize);
<a name="l00070"></a>00070 hash.<a class="code" href="class_hash_transformation.html#aa0b8c7a110d8968268fd02ec32b9a8e8" title="compute hash for current message, then restart for a new message">Final</a>(h);
<a name="l00071"></a>00071
<a name="l00072"></a>00072 <span class="comment">// compute representative</span>
<a name="l00073"></a>00073 GetMGF().GenerateAndMask(hash, representative, representativeByteLength - u - digestSize, h, digestSize, <span class="keyword">false</span>);
<a name="l00074"></a>00074 byte *xorStart = representative + representativeByteLength - u - digestSize - salt.size() - recoverableMessageLength - 1;
<a name="l00075"></a>00075 xorStart[0] ^= 1;
<a name="l00076"></a>00076 xorbuf(xorStart + 1, recoverableMessage, recoverableMessageLength);
<a name="l00077"></a>00077 xorbuf(xorStart + 1 + recoverableMessageLength, salt, salt.size());
<a name="l00078"></a>00078 memcpy(representative + representativeByteLength - u, hashIdentifier.first, hashIdentifier.second);
<a name="l00079"></a>00079 representative[representativeByteLength - 1] = hashIdentifier.second ? 0xcc : 0xbc;
<a name="l00080"></a>00080 <span class="keywordflow">if</span> (representativeBitLength % 8 != 0)
<a name="l00081"></a>00081 representative[0] = (byte)Crop(representative[0], representativeBitLength % 8);
<a name="l00082"></a>00082 }
<a name="l00083"></a>00083
<a name="l00084"></a>00084 <a class="code" href="struct_decoding_result.html" title="used to return decoding results">DecodingResult</a> PSSR_MEM_Base::RecoverMessageFromRepresentative(
<a name="l00085"></a>00085 <a class="code" href="class_hash_transformation.html" title="interface for hash functions and data processing part of MACs">HashTransformation</a> &hash, HashIdentifier hashIdentifier, <span class="keywordtype">bool</span> messageEmpty,
<a name="l00086"></a>00086 byte *representative, <span class="keywordtype">size_t</span> representativeBitLength,
<a name="l00087"></a>00087 byte *recoverableMessage)<span class="keyword"> const</span>
<a name="l00088"></a>00088 <span class="keyword"></span>{
<a name="l00089"></a>00089 assert(representativeBitLength >= MinRepresentativeBitLength(hashIdentifier.second, hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>()));
<a name="l00090"></a>00090
<a name="l00091"></a>00091 <span class="keyword">const</span> <span class="keywordtype">size_t</span> u = hashIdentifier.second + 1;
<a name="l00092"></a>00092 <span class="keyword">const</span> <span class="keywordtype">size_t</span> representativeByteLength = BitsToBytes(representativeBitLength);
<a name="l00093"></a>00093 <span class="keyword">const</span> <span class="keywordtype">size_t</span> digestSize = hash.<a class="code" href="class_hash_transformation.html#a9f42cc280bac76b884ad12615c0dabb5" title="size of the hash/digest/MAC returned by Final()">DigestSize</a>();
<a name="l00094"></a>00094 <span class="keyword">const</span> <span class="keywordtype">size_t</span> saltSize = SaltLen(digestSize);
<a name="l00095"></a>00095 <span class="keyword">const</span> byte *<span class="keyword">const</span> h = representative + representativeByteLength - u - digestSize;
<a name="l00096"></a>00096
<a name="l00097"></a>00097 <a class="code" href="class_sec_block.html" title="a block of memory allocated using A">SecByteBlock</a> digest(digestSize);
<a name="l00098"></a>00098 hash.<a class="code" href="class_hash_transformation.html#aa0b8c7a110d8968268fd02ec32b9a8e8" title="compute hash for current message, then restart for a new message">Final</a>(digest);
<a name="l00099"></a>00099
<a name="l00100"></a>00100 <a class="code" href="struct_decoding_result.html" title="used to return decoding results">DecodingResult</a> result(0);
<a name="l00101"></a>00101 <span class="keywordtype">bool</span> &valid = result.isValidCoding;
<a name="l00102"></a>00102 <span class="keywordtype">size_t</span> &recoverableMessageLength = result.messageLength;
<a name="l00103"></a>00103
<a name="l00104"></a>00104 valid = (representative[representativeByteLength - 1] == (hashIdentifier.second ? 0xcc : 0xbc)) && valid;
<a name="l00105"></a>00105 valid = VerifyBufsEqual(representative + representativeByteLength - u, hashIdentifier.first, hashIdentifier.second) && valid;
<a name="l00106"></a>00106
<a name="l00107"></a>00107 GetMGF().GenerateAndMask(hash, representative, representativeByteLength - u - digestSize, h, digestSize);
<a name="l00108"></a>00108 <span class="keywordflow">if</span> (representativeBitLength % 8 != 0)
<a name="l00109"></a>00109 representative[0] = (byte)Crop(representative[0], representativeBitLength % 8);
<a name="l00110"></a>00110
<a name="l00111"></a>00111 <span class="comment">// extract salt and recoverableMessage from DB = 00 ... || 01 || M || salt</span>
<a name="l00112"></a>00112 byte *salt = representative + representativeByteLength - u - digestSize - saltSize;
<a name="l00113"></a>00113 byte *M = std::find_if(representative, salt-1, std::bind2nd(std::not_equal_to<byte>(), 0));
<a name="l00114"></a>00114 recoverableMessageLength = salt-M-1;
<a name="l00115"></a>00115 <span class="keywordflow">if</span> (*M == 0x01
<a name="l00116"></a>00116 && (<span class="keywordtype">size_t</span>)(M - representative - (representativeBitLength % 8 != 0)) >= MinPadLen(digestSize)
<a name="l00117"></a>00117 && recoverableMessageLength <= MaxRecoverableLength(representativeBitLength, hashIdentifier.second, digestSize))
<a name="l00118"></a>00118 {
<a name="l00119"></a>00119 memcpy(recoverableMessage, M+1, recoverableMessageLength);
<a name="l00120"></a>00120 }
<a name="l00121"></a>00121 <span class="keywordflow">else</span>
<a name="l00122"></a>00122 {
<a name="l00123"></a>00123 recoverableMessageLength = 0;
<a name="l00124"></a>00124 valid = <span class="keyword">false</span>;
<a name="l00125"></a>00125 }
<a name="l00126"></a>00126
<a name="l00127"></a>00127 <span class="comment">// verify H = hash of M'</span>
<a name="l00128"></a>00128 byte c[8];
<a name="l00129"></a>00129 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c, (word32)SafeRightShift<29>(recoverableMessageLength));
<a name="l00130"></a>00130 PutWord(<span class="keyword">false</span>, BIG_ENDIAN_ORDER, c+4, word32(recoverableMessageLength << 3));
<a name="l00131"></a>00131 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(c, 8);
<a name="l00132"></a>00132 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(recoverableMessage, recoverableMessageLength);
<a name="l00133"></a>00133 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(digest, digestSize);
<a name="l00134"></a>00134 hash.<a class="code" href="class_hash_transformation.html#aafabefaf445b65d3ba0d8e1c0294afe5" title="process more input">Update</a>(salt, saltSize);
<a name="l00135"></a>00135 valid = hash.<a class="code" href="class_hash_transformation.html#a16c4aecd047015d513feef4ed5b929ba" title="verify that digest is a valid digest for the current message, then reinitialize the object...">Verify</a>(h) && valid;
<a name="l00136"></a>00136
<a name="l00137"></a>00137 <span class="keywordflow">if</span> (!AllowRecovery() && valid && recoverableMessageLength != 0)
<a name="l00138"></a>00138 {<span class="keywordflow">throw</span> <a class="code" href="class_not_implemented.html" title="exception thrown by a class if a non-implemented method is called">NotImplemented</a>(<span class="stringliteral">"PSSR_MEM: message recovery disabled"</span>);}
<a name="l00139"></a>00139
<a name="l00140"></a>00140 <span class="keywordflow">return</span> result;
<a name="l00141"></a>00141 }
<a name="l00142"></a>00142
<a name="l00143"></a>00143 <span class="preprocessor">#endif</span>
<a name="l00144"></a>00144 <span class="preprocessor"></span>
<a name="l00145"></a>00145 NAMESPACE_END
</pre></div></div>
</div>
<hr class="footer"/><address class="footer"><small>Generated on Sun Oct 16 2011 for Crypto++ by 
<a href="http://www.doxygen.org/index.html">
<img class="footer" src="doxygen.png" alt="doxygen"/></a> 1.7.4 </small></address>
</body>
</html>
