Botan 2.1.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- Class List
- Class Index
- Class Hierarchy
- Class Members

Public Member Functions | List of all members
Botan::DLIES_Decryptor Class Reference

`#include <dlies.h>`

Inheritance diagram for Botan::DLIES_Decryptor:

## Public Member Functions
secure_vector< uint8_t > | decrypt (const uint8_t in[], size_t length) const
template<typename Alloc >
secure_vector< uint8_t > | decrypt (const std::vector< uint8_t, Alloc > &in) const
secure_vector< uint8_t > | decrypt_or_random (const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng) const
secure_vector< uint8_t > | decrypt_or_random (const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng, const uint8_t required_content_bytes[], const uint8_t required_content_offsets[], size_t required_contents) const
| DLIES_Decryptor (const DH_PrivateKey &own_priv_key, RandomNumberGenerator &rng, KDF *kdf, MessageAuthenticationCode *mac, size_t mac_key_len=20)
| DLIES_Decryptor (const DH_PrivateKey &own_priv_key, RandomNumberGenerator &rng, KDF *kdf, Cipher_Mode *cipher, size_t cipher_key_len, MessageAuthenticationCode *mac, size_t mac_key_len=20)
void | set_initialization_vector (const InitializationVector &iv)
| Set the initialization vector for the data decryption method. More...

## Detailed Description

DLIES Decryption

Definition at line 96 of file dlies.h.

## Constructor & Destructor Documentation

Botan::DLIES_Decryptor::DLIES_Decryptor | ( | const DH_PrivateKey & | own_priv_key,
|  | RandomNumberGenerator & | rng,
|  | KDF * | kdf,
|  | MessageAuthenticationCode * | mac,
|  | size_t | mac_key_len = `20`
| ) |  |

Stream mode: use KDF to provide a stream of bytes to xor with the message

Parameters

  own_priv_key | own (ephemeral) DH private key
  rng | the RNG to use
  kdf | the KDF that should be used
  mac | the MAC function that should be used
  mac_key_len | key length of the MAC function. Default = 20 bytes

input = (ephemeral) public key + ciphertext + tag

Definition at line 135 of file dlies.cpp.

139 :
140 DLIES_Decryptor(own_priv_key, rng, kdf, nullptr, 0, mac, mac_key_length)
141 {}
Botan::DLIES_Decryptor::DLIES_Decryptor
DLIES_Decryptor(const DH_PrivateKey &own_priv_key, RandomNumberGenerator &rng, KDF *kdf, MessageAuthenticationCode *mac, size_t mac_key_len=20)
Definition: dlies.cpp:135

Botan::DLIES_Decryptor::DLIES_Decryptor | ( | const DH_PrivateKey & | own_priv_key,
|  | RandomNumberGenerator & | rng,
|  | KDF * | kdf,
|  | Cipher_Mode * | cipher,
|  | size_t | cipher_key_len,
|  | MessageAuthenticationCode * | mac,
|  | size_t | mac_key_len = `20`
| ) |  |

Block cipher mode

Parameters

  own_priv_key | own (ephemeral) DH private key
  rng | the RNG to use
  kdf | the KDF that should be used
  cipher | the block cipher that should be used
  cipher_key_len | the key length of the block cipher
  mac | the MAC function that should be used
  mac_key_len | key length of the MAC function. Default = 20 bytes

input = (ephemeral) public key + ciphertext + tag

Definition at line 115 of file dlies.cpp.

References BOTAN_ASSERT_NONNULL.

121 :
122 m_pub_key_size(own_priv_key.public_value().size()),
123 m_ka(own_priv_key, rng, "Raw"),
124 m_kdf(kdf),
125 m_cipher(cipher),
126 m_cipher_key_len(cipher_key_len),
127 m_mac(mac),
128 m_mac_keylen(mac_key_length),
129 m_iv()
130 {
131 BOTAN_ASSERT_NONNULL(kdf);
132 BOTAN_ASSERT_NONNULL(mac);
133 }
BOTAN_ASSERT_NONNULL
#define BOTAN_ASSERT_NONNULL(ptr)
Definition: assert.h:79

## Member Function Documentation

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt | ( | const uint8_t | in[],
|  | size_t | length
| ) |  | const
| inherited

Decrypt a ciphertext, throwing an exception if the input seems to be invalid (eg due to an accidental or malicious error in the ciphertext).

Parameters

  in | the ciphertext as a byte array
  length | the length of the above byte array

Returns
  decrypted message

Definition at line 16 of file pubkey.cpp.

Referenced by Botan::KeyPair::encryption_consistency_check().

17 {
18 uint8_t valid_mask = 0;
19
20 secure_vector<uint8_t> decoded = do_decrypt(valid_mask, in, length);
21
22 if(valid_mask == 0)
23 throw Decoding_Error("Invalid public key ciphertext, cannot decrypt");
24
25 return decoded;
26 }
template<typename Alloc >

secure_vector<uint8_t> Botan::PK_Decryptor::decrypt | ( | const std::vector< uint8_t, Alloc > & | in | ) | const
| inline inherited

Same as above, but taking a vector

Parameters

  in | the ciphertext

Returns
  decrypted message

Definition at line 105 of file pubkey.h.

References Botan::CryptoBox::decrypt().

106 {
107 return decrypt(in.data(), in.size());
108 }
Botan::PK_Decryptor::decrypt
secure_vector< uint8_t > decrypt(const uint8_t in[], size_t length) const
Definition: pubkey.cpp:16

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt_or_random | ( | const uint8_t | in[],
|  | size_t | length,
|  | size_t | expected_pt_len,
|  | RandomNumberGenerator & | rng
| ) |  | const
| inherited

Decrypt a ciphertext. If the ciphertext is invalid (eg due to invalid padding) or is not the expected length, instead returns a random string of the expected length. Use to avoid oracle attacks, especially against PKCS #1 v1.5 decryption.

Definition at line 77 of file pubkey.cpp.

81 {
82 return decrypt_or_random(in, length, expected_pt_len, rng,
83 nullptr, nullptr, 0);
84 }
Botan::PK_Decryptor::decrypt_or_random
secure_vector< uint8_t > decrypt_or_random(const uint8_t in[], size_t length, size_t expected_pt_len, RandomNumberGenerator &rng) const
Definition: pubkey.cpp:77

secure_vector< uint8_t > Botan::PK_Decryptor::decrypt_or_random | ( | const uint8_t | in[],
|  | size_t | length,
|  | size_t | expected_pt_len,
|  | RandomNumberGenerator & | rng,
|  | const uint8_t | required_content_bytes[],
|  | const uint8_t | required_content_offsets[],
|  | size_t | required_contents
| ) |  | const
| inherited

Decrypt a ciphertext. If the ciphertext is invalid (eg due to invalid padding) or is not the expected length, instead returns a random string of the expected length. Use to avoid oracle attacks, especially against PKCS #1 v1.5 decryption.

Additionally checks (also in const time) that: contents[required_content_offsets[i]] == required_content_bytes[i] for 0 <= i < required_contents

Used for example in TLS, which encodes the client version in the content bytes: if there is any timing variation the version check can be used as an oracle to recover the key.

Definition at line 29 of file pubkey.cpp.

References BOTAN_ASSERT, Botan::CT::conditional_copy_mem(), Botan::CT::is_equal(), and Botan::RandomNumberGenerator::random_vec().

36 {
37 const secure_vector<uint8_t> fake_pms = rng.random_vec(expected_pt_len);
38
39 uint8_t valid_mask = 0;
40 secure_vector<uint8_t> decoded = do_decrypt(valid_mask, in, length);
41
42 valid_mask &= CT::is_equal(decoded.size(), expected_pt_len);
43
44 decoded.resize(expected_pt_len);
45
46 for(size_t i = 0; i != required_contents_length; ++i)
47 {
48 /*
49 These values are chosen by the application and for TLS are constants,
50 so this early failure via assert is fine since we know 0,1 < 48
51
52 If there is a protocol that has content checks on the key where
53 the expected offsets are controllable by the attacker this could
54 still leak.
55
56 Alternately could always reduce the offset modulo the length?
57 */
58
59 const uint8_t exp = required_content_bytes[i];
60 const uint8_t off = required_content_offsets[i];
61
62 BOTAN_ASSERT(off < expected_pt_len, "Offset in range of plaintext");
63
64 valid_mask &= CT::is_equal(decoded[off], exp);
65 }
66
67 CT::conditional_copy_mem(valid_mask,
68 /*output*/decoded.data(),
69 /*from0*/decoded.data(),
70 /*from1*/fake_pms.data(),
71 expected_pt_len);
72
73 return decoded;
74 }
Botan::CT::conditional_copy_mem
void conditional_copy_mem(T value, T *to, const T *from0, const T *from1, size_t elems)
Definition: ct_utils.h:138
Botan::CT::is_equal
T is_equal(T x, T y)
Definition: ct_utils.h:116
BOTAN_ASSERT
#define BOTAN_ASSERT(expr, assertion_made)
Definition: assert.h:27

void Botan::DLIES_Decryptor::set_initialization_vector | ( | const InitializationVector & | iv | ) |
| inline

Set the initialization vector for the data decryption method.

Definition at line 138 of file dlies.h.

139 {
140 m_iv = iv;
141 }

The documentation for this class was generated from the following files:

- src/lib/pubkey/dlies/dlies.h
- src/lib/pubkey/dlies/dlies.cpp