diff --git a/COPYING b/COPYING --- a/COPYING +++ b/COPYING @@ -1,22 +1,24 @@ -Copyright (c) 2009 Marcel Fourné - -Permission is hereby granted, free of charge, to any person -obtaining a copy of this software and associated documentation -files (the "Software"), to deal in the Software without -restriction, including without limitation the rights to use, -copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the -Software is furnished to do so, subject to the following -conditions: +Copyright (c) 2009, Marcel Fourné +All rights reserved. -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + * Neither the name of the nor the + names of its contributors may be used to endorse or promote products + derived from this software without specific prior written permission. -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES -OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT -HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, -WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -OTHER DEALINGS IN THE SOFTWARE. +THIS SOFTWARE IS PROVIDED BY ''AS IS'' AND ANY +EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY +DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND +ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/README b/README --- a/README +++ b/README @@ -2,25 +2,48 @@ --- RSA just doesn't cut it anymore for fast public-key crypto. Keys are large for reasonable security making it quite slow... -Enter elliptic curves: smaller numbers are necessary and everything is faster. Maybe this library is not for embedded system usage, but now people can experiment with ECC for those use-cases where otherwise some form of RSA would be chosen. +Enter elliptic curves: smaller numbers are necessary and everything is faster. Maybe this library is not for embedded system usage, but now people can experiment with ECC for those use-cases where some form of RSA would be chosen otherwise. Hecc.Base ----------- This is the Haskell-Elliptic-Curve-Cryptography-library, or maybe more appropriately atm it is only the basic math for many ECC-algorithms the user of this library may wish to implement. -As an example the EC-variant of the Diffie-Hellman key-exchange is included which shows how the values can be computed with this library. -Also included is a basic speed-test (a point multiplication) for the NIST Curve P-256 (the author wants some usage results and performance-numbers... so...). +As an example the EC-variant of the Diffie-Hellman key-exchange is included which shows how the values can be computed with this library (a better variant will follow, this is just an example). +Also included is a basic speed-benchmarking-file (point multiplication) for example on the NIST Curve P-256 (the author wants some usage results and performance-numbers... so...). The API ------- -...is _not_ stable right now! This is only some ECC-playground. If anybody wants to use the library in its current state for serious cryptographic uses, then by all means contact the author! -The Code began as a prototyped script and has since been polished, but this is best-effort work in progress! +...is not stable right now. If anybody wants to use the library in its current state for serious cryptographic uses, then by all means contact the author! +The Code began as a prototyped script and has since been polished, but this is best-effort work in progress. + +pmul +---- + +Point multiplication can be done by this library using one of two algorithms: double-and-add and mongomery ladder. The latter is the default and is intended to be mostly resistant to timing attacks, the former may be faster, depending on the number it multiplies by. + + +Timing Attack Resistance +------------------------ +The point multiplication uses the montgomery ladder algorithm which should be timing attack resistant, but when mul by a number in binary form 1000..0 the operation gets strangely fast (us instead of ms) and 1000..0001 it is strangely slow (1.5 times), which hints to something fishy going on. More research will follow, but sidechannel-resistance is not totally out-of-focus. +Testing has given me the idea that the following-zeroes-case massively benefits from branch-prediction and the trailing-one-case throws it totally off (will have to check that on other CPUs). "More natural" numbers are safer (tested), but I wouldn't dare to say that the matter is resolved. +P.S.: 2^N-1 does not show the cache-problem, only long rows of zeroes. + + Plan ---- -Some algorithms using these primitives will likely follow (also: better versions of the primitives). +Some algorithms using these primitives will likely follow (ECDH, maybe ECDSA; also: better versions of the primitives). +Speed is a good goal, may have some more improvements in the future. +Testing is on the list. +Hyperelliptic Curves... maybe. +The upcoming Integer/GMP switch... haven't decided whether side to take... GMP-bindings or pure Haskell. + +Motivation +---------- + +This is a side-project from which other people may benefit. Due to time-constraints, I can't work as much on it as I would like. If you use/like it or want to make some criticism heard, please write me an email. diff --git a/hecc.cabal b/hecc.cabal --- a/hecc.cabal +++ b/hecc.cabal @@ -1,8 +1,8 @@ Name: hecc -Version: 0.1 +Version: 0.2 Synopsis: Elliptic Curve Cryptography for Haskell Description: Pure math & algorithms for Elliptic Curve Cryptography in Haskell -License: OtherLicense +License: BSD3 License-file: COPYING Copyright: (c) Marcel Fourné, 2009 Author: Marcel Fourné @@ -12,9 +12,12 @@ Build-Type: Simple Cabal-Version: >=1.2 Data-Files: README -Extra-Source-Files: src/test.hs +Extra-Source-Files: src/bench.hs src/Examples.hs hs-source-dirs: src -Build-Depends: base >= 3 && < 5 +Build-Depends: base >= 3 && < 5, + MonadRandom, + haskell98 Exposed-modules: Codec.Encryption.ECC.Base -ghc-options: -Wall + Codec.Encryption.ECC.StandardCurves +ghc-options: -Wall -O2 diff --git a/src/Codec/Encryption/ECC/Base.hs b/src/Codec/Encryption/ECC/Base.hs --- a/src/Codec/Encryption/ECC/Base.hs +++ b/src/Codec/Encryption/ECC/Base.hs @@ -1,45 +1,49 @@ {-# LANGUAGE PatternGuards #-} ----------------------------------------------------------------------------- -- | --- Module : Hecc.Base +-- Module : Codec.Encryption.ECC.Base -- Copyright : (c) Marcel Fourné 2009 --- License : MIT-X11-License +-- License : BSD3 -- Maintainer : Marcel Fourné (hecc@bitrot.dyndns.org -- -- ECC Base algorithms & point formats -- ----------------------------------------------------------------------------- -module Codec.Encryption.ECC.Base (ECInt(), - ECP(..), +module Codec.Encryption.ECC.Base (ECP(..), EC(..), modinv, pmul, ison, + genkey, EPa(..), EPp(..), EPj(..), EPmj(..)) where --- |this may change in the future if the need arises -type ECInt = Integer +import Control.Monad.Random +import Data.Bits +import Numeric +import Char -- |extended euclidean algorithm, recursive variant -eeukl :: ECInt -> ECInt -> (ECInt, ECInt, ECInt) +eeukl :: Integer -> Integer -> (Integer, Integer, Integer) eeukl a 0 = (a,1,0) eeukl a b = let (d,s,t) = eeukl b (a `mod` b) in (d,t,s-(div a b)*t) --- |computing the modular inverse -modinv :: ECInt -> ECInt -> ECInt +-- |computing the modular inverse of @a@ `mod` @m@ +modinv :: Integer -- ^the number to invert + -> Integer -- ^the modulus + -> Integer -- ^the inverted value modinv a m = let (x,y,_) = eeukl a m in if x == 1 then mod y m else undefined --- |class of all Elliptic Curves -data EC = EC (ECInt, ECInt, ECInt) +-- |class of all Elliptic Curves, has the form y^2=x^3+A*x+B mod P, the parameters being A, B and P +data EC = EC (Integer, Integer, Integer) deriving (Eq) instance Show EC where show (EC (a,b,p)) = "y^2=x^3+" ++ show a ++ "*x+" ++ show b ++ " mod " ++ show p @@ -47,17 +51,17 @@ class ECP a where -- |function returning the appropriate INF in the specific ECP-Format, for generic higher-level-algorithms inf :: a - -- |generic getters - getx :: a -> EC -> ECInt - -- |generic getters - gety :: a -> EC -> ECInt + -- |generic getter, returning the affine x-value + getx :: a -> EC -> Integer + -- |generic getters, returning the affine y-value + gety :: a -> EC -> Integer -- |add an elliptic point onto itself, base for padd a a c pdouble :: a -> EC -> a -- |add 2 elliptic points padd :: a -> a -> EC -> a --- |Elliptic Point Affine coordinates -data EPa = EPa (ECInt, ECInt) +-- |Elliptic Point Affine coordinates, two parameters x and y +data EPa = EPa (Integer, Integer) | Infa deriving (Eq) instance Show EPa where show (EPa (a,b)) = show (a,b) @@ -85,17 +89,17 @@ y3 = (lambda*(x1-x3)-y1) `mod` p in EPa (x3,y3) --- |Elliptic Point Projective coordinates -data EPp = EPp (ECInt, ECInt, ECInt) +-- |Elliptic Point Projective coordinates, three parameters x, y and z, like affine (x/z,y/z) +data EPp = EPp (Integer, Integer, Integer) | Infp deriving (Eq) instance Show EPp where show (EPp (a,b,c)) = show (a,b,c) show Infp = "Null" instance ECP EPp where inf = Infp - getx (EPp (x,_,z)) (EC (_,_,p))= (x * (modinv z p)) `mod` p + getx (EPp (x,_,z)) (EC (_,_,p)) = (x * (modinv z p)) `mod` p getx Infp _ = undefined - gety (EPp (_,y,z)) (EC (_,_,p))= (y * (modinv z p)) `mod` p + gety (EPp (_,y,z)) (EC (_,_,p)) = (y * (modinv z p)) `mod` p gety Infp _ = undefined pdouble (EPp (x1,y1,z1)) (EC (alpha,_,p)) = let a = (alpha*z1^(2::Int)+3*x1^(2::Int)) `mod` p @@ -121,8 +125,8 @@ z3 = (b^(3::Int)*z1*z2) `mod` p in EPp (x3,y3,z3) --- |Elliptic Point Jacobian coordinates -data EPj = EPj (ECInt, ECInt, ECInt) +-- |Elliptic Point Jacobian coordinates, three parameter x, y and z, like affine (x/z^2,y/z^3) +data EPj = EPj (Integer, Integer, Integer) | Infj deriving (Eq) instance Show EPj where show (EPj (a,b,c)) = show (a,b,c) @@ -158,8 +162,8 @@ z3 = (z1*z2*e) `mod` p in EPj (x3,y3,z3) --- |Elliptic Point Modified Jacobian coordinates -data EPmj = EPmj (ECInt, ECInt, ECInt, ECInt) +-- |Elliptic Point Modified Jacobian coordinates, four parameters x,y,z and A*z^4 (A being the first curve-parameter), like affine coordinates (x/z^2,y/z^3) +data EPmj = EPmj (Integer, Integer, Integer, Integer) | Infmj deriving (Eq) instance Show EPmj where show (EPmj (a,b,c,d)) = show (a,b,c,d) @@ -199,22 +203,51 @@ z3' = (alpha*z3^(4::Int)) `mod` p in EPmj (x3,y3,z3,z3') --- |this is a generic handle for Point Multiplication. The implementation will likely change. -pmul :: (ECP a) => a -> ECInt -> EC -> a -pmul = dnadd +-- |this is a generic handle for Point Multiplication. The implementation may change. +pmul :: (ECP a) => a -- ^the point to multiply + -> Integer -- ^times to multiply the point + -> EC -- ^the curve to operate on + -> a -- ^the result-point +pmul = montgladder +-- pmul = dnadd -- |double and add for generic ECP -dnadd :: (ECP a) => a -> ECInt -> EC -> a +dnadd :: (ECP a) => a -> Integer -> EC -> a dnadd b k' c@(EC (_,_,p)) = - let k'' = k' `mod` (p - 1) - ex a k s - | k == 0 = s - | k `mod` 2 == 0 = ex (pdouble a c) (k `div` 2) s - | otherwise = ex (pdouble a c) (k `div` 2) (padd a s c) - in ex b k'' inf + let k = k' `mod` (p - 1) + ex a i + | i < 0 = a + | not (testBit k i) = ex (pdouble a c) (i - 1) + | otherwise = ex (padd (pdouble a c) b c) (i - 1) + in ex inf (length (binary k) - 1) +-- montgomery ladder, timing-attack-resistant (except for caches...) +montgladder :: (ECP a) => a -> Integer -> EC -> a +montgladder b k' c@(EC (_,_,p)) = + let k = k' `mod` (p - 1) + ex p1 p2 i + | i < 0 = p1 + | not (testBit k i) = ex (pdouble p1 c) (padd p1 p2 c) (i - 1) + | otherwise = ex (padd p1 p2 c) (pdouble p2 c) (i - 1) + in ex b (pdouble b c) ((length (binary k)) - 2) + +-- binary representation of an integer +-- taken from http://haskell.org/haskellwiki/Fibonacci_primes_in_parallel +binary :: Integer -> String +binary = flip (showIntAtBase 2 intToDigit) [] + -- |generic verify, if generic ECP is on EC via getx and gety -ison :: (ECP a) => a -> EC -> Bool +ison :: (ECP a) => a -- ^ the elliptic curve point which we check + -> EC -- ^the curve to test on + -> Bool -- ^is the point on the curve? ison pt curve@(EC (alpha,beta,p)) = let x = getx pt curve y = gety pt curve in (y^(2::Int)) `mod` p == (x^(3::Int)+alpha*x+beta) `mod` p + +-- | given a generator and a curve, generate a point randomly +genkey :: (ECP a) => a -- ^a generator (a point on the curve which multiplied gets to be every other point on the curve) + -> EC -- ^the curve + -> IO a -- ^the random point which will be the key +genkey a c@(EC (_,_,p)) = do + n <- evalRandIO $ getRandomR (1,p) + return $ pmul a n c diff --git a/src/Codec/Encryption/ECC/StandardCurves.hs b/src/Codec/Encryption/ECC/StandardCurves.hs new file mode 100644 --- /dev/null +++ b/src/Codec/Encryption/ECC/StandardCurves.hs @@ -0,0 +1,37 @@ +----------------------------------------------------------------------------- +-- | +-- Module : Codec.Encryption.ECC.StandardCurves +-- Copyright : (c) Marcel Fourné 2009 +-- License : BSD3 +-- Maintainer : Marcel Fourné (hecc@bitrot.dyndns.org +-- +-- ECC Standard Curves, taken from Standard Documents found somewhere(tm) +-- +----------------------------------------------------------------------------- + + +module Codec.Encryption.ECC.StandardCurves + where + +data StandardCurve = StandardCurve {stdc_p::Integer,stdc_a::Integer,stdc_b::Integer,stdc_xp::Integer,stdc_yp::Integer} + +-- Curves over Prime Fields, NIST variety + +p521:: StandardCurve +p521 = StandardCurve { + stdc_p = 6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151, + stdc_a = 6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057149, + stdc_b = 1093849038073734274511112390766805569936207598951683748994586394495953116150735016013708737573759623248592132296706313309438452531591012912142327488478985984, + stdc_xp = 2661740802050217063228768716723360960729859168756973147706671368418802944996427808491545080627771902352094241225065558662157113545570916814161637315895999846, + stdc_yp = 3757180025770020463545507224491183603594455134769762486694567779615544477440556316691234405012945539562144444537289428522585666729196580810124344277578376784 + } + +p256:: StandardCurve +p256 = StandardCurve { + stdc_p = 115792089210356248762697446949407573530086143415290314195533631308867097853951, + stdc_a = 115792089210356248762697446949407573530086143415290314195533631308867097853948, + stdc_b = 41058363725152142129326129780047268409114441015993725554835256314039467401291, + stdc_xp = 48439561293906451759052585252797914202762949526041747995844080717082404635286, + stdc_yp = 36134250956749795798585127919587881956611106672985015071877198253568414405109 + } + diff --git a/src/Examples.hs b/src/Examples.hs --- a/src/Examples.hs +++ b/src/Examples.hs @@ -1,9 +1,17 @@ -module Examples (ecdh) - where +----------------------------------------------------------------------------- +-- | +-- Module : +-- Copyright : (c) Marcel Fourné 2009 +-- License : BSD3 +-- Maintainer : Marcel Fourné (hecc@bitrot.dyndns.org +-- +-- computing ECDH-values as an example +-- +----------------------------------------------------------------------------- import Codec.Encryption.ECC.Base -ecdh :: (ECP a) => EC -> a -> ECInt -> t -> ECInt +ecdh :: (ECP a) => EC -> a -> Integer -> t -> Integer ecdh c a kprivA kprivB = let kpubA = pmul a kprivA c kpubB = pmul a kprivA c ergA = pmul kpubB kprivA c diff --git a/src/bench.hs b/src/bench.hs new file mode 100644 --- /dev/null +++ b/src/bench.hs @@ -0,0 +1,59 @@ +----------------------------------------------------------------------------- +-- | +-- Module : +-- Copyright : (c) Marcel Fourné 2009 +-- License : BSD3 +-- Maintainer : Marcel Fourné (hecc@bitrot.dyndns.org +-- +-- benchmarking playground, not production quality +-- +----------------------------------------------------------------------------- +import Codec.Encryption.ECC.Base +--import Examples +import Criterion.Main +import Codec.Encryption.ECC.StandardCurves +import Control.Monad.Random +import Char + +testfkt:: (ECP a) => a -> Integer -> EC -> Int -> a +testfkt b k' c n = pmul b ((toInteger (n-n)) + k') c + +main = do +--{- + let c = EC (stdc_a p256,stdc_b p256,stdc_p p256) +-- k' = 78260987815077071890976764339238653408132491773166348437934213365482899760747 +-- k' = 2^254+2^253+2^252+2^251+2^250 +-- k' = 2^254+1 + k' <- evalRandIO $ getRandomR (1,stdc_p p256) + defaultMain [ + bench "NIST P-256" $ whnf (testfkt (EPp (stdc_xp p256,stdc_yp p256,1)) k' c) 10 + ] +---} +{- + let c = EC (stdc_a p521, stdc_b p521,stdc_p p521) + k' = 1093849038073734274511112390766805569936207598951683748994586394495953116150735016013708737573759623248592132296706313309438452531591012912142327488478985984 + in defaultMain [ + bench "NIST P-521" $ whnf (testfkt (EPp (stdc_xp p521,stdc_yp p521,1)) k' c) 10 + ] +---} +{- + let c = EC (stdc_a p256,stdc_b p256,stdc_p p256) + k' = 115792089210356248762697446949407573529996955224135760342422259061068512044368 + x = getx (pmul (EPp (stdc_xp p256, stdc_yp p256, 1)) k' c) c + y = gety (pmul (EPp (stdc_xp p256, stdc_yp p256, 1)) k' c) c + in print (x,y) +---} +{- + let p = 6277101735386680763835789423207666416083908700390324961279 + a = 6277101735386680763835789423207666416083908700390324961276 + b = 2455155546008943817740293915197451784769108058161191238065 + c = EC (a,b,p) + x = 602046282375688656758213480587526111916698976636884684818 + y = 174050332293622031404857552280219410364023488927386650641 + alpha = EPa (x,y) + kprivA = 5114103500503308041454439524093827019673558354999860770782 + kprivB = 1748161650263518407976227277807126651450677841379957675747 + in defaultMain [ + bench "ecdh" $ print [ (x,y)|x <-[1], y <- [(ecdh c alpha kprivA kprivB)]] + ] +---} diff --git a/src/test.hs b/src/test.hs deleted file mode 100644 --- a/src/test.hs +++ /dev/null @@ -1,44 +0,0 @@ -import Codec.Encryption.ECC.Base -import Examples -import System.CPUTime - -main = do - {-let p = 6277101735386680763835789423207666416083908700390324961279::ECInt - a = 6277101735386680763835789423207666416083908700390324961276::ECInt - b = 2455155546008943817740293915197451784769108058161191238065::ECInt - c = EC (a,b,p) - x = 602046282375688656758213480587526111916698976636884684818::ECInt - y = 174050332293622031404857552280219410364023488927386650641::ECInt - alpha = EPa (x,y) - kprivA = 5114103500503308041454439524093827019673558354999860770782::ECInt - kprivB = 1748161650263518407976227277807126651450677841379957675747::ECInt - print [ (x,y)|x <-[1], y <- [(ecdh c alpha kprivA kprivB)]] - -} - let p = 115792089210356248762697446949407573530086143415290314195533631308867097853951 - a = 115792089210356248762697446949407573530086143415290314195533631308867097853948 - b = 41058363725152142129326129780047268409114441015993725554835256314039467401291 - c = EC (a,b,p) - xp = 48439561293906451759052585252797914202762949526041747995844080717082404635286 - yp = 36134250956749795798585127919587881956611106672985015071877198253568414405109 - xq = 91120319633256209954638481795610364441930342474826146651283703640232629993874 - yq = 80764272623998874743522585409326200078679332703816718187804498579075161456710 - k' = 78260987815077071890976764339238653408132491773166348437934213365482899760747 - --pt = pmul (EPa (xp,yp)) k' c - --pt = pmul (EPp (xp,yp,1)) k' c - --pt = pmul (EPmj (xp,yp,1,a)) k' c - prec = cpuTimePrecision - - {-let p = 6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151 - a = 6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057149 - b = 1093849038073734274511112390766805569936207598951683748994586394495953116150735016013708737573759623248592132296706313309438452531591012912142327488478985984 - c = EC (a,b,p) - xp = 2661740802050217063228768716723360960729859168756973147706671368418802944996427808491545080627771902352094241225065558662157113545570916814161637315895999846 - yp = 3757180025770020463545507224491183603594455134769762486694567779615544477440556316691234405012945539562144444537289428522585666729196580810124344277578376784 - k' = 1093849038073734274511112390766805569936207598951683748994586394495953116150735016013708737573759623248592132296706313309438452531591012912142327488478985984 - prec = cpuTimePrecision - -} - t1 <- getCPUTime - print $ pmul (EPp (xp,yp,1)) k' c - t2 <- getCPUTime - putStrLn $ "Precision: " ++ (show (div prec (1000^2))) ++ " mikrosecs" - putStrLn $ "Time used: " ++ (show (div (t2 - t1) (1000^2))) ++ " mikrosecs"