Bouncy Castle Cryptography Library 1.80 · org.bouncycastle.crypto.agreement.jpake.JPAKEUtil

Modifier and Type	Field and Description
pack-priv static final BigInteger	ONE
pack-priv static final BigInteger	ZERO

Access	Constructor and Description
public	JPAKEUtil()

Method Summary

Modifier and Type	Method and Description
public static BigInteger	calculateA(BigInteger p, BigInteger q, BigInteger gA, BigInteger x2s) Calculate A as done in round 2.
public static BigInteger	calculateGA(BigInteger p, BigInteger gx1, BigInteger gx3, BigInteger gx4) Calculate ga as done in round 2.
public static BigInteger	calculateGx(BigInteger p, BigInteger g, BigInteger x) Calculate g^x mod p as done in round 1.
private static BigInteger	calculateHashForZeroKnowledgeProof(BigInteger g, BigInteger gr, BigInteger gx, String participantId, Digest digest)
public static BigInteger	calculateKeyingMaterial(BigInteger p, BigInteger q, BigInteger gx4, BigInteger x2, BigInteger s, BigInteger B) Calculates the keying material, which can be done after round 2 has completed.
private static byte[]	calculateMacKey(BigInteger keyingMaterial, Digest digest) Calculates the MacKey (i.e. the key to use when calculating the MagTag for key confirmation).
public static BigInteger	calculateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest) Calculates the MacTag (to be used for key confirmation), as defined by NIST SP 800-56A Revision 1, Section 8.2 Unilateral Key Confirmation for Key Agreement Schemes.
public static BigInteger	calculateS(char[] password) Deprecated Use version including the modulus instead. Converts the given password to a `BigInteger` for use in arithmetic calculations.
public static BigInteger	calculateS(BigInteger q, byte[] password) Converts the given password to a `BigInteger` mod q.
public static BigInteger	calculateS(BigInteger q, char[] password) Converts the given password to a `BigInteger` mod q.
public static BigInteger	calculateX2s(BigInteger q, BigInteger x2, BigInteger s) Calculate x2 * s as done in round 2.
public static BigInteger[]	calculateZeroKnowledgeProof(BigInteger p, BigInteger q, BigInteger g, BigInteger gx, BigInteger x, String participantId, Digest digest, SecureRandom random) Calculate a zero knowledge proof of x using Schnorr's signature.
public static BigInteger	generateX1(BigInteger q, SecureRandom random) Return a value that can be used as x1 or x3 during round 1.
public static BigInteger	generateX2(BigInteger q, SecureRandom random) Return a value that can be used as x2 or x4 during round 1.
private static byte[]	intToByteArray(int value)
private static void	updateDigest(Digest digest, BigInteger bigInteger)
private static void	updateDigest(Digest digest, String string)
private static void	updateDigestIncludingSize(Digest digest, BigInteger bigInteger)
private static void	updateDigestIncludingSize(Digest digest, String string)
private static void	updateMac(Mac mac, BigInteger bigInteger)
private static void	updateMac(Mac mac, String string)
public static void	validateGa(BigInteger ga) Validates that ga is not 1.
public static void	validateGx4(BigInteger gx4) Validates that g^x4 is not 1.
public static void	validateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest, BigInteger the MacTag received from the partner. partnerMacTag) Validates the MacTag received from the partner participant.
public static void	validateNotNull(Object object in question object, String name of the object (to be used in exception message) description) Validates that the given object is not null.
public static void	validateParticipantIdsDiffer(String participantId1, String participantId2) Validates that the given participant ids are not equal.
public static void	validateParticipantIdsEqual(String expectedParticipantId, String actualParticipantId) Validates that the given participant ids are equal.
public static void	validateZeroKnowledgeProof(BigInteger p, BigInteger q, BigInteger g, BigInteger gx, BigInteger[] zeroKnowledgeProof, String participantId, Digest digest) Validates the zero knowledge proof (generated by `calculateZeroKnowledgeProof(BigInteger, BigInteger, BigInteger, BigInteger, BigInteger, String, Digest, SecureRandom)`) is correct.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

ONE	back to summary
pack-priv static final BigInteger ONE

ZERO	back to summary
pack-priv static final BigInteger ZERO

JPAKEUtil	back to summary
public JPAKEUtil()

Method Detail

calculateA	back to summary
public static BigInteger calculateA(BigInteger p, BigInteger q, BigInteger gA, BigInteger x2s) Calculate A as done in round 2.

calculateGA	back to summary
public static BigInteger calculateGA(BigInteger p, BigInteger gx1, BigInteger gx3, BigInteger gx4) Calculate ga as done in round 2.

calculateGx	back to summary
public static BigInteger calculateGx(BigInteger p, BigInteger g, BigInteger x) Calculate g^x mod p as done in round 1.

calculateHashForZeroKnowledgeProof	back to summary
private static BigInteger calculateHashForZeroKnowledgeProof(BigInteger g, BigInteger gr, BigInteger gx, String participantId, Digest digest)

calculateKeyingMaterial back to summary

calculateKeyingMaterial	back to summary
public static BigInteger calculateKeyingMaterial(BigInteger p, BigInteger q, BigInteger gx4, BigInteger x2, BigInteger s, BigInteger B) Calculates the keying material, which can be done after round 2 has completed. A session key must be derived from this key material using a secure key derivation function (KDF). The KDF used to derive the key is handled externally (i.e. not by `JPAKEParticipant`). KeyingMaterial = (B/g^{x2x4s})^x2

public static BigInteger calculateKeyingMaterial(BigInteger p, BigInteger q, BigInteger gx4, BigInteger x2, BigInteger s, BigInteger B)

Calculates the keying material, which can be done after round 2 has completed. A session key must be derived from this key material using a secure key derivation function (KDF). The KDF used to derive the key is handled externally (i.e. not by JPAKEParticipant).

KeyingMaterial = (B/g^{x2*x4*s})^x2

calculateMacKey	back to summary
private static byte[] calculateMacKey(BigInteger keyingMaterial, Digest digest) Calculates the MacKey (i.e. the key to use when calculating the MagTag for key confirmation). MacKey = H(K \|\| "JPAKE_KC")

calculateMacKey

back to summary

private static byte[] calculateMacKey(BigInteger keyingMaterial, Digest digest)

Calculates the MacKey (i.e. the key to use when calculating the MagTag for key confirmation).

MacKey = H(K || "JPAKE_KC")

calculateMacTag back to summary

calculateMacTag	back to summary
public static BigInteger calculateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest) Calculates the MacTag (to be used for key confirmation), as defined by NIST SP 800-56A Revision 1, Section 8.2 Unilateral Key Confirmation for Key Agreement Schemes. MacTag = HMAC(MacKey, MacLen, MacData) MacKey = H(K \|\| "JPAKE_KC") MacData = "KC_1_U" \|\| participantId \|\| partnerParticipantId \|\| gx1 \|\| gx2 \|\| gx3 \|\| gx4 Note that both participants use "KC_1_U" because the sender of the round 3 message is always the initiator for key confirmation. HMAC = `HMac` used with the given `Digest` H = The given `Digest` MacLen = length of MacTag

public static BigInteger calculateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest)

Calculates the MacTag (to be used for key confirmation), as defined by NIST SP 800-56A Revision 1, Section 8.2 Unilateral Key Confirmation for Key Agreement Schemes.

MacTag = HMAC(MacKey, MacLen, MacData)

MacKey = H(K || "JPAKE_KC")

MacData = "KC_1_U" || participantId || partnerParticipantId || gx1 || gx2 || gx3 || gx4

Note that both participants use "KC_1_U" because the sender of the round 3 message
is always the initiator for key confirmation.

HMAC = HMac used with the given Digest
H = The given Digest
MacLen = length of MacTag

calculateS	back to summary
public static BigInteger calculateS(char[] password) Deprecated Use version including the modulus instead. Converts the given password to a `BigInteger` for use in arithmetic calculations.

calculateS	back to summary
public static BigInteger calculateS(BigInteger q, byte[] password) throws CryptoException Converts the given password to a `BigInteger` mod q.

calculateS	back to summary
public static BigInteger calculateS(BigInteger q, char[] password) throws CryptoException Converts the given password to a `BigInteger` mod q.

calculateX2s	back to summary
public static BigInteger calculateX2s(BigInteger q, BigInteger x2, BigInteger s) Calculate x2 * s as done in round 2.

calculateZeroKnowledgeProof	back to summary
public static BigInteger[] calculateZeroKnowledgeProof(BigInteger p, BigInteger q, BigInteger g, BigInteger gx, BigInteger x, String participantId, Digest digest, SecureRandom random) Calculate a zero knowledge proof of x using Schnorr's signature. The returned array has two elements {g^v, r = v-x*h} for x.

generateX1 back to summary

generateX1	back to summary
public static BigInteger generateX1(BigInteger q, SecureRandom random) Return a value that can be used as x1 or x3 during round 1. The returned value is a random value in the range `[0, q-1]`.

public static BigInteger generateX1(BigInteger q, SecureRandom random)

Return a value that can be used as x1 or x3 during round 1.

The returned value is a random value in the range [0, q-1].

generateX2 back to summary

generateX2	back to summary
public static BigInteger generateX2(BigInteger q, SecureRandom random) Return a value that can be used as x2 or x4 during round 1. The returned value is a random value in the range `[1, q-1]`.

public static BigInteger generateX2(BigInteger q, SecureRandom random)

Return a value that can be used as x2 or x4 during round 1.

The returned value is a random value in the range [1, q-1].

intToByteArray	back to summary
private static byte[] intToByteArray(int value)

updateDigest	back to summary
private static void updateDigest(Digest digest, BigInteger bigInteger)

updateDigest	back to summary
private static void updateDigest(Digest digest, String string)

updateDigestIncludingSize	back to summary
private static void updateDigestIncludingSize(Digest digest, BigInteger bigInteger)

updateDigestIncludingSize	back to summary
private static void updateDigestIncludingSize(Digest digest, String string)

updateMac	back to summary
private static void updateMac(Mac mac, BigInteger bigInteger)

updateMac	back to summary
private static void updateMac(Mac mac, String string)

validateGa	back to summary
public static void validateGa(BigInteger ga) throws CryptoException Validates that ga is not 1. As described by Feng Hao... Alice could simply check ga != 1 to ensure it is a generator. In fact, as we will explain in Section 3, (x1 + x3 + x4 ) is random over Zq even in the face of active attacks. Hence, the probability for ga = 1 is extremely small - on the order of 2^160 for 160-bit q. Exceptions CryptoException: if ga is 1

validateGa

back to summary

public static void validateGa(BigInteger ga) throws CryptoException

Validates that ga is not 1.

As described by Feng Hao...

Alice could simply check ga != 1 to ensure it is a generator. In fact, as we will explain in Section 3, (x1 + x3 + x4 ) is random over Zq even in the face of active attacks. Hence, the probability for ga = 1 is extremely small - on the order of 2^160 for 160-bit q.

Exceptions

CryptoException:: if ga is 1

validateGx4	back to summary
public static void validateGx4(BigInteger gx4) throws CryptoException Validates that g^x4 is not 1. Exceptions CryptoException: if g^x4 is 1

validateGx4

back to summary

public static void validateGx4(BigInteger gx4) throws CryptoException

Validates that g^x4 is not 1.

Exceptions

CryptoException:: if g^x4 is 1

validateMacTag	back to summary
public static void validateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest, BigInteger partnerMacTag) throws CryptoException Validates the MacTag received from the partner participant. Parameters partnerMacTag:BigInteger the MacTag received from the partner. Exceptions CryptoException: if the participantId strings are equal.

validateMacTag

back to summary

public static void validateMacTag(String participantId, String partnerParticipantId, BigInteger gx1, BigInteger gx2, BigInteger gx3, BigInteger gx4, BigInteger keyingMaterial, Digest digest, BigInteger partnerMacTag) throws CryptoException

Validates the MacTag received from the partner participant.

Parameters

partnerMacTag:BigInteger: the MacTag received from the partner.

Exceptions

CryptoException:: if the participantId strings are equal.

validateNotNull	back to summary
public static void validateNotNull(Object object, String description) Validates that the given object is not null. Parameters object:Object object in question description:String name of the object (to be used in exception message) Exceptions NullPointerException: if the object is null.

validateNotNull

back to summary

public static void validateNotNull(Object object, String description)

Validates that the given object is not null.

Parameters

object:Object: object in question
description:String: name of the object (to be used in exception message)

Exceptions

NullPointerException:: if the object is null.

validateParticipantIdsDiffer	back to summary
public static void validateParticipantIdsDiffer(String participantId1, String participantId2) throws CryptoException Validates that the given participant ids are not equal. (For the J-PAKE exchange, each participant must use a unique id.) Exceptions CryptoException: if the participantId strings are equal.

validateParticipantIdsDiffer

back to summary

public static void validateParticipantIdsDiffer(String participantId1, String participantId2) throws CryptoException

Validates that the given participant ids are not equal. (For the J-PAKE exchange, each participant must use a unique id.)

Exceptions

CryptoException:: if the participantId strings are equal.

validateParticipantIdsEqual	back to summary
public static void validateParticipantIdsEqual(String expectedParticipantId, String actualParticipantId) throws CryptoException Validates that the given participant ids are equal. This is used to ensure that the payloads received from each round all come from the same participant. Exceptions CryptoException: if the participantId strings are equal.

validateParticipantIdsEqual

back to summary

public static void validateParticipantIdsEqual(String expectedParticipantId, String actualParticipantId) throws CryptoException

Validates that the given participant ids are equal. This is used to ensure that the payloads received from each round all come from the same participant.

Exceptions

CryptoException:: if the participantId strings are equal.

validateZeroKnowledgeProof back to summary

validateZeroKnowledgeProof	back to summary
public static void validateZeroKnowledgeProof(BigInteger p, BigInteger q, BigInteger g, BigInteger gx, BigInteger[] zeroKnowledgeProof, String participantId, Digest digest) throws CryptoException Validates the zero knowledge proof (generated by `calculateZeroKnowledgeProof(BigInteger, BigInteger, BigInteger, BigInteger, BigInteger, String, Digest, SecureRandom)`) is correct. Exceptions CryptoException: if the zero knowledge proof is not correct

public static void validateZeroKnowledgeProof(BigInteger p, BigInteger q, BigInteger g, BigInteger gx, BigInteger[] zeroKnowledgeProof, String participantId, Digest digest) throws CryptoException

Validates the zero knowledge proof (generated by calculateZeroKnowledgeProof(BigInteger, BigInteger, BigInteger, BigInteger, BigInteger, String, Digest, SecureRandom)) is correct.

Exceptions

CryptoException:: if the zero knowledge proof is not correct

public Class JPAKEUtil

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail