Blind the private exponent before the modular exponentiation in the prime-field asymmetric primitives, and add BigIntegers.createBlindedExponent for the shared step.

Author: gefeili

core/src/main/java/org/bouncycastle/crypto/agreement/DHAgreement.java

@@ -13,6 +13,7 @@
 import org.bouncycastle.crypto.params.DHPrivateKeyParameters;
 import org.bouncycastle.crypto.params.DHPublicKeyParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.util.BigIntegers;
 
 /**
  * a Diffie-Hellman key exchange engine.
@@ -114,12 +115,24 @@ public BigInteger calculateAgreement(DHPublicKeyParameters pub, BigInteger messa
             ? pub.getY()
             : new DHPublicKeyParameters(pub.getY(), dhParams).getY();
 
-        BigInteger result = peerY.modPow(privateValue, p);
+        // Both bases are peer-supplied and both exponents are private - privateValue is this run's
+        // ephemeral, key.getX() is the long-term key - so both exponents are blinded before the
+        // variable-time modPow. The multiples are of p-1 rather than of the subgroup order: the
+        // DHPublicKeyParameters construction above only checks the subgroup when the parameters carry
+        // q, so a base outside the order-q subgroup is possible, and for a safe prime an odd multiple
+        // of q would give the wrong shared secret for such a base.
+        BigInteger pSub1 = p.subtract(ONE);
+
+        BigInteger blindedPrivateValue = BigIntegers.createBlindedExponent(privateValue, pSub1, random);
+
+        BigInteger result = peerY.modPow(blindedPrivateValue, p);
         if (result.equals(ONE))
         {
             throw new IllegalStateException("Shared key can't be 1");
         }
 
-        return peerMessage.modPow(key.getX(), p).multiply(result).mod(p);
+        BigInteger blindedX = BigIntegers.createBlindedExponent(key.getX(), pSub1, random);
+
+        return peerMessage.modPow(blindedX, p).multiply(result).mod(p);
     }
 }

core/src/main/java/org/bouncycastle/crypto/agreement/DHBasicAgreement.java

@@ -1,6 +1,7 @@
 package org.bouncycastle.crypto.agreement;
 
 import java.math.BigInteger;
+import java.security.SecureRandom;
 
 import org.bouncycastle.crypto.BasicAgreement;
 import org.bouncycastle.crypto.CipherParameters;
@@ -10,6 +11,7 @@
 import org.bouncycastle.crypto.params.DHPrivateKeyParameters;
 import org.bouncycastle.crypto.params.DHPublicKeyParameters;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.util.BigIntegers;
 
 /**
  * a Diffie-Hellman key agreement class.
@@ -25,6 +27,7 @@ public class DHBasicAgreement
 
     private DHPrivateKeyParameters  key;
     private DHParameters            dhParams;
+    private SecureRandom            random;
 
     public void init(
         CipherParameters    param)
@@ -35,10 +38,12 @@ public void init(
         {
             ParametersWithRandom rParam = (ParametersWithRandom)param;
             kParam = (AsymmetricKeyParameter)rParam.getParameters();
+            this.random = CryptoServicesRegistrar.getSecureRandom(rParam.getRandom());
         }
         else
         {
             kParam = (AsymmetricKeyParameter)param;
+            this.random = CryptoServicesRegistrar.getSecureRandom();
         }
 
         if (!(kParam instanceof DHPrivateKeyParameters))
@@ -72,14 +77,22 @@ public BigInteger calculateAgreement(
         }
 
         BigInteger p = dhParams.getP();
+        BigInteger pSub1 = p.subtract(ONE);
 
         BigInteger peerY = pub.getY();
-        if (peerY == null || peerY.compareTo(ONE) <= 0 || peerY.compareTo(p.subtract(ONE)) >= 0)
+        if (peerY == null || peerY.compareTo(ONE) <= 0 || peerY.compareTo(pSub1) >= 0)
         {
             throw new IllegalArgumentException("Diffie-Hellman public key is weak");
         }
 
-        BigInteger result = peerY.modPow(key.getX(), p);
+        // peerY is peer-supplied and the exponent is our private value, which for static-static
+        // agreement is long lived, so the exponent is blinded before the variable-time modPow sees
+        // it. The multiple is of p-1 rather than of the subgroup order: peerY has only been range
+        // checked here, so it need not lie in the order-q subgroup, and for a safe prime an odd
+        // multiple of q would give the wrong shared secret for the values that do not.
+        BigInteger blindedX = BigIntegers.createBlindedExponent(key.getX(), pSub1, random);
+
+        BigInteger result = peerY.modPow(blindedX, p);
         if (result.equals(ONE))
         {
             throw new IllegalStateException("Shared key can't be 1");

core/src/main/java/org/bouncycastle/crypto/agreement/MQVBasicAgreement.java

@@ -1,6 +1,7 @@
 package org.bouncycastle.crypto.agreement;
 
 import java.math.BigInteger;
+import java.security.SecureRandom;
 
 import org.bouncycastle.crypto.BasicAgreement;
 import org.bouncycastle.crypto.CipherParameters;
@@ -10,18 +11,33 @@
 import org.bouncycastle.crypto.params.DHParameters;
 import org.bouncycastle.crypto.params.DHPrivateKeyParameters;
 import org.bouncycastle.crypto.params.DHPublicKeyParameters;
+import org.bouncycastle.crypto.params.ParametersWithRandom;
+import org.bouncycastle.util.BigIntegers;
 
 public class MQVBasicAgreement
     implements BasicAgreement
 {
     private static final BigInteger ONE = BigInteger.valueOf(1);
 
+    private SecureRandom random;
+
     DHMQVPrivateParameters privParams;
 
     public void init(
         CipherParameters key)
     {
-        this.privParams = (DHMQVPrivateParameters)key;
+        if (key instanceof ParametersWithRandom)
+        {
+            ParametersWithRandom rParam = (ParametersWithRandom)key;
+
+            this.privParams = (DHMQVPrivateParameters)rParam.getParameters();
+            this.random = CryptoServicesRegistrar.getSecureRandom(rParam.getRandom());
+        }
+        else
+        {
+            this.privParams = (DHMQVPrivateParameters)key;
+            this.random = CryptoServicesRegistrar.getSecureRandom();
+        }
 
         CryptoServicesRegistrar.checkConstraints(Utils.getDefaultProperties("MQV", this.privParams.getStaticPrivateKey()));
     }
@@ -75,7 +91,21 @@ private BigInteger calculateDHMQVAgreement(
         BigInteger TA =  tA.getY().mod(twoW).add(twoW);
         BigInteger SA =  rA.getX().add(TA.multiply(xA.getX())).mod(q);
         BigInteger TB =  tB.getY().mod(twoW).add(twoW);
-        BigInteger Z =   tB.getY().multiply(yB.getY().modPow(TB, parameters.getP())).modPow(SA, parameters.getP());
+
+        // SA carries the static private key, and the base below is built entirely from values the
+        // other party supplied, so the exponent is blinded before the variable-time modPow sees it.
+        // TB is derived from a public value and is left alone.
+        //
+        // A multiple of q is sound here, rather than of p-1, because every value in that base has
+        // been checked to lie in the order-q subgroup before it arrives: calculateAgreement requires
+        // q to be present and the peer's static parameters to equal ours, DHMQVPublicParameters
+        // requires the peer's two public keys to share domain parameters, and
+        // DHPublicKeyParameters rejects a y outside the subgroup whenever q is present. A product of
+        // subgroup elements is a subgroup element, so base^q = 1. q also keeps the exponent the size
+        // of SA, which is already reduced mod q - blinding with p-1 would grow it to the size of p.
+        BigInteger blindedSA = BigIntegers.createBlindedExponent(SA, q, random);
+
+        BigInteger Z =   tB.getY().multiply(yB.getY().modPow(TB, parameters.getP())).modPow(blindedSA, parameters.getP());
 
         return Z;
     }

core/src/main/java/org/bouncycastle/crypto/agreement/jpake/JPAKEParticipant.java

@@ -283,8 +283,8 @@ public JPAKERound1Payload createRound1PayloadToSend()
         this.x1 = JPAKEUtil.generateX1(q, random);
         this.x2 = JPAKEUtil.generateX2(q, random);
 
-        this.gx1 = JPAKEUtil.calculateGx(p, g, x1);
-        this.gx2 = JPAKEUtil.calculateGx(p, g, x2);
+        this.gx1 = JPAKEUtil.calculateGx(p, q, g, x1, random);
+        this.gx2 = JPAKEUtil.calculateGx(p, q, g, x2, random);
         BigInteger[] knowledgeProofForX1 = JPAKEUtil.calculateZeroKnowledgeProof(p, q, g, gx1, x1, participantId, digest, random);
         BigInteger[] knowledgeProofForX2 = JPAKEUtil.calculateZeroKnowledgeProof(p, q, g, gx2, x2, participantId, digest, random);
 
@@ -347,7 +347,7 @@ public JPAKERound2Payload createRound2PayloadToSend()
         BigInteger gA = JPAKEUtil.calculateGA(p, gx1, gx3, gx4);
         BigInteger s = calculateS();
         BigInteger x2s = JPAKEUtil.calculateX2s(q, x2, s);
-        BigInteger A = JPAKEUtil.calculateA(p, q, gA, x2s);
+        BigInteger A = JPAKEUtil.calculateA(p, q, gA, x2s, random);
         BigInteger[] knowledgeProofForX2s = JPAKEUtil.calculateZeroKnowledgeProof(p, q, gA, A, x2s, participantId, digest, random);
 
         this.state = STATE_ROUND_2_CREATED;
@@ -437,7 +437,7 @@ public BigInteger calculateKeyingMaterial()
         Arrays.fill(password, (char)0);
         this.password = null;
 
-        BigInteger keyingMaterial = JPAKEUtil.calculateKeyingMaterial(p, q, gx4, x2, s, b);
+        BigInteger keyingMaterial = JPAKEUtil.calculateKeyingMaterial(p, q, gx4, x2, s, b, random);
 
         /*
          * Clear the ephemeral private key fields as well.

core/src/main/java/org/bouncycastle/crypto/agreement/jpake/JPAKEUtil.java

@@ -4,6 +4,7 @@
 import java.security.SecureRandom;
 
 import org.bouncycastle.crypto.CryptoException;
+import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.Digest;
 import org.bouncycastle.crypto.Mac;
 import org.bouncycastle.crypto.macs.HMac;
@@ -27,6 +28,23 @@ public class JPAKEUtil
     static final BigInteger ZERO = BigInteger.valueOf(0);
     static final BigInteger ONE = BigInteger.valueOf(1);
 
+    /**
+     * Add a random multiple of q to a private exponent, so that the variable-time
+     * {@link BigInteger#modPow(BigInteger, BigInteger)} applied to it sees a different exponent on
+     * each call. The result is unchanged because every base J-PAKE raises is known to have order q:
+     * the generator g is checked with <code>g^q = 1</code> when the
+     * {@link JPAKEPrimeOrderGroup} is built, and each value received from the other participant is
+     * checked the same way by
+     * {@link #validateZeroKnowledgeProof(BigInteger, BigInteger, BigInteger, BigInteger, BigInteger[], String, Digest)}
+     * before it is ever used as a base. That is what makes a multiple of q sound here rather than
+     * one of p-1, and it matters for cost: the exponents are the size of q, so blinding with p-1
+     * would grow them to the size of p.
+     */
+    private static BigInteger blindExponent(BigInteger e, BigInteger q, SecureRandom random)
+    {
+        return BigIntegers.createBlindedExponent(e, q, CryptoServicesRegistrar.getSecureRandom(random));
+    }
+
     /**
      * Return a value that can be used as x1 or x3 during round 1.
      * <p>
@@ -91,13 +109,37 @@ public static BigInteger calculateS(BigInteger q, char[] password)
 
     /**
      * Calculate g^x mod p as done in round 1.
+     *
+     * @deprecated x is a private ephemeral value, and this method has no q to randomise the
+     * exponent with, so it falls back to a multiple of p-1 - always sound, but it grows the exponent
+     * from the size of q to the size of p. Use
+     * {@link #calculateGx(BigInteger, BigInteger, BigInteger, BigInteger, SecureRandom)} instead.
      */
     public static BigInteger calculateGx(
         BigInteger p,
         BigInteger g,
         BigInteger x)
     {
-        return g.modPow(x, p);
+        return g.modPow(blindExponent(x, p.subtract(ONE), null), p);
+    }
+
+    /**
+     * Calculate g^x mod p as done in round 1.
+     * <p>
+     * x is the participant's private ephemeral value; leaking it lets an attacker brute-force the
+     * password, so the exponent is randomised with a multiple of q before it is raised.
+     *
+     * @param random source of the randomisation, may be null to take the default from
+     * {@link CryptoServicesRegistrar}.
+     */
+    public static BigInteger calculateGx(
+        BigInteger p,
+        BigInteger q,
+        BigInteger g,
+        BigInteger x,
+        SecureRandom random)
+    {
+        return g.modPow(blindExponent(x, q, random), p);
     }
 
 
@@ -135,9 +177,28 @@ public static BigInteger calculateA(
         BigInteger q,
         BigInteger gA,
         BigInteger x2s)
+    {
+        return calculateA(p, q, gA, x2s, null);
+    }
+
+    /**
+     * Calculate A as done in round 2.
+     * <p>
+     * x2s carries the password, so the exponent is randomised with a multiple of q before it is
+     * raised. gA is a product of values each checked to have order q, so it has order q too.
+     *
+     * @param random source of the randomisation, may be null to take the default from
+     * {@link CryptoServicesRegistrar}.
+     */
+    public static BigInteger calculateA(
+        BigInteger p,
+        BigInteger q,
+        BigInteger gA,
+        BigInteger x2s,
+        SecureRandom random)
     {
         // A = ga^(x*s)
-        return gA.modPow(x2s, p);
+        return gA.modPow(blindExponent(x2s, q, random), p);
     }
 
     /**
@@ -161,7 +222,9 @@ public static BigInteger[] calculateZeroKnowledgeProof(
         BigInteger vMax = q.subtract(ONE);
         BigInteger v = BigIntegers.createRandomInRange(vMin, vMax, random);
 
-        BigInteger gv = g.modPow(v, p);
+        // r below is published, so recovering v from the timing of this call would give up x as
+        // (v - r) / h. The exponent is randomised with a multiple of q before it is raised.
+        BigInteger gv = g.modPow(blindExponent(v, q, random), p);
         BigInteger h = calculateHashForZeroKnowledgeProof(g, gv, gx, participantId, digest); // h
 
         zeroKnowledgeProof[0] = gv;
@@ -282,7 +345,36 @@ public static BigInteger calculateKeyingMaterial(
         BigInteger s,
         BigInteger B)
     {
-        return gx4.modPow(x2.multiply(s).negate().mod(q), p).multiply(B).modPow(x2, p);
+        return calculateKeyingMaterial(p, q, gx4, x2, s, B, null);
+    }
+
+    /**
+     * Calculates the keying material, which can be done after round 2 has completed.
+     * A session key must be derived from this key material using a secure key derivation function (KDF).
+     * The KDF used to derive the key is handled externally (i.e. not by {@link JPAKEParticipant}).
+     * <pre>
+     * KeyingMaterial = (B/g^{x2*x4*s})^x2
+     * </pre>
+     * <p>
+     * One exponent carries the password and the other the private ephemeral x2, so both are
+     * randomised with a multiple of q before they are raised. gx4 and B have each been checked to
+     * have order q, so the product raised by the second call does too.
+     *
+     * @param random source of the randomisation, may be null to take the default from
+     * {@link CryptoServicesRegistrar}.
+     */
+    public static BigInteger calculateKeyingMaterial(
+        BigInteger p,
+        BigInteger q,
+        BigInteger gx4,
+        BigInteger x2,
+        BigInteger s,
+        BigInteger B,
+        SecureRandom random)
+    {
+        BigInteger negX2s = blindExponent(x2.multiply(s).negate().mod(q), q, random);
+
+        return gx4.modPow(negX2s, p).multiply(B).modPow(blindExponent(x2, q, random), p);
     }
 
     /**

core/src/main/java/org/bouncycastle/crypto/agreement/srp/SRP6Client.java

@@ -4,8 +4,10 @@
 import java.security.SecureRandom;
 
 import org.bouncycastle.crypto.CryptoException;
+import org.bouncycastle.crypto.CryptoServicesRegistrar;
 import org.bouncycastle.crypto.Digest;
 import org.bouncycastle.crypto.params.SRP6GroupParameters;
+import org.bouncycastle.util.BigIntegers;
 
 /**
  * Implements the client side SRP-6a protocol. Note that this class is stateful, and therefore NOT threadsafe.
@@ -68,7 +70,7 @@ public BigInteger generateClientCredentials(byte[] salt, byte[] identity, byte[]
     {
         this.x = SRP6Util.calculateX(digest, N, salt, identity, password);
         this.a = selectPrivateValue();
-        this.A = g.modPow(a, N);
+        this.A = g.modPow(blindExponent(a), N);
 
         return A;
     }
@@ -97,10 +99,26 @@ private BigInteger calculateS()
     {
         BigInteger k = SRP6Util.calculateK(digest, N, g);
         BigInteger exp = u.multiply(x).add(a);
-        BigInteger tmp = g.modPow(x, N).multiply(k).mod(N);
-        return B.subtract(tmp).mod(N).modPow(exp, N);
+        BigInteger tmp = g.modPow(blindExponent(x), N).multiply(k).mod(N);
+        return B.subtract(tmp).mod(N).modPow(blindExponent(exp), N);
     }
-    
+
+    /**
+     * Add a random multiple of N-1 to a private exponent, so that the variable-time
+     * BigInteger.modPow applied to it sees a different exponent on each call. Raising any value
+     * coprime to the prime N to the power N-1 gives 1 by Fermat's little theorem, so the result is
+     * unchanged; a base of 0 is likewise unaffected, since 0 to any positive power is 0. The
+     * multiple is of N-1 rather than of the order of g because the bases blinded here include a
+     * server-supplied value that need not lie in the subgroup g generates, and for a safe prime an
+     * odd multiple of that order would give the wrong answer for the values that do not.
+     */
+    private BigInteger blindExponent(BigInteger e)
+    {
+        return BigIntegers.createBlindedExponent(e, N.subtract(BigInteger.ONE),
+            CryptoServicesRegistrar.getSecureRandom(random));
+    }
+
+
     /**
      * Computes the client evidence message M1 using the previously received values.
      * To be called after calculating the secret S.