/**
* Javascript implementation of RSA-KEM.
*
* @author Lautaro Cozzani Rodriguez
* @author Dave Longley
*
* Copyright (c) 2014 Lautaro Cozzani <lautaro.cozzani@scytl.com>
* Copyright (c) 2014 Digital Bazaar, Inc.
*/
var forge = require('./forge');
require('./util');
require('./random');
require('./jsbn');
module.exports = forge.kem = forge.kem || {};
var BigInteger = forge.jsbn.BigInteger;
/**
* The API for the RSA Key Encapsulation Mechanism (RSA-KEM) from ISO 18033-2.
*/
forge.kem.rsa = {};
/**
* Creates an RSA KEM API object for generating a secret asymmetric key.
*
* The symmetric key may be generated via a call to 'encrypt', which will
* produce a ciphertext to be transmitted to the recipient and a key to be
* kept secret. The ciphertext is a parameter to be passed to 'decrypt' which
* will produce the same secret key for the recipient to use to decrypt a
* message that was encrypted with the secret key.
*
* @param kdf the KDF API to use (eg: new forge.kem.kdf1()).
* @param options the options to use.
* [prng] a custom crypto-secure pseudo-random number generator to use,
* that must define "getBytesSync".
*/
forge.kem.rsa.create = function(kdf, options) {
options = options || {};
var prng = options.prng || forge.random;
var kem = {};
/**
* Generates a secret key and its encapsulation.
*
* @param publicKey the RSA public key to encrypt with.
* @param keyLength the length, in bytes, of the secret key to generate.
*
* @return an object with:
* encapsulation: the ciphertext for generating the secret key, as a
* binary-encoded string of bytes.
* key: the secret key to use for encrypting a message.
*/
kem.encrypt = function(publicKey, keyLength) {
// generate a random r where 1 < r < n
var byteLength = Math.ceil(publicKey.n.bitLength() / 8);
var r;
do {
r = new BigInteger(
forge.util.bytesToHex(prng.getBytesSync(byteLength)),
16).mod(publicKey.n);
} while(r.compareTo(BigInteger.ONE) <= 0);
// prepend r with zeros
r = forge.util.hexToBytes(r.toString(16));
var zeros = byteLength - r.length;
if(zeros > 0) {
r = forge.util.fillString(String.fromCharCode(0), zeros) + r;
}
// encrypt the random
var encapsulation = publicKey.encrypt(r, 'NONE');
// generate the secret key
var key = kdf.generate(r, keyLength);
return {encapsulation: encapsulation, key: key};
};
/**
* Decrypts an encapsulated secret key.
*
* @param privateKey the RSA private key to decrypt with.
* @param encapsulation the ciphertext for generating the secret key, as
* a binary-encoded string of bytes.
* @param keyLength the length, in bytes, of the secret key to generate.
*
* @return the secret key as a binary-encoded string of bytes.
*/
kem.decrypt = function(privateKey, encapsulation, keyLength) {
// decrypt the encapsulation and generate the secret key
var r = privateKey.decrypt(encapsulation, 'NONE');
return kdf.generate(r, keyLength);
};
return kem;
};
// TODO: add forge.kem.kdf.create('KDF1', {md: ..., ...}) API?
/**
* Creates a key derivation API object that implements KDF1 per ISO 18033-2.
*
* @param md the hash API to use.
* @param [digestLength] an optional digest length that must be positive and
* less than or equal to md.digestLength.
*
* @return a KDF1 API object.
*/
forge.kem.kdf1 = function(md, digestLength) {
_createKDF(this, md, 0, digestLength || md.digestLength);
};
/**
* Creates a key derivation API object that implements KDF2 per ISO 18033-2.
*
* @param md the hash API to use.
* @param [digestLength] an optional digest length that must be positive and
* less than or equal to md.digestLength.
*
* @return a KDF2 API object.
*/
forge.kem.kdf2 = function(md, digestLength) {
_createKDF(this, md, 1, digestLength || md.digestLength);
};
/**
* Creates a KDF1 or KDF2 API object.
*
* @param md the hash API to use.
* @param counterStart the starting index for the counter.
* @param digestLength the digest length to use.
*
* @return the KDF API object.
*/
function _createKDF(kdf, md, counterStart, digestLength) {
/**
* Generate a key of the specified length.
*
* @param x the binary-encoded byte string to generate a key from.
* @param length the number of bytes to generate (the size of the key).
*
* @return the key as a binary-encoded string.
*/
kdf.generate = function(x, length) {
var key = new forge.util.ByteBuffer();
// run counter from counterStart to ceil(length / Hash.len)
var k = Math.ceil(length / digestLength) + counterStart;
var c = new forge.util.ByteBuffer();
for(var i = counterStart; i < k; ++i) {
// I2OSP(i, 4): convert counter to an octet string of 4 octets
c.putInt32(i);
// digest 'x' and the counter and add the result to the key
md.start();
md.update(x + c.getBytes());
var hash = md.digest();
key.putBytes(hash.getBytes(digestLength));
}
// truncate to the correct key length
key.truncate(key.length() - length);
return key.getBytes();
};
}