|
| 1 | +package com.softwareverde.security.secp256k1; |
| 2 | + |
| 3 | +import com.softwareverde.constable.bytearray.ByteArray; |
| 4 | +import com.softwareverde.constable.bytearray.MutableByteArray; |
| 5 | +import com.softwareverde.logging.Logger; |
| 6 | +import com.softwareverde.security.hash.sha512.Sha512Hash; |
| 7 | +import com.softwareverde.security.secp256k1.key.PrivateKey; |
| 8 | +import com.softwareverde.security.secp256k1.key.PublicKey; |
| 9 | +import com.softwareverde.security.util.HashUtil; |
| 10 | +import com.softwareverde.util.Util; |
| 11 | +import com.softwareverde.util.bytearray.ByteArrayBuilder; |
| 12 | +import org.bouncycastle.math.ec.ECCurve; |
| 13 | +import org.bouncycastle.math.ec.ECPoint; |
| 14 | + |
| 15 | +import javax.crypto.Cipher; |
| 16 | +import javax.crypto.SecretKey; |
| 17 | +import javax.crypto.spec.IvParameterSpec; |
| 18 | +import javax.crypto.spec.SecretKeySpec; |
| 19 | +import java.math.BigInteger; |
| 20 | +import java.security.spec.AlgorithmParameterSpec; |
| 21 | + |
| 22 | +public class Ecies { |
| 23 | + protected static ByteArray substring(final ByteArray byteArray, final Integer offset) { |
| 24 | + final int byteCount = (byteArray.getByteCount() - offset); |
| 25 | + return ByteArray.wrap(byteArray.getBytes(offset, byteCount)); |
| 26 | + } |
| 27 | + |
| 28 | + public static class Aes { |
| 29 | + public static final String KEY_ALGORITHM = "AES"; |
| 30 | + public static final String ENCRYPTION_CIPHER = "AES/CBC/PKCS7Padding"; |
| 31 | + public static final Integer INITIALIZATION_VECTOR_BYTE_COUNT = 16; |
| 32 | + |
| 33 | + public static ByteArray encrypt(final ByteArray data, final PrivateKey key, final ByteArray initializationVectorBytes) { |
| 34 | + try { |
| 35 | + final SecretKey secretKey = new SecretKeySpec(key.getBytes(), 0, key.getByteCount(), KEY_ALGORITHM); |
| 36 | + |
| 37 | + final Cipher aesCipher = Cipher.getInstance(ENCRYPTION_CIPHER); |
| 38 | + final AlgorithmParameterSpec initializationVector = new IvParameterSpec(initializationVectorBytes.getBytes()); |
| 39 | + aesCipher.init(Cipher.ENCRYPT_MODE, secretKey, initializationVector); |
| 40 | + final byte[] cipherText = aesCipher.doFinal(data.getBytes()); |
| 41 | + |
| 42 | + final ByteArrayBuilder byteArrayBuilder = new ByteArrayBuilder(); |
| 43 | + byteArrayBuilder.appendBytes(initializationVectorBytes); |
| 44 | + byteArrayBuilder.appendBytes(cipherText); |
| 45 | + return byteArrayBuilder; |
| 46 | + } |
| 47 | + catch (final Exception exception) { |
| 48 | + Logger.error("Unable to encrypt data.", exception); |
| 49 | + return null; |
| 50 | + } |
| 51 | + } |
| 52 | + |
| 53 | + public static ByteArray decrypt(final ByteArray data, final ByteArray key) { |
| 54 | + try { |
| 55 | + final SecretKey secretKey = new SecretKeySpec(key.getBytes(), 0, key.getByteCount(), KEY_ALGORITHM); |
| 56 | + |
| 57 | + final byte[] initializationVectorBytes = data.getBytes(0, INITIALIZATION_VECTOR_BYTE_COUNT); |
| 58 | + final AlgorithmParameterSpec initializationVector = new IvParameterSpec(initializationVectorBytes); |
| 59 | + final ByteArray encryptedData = Ecies.substring(data, INITIALIZATION_VECTOR_BYTE_COUNT); |
| 60 | + |
| 61 | + final Cipher aesCipher = Cipher.getInstance(ENCRYPTION_CIPHER); |
| 62 | + aesCipher.init(Cipher.DECRYPT_MODE, secretKey, initializationVector); |
| 63 | + return ByteArray.wrap(aesCipher.doFinal(encryptedData.getBytes())); |
| 64 | + } |
| 65 | + catch (final Exception exception) { |
| 66 | + Logger.error("Unable to decrypt data.", exception); |
| 67 | + return null; |
| 68 | + } |
| 69 | + } |
| 70 | + } |
| 71 | + protected final PrivateKey _localPrivateKey; |
| 72 | + protected final PublicKey _remotePublicKey; |
| 73 | + protected Boolean _includePublicKey = false; |
| 74 | + |
| 75 | + protected Sha512Hash _getK() { |
| 76 | + final ECCurve curve = Secp256k1.CURVE_DOMAIN.getCurve(); |
| 77 | + final PublicKey decompressedPublicKey = _remotePublicKey.decompress(); |
| 78 | + final ECPoint KB = curve.decodePoint(decompressedPublicKey.getBytes()); |
| 79 | + final ECPoint P = KB.multiply(new BigInteger(1, _localPrivateKey.getBytes())); |
| 80 | + final BigInteger S = P.normalize().getXCoord().toBigInteger(); |
| 81 | + final MutableByteArray sBytes = new MutableByteArray(32); |
| 82 | + sBytes.setBytes(0, S.toByteArray()); |
| 83 | + |
| 84 | + return HashUtil.sha512(sBytes); |
| 85 | + } |
| 86 | + |
| 87 | + protected PrivateKey _getFirstK() { |
| 88 | + final Sha512Hash k = _getK(); |
| 89 | + return PrivateKey.fromBytes(k.getBytes(0, PrivateKey.KEY_BYTE_COUNT)); |
| 90 | + } |
| 91 | + |
| 92 | + protected PrivateKey _getLastK() { |
| 93 | + final Sha512Hash k = _getK(); |
| 94 | + return PrivateKey.fromBytes(Ecies.substring(k, PrivateKey.KEY_BYTE_COUNT)); |
| 95 | + } |
| 96 | + |
| 97 | + public Ecies(final PrivateKey privateKey, final PublicKey recipientPublicKey) { |
| 98 | + _localPrivateKey = privateKey; |
| 99 | + _remotePublicKey = recipientPublicKey; |
| 100 | + } |
| 101 | + |
| 102 | + public void setIncludePublicKey(final Boolean includePublicKey) { |
| 103 | + _includePublicKey = includePublicKey; |
| 104 | + } |
| 105 | + |
| 106 | + public Boolean getIncludePublicKey() { |
| 107 | + return _includePublicKey; |
| 108 | + } |
| 109 | + |
| 110 | + public ByteArray encrypt(final ByteArray message) { |
| 111 | + return this.encrypt(message, null); |
| 112 | + } |
| 113 | + |
| 114 | + public ByteArray encrypt(final ByteArray message, final ByteArray nullableInitializationVector) { |
| 115 | + final PublicKey sendersPublicKey; |
| 116 | + { |
| 117 | + final PublicKey uncompressedPublicKey = _localPrivateKey.getPublicKey(); |
| 118 | + sendersPublicKey = uncompressedPublicKey.compress(); |
| 119 | + } |
| 120 | + |
| 121 | + final ByteArray initializationVector; |
| 122 | + { |
| 123 | + final ByteArray hmac = (nullableInitializationVector != null ? nullableInitializationVector : HashUtil.sha256Hmac(message, _localPrivateKey)); |
| 124 | + initializationVector = ByteArray.wrap(hmac.getBytes(0, Aes.INITIALIZATION_VECTOR_BYTE_COUNT)); |
| 125 | + } |
| 126 | + |
| 127 | + final ByteArray c; |
| 128 | + { |
| 129 | + final PrivateKey kE = _getFirstK(); |
| 130 | + c = Aes.encrypt(message, kE, initializationVector); |
| 131 | + if (c == null) { return null; } |
| 132 | + } |
| 133 | + |
| 134 | + final ByteArray d; |
| 135 | + { |
| 136 | + final ByteArray ct = Ecies.substring(c, Aes.INITIALIZATION_VECTOR_BYTE_COUNT); |
| 137 | + final ByteArrayBuilder hmacPreImage = new ByteArrayBuilder(); |
| 138 | + { |
| 139 | + hmacPreImage.appendBytes(initializationVector); |
| 140 | + if (_includePublicKey) { |
| 141 | + hmacPreImage.appendBytes(sendersPublicKey); |
| 142 | + } |
| 143 | + hmacPreImage.appendBytes(ct); |
| 144 | + } |
| 145 | + |
| 146 | + final PrivateKey kM = _getLastK(); |
| 147 | + d = HashUtil.sha256Hmac(hmacPreImage, kM); |
| 148 | + } |
| 149 | + |
| 150 | + final ByteArrayBuilder result = new ByteArrayBuilder(); |
| 151 | + { |
| 152 | + if (_includePublicKey) { |
| 153 | + result.appendBytes(sendersPublicKey); |
| 154 | + } |
| 155 | + result.appendBytes(c); |
| 156 | + result.appendBytes(d); |
| 157 | + } |
| 158 | + |
| 159 | + return result; |
| 160 | + } |
| 161 | + |
| 162 | + public ByteArray decrypt(final ByteArray data) { |
| 163 | + final int publicKeyByteCount; |
| 164 | + final PublicKey sendersPublicKey; |
| 165 | + if (_includePublicKey) { |
| 166 | + final ByteArray publicKeyBytes; |
| 167 | + if (Util.areEqual(PublicKey.UNCOMPRESSED_FIRST_BYTE, data.getByte(0))) { |
| 168 | + publicKeyBytes = ByteArray.wrap(data.getBytes(0, PublicKey.UNCOMPRESSED_BYTE_COUNT)); |
| 169 | + publicKeyByteCount = PublicKey.UNCOMPRESSED_BYTE_COUNT; |
| 170 | + } |
| 171 | + else { |
| 172 | + publicKeyBytes = ByteArray.wrap(data.getBytes(0, PublicKey.COMPRESSED_BYTE_COUNT)); |
| 173 | + publicKeyByteCount = PublicKey.COMPRESSED_BYTE_COUNT; |
| 174 | + } |
| 175 | + sendersPublicKey = PublicKey.fromBytes(publicKeyBytes).compress(); |
| 176 | + if ((sendersPublicKey == null) || (! sendersPublicKey.isValid())) { return null; } |
| 177 | + |
| 178 | + final PublicKey publicKey = _localPrivateKey.getPublicKey(); |
| 179 | + if ( (! Util.areEqual(publicKey.compress(), sendersPublicKey)) && (! Util.areEqual(_remotePublicKey.compress(), sendersPublicKey)) ) { |
| 180 | + return null; |
| 181 | + } |
| 182 | + } |
| 183 | + else { |
| 184 | + publicKeyByteCount = 0; |
| 185 | + sendersPublicKey = null; // _remotePublicKey; |
| 186 | + } |
| 187 | + |
| 188 | + final int hmacByteCount = 32; |
| 189 | + |
| 190 | + final ByteArray c; |
| 191 | + { |
| 192 | + final int cByteCount = (data.getByteCount() - publicKeyByteCount - hmacByteCount); |
| 193 | + c = ByteArray.wrap(data.getBytes(publicKeyByteCount, cByteCount)); |
| 194 | + } |
| 195 | + |
| 196 | + final ByteArray d; |
| 197 | + { |
| 198 | + final int dOffset = (data.getByteCount() - hmacByteCount); |
| 199 | + d = Ecies.substring(data, dOffset); |
| 200 | + } |
| 201 | + |
| 202 | + final ByteArrayBuilder hmacPreImage = new ByteArrayBuilder(); |
| 203 | + { |
| 204 | + final ByteArray initializationVector = ByteArray.wrap(c.getBytes(0, Aes.INITIALIZATION_VECTOR_BYTE_COUNT)); |
| 205 | + final ByteArray ct = Ecies.substring(c, Aes.INITIALIZATION_VECTOR_BYTE_COUNT); |
| 206 | + |
| 207 | + hmacPreImage.appendBytes(initializationVector); |
| 208 | + if (_includePublicKey) { |
| 209 | + hmacPreImage.appendBytes(sendersPublicKey); |
| 210 | + } |
| 211 | + hmacPreImage.appendBytes(ct); |
| 212 | + } |
| 213 | + |
| 214 | + final ByteArray d2; |
| 215 | + { |
| 216 | + final PrivateKey kM = _getLastK(); |
| 217 | + d2 = HashUtil.sha256Hmac(hmacPreImage, kM); |
| 218 | + } |
| 219 | + |
| 220 | + final boolean checksumMatches = Util.areEqual(d, d2); |
| 221 | + if (! checksumMatches) { return null; } |
| 222 | + |
| 223 | + final PrivateKey kE = _getFirstK(); |
| 224 | + return Aes.decrypt(c, kE); |
| 225 | + } |
| 226 | +} |
0 commit comments