Subversion Repositories openrisc

/* ICMGenerator.java --

   Copyright (C) 2001, 2002, 2006 Free Software Foundation, Inc.

This file is a part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation; either version 2 of the License, or (at

your option) any later version.

GNU Classpath is distributed in the hope that it will be useful, but

WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

General Public License for more details.

You should have received a copy of the GNU General Public License

along with GNU Classpath; if not, write to the Free Software

Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301

USA

Linking this library statically or dynamically with other modules is

making a combined work based on this library.  Thus, the terms and

conditions of the GNU General Public License cover the whole

combination.

As a special exception, the copyright holders of this library give you

permission to link this library with independent modules to produce an

executable, regardless of the license terms of these independent

modules, and to copy and distribute the resulting executable under

terms of your choice, provided that you also meet, for each linked

independent module, the terms and conditions of the license of that

module.  An independent module is a module which is not derived from

or based on this library.  If you modify this library, you may extend

this exception to your version of the library, but you are not

obligated to do so.  If you do not wish to do so, delete this

exception statement from your version.  */

package gnu.javax.crypto.prng;

import gnu.java.security.Registry;

import gnu.java.security.prng.BasePRNG;

import gnu.java.security.prng.LimitReachedException;

import gnu.javax.crypto.cipher.CipherFactory;

import gnu.javax.crypto.cipher.IBlockCipher;

import java.math.BigInteger;

import java.security.InvalidKeyException;

import java.util.HashMap;

import java.util.Map;

/**

 * Counter Mode is a way to define a pseudorandom keystream generator using a

 * block cipher. The keystream can be used for additive encryption, key

 * derivation, or any other application requiring pseudorandom data.

 * <p>

 * In ICM, the keystream is logically broken into segments. Each segment is

 * identified with a segment index, and the segments have equal lengths. This

 * segmentation makes ICM especially appropriate for securing packet-based

 * protocols.

 * <p>

 * This implementation adheres to the definition of the ICM keystream generation

 * function that allows for any symetric key block cipher algorithm

 * (initialisation parameter <code>gnu.crypto.prng.icm.cipher.name</code>

 * taken to be an instance of {@link java.lang.String}) to be used. If such a

 * parameter is not defined/included in the initialisation <code>Map</code>,

 * then the "Rijndael" algorithm is used. Furthermore, if the initialisation

 * parameter <code>gnu.crypto.cipher.block.size</code> (taken to be a instance

 * of {@link java.lang.Integer}) is missing or undefined in the initialisation

 * <code>Map</code>, then the cipher's <em>default</em> block size is used.

 * <p>

 * The practical limits and constraints of such generator are:

 * <ul>

 * <li>The number of blocks in any segment <b>MUST NOT</b> exceed <code>

 *    256 ** BLOCK_INDEX_LENGTH</code>.

 * The number of segments <b>MUST NOT</b> exceed

 * <code>256 ** SEGMENT_INDEX_LENGTH</code>. These restrictions ensure the

 * uniqueness of each block cipher input.</li>

 * <li>Each segment contains <code>SEGMENT_LENGTH</code> octets; this value

 * <b>MUST NOT</b> exceed the value <code>(256 ** BLOCK_INDEX_LENGTH) *

 *    BLOCK_LENGTH</code>.</li>

 * <li>The sum of <code>SEGMENT_INDEX_LENGTH</code> and

 * <code>BLOCK_INDEX_LENGTH</code> <b>MUST NOT</b> exceed <code>BLOCK_LENGTH

 *    / 2</code>.

 * This requirement protects the ICM keystream generator from potentially

 * failing to be pseudorandom.</li>

 * </ul>

 * <p>

 * <b>NOTE</b>: Rijndael is used as the default symmetric key block cipher

 * algorithm because, with its default block and key sizes, it is the AES. Yet

 * being Rijndael, the algorithm offers more versatile block and key sizes which

 * may prove to be useful for generating <em>longer</em> key streams.

 * <p>

 * References:

 * <ol>

 * <li><a

 * href="http://www.ietf.org/internet-drafts/draft-mcgrew-saag-icm-00.txt">

 * Integer Counter Mode</a>, David A. McGrew.</li>

 * </ol>

 */

public class ICMGenerator

    extends BasePRNG

    implements Cloneable

{

  /** Property name of underlying block cipher for this ICM generator. */

  public static final String CIPHER = "gnu.crypto.prng.icm.cipher.name";

  /** Property name of ICM's block index length. */

  public static final String BLOCK_INDEX_LENGTH =

      "gnu.crypto.prng.icm.block.index.length";

  /** Property name of ICM's segment index length. */

  public static final String SEGMENT_INDEX_LENGTH =

      "gnu.crypto.prng.icm.segment.index.length";

  /** Property name of ICM's offset. */

  public static final String OFFSET = "gnu.crypto.prng.icm.offset";

  /** Property name of ICM's segment index. */

  public static final String SEGMENT_INDEX = "gnu.crypto.prng.icm.segment.index";

  /** The integer value 256 as a BigInteger. */

  private static final BigInteger TWO_FIFTY_SIX = new BigInteger("256");

  /** The underlying cipher implementation. */

  private IBlockCipher cipher;

  /** This keystream block index length in bytes. */

  private int blockNdxLength = -1;

  /** This keystream segment index length in bytes. */

  private int segmentNdxLength = -1;

  /** The index of the next block for a given keystream segment. */

  private BigInteger blockNdx = BigInteger.ZERO;

  /** The segment index for this keystream. */

  private BigInteger segmentNdx;

  /** The initial counter for a given keystream segment. */

  private BigInteger C0;

  /** Trivial 0-arguments constructor. */

  public ICMGenerator()

  {

    super(Registry.ICM_PRNG);

  }

  // Conceptually, ICM is a keystream generator that takes a secret key and a

  // segment index as an input and then outputs a keystream segment. The

  // segmentation lends itself to packet encryption, as each keystream segment

  // can be used to encrypt a distinct packet.

  //

  // An ICM key consists of the block cipher key and an Offset. The Offset is

  // an integer with BLOCK_LENGTH octets...

  public void setup(Map attributes)

  {

    // find out which cipher algorithm to use

    boolean newCipher = true;

    String underlyingCipher = (String) attributes.get(CIPHER);

    if (underlyingCipher == null)

      if (cipher == null) // happy birthday

        // ensure we have a reliable implementation of this cipher

        cipher = CipherFactory.getInstance(Registry.RIJNDAEL_CIPHER);

      else

        // we already have one. use it as is

        newCipher = false;

    else // ensure we have a reliable implementation of this cipher

      cipher = CipherFactory.getInstance(underlyingCipher);

    // find out what block size we should use it in

    int cipherBlockSize = 0;

    Integer bs = (Integer) attributes.get(IBlockCipher.CIPHER_BLOCK_SIZE);

    if (bs != null)

      cipherBlockSize = bs.intValue();

    else

      {

        if (newCipher) // assume we'll use its default block size

          cipherBlockSize = cipher.defaultBlockSize();

        // else use as is

      }

    // get the key material

    byte[] key = (byte[]) attributes.get(IBlockCipher.KEY_MATERIAL);

    if (key == null)

      throw new IllegalArgumentException(IBlockCipher.KEY_MATERIAL);

    // now initialise the cipher

    HashMap map = new HashMap();

    if (cipherBlockSize != 0) // only needed if new or changed

      map.put(IBlockCipher.CIPHER_BLOCK_SIZE, Integer.valueOf(cipherBlockSize));

    map.put(IBlockCipher.KEY_MATERIAL, key);

    try

      {

        cipher.init(map);

      }

    catch (InvalidKeyException x)

      {

        throw new IllegalArgumentException(IBlockCipher.KEY_MATERIAL);

      }

    // at this point we have an initialised (new or otherwise) cipher

    // ensure that remaining params make sense

    cipherBlockSize = cipher.currentBlockSize();

    BigInteger counterRange = TWO_FIFTY_SIX.pow(cipherBlockSize);

    // offset, like the underlying cipher key is not cloneable

    // always look for it and throw an exception if it's not there

    Object obj = attributes.get(OFFSET);

    // allow either a byte[] or a BigInteger

    BigInteger r;

    if (obj instanceof BigInteger)

      r = (BigInteger) obj;

    else // assume byte[]. should be same length as cipher block size

      {

        byte[] offset = (byte[]) obj;

        if (offset.length != cipherBlockSize)

          throw new IllegalArgumentException(OFFSET);

        r = new BigInteger(1, offset);

      }

    int wantBlockNdxLength = -1; // number of octets in the block index

    Integer i = (Integer) attributes.get(BLOCK_INDEX_LENGTH);

    if (i != null)

      {

        wantBlockNdxLength = i.intValue();

        if (wantBlockNdxLength < 1)

          throw new IllegalArgumentException(BLOCK_INDEX_LENGTH);

      }

    int wantSegmentNdxLength = -1; // number of octets in the segment index

    i = (Integer) attributes.get(SEGMENT_INDEX_LENGTH);

    if (i != null)

      {

        wantSegmentNdxLength = i.intValue();

        if (wantSegmentNdxLength < 1)

          throw new IllegalArgumentException(SEGMENT_INDEX_LENGTH);

      }

    // if both are undefined check if it's a reuse

    if ((wantBlockNdxLength == -1) && (wantSegmentNdxLength == -1))

      {

        if (blockNdxLength == -1) // new instance

          throw new IllegalArgumentException(BLOCK_INDEX_LENGTH + ", "

                                             + SEGMENT_INDEX_LENGTH);

        // else reuse old values

      }

    else // only one is undefined, set it to BLOCK_LENGTH/2 minus the other

      {

        int limit = cipherBlockSize / 2;

        if (wantBlockNdxLength == -1)

          wantBlockNdxLength = limit - wantSegmentNdxLength;

        else if (wantSegmentNdxLength == -1)

          wantSegmentNdxLength = limit - wantBlockNdxLength;

        else if ((wantSegmentNdxLength + wantBlockNdxLength) > limit)

          throw new IllegalArgumentException(BLOCK_INDEX_LENGTH + ", "

                                             + SEGMENT_INDEX_LENGTH);

        // save new values

        blockNdxLength = wantBlockNdxLength;

        segmentNdxLength = wantSegmentNdxLength;

      }

    // get the segment index as a BigInteger

    BigInteger s = (BigInteger) attributes.get(SEGMENT_INDEX);

    if (s == null)

      {

        if (segmentNdx == null) // segment index was never set

          throw new IllegalArgumentException(SEGMENT_INDEX);

        // reuse; check if still valid

        if (segmentNdx.compareTo(TWO_FIFTY_SIX.pow(segmentNdxLength)) > 0)

          throw new IllegalArgumentException(SEGMENT_INDEX);

      }

    else

      {

        if (s.compareTo(TWO_FIFTY_SIX.pow(segmentNdxLength)) > 0)

          throw new IllegalArgumentException(SEGMENT_INDEX);

        segmentNdx = s;

      }

    // The initial counter of the keystream segment with segment index s is

    // defined as follows, where r denotes the Offset:

    //

    // C[0] = (s * (256^BLOCK_INDEX_LENGTH) + r) modulo (256^BLOCK_LENGTH)

    C0 = segmentNdx.multiply(TWO_FIFTY_SIX.pow(blockNdxLength))

                   .add(r).modPow(BigInteger.ONE, counterRange);

    try

      {

        fillBlock();

      }

    catch (LimitReachedException impossible)

      {

        throw (InternalError)

          new InternalError().initCause(impossible);

      }

  }

  public void fillBlock() throws LimitReachedException

  {

    if (C0 == null)

      throw new IllegalStateException();

    if (blockNdx.compareTo(TWO_FIFTY_SIX.pow(blockNdxLength)) >= 0)

      throw new LimitReachedException();

    int cipherBlockSize = cipher.currentBlockSize();

    BigInteger counterRange = TWO_FIFTY_SIX.pow(cipherBlockSize);

    // encrypt the counter for the current blockNdx

    // C[i] = (C[0] + i) modulo (256^BLOCK_LENGTH).

    BigInteger Ci = C0.add(blockNdx).modPow(BigInteger.ONE, counterRange);

    buffer = Ci.toByteArray();

    int limit = buffer.length;

    if (limit < cipherBlockSize)

      {

        byte[] data = new byte[cipherBlockSize];

        System.arraycopy(buffer, 0, data, cipherBlockSize - limit, limit);

        buffer = data;

      }

    else if (limit > cipherBlockSize)

      {

        byte[] data = new byte[cipherBlockSize];

        System.arraycopy(buffer, limit - cipherBlockSize, data, 0,

                         cipherBlockSize);

        buffer = data;

      }

    cipher.encryptBlock(buffer, 0, buffer, 0);

    blockNdx = blockNdx.add(BigInteger.ONE); // increment blockNdx

  }

}