PaceEcdhProtocol.cs

using System;
using System.Xml;
using NeuroAccess.Nfc.TravelDocuments.Security;
using Waher.Content.Xml;
using Waher.Runtime.Inventory;
using Waher.Security.EllipticCurves;
using Waher.Security.SHA3;
 
namespace NeuroAccess.Nfc.TravelDocuments.PACE
{
    public abstract class PaceEcdhProtocol() : PaceProtocol()
    {
        private EllipticCurve? curve;
 
        public EllipticCurve? Curve => this.curve;
 
        public override bool IsConfigured => this.curve is not null;
 
        public override bool Configure(Vector SecurityInfo)
        {
            if (!base.Configure(SecurityInfo))
                return false;
 
            if (!this.ParameterId.HasValue ||
                this.ParameterId.Value < int.MinValue ||
                this.ParameterId.Value > int.MaxValue)
            {
                return false;
            }
 
            switch ((int)this.ParameterId.Value)
            {
                case 0:
                    return false;   // TODO: 1024 - bit MODP Group with 160 - bit Prime Order, RFC 5114
 
                case 1:
                    return false;   // TODO: 2048 - bit MODP Group with 224 - bit Prime Order, RFC 5114
 
                case 2:
                    return false;   // TODO: 2048 - bit MODP Group with 256 - bit Prime Order
 
                // 3-7: Reserved for future use
 
                case 8:
                    this.curve = new NistP192();
                    return true;
 
                case 9:
                    this.curve = new BrainpoolP192();
                    return true;
 
                case 10:
                    this.curve = new NistP224();
                    return true;
 
                case 11:
                    this.curve = new BrainpoolP224();
                    return true;
 
                case 12:
                    this.curve = new NistP256();
                    return true;
 
                case 13:
                    this.curve = new BrainpoolP256();
                    return true;
 
                case 14:
                    this.curve = new BrainpoolP320();
                    return true;
 
                case 15:
                    this.curve = new NistP384();
                    return true;
 
                case 16:
                    this.curve = new BrainpoolP384();
                    return true;
 
                case 17:
                    this.curve = new BrainpoolP512();
                    return true;
 
                case 18:
                    this.curve = new NistP521();
                    return true;
 
                // 19-31: Reserved for future use
 
                default:
                    return false;
            }
        }
 
        public override byte[] CreateNewKey(byte[]? Seed, ref int Index)
        {
            if (this.curve is null)
                throw new NotSupportedException("EEC Curve not configured.");
 
            if (Seed is null)
                this.curve.GenerateKeys();
            else
            {
                byte[] Secret = this.GenerateSecret(Seed, ref Index);
                this.curve.SetPrivateKey(Secret);
            }
 
            return this.curve.PublicKeyBigEndian;
        }
 
        public byte[] GenerateSecret(byte[]? Seed, ref int Index)
        {
            if (Seed is null)
                return this.curve!.GenerateSecret();
 
            SHAKE256 H = new(this.curve!.BigIntegerBytes << 3);
            byte[] B;
            System.Numerics.BigInteger D;
            System.Numerics.BigInteger? Order;
 
            if (this.curve is PrimeFieldCurve PrimeFieldCurve)
                Order = PrimeFieldCurve.Order;
            else
                Order = null;
 
            do
            {
                B = H.ComputeVariable(TravelDocumentsClient.CONCAT(Seed, BitConverter.GetBytes(Index++)));
                B[this.curve.BigIntegerBytes - 1] &= this.curve.MsbOrderMask;
 
                D = EllipticCurve.ToInt(B);
            }
            while (D.IsZero || (Order.HasValue && D >= Order));
 
            return B;
        }
 
        public override byte[] ImportKey(XmlDocument Xml)
        {
            if (this.curve is null)
                throw new NotSupportedException("EEC Curve not configured.");
 
            if (Xml?.DocumentElement is null)
                throw new ArgumentNullException(nameof(Xml), "Missing XML.");
 
            if (Xml.DocumentElement.Name != "EllipticCurve" ||
                Xml.DocumentElement.NamespaceURI != "http://waher.se/Schema/EllipticCurves.xsd")
            {
                throw new ArgumentException("Not an Elliptic Curve export XML document.", nameof(Xml));
            }
 
            if (XML.Attribute(Xml.DocumentElement, "type") != this.curve.GetType().FullName)
                throw new ArgumentException("Exported curve type does not match current curve.", nameof(Xml));
 
            byte[] Secret = Convert.FromBase64String(XML.Attribute(Xml.DocumentElement, "d"));
 
            this.curve.SetPrivateKey(Secret);
 
            return this.curve.PublicKeyBigEndian;
        }
 
        public override IPaceProtocol CreateEphemeralKey()
        {
            PaceEcdhProtocol Result = (PaceEcdhProtocol)Types.Instantiate(this.GetType());
 
            if (this.curve is not null)
                Result.curve = (EllipticCurve)Types.Instantiate(this.curve.GetType());
 
            return Result;
        }
 
        public void SetPrivateKey(byte[] PrivateKey)
        {
            if (this.curve is null)
                throw new NotSupportedException("EEC Curve not configured.");
 
            this.curve.SetPrivateKey(PrivateKey);
        }
 
        public override byte[] GetSharedSecret(byte[] RemotePublicKey)
        {
            //return this.curve!.GetSharedKey(RemotePublicKey, this.HashFunction);
 
            PointOnCurve H = this.curve!.GetSharedPoint(RemotePublicKey, true);
 
            byte[] X = H.X.ToByteArray();   // Little endian
            byte[] Y = H.Y.ToByteArray();   // Little endian
            int c = this.curve.OrderBytes;
 
            if (X.Length != c)
                Array.Resize(ref X, c);
 
            if (Y.Length != c)
                Array.Resize(ref Y, c);
 
            Array.Reverse(X);   // Most significant byte first.
            Array.Reverse(Y);   // Most significant byte first.
 
            byte[] Result = new byte[c << 1];
 
            Buffer.BlockCopy(X, 0, Result, 0, c);
            Buffer.BlockCopy(Y, 0, Result, c, c);
 
            return Result;
        }
 
        public PointOnCurve GetGenericMap(byte[] s, byte[] RemotePublicKey)
        {
            PointOnCurve G = this.curve!.BasePoint;
            PointOnCurve H = this.curve.GetSharedPoint(RemotePublicKey, true);
 
            byte[] s2 = (byte[])s.Clone();
            Array.Reverse(s2);
 
            PointOnCurve Ĝ = this.curve.ScalarMultiplication(s2, G, true);
            this.curve.AddTo(ref Ĝ, H);
 
            return Ĝ;
        }
    }
}