Skip to content

Commit d8b9db2

Browse files
famoserfamoser
committed
test: Add GMP ECC test
1 parent 858c378 commit d8b9db2

File tree

1 file changed

+368
-0
lines changed

1 file changed

+368
-0
lines changed

‎ext/gmp/tests/gmp_cryptography_ecc.phpt

+368
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,368 @@
1+
--TEST--
2+
Examples of the usage of gmp for elliptic curve cryptography.
3+
--DESCRIPTION--
4+
DANGER: DO NOT USE IN SECURITY-RELATED USE-CASES.
5+
This implementation is not hardened or tested against side channels (e.g. time or cache).
6+
Side-channels as contained in this implementation may compromise secrets (e.g. secret keys).
7+
Hence, it MUST NOT BE USED IN SECURITY-RELATED USE-CASES.
8+
9+
This implementation operates on the secp256r1 curve from https://www.secg.org/sec2-v2.pdf (also known as NIST P-256).
10+
For addition and doublication, it implements https://www.secg.org/sec1-v2.pdf (2.2.1).
11+
For point decompression, it implements https://www.secg.org/sec1-v2.pdf (2.3.4).
12+
For scalar multiplication, it uses the well-known double-add-always pardigm.
13+
14+
The implementation executes a diffie-hellman handshake.
15+
Omitted is an explicit demonstration of (public-key) encryption, commitments, zero-knowledge proofs or similar common applications.
16+
However, the operations used for diffie-hellman is at the core of all these other applications, hence these use-cases are implicitly covered.
17+
18+
$aliceSecret and $bobSecret generated with
19+
$random = gmp_random_range(0, $n);
20+
$randomHex = strtoupper(gmp_strval($random, 16));
21+
echo chunk_split($randomHex, 8, " ");
22+
--EXTENSIONS--
23+
gmp
24+
--FILE--
25+
<?php
26+
27+
/**
28+
* Elliptic curve point with x and y coordinates
29+
*/
30+
class Point
31+
{
32+
public function __construct(public \GMP $x, public \GMP $y)
33+
{
34+
}
35+
36+
public static function createInfinity(): Point
37+
{
38+
return new Point(gmp_init(0), gmp_init(0));
39+
}
40+
41+
public function isInfinity(): bool
42+
{
43+
return gmp_cmp($this->x, 0) === 0 && gmp_cmp($this->y, 0) === 0;
44+
}
45+
46+
public function equals(self $other): bool
47+
{
48+
return gmp_cmp($this->x, $other->x) === 0 && gmp_cmp($this->y, $other->y) === 0;
49+
}
50+
}
51+
52+
53+
/**
54+
* In the finite field F_p,
55+
* an elliptic curve in the short Weierstrass form y^2 = x^3 + ax + b is defined,
56+
* forming a group over addition.
57+
*
58+
* A base point G of order n and cofactor h is picked in this group.
59+
*/
60+
class Curve
61+
{
62+
public function __construct(private readonly \GMP $p, private readonly \GMP $a, private readonly \GMP $b, private readonly Point $G, private readonly \GMP $n)
63+
{
64+
}
65+
66+
public function getP(): \GMP
67+
{
68+
return $this->p;
69+
}
70+
71+
public function getA(): \GMP
72+
{
73+
return $this->a;
74+
}
75+
76+
public function getB(): \GMP
77+
{
78+
return $this->b;
79+
}
80+
81+
public function getG(): Point
82+
{
83+
return $this->G;
84+
}
85+
86+
public function getN(): \GMP
87+
{
88+
return $this->n;
89+
}
90+
}
91+
92+
93+
/**
94+
* Math inside a prime field; hence always (mod p)
95+
*/
96+
class PrimeField
97+
{
98+
private int $elementBitLength;
99+
100+
public function __construct(private readonly \GMP $prime)
101+
{
102+
$this->elementBitLength = strlen(gmp_strval($prime, 2));
103+
}
104+
105+
public function getElementBitLength(): int
106+
{
107+
return $this->elementBitLength;
108+
}
109+
110+
public function add(\GMP $a, \GMP $b): \GMP
111+
{
112+
$r = gmp_add($a, $b);
113+
return gmp_mod($r, $this->prime);
114+
}
115+
116+
public function mul(\GMP $a, \GMP $b): \GMP
117+
{
118+
$r = gmp_mul($a, $b);
119+
return gmp_mod($r, $this->prime);
120+
}
121+
122+
public function sub(\GMP $a, \GMP $b): \GMP
123+
{
124+
$r = gmp_sub($a, $b);
125+
return gmp_mod($r, $this->prime);
126+
}
127+
128+
public function mod(\GMP $a): \GMP
129+
{
130+
return gmp_mod($a, $this->prime);
131+
}
132+
133+
public function invert(\GMP $z): \GMP|false
134+
{
135+
return gmp_invert($z, $this->prime);
136+
}
137+
}
138+
139+
class UnsafePrimeCurveMath
140+
{
141+
private PrimeField $field;
142+
public function __construct(private readonly Curve $curve)
143+
{
144+
$this->field = new PrimeField($this->curve->getP());
145+
}
146+
147+
/**
148+
* checks whether point fulfills the defining equation of the curve
149+
*/
150+
public function isOnCurve(Point $point): bool
151+
{
152+
$left = gmp_pow($point->y, 2);
153+
$right = gmp_add(
154+
gmp_add(
155+
gmp_pow($point->x, 3),
156+
gmp_mul($this->curve->getA(), $point->x)
157+
),
158+
$this->curve->getB()
159+
);
160+
161+
$comparison = $this->field->sub($left, $right);
162+
163+
return gmp_cmp($comparison, 0) == 0;
164+
}
165+
166+
/**
167+
* implements https://www.secg.org/sec1-v2.pdf 2.3.4
168+
*/
169+
public function fromXCoordinate(\GMP $x, bool $isEvenY): Point
170+
{
171+
$alpha = gmp_add(
172+
gmp_add(
173+
gmp_powm($x, gmp_init(3, 10), $this->curve->getP()),
174+
gmp_mul($this->curve->getA(), $x)
175+
),
176+
$this->curve->getB()
177+
);
178+
179+
$jacobiSymbol = gmp_jacobi($alpha, $this->curve->getP());
180+
if ($jacobiSymbol !== 1) {
181+
throw new Exception('No square root of alpha.');
182+
}
183+
184+
$const = gmp_div(gmp_add($this->curve->getP(), 1), 4);
185+
$beta = gmp_powm($alpha, $const, $this->curve->getP());
186+
187+
$yp = $isEvenY ? gmp_init(0) : gmp_init(1);
188+
if (gmp_cmp(gmp_mod($beta, 2), $yp) === 0) {
189+
return new Point($x, $beta);
190+
} else {
191+
return new Point($x, gmp_sub($this->curve->getP(), $beta));
192+
}
193+
}
194+
195+
/**
196+
* rules from https://www.secg.org/SEC1-Ver-1.0.pdf (2.2.1)
197+
*/
198+
private function add(Point $a, Point $b): Point
199+
{
200+
// rule 1 & 2
201+
if ($a->isInfinity()) {
202+
return clone $b;
203+
} elseif ($b->isInfinity()) {
204+
return clone $a;
205+
}
206+
207+
if (gmp_cmp($a->x, $b->x) === 0) {
208+
// rule 3
209+
if (gmp_cmp($b->y, $a->y) !== 0) {
210+
return Point::createInfinity();
211+
}
212+
213+
// rule 5
214+
return $this->double($a);
215+
}
216+
217+
// rule 4 (note that a / b = a * b^-1)
218+
$lambda = $this->field->mul(
219+
gmp_sub($b->y, $a->y),
220+
$this->field->invert(gmp_sub($b->x, $a->x))
221+
);
222+
223+
$x = $this->field->sub(
224+
gmp_sub(
225+
gmp_pow($lambda, 2),
226+
$a->x
227+
),
228+
$b->x
229+
);
230+
231+
$y = $this->field->sub(
232+
gmp_mul(
233+
$lambda,
234+
gmp_sub($a->x, $x)
235+
),
236+
$a->y
237+
);
238+
239+
return new Point($x, $y);
240+
}
241+
242+
private function double(Point $a): Point
243+
{
244+
if (gmp_cmp($a->y, 0) === 0) {
245+
return Point::createInfinity();
246+
}
247+
248+
// rule 5 (note that a / b = a * b^-1)
249+
$lambda = $this->field->mul(
250+
gmp_add(
251+
gmp_mul(
252+
gmp_init(3),
253+
gmp_pow($a->x, 2)
254+
),
255+
$this->curve->getA()
256+
),
257+
$this->field->invert(
258+
gmp_mul(2, $a->y)
259+
)
260+
);
261+
262+
$x = $this->field->sub(
263+
gmp_pow($lambda, 2),
264+
gmp_mul(2, $a->x)
265+
);
266+
267+
$y = $this->field->sub(
268+
gmp_mul(
269+
$lambda,
270+
gmp_sub($a->x, $x)
271+
),
272+
$a->y
273+
);
274+
275+
return new Point($x, $y);
276+
}
277+
278+
private function conditionalSwap(Point $a, Point $b, int $swapBit): void
279+
{
280+
$this->conditionalSwapScalar($a->x, $b->x, $swapBit, $this->field->getElementBitLength());
281+
$this->conditionalSwapScalar($a->y, $b->y, $swapBit, $this->field->getElementBitLength());
282+
}
283+
284+
private function conditionalSwapScalar(GMP &$a, GMP &$b, int $swapBit, int $elementBitLength): void
285+
{
286+
// create a mask (note how it inverts the maskbit)
287+
$mask = gmp_init(str_repeat((string)(1 - $swapBit), $elementBitLength), 2);
288+
289+
// if mask is 1, tempA = a, else temp = 0
290+
$tempA = gmp_and($a, $mask);
291+
$tempB = gmp_and($b, $mask);
292+
293+
$a = gmp_xor($tempB, gmp_xor($a, $b)); // if mask is 1, then b XOR a XOR b = a, else 0 XOR a XOR b = a XOR b
294+
$b = gmp_xor($tempA, gmp_xor($a, $b)); // if mask is 1, then a XOR a XOR b = b, else 0 XOR a XOR b XOR b = a
295+
$a = gmp_xor($tempB, gmp_xor($a, $b)); // if mask is 1, then b XOR a XOR b = a, else 0 XOR a XOR b XOR a = b
296+
297+
// hence if mask is 1 (= inverse of $swapBit), then no swap, else swap
298+
}
299+
300+
/**
301+
* multiplication using the double-add-always
302+
*/
303+
public function mul(Point $point, \GMP $factor): Point
304+
{
305+
$mulField = new PrimeField($this->curve->getN());
306+
307+
// reduce factor once to ensure it is within our curve N bit size (and reduce computational effort)
308+
$reducedFactor = $mulField->mod($factor);
309+
310+
// normalize to the element bit length to always execute the double-add loop a constant number of times
311+
$factorBits = gmp_strval($reducedFactor, 2);
312+
$normalizedFactorBits = str_pad($factorBits, $mulField->getElementBitLength(), '0', STR_PAD_LEFT);
313+
314+
/**
315+
* how this works:
316+
* first, observe r[0] is infinity and r[1] our "real" point.
317+
* r[0] and r[1] are swapped iff the corresponding bit in $factor is set to 1,
318+
* hence if $j = 1, then the "real" point is added, else the "real" point is doubled
319+
*/
320+
/** @var Point[] $r */
321+
$r = [Point::createInfinity(), clone $point];
322+
for ($i = 0; $i < $mulField->getElementBitLength(); $i++) {
323+
$j = (int)$normalizedFactorBits[$i];
324+
325+
$this->conditionalSwap($r[0], $r[1], $j ^ 1);
326+
327+
$r[0] = $this->add($r[0], $r[1]);
328+
$r[1] = $this->double($r[1]);
329+
330+
$this->conditionalSwap($r[0], $r[1], $j ^ 1);
331+
}
332+
333+
return $r[0];
334+
}
335+
}
336+
337+
// secp256r1 curve from https://www.secg.org/sec2-v2.pdf (also known as NIST P-256).
338+
$p = gmp_init('FFFFFFFF 00000001 00000000 00000000 00000000 FFFFFFFF FFFFFFFF FFFFFFFF', 16);
339+
$a = gmp_init('FFFFFFFF 00000001 00000000 00000000 00000000 FFFFFFFF FFFFFFFF FFFFFFFC', 16);
340+
$b = gmp_init('5AC635D8 AA3A93E7 B3EBBD55 769886BC 651D06B0 CC53B0F6 3BCE3C3E 27D2604B', 16);
341+
342+
$Gx = gmp_init('6B17D1F2 E12C4247 F8BCE6E5 63A440F2 77037D81 2DEB33A0 F4A13945 D898C296', 16);
343+
$Gy = gmp_init('4FE342E2 FE1A7F9B 8EE7EB4A 7C0F9E16 2BCE3357 6B315ECE CBB64068 37BF51F5', 16);
344+
$G = new Point($Gx, $Gy);
345+
346+
$n = gmp_init('FFFFFFFF 00000000 FFFFFFFF FFFFFFFF BCE6FAAD A7179E84 F3B9CAC2 FC632551', 16);
347+
$curve = new Curve($p, $a, $b, $G, $n);
348+
$math = new UnsafePrimeCurveMath($curve);
349+
var_dump($math->isOnCurve($G)); // sanity check
350+
351+
// do diffie hellman key exchange
352+
$aliceSecret = gmp_init('1421B466 CB12D4F1 298CF525 DE823345 B81B861F 25B5AA7B E86869F9 697C13D', 16);
353+
$bobSecret = gmp_init('3CFFD9D8 3D5EF967 3432932D D70EC213 8D559C30 7EFBCFF6 0EB96EAB F08B0CBA', 16);
354+
355+
$alicePublicKey = $math->mul($curve->getG(), $aliceSecret);
356+
$bobPublicKey = $math->mul($curve->getG(), $bobSecret);
357+
358+
$bobPublicKeyReconstructed = $math->fromXCoordinate($bobPublicKey->x, gmp_cmp(gmp_mod($bobPublicKey->y, 2), 0) === 0);
359+
$aliceSharedKey = $math->mul($bobPublicKey, $aliceSecret);
360+
361+
$alicePublicKeyReconstructed = $math->fromXCoordinate($alicePublicKey->x, gmp_cmp(gmp_mod($alicePublicKey->y, 2), 0) === 0);
362+
$bobSharedKey = $math->mul($alicePublicKey, $bobSecret);
363+
364+
var_dump($aliceSharedKey->equals($bobSharedKey));
365+
?>
366+
--EXPECT--
367+
bool(true)
368+
bool(true)

0 commit comments

Comments
 (0)