org.bouncycastle.crypto.params

Class SM9EncMasterPublicKeyParameters

java.lang.Object

org.bouncycastle.crypto.params.AsymmetricKeyParameter

org.bouncycastle.crypto.params.SM9EncMasterPublicKeyParameters

All Implemented Interfaces:

CipherParameters

public class SM9EncMasterPublicKeyParameters
extends AsymmetricKeyParameter

SM9 encryption master public key P_pub-e = [ke]P1, a point of G1 (GM/T 0044.4-2016). Note the group roles are swapped relative to signature: the encryption master public key lives in G1 and users' keys in G2.

Method Summary

Modifier and Type	Method and Description
static SM9EncMasterPublicKeyParameters	fromEncoded(byte[] enc)
byte[]	getEncoded() The master public key point P_pub-e of G1 in uncompressed form (0x04 || x || y, 65 bytes).
SM9EncPublicKeyParameters	getUserPublicKey(byte[] identity) The encryption public key of the user identified by identity: the recipient key a sender encapsulates to (or encrypts to), formed from this master public key and the identity under the encryption hid 0x03 (GM/T 0044.4).
SM9EncPublicKeyParameters	getUserPublicKey(byte[] identity, byte hid) The public key of the user identified by identity under an explicit hid - use when the KGC's published hid differs from the encryption default SM9EncMasterPrivateKeyParameters.HID.
ECPoint	multiplyRecipientPoint(byte[] identity, byte hid, java.math.BigInteger r) [r]Q for Q = [H1(identity||hid, N)]P1 + P_pub-e, the point recipientPoint(byte[], byte) gives, and a secret r in [1, N-1]: the C1 = [r]Q_B that encryption and encapsulation send (GM/T 0044.4-2016), and the R = [r]Q_peer the key exchange sends (GM/T 0044.3-2016).
Fp12	pairingWithP2() g = e(P_pub-e, P2), the fixed pairing value used by both encapsulation and encryption.
ECPoint	recipientPoint(byte[] identity) Q = [H1(identity||hid, N)]P1 + P_pub-e, the recipient's public key point in G1, using the encryption hid (0x03).
ECPoint	recipientPoint(byte[] identity, byte hid) Q = [H1(identity||hid, N)]P1 + P_pub-e for an explicit hid (0x03 encryption, 0x02 key exchange).

Methods inherited from class org.bouncycastle.crypto.params.AsymmetricKeyParameter

isPrivate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

getUserPublicKey

public SM9EncPublicKeyParameters getUserPublicKey(byte[] identity)

The encryption public key of the user identified by identity: the recipient key a sender encapsulates to (or encrypts to), formed from this master public key and the identity under the encryption hid 0x03 (GM/T 0044.4). It is derived from the published master public key alone, so any sender can construct it without KGC interaction.

getUserPublicKey

public SM9EncPublicKeyParameters getUserPublicKey(byte[] identity,
                                                  byte hid)

The public key of the user identified by identity under an explicit hid - use when the KGC's published hid differs from the encryption default SM9EncMasterPrivateKeyParameters.HID. Any one byte is a legal hid; 0x03 and 0x02 are the values the GM/T 0044 worked examples publish for the encryption and key-exchange functions.

A key under SM9EncMasterPrivateKeyParameters.HID_EXCHANGE names a key-exchange peer: SM9Engine and SM9KEMGenerator refuse to encrypt or encapsulate to it, since no decryption or decapsulation key can be derived under that hid.

recipientPoint

public ECPoint recipientPoint(byte[] identity)

Q = [H1(identity||hid, N)]P1 + P_pub-e, the recipient's public key point in G1, using the encryption hid (0x03).

recipientPoint

public ECPoint recipientPoint(byte[] identity,
                              byte hid)

Q = [H1(identity||hid, N)]P1 + P_pub-e for an explicit hid (0x03 encryption, 0x02 key exchange).

Encryption, encapsulation and the key exchange do not form Q: they form its multiple by their ephemeral through multiplyRecipientPoint(byte[], byte, java.math.BigInteger).

multiplyRecipientPoint

public ECPoint multiplyRecipientPoint(byte[] identity,
                                      byte hid,
                                      java.math.BigInteger r)

[r]Q for Q = [H1(identity||hid, N)]P1 + P_pub-e, the point recipientPoint(byte[], byte) gives, and a secret r in [1, N-1]: the C1 = [r]Q_B that encryption and encapsulation send (GM/T 0044.4-2016), and the R = [r]Q_peer the key exchange sends (GM/T 0044.3-2016). Q is not formed: [r]Q is formed as [r h1 mod N]P1 + [r]P_pub-e, the product r h1 by BigIntegers.modMult(java.math.BigInteger, java.math.BigInteger, java.math.BigInteger), in the same steps whatever r is, and the sum by SM9Curve.sumOfTwoMultipliesSecure(org.bouncycastle.math.ec.ECPoint, java.math.BigInteger, org.bouncycastle.math.ec.ECPoint, java.math.BigInteger), one comb over P1's table and P_pub-e's, each thirty-two multiples of the point and their doubles, 4 KB. P_pub-e's is made the first time this key is multiplied and kept with it, as the powers of pairingWithP2() are, so that a sender holding one master public key for many recipients, and a party to many exchanges, makes it once.

Parameters:

identity - the recipient's or the peer's identity.

hid - the hid Q is formed under.

r - the ephemeral, in [1, N-1].

Returns:

[r]Q, in affine coordinates.

Throws:

java.lang.IllegalArgumentException - if r is not in [1, N-1], or if Q is the point at infinity, as recipientPoint refuses it: [r]Q is then at infinity as well, and it is for no other Q.

pairingWithP2

public Fp12 pairingWithP2()

g = e(P_pub-e, P2), the fixed pairing value used by both encapsulation and encryption.

It depends on this key alone, which is immutable, so it is computed once and kept: it is the costliest single step of an encryption, an encapsulation or a key exchange, and a sender holds one master public key for many of them. It involves no secret, so it is computed as verification's pairings are, through SM9Pairing.multiPair(org.bouncycastle.math.ec.ECPoint[], org.bouncycastle.math.ec.sm9.SM9G2Point[]), over the lines of P2's Miller loop, which P2 keeps, where SM9Pairing.pairing(org.bouncycastle.math.ec.ECPoint, org.bouncycastle.math.ec.sm9.SM9G2Point), which is for a private key, would compute them afresh from a random representative of P2 and give its final exponentiation a random factor. Two threads asking for it first may both compute it, and get equal values. Encryption, encapsulation and the key exchange raise it to each ephemeral through Fp12.powSecureFixedBase(java.math.BigInteger), which keeps sixty-four powers of it with it, 24 KB, once the first of them has made them.

getEncoded

public byte[] getEncoded()

The master public key point P_pub-e of G1 in uncompressed form (0x04 || x || y, 65 bytes).

fromEncoded

public static SM9EncMasterPublicKeyParameters fromEncoded(byte[] enc)