key-exchange: Add identifiers for NIST round 3 submission KEM candidates

diff --git a/src/libstrongswan/crypto/key_exchange.c b/src/libstrongswan/crypto/key_exchange.c
index 74107cec4d80cb75cff6c419e25b4137ef57ccb3..880db4cd8a418145f9016a75c77da41933a763a0 100644 (file)
--- a/src/libstrongswan/crypto/key_exchange.c
+++ b/src/libstrongswan/crypto/key_exchange.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2016-2020 Andreas Steffen
  * Copyright (C) 2010-2020 Tobias Brunner
  * Copyright (C) 2005-2010 Martin Willi
  * Copyright (C) 2005 Jan Hutter
@@ -57,7 +58,30 @@ ENUM_NEXT(key_exchange_method_names, NTRU_112_BIT, NTRU_256_BIT, MODP_NULL,
        "NTRU_256");
 ENUM_NEXT(key_exchange_method_names, NH_128_BIT, NH_128_BIT, NTRU_256_BIT,
        "NEWHOPE_128");
-ENUM_NEXT(key_exchange_method_names, MODP_CUSTOM, MODP_CUSTOM, NH_128_BIT,
+ENUM_NEXT(key_exchange_method_names, KE_KYBER_L1, KE_HQC_L5, NH_128_BIT,
+       "KYBER_L1",
+       "KYBER_L3",
+       "KYBER_L5",
+       "NTRU_HPS_L1",
+       "NTRU_HPS_L3",
+       "NTRU_HPS_L5",
+       "NTRU_HRSS_L3",
+       "SABER_L1",
+       "SABER_L3",
+       "SABER_L5",
+       "BIKE_L1",
+       "BIKE_L3",
+       "BIKE_L5",
+       "FRODO_AES_L1",
+       "FRODO_AES_L3",
+       "FRODO_AES_L5",
+       "FRODO_SHAKE_L1",
+       "FRODO_SHAKE_L3",
+       "FRODO_SHAKE_L5",
+       "HQC_L1",
+       "HQC_L3",
+       "HQC_L5");
+ENUM_NEXT(key_exchange_method_names, MODP_CUSTOM, MODP_CUSTOM, KE_HQC_L5,
        "MODP_CUSTOM");
 ENUM_END(key_exchange_method_names, MODP_CUSTOM);
 
@@ -97,7 +121,30 @@ ENUM_NEXT(key_exchange_method_names_short, NTRU_112_BIT, NTRU_256_BIT, MODP_NULL
        "ntru256");
 ENUM_NEXT(key_exchange_method_names_short, NH_128_BIT, NH_128_BIT, NTRU_256_BIT,
        "newhope128");
-ENUM_NEXT(key_exchange_method_names_short, MODP_CUSTOM, MODP_CUSTOM, NH_128_BIT,
+ENUM_NEXT(key_exchange_method_names_short, KE_KYBER_L1, KE_HQC_L5, NH_128_BIT,
+       "kyber1",
+       "kyber3",
+       "kyber5",
+       "ntrup1",
+       "ntrup3",
+       "ntrup5",
+       "ntrur3",
+       "saber1",
+       "saber3",
+       "saber5",
+       "bike1",
+       "bike3",
+       "bike5",
+       "frodoa1",
+       "frodoa3",
+       "frodoa5",
+       "frodos1",
+       "frodos3",
+       "frodos5",
+       "hqc1",
+       "hqc3",
+       "hqc5");
+ENUM_NEXT(key_exchange_method_names_short, MODP_CUSTOM, MODP_CUSTOM, KE_HQC_L5,
        "modpcustom");
 ENUM_END(key_exchange_method_names_short, MODP_CUSTOM);
 
@@ -616,6 +663,41 @@ bool key_exchange_is_ecdh(key_exchange_method_t ke)
        }
 }
 
+/*
+ * Described in header
+ */
+bool key_exchange_is_kem(key_exchange_method_t ke)
+{
+       switch (ke)
+       {
+               case KE_KYBER_L1:
+               case KE_KYBER_L3:
+               case KE_KYBER_L5:
+               case KE_NTRU_HPS_L1:
+               case KE_NTRU_HPS_L3:
+               case KE_NTRU_HPS_L5:
+               case KE_NTRU_HRSS_L3:
+               case KE_SABER_L1:
+               case KE_SABER_L3:
+               case KE_SABER_L5:
+               case KE_BIKE_L1:
+               case KE_BIKE_L3:
+               case KE_BIKE_L5:
+               case KE_HQC_L1:
+               case KE_HQC_L3:
+               case KE_HQC_L5:
+               case KE_FRODO_AES_L1:
+               case KE_FRODO_AES_L3:
+               case KE_FRODO_AES_L5:
+               case KE_FRODO_SHAKE_L1:
+               case KE_FRODO_SHAKE_L3:
+               case KE_FRODO_SHAKE_L5:
+                       return TRUE;
+               default:
+                       return FALSE;
+       }
+}
+
 /*
  * Described in header
  */
@@ -675,6 +757,28 @@ bool key_exchange_verify_pubkey(key_exchange_method_t ke, chunk_t value)
                case NTRU_192_BIT:
                case NTRU_256_BIT:
                case NH_128_BIT:
+               case KE_KYBER_L1:
+               case KE_KYBER_L3:
+               case KE_KYBER_L5:
+               case KE_NTRU_HPS_L1:
+               case KE_NTRU_HPS_L3:
+               case KE_NTRU_HPS_L5:
+               case KE_NTRU_HRSS_L3:
+               case KE_SABER_L1:
+               case KE_SABER_L3:
+               case KE_SABER_L5:
+               case KE_BIKE_L1:
+               case KE_BIKE_L3:
+               case KE_BIKE_L5:
+               case KE_FRODO_AES_L1:
+               case KE_FRODO_AES_L3:
+               case KE_FRODO_AES_L5:
+               case KE_FRODO_SHAKE_L1:
+               case KE_FRODO_SHAKE_L3:
+               case KE_FRODO_SHAKE_L5:
+               case KE_HQC_L1:
+               case KE_HQC_L3:
+               case KE_HQC_L5:
                        /* verification currently not supported, do in plugin */
                        valid = FALSE;
                        break;

diff --git a/src/libstrongswan/crypto/key_exchange.h b/src/libstrongswan/crypto/key_exchange.h
index 4aa4e264b2902334bfd185c2291d6416f02f67af..d9d3cc9f9ec50a9b369cc8e03d2e13e105f61757 100644 (file)
--- a/src/libstrongswan/crypto/key_exchange.h
+++ b/src/libstrongswan/crypto/key_exchange.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2016-2020 Andreas Steffen
  * Copyright (C) 2010-2020 Tobias Brunner
  * Copyright (C) 2005-2007 Martin Willi
  * Copyright (C) 2005 Jan Hutter
@@ -66,14 +67,38 @@ enum key_exchange_method_t {
        CURVE_25519   = 31,
        CURVE_448     = 32,
        /** insecure NULL diffie hellman group for testing, in PRIVATE USE */
-       MODP_NULL = 1024,
-       /** MODP group with custom generator/prime */
+       MODP_NULL          = 1024,
        /** Parameters defined by IEEE 1363.1, in PRIVATE USE */
-       NTRU_112_BIT = 1030,
-       NTRU_128_BIT = 1031,
-       NTRU_192_BIT = 1032,
-       NTRU_256_BIT = 1033,
-       NH_128_BIT   = 1040,
+       NTRU_112_BIT       = 1030,
+       NTRU_128_BIT       = 1031,
+       NTRU_192_BIT       = 1032,
+       NTRU_256_BIT       = 1033,
+       NH_128_BIT         = 1040,
+       /** NIST round 3 KEM candidates, in PRIVATE USE */
+       KE_KYBER_L1        = 1050,
+       KE_KYBER_L3        = 1051,
+       KE_KYBER_L5        = 1052,
+       KE_NTRU_HPS_L1     = 1053,
+       KE_NTRU_HPS_L3     = 1054,
+       KE_NTRU_HPS_L5     = 1055,
+       KE_NTRU_HRSS_L3    = 1056,
+       KE_SABER_L1        = 1057,
+       KE_SABER_L3        = 1058,
+       KE_SABER_L5        = 1059,
+       /** NIST alternative KEM candidates, in PRIVATE USE */
+       KE_BIKE_L1         = 1060,
+       KE_BIKE_L3         = 1061,
+       KE_BIKE_L5         = 1062,
+       KE_FRODO_AES_L1    = 1063,
+       KE_FRODO_AES_L3    = 1064,
+       KE_FRODO_AES_L5    = 1065,
+       KE_FRODO_SHAKE_L1  = 1066,
+       KE_FRODO_SHAKE_L3  = 1067,
+       KE_FRODO_SHAKE_L5  = 1068,
+       KE_HQC_L1          = 1069,
+       KE_HQC_L3          = 1070,
+       KE_HQC_L5          = 1071,
+       /** MODP group with custom generator/prime */
        /** internally used DH group with additional parameters g and p, outside
         * of PRIVATE USE (i.e. IKEv2 DH group range) so it can't be negotiated */
        MODP_CUSTOM = 65536,
@@ -104,7 +129,7 @@ struct key_exchange_t {
                __attribute__((warn_unused_result));
 
        /**
-        * Sets the public key from the peer.
+        * Sets the public key received from the peer.
         *
         * @note This operation should be relatively quick. Costly public key
         * validation operations or key derivation should be implemented in
@@ -126,10 +151,10 @@ struct key_exchange_t {
                __attribute__((warn_unused_result));
 
        /**
-        * Set an explicit own private key to use.
+        * Set a seed used for the derivation of private key material.
         *
-        * Calling this method is usually not required, as the DH backend generates
-        * an appropriate private value itself. It is optional to implement, and
+        * Calling this method is usually not required, as the key exchange objects
+        * generate the private key material themselves. This is optional to implement, and
         * used mostly for testing purposes.  The private key may be the actual key
         * or a seed for a DRBG.
         *
@@ -206,6 +231,13 @@ diffie_hellman_params_t *diffie_hellman_get_params(key_exchange_method_t ke);
  */
 bool key_exchange_is_ecdh(key_exchange_method_t ke);
 
+/**
+ * Check if the key exchange method is a Key Encapsulation Mechanism (KEM)
+ *
+ * @return                     TRUE if KEM used
+ */
+bool key_exchange_is_kem(key_exchange_method_t ke);
+
 /**
  * Check if a public key is valid for given key exchange method.
  *

diff --git a/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt b/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt
index 8456fe4ea0ca4a7002e8df6f1e66c17d5d259047..bcc49401eadcbb8a3099c3d3c0d4d9ed8cf93463 100644 (file)
--- a/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt
+++ b/src/libstrongswan/crypto/proposal/proposal_keywords_static.txt
@@ -1,6 +1,6 @@
 %{
 /*
- * Copyright (C) 2009-2013 Andreas Steffen
+ * Copyright (C) 2009-2020 Andreas Steffen
  *
  * Copyright (C) secunet Security Networks AG
  *
@@ -181,5 +181,27 @@ ntru128,          KEY_EXCHANGE_METHOD, NTRU_128_BIT,               0
 ntru192,          KEY_EXCHANGE_METHOD, NTRU_192_BIT,               0
 ntru256,          KEY_EXCHANGE_METHOD, NTRU_256_BIT,               0
 newhope128,       KEY_EXCHANGE_METHOD, NH_128_BIT,                 0
+kyber1,           KEY_EXCHANGE_METHOD, KE_KYBER_L1,                0
+kyber3,           KEY_EXCHANGE_METHOD, KE_KYBER_L3,                0
+kyber5,           KEY_EXCHANGE_METHOD, KE_KYBER_L5,                0
+ntrup1,           KEY_EXCHANGE_METHOD, KE_NTRU_HPS_L1,             0
+ntrup3,           KEY_EXCHANGE_METHOD, KE_NTRU_HPS_L3,             0
+ntrup5,           KEY_EXCHANGE_METHOD, KE_NTRU_HPS_L5,             0
+ntrur3,           KEY_EXCHANGE_METHOD, KE_NTRU_HRSS_L3,            0
+saber1,           KEY_EXCHANGE_METHOD, KE_SABER_L1,                0
+saber3,           KEY_EXCHANGE_METHOD, KE_SABER_L3,                0
+saber5,           KEY_EXCHANGE_METHOD, KE_SABER_L5,                0
+bike1,            KEY_EXCHANGE_METHOD, KE_BIKE_L1,                 0
+bike3,            KEY_EXCHANGE_METHOD, KE_BIKE_L3,                 0
+bike5,            KEY_EXCHANGE_METHOD, KE_BIKE_L5,                 0
+frodoa1,          KEY_EXCHANGE_METHOD, KE_FRODO_AES_L1,            0
+frodoa3,          KEY_EXCHANGE_METHOD, KE_FRODO_AES_L3,            0
+frodoa5,          KEY_EXCHANGE_METHOD, KE_FRODO_AES_L5,            0
+frodos1,          KEY_EXCHANGE_METHOD, KE_FRODO_SHAKE_L1,          0
+frodos3,          KEY_EXCHANGE_METHOD, KE_FRODO_SHAKE_L3,          0
+frodos5,          KEY_EXCHANGE_METHOD, KE_FRODO_SHAKE_L5,          0
+hqc1,             KEY_EXCHANGE_METHOD, KE_HQC_L1,                  0
+hqc3,             KEY_EXCHANGE_METHOD, KE_HQC_L3,                  0
+hqc5,             KEY_EXCHANGE_METHOD, KE_HQC_L5,                  0
 noesn,            EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS,   0
 esn,              EXTENDED_SEQUENCE_NUMBERS, EXT_SEQ_NUMBERS,      0