STF538: Start Encryption TPs implementation (33e34487) · Commits · ITS - Intelligent Transport Systems / ITS

ccsrc/Externals/LibItsSecurity_externals.cc

+41 −5

Original line number	Original line	Diff line number	Diff line
	@@ -251,11 +251,47 @@ namespace LibItsSecurity__Functions


	OCTETSTRING fx__encryptWithEciesNistp256WithSha256(const OCTETSTRING& p__toBeEncryptedSecuredMessage, const OCTETSTRING& p__peerPublicKeyX, const OCTETSTRING& p__peerPublicKeyY, OCTETSTRING& p__publicEncKeyX, OCTETSTRING& p__publicEncKeyY, OCTETSTRING& p__ephKey, OCTETSTRING& p__tag, OCTETSTRING& p__nonce) {		OCTETSTRING fx__encryptWithEciesNistp256WithSha256(const OCTETSTRING& p__toBeEncryptedSecuredMessage, const OCTETSTRING& p__peerPublicKeyX, const OCTETSTRING& p__peerPublicKeyY, OCTETSTRING& p__publicEncKeyX, OCTETSTRING& p__publicEncKeyY, OCTETSTRING& p__ephKey, OCTETSTRING& p__tag, OCTETSTRING& p__nonce) {
	OCTETSTRING os;		loggers::get_instance().log_msg(">>> fx__encryptWithEciesNistp256WithSha256: ", p__toBeEncryptedSecuredMessage);
			loggers::get_instance().log_msg(">>> fx__encryptWithEciesNistp256WithSha256: ", p__peerPublicKeyX);
	os = OCTETSTRING();		loggers::get_instance().log_msg(">>> fx__encryptWithEciesNistp256WithSha256: ", p__publicEncKeyY);
	p__nonce = OCTETSTRING();
	p__tag = OCTETSTRING();		ec_keys ec(ec_elliptic_curves::nist_p_256);
			std::vector<unsigned char> peer_public_key_x(static_cast<const unsigned char >(p__peerPublicKeyX), p__peerPublicKeyX.lengthof() + static_cast<const unsigned char >(p__peerPublicKeyX));
			std::vector<unsigned char> peer_public_key_y(static_cast<const unsigned char >(p__publicEncKeyY), p__publicEncKeyY.lengthof() + static_cast<const unsigned char >(p__publicEncKeyY));
			int unused = 0;
			if (ec.generate_ephemeral_key(
			encryption_algotithm::aes_128_ccm,
			peer_public_key_x,
			peer_public_key_y,
			unused) != 0) {
			loggers::get_instance().warning("fx__encryptWithEciesNistp256WithSha256: Failed to generate sender's ephemeral key");
			return OCTETSTRING();
			}
			std::vector<unsigned char> enc_eph_key;
			if (ec.encrypt_ephemeral_key(ec.ephemeral_key(), enc_eph_key) != 0) {
			loggers::get_instance().warning("fx__encryptWithEciesNistp256WithSha256: Failed to encrypt generated sender's ephemeral key");
			return OCTETSTRING();
			}
			p__ephKey = OCTETSTRING(enc_eph_key.size(), enc_eph_key.data());
			loggers::get_instance().log_to_hexa("fx__encryptWithEciesNistp256WithSha256: p__ephKey: ", ec.ephemeral_key().data(), ec.ephemeral_key().size());
			loggers::get_instance().log_to_hexa("fx__encryptWithEciesNistp256WithSha256: Encrypted p__ephKey: ", p__ephKey);
			p__publicEncKeyX = OCTETSTRING(ec.encryption_key_x().size(), ec.encryption_key_x().data());
			loggers::get_instance().log_to_hexa("fx__encryptWithEciesNistp256WithSha256: p__publicEncKeyX: ", p__publicEncKeyX);
			p__publicEncKeyY = OCTETSTRING(ec.encryption_key_y().size(), ec.encryption_key_y().data());
			loggers::get_instance().log_to_hexa("fx__encryptWithEciesNistp256WithSha256: p__publicEncKeyY: ", p__publicEncKeyY);

			std::vector<unsigned char> message(static_cast<const unsigned char >(p__toBeEncryptedSecuredMessage), p__toBeEncryptedSecuredMessage.lengthof() + static_cast<const unsigned char >(p__toBeEncryptedSecuredMessage));
			std::vector<unsigned char> enc_message;
			if (ec.encrypt(message, enc_message) == -1) {
			loggers::get_instance().warning("fx__encryptWithEciesNistp256WithSha256: Failed to encrypt message");
			return OCTETSTRING();
			}
			OCTETSTRING os(enc_message.size(), enc_message.data());
			loggers::get_instance().log_to_hexa("fx__encryptWithEciesNistp256WithSha256: enc message: ", os);
			p__nonce = OCTETSTRING(ec.nonce().size(), ec.nonce().data());
			loggers::get_instance().log_to_hexa("fx__encryptWithEciesNistp256WithSha256: p__nonce: ", p__nonce);
			p__tag = OCTETSTRING(ec.tag().size(), ec.tag().data());
			loggers::get_instance().log_to_hexa("fx__encryptWithEciesNistp256WithSha256: p__tag: ", p__tag);
	return os;		return os;
	}		}

ccsrc/Framework/LayerFactory.hh

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -56,7 +56,9 @@ public: //! \publicsection
	* beaconing : Set to 1 if GnLayer shall start beaconing		* beaconing : Set to 1 if GnLayer shall start beaconing
	* Beaconing timer expiry : expiry (ms)		* Beaconing timer expiry : expiry (ms)
	* device_mode : Set to 1 if the layer shall encapsulate upper layer PDU		* device_mode : Set to 1 if the layer shall encapsulate upper layer PDU
	* secured_mode : Set to 1 if message exchanges shall be secured		* secured_mode : Set to 1 if message exchanges shall be signed
			* encrypted_mode : Set to 1 if message exchanges shall be encrypted
			* NOTE: For signed & encrypted message exchanges, both secured_mode and encrypted_mode shall be set to 1
	* certificate : Certificate identifier the Test Adapter shall use		* certificate : Certificate identifier the Test Adapter shall use
	* secure_db_path : Path to the certificates and keys storage location		* secure_db_path : Path to the certificates and keys storage location
	* hash : Hash algorithm to be used when secured mode is set		* hash : Hash algorithm to be used when secured mode is set

ccsrc/Framework/Params.hh

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -56,7 +56,7 @@ public: //! \publicsection
	static const std::string& certificate; //! The certificate identifier the Test System shall use. E.g. CERT_TS_A		static const std::string& certificate; //! The certificate identifier the Test System shall use. E.g. CERT_TS_A
	static const std::string& hash; //! The digest algorithm the Test System shall use, authorised values are SHA-256 or SHA-384. Default: SHA-256		static const std::string& hash; //! The digest algorithm the Test System shall use, authorised values are SHA-256 or SHA-384. Default: SHA-256
	static const std::string& signature; //! The signature algorithm the Test System shall use, authorised values are NISTP-256, BP-256 and BP-384. Default: NISTP-256		static const std::string& signature; //! The signature algorithm the Test System shall use, authorised values are NISTP-256, BP-256 and BP-384. Default: NISTP-256
	static const std::string& cypher;		static const std::string& cypher; //! The encryption algorithm the Test System shall use, authorised values are NISTP-256 and BP-256. Default: NISTP-256
	static const std::string& distanceA; //! Test system GeoNetworking DistanceA parameter name		static const std::string& distanceA; //! Test system GeoNetworking DistanceA parameter name
	static const std::string& distanceB; //! Test system GeoNetworking DistanceB parameter name		static const std::string& distanceB; //! Test system GeoNetworking DistanceB parameter name
	static const std::string& angle; //! Test system GeoNetworking Angle parameter name		static const std::string& angle; //! Test system GeoNetworking Angle parameter name

ccsrc/Protocols/Security/ec_keys.cc

+105 −6

Original line number	Original line	Diff line number	Diff line
	@@ -179,7 +179,7 @@ int ec_keys::generate_ephemeral_key(const encryption_algotithm p_enc_algorithm,

	// Sanity checks		// Sanity checks
	if ((_pub_key_x.size() != 0) \|\| (_pub_key_y.size() != 0)) {		if ((_pub_key_x.size() != 0) \|\| (_pub_key_y.size() != 0)) {
	printf("ec_keys::generate_ephemeral_key: Constrictor format #1 shall be used");		loggers::get_instance().warning("ec_keys::generate_ephemeral_key: Constrictor format #1 shall be used");
	return -1;		return -1;
	}		}
	p_unused = 0;		p_unused = 0;
	@@ -189,7 +189,6 @@ int ec_keys::generate_ephemeral_key(const encryption_algotithm p_enc_algorithm,
	// Set buffers size		// Set buffers size
	int len = (EC_GROUP_get_degree(_ec_group) + 7) / 8;		int len = (EC_GROUP_get_degree(_ec_group) + 7) / 8;
	_eph_key.resize(len);		_eph_key.resize(len);
	printf("ec_keys::generate_ephemeral_key: ephemeral_ec_key_len=%d\n", _eph_key.size());

	// Convert the public keys (X,Y) into EC_POINT data structure		// Convert the public keys (X,Y) into EC_POINT data structure
	EC_POINT *ec_point = nullptr;		EC_POINT *ec_point = nullptr;
	@@ -211,12 +210,12 @@ int ec_keys::generate_ephemeral_key(const encryption_algotithm p_enc_algorithm,
	return 0;		return 0;
	}		}

	int ec_keys::generate_ephemeral_key(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_public_enc_key_x, const std::vector<unsigned char>& p_public_enc_key_y) { // TODO Change it into ctor		int ec_keys::generate_ephemeral_key(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_public_enc_key_x, const std::vector<unsigned char>& p_public_enc_key_y) {
	loggers::get_instance().log(">>> ec_keys::generate_ephemeral_key (2)");		loggers::get_instance().log(">>> ec_keys::generate_ephemeral_key (2)");

	// Sanity checks		// Sanity checks
	if (_pri_key.size() == 0) {		if (_pri_key.size() == 0) {
	printf("ec_keys::generate_ephemeral_key: Constrictor format #2 shall be used");		loggers::get_instance().warning("ec_keys::generate_ephemeral_key: Constrictor format #2 shall be used");
	return -1;		return -1;
	}		}
	_encryption_algotithm = p_enc_algorithm;		_encryption_algotithm = p_enc_algorithm;
	@@ -224,7 +223,6 @@ int ec_keys::generate_ephemeral_key(const encryption_algotithm p_enc_algorithm,
	// Set buffers size		// Set buffers size
	int len = (EC_GROUP_get_degree(_ec_group) + 7) / 8;		int len = (EC_GROUP_get_degree(_ec_group) + 7) / 8;
	_eph_key.resize(len);		_eph_key.resize(len);
	printf("ec_keys::generate_ephemeral_key: ephemeral_ec_key_len=%d\n", _eph_key.size());
	// Convert the peer public encryption key to an EC point		// Convert the peer public encryption key to an EC point
	EC_POINT *ec_point = nullptr;		EC_POINT *ec_point = nullptr;
	bin_to_ec_point(p_public_enc_key_x, p_public_enc_key_y, &ec_point);		bin_to_ec_point(p_public_enc_key_x, p_public_enc_key_y, &ec_point);
	@@ -239,6 +237,107 @@ int ec_keys::generate_ephemeral_key(const encryption_algotithm p_enc_algorithm,
	return 0;		return 0;
	}		}

			int ec_keys::encrypt(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_message, std::vector<unsigned char>& p_enc_message) {
			loggers::get_instance().log(">>> ec_keys::encrypt: %d", p_enc_algorithm);

			// Sanity checks
			if ((_pub_key_x.size() != 0) \|\| (_pub_key_y.size() != 0)) {
			loggers::get_instance().warning("ec_keys::encrypt: Constructor format #1 shall be used");
			return -1;
			}
			_encryption_algotithm = p_enc_algorithm;

			// Initialize the context and encryption operation
			EVP_CIPHER_CTX *ctx = ::EVP_CIPHER_CTX_new();
			switch (_encryption_algotithm) {
			case encryption_algotithm::aes_128_ccm:
			::EVP_EncryptInit_ex(ctx, EVP_aes_128_ccm(), NULL, NULL, NULL);
			// Allocate buffers size
			_nonce.resize(12);
			_tag.resize(16);
			_eph_key.resize(16);
			p_enc_message.resize(p_message.size());
			break;
			case encryption_algotithm::aes_256_ccm:
			::EVP_EncryptInit_ex(ctx, EVP_aes_256_ccm(), NULL, NULL, NULL);
			break;
			case encryption_algotithm::aes_128_gcm:
			::EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL);
			break;
			case encryption_algotithm::aes_256_gcm:
			::EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL);
			break;
			} // End of 'switch' statement
			// Generate _eph_key
			::RAND_pseudo_bytes(_eph_key.data(), _eph_key.size());
			loggers::get_instance().log_to_hexa("ec_keys::encrypt: _eph_key: ", _eph_key.data(), _eph_key.size());
			// Generate _nonce
			::RAND_pseudo_bytes(_nonce.data(), _nonce.size());
			loggers::get_instance().log_to_hexa("ec_keys::encrypt: nonce: ", _nonce.data(), _nonce.size());
			// Set nonce length
			::EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_IVLEN, _nonce.size(), NULL);
			// Set tag length
			::EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG, _tag.size(), NULL);
			// Prime the key and nonce
			::EVP_EncryptInit_ex(ctx, NULL, NULL, _eph_key.data(), _nonce.data());
			// No authentication data
			// Encrypt the data
			int len = 0;
			::EVP_EncryptUpdate(ctx, p_enc_message.data(), &len, p_message.data(), p_message.size());
			// Finalize the encryption session
			::EVP_EncryptFinal_ex(ctx, p_enc_message.data() + len, &len);
			// Get the authentication tag
			::EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_GET_TAG, _tag.size(), _tag.data());
			loggers::get_instance().log_to_hexa("ec_keys::encrypt: tag: ", _tag.data(), _tag.size());

			::EVP_CIPHER_CTX_free(ctx);

			return 0;
			}

			int ec_keys::decrypt(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_key, const std::vector<unsigned char>& p_nonce, const std::vector<unsigned char>& p_tag, const std::vector<unsigned char>& p_enc_message, std::vector<unsigned char>& p_message) {
			loggers::get_instance().log(">>> ec_keys::decrypt");

			// Sanity checks
			if ((_pri_key.size() == 0) \|\| (_eph_key.size() == 0)) {
			loggers::get_instance().warning("ec_keys::decrypt: Constrictor format #2 shall be used");
			return -1;
			}
			_encryption_algotithm = p_enc_algorithm;
			_eph_key = p_key;
			_nonce = p_nonce;
			_tag = p_tag;

			// Initialize the context and decryption operation
			EVP_CIPHER_CTX *ctx = ::EVP_CIPHER_CTX_new();
			switch (_encryption_algotithm) {
			case encryption_algotithm::aes_128_ccm:
			::EVP_DecryptInit_ex(ctx, EVP_aes_128_ccm(), NULL, NULL, NULL);
			break;
			case encryption_algotithm::aes_256_ccm:
			::EVP_DecryptInit_ex(ctx, EVP_aes_256_ccm(), NULL, NULL, NULL);
			break;
			case encryption_algotithm::aes_128_gcm:
			::EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL);
			break;
			case encryption_algotithm::aes_256_gcm:
			::EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL);
			break;
			} // End of 'switch' statement
			// Set nonce length
			EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_IVLEN, _nonce.size(), NULL);
			// Set expected tag value
			EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG, _tag.size(), _tag.data());
			// Specify key and IV
			EVP_DecryptInit_ex(ctx, NULL, NULL, _eph_key.data(), _nonce.data());
			// Decrypt plaintext, verify tag: can only be called once
			p_message.resize(p_enc_message.size());
			int len = 0;
			int result = EVP_DecryptUpdate(ctx, p_message.data(), &len, p_enc_message.data(), p_enc_message.size());
			::EVP_CIPHER_CTX_free(ctx);

			return (result > 0) ? 0 : -1;
			}
	int ec_keys::encrypt(const std::vector<unsigned char>& p_message, std::vector<unsigned char>& p_enc_message) {		int ec_keys::encrypt(const std::vector<unsigned char>& p_message, std::vector<unsigned char>& p_enc_message) {
	loggers::get_instance().log(">>> ec_keys::encrypt");		loggers::get_instance().log(">>> ec_keys::encrypt");

	@@ -295,7 +394,7 @@ int ec_keys::decrypt(const std::vector<unsigned char>& p_nonce, const std::vecto

	// Sanity checks		// Sanity checks
	if ((_pri_key.size() == 0) \|\| (_eph_key.size() == 0)) {		if ((_pri_key.size() == 0) \|\| (_eph_key.size() == 0)) {
	printf("ec_keys::decrypt: Constrictor format #2 shall be used");		loggers::get_instance().warning("ec_keys::decrypt: Constrictor format #2 shall be used");
	return -1;		return -1;
	}		}
	_nonce = p_nonce;		_nonce = p_nonce;

ccsrc/Protocols/Security/ec_keys.hh

+27 −0

Original line number	Original line	Diff line number	Diff line
	@@ -109,6 +109,33 @@ public:
	int encrypt_ephemeral_key(const std::vector<unsigned char>& p_eph_key, std::vector<unsigned char>& p_enc_eph_key) { p_enc_eph_key = p_eph_key; return 0; }; // FIXME		int encrypt_ephemeral_key(const std::vector<unsigned char>& p_eph_key, std::vector<unsigned char>& p_enc_eph_key) { p_enc_eph_key = p_eph_key; return 0; }; // FIXME
	int decrypt_ephemeral_key(const std::vector<unsigned char>& p_enc_eph_key, std::vector<unsigned char>& p_eph_key) { p_eph_key = p_enc_eph_key; return 0; }; // FIXME		int decrypt_ephemeral_key(const std::vector<unsigned char>& p_enc_eph_key, std::vector<unsigned char>& p_eph_key) { p_eph_key = p_enc_eph_key; return 0; }; // FIXME

			/*!
			* \fn int encrypt(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_message, std::vector<unsigned char>& p_enc_message);
			* \brief Encryption using the specified algorithm.
			* \param[in] p_enc_algorithm The algorithm to use for the encryption
			* \param[in] p_message The message to be encrypted
			* \param[out] p_enc_message The encrypted message
			* \remark To get the generated ephemeral key, uses \see ephemeral_key method
			* \remark To get the generated nonce vector, uses \see nonce method
			* \remark To get the generated tag, uses \see tag method
			* \return 0 on success, -1 otherwise
			*/
			int encrypt(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_message, std::vector<unsigned char>& p_enc_message);
			/*!
			* \fn int decrypt(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_key, const std::vector<unsigned char>& p_nonce, const std::vector<unsigned char>& p_tag, const std::vector<unsigned char>& p_enc_message, std::vector<unsigned char>& p_message);
			* \brief Decryption using the specified algorithm.
			* \param[in] p_enc_algorithm The algorithm to use for the decryption
			* \param[in] p_nonce The algorithm to use for the encryption
			* \param[in] p_tag The algorithm to use for the encryption
			* \param[in] p_enc_message The message to be decrypted
			* \param[out] p_message The decrypted message
			* \remark To get the generated ephemeral key, uses \see ephemeral_key method
			* \remark To get the generated nonce vector, uses \see nonce method
			* \remark To get the generated tag, uses \see tag method
			* \return 0 on success, -1 otherwise
			*/
			int decrypt(const encryption_algotithm p_enc_algorithm, const std::vector<unsigned char>& p_key, const std::vector<unsigned char>& p_nonce, const std::vector<unsigned char>& p_tag, const std::vector<unsigned char>& p_enc_message, std::vector<unsigned char>& p_message);

	int encrypt(const std::vector<unsigned char>& p_message, std::vector<unsigned char>& p_enc_message);		int encrypt(const std::vector<unsigned char>& p_message, std::vector<unsigned char>& p_enc_message);
	int decrypt(const std::vector<unsigned char>& p_nonce, const std::vector<unsigned char>& p_tag, const std::vector<unsigned char>& p_enc_message, std::vector<unsigned char>& p_message);		int decrypt(const std::vector<unsigned char>& p_nonce, const std::vector<unsigned char>& p_tag, const std::vector<unsigned char>& p_enc_message, std::vector<unsigned char>& p_message);

Admin message