(c#)在(EC)DHE x25519上使用私钥和公钥计算密钥共享

Question

我正在使用(EC)DHE加密类型x25519，我在计算共享密钥时遇到了一个大问题。

我有三个关键:

• Alice的私钥:

  a : "984a382e1e48d2a522a0e81b92fd13517e904316c6687a59d66cd2e5d9519a53"
  

• Alice的公钥:

  Q(a) = a*G(a) : "3db045ba8a16efd9e15de287158097ee754ce5d76e83c5e434109dd132a4736d"
  

• Bob的公钥:

  Q(b) =  b*G(b) : "74676252b0757ba3cb945ea053d9d65897a22e01592f7fa9c9503b818cd9df5a"
  

所以现在我需要像这样组合Alice的私钥和Bob的公钥(以找到它们之间的共享密钥):

Z = a * Q(b) = a * b * G(b)

有人用c#帮我解决这个问题吗?(我需要一个编程代码)。

Answer 1

我正在使用(EC)DHE加密类型x25519，我在计算共享密钥时遇到了一个大问题。

微软没有默认实现的椭圆曲线x25519。然而，他们对加密Diffie Hellman对象的实现允许我们定义我们自己的曲线。

一旦我们定义了自己要使用的曲线(x25519)，我们就可以使用微软的ECDiffieHellmanCng实现来导入曲线，生成密钥，并创建共享秘密。

感谢Yasar_yy关于x25519上一个无关主题的问题，他为我们实现了曲线。

我们使用ECCurve类实现曲线

public static ECCurve Curve25519 {get; init;} = new ECCurve()
{
CurveType = ECCurve.ECCurveType.PrimeMontgomery,
B = new byte[] { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 },
A = new byte[] { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x07, 0x6d, 0x06 }, // 486662
G = new ECPoint()
{
X = new byte[] { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9 },
Y = new byte[] { 0x20, 0xae, 0x19, 0xa1, 0xb8, 0xa0, 0x86, 0xb4, 0xe0, 0x1e, 0xdd, 0x2c, 0x77, 0x48, 0xd1, 0x4c,
0x92, 0x3d, 0x4d, 0x7e, 0x6d, 0x7c, 0x61, 0xb2, 0x29, 0xe9, 0xc5, 0xa2, 0x7e, 0xce, 0xd3, 0xd9 }
},
Prime = new byte[] { 0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xed },
//Prime = new byte[] { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 },
Order = new byte[] { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x14, 0xde, 0xf9, 0xde, 0xa2, 0xf7, 0x9c, 0xd6, 0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed },
Cofactor = new byte[] { 8 }
};

在我们定义了我们想要使用的曲线之后，我们只需要为曲线生成键，剩下的就是使用ECDiffieHellmanCng类的标准了。

public class Person
{
public string Name {get; set;}
public byte[] PublicKey {get; private set;}
public byte[] PrivateKey {get; private set;}
private ECParameters EncryptionParameters;
public void GenerateInitialKeys()
{
using (ECDiffieHellmanCng bob = new ECDiffieHellmanCng())
{
// we have to generate the key explicitly using the curve we defined, the auto-generated keys can not be used
bob.GenerateKey(Curve25519);
// assign what algorithms for derivation and hashing should be used
bob.KeyDerivationFunction = ECDiffieHellmanKeyDerivationFunction.Hash;
bob.HashAlgorithm = CngAlgorithm.Sha256;
// save the keys
PublicKey = bob.PublicKey.ToByteArray();
PrivateKey = bob.ExportECPrivateKey();
// export the curve information so we can create a shared secret later
EncryptionParameters = bob.ExportParameters(true);
}
}
public void CreateSharedSecret(byte[] OtherPublicKey)
{
if(EncryptionParameters is null)
{
throw new NullReferenceException($"{nameof(EncryptionParameters)} must not be null, invoke {nameof(GenerateInitialKeys)} to generate new keys and {nameof(EncryptionParameters)}");
}
using (ECDiffieHellmanCng bob = new ECDiffieHellmanCng())
{
// import the curve information from when generated our initial keys
bob.ImportParameters(EncryptionParameters);
// assign what algorithms for derivation and hashing should be used
bob.KeyDerivationFunction = ECDiffieHellmanKeyDerivationFunction.Hash;
bob.HashAlgorithm = CngAlgorithm.Sha256;
// import the byte[] as a key, note EccFullPublicBlob is required, otherwise a generic runtime error will throw and will contain absolutely no useful information
CngKey otherKey = CngKey.Import(OtherPublicKey, CngKeyBlobFormat.EccFullPublicBlob)
// Save the shared secret
PrivateKey = bob.DeriveKeyMaterial(otherKey);
}
}
// This is just here to visually verify the private keys for equality because we don't speak or read byte[]
public string ExportPrivateKey()
{
return Convert.ToBase64String(PrivateKey ?? Array.Empty<byte>());
}
}

要使用这个非常基本的类，我们就叫GenerateKeys，然后叫CreateSharedSecret。

Person alice = new();
Person bob = new();
alice.GenerateInitialKeys();
bob.GenerateInitialKeys();
alice.CreateSharedSecret(bob.PublicKey);
bob.CreateSharedSecret(alice.PublicKey);
Console.WriteLine(alice.ExportPrivateKey() == bob.ExportPrivateKey());
// ideally should output: true

Answer 2

一个舒适的替代内置功能(参见另一个答案)是BouncyCastle，它允许更紧凑的实现，还支持轻松导入原始X25519密钥:

using Org.BouncyCastle.Crypto.Agreement;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Utilities.Encoders;
...
X25519PrivateKeyParameters privateKeyAlice = new X25519PrivateKeyParameters(Hex.Decode("a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4"), 0);
X25519PublicKeyParameters publicKeyBob = new X25519PublicKeyParameters(Hex.Decode("e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c"), 0);
X25519Agreement agreementAlice = new X25519Agreement();
agreementAlice.Init(privateKeyAlice);
byte[] secretAlice = new byte[agreementAlice.AgreementSize];
agreementAlice.CalculateAgreement(publicKeyBob, secretAlice, 0);
Console.WriteLine(Hex.ToHexString(secretAlice)); // c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552

在发布的示例中，使用了来自Rfc7748的测试向量(其中指定曲线25519等)。

与内置功能(见这里)相比，BC愉快地提供了未修改的共享秘密，可用于根据需要派生密钥(例如通过应用摘要)。