seemenkina · seemenkina · Nov 3, 2020
diff --git a/set5/chl33.go b/set5/chl33.go
@@ -0,0 +1,69 @@
+package set5
+
+import (
+	"crypto/aes"
+	"crypto/rand"
+	"crypto/sha1"
+	"crypto/sha256"
+	"fmt"
+	"math"
+	"math/big"
+
+	"github.com/seemenkina/cryptopals/set2"
+)
+
+type DHParticipant struct {
+	p       *big.Int
+	g       *big.Int
+	private *big.Int
+	public  *big.Int
+	result  *big.Int
+}
+
+func (dh *DHParticipant) SetParams(p, g *big.Int) {
+	dh.p = p
+	dh.g = g
+}
+
+func (dh *DHParticipant) GetParams() (*big.Int, *big.Int) {
+	return dh.p, dh.g
+}
+
+func (dh *DHParticipant) GeneratePrivateKey() {
+	private, err := rand.Int(rand.Reader, big.NewInt(math.MaxInt64))
+	if err != nil {
+		println(fmt.Errorf("can not create private key, %s", err))
+		panic(err)
+	}
+	dh.private = private
+}
+
+func (dh *DHParticipant) GeneratePublicKey() {
+	dh.public = new(big.Int).Exp(dh.g, dh.private, dh.p)
+}
+
+func (dh *DHParticipant) DHHandshake(public *big.Int) {
+	dh.result = new(big.Int).Exp(public, dh.private, dh.p)
+}
+
+func (dh *DHParticipant) GetPublicKey() *big.Int {
+	return dh.public
+}
+
+func (dh *DHParticipant) DHResult() []byte {
+	return sha256.New().Sum(dh.result.Bytes())
+}
+
+func (dh *DHParticipant) Encrypt(msg []byte) ([]byte, []byte, error) {
+	key := sha1.New().Sum(dh.result.Bytes())[:aes.BlockSize]
+	iv := make([]byte, aes.BlockSize)
+	_, _ = rand.Read(iv)
+	decr, err := set2.CBCModeEncrypt(iv, msg, key, aes.BlockSize)
+	return decr, iv, err
+}
+
+func (dh *DHParticipant) Decrypt(cipher, iv []byte) ([]byte, error) {
+	key := sha1.New().Sum(dh.result.Bytes())[:aes.BlockSize]
+	plainText, err := set2.CBCModeDecrypt(iv, cipher, key, aes.BlockSize)
+	return plainText, err
+}
diff --git a/set5/chl34.go b/set5/chl34.go
@@ -0,0 +1,51 @@
+package set5
+
+import (
+	"crypto/aes"
+	"crypto/sha1"
+	"math/big"
+
+	"github.com/seemenkina/cryptopals/set2"
+)
+
+type params func() (*big.Int, *big.Int)
+
+func Attack(candidate, cipher, iv []byte) ([]byte, error) {
+	key := sha1.New().Sum(candidate)[:aes.BlockSize]
+	plainMiddle, err := set2.CBCModeDecrypt(iv, cipher, key, aes.BlockSize)
+	return plainMiddle, err
+}
+
+func MITMAttack(alice, bob *DHParticipant, createParams params) ([]byte, []byte) {
+	p, g := createParams()
+	alice.SetParams(p, g)
+	alice.GeneratePrivateKey()
+	alice.GeneratePublicKey()
+
+	bob.SetParams(p, g)
+	bob.GeneratePrivateKey()
+	bob.GeneratePublicKey()
+
+	alice.DHHandshake(p)
+	bob.DHHandshake(p)
+
+	cipherA, ivA, err := alice.Encrypt([]byte("msg"))
+	if err != nil {
+		panic(err)
+	}
+
+	plainTA, err := bob.Decrypt(cipherA, ivA)
+	if err != nil {
+		panic(err)
+	}
+
+	cipherB, ivB, err := bob.Encrypt(plainTA)
+	if err != nil {
+		panic(err)
+	}
+
+	// p**a %p == 0, p**b %p == 0 instead of B**a %p, A**b %p
+	pma, _ := Attack(nil, cipherA, ivA)
+	pmb, _ := Attack(nil, cipherB, ivB)
+	return pma, pmb
+}
diff --git a/set5/chl35.go b/set5/chl35.go
@@ -0,0 +1,57 @@
+package set5
+
+import "math/big"
+
+func MITMAttackG(alice, bob *DHParticipant, createParams params) ([]byte, []byte) {
+	p, g := createParams()
+	alice.SetParams(p, g)
+	alice.GeneratePrivateKey()
+	alice.GeneratePublicKey()
+
+	bob.SetParams(p, g)
+	bob.GeneratePrivateKey()
+	bob.GeneratePublicKey()
+
+	alice.DHHandshake(bob.GetPublicKey())
+	bob.DHHandshake(alice.GetPublicKey())
+
+	cipherA, ivA, err := alice.Encrypt([]byte("msg"))
+	if err != nil {
+		panic(err)
+	}
+
+	plainTA, err := bob.Decrypt(cipherA, ivA)
+	if err != nil {
+		panic(err)
+	}
+
+	cipherB, ivB, err := bob.Encrypt(plainTA)
+	if err != nil {
+		panic(err)
+	}
+
+	ONE := new(big.Int).SetUint64(1)
+
+	if g.Cmp(ONE) == 0 {
+		plA, _ := Attack(ONE.Bytes(), cipherA, ivA)
+		plB, _ := Attack(ONE.Bytes(), cipherB, ivB)
+		return plA, plB
+	} else if g == p {
+		plA, _ := Attack(nil, cipherA, ivA)
+		plB, _ := Attack(nil, cipherB, ivB)
+		return plA, plB
+	} else if g.Cmp(p.Sub(p, ONE)) == 0 {
+		plA, err := Attack(ONE.Bytes(), cipherA, ivA)
+		if err != nil {
+			cand := p.Sub(p, ONE)
+			plA, err = Attack(cand.Bytes(), cipherA, ivA)
+		}
+		plB, err := Attack(ONE.Bytes(), cipherB, ivB)
+		if err != nil {
+			cand := p.Sub(p, ONE)
+			plB, err = Attack(cand.Bytes(), cipherB, ivB)
+		}
+		return plA, plB
+	}
+	return nil, nil
+}
diff --git a/set5/set5_test.go b/set5/set5_test.go
@@ -0,0 +1,139 @@
+package set5
+
+import (
+	"math/big"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDiffieHellman(t *testing.T) {
+	alice := DHParticipant{}
+	bob := DHParticipant{}
+
+	p := new(big.Int).SetBytes([]byte("ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea" +
+		"63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a" +
+		"637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d" +
+		"39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca23732" +
+		"7ffffffffffffffff"))
+	g := new(big.Int).SetUint64(2)
+
+	alice.SetParams(p, g)
+	alice.GeneratePrivateKey()
+	alice.GeneratePublicKey()
+
+	bob.SetParams(p, g)
+	bob.GeneratePrivateKey()
+	bob.GeneratePublicKey()
+
+	alice.DHHandshake(bob.GetPublicKey())
+	bob.DHHandshake(alice.GetPublicKey())
+
+	assert.EqualValues(t, alice.DHResult(), bob.DHResult())
+}
+
+func TestDHEncrypt(t *testing.T) {
+	alice := DHParticipant{}
+	bob := DHParticipant{}
+
+	p := new(big.Int).SetBytes([]byte("ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea" +
+		"63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a" +
+		"637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d" +
+		"39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca23732" +
+		"7ffffffffffffffff"))
+	g := new(big.Int).SetUint64(2)
+	message := "Secret message"
+
+	alice.SetParams(p, g)
+	alice.GeneratePrivateKey()
+	alice.GeneratePublicKey()
+
+	bob.SetParams(p, g)
+	bob.GeneratePrivateKey()
+	bob.GeneratePublicKey()
+
+	alice.DHHandshake(bob.GetPublicKey())
+	bob.DHHandshake(alice.GetPublicKey())
+
+	encrAlice, iv, err := alice.Encrypt([]byte(message))
+	require.NoError(t, err)
+
+	msg, err := bob.Decrypt(encrAlice, iv)
+	require.NoError(t, err)
+
+	assert.EqualValues(t, message, msg)
+}
+
+func GetHardcodeParams() (*big.Int, *big.Int) {
+	p := new(big.Int).SetBytes([]byte("ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea" +
+		"63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a" +
+		"637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d" +
+		"39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca23732" +
+		"7ffffffffffffffff"))
+	g := new(big.Int).SetUint64(2)
+	return p, g
+}
+
+func GetParamG1() (*big.Int, *big.Int) {
+	p := new(big.Int).SetBytes([]byte("ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea" +
+		"63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a" +
+		"637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d" +
+		"39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca23732" +
+		"7ffffffffffffffff"))
+	g := new(big.Int).SetUint64(1)
+	return p, g
+}
+
+func GetParamGP() (*big.Int, *big.Int) {
+	p := new(big.Int).SetBytes([]byte("ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea" +
+		"63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a" +
+		"637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d" +
+		"39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca23732" +
+		"7ffffffffffffffff"))
+	g := p
+	return p, g
+}
+
+func GetParamGP1() (*big.Int, *big.Int) {
+	p := new(big.Int).SetBytes([]byte("ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea" +
+		"63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a" +
+		"637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d" +
+		"39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca23732" +
+		"7ffffffffffffffff"))
+	g := new(big.Int)
+	g = g.Sub(p, new(big.Int).SetUint64(1))
+	return p, g
+}
+
+// TestDHAlgEva_MITMAttack is implemented test for a MITM key-fixing attack on Diffie-Hellman with parameter injection (set 34)
+func TestDHAlgEva_MITMAttack(t *testing.T) {
+	dhA := new(DHParticipant)
+	dhB := new(DHParticipant)
+	pA, pB := MITMAttack(dhA, dhB, GetHardcodeParams)
+	assert.EqualValues(t, pA, pB)
+}
+
+// TestMITMAttackG is implemented test for DH with negotiated groups, and break with malicious "g" parameters (set 35)
+func TestMITMAttackG(t *testing.T) {
+	tests := []struct {
+		function params
+	}{
+		{GetParamG1},
+		{GetParamGP},
+		{GetParamGP1},
+	}
+
+	dhA := new(DHParticipant)
+	dhB := new(DHParticipant)
+
+	for _, tt := range tests {
+		tf := tt.function
+		t.Run("", func(t *testing.T) {
+			pA, pB := MITMAttackG(dhA, dhB, tf)
+			assert.NotEmpty(t, pA)
+			assert.NotEmpty(t, pB)
+			require.EqualValues(t, pA, pB)
+		})
+	}
+}