The class FBB::ECDH computes shared keys (shared secrets) applying elliptic keys to the Diffie-Hellman (1976) algorithm. The Diffie-Hellman algorithm uses public and private information, providing a public key infrastructure (PKI). The public information consists of an elliptic curve specification and a public key, which may be shared over insecure media.
The Diffie-Hellman algorithm is commonly used to compute a shared key which is then used to encrypt information sent between two parties.
One party, which in this man-page is called the initiator, specifies at construction time an elliptic curve, constructs a public and private key, and writes the public key in hexadecimal big-endian form, followed by the name of the used elliptic curve to file. The initiator's private key is separately written to file, as the private key is required for computating the shared key. Encryption may be used when writing the private key to file.
Next the initiator passes the file containing the initiator's public key and the name of the used elliptic curve to the other party, which in this man-page is called the peer.
The peer, having received the initiator's (public key) file constructs an FBB::ECDH object. The peer's ECDH constructor computes the peer's public and private key, writes the peer's public key to file, and constructs the shared key. Once the peer's ECDH object has been constructed the peer can write the shared key to file. The peer's private key may optionally also be written to file, but that's optional, as the peer's private key is not required for subsequent computations. Encryption may also be used when writing the peer's private key to file.
The file containing the peer's public key is then sent to the initator. The initator constructs an ECDH object specifying the names of the used elliptic curve, of the file containing the initiator's private key, and the name of the file containing the peer's public key. Once this ECDH object has been constructed the peer may write the shared key to file.
The initiator and peer's shared keys are identical and can be used for symmetric encryption of sensitive information shared between the initiator and the peer.
FBB::Exceptions are thrown if the ECDH constructors or members cannot complete their tasks.
Perfect Forward Secrecy and Ephemeral Diffie Hellman
The initiator and peer may decide not to save their private information once they have constructed their shared keys, resulting in Perfect Forward Secrecy and Ephemeral Diffie Hellman. Here, this procedure is applied as follows:
Document encryption using Diffie Hellman
As with PKI in general, the Diffie Hellman key exchange method itself is normally not used for encrypting documents. Instead, it is used to obtain a key that is used for symmetric encryption methods like 3DES or CBC. These symmetric encryption methods are available through, e.g., Bobcats' ISymCryptStream and OSymCryptStream classes.
This constructor should be called by the initiator to start the Diffie-Hellman shared key computation procedure;
The move constructor (and move assignment operator) is available.
Start the program with one of the following arguments:
#include "main.ih"
int main(int argc, char **argv)
try
{
if (argc == 1)
{
usage(path{ argv[0] }.filename().string());
return 0;
}
if ("curves"s == argv[1]) // show supported ECDH curves.
cout << ECDH{};
else if ("init"s == argv[1]) // initiator key construction
{
// write the file containing
// the curve + public key
ECDH ecdh{ ECDH::Initiator, "secp384r1", "init.pub" };
// save the initiator's
// private key
ecdh.privKey("init.sec", "use your passphrase");
// not using encryption:
// auto initSec = Exception::factory<ofstream>("init.sec");
// initSec << ecdh.privKey() << '\n';
}
else if ("priv"s == argv[1]) // initiator key construction
{
// write the file containing
// the curve + public key
ECDH ecdh{ ECDH::Initiator, "secp384r1", "init.pub" };
cout << "wait for the peer's public key. "
"Press Enter to continue... ";
cin.ignore(100, '\n');
// written to file
auto initShared = Exception::factory<ofstream>("init.shared");
initShared << ecdh.sharedKey("peer.pub") << '\n';
}
else if ("peer"s == argv[1]) // peer's key construction
{
// write the peer's public key
ECDH ecdh{ ECDH::Peer, "init.pub", "peer.pub" };
// save the peer's private
// key (although not needed)
auto out = Exception::factory<ofstream>("peer.sec");
out << ecdh.privKey() << '\n';
out = Exception::factory<ofstream>("peer.shared");
out << ecdh.sharedKey() << '\n';
}
else if ("shared"s == argv[1]) // the initiator's shared key
{ // construction
ECDH ecdh{ "secp384r1", "peer.pub", "init.sec",
"use your passphrase" };
auto initShared = Exception::factory<ofstream>("init.shared");
initShared << ecdh.sharedKey() << '\n'; // written to file
}
else
{
usage(path{ argv[0] }.filename().string());
return 1;
}
}
catch (exception const &exc)
{
cerr << "Error: " << exc.what() << '\n';
return 1;
}
catch (...) // and handle an unexpected exception
{
cerr << "unexpected exception\n";
return 1;
}