Simplify SPAKE2 implementation.

crypto/p224_spake.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// This code implements SPAKE2, a varient of EKE:
+// This code implements SPAKE2, a variant of EKE:
 //  http://www.di.ens.fr/~pointche/pub.php?reference=AbPo04
 
 #include <crypto/p224_spake.h>
 
 #include <base/logging.h>
 #include <base/rand_util.h>
 #include <crypto/p224.h>
 #include <crypto/secure_util.h>
 
 namespace {
@@ skipping 73 matching lines @@
   {197567436, 51226044, 60372156, 175772188,
    42075930, 8083165, 160827401, 65097570},
   {1, 0, 0, 0, 0, 0, 0},
 };
 
 }  // anonymous namespace
 
 namespace crypto {
 
 P224EncryptedKeyExchange::P224EncryptedKeyExchange(
-    PeerType peer_type,
-    const base::StringPiece& password,
-    const base::StringPiece& session)
+    PeerType peer_type, const base::StringPiece& password)
     : state_(kStateInitial),
       is_server_(peer_type == kPeerTypeServer) {
   // x_ is a random scalar.
   base::RandBytes(x_, sizeof(x_));
 
   // X = g**x_
   p224::Point X;
   p224::ScalarBaseMult(x_, &X);
 
-  // The "password" in the SPAKE2 protocol is
-  // SHA256(P(password) + P(session)) where P is function that prepends a
-  // uint32, big-endian length prefix.
-  uint8 password_length[4], session_length[4];
-  password_length[0] = password.size() >> 24;
-  password_length[1] = password.size() >> 16;
-  password_length[2] = password.size() >> 8;
-  password_length[3] = password.size();
-  session_length[0] = session.size() >> 24;
-  session_length[1] = session.size() >> 16;
-  session_length[2] = session.size() >> 8;
-  session_length[3] = session.size();
-  SHA256HashString(std::string(reinterpret_cast<const char *>(password_length),
-                               sizeof(password_length)) +
-                   password.as_string() +
-                   std::string(reinterpret_cast<const char *>(session_length),
-                               sizeof(session_length)) +
-                   session.as_string(),
-                   pw_,
-                   sizeof(pw_));
+  // Calculate |password| hash to get SPAKE password value.
+  SHA256HashString(std::string(password.data(), password.length()),
+                   pw_, sizeof(pw_));
 
   // The client masks the Diffie-Hellman value, X, by adding M**pw and the
   // server uses N**pw.
   p224::Point MNpw;
   p224::ScalarMult(is_server_ ? kN : kM, pw_, &MNpw);
 
   // X* = X + (N|M)**pw
   p224::Point Xstar;
   p224::Add(X, MNpw, &Xstar);
 
@@ skipping 52 matching lines @@
   p224::ScalarMult(is_server_ ? kM : kN, pw_, &MNpw);
   p224::Negate(MNpw, &minus_MNpw);
 
   // Y = Y* - (N|M)**pw
   p224::Add(Ystar, minus_MNpw, &Y);
 
   // K = Y**x_
   p224::ScalarMult(Y, x_, &k);
 
   // If everything worked out, then K is the same for both parties.
-  std::string k_str = k.ToString();
+  key_ = k.ToString();
 
   std::string client_masked_dh, server_masked_dh;
   if (is_server_) {
     client_masked_dh = message.as_string();
     server_masked_dh = next_message_;
   } else {
     client_masked_dh = next_message_;
     server_masked_dh = message.as_string();
   }
 
   // Now we calculate the hashes that each side will use to prove to the other
   // that they derived the correct value for K.
   uint8 client_hash[kSHA256Length], server_hash[kSHA256Length];
-  CalculateHash(kPeerTypeClient, client_masked_dh, server_masked_dh, k_str,
+  CalculateHash(kPeerTypeClient, client_masked_dh, server_masked_dh, key_,
                 client_hash);
-  CalculateHash(kPeerTypeServer, client_masked_dh, server_masked_dh, k_str,
+  CalculateHash(kPeerTypeServer, client_masked_dh, server_masked_dh, key_,
                 server_hash);
 
   const uint8* my_hash = is_server_ ? server_hash : client_hash;
   const uint8* their_hash = is_server_ ? client_hash : server_hash;
 
   next_message_ =
       std::string(reinterpret_cast<const char*>(my_hash), kSHA256Length);
   memcpy(expected_authenticator_, their_hash, kSHA256Length);
   state_ = kStateSendHash;
   return kResultPending;
@@ skipping 19 matching lines @@
       std::string(reinterpret_cast<const char *>(pw_), sizeof(pw_));
   hash_contents += k;
 
   SHA256HashString(hash_contents, out_digest, kSHA256Length);
 }
 
 const std::string& P224EncryptedKeyExchange::error() const {
   return error_;
 }
 
+const std::string& P224EncryptedKeyExchange::GetKey() {
+  DCHECK_EQ(state_, kStateDone);
+  return key_;
+}
+
 }  // namespace crypto