1*e7b1675dSTing-Kang Chang// Copyright 2022 Google LLC 2*e7b1675dSTing-Kang Chang// 3*e7b1675dSTing-Kang Chang// Licensed under the Apache License, Version 2.0 (the "License"); 4*e7b1675dSTing-Kang Chang// you may not use this file except in compliance with the License. 5*e7b1675dSTing-Kang Chang// You may obtain a copy of the License at 6*e7b1675dSTing-Kang Chang// 7*e7b1675dSTing-Kang Chang// http://www.apache.org/licenses/LICENSE-2.0 8*e7b1675dSTing-Kang Chang// 9*e7b1675dSTing-Kang Chang// Unless required by applicable law or agreed to in writing, software 10*e7b1675dSTing-Kang Chang// distributed under the License is distributed on an "AS IS" BASIS, 11*e7b1675dSTing-Kang Chang// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12*e7b1675dSTing-Kang Chang// See the License for the specific language governing permissions and 13*e7b1675dSTing-Kang Chang// limitations under the License. 14*e7b1675dSTing-Kang Chang// 15*e7b1675dSTing-Kang Chang//////////////////////////////////////////////////////////////////////////////// 16*e7b1675dSTing-Kang Chang 17*e7b1675dSTing-Kang Changpackage hpke 18*e7b1675dSTing-Kang Chang 19*e7b1675dSTing-Kang Changimport ( 20*e7b1675dSTing-Kang Chang "errors" 21*e7b1675dSTing-Kang Chang "fmt" 22*e7b1675dSTing-Kang Chang 23*e7b1675dSTing-Kang Chang "github.com/google/tink/go/tink" 24*e7b1675dSTing-Kang Chang pb "github.com/google/tink/go/proto/hpke_go_proto" 25*e7b1675dSTing-Kang Chang) 26*e7b1675dSTing-Kang Chang 27*e7b1675dSTing-Kang Chang// Decrypt for HPKE implements interface HybridDecrypt. 28*e7b1675dSTing-Kang Changtype Decrypt struct { 29*e7b1675dSTing-Kang Chang recipientPrivKey *pb.HpkePrivateKey 30*e7b1675dSTing-Kang Chang kem kem 31*e7b1675dSTing-Kang Chang kdf kdf 32*e7b1675dSTing-Kang Chang aead aead 33*e7b1675dSTing-Kang Chang encapsulatedKeyLen int 34*e7b1675dSTing-Kang Chang} 35*e7b1675dSTing-Kang Chang 36*e7b1675dSTing-Kang Changvar _ tink.HybridDecrypt = (*Decrypt)(nil) 37*e7b1675dSTing-Kang Chang 38*e7b1675dSTing-Kang Chang// NewDecrypt constructs a Decrypt using HpkePrivateKey. 39*e7b1675dSTing-Kang Changfunc NewDecrypt(recipientPrivKey *pb.HpkePrivateKey) (*Decrypt, error) { 40*e7b1675dSTing-Kang Chang if recipientPrivKey.GetPrivateKey() == nil || len(recipientPrivKey.GetPrivateKey()) == 0 { 41*e7b1675dSTing-Kang Chang return nil, errors.New("HpkePrivateKey.PrivateKey bytes are missing") 42*e7b1675dSTing-Kang Chang } 43*e7b1675dSTing-Kang Chang kem, kdf, aead, err := newPrimitivesFromProto(recipientPrivKey.GetPublicKey().GetParams()) 44*e7b1675dSTing-Kang Chang if err != nil { 45*e7b1675dSTing-Kang Chang return nil, err 46*e7b1675dSTing-Kang Chang } 47*e7b1675dSTing-Kang Chang return &Decrypt{recipientPrivKey, kem, kdf, aead, kem.encapsulatedKeyLength()}, nil 48*e7b1675dSTing-Kang Chang} 49*e7b1675dSTing-Kang Chang 50*e7b1675dSTing-Kang Chang// Decrypt decrypts ciphertext, verifying the integrity of contextInfo. 51*e7b1675dSTing-Kang Changfunc (d *Decrypt) Decrypt(ciphertext, contextInfo []byte) ([]byte, error) { 52*e7b1675dSTing-Kang Chang if len(ciphertext) < d.encapsulatedKeyLen { 53*e7b1675dSTing-Kang Chang return nil, fmt.Errorf("ciphertext (size %d) is too short", len(ciphertext)) 54*e7b1675dSTing-Kang Chang } 55*e7b1675dSTing-Kang Chang 56*e7b1675dSTing-Kang Chang encapsulatedKey := ciphertext[:d.encapsulatedKeyLen] 57*e7b1675dSTing-Kang Chang aeadCiphertext := ciphertext[d.encapsulatedKeyLen:] 58*e7b1675dSTing-Kang Chang 59*e7b1675dSTing-Kang Chang ctx, err := newRecipientContext(encapsulatedKey, d.recipientPrivKey, d.kem, d.kdf, d.aead, contextInfo) 60*e7b1675dSTing-Kang Chang if err != nil { 61*e7b1675dSTing-Kang Chang return nil, fmt.Errorf("newRecipientContext: %v", err) 62*e7b1675dSTing-Kang Chang } 63*e7b1675dSTing-Kang Chang 64*e7b1675dSTing-Kang Chang return ctx.open(aeadCiphertext, emptyAssociatedData) 65*e7b1675dSTing-Kang Chang} 66