fisherstevenk / kyberjce

Pure Java implementation of the Kyber (version 3) post-quantum IND-CCA2 KEM.

CRYSTALS KYBER Java

KYBER is an IND-CCA2-secure key encapsulation mechanism (KEM), whose security is based on the hardness of solving the learning-with-errors (LWE) problem over module lattices. The homepage for CRYSTALS Kyber can be found here (some information from this README is pulled directly from their site).

The initial creation of this code was translated from this Go implementation of Kyber (version 3). After getting that to work, the code was modified into a JCE. The Diffie-Hellman OpenJDK 11 code was used as a base.

Kyber has three different parameter sets: 512, 768, and 1024. Kyber-512 aims at security roughly equivalent to AES-128, Kyber-768 aims at security roughly equivalent to AES-192, and Kyber-1024 aims at security roughly equivalent to AES-256.

Sun Libraries

The "sun.security.*" library requirements have been removed from version 3.0.0 of this library. The required "sun.security.*" classes were copied from Java 13 and refactored into "com.swiftcryptollc.crypto.util" under the GNU General Public License version 2. Part of the refactoring was to remove unused methods and variables, and to change to new base classes where possible.

Loading the Kyber JCE

There are a couple ways to load the Kyber JCE. One way is to add these two lines to your program:

Security.setProperty("crypto.policy", "unlimited");
Security.addProvider(new KyberJCE());

Example Use

The following code will show a basic Key Agreement between two parties. (Additional AES encryption is recommended for further securing remote communication.)

// Alice generates a KeyPair and sends her public key to Bob
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Kyber1024");
KeyPair aliceKeyPair = keyGen.generateKeyPair();

// Bob Generates a KeyPair and an initial Key Agreement
// "Kyber512" or "Kyber768" or "Kyber1024" are options for Key Generation
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("Kyber1024");
KeyPair bobKeyPair = keyGen.generateKeyPair();
KeyAgreement keyAgreement = KeyAgreement.getInstance("Kyber");
keyAgreement.init(bobKeyPair.getPrivate());

// Bob generates a Secret Key and Cipher Text from Alice's Public Key
// KyberEncrypted holds the Secret Key and the Cipher Text
KyberEncrypted kyberEncrypted = (KyberEncrypted) keyAgreement.doPhase((KyberPublicKey) alicePublicKey, true);

// Bob sends Alice the generated Cipher Text 
// Alice creates her own KeyAgreement and initializes it with her private key
KeyAgreement keyAgreement = KeyAgreement.getInstance("Kyber");
keyAgreement.init((KyberPrivateKey) alicePrivateKey);

// Alice generates the same Secret Key from the Cipher Text
// KyberDecrypted holds the Secret Key (will be the same one that Bob generated) and the variant
KyberDecrypted kyberDecrypted = (KyberDecrypted) keyAgreement.doPhase(cipherText, true);

DISCLAIMER

This library is available under the MIT License. The tests from the Go implementation have been converted to Java. The original test files are used as the main test source. Additional tests include X.509 encoding and decoding, a key agreement, and a massively multi-threaded key agreement test for good measure. The tests all pass, however please note that the code has not been examined by a third party for potential vulnerabilities.

Further Information

More details about CRYSTALS and the most secure ways to use it can be found here

Signing Expiration

The signing certificates are ony valid for 5 years. This means that the certificate for each signed Release jar file is only good until 2027-08-03. After that time, you will no longer be able to import the 2.1.2 jar into the Oracle JVM. (No one knows what will happen in 5 years, but you can import it into the OpenJDK JVM and I probably will have an updated certificate at that point as well.)

Contact

[email protected]

kyberjce's Issues

Dependency Gone

Hello the following dependency is no longer available:

        <!-- https://mvnrepository.com/artifact/com.github.aelstad/keccakj -->
        <dependency>
            <groupId>com.github.aelstad</groupId>
            <artifactId>keccakj</artifactId>
            <version>1.1.0</version>
        </dependency>

It is a known issue that likely will not get addressed: aelstad/keccakj#4
Is it possible to use another lib?

Change to Java 17 LTE

Currently builds to Java 18. Change to Java 17 LTE.

Add OpenJDK 13 Compiled Jar

Add Signing Expiration Date

Get 2.1 signed

constantTimeCompare return for array size difference should be 1

/**
 * Test to compare the equality of two byte arrays
 *
 * Returns 0 if they are equal
 *
 * @param x
 * @param y
 * @return
 */
public static int constantTimeCompare(byte[] x, byte[] y) {
    if (x.length != y.length) {
        **return 0;**
    }

.....

Should be "return 1"

INDCCA / KyberKeyAgreement.java

only glanced at the code (and might misread it) but it looks to me that in
KyberKeyAgreement.java,
in the decryption, i.e. decrypt512 there is the following issue:

In case the FO-transform returns a failure (i.e. constant time comparing the arrays does not return 0), then instead of returning a pseudo-random value, you throw an exception. If so, this would very much destroy INDCCA?!

I.e. we should always return something, and in case of a failure a pseudo-random number (overwrite pre-k with z). E.g. see here https://github.com/pq-crystals/kyber/blob/master/ref/kem.c or in the spec...

Did I overlook something?

java: exporting a package from system module java.base is not allowed with --release

Having issues with the following on build:

java: exporting a package from system module java.base is not allowed with --release

Using Temurin 18.0.2 JDK --> sometimes a runtime error with the following:

Exception in thread "main" java.lang.IllegalAccessError: class com.swiftcryptollc.crypto.provider.KyberJCE (in unnamed module @0x27abe2cd) cannot access class sun.security.util.SecurityConstants (in module java.base) because module java.base does not export sun.security.util to unnamed module @0x27abe2cd

Thanks,

KyberKeyAgreement.java

There are bugs in the decryption functions。
for example, in decrypt768:
for (int i = 0; i < KyberParams.paramsSymBytes; i++) {
int length = KyberParams.Kyber768SKBytes - KyberParams.paramsSymBytes + i;
byte[] skx = new byte[length];
System.arraycopy(privateKey, 0, skx, 0, length);
kr[i] = (byte) ((int) (kr[i] & 0xFF) ^ ((int) (fail & 0xFF) & ((int) (kr[i] & 0xFF) ^ (int) (skx[i] & 0xFF))));
}
This code copies the first length bytes of privateKey to skx， which is part of IND-CPA-Private.
However, what actually needs to be copied is the randomBytes('z' in 《Endemic Oblivious Transfer》)
（2 * KyberParams.Kyber768SKBytes + 2 * KyberParams.paramsSymBytes, KyberParams.Kyber1024SKBytes）