[PATCH BlueZ v2 0/1] Allow Non-Ephemeral ECC Key Sets

[PATCH BlueZ v2 0/1] Allow Non-Ephemeral ECC Key Sets

[Brian Gix]

Version 2, to address uninitialized private_key issue, by adding a new
API. This is separates the two major tasks of generating ECC key sets,
which are:

a) Create a Private Key (Only used here when creating Ephemeral set)
b) Create the matching Public Key from the Private Key.

In hindsight, we may have wanted to call the original API something like
ecc_make_keys() or ecc_make_key_set() instead of the singlular ecc_make_key.
Making that change now will require more wide-reaching changes, however. But
I am willing to do it in a v3 if people think it better.

Some minor spelling/capitalization issues were also addressed

Mesh will be the first to use non-Ephemeral keys

Brian Gix (1):
  shared/ecc: Allow pre-composed Private Keys

 src/shared/ecc.c | 42 +++++++++++++++++++++++++++++-------------
 src/shared/ecc.h | 17 ++++++++++++++---
 2 files changed, 43 insertions(+), 16 deletions(-)

-- 
2.14.3

[PATCH BlueZ v2 1/1] shared/ecc: Allow pre-composed Private Keys

[Brian Gix]

Add function ecc_make_public_key() which takes a const private_key
and generates a validated public_key to complete the pair.

Non-ephemeral key sets are required to support Bluetooth Mesh.
---
 src/shared/ecc.c | 42 +++++++++++++++++++++++++++++-------------
 src/shared/ecc.h | 17 ++++++++++++++---
 2 files changed, 43 insertions(+), 16 deletions(-)

diff --git a/src/shared/ecc.c b/src/shared/ecc.c
index eb2cc005d..47f229ca9 100644
--- a/src/shared/ecc.c
+++ b/src/shared/ecc.c
@@ -856,33 +856,49 @@ static void ecc_native2bytes(const uint64_t native[NUM_ECC_DIGITS],
 	}
 }
 
-bool ecc_make_key(uint8_t public_key[64], uint8_t private_key[32])
+bool ecc_make_public_key(const uint8_t private_key[32], uint8_t public_key[64])
 {
 	struct ecc_point pk;
 	uint64_t priv[NUM_ECC_DIGITS];
-	unsigned tries = 0;
 
-	do {
-		if (!get_random_number(priv) || (tries++ >= MAX_TRIES))
-			return false;
+	ecc_bytes2native(private_key, priv);
 
-		if (vli_is_zero(priv))
-			continue;
+	if (vli_is_zero(priv))
+		return false;
 
-		/* Make sure the private key is in the range [1, n-1]. */
-		if (vli_cmp(curve_n, priv) != 1)
-			continue;
+	/* Make sure the private key is in the range [1, n-1]. */
+	if (vli_cmp(curve_n, priv) != 1)
+		return false;
+
+	ecc_point_mult(&pk, &curve_g, priv, NULL, vli_num_bits(priv));
 
-		ecc_point_mult(&pk, &curve_g, priv, NULL, vli_num_bits(priv));
-	} while (ecc_point_is_zero(&pk));
+	if (ecc_point_is_zero(&pk))
+		return false;
 
-	ecc_native2bytes(priv, private_key);
 	ecc_native2bytes(pk.x, public_key);
 	ecc_native2bytes(pk.y, &public_key[32]);
 
 	return true;
 }
 
+bool ecc_make_key(uint8_t public_key[64], uint8_t private_key[32])
+{
+	uint64_t priv[NUM_ECC_DIGITS];
+	unsigned tries = 0;
+	bool result = false;
+
+	for (tries = 0; !result && tries < MAX_TRIES; tries++) {
+		if (!get_random_number(priv))
+			continue;
+
+		ecc_native2bytes(priv, private_key);
+
+		result = ecc_make_public_key(private_key, public_key);
+	}
+
+	return result;
+}
+
 bool ecc_valid_public_key(const uint8_t public_key[64])
 {
 	struct ecc_point pk;
diff --git a/src/shared/ecc.h b/src/shared/ecc.h
index f89f2b0c3..a88e735c7 100644
--- a/src/shared/ecc.h
+++ b/src/shared/ecc.h
@@ -27,14 +27,25 @@
 #include <stdbool.h>
 #include <stdint.h>
 
+/* Create a public key from a private key.
+ *
+ * Outputs:
+ *	private_key - Const private key
+ *	public_key  - Will be filled in with the public key.
+ *
+ * Returns true if the public key was generated successfully, false
+ * if an error occurred. The keys are with the LSB first.
+ */
+bool ecc_make_public_key(const uint8_t private_key[32], uint8_t public_key[64]);
+
 /* Create a public/private key pair.
  *
  * Outputs:
  *	public_key  - Will be filled in with the public key.
- *	private_Key - Will be filled in with the private key.
+ *	private_key - Will be filled in with the private key.
  *
  * Returns true if the key pair was generated successfully, false
- * if an error occurred. They keys are with the LSB first.
+ * if an error occurred. The keys are with the LSB first.
  */
 bool ecc_make_key(uint8_t public_key[64], uint8_t private_key[32]);
 
@@ -54,7 +65,7 @@ bool ecc_valid_public_key(const uint8_t public_key[64]);
  *
  * Inputs:
  *	public_key  - The public key of the remote party.
- *	private_Key - Your private key.
+ *	private_key - Your private key.
  *
  * Outputs:
  *	secret - Will be filled in with the shared secret value.
-- 
2.14.3

Re: [PATCH BlueZ v2 0/1] Allow Non-Ephemeral ECC Key Sets

[Luiz Augusto von Dentz]

Hi Brian,

On Fri, Apr 27, 2018 at 8:11 PM Brian Gix <brian.gix@intel.com> wrote:

> Version 2, to address uninitialized private_key issue, by adding a new
> API. This is separates the two major tasks of generating ECC key sets,
> which are:

> a) Create a Private Key (Only used here when creating Ephemeral set)
> b) Create the matching Public Key from the Private Key.

> In hindsight, we may have wanted to call the original API something like
> ecc_make_keys() or ecc_make_key_set() instead of the singlular
ecc_make_key.
> Making that change now will require more wide-reaching changes, however.
But
> I am willing to do it in a v3 if people think it better.

> Some minor spelling/capitalization issues were also addressed

> Mesh will be the first to use non-Ephemeral keys

> Brian Gix (1):
>    shared/ecc: Allow pre-composed Private Keys

>   src/shared/ecc.c | 42 +++++++++++++++++++++++++++++-------------
>   src/shared/ecc.h | 17 ++++++++++++++---
>   2 files changed, 43 insertions(+), 16 deletions(-)


I went ahead and applied this one since the bigger set depending on it,
note that I did have to fix the following warning by checkpatch:

  Applying: shared/ecc: Allow pre-composed Private Keys
WARNING:UNSPECIFIED_INT: Prefer 'unsigned int' to bare use of 'unsigned'
#50: FILE: src/shared/ecc.c:887:
+    unsigned tries = 0;

> --
> 2.14.3



-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ v2 1/1] shared/ecc: Allow pre-composed Private Keys

[Marcel Holtmann]

Hi Brian,

> Add function ecc_make_public_key() which takes a const private_key
> and generates a validated public_key to complete the pair.
> 
> Non-ephemeral key sets are required to support Bluetooth Mesh.
> ---
> src/shared/ecc.c | 42 +++++++++++++++++++++++++++++-------------
> src/shared/ecc.h | 17 ++++++++++++++---
> 2 files changed, 43 insertions(+), 16 deletions(-)
> 
> diff --git a/src/shared/ecc.c b/src/shared/ecc.c
> index eb2cc005d..47f229ca9 100644
> --- a/src/shared/ecc.c
> +++ b/src/shared/ecc.c
> @@ -856,33 +856,49 @@ static void ecc_native2bytes(const uint64_t native[NUM_ECC_DIGITS],
> 	}
> }
> 
> -bool ecc_make_key(uint8_t public_key[64], uint8_t private_key[32])
> +bool ecc_make_public_key(const uint8_t private_key[32], uint8_t public_key[64])
> {
> 	struct ecc_point pk;
> 	uint64_t priv[NUM_ECC_DIGITS];
> -	unsigned tries = 0;
> 
> -	do {
> -		if (!get_random_number(priv) || (tries++ >= MAX_TRIES))
> -			return false;
> +	ecc_bytes2native(private_key, priv);
> 
> -		if (vli_is_zero(priv))
> -			continue;
> +	if (vli_is_zero(priv))
> +		return false;
> 
> -		/* Make sure the private key is in the range [1, n-1]. */
> -		if (vli_cmp(curve_n, priv) != 1)
> -			continue;
> +	/* Make sure the private key is in the range [1, n-1]. */
> +	if (vli_cmp(curve_n, priv) != 1)
> +		return false;
> +
> +	ecc_point_mult(&pk, &curve_g, priv, NULL, vli_num_bits(priv));
> 
> -		ecc_point_mult(&pk, &curve_g, priv, NULL, vli_num_bits(priv));
> -	} while (ecc_point_is_zero(&pk));
> +	if (ecc_point_is_zero(&pk))
> +		return false;
> 
> -	ecc_native2bytes(priv, private_key);
> 	ecc_native2bytes(pk.x, public_key);
> 	ecc_native2bytes(pk.y, &public_key[32]);
> 
> 	return true;
> }
> 
> +bool ecc_make_key(uint8_t public_key[64], uint8_t private_key[32])
> +{
> +	uint64_t priv[NUM_ECC_DIGITS];
> +	unsigned tries = 0;
> +	bool result = false;
> +
> +	for (tries = 0; !result && tries < MAX_TRIES; tries++) {
> +		if (!get_random_number(priv))
> +			continue;
> +
> +		ecc_native2bytes(priv, private_key);
> +
> +		result = ecc_make_public_key(private_key, public_key);
> +	}

this is actually a functional change. On result == false, the private_key return value is now populated. Also the !result in the for-loop check is rather complicated. That is hard to follow code. In addition setting tries = 0 on declaration is pointless. Just blindly trying to swap a do-while with a for-loop is not going to work.

I would have preferred you didn’t touch ecc_make_key at all and just create a new ecc_make_public_key. I think you tried to over-optimize here.

> +
> +	return result;
> +}
> +
> bool ecc_valid_public_key(const uint8_t public_key[64])
> {
> 	struct ecc_point pk;
> diff --git a/src/shared/ecc.h b/src/shared/ecc.h
> index f89f2b0c3..a88e735c7 100644
> --- a/src/shared/ecc.h
> +++ b/src/shared/ecc.h
> @@ -27,14 +27,25 @@
> #include <stdbool.h>
> #include <stdint.h>
> 
> +/* Create a public key from a private key.
> + *
> + * Outputs:
> + *	private_key - Const private key

This so wrong.

It is Inputs: private_key and the word “Const” has nothing to do here.

> + *	public_key  - Will be filled in with the public key.
> + *
> + * Returns true if the public key was generated successfully, false
> + * if an error occurred. The keys are with the LSB first.
> + */
> +bool ecc_make_public_key(const uint8_t private_key[32], uint8_t public_key[64]);
> +
> /* Create a public/private key pair.
>  *
>  * Outputs:
>  *	public_key  - Will be filled in with the public key.
> - *	private_Key - Will be filled in with the private key.
> + *	private_key - Will be filled in with the private key.
>  *
>  * Returns true if the key pair was generated successfully, false
> - * if an error occurred. They keys are with the LSB first.
> + * if an error occurred. The keys are with the LSB first.
>  */
> bool ecc_make_key(uint8_t public_key[64], uint8_t private_key[32]);
> 
> @@ -54,7 +65,7 @@ bool ecc_valid_public_key(const uint8_t public_key[64]);
>  *
>  * Inputs:
>  *	public_key  - The public key of the remote party.
> - *	private_Key - Your private key.
> + *	private_key - Your private key.
>  *
>  * Outputs:
>  *	secret - Will be filled in with the shared secret value.

Regards

Marcel

RE: [PATCH BlueZ v2 1/1] shared/ecc: Allow pre-composed Private Keys

[Gix, Brian]

SGkgTWFyY2VsLA0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZyb206IE1hcmNl
bCBIb2x0bWFubiBbbWFpbHRvOm1hcmNlbEBob2x0bWFubi5vcmddDQo+IFNlbnQ6IE1vbmRheSwg
QXByaWwgMzAsIDIwMTggMTo0NiBBTQ0KPiBUbzogR2l4LCBCcmlhbiA8YnJpYW4uZ2l4QGludGVs
LmNvbT4NCj4gQ2M6IEx1aXogQXVndXN0byB2b24gRGVudHogPGx1aXouZGVudHpAZ21haWwuY29t
PjsgbGludXgtDQo+IGJsdWV0b290aEB2Z2VyLmtlcm5lbC5vcmcNCj4gU3ViamVjdDogUmU6IFtQ
QVRDSCBCbHVlWiB2MiAxLzFdIHNoYXJlZC9lY2M6IEFsbG93IHByZS1jb21wb3NlZCBQcml2YXRl
DQo+IEtleXMNCj4gDQo+IEhpIEJyaWFuLA0KPiANCj4gPiBBZGQgZnVuY3Rpb24gZWNjX21ha2Vf
cHVibGljX2tleSgpIHdoaWNoIHRha2VzIGEgY29uc3QgcHJpdmF0ZV9rZXkgYW5kDQo+ID4gZ2Vu
ZXJhdGVzIGEgdmFsaWRhdGVkIHB1YmxpY19rZXkgdG8gY29tcGxldGUgdGhlIHBhaXIuDQo+ID4N
Cj4gPiBOb24tZXBoZW1lcmFsIGtleSBzZXRzIGFyZSByZXF1aXJlZCB0byBzdXBwb3J0IEJsdWV0
b290aCBNZXNoLg0KPiA+IC0tLQ0KPiA+IHNyYy9zaGFyZWQvZWNjLmMgfCA0MiArKysrKysrKysr
KysrKysrKysrKysrKysrKysrKy0tLS0tLS0tLS0tLS0NCj4gPiBzcmMvc2hhcmVkL2VjYy5oIHwg
MTcgKysrKysrKysrKysrKystLS0NCj4gPiAyIGZpbGVzIGNoYW5nZWQsIDQzIGluc2VydGlvbnMo
KyksIDE2IGRlbGV0aW9ucygtKQ0KPiA+DQo+ID4gZGlmZiAtLWdpdCBhL3NyYy9zaGFyZWQvZWNj
LmMgYi9zcmMvc2hhcmVkL2VjYy5jIGluZGV4DQo+ID4gZWIyY2MwMDVkLi40N2YyMjljYTkgMTAw
NjQ0DQo+ID4gLS0tIGEvc3JjL3NoYXJlZC9lY2MuYw0KPiA+ICsrKyBiL3NyYy9zaGFyZWQvZWNj
LmMNCj4gPiBAQCAtODU2LDMzICs4NTYsNDkgQEAgc3RhdGljIHZvaWQgZWNjX25hdGl2ZTJieXRl
cyhjb25zdCB1aW50NjRfdA0KPiBuYXRpdmVbTlVNX0VDQ19ESUdJVFNdLA0KPiA+IAl9DQo+ID4g
fQ0KPiA+DQo+ID4gLWJvb2wgZWNjX21ha2Vfa2V5KHVpbnQ4X3QgcHVibGljX2tleVs2NF0sIHVp
bnQ4X3QgcHJpdmF0ZV9rZXlbMzJdKQ0KPiA+ICtib29sIGVjY19tYWtlX3B1YmxpY19rZXkoY29u
c3QgdWludDhfdCBwcml2YXRlX2tleVszMl0sIHVpbnQ4X3QNCj4gPiArcHVibGljX2tleVs2NF0p
DQo+ID4gew0KPiA+IAlzdHJ1Y3QgZWNjX3BvaW50IHBrOw0KPiA+IAl1aW50NjRfdCBwcml2W05V
TV9FQ0NfRElHSVRTXTsNCj4gPiAtCXVuc2lnbmVkIHRyaWVzID0gMDsNCj4gPg0KPiA+IC0JZG8g
ew0KPiA+IC0JCWlmICghZ2V0X3JhbmRvbV9udW1iZXIocHJpdikgfHwgKHRyaWVzKysgPj0gTUFY
X1RSSUVTKSkNCj4gPiAtCQkJcmV0dXJuIGZhbHNlOw0KPiA+ICsJZWNjX2J5dGVzMm5hdGl2ZShw
cml2YXRlX2tleSwgcHJpdik7DQo+ID4NCj4gPiAtCQlpZiAodmxpX2lzX3plcm8ocHJpdikpDQo+
ID4gLQkJCWNvbnRpbnVlOw0KPiA+ICsJaWYgKHZsaV9pc196ZXJvKHByaXYpKQ0KPiA+ICsJCXJl
dHVybiBmYWxzZTsNCj4gPg0KPiA+IC0JCS8qIE1ha2Ugc3VyZSB0aGUgcHJpdmF0ZSBrZXkgaXMg
aW4gdGhlIHJhbmdlIFsxLCBuLTFdLiAqLw0KPiA+IC0JCWlmICh2bGlfY21wKGN1cnZlX24sIHBy
aXYpICE9IDEpDQo+ID4gLQkJCWNvbnRpbnVlOw0KPiA+ICsJLyogTWFrZSBzdXJlIHRoZSBwcml2
YXRlIGtleSBpcyBpbiB0aGUgcmFuZ2UgWzEsIG4tMV0uICovDQo+ID4gKwlpZiAodmxpX2NtcChj
dXJ2ZV9uLCBwcml2KSAhPSAxKQ0KPiA+ICsJCXJldHVybiBmYWxzZTsNCj4gPiArDQo+ID4gKwll
Y2NfcG9pbnRfbXVsdCgmcGssICZjdXJ2ZV9nLCBwcml2LCBOVUxMLCB2bGlfbnVtX2JpdHMocHJp
dikpOw0KPiA+DQo+ID4gLQkJZWNjX3BvaW50X211bHQoJnBrLCAmY3VydmVfZywgcHJpdiwgTlVM
TCwNCj4gdmxpX251bV9iaXRzKHByaXYpKTsNCj4gPiAtCX0gd2hpbGUgKGVjY19wb2ludF9pc196
ZXJvKCZwaykpOw0KPiA+ICsJaWYgKGVjY19wb2ludF9pc196ZXJvKCZwaykpDQo+ID4gKwkJcmV0
dXJuIGZhbHNlOw0KPiA+DQo+ID4gLQllY2NfbmF0aXZlMmJ5dGVzKHByaXYsIHByaXZhdGVfa2V5
KTsNCj4gPiAJZWNjX25hdGl2ZTJieXRlcyhway54LCBwdWJsaWNfa2V5KTsNCj4gPiAJZWNjX25h
dGl2ZTJieXRlcyhway55LCAmcHVibGljX2tleVszMl0pOw0KPiA+DQo+ID4gCXJldHVybiB0cnVl
Ow0KPiA+IH0NCj4gPg0KPiA+ICtib29sIGVjY19tYWtlX2tleSh1aW50OF90IHB1YmxpY19rZXlb
NjRdLCB1aW50OF90IHByaXZhdGVfa2V5WzMyXSkgew0KPiA+ICsJdWludDY0X3QgcHJpdltOVU1f
RUNDX0RJR0lUU107DQo+ID4gKwl1bnNpZ25lZCB0cmllcyA9IDA7DQo+ID4gKwlib29sIHJlc3Vs
dCA9IGZhbHNlOw0KPiA+ICsNCj4gPiArCWZvciAodHJpZXMgPSAwOyAhcmVzdWx0ICYmIHRyaWVz
IDwgTUFYX1RSSUVTOyB0cmllcysrKSB7DQo+ID4gKwkJaWYgKCFnZXRfcmFuZG9tX251bWJlcihw
cml2KSkNCj4gPiArCQkJY29udGludWU7DQo+ID4gKw0KPiA+ICsJCWVjY19uYXRpdmUyYnl0ZXMo
cHJpdiwgcHJpdmF0ZV9rZXkpOw0KPiA+ICsNCj4gPiArCQlyZXN1bHQgPSBlY2NfbWFrZV9wdWJs
aWNfa2V5KHByaXZhdGVfa2V5LCBwdWJsaWNfa2V5KTsNCj4gPiArCX0NCj4gDQo+IHRoaXMgaXMg
YWN0dWFsbHkgYSBmdW5jdGlvbmFsIGNoYW5nZS4gT24gcmVzdWx0ID09IGZhbHNlLCB0aGUgcHJp
dmF0ZV9rZXkgcmV0dXJuDQo+IHZhbHVlIGlzIG5vdyBwb3B1bGF0ZWQuIEFsc28gdGhlICFyZXN1
bHQgaW4gdGhlIGZvci1sb29wIGNoZWNrIGlzIHJhdGhlcg0KPiBjb21wbGljYXRlZC4gVGhhdCBp
cyBoYXJkIHRvIGZvbGxvdyBjb2RlLiBJbiBhZGRpdGlvbiBzZXR0aW5nIHRyaWVzID0gMCBvbg0K
PiBkZWNsYXJhdGlvbiBpcyBwb2ludGxlc3MuIEp1c3QgYmxpbmRseSB0cnlpbmcgdG8gc3dhcCBh
IGRvLXdoaWxlIHdpdGggYSBmb3ItbG9vcA0KPiBpcyBub3QgZ29pbmcgdG8gd29yay4NCj4gDQo+
IEkgd291bGQgaGF2ZSBwcmVmZXJyZWQgeW91IGRpZG7igJl0IHRvdWNoIGVjY19tYWtlX2tleSBh
dCBhbGwgYW5kIGp1c3QgY3JlYXRlDQo+IGEgbmV3IGVjY19tYWtlX3B1YmxpY19rZXkuIEkgdGhp
bmsgeW91IHRyaWVkIHRvIG92ZXItb3B0aW1pemUgaGVyZS4NCg0KSXQgaXMgYSAiRnVuY3Rpb25h
bCBjaGFuZ2Ugb24gRmFpbCIgd2hpY2ggSSBkaXNyZWdhcmRlZCBhcyB0cml2aWFsIChJIGRvIG5v
dCBiZWxpZXZlDQphbnkgaW1wbGVtZW50YXRpb25zIHdvdWxkIHVzZSBhIHJldHVybiBwcml2YXRl
X2tleSBvbiBmYWlsKSBidXQgSSBkbyB0YWtlIHlvdXIgcG9pbnQuDQoNCkx1aXogaGFzIGFscmVh
ZHkgYXBwbGllZCB0aGUgcGF0Y2gsIGJ1dCBJIGNhbiByZS1lZGl0IGl0IHRvIHJlc3RvcmUgdGhl
IG9yaWdpbmFsIGVjY19tYWtlX2tleSgpDQp0byBpdHMgb3JpZ2luYWwgc3RhdGUgKG1ha2luZyB0
aGUgcmVzdCBvZiB0aGUgY29tbWVudHMgbW9vdCksIGFuZCBhZGQgZWNjX21ha2VfcHVibGljX2tl
eSgpDQphcyBhIHN0YW5kLWFsb25lIGZ1bmN0aW9uIHdpdGggbm8gY3Jvc3MgZGVwZW5kZW5jaWVz
IHdpdGggZWNjX21ha2Vfa2V5KCkuIFRob3VnaHRzPw0KDQo+IA0KPiA+ICsNCj4gPiArCXJldHVy
biByZXN1bHQ7DQo+ID4gK30NCj4gPiArDQo+ID4gYm9vbCBlY2NfdmFsaWRfcHVibGljX2tleShj
b25zdCB1aW50OF90IHB1YmxpY19rZXlbNjRdKSB7DQo+ID4gCXN0cnVjdCBlY2NfcG9pbnQgcGs7
DQo+ID4gZGlmZiAtLWdpdCBhL3NyYy9zaGFyZWQvZWNjLmggYi9zcmMvc2hhcmVkL2VjYy5oIGlu
ZGV4DQo+ID4gZjg5ZjJiMGMzLi5hODhlNzM1YzcgMTAwNjQ0DQo+ID4gLS0tIGEvc3JjL3NoYXJl
ZC9lY2MuaA0KPiA+ICsrKyBiL3NyYy9zaGFyZWQvZWNjLmgNCj4gPiBAQCAtMjcsMTQgKzI3LDI1
IEBADQo+ID4gI2luY2x1ZGUgPHN0ZGJvb2wuaD4NCj4gPiAjaW5jbHVkZSA8c3RkaW50Lmg+DQo+
ID4NCj4gPiArLyogQ3JlYXRlIGEgcHVibGljIGtleSBmcm9tIGEgcHJpdmF0ZSBrZXkuDQo+ID4g
KyAqDQo+ID4gKyAqIE91dHB1dHM6DQo+ID4gKyAqCXByaXZhdGVfa2V5IC0gQ29uc3QgcHJpdmF0
ZSBrZXkNCj4gDQo+IFRoaXMgc28gd3JvbmcuDQo+IA0KPiBJdCBpcyBJbnB1dHM6IHByaXZhdGVf
a2V5IGFuZCB0aGUgd29yZCDigJxDb25zdOKAnSBoYXMgbm90aGluZyB0byBkbyBoZXJlLg0KDQpZ
b3UgYXJlIGNvcnJlY3QsIHRoYXQgcHJpdmF0ZV9rZXkgaGVyZSBzaG91bGQgYmUgaW4gbGlzdGVk
IGFzIGFuIElucHV0LiANCg0KSG93ZXZlciBjb25zdCBhYnNvbHV0ZWx5IGFwcGxpZXMgaW4gdGhp
cyBjYXNlICh0aGUgaW5wdXQgY2FzZSkgc2luY2UgaXQgbXVzdA0Kbm90IGJlIGNoYW5nZWQgKGl0
IGlzIG5vbi1lcGhlbWVyYWwpLg0KDQoNCj4gDQo+ID4gKyAqCXB1YmxpY19rZXkgIC0gV2lsbCBi
ZSBmaWxsZWQgaW4gd2l0aCB0aGUgcHVibGljIGtleS4NCj4gPiArICoNCj4gPiArICogUmV0dXJu
cyB0cnVlIGlmIHRoZSBwdWJsaWMga2V5IHdhcyBnZW5lcmF0ZWQgc3VjY2Vzc2Z1bGx5LCBmYWxz
ZQ0KPiA+ICsgKiBpZiBhbiBlcnJvciBvY2N1cnJlZC4gVGhlIGtleXMgYXJlIHdpdGggdGhlIExT
QiBmaXJzdC4NCj4gPiArICovDQo+ID4gK2Jvb2wgZWNjX21ha2VfcHVibGljX2tleShjb25zdCB1
aW50OF90IHByaXZhdGVfa2V5WzMyXSwgdWludDhfdA0KPiA+ICtwdWJsaWNfa2V5WzY0XSk7DQo+
ID4gKw0KPiA+IC8qIENyZWF0ZSBhIHB1YmxpYy9wcml2YXRlIGtleSBwYWlyLg0KPiA+ICAqDQo+
ID4gICogT3V0cHV0czoNCj4gPiAgKglwdWJsaWNfa2V5ICAtIFdpbGwgYmUgZmlsbGVkIGluIHdp
dGggdGhlIHB1YmxpYyBrZXkuDQo+ID4gLSAqCXByaXZhdGVfS2V5IC0gV2lsbCBiZSBmaWxsZWQg
aW4gd2l0aCB0aGUgcHJpdmF0ZSBrZXkuDQo+ID4gKyAqCXByaXZhdGVfa2V5IC0gV2lsbCBiZSBm
aWxsZWQgaW4gd2l0aCB0aGUgcHJpdmF0ZSBrZXkuDQo+ID4gICoNCj4gPiAgKiBSZXR1cm5zIHRy
dWUgaWYgdGhlIGtleSBwYWlyIHdhcyBnZW5lcmF0ZWQgc3VjY2Vzc2Z1bGx5LCBmYWxzZQ0KPiA+
IC0gKiBpZiBhbiBlcnJvciBvY2N1cnJlZC4gVGhleSBrZXlzIGFyZSB3aXRoIHRoZSBMU0IgZmly
c3QuDQo+ID4gKyAqIGlmIGFuIGVycm9yIG9jY3VycmVkLiBUaGUga2V5cyBhcmUgd2l0aCB0aGUg
TFNCIGZpcnN0Lg0KPiA+ICAqLw0KPiA+IGJvb2wgZWNjX21ha2Vfa2V5KHVpbnQ4X3QgcHVibGlj
X2tleVs2NF0sIHVpbnQ4X3QgcHJpdmF0ZV9rZXlbMzJdKTsNCj4gPg0KPiA+IEBAIC01NCw3ICs2
NSw3IEBAIGJvb2wgZWNjX3ZhbGlkX3B1YmxpY19rZXkoY29uc3QgdWludDhfdA0KPiA+IHB1Ymxp
Y19rZXlbNjRdKTsNCj4gPiAgKg0KPiA+ICAqIElucHV0czoNCj4gPiAgKglwdWJsaWNfa2V5ICAt
IFRoZSBwdWJsaWMga2V5IG9mIHRoZSByZW1vdGUgcGFydHkuDQo+ID4gLSAqCXByaXZhdGVfS2V5
IC0gWW91ciBwcml2YXRlIGtleS4NCj4gPiArICoJcHJpdmF0ZV9rZXkgLSBZb3VyIHByaXZhdGUg
a2V5Lg0KPiA+ICAqDQo+ID4gICogT3V0cHV0czoNCj4gPiAgKglzZWNyZXQgLSBXaWxsIGJlIGZp
bGxlZCBpbiB3aXRoIHRoZSBzaGFyZWQgc2VjcmV0IHZhbHVlLg0KPiANCj4gUmVnYXJkcw0KPiAN
Cj4gTWFyY2VsDQoNCg==