Guidelines on the Cryptographic Algorithms, Accompanying the Usage of Standards GOST R 34.10-2012 and GOST R 34.11-2012
CRYPTO-PRO18, Suschevsky val Moscow127018Russian Federation+7 (495) 995-48-20svs@cryptopro.ruCRYPTO-PRO18, Suschevsky val Moscow127018Russian Federation+7 (495) 995-48-20alekseev@cryptopro.ruCRYPTO-PRO18, Suschevsky val Moscow127018Russian Federation+7 (495) 995-48-20oshkin@cryptopro.ruCRYPTO-PRO18, Suschevsky val Moscow127018Russian Federation+7 (495) 995-48-20vpopov@cryptopro.ruCRYPTO-PRO18, Suschevsky val Moscow127018Russian Federation+7 (495) 995-48-20lse@cryptopro.ruFACTOR-TS11A, 1st Magistralny proezd Moscow123290Russian Federation+7 (495) 644-31-30v_podobaev@factor-ts.ruTCI8, Zoologicheskaya stMoscow117218Russian Federation+7 (499) 254-24-50beldmit@gmail.com
General
Network Working GroupTODO
The purpose of this document is to make the specifications of the cryptographic algorithms
defined by the Russian national standards GOST R 34.10-2012 and GOST R 34.11-2012
available to the Internet community
for their implementation in the cryptographic protocols based on the accompanying algorithms.
These specifications define the pseudorandom functions,
the key agreement algorithm based on the Diffie-Hellman algorithm and a hash function, the parameters of elliptic curves,
the key derivation functions and the key export functions.
The accompanying algorithms are intended for the cryptographic protocols implementation.
This memo contains a description of the accompanying algorithms based on the Russian
national standards GOST R 34.10-2012 and GOST R 34.11-2012 .
The English versions of these standards can be found in and ;
the English version of the encryption standard GOST 28147-89 (which is used in the key export functions) can be found in .
The specifications of algorithms and parameters proposed in this memo are provided
on the basis of experience in the development of the cryptographic protocols, as
described in , and .
This memo describes the pseudorandom functions, the key agreement
algorithm based on the Diffie-Hellman algorithm and a hash function, the parameters of
elliptic curves, the key derivation functions, and the key export
functions necessary to ensure interoperability of security protocols
that make use of the Russian cryptographic standards
GOST R 34.10-2012 digital signature algorithm
and GOST R 34.11-2012 cryptographic hash function.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT",
"RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in
.
This document uses the following terms and definitions for the sets and operations
on the elements of these sets:
exclusive-or of two binary vectors of the same length;
the finite vector space over GF(2) of dimension n, n >= 0, with the (xor) operation;
for n = 0 the V_0 space consists of a single empty element of size 0;
if U is an element of V_n, then U = (u_(n-1), u_(n-2), ..., u_1, u_0),
where u_i in {0, 1};
the set of byte vectors of size r, r >= 0, for r = 0 the V_(8, r) set consists of a single empty element of size 0;
if W is an element of V_(8, r), r > 0, then W = (w^0, w^1, ..., w^(r-1)),
where w^0, w^1, ..., w^(r-1) are elements of V_8;
the bit representation of the element W = (w^0, w^1, ..., w^(r-1)) of V_(8, r)
is an element (w_(8r-1), w_(8r-2), ..., w_1, w_0) of V_(8*r),
where w^0 = (w_7, w_6, ..., w_0),
w^1 = (w_15, w_14, ..., w_8), ..., w^(r-1) = (w_(8r-1), w_(8r-2), ..., w_(8r-8))
are elements of V_8;
if n is a multiple of 8, r = n/8, then the byte representation of the element W = (w_(n-1), w_(n-2), ..., w_0) of V_n
is a byte vector (w^0, w^1, ..., w^(r-1)) of V_(8, r), where
w^0 = (w_7, w_6, ..., w_0), w^1 = (w_15, w_14, ..., w_8), ..., w^(r-1) = (w_(8r-1), w_(8r-2), ..., w_(8r-8)) are elements of V_8;
concatenation of byte vectors A and B, i.e.,
if A in V_(8, r1), B in V_(8, r2), A = (a^0, a^1, ..., a^(r1-1)) and B = (b^0, b^1, ..., b^(r2-1)),
then A|B = (a^0, a^1, ..., a^(r1-1), b^0, b^1, ..., b^(r2-1)) is an element of V_(8, r1+r2);
an arbitrary element of V_n; if K in V_n, then its size (in bits) is equal to n,
where n can be an arbitrary natural number.
This memo uses the following abbreviations and symbols:
SymbolsMeaningH_256 GOST R 34.11-2012 hash function with 256-bit outputH_512GOST R 34.11-2012 hash function with 512-bit outputHMACa function for calculating a message authentication code, based on a hash function in accordance with PRFa pseudorandom function, i.e., a transformation that allows to generate pseudorandom sequence of bytesKDFa key derivation function, i.e., a transformation that allows to derive keys and keying material from
the root key and additional input using a pseudorandom functionVKOa key agreement algorithm based on the Diffie-Hellman algorithm and a hash function.
To generate a byte sequence of the size r with functions that give a
longer output the output is truncated to
the first r bytes. This remark applies to the following functions:
the functions described in ;
KDF_TREE_GOSTR3411_2012_256 described in ;
KDF_GOSTR3411_2012_256 described in .
Hereinafter all data are provided in byte representation unless
otherwise specified.
If a function is defined outside this document (e.g., H_256) and its definition requires arguments
in bit representation, it is assumed that the bit representations of the arguments are formed immediately
before the calculation of the function (in particular, immediately after the application of the operation
(|) to the byte representation of the arguments).
If the output of another function defined outside of this document
is used as an argument of the functions defined below and it
has the bit representation then it is assumed that
an output MUST have length that is a multiple of 8 and that it will be translated into the byte representation in advance.
When an elliptic point is given to an input of a hash function, affine coordinates for short Weierstrass
form are used (see ): an x coordinate value is fed first, an y coordinate value is fed second, both in little-endian format.
This section defines the HMAC transformations based on the GOST R 34.11-2012
algorithm.
This HMAC transformation is based on the GOST R 34.11-2012
hash function with 256-bit output. The object identifier of this
transformation is shown below:
id-tc26-hmac-gost-3411-12-256::= {iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) mac(4) hmac-gost-3411-12-256(1)}.
This algorithm uses H_256 as a hash function for HMAC, described in . The method of forming
the values of ipad and opad is also specified in . The size of HMAC_GOSTR3411_2012_256 output is equal
to 32 bytes, the block size of the iterative procedure for the H_256 compression function is equal
to 64 bytes (in the notation of , L = 32 and B = 64, respectively).
This HMAC transformation is based on the GOST R 34.11-2012
hash function with 512-bit output. The object identifier of this
transformation is shown below:
id-tc26-hmac-gost-3411-12-512::= {iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) mac(4) hmac-gost-3411-12-512(2)}.
This algorithm uses H_512 as a hash function for HMAC, described in . The method of forming
the values of ipad and opad is also specified in . The size of HMAC_GOSTR3411_2012_512 output is equal
to 64 bytes, the block size of the iterative procedure for the H_512 compression function is equal
to 64 bytes (in the notation of , L = 64 and B = 64, respectively).
This section defines six HMAC-based PRF transformations recommended for usage.
Two of them are designed for the TLS protocol and four are designed for the IPsec protocol.
This is the transformation providing the pseudorandom function for the TLS protocol (1.0 and higher versions)
in accordance with GOST R 34.11-2012 .
It uses the P_GOSTR3411_2012_256 function that is similar to the P_hash
function defined in Section 5 of , where HMAC_GOSTR3411_2012_256 function (defined
in of this document) is used as the HMAC_hash function.
PRF_TLS_GOSTR3411_2012_256 (secret, label, seed) = = P_GOSTR3411_2012_256 (secret, label | seed).
Label and seed values MUST be assigned by a protocol, their lengths SHOULD be fixed by a protocol in order to avoid possible collisions.
This is the transformation providing the pseudorandom function for the TLS protocol (1.0 and higher versions)
in accordance with GOST R 34.11-2012 .
It uses the P_GOSTR3411_2012_512 function that is similar to the P_hash
function defined in Section 5 of , where HMAC_GOSTR3411_2012_512 function (defined
in of this document) is used as the HMAC_hash function.
PRF_TLS_GOSTR3411_2012_512 (secret, label, seed) = = P_GOSTR3411_2012_512 (secret, label | seed).
Label and seed values MUST be assigned by a protocol, their lengths SHOULD be fixed by a protocol in order to avoid possible collisions.
IPsec family protocols use the pseudorandom functions for the purposes
of keying material generation and authentication. The specifications for the version 1 (IKEv1) and version 2
(IKEv2) of the Internet Key Exchange protocol
define the usage of PRF in various parts of the protocols.
According to the Section 4 of , if a PRF is not negotiated, the HMAC based on the negotiated
hash algorithm is used. So, when the 256-bit version of GOST R 34.11-2012 is used as a hash function in IKEv1, HMAC_GOST3411_2012_256
is used as a PRF; when the 512-version of GOST R 34.11-2012 is used as a hash function in IKEv1, HMAC_GOST3411_2012_512 is used as a PRF.
IKEv2 has no default PRF. This document specifies that HMAC_GOST3411_2012_256
and HMAC_GOST3411_2012_512 may be used as a PRF for the IKEv2 protocol.
This section specifies the key agreement algorithms based on GOST R 34.10-2012 .
The VKO_GOSTR3410_2012_256 transformation is used for agreement of 256-bit keys and is
based on the 256-bit version of GOST R 34.11-2012 . This algorithm can be applied
for a key agreement using
GOST R 34.10-2012 with 256-bit or 512-bit private keys.
The algorithm is designed to produce an encryption key or a keying material of size 256 bits
to be used in various cryptographic protocols. A key or a keying material KEK_VKO (x, y, UKM) is
produced from the private key x of one side, the public key y*P of the opposite side and the UKM value, considered as an integer.
The algorithm can be used for static and ephemeral keys with the public key size n ≥ 512
bits including the case where one side uses a static key and the other uses an ephemeral one.
The UKM parameter is optional (the default UKM = 1) and can take any integer value from 1 to 2^(n/2)-1.
It is allowed to use a nonzero UKM of an arbitrary size not exceeding n/2 bits. If at least one
of the parties uses static keys, the RECOMMENDED length of UKM is 64 bits or more.
KEK_VKO (x, y, UKM) is calculated using the formulas
KEK_VKO (x, y, UKM) = H_256 (K (x, y, UKM)),
K (x, y, UKM) = (m/q*UKM*x mod q)*(y*P),
where m and q are the parameters of an elliptic curve defined in the GOST R 34.10-2012 standard
(m is an elliptic curve points group order, q is an order of a cyclic subgroup), P is a nonzero point of the subgroup; P is defined by a protocol.
This algorithm is defined similar to the one specified in Section 5.2 of , but
applies the hash function H_256 instead of the hash function
GOST R 34.11-94 (referred as gostR3411). In addition, K(x, y, UKM)
is calculated with public key size n ≥ 512 bits and UKM has a size up to n/2 bits.
The VKO_GOSTR3410_2012_512 transformation is used for agreement of 512-bit keys and is
based on the 512-bit version of GOST R 34.11-2012 . This algorithm can be applied
for a key agreement using
GOST R 34.10-2012 with 512-bit private keys.
The algorithm is designed to produce an encryption key or a keying material of size 512 bits
to be used in various cryptographic protocols. A key or a keying material KEK_VKO (x, y, UKM) is
produced from the private key x of one side, the public key y*P of the opposite side and the UKM value, considered as an integer.
The algorithm can be used for static and ephemeral keys with the public key size n ≥ 1024
bits including the case where one side uses a static key and the other uses an ephemeral one.
The UKM parameter is optional (the default UKM = 1) and can take any integer value from 1 to 2^(n/2)-1. It is
allowed to use a nonzero UKM of an arbitrary size not exceeding n/2 bits. If at least one
of the parties uses static keys, the RECOMMENDED length of UKM is 128 bits or more.
KEK_VKO (x, y, UKM) is calculated using the formulas
KEK_VKO (x, y, UKM) = H_512 (K (x, y, UKM)),
K (x, y, UKM) = (m/q*UKM*x mod q)*(y*P),
where m and q are the parameters of an elliptic curve defined in the GOST R 34.10-2012 standard
(m is an elliptic curve points group order, q is an order of a cyclic subgroup), P is a nonzero point of the subgroup; P is defined by a protocol.
This algorithm is defined similar to the one specified in Section 5.2 of , but
applies the hash function H_512 instead of the hash function
GOST R 34.11-94 (referred as gostR3411). In addition, K(x, y, UKM)
is calculated with public key size n ≥ 1024 bits and UKM has a size up to n/2 bits.
The key derivation function KDF_TREE_GOSTR3411_2012_256 based on the HMAC_GOSTR3411_2012_256 function is given by:
KDF_TREE_GOSTR3411_2012_256 (K_in, label, seed, R) = K(1) | K(2) | K(3) | K(4) |...,
K(i) = HMAC_GOSTR3411_2012_256 (K_in, [i]_b | label | 0x00 | seed | [L]_b), i ≥ 1,
where
derivation key; the parameters that MUST be assigned by a protocol, their lengths SHOULD be fixed by a protocol;a fixed external parameter, with possible values of 1, 2, 3 or 4; iteration counter; byte representation of the iteration counter (in the network byte order), the number of bytes
in the representation [i]_b is equal to R (no more than 4 bytes); the required size (in bits) of the generated keying material (an integer, not exceeding 256*(2^(8*R)-1)); byte representation of L, in network byte order (variable length: no leading zero bytes added).
The key derivation function KDF_TREE_GOSTR3411_2012_256 is intended for generating a keying material of size
L, not exceeding 256*(2^(8*R)-1) bits, and utilizes general principles of the input and output for the key
derivation function outlined in Section 5.1 of NIST SP 800-108 .
The HMAC_GOSTR3411_2012_256 algorithm described in is selected as a pseudorandom function.
Each key derived from the keying material formed using the derivation key K_in (0-level key) may be
a 1-level derivation key and may be used to generate a new keying material. The keying material derived
from the 1-level derivation key can be split down into the 2nd level derivation keys. The application of
this procedure leads to the construction of the key tree with the root key and the formation of the keying
material to the hierarchy of the levels, as described in Section 6 of NIST SP 800-108 . The partitioning
procedure for keying material at each level is defined in accordance with a specific protocol.
The KDF_GOSTR3411_2012_256 function is equivalent to the function KDF_TREE_GOSTR3411_2012_256, when R = 1, L = 256, and is given by:
KDF_GOSTR3411_2012_256 (K_in, label, seed) = HMAC_GOSTR3411_2012_256 (K_in, 0x01 | label | 0x00 | seed | 0x01 | 0x00),
where
derivation key,
the parameters that MUST be assigned by a protocol, their lengths SHOULD be fixed by a protocol.
Wrapped representation of a secret key K (256-bit GOST 28147-89 key, 256-bit or 512-bit GOST R 34.10-2012 private key)
is formed as follows by using
a given export key K_e (GOST 28147-89 key) and a random seed vector:
Generate a random seed vector from 8 up to 16 bytes.
With the key derivation function, using an export key K_e as a derivation key,
produce a key KEK_e (K_e, seed), where
KEK_e (K_e, seed) = KDF_GOSTR3411_2012_256 (K_e, label, seed),
where the KDF_GOSTR3411_2012_256 function (see ) is used as a key derivation function for
the fixed label value
label = (0x26 | 0xBD | 0xB8 | 0x78).
GOST 28147-89 MAC value (4-byte) for the data K and the key KEK_e (K_e, seed) is calculated,
initialization vector (IV) in this case is equal to the first 8 bytes of seed.
The resulting value is denoted as CEK_MAC.
The key K is encrypted with the GOST 28147-89 algorithm in the Electronic Codebook (ECB)
mode with the key KEK_e (K_e, seed). The result is denoted as CEK_ENC.
The wrapped representation of the key is (seed | CEK_ENC | CEK_MAC).
The value of key K is restored from the wrapped representation of the
key and the export key K_e as follows:
Obtain the seed, CEK_ENC and CEK_MAC values from the wrapped representation of the key.
With the key derivation function, using the export key K_e as a derivation key,
produce a key KEK_e(K_e, seed), where
KEK_e (K_e, seed) = KDF_GOSTR3411_2012_256 (K_e, label, seed),
where the KDF_GOSTR3411_2012_256 function (see section ) is used as a key derivation function for
the fixed label value
label = (0x26 | 0xBD | 0xB8 | 0x78).
The CEK_ENC field is decrypted with the GOST 28147-89 algorithm in
the Electronic Codebook (ECB) mode with the key KEK_e(K_e, seed). The unwrapped key
K is assumed to be equal to the result of decryption.
GOST 28147-89 MAC value (4-byte) for the data K and the key KEK_e(K_e, seed) is calculated, initialization
vector (IV) in this case is equal to the first 8 bytes of seed. If the result is not equal
to CEK_MAC, an error is returned.
The GOST 28147-89 algorithm is used with the parameter set defined in of this document.
This section defines the elliptic curves parameters and object identifiers that
are RECOMMENDED for the usage with the signature and verification
algorithms of the digital signature in accordance with the GOST R 34.10-2012 standard
and with the key agreement algorithms VKO_GOSTR3410_2012_256 and VKO_GOSTR3410_2012_512.
This document does not negate the use of other parameters of elliptic curves.
This section defines the elliptic curves parameters of the GOST R 34.10-2012
standard for the case of elliptic curves with prime 512-bit moduli in canonical (short Weierstrass) form, that is
given by the following equation defined in GOST R 34.10-2012 :
y^2 = x^3 + ax + b (mod p).
In case of elliptic curves with 256-bit prime moduli the parameters defined in are proposed to use.
The parameters for each elliptic curve are represented by the following values which are defined in GOST R 34.10-2012 :
the characteristic of the underlying prime field;
the coefficients of the equation of the elliptic curve in the canonical form;
the elliptic curve group order;
the elliptic curve subgroup order;
the coordinates of the point P (generator of the subgroup of order q) of the elliptic curve in the canonical form.
Both sets of the parameters are presented as ASN structures of the form:
SEQUENCE {
p INTEGER,
a INTEGER,
b INTEGER,
m INTEGER,
q INTEGER,
x INTEGER,
y INTEGER
}
The parameter sets have the following object identifiers:
id-tc26-gost-3410-12-512-paramSetA::= {iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) constants(2) sign-constants(1) gost-3410-12-512-constants(2) paramSetA(1)}; id-tc26-gost-3410-12-512-paramSetB::= {iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) constants(2) sign-constants(1) gost-3410-12-512-constants(2) paramSetB(2)}.
The corresponding values of the parameter sets can be found in .
This section defines the elliptic curves parameters and object identifiers of
the GOST R 34.10-2012 standard
for the case of elliptic curves that have a representation
in the Twisted Edwards form with prime 256-bit and 512-bit moduli.
A Twisted Edwards curve E over a finite prime field F_p, p > 3,
is an elliptic curve defined by the equation:
e*u^2 + v^2 = 1 + d*u^2*v^2 (mod p),
where e, d are in F_p, ed(e-d) != 0.
A Twisted Edwards curve has an equivalent representation in the short Weierstrass form defined
by parameters a, b. The parameters a, b, e and d are related as follows:
a = s^2 – 3*t^2 (mod p),
b = 2*t^3 - t*s^2 (mod p),
where
s = (e – d)/4 (mod p),
t = (e + d)/6 (mod p).
Coordinate transformations are defined as follows:
(u,v) --> (x,y) = (s(1 + v)/(1 – v) + t, s(1 + v)/((1 – v)u)),
(x,y) --> (u,v) = ((x - t)/y, (x - t - s)/(x - t + s)).
The parameters for each elliptic curve are represented by the following values which are defined in GOST R 34.10-2012 :
the characteristic of the underlying prime field;
the coefficients of the equation of the elliptic curve in the canonical form;
the coefficients of the equation of the elliptic curve in the Twisted Edwards form;
the elliptic curve group order;
the elliptic curve subgroup order;
the coordinates of the point P (generator of the subgroup of order q) of the elliptic curve in the canonical form;
the coordinates of the point P (generator of the subgroup of order q) of the elliptic curve in the Twisted Edwards form.
Both sets of the parameters are presented as ASN structures of the form:
SEQUENCE {
p INTEGER,
a INTEGER,
b INTEGER,
e INTEGER,
d INTEGER,
m INTEGER,
q INTEGER,
x INTEGER,
y INTEGER,
u INTEGER,
v INTEGER
}
The parameter sets have the following object identifiers:
id-tc26-gost-3410-2012-256-paramSetA ::= {iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) constants(2) sign-constants(1) gost-3410-12-256-constants(1) paramSetA(1)};
id-tc26-gost-3410-2012-512-paramSetC ::= {iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) constants(2) sign-constants(1) gost-3410-12-512-constants(2) paramSetC(3)}.
The corresponding values of the parameter sets can be found in .
We thank Valery Smyslov, Igor Ustinov, Basil Dolmatov, Russ Housley, Dmitry Khovratovich,
Oleksandr Kazymyrov, Ekaterina Smyshlyaeva, Vasily Nikolaev and Lolita Sonina for their careful readings and useful comments.
Systems of information processing. Cryptographic data security.
Algorithms of cryptographic transformation
Gosudarstvennyi Standard of USSR, Government Committee of the USSR
for Standards (In Russian)
Information technology. Cryptographic data security. Signature and verification
processes of [electronic] digital signature
Federal Agency on Technical Regulating and Metrology (In Russian)
Information technology. Cryptographic Data Security. Hashing function
Federal Agency on Technical Regulating and Metrology (In Russian)
Information technology. Cryptographic Data Security. Hashing function
Federal Agency on Technical Regulating and Metrology (In Russian)
Recommendation for Key Derivation Using Pseudorandom Functions
National Institute of Standards and Technology
Parameter set: id-tc26-gost-3410-12-512-paramSetA
SEQUENCE
{
OBJECT IDENTIFIER
id-tc26-gost-3410-12-512-paramSetA
SEQUENCE
{
INTEGER
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FD
C7
INTEGER
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FD
C4
INTEGER
00 E8 C2 50 5D ED FC 86 DD C1 BD 0B 2B 66 67 F1
DA 34 B8 25 74 76 1C B0 E8 79 BD 08 1C FD 0B 62
65 EE 3C B0 90 F3 0D 27 61 4C B4 57 40 10 DA 90
DD 86 2E F9 D4 EB EE 47 61 50 31 90 78 5A 71 C7
60
INTEGER
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF 27 E6 95 32 F4 8D 89 11 6F F2 2B 8D 4E 05 60
60 9B 4B 38 AB FA D2 B8 5D CA CD B1 41 1F 10 B2
75
INTEGER
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF 27 E6 95 32 F4 8D 89 11 6F F2 2B 8D 4E 05 60
60 9B 4B 38 AB FA D2 B8 5D CA CD B1 41 1F 10 B2
75
INTEGER
03
INTEGER
75 03 CF E8 7A 83 6A E3 A6 1B 88 16 E2 54 50 E6
CE 5E 1C 93 AC F1 AB C1 77 80 64 FD CB EF A9 21
DF 16 26 BE 4F D0 36 E9 3D 75 E6 A5 0E 3A 41 E9
80 28 FE 5F C2 35 F5 B8 89 A5 89 CB 52 15 F2 A4
}
}
Parameter set: id-tc26-gost-3410-12-512-paramSetB
SEQUENCE
{
OBJECT IDENTIFIER
id-tc26-gost-3410-12-512-paramSetB
SEQUENCE
{
INTEGER
00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6F
INTEGER
00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6C
INTEGER
68 7D 1B 45 9D C8 41 45 7E 3E 06 CF 6F 5E 25 17
B9 7C 7D 61 4A F1 38 BC BF 85 DC 80 6C 4B 28 9F
3E 96 5D 2D B1 41 6D 21 7F 8B 27 6F AD 1A B6 9C
50 F7 8B EE 1F A3 10 6E FB 8C CB C7 C5 14 01 16
INTEGER
00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
01 49 A1 EC 14 25 65 A5 45 AC FD B7 7B D9 D4 0C
FA 8B 99 67 12 10 1B EA 0E C6 34 6C 54 37 4F 25
BD
INTEGER
00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
01 49 A1 EC 14 25 65 A5 45 AC FD B7 7B D9 D4 0C
FA 8B 99 67 12 10 1B EA 0E C6 34 6C 54 37 4F 25
BD
INTEGER
02
INTEGER
1A 8F 7E DA 38 9B 09 4C 2C 07 1E 36 47 A8 94 0F
3C 12 3B 69 75 78 C2 13 BE 6D D9 E6 C8 EC 73 35
DC B2 28 FD 1E DF 4A 39 15 2C BC AA F8 C0 39 88
28 04 10 55 F9 4C EE EC 7E 21 34 07 80 FE 41 BD
}
}
Parameter set: id-tc26-gost-3410-2012-256-paramSetA
SEQUENCE
{
OBJECT IDENTIFIER
id-tc26-gost-3410-2012-256-paramSetA
SEQUENCE
{
INTEGER
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FD
97
INTEGER
00 C2 17 3F 15 13 98 16 73 AF 48 92 C2 30 35 A2
7C E2 5E 20 13 BF 95 AA 33 B2 2C 65 6F 27 7E 73
35
INTEGER
29 5F 9B AE 74 28 ED 9C CC 20 E7 C3 59 A9 D4 1A
22 FC CD 91 08 E1 7B F7 BA 93 37 A6 F8 AE 95 13
INTEGER
01
INTEGER
06 05 F6 B7 C1 83 FA 81 57 8B C3 9C FA D5 18 13
2B 9D F6 28 97 00 9A F7 E5 22 C3 2D 6D C7 BF FB
INTEGER
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 3F 63 37 7F 21 ED 98 D7 04 56 BD 55 B0 D8 31
9C
INTEGER
40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F D8 CD DF C8 7B 66 35 C1 15 AF 55 6C 36 0C 67
INTEGER
00 91 E3 84 43 A5 E8 2C 0D 88 09 23 42 57 12 B2
BB 65 8B 91 96 93 2E 02 C7 8B 25 82 FE 74 2D AA
28
INTEGER
32 87 94 23 AB 1A 03 75 89 57 86 C4 BB 46 E9 56
5F DE 0B 53 44 76 67 40 AF 26 8A DB 32 32 2E 5C
INTEGER
0D
INTEGER
60 CA 1E 32 AA 47 5B 34 84 88 C3 8F AB 07 64 9C
E7 EF 8D BE 87 F2 2E 81 F9 2B 25 92 DB A3 00 E7
}
}
Parameter set: id-tc26-gost-3410-2012-512-paramSetC
SEQUENCE
{
OBJECT IDENTIFIER
id-tc26-gost-3410-2012-512-paramSetC
SEQUENCE
{
INTEGER
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FD
C7
INTEGER
00 DC 92 03 E5 14 A7 21 87 54 85 A5 29 D2 C7 22
FB 18 7B C8 98 0E B8 66 64 4D E4 1C 68 E1 43 06
45 46 E8 61 C0 E2 C9 ED D9 2A DE 71 F4 6F CF 50
FF 2A D9 7F 95 1F DA 9F 2A 2E B6 54 6F 39 68 9B
D3
INTEGER
00 B4 C4 EE 28 CE BC 6C 2C 8A C1 29 52 CF 37 F1
6A C7 EF B6 A9 F6 9F 4B 57 FF DA 2E 4F 0D E5 AD
E0 38 CB C2 FF F7 19 D2 C1 8D E0 28 4B 8B FE F3
B5 2B 8C C7 A5 F5 BF 0A 3C 8D 23 19 A5 31 25 57
E1
INTEGER
01
INTEGER
00 9E 4F 5D 8C 01 7D 8D 9F 13 A5 CF 3C DF 5B FE
4D AB 40 2D 54 19 8E 31 EB DE 28 A0 62 10 50 43
9C A6 B3 9E 0A 51 5C 06 B3 04 E2 CE 43 E7 9E 36
9E 91 A0 CF C2 BC 2A 22 B4 CA 30 2D BB 33 EE 75
50
INTEGER
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF 26 33 6E 91 94 1A AC 01 30 CE A7 FD 45 1D 40
B3 23 B6 A7 9E 9D A6 84 9A 51 88 F3 BD 1F C0 8F
B4
INTEGER
3F FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
C9 8C DB A4 65 06 AB 00 4C 33 A9 FF 51 47 50 2C
C8 ED A9 E7 A7 69 A1 26 94 62 3C EF 47 F0 23 ED
INTEGER
00 E2 E3 1E DF C2 3D E7 BD EB E2 41 CE 59 3E F5
DE 22 95 B7 A9 CB AE F0 21 D3 85 F7 07 4C EA 04
3A A2 72 72 A7 AE 60 2B F2 A7 B9 03 3D B9 ED 36
10 C6 FB 85 48 7E AE 97 AA C5 BC 79 28 C1 95 01
48
INTEGER
00 F5 CE 40 D9 5B 5E B8 99 AB BC CF F5 91 1C B8
57 79 39 80 4D 65 27 37 8B 8C 10 8C 3D 20 90 FF
9B E1 8E 2D 33 E3 02 1E D2 EF 32 D8 58 22 42 3B
63 04 F7 26 AA 85 4B AE 07 D0 39 6E 9A 9A DD C4
0F
INTEGER
12
INTEGER
46 9A F7 9D 1F B1 F5 E1 6B 99 59 2B 77 A0 1E 2A
0F DF B0 D0 17 94 36 8D 9A 56 11 7F 7B 38 66 95
22 DD 4B 65 0C F7 89 EE BF 06 8C 5D 13 97 32 F0
90 56 22 C0 4B 2B AA E7 60 03 03 EE 73 00 1A 3D
}
}
The parameter set has the following object identifier:
id-tc26-gost-28147-param-Z::= {iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) constants(2) cipher-constants(5) gost-28147-constants(1) param-Z(1)}
The parameter set is defined below: