commit 5b89262d5384a98180386fc7edec7b54b3a5ed35
parent bd80e5d9fe19153b1589b843ae234f0ee96a3dbd
Author: Armin Preiml <apreiml@strohwolke.at>
Date: Sun, 21 Nov 2021 20:30:09 +0100
add crypto::cipher::ctr stream mode
Signed-off-by: Armin Preiml <apreiml@strohwolke.at>
Signed-off-by: Drew DeVault <sir@cmpwn.com>
Diffstat:
5 files changed, 332 insertions(+), 7 deletions(-)
diff --git a/crypto/aes/aes_ct64.ha b/crypto/aes/aes_ct64.ha
@@ -27,6 +27,13 @@ use crypto::cipher;
use crypto::math;
use endian;
+export def BLOCKSIZE: size = 16;
+
+def CT64_NPARALLEL: size = 4;
+
+// Size of the buffer used for [[crypto::cipher::ctr]].
+export def CTR_BUFSIZE: size = BLOCKSIZE * (CT64_NPARALLEL + 1);
+
export type ct64_block = struct {
cipher::block,
rounds: uint,
@@ -36,8 +43,8 @@ export type ct64_block = struct {
// Creates a constant time, 64-bit optimised aes [[crypto::cipher::block]].
export fn ct64(key: []u8) ct64_block = {
let state = ct64_block {
- sz = 16z,
- nparallel = 4z,
+ sz = BLOCKSIZE,
+ nparallel = CT64_NPARALLEL,
encrypt = &aes_ct64_encrypt,
decrypt = &aes_ct64_decrypt,
...
diff --git a/crypto/aes/ctr+test.ha b/crypto/aes/ctr+test.ha
@@ -0,0 +1,229 @@
+use crypto::cipher;
+use bytes;
+
+@test fn ctr_encrypt_zero_iv() void = {
+ const key: [_]u8 = [
+ 0xc3, 0x43, 0x2a, 0xf7, 0xcf, 0x56, 0x72, 0xad,
+ 0x0f, 0x4d, 0xab, 0xee, 0xf5, 0x32, 0x0e, 0x33,
+ ];
+
+ const iv: [_]u8 = [
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ ];
+
+ const plain: [_]u8 = [
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ ];
+
+ const cipher: [_]u8 = [
+ 0xda, 0xe1, 0x45, 0xd6, 0xe8, 0x6a, 0xc0, 0x4b,
+ 0xb8, 0x68, 0xf0, 0xdb, 0xcd, 0x8a, 0x22, 0x80,
+ ];
+
+ let result: [16]u8 = [0...];
+ let buf: [CTR_BUFSIZE]u8 = [0...];
+
+ let b = ct64(key);
+ let ctr = cipher::ctr(&b, iv[..], buf[..]);
+
+ cipher::stream_xor(&ctr, result, plain);
+ assert(bytes::equal(cipher, result));
+};
+
+@test fn ctr_encrypt_max_iv() void = {
+ const key: [_]u8 = [
+ 0xc3, 0x43, 0x2a, 0xf7, 0xcf, 0x56, 0x72, 0xad,
+ 0x0f, 0x4d, 0xab, 0xee, 0xf5, 0x32, 0x0e, 0x33,
+ ];
+
+ const iv: [_]u8 = [
+ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+ ];
+
+ const plain: [_]u8 = [
+ 0x1f, 0x03, 0x62, 0xb4, 0xb6, 0xd3, 0xc9, 0xc1,
+ 0xfa, 0x12, 0xa1, 0x1f, 0xa5, 0x6a, 0xbe, 0x46,
+ 0x85, 0xea,
+ ];
+
+ const cipher: [_]u8 = [
+ 0x3d, 0x31, 0x42, 0x04, 0xf5, 0x1d, 0x04, 0x4c,
+ 0x3e, 0xb1, 0xa5, 0xf8, 0x18, 0x79, 0x87, 0x41,
+ 0x5f, 0x0b,
+ ];
+
+ let result: [18]u8 = [0...];
+ let buf: [CTR_BUFSIZE]u8 = [0...];
+
+ let b = ct64(key);
+ let ctr = cipher::ctr(&b, iv[..], buf[..]);
+
+ cipher::stream_xor(&ctr, result, plain);
+ assert(bytes::equal(cipher, result));
+};
+
+@test fn ctr_test_multiple_blocks() void = {
+ const key: [_]u8 = [
+ 0xae, 0x0c, 0x47, 0x6d, 0xce, 0x69, 0xdf, 0x52,
+ 0xf7, 0x5e, 0x1f, 0x16, 0x7e, 0xea, 0x1c, 0xf0,
+ ];
+
+ const iv: [_]u8 = [
+ 0x9a, 0x11, 0xd7, 0x24, 0x43, 0x86, 0x50, 0xf0,
+ 0xd9, 0x8c, 0x0d, 0x0d, 0x7a, 0x2e, 0x95, 0x72,
+ ];
+
+ const plain: [_]u8 = [
+ 0x05, 0xc8, 0x4a, 0xf7, 0xba, 0x4b, 0xc2, 0x4f,
+ 0xd3, 0x63, 0xf3, 0x20, 0x51, 0x2b, 0x65, 0xec,
+ 0x4c, 0xe7, 0x7f, 0x78, 0x17, 0x45, 0x0c, 0x6e,
+ 0xff, 0xf1, 0x73, 0x97, 0x42, 0x4d, 0x4a, 0x30,
+ 0x5d, 0xb2, 0x79, 0x45, 0xca, 0x20, 0x10, 0x5b,
+ 0x2c, 0x34, 0x4c, 0xed, 0x42, 0x59, 0x61, 0x3a,
+ 0x66, 0xa3, 0x2e, 0x74, 0xa8, 0xbb, 0x9c, 0xe9,
+ 0x4e, 0xda, 0x33, 0x97, 0x98, 0x41, 0x9a, 0xf0,
+ 0xbb, 0x6d, 0xcb, 0x5d, 0x15, 0x60, 0x26, 0x7c,
+ 0x6c, 0xe5, 0xa4, 0xaf, 0x52, 0x14, 0x29, 0x2f,
+ ];
+
+ const cipher: [_]u8 = [
+ 0xc1, 0xe5, 0x15, 0x76, 0x5b, 0xb2, 0x3a, 0xbc,
+ 0xc4, 0x71, 0xdf, 0xcc, 0x20, 0xe0, 0x63, 0xd6,
+ 0xb3, 0x7d, 0x48, 0x51, 0xe0, 0xd1, 0xcb, 0x07,
+ 0xa3, 0xc8, 0xc6, 0xb9, 0x43, 0xa9, 0x1e, 0x70,
+ 0xb2, 0x1e, 0xbe, 0xc3, 0x11, 0x36, 0xb2, 0x64,
+ 0x7c, 0xaf, 0x89, 0x46, 0x17, 0x60, 0x90, 0x19,
+ 0x23, 0x53, 0xd1, 0xce, 0xc6, 0x5c, 0x50, 0x9c,
+ 0x8c, 0x1d, 0xa8, 0xee, 0x44, 0x9c, 0xa2, 0xb2,
+ 0x97, 0x62, 0x39, 0xcc, 0x91, 0xb0, 0xcc, 0x2c,
+ 0x1b, 0x4c, 0xc3, 0x5d, 0xc3, 0xfa, 0xe9, 0x98,
+ ];
+
+ let result: [80]u8 = [0...];
+ let buf: [CTR_BUFSIZE]u8 = [0...];
+
+ let b = ct64(key);
+ let ctr = cipher::ctr(&b, iv[..], buf[..]);
+
+ cipher::stream_xor(&ctr, result, plain);
+ assert(bytes::equal(cipher, result));
+};
+
+@test fn ctr_test_multiple_calls() void = {
+ const key: [_]u8 = [
+ 0xae, 0x0c, 0x47, 0x6d, 0xce, 0x69, 0xdf, 0x52,
+ 0xf7, 0x5e, 0x1f, 0x16, 0x7e, 0xea, 0x1c, 0xf0,
+ ];
+
+ const iv: [_]u8 = [
+ 0x9a, 0x11, 0xd7, 0x24, 0x43, 0x86, 0x50, 0xf0,
+ 0xd9, 0x8c, 0x0d, 0x0d, 0x7a, 0x2e, 0x95, 0x72,
+ ];
+
+ const plain: [_]u8 = [
+ 0x05, 0xc8, 0x4a, 0xf7, 0xba, 0x4b, 0xc2, 0x4f,
+ 0xd3, 0x63, 0xf3, 0x20, 0x51, 0x2b, 0x65, 0xec,
+ 0x4c, 0xe7, 0x7f, 0x78, 0x17, 0x45, 0x0c, 0x6e,
+ 0xff, 0xf1, 0x73, 0x97, 0x42, 0x4d, 0x4a, 0x30,
+ 0x5d, 0xb2, 0x79, 0x45, 0xca, 0x20, 0x10, 0x5b,
+ 0x2c, 0x34, 0x4c, 0xed, 0x42, 0x59, 0x61, 0x3a,
+ 0x66, 0xa3, 0x2e, 0x74, 0xa8, 0xbb, 0x9c, 0xe9,
+ 0x4e, 0xda, 0x33, 0x97, 0x98, 0x41, 0x9a, 0xf0,
+ 0xbb, 0x6d, 0xcb, 0x5d, 0x15, 0x60, 0x26, 0x7c,
+ 0x6c, 0xe5, 0xa4, 0xaf, 0x52, 0x14, 0x29, 0x2f,
+ ];
+
+ const cipher: [_]u8 = [
+ 0xc1, 0xe5, 0x15, 0x76, 0x5b, 0xb2, 0x3a, 0xbc,
+ 0xc4, 0x71, 0xdf, 0xcc, 0x20, 0xe0, 0x63, 0xd6,
+ 0xb3, 0x7d, 0x48, 0x51, 0xe0, 0xd1, 0xcb, 0x07,
+ 0xa3, 0xc8, 0xc6, 0xb9, 0x43, 0xa9, 0x1e, 0x70,
+ 0xb2, 0x1e, 0xbe, 0xc3, 0x11, 0x36, 0xb2, 0x64,
+ 0x7c, 0xaf, 0x89, 0x46, 0x17, 0x60, 0x90, 0x19,
+ 0x23, 0x53, 0xd1, 0xce, 0xc6, 0x5c, 0x50, 0x9c,
+ 0x8c, 0x1d, 0xa8, 0xee, 0x44, 0x9c, 0xa2, 0xb2,
+ 0x97, 0x62, 0x39, 0xcc, 0x91, 0xb0, 0xcc, 0x2c,
+ 0x1b, 0x4c, 0xc3, 0x5d, 0xc3, 0xfa, 0xe9, 0x98,
+ ];
+
+ let result: [80]u8 = [0...];
+ let buf: [CTR_BUFSIZE]u8 = [0...];
+
+ let b = ct64(key);
+
+ let ctr = cipher::ctr(&b, iv[..], buf[..]);
+ cipher::stream_xor(&ctr, result[0..32], plain[0..32]);
+ cipher::stream_xor(&ctr, result[32..], plain[32..]);
+ assert(bytes::equal(cipher, result));
+
+ // test nparallel blocks
+ ctr = cipher::ctr(&b, iv[..], buf[..]);
+ cipher::stream_xor(&ctr, result[0..64], plain[0..64]);
+ cipher::stream_xor(&ctr, result[64..], plain[64..]);
+ assert(bytes::equal(cipher, result));
+};
+
+@test fn ctr_encrypt_in_place() void = {
+ const key: [_]u8 = [
+ 0x3f, 0xf8, 0x68, 0x06, 0xe4, 0xcc, 0x88, 0x11,
+ 0xa6, 0xba, 0x14, 0xb6, 0x0b, 0x4c, 0x5a, 0xef,
+ ];
+
+ const iv: [_]u8 = [
+ 0xc5, 0x4c, 0x99, 0xd2, 0xd0, 0xef, 0xf5, 0xde,
+ 0x95, 0x38, 0x45, 0x34, 0xeb, 0xa2, 0xad, 0xa0,
+ ];
+
+ let result: [_]u8 = [
+ 0x65, 0x60, 0x3b, 0x9a, 0x07, 0x56, 0xb1, 0x96,
+ 0x3b, 0xd8, 0x8d, 0x84, 0x20, 0x29, 0xec, 0x7f,
+ 0xa6, 0xe9, 0xf8, 0xdf, 0xa3, 0x37, 0xf3, 0x8f,
+ ];
+
+ const cipher: [_]u8 = [
+ 0x14, 0xfd, 0x4b, 0x5b, 0x4a, 0x11, 0xd3, 0xdf,
+ 0x6e, 0x02, 0x61, 0x09, 0x64, 0x1f, 0xa1, 0x86,
+ 0xb1, 0xa6, 0xd9, 0x40, 0xaf, 0x1b, 0x02, 0xe1,
+ ];
+
+ let b = ct64(key);
+ let buf: [CTR_BUFSIZE]u8 = [0...];
+ let ctr = cipher::ctr(&b, iv[..], buf[..]);
+
+ cipher::stream_xor(&ctr, result, result);
+ assert(bytes::equal(cipher, result));
+};
+
+@test fn ctr_encrypt_smaller_buf() void = {
+ const key: [_]u8 = [
+ 0x3f, 0xf8, 0x68, 0x06, 0xe4, 0xcc, 0x88, 0x11,
+ 0xa6, 0xba, 0x14, 0xb6, 0x0b, 0x4c, 0x5a, 0xef,
+ ];
+
+ const iv: [_]u8 = [
+ 0xc5, 0x4c, 0x99, 0xd2, 0xd0, 0xef, 0xf5, 0xde,
+ 0x95, 0x38, 0x45, 0x34, 0xeb, 0xa2, 0xad, 0xa0,
+ ];
+
+ let result: [_]u8 = [
+ 0x65, 0x60, 0x3b, 0x9a, 0x07, 0x56, 0xb1, 0x96,
+ 0x3b, 0xd8, 0x8d, 0x84, 0x20, 0x29, 0xec, 0x7f,
+ 0xa6, 0xe9, 0xf8, 0xdf, 0xa3, 0x37, 0xf3, 0x8f,
+ ];
+
+ const cipher: [_]u8 = [
+ 0x14, 0xfd, 0x4b, 0x5b, 0x4a, 0x11, 0xd3, 0xdf,
+ 0x6e, 0x02, 0x61, 0x09, 0x64, 0x1f, 0xa1, 0x86,
+ 0xb1, 0xa6, 0xd9, 0x40, 0xaf, 0x1b, 0x02, 0xe1,
+ ];
+
+ let b = ct64(key);
+ let buf: [64]u8 = [0...];
+ let ctr = cipher::ctr(&b, iv[..], buf[..]);
+
+ cipher::stream_xor(&ctr, result, result);
+ assert(bytes::equal(cipher, result));
+};
diff --git a/crypto/cipher/ctr.ha b/crypto/cipher/ctr.ha
@@ -0,0 +1,85 @@
+use crypto::math;
+
+export type ctr_stream = struct {
+ stream,
+ b: *block,
+ counter: []u8,
+ xorbuf: []u8,
+ xorused: size,
+};
+
+// Creates a ctr [[stream]] on top of given block cipher. The caller must
+// provide the initiation vector and a buffer for the state. The size of
+// the buffer depends on the block cipher. Use [[crypto::aes::CTR_BUFSIZE]]
+// for the stdlib AES implementation.
+export fn ctr(b: *block, iv: []u8, buf: []u8) ctr_stream = {
+ assert(len(iv) == sz(b), "iv is of invalid block size");
+ assert(len(buf) >= sz(b) * 2, "buf must be at least 2 * blocksize");
+
+ let bsz = sz(b);
+
+ // one buf block is used for the counter
+ let counter = buf[0..bsz];
+
+ // the remaining space is used to store the key stream. It needs
+ // to be at least the size of one block and ideally the size of
+ // nparallel(b) times the block size. A bigger buffer than the latter
+ // option is of no use.
+ let xorbuf = buf[bsz..];
+
+ counter[..] = iv[..];
+
+ // cap the buffer to a multiple of bsz.
+ let maxxorbufsz = sz(b) * nparallel(b);
+ let xorbufsz = len(xorbuf);
+ if (xorbufsz < maxxorbufsz) {
+ xorbufsz = xorbufsz - xorbufsz % sz(b);
+ } else {
+ xorbufsz = maxxorbufsz;
+ };
+
+ return ctr_stream {
+ xor = &ctr_stream_xor,
+ b = b,
+ counter = counter,
+ xorbuf = xorbuf,
+ // mark all as used to force fill xorbuf
+ xorused = xorbufsz,
+ };
+};
+
+fn ctr_stream_xor(s: *stream, dest: []u8, src: []u8) void = {
+ let ctr = s: *ctr_stream;
+ let bsz = sz(ctr.b);
+ let nparallel = nparallel(ctr.b);
+ let i = 0z;
+
+ for (true) {
+ for (ctr.xorused < len(ctr.xorbuf)) {
+ dest[i] = src[i] ^ ctr.xorbuf[ctr.xorused];
+ ctr.xorused += 1;
+ i += 1;
+ if (i >= len(dest)) {
+ return;
+ };
+ };
+ fill_xorbuf(ctr);
+ };
+};
+
+fn fill_xorbuf(ctr: *ctr_stream) void = {
+ let bsz = sz(ctr.b);
+ for (let i = 0z; i < len(ctr.xorbuf) / bsz; i += 1) {
+ ctr.xorbuf[i * bsz..(i * bsz + bsz)] = ctr.counter[0..bsz];
+
+ for (let j = len(ctr.counter); j > 0; j -= 1) {
+ ctr.counter[j - 1] += 1;
+ if (ctr.counter[j - 1] != 0) {
+ break;
+ };
+ };
+ };
+
+ encrypt(ctr.b, ctr.xorbuf, ctr.xorbuf);
+ ctr.xorused = 0;
+};
diff --git a/scripts/gen-stdlib b/scripts/gen-stdlib
@@ -201,7 +201,7 @@ crypto_aes() {
gensrcs_crypto_aes
gen_ssa crypto::aes crypto::cipher crypto::math endian
else
- gensrcs_crypto_aes ct64+test.ha cbc+test.ha
+ gensrcs_crypto_aes ct64+test.ha cbc+test.ha ctr+test.ha
gen_ssa crypto::aes bytes crypto::cipher crypto::math endian
fi
}
@@ -227,7 +227,8 @@ crypto_cipher() {
gen_srcs crypto::cipher \
cipher.ha \
stream.ha \
- cbc.ha
+ cbc.ha \
+ ctr.ha
gen_ssa crypto::cipher bytes crypto::math
}
diff --git a/stdlib.mk b/stdlib.mk
@@ -681,7 +681,8 @@ $(HARECACHE)/crypto/blake2b/crypto_blake2b-any.ssa: $(stdlib_crypto_blake2b_any_
stdlib_crypto_cipher_any_srcs= \
$(STDLIB)/crypto/cipher/cipher.ha \
$(STDLIB)/crypto/cipher/stream.ha \
- $(STDLIB)/crypto/cipher/cbc.ha
+ $(STDLIB)/crypto/cipher/cbc.ha \
+ $(STDLIB)/crypto/cipher/ctr.ha
$(HARECACHE)/crypto/cipher/crypto_cipher-any.ssa: $(stdlib_crypto_cipher_any_srcs) $(stdlib_rt) $(stdlib_bytes_$(PLATFORM)) $(stdlib_crypto_math_$(PLATFORM))
@printf 'HAREC \t$@\n'
@@ -2380,7 +2381,8 @@ $(TESTCACHE)/compress/zlib/compress_zlib-any.ssa: $(testlib_compress_zlib_any_sr
testlib_crypto_aes_any_srcs= \
$(STDLIB)/crypto/aes/aes_ct64.ha \
$(STDLIB)/crypto/aes/ct64+test.ha \
- $(STDLIB)/crypto/aes/cbc+test.ha
+ $(STDLIB)/crypto/aes/cbc+test.ha \
+ $(STDLIB)/crypto/aes/ctr+test.ha
$(TESTCACHE)/crypto/aes/crypto_aes-any.ssa: $(testlib_crypto_aes_any_srcs) $(testlib_rt) $(testlib_bytes_$(PLATFORM)) $(testlib_crypto_cipher_$(PLATFORM)) $(testlib_crypto_math_$(PLATFORM)) $(testlib_endian_$(PLATFORM))
@printf 'HAREC \t$@\n'
@@ -2404,7 +2406,8 @@ $(TESTCACHE)/crypto/blake2b/crypto_blake2b-any.ssa: $(testlib_crypto_blake2b_any
testlib_crypto_cipher_any_srcs= \
$(STDLIB)/crypto/cipher/cipher.ha \
$(STDLIB)/crypto/cipher/stream.ha \
- $(STDLIB)/crypto/cipher/cbc.ha
+ $(STDLIB)/crypto/cipher/cbc.ha \
+ $(STDLIB)/crypto/cipher/ctr.ha
$(TESTCACHE)/crypto/cipher/crypto_cipher-any.ssa: $(testlib_crypto_cipher_any_srcs) $(testlib_rt) $(testlib_bytes_$(PLATFORM)) $(testlib_crypto_math_$(PLATFORM))
@printf 'HAREC \t$@\n'
