/src/botan/src/lib/modes/aead/siv/siv.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * SIV Mode Encryption |
3 | | * (C) 2013,2017 Jack Lloyd |
4 | | * (C) 2016 Daniel Neus, Rohde & Schwarz Cybersecurity |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #include <botan/siv.h> |
10 | | #include <botan/block_cipher.h> |
11 | | #include <botan/cmac.h> |
12 | | #include <botan/internal/poly_dbl.h> |
13 | | #include <botan/ctr.h> |
14 | | |
15 | | namespace Botan { |
16 | | |
17 | | SIV_Mode::SIV_Mode(BlockCipher* cipher) : |
18 | | m_name(cipher->name() + "/SIV"), |
19 | | m_ctr(new CTR_BE(cipher->clone(), 8)), |
20 | | m_mac(new CMAC(cipher)), |
21 | | m_bs(cipher->block_size()) |
22 | 0 | { |
23 | 0 | // Not really true but only 128 bit allowed at the moment |
24 | 0 | if(m_bs != 16) |
25 | 0 | throw Invalid_Argument("SIV requires a 128 bit block cipher"); |
26 | 0 | } |
27 | | |
28 | | SIV_Mode::~SIV_Mode() |
29 | 0 | { |
30 | 0 | // for ~unique_ptr |
31 | 0 | } |
32 | | |
33 | | void SIV_Mode::clear() |
34 | 0 | { |
35 | 0 | m_ctr->clear(); |
36 | 0 | m_mac->clear(); |
37 | 0 | reset(); |
38 | 0 | } |
39 | | |
40 | | void SIV_Mode::reset() |
41 | 0 | { |
42 | 0 | m_nonce.clear(); |
43 | 0 | m_msg_buf.clear(); |
44 | 0 | m_ad_macs.clear(); |
45 | 0 | } |
46 | | |
47 | | std::string SIV_Mode::name() const |
48 | 0 | { |
49 | 0 | return m_name; |
50 | 0 | } |
51 | | |
52 | | bool SIV_Mode::valid_nonce_length(size_t) const |
53 | 0 | { |
54 | 0 | return true; |
55 | 0 | } |
56 | | |
57 | | size_t SIV_Mode::update_granularity() const |
58 | 0 | { |
59 | 0 | /* |
60 | 0 | This value does not particularly matter as regardless SIV_Mode::update |
61 | 0 | buffers all input, so in theory this could be 1. However as for instance |
62 | 0 | Transform_Filter creates update_granularity() uint8_t buffers, use a |
63 | 0 | somewhat large size to avoid bouncing on a tiny buffer. |
64 | 0 | */ |
65 | 0 | return 128; |
66 | 0 | } |
67 | | |
68 | | Key_Length_Specification SIV_Mode::key_spec() const |
69 | 0 | { |
70 | 0 | return m_mac->key_spec().multiple(2); |
71 | 0 | } |
72 | | |
73 | | void SIV_Mode::key_schedule(const uint8_t key[], size_t length) |
74 | 0 | { |
75 | 0 | const size_t keylen = length / 2; |
76 | 0 | m_mac->set_key(key, keylen); |
77 | 0 | m_ctr->set_key(key + keylen, keylen); |
78 | 0 | m_ad_macs.clear(); |
79 | 0 | } |
80 | | |
81 | | void SIV_Mode::set_associated_data_n(size_t n, const uint8_t ad[], size_t length) |
82 | 0 | { |
83 | 0 | const size_t max_ads = block_size() * 8 - 2; |
84 | 0 | if(n > max_ads) |
85 | 0 | throw Invalid_Argument(name() + " allows no more than " + std::to_string(max_ads) + " ADs"); |
86 | 0 | |
87 | 0 | if(n >= m_ad_macs.size()) |
88 | 0 | m_ad_macs.resize(n+1); |
89 | 0 |
|
90 | 0 | m_ad_macs[n] = m_mac->process(ad, length); |
91 | 0 | } |
92 | | |
93 | | void SIV_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) |
94 | 0 | { |
95 | 0 | if(!valid_nonce_length(nonce_len)) |
96 | 0 | throw Invalid_IV_Length(name(), nonce_len); |
97 | 0 | |
98 | 0 | if(nonce_len) |
99 | 0 | m_nonce = m_mac->process(nonce, nonce_len); |
100 | 0 | else |
101 | 0 | m_nonce.clear(); |
102 | 0 |
|
103 | 0 | m_msg_buf.clear(); |
104 | 0 | } |
105 | | |
106 | | size_t SIV_Mode::process(uint8_t buf[], size_t sz) |
107 | 0 | { |
108 | 0 | // all output is saved for processing in finish |
109 | 0 | m_msg_buf.insert(m_msg_buf.end(), buf, buf + sz); |
110 | 0 | return 0; |
111 | 0 | } |
112 | | |
113 | | secure_vector<uint8_t> SIV_Mode::S2V(const uint8_t* text, size_t text_len) |
114 | 0 | { |
115 | 0 | const std::vector<uint8_t> zeros(block_size()); |
116 | 0 |
|
117 | 0 | secure_vector<uint8_t> V = m_mac->process(zeros.data(), zeros.size()); |
118 | 0 |
|
119 | 0 | for(size_t i = 0; i != m_ad_macs.size(); ++i) |
120 | 0 | { |
121 | 0 | poly_double_n(V.data(), V.size()); |
122 | 0 | V ^= m_ad_macs[i]; |
123 | 0 | } |
124 | 0 |
|
125 | 0 | if(m_nonce.size()) |
126 | 0 | { |
127 | 0 | poly_double_n(V.data(), V.size()); |
128 | 0 | V ^= m_nonce; |
129 | 0 | } |
130 | 0 |
|
131 | 0 | if(text_len < block_size()) |
132 | 0 | { |
133 | 0 | poly_double_n(V.data(), V.size()); |
134 | 0 | xor_buf(V.data(), text, text_len); |
135 | 0 | V[text_len] ^= 0x80; |
136 | 0 | return m_mac->process(V); |
137 | 0 | } |
138 | 0 | |
139 | 0 | m_mac->update(text, text_len - block_size()); |
140 | 0 | xor_buf(V.data(), &text[text_len - block_size()], block_size()); |
141 | 0 | m_mac->update(V); |
142 | 0 |
|
143 | 0 | return m_mac->final(); |
144 | 0 | } |
145 | | |
146 | | void SIV_Mode::set_ctr_iv(secure_vector<uint8_t> V) |
147 | 0 | { |
148 | 0 | V[m_bs-8] &= 0x7F; |
149 | 0 | V[m_bs-4] &= 0x7F; |
150 | 0 |
|
151 | 0 | ctr().set_iv(V.data(), V.size()); |
152 | 0 | } |
153 | | |
154 | | void SIV_Encryption::finish(secure_vector<uint8_t>& buffer, size_t offset) |
155 | 0 | { |
156 | 0 | BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane"); |
157 | 0 |
|
158 | 0 | buffer.insert(buffer.begin() + offset, msg_buf().begin(), msg_buf().end()); |
159 | 0 | msg_buf().clear(); |
160 | 0 |
|
161 | 0 | const secure_vector<uint8_t> V = S2V(buffer.data() + offset, buffer.size() - offset); |
162 | 0 |
|
163 | 0 | buffer.insert(buffer.begin() + offset, V.begin(), V.end()); |
164 | 0 |
|
165 | 0 | if(buffer.size() != offset + V.size()) |
166 | 0 | { |
167 | 0 | set_ctr_iv(V); |
168 | 0 | ctr().cipher1(&buffer[offset + V.size()], buffer.size() - offset - V.size()); |
169 | 0 | } |
170 | 0 | } |
171 | | |
172 | | void SIV_Decryption::finish(secure_vector<uint8_t>& buffer, size_t offset) |
173 | 0 | { |
174 | 0 | BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane"); |
175 | 0 |
|
176 | 0 | if(msg_buf().size() > 0) |
177 | 0 | { |
178 | 0 | buffer.insert(buffer.begin() + offset, msg_buf().begin(), msg_buf().end()); |
179 | 0 | msg_buf().clear(); |
180 | 0 | } |
181 | 0 |
|
182 | 0 | const size_t sz = buffer.size() - offset; |
183 | 0 |
|
184 | 0 | BOTAN_ASSERT(sz >= tag_size(), "We have the tag"); |
185 | 0 |
|
186 | 0 | secure_vector<uint8_t> V(buffer.data() + offset, |
187 | 0 | buffer.data() + offset + block_size()); |
188 | 0 |
|
189 | 0 | if(buffer.size() != offset + V.size()) |
190 | 0 | { |
191 | 0 | set_ctr_iv(V); |
192 | 0 |
|
193 | 0 | ctr().cipher(buffer.data() + offset + V.size(), |
194 | 0 | buffer.data() + offset, |
195 | 0 | buffer.size() - offset - V.size()); |
196 | 0 | } |
197 | 0 |
|
198 | 0 | const secure_vector<uint8_t> T = S2V(buffer.data() + offset, buffer.size() - offset - V.size()); |
199 | 0 |
|
200 | 0 | if(!constant_time_compare(T.data(), V.data(), T.size())) |
201 | 0 | throw Invalid_Authentication_Tag("SIV tag check failed"); |
202 | 0 | |
203 | 0 | buffer.resize(buffer.size() - tag_size()); |
204 | 0 | } |
205 | | |
206 | | } |