/src/botan/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * ChaCha20Poly1305 AEAD |
3 | | * (C) 2014,2016,2018 Jack Lloyd |
4 | | * (C) 2016 Daniel Neus, Rohde & Schwarz Cybersecurity |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #include <botan/chacha20poly1305.h> |
10 | | #include <botan/loadstor.h> |
11 | | |
12 | | namespace Botan { |
13 | | |
14 | | ChaCha20Poly1305_Mode::ChaCha20Poly1305_Mode() : |
15 | | m_chacha(StreamCipher::create("ChaCha")), |
16 | | m_poly1305(MessageAuthenticationCode::create("Poly1305")) |
17 | 170 | { |
18 | 170 | if(!m_chacha || !m_poly1305) |
19 | 0 | throw Algorithm_Not_Found("ChaCha20Poly1305"); |
20 | 170 | } |
21 | | |
22 | | bool ChaCha20Poly1305_Mode::valid_nonce_length(size_t n) const |
23 | 230 | { |
24 | 230 | return (n == 8 || n == 12 || n == 24); |
25 | 230 | } |
26 | | |
27 | | void ChaCha20Poly1305_Mode::clear() |
28 | 0 | { |
29 | 0 | m_chacha->clear(); |
30 | 0 | m_poly1305->clear(); |
31 | 0 | reset(); |
32 | 0 | } |
33 | | |
34 | | void ChaCha20Poly1305_Mode::reset() |
35 | 0 | { |
36 | 0 | m_ad.clear(); |
37 | 0 | m_ctext_len = 0; |
38 | 0 | m_nonce_len = 0; |
39 | 0 | } |
40 | | |
41 | | void ChaCha20Poly1305_Mode::key_schedule(const uint8_t key[], size_t length) |
42 | 170 | { |
43 | 170 | m_chacha->set_key(key, length); |
44 | 170 | } |
45 | | |
46 | | void ChaCha20Poly1305_Mode::set_associated_data(const uint8_t ad[], size_t length) |
47 | 230 | { |
48 | 230 | if(m_ctext_len > 0 || m_nonce_len > 0) |
49 | 0 | throw Invalid_State("Cannot set AD for ChaCha20Poly1305 while processing a message"); |
50 | 230 | m_ad.assign(ad, ad + length); |
51 | 230 | } |
52 | | |
53 | | void ChaCha20Poly1305_Mode::update_len(size_t len) |
54 | 460 | { |
55 | 460 | uint8_t len8[8] = { 0 }; |
56 | 460 | store_le(static_cast<uint64_t>(len), len8); |
57 | 460 | m_poly1305->update(len8, 8); |
58 | 460 | } |
59 | | |
60 | | void ChaCha20Poly1305_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) |
61 | 230 | { |
62 | 230 | if(!valid_nonce_length(nonce_len)) |
63 | 0 | throw Invalid_IV_Length(name(), nonce_len); |
64 | 230 | |
65 | 230 | m_ctext_len = 0; |
66 | 230 | m_nonce_len = nonce_len; |
67 | 230 | |
68 | 230 | m_chacha->set_iv(nonce, nonce_len); |
69 | 230 | |
70 | 230 | uint8_t first_block[64]; |
71 | 230 | m_chacha->write_keystream(first_block, sizeof(first_block)); |
72 | 230 | |
73 | 230 | m_poly1305->set_key(first_block, 32); |
74 | | // Remainder of first block is discarded |
75 | 230 | secure_scrub_memory(first_block, sizeof(first_block)); |
76 | 230 | |
77 | 230 | m_poly1305->update(m_ad); |
78 | 230 | |
79 | 230 | if(cfrg_version()) |
80 | 230 | { |
81 | 230 | if(m_ad.size() % 16) |
82 | 230 | { |
83 | 230 | const uint8_t zeros[16] = { 0 }; |
84 | 230 | m_poly1305->update(zeros, 16 - m_ad.size() % 16); |
85 | 230 | } |
86 | 230 | } |
87 | 0 | else |
88 | 0 | { |
89 | 0 | update_len(m_ad.size()); |
90 | 0 | } |
91 | 230 | } |
92 | | |
93 | | size_t ChaCha20Poly1305_Encryption::process(uint8_t buf[], size_t sz) |
94 | 165 | { |
95 | 165 | m_chacha->cipher1(buf, sz); |
96 | 165 | m_poly1305->update(buf, sz); // poly1305 of ciphertext |
97 | 165 | m_ctext_len += sz; |
98 | 165 | return sz; |
99 | 165 | } |
100 | | |
101 | | void ChaCha20Poly1305_Encryption::finish(secure_vector<uint8_t>& buffer, size_t offset) |
102 | 165 | { |
103 | 165 | update(buffer, offset); |
104 | 165 | if(cfrg_version()) |
105 | 165 | { |
106 | 165 | if(m_ctext_len % 16) |
107 | 77 | { |
108 | 77 | const uint8_t zeros[16] = { 0 }; |
109 | 77 | m_poly1305->update(zeros, 16 - m_ctext_len % 16); |
110 | 77 | } |
111 | 165 | update_len(m_ad.size()); |
112 | 165 | } |
113 | 165 | update_len(m_ctext_len); |
114 | 165 | |
115 | 165 | buffer.resize(buffer.size() + tag_size()); |
116 | 165 | m_poly1305->final(&buffer[buffer.size() - tag_size()]); |
117 | 165 | m_ctext_len = 0; |
118 | 165 | m_nonce_len = 0; |
119 | 165 | } |
120 | | |
121 | | size_t ChaCha20Poly1305_Decryption::process(uint8_t buf[], size_t sz) |
122 | 0 | { |
123 | 0 | m_poly1305->update(buf, sz); // poly1305 of ciphertext |
124 | 0 | m_chacha->cipher1(buf, sz); |
125 | 0 | m_ctext_len += sz; |
126 | 0 | return sz; |
127 | 0 | } |
128 | | |
129 | | void ChaCha20Poly1305_Decryption::finish(secure_vector<uint8_t>& buffer, size_t offset) |
130 | 65 | { |
131 | 65 | BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane"); |
132 | 65 | const size_t sz = buffer.size() - offset; |
133 | 65 | uint8_t* buf = buffer.data() + offset; |
134 | 65 | |
135 | 65 | BOTAN_ASSERT(sz >= tag_size(), "Have the tag as part of final input"); |
136 | 65 | |
137 | 65 | const size_t remaining = sz - tag_size(); |
138 | 65 | |
139 | 65 | if(remaining) |
140 | 64 | { |
141 | 64 | m_poly1305->update(buf, remaining); // poly1305 of ciphertext |
142 | 64 | m_chacha->cipher1(buf, remaining); |
143 | 64 | m_ctext_len += remaining; |
144 | 64 | } |
145 | 65 | |
146 | 65 | if(cfrg_version()) |
147 | 65 | { |
148 | 65 | if(m_ctext_len % 16) |
149 | 49 | { |
150 | 49 | const uint8_t zeros[16] = { 0 }; |
151 | 49 | m_poly1305->update(zeros, 16 - m_ctext_len % 16); |
152 | 49 | } |
153 | 65 | update_len(m_ad.size()); |
154 | 65 | } |
155 | 65 | |
156 | 65 | update_len(m_ctext_len); |
157 | 65 | |
158 | 65 | uint8_t mac[16]; |
159 | 65 | m_poly1305->final(mac); |
160 | 65 | |
161 | 65 | const uint8_t* included_tag = &buf[remaining]; |
162 | 65 | |
163 | 65 | m_ctext_len = 0; |
164 | 65 | m_nonce_len = 0; |
165 | 65 | |
166 | 65 | if(!constant_time_compare(mac, included_tag, tag_size())) |
167 | 65 | throw Invalid_Authentication_Tag("ChaCha20Poly1305 tag check failed"); |
168 | 0 | buffer.resize(offset + remaining); |
169 | 0 | } |
170 | | |
171 | | } |