diff --git a/demos/timing.c b/demos/timing.c index e180b0d27..927ad4385 100644 --- a/demos/timing.c +++ b/demos/timing.c @@ -1153,8 +1153,13 @@ static void time_macs(void) static void time_encmacs_(unsigned long MAC_SIZE) { -#if defined(LTC_EAX_MODE) || defined(LTC_OCB_MODE) || defined(LTC_OCB3_MODE) || defined(LTC_CCM_MODE) || defined(LTC_GCM_MODE) - unsigned char *buf, IV[16], key[16], tag[16]; +#if defined(LTC_EAX_MODE) || defined(LTC_OCB_MODE) || defined(LTC_OCB3_MODE) || \ + defined(LTC_CCM_MODE) || defined(LTC_GCM_MODE) || defined(LTC_SIV_MODE) +#if defined(LTC_SIV_MODE) + unsigned char *aad[4]; + unsigned long buflen; +#endif + unsigned char *buf, IV[16], key[32], tag[16]; ulong64 t1, t2; unsigned long x, z; int err, cipher_idx; @@ -1171,8 +1176,8 @@ static void time_encmacs_(unsigned long MAC_SIZE) cipher_idx = find_cipher("aes"); yarrow_read(buf, MAC_SIZE*1024, &yarrow_prng); - yarrow_read(key, 16, &yarrow_prng); - yarrow_read(IV, 16, &yarrow_prng); + yarrow_read(key, sizeof(key), &yarrow_prng); + yarrow_read(IV, sizeof(IV), &yarrow_prng); #ifdef LTC_EAX_MODE t2 = -1; @@ -1308,8 +1313,38 @@ __attribute__ ((aligned (16))) } fprintf(stderr, "GCM (precomp)\t\t%9"PRI64"u\n", t2/(ulong64)(MAC_SIZE*1024)); } +#endif +#ifdef LTC_SIV_MODE + for(z = 0; z < 4; z++) { + aad[z] = IV + z * 4; + } + for(z = 0; z < 4; z++) { + t2 = -1; + for (x = 0; x < 10000; x++) { + buflen = MAC_SIZE*1024; + t_start(); + t1 = t_read(); + if ((err = siv_memory(cipher_idx, LTC_ENCRYPT, + key, 32, + buf, MAC_SIZE*1024 - 16, + buf, &buflen, + aad[0], 16, + aad[1], 12, + aad[2], 8, + aad[3], 4, + NULL)) != CRYPT_OK) { + fprintf(stderr, "\nSIV error... %s\n", error_to_string(err)); + exit(EXIT_FAILURE); + } + t1 = t_read() - t1; + if (t1 < t2) t2 = t1; + } + aad[3-z] = NULL; + fprintf(stderr, "SIV (%lu x AAD)\t\t%9"PRI64"u\n", 4-z, t2/(ulong64)(MAC_SIZE*1024)); + } #endif + XFREE(buf); #else LTC_UNUSED_PARAM(MAC_SIZE); diff --git a/doc/crypt.tex b/doc/crypt.tex index ba31872a9..c1783653b 100644 --- a/doc/crypt.tex +++ b/doc/crypt.tex @@ -2576,6 +2576,160 @@ \subsection{One--Shot Packet} In order to enable OpenSSH compatibility, the flag \textit{CHACHA20POLY1305\_OPENSSH\_COMPAT} has to be \textbf{OR}'ed into the \textit{direction} parameter. + +\mysection{SIV} +\label{SIV} + +The SIV (Synthetic Initialization Vector) authenticated encryption is a block cipher mode of encryption +defined by \url{https://tools.ietf.org/html/rfc5297}. + +In contrast to all the other AEAD modes, SIV provides no iterative API. Instead it only provides one--shot APIs. + +AEAD algorithm design usually suggests using a separate Nonce (also called IV) and additional authenticated Data (AAD). +SIV treats this slightly different and does not enforce any of the two, but leaves it up to the user. +Also SIV allows passing multiple sets of data as AAD, up to a maximum of \texttt{126} elements. +In case one wants to use a Nonce in a classical style it is suggested to pass it as the last of the AAD elements, +thereby limiting the number of AAD to \texttt{125}. + +\subsection{Encryption / Decryption} +To encrypt and create a tag resp. decrypt and check the tag, the following API functions can be used. + +\index{siv\_encrypt()} +\begin{verbatim} +int siv_encrypt( int cipher, + const unsigned char *key, unsigned long keylen, + const unsigned char *ad[], unsigned long adlen[], + const unsigned char *pt, unsigned long ptlen, + unsigned char *ct, unsigned long *ctlen); +\end{verbatim} +This encrypts the data where \textit{pt} is the plaintext and \textit{ct} is the ciphertext. +The length of the plaintext is given in \textit{ptlen} and the length of the ciphertext is given in \textit{ctlen}. +\textit{ctlen} shall contain the max buffer size allocated at \textit{ct} on input, and will be updated with the +written length on successful encryption. + +\textit{ctlen} must be at least \texttt{16} octets larger that \textit{ptlen}. + +The key to the encrypt operation is passed in \textit{key} of length \textit{keylen}. + +The AAD is passed as array of pointers in \textit{ad}. The length of each AAD is passed as array of +\textit{unsigned long} in \textit{adlen}. +As soon as an array element of \textit{ad} is hit which equals \texttt{NULL} or an array element of \textit{adlen} +is hit which equals \texttt{0}, processing is stopped. +\index{siv\_decrypt()} +\begin{verbatim} +int siv_decrypt( int cipher, + const unsigned char *key, unsigned long keylen, + const unsigned char *ad[], unsigned long adlen[], + const unsigned char *ct, unsigned long ctlen, + unsigned char *pt, unsigned long *ptlen); +\end{verbatim} +This decrypts the data where \textit{in} is the ciphertext and \textit{out} is the plaintext. The length of both are +equal and stored in \textit{inlen}. + +The AAD is processed in the same way as in the encrypt function. + +An example of encryption and decryption with SIV using multiple AAD and a Nonce is given below. + +\begin{small} +\begin{verbatim} +#include + +int main(void) +{ + int err; + unsigned char plain[16] = {0}; + unsigned char ct[sizeof(plain) + 16] = {0}; + unsigned long plainlen = sizeof(plain), ctlen = sizeof(ct); + + register_cipher(&aes_desc); + + /* We need to cast the AAD strings because the API asks for an `unsigned char*` + * but a string is on most platforms defined as a "signed" `char*`. */ + if ((err = siv_encrypt(find_cipher("aes"), + ((unsigned char[32]) {0x0}), 32, + ((const unsigned char*[]) {(void*)"aad0", (void*)"aad1", + (void*)"NONCE", NULL}), + ((unsigned long[]) {4, 4, 5, 0}), + plain, plainlen, + ct, &ctlen)) != CRYPT_OK) { + whine_and_pout(err); + } + + if ((err = siv_decrypt(find_cipher("aes"), + ((unsigned char[32]) {0x0}), 32, + ((const unsigned char*[]) {(void*)"aad0", (void*)"aad1", + (void*)"NONCE", NULL}), + ((unsigned long[]) {4, 4, 5, 0}), + ct, ctlen, + plain, &plainlen)) != CRYPT_OK) { + whine_and_pout(err); + } + + return EXIT_SUCCESS; +} +\end{verbatim} +\end{small} + +\subsection{One--Shot Packet} +To process a single packet under any given key the following helper function can be used. + +\index{siv\_memory()} +\begin{verbatim} +int siv_memory( int cipher, int direction, + const unsigned char *key, unsigned long keylen, + const unsigned char *in, unsigned long inlen, + unsigned char *out, unsigned long *outlen, + ...); +\end{verbatim} + +This will execute a SIV operation of the \textit{direction} (\texttt{LTC\_ENCRYPT} resp. \texttt{LTC\_DECRYPT}) +using the \textit{cipher} with the \textit{key} of len \textit{keylen}. +The AAD is optionally passed as varargs of the form \textit{(const unsigned char*, unsigned long)}, which musst be +NULL terminated. +The input is passed via the \textit{in} argument of length \textit{inlen}. +The output is stored in the buffer pointer to by the \textit{out} argument where the length is passed as \textit{outlen}. +\textit{outlen} shall contain the initial size of the buffer behind \textit{out} when calling the function and on +return it will contain the written size. + +In case the operation is \textit{encryption} the buffer of \textit{out} shall be at least \texttt{inlen + 16} bytes wide. +In the case of \textit{decryption} the buffer of \textit{out} shall be at least \texttt{inlen - 16} bytes wide. + +An example of encryption and decryption with the one--shot API of SIV using multiple AAD is given below. + +\begin{small} +\begin{verbatim} +#include + +int main(void) +{ + int err; + unsigned char plain[16] = {0}; + unsigned char ct[sizeof(plain) + 16] = {0}; + unsigned long plainlen = sizeof(plain), ctlen = sizeof(ct); + + register_cipher(&aes_desc); + + if ((err = siv_memory(find_cipher("aes"), LTC_ENCRYPT, + ((unsigned char[32]) {0x0}), 32, + plain, plainlen, + ct, &ctlen, + "aad0", 4uL, "aad1", 4uL, "NONCE", 5uL, NULL)) != CRYPT_OK) { + whine_and_pout(err); + } + + if ((err = siv_memory(find_cipher("aes"), LTC_DECRYPT, + ((unsigned char[32]) {0x0}), 32, + ct, ctlen, + plain, &plainlen, + "aad0", 4uL, "aad1", 4uL, "NONCE", 5uL, NULL)) != CRYPT_OK) { + whine_and_pout(err); + } + + return EXIT_SUCCESS; +} +\end{verbatim} +\end{small} + \chapter{One-Way Cryptographic Hash Functions} \mysection{Core Functions} Like the ciphers, there are hash core functions and a universal data type to hold the hash state called \textit{hash\_state}. To initialize hash diff --git a/src/encauth/siv/siv.c b/src/encauth/siv/siv.c index 4543ad83e..a8c45cb4f 100644 --- a/src/encauth/siv/siv.c +++ b/src/encauth/siv/siv.c @@ -10,6 +10,15 @@ #ifdef LTC_SIV_MODE +/* RFC 5297 - Chapter 7 - Security Considerations + * + * [...] S2V must not be + * passed more than 127 components. Since SIV includes the plaintext as + * a component to S2V, that limits the number of components of + * associated data that can be safely passed to SIV to 126. + */ +static const unsigned long s_siv_max_aad_components = 126; + static LTC_INLINE void s_siv_dbl(unsigned char *inout) { int y, mask, msb, len; @@ -28,15 +37,6 @@ static LTC_INLINE void s_siv_dbl(unsigned char *inout) inout[len - 1] = ((inout[len - 1] << 1) ^ (msb ? mask : 0)) & 255; } -static LTC_INLINE int s_siv_S2V_zero(int cipher, - const unsigned char *key, unsigned long keylen, - unsigned char *D, unsigned long *Dlen) -{ - /* D = AES-CMAC(K, ) */ - const unsigned char zero_or_one[16] = {0}; - return omac_memory(cipher, key, keylen, zero_or_one, sizeof(zero_or_one), D, Dlen); -} - static LTC_INLINE int s_siv_S2V_one(int cipher, const unsigned char *key, unsigned long keylen, unsigned char *V, unsigned long *Vlen) @@ -48,10 +48,45 @@ static LTC_INLINE int s_siv_S2V_one(int cipher, zero_or_one[0] = 1; return omac_memory(cipher, key, keylen, zero_or_one, sizeof(zero_or_one), V, Vlen); } -static LTC_INLINE int s_siv_S2V_dbl_xor_cmac(int cipher, - const unsigned char *key, unsigned long keylen, - const unsigned char *aad, unsigned long aadlen, - unsigned char *D, unsigned long Dlen) + +typedef struct siv_omac_ctx_t { + omac_state omac; + int cipher; +} siv_omac_ctx_t; + +static LTC_INLINE int s_siv_ctx_init(int cipher, + const unsigned char *key, unsigned long keylen, + siv_omac_ctx_t *ctx) +{ + ctx->cipher = cipher; + return omac_init(&ctx->omac, cipher, key, keylen); +} + +static LTC_INLINE int s_siv_omac_memory(siv_omac_ctx_t *ctx, + const unsigned char *in, unsigned long inlen, + unsigned char *out, unsigned long *outlen) +{ + int err; + omac_state omac = ctx->omac; + if ((err = omac_process(&omac, in, inlen)) != CRYPT_OK) { + return err; + } + err = omac_done(&omac, out, outlen); + zeromem(&omac, sizeof(omac)); + return err; +} + +static LTC_INLINE int s_siv_S2V_zero(siv_omac_ctx_t *ctx, + unsigned char *D, unsigned long *Dlen) +{ + /* D = AES-CMAC(K, ) */ + const unsigned char zero_or_one[16] = {0}; + return s_siv_omac_memory(ctx, zero_or_one, sizeof(zero_or_one), D, Dlen); +} + +static LTC_INLINE int s_siv_S2V_dbl_xor_cmac(siv_omac_ctx_t *ctx, + const unsigned char *aad, unsigned long aadlen, + unsigned char *D, unsigned long Dlen) { /* for i = 1 to n-1 do * D = dbl(D) xor AES-CMAC(K, Si) @@ -61,7 +96,7 @@ static LTC_INLINE int s_siv_S2V_dbl_xor_cmac(int cipher, unsigned char TMP[16]; unsigned long i, TMPlen = sizeof(TMP); s_siv_dbl(D); - if ((err = omac_memory(cipher, key, keylen, aad, aadlen, TMP, &TMPlen)) != CRYPT_OK) { + if ((err = s_siv_omac_memory(ctx, aad, aadlen, TMP, &TMPlen)) != CRYPT_OK) { return err; } for (i = 0; i < Dlen; ++i) { @@ -70,11 +105,28 @@ static LTC_INLINE int s_siv_S2V_dbl_xor_cmac(int cipher, return err; } -static LTC_INLINE int s_siv_S2V_T(int cipher, - const unsigned char *in, unsigned long inlen, - const unsigned char *key, unsigned long keylen, - unsigned char *D, - unsigned char *V, unsigned long *Vlen) +static LTC_INLINE int s_siv_omac_memory_multi(siv_omac_ctx_t *ctx, + unsigned char *out, unsigned long *outlen, + const unsigned char *in, unsigned long inlen, + ...) +{ + int err; + va_list args; + omac_state omac = ctx->omac; + va_start(args, inlen); + + if ((err = omac_vprocess(&omac, in, inlen, args)) != CRYPT_OK) { + return err; + } + err = omac_done(&omac, out, outlen); + zeromem(&omac, sizeof(omac)); + return err; +} + +static LTC_INLINE int s_siv_S2V_T(siv_omac_ctx_t *ctx, + const unsigned char *in, unsigned long inlen, + unsigned char *D, + unsigned char *V, unsigned long *Vlen) { int err; unsigned long i; @@ -91,7 +143,7 @@ static LTC_INLINE int s_siv_S2V_T(int cipher, for(i = 0; i < 16; ++i) { T[i] ^= D[i]; } - err = omac_memory_multi(cipher, key, keylen, V, Vlen, in, inlen - 16, T, 16uL, NULL); + err = s_siv_omac_memory_multi(ctx, V, Vlen, in, inlen - 16, T, 16uL, NULL); } else { s_siv_dbl(D); XMEMCPY(T, in, inlen); @@ -103,39 +155,44 @@ static LTC_INLINE int s_siv_S2V_T(int cipher, T[i] ^= D[i]; } - err = omac_memory(cipher, key, keylen, T, 16, V, Vlen); + err = s_siv_omac_memory(ctx, T, 16, V, Vlen); } return err; } - static int s_siv_S2V(int cipher, const unsigned char *key, unsigned long keylen, const unsigned char **ad, unsigned long *adlen, const unsigned char *in, unsigned long inlen, unsigned char *V, unsigned long *Vlen) { - int err, n; + int err; unsigned char D[16]; - unsigned long Dlen = sizeof(D); + unsigned long Dlen = sizeof(D), n = 0; + siv_omac_ctx_t ctx; if(ad == NULL || adlen == NULL || ad[0] == NULL || adlen[0] == 0) { err = s_siv_S2V_one(cipher, key, keylen, V, Vlen); } else { + if ((err = s_siv_ctx_init(cipher, key, keylen, &ctx)) != CRYPT_OK) { + return err; + } Dlen = sizeof(D); - if ((err = s_siv_S2V_zero(cipher, key, keylen, D, &Dlen)) != CRYPT_OK) { + if ((err = s_siv_S2V_zero(&ctx, D, &Dlen)) != CRYPT_OK) { return err; } - n = 0; while(ad[n] != NULL && adlen[n] != 0) { - if ((err = s_siv_S2V_dbl_xor_cmac(cipher, key, keylen, ad[n], adlen[n], D, Dlen)) != CRYPT_OK) { + if (n >= s_siv_max_aad_components) { + return CRYPT_INPUT_TOO_LONG; + } + if ((err = s_siv_S2V_dbl_xor_cmac(&ctx, ad[n], adlen[n], D, Dlen)) != CRYPT_OK) { return err; } n++; } - err = s_siv_S2V_T(cipher, in, inlen, key, keylen, D, V, Vlen); + err = s_siv_S2V_T(&ctx, in, inlen, D, V, Vlen); } return err; @@ -193,11 +250,11 @@ typedef struct { @param ctlen [in/out] The length of the ciphertext @return CRYPT_OK if successful */ -int siv_encrypt(int cipher, - const unsigned char *key, unsigned long keylen, - const unsigned char *ad[], unsigned long adlen[], - const unsigned char *pt, unsigned long ptlen, - unsigned char *ct, unsigned long *ctlen) +int siv_encrypt( int cipher, + const unsigned char *key, unsigned long keylen, + const unsigned char *ad[], unsigned long adlen[], + const unsigned char *pt, unsigned long ptlen, + unsigned char *ct, unsigned long *ctlen) { int err; const unsigned char *K1, *K2; @@ -211,12 +268,17 @@ int siv_encrypt(int cipher, LTC_ARGCHK(ct != NULL); LTC_ARGCHK(ctlen != NULL); - if ((err = cipher_is_valid(cipher)) != CRYPT_OK) { - return err; + if (ptlen + 16 < ptlen) { + return CRYPT_OVERFLOW; } if (*ctlen < ptlen + 16) { + *ctlen = ptlen + 16; return CRYPT_BUFFER_OVERFLOW; } + if ((err = cipher_is_valid(cipher)) != CRYPT_OK) { + return err; + } + K1 = key; K2 = &key[keylen/2]; @@ -262,11 +324,11 @@ int siv_encrypt(int cipher, @param ptlen [in/out] The length of the plaintext @return CRYPT_OK if successful */ -int siv_decrypt(int cipher, - const unsigned char *key, unsigned long keylen, - const unsigned char *ad[], unsigned long adlen[], - const unsigned char *ct, unsigned long ctlen, - unsigned char *pt, unsigned long *ptlen) +int siv_decrypt( int cipher, + const unsigned char *key, unsigned long keylen, + const unsigned char *ad[], unsigned long adlen[], + const unsigned char *ct, unsigned long ctlen, + unsigned char *pt, unsigned long *ptlen) { int err; unsigned char *pt_work; @@ -281,13 +343,17 @@ int siv_decrypt(int cipher, LTC_ARGCHK(pt != NULL); LTC_ARGCHK(ptlen != NULL); - if ((err = cipher_is_valid(cipher)) != CRYPT_OK) { - return err; + if (ctlen < 16) { + return CRYPT_INVALID_ARG; } - if (*ptlen < ctlen || ctlen < 16) { + if (*ptlen < (ctlen - 16)) { + *ptlen = ctlen - 16; return CRYPT_BUFFER_OVERFLOW; } + if ((err = cipher_is_valid(cipher)) != CRYPT_OK) { + return err; + } *ptlen = ctlen - 16; pt_work = XMALLOC(*ptlen); if (pt_work == NULL) { @@ -313,10 +379,9 @@ int siv_decrypt(int cipher, copy_or_zeromem(pt_work, pt, *ptlen, err); out: #ifdef LTC_CLEAN_STACK - zeromem(Q, sizeof(Q)); zeromem(&siv, sizeof(siv)); - zeromem(pt_work, *ptlen); #endif + zeromem(pt_work, *ptlen); XFREE(pt_work); return err; @@ -340,14 +405,14 @@ int siv_memory( int cipher, int direction, const unsigned char *key, unsigned long keylen, const unsigned char *in, unsigned long inlen, unsigned char *out, unsigned long *outlen, - ...) + ...) { int err; va_list args; siv_state siv; unsigned char D[16], *in_buf = NULL, *out_work; const unsigned char *aad, *K1, *K2, *in_work; - unsigned long aadlen, Dlen = sizeof(D), Vlen = sizeof(siv.V), in_work_len; + unsigned long n = 0, aadlen, Dlen = sizeof(D), Vlen = sizeof(siv.V), in_work_len; LTC_ARGCHK(key != NULL); LTC_ARGCHK(in != NULL); @@ -358,9 +423,11 @@ int siv_memory( int cipher, int direction, return err; } if (direction == LTC_ENCRYPT && *outlen < inlen + 16) { + *outlen = inlen + 16; return CRYPT_BUFFER_OVERFLOW; } else if (direction == LTC_DECRYPT && (inlen < 16 || *outlen < inlen - 16)) { - return CRYPT_INVALID_ARG; + *outlen = inlen - 16; + return CRYPT_BUFFER_OVERFLOW; } K1 = key; @@ -385,34 +452,43 @@ int siv_memory( int cipher, int direction, va_start(args, outlen); aad = va_arg(args, const unsigned char*); - aadlen = va_arg(args, unsigned long); + aadlen = aad ? va_arg(args, unsigned long) : 0; if (aad == NULL || aadlen == 0) { if ((err = s_siv_S2V_one(cipher, K1, keylen/2, siv.V, &Vlen)) != CRYPT_OK) { goto err_out; } } else { - if ((err = s_siv_S2V_zero(cipher, K1, keylen/2, D, &Dlen)) != CRYPT_OK) { + siv_omac_ctx_t ctx; + if ((err = s_siv_ctx_init(cipher, K1, keylen/2, &ctx)) != CRYPT_OK) { + goto err_out; + } + if ((err = s_siv_S2V_zero(&ctx, D, &Dlen)) != CRYPT_OK) { goto err_out; } do { - if ((err = s_siv_S2V_dbl_xor_cmac(cipher, K1, keylen/2, aad, aadlen, D, Dlen)) != CRYPT_OK) { + if (n >= s_siv_max_aad_components) { + err = CRYPT_INPUT_TOO_LONG; + goto err_out; + } + if ((err = s_siv_S2V_dbl_xor_cmac(&ctx, aad, aadlen, D, Dlen)) != CRYPT_OK) { goto err_out; } aad = va_arg(args, const unsigned char*); if (aad == NULL) break; aadlen = va_arg(args, unsigned long); + n++; } while (aadlen); - if ((err = s_siv_S2V_T(cipher, in_work, in_work_len, K1, keylen/2, D, siv.V, &Vlen)) != CRYPT_OK) { + if ((err = s_siv_S2V_T(&ctx, in_work, in_work_len, D, siv.V, &Vlen)) != CRYPT_OK) { goto err_out; } } if (direction == LTC_DECRYPT) { err = XMEM_NEQ(siv.V, in, Vlen); - copy_or_zeromem(in_buf, out, in_work_len, err); + copy_or_zeromem(in_work, out, in_work_len, err); *outlen = in_work_len; } else { s_siv_bitand(siv.V, siv.Q); @@ -426,8 +502,10 @@ int siv_memory( int cipher, int direction, *outlen = inlen + 16; } err_out: - if (in_buf) + if (in_buf) { + zeromem(in_buf, in_work_len); XFREE(in_buf); + } va_end(args); #ifdef LTC_CLEAN_STACK zeromem(D, sizeof(D)); @@ -521,14 +599,19 @@ int siv_test(void) }; #undef PL_PAIR - int err; + int err, cipher; unsigned n; - unsigned long buflen; + unsigned long buflen, tmplen; unsigned char buf[MAX(sizeof(output_A1), sizeof(output_A2))]; + const unsigned long niter = 1000; + unsigned char *tmpe, *tmpd; + const unsigned long tmpmax = 16 + niter * 16; + + cipher = find_cipher("aes"); for (n = 0; n < sizeof(siv_tests)/sizeof(siv_tests[0]); ++n) { buflen = sizeof(buf); - if ((err = siv_encrypt(find_cipher("aes"), + if ((err = siv_encrypt(cipher, siv_tests[n].Key, siv_tests[n].Keylen, (const unsigned char **)siv_tests[n].ADs, siv_tests[n].ADlens, siv_tests[n].Plaintext, siv_tests[n].Plaintextlen, @@ -539,7 +622,7 @@ int siv_test(void) return CRYPT_FAIL_TESTVECTOR; } buflen = sizeof(buf); - if ((err = siv_decrypt(find_cipher("aes"), + if ((err = siv_decrypt(cipher, siv_tests[n].Key, siv_tests[n].Keylen, (const unsigned char **)siv_tests[n].ADs, siv_tests[n].ADlens, siv_tests[n].output, siv_tests[n].outputlen, @@ -553,7 +636,7 @@ int siv_test(void) /* Testcase 0x2 */ buflen = sizeof(buf); - if ((err = siv_memory(find_cipher("aes"), LTC_ENCRYPT, + if ((err = siv_memory(cipher, LTC_ENCRYPT, siv_tests[0].Key, siv_tests[0].Keylen, siv_tests[0].Plaintext, siv_tests[0].Plaintextlen, buf, &buflen, @@ -566,7 +649,7 @@ int siv_test(void) } /* Testcase 0x1002 */ buflen = sizeof(buf); - if ((err = siv_memory(find_cipher("aes"), LTC_DECRYPT, + if ((err = siv_memory(cipher, LTC_DECRYPT, siv_tests[0].Key, siv_tests[0].Keylen, siv_tests[0].output, siv_tests[0].outputlen, buf, &buflen, @@ -582,7 +665,7 @@ int siv_test(void) /* Testcase 0x3 */ buflen = sizeof(buf); - if ((err = siv_memory(find_cipher("aes"), LTC_ENCRYPT, + if ((err = siv_memory(cipher, LTC_ENCRYPT, siv_tests[1].Key, siv_tests[1].Keylen, siv_tests[1].Plaintext, siv_tests[1].Plaintextlen, buf, &buflen, @@ -597,7 +680,7 @@ int siv_test(void) } /* Testcase 0x1003 */ buflen = sizeof(buf); - if ((err = siv_memory(find_cipher("aes"), LTC_DECRYPT, + if ((err = siv_memory(cipher, LTC_DECRYPT, siv_tests[1].Key, siv_tests[1].Keylen, siv_tests[1].output, siv_tests[1].outputlen, buf, &buflen, @@ -610,7 +693,54 @@ int siv_test(void) if (compare_testvector(buf, buflen, siv_tests[1].Plaintext, siv_tests[1].Plaintextlen, siv_tests[1].name, n + 0x1000) != 0) { return CRYPT_FAIL_TESTVECTOR; } - return CRYPT_OK; + + tmpe = XCALLOC(1, tmpmax); + if (tmpe == NULL) { + return CRYPT_MEM; + } + tmpd = XCALLOC(1, tmpmax); + if (tmpd == NULL) { + err = CRYPT_MEM; + goto out_tmpd; + } + tmplen = 16; + for (n = 0; n < niter; ++n) { + buflen = tmpmax; + if ((err = siv_memory(cipher, LTC_ENCRYPT, + siv_tests[0].Key, siv_tests[0].Keylen, + tmpe, tmplen, + tmpe, &buflen, + NULL)) != CRYPT_OK) { + goto out; + } + tmplen = buflen; + } + if (compare_testvector(&buflen, sizeof(buflen), &tmpmax, sizeof(tmpmax), "Multiple encrypt length", -(int)niter)) { + err = CRYPT_FAIL_TESTVECTOR; + goto out; + } + XMEMCPY(tmpd, tmpe, buflen); + for (n = 0; n < niter; ++n) { + buflen = tmpmax; + if ((err = siv_memory(cipher, LTC_DECRYPT, + siv_tests[0].Key, siv_tests[0].Keylen, + tmpd, tmplen, + tmpd, &buflen, + NULL)) != CRYPT_OK) { + goto out; + } + tmplen = buflen; + } + if (compare_testvector(tmpd, tmplen, tmpe, tmplen, "Multi decrypt", niter + 0x2000)) { + err = CRYPT_FAIL_TESTVECTOR; + } + +out: + XFREE(tmpd); +out_tmpd: + XFREE(tmpe); + + return err; #endif } diff --git a/src/headers/tomcrypt_mac.h b/src/headers/tomcrypt_mac.h index d5693fa4d..016582d09 100644 --- a/src/headers/tomcrypt_mac.h +++ b/src/headers/tomcrypt_mac.h @@ -567,21 +567,21 @@ int chacha20poly1305_test(void); #endif /* LTC_CHACHA20POLY1305_MODE */ #ifdef LTC_SIV_MODE -int siv_encrypt(int cipher, - const unsigned char *key, unsigned long keylen, - const unsigned char *ad[], unsigned long adlen[], - const unsigned char *pt, unsigned long ptlen, - unsigned char *ct, unsigned long *ctlen); -int siv_decrypt(int cipher, - const unsigned char *key, unsigned long keylen, - const unsigned char *ad[], unsigned long adlen[], - const unsigned char *ct, unsigned long ctlen, - unsigned char *pt, unsigned long *ptlen); +int siv_encrypt( int cipher, + const unsigned char *key, unsigned long keylen, + const unsigned char *ad[], unsigned long adlen[], + const unsigned char *pt, unsigned long ptlen, + unsigned char *ct, unsigned long *ctlen); +int siv_decrypt( int cipher, + const unsigned char *key, unsigned long keylen, + const unsigned char *ad[], unsigned long adlen[], + const unsigned char *ct, unsigned long ctlen, + unsigned char *pt, unsigned long *ptlen); int siv_memory( int cipher, int direction, const unsigned char *key, unsigned long keylen, const unsigned char *in, unsigned long inlen, unsigned char *out, unsigned long *outlen, - ...) LTC_NULL_TERMINATED; + ...) LTC_NULL_TERMINATED; int siv_test(void); #endif