src/torsion: import.

binding.gyp

@@ -20,6 +20,7 @@
       "./src/torsion/src/poly1305.c",
       "./src/torsion/src/rsa.c",
       "./src/torsion/src/salsa20.c",
+      "./src/torsion/src/secretbox.c",
       "./src/torsion/src/siphash.c",
       "./src/torsion/src/util.c",
       "./src/bcrypto.cc"

lib/ssh.js

@@ -58,15 +58,15 @@ const typeToCurve = {
   [keyTypes.P521]: 'nistp521'
 };
 
-const cipherToName = {
-  '3des-cbc': 'DES-EDE3-CBC',
-  'aes128-cbc': 'AES-128-CBC',
-  'aes192-cbc': 'AES-192-CBC',
-  'aes256-cbc': 'AES-256-CBC',
-  '[email protected]': 'AES-256-CBC',
-  'aes128-ctr': 'AES-128-CTR',
-  'aes192-ctr': 'AES-192-CTR',
-  'aes256-ctr': 'AES-256-CTR'
+const cipherInfo = {
+  '3des-cbc': ['DES-EDE3-CBC', 24, 8],
+  'aes128-cbc': ['AES-128-CBC', 16, 16],
+  'aes192-cbc': ['AES-192-CBC', 24, 16],
+  'aes256-cbc': ['AES-256-CBC', 32, 16],
+  '[email protected]': ['AES-256-CBC', 32, 16],
+  'aes128-ctr': ['AES-128-CTR', 16, 16],
+  'aes192-ctr': ['AES-192-CTR', 24, 16],
+  'aes256-ctr': ['AES-256-CTR', 32, 16]
 };
 
 const AUTH_MAGIC = 'openssh-key-v1';
@@ -1098,11 +1098,10 @@ function derive(sname, passwd, salt, rounds) {
   assert(Buffer.isBuffer(salt));
   assert((rounds >>> 0) === rounds);
 
-  if (!cipherToName.hasOwnProperty(sname))
+  if (!cipherInfo.hasOwnProperty(sname))
     throw new Error(`Unknown cipher: ${sname}.`);
 
-  const name = cipherToName[sname];
-  const {keySize, ivSize} = cipher.get(name);
+  const [name, keySize, ivSize] = cipherInfo[sname];
 
   const size = keySize + ivSize;
   const secret = bcrypt.pbkdf(passwd, salt, rounds, size);

src/bcrypto.cc

@@ -275,7 +275,7 @@ bcrypto_aead_create(napi_env env, napi_callback_info info) {
   aead_t *ctx = (aead_t *)torsion_alloc(sizeof(aead_t));
   napi_value handle;
 
-  aead_init(ctx);
+  ctx->mode = -1;
 
   CHECK(napi_create_external(env,
                              ctx,
@@ -304,8 +304,7 @@ bcrypto_aead_init(napi_env env, napi_callback_info info) {
   JS_ASSERT(iv_len == 8 || iv_len == 12 || iv_len == 16
          || iv_len == 24 || iv_len == 28 || iv_len == 32, JS_ERR_IV_SIZE);
 
-  aead_init(ctx);
-  aead_setup(ctx, key, iv, iv_len);
+  aead_init(ctx, key, iv, iv_len);
 
   return argv[0];
 }
@@ -481,8 +480,7 @@ bcrypto_aead_static_encrypt(napi_env env, napi_callback_info info) {
   JS_ASSERT(iv_len == 8 || iv_len == 12 || iv_len == 16
          || iv_len == 24 || iv_len == 28 || iv_len == 32, JS_ERR_IV_SIZE);
 
-  aead_init(&ctx);
-  aead_setup(&ctx, key, iv, iv_len);
+  aead_init(&ctx, key, iv, iv_len);
   aead_aad(&ctx, aad, aad_len);
   aead_encrypt(&ctx, msg, msg, msg_len);
   aead_final(&ctx, out);
@@ -520,8 +518,7 @@ bcrypto_aead_static_decrypt(napi_env env, napi_callback_info info) {
          || iv_len == 24 || iv_len == 28 || iv_len == 32, JS_ERR_IV_SIZE);
   JS_ASSERT(tag_len == 16, JS_ERR_TAG_SIZE);
 
-  aead_init(&ctx);
-  aead_setup(&ctx, key, iv, iv_len);
+  aead_init(&ctx, key, iv, iv_len);
   aead_aad(&ctx, aad, aad_len);
   aead_decrypt(&ctx, msg, msg, msg_len);
   aead_final(&ctx, mac);
@@ -559,8 +556,7 @@ bcrypto_aead_static_auth(napi_env env, napi_callback_info info) {
          || iv_len == 24 || iv_len == 28 || iv_len == 32, JS_ERR_IV_SIZE);
   JS_ASSERT(tag_len == 16, JS_ERR_TAG_SIZE);
 
-  aead_init(&ctx);
-  aead_setup(&ctx, key, iv, iv_len);
+  aead_init(&ctx, key, iv, iv_len);
   aead_aad(&ctx, aad, aad_len);
   aead_auth(&ctx, msg, msg_len);
   aead_final(&ctx, mac);

src/torsion/include/torsion/aead.h

@@ -39,22 +39,19 @@ typedef struct _aead_s {
   poly1305_t poly;
   unsigned char key[64];
   int mode;
-  uint64_t aad_len;
-  uint64_t cipher_len;
+  uint64_t adlen;
+  uint64_t ctlen;
 } aead_t;
 
 /*
  * AEAD
  */
 
 void
-aead_init(aead_t *aead);
-
-void
-aead_setup(aead_t *aead,
-           const unsigned char *key,
-           const unsigned char *iv,
-           size_t iv_len);
+aead_init(aead_t *aead,
+          const unsigned char *key,
+          const unsigned char *iv,
+          size_t iv_len);
 
 void
 aead_aad(aead_t *aead, const unsigned char *aad, size_t len);

src/torsion/include/torsion/drbg.h

@@ -1,5 +1,5 @@
 /*!
- * drbg.h - hmac-drbg implementation for libtorsion
+ * drbg.h - drbg implementations for libtorsion
  * Copyright (c) 2020, Christopher Jeffrey (MIT License).
  * https://github.com/bcoin-org/libtorsion
  */
@@ -12,43 +12,148 @@ extern "C" {
 #endif
 
 #include <stddef.h>
+#include "cipher.h"
 #include "hash.h"
 
 /*
  * Symbol Aliases
  */
 
-#define drbg_init torsion_drbg_init
-#define drbg_reseed torsion_drbg_reseed
-#define drbg_generate torsion_drbg_generate
-#define drbg_rng __torsion_drbg_rng
+#define hmac_drbg_init torsion_hmac_drbg_init
+#define hmac_drbg_reseed torsion_hmac_drbg_reseed
+#define hmac_drbg_generate torsion_hmac_drbg_generate
+#define hmac_drbg_rng __torsion_hmac_drbg_rng
+
+#define hash_drbg_init torsion_hash_drbg_init
+#define hash_drbg_reseed torsion_hash_drbg_reseed
+#define hash_drbg_generate torsion_hash_drbg_generate
+#define hash_drbg_rng __torsion_hash_drbg_rng
+
+#define ctr_drbg_init torsion_ctr_drbg_init
+#define ctr_drbg_reseed torsion_ctr_drbg_reseed
+#define ctr_drbg_generate torsion_ctr_drbg_generate
+#define ctr_drbg_rng __torsion_ctr_drbg_rng
 
 /*
  * Structs
  */
 
-typedef struct _drbg_s {
+typedef struct _hmac_drbg_s {
   int type;
+  size_t size;
   hmac_t kmac;
   unsigned char K[HASH_MAX_OUTPUT_SIZE];
   unsigned char V[HASH_MAX_OUTPUT_SIZE];
-} drbg_t;
+} hmac_drbg_t;
+
+typedef struct _hash_drbg_s {
+  int type;
+  hash_t hash;
+  size_t size;
+  size_t length;
+  unsigned char V[111];
+  unsigned char C[111];
+  uint64_t rounds;
+} hash_drbg_t;
+
+typedef struct _ctr_drbg_s {
+  aes_t aes;
+  size_t key_size;
+  size_t blk_size;
+  size_t ent_size;
+  int derivation;
+  unsigned char KV[48];
+  unsigned char *K;
+  unsigned char *V;
+  unsigned char state[16];
+} ctr_drbg_t;
+
+typedef hmac_drbg_t drbg_t;
 
 /*
  * DRBG
  */
 
+#define drbg_init hmac_drbg_init
+#define drbg_reseed hmac_drbg_reseed
+#define drbg_generate(drbg, out, len) \
+  hmac_drbg_generate(drbg, out, len, NULL, 0)
+#define drbg_rng hmac_drbg_rng
+
+/*
+ * HMAC-DRBG
+ */
+
+void
+hmac_drbg_init(hmac_drbg_t *drbg,
+               int type,
+               const unsigned char *seed,
+               size_t seed_len);
+
+void
+hmac_drbg_reseed(hmac_drbg_t *drbg, const unsigned char *seed, size_t seed_len);
+
+void
+hmac_drbg_generate(hmac_drbg_t *drbg, void *out, size_t len,
+                   const unsigned char *add, size_t add_len);
+
+void
+hmac_drbg_rng(void *out, size_t size, void *arg);
+
+/*
+ * Hash-DRBG
+ */
+
+void
+hash_drbg_init(hash_drbg_t *drbg,
+               int type,
+               const unsigned char *seed,
+               size_t seed_len);
+
+void
+hash_drbg_reseed(hash_drbg_t *drbg,
+                 const unsigned char *seed,
+                 size_t seed_len);
+
+void
+hash_drbg_generate(hash_drbg_t *drbg,
+                   void *out,
+                   size_t len,
+                   const unsigned char *add,
+                   size_t add_len);
+
+void
+hash_drbg_rng(void *out, size_t size, void *arg);
+
+/*
+ * CTR-DRBG
+ */
+
 void
-drbg_init(drbg_t *drbg, int type, const unsigned char *seed, size_t seed_len);
+ctr_drbg_init(ctr_drbg_t *drbg,
+              unsigned int bits,
+              const unsigned char *nonce,
+              size_t nonce_len,
+              const unsigned char *pers,
+              size_t pers_len,
+              int derivation);
 
 void
-drbg_reseed(drbg_t *drbg, const unsigned char *seed, size_t seed_len);
+ctr_drbg_reseed(ctr_drbg_t *drbg,
+                const unsigned char *nonce,
+                size_t nonce_len,
+                const unsigned char *add,
+                size_t add_len);
 
 void
-drbg_generate(drbg_t *drbg, void *out, size_t len);
+ctr_drbg_generate(ctr_drbg_t *drbg,
+                  void *out,
+                  size_t len,
+                  const unsigned char *add,
+                  size_t add_len);
 
 void
-drbg_rng(void *out, size_t size, void *arg);
+ctr_drbg_rng(void *out, size_t size, void *arg);
 
 #ifdef __cplusplus
 }