| ... | @@ -1,16 +1,21 @@ | ... | @@ -1,16 +1,21 @@ |
| 1 | //! AEGIS is a very fast authenticated encryption system built on top of the core AES function. | 1 | //! AEGIS is a very fast authenticated encryption system built on top of the core AES function. |
| 2 | //! | 2 | //! |
| 3 | //! The AEGIS-128L variant has a 128 bit key, a 128 bit nonce, and processes 256 bit message blocks. | 3 | //! The AEGIS-128* variants have a 128 bit key and a 128 bit nonce. |
| 4 | //! The AEGIS-256 variant has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks. | 4 | //! The AEGIS-256* variants have a 256 bit key and a 256 bit nonce. |
| | 5 | //! All of them can compute 128 and 256 bit authentication tags. |
| 5 | //! | 6 | //! |
| 6 | //! The AEGIS cipher family offers performance that significantly exceeds that of AES-GCM with | 7 | //! The AEGIS cipher family offers performance that significantly exceeds that of AES-GCM with |
| 7 | //! hardware support for parallelizable AES block encryption. | 8 | //! hardware support for parallelizable AES block encryption. |
| 8 | //! | 9 | //! |
| 9 | //! Unlike with AES-GCM, nonces can be safely chosen at random with no practical limit when using AEGIS-256. | 10 | //! On high-end Intel CPUs with AVX-512 support, AEGIS-128X4 and AEGIS-256X4 are the fastest options. |
| 10 | //! AEGIS-128L also allows for more messages to be safely encrypted when using random nonces. | 11 | //! On other modern server, desktop and mobile CPUs, AEGIS-128X2 and AEGIS-256X2 are usually the fastest options. |
| | 12 | //! AEGIS-128L and AEGIS-256 perform well on a broad range of platforms, including WebAssembly. |
| 11 | //! | 13 | //! |
| 12 | //! AEGIS is believed to be key-committing, making it a safer choice than most other AEADs | 14 | //! Unlike with AES-GCM, nonces can be safely chosen at random with no practical limit when using AEGIS-256*. |
| 13 | //! when the key has low entropy, or can be controlled by an attacker. | 15 | //! AEGIS-128* also allows for more messages to be safely encrypted when using random nonces. |
| | 16 | //! |
| | 17 | //! Unless the associated data can be fully controled by an adversary, AEGIS is believed to be key-committing, |
| | 18 | //! making it a safer choice than most other AEADs when the key has low entropy, or can be controlled by an attacker. |
| 14 | //! | 19 | //! |
| 15 | //! Finally, leaking the state does not leak the key. | 20 | //! Finally, leaking the state does not leak the key. |
| 16 | //! | 21 | //! |
| ... | @@ -20,122 +25,202 @@ const std = @import("std"); | ... | @@ -20,122 +25,202 @@ const std = @import("std"); |
| 20 | const crypto = std.crypto; | 25 | const crypto = std.crypto; |
| 21 | const mem = std.mem; | 26 | const mem = std.mem; |
| 22 | const assert = std.debug.assert; | 27 | const assert = std.debug.assert; |
| 23 | const AesBlock = crypto.core.aes.Block; | | |
| 24 | const AuthenticationError = crypto.errors.AuthenticationError; | 28 | const AuthenticationError = crypto.errors.AuthenticationError; |
| 25 | | 29 | |
| 26 | /// AEGIS-128L with a 128-bit authentication tag. | 30 | /// AEGIS-128X4 with a 128 bit tag |
| 27 | pub const Aegis128L = Aegis128LGeneric(128); | 31 | pub const Aegis128X4 = Aegis128XGeneric(4, 128); |
| 28 | | 32 | /// AEGIS-128X2 with a 128 bit tag |
| 29 | /// AEGIS-128L with a 256-bit authentication tag. | 33 | pub const Aegis128X2 = Aegis128XGeneric(2, 128); |
| 30 | pub const Aegis128L_256 = Aegis128LGeneric(256); | 34 | /// AEGIS-128L with a 128 bit tag |
| 31 | | 35 | pub const Aegis128L = Aegis128XGeneric(1, 128); |
| 32 | /// AEGIS-256 with a 128-bit authentication tag. | 36 | |
| 33 | pub const Aegis256 = Aegis256Generic(128); | 37 | /// AEGIS-256X4 with a 128 bit tag |
| 34 | | 38 | pub const Aegis256X4 = Aegis256XGeneric(4, 128); |
| 35 | /// AEGIS-256 with a 256-bit authentication tag. | 39 | /// AEGIS-256X2 with a 128 bit tag |
| 36 | pub const Aegis256_256 = Aegis256Generic(256); | 40 | pub const Aegis256X2 = Aegis256XGeneric(2, 128); |
| 37 | | 41 | /// AEGIS-256 with a 128 bit tag |
| 38 | const State128L = struct { | 42 | pub const Aegis256 = Aegis256XGeneric(1, 128); |
| 39 | blocks: [8]AesBlock, | 43 | |
| 40 | | 44 | /// AEGIS-128X4 with a 256 bit tag |
| 41 | fn init(key: [16]u8, nonce: [16]u8) State128L { | 45 | pub const Aegis128X4_256 = Aegis128XGeneric(4, 256); |
| 42 | const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }); | 46 | /// AEGIS-128X2 with a 256 bit tag |
| 43 | const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }); | 47 | pub const Aegis128X2_256 = Aegis128XGeneric(2, 256); |
| 44 | const key_block = AesBlock.fromBytes(&key); | 48 | /// AEGIS-128L with a 256 bit tag |
| 45 | const nonce_block = AesBlock.fromBytes(&nonce); | 49 | pub const Aegis128L_256 = Aegis128XGeneric(1, 256); |
| 46 | const blocks = [8]AesBlock{ | 50 | |
| 47 | key_block.xorBlocks(nonce_block), | 51 | /// AEGIS-256X4 with a 256 bit tag |
| 48 | c1, | 52 | pub const Aegis256X4_256 = Aegis256XGeneric(4, 256); |
| 49 | c2, | 53 | /// AEGIS-256X2 with a 256 bit tag |
| 50 | c1, | 54 | pub const Aegis256X2_256 = Aegis256XGeneric(2, 256); |
| 51 | key_block.xorBlocks(nonce_block), | 55 | /// AEGIS-256 with a 256 bit tag |
| 52 | key_block.xorBlocks(c2), | 56 | pub const Aegis256_256 = Aegis256XGeneric(1, 256); |
| 53 | key_block.xorBlocks(c1), | 57 | |
| 54 | key_block.xorBlocks(c2), | 58 | fn State128X(comptime degree: u7) type { |
| 55 | }; | 59 | return struct { |
| 56 | var state = State128L{ .blocks = blocks }; | 60 | const AesBlockVec = crypto.core.aes.BlockVec(degree); |
| 57 | var i: usize = 0; | 61 | const State = @This(); |
| 58 | while (i < 10) : (i += 1) { | 62 | |
| 59 | state.update(nonce_block, key_block); | 63 | blocks: [8]AesBlockVec, |
| | 64 | |
| | 65 | const aes_block_length = AesBlockVec.block_length; |
| | 66 | const rate = aes_block_length * 2; |
| | 67 | const alignment = AesBlockVec.native_word_size; |
| | 68 | |
| | 69 | fn init(key: [16]u8, nonce: [16]u8) State { |
| | 70 | const c1 = AesBlockVec.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd } ** degree); |
| | 71 | const c2 = AesBlockVec.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 } ** degree); |
| | 72 | const key_block = AesBlockVec.fromBytes(&(key ** degree)); |
| | 73 | const nonce_block = AesBlockVec.fromBytes(&(nonce ** degree)); |
| | 74 | const blocks = [8]AesBlockVec{ |
| | 75 | key_block.xorBlocks(nonce_block), |
| | 76 | c1, |
| | 77 | c2, |
| | 78 | c1, |
| | 79 | key_block.xorBlocks(nonce_block), |
| | 80 | key_block.xorBlocks(c2), |
| | 81 | key_block.xorBlocks(c1), |
| | 82 | key_block.xorBlocks(c2), |
| | 83 | }; |
| | 84 | var state = State{ .blocks = blocks }; |
| | 85 | if (degree > 1) { |
| | 86 | const context_block = ctx: { |
| | 87 | var contexts_bytes = [_]u8{0} ** aes_block_length; |
| | 88 | for (0..degree) |i| { |
| | 89 | contexts_bytes[i * 16] = @intCast(i); |
| | 90 | contexts_bytes[i * 16 + 1] = @intCast(degree - 1); |
| | 91 | } |
| | 92 | break :ctx AesBlockVec.fromBytes(&contexts_bytes); |
| | 93 | }; |
| | 94 | for (0..10) |_| { |
| | 95 | state.blocks[3] = state.blocks[3].xorBlocks(context_block); |
| | 96 | state.blocks[7] = state.blocks[7].xorBlocks(context_block); |
| | 97 | state.update(nonce_block, key_block); |
| | 98 | } |
| | 99 | } else { |
| | 100 | for (0..10) |_| { |
| | 101 | state.update(nonce_block, key_block); |
| | 102 | } |
| | 103 | } |
| | 104 | return state; |
| 60 | } | 105 | } |
| 61 | return state; | | |
| 62 | } | | |
| 63 | | 106 | |
| 64 | inline fn update(state: *State128L, d1: AesBlock, d2: AesBlock) void { | 107 | inline fn update(state: *State, d1: AesBlockVec, d2: AesBlockVec) void { |
| 65 | const blocks = &state.blocks; | 108 | const blocks = &state.blocks; |
| 66 | const tmp = blocks[7]; | 109 | const tmp = blocks[7]; |
| 67 | comptime var i: usize = 7; | 110 | comptime var i: usize = 7; |
| 68 | inline while (i > 0) : (i -= 1) { | 111 | inline while (i > 0) : (i -= 1) { |
| 69 | blocks[i] = blocks[i - 1].encrypt(blocks[i]); | 112 | blocks[i] = blocks[i - 1].encrypt(blocks[i]); |
| | 113 | } |
| | 114 | blocks[0] = tmp.encrypt(blocks[0]); |
| | 115 | blocks[0] = blocks[0].xorBlocks(d1); |
| | 116 | blocks[4] = blocks[4].xorBlocks(d2); |
| 70 | } | 117 | } |
| 71 | blocks[0] = tmp.encrypt(blocks[0]); | | |
| 72 | blocks[0] = blocks[0].xorBlocks(d1); | | |
| 73 | blocks[4] = blocks[4].xorBlocks(d2); | | |
| 74 | } | | |
| 75 | | 118 | |
| 76 | fn absorb(state: *State128L, src: *const [32]u8) void { | 119 | fn absorb(state: *State, src: *const [rate]u8) void { |
| 77 | const msg0 = AesBlock.fromBytes(src[0..16]); | 120 | const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]); |
| 78 | const msg1 = AesBlock.fromBytes(src[16..32]); | 121 | const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]); |
| 79 | state.update(msg0, msg1); | 122 | state.update(msg0, msg1); |
| 80 | } | 123 | } |
| 81 | | 124 | |
| 82 | fn enc(state: *State128L, dst: *[32]u8, src: *const [32]u8) void { | 125 | fn enc(state: *State, dst: *[rate]u8, src: *const [rate]u8) void { |
| 83 | const blocks = &state.blocks; | 126 | const blocks = &state.blocks; |
| 84 | const msg0 = AesBlock.fromBytes(src[0..16]); | 127 | const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]); |
| 85 | const msg1 = AesBlock.fromBytes(src[16..32]); | 128 | const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]); |
| 86 | var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]); | 129 | var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]); |
| 87 | var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]); | 130 | var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]); |
| 88 | tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3])); | 131 | tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3])); |
| 89 | tmp1 = tmp1.xorBlocks(blocks[6].andBlocks(blocks[7])); | 132 | tmp1 = tmp1.xorBlocks(blocks[6].andBlocks(blocks[7])); |
| 90 | dst[0..16].* = tmp0.toBytes(); | 133 | dst[0..aes_block_length].* = tmp0.toBytes(); |
| 91 | dst[16..32].* = tmp1.toBytes(); | 134 | dst[aes_block_length..rate].* = tmp1.toBytes(); |
| 92 | state.update(msg0, msg1); | 135 | state.update(msg0, msg1); |
| 93 | } | 136 | } |
| 94 | | 137 | |
| 95 | fn dec(state: *State128L, dst: *[32]u8, src: *const [32]u8) void { | 138 | fn dec(state: *State, dst: *[rate]u8, src: *const [rate]u8) void { |
| 96 | const blocks = &state.blocks; | 139 | const blocks = &state.blocks; |
| 97 | var msg0 = AesBlock.fromBytes(src[0..16]).xorBlocks(blocks[6]).xorBlocks(blocks[1]); | 140 | var msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]).xorBlocks(blocks[6]).xorBlocks(blocks[1]); |
| 98 | var msg1 = AesBlock.fromBytes(src[16..32]).xorBlocks(blocks[2]).xorBlocks(blocks[5]); | 141 | var msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]).xorBlocks(blocks[2]).xorBlocks(blocks[5]); |
| 99 | msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3])); | 142 | msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3])); |
| 100 | msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7])); | 143 | msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7])); |
| 101 | dst[0..16].* = msg0.toBytes(); | 144 | dst[0..aes_block_length].* = msg0.toBytes(); |
| 102 | dst[16..32].* = msg1.toBytes(); | 145 | dst[aes_block_length..rate].* = msg1.toBytes(); |
| 103 | state.update(msg0, msg1); | 146 | state.update(msg0, msg1); |
| 104 | } | 147 | } |
| 105 | | 148 | |
| 106 | fn mac(state: *State128L, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 { | 149 | fn decLast(state: *State, dst: []u8, src: []const u8) void { |
| 107 | const blocks = &state.blocks; | 150 | const blocks = &state.blocks; |
| 108 | var sizes: [16]u8 = undefined; | 151 | const z0 = blocks[6].xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3])); |
| 109 | mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little); | 152 | const z1 = blocks[2].xorBlocks(blocks[5]).xorBlocks(blocks[6].andBlocks(blocks[7])); |
| 110 | mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little); | 153 | var pad = [_]u8{0} ** rate; |
| 111 | const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[2]); | 154 | pad[0..aes_block_length].* = z0.toBytes(); |
| 112 | var i: usize = 0; | 155 | pad[aes_block_length..].* = z1.toBytes(); |
| 113 | while (i < 7) : (i += 1) { | 156 | for (pad[0..src.len], src) |*p, x| p.* ^= x; |
| 114 | state.update(tmp, tmp); | 157 | @memcpy(dst, pad[0..src.len]); |
| | 158 | @memset(pad[src.len..], 0); |
| | 159 | const msg0 = AesBlockVec.fromBytes(pad[0..aes_block_length]); |
| | 160 | const msg1 = AesBlockVec.fromBytes(pad[aes_block_length..rate]); |
| | 161 | state.update(msg0, msg1); |
| 115 | } | 162 | } |
| 116 | return switch (tag_bits) { | | |
| 117 | 128 => blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]) | | |
| 118 | .xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes(), | | |
| 119 | 256 => tag: { | | |
| 120 | const t1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]); | | |
| 121 | const t2 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]); | | |
| 122 | break :tag t1.toBytes() ++ t2.toBytes(); | | |
| 123 | }, | | |
| 124 | else => unreachable, | | |
| 125 | }; | | |
| 126 | } | | |
| 127 | }; | | |
| 128 | | 163 | |
| 129 | fn Aegis128LGeneric(comptime tag_bits: u9) type { | 164 | fn mac(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 { |
| | 165 | const blocks = &state.blocks; |
| | 166 | var sizes: [aes_block_length]u8 = undefined; |
| | 167 | mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little); |
| | 168 | mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little); |
| | 169 | for (1..degree) |i| { |
| | 170 | @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]); |
| | 171 | } |
| | 172 | const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[2]); |
| | 173 | for (0..7) |_| { |
| | 174 | state.update(tmp, tmp); |
| | 175 | } |
| | 176 | switch (tag_bits) { |
| | 177 | 128 => { |
| | 178 | var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes(); |
| | 179 | var tag = tag_multi[0..16].*; |
| | 180 | @memcpy(tag[0..], tag_multi[0..16]); |
| | 181 | for (1..degree) |d| { |
| | 182 | for (0..16) |i| { |
| | 183 | tag[i] ^= tag_multi[d * 16 + i]; |
| | 184 | } |
| | 185 | } |
| | 186 | return tag; |
| | 187 | }, |
| | 188 | 256 => { |
| | 189 | const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes(); |
| | 190 | const tag_multi_2 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes(); |
| | 191 | var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*; |
| | 192 | for (1..degree) |d| { |
| | 193 | for (0..16) |i| { |
| | 194 | tag[i] ^= tag_multi_1[d * 16 + i]; |
| | 195 | tag[i + 16] ^= tag_multi_2[d * 16 + i]; |
| | 196 | } |
| | 197 | } |
| | 198 | return tag; |
| | 199 | }, |
| | 200 | else => unreachable, |
| | 201 | } |
| | 202 | } |
| | 203 | }; |
| | 204 | } |
| | 205 | |
| | 206 | /// AEGIS is a very fast authenticated encryption system built on top of the core AES function. |
| | 207 | /// |
| | 208 | /// The 128 bits variants of AEGIS have a 128 bit key and a 128 bit nonce. |
| | 209 | /// |
| | 210 | /// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/ |
| | 211 | fn Aegis128XGeneric(comptime degree: u7, comptime tag_bits: u9) type { |
| | 212 | comptime assert(degree > 0); // degree must be greater than 0 |
| 130 | comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits | 213 | comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits |
| 131 | | 214 | |
| 132 | return struct { | 215 | return struct { |
| | 216 | const State = State128X(degree); |
| | 217 | |
| 133 | pub const tag_length = tag_bits / 8; | 218 | pub const tag_length = tag_bits / 8; |
| 134 | pub const nonce_length = 16; | 219 | pub const nonce_length = 16; |
| 135 | pub const key_length = 16; | 220 | pub const key_length = 16; |
| 136 | pub const block_length = 32; | 221 | pub const block_length = State.rate; |
| 137 | | 222 | |
| 138 | const State = State128L; | 223 | const alignment = State.alignment; |
| 139 | | 224 | |
| 140 | /// c: ciphertext: output buffer should be of size m.len | 225 | /// c: ciphertext: output buffer should be of size m.len |
| 141 | /// tag: authentication tag: output MAC | 226 | /// tag: authentication tag: output MAC |
| ... | @@ -145,27 +230,27 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type { | ... | @@ -145,27 +230,27 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type { |
| 145 | /// k: private key | 230 | /// k: private key |
| 146 | pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void { | 231 | pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void { |
| 147 | assert(c.len == m.len); | 232 | assert(c.len == m.len); |
| 148 | var state = State128L.init(key, npub); | 233 | var state = State.init(key, npub); |
| 149 | var src: [32]u8 align(16) = undefined; | 234 | var src: [block_length]u8 align(alignment) = undefined; |
| 150 | var dst: [32]u8 align(16) = undefined; | 235 | var dst: [block_length]u8 align(alignment) = undefined; |
| 151 | var i: usize = 0; | 236 | var i: usize = 0; |
| 152 | while (i + 32 <= ad.len) : (i += 32) { | 237 | while (i + block_length <= ad.len) : (i += block_length) { |
| 153 | state.absorb(ad[i..][0..32]); | 238 | state.absorb(ad[i..][0..block_length]); |
| 154 | } | 239 | } |
| 155 | if (ad.len % 32 != 0) { | 240 | if (ad.len % block_length != 0) { |
| 156 | @memset(src[0..], 0); | 241 | @memset(src[0..], 0); |
| 157 | @memcpy(src[0 .. ad.len % 32], ad[i..][0 .. ad.len % 32]); | 242 | @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]); |
| 158 | state.absorb(&src); | 243 | state.absorb(&src); |
| 159 | } | 244 | } |
| 160 | i = 0; | 245 | i = 0; |
| 161 | while (i + 32 <= m.len) : (i += 32) { | 246 | while (i + block_length <= m.len) : (i += block_length) { |
| 162 | state.enc(c[i..][0..32], m[i..][0..32]); | 247 | state.enc(c[i..][0..block_length], m[i..][0..block_length]); |
| 163 | } | 248 | } |
| 164 | if (m.len % 32 != 0) { | 249 | if (m.len % block_length != 0) { |
| 165 | @memset(src[0..], 0); | 250 | @memset(src[0..], 0); |
| 166 | @memcpy(src[0 .. m.len % 32], m[i..][0 .. m.len % 32]); | 251 | @memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]); |
| 167 | state.enc(&dst, &src); | 252 | state.enc(&dst, &src); |
| 168 | @memcpy(c[i..][0 .. m.len % 32], dst[0 .. m.len % 32]); | 253 | @memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]); |
| 169 | } | 254 | } |
| 170 | tag.* = state.mac(tag_bits, ad.len, m.len); | 255 | tag.* = state.mac(tag_bits, ad.len, m.len); |
| 171 | } | 256 | } |
| ... | @@ -181,31 +266,23 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type { | ... | @@ -181,31 +266,23 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type { |
| 181 | /// Contents of `m` are undefined if an error is returned. | 266 | /// Contents of `m` are undefined if an error is returned. |
| 182 | pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void { | 267 | pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void { |
| 183 | assert(c.len == m.len); | 268 | assert(c.len == m.len); |
| 184 | var state = State128L.init(key, npub); | 269 | var state = State.init(key, npub); |
| 185 | var src: [32]u8 align(16) = undefined; | 270 | var src: [block_length]u8 align(alignment) = undefined; |
| 186 | var dst: [32]u8 align(16) = undefined; | | |
| 187 | var i: usize = 0; | 271 | var i: usize = 0; |
| 188 | while (i + 32 <= ad.len) : (i += 32) { | 272 | while (i + block_length <= ad.len) : (i += block_length) { |
| 189 | state.absorb(ad[i..][0..32]); | 273 | state.absorb(ad[i..][0..block_length]); |
| 190 | } | 274 | } |
| 191 | if (ad.len % 32 != 0) { | 275 | if (ad.len % block_length != 0) { |
| 192 | @memset(src[0..], 0); | 276 | @memset(src[0..], 0); |
| 193 | @memcpy(src[0 .. ad.len % 32], ad[i..][0 .. ad.len % 32]); | 277 | @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]); |
| 194 | state.absorb(&src); | 278 | state.absorb(&src); |
| 195 | } | 279 | } |
| 196 | i = 0; | 280 | i = 0; |
| 197 | while (i + 32 <= m.len) : (i += 32) { | 281 | while (i + block_length <= m.len) : (i += block_length) { |
| 198 | state.dec(m[i..][0..32], c[i..][0..32]); | 282 | state.dec(m[i..][0..block_length], c[i..][0..block_length]); |
| 199 | } | 283 | } |
| 200 | if (m.len % 32 != 0) { | 284 | if (m.len % block_length != 0) { |
| 201 | @memset(src[0..], 0); | 285 | state.decLast(m[i..], c[i..]); |
| 202 | @memcpy(src[0 .. m.len % 32], c[i..][0 .. m.len % 32]); | | |
| 203 | state.dec(&dst, &src); | | |
| 204 | @memcpy(m[i..][0 .. m.len % 32], dst[0 .. m.len % 32]); | | |
| 205 | @memset(dst[0 .. m.len % 32], 0); | | |
| 206 | const blocks = &state.blocks; | | |
| 207 | blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(dst[0..16])); | | |
| 208 | blocks[4] = blocks[4].xorBlocks(AesBlock.fromBytes(dst[16..32])); | | |
| 209 | } | 286 | } |
| 210 | var computed_tag = state.mac(tag_bits, ad.len, m.len); | 287 | var computed_tag = state.mac(tag_bits, ad.len, m.len); |
| 211 | const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag); | 288 | const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag); |
| ... | @@ -218,107 +295,172 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type { | ... | @@ -218,107 +295,172 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type { |
| 218 | }; | 295 | }; |
| 219 | } | 296 | } |
| 220 | | 297 | |
| 221 | const State256 = struct { | 298 | fn State256X(comptime degree: u7) type { |
| 222 | blocks: [6]AesBlock, | 299 | return struct { |
| 223 | | 300 | const AesBlockVec = crypto.core.aes.BlockVec(degree); |
| 224 | fn init(key: [32]u8, nonce: [32]u8) State256 { | 301 | const State = @This(); |
| 225 | const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }); | 302 | |
| 226 | const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }); | 303 | blocks: [6]AesBlockVec, |
| 227 | const key_block1 = AesBlock.fromBytes(key[0..16]); | 304 | |
| 228 | const key_block2 = AesBlock.fromBytes(key[16..32]); | 305 | const aes_block_length = AesBlockVec.block_length; |
| 229 | const nonce_block1 = AesBlock.fromBytes(nonce[0..16]); | 306 | const rate = aes_block_length; |
| 230 | const nonce_block2 = AesBlock.fromBytes(nonce[16..32]); | 307 | const alignment = AesBlockVec.native_word_size; |
| 231 | const kxn1 = key_block1.xorBlocks(nonce_block1); | 308 | |
| 232 | const kxn2 = key_block2.xorBlocks(nonce_block2); | 309 | fn init(key: [32]u8, nonce: [32]u8) State { |
| 233 | const blocks = [6]AesBlock{ | 310 | const c1 = AesBlockVec.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd } ** degree); |
| 234 | kxn1, | 311 | const c2 = AesBlockVec.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 } ** degree); |
| 235 | kxn2, | 312 | const key_block1 = AesBlockVec.fromBytes(key[0..16] ** degree); |
| 236 | c1, | 313 | const key_block2 = AesBlockVec.fromBytes(key[16..32] ** degree); |
| 237 | c2, | 314 | const nonce_block1 = AesBlockVec.fromBytes(nonce[0..16] ** degree); |
| 238 | key_block1.xorBlocks(c2), | 315 | const nonce_block2 = AesBlockVec.fromBytes(nonce[16..32] ** degree); |
| 239 | key_block2.xorBlocks(c1), | 316 | const kxn1 = key_block1.xorBlocks(nonce_block1); |
| 240 | }; | 317 | const kxn2 = key_block2.xorBlocks(nonce_block2); |
| 241 | var state = State256{ .blocks = blocks }; | 318 | const blocks = [6]AesBlockVec{ |
| 242 | var i: usize = 0; | 319 | kxn1, |
| 243 | while (i < 4) : (i += 1) { | 320 | kxn2, |
| 244 | state.update(key_block1); | 321 | c1, |
| 245 | state.update(key_block2); | 322 | c2, |
| 246 | state.update(kxn1); | 323 | key_block1.xorBlocks(c2), |
| 247 | state.update(kxn2); | 324 | key_block2.xorBlocks(c1), |
| | 325 | }; |
| | 326 | var state = State{ .blocks = blocks }; |
| | 327 | if (degree > 1) { |
| | 328 | const context_block = ctx: { |
| | 329 | var contexts_bytes = [_]u8{0} ** aes_block_length; |
| | 330 | for (0..degree) |i| { |
| | 331 | contexts_bytes[i * 16] = @intCast(i); |
| | 332 | contexts_bytes[i * 16 + 1] = @intCast(degree - 1); |
| | 333 | } |
| | 334 | break :ctx AesBlockVec.fromBytes(&contexts_bytes); |
| | 335 | }; |
| | 336 | for (0..4) |_| { |
| | 337 | state.blocks[3] = state.blocks[3].xorBlocks(context_block); |
| | 338 | state.blocks[5] = state.blocks[5].xorBlocks(context_block); |
| | 339 | state.update(key_block1); |
| | 340 | state.blocks[3] = state.blocks[3].xorBlocks(context_block); |
| | 341 | state.blocks[5] = state.blocks[5].xorBlocks(context_block); |
| | 342 | state.update(key_block2); |
| | 343 | state.blocks[3] = state.blocks[3].xorBlocks(context_block); |
| | 344 | state.blocks[5] = state.blocks[5].xorBlocks(context_block); |
| | 345 | state.update(kxn1); |
| | 346 | state.blocks[3] = state.blocks[3].xorBlocks(context_block); |
| | 347 | state.blocks[5] = state.blocks[5].xorBlocks(context_block); |
| | 348 | state.update(kxn2); |
| | 349 | } |
| | 350 | } else { |
| | 351 | for (0..4) |_| { |
| | 352 | state.update(key_block1); |
| | 353 | state.update(key_block2); |
| | 354 | state.update(kxn1); |
| | 355 | state.update(kxn2); |
| | 356 | } |
| | 357 | } |
| | 358 | return state; |
| 248 | } | 359 | } |
| 249 | return state; | | |
| 250 | } | | |
| 251 | | 360 | |
| 252 | inline fn update(state: *State256, d: AesBlock) void { | 361 | inline fn update(state: *State, d: AesBlockVec) void { |
| 253 | const blocks = &state.blocks; | 362 | const blocks = &state.blocks; |
| 254 | const tmp = blocks[5].encrypt(blocks[0]); | 363 | const tmp = blocks[5].encrypt(blocks[0]); |
| 255 | comptime var i: usize = 5; | 364 | comptime var i: usize = 5; |
| 256 | inline while (i > 0) : (i -= 1) { | 365 | inline while (i > 0) : (i -= 1) { |
| 257 | blocks[i] = blocks[i - 1].encrypt(blocks[i]); | 366 | blocks[i] = blocks[i - 1].encrypt(blocks[i]); |
| | 367 | } |
| | 368 | blocks[0] = tmp.xorBlocks(d); |
| 258 | } | 369 | } |
| 259 | blocks[0] = tmp.xorBlocks(d); | | |
| 260 | } | | |
| 261 | | 370 | |
| 262 | fn absorb(state: *State256, src: *const [16]u8) void { | 371 | fn absorb(state: *State, src: *const [rate]u8) void { |
| 263 | const msg = AesBlock.fromBytes(src); | 372 | const msg = AesBlockVec.fromBytes(src); |
| 264 | state.update(msg); | 373 | state.update(msg); |
| 265 | } | 374 | } |
| 266 | | 375 | |
| 267 | fn enc(state: *State256, dst: *[16]u8, src: *const [16]u8) void { | 376 | fn enc(state: *State, dst: *[rate]u8, src: *const [rate]u8) void { |
| 268 | const blocks = &state.blocks; | 377 | const blocks = &state.blocks; |
| 269 | const msg = AesBlock.fromBytes(src); | 378 | const msg = AesBlockVec.fromBytes(src); |
| 270 | var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]); | 379 | var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]); |
| 271 | tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3])); | 380 | tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3])); |
| 272 | dst.* = tmp.toBytes(); | 381 | dst.* = tmp.toBytes(); |
| 273 | state.update(msg); | 382 | state.update(msg); |
| 274 | } | 383 | } |
| 275 | | 384 | |
| 276 | fn dec(state: *State256, dst: *[16]u8, src: *const [16]u8) void { | 385 | fn dec(state: *State, dst: *[rate]u8, src: *const [rate]u8) void { |
| 277 | const blocks = &state.blocks; | 386 | const blocks = &state.blocks; |
| 278 | var msg = AesBlock.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]); | 387 | var msg = AesBlockVec.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]); |
| 279 | msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3])); | 388 | msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3])); |
| 280 | dst.* = msg.toBytes(); | 389 | dst.* = msg.toBytes(); |
| 281 | state.update(msg); | 390 | state.update(msg); |
| 282 | } | 391 | } |
| 283 | | 392 | |
| 284 | fn mac(state: *State256, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 { | 393 | fn decLast(state: *State, dst: []u8, src: []const u8) void { |
| 285 | const blocks = &state.blocks; | 394 | const blocks = &state.blocks; |
| 286 | var sizes: [16]u8 = undefined; | 395 | const z = blocks[5].xorBlocks(blocks[4]).xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3])); |
| 287 | mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little); | 396 | var pad = z.toBytes(); |
| 288 | mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little); | 397 | for (pad[0..src.len], src) |*p, x| p.* ^= x; |
| 289 | const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[3]); | 398 | @memcpy(dst, pad[0..src.len]); |
| 290 | var i: usize = 0; | 399 | @memset(pad[src.len..], 0); |
| 291 | while (i < 7) : (i += 1) { | 400 | const msg = AesBlockVec.fromBytes(pad[0..]); |
| 292 | state.update(tmp); | 401 | state.update(msg); |
| 293 | } | 402 | } |
| 294 | return switch (tag_bits) { | 403 | |
| 295 | 128 => blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]) | 404 | fn mac(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 { |
| 296 | .xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes(), | 405 | const blocks = &state.blocks; |
| 297 | 256 => tag: { | 406 | var sizes: [aes_block_length]u8 = undefined; |
| 298 | const t1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]); | 407 | mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little); |
| 299 | const t2 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]); | 408 | mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little); |
| 300 | break :tag t1.toBytes() ++ t2.toBytes(); | 409 | for (1..degree) |i| { |
| 301 | }, | 410 | @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]); |
| 302 | else => unreachable, | 411 | } |
| 303 | }; | 412 | const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[3]); |
| 304 | } | 413 | for (0..7) |_| { |
| 305 | }; | 414 | state.update(tmp); |
| | 415 | } |
| | 416 | switch (tag_bits) { |
| | 417 | 128 => { |
| | 418 | var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes(); |
| | 419 | var tag = tag_multi[0..16].*; |
| | 420 | @memcpy(tag[0..], tag_multi[0..16]); |
| | 421 | for (1..degree) |d| { |
| | 422 | for (0..16) |i| { |
| | 423 | tag[i] ^= tag_multi[d * 16 + i]; |
| | 424 | } |
| | 425 | } |
| | 426 | return tag; |
| | 427 | }, |
| | 428 | 256 => { |
| | 429 | const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).toBytes(); |
| | 430 | const tag_multi_2 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes(); |
| | 431 | var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*; |
| | 432 | for (1..degree) |d| { |
| | 433 | for (0..16) |i| { |
| | 434 | tag[i] ^= tag_multi_1[d * 16 + i]; |
| | 435 | tag[i + 16] ^= tag_multi_2[d * 16 + i]; |
| | 436 | } |
| | 437 | } |
| | 438 | return tag; |
| | 439 | }, |
| | 440 | else => unreachable, |
| | 441 | } |
| | 442 | } |
| | 443 | }; |
| | 444 | } |
| 306 | | 445 | |
| 307 | /// AEGIS is a very fast authenticated encryption system built on top of the core AES function. | 446 | /// AEGIS is a very fast authenticated encryption system built on top of the core AES function. |
| 308 | /// | 447 | /// |
| 309 | /// The 256 bit variant of AEGIS has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks. | 448 | /// The 256 bits variants of AEGIS have a 256 bit key and a 256 bit nonce. |
| 310 | /// | 449 | /// |
| 311 | /// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/ | 450 | /// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/ |
| 312 | fn Aegis256Generic(comptime tag_bits: u9) type { | 451 | fn Aegis256XGeneric(comptime degree: u7, comptime tag_bits: u9) type { |
| | 452 | comptime assert(degree > 0); // degree must be greater than 0 |
| 313 | comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits | 453 | comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits |
| 314 | | 454 | |
| 315 | return struct { | 455 | return struct { |
| | 456 | const State = State256X(degree); |
| | 457 | |
| 316 | pub const tag_length = tag_bits / 8; | 458 | pub const tag_length = tag_bits / 8; |
| 317 | pub const nonce_length = 32; | 459 | pub const nonce_length = 32; |
| 318 | pub const key_length = 32; | 460 | pub const key_length = 32; |
| 319 | pub const block_length = 16; | 461 | pub const block_length = State.rate; |
| 320 | | 462 | |
| 321 | const State = State256; | 463 | const alignment = State.alignment; |
| 322 | | 464 | |
| 323 | /// c: ciphertext: output buffer should be of size m.len | 465 | /// c: ciphertext: output buffer should be of size m.len |
| 324 | /// tag: authentication tag: output MAC | 466 | /// tag: authentication tag: output MAC |
| ... | @@ -328,27 +470,27 @@ fn Aegis256Generic(comptime tag_bits: u9) type { | ... | @@ -328,27 +470,27 @@ fn Aegis256Generic(comptime tag_bits: u9) type { |
| 328 | /// k: private key | 470 | /// k: private key |
| 329 | pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void { | 471 | pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void { |
| 330 | assert(c.len == m.len); | 472 | assert(c.len == m.len); |
| 331 | var state = State256.init(key, npub); | 473 | var state = State.init(key, npub); |
| 332 | var src: [16]u8 align(16) = undefined; | 474 | var src: [block_length]u8 align(alignment) = undefined; |
| 333 | var dst: [16]u8 align(16) = undefined; | 475 | var dst: [block_length]u8 align(alignment) = undefined; |
| 334 | var i: usize = 0; | 476 | var i: usize = 0; |
| 335 | while (i + 16 <= ad.len) : (i += 16) { | 477 | while (i + block_length <= ad.len) : (i += block_length) { |
| 336 | state.enc(&dst, ad[i..][0..16]); | 478 | state.enc(&dst, ad[i..][0..block_length]); |
| 337 | } | 479 | } |
| 338 | if (ad.len % 16 != 0) { | 480 | if (ad.len % block_length != 0) { |
| 339 | @memset(src[0..], 0); | 481 | @memset(src[0..], 0); |
| 340 | @memcpy(src[0 .. ad.len % 16], ad[i..][0 .. ad.len % 16]); | 482 | @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]); |
| 341 | state.enc(&dst, &src); | 483 | state.enc(&dst, &src); |
| 342 | } | 484 | } |
| 343 | i = 0; | 485 | i = 0; |
| 344 | while (i + 16 <= m.len) : (i += 16) { | 486 | while (i + block_length <= m.len) : (i += block_length) { |
| 345 | state.enc(c[i..][0..16], m[i..][0..16]); | 487 | state.enc(c[i..][0..block_length], m[i..][0..block_length]); |
| 346 | } | 488 | } |
| 347 | if (m.len % 16 != 0) { | 489 | if (m.len % block_length != 0) { |
| 348 | @memset(src[0..], 0); | 490 | @memset(src[0..], 0); |
| 349 | @memcpy(src[0 .. m.len % 16], m[i..][0 .. m.len % 16]); | 491 | @memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]); |
| 350 | state.enc(&dst, &src); | 492 | state.enc(&dst, &src); |
| 351 | @memcpy(c[i..][0 .. m.len % 16], dst[0 .. m.len % 16]); | 493 | @memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]); |
| 352 | } | 494 | } |
| 353 | tag.* = state.mac(tag_bits, ad.len, m.len); | 495 | tag.* = state.mac(tag_bits, ad.len, m.len); |
| 354 | } | 496 | } |
| ... | @@ -364,30 +506,23 @@ fn Aegis256Generic(comptime tag_bits: u9) type { | ... | @@ -364,30 +506,23 @@ fn Aegis256Generic(comptime tag_bits: u9) type { |
| 364 | /// Contents of `m` are undefined if an error is returned. | 506 | /// Contents of `m` are undefined if an error is returned. |
| 365 | pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void { | 507 | pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void { |
| 366 | assert(c.len == m.len); | 508 | assert(c.len == m.len); |
| 367 | var state = State256.init(key, npub); | 509 | var state = State.init(key, npub); |
| 368 | var src: [16]u8 align(16) = undefined; | 510 | var src: [block_length]u8 align(alignment) = undefined; |
| 369 | var dst: [16]u8 align(16) = undefined; | | |
| 370 | var i: usize = 0; | 511 | var i: usize = 0; |
| 371 | while (i + 16 <= ad.len) : (i += 16) { | 512 | while (i + block_length <= ad.len) : (i += block_length) { |
| 372 | state.enc(&dst, ad[i..][0..16]); | 513 | state.absorb(ad[i..][0..block_length]); |
| 373 | } | 514 | } |
| 374 | if (ad.len % 16 != 0) { | 515 | if (ad.len % block_length != 0) { |
| 375 | @memset(src[0..], 0); | 516 | @memset(src[0..], 0); |
| 376 | @memcpy(src[0 .. ad.len % 16], ad[i..][0 .. ad.len % 16]); | 517 | @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]); |
| 377 | state.enc(&dst, &src); | 518 | state.absorb(&src); |
| 378 | } | 519 | } |
| 379 | i = 0; | 520 | i = 0; |
| 380 | while (i + 16 <= m.len) : (i += 16) { | 521 | while (i + block_length <= m.len) : (i += block_length) { |
| 381 | state.dec(m[i..][0..16], c[i..][0..16]); | 522 | state.dec(m[i..][0..block_length], c[i..][0..block_length]); |
| 382 | } | 523 | } |
| 383 | if (m.len % 16 != 0) { | 524 | if (m.len % block_length != 0) { |
| 384 | @memset(src[0..], 0); | 525 | state.decLast(m[i..], c[i..]); |
| 385 | @memcpy(src[0 .. m.len % 16], c[i..][0 .. m.len % 16]); | | |
| 386 | state.dec(&dst, &src); | | |
| 387 | @memcpy(m[i..][0 .. m.len % 16], dst[0 .. m.len % 16]); | | |
| 388 | @memset(dst[0 .. m.len % 16], 0); | | |
| 389 | const blocks = &state.blocks; | | |
| 390 | blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(&dst)); | | |
| 391 | } | 526 | } |
| 392 | var computed_tag = state.mac(tag_bits, ad.len, m.len); | 527 | var computed_tag = state.mac(tag_bits, ad.len, m.len); |
| 393 | const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag); | 528 | const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag); |
| ... | @@ -400,6 +535,24 @@ fn Aegis256Generic(comptime tag_bits: u9) type { | ... | @@ -400,6 +535,24 @@ fn Aegis256Generic(comptime tag_bits: u9) type { |
| 400 | }; | 535 | }; |
| 401 | } | 536 | } |
| 402 | | 537 | |
| | 538 | /// The `Aegis128X4Mac` message authentication function outputs 256 bit tags. |
| | 539 | /// In addition to being extremely fast, its large state, non-linearity |
| | 540 | /// and non-invertibility provides the following properties: |
| | 541 | /// - 128 bit security, stronger than GHash/Polyval/Poly1305. |
| | 542 | /// - Recovering the secret key from the state would require ~2^128 attempts, |
| | 543 | /// which is infeasible for any practical adversary. |
| | 544 | /// - It has a large security margin against internal collisions. |
| | 545 | pub const Aegis128X4Mac = AegisMac(Aegis128X4_256); |
| | 546 | |
| | 547 | /// The `Aegis128X2Mac` message authentication function outputs 256 bit tags. |
| | 548 | /// In addition to being extremely fast, its large state, non-linearity |
| | 549 | /// and non-invertibility provides the following properties: |
| | 550 | /// - 128 bit security, stronger than GHash/Polyval/Poly1305. |
| | 551 | /// - Recovering the secret key from the state would require ~2^128 attempts, |
| | 552 | /// which is infeasible for any practical adversary. |
| | 553 | /// - It has a large security margin against internal collisions. |
| | 554 | pub const Aegis128X2Mac = AegisMac(Aegis128X2_256); |
| | 555 | |
| 403 | /// The `Aegis128LMac` message authentication function outputs 256 bit tags. | 556 | /// The `Aegis128LMac` message authentication function outputs 256 bit tags. |
| 404 | /// In addition to being extremely fast, its large state, non-linearity | 557 | /// In addition to being extremely fast, its large state, non-linearity |
| 405 | /// and non-invertibility provides the following properties: | 558 | /// and non-invertibility provides the following properties: |
| ... | @@ -409,34 +562,60 @@ fn Aegis256Generic(comptime tag_bits: u9) type { | ... | @@ -409,34 +562,60 @@ fn Aegis256Generic(comptime tag_bits: u9) type { |
| 409 | /// - It has a large security margin against internal collisions. | 562 | /// - It has a large security margin against internal collisions. |
| 410 | pub const Aegis128LMac = AegisMac(Aegis128L_256); | 563 | pub const Aegis128LMac = AegisMac(Aegis128L_256); |
| 411 | | 564 | |
| | 565 | /// The `Aegis256X4Mac` message authentication function has a 256-bit key size, |
| | 566 | /// and outputs 256 bit tags. Unless theoretical multi-target attacks are a |
| | 567 | /// concern, the AEGIS-128L variant should be preferred. |
| | 568 | /// AEGIS' large state, non-linearity and non-invertibility provides the |
| | 569 | /// following properties: |
| | 570 | /// - 256 bit security against forgery. |
| | 571 | /// - Recovering the secret key from the state would require ~2^256 attempts, |
| | 572 | /// which is infeasible for any practical adversary. |
| | 573 | /// - It has a large security margin against internal collisions. |
| | 574 | pub const Aegis256X4Mac = AegisMac(Aegis256X4_256); |
| | 575 | |
| | 576 | /// The `Aegis256X2Mac` message authentication function has a 256-bit key size, |
| | 577 | /// and outputs 256 bit tags. Unless theoretical multi-target attacks are a |
| | 578 | /// concern, the AEGIS-128L variant should be preferred. |
| | 579 | /// AEGIS' large state, non-linearity and non-invertibility provides the |
| | 580 | /// following properties: |
| | 581 | /// - 256 bit security against forgery. |
| | 582 | /// - Recovering the secret key from the state would require ~2^256 attempts, |
| | 583 | /// which is infeasible for any practical adversary. |
| | 584 | /// - It has a large security margin against internal collisions. |
| | 585 | pub const Aegis256X2Mac = AegisMac(Aegis256X2_256); |
| | 586 | |
| 412 | /// The `Aegis256Mac` message authentication function has a 256-bit key size, | 587 | /// The `Aegis256Mac` message authentication function has a 256-bit key size, |
| 413 | /// and outputs 256 bit tags. Unless theoretical multi-target attacks are a | 588 | /// and outputs 256 bit tags. Unless theoretical multi-target attacks are a |
| 414 | /// concern, the AEGIS-128L variant should be preferred. | 589 | /// concern, the AEGIS-128L variant should be preferred. |
| 415 | /// AEGIS' large state, non-linearity and non-invertibility provides the | 590 | /// AEGIS' large state, non-linearity and non-invertibility provides the |
| 416 | /// following properties: | 591 | /// following properties: |
| 417 | /// - More than 128 bit security against forgery. | 592 | /// - 256 bit security against forgery. |
| 418 | /// - Recovering the secret key from the state would require ~2^256 attempts, | 593 | /// - Recovering the secret key from the state would require ~2^256 attempts, |
| 419 | /// which is infeasible for any practical adversary. | 594 | /// which is infeasible for any practical adversary. |
| 420 | /// - It has a large security margin against internal collisions. | 595 | /// - It has a large security margin against internal collisions. |
| 421 | pub const Aegis256Mac = AegisMac(Aegis256_256); | 596 | pub const Aegis256Mac = AegisMac(Aegis256_256); |
| 422 | | 597 | |
| 423 | /// Aegis128L MAC with a 128-bit output. | 598 | /// AEGIS-128X4 MAC with 128-bit tags |
| 424 | /// A MAC with a 128-bit output is not safe unless the number of messages | 599 | pub const Aegis128X4Mac_128 = AegisMac(Aegis128X4); |
| 425 | /// authenticated with the same key remains small. | 600 | |
| 426 | /// After 2^48 messages, the probability of a collision is already ~ 2^-33. | 601 | /// AEGIS-128X2 MAC with 128-bit tags |
| 427 | /// If unsure, use the Aegis128LMac type, that has a 256 bit output. | 602 | pub const Aegis128X2Mac_128 = AegisMac(Aegis128X2); |
| | 603 | |
| | 604 | /// AEGIS-128L MAC with 128-bit tags |
| 428 | pub const Aegis128LMac_128 = AegisMac(Aegis128L); | 605 | pub const Aegis128LMac_128 = AegisMac(Aegis128L); |
| 429 | | 606 | |
| 430 | /// Aegis256 MAC with a 128-bit output. | 607 | /// AEGIS-256X4 MAC with 128-bit tags |
| 431 | /// A MAC with a 128-bit output is not safe unless the number of messages | 608 | pub const Aegis256X4Mac_128 = AegisMac(Aegis256X4); |
| 432 | /// authenticated with the same key remains small. | 609 | |
| 433 | /// After 2^48 messages, the probability of a collision is already ~ 2^-33. | 610 | /// AEGIS-256X2 MAC with 128-bit tags |
| 434 | /// If unsure, use the Aegis256Mac type, that has a 256 bit output. | 611 | pub const Aegis256X2Mac_128 = AegisMac(Aegis256X2); |
| | 612 | |
| | 613 | /// AEGIS-256 MAC with 128-bit tags |
| 435 | pub const Aegis256Mac_128 = AegisMac(Aegis256); | 614 | pub const Aegis256Mac_128 = AegisMac(Aegis256); |
| 436 | | 615 | |
| 437 | fn AegisMac(comptime T: type) type { | 616 | fn AegisMac(comptime T: type) type { |
| 438 | return struct { | 617 | return struct { |
| 439 | const Self = @This(); | 618 | const Mac = @This(); |
| 440 | | 619 | |
| 441 | pub const mac_length = T.tag_length; | 620 | pub const mac_length = T.tag_length; |
| 442 | pub const key_length = T.key_length; | 621 | pub const key_length = T.key_length; |
| ... | @@ -448,15 +627,15 @@ fn AegisMac(comptime T: type) type { | ... | @@ -448,15 +627,15 @@ fn AegisMac(comptime T: type) type { |
| 448 | msg_len: usize = 0, | 627 | msg_len: usize = 0, |
| 449 | | 628 | |
| 450 | /// Initialize a state for the MAC function | 629 | /// Initialize a state for the MAC function |
| 451 | pub fn init(key: *const [key_length]u8) Self { | 630 | pub fn init(key: *const [key_length]u8) Mac { |
| 452 | const nonce = [_]u8{0} ** T.nonce_length; | 631 | const nonce = [_]u8{0} ** T.nonce_length; |
| 453 | return Self{ | 632 | return Mac{ |
| 454 | .state = T.State.init(key.*, nonce), | 633 | .state = T.State.init(key.*, nonce), |
| 455 | }; | 634 | }; |
| 456 | } | 635 | } |
| 457 | | 636 | |
| 458 | /// Add data to the state | 637 | /// Add data to the state |
| 459 | pub fn update(self: *Self, b: []const u8) void { | 638 | pub fn update(self: *Mac, b: []const u8) void { |
| 460 | self.msg_len += b.len; | 639 | self.msg_len += b.len; |
| 461 | | 640 | |
| 462 | const len_partial = @min(b.len, block_length - self.off); | 641 | const len_partial = @min(b.len, block_length - self.off); |
| ... | @@ -469,6 +648,10 @@ fn AegisMac(comptime T: type) type { | ... | @@ -469,6 +648,10 @@ fn AegisMac(comptime T: type) type { |
| 469 | | 648 | |
| 470 | var i = len_partial; | 649 | var i = len_partial; |
| 471 | self.off = 0; | 650 | self.off = 0; |
| | 651 | while (i + block_length * 2 <= b.len) : (i += block_length * 2) { |
| | 652 | self.state.absorb(b[i..][0..block_length]); |
| | 653 | self.state.absorb(b[i..][block_length .. block_length * 2]); |
| | 654 | } |
| 472 | while (i + block_length <= b.len) : (i += block_length) { | 655 | while (i + block_length <= b.len) : (i += block_length) { |
| 473 | self.state.absorb(b[i..][0..block_length]); | 656 | self.state.absorb(b[i..][0..block_length]); |
| 474 | } | 657 | } |
| ... | @@ -479,7 +662,7 @@ fn AegisMac(comptime T: type) type { | ... | @@ -479,7 +662,7 @@ fn AegisMac(comptime T: type) type { |
| 479 | } | 662 | } |
| 480 | | 663 | |
| 481 | /// Return an authentication tag for the current state | 664 | /// Return an authentication tag for the current state |
| 482 | pub fn final(self: *Self, out: *[mac_length]u8) void { | 665 | pub fn final(self: *Mac, out: *[mac_length]u8) void { |
| 483 | if (self.off > 0) { | 666 | if (self.off > 0) { |
| 484 | var pad = [_]u8{0} ** block_length; | 667 | var pad = [_]u8{0} ** block_length; |
| 485 | @memcpy(pad[0..self.off], self.buf[0..self.off]); | 668 | @memcpy(pad[0..self.off], self.buf[0..self.off]); |
| ... | @@ -490,20 +673,20 @@ fn AegisMac(comptime T: type) type { | ... | @@ -490,20 +673,20 @@ fn AegisMac(comptime T: type) type { |
| 490 | | 673 | |
| 491 | /// Return an authentication tag for a message and a key | 674 | /// Return an authentication tag for a message and a key |
| 492 | pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void { | 675 | pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void { |
| 493 | var ctx = Self.init(key); | 676 | var ctx = Mac.init(key); |
| 494 | ctx.update(msg); | 677 | ctx.update(msg); |
| 495 | ctx.final(out); | 678 | ctx.final(out); |
| 496 | } | 679 | } |
| 497 | | 680 | |
| 498 | pub const Error = error{}; | 681 | pub const Error = error{}; |
| 499 | pub const Writer = std.io.Writer(*Self, Error, write); | 682 | pub const Writer = std.io.Writer(*Mac, Error, write); |
| 500 | | 683 | |
| 501 | fn write(self: *Self, bytes: []const u8) Error!usize { | 684 | fn write(self: *Mac, bytes: []const u8) Error!usize { |
| 502 | self.update(bytes); | 685 | self.update(bytes); |
| 503 | return bytes.len; | 686 | return bytes.len; |
| 504 | } | 687 | } |
| 505 | | 688 | |
| 506 | pub fn writer(self: *Self) Writer { | 689 | pub fn writer(self: *Mac) Writer { |
| 507 | return .{ .context = self }; | 690 | return .{ .context = self }; |
| 508 | } | 691 | } |
| 509 | }; | 692 | }; |
| ... | @@ -568,6 +751,23 @@ test "Aegis128L test vector 3" { | ... | @@ -568,6 +751,23 @@ test "Aegis128L test vector 3" { |
| 568 | try htest.assertEqual("83cc600dc4e3e7e62d4055826174f149", &tag); | 751 | try htest.assertEqual("83cc600dc4e3e7e62d4055826174f149", &tag); |
| 569 | } | 752 | } |
| 570 | | 753 | |
| | 754 | test "Aegis128X2 test vector 1" { |
| | 755 | const key: [Aegis128X2.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }; |
| | 756 | const nonce: [Aegis128X2.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }; |
| | 757 | var empty = [_]u8{}; |
| | 758 | var tag: [Aegis128X2.tag_length]u8 = undefined; |
| | 759 | var tag256: [Aegis128X2_256.tag_length]u8 = undefined; |
| | 760 | |
| | 761 | Aegis128X2.encrypt(&empty, &tag, &empty, &empty, nonce, key); |
| | 762 | Aegis128X2_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key); |
| | 763 | try htest.assertEqual("63117dc57756e402819a82e13eca8379", &tag); |
| | 764 | try htest.assertEqual("b92c71fdbd358b8a4de70b27631ace90cffd9b9cfba82028412bac41b4f53759", &tag256); |
| | 765 | tag[0] +%= 1; |
| | 766 | try testing.expectError(error.AuthenticationFailed, Aegis128X2.decrypt(&empty, &empty, tag, &empty, nonce, key)); |
| | 767 | tag256[0] +%= 1; |
| | 768 | try testing.expectError(error.AuthenticationFailed, Aegis128X2_256.decrypt(&empty, &empty, tag256, &empty, nonce, key)); |
| | 769 | } |
| | 770 | |
| 571 | test "Aegis256 test vector 1" { | 771 | test "Aegis256 test vector 1" { |
| 572 | const key: [Aegis256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30; | 772 | const key: [Aegis256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30; |
| 573 | const nonce: [Aegis256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29; | 773 | const nonce: [Aegis256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29; |
| ... | @@ -624,6 +824,23 @@ test "Aegis256 test vector 3" { | ... | @@ -624,6 +824,23 @@ test "Aegis256 test vector 3" { |
| 624 | try htest.assertEqual("f7a0878f68bd083e8065354071fc27c3", &tag); | 824 | try htest.assertEqual("f7a0878f68bd083e8065354071fc27c3", &tag); |
| 625 | } | 825 | } |
| 626 | | 826 | |
| | 827 | test "Aegis256X4 test vector 1" { |
| | 828 | const key: [Aegis256X4.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }; |
| | 829 | const nonce: [Aegis256X4.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f }; |
| | 830 | var empty = [_]u8{}; |
| | 831 | var tag: [Aegis256X4.tag_length]u8 = undefined; |
| | 832 | var tag256: [Aegis256X4_256.tag_length]u8 = undefined; |
| | 833 | |
| | 834 | Aegis256X4.encrypt(&empty, &tag, &empty, &empty, nonce, key); |
| | 835 | Aegis256X4_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key); |
| | 836 | try htest.assertEqual("3b7fee6cee7bf17888ad11ed2397beb4", &tag); |
| | 837 | try htest.assertEqual("6093a1a8aab20ec635dc1ca71745b01b5bec4fc444c9ffbebd710d4a34d20eaf", &tag256); |
| | 838 | tag[0] +%= 1; |
| | 839 | try testing.expectError(error.AuthenticationFailed, Aegis256X4.decrypt(&empty, &empty, tag, &empty, nonce, key)); |
| | 840 | tag256[0] +%= 1; |
| | 841 | try testing.expectError(error.AuthenticationFailed, Aegis256X4_256.decrypt(&empty, &empty, tag256, &empty, nonce, key)); |
| | 842 | } |
| | 843 | |
| 627 | test "Aegis MAC" { | 844 | test "Aegis MAC" { |
| 628 | const key = [_]u8{0x00} ** Aegis128LMac.key_length; | 845 | const key = [_]u8{0x00} ** Aegis128LMac.key_length; |
| 629 | var msg: [64]u8 = undefined; | 846 | var msg: [64]u8 = undefined; |