authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-08-15 15:09:06+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2025-08-15 13:09:06+00:00
logc1eff72c4a0a9d036299b322184f271f6a61ea28
treea5a4dd0be113a1e45a8ed6e94b8c4a860dd56d8f
parente9eee8dace5af05f0c47f29443542783ed5fa080
signaturebadge-check Signed by PGP key B5690EEEBB952194

crypto/aes_ocb.zig: actually check against test vectors (#24835)

And use the correct bit endianness for padding

1 files changed, 11 insertions(+), 5 deletions(-)

lib/std/crypto/aes_ocb.zig+11-5
...@@ -76,7 +76,7 @@ fn AesOcb(comptime Aes: anytype) type {...@@ -76,7 +76,7 @@ fn AesOcb(comptime Aes: anytype) type {
76 xorWith(&offset, lx.star);76 xorWith(&offset, lx.star);
77 var padded = [_]u8{0} ** 16;77 var padded = [_]u8{0} ** 16;
78 @memcpy(padded[0..leftover], a[i * 16 ..][0..leftover]);78 @memcpy(padded[0..leftover], a[i * 16 ..][0..leftover]);
79 padded[leftover] = 1;79 padded[leftover] = 0x80;
80 var e = xorBlocks(offset, padded);80 var e = xorBlocks(offset, padded);
81 aes_enc_ctx.encrypt(&e, &e);81 aes_enc_ctx.encrypt(&e, &e);
82 xorWith(&sum, e);82 xorWith(&sum, e);
...@@ -259,6 +259,7 @@ fn xorWith(x: *Block, y: Block) void {...@@ -259,6 +259,7 @@ fn xorWith(x: *Block, y: Block) void {
259}259}
260260
261const hexToBytes = std.fmt.hexToBytes;261const hexToBytes = std.fmt.hexToBytes;
262const testing = std.testing;
262263
263test "AesOcb test vector 1" {264test "AesOcb test vector 1" {
264 if (builtin.zig_backend == .stage2_c) return error.SkipZigTest;265 if (builtin.zig_backend == .stage2_c) return error.SkipZigTest;
...@@ -296,6 +297,7 @@ test "AesOcb test vector 2" {...@@ -296,6 +297,7 @@ test "AesOcb test vector 2" {
296 var expected_tag: [tag.len]u8 = undefined;297 var expected_tag: [tag.len]u8 = undefined;
297 _ = try hexToBytes(&expected_tag, "C5CD9D1850C141E358649994EE701B68");298 _ = try hexToBytes(&expected_tag, "C5CD9D1850C141E358649994EE701B68");
298299
300 try testing.expectEqualSlices(u8, &expected_tag, &tag);
299 var m: [0]u8 = undefined;301 var m: [0]u8 = undefined;
300 try Aes128Ocb.decrypt(&m, &c, tag, &ad, nonce, k);302 try Aes128Ocb.decrypt(&m, &c, tag, &ad, nonce, k);
301}303}
...@@ -319,6 +321,8 @@ test "AesOcb test vector 3" {...@@ -319,6 +321,8 @@ test "AesOcb test vector 3" {
319 _ = try hexToBytes(&expected_tag, "479AD363AC366B95A98CA5F3000B1479");321 _ = try hexToBytes(&expected_tag, "479AD363AC366B95A98CA5F3000B1479");
320 _ = try hexToBytes(&expected_c, "4412923493C57D5DE0D700F753CCE0D1D2D95060122E9F15A5DDBFC5787E50B5CC55EE507BCB084E");322 _ = try hexToBytes(&expected_c, "4412923493C57D5DE0D700F753CCE0D1D2D95060122E9F15A5DDBFC5787E50B5CC55EE507BCB084E");
321323
324 try testing.expectEqualSlices(u8, &expected_tag, &tag);
325 try testing.expectEqualSlices(u8, &expected_c, &c);
322 var m2: [m.len]u8 = undefined;326 var m2: [m.len]u8 = undefined;
323 try Aes128Ocb.decrypt(&m2, &c, tag, "", nonce, k);327 try Aes128Ocb.decrypt(&m2, &c, tag, "", nonce, k);
324 assert(mem.eql(u8, &m, &m2));328 assert(mem.eql(u8, &m, &m2));
...@@ -331,19 +335,21 @@ test "AesOcb test vector 4" {...@@ -331,19 +335,21 @@ test "AesOcb test vector 4" {
331 var nonce: [Aes128Ocb.nonce_length]u8 = undefined;335 var nonce: [Aes128Ocb.nonce_length]u8 = undefined;
332 var tag: [Aes128Ocb.tag_length]u8 = undefined;336 var tag: [Aes128Ocb.tag_length]u8 = undefined;
333 var m: [40]u8 = undefined;337 var m: [40]u8 = undefined;
334 var ad = m;
335 var c: [m.len]u8 = undefined;338 var c: [m.len]u8 = undefined;
336 _ = try hexToBytes(&k, "000102030405060708090A0B0C0D0E0F");339 _ = try hexToBytes(&k, "000102030405060708090A0B0C0D0E0F");
337 _ = try hexToBytes(&m, "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627");340 _ = try hexToBytes(&m, "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627");
338 _ = try hexToBytes(&nonce, "BBAA99887766554433221104");341 _ = try hexToBytes(&nonce, "BBAA9988776655443322110D");
342 const ad = m;
339343
340 Aes128Ocb.encrypt(&c, &tag, &m, &ad, nonce, k);344 Aes128Ocb.encrypt(&c, &tag, &m, &ad, nonce, k);
341345
342 var expected_c: [c.len]u8 = undefined;346 var expected_c: [c.len]u8 = undefined;
343 var expected_tag: [tag.len]u8 = undefined;347 var expected_tag: [tag.len]u8 = undefined;
344 _ = try hexToBytes(&expected_tag, "3AD7A4FF3835B8C5701C1CCEC8FC3358");348 _ = try hexToBytes(&expected_tag, "ED07BA06A4A69483A7035490C5769E60");
345 _ = try hexToBytes(&expected_c, "571D535B60B277188BE5147170A9A22C");349 _ = try hexToBytes(&expected_c, "D5CA91748410C1751FF8A2F618255B68A0A12E093FF454606E59F9C1D0DDC54B65E8628E568BAD7A");
346350
351 try testing.expectEqualSlices(u8, &expected_tag, &tag);
352 try testing.expectEqualSlices(u8, &expected_c, &c);
347 var m2: [m.len]u8 = undefined;353 var m2: [m.len]u8 = undefined;
348 try Aes128Ocb.decrypt(&m2, &c, tag, &ad, nonce, k);354 try Aes128Ocb.decrypt(&m2, &c, tag, &ad, nonce, k);
349 assert(mem.eql(u8, &m, &m2));355 assert(mem.eql(u8, &m, &m2));