From 03fbadbf3a1aa64faa9a74a16712a4a0f3c16653 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 Apr 2026 12:03:05 +0200 Subject: [PATCH 1/2] std.crypto.aes-siv: Add an assertion for the number of AD inputs AES-SIV supports "only" up to 126 AD fields. Passing more than that never happens in any real-world protocol (it's typically 1-3), but an assert() doesn't hurt. --- lib/std/crypto/aes_siv.zig | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/std/crypto/aes_siv.zig b/lib/std/crypto/aes_siv.zig index 4cbbca2eeb61a7d6ff449716533be34d1d0b6be1..b58f24bf480c95a8f42591c25fd27368dfeeb6ca 100644 --- a/lib/std/crypto/aes_siv.zig +++ b/lib/std/crypto/aes_siv.zig @@ -229,6 +229,7 @@ fn AesSiv(comptime Aes: anytype) type { /// an arbitrary vector of associated data strings as specified in RFC 5297. pub fn encryptWithAdVector(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const []const u8, key: [key_length]u8) void { debug.assert(c.len == m.len); + debug.assert(ad.len <= 126); // AES-SIV supports at most 126 associated data components // Split key into K1 (for S2V) and K2 (for CTR) const k1 = key[0 .. Aes.key_bits / 8]; @@ -263,6 +264,7 @@ fn AesSiv(comptime Aes: anytype) type { /// an arbitrary vector of associated data strings as specified in RFC 5297. pub fn decryptWithAdVector(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const []const u8, key: [key_length]u8) AuthenticationError!void { assert(c.len == m.len); + assert(ad.len <= 126); // AES-SIV supports at most 126 associated data components // Split key into K1 (for S2V) and K2 (for CTR) const k1 = key[0 .. Aes.key_bits / 8]; -- 2.54.0 From b1240e13872509f1806924ec9b3df653510088f2 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 Apr 2026 23:02:25 +0200 Subject: [PATCH 2/2] aes-siv: update the comment to mention the max number of AD inputs --- lib/std/crypto/aes_siv.zig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/std/crypto/aes_siv.zig b/lib/std/crypto/aes_siv.zig index b58f24bf480c95a8f42591c25fd27368dfeeb6ca..b3be102831e902f61864a67ca304b01dfa73c32a 100644 --- a/lib/std/crypto/aes_siv.zig +++ b/lib/std/crypto/aes_siv.zig @@ -226,7 +226,7 @@ fn AesSiv(comptime Aes: anytype) type { /// Encrypts plaintext with multiple associated data components. /// This is the most general form of AES-SIV encryption that accepts - /// an arbitrary vector of associated data strings as specified in RFC 5297. + /// a vector of up to 126 associated data strings as specified in RFC 5297. pub fn encryptWithAdVector(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const []const u8, key: [key_length]u8) void { debug.assert(c.len == m.len); debug.assert(ad.len <= 126); // AES-SIV supports at most 126 associated data components @@ -261,7 +261,7 @@ fn AesSiv(comptime Aes: anytype) type { /// Decrypts ciphertext with multiple associated data components. /// This is the most general form of AES-SIV decryption that accepts - /// an arbitrary vector of associated data strings as specified in RFC 5297. + /// a vector of up to 126 associated data strings as specified in RFC 5297. pub fn decryptWithAdVector(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const []const u8, key: [key_length]u8) AuthenticationError!void { assert(c.len == m.len); assert(ad.len <= 126); // AES-SIV supports at most 126 associated data components -- 2.54.0