authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-10-26 08:44:40+01:00
committergravatar for git@vexu.euVeikka Tuominen <git@vexu.eu> 2020-10-28 21:43:15+02:00
logea45897fcc5097c4cf73a30fe009500f6efe8bc5
tree9b1af4e7f204b7502e15c1eaa9796876ee7d6352
parent6d2f103bfb8931e2e65ca7f79d62389b69781492

PascalCase *box names, remove unneeded comptime & parenthesis

Also rename (salsa20|chacha20)Internal() to a better name. And sort reexported crypto.* names

3 files changed, 58 insertions(+), 52 deletions(-)

lib/std/crypto.zig+17-11
...@@ -6,13 +6,17 @@...@@ -6,13 +6,17 @@
66
7/// Authenticated Encryption with Associated Data7/// Authenticated Encryption with Associated Data
8pub const aead = struct {8pub const aead = struct {
9 pub const Gimli = @import("crypto/gimli.zig").Aead;
10 pub const ChaCha20Poly1305 = @import("crypto/chacha20.zig").Chacha20Poly1305;
11 pub const XChaCha20Poly1305 = @import("crypto/chacha20.zig").XChacha20Poly1305;
12 pub const Aegis128L = @import("crypto/aegis.zig").Aegis128L;9 pub const Aegis128L = @import("crypto/aegis.zig").Aegis128L;
13 pub const Aegis256 = @import("crypto/aegis.zig").Aegis256;10 pub const Aegis256 = @import("crypto/aegis.zig").Aegis256;
11
14 pub const Aes128Gcm = @import("crypto/aes_gcm.zig").Aes128Gcm;12 pub const Aes128Gcm = @import("crypto/aes_gcm.zig").Aes128Gcm;
15 pub const Aes256Gcm = @import("crypto/aes_gcm.zig").Aes256Gcm;13 pub const Aes256Gcm = @import("crypto/aes_gcm.zig").Aes256Gcm;
14
15 pub const Gimli = @import("crypto/gimli.zig").Aead;
16
17 pub const ChaCha20Poly1305 = @import("crypto/chacha20.zig").Chacha20Poly1305;
18 pub const XChaCha20Poly1305 = @import("crypto/chacha20.zig").XChacha20Poly1305;
19
16 pub const XSalsa20Poly1305 = @import("crypto/salsa20.zig").XSalsa20Poly1305;20 pub const XSalsa20Poly1305 = @import("crypto/salsa20.zig").XSalsa20Poly1305;
17};21};
1822
...@@ -49,13 +53,13 @@ pub const ecc = struct {...@@ -49,13 +53,13 @@ pub const ecc = struct {
4953
50/// Hash functions.54/// Hash functions.
51pub const hash = struct {55pub const hash = struct {
56 pub const blake2 = @import("crypto/blake2.zig");
57 pub const Blake3 = @import("crypto/blake3.zig").Blake3;
58 pub const Gimli = @import("crypto/gimli.zig").Hash;
52 pub const Md5 = @import("crypto/md5.zig").Md5;59 pub const Md5 = @import("crypto/md5.zig").Md5;
53 pub const Sha1 = @import("crypto/sha1.zig").Sha1;60 pub const Sha1 = @import("crypto/sha1.zig").Sha1;
54 pub const sha2 = @import("crypto/sha2.zig");61 pub const sha2 = @import("crypto/sha2.zig");
55 pub const sha3 = @import("crypto/sha3.zig");62 pub const sha3 = @import("crypto/sha3.zig");
56 pub const blake2 = @import("crypto/blake2.zig");
57 pub const Blake3 = @import("crypto/blake3.zig").Blake3;
58 pub const Gimli = @import("crypto/gimli.zig").Hash;
59};63};
6064
61/// Key derivation functions.65/// Key derivation functions.
...@@ -65,8 +69,8 @@ pub const kdf = struct {...@@ -65,8 +69,8 @@ pub const kdf = struct {
6569
66/// MAC functions requiring single-use secret keys.70/// MAC functions requiring single-use secret keys.
67pub const onetimeauth = struct {71pub const onetimeauth = struct {
68 pub const Poly1305 = @import("crypto/poly1305.zig").Poly1305;
69 pub const Ghash = @import("crypto/ghash.zig").Ghash;72 pub const Ghash = @import("crypto/ghash.zig").Ghash;
73 pub const Poly1305 = @import("crypto/poly1305.zig").Poly1305;
70};74};
7175
72/// A password hashing function derives a uniform key from low-entropy input material such as passwords.76/// A password hashing function derives a uniform key from low-entropy input material such as passwords.
...@@ -99,17 +103,19 @@ pub const sign = struct {...@@ -99,17 +103,19 @@ pub const sign = struct {
99/// Most applications should be using AEAD constructions instead of stream ciphers directly.103/// Most applications should be using AEAD constructions instead of stream ciphers directly.
100pub const stream = struct {104pub const stream = struct {
101 pub const ChaCha20IETF = @import("crypto/chacha20.zig").ChaCha20IETF;105 pub const ChaCha20IETF = @import("crypto/chacha20.zig").ChaCha20IETF;
102 pub const XChaCha20IETF = @import("crypto/chacha20.zig").XChaCha20IETF;
103 pub const ChaCha20With64BitNonce = @import("crypto/chacha20.zig").ChaCha20With64BitNonce;106 pub const ChaCha20With64BitNonce = @import("crypto/chacha20.zig").ChaCha20With64BitNonce;
107 pub const XChaCha20IETF = @import("crypto/chacha20.zig").XChaCha20IETF;
108
104 pub const Salsa20 = @import("crypto/salsa20.zig").Salsa20;109 pub const Salsa20 = @import("crypto/salsa20.zig").Salsa20;
105 pub const XSalsa20 = @import("crypto/salsa20.zig").XSalsa20;110 pub const XSalsa20 = @import("crypto/salsa20.zig").XSalsa20;
106};111};
107112
108pub const nacl = struct {113pub const nacl = struct {
109 const salsa20 = @import("crypto/salsa20.zig");114 const salsa20 = @import("crypto/salsa20.zig");
110 pub const box = salsa20.box;115
111 pub const secretBox = salsa20.secretBox;116 pub const Box = salsa20.Box;
112 pub const sealedBox = salsa20.sealedBox;117 pub const SecretBox = salsa20.SecretBox;
118 pub const SealedBox = salsa20.SealedBox;
113};119};
114120
115const std = @import("std.zig");121const std = @import("std.zig");
lib/std/crypto/chacha20.zig+8-8
...@@ -100,7 +100,7 @@ const ChaCha20VecImpl = struct {...@@ -100,7 +100,7 @@ const ChaCha20VecImpl = struct {
100 x[3] +%= ctx[3];100 x[3] +%= ctx[3];
101 }101 }
102102
103 fn chaCha20Internal(out: []u8, in: []const u8, key: [8]u32, counter: [4]u32) void {103 fn chacha20Xor(out: []u8, in: []const u8, key: [8]u32, counter: [4]u32) void {
104 var ctx = initContext(key, counter);104 var ctx = initContext(key, counter);
105 var x: BlockVec = undefined;105 var x: BlockVec = undefined;
106 var buf: [64]u8 = undefined;106 var buf: [64]u8 = undefined;
...@@ -239,7 +239,7 @@ const ChaCha20NonVecImpl = struct {...@@ -239,7 +239,7 @@ const ChaCha20NonVecImpl = struct {
239 }239 }
240 }240 }
241241
242 fn chaCha20Internal(out: []u8, in: []const u8, key: [8]u32, counter: [4]u32) void {242 fn chacha20Xor(out: []u8, in: []const u8, key: [8]u32, counter: [4]u32) void {
243 var ctx = initContext(key, counter);243 var ctx = initContext(key, counter);
244 var x: BlockVec = undefined;244 var x: BlockVec = undefined;
245 var buf: [64]u8 = undefined;245 var buf: [64]u8 = undefined;
...@@ -325,7 +325,7 @@ pub const ChaCha20IETF = struct {...@@ -325,7 +325,7 @@ pub const ChaCha20IETF = struct {
325 c[1] = mem.readIntLittle(u32, nonce[0..4]);325 c[1] = mem.readIntLittle(u32, nonce[0..4]);
326 c[2] = mem.readIntLittle(u32, nonce[4..8]);326 c[2] = mem.readIntLittle(u32, nonce[4..8]);
327 c[3] = mem.readIntLittle(u32, nonce[8..12]);327 c[3] = mem.readIntLittle(u32, nonce[8..12]);
328 ChaCha20Impl.chaCha20Internal(out, in, keyToWords(key), c);328 ChaCha20Impl.chacha20Xor(out, in, keyToWords(key), c);
329 }329 }
330};330};
331331
...@@ -351,7 +351,7 @@ pub const ChaCha20With64BitNonce = struct {...@@ -351,7 +351,7 @@ pub const ChaCha20With64BitNonce = struct {
351351
352 // first partial big block352 // first partial big block
353 if (((@intCast(u64, maxInt(u32) - @truncate(u32, counter)) + 1) << 6) < in.len) {353 if (((@intCast(u64, maxInt(u32) - @truncate(u32, counter)) + 1) << 6) < in.len) {
354 ChaCha20Impl.chaCha20Internal(out[cursor..big_block], in[cursor..big_block], k, c);354 ChaCha20Impl.chacha20Xor(out[cursor..big_block], in[cursor..big_block], k, c);
355 cursor = big_block - cursor;355 cursor = big_block - cursor;
356 c[1] += 1;356 c[1] += 1;
357 if (comptime @sizeOf(usize) > 4) {357 if (comptime @sizeOf(usize) > 4) {
...@@ -359,14 +359,14 @@ pub const ChaCha20With64BitNonce = struct {...@@ -359,14 +359,14 @@ pub const ChaCha20With64BitNonce = struct {
359 var remaining_blocks: u32 = @intCast(u32, (in.len / big_block));359 var remaining_blocks: u32 = @intCast(u32, (in.len / big_block));
360 var i: u32 = 0;360 var i: u32 = 0;
361 while (remaining_blocks > 0) : (remaining_blocks -= 1) {361 while (remaining_blocks > 0) : (remaining_blocks -= 1) {
362 ChaCha20Impl.chaCha20Internal(out[cursor .. cursor + big_block], in[cursor .. cursor + big_block], k, c);362 ChaCha20Impl.chacha20Xor(out[cursor .. cursor + big_block], in[cursor .. cursor + big_block], k, c);
363 c[1] += 1; // upper 32-bit of counter, generic chaCha20Internal() doesn't know about this.363 c[1] += 1; // upper 32-bit of counter, generic chacha20Xor() doesn't know about this.
364 cursor += big_block;364 cursor += big_block;
365 }365 }
366 }366 }
367 }367 }
368368
369 ChaCha20Impl.chaCha20Internal(out[cursor..], in[cursor..], k, c);369 ChaCha20Impl.chacha20Xor(out[cursor..], in[cursor..], k, c);
370 }370 }
371};371};
372372
...@@ -694,7 +694,7 @@ fn chacha20poly1305OpenDetached(dst: []u8, ciphertext: []const u8, tag: *const [...@@ -694,7 +694,7 @@ fn chacha20poly1305OpenDetached(dst: []u8, ciphertext: []const u8, tag: *const [
694 // See https://github.com/ziglang/zig/issues/1776694 // See https://github.com/ziglang/zig/issues/1776
695 var acc: u8 = 0;695 var acc: u8 = 0;
696 for (computedTag) |_, i| {696 for (computedTag) |_, i| {
697 acc |= (computedTag[i] ^ tag[i]);697 acc |= computedTag[i] ^ tag[i];
698 }698 }
699 if (acc != 0) {699 if (acc != 0) {
700 return error.AuthenticationFailed;700 return error.AuthenticationFailed;
lib/std/crypto/salsa20.zig+33-33
...@@ -40,7 +40,7 @@ const Salsa20NonVecImpl = struct {...@@ -40,7 +40,7 @@ const Salsa20NonVecImpl = struct {
40 d: u6,40 d: u6,
41 };41 };
4242
43 inline fn Rp(comptime a: usize, comptime b: usize, comptime c: usize, comptime d: u6) QuarterRound {43 inline fn Rp(a: usize, b: usize, c: usize, d: u6) QuarterRound {
44 return QuarterRound{44 return QuarterRound{
45 .a = a,45 .a = a,
46 .b = b,46 .b = b,
...@@ -82,7 +82,7 @@ const Salsa20NonVecImpl = struct {...@@ -82,7 +82,7 @@ const Salsa20NonVecImpl = struct {
82 }82 }
83 }83 }
8484
85 fn salsa20Internal(out: []u8, in: []const u8, key: [8]u32, d: [4]u32) void {85 fn salsa20Xor(out: []u8, in: []const u8, key: [8]u32, d: [4]u32) void {
86 var ctx = initContext(key, d);86 var ctx = initContext(key, d);
87 var x: BlockVec = undefined;87 var x: BlockVec = undefined;
88 var buf: [64]u8 = undefined;88 var buf: [64]u8 = undefined;
...@@ -174,7 +174,7 @@ pub const Salsa20 = struct {...@@ -174,7 +174,7 @@ pub const Salsa20 = struct {
174 d[1] = mem.readIntLittle(u32, nonce[4..8]);174 d[1] = mem.readIntLittle(u32, nonce[4..8]);
175 d[2] = @truncate(u32, counter);175 d[2] = @truncate(u32, counter);
176 d[3] = @truncate(u32, counter >> 32);176 d[3] = @truncate(u32, counter >> 32);
177 Salsa20Impl.salsa20Internal(out, in, keyToWords(key), d);177 Salsa20Impl.salsa20Xor(out, in, keyToWords(key), d);
178 }178 }
179};179};
180180
...@@ -244,7 +244,7 @@ pub const XSalsa20Poly1305 = struct {...@@ -244,7 +244,7 @@ pub const XSalsa20Poly1305 = struct {
244 mac.final(&computedTag);244 mac.final(&computedTag);
245 var acc: u8 = 0;245 var acc: u8 = 0;
246 for (computedTag) |_, i| {246 for (computedTag) |_, i| {
247 acc |= (computedTag[i] ^ tag[i]);247 acc |= computedTag[i] ^ tag[i];
248 }248 }
249 if (acc != 0) {249 if (acc != 0) {
250 mem.secureZero(u8, &computedTag);250 mem.secureZero(u8, &computedTag);
...@@ -261,7 +261,7 @@ pub const XSalsa20Poly1305 = struct {...@@ -261,7 +261,7 @@ pub const XSalsa20Poly1305 = struct {
261/// A secret key shared by all the recipients must be already known in order to use this API.261/// A secret key shared by all the recipients must be already known in order to use this API.
262///262///
263/// Nonces are 192-bit large and can safely be chosen with a random number generator.263/// Nonces are 192-bit large and can safely be chosen with a random number generator.
264pub const secretBox = struct {264pub const SecretBox = struct {
265 /// Key length in bytes.265 /// Key length in bytes.
266 pub const key_length = XSalsa20Poly1305.key_length;266 pub const key_length = XSalsa20Poly1305.key_length;
267 /// Nonce length in bytes.267 /// Nonce length in bytes.
...@@ -295,7 +295,7 @@ pub const secretBox = struct {...@@ -295,7 +295,7 @@ pub const secretBox = struct {
295/// and is decrypted using the recipient's secret key and the sender's public key.295/// and is decrypted using the recipient's secret key and the sender's public key.
296///296///
297/// Nonces are 192-bit large and can safely be chosen with a random number generator.297/// Nonces are 192-bit large and can safely be chosen with a random number generator.
298pub const box = struct {298pub const Box = struct {
299 /// Public key length in bytes.299 /// Public key length in bytes.
300 pub const public_length = X25519.public_length;300 pub const public_length = X25519.public_length;
301 /// Secret key length in bytes.301 /// Secret key length in bytes.
...@@ -323,13 +323,13 @@ pub const box = struct {...@@ -323,13 +323,13 @@ pub const box = struct {
323 /// Encrypt and authenticate a message using a recipient's public key `public_key` and a sender's `secret_key`.323 /// Encrypt and authenticate a message using a recipient's public key `public_key` and a sender's `secret_key`.
324 pub fn seal(c: []u8, m: []const u8, npub: [nonce_length]u8, public_key: [public_length]u8, secret_key: [secret_length]u8) !void {324 pub fn seal(c: []u8, m: []const u8, npub: [nonce_length]u8, public_key: [public_length]u8, secret_key: [secret_length]u8) !void {
325 const shared_key = try createSharedSecret(public_key, secret_key);325 const shared_key = try createSharedSecret(public_key, secret_key);
326 return secretBox.seal(c, m, npub, shared_key);326 return SecretBox.seal(c, m, npub, shared_key);
327 }327 }
328328
329 /// Verify and decrypt a message using a recipient's secret key `public_key` and a sender's `public_key`.329 /// Verify and decrypt a message using a recipient's secret key `public_key` and a sender's `public_key`.
330 pub fn open(m: []u8, c: []const u8, npub: [nonce_length]u8, public_key: [public_length]u8, secret_key: [secret_length]u8) !void {330 pub fn open(m: []u8, c: []const u8, npub: [nonce_length]u8, public_key: [public_length]u8, secret_key: [secret_length]u8) !void {
331 const shared_key = try createSharedSecret(public_key, secret_key);331 const shared_key = try createSharedSecret(public_key, secret_key);
332 return secretBox.open(m, c, npub, shared_key);332 return SecretBox.open(m, c, npub, shared_key);
333 }333 }
334};334};
335335
...@@ -340,20 +340,20 @@ pub const box = struct {...@@ -340,20 +340,20 @@ pub const box = struct {
340/// While the recipient can verify the integrity of the message, it cannot verify the identity of the sender.340/// While the recipient can verify the integrity of the message, it cannot verify the identity of the sender.
341///341///
342/// A message is encrypted using an ephemeral key pair, whose secret part is destroyed right after the encryption process.342/// A message is encrypted using an ephemeral key pair, whose secret part is destroyed right after the encryption process.
343pub const sealedBox = struct {343pub const SealedBox = struct {
344 pub const public_length = box.public_length;344 pub const public_length = Box.public_length;
345 pub const secret_length = box.secret_length;345 pub const secret_length = Box.secret_length;
346 pub const seed_length = box.seed_length;346 pub const seed_length = Box.seed_length;
347 pub const seal_length = box.public_length + box.tag_length;347 pub const seal_length = Box.public_length + Box.tag_length;
348348
349 /// A key pair.349 /// A key pair.
350 pub const KeyPair = box.KeyPair;350 pub const KeyPair = Box.KeyPair;
351351
352 fn createNonce(pk1: [public_length]u8, pk2: [public_length]u8) [box.nonce_length]u8 {352 fn createNonce(pk1: [public_length]u8, pk2: [public_length]u8) [Box.nonce_length]u8 {
353 var hasher = Blake2b(box.nonce_length * 8).init(.{});353 var hasher = Blake2b(Box.nonce_length * 8).init(.{});
354 hasher.update(&pk1);354 hasher.update(&pk1);
355 hasher.update(&pk2);355 hasher.update(&pk2);
356 var nonce: [box.nonce_length]u8 = undefined;356 var nonce: [Box.nonce_length]u8 = undefined;
357 hasher.final(&nonce);357 hasher.final(&nonce);
358 return nonce;358 return nonce;
359 }359 }
...@@ -365,7 +365,7 @@ pub const sealedBox = struct {...@@ -365,7 +365,7 @@ pub const sealedBox = struct {
365 var ekp = try KeyPair.create(null);365 var ekp = try KeyPair.create(null);
366 const nonce = createNonce(ekp.public_key, public_key);366 const nonce = createNonce(ekp.public_key, public_key);
367 mem.copy(u8, c[0..public_length], ekp.public_key[0..]);367 mem.copy(u8, c[0..public_length], ekp.public_key[0..]);
368 try box.seal(c[box.public_length..], m, nonce, public_key, ekp.secret_key);368 try Box.seal(c[Box.public_length..], m, nonce, public_key, ekp.secret_key);
369 mem.secureZero(u8, ekp.secret_key[0..]);369 mem.secureZero(u8, ekp.secret_key[0..]);
370 }370 }
371371
...@@ -377,7 +377,7 @@ pub const sealedBox = struct {...@@ -377,7 +377,7 @@ pub const sealedBox = struct {
377 }377 }
378 const epk = c[0..public_length];378 const epk = c[0..public_length];
379 const nonce = createNonce(epk.*, keypair.public_key);379 const nonce = createNonce(epk.*, keypair.public_key);
380 return box.open(m, c[public_length..], nonce, epk.*, keypair.secret_key);380 return Box.open(m, c[public_length..], nonce, epk.*, keypair.secret_key);
381 }381 }
382};382};
383383
...@@ -400,37 +400,37 @@ test "xsalsa20poly1305 secretbox" {...@@ -400,37 +400,37 @@ test "xsalsa20poly1305 secretbox" {
400 var msg: [100]u8 = undefined;400 var msg: [100]u8 = undefined;
401 var msg2: [msg.len]u8 = undefined;401 var msg2: [msg.len]u8 = undefined;
402 var key: [XSalsa20Poly1305.key_length]u8 = undefined;402 var key: [XSalsa20Poly1305.key_length]u8 = undefined;
403 var nonce: [box.nonce_length]u8 = undefined;403 var nonce: [Box.nonce_length]u8 = undefined;
404 var boxed: [msg.len + box.tag_length]u8 = undefined;404 var boxed: [msg.len + Box.tag_length]u8 = undefined;
405 try crypto.randomBytes(&msg);405 try crypto.randomBytes(&msg);
406 try crypto.randomBytes(&key);406 try crypto.randomBytes(&key);
407 try crypto.randomBytes(&nonce);407 try crypto.randomBytes(&nonce);
408408
409 secretBox.seal(boxed[0..], msg[0..], nonce, key);409 SecretBox.seal(boxed[0..], msg[0..], nonce, key);
410 try secretBox.open(msg2[0..], boxed[0..], nonce, key);410 try SecretBox.open(msg2[0..], boxed[0..], nonce, key);
411}411}
412412
413test "xsalsa20poly1305 box" {413test "xsalsa20poly1305 box" {
414 var msg: [100]u8 = undefined;414 var msg: [100]u8 = undefined;
415 var msg2: [msg.len]u8 = undefined;415 var msg2: [msg.len]u8 = undefined;
416 var nonce: [box.nonce_length]u8 = undefined;416 var nonce: [Box.nonce_length]u8 = undefined;
417 var boxed: [msg.len + box.tag_length]u8 = undefined;417 var boxed: [msg.len + Box.tag_length]u8 = undefined;
418 try crypto.randomBytes(&msg);418 try crypto.randomBytes(&msg);
419 try crypto.randomBytes(&nonce);419 try crypto.randomBytes(&nonce);
420420
421 var kp1 = try box.KeyPair.create(null);421 var kp1 = try Box.KeyPair.create(null);
422 var kp2 = try box.KeyPair.create(null);422 var kp2 = try Box.KeyPair.create(null);
423 try box.seal(boxed[0..], msg[0..], nonce, kp1.public_key, kp2.secret_key);423 try Box.seal(boxed[0..], msg[0..], nonce, kp1.public_key, kp2.secret_key);
424 try box.open(msg2[0..], boxed[0..], nonce, kp2.public_key, kp1.secret_key);424 try Box.open(msg2[0..], boxed[0..], nonce, kp2.public_key, kp1.secret_key);
425}425}
426426
427test "xsalsa20poly1305 sealedbox" {427test "xsalsa20poly1305 sealedbox" {
428 var msg: [100]u8 = undefined;428 var msg: [100]u8 = undefined;
429 var msg2: [msg.len]u8 = undefined;429 var msg2: [msg.len]u8 = undefined;
430 var boxed: [msg.len + sealedBox.seal_length]u8 = undefined;430 var boxed: [msg.len + SealedBox.seal_length]u8 = undefined;
431 try crypto.randomBytes(&msg);431 try crypto.randomBytes(&msg);
432432
433 var kp = try box.KeyPair.create(null);433 var kp = try Box.KeyPair.create(null);
434 try sealedBox.seal(boxed[0..], msg[0..], kp.public_key);434 try SealedBox.seal(boxed[0..], msg[0..], kp.public_key);
435 try sealedBox.open(msg2[0..], boxed[0..], kp);435 try SealedBox.open(msg2[0..], boxed[0..], kp);
436}436}