authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-25 20:17:56+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-26 10:50:34+02:00
logff2e82f382b253ca50977d16fe58865e0de3223f
treea1a86e1ebf5d30c9a75f24501cd67313c9668805
parentb8729ca1a07863a0413b90206b82c1a0794abbd5

Rename `at` to `tag` in AEADs

2 files changed, 38 insertions(+), 38 deletions(-)

lib/std/crypto/chacha20.zig+12-12
...@@ -744,26 +744,26 @@ pub const Chacha20Poly1305 = struct {...@@ -744,26 +744,26 @@ pub const Chacha20Poly1305 = struct {
744 pub const key_length = 32;744 pub const key_length = 32;
745745
746 /// c: ciphertext: output buffer should be of size m.len746 /// c: ciphertext: output buffer should be of size m.len
747 /// at: authentication tag: output MAC747 /// tag: authentication tag: output MAC
748 /// m: message748 /// m: message
749 /// ad: Associated Data749 /// ad: Associated Data
750 /// npub: public nonce750 /// npub: public nonce
751 /// k: private key751 /// k: private key
752 pub fn encrypt(c: []u8, at: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {752 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
753 assert(c.len == m.len);753 assert(c.len == m.len);
754 return chacha20poly1305SealDetached(c, at, m, ad, k, npub);754 return chacha20poly1305SealDetached(c, tag, m, ad, k, npub);
755 }755 }
756756
757 /// m: message: output buffer should be of size c.len757 /// m: message: output buffer should be of size c.len
758 /// c: ciphertext758 /// c: ciphertext
759 /// at: authentication tag759 /// tag: authentication tag
760 /// ad: Associated Data760 /// ad: Associated Data
761 /// npub: public nonce761 /// npub: public nonce
762 /// k: private key762 /// k: private key
763 /// NOTE: the check of the authentication tag is currently not done in constant time763 /// NOTE: the check of the authentication tag is currently not done in constant time
764 pub fn decrypt(m: []u8, c: []const u8, at: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {764 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
765 assert(c.len == m.len);765 assert(c.len == m.len);
766 return try chacha20poly1305OpenDetached(m, c, at[0..], ad, k, npub);766 return try chacha20poly1305OpenDetached(m, c, tag[0..], ad, k, npub);
767 }767 }
768};768};
769769
...@@ -773,26 +773,26 @@ pub const XChacha20Poly1305 = struct {...@@ -773,26 +773,26 @@ pub const XChacha20Poly1305 = struct {
773 pub const key_length = 32;773 pub const key_length = 32;
774774
775 /// c: ciphertext: output buffer should be of size m.len775 /// c: ciphertext: output buffer should be of size m.len
776 /// at: authentication tag: output MAC776 /// tag: authentication tag: output MAC
777 /// m: message777 /// m: message
778 /// ad: Associated Data778 /// ad: Associated Data
779 /// npub: public nonce779 /// npub: public nonce
780 /// k: private key780 /// k: private key
781 pub fn encrypt(c: []u8, at: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {781 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
782 assert(c.len == m.len);782 assert(c.len == m.len);
783 return xchacha20poly1305SealDetached(c, at, m, ad, k, npub);783 return xchacha20poly1305SealDetached(c, tag, m, ad, k, npub);
784 }784 }
785785
786 /// m: message: output buffer should be of size c.len786 /// m: message: output buffer should be of size c.len
787 /// c: ciphertext787 /// c: ciphertext
788 /// at: authentication tag788 /// tag: authentication tag
789 /// ad: Associated Data789 /// ad: Associated Data
790 /// npub: public nonce790 /// npub: public nonce
791 /// k: private key791 /// k: private key
792 /// NOTE: the check of the authentication tag is currently not done in constant time792 /// NOTE: the check of the authentication tag is currently not done in constant time
793 pub fn decrypt(m: []u8, c: []const u8, at: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {793 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
794 assert(c.len == m.len);794 assert(c.len == m.len);
795 return try xchacha20poly1305OpenDetached(m, c, at[0..], ad, k, npub);795 return try xchacha20poly1305OpenDetached(m, c, tag[0..], ad, k, npub);
796 }796 }
797};797};
798798
lib/std/crypto/gimli.zig+26-26
...@@ -228,12 +228,12 @@ pub const Aead = struct {...@@ -228,12 +228,12 @@ pub const Aead = struct {
228 }228 }
229229
230 /// c: ciphertext: output buffer should be of size m.len230 /// c: ciphertext: output buffer should be of size m.len
231 /// at: authentication tag: output MAC231 /// tag: authentication tag: output MAC
232 /// m: message232 /// m: message
233 /// ad: Associated Data233 /// ad: Associated Data
234 /// npub: public nonce234 /// npub: public nonce
235 /// k: private key235 /// k: private key
236 pub fn encrypt(c: []u8, at: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {236 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
237 assert(c.len == m.len);237 assert(c.len == m.len);
238238
239 var state = Aead.init(ad, npub, k);239 var state = Aead.init(ad, npub, k);
...@@ -269,17 +269,17 @@ pub const Aead = struct {...@@ -269,17 +269,17 @@ pub const Aead = struct {
269269
270 // After the final non-full block of plaintext, the first 16 bytes270 // After the final non-full block of plaintext, the first 16 bytes
271 // of the state are output as an authentication tag.271 // of the state are output as an authentication tag.
272 std.mem.copy(u8, at, buf[0..State.RATE]);272 std.mem.copy(u8, tag, buf[0..State.RATE]);
273 }273 }
274274
275 /// m: message: output buffer should be of size c.len275 /// m: message: output buffer should be of size c.len
276 /// c: ciphertext276 /// c: ciphertext
277 /// at: authentication tag277 /// tag: authentication tag
278 /// ad: Associated Data278 /// ad: Associated Data
279 /// npub: public nonce279 /// npub: public nonce
280 /// k: private key280 /// k: private key
281 /// NOTE: the check of the authentication tag is currently not done in constant time281 /// NOTE: the check of the authentication tag is currently not done in constant time
282 pub fn decrypt(m: []u8, c: []const u8, at: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {282 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
283 assert(c.len == m.len);283 assert(c.len == m.len);
284284
285 var state = Aead.init(ad, npub, k);285 var state = Aead.init(ad, npub, k);
...@@ -312,7 +312,7 @@ pub const Aead = struct {...@@ -312,7 +312,7 @@ pub const Aead = struct {
312 // After the final non-full block of plaintext, the first 16 bytes312 // After the final non-full block of plaintext, the first 16 bytes
313 // of the state are the authentication tag.313 // of the state are the authentication tag.
314 // TODO: use a constant-time equality check here, see https://github.com/ziglang/zig/issues/1776314 // TODO: use a constant-time equality check here, see https://github.com/ziglang/zig/issues/1776
315 if (!mem.eql(u8, buf[0..State.RATE], &at)) {315 if (!mem.eql(u8, buf[0..State.RATE], &tag)) {
316 @memset(m.ptr, undefined, m.len);316 @memset(m.ptr, undefined, m.len);
317 return error.InvalidMessage;317 return error.InvalidMessage;
318 }318 }
...@@ -332,13 +332,13 @@ test "cipher" {...@@ -332,13 +332,13 @@ test "cipher" {
332 const pt: [0]u8 = undefined;332 const pt: [0]u8 = undefined;
333333
334 var ct: [pt.len]u8 = undefined;334 var ct: [pt.len]u8 = undefined;
335 var at: [16]u8 = undefined;335 var tag: [16]u8 = undefined;
336 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);336 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
337 htest.assertEqual("", &ct);337 htest.assertEqual("", &ct);
338 htest.assertEqual("14DA9BB7120BF58B985A8E00FDEBA15B", &at);338 htest.assertEqual("14DA9BB7120BF58B985A8E00FDEBA15B", &tag);
339339
340 var pt2: [pt.len]u8 = undefined;340 var pt2: [pt.len]u8 = undefined;
341 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);341 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
342 testing.expectEqualSlices(u8, &pt, &pt2);342 testing.expectEqualSlices(u8, &pt, &pt2);
343 }343 }
344 { // test vector (34) from NIST KAT submission.344 { // test vector (34) from NIST KAT submission.
...@@ -347,13 +347,13 @@ test "cipher" {...@@ -347,13 +347,13 @@ test "cipher" {
347 try std.fmt.hexToBytes(&pt, "00");347 try std.fmt.hexToBytes(&pt, "00");
348348
349 var ct: [pt.len]u8 = undefined;349 var ct: [pt.len]u8 = undefined;
350 var at: [16]u8 = undefined;350 var tag: [16]u8 = undefined;
351 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);351 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
352 htest.assertEqual("7F", &ct);352 htest.assertEqual("7F", &ct);
353 htest.assertEqual("80492C317B1CD58A1EDC3A0D3E9876FC", &at);353 htest.assertEqual("80492C317B1CD58A1EDC3A0D3E9876FC", &tag);
354354
355 var pt2: [pt.len]u8 = undefined;355 var pt2: [pt.len]u8 = undefined;
356 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);356 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
357 testing.expectEqualSlices(u8, &pt, &pt2);357 testing.expectEqualSlices(u8, &pt, &pt2);
358 }358 }
359 { // test vector (106) from NIST KAT submission.359 { // test vector (106) from NIST KAT submission.
...@@ -363,13 +363,13 @@ test "cipher" {...@@ -363,13 +363,13 @@ test "cipher" {
363 try std.fmt.hexToBytes(&pt, "000102");363 try std.fmt.hexToBytes(&pt, "000102");
364364
365 var ct: [pt.len]u8 = undefined;365 var ct: [pt.len]u8 = undefined;
366 var at: [16]u8 = undefined;366 var tag: [16]u8 = undefined;
367 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);367 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
368 htest.assertEqual("484D35", &ct);368 htest.assertEqual("484D35", &ct);
369 htest.assertEqual("030BBEA23B61C00CED60A923BDCF9147", &at);369 htest.assertEqual("030BBEA23B61C00CED60A923BDCF9147", &tag);
370370
371 var pt2: [pt.len]u8 = undefined;371 var pt2: [pt.len]u8 = undefined;
372 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);372 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
373 testing.expectEqualSlices(u8, &pt, &pt2);373 testing.expectEqualSlices(u8, &pt, &pt2);
374 }374 }
375 { // test vector (790) from NIST KAT submission.375 { // test vector (790) from NIST KAT submission.
...@@ -379,13 +379,13 @@ test "cipher" {...@@ -379,13 +379,13 @@ test "cipher" {
379 try std.fmt.hexToBytes(&pt, "000102030405060708090A0B0C0D0E0F10111213141516");379 try std.fmt.hexToBytes(&pt, "000102030405060708090A0B0C0D0E0F10111213141516");
380380
381 var ct: [pt.len]u8 = undefined;381 var ct: [pt.len]u8 = undefined;
382 var at: [16]u8 = undefined;382 var tag: [16]u8 = undefined;
383 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);383 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
384 htest.assertEqual("6815B4A0ECDAD01596EAD87D9E690697475D234C6A13D1", &ct);384 htest.assertEqual("6815B4A0ECDAD01596EAD87D9E690697475D234C6A13D1", &ct);
385 htest.assertEqual("DFE23F1642508290D68245279558B2FB", &at);385 htest.assertEqual("DFE23F1642508290D68245279558B2FB", &tag);
386386
387 var pt2: [pt.len]u8 = undefined;387 var pt2: [pt.len]u8 = undefined;
388 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);388 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
389 testing.expectEqualSlices(u8, &pt, &pt2);389 testing.expectEqualSlices(u8, &pt, &pt2);
390 }390 }
391 { // test vector (1057) from NIST KAT submission.391 { // test vector (1057) from NIST KAT submission.
...@@ -394,13 +394,13 @@ test "cipher" {...@@ -394,13 +394,13 @@ test "cipher" {
394 try std.fmt.hexToBytes(&pt, "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");394 try std.fmt.hexToBytes(&pt, "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
395395
396 var ct: [pt.len]u8 = undefined;396 var ct: [pt.len]u8 = undefined;
397 var at: [16]u8 = undefined;397 var tag: [16]u8 = undefined;
398 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);398 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
399 htest.assertEqual("7F8A2CF4F52AA4D6B2E74105C30A2777B9D0C8AEFDD555DE35861BD3011F652F", &ct);399 htest.assertEqual("7F8A2CF4F52AA4D6B2E74105C30A2777B9D0C8AEFDD555DE35861BD3011F652F", &ct);
400 htest.assertEqual("7256456FA935AC34BBF55AE135F33257", &at);400 htest.assertEqual("7256456FA935AC34BBF55AE135F33257", &tag);
401401
402 var pt2: [pt.len]u8 = undefined;402 var pt2: [pt.len]u8 = undefined;
403 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);403 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
404 testing.expectEqualSlices(u8, &pt, &pt2);404 testing.expectEqualSlices(u8, &pt, &pt2);
405 }405 }
406}406}