authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-02-17 18:56:09+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2025-02-17 17:56:09+00:00
log55c46870b23ac16670beaa3ff1c082b703738307
tree41c94888341184b9205b8adf769ec7e386fddfc6
parent1b62469ec93f78dbcebc90187eb9be795986d66f
signaturebadge-check Signed by PGP key B5690EEEBB952194

crypto.auth.Aegis128X*Mac: properly absorb tags in the first lane (#22922)

In the MAC finalization function, concatenated tags at odd positions were not absorbed into the correct lane. Spotted by a Tigerbeetle regression test and reported by Rafael Batiati (@batiati) — Thanks!

1 files changed, 8 insertions(+), 6 deletions(-)

lib/std/crypto/aegis.zig+8-6
...@@ -219,7 +219,8 @@ fn State128X(comptime degree: u7) type {...@@ -219,7 +219,8 @@ fn State128X(comptime degree: u7) type {
219 128 => {219 128 => {
220 const tags = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();220 const tags = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();
221 for (0..degree / 2) |d| {221 for (0..degree / 2) |d| {
222 v[0..32].* = tags[d * 32 ..][0..32].*;222 v[0..16].* = tags[d * 32 ..][0..16].*;
223 v[rate / 2 ..][0..16].* = tags[d * 32 ..][16..32].*;
223 state.absorb(&v);224 state.absorb(&v);
224 }225 }
225 },226 },
...@@ -227,7 +228,8 @@ fn State128X(comptime degree: u7) type {...@@ -227,7 +228,8 @@ fn State128X(comptime degree: u7) type {
227 const tags_0 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();228 const tags_0 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();
228 const tags_1 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();229 const tags_1 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();
229 for (1..degree) |d| {230 for (1..degree) |d| {
230 v[0..32].* = tags_0[d * 16 ..][0..16].* ++ tags_1[d * 16 ..][0..16].*;231 v[0..16].* = tags_0[d * 16 ..][0..16].*;
232 v[rate / 2 ..][0..16].* = tags_1[d * 16 ..][0..16].*;
231 state.absorb(&v);233 state.absorb(&v);
232 }234 }
233 },235 },
...@@ -1013,13 +1015,13 @@ test "AEGISMAC-128* test vectors" {...@@ -1013,13 +1015,13 @@ test "AEGISMAC-128* test vectors" {
10131015
1014 Aegis128X2Mac.createWithNonce(&mac256, &msg, &key, &nonce);1016 Aegis128X2Mac.createWithNonce(&mac256, &msg, &key, &nonce);
1015 Aegis128X2Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);1017 Aegis128X2Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1016 try htest.assertEqual("7aa41edfd57a95c1108d83c63b8d4d01", &mac128);1018 try htest.assertEqual("6873ee34e6b5c59143b6d35c5e4f2c6e", &mac128);
1017 try htest.assertEqual("55b6449929cd2b01d04786e57698b3ddfb5cbf6e421bbd022637a33d60f40294", &mac256);1019 try htest.assertEqual("afcba3fc2d63c8d6c7f2d63f3ec8fbbbaf022e15ac120e78ffa7755abccd959c", &mac256);
10181020
1019 Aegis128X4Mac.createWithNonce(&mac256, &msg, &key, &nonce);1021 Aegis128X4Mac.createWithNonce(&mac256, &msg, &key, &nonce);
1020 Aegis128X4Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);1022 Aegis128X4Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1021 try htest.assertEqual("46a194ea4337bb32c2186a99e312f3a7", &mac128);1023 try htest.assertEqual("c45a98fd9ab8956ce616eb008cfe4e53", &mac128);
1022 try htest.assertEqual("ea884072699569532fb68ae9fb2653c9ffef3e974333d3a17d77be02453cc12f", &mac256);1024 try htest.assertEqual("26fdc76f41b1da7aec7779f6e964beae8904e662f05aca8345ae3befb357412a", &mac256);
1023}1025}
10241026
1025test "AEGISMAC-256* test vectors" {1027test "AEGISMAC-256* test vectors" {