authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-09-28 14:50:00+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-09-29 17:10:04+02:00
logbb1c6bc376f1a30d6dadd4aebcd1ebec6b4c8621
tree7478e670edceb767c4d2fcf78550f821c782ed07
parent9f274e1f7df65472b0b312cbb6a559ebbaae7e1b

Add AEGIS-256 as well

3 files changed, 231 insertions(+), 11 deletions(-)

lib/std/crypto.zig+1
......@@ -29,6 +29,7 @@ pub const aead = struct {
2929 pub const ChaCha20Poly1305 = chacha20.Chacha20Poly1305;
3030 pub const XChaCha20Poly1305 = chacha20.XChacha20Poly1305;
3131 pub const AEGIS128L = @import("crypto/aegis.zig").AEGIS128L;
32 pub const AEGIS256 = @import("crypto/aegis.zig").AEGIS256;
3233};
3334
3435/// MAC functions requiring single-use secret keys.
lib/std/crypto/aegis.zig+228-10
......@@ -3,10 +3,10 @@ const mem = std.mem;
33const assert = std.debug.assert;
44const AESBlock = std.crypto.core.aes.Block;
55
6const State = struct {
6const State128L = struct {
77 blocks: [8]AESBlock,
88
9 fn init(key: [16]u8, nonce: [16]u8) State {
9 fn init(key: [16]u8, nonce: [16]u8) State128L {
1010 const c1 = AESBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
1111 const c2 = AESBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
1212 const key_block = AESBlock.fromBytes(&key);
......@@ -21,7 +21,7 @@ const State = struct {
2121 key_block.xorBlocks(c1),
2222 key_block.xorBlocks(c2),
2323 };
24 var state = State{ .blocks = blocks };
24 var state = State128L{ .blocks = blocks };
2525 var i: usize = 0;
2626 while (i < 10) : (i += 1) {
2727 state.update(nonce_block, key_block);
......@@ -29,7 +29,7 @@ const State = struct {
2929 return state;
3030 }
3131
32 inline fn update(state: *State, d1: AESBlock, d2: AESBlock) void {
32 inline fn update(state: *State128L, d1: AESBlock, d2: AESBlock) void {
3333 const blocks = &state.blocks;
3434 const tmp = blocks[7];
3535 comptime var i: usize = 7;
......@@ -41,7 +41,7 @@ const State = struct {
4141 blocks[4] = blocks[4].xorBlocks(d2);
4242 }
4343
44 fn enc(state: *State, dst: []u8, src: []const u8) void {
44 fn enc(state: *State128L, dst: *[32]u8, src: *const [32]u8) void {
4545 const blocks = &state.blocks;
4646 const msg0 = AESBlock.fromBytes(src[0..16]);
4747 const msg1 = AESBlock.fromBytes(src[16..32]);
......@@ -54,7 +54,7 @@ const State = struct {
5454 state.update(msg0, msg1);
5555 }
5656
57 fn dec(state: *State, dst: []u8, src: []const u8) void {
57 fn dec(state: *State128L, dst: *[32]u8, src: *const [32]u8) void {
5858 const blocks = &state.blocks;
5959 var msg0 = AESBlock.fromBytes(src[0..16]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);
6060 var msg1 = AESBlock.fromBytes(src[16..32]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);
......@@ -65,7 +65,7 @@ const State = struct {
6565 state.update(msg0, msg1);
6666 }
6767
68 fn mac(state: *State, adlen: usize, mlen: usize) [16]u8 {
68 fn mac(state: *State128L, adlen: usize, mlen: usize) [16]u8 {
6969 const blocks = &state.blocks;
7070 var sizes: [16]u8 = undefined;
7171 mem.writeIntLittle(u64, sizes[0..8], adlen * 8);
......@@ -99,7 +99,7 @@ pub const AEGIS128L = struct {
9999 /// k: private key
100100 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
101101 assert(c.len == m.len);
102 var state = State.init(key, npub);
102 var state = State128L.init(key, npub);
103103 var src: [32]u8 align(16) = undefined;
104104 var dst: [32]u8 align(16) = undefined;
105105 var i: usize = 0;
......@@ -132,7 +132,7 @@ pub const AEGIS128L = struct {
132132 /// k: private key
133133 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) !void {
134134 assert(c.len == m.len);
135 var state = State.init(key, npub);
135 var state = State128L.init(key, npub);
136136 var src: [32]u8 align(16) = undefined;
137137 var dst: [32]u8 align(16) = undefined;
138138 var i: usize = 0;
......@@ -170,10 +170,171 @@ pub const AEGIS128L = struct {
170170 }
171171};
172172
173const State256 = struct {
174 blocks: [6]AESBlock,
175
176 fn init(key: [32]u8, nonce: [32]u8) State256 {
177 const c1 = AESBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
178 const c2 = AESBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
179 const key_block1 = AESBlock.fromBytes(key[0..16]);
180 const key_block2 = AESBlock.fromBytes(key[16..32]);
181 const nonce_block1 = AESBlock.fromBytes(nonce[0..16]);
182 const nonce_block2 = AESBlock.fromBytes(nonce[16..32]);
183 const kxn1 = key_block1.xorBlocks(nonce_block1);
184 const kxn2 = key_block2.xorBlocks(nonce_block2);
185 const blocks = [6]AESBlock{
186 kxn1,
187 kxn2,
188 c1,
189 c2,
190 key_block1.xorBlocks(c2),
191 key_block2.xorBlocks(c1),
192 };
193 var state = State256{ .blocks = blocks };
194 var i: usize = 0;
195 while (i < 4) : (i += 1) {
196 state.update(key_block1);
197 state.update(key_block2);
198 state.update(kxn1);
199 state.update(kxn2);
200 }
201 return state;
202 }
203
204 inline fn update(state: *State256, d: AESBlock) void {
205 const blocks = &state.blocks;
206 const tmp = blocks[5].encrypt(blocks[0]);
207 comptime var i: usize = 5;
208 inline while (i > 0) : (i -= 1) {
209 blocks[i] = blocks[i - 1].encrypt(blocks[i]);
210 }
211 blocks[0] = tmp.xorBlocks(d);
212 }
213
214 fn enc(state: *State256, dst: *[16]u8, src: *const [16]u8) void {
215 const blocks = &state.blocks;
216 const msg = AESBlock.fromBytes(src);
217 var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
218 tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3]));
219 dst.* = tmp.toBytes();
220 state.update(msg);
221 }
222
223 fn dec(state: *State256, dst: *[16]u8, src: *const [16]u8) void {
224 const blocks = &state.blocks;
225 var msg = AESBlock.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
226 msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3]));
227 dst.* = msg.toBytes();
228 state.update(msg);
229 }
230
231 fn mac(state: *State256, adlen: usize, mlen: usize) [16]u8 {
232 const blocks = &state.blocks;
233 var sizes: [16]u8 = undefined;
234 mem.writeIntLittle(u64, sizes[0..8], adlen * 8);
235 mem.writeIntLittle(u64, sizes[8..16], mlen * 8);
236 const tmp = AESBlock.fromBytes(&sizes).xorBlocks(blocks[3]);
237 var i: usize = 0;
238 while (i < 7) : (i += 1) {
239 state.update(tmp);
240 }
241 return blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).
242 xorBlocks(blocks[5]).toBytes();
243 }
244};
245
246/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.
247///
248/// The 256 bit variant of AEGIS has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks.
249///
250/// https://eprint.iacr.org/2013/695.pdf
251pub const AEGIS256 = struct {
252 pub const tag_length = 16;
253 pub const nonce_length = 32;
254 pub const key_length = 32;
255
256 /// c: ciphertext: output buffer should be of size m.len
257 /// tag: authentication tag: output MAC
258 /// m: message
259 /// ad: Associated Data
260 /// npub: public nonce
261 /// k: private key
262 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
263 assert(c.len == m.len);
264 var state = State256.init(key, npub);
265 var src: [16]u8 align(16) = undefined;
266 var dst: [16]u8 align(16) = undefined;
267 var i: usize = 0;
268 while (i + 16 <= ad.len) : (i += 16) {
269 state.enc(&dst, ad[i..][0..16]);
270 }
271 if (ad.len % 16 != 0) {
272 mem.set(u8, src[0..], 0);
273 mem.copy(u8, src[0 .. ad.len % 16], ad[i .. i + ad.len % 16]);
274 state.enc(&dst, &src);
275 }
276 i = 0;
277 while (i + 16 <= m.len) : (i += 16) {
278 state.enc(c[i..][0..16], m[i..][0..16]);
279 }
280 if (m.len % 16 != 0) {
281 mem.set(u8, src[0..], 0);
282 mem.copy(u8, src[0 .. m.len % 16], m[i .. i + m.len % 16]);
283 state.enc(&dst, &src);
284 mem.copy(u8, c[i .. i + m.len % 16], dst[0 .. m.len % 16]);
285 }
286 tag.* = state.mac(ad.len, m.len);
287 }
288
289 /// m: message: output buffer should be of size c.len
290 /// c: ciphertext
291 /// tag: authentication tag
292 /// ad: Associated Data
293 /// npub: public nonce
294 /// k: private key
295 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) !void {
296 assert(c.len == m.len);
297 var state = State256.init(key, npub);
298 var src: [16]u8 align(16) = undefined;
299 var dst: [16]u8 align(16) = undefined;
300 var i: usize = 0;
301 while (i + 16 <= ad.len) : (i += 16) {
302 state.enc(&dst, ad[i..][0..16]);
303 }
304 if (ad.len % 16 != 0) {
305 mem.set(u8, src[0..], 0);
306 mem.copy(u8, src[0 .. ad.len % 16], ad[i .. i + ad.len % 16]);
307 state.enc(&dst, &src);
308 }
309 i = 0;
310 while (i + 16 <= m.len) : (i += 16) {
311 state.dec(m[i..][0..16], c[i..][0..16]);
312 }
313 if (m.len % 16 != 0) {
314 mem.set(u8, src[0..], 0);
315 mem.copy(u8, src[0 .. m.len % 16], c[i .. i + m.len % 16]);
316 state.dec(&dst, &src);
317 mem.copy(u8, m[i .. i + m.len % 16], dst[0 .. m.len % 16]);
318 mem.set(u8, dst[0 .. m.len % 16], 0);
319 const blocks = &state.blocks;
320 blocks[0] = blocks[0].xorBlocks(AESBlock.fromBytes(&dst));
321 }
322 const computed_tag = state.mac(ad.len, m.len);
323 var acc: u8 = 0;
324 for (computed_tag) |_, j| {
325 acc |= (computed_tag[j] ^ tag[j]);
326 }
327 if (acc != 0) {
328 mem.set(u8, m, 0xaa);
329 return error.AuthenticationFailed;
330 }
331 }
332};
333
173334const htest = @import("test.zig");
174335const testing = std.testing;
175336
176test "AEGIS128L" {
337test "AEGIS128L test vector 1" {
177338 const key: [AEGIS128L.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 14;
178339 const nonce: [AEGIS128L.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 13;
179340 const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 };
......@@ -195,3 +356,60 @@ test "AEGIS128L" {
195356 tag[0] +%= 1;
196357 testing.expectError(error.AuthenticationFailed, AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key));
197358}
359
360test "AEGIS128L test vector 2" {
361 const key: [AEGIS128L.key_length]u8 = [_]u8{0x00} ** 16;
362 const nonce: [AEGIS128L.nonce_length]u8 = [_]u8{0x00} ** 16;
363 const ad = [_]u8{};
364 const m = [_]u8{0x00} ** 16;
365 var c: [m.len]u8 = undefined;
366 var m2: [m.len]u8 = undefined;
367 var tag: [AEGIS128L.tag_length]u8 = undefined;
368
369 AEGIS128L.encrypt(&c, &tag, &m, &ad, nonce, key);
370 try AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key);
371 testing.expectEqualSlices(u8, &m, &m2);
372
373 htest.assertEqual("41de9000a7b5e40e2d68bb64d99ebb19", &c);
374 htest.assertEqual("f4d997cc9b94227ada4fe4165422b1c8", &tag);
375}
376
377test "AEGIS256 test vector 1" {
378 const key: [AEGIS256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30;
379 const nonce: [AEGIS256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29;
380 const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 };
381 const m = [32]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
382 var c: [m.len]u8 = undefined;
383 var m2: [m.len]u8 = undefined;
384 var tag: [AEGIS256.tag_length]u8 = undefined;
385
386 AEGIS256.encrypt(&c, &tag, &m, &ad, nonce, key);
387 try AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key);
388 testing.expectEqualSlices(u8, &m, &m2);
389
390 htest.assertEqual("f373079ed84b2709faee373584585d60accd191db310ef5d8b11833df9dec711", &c);
391 htest.assertEqual("8d86f91ee606e9ff26a01b64ccbdd91d", &tag);
392
393 c[0] +%= 1;
394 testing.expectError(error.AuthenticationFailed, AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key));
395 c[0] -%= 1;
396 tag[0] +%= 1;
397 testing.expectError(error.AuthenticationFailed, AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key));
398}
399
400test "AEGIS256 test vector 2" {
401 const key: [AEGIS256.key_length]u8 = [_]u8{0x00} ** 32;
402 const nonce: [AEGIS256.nonce_length]u8 = [_]u8{0x00} ** 32;
403 const ad = [_]u8{};
404 const m = [_]u8{0x00} ** 16;
405 var c: [m.len]u8 = undefined;
406 var m2: [m.len]u8 = undefined;
407 var tag: [AEGIS256.tag_length]u8 = undefined;
408
409 AEGIS256.encrypt(&c, &tag, &m, &ad, nonce, key);
410 try AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key);
411 testing.expectEqualSlices(u8, &m, &m2);
412
413 htest.assertEqual("b98f03a947807713d75a4fff9fc277a6", &c);
414 htest.assertEqual("478f3b50dc478ef7d5cf2d0f7cc13180", &tag);
415}
lib/std/crypto/benchmark.zig+2-1
......@@ -149,7 +149,8 @@ const aeads = [_]Crypto{
149149 Crypto{ .ty = crypto.aead.ChaCha20Poly1305, .name = "chacha20Poly1305" },
150150 Crypto{ .ty = crypto.aead.XChaCha20Poly1305, .name = "xchacha20Poly1305" },
151151 Crypto{ .ty = crypto.aead.Gimli, .name = "gimli-aead" },
152 Crypto{ .ty = crypto.aead.AEGIS128L, .name = "aegis128l" },
152 Crypto{ .ty = crypto.aead.AEGIS128L, .name = "aegis-128l" },
153 Crypto{ .ty = crypto.aead.AEGIS256, .name = "aegis-256" },
153154};
154155
155156pub fn benchmarkAead(comptime Aead: anytype, comptime bytes: comptime_int) !u64 {