authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-25 20:17:56+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-26 10:50:34+02:00
logff2e82f382b253ca50977d16fe58865e0de3223f
treea1a86e1ebf5d30c9a75f24501cd67313c9668805
parentb8729ca1a07863a0413b90206b82c1a0794abbd5

Rename `at` to `tag` in AEADs

2 files changed, 38 insertions(+), 38 deletions(-)

lib/std/crypto/chacha20.zig+12-12
......@@ -744,26 +744,26 @@ pub const Chacha20Poly1305 = struct {
744744 pub const key_length = 32;
745745
746746 /// c: ciphertext: output buffer should be of size m.len
747 /// at: authentication tag: output MAC
747 /// tag: authentication tag: output MAC
748748 /// m: message
749749 /// ad: Associated Data
750750 /// npub: public nonce
751751 /// k: private key
752 pub fn encrypt(c: []u8, at: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
752 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
753753 assert(c.len == m.len);
754 return chacha20poly1305SealDetached(c, at, m, ad, k, npub);
754 return chacha20poly1305SealDetached(c, tag, m, ad, k, npub);
755755 }
756756
757757 /// m: message: output buffer should be of size c.len
758758 /// c: ciphertext
759 /// at: authentication tag
759 /// tag: authentication tag
760760 /// ad: Associated Data
761761 /// npub: public nonce
762762 /// k: private key
763763 /// NOTE: the check of the authentication tag is currently not done in constant time
764 pub fn decrypt(m: []u8, c: []const u8, at: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
764 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
765765 assert(c.len == m.len);
766 return try chacha20poly1305OpenDetached(m, c, at[0..], ad, k, npub);
766 return try chacha20poly1305OpenDetached(m, c, tag[0..], ad, k, npub);
767767 }
768768};
769769
......@@ -773,26 +773,26 @@ pub const XChacha20Poly1305 = struct {
773773 pub const key_length = 32;
774774
775775 /// c: ciphertext: output buffer should be of size m.len
776 /// at: authentication tag: output MAC
776 /// tag: authentication tag: output MAC
777777 /// m: message
778778 /// ad: Associated Data
779779 /// npub: public nonce
780780 /// k: private key
781 pub fn encrypt(c: []u8, at: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
781 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
782782 assert(c.len == m.len);
783 return xchacha20poly1305SealDetached(c, at, m, ad, k, npub);
783 return xchacha20poly1305SealDetached(c, tag, m, ad, k, npub);
784784 }
785785
786786 /// m: message: output buffer should be of size c.len
787787 /// c: ciphertext
788 /// at: authentication tag
788 /// tag: authentication tag
789789 /// ad: Associated Data
790790 /// npub: public nonce
791791 /// k: private key
792792 /// NOTE: the check of the authentication tag is currently not done in constant time
793 pub fn decrypt(m: []u8, c: []const u8, at: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
793 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
794794 assert(c.len == m.len);
795 return try xchacha20poly1305OpenDetached(m, c, at[0..], ad, k, npub);
795 return try xchacha20poly1305OpenDetached(m, c, tag[0..], ad, k, npub);
796796 }
797797};
798798
lib/std/crypto/gimli.zig+26-26
......@@ -228,12 +228,12 @@ pub const Aead = struct {
228228 }
229229
230230 /// c: ciphertext: output buffer should be of size m.len
231 /// at: authentication tag: output MAC
231 /// tag: authentication tag: output MAC
232232 /// m: message
233233 /// ad: Associated Data
234234 /// npub: public nonce
235235 /// k: private key
236 pub fn encrypt(c: []u8, at: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
236 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
237237 assert(c.len == m.len);
238238
239239 var state = Aead.init(ad, npub, k);
......@@ -269,17 +269,17 @@ pub const Aead = struct {
269269
270270 // After the final non-full block of plaintext, the first 16 bytes
271271 // of the state are output as an authentication tag.
272 std.mem.copy(u8, at, buf[0..State.RATE]);
272 std.mem.copy(u8, tag, buf[0..State.RATE]);
273273 }
274274
275275 /// m: message: output buffer should be of size c.len
276276 /// c: ciphertext
277 /// at: authentication tag
277 /// tag: authentication tag
278278 /// ad: Associated Data
279279 /// npub: public nonce
280280 /// k: private key
281281 /// NOTE: the check of the authentication tag is currently not done in constant time
282 pub fn decrypt(m: []u8, c: []const u8, at: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
282 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) !void {
283283 assert(c.len == m.len);
284284
285285 var state = Aead.init(ad, npub, k);
......@@ -312,7 +312,7 @@ pub const Aead = struct {
312312 // After the final non-full block of plaintext, the first 16 bytes
313313 // of the state are the authentication tag.
314314 // TODO: use a constant-time equality check here, see https://github.com/ziglang/zig/issues/1776
315 if (!mem.eql(u8, buf[0..State.RATE], &at)) {
315 if (!mem.eql(u8, buf[0..State.RATE], &tag)) {
316316 @memset(m.ptr, undefined, m.len);
317317 return error.InvalidMessage;
318318 }
......@@ -332,13 +332,13 @@ test "cipher" {
332332 const pt: [0]u8 = undefined;
333333
334334 var ct: [pt.len]u8 = undefined;
335 var at: [16]u8 = undefined;
336 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);
335 var tag: [16]u8 = undefined;
336 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
337337 htest.assertEqual("", &ct);
338 htest.assertEqual("14DA9BB7120BF58B985A8E00FDEBA15B", &at);
338 htest.assertEqual("14DA9BB7120BF58B985A8E00FDEBA15B", &tag);
339339
340340 var pt2: [pt.len]u8 = undefined;
341 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);
341 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
342342 testing.expectEqualSlices(u8, &pt, &pt2);
343343 }
344344 { // test vector (34) from NIST KAT submission.
......@@ -347,13 +347,13 @@ test "cipher" {
347347 try std.fmt.hexToBytes(&pt, "00");
348348
349349 var ct: [pt.len]u8 = undefined;
350 var at: [16]u8 = undefined;
351 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);
350 var tag: [16]u8 = undefined;
351 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
352352 htest.assertEqual("7F", &ct);
353 htest.assertEqual("80492C317B1CD58A1EDC3A0D3E9876FC", &at);
353 htest.assertEqual("80492C317B1CD58A1EDC3A0D3E9876FC", &tag);
354354
355355 var pt2: [pt.len]u8 = undefined;
356 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);
356 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
357357 testing.expectEqualSlices(u8, &pt, &pt2);
358358 }
359359 { // test vector (106) from NIST KAT submission.
......@@ -363,13 +363,13 @@ test "cipher" {
363363 try std.fmt.hexToBytes(&pt, "000102");
364364
365365 var ct: [pt.len]u8 = undefined;
366 var at: [16]u8 = undefined;
367 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);
366 var tag: [16]u8 = undefined;
367 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
368368 htest.assertEqual("484D35", &ct);
369 htest.assertEqual("030BBEA23B61C00CED60A923BDCF9147", &at);
369 htest.assertEqual("030BBEA23B61C00CED60A923BDCF9147", &tag);
370370
371371 var pt2: [pt.len]u8 = undefined;
372 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);
372 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
373373 testing.expectEqualSlices(u8, &pt, &pt2);
374374 }
375375 { // test vector (790) from NIST KAT submission.
......@@ -379,13 +379,13 @@ test "cipher" {
379379 try std.fmt.hexToBytes(&pt, "000102030405060708090A0B0C0D0E0F10111213141516");
380380
381381 var ct: [pt.len]u8 = undefined;
382 var at: [16]u8 = undefined;
383 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);
382 var tag: [16]u8 = undefined;
383 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
384384 htest.assertEqual("6815B4A0ECDAD01596EAD87D9E690697475D234C6A13D1", &ct);
385 htest.assertEqual("DFE23F1642508290D68245279558B2FB", &at);
385 htest.assertEqual("DFE23F1642508290D68245279558B2FB", &tag);
386386
387387 var pt2: [pt.len]u8 = undefined;
388 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);
388 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
389389 testing.expectEqualSlices(u8, &pt, &pt2);
390390 }
391391 { // test vector (1057) from NIST KAT submission.
......@@ -394,13 +394,13 @@ test "cipher" {
394394 try std.fmt.hexToBytes(&pt, "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F");
395395
396396 var ct: [pt.len]u8 = undefined;
397 var at: [16]u8 = undefined;
398 Aead.encrypt(&ct, &at, &pt, &ad, nonce, key);
397 var tag: [16]u8 = undefined;
398 Aead.encrypt(&ct, &tag, &pt, &ad, nonce, key);
399399 htest.assertEqual("7F8A2CF4F52AA4D6B2E74105C30A2777B9D0C8AEFDD555DE35861BD3011F652F", &ct);
400 htest.assertEqual("7256456FA935AC34BBF55AE135F33257", &at);
400 htest.assertEqual("7256456FA935AC34BBF55AE135F33257", &tag);
401401
402402 var pt2: [pt.len]u8 = undefined;
403 try Aead.decrypt(&pt2, &ct, at, &ad, nonce, key);
403 try Aead.decrypt(&pt2, &ct, tag, &ad, nonce, key);
404404 testing.expectEqualSlices(u8, &pt, &pt2);
405405 }
406406}