From fbe7d8c1cbb3fa6a6b080cad97067705cb7da1be Mon Sep 17 00:00:00 2001 From: lukechampine Date: Tue, 5 Nov 2019 11:47:04 -0500 Subject: [PATCH 1/6] crypto: Add chacha20poly1305 --- lib/std/crypto/chacha20.zig | 194 ++++++++++++++++++++++++++++++++++++ 1 file changed, 194 insertions(+) diff --git a/lib/std/crypto/chacha20.zig b/lib/std/crypto/chacha20.zig index 10d2130659..eaa1fc03c2 100644 --- a/lib/std/crypto/chacha20.zig +++ b/lib/std/crypto/chacha20.zig @@ -7,6 +7,7 @@ const assert = std.debug.assert; const testing = std.testing; const builtin = @import("builtin"); const maxInt = std.math.maxInt; +const Poly1305 = std.crypto.Poly1305; const QuarterRound = struct { a: usize, @@ -434,3 +435,196 @@ test "crypto.chacha20 test vector 5" { chaCha20With64BitNonce(result[0..], input[0..], 0, key, nonce); testing.expectEqualSlices(u8, &expected_result, &result); } + +pub const chacha20poly1305_tag_size = 16; + +pub fn chacha20poly1305Seal(dst: []u8, plaintext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) void { + assert(dst.len >= plaintext.len + chacha20poly1305_tag_size); + + // derive poly1305 key + var polyKey = [_]u8{0} ** 32; + chaCha20IETF(polyKey[0..], polyKey[0..], 0, key, nonce); + + // encrypt plaintext + chaCha20IETF(dst[0..plaintext.len], plaintext, 1, key, nonce); + + // construct mac + var mac = Poly1305.init(polyKey[0..]); + mac.update(data); + if (data.len % 16 != 0) { + const zeros = [_]u8{0} ** 16; + const padding = 16 - (data.len % 16); + mac.update(zeros[0..padding]); + } + mac.update(dst[0..plaintext.len]); + if (plaintext.len % 16 != 0) { + const zeros = [_]u8{0} ** 16; + const padding = 16 - (plaintext.len % 16); + mac.update(zeros[0..padding]); + } + var lens: [16]u8 = undefined; + mem.writeIntSliceLittle(u64, lens[0..8], data.len); + mem.writeIntSliceLittle(u64, lens[8..16], plaintext.len); + mac.update(lens[0..]); + mac.final(dst[plaintext.len..]); +} + +pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) bool { + assert(ciphertext.len >= chacha20poly1305_tag_size); + assert(dst.len >= ciphertext.len - chacha20poly1305_tag_size); + + // split ciphertext and tag + var polyTag = ciphertext[ciphertext.len - chacha20poly1305_tag_size ..]; + ciphertext = ciphertext[0 .. ciphertext.len - chacha20poly1305_tag_size]; + + // derive poly1305 key + var polyKey = [_]u8{0} ** 32; + chaCha20IETF(polyKey[0..], polyKey[0..], 0, key, nonce); + + // construct mac + var mac = Poly1305.init(polyKey[0..]); + + mac.update(data); + if (data.len % 16 != 0) { + const zeros = [_]u8{0} ** 16; + const padding = 16 - (data.len % 16); + mac.update(zeros[0..padding]); + } + mac.update(ciphertext); + if (ciphertext.len % 16 != 0) { + const zeros = [_]u8{0} ** 16; + const padding = 16 - (ciphertext.len % 16); + mac.update(zeros[0..padding]); + } + var lens: [16]u8 = undefined; + mem.writeIntSliceLittle(u64, lens[0..8], data.len); + mem.writeIntSliceLittle(u64, lens[8..16], ciphertext.len); + mac.update(lens[0..]); + var computedTag: [16]u8 = undefined; + mac.final(computedTag[0..]); + + // verify mac + if (!mem.eql(u8, polyTag, computedTag[0..])) { + return false; + } + + // decrypt ciphertext + chaCha20IETF(dst[0..ciphertext.len], ciphertext, 1, key, nonce); + return true; +} + +test "seal" { + { + const plaintext = ""; + const data = ""; + const key = [_]u8{ + 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, + 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, + }; + const nonce = [_]u8{ 0x7, 0x0, 0x0, 0x0, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47 }; + const exp_out = [_]u8{ 0xa0, 0x78, 0x4d, 0x7a, 0x47, 0x16, 0xf3, 0xfe, 0xb4, 0xf6, 0x4e, 0x7f, 0x4b, 0x39, 0xbf, 0x4 }; + + var out: [exp_out.len]u8 = undefined; + chacha20poly1305Seal(out[0..], plaintext, data, key, nonce); + testing.expectEqualSlices(u8, exp_out, out); + } + { + const plaintext = [_]u8{ + 0x4c, 0x61, 0x64, 0x69, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x47, 0x65, 0x6e, 0x74, 0x6c, + 0x65, 0x6d, 0x65, 0x6e, 0x20, 0x6f, 0x66, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x61, 0x73, + 0x73, 0x20, 0x6f, 0x66, 0x20, 0x27, 0x39, 0x39, 0x3a, 0x20, 0x49, 0x66, 0x20, 0x49, 0x20, 0x63, + 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x6f, 0x66, 0x66, 0x65, 0x72, 0x20, 0x79, 0x6f, 0x75, 0x20, 0x6f, + 0x6e, 0x6c, 0x79, 0x20, 0x6f, 0x6e, 0x65, 0x20, 0x74, 0x69, 0x70, 0x20, 0x66, 0x6f, 0x72, 0x20, + 0x74, 0x68, 0x65, 0x20, 0x66, 0x75, 0x74, 0x75, 0x72, 0x65, 0x2c, 0x20, 0x73, 0x75, 0x6e, 0x73, + 0x63, 0x72, 0x65, 0x65, 0x6e, 0x20, 0x77, 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x62, 0x65, 0x20, 0x69, + 0x74, 0x2e, + }; + const data = [_]u8{ 0x50, 0x51, 0x52, 0x53, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7 }; + const key = [_]u8{ + 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, + 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, + }; + const nonce = [_]u8{ 0x7, 0x0, 0x0, 0x0, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47 }; + const exp_out = [_]u8{ + 0xd3, 0x1a, 0x8d, 0x34, 0x64, 0x8e, 0x60, 0xdb, 0x7b, 0x86, 0xaf, 0xbc, 0x53, 0xef, 0x7e, 0xc2, + 0xa4, 0xad, 0xed, 0x51, 0x29, 0x6e, 0x8, 0xfe, 0xa9, 0xe2, 0xb5, 0xa7, 0x36, 0xee, 0x62, 0xd6, + 0x3d, 0xbe, 0xa4, 0x5e, 0x8c, 0xa9, 0x67, 0x12, 0x82, 0xfa, 0xfb, 0x69, 0xda, 0x92, 0x72, 0x8b, + 0x1a, 0x71, 0xde, 0xa, 0x9e, 0x6, 0xb, 0x29, 0x5, 0xd6, 0xa5, 0xb6, 0x7e, 0xcd, 0x3b, 0x36, + 0x92, 0xdd, 0xbd, 0x7f, 0x2d, 0x77, 0x8b, 0x8c, 0x98, 0x3, 0xae, 0xe3, 0x28, 0x9, 0x1b, 0x58, + 0xfa, 0xb3, 0x24, 0xe4, 0xfa, 0xd6, 0x75, 0x94, 0x55, 0x85, 0x80, 0x8b, 0x48, 0x31, 0xd7, 0xbc, + 0x3f, 0xf4, 0xde, 0xf0, 0x8e, 0x4b, 0x7a, 0x9d, 0xe5, 0x76, 0xd2, 0x65, 0x86, 0xce, 0xc6, 0x4b, + 0x61, 0x16, 0x1a, 0xe1, 0xb, 0x59, 0x4f, 0x9, 0xe2, 0x6a, 0x7e, 0x90, 0x2e, 0xcb, 0xd0, 0x60, + 0x6, 0x91, + }; + + var out: [exp_out.len]u8 = undefined; + chacha20poly1305Seal(out[0..], plaintext[0..], data[0..], key, nonce); + testing.expectEqualSlices(u8, exp_out, out); + } +} + +test "open" { + { + const ciphertext = [_]u8{ 0xa0, 0x78, 0x4d, 0x7a, 0x47, 0x16, 0xf3, 0xfe, 0xb4, 0xf6, 0x4e, 0x7f, 0x4b, 0x39, 0xbf, 0x4 }; + const data = ""; + const key = [_]u8{ + 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, + 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, + }; + const nonce = [_]u8{ 0x7, 0x0, 0x0, 0x0, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47 }; + const exp_out = ""; + + var out: [exp_out.len]u8 = undefined; + var valid: bool = chacha20poly1305Open(out[0..], ciphertext[0..], data, key, nonce); + testing.expect(valid); + testing.expectEqualSlices(u8, exp_out, out); + } + { + const ciphertext = [_]u8{ + 0xd3, 0x1a, 0x8d, 0x34, 0x64, 0x8e, 0x60, 0xdb, 0x7b, 0x86, 0xaf, 0xbc, 0x53, 0xef, 0x7e, 0xc2, + 0xa4, 0xad, 0xed, 0x51, 0x29, 0x6e, 0x8, 0xfe, 0xa9, 0xe2, 0xb5, 0xa7, 0x36, 0xee, 0x62, 0xd6, + 0x3d, 0xbe, 0xa4, 0x5e, 0x8c, 0xa9, 0x67, 0x12, 0x82, 0xfa, 0xfb, 0x69, 0xda, 0x92, 0x72, 0x8b, + 0x1a, 0x71, 0xde, 0xa, 0x9e, 0x6, 0xb, 0x29, 0x5, 0xd6, 0xa5, 0xb6, 0x7e, 0xcd, 0x3b, 0x36, + 0x92, 0xdd, 0xbd, 0x7f, 0x2d, 0x77, 0x8b, 0x8c, 0x98, 0x3, 0xae, 0xe3, 0x28, 0x9, 0x1b, 0x58, + 0xfa, 0xb3, 0x24, 0xe4, 0xfa, 0xd6, 0x75, 0x94, 0x55, 0x85, 0x80, 0x8b, 0x48, 0x31, 0xd7, 0xbc, + 0x3f, 0xf4, 0xde, 0xf0, 0x8e, 0x4b, 0x7a, 0x9d, 0xe5, 0x76, 0xd2, 0x65, 0x86, 0xce, 0xc6, 0x4b, + 0x61, 0x16, 0x1a, 0xe1, 0xb, 0x59, 0x4f, 0x9, 0xe2, 0x6a, 0x7e, 0x90, 0x2e, 0xcb, 0xd0, 0x60, + 0x6, 0x91, + }; + const data = [_]u8{ 0x50, 0x51, 0x52, 0x53, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7 }; + const key = [_]u8{ + 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, + 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, + }; + const nonce = [_]u8{ 0x7, 0x0, 0x0, 0x0, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47 }; + const exp_out = [_]u8{ + 0x4c, 0x61, 0x64, 0x69, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x47, 0x65, 0x6e, 0x74, 0x6c, + 0x65, 0x6d, 0x65, 0x6e, 0x20, 0x6f, 0x66, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x61, 0x73, + 0x73, 0x20, 0x6f, 0x66, 0x20, 0x27, 0x39, 0x39, 0x3a, 0x20, 0x49, 0x66, 0x20, 0x49, 0x20, 0x63, + 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x6f, 0x66, 0x66, 0x65, 0x72, 0x20, 0x79, 0x6f, 0x75, 0x20, 0x6f, + 0x6e, 0x6c, 0x79, 0x20, 0x6f, 0x6e, 0x65, 0x20, 0x74, 0x69, 0x70, 0x20, 0x66, 0x6f, 0x72, 0x20, + 0x74, 0x68, 0x65, 0x20, 0x66, 0x75, 0x74, 0x75, 0x72, 0x65, 0x2c, 0x20, 0x73, 0x75, 0x6e, 0x73, + 0x63, 0x72, 0x65, 0x65, 0x6e, 0x20, 0x77, 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x62, 0x65, 0x20, 0x69, + 0x74, 0x2e, + }; + + var out: [exp_out.len]u8 = undefined; + var valid: bool = chacha20poly1305Open(out[0..], ciphertext[0..], data[0..], key, nonce); + testing.expect(valid); + testing.expectEqualSlices(u8, exp_out, out); + + // corrupting the ciphertext, data, key, or nonce should cause a failure + var bad_ciphertext = ciphertext; + bad_ciphertext[0] ^= 1; + testing.expect(!chacha20poly1305Open(out[0..], bad_ciphertext[0..], data, key, nonce)); + var bad_data = data; + bad_data[0] ^= 1; + testing.expect(!chacha20poly1305Open(out[0..], ciphertext[0..], bad_data, key, nonce)); + var bad_key = key; + bad_key[0] ^= 1; + testing.expect(!chacha20poly1305Open(out[0..], ciphertext[0..], data, bad_key, nonce)); + var bad_nonce = nonce; + bad_nonce[0] ^= 1; + testing.expect(!chacha20poly1305Open(out[0..], ciphertext[0..], data, key, bad_nonce)); + } +} From ae7bb4ecc03d063acc75058f74fcf43b61b5a358 Mon Sep 17 00:00:00 2001 From: lukechampine Date: Tue, 5 Nov 2019 11:51:16 -0500 Subject: [PATCH 2/6] chacha20poly1305: verify tag in constant time --- lib/std/crypto/chacha20.zig | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/std/crypto/chacha20.zig b/lib/std/crypto/chacha20.zig index eaa1fc03c2..18ea7a2bfe 100644 --- a/lib/std/crypto/chacha20.zig +++ b/lib/std/crypto/chacha20.zig @@ -503,8 +503,14 @@ pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, var computedTag: [16]u8 = undefined; mac.final(computedTag[0..]); - // verify mac - if (!mem.eql(u8, polyTag, computedTag[0..])) { + // verify mac in constant time + // TODO: we can't currently guarantee that this will run in constant time. + // See https://github.com/ziglang/zig/issues/1776 + var acc: u8 = 0; + for (computedTag) |_, i| { + acc |= (computedTag[i] ^ polyTag[i]); + } + if (acc != 0) { return false; } From 1953b605998c7b06acffd4aaef50846cacbb64ea Mon Sep 17 00:00:00 2001 From: lukechampine Date: Tue, 5 Nov 2019 16:15:40 -0500 Subject: [PATCH 3/6] chacha20poly1305: Return false on short ciphertext --- lib/std/crypto/chacha20.zig | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/std/crypto/chacha20.zig b/lib/std/crypto/chacha20.zig index 18ea7a2bfe..ea0ae03a06 100644 --- a/lib/std/crypto/chacha20.zig +++ b/lib/std/crypto/chacha20.zig @@ -469,11 +469,15 @@ pub fn chacha20poly1305Seal(dst: []u8, plaintext: []const u8, data: []const u8, mac.final(dst[plaintext.len..]); } +/// Verifies and decrypts an authenticated message produced by chacha20poly1305Open. +/// Returns false if message was invalid or authentication failed. pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) bool { - assert(ciphertext.len >= chacha20poly1305_tag_size); - assert(dst.len >= ciphertext.len - chacha20poly1305_tag_size); + if (ciphertext.len < chacha20poly1305_tag_size) { + return false; + } // split ciphertext and tag + assert(dst.len >= ciphertext.len - chacha20poly1305_tag_size); var polyTag = ciphertext[ciphertext.len - chacha20poly1305_tag_size ..]; ciphertext = ciphertext[0 .. ciphertext.len - chacha20poly1305_tag_size]; From d6ca2323cf7f544836b1ab2d318d5286c4ca0e62 Mon Sep 17 00:00:00 2001 From: lukechampine Date: Wed, 6 Nov 2019 20:33:45 -0500 Subject: [PATCH 4/6] chacha: Use error set instead of bool --- lib/std/crypto/chacha20.zig | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/lib/std/crypto/chacha20.zig b/lib/std/crypto/chacha20.zig index ea0ae03a06..0386894b9a 100644 --- a/lib/std/crypto/chacha20.zig +++ b/lib/std/crypto/chacha20.zig @@ -470,10 +470,9 @@ pub fn chacha20poly1305Seal(dst: []u8, plaintext: []const u8, data: []const u8, } /// Verifies and decrypts an authenticated message produced by chacha20poly1305Open. -/// Returns false if message was invalid or authentication failed. -pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) bool { +pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) !void { if (ciphertext.len < chacha20poly1305_tag_size) { - return false; + return error.InvalidMessage; } // split ciphertext and tag @@ -515,12 +514,11 @@ pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, acc |= (computedTag[i] ^ polyTag[i]); } if (acc != 0) { - return false; + return error.AuthenticationFailed; } // decrypt ciphertext chaCha20IETF(dst[0..ciphertext.len], ciphertext, 1, key, nonce); - return true; } test "seal" { @@ -585,8 +583,7 @@ test "open" { const exp_out = ""; var out: [exp_out.len]u8 = undefined; - var valid: bool = chacha20poly1305Open(out[0..], ciphertext[0..], data, key, nonce); - testing.expect(valid); + try chacha20poly1305Open(out[0..], ciphertext[0..], data, key, nonce); testing.expectEqualSlices(u8, exp_out, out); } { @@ -619,22 +616,24 @@ test "open" { }; var out: [exp_out.len]u8 = undefined; - var valid: bool = chacha20poly1305Open(out[0..], ciphertext[0..], data[0..], key, nonce); - testing.expect(valid); + try chacha20poly1305Open(out[0..], ciphertext[0..], data[0..], key, nonce); testing.expectEqualSlices(u8, exp_out, out); // corrupting the ciphertext, data, key, or nonce should cause a failure var bad_ciphertext = ciphertext; bad_ciphertext[0] ^= 1; - testing.expect(!chacha20poly1305Open(out[0..], bad_ciphertext[0..], data, key, nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], bad_ciphertext[0..], data, key, nonce)); var bad_data = data; bad_data[0] ^= 1; - testing.expect(!chacha20poly1305Open(out[0..], ciphertext[0..], bad_data, key, nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], bad_data, key, nonce)); var bad_key = key; bad_key[0] ^= 1; - testing.expect(!chacha20poly1305Open(out[0..], ciphertext[0..], data, bad_key, nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], data, bad_key, nonce)); var bad_nonce = nonce; bad_nonce[0] ^= 1; - testing.expect(!chacha20poly1305Open(out[0..], ciphertext[0..], data, key, bad_nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], data, key, bad_nonce)); + + // a short ciphertext should result in a different error + testing.expectError(error.InvalidMessage, chacha20poly1305Open(out[0..], "", data, key, bad_nonce)); } } From d1a570a4b83ef1e795e19a4186e9255de6b1535f Mon Sep 17 00:00:00 2001 From: lukechampine Date: Wed, 6 Nov 2019 20:39:41 -0500 Subject: [PATCH 5/6] chacha: Fix open docstring --- lib/std/crypto/chacha20.zig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/std/crypto/chacha20.zig b/lib/std/crypto/chacha20.zig index 0386894b9a..28afcdfaff 100644 --- a/lib/std/crypto/chacha20.zig +++ b/lib/std/crypto/chacha20.zig @@ -469,7 +469,7 @@ pub fn chacha20poly1305Seal(dst: []u8, plaintext: []const u8, data: []const u8, mac.final(dst[plaintext.len..]); } -/// Verifies and decrypts an authenticated message produced by chacha20poly1305Open. +/// Verifies and decrypts an authenticated message produced by chacha20poly1305Seal. pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) !void { if (ciphertext.len < chacha20poly1305_tag_size) { return error.InvalidMessage; From ab093228f931f71ca55d526bbce18835c9dea852 Mon Sep 17 00:00:00 2001 From: lukechampine Date: Mon, 30 Dec 2019 13:53:09 -0500 Subject: [PATCH 6/6] Fix segfault by not reassigning to function parameter --- lib/std/crypto/chacha20.zig | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/lib/std/crypto/chacha20.zig b/lib/std/crypto/chacha20.zig index 28afcdfaff..8a0f677660 100644 --- a/lib/std/crypto/chacha20.zig +++ b/lib/std/crypto/chacha20.zig @@ -470,15 +470,15 @@ pub fn chacha20poly1305Seal(dst: []u8, plaintext: []const u8, data: []const u8, } /// Verifies and decrypts an authenticated message produced by chacha20poly1305Seal. -pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) !void { - if (ciphertext.len < chacha20poly1305_tag_size) { +pub fn chacha20poly1305Open(dst: []u8, msgAndTag: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) !void { + if (msgAndTag.len < chacha20poly1305_tag_size) { return error.InvalidMessage; } // split ciphertext and tag - assert(dst.len >= ciphertext.len - chacha20poly1305_tag_size); - var polyTag = ciphertext[ciphertext.len - chacha20poly1305_tag_size ..]; - ciphertext = ciphertext[0 .. ciphertext.len - chacha20poly1305_tag_size]; + assert(dst.len >= msgAndTag.len - chacha20poly1305_tag_size); + var ciphertext = msgAndTag[0 .. msgAndTag.len - chacha20poly1305_tag_size]; + var polyTag = msgAndTag[ciphertext.len..]; // derive poly1305 key var polyKey = [_]u8{0} ** 32; @@ -534,7 +534,7 @@ test "seal" { var out: [exp_out.len]u8 = undefined; chacha20poly1305Seal(out[0..], plaintext, data, key, nonce); - testing.expectEqualSlices(u8, exp_out, out); + testing.expectEqualSlices(u8, exp_out[0..], out[0..]); } { const plaintext = [_]u8{ @@ -567,7 +567,7 @@ test "seal" { var out: [exp_out.len]u8 = undefined; chacha20poly1305Seal(out[0..], plaintext[0..], data[0..], key, nonce); - testing.expectEqualSlices(u8, exp_out, out); + testing.expectEqualSlices(u8, exp_out[0..], out[0..]); } } @@ -584,7 +584,7 @@ test "open" { var out: [exp_out.len]u8 = undefined; try chacha20poly1305Open(out[0..], ciphertext[0..], data, key, nonce); - testing.expectEqualSlices(u8, exp_out, out); + testing.expectEqualSlices(u8, exp_out[0..], out[0..]); } { const ciphertext = [_]u8{ @@ -617,23 +617,23 @@ test "open" { var out: [exp_out.len]u8 = undefined; try chacha20poly1305Open(out[0..], ciphertext[0..], data[0..], key, nonce); - testing.expectEqualSlices(u8, exp_out, out); + testing.expectEqualSlices(u8, exp_out[0..], out[0..]); // corrupting the ciphertext, data, key, or nonce should cause a failure var bad_ciphertext = ciphertext; bad_ciphertext[0] ^= 1; - testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], bad_ciphertext[0..], data, key, nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], bad_ciphertext[0..], data[0..], key, nonce)); var bad_data = data; bad_data[0] ^= 1; - testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], bad_data, key, nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], bad_data[0..], key, nonce)); var bad_key = key; bad_key[0] ^= 1; - testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], data, bad_key, nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], data[0..], bad_key, nonce)); var bad_nonce = nonce; bad_nonce[0] ^= 1; - testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], data, key, bad_nonce)); + testing.expectError(error.AuthenticationFailed, chacha20poly1305Open(out[0..], ciphertext[0..], data[0..], key, bad_nonce)); // a short ciphertext should result in a different error - testing.expectError(error.InvalidMessage, chacha20poly1305Open(out[0..], "", data, key, bad_nonce)); + testing.expectError(error.InvalidMessage, chacha20poly1305Open(out[0..], "", data[0..], key, bad_nonce)); } }