From bb1c6bc376f1a30d6dadd4aebcd1ebec6b4c8621 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 28 Sep 2020 14:50:00 +0200 Subject: [PATCH] Add AEGIS-256 as well --- lib/std/crypto.zig | 1 + lib/std/crypto/aegis.zig | 238 +++++++++++++++++++++++++++++++++-- lib/std/crypto/benchmark.zig | 3 +- 3 files changed, 231 insertions(+), 11 deletions(-) diff --git a/lib/std/crypto.zig b/lib/std/crypto.zig index 73ad2ba20b..fa69d51d4d 100644 --- a/lib/std/crypto.zig +++ b/lib/std/crypto.zig @@ -29,6 +29,7 @@ pub const aead = struct { pub const ChaCha20Poly1305 = chacha20.Chacha20Poly1305; pub const XChaCha20Poly1305 = chacha20.XChacha20Poly1305; pub const AEGIS128L = @import("crypto/aegis.zig").AEGIS128L; + pub const AEGIS256 = @import("crypto/aegis.zig").AEGIS256; }; /// MAC functions requiring single-use secret keys. diff --git a/lib/std/crypto/aegis.zig b/lib/std/crypto/aegis.zig index 690f016a10..7ea7136f1e 100644 --- a/lib/std/crypto/aegis.zig +++ b/lib/std/crypto/aegis.zig @@ -3,10 +3,10 @@ const mem = std.mem; const assert = std.debug.assert; const AESBlock = std.crypto.core.aes.Block; -const State = struct { +const State128L = struct { blocks: [8]AESBlock, - fn init(key: [16]u8, nonce: [16]u8) State { + fn init(key: [16]u8, nonce: [16]u8) State128L { const c1 = AESBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }); const c2 = AESBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }); const key_block = AESBlock.fromBytes(&key); @@ -21,7 +21,7 @@ const State = struct { key_block.xorBlocks(c1), key_block.xorBlocks(c2), }; - var state = State{ .blocks = blocks }; + var state = State128L{ .blocks = blocks }; var i: usize = 0; while (i < 10) : (i += 1) { state.update(nonce_block, key_block); @@ -29,7 +29,7 @@ const State = struct { return state; } - inline fn update(state: *State, d1: AESBlock, d2: AESBlock) void { + inline fn update(state: *State128L, d1: AESBlock, d2: AESBlock) void { const blocks = &state.blocks; const tmp = blocks[7]; comptime var i: usize = 7; @@ -41,7 +41,7 @@ const State = struct { blocks[4] = blocks[4].xorBlocks(d2); } - fn enc(state: *State, dst: []u8, src: []const u8) void { + fn enc(state: *State128L, dst: *[32]u8, src: *const [32]u8) void { const blocks = &state.blocks; const msg0 = AESBlock.fromBytes(src[0..16]); const msg1 = AESBlock.fromBytes(src[16..32]); @@ -54,7 +54,7 @@ const State = struct { state.update(msg0, msg1); } - fn dec(state: *State, dst: []u8, src: []const u8) void { + fn dec(state: *State128L, dst: *[32]u8, src: *const [32]u8) void { const blocks = &state.blocks; var msg0 = AESBlock.fromBytes(src[0..16]).xorBlocks(blocks[6]).xorBlocks(blocks[1]); var msg1 = AESBlock.fromBytes(src[16..32]).xorBlocks(blocks[2]).xorBlocks(blocks[5]); @@ -65,7 +65,7 @@ const State = struct { state.update(msg0, msg1); } - fn mac(state: *State, adlen: usize, mlen: usize) [16]u8 { + fn mac(state: *State128L, adlen: usize, mlen: usize) [16]u8 { const blocks = &state.blocks; var sizes: [16]u8 = undefined; mem.writeIntLittle(u64, sizes[0..8], adlen * 8); @@ -99,7 +99,7 @@ pub const AEGIS128L = struct { /// k: private key pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void { assert(c.len == m.len); - var state = State.init(key, npub); + var state = State128L.init(key, npub); var src: [32]u8 align(16) = undefined; var dst: [32]u8 align(16) = undefined; var i: usize = 0; @@ -132,7 +132,7 @@ pub const AEGIS128L = struct { /// k: private key pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) !void { assert(c.len == m.len); - var state = State.init(key, npub); + var state = State128L.init(key, npub); var src: [32]u8 align(16) = undefined; var dst: [32]u8 align(16) = undefined; var i: usize = 0; @@ -170,10 +170,171 @@ pub const AEGIS128L = struct { } }; +const State256 = struct { + blocks: [6]AESBlock, + + fn init(key: [32]u8, nonce: [32]u8) State256 { + const c1 = AESBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }); + const c2 = AESBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }); + const key_block1 = AESBlock.fromBytes(key[0..16]); + const key_block2 = AESBlock.fromBytes(key[16..32]); + const nonce_block1 = AESBlock.fromBytes(nonce[0..16]); + const nonce_block2 = AESBlock.fromBytes(nonce[16..32]); + const kxn1 = key_block1.xorBlocks(nonce_block1); + const kxn2 = key_block2.xorBlocks(nonce_block2); + const blocks = [6]AESBlock{ + kxn1, + kxn2, + c1, + c2, + key_block1.xorBlocks(c2), + key_block2.xorBlocks(c1), + }; + var state = State256{ .blocks = blocks }; + var i: usize = 0; + while (i < 4) : (i += 1) { + state.update(key_block1); + state.update(key_block2); + state.update(kxn1); + state.update(kxn2); + } + return state; + } + + inline fn update(state: *State256, d: AESBlock) void { + const blocks = &state.blocks; + const tmp = blocks[5].encrypt(blocks[0]); + comptime var i: usize = 5; + inline while (i > 0) : (i -= 1) { + blocks[i] = blocks[i - 1].encrypt(blocks[i]); + } + blocks[0] = tmp.xorBlocks(d); + } + + fn enc(state: *State256, dst: *[16]u8, src: *const [16]u8) void { + const blocks = &state.blocks; + const msg = AESBlock.fromBytes(src); + var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]); + tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3])); + dst.* = tmp.toBytes(); + state.update(msg); + } + + fn dec(state: *State256, dst: *[16]u8, src: *const [16]u8) void { + const blocks = &state.blocks; + var msg = AESBlock.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]); + msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3])); + dst.* = msg.toBytes(); + state.update(msg); + } + + fn mac(state: *State256, adlen: usize, mlen: usize) [16]u8 { + const blocks = &state.blocks; + var sizes: [16]u8 = undefined; + mem.writeIntLittle(u64, sizes[0..8], adlen * 8); + mem.writeIntLittle(u64, sizes[8..16], mlen * 8); + const tmp = AESBlock.fromBytes(&sizes).xorBlocks(blocks[3]); + var i: usize = 0; + while (i < 7) : (i += 1) { + state.update(tmp); + } + return blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]). + xorBlocks(blocks[5]).toBytes(); + } +}; + +/// AEGIS is a very fast authenticated encryption system built on top of the core AES function. +/// +/// The 256 bit variant of AEGIS has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks. +/// +/// https://eprint.iacr.org/2013/695.pdf +pub const AEGIS256 = struct { + pub const tag_length = 16; + pub const nonce_length = 32; + pub const key_length = 32; + + /// c: ciphertext: output buffer should be of size m.len + /// tag: authentication tag: output MAC + /// m: message + /// ad: Associated Data + /// npub: public nonce + /// k: private key + pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void { + assert(c.len == m.len); + var state = State256.init(key, npub); + var src: [16]u8 align(16) = undefined; + var dst: [16]u8 align(16) = undefined; + var i: usize = 0; + while (i + 16 <= ad.len) : (i += 16) { + state.enc(&dst, ad[i..][0..16]); + } + if (ad.len % 16 != 0) { + mem.set(u8, src[0..], 0); + mem.copy(u8, src[0 .. ad.len % 16], ad[i .. i + ad.len % 16]); + state.enc(&dst, &src); + } + i = 0; + while (i + 16 <= m.len) : (i += 16) { + state.enc(c[i..][0..16], m[i..][0..16]); + } + if (m.len % 16 != 0) { + mem.set(u8, src[0..], 0); + mem.copy(u8, src[0 .. m.len % 16], m[i .. i + m.len % 16]); + state.enc(&dst, &src); + mem.copy(u8, c[i .. i + m.len % 16], dst[0 .. m.len % 16]); + } + tag.* = state.mac(ad.len, m.len); + } + + /// m: message: output buffer should be of size c.len + /// c: ciphertext + /// tag: authentication tag + /// ad: Associated Data + /// npub: public nonce + /// k: private key + pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) !void { + assert(c.len == m.len); + var state = State256.init(key, npub); + var src: [16]u8 align(16) = undefined; + var dst: [16]u8 align(16) = undefined; + var i: usize = 0; + while (i + 16 <= ad.len) : (i += 16) { + state.enc(&dst, ad[i..][0..16]); + } + if (ad.len % 16 != 0) { + mem.set(u8, src[0..], 0); + mem.copy(u8, src[0 .. ad.len % 16], ad[i .. i + ad.len % 16]); + state.enc(&dst, &src); + } + i = 0; + while (i + 16 <= m.len) : (i += 16) { + state.dec(m[i..][0..16], c[i..][0..16]); + } + if (m.len % 16 != 0) { + mem.set(u8, src[0..], 0); + mem.copy(u8, src[0 .. m.len % 16], c[i .. i + m.len % 16]); + state.dec(&dst, &src); + mem.copy(u8, m[i .. i + m.len % 16], dst[0 .. m.len % 16]); + mem.set(u8, dst[0 .. m.len % 16], 0); + const blocks = &state.blocks; + blocks[0] = blocks[0].xorBlocks(AESBlock.fromBytes(&dst)); + } + const computed_tag = state.mac(ad.len, m.len); + var acc: u8 = 0; + for (computed_tag) |_, j| { + acc |= (computed_tag[j] ^ tag[j]); + } + if (acc != 0) { + mem.set(u8, m, 0xaa); + return error.AuthenticationFailed; + } + } +}; + const htest = @import("test.zig"); const testing = std.testing; -test "AEGIS128L" { +test "AEGIS128L test vector 1" { const key: [AEGIS128L.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 14; const nonce: [AEGIS128L.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 13; const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 }; @@ -195,3 +356,60 @@ test "AEGIS128L" { tag[0] +%= 1; testing.expectError(error.AuthenticationFailed, AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key)); } + +test "AEGIS128L test vector 2" { + const key: [AEGIS128L.key_length]u8 = [_]u8{0x00} ** 16; + const nonce: [AEGIS128L.nonce_length]u8 = [_]u8{0x00} ** 16; + const ad = [_]u8{}; + const m = [_]u8{0x00} ** 16; + var c: [m.len]u8 = undefined; + var m2: [m.len]u8 = undefined; + var tag: [AEGIS128L.tag_length]u8 = undefined; + + AEGIS128L.encrypt(&c, &tag, &m, &ad, nonce, key); + try AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key); + testing.expectEqualSlices(u8, &m, &m2); + + htest.assertEqual("41de9000a7b5e40e2d68bb64d99ebb19", &c); + htest.assertEqual("f4d997cc9b94227ada4fe4165422b1c8", &tag); +} + +test "AEGIS256 test vector 1" { + const key: [AEGIS256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30; + const nonce: [AEGIS256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29; + const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 }; + const m = [32]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f }; + var c: [m.len]u8 = undefined; + var m2: [m.len]u8 = undefined; + var tag: [AEGIS256.tag_length]u8 = undefined; + + AEGIS256.encrypt(&c, &tag, &m, &ad, nonce, key); + try AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key); + testing.expectEqualSlices(u8, &m, &m2); + + htest.assertEqual("f373079ed84b2709faee373584585d60accd191db310ef5d8b11833df9dec711", &c); + htest.assertEqual("8d86f91ee606e9ff26a01b64ccbdd91d", &tag); + + c[0] +%= 1; + testing.expectError(error.AuthenticationFailed, AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key)); + c[0] -%= 1; + tag[0] +%= 1; + testing.expectError(error.AuthenticationFailed, AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key)); +} + +test "AEGIS256 test vector 2" { + const key: [AEGIS256.key_length]u8 = [_]u8{0x00} ** 32; + const nonce: [AEGIS256.nonce_length]u8 = [_]u8{0x00} ** 32; + const ad = [_]u8{}; + const m = [_]u8{0x00} ** 16; + var c: [m.len]u8 = undefined; + var m2: [m.len]u8 = undefined; + var tag: [AEGIS256.tag_length]u8 = undefined; + + AEGIS256.encrypt(&c, &tag, &m, &ad, nonce, key); + try AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key); + testing.expectEqualSlices(u8, &m, &m2); + + htest.assertEqual("b98f03a947807713d75a4fff9fc277a6", &c); + htest.assertEqual("478f3b50dc478ef7d5cf2d0f7cc13180", &tag); +} diff --git a/lib/std/crypto/benchmark.zig b/lib/std/crypto/benchmark.zig index d5b93947c5..6578961902 100644 --- a/lib/std/crypto/benchmark.zig +++ b/lib/std/crypto/benchmark.zig @@ -149,7 +149,8 @@ const aeads = [_]Crypto{ Crypto{ .ty = crypto.aead.ChaCha20Poly1305, .name = "chacha20Poly1305" }, Crypto{ .ty = crypto.aead.XChaCha20Poly1305, .name = "xchacha20Poly1305" }, Crypto{ .ty = crypto.aead.Gimli, .name = "gimli-aead" }, - Crypto{ .ty = crypto.aead.AEGIS128L, .name = "aegis128l" }, + Crypto{ .ty = crypto.aead.AEGIS128L, .name = "aegis-128l" }, + Crypto{ .ty = crypto.aead.AEGIS256, .name = "aegis-256" }, }; pub fn benchmarkAead(comptime Aead: anytype, comptime bytes: comptime_int) !u64 {