Merge remote-tracking branch 'public/pr/1617' into development
This commit is contained in:
Simon Butcher
commit
95a1c1f8ab
33 changed files with 4075 additions and 79 deletions
|
|
@ -1,5 +1,12 @@
|
|||
mbed TLS ChangeLog (Sorted per branch, date)
|
||||
|
||||
= mbed TLS x.x.x branch released xxxx-xx-xx
|
||||
|
||||
Features
|
||||
* Add new crypto primitives from RFC 7539: stream cipher Chacha20, one-time
|
||||
authenticator Poly1305 and AEAD construct Chacha20-Poly1305. Contributed by
|
||||
Daniel King (#485).
|
||||
|
||||
= mbed TLS 2.11.0 branch released 2018-06-18
|
||||
|
||||
Features
|
||||
|
|
|
|||
212
include/mbedtls/chacha20.h
Normal file
212
include/mbedtls/chacha20.h
Normal file
|
|
@ -0,0 +1,212 @@
|
|||
/**
|
||||
* \file chacha20.h
|
||||
*
|
||||
* \brief This file contains ChaCha20 definitions and functions.
|
||||
*
|
||||
* ChaCha20 is a stream cipher that can encrypt and decrypt
|
||||
* information. ChaCha was created by Daniel Bernstein as a variant of
|
||||
* its Salsa cipher https://cr.yp.to/chacha/chacha-20080128.pdf
|
||||
* ChaCha20 is the variant with 20 rounds, that was also standardized
|
||||
* in RFC 7539.
|
||||
*
|
||||
* \author Daniel King <damaki.gh@gmail.com>
|
||||
*/
|
||||
|
||||
/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CHACHA20_H
|
||||
#define MBEDTLS_CHACHA20_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA -0x0051 /**< Invalid input parameter(s). */
|
||||
#define MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE -0x0053 /**< Feature not available. For example, s part of the API is not implemented. */
|
||||
#define MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED -0x0055 /**< Chacha20 hardware accelerator failed. */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_CHACHA20_ALT)
|
||||
|
||||
typedef struct
|
||||
{
|
||||
uint32_t state[16]; /*! The state (before round operations). */
|
||||
uint8_t keystream8[64]; /*! Leftover keystream bytes. */
|
||||
size_t keystream_bytes_used; /*! Number of keystream bytes already used. */
|
||||
}
|
||||
mbedtls_chacha20_context;
|
||||
|
||||
#else /* MBEDTLS_CHACHA20_ALT */
|
||||
#include "chacha20_alt.h"
|
||||
#endif /* MBEDTLS_CHACHA20_ALT */
|
||||
|
||||
/**
|
||||
* \brief This function initializes the specified ChaCha20 context.
|
||||
*
|
||||
* It must be the first API called before using
|
||||
* the context.
|
||||
*
|
||||
* It is usually followed by calls to
|
||||
* \c mbedtls_chacha20_setkey() and
|
||||
* \c mbedtls_chacha20_starts(), then one or more calls to
|
||||
* to \c mbedtls_chacha20_update(), and finally to
|
||||
* \c mbedtls_chacha20_free().
|
||||
*
|
||||
* \param ctx The ChaCha20 context to initialize.
|
||||
*/
|
||||
void mbedtls_chacha20_init( mbedtls_chacha20_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief This function releases and clears the specified ChaCha20 context.
|
||||
*
|
||||
* \param ctx The ChaCha20 context to clear.
|
||||
*/
|
||||
void mbedtls_chacha20_free( mbedtls_chacha20_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief This function sets the encryption/decryption key.
|
||||
*
|
||||
* \note After using this function, you must also call
|
||||
* \c mbedtls_chacha20_starts() to set a nonce before you
|
||||
* start encrypting/decrypting data with
|
||||
* \c mbedtls_chacha_update().
|
||||
*
|
||||
* \param ctx The ChaCha20 context to which the key should be bound.
|
||||
* \param key The encryption/decryption key. Must be 32 bytes in length.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or key is NULL.
|
||||
*/
|
||||
int mbedtls_chacha20_setkey( mbedtls_chacha20_context *ctx,
|
||||
const unsigned char key[32] );
|
||||
|
||||
/**
|
||||
* \brief This function sets the nonce and initial counter value.
|
||||
*
|
||||
* \note A ChaCha20 context can be re-used with the same key by
|
||||
* calling this function to change the nonce.
|
||||
*
|
||||
* \warning You must never use the same nonce twice with the same key.
|
||||
* This would void any confidentiality guarantees for the
|
||||
* messages encrypted with the same nonce and key.
|
||||
*
|
||||
* \param ctx The ChaCha20 context to which the nonce should be bound.
|
||||
* \param nonce The nonce. Must be 12 bytes in size.
|
||||
* \param counter The initial counter value. This is usually 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or nonce is
|
||||
* NULL.
|
||||
*/
|
||||
int mbedtls_chacha20_starts( mbedtls_chacha20_context* ctx,
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter );
|
||||
|
||||
/**
|
||||
* \brief This function encrypts or decrypts data.
|
||||
*
|
||||
* Since ChaCha20 is a stream cipher, the same operation is
|
||||
* used for encrypting and decrypting data.
|
||||
*
|
||||
* \note The \p input and \p output pointers must either be equal or
|
||||
* point to non-overlapping buffers.
|
||||
*
|
||||
* \note \c mbedtls_chacha20_setkey() and
|
||||
* \c mbedtls_chacha20_starts() must be called at least once
|
||||
* to setup the context before this function can be called.
|
||||
*
|
||||
* \note This function can be called multiple times in a row in
|
||||
* order to encrypt of decrypt data piecewise with the same
|
||||
* key and nonce.
|
||||
*
|
||||
* \param ctx The ChaCha20 context to use for encryption or decryption.
|
||||
* \param size The length of the input data in bytes.
|
||||
* \param input The buffer holding the input data.
|
||||
* This pointer can be NULL if size == 0.
|
||||
* \param output The buffer holding the output data.
|
||||
* Must be able to hold \p size bytes.
|
||||
* This pointer can be NULL if size == 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if the ctx, input, or
|
||||
* output pointers are NULL.
|
||||
*/
|
||||
int mbedtls_chacha20_update( mbedtls_chacha20_context *ctx,
|
||||
size_t size,
|
||||
const unsigned char *input,
|
||||
unsigned char *output );
|
||||
|
||||
/**
|
||||
* \brief This function encrypts or decrypts data with ChaCha20 and
|
||||
* the given key and nonce.
|
||||
*
|
||||
* Since ChaCha20 is a stream cipher, the same operation is
|
||||
* used for encrypting and decrypting data.
|
||||
*
|
||||
* \warning You must never use the same (key, nonce) pair more than
|
||||
* once. This would void any confidentiality guarantees for
|
||||
* the messages encrypted with the same nonce and key.
|
||||
*
|
||||
* \note The \p input and \p output pointers must either be equal or
|
||||
* point to non-overlapping buffers.
|
||||
*
|
||||
* \param key The encryption/decryption key. Must be 32 bytes in length.
|
||||
* \param nonce The nonce. Must be 12 bytes in size.
|
||||
* \param counter The initial counter value. This is usually 0.
|
||||
* \param size The length of the input data in bytes.
|
||||
* \param input The buffer holding the input data.
|
||||
* This pointer can be NULL if size == 0.
|
||||
* \param output The buffer holding the output data.
|
||||
* Must be able to hold \p size bytes.
|
||||
* This pointer can be NULL if size == 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if key, nonce, input,
|
||||
* or output is NULL.
|
||||
*/
|
||||
int mbedtls_chacha20_crypt( const unsigned char key[32],
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter,
|
||||
size_t size,
|
||||
const unsigned char* input,
|
||||
unsigned char* output );
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
/**
|
||||
* \brief The ChaCha20 checkup routine.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return \c 1 on failure.
|
||||
*/
|
||||
int mbedtls_chacha20_self_test( int verbose );
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* MBEDTLS_CHACHA20_H */
|
||||
355
include/mbedtls/chachapoly.h
Normal file
355
include/mbedtls/chachapoly.h
Normal file
|
|
@ -0,0 +1,355 @@
|
|||
/**
|
||||
* \file chachapoly.h
|
||||
*
|
||||
* \brief This file contains the AEAD-ChaCha20-Poly1305 definitions and
|
||||
* functions.
|
||||
*
|
||||
* ChaCha20-Poly1305 is an algorithm for Authenticated Encryption
|
||||
* with Associated Data (AEAD) that can be used to encrypt and
|
||||
* authenticate data. It is based on ChaCha20 and Poly1305 by Daniel
|
||||
* Bernstein and was standardized in RFC 7539.
|
||||
*
|
||||
* \author Daniel King <damaki.gh@gmail.com>
|
||||
*/
|
||||
|
||||
/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_CHACHAPOLY_H
|
||||
#define MBEDTLS_CHACHAPOLY_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
/* for shared error codes */
|
||||
#include "poly1305.h"
|
||||
|
||||
#define MBEDTLS_ERR_CHACHAPOLY_BAD_STATE -0x0054 /**< The requested operation is not permitted in the current state. */
|
||||
#define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED -0x0056 /**< Authenticated decryption failed: data was not authentic. */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
typedef enum
|
||||
{
|
||||
MBEDTLS_CHACHAPOLY_ENCRYPT, /**< The mode value for performing encryption. */
|
||||
MBEDTLS_CHACHAPOLY_DECRYPT /**< The mode value for performing decryption. */
|
||||
}
|
||||
mbedtls_chachapoly_mode_t;
|
||||
|
||||
#if !defined(MBEDTLS_CHACHAPOLY_ALT)
|
||||
|
||||
#include "chacha20.h"
|
||||
|
||||
typedef struct
|
||||
{
|
||||
mbedtls_chacha20_context chacha20_ctx; /**< The ChaCha20 context. */
|
||||
mbedtls_poly1305_context poly1305_ctx; /**< The Poly1305 context. */
|
||||
uint64_t aad_len; /**< The length (bytes) of the Additional Authenticated Data. */
|
||||
uint64_t ciphertext_len; /**< The length (bytes) of the ciphertext. */
|
||||
int state; /**< The current state of the context. */
|
||||
mbedtls_chachapoly_mode_t mode; /**< Cipher mode (encrypt or decrypt). */
|
||||
}
|
||||
mbedtls_chachapoly_context;
|
||||
|
||||
#else /* !MBEDTLS_CHACHAPOLY_ALT */
|
||||
#include "chachapoly_alt.h"
|
||||
#endif /* !MBEDTLS_CHACHAPOLY_ALT */
|
||||
|
||||
/**
|
||||
* \brief This function initializes the specified ChaCha20-Poly1305 context.
|
||||
*
|
||||
* It must be the first API called before using
|
||||
* the context. It must be followed by a call to
|
||||
* \c mbedtls_chachapoly_setkey() before any operation can be
|
||||
* done, and to \c mbedtls_chachapoly_free() once all
|
||||
* operations with that context have been finished.
|
||||
*
|
||||
* In order to encrypt or decrypt full messages at once, for
|
||||
* each message you should make a single call to
|
||||
* \c mbedtls_chachapoly_crypt_and_tag() or
|
||||
* \c mbedtls_chachapoly_auth_decrypt().
|
||||
*
|
||||
* In order to encrypt messages piecewise, for each
|
||||
* message you should make a call to
|
||||
* \c mbedtls_chachapoly_starts(), then 0 or more calls to
|
||||
* \c mbedtls_chachapoly_update_aad(), then 0 or more calls to
|
||||
* \c mbedtls_chachapoly_update(), then one call to
|
||||
* \c mbedtls_chachapoly_finish().
|
||||
*
|
||||
* \warning Decryption with the piecewise API is discouraged! Always
|
||||
* use \c mbedtls_chachapoly_auth_decrypt() when possible!
|
||||
*
|
||||
* If however this is not possible because the data is too
|
||||
* large to fit in memory, you need to:
|
||||
*
|
||||
* - call \c mbedtls_chachapoly_starts() and (if needed)
|
||||
* \c mbedtls_chachapoly_update_aad() as above,
|
||||
* - call \c mbedtls_chachapoly_update() multiple times and
|
||||
* ensure its output (the plaintext) is NOT used in any other
|
||||
* way than placing it in temporary storage at this point,
|
||||
* - call \c mbedtls_chachapoly_finish() to compute the
|
||||
* authentication tag and compared it in constant time to the
|
||||
* tag received with the ciphertext.
|
||||
*
|
||||
* If the tags are not equal, you must immediately discard
|
||||
* all previous outputs of \c mbedtls_chachapoly_update(),
|
||||
* otherwise you can now safely use the plaintext.
|
||||
*
|
||||
* \param ctx The ChachaPoly context to initialize.
|
||||
*/
|
||||
void mbedtls_chachapoly_init( mbedtls_chachapoly_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief This function releases and clears the specified ChaCha20-Poly1305 context.
|
||||
*
|
||||
* \param ctx The ChachaPoly context to clear.
|
||||
*/
|
||||
void mbedtls_chachapoly_free( mbedtls_chachapoly_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief This function sets the ChaCha20-Poly1305 symmetric encryption key.
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context to which the key should be
|
||||
* bound.
|
||||
* \param key The 256-bit (32 bytes) key.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if \p ctx or \p key are NULL.
|
||||
*/
|
||||
int mbedtls_chachapoly_setkey( mbedtls_chachapoly_context *ctx,
|
||||
const unsigned char key[32] );
|
||||
|
||||
/**
|
||||
* \brief This function starts a ChaCha20-Poly1305 encryption or
|
||||
* decryption operation.
|
||||
*
|
||||
* \warning You must never use the same nonce twice with the same key.
|
||||
* This would void any confidentiality and authenticity
|
||||
* guarantees for the messages encrypted with the same nonce
|
||||
* and key.
|
||||
*
|
||||
* \note If the context is being used for AAD only (no data to
|
||||
* encrypt or decrypt) then \p mode can be set to any value.
|
||||
*
|
||||
* \warning Decryption with the piecewise API is discouraged, see the
|
||||
* warning on \c mbedtls_chachapoly_init().
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context.
|
||||
* \param nonce The nonce/IV to use for the message. Must be 12 bytes.
|
||||
* \param mode The operation to perform: #MBEDTLS_CHACHAPOLY_ENCRYPT or
|
||||
* #MBEDTLS_CHACHAPOLY_DECRYPT (discouraged, see warning).
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if \p ctx or \p mac are NULL.
|
||||
*/
|
||||
int mbedtls_chachapoly_starts( mbedtls_chachapoly_context *ctx,
|
||||
const unsigned char nonce[12],
|
||||
mbedtls_chachapoly_mode_t mode );
|
||||
|
||||
/**
|
||||
* \brief This function feeds additional data to be authenticated
|
||||
* into an ongoing ChaCha20-Poly1305 operation.
|
||||
*
|
||||
* The Additional Authenticated Data (AAD), also called
|
||||
* Associated Data (AD) is only authenticated but not
|
||||
* encrypted nor included in the encrypted output. It is
|
||||
* usually transmitted separately from the ciphertext or
|
||||
* computed locally by each party.
|
||||
*
|
||||
* \note This function is called before data is encrypted/decrypted.
|
||||
* I.e. call this function to process the AAD before calling
|
||||
* \c mbedtls_chachapoly_update().
|
||||
*
|
||||
* You may call this function multiple times to process
|
||||
* an arbitrary amount of AAD. It is permitted to call
|
||||
* this function 0 times, if no AAD is used.
|
||||
*
|
||||
* This function cannot be called any more if data has
|
||||
* been processed by \c mbedtls_chachapoly_update(),
|
||||
* or if the context has been finished.
|
||||
*
|
||||
* \warning Decryption with the piecewise API is discouraged, see the
|
||||
* warning on \c mbedtls_chachapoly_init().
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context to use.
|
||||
* \param aad_len The length (in bytes) of the AAD. The length has no
|
||||
* restrictions.
|
||||
* \param aad Buffer containing the AAD.
|
||||
* This pointer can be NULL if aad_len == 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if \p ctx or \p aad are NULL.
|
||||
* \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE
|
||||
* if the operations has not been started or has been
|
||||
* finished, or if the AAD has been finished.
|
||||
*/
|
||||
int mbedtls_chachapoly_update_aad( mbedtls_chachapoly_context *ctx,
|
||||
const unsigned char *aad,
|
||||
size_t aad_len );
|
||||
|
||||
/**
|
||||
* \brief Thus function feeds data to be encrypted or decrypted
|
||||
* into an on-going ChaCha20-Poly1305
|
||||
* operation.
|
||||
*
|
||||
* The direction (encryption or decryption) depends on the
|
||||
* mode that was given when calling
|
||||
* \c mbedtls_chachapoly_starts().
|
||||
*
|
||||
* You may call this function multiple times to process
|
||||
* an arbitrary amount of data. It is permitted to call
|
||||
* this function 0 times, if no data is to be encrypted
|
||||
* or decrypted.
|
||||
*
|
||||
* \warning Decryption with the piecewise API is discouraged, see the
|
||||
* warning on \c mbedtls_chachapoly_init().
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context to use.
|
||||
* \param len The length (in bytes) of the data to encrypt or decrypt.
|
||||
* \param input The buffer containing the data to encrypt or decrypt.
|
||||
* This pointer can be NULL if len == 0.
|
||||
* \param output The buffer to where the encrypted or decrypted data is written.
|
||||
* Must be able to hold \p len bytes.
|
||||
* This pointer can be NULL if len == 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if \p ctx, \p input, or \p output are NULL.
|
||||
* \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE
|
||||
* if the operation has not been started or has been
|
||||
* finished.
|
||||
*/
|
||||
int mbedtls_chachapoly_update( mbedtls_chachapoly_context *ctx,
|
||||
size_t len,
|
||||
const unsigned char *input,
|
||||
unsigned char *output );
|
||||
|
||||
/**
|
||||
* \brief This function finished the ChaCha20-Poly1305 operation and
|
||||
* generates the MAC (authentication tag).
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context to use.
|
||||
* \param mac The buffer to where the 128-bit (16 bytes) MAC is written.
|
||||
*
|
||||
* \warning Decryption with the piecewise API is discouraged, see the
|
||||
* warning on \c mbedtls_chachapoly_init().
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if \p ctx or \p mac are NULL.
|
||||
* \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE
|
||||
* if the operation has not been started or has been
|
||||
* finished.
|
||||
*/
|
||||
int mbedtls_chachapoly_finish( mbedtls_chachapoly_context *ctx,
|
||||
unsigned char mac[16] );
|
||||
|
||||
/**
|
||||
* \brief This function performs a complete ChaCha20-Poly1305
|
||||
* authenticated encryption with the previously-set key.
|
||||
*
|
||||
* \note Before using this function, you must set the key with
|
||||
* \c mbedtls_chachapoly_setkey().
|
||||
*
|
||||
* \warning You must never use the same nonce twice with the same key.
|
||||
* This would void any confidentiality and authenticity
|
||||
* guarantees for the messages encrypted with the same nonce
|
||||
* and key.
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context to use (holds the key).
|
||||
* \param length The length (in bytes) of the data to encrypt or decrypt.
|
||||
* \param nonce The 96-bit (12 bytes) nonce/IV to use.
|
||||
* \param aad The buffer containing the additional authenticated data (AAD).
|
||||
* This pointer can be NULL if aad_len == 0.
|
||||
* \param aad_len The length (in bytes) of the AAD data to process.
|
||||
* \param input The buffer containing the data to encrypt or decrypt.
|
||||
* This pointer can be NULL if ilen == 0.
|
||||
* \param output The buffer to where the encrypted or decrypted data is written.
|
||||
* This pointer can be NULL if ilen == 0.
|
||||
* \param tag The buffer to where the computed 128-bit (16 bytes) MAC is written.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if one or more of the required parameters are NULL.
|
||||
*/
|
||||
int mbedtls_chachapoly_encrypt_and_tag( mbedtls_chachapoly_context *ctx,
|
||||
size_t length,
|
||||
const unsigned char nonce[12],
|
||||
const unsigned char *aad,
|
||||
size_t aad_len,
|
||||
const unsigned char *input,
|
||||
unsigned char *output,
|
||||
unsigned char tag[16] );
|
||||
|
||||
/**
|
||||
* \brief This function performs a complete ChaCha20-Poly1305
|
||||
* authenticated decryption with the previously-set key.
|
||||
*
|
||||
* \note Before using this function, you must set the key with
|
||||
* \c mbedtls_chachapoly_setkey().
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context to use (holds the key).
|
||||
* \param length The length (in bytes) of the data to decrypt.
|
||||
* \param nonce The 96-bit (12 bytes) nonce/IV to use.
|
||||
* \param aad The buffer containing the additional authenticated data (AAD).
|
||||
* This pointer can be NULL if aad_len == 0.
|
||||
* \param aad_len The length (in bytes) of the AAD data to process.
|
||||
* \param tag The buffer holding the authentication tag.
|
||||
* \param input The buffer containing the data to decrypt.
|
||||
* This pointer can be NULL if ilen == 0.
|
||||
* \param output The buffer to where the decrypted data is written.
|
||||
* This pointer can be NULL if ilen == 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if one or more of the required parameters are NULL.
|
||||
* \return #MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED
|
||||
* if the data was not authentic.
|
||||
*/
|
||||
int mbedtls_chachapoly_auth_decrypt( mbedtls_chachapoly_context *ctx,
|
||||
size_t length,
|
||||
const unsigned char nonce[12],
|
||||
const unsigned char *aad,
|
||||
size_t aad_len,
|
||||
const unsigned char tag[16],
|
||||
const unsigned char *input,
|
||||
unsigned char *output );
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
/**
|
||||
* \brief The ChaCha20-Poly1305 checkup routine.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return \c 1 on failure.
|
||||
*/
|
||||
int mbedtls_chachapoly_self_test( int verbose );
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* MBEDTLS_CHACHAPOLY_H */
|
||||
|
|
@ -37,7 +37,7 @@
|
|||
|
||||
#include <stddef.h>
|
||||
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
#define MBEDTLS_CIPHER_MODE_AEAD
|
||||
#endif
|
||||
|
||||
|
|
@ -87,6 +87,7 @@ typedef enum {
|
|||
MBEDTLS_CIPHER_ID_BLOWFISH, /**< The Blowfish cipher. */
|
||||
MBEDTLS_CIPHER_ID_ARC4, /**< The RC4 cipher. */
|
||||
MBEDTLS_CIPHER_ID_ARIA, /**< The Aria cipher. */
|
||||
MBEDTLS_CIPHER_ID_CHACHA20, /**< The ChaCha20 cipher. */
|
||||
} mbedtls_cipher_id_t;
|
||||
|
||||
/**
|
||||
|
|
@ -169,6 +170,8 @@ typedef enum {
|
|||
MBEDTLS_CIPHER_AES_256_OFB, /**< AES 256-bit cipher in OFB mode. */
|
||||
MBEDTLS_CIPHER_AES_128_XTS, /**< AES 128-bit cipher in XTS block mode. */
|
||||
MBEDTLS_CIPHER_AES_256_XTS, /**< AES 256-bit cipher in XTS block mode. */
|
||||
MBEDTLS_CIPHER_CHACHA20, /**< ChaCha20 stream cipher. */
|
||||
MBEDTLS_CIPHER_CHACHA20_POLY1305, /**< ChaCha20-Poly1305 AEAD cipher. */
|
||||
} mbedtls_cipher_type_t;
|
||||
|
||||
/** Supported cipher modes. */
|
||||
|
|
@ -183,6 +186,7 @@ typedef enum {
|
|||
MBEDTLS_MODE_STREAM, /**< The stream cipher mode. */
|
||||
MBEDTLS_MODE_CCM, /**< The CCM cipher mode. */
|
||||
MBEDTLS_MODE_XTS, /**< The XTS cipher mode. */
|
||||
MBEDTLS_MODE_CHACHAPOLY, /**< The ChaCha-Poly cipher mode. */
|
||||
} mbedtls_cipher_mode_t;
|
||||
|
||||
/** Supported cipher padding types. */
|
||||
|
|
@ -586,11 +590,11 @@ int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
|
|||
*/
|
||||
int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
/**
|
||||
* \brief This function adds additional data for AEAD ciphers.
|
||||
* Only supported with GCM. Must be called
|
||||
* exactly once, after mbedtls_cipher_reset().
|
||||
* Currently supported with GCM and ChaCha20+Poly1305.
|
||||
* Must be called exactly once, after mbedtls_cipher_reset().
|
||||
*
|
||||
* \param ctx The generic cipher context.
|
||||
* \param ad The additional data to use.
|
||||
|
|
@ -601,7 +605,7 @@ int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx );
|
|||
*/
|
||||
int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *ad, size_t ad_len );
|
||||
#endif /* MBEDTLS_GCM_C */
|
||||
#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
/**
|
||||
* \brief The generic cipher update function. It encrypts or
|
||||
|
|
@ -659,10 +663,10 @@ int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *i
|
|||
int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
|
||||
unsigned char *output, size_t *olen );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
/**
|
||||
* \brief This function writes a tag for AEAD ciphers.
|
||||
* Only supported with GCM.
|
||||
* Currently supported with GCM and ChaCha20+Poly1305.
|
||||
* Must be called after mbedtls_cipher_finish().
|
||||
*
|
||||
* \param ctx The generic cipher context.
|
||||
|
|
@ -677,7 +681,7 @@ int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
|
|||
|
||||
/**
|
||||
* \brief This function checks the tag for AEAD ciphers.
|
||||
* Only supported with GCM.
|
||||
* Currently supported with GCM and ChaCha20+Poly1305.
|
||||
* Must be called after mbedtls_cipher_finish().
|
||||
*
|
||||
* \param ctx The generic cipher context.
|
||||
|
|
@ -689,7 +693,7 @@ int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
|
|||
*/
|
||||
int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *tag, size_t tag_len );
|
||||
#endif /* MBEDTLS_GCM_C */
|
||||
#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
/**
|
||||
* \brief The generic all-in-one encryption/decryption function,
|
||||
|
|
|
|||
|
|
@ -88,6 +88,28 @@
|
|||
*/
|
||||
//#define MBEDTLS_NO_UDBL_DIVISION
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_NO_64BIT_MULTIPLICATION
|
||||
*
|
||||
* The platform lacks support for 32x32 -> 64-bit multiplication.
|
||||
*
|
||||
* Used in:
|
||||
* library/poly1305.c
|
||||
*
|
||||
* Some parts of the library may use multiplication of two unsigned 32-bit
|
||||
* operands with a 64-bit result in order to speed up computations. On some
|
||||
* platforms, this is not available in hardware and has to be implemented in
|
||||
* software, usually in a library provided by the toolchain.
|
||||
*
|
||||
* Sometimes it is not desirable to have to link to that library. This option
|
||||
* removes the dependency of that library on platforms that lack a hardware
|
||||
* 64-bit multiplier by embedding a software implementation in Mbed TLS.
|
||||
*
|
||||
* Note that depending on the compiler, this may decrease performance compared
|
||||
* to using the library function provided by the toolchain.
|
||||
*/
|
||||
//#define MBEDTLS_NO_64BIT_MULTIPLICATION
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_HAVE_SSE2
|
||||
*
|
||||
|
|
@ -279,6 +301,8 @@
|
|||
//#define MBEDTLS_BLOWFISH_ALT
|
||||
//#define MBEDTLS_CAMELLIA_ALT
|
||||
//#define MBEDTLS_CCM_ALT
|
||||
//#define MBEDTLS_CHACHA20_ALT
|
||||
//#define MBEDTLS_CHACHAPOLY_ALT
|
||||
//#define MBEDTLS_CMAC_ALT
|
||||
//#define MBEDTLS_DES_ALT
|
||||
//#define MBEDTLS_DHM_ALT
|
||||
|
|
@ -287,6 +311,7 @@
|
|||
//#define MBEDTLS_MD2_ALT
|
||||
//#define MBEDTLS_MD4_ALT
|
||||
//#define MBEDTLS_MD5_ALT
|
||||
//#define MBEDTLS_POLY1305_ALT
|
||||
//#define MBEDTLS_RIPEMD160_ALT
|
||||
//#define MBEDTLS_RSA_ALT
|
||||
//#define MBEDTLS_SHA1_ALT
|
||||
|
|
@ -1944,6 +1969,26 @@
|
|||
*/
|
||||
#define MBEDTLS_CERTS_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_CHACHA20_C
|
||||
*
|
||||
* Enable the ChaCha20 stream cipher.
|
||||
*
|
||||
* Module: library/chacha20.c
|
||||
*/
|
||||
#define MBEDTLS_CHACHA20_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_CHACHAPOLY_C
|
||||
*
|
||||
* Enable the ChaCha20-Poly1305 AEAD algorithm.
|
||||
*
|
||||
* Module: library/chachapoly.c
|
||||
*
|
||||
* This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C
|
||||
*/
|
||||
#define MBEDTLS_CHACHAPOLY_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_CIPHER_C
|
||||
*
|
||||
|
|
@ -2486,6 +2531,16 @@
|
|||
*/
|
||||
#define MBEDTLS_PLATFORM_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_POLY1305_C
|
||||
*
|
||||
* Enable the Poly1305 MAC algorithm.
|
||||
*
|
||||
* Module: library/poly1305.c
|
||||
* Caller: library/chachapoly.c
|
||||
*/
|
||||
#define MBEDTLS_POLY1305_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_RIPEMD160_C
|
||||
*
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@
|
|||
* DES 2 0x0032-0x0032 0x0033-0x0033
|
||||
* CTR_DBRG 4 0x0034-0x003A
|
||||
* ENTROPY 3 0x003C-0x0040 0x003D-0x003F
|
||||
* NET 11 0x0042-0x0052 0x0043-0x0045
|
||||
* NET 13 0x0042-0x0052 0x0043-0x0049
|
||||
* ARIA 4 0x0058-0x005E
|
||||
* ASN1 7 0x0060-0x006C
|
||||
* CMAC 1 0x007A-0x007A
|
||||
|
|
@ -77,6 +77,9 @@
|
|||
* SHA1 1 0x0035-0x0035
|
||||
* SHA256 1 0x0037-0x0037
|
||||
* SHA512 1 0x0039-0x0039
|
||||
* CHACHA20 3 0x0051-0x0055
|
||||
* POLY1305 3 0x0057-0x005B
|
||||
* CHACHAPOLY 2 0x0054-0x0056
|
||||
*
|
||||
* High-level module nr (3 bits - 0x0...-0x7...)
|
||||
* Name ID Nr of Errors
|
||||
|
|
|
|||
181
include/mbedtls/poly1305.h
Normal file
181
include/mbedtls/poly1305.h
Normal file
|
|
@ -0,0 +1,181 @@
|
|||
/**
|
||||
* \file poly1305.h
|
||||
*
|
||||
* \brief This file contains Poly1305 definitions and functions.
|
||||
*
|
||||
* Poly1305 is a one-time message authenticator that can be used to
|
||||
* authenticate messages. Poly1305-AES was created by Daniel
|
||||
* Bernstein https://cr.yp.to/mac/poly1305-20050329.pdf The generic
|
||||
* Poly1305 algorithm (not tied to AES) was also standardized in RFC
|
||||
* 7539.
|
||||
*
|
||||
* \author Daniel King <damaki.gh@gmail.com>
|
||||
*/
|
||||
|
||||
/* Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of Mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef MBEDTLS_POLY1305_H
|
||||
#define MBEDTLS_POLY1305_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA -0x0057 /**< Invalid input parameter(s). */
|
||||
#define MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE -0x0059 /**< Feature not available. For example, s part of the API is not implemented. */
|
||||
#define MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED -0x005B /**< Poly1305 hardware accelerator failed. */
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_POLY1305_ALT)
|
||||
|
||||
typedef struct
|
||||
{
|
||||
uint32_t r[4]; /** The value for 'r' (low 128 bits of the key). */
|
||||
uint32_t s[4]; /** The value for 's' (high 128 bits of the key). */
|
||||
uint32_t acc[5]; /** The accumulator number. */
|
||||
uint8_t queue[16]; /** The current partial block of data. */
|
||||
size_t queue_len; /** The number of bytes stored in 'queue'. */
|
||||
}
|
||||
mbedtls_poly1305_context;
|
||||
|
||||
#else /* MBEDTLS_POLY1305_ALT */
|
||||
#include "poly1305_alt.h"
|
||||
#endif /* MBEDTLS_POLY1305_ALT */
|
||||
|
||||
/**
|
||||
* \brief This function initializes the specified Poly1305 context.
|
||||
*
|
||||
* It must be the first API called before using
|
||||
* the context.
|
||||
*
|
||||
* It is usually followed by a call to
|
||||
* \c mbedtls_poly1305_starts(), then one or more calls to
|
||||
* \c mbedtls_poly1305_update(), then one call to
|
||||
* \c mbedtls_poly1305_finish(), then finally
|
||||
* \c mbedtls_poly1305_free().
|
||||
*
|
||||
* \param ctx The Poly1305 context to initialize.
|
||||
*/
|
||||
void mbedtls_poly1305_init( mbedtls_poly1305_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief This function releases and clears the specified Poly1305 context.
|
||||
*
|
||||
* \param ctx The Poly1305 context to clear.
|
||||
*/
|
||||
void mbedtls_poly1305_free( mbedtls_poly1305_context *ctx );
|
||||
|
||||
/**
|
||||
* \brief This function sets the one-time authentication key.
|
||||
*
|
||||
* \warning The key must be unique and unpredictable for each
|
||||
* invocation of Poly1305.
|
||||
*
|
||||
* \param ctx The Poly1305 context to which the key should be bound.
|
||||
* \param key The buffer containing the 256-bit key.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if ctx or key are NULL.
|
||||
*/
|
||||
int mbedtls_poly1305_starts( mbedtls_poly1305_context *ctx,
|
||||
const unsigned char key[32] );
|
||||
|
||||
/**
|
||||
* \brief This functions feeds an input buffer into an ongoing
|
||||
* Poly1305 computation.
|
||||
*
|
||||
* It is called between \c mbedtls_cipher_poly1305_starts() and
|
||||
* \c mbedtls_cipher_poly1305_finish().
|
||||
* It can be called repeatedly to process a stream of data.
|
||||
*
|
||||
* \param ctx The Poly1305 context to use for the Poly1305 operation.
|
||||
* \param ilen The length of the input data (in bytes). Any value is accepted.
|
||||
* \param input The buffer holding the input data.
|
||||
* This pointer can be NULL if ilen == 0.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if ctx or input are NULL.
|
||||
*/
|
||||
int mbedtls_poly1305_update( mbedtls_poly1305_context *ctx,
|
||||
const unsigned char *input,
|
||||
size_t ilen );
|
||||
|
||||
/**
|
||||
* \brief This function generates the Poly1305 Message
|
||||
* Authentication Code (MAC).
|
||||
*
|
||||
* \param ctx The Poly1305 context to use for the Poly1305 operation.
|
||||
* \param mac The buffer to where the MAC is written. Must be big enough
|
||||
* to hold the 16-byte MAC.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if ctx or mac are NULL.
|
||||
*/
|
||||
int mbedtls_poly1305_finish( mbedtls_poly1305_context *ctx,
|
||||
unsigned char mac[16] );
|
||||
|
||||
/**
|
||||
* \brief This function calculates the Poly1305 MAC of the input
|
||||
* buffer with the provided key.
|
||||
*
|
||||
* \warning The key must be unique and unpredictable for each
|
||||
* invocation of Poly1305.
|
||||
*
|
||||
* \param key The buffer containing the 256-bit key.
|
||||
* \param ilen The length of the input data (in bytes). Any value is accepted.
|
||||
* \param input The buffer holding the input data.
|
||||
* This pointer can be NULL if ilen == 0.
|
||||
* \param mac The buffer to where the MAC is written. Must be big enough
|
||||
* to hold the 16-byte MAC.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA
|
||||
* if key, input, or mac are NULL.
|
||||
*/
|
||||
int mbedtls_poly1305_mac( const unsigned char key[32],
|
||||
const unsigned char *input,
|
||||
size_t ilen,
|
||||
unsigned char mac[16] );
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
/**
|
||||
* \brief The Poly1305 checkup routine.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return \c 1 on failure.
|
||||
*/
|
||||
int mbedtls_poly1305_self_test( int verbose );
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* MBEDTLS_POLY1305_H */
|
||||
|
|
@ -14,6 +14,8 @@ set(src_crypto
|
|||
blowfish.c
|
||||
camellia.c
|
||||
ccm.c
|
||||
chacha20.c
|
||||
chachapoly.c
|
||||
cipher.c
|
||||
cipher_wrap.c
|
||||
cmac.c
|
||||
|
|
@ -49,6 +51,7 @@ set(src_crypto
|
|||
pkwrite.c
|
||||
platform.c
|
||||
platform_util.c
|
||||
poly1305.c
|
||||
ripemd160.c
|
||||
rsa.c
|
||||
rsa_internal.c
|
||||
|
|
|
|||
|
|
@ -48,10 +48,10 @@ DLEXT=dll
|
|||
endif
|
||||
|
||||
OBJS_CRYPTO= aes.o aesni.o arc4.o \
|
||||
asn1parse.o asn1write.o base64.o \
|
||||
bignum.o blowfish.o camellia.o \
|
||||
aria.o \
|
||||
ccm.o cipher.o cipher_wrap.o \
|
||||
aria.o asn1parse.o asn1write.o \
|
||||
base64.o bignum.o blowfish.o \
|
||||
camellia.o ccm.o chacha20.o \
|
||||
chachapoly.o cipher.o cipher_wrap.o \
|
||||
cmac.o ctr_drbg.o des.o \
|
||||
dhm.o ecdh.o ecdsa.o \
|
||||
ecjpake.o ecp.o \
|
||||
|
|
@ -64,11 +64,11 @@ OBJS_CRYPTO= aes.o aesni.o arc4.o \
|
|||
padlock.o pem.o pk.o \
|
||||
pk_wrap.o pkcs12.o pkcs5.o \
|
||||
pkparse.o pkwrite.o platform.o \
|
||||
platform_util.o ripemd160.o rsa_internal.o \
|
||||
rsa.o sha1.o sha256.o \
|
||||
sha512.o threading.o timing.o \
|
||||
version.o version_features.o \
|
||||
xtea.o
|
||||
platform_util.o poly1305.o \
|
||||
ripemd160.o rsa_internal.o rsa.o \
|
||||
sha1.o sha256.o sha512.o \
|
||||
threading.o timing.o version.o \
|
||||
version_features.o xtea.o
|
||||
|
||||
OBJS_X509= certs.o pkcs11.o x509.o \
|
||||
x509_create.o x509_crl.o x509_crt.o \
|
||||
|
|
|
|||
570
library/chacha20.c
Normal file
570
library/chacha20.c
Normal file
|
|
@ -0,0 +1,570 @@
|
|||
/**
|
||||
* \file chacha20.c
|
||||
*
|
||||
* \brief ChaCha20 cipher.
|
||||
*
|
||||
* \author Daniel King <damaki.gh@gmail.com>
|
||||
*
|
||||
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
|
||||
#include "mbedtls/chacha20.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#include <stddef.h>
|
||||
#include <string.h>
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
#if defined(MBEDTLS_PLATFORM_C)
|
||||
#include "mbedtls/platform.h"
|
||||
#else
|
||||
#include <stdio.h>
|
||||
#define mbedtls_printf printf
|
||||
#endif /* MBEDTLS_PLATFORM_C */
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#if !defined(MBEDTLS_CHACHA20_ALT)
|
||||
|
||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||
!defined(inline) && !defined(__cplusplus)
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
#define BYTES_TO_U32_LE( data, offset ) \
|
||||
( (uint32_t) data[offset] \
|
||||
| (uint32_t) ( (uint32_t) data[( offset ) + 1] << 8 ) \
|
||||
| (uint32_t) ( (uint32_t) data[( offset ) + 2] << 16 ) \
|
||||
| (uint32_t) ( (uint32_t) data[( offset ) + 3] << 24 ) \
|
||||
)
|
||||
|
||||
#define ROTL32( value, amount ) \
|
||||
( (uint32_t) ( value << amount ) | ( value >> ( 32 - amount ) ) )
|
||||
|
||||
#define CHACHA20_CTR_INDEX ( 12U )
|
||||
|
||||
#define CHACHA20_BLOCK_SIZE_BYTES ( 4U * 16U )
|
||||
|
||||
/**
|
||||
* \brief ChaCha20 quarter round operation.
|
||||
*
|
||||
* The quarter round is defined as follows (from RFC 7539):
|
||||
* 1. a += b; d ^= a; d <<<= 16;
|
||||
* 2. c += d; b ^= c; b <<<= 12;
|
||||
* 3. a += b; d ^= a; d <<<= 8;
|
||||
* 4. c += d; b ^= c; b <<<= 7;
|
||||
*
|
||||
* \param state ChaCha20 state to modify.
|
||||
* \param a The index of 'a' in the state.
|
||||
* \param b The index of 'b' in the state.
|
||||
* \param c The index of 'c' in the state.
|
||||
* \param d The index of 'd' in the state.
|
||||
*/
|
||||
static inline void chacha20_quarter_round( uint32_t state[16],
|
||||
size_t a,
|
||||
size_t b,
|
||||
size_t c,
|
||||
size_t d )
|
||||
{
|
||||
/* a += b; d ^= a; d <<<= 16; */
|
||||
state[a] += state[b];
|
||||
state[d] ^= state[a];
|
||||
state[d] = ROTL32( state[d], 16 );
|
||||
|
||||
/* c += d; b ^= c; b <<<= 12 */
|
||||
state[c] += state[d];
|
||||
state[b] ^= state[c];
|
||||
state[b] = ROTL32( state[b], 12 );
|
||||
|
||||
/* a += b; d ^= a; d <<<= 8; */
|
||||
state[a] += state[b];
|
||||
state[d] ^= state[a];
|
||||
state[d] = ROTL32( state[d], 8 );
|
||||
|
||||
/* c += d; b ^= c; b <<<= 7; */
|
||||
state[c] += state[d];
|
||||
state[b] ^= state[c];
|
||||
state[b] = ROTL32( state[b], 7 );
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Perform the ChaCha20 inner block operation.
|
||||
*
|
||||
* This function performs two rounds: the column round and the
|
||||
* diagonal round.
|
||||
*
|
||||
* \param state The ChaCha20 state to update.
|
||||
*/
|
||||
static void chacha20_inner_block( uint32_t state[16] )
|
||||
{
|
||||
chacha20_quarter_round( state, 0, 4, 8, 12 );
|
||||
chacha20_quarter_round( state, 1, 5, 9, 13 );
|
||||
chacha20_quarter_round( state, 2, 6, 10, 14 );
|
||||
chacha20_quarter_round( state, 3, 7, 11, 15 );
|
||||
|
||||
chacha20_quarter_round( state, 0, 5, 10, 15 );
|
||||
chacha20_quarter_round( state, 1, 6, 11, 12 );
|
||||
chacha20_quarter_round( state, 2, 7, 8, 13 );
|
||||
chacha20_quarter_round( state, 3, 4, 9, 14 );
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Generates a keystream block.
|
||||
*
|
||||
* \param initial_state The initial ChaCha20 state (key, nonce, counter).
|
||||
* \param keystream Generated keystream bytes are written to this buffer.
|
||||
*/
|
||||
static void chacha20_block( const uint32_t initial_state[16],
|
||||
unsigned char keystream[64] )
|
||||
{
|
||||
uint32_t working_state[16];
|
||||
size_t i;
|
||||
|
||||
memcpy( working_state,
|
||||
initial_state,
|
||||
CHACHA20_BLOCK_SIZE_BYTES );
|
||||
|
||||
for( i = 0U; i < 10U; i++ )
|
||||
chacha20_inner_block( working_state );
|
||||
|
||||
working_state[ 0] += initial_state[ 0];
|
||||
working_state[ 1] += initial_state[ 1];
|
||||
working_state[ 2] += initial_state[ 2];
|
||||
working_state[ 3] += initial_state[ 3];
|
||||
working_state[ 4] += initial_state[ 4];
|
||||
working_state[ 5] += initial_state[ 5];
|
||||
working_state[ 6] += initial_state[ 6];
|
||||
working_state[ 7] += initial_state[ 7];
|
||||
working_state[ 8] += initial_state[ 8];
|
||||
working_state[ 9] += initial_state[ 9];
|
||||
working_state[10] += initial_state[10];
|
||||
working_state[11] += initial_state[11];
|
||||
working_state[12] += initial_state[12];
|
||||
working_state[13] += initial_state[13];
|
||||
working_state[14] += initial_state[14];
|
||||
working_state[15] += initial_state[15];
|
||||
|
||||
for( i = 0U; i < 16; i++ )
|
||||
{
|
||||
size_t offset = i * 4U;
|
||||
|
||||
keystream[offset ] = (unsigned char)( working_state[i] );
|
||||
keystream[offset + 1U] = (unsigned char)( working_state[i] >> 8 );
|
||||
keystream[offset + 2U] = (unsigned char)( working_state[i] >> 16 );
|
||||
keystream[offset + 3U] = (unsigned char)( working_state[i] >> 24 );
|
||||
}
|
||||
|
||||
mbedtls_platform_zeroize( working_state, sizeof( working_state ) );
|
||||
}
|
||||
|
||||
void mbedtls_chacha20_init( mbedtls_chacha20_context *ctx )
|
||||
{
|
||||
if( ctx != NULL )
|
||||
{
|
||||
mbedtls_platform_zeroize( ctx->state, sizeof( ctx->state ) );
|
||||
mbedtls_platform_zeroize( ctx->keystream8, sizeof( ctx->keystream8 ) );
|
||||
|
||||
/* Initially, there's no keystream bytes available */
|
||||
ctx->keystream_bytes_used = CHACHA20_BLOCK_SIZE_BYTES;
|
||||
}
|
||||
}
|
||||
|
||||
void mbedtls_chacha20_free( mbedtls_chacha20_context *ctx )
|
||||
{
|
||||
if( ctx != NULL )
|
||||
{
|
||||
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_chacha20_context ) );
|
||||
}
|
||||
}
|
||||
|
||||
int mbedtls_chacha20_setkey( mbedtls_chacha20_context *ctx,
|
||||
const unsigned char key[32] )
|
||||
{
|
||||
if( ( ctx == NULL ) || ( key == NULL ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
/* ChaCha20 constants - the string "expand 32-byte k" */
|
||||
ctx->state[0] = 0x61707865;
|
||||
ctx->state[1] = 0x3320646e;
|
||||
ctx->state[2] = 0x79622d32;
|
||||
ctx->state[3] = 0x6b206574;
|
||||
|
||||
/* Set key */
|
||||
ctx->state[4] = BYTES_TO_U32_LE( key, 0 );
|
||||
ctx->state[5] = BYTES_TO_U32_LE( key, 4 );
|
||||
ctx->state[6] = BYTES_TO_U32_LE( key, 8 );
|
||||
ctx->state[7] = BYTES_TO_U32_LE( key, 12 );
|
||||
ctx->state[8] = BYTES_TO_U32_LE( key, 16 );
|
||||
ctx->state[9] = BYTES_TO_U32_LE( key, 20 );
|
||||
ctx->state[10] = BYTES_TO_U32_LE( key, 24 );
|
||||
ctx->state[11] = BYTES_TO_U32_LE( key, 28 );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_chacha20_starts( mbedtls_chacha20_context* ctx,
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter )
|
||||
{
|
||||
if( ( ctx == NULL ) || ( nonce == NULL ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
/* Counter */
|
||||
ctx->state[12] = counter;
|
||||
|
||||
/* Nonce */
|
||||
ctx->state[13] = BYTES_TO_U32_LE( nonce, 0 );
|
||||
ctx->state[14] = BYTES_TO_U32_LE( nonce, 4 );
|
||||
ctx->state[15] = BYTES_TO_U32_LE( nonce, 8 );
|
||||
|
||||
mbedtls_platform_zeroize( ctx->keystream8, sizeof( ctx->keystream8 ) );
|
||||
|
||||
/* Initially, there's no keystream bytes available */
|
||||
ctx->keystream_bytes_used = CHACHA20_BLOCK_SIZE_BYTES;
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_chacha20_update( mbedtls_chacha20_context *ctx,
|
||||
size_t size,
|
||||
const unsigned char *input,
|
||||
unsigned char *output )
|
||||
{
|
||||
size_t offset = 0U;
|
||||
size_t i;
|
||||
|
||||
if( ctx == NULL )
|
||||
{
|
||||
return( MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
}
|
||||
else if( ( size > 0U ) && ( ( input == NULL ) || ( output == NULL ) ) )
|
||||
{
|
||||
/* input and output pointers are allowed to be NULL only if size == 0 */
|
||||
return( MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
/* Use leftover keystream bytes, if available */
|
||||
while( size > 0U && ctx->keystream_bytes_used < CHACHA20_BLOCK_SIZE_BYTES )
|
||||
{
|
||||
output[offset] = input[offset]
|
||||
^ ctx->keystream8[ctx->keystream_bytes_used];
|
||||
|
||||
ctx->keystream_bytes_used++;
|
||||
offset++;
|
||||
size--;
|
||||
}
|
||||
|
||||
/* Process full blocks */
|
||||
while( size >= CHACHA20_BLOCK_SIZE_BYTES )
|
||||
{
|
||||
/* Generate new keystream block and increment counter */
|
||||
chacha20_block( ctx->state, ctx->keystream8 );
|
||||
ctx->state[CHACHA20_CTR_INDEX]++;
|
||||
|
||||
for( i = 0U; i < 64U; i += 8U )
|
||||
{
|
||||
output[offset + i ] = input[offset + i ] ^ ctx->keystream8[i ];
|
||||
output[offset + i+1] = input[offset + i+1] ^ ctx->keystream8[i+1];
|
||||
output[offset + i+2] = input[offset + i+2] ^ ctx->keystream8[i+2];
|
||||
output[offset + i+3] = input[offset + i+3] ^ ctx->keystream8[i+3];
|
||||
output[offset + i+4] = input[offset + i+4] ^ ctx->keystream8[i+4];
|
||||
output[offset + i+5] = input[offset + i+5] ^ ctx->keystream8[i+5];
|
||||
output[offset + i+6] = input[offset + i+6] ^ ctx->keystream8[i+6];
|
||||
output[offset + i+7] = input[offset + i+7] ^ ctx->keystream8[i+7];
|
||||
}
|
||||
|
||||
offset += CHACHA20_BLOCK_SIZE_BYTES;
|
||||
size -= CHACHA20_BLOCK_SIZE_BYTES;
|
||||
}
|
||||
|
||||
/* Last (partial) block */
|
||||
if( size > 0U )
|
||||
{
|
||||
/* Generate new keystream block and increment counter */
|
||||
chacha20_block( ctx->state, ctx->keystream8 );
|
||||
ctx->state[CHACHA20_CTR_INDEX]++;
|
||||
|
||||
for( i = 0U; i < size; i++)
|
||||
{
|
||||
output[offset + i] = input[offset + i] ^ ctx->keystream8[i];
|
||||
}
|
||||
|
||||
ctx->keystream_bytes_used = size;
|
||||
|
||||
}
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_chacha20_crypt( const unsigned char key[32],
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter,
|
||||
size_t data_len,
|
||||
const unsigned char* input,
|
||||
unsigned char* output )
|
||||
{
|
||||
mbedtls_chacha20_context ctx;
|
||||
int ret;
|
||||
|
||||
mbedtls_chacha20_init( &ctx );
|
||||
|
||||
ret = mbedtls_chacha20_setkey( &ctx, key );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_chacha20_starts( &ctx, nonce, counter );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_chacha20_update( &ctx, data_len, input, output );
|
||||
|
||||
cleanup:
|
||||
mbedtls_chacha20_free( &ctx );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#endif /* !MBEDTLS_CHACHA20_ALT */
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
|
||||
static const unsigned char test_keys[2][32] =
|
||||
{
|
||||
{
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
},
|
||||
{
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
|
||||
}
|
||||
};
|
||||
|
||||
static const unsigned char test_nonces[2][12] =
|
||||
{
|
||||
{
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00
|
||||
},
|
||||
{
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x02
|
||||
}
|
||||
};
|
||||
|
||||
static const uint32_t test_counters[2] =
|
||||
{
|
||||
0U,
|
||||
1U
|
||||
};
|
||||
|
||||
static const unsigned char test_input[2][375] =
|
||||
{
|
||||
{
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
},
|
||||
{
|
||||
0x41, 0x6e, 0x79, 0x20, 0x73, 0x75, 0x62, 0x6d,
|
||||
0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x20, 0x74,
|
||||
0x6f, 0x20, 0x74, 0x68, 0x65, 0x20, 0x49, 0x45,
|
||||
0x54, 0x46, 0x20, 0x69, 0x6e, 0x74, 0x65, 0x6e,
|
||||
0x64, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x74,
|
||||
0x68, 0x65, 0x20, 0x43, 0x6f, 0x6e, 0x74, 0x72,
|
||||
0x69, 0x62, 0x75, 0x74, 0x6f, 0x72, 0x20, 0x66,
|
||||
0x6f, 0x72, 0x20, 0x70, 0x75, 0x62, 0x6c, 0x69,
|
||||
0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x61,
|
||||
0x73, 0x20, 0x61, 0x6c, 0x6c, 0x20, 0x6f, 0x72,
|
||||
0x20, 0x70, 0x61, 0x72, 0x74, 0x20, 0x6f, 0x66,
|
||||
0x20, 0x61, 0x6e, 0x20, 0x49, 0x45, 0x54, 0x46,
|
||||
0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65,
|
||||
0x74, 0x2d, 0x44, 0x72, 0x61, 0x66, 0x74, 0x20,
|
||||
0x6f, 0x72, 0x20, 0x52, 0x46, 0x43, 0x20, 0x61,
|
||||
0x6e, 0x64, 0x20, 0x61, 0x6e, 0x79, 0x20, 0x73,
|
||||
0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74,
|
||||
0x20, 0x6d, 0x61, 0x64, 0x65, 0x20, 0x77, 0x69,
|
||||
0x74, 0x68, 0x69, 0x6e, 0x20, 0x74, 0x68, 0x65,
|
||||
0x20, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74,
|
||||
0x20, 0x6f, 0x66, 0x20, 0x61, 0x6e, 0x20, 0x49,
|
||||
0x45, 0x54, 0x46, 0x20, 0x61, 0x63, 0x74, 0x69,
|
||||
0x76, 0x69, 0x74, 0x79, 0x20, 0x69, 0x73, 0x20,
|
||||
0x63, 0x6f, 0x6e, 0x73, 0x69, 0x64, 0x65, 0x72,
|
||||
0x65, 0x64, 0x20, 0x61, 0x6e, 0x20, 0x22, 0x49,
|
||||
0x45, 0x54, 0x46, 0x20, 0x43, 0x6f, 0x6e, 0x74,
|
||||
0x72, 0x69, 0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e,
|
||||
0x22, 0x2e, 0x20, 0x53, 0x75, 0x63, 0x68, 0x20,
|
||||
0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e,
|
||||
0x74, 0x73, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75,
|
||||
0x64, 0x65, 0x20, 0x6f, 0x72, 0x61, 0x6c, 0x20,
|
||||
0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e,
|
||||
0x74, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x49, 0x45,
|
||||
0x54, 0x46, 0x20, 0x73, 0x65, 0x73, 0x73, 0x69,
|
||||
0x6f, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x73, 0x20,
|
||||
0x77, 0x65, 0x6c, 0x6c, 0x20, 0x61, 0x73, 0x20,
|
||||
0x77, 0x72, 0x69, 0x74, 0x74, 0x65, 0x6e, 0x20,
|
||||
0x61, 0x6e, 0x64, 0x20, 0x65, 0x6c, 0x65, 0x63,
|
||||
0x74, 0x72, 0x6f, 0x6e, 0x69, 0x63, 0x20, 0x63,
|
||||
0x6f, 0x6d, 0x6d, 0x75, 0x6e, 0x69, 0x63, 0x61,
|
||||
0x74, 0x69, 0x6f, 0x6e, 0x73, 0x20, 0x6d, 0x61,
|
||||
0x64, 0x65, 0x20, 0x61, 0x74, 0x20, 0x61, 0x6e,
|
||||
0x79, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x20, 0x6f,
|
||||
0x72, 0x20, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x2c,
|
||||
0x20, 0x77, 0x68, 0x69, 0x63, 0x68, 0x20, 0x61,
|
||||
0x72, 0x65, 0x20, 0x61, 0x64, 0x64, 0x72, 0x65,
|
||||
0x73, 0x73, 0x65, 0x64, 0x20, 0x74, 0x6f
|
||||
}
|
||||
};
|
||||
|
||||
static const unsigned char test_output[2][375] =
|
||||
{
|
||||
{
|
||||
0x76, 0xb8, 0xe0, 0xad, 0xa0, 0xf1, 0x3d, 0x90,
|
||||
0x40, 0x5d, 0x6a, 0xe5, 0x53, 0x86, 0xbd, 0x28,
|
||||
0xbd, 0xd2, 0x19, 0xb8, 0xa0, 0x8d, 0xed, 0x1a,
|
||||
0xa8, 0x36, 0xef, 0xcc, 0x8b, 0x77, 0x0d, 0xc7,
|
||||
0xda, 0x41, 0x59, 0x7c, 0x51, 0x57, 0x48, 0x8d,
|
||||
0x77, 0x24, 0xe0, 0x3f, 0xb8, 0xd8, 0x4a, 0x37,
|
||||
0x6a, 0x43, 0xb8, 0xf4, 0x15, 0x18, 0xa1, 0x1c,
|
||||
0xc3, 0x87, 0xb6, 0x69, 0xb2, 0xee, 0x65, 0x86
|
||||
},
|
||||
{
|
||||
0xa3, 0xfb, 0xf0, 0x7d, 0xf3, 0xfa, 0x2f, 0xde,
|
||||
0x4f, 0x37, 0x6c, 0xa2, 0x3e, 0x82, 0x73, 0x70,
|
||||
0x41, 0x60, 0x5d, 0x9f, 0x4f, 0x4f, 0x57, 0xbd,
|
||||
0x8c, 0xff, 0x2c, 0x1d, 0x4b, 0x79, 0x55, 0xec,
|
||||
0x2a, 0x97, 0x94, 0x8b, 0xd3, 0x72, 0x29, 0x15,
|
||||
0xc8, 0xf3, 0xd3, 0x37, 0xf7, 0xd3, 0x70, 0x05,
|
||||
0x0e, 0x9e, 0x96, 0xd6, 0x47, 0xb7, 0xc3, 0x9f,
|
||||
0x56, 0xe0, 0x31, 0xca, 0x5e, 0xb6, 0x25, 0x0d,
|
||||
0x40, 0x42, 0xe0, 0x27, 0x85, 0xec, 0xec, 0xfa,
|
||||
0x4b, 0x4b, 0xb5, 0xe8, 0xea, 0xd0, 0x44, 0x0e,
|
||||
0x20, 0xb6, 0xe8, 0xdb, 0x09, 0xd8, 0x81, 0xa7,
|
||||
0xc6, 0x13, 0x2f, 0x42, 0x0e, 0x52, 0x79, 0x50,
|
||||
0x42, 0xbd, 0xfa, 0x77, 0x73, 0xd8, 0xa9, 0x05,
|
||||
0x14, 0x47, 0xb3, 0x29, 0x1c, 0xe1, 0x41, 0x1c,
|
||||
0x68, 0x04, 0x65, 0x55, 0x2a, 0xa6, 0xc4, 0x05,
|
||||
0xb7, 0x76, 0x4d, 0x5e, 0x87, 0xbe, 0xa8, 0x5a,
|
||||
0xd0, 0x0f, 0x84, 0x49, 0xed, 0x8f, 0x72, 0xd0,
|
||||
0xd6, 0x62, 0xab, 0x05, 0x26, 0x91, 0xca, 0x66,
|
||||
0x42, 0x4b, 0xc8, 0x6d, 0x2d, 0xf8, 0x0e, 0xa4,
|
||||
0x1f, 0x43, 0xab, 0xf9, 0x37, 0xd3, 0x25, 0x9d,
|
||||
0xc4, 0xb2, 0xd0, 0xdf, 0xb4, 0x8a, 0x6c, 0x91,
|
||||
0x39, 0xdd, 0xd7, 0xf7, 0x69, 0x66, 0xe9, 0x28,
|
||||
0xe6, 0x35, 0x55, 0x3b, 0xa7, 0x6c, 0x5c, 0x87,
|
||||
0x9d, 0x7b, 0x35, 0xd4, 0x9e, 0xb2, 0xe6, 0x2b,
|
||||
0x08, 0x71, 0xcd, 0xac, 0x63, 0x89, 0x39, 0xe2,
|
||||
0x5e, 0x8a, 0x1e, 0x0e, 0xf9, 0xd5, 0x28, 0x0f,
|
||||
0xa8, 0xca, 0x32, 0x8b, 0x35, 0x1c, 0x3c, 0x76,
|
||||
0x59, 0x89, 0xcb, 0xcf, 0x3d, 0xaa, 0x8b, 0x6c,
|
||||
0xcc, 0x3a, 0xaf, 0x9f, 0x39, 0x79, 0xc9, 0x2b,
|
||||
0x37, 0x20, 0xfc, 0x88, 0xdc, 0x95, 0xed, 0x84,
|
||||
0xa1, 0xbe, 0x05, 0x9c, 0x64, 0x99, 0xb9, 0xfd,
|
||||
0xa2, 0x36, 0xe7, 0xe8, 0x18, 0xb0, 0x4b, 0x0b,
|
||||
0xc3, 0x9c, 0x1e, 0x87, 0x6b, 0x19, 0x3b, 0xfe,
|
||||
0x55, 0x69, 0x75, 0x3f, 0x88, 0x12, 0x8c, 0xc0,
|
||||
0x8a, 0xaa, 0x9b, 0x63, 0xd1, 0xa1, 0x6f, 0x80,
|
||||
0xef, 0x25, 0x54, 0xd7, 0x18, 0x9c, 0x41, 0x1f,
|
||||
0x58, 0x69, 0xca, 0x52, 0xc5, 0xb8, 0x3f, 0xa3,
|
||||
0x6f, 0xf2, 0x16, 0xb9, 0xc1, 0xd3, 0x00, 0x62,
|
||||
0xbe, 0xbc, 0xfd, 0x2d, 0xc5, 0xbc, 0xe0, 0x91,
|
||||
0x19, 0x34, 0xfd, 0xa7, 0x9a, 0x86, 0xf6, 0xe6,
|
||||
0x98, 0xce, 0xd7, 0x59, 0xc3, 0xff, 0x9b, 0x64,
|
||||
0x77, 0x33, 0x8f, 0x3d, 0xa4, 0xf9, 0xcd, 0x85,
|
||||
0x14, 0xea, 0x99, 0x82, 0xcc, 0xaf, 0xb3, 0x41,
|
||||
0xb2, 0x38, 0x4d, 0xd9, 0x02, 0xf3, 0xd1, 0xab,
|
||||
0x7a, 0xc6, 0x1d, 0xd2, 0x9c, 0x6f, 0x21, 0xba,
|
||||
0x5b, 0x86, 0x2f, 0x37, 0x30, 0xe3, 0x7c, 0xfd,
|
||||
0xc4, 0xfd, 0x80, 0x6c, 0x22, 0xf2, 0x21
|
||||
}
|
||||
};
|
||||
|
||||
static const size_t test_lengths[2] =
|
||||
{
|
||||
64U,
|
||||
375U
|
||||
};
|
||||
|
||||
#define ASSERT( cond, args ) \
|
||||
do \
|
||||
{ \
|
||||
if( ! ( cond ) ) \
|
||||
{ \
|
||||
if( verbose != 0 ) \
|
||||
mbedtls_printf args; \
|
||||
\
|
||||
return( -1 ); \
|
||||
} \
|
||||
} \
|
||||
while( 0 )
|
||||
|
||||
int mbedtls_chacha20_self_test( int verbose )
|
||||
{
|
||||
unsigned char output[381];
|
||||
unsigned i;
|
||||
int ret;
|
||||
|
||||
for( i = 0U; i < 2U; i++ )
|
||||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( " ChaCha20 test %u ", i );
|
||||
|
||||
ret = mbedtls_chacha20_crypt( test_keys[i],
|
||||
test_nonces[i],
|
||||
test_counters[i],
|
||||
test_lengths[i],
|
||||
test_input[i],
|
||||
output );
|
||||
|
||||
ASSERT( 0 == ret, ( "error code: %i\n", ret ) );
|
||||
|
||||
ASSERT( 0 == memcmp( output, test_output[i], test_lengths[i] ),
|
||||
( "failed (output)\n" ) );
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "passed\n" );
|
||||
}
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "\n" );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#endif /* !MBEDTLS_CHACHA20_C */
|
||||
547
library/chachapoly.c
Normal file
547
library/chachapoly.c
Normal file
|
|
@ -0,0 +1,547 @@
|
|||
/**
|
||||
* \file chachapoly.c
|
||||
*
|
||||
* \brief ChaCha20-Poly1305 AEAD construction based on RFC 7539.
|
||||
*
|
||||
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
|
||||
#include "mbedtls/chachapoly.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
#if defined(MBEDTLS_PLATFORM_C)
|
||||
#include "mbedtls/platform.h"
|
||||
#else
|
||||
#include <stdio.h>
|
||||
#define mbedtls_printf printf
|
||||
#endif /* MBEDTLS_PLATFORM_C */
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#if !defined(MBEDTLS_CHACHAPOLY_ALT)
|
||||
|
||||
#define CHACHAPOLY_STATE_INIT ( 0 )
|
||||
#define CHACHAPOLY_STATE_AAD ( 1 )
|
||||
#define CHACHAPOLY_STATE_CIPHERTEXT ( 2 ) /* Encrypting or decrypting */
|
||||
#define CHACHAPOLY_STATE_FINISHED ( 3 )
|
||||
|
||||
/**
|
||||
* \brief Adds nul bytes to pad the AAD for Poly1305.
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context.
|
||||
*/
|
||||
static int chachapoly_pad_aad( mbedtls_chachapoly_context *ctx )
|
||||
{
|
||||
uint32_t partial_block_len = (uint32_t) ( ctx->aad_len % 16U );
|
||||
unsigned char zeroes[15];
|
||||
|
||||
if( partial_block_len == 0U )
|
||||
return( 0 );
|
||||
|
||||
memset( zeroes, 0, sizeof( zeroes ) );
|
||||
|
||||
return( mbedtls_poly1305_update( &ctx->poly1305_ctx,
|
||||
zeroes,
|
||||
16U - partial_block_len ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Adds nul bytes to pad the ciphertext for Poly1305.
|
||||
*
|
||||
* \param ctx The ChaCha20-Poly1305 context.
|
||||
*/
|
||||
static int chachapoly_pad_ciphertext( mbedtls_chachapoly_context *ctx )
|
||||
{
|
||||
uint32_t partial_block_len = (uint32_t) ( ctx->ciphertext_len % 16U );
|
||||
unsigned char zeroes[15];
|
||||
|
||||
if( partial_block_len == 0U )
|
||||
return( 0 );
|
||||
|
||||
memset( zeroes, 0, sizeof( zeroes ) );
|
||||
return( mbedtls_poly1305_update( &ctx->poly1305_ctx,
|
||||
zeroes,
|
||||
16U - partial_block_len ) );
|
||||
}
|
||||
|
||||
void mbedtls_chachapoly_init( mbedtls_chachapoly_context *ctx )
|
||||
{
|
||||
if( ctx != NULL )
|
||||
{
|
||||
mbedtls_chacha20_init( &ctx->chacha20_ctx );
|
||||
mbedtls_poly1305_init( &ctx->poly1305_ctx );
|
||||
ctx->aad_len = 0U;
|
||||
ctx->ciphertext_len = 0U;
|
||||
ctx->state = CHACHAPOLY_STATE_INIT;
|
||||
ctx->mode = MBEDTLS_CHACHAPOLY_ENCRYPT;
|
||||
}
|
||||
}
|
||||
|
||||
void mbedtls_chachapoly_free( mbedtls_chachapoly_context *ctx )
|
||||
{
|
||||
if( ctx != NULL )
|
||||
{
|
||||
mbedtls_chacha20_free( &ctx->chacha20_ctx );
|
||||
mbedtls_poly1305_free( &ctx->poly1305_ctx );
|
||||
ctx->aad_len = 0U;
|
||||
ctx->ciphertext_len = 0U;
|
||||
ctx->state = CHACHAPOLY_STATE_INIT;
|
||||
ctx->mode = MBEDTLS_CHACHAPOLY_ENCRYPT;
|
||||
}
|
||||
}
|
||||
|
||||
int mbedtls_chachapoly_setkey( mbedtls_chachapoly_context *ctx,
|
||||
const unsigned char key[32] )
|
||||
{
|
||||
int ret;
|
||||
|
||||
if( ( ctx == NULL ) || ( key == NULL ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
ret = mbedtls_chacha20_setkey( &ctx->chacha20_ctx, key );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
int mbedtls_chachapoly_starts( mbedtls_chachapoly_context *ctx,
|
||||
const unsigned char nonce[12],
|
||||
mbedtls_chachapoly_mode_t mode )
|
||||
{
|
||||
int ret;
|
||||
unsigned char poly1305_key[64];
|
||||
|
||||
if( ( ctx == NULL ) || ( nonce == NULL ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
/* Set counter = 0, will be update to 1 when generating Poly1305 key */
|
||||
ret = mbedtls_chacha20_starts( &ctx->chacha20_ctx, nonce, 0U );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
/* Generate the Poly1305 key by getting the ChaCha20 keystream output with
|
||||
* counter = 0. This is the same as encrypting a buffer of zeroes.
|
||||
* Only the first 256-bits (32 bytes) of the key is used for Poly1305.
|
||||
* The other 256 bits are discarded.
|
||||
*/
|
||||
memset( poly1305_key, 0, sizeof( poly1305_key ) );
|
||||
ret = mbedtls_chacha20_update( &ctx->chacha20_ctx, sizeof( poly1305_key ),
|
||||
poly1305_key, poly1305_key );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_poly1305_starts( &ctx->poly1305_ctx, poly1305_key );
|
||||
|
||||
if( ret == 0 )
|
||||
{
|
||||
ctx->aad_len = 0U;
|
||||
ctx->ciphertext_len = 0U;
|
||||
ctx->state = CHACHAPOLY_STATE_AAD;
|
||||
ctx->mode = mode;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
mbedtls_platform_zeroize( poly1305_key, 64U );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
int mbedtls_chachapoly_update_aad( mbedtls_chachapoly_context *ctx,
|
||||
const unsigned char *aad,
|
||||
size_t aad_len )
|
||||
{
|
||||
if( ctx == NULL )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
else if( ( aad_len > 0U ) && ( aad == NULL ) )
|
||||
{
|
||||
/* aad pointer is allowed to be NULL if aad_len == 0 */
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
else if( ctx->state != CHACHAPOLY_STATE_AAD )
|
||||
{
|
||||
return( MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
}
|
||||
|
||||
ctx->aad_len += aad_len;
|
||||
|
||||
return( mbedtls_poly1305_update( &ctx->poly1305_ctx, aad, aad_len ) );
|
||||
}
|
||||
|
||||
int mbedtls_chachapoly_update( mbedtls_chachapoly_context *ctx,
|
||||
size_t len,
|
||||
const unsigned char *input,
|
||||
unsigned char *output )
|
||||
{
|
||||
int ret;
|
||||
|
||||
if( ctx == NULL )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
else if( ( len > 0U ) && ( ( input == NULL ) || ( output == NULL ) ) )
|
||||
{
|
||||
/* input and output pointers are allowed to be NULL if len == 0 */
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
else if( ( ctx->state != CHACHAPOLY_STATE_AAD ) &&
|
||||
( ctx->state != CHACHAPOLY_STATE_CIPHERTEXT ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
}
|
||||
|
||||
if( ctx->state == CHACHAPOLY_STATE_AAD )
|
||||
{
|
||||
ctx->state = CHACHAPOLY_STATE_CIPHERTEXT;
|
||||
|
||||
ret = chachapoly_pad_aad( ctx );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
}
|
||||
|
||||
ctx->ciphertext_len += len;
|
||||
|
||||
if( ctx->mode == MBEDTLS_CHACHAPOLY_ENCRYPT )
|
||||
{
|
||||
ret = mbedtls_chacha20_update( &ctx->chacha20_ctx, len, input, output );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
|
||||
ret = mbedtls_poly1305_update( &ctx->poly1305_ctx, output, len );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
}
|
||||
else /* DECRYPT */
|
||||
{
|
||||
ret = mbedtls_poly1305_update( &ctx->poly1305_ctx, input, len );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
|
||||
ret = mbedtls_chacha20_update( &ctx->chacha20_ctx, len, input, output );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
}
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_chachapoly_finish( mbedtls_chachapoly_context *ctx,
|
||||
unsigned char mac[16] )
|
||||
{
|
||||
int ret;
|
||||
unsigned char len_block[16];
|
||||
|
||||
if( ( ctx == NULL ) || ( mac == NULL ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
else if( ctx->state == CHACHAPOLY_STATE_INIT )
|
||||
{
|
||||
return( MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
}
|
||||
|
||||
if( ctx->state == CHACHAPOLY_STATE_AAD )
|
||||
{
|
||||
ret = chachapoly_pad_aad( ctx );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
}
|
||||
else if( ctx->state == CHACHAPOLY_STATE_CIPHERTEXT )
|
||||
{
|
||||
ret = chachapoly_pad_ciphertext( ctx );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
}
|
||||
|
||||
ctx->state = CHACHAPOLY_STATE_FINISHED;
|
||||
|
||||
/* The lengths of the AAD and ciphertext are processed by
|
||||
* Poly1305 as the final 128-bit block, encoded as little-endian integers.
|
||||
*/
|
||||
len_block[ 0] = (unsigned char)( ctx->aad_len );
|
||||
len_block[ 1] = (unsigned char)( ctx->aad_len >> 8 );
|
||||
len_block[ 2] = (unsigned char)( ctx->aad_len >> 16 );
|
||||
len_block[ 3] = (unsigned char)( ctx->aad_len >> 24 );
|
||||
len_block[ 4] = (unsigned char)( ctx->aad_len >> 32 );
|
||||
len_block[ 5] = (unsigned char)( ctx->aad_len >> 40 );
|
||||
len_block[ 6] = (unsigned char)( ctx->aad_len >> 48 );
|
||||
len_block[ 7] = (unsigned char)( ctx->aad_len >> 56 );
|
||||
len_block[ 8] = (unsigned char)( ctx->ciphertext_len );
|
||||
len_block[ 9] = (unsigned char)( ctx->ciphertext_len >> 8 );
|
||||
len_block[10] = (unsigned char)( ctx->ciphertext_len >> 16 );
|
||||
len_block[11] = (unsigned char)( ctx->ciphertext_len >> 24 );
|
||||
len_block[12] = (unsigned char)( ctx->ciphertext_len >> 32 );
|
||||
len_block[13] = (unsigned char)( ctx->ciphertext_len >> 40 );
|
||||
len_block[14] = (unsigned char)( ctx->ciphertext_len >> 48 );
|
||||
len_block[15] = (unsigned char)( ctx->ciphertext_len >> 56 );
|
||||
|
||||
ret = mbedtls_poly1305_update( &ctx->poly1305_ctx, len_block, 16U );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
|
||||
ret = mbedtls_poly1305_finish( &ctx->poly1305_ctx, mac );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
static int chachapoly_crypt_and_tag( mbedtls_chachapoly_context *ctx,
|
||||
mbedtls_chachapoly_mode_t mode,
|
||||
size_t length,
|
||||
const unsigned char nonce[12],
|
||||
const unsigned char *aad,
|
||||
size_t aad_len,
|
||||
const unsigned char *input,
|
||||
unsigned char *output,
|
||||
unsigned char tag[16] )
|
||||
{
|
||||
int ret;
|
||||
|
||||
ret = mbedtls_chachapoly_starts( ctx, nonce, mode );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_chachapoly_update_aad( ctx, aad, aad_len );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_chachapoly_update( ctx, length, input, output );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_chachapoly_finish( ctx, tag );
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
||||
int mbedtls_chachapoly_encrypt_and_tag( mbedtls_chachapoly_context *ctx,
|
||||
size_t length,
|
||||
const unsigned char nonce[12],
|
||||
const unsigned char *aad,
|
||||
size_t aad_len,
|
||||
const unsigned char *input,
|
||||
unsigned char *output,
|
||||
unsigned char tag[16] )
|
||||
{
|
||||
return( chachapoly_crypt_and_tag( ctx, MBEDTLS_CHACHAPOLY_ENCRYPT,
|
||||
length, nonce, aad, aad_len,
|
||||
input, output, tag ) );
|
||||
}
|
||||
|
||||
int mbedtls_chachapoly_auth_decrypt( mbedtls_chachapoly_context *ctx,
|
||||
size_t length,
|
||||
const unsigned char nonce[12],
|
||||
const unsigned char *aad,
|
||||
size_t aad_len,
|
||||
const unsigned char tag[16],
|
||||
const unsigned char *input,
|
||||
unsigned char *output )
|
||||
{
|
||||
int ret;
|
||||
unsigned char check_tag[16];
|
||||
size_t i;
|
||||
int diff;
|
||||
|
||||
if( tag == NULL )
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
if( ( ret = chachapoly_crypt_and_tag( ctx,
|
||||
MBEDTLS_CHACHAPOLY_DECRYPT, length, nonce,
|
||||
aad, aad_len, input, output, check_tag ) ) != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/* Check tag in "constant-time" */
|
||||
for( diff = 0, i = 0; i < sizeof( check_tag ); i++ )
|
||||
diff |= tag[i] ^ check_tag[i];
|
||||
|
||||
if( diff != 0 )
|
||||
{
|
||||
mbedtls_platform_zeroize( output, length );
|
||||
return( MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED );
|
||||
}
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_CHACHAPOLY_ALT */
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
|
||||
static const unsigned char test_key[1][32] =
|
||||
{
|
||||
{
|
||||
0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
|
||||
0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
|
||||
0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
|
||||
0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f
|
||||
}
|
||||
};
|
||||
|
||||
static const unsigned char test_nonce[1][12] =
|
||||
{
|
||||
{
|
||||
0x07, 0x00, 0x00, 0x00, /* 32-bit common part */
|
||||
0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47 /* 64-bit IV */
|
||||
}
|
||||
};
|
||||
|
||||
static const unsigned char test_aad[1][12] =
|
||||
{
|
||||
{
|
||||
0x50, 0x51, 0x52, 0x53, 0xc0, 0xc1, 0xc2, 0xc3,
|
||||
0xc4, 0xc5, 0xc6, 0xc7
|
||||
}
|
||||
};
|
||||
|
||||
static const size_t test_aad_len[1] =
|
||||
{
|
||||
12U
|
||||
};
|
||||
|
||||
static const unsigned char test_input[1][114] =
|
||||
{
|
||||
{
|
||||
0x4c, 0x61, 0x64, 0x69, 0x65, 0x73, 0x20, 0x61,
|
||||
0x6e, 0x64, 0x20, 0x47, 0x65, 0x6e, 0x74, 0x6c,
|
||||
0x65, 0x6d, 0x65, 0x6e, 0x20, 0x6f, 0x66, 0x20,
|
||||
0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x61, 0x73,
|
||||
0x73, 0x20, 0x6f, 0x66, 0x20, 0x27, 0x39, 0x39,
|
||||
0x3a, 0x20, 0x49, 0x66, 0x20, 0x49, 0x20, 0x63,
|
||||
0x6f, 0x75, 0x6c, 0x64, 0x20, 0x6f, 0x66, 0x66,
|
||||
0x65, 0x72, 0x20, 0x79, 0x6f, 0x75, 0x20, 0x6f,
|
||||
0x6e, 0x6c, 0x79, 0x20, 0x6f, 0x6e, 0x65, 0x20,
|
||||
0x74, 0x69, 0x70, 0x20, 0x66, 0x6f, 0x72, 0x20,
|
||||
0x74, 0x68, 0x65, 0x20, 0x66, 0x75, 0x74, 0x75,
|
||||
0x72, 0x65, 0x2c, 0x20, 0x73, 0x75, 0x6e, 0x73,
|
||||
0x63, 0x72, 0x65, 0x65, 0x6e, 0x20, 0x77, 0x6f,
|
||||
0x75, 0x6c, 0x64, 0x20, 0x62, 0x65, 0x20, 0x69,
|
||||
0x74, 0x2e
|
||||
}
|
||||
};
|
||||
|
||||
static const unsigned char test_output[1][114] =
|
||||
{
|
||||
{
|
||||
0xd3, 0x1a, 0x8d, 0x34, 0x64, 0x8e, 0x60, 0xdb,
|
||||
0x7b, 0x86, 0xaf, 0xbc, 0x53, 0xef, 0x7e, 0xc2,
|
||||
0xa4, 0xad, 0xed, 0x51, 0x29, 0x6e, 0x08, 0xfe,
|
||||
0xa9, 0xe2, 0xb5, 0xa7, 0x36, 0xee, 0x62, 0xd6,
|
||||
0x3d, 0xbe, 0xa4, 0x5e, 0x8c, 0xa9, 0x67, 0x12,
|
||||
0x82, 0xfa, 0xfb, 0x69, 0xda, 0x92, 0x72, 0x8b,
|
||||
0x1a, 0x71, 0xde, 0x0a, 0x9e, 0x06, 0x0b, 0x29,
|
||||
0x05, 0xd6, 0xa5, 0xb6, 0x7e, 0xcd, 0x3b, 0x36,
|
||||
0x92, 0xdd, 0xbd, 0x7f, 0x2d, 0x77, 0x8b, 0x8c,
|
||||
0x98, 0x03, 0xae, 0xe3, 0x28, 0x09, 0x1b, 0x58,
|
||||
0xfa, 0xb3, 0x24, 0xe4, 0xfa, 0xd6, 0x75, 0x94,
|
||||
0x55, 0x85, 0x80, 0x8b, 0x48, 0x31, 0xd7, 0xbc,
|
||||
0x3f, 0xf4, 0xde, 0xf0, 0x8e, 0x4b, 0x7a, 0x9d,
|
||||
0xe5, 0x76, 0xd2, 0x65, 0x86, 0xce, 0xc6, 0x4b,
|
||||
0x61, 0x16
|
||||
}
|
||||
};
|
||||
|
||||
static const size_t test_input_len[1] =
|
||||
{
|
||||
114U
|
||||
};
|
||||
|
||||
static const unsigned char test_mac[1][16] =
|
||||
{
|
||||
{
|
||||
0x1a, 0xe1, 0x0b, 0x59, 0x4f, 0x09, 0xe2, 0x6a,
|
||||
0x7e, 0x90, 0x2e, 0xcb, 0xd0, 0x60, 0x06, 0x91
|
||||
}
|
||||
};
|
||||
|
||||
#define ASSERT( cond, args ) \
|
||||
do \
|
||||
{ \
|
||||
if( ! ( cond ) ) \
|
||||
{ \
|
||||
if( verbose != 0 ) \
|
||||
mbedtls_printf args; \
|
||||
\
|
||||
return( -1 ); \
|
||||
} \
|
||||
} \
|
||||
while( 0 )
|
||||
|
||||
int mbedtls_chachapoly_self_test( int verbose )
|
||||
{
|
||||
mbedtls_chachapoly_context ctx;
|
||||
unsigned i;
|
||||
int ret;
|
||||
unsigned char output[200];
|
||||
unsigned char mac[16];
|
||||
|
||||
for( i = 0U; i < 1U; i++ )
|
||||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( " ChaCha20-Poly1305 test %u ", i );
|
||||
|
||||
mbedtls_chachapoly_init( &ctx );
|
||||
|
||||
ret = mbedtls_chachapoly_setkey( &ctx, test_key[i] );
|
||||
ASSERT( 0 == ret, ( "setkey() error code: %i\n", ret ) );
|
||||
|
||||
ret = mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
test_input_len[i],
|
||||
test_nonce[i],
|
||||
test_aad[i],
|
||||
test_aad_len[i],
|
||||
test_input[i],
|
||||
output,
|
||||
mac );
|
||||
|
||||
ASSERT( 0 == ret, ( "crypt_and_tag() error code: %i\n", ret ) );
|
||||
|
||||
ASSERT( 0 == memcmp( output, test_output[i], test_input_len[i] ),
|
||||
( "failure (wrong output)\n" ) );
|
||||
|
||||
ASSERT( 0 == memcmp( mac, test_mac[i], 16U ),
|
||||
( "failure (wrong MAC)\n" ) );
|
||||
|
||||
mbedtls_chachapoly_free( &ctx );
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "passed\n" );
|
||||
}
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "\n" );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#endif /* MBEDTLS_CHACHAPOLY_C */
|
||||
172
library/cipher.c
172
library/cipher.c
|
|
@ -38,6 +38,10 @@
|
|||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
#include "mbedtls/chachapoly.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#include "mbedtls/gcm.h"
|
||||
#endif
|
||||
|
|
@ -46,6 +50,10 @@
|
|||
#include "mbedtls/ccm.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
#include "mbedtls/chacha20.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CMAC_C)
|
||||
#include "mbedtls/cmac.h"
|
||||
#endif
|
||||
|
|
@ -61,6 +69,27 @@
|
|||
#define MBEDTLS_CIPHER_MODE_STREAM
|
||||
#endif
|
||||
|
||||
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
/* Compare the contents of two buffers in constant time.
|
||||
* Returns 0 if the contents are bitwise identical, otherwise returns
|
||||
* a non-zero value.
|
||||
* This is currently only used by GCM and ChaCha20+Poly1305.
|
||||
*/
|
||||
static int mbedtls_constant_time_memcmp( const void *v1, const void *v2, size_t len )
|
||||
{
|
||||
const unsigned char *p1 = (const unsigned char*) v1;
|
||||
const unsigned char *p2 = (const unsigned char*) v2;
|
||||
size_t i;
|
||||
unsigned char diff;
|
||||
|
||||
for( diff = 0, i = 0; i < len; i++ )
|
||||
diff |= p1[i] ^ p2[i];
|
||||
|
||||
return (int)diff;
|
||||
}
|
||||
#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
static int supported_init = 0;
|
||||
|
||||
const int *mbedtls_cipher_list( void )
|
||||
|
|
@ -232,6 +261,18 @@ int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
|
|||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20 )
|
||||
{
|
||||
if ( 0 != mbedtls_chacha20_starts( (mbedtls_chacha20_context*)ctx->cipher_ctx,
|
||||
iv,
|
||||
0U ) ) /* Initial counter value */
|
||||
{
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
memcpy( ctx->iv, iv, actual_iv_size );
|
||||
ctx->iv_size = actual_iv_size;
|
||||
|
||||
|
|
@ -248,22 +289,45 @@ int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx )
|
|||
return( 0 );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *ad, size_t ad_len )
|
||||
{
|
||||
if( NULL == ctx || NULL == ctx->cipher_info )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
|
||||
{
|
||||
return mbedtls_gcm_starts( (mbedtls_gcm_context *) ctx->cipher_ctx, ctx->operation,
|
||||
ctx->iv, ctx->iv_size, ad, ad_len );
|
||||
}
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
|
||||
{
|
||||
int result;
|
||||
mbedtls_chachapoly_mode_t mode;
|
||||
|
||||
mode = ( ctx->operation == MBEDTLS_ENCRYPT )
|
||||
? MBEDTLS_CHACHAPOLY_ENCRYPT
|
||||
: MBEDTLS_CHACHAPOLY_DECRYPT;
|
||||
|
||||
result = mbedtls_chachapoly_starts( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
|
||||
ctx->iv,
|
||||
mode );
|
||||
if ( result != 0 )
|
||||
return( result );
|
||||
|
||||
return mbedtls_chachapoly_update_aad( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
|
||||
ad, ad_len );
|
||||
}
|
||||
#endif
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* MBEDTLS_GCM_C */
|
||||
#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input,
|
||||
size_t ilen, unsigned char *output, size_t *olen )
|
||||
|
|
@ -304,6 +368,15 @@ int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *i
|
|||
}
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20_POLY1305 )
|
||||
{
|
||||
*olen = ilen;
|
||||
return mbedtls_chachapoly_update( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
|
||||
ilen, input, output );
|
||||
}
|
||||
#endif
|
||||
|
||||
if ( 0 == block_size )
|
||||
{
|
||||
return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT;
|
||||
|
|
@ -685,6 +758,12 @@ int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
|
|||
return( 0 );
|
||||
}
|
||||
|
||||
if ( ( MBEDTLS_CIPHER_CHACHA20 == ctx->cipher_info->type ) ||
|
||||
( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) )
|
||||
{
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode )
|
||||
{
|
||||
if( ctx->unprocessed_len != 0 )
|
||||
|
|
@ -796,7 +875,7 @@ int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx, mbedtls_ciph
|
|||
}
|
||||
#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
|
||||
unsigned char *tag, size_t tag_len )
|
||||
{
|
||||
|
|
@ -806,8 +885,22 @@ int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
|
|||
if( MBEDTLS_ENCRYPT != ctx->operation )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
|
||||
return mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx, tag, tag_len );
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
|
||||
{
|
||||
/* Don't allow truncated MAC for Poly1305 */
|
||||
if ( tag_len != 16U )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
return mbedtls_chachapoly_finish( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
|
||||
tag );
|
||||
}
|
||||
#endif
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
|
@ -815,6 +908,7 @@ int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
|
|||
int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
|
||||
const unsigned char *tag, size_t tag_len )
|
||||
{
|
||||
unsigned char check_tag[16];
|
||||
int ret;
|
||||
|
||||
if( NULL == ctx || NULL == ctx->cipher_info ||
|
||||
|
|
@ -823,12 +917,9 @@ int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
|
|||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
|
||||
{
|
||||
unsigned char check_tag[16];
|
||||
size_t i;
|
||||
int diff;
|
||||
|
||||
if( tag_len > sizeof( check_tag ) )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
|
|
@ -839,18 +930,38 @@ int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
|
|||
}
|
||||
|
||||
/* Check the tag in "constant-time" */
|
||||
for( diff = 0, i = 0; i < tag_len; i++ )
|
||||
diff |= tag[i] ^ check_tag[i];
|
||||
|
||||
if( diff != 0 )
|
||||
if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
|
||||
return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* MBEDTLS_GCM_C */
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
|
||||
{
|
||||
/* Don't allow truncated MAC for Poly1305 */
|
||||
if ( tag_len != sizeof( check_tag ) )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
ret = mbedtls_chachapoly_finish( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
|
||||
check_tag );
|
||||
if ( ret != 0 )
|
||||
{
|
||||
return( ret );
|
||||
}
|
||||
|
||||
/* Check the tag in "constant-time" */
|
||||
if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
|
||||
return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* MBEDTLS_GCM_C */
|
||||
#endif /* MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
/*
|
||||
* Packet-oriented wrapper for non-AEAD modes
|
||||
|
|
@ -909,6 +1020,21 @@ int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx,
|
|||
tag, tag_len ) );
|
||||
}
|
||||
#endif /* MBEDTLS_CCM_C */
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
|
||||
{
|
||||
/* ChachaPoly has fixed length nonce and MAC (tag) */
|
||||
if ( ( iv_len != ctx->cipher_info->iv_size ) ||
|
||||
( tag_len != 16U ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
*olen = ilen;
|
||||
return( mbedtls_chachapoly_encrypt_and_tag( ctx->cipher_ctx,
|
||||
ilen, iv, ad, ad_len, input, output, tag ) );
|
||||
}
|
||||
#endif /* MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
|
||||
}
|
||||
|
|
@ -955,6 +1081,28 @@ int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx,
|
|||
return( ret );
|
||||
}
|
||||
#endif /* MBEDTLS_CCM_C */
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
|
||||
{
|
||||
int ret;
|
||||
|
||||
/* ChachaPoly has fixed length nonce and MAC (tag) */
|
||||
if ( ( iv_len != ctx->cipher_info->iv_size ) ||
|
||||
( tag_len != 16U ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
*olen = ilen;
|
||||
ret = mbedtls_chachapoly_auth_decrypt( ctx->cipher_ctx, ilen,
|
||||
iv, ad, ad_len, tag, input, output );
|
||||
|
||||
if( ret == MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED )
|
||||
ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
|
||||
|
||||
return( ret );
|
||||
}
|
||||
#endif /* MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
|
||||
}
|
||||
|
|
|
|||
|
|
@ -33,6 +33,10 @@
|
|||
|
||||
#include "mbedtls/cipher_internal.h"
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
#include "mbedtls/chachapoly.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_AES_C)
|
||||
#include "mbedtls/aes.h"
|
||||
#endif
|
||||
|
|
@ -57,6 +61,10 @@
|
|||
#include "mbedtls/blowfish.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
#include "mbedtls/chacha20.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#include "mbedtls/gcm.h"
|
||||
#endif
|
||||
|
|
@ -1886,6 +1894,162 @@ static const mbedtls_cipher_info_t arc4_128_info = {
|
|||
};
|
||||
#endif /* MBEDTLS_ARC4_C */
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
|
||||
static int chacha20_setkey_wrap( void *ctx, const unsigned char *key,
|
||||
unsigned int key_bitlen )
|
||||
{
|
||||
if( key_bitlen != 256U )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
if ( 0 != mbedtls_chacha20_setkey( (mbedtls_chacha20_context*)ctx, key ) )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
static int chacha20_stream_wrap( void *ctx, size_t length,
|
||||
const unsigned char *input,
|
||||
unsigned char *output )
|
||||
{
|
||||
int ret;
|
||||
|
||||
ret = mbedtls_chacha20_update( ctx, length, input, output );
|
||||
if( ret == MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
static void * chacha20_ctx_alloc( void )
|
||||
{
|
||||
mbedtls_chacha20_context *ctx;
|
||||
ctx = mbedtls_calloc( 1, sizeof( mbedtls_chacha20_context ) );
|
||||
|
||||
if( ctx == NULL )
|
||||
return( NULL );
|
||||
|
||||
mbedtls_chacha20_init( ctx );
|
||||
|
||||
return( ctx );
|
||||
}
|
||||
|
||||
static void chacha20_ctx_free( void *ctx )
|
||||
{
|
||||
mbedtls_chacha20_free( (mbedtls_chacha20_context *) ctx );
|
||||
mbedtls_free( ctx );
|
||||
}
|
||||
|
||||
static const mbedtls_cipher_base_t chacha20_base_info = {
|
||||
MBEDTLS_CIPHER_ID_CHACHA20,
|
||||
NULL,
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CBC)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CFB)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_OFB)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CTR)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_XTS)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_STREAM)
|
||||
chacha20_stream_wrap,
|
||||
#endif
|
||||
chacha20_setkey_wrap,
|
||||
chacha20_setkey_wrap,
|
||||
chacha20_ctx_alloc,
|
||||
chacha20_ctx_free
|
||||
};
|
||||
static const mbedtls_cipher_info_t chacha20_info = {
|
||||
MBEDTLS_CIPHER_CHACHA20,
|
||||
MBEDTLS_MODE_STREAM,
|
||||
256,
|
||||
"CHACHA20",
|
||||
12,
|
||||
0,
|
||||
1,
|
||||
&chacha20_base_info
|
||||
};
|
||||
#endif /* MBEDTLS_CHACHA20_C */
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
|
||||
static int chachapoly_setkey_wrap( void *ctx,
|
||||
const unsigned char *key,
|
||||
unsigned int key_bitlen )
|
||||
{
|
||||
if( key_bitlen != 256U )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
if ( 0 != mbedtls_chachapoly_setkey( (mbedtls_chachapoly_context*)ctx, key ) )
|
||||
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
static void * chachapoly_ctx_alloc( void )
|
||||
{
|
||||
mbedtls_chachapoly_context *ctx;
|
||||
ctx = mbedtls_calloc( 1, sizeof( mbedtls_chachapoly_context ) );
|
||||
|
||||
if( ctx == NULL )
|
||||
return( NULL );
|
||||
|
||||
mbedtls_chachapoly_init( ctx );
|
||||
|
||||
return( ctx );
|
||||
}
|
||||
|
||||
static void chachapoly_ctx_free( void *ctx )
|
||||
{
|
||||
mbedtls_chachapoly_free( (mbedtls_chachapoly_context *) ctx );
|
||||
mbedtls_free( ctx );
|
||||
}
|
||||
|
||||
static const mbedtls_cipher_base_t chachapoly_base_info = {
|
||||
MBEDTLS_CIPHER_ID_CHACHA20,
|
||||
NULL,
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CBC)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CFB)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_OFB)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_CTR)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_XTS)
|
||||
NULL,
|
||||
#endif
|
||||
#if defined(MBEDTLS_CIPHER_MODE_STREAM)
|
||||
NULL,
|
||||
#endif
|
||||
chachapoly_setkey_wrap,
|
||||
chachapoly_setkey_wrap,
|
||||
chachapoly_ctx_alloc,
|
||||
chachapoly_ctx_free
|
||||
};
|
||||
static const mbedtls_cipher_info_t chachapoly_info = {
|
||||
MBEDTLS_CIPHER_CHACHA20_POLY1305,
|
||||
MBEDTLS_MODE_CHACHAPOLY,
|
||||
256,
|
||||
"CHACHA20-POLY1305",
|
||||
12,
|
||||
0,
|
||||
1,
|
||||
&chachapoly_base_info
|
||||
};
|
||||
#endif /* MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_NULL_CIPHER)
|
||||
static int null_crypt_stream( void *ctx, size_t length,
|
||||
const unsigned char *input,
|
||||
|
|
@ -2087,6 +2251,14 @@ const mbedtls_cipher_definition_t mbedtls_cipher_definitions[] =
|
|||
#endif
|
||||
#endif /* MBEDTLS_DES_C */
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
{ MBEDTLS_CIPHER_CHACHA20, &chacha20_info },
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
{ MBEDTLS_CIPHER_CHACHA20_POLY1305, &chachapoly_info },
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_NULL_CIPHER)
|
||||
{ MBEDTLS_CIPHER_NULL, &null_cipher_info },
|
||||
#endif /* MBEDTLS_CIPHER_NULL_CIPHER */
|
||||
|
|
|
|||
|
|
@ -73,6 +73,14 @@
|
|||
#include "mbedtls/ccm.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
#include "mbedtls/chacha20.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
#include "mbedtls/chachapoly.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_C)
|
||||
#include "mbedtls/cipher.h"
|
||||
#endif
|
||||
|
|
@ -157,6 +165,10 @@
|
|||
#include "mbedtls/pkcs5.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_POLY1305_C)
|
||||
#include "mbedtls/poly1305.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_RIPEMD160_C)
|
||||
#include "mbedtls/ripemd160.h"
|
||||
#endif
|
||||
|
|
@ -676,6 +688,22 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
|
|||
mbedtls_snprintf( buf, buflen, "CCM - CCM hardware accelerator failed" );
|
||||
#endif /* MBEDTLS_CCM_C */
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
if( use_ret == -(MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA) )
|
||||
mbedtls_snprintf( buf, buflen, "CHACHA20 - Invalid input parameter(s)" );
|
||||
if( use_ret == -(MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE) )
|
||||
mbedtls_snprintf( buf, buflen, "CHACHA20 - Feature not available. For example, s part of the API is not implemented" );
|
||||
if( use_ret == -(MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED) )
|
||||
mbedtls_snprintf( buf, buflen, "CHACHA20 - Chacha20 hardware accelerator failed" );
|
||||
#endif /* MBEDTLS_CHACHA20_C */
|
||||
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if( use_ret == -(MBEDTLS_ERR_CHACHAPOLY_BAD_STATE) )
|
||||
mbedtls_snprintf( buf, buflen, "CHACHAPOLY - The requested operation is not permitted in the current state" );
|
||||
if( use_ret == -(MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED) )
|
||||
mbedtls_snprintf( buf, buflen, "CHACHAPOLY - Authenticated decryption failed: data was not authentic" );
|
||||
#endif /* MBEDTLS_CHACHAPOLY_C */
|
||||
|
||||
#if defined(MBEDTLS_CMAC_C)
|
||||
if( use_ret == -(MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED) )
|
||||
mbedtls_snprintf( buf, buflen, "CMAC - CMAC hardware accelerator failed" );
|
||||
|
|
@ -793,6 +821,15 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
|
|||
mbedtls_snprintf( buf, buflen, "PADLOCK - Input data should be aligned" );
|
||||
#endif /* MBEDTLS_PADLOCK_C */
|
||||
|
||||
#if defined(MBEDTLS_POLY1305_C)
|
||||
if( use_ret == -(MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA) )
|
||||
mbedtls_snprintf( buf, buflen, "POLY1305 - Invalid input parameter(s)" );
|
||||
if( use_ret == -(MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE) )
|
||||
mbedtls_snprintf( buf, buflen, "POLY1305 - Feature not available. For example, s part of the API is not implemented" );
|
||||
if( use_ret == -(MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED) )
|
||||
mbedtls_snprintf( buf, buflen, "POLY1305 - Poly1305 hardware accelerator failed" );
|
||||
#endif /* MBEDTLS_POLY1305_C */
|
||||
|
||||
#if defined(MBEDTLS_RIPEMD160_C)
|
||||
if( use_ret == -(MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED) )
|
||||
mbedtls_snprintf( buf, buflen, "RIPEMD160 - RIPEMD160 hardware accelerator failed" );
|
||||
|
|
|
|||
563
library/poly1305.c
Normal file
563
library/poly1305.c
Normal file
|
|
@ -0,0 +1,563 @@
|
|||
/**
|
||||
* \file poly1305.c
|
||||
*
|
||||
* \brief Poly1305 authentication algorithm.
|
||||
*
|
||||
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "mbedtls/config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_POLY1305_C)
|
||||
|
||||
#include "mbedtls/poly1305.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
#if defined(MBEDTLS_PLATFORM_C)
|
||||
#include "mbedtls/platform.h"
|
||||
#else
|
||||
#include <stdio.h>
|
||||
#define mbedtls_printf printf
|
||||
#endif /* MBEDTLS_PLATFORM_C */
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#if !defined(MBEDTLS_POLY1305_ALT)
|
||||
|
||||
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
||||
!defined(inline) && !defined(__cplusplus)
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
#define POLY1305_BLOCK_SIZE_BYTES ( 16U )
|
||||
|
||||
#define BYTES_TO_U32_LE( data, offset ) \
|
||||
( (uint32_t) data[offset] \
|
||||
| (uint32_t) ( (uint32_t) data[( offset ) + 1] << 8 ) \
|
||||
| (uint32_t) ( (uint32_t) data[( offset ) + 2] << 16 ) \
|
||||
| (uint32_t) ( (uint32_t) data[( offset ) + 3] << 24 ) \
|
||||
)
|
||||
|
||||
/*
|
||||
* Our implementation is tuned for 32-bit platforms with a 64-bit multiplier.
|
||||
* However we provided an alternative for platforms without such a multiplier.
|
||||
*/
|
||||
#if defined(MBEDTLS_NO_64BIT_MULTIPLICATION)
|
||||
static uint64_t mul64( uint32_t a, uint32_t b )
|
||||
{
|
||||
/* a = al + 2**16 ah, b = bl + 2**16 bh */
|
||||
const uint16_t al = (uint16_t) a;
|
||||
const uint16_t bl = (uint16_t) b;
|
||||
const uint16_t ah = a >> 16;
|
||||
const uint16_t bh = b >> 16;
|
||||
|
||||
/* ab = al*bl + 2**16 (ah*bl + bl*bh) + 2**32 ah*bh */
|
||||
const uint32_t lo = (uint32_t) al * bl;
|
||||
const uint64_t me = (uint64_t)( (uint32_t) ah * bl ) + (uint32_t) al * bh;
|
||||
const uint32_t hi = (uint32_t) ah * bh;
|
||||
|
||||
return( lo + ( me << 16 ) + ( (uint64_t) hi << 32 ) );
|
||||
}
|
||||
#else
|
||||
static inline uint64_t mul64( uint32_t a, uint32_t b )
|
||||
{
|
||||
return( (uint64_t) a * b );
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
/**
|
||||
* \brief Process blocks with Poly1305.
|
||||
*
|
||||
* \param ctx The Poly1305 context.
|
||||
* \param nblocks Number of blocks to process. Note that this
|
||||
* function only processes full blocks.
|
||||
* \param input Buffer containing the input block(s).
|
||||
* \param needs_padding Set to 0 if the padding bit has already been
|
||||
* applied to the input data before calling this
|
||||
* function. Otherwise, set this parameter to 1.
|
||||
*/
|
||||
static void poly1305_process( mbedtls_poly1305_context *ctx,
|
||||
size_t nblocks,
|
||||
const unsigned char *input,
|
||||
uint32_t needs_padding )
|
||||
{
|
||||
uint64_t d0, d1, d2, d3;
|
||||
uint32_t acc0, acc1, acc2, acc3, acc4;
|
||||
uint32_t r0, r1, r2, r3;
|
||||
uint32_t rs1, rs2, rs3;
|
||||
size_t offset = 0U;
|
||||
size_t i;
|
||||
|
||||
r0 = ctx->r[0];
|
||||
r1 = ctx->r[1];
|
||||
r2 = ctx->r[2];
|
||||
r3 = ctx->r[3];
|
||||
|
||||
rs1 = r1 + ( r1 >> 2U );
|
||||
rs2 = r2 + ( r2 >> 2U );
|
||||
rs3 = r3 + ( r3 >> 2U );
|
||||
|
||||
acc0 = ctx->acc[0];
|
||||
acc1 = ctx->acc[1];
|
||||
acc2 = ctx->acc[2];
|
||||
acc3 = ctx->acc[3];
|
||||
acc4 = ctx->acc[4];
|
||||
|
||||
/* Process full blocks */
|
||||
for( i = 0U; i < nblocks; i++ )
|
||||
{
|
||||
/* The input block is treated as a 128-bit little-endian integer */
|
||||
d0 = BYTES_TO_U32_LE( input, offset + 0 );
|
||||
d1 = BYTES_TO_U32_LE( input, offset + 4 );
|
||||
d2 = BYTES_TO_U32_LE( input, offset + 8 );
|
||||
d3 = BYTES_TO_U32_LE( input, offset + 12 );
|
||||
|
||||
/* Compute: acc += (padded) block as a 130-bit integer */
|
||||
d0 += (uint64_t) acc0;
|
||||
d1 += (uint64_t) acc1 + ( d0 >> 32U );
|
||||
d2 += (uint64_t) acc2 + ( d1 >> 32U );
|
||||
d3 += (uint64_t) acc3 + ( d2 >> 32U );
|
||||
acc0 = (uint32_t) d0;
|
||||
acc1 = (uint32_t) d1;
|
||||
acc2 = (uint32_t) d2;
|
||||
acc3 = (uint32_t) d3;
|
||||
acc4 += (uint32_t) ( d3 >> 32U ) + needs_padding;
|
||||
|
||||
/* Compute: acc *= r */
|
||||
d0 = mul64( acc0, r0 ) +
|
||||
mul64( acc1, rs3 ) +
|
||||
mul64( acc2, rs2 ) +
|
||||
mul64( acc3, rs1 );
|
||||
d1 = mul64( acc0, r1 ) +
|
||||
mul64( acc1, r0 ) +
|
||||
mul64( acc2, rs3 ) +
|
||||
mul64( acc3, rs2 ) +
|
||||
mul64( acc4, rs1 );
|
||||
d2 = mul64( acc0, r2 ) +
|
||||
mul64( acc1, r1 ) +
|
||||
mul64( acc2, r0 ) +
|
||||
mul64( acc3, rs3 ) +
|
||||
mul64( acc4, rs2 );
|
||||
d3 = mul64( acc0, r3 ) +
|
||||
mul64( acc1, r2 ) +
|
||||
mul64( acc2, r1 ) +
|
||||
mul64( acc3, r0 ) +
|
||||
mul64( acc4, rs3 );
|
||||
acc4 *= r0;
|
||||
|
||||
/* Compute: acc %= (2^130 - 5) (partial remainder) */
|
||||
d1 += ( d0 >> 32 );
|
||||
d2 += ( d1 >> 32 );
|
||||
d3 += ( d2 >> 32 );
|
||||
acc0 = (uint32_t) d0;
|
||||
acc1 = (uint32_t) d1;
|
||||
acc2 = (uint32_t) d2;
|
||||
acc3 = (uint32_t) d3;
|
||||
acc4 = (uint32_t) ( d3 >> 32 ) + acc4;
|
||||
|
||||
d0 = (uint64_t) acc0 + ( acc4 >> 2 ) + ( acc4 & 0xFFFFFFFCU );
|
||||
acc4 &= 3U;
|
||||
acc0 = (uint32_t) d0;
|
||||
d0 = (uint64_t) acc1 + ( d0 >> 32U );
|
||||
acc1 = (uint32_t) d0;
|
||||
d0 = (uint64_t) acc2 + ( d0 >> 32U );
|
||||
acc2 = (uint32_t) d0;
|
||||
d0 = (uint64_t) acc3 + ( d0 >> 32U );
|
||||
acc3 = (uint32_t) d0;
|
||||
d0 = (uint64_t) acc4 + ( d0 >> 32U );
|
||||
acc4 = (uint32_t) d0;
|
||||
|
||||
offset += POLY1305_BLOCK_SIZE_BYTES;
|
||||
}
|
||||
|
||||
ctx->acc[0] = acc0;
|
||||
ctx->acc[1] = acc1;
|
||||
ctx->acc[2] = acc2;
|
||||
ctx->acc[3] = acc3;
|
||||
ctx->acc[4] = acc4;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Compute the Poly1305 MAC
|
||||
*
|
||||
* \param ctx The Poly1305 context.
|
||||
* \param mac The buffer to where the MAC is written. Must be
|
||||
* big enough to contain the 16-byte MAC.
|
||||
*/
|
||||
static void poly1305_compute_mac( const mbedtls_poly1305_context *ctx,
|
||||
unsigned char mac[16] )
|
||||
{
|
||||
uint64_t d;
|
||||
uint32_t g0, g1, g2, g3, g4;
|
||||
uint32_t acc0, acc1, acc2, acc3, acc4;
|
||||
uint32_t mask;
|
||||
uint32_t mask_inv;
|
||||
|
||||
acc0 = ctx->acc[0];
|
||||
acc1 = ctx->acc[1];
|
||||
acc2 = ctx->acc[2];
|
||||
acc3 = ctx->acc[3];
|
||||
acc4 = ctx->acc[4];
|
||||
|
||||
/* Before adding 's' we ensure that the accumulator is mod 2^130 - 5.
|
||||
* We do this by calculating acc - (2^130 - 5), then checking if
|
||||
* the 131st bit is set. If it is, then reduce: acc -= (2^130 - 5)
|
||||
*/
|
||||
|
||||
/* Calculate acc + -(2^130 - 5) */
|
||||
d = ( (uint64_t) acc0 + 5U );
|
||||
g0 = (uint32_t) d;
|
||||
d = ( (uint64_t) acc1 + ( d >> 32 ) );
|
||||
g1 = (uint32_t) d;
|
||||
d = ( (uint64_t) acc2 + ( d >> 32 ) );
|
||||
g2 = (uint32_t) d;
|
||||
d = ( (uint64_t) acc3 + ( d >> 32 ) );
|
||||
g3 = (uint32_t) d;
|
||||
g4 = acc4 + (uint32_t) ( d >> 32U );
|
||||
|
||||
/* mask == 0xFFFFFFFF if 131st bit is set, otherwise mask == 0 */
|
||||
mask = (uint32_t) 0U - ( g4 >> 2U );
|
||||
mask_inv = ~mask;
|
||||
|
||||
/* If 131st bit is set then acc=g, otherwise, acc is unmodified */
|
||||
acc0 = ( acc0 & mask_inv ) | ( g0 & mask );
|
||||
acc1 = ( acc1 & mask_inv ) | ( g1 & mask );
|
||||
acc2 = ( acc2 & mask_inv ) | ( g2 & mask );
|
||||
acc3 = ( acc3 & mask_inv ) | ( g3 & mask );
|
||||
|
||||
/* Add 's' */
|
||||
d = (uint64_t) acc0 + ctx->s[0];
|
||||
acc0 = (uint32_t) d;
|
||||
d = (uint64_t) acc1 + ctx->s[1] + ( d >> 32U );
|
||||
acc1 = (uint32_t) d;
|
||||
d = (uint64_t) acc2 + ctx->s[2] + ( d >> 32U );
|
||||
acc2 = (uint32_t) d;
|
||||
acc3 += ctx->s[3] + (uint32_t) ( d >> 32U );
|
||||
|
||||
/* Compute MAC (128 least significant bits of the accumulator) */
|
||||
mac[ 0] = (unsigned char)( acc0 );
|
||||
mac[ 1] = (unsigned char)( acc0 >> 8 );
|
||||
mac[ 2] = (unsigned char)( acc0 >> 16 );
|
||||
mac[ 3] = (unsigned char)( acc0 >> 24 );
|
||||
mac[ 4] = (unsigned char)( acc1 );
|
||||
mac[ 5] = (unsigned char)( acc1 >> 8 );
|
||||
mac[ 6] = (unsigned char)( acc1 >> 16 );
|
||||
mac[ 7] = (unsigned char)( acc1 >> 24 );
|
||||
mac[ 8] = (unsigned char)( acc2 );
|
||||
mac[ 9] = (unsigned char)( acc2 >> 8 );
|
||||
mac[10] = (unsigned char)( acc2 >> 16 );
|
||||
mac[11] = (unsigned char)( acc2 >> 24 );
|
||||
mac[12] = (unsigned char)( acc3 );
|
||||
mac[13] = (unsigned char)( acc3 >> 8 );
|
||||
mac[14] = (unsigned char)( acc3 >> 16 );
|
||||
mac[15] = (unsigned char)( acc3 >> 24 );
|
||||
}
|
||||
|
||||
void mbedtls_poly1305_init( mbedtls_poly1305_context *ctx )
|
||||
{
|
||||
if( ctx != NULL )
|
||||
{
|
||||
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_poly1305_context ) );
|
||||
}
|
||||
}
|
||||
|
||||
void mbedtls_poly1305_free( mbedtls_poly1305_context *ctx )
|
||||
{
|
||||
if( ctx != NULL )
|
||||
{
|
||||
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_poly1305_context ) );
|
||||
}
|
||||
}
|
||||
|
||||
int mbedtls_poly1305_starts( mbedtls_poly1305_context *ctx,
|
||||
const unsigned char key[32] )
|
||||
{
|
||||
if( ctx == NULL || key == NULL )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
/* r &= 0x0ffffffc0ffffffc0ffffffc0fffffff */
|
||||
ctx->r[0] = BYTES_TO_U32_LE( key, 0 ) & 0x0FFFFFFFU;
|
||||
ctx->r[1] = BYTES_TO_U32_LE( key, 4 ) & 0x0FFFFFFCU;
|
||||
ctx->r[2] = BYTES_TO_U32_LE( key, 8 ) & 0x0FFFFFFCU;
|
||||
ctx->r[3] = BYTES_TO_U32_LE( key, 12 ) & 0x0FFFFFFCU;
|
||||
|
||||
ctx->s[0] = BYTES_TO_U32_LE( key, 16 );
|
||||
ctx->s[1] = BYTES_TO_U32_LE( key, 20 );
|
||||
ctx->s[2] = BYTES_TO_U32_LE( key, 24 );
|
||||
ctx->s[3] = BYTES_TO_U32_LE( key, 28 );
|
||||
|
||||
/* Initial accumulator state */
|
||||
ctx->acc[0] = 0U;
|
||||
ctx->acc[1] = 0U;
|
||||
ctx->acc[2] = 0U;
|
||||
ctx->acc[3] = 0U;
|
||||
ctx->acc[4] = 0U;
|
||||
|
||||
/* Queue initially empty */
|
||||
mbedtls_platform_zeroize( ctx->queue, sizeof( ctx->queue ) );
|
||||
ctx->queue_len = 0U;
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_poly1305_update( mbedtls_poly1305_context *ctx,
|
||||
const unsigned char *input,
|
||||
size_t ilen )
|
||||
{
|
||||
size_t offset = 0U;
|
||||
size_t remaining = ilen;
|
||||
size_t queue_free_len;
|
||||
size_t nblocks;
|
||||
|
||||
if( ctx == NULL )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
else if( ( ilen > 0U ) && ( input == NULL ) )
|
||||
{
|
||||
/* input pointer is allowed to be NULL only if ilen == 0 */
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
if( ( remaining > 0U ) && ( ctx->queue_len > 0U ) )
|
||||
{
|
||||
queue_free_len = ( POLY1305_BLOCK_SIZE_BYTES - ctx->queue_len );
|
||||
|
||||
if( ilen < queue_free_len )
|
||||
{
|
||||
/* Not enough data to complete the block.
|
||||
* Store this data with the other leftovers.
|
||||
*/
|
||||
memcpy( &ctx->queue[ctx->queue_len],
|
||||
input,
|
||||
ilen );
|
||||
|
||||
ctx->queue_len += ilen;
|
||||
|
||||
remaining = 0U;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Enough data to produce a complete block */
|
||||
memcpy( &ctx->queue[ctx->queue_len],
|
||||
input,
|
||||
queue_free_len );
|
||||
|
||||
ctx->queue_len = 0U;
|
||||
|
||||
poly1305_process( ctx, 1U, ctx->queue, 1U ); /* add padding bit */
|
||||
|
||||
offset += queue_free_len;
|
||||
remaining -= queue_free_len;
|
||||
}
|
||||
}
|
||||
|
||||
if( remaining >= POLY1305_BLOCK_SIZE_BYTES )
|
||||
{
|
||||
nblocks = remaining / POLY1305_BLOCK_SIZE_BYTES;
|
||||
|
||||
poly1305_process( ctx, nblocks, &input[offset], 1U );
|
||||
|
||||
offset += nblocks * POLY1305_BLOCK_SIZE_BYTES;
|
||||
remaining %= POLY1305_BLOCK_SIZE_BYTES;
|
||||
}
|
||||
|
||||
if( remaining > 0U )
|
||||
{
|
||||
/* Store partial block */
|
||||
ctx->queue_len = remaining;
|
||||
memcpy( ctx->queue, &input[offset], remaining );
|
||||
}
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_poly1305_finish( mbedtls_poly1305_context *ctx,
|
||||
unsigned char mac[16] )
|
||||
{
|
||||
if( ( ctx == NULL ) || ( mac == NULL ) )
|
||||
{
|
||||
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
/* Process any leftover data */
|
||||
if( ctx->queue_len > 0U )
|
||||
{
|
||||
/* Add padding bit */
|
||||
ctx->queue[ctx->queue_len] = 1U;
|
||||
ctx->queue_len++;
|
||||
|
||||
/* Pad with zeroes */
|
||||
memset( &ctx->queue[ctx->queue_len],
|
||||
0,
|
||||
POLY1305_BLOCK_SIZE_BYTES - ctx->queue_len );
|
||||
|
||||
poly1305_process( ctx, 1U, /* Process 1 block */
|
||||
ctx->queue, 0U ); /* Already padded above */
|
||||
}
|
||||
|
||||
poly1305_compute_mac( ctx, mac );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
int mbedtls_poly1305_mac( const unsigned char key[32],
|
||||
const unsigned char *input,
|
||||
size_t ilen,
|
||||
unsigned char mac[16] )
|
||||
{
|
||||
mbedtls_poly1305_context ctx;
|
||||
int ret;
|
||||
|
||||
mbedtls_poly1305_init( &ctx );
|
||||
|
||||
ret = mbedtls_poly1305_starts( &ctx, key );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_poly1305_update( &ctx, input, ilen );
|
||||
if( ret != 0 )
|
||||
goto cleanup;
|
||||
|
||||
ret = mbedtls_poly1305_finish( &ctx, mac );
|
||||
|
||||
cleanup:
|
||||
mbedtls_poly1305_free( &ctx );
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_POLY1305_ALT */
|
||||
|
||||
#if defined(MBEDTLS_SELF_TEST)
|
||||
|
||||
static const unsigned char test_keys[2][32] =
|
||||
{
|
||||
{
|
||||
0x85, 0xd6, 0xbe, 0x78, 0x57, 0x55, 0x6d, 0x33,
|
||||
0x7f, 0x44, 0x52, 0xfe, 0x42, 0xd5, 0x06, 0xa8,
|
||||
0x01, 0x03, 0x80, 0x8a, 0xfb, 0x0d, 0xb2, 0xfd,
|
||||
0x4a, 0xbf, 0xf6, 0xaf, 0x41, 0x49, 0xf5, 0x1b
|
||||
},
|
||||
{
|
||||
0x1c, 0x92, 0x40, 0xa5, 0xeb, 0x55, 0xd3, 0x8a,
|
||||
0xf3, 0x33, 0x88, 0x86, 0x04, 0xf6, 0xb5, 0xf0,
|
||||
0x47, 0x39, 0x17, 0xc1, 0x40, 0x2b, 0x80, 0x09,
|
||||
0x9d, 0xca, 0x5c, 0xbc, 0x20, 0x70, 0x75, 0xc0
|
||||
}
|
||||
};
|
||||
|
||||
static const unsigned char test_data[2][127] =
|
||||
{
|
||||
{
|
||||
0x43, 0x72, 0x79, 0x70, 0x74, 0x6f, 0x67, 0x72,
|
||||
0x61, 0x70, 0x68, 0x69, 0x63, 0x20, 0x46, 0x6f,
|
||||
0x72, 0x75, 0x6d, 0x20, 0x52, 0x65, 0x73, 0x65,
|
||||
0x61, 0x72, 0x63, 0x68, 0x20, 0x47, 0x72, 0x6f,
|
||||
0x75, 0x70
|
||||
},
|
||||
{
|
||||
0x27, 0x54, 0x77, 0x61, 0x73, 0x20, 0x62, 0x72,
|
||||
0x69, 0x6c, 0x6c, 0x69, 0x67, 0x2c, 0x20, 0x61,
|
||||
0x6e, 0x64, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
|
||||
0x6c, 0x69, 0x74, 0x68, 0x79, 0x20, 0x74, 0x6f,
|
||||
0x76, 0x65, 0x73, 0x0a, 0x44, 0x69, 0x64, 0x20,
|
||||
0x67, 0x79, 0x72, 0x65, 0x20, 0x61, 0x6e, 0x64,
|
||||
0x20, 0x67, 0x69, 0x6d, 0x62, 0x6c, 0x65, 0x20,
|
||||
0x69, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x77,
|
||||
0x61, 0x62, 0x65, 0x3a, 0x0a, 0x41, 0x6c, 0x6c,
|
||||
0x20, 0x6d, 0x69, 0x6d, 0x73, 0x79, 0x20, 0x77,
|
||||
0x65, 0x72, 0x65, 0x20, 0x74, 0x68, 0x65, 0x20,
|
||||
0x62, 0x6f, 0x72, 0x6f, 0x67, 0x6f, 0x76, 0x65,
|
||||
0x73, 0x2c, 0x0a, 0x41, 0x6e, 0x64, 0x20, 0x74,
|
||||
0x68, 0x65, 0x20, 0x6d, 0x6f, 0x6d, 0x65, 0x20,
|
||||
0x72, 0x61, 0x74, 0x68, 0x73, 0x20, 0x6f, 0x75,
|
||||
0x74, 0x67, 0x72, 0x61, 0x62, 0x65, 0x2e
|
||||
}
|
||||
};
|
||||
|
||||
static const size_t test_data_len[2] =
|
||||
{
|
||||
34U,
|
||||
127U
|
||||
};
|
||||
|
||||
static const unsigned char test_mac[2][16] =
|
||||
{
|
||||
{
|
||||
0xa8, 0x06, 0x1d, 0xc1, 0x30, 0x51, 0x36, 0xc6,
|
||||
0xc2, 0x2b, 0x8b, 0xaf, 0x0c, 0x01, 0x27, 0xa9
|
||||
},
|
||||
{
|
||||
0x45, 0x41, 0x66, 0x9a, 0x7e, 0xaa, 0xee, 0x61,
|
||||
0xe7, 0x08, 0xdc, 0x7c, 0xbc, 0xc5, 0xeb, 0x62
|
||||
}
|
||||
};
|
||||
|
||||
#define ASSERT( cond, args ) \
|
||||
do \
|
||||
{ \
|
||||
if( ! ( cond ) ) \
|
||||
{ \
|
||||
if( verbose != 0 ) \
|
||||
mbedtls_printf args; \
|
||||
\
|
||||
return( -1 ); \
|
||||
} \
|
||||
} \
|
||||
while( 0 )
|
||||
|
||||
int mbedtls_poly1305_self_test( int verbose )
|
||||
{
|
||||
unsigned char mac[16];
|
||||
unsigned i;
|
||||
int ret;
|
||||
|
||||
for( i = 0U; i < 2U; i++ )
|
||||
{
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( " Poly1305 test %u ", i );
|
||||
|
||||
ret = mbedtls_poly1305_mac( test_keys[i],
|
||||
test_data[i],
|
||||
test_data_len[i],
|
||||
mac );
|
||||
ASSERT( 0 == ret, ( "error code: %i\n", ret ) );
|
||||
|
||||
ASSERT( 0 == memcmp( mac, test_mac[i], 16U ), ( "failed (mac)\n" ) );
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "passed\n" );
|
||||
}
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "\n" );
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
||||
#endif /* MBEDTLS_POLY1305_C */
|
||||
|
|
@ -39,6 +39,9 @@ static const char *features[] = {
|
|||
#if defined(MBEDTLS_NO_UDBL_DIVISION)
|
||||
"MBEDTLS_NO_UDBL_DIVISION",
|
||||
#endif /* MBEDTLS_NO_UDBL_DIVISION */
|
||||
#if defined(MBEDTLS_NO_64BIT_MULTIPLICATION)
|
||||
"MBEDTLS_NO_64BIT_MULTIPLICATION",
|
||||
#endif /* MBEDTLS_NO_64BIT_MULTIPLICATION */
|
||||
#if defined(MBEDTLS_HAVE_SSE2)
|
||||
"MBEDTLS_HAVE_SSE2",
|
||||
#endif /* MBEDTLS_HAVE_SSE2 */
|
||||
|
|
@ -102,6 +105,12 @@ static const char *features[] = {
|
|||
#if defined(MBEDTLS_CCM_ALT)
|
||||
"MBEDTLS_CCM_ALT",
|
||||
#endif /* MBEDTLS_CCM_ALT */
|
||||
#if defined(MBEDTLS_CHACHA20_ALT)
|
||||
"MBEDTLS_CHACHA20_ALT",
|
||||
#endif /* MBEDTLS_CHACHA20_ALT */
|
||||
#if defined(MBEDTLS_CHACHAPOLY_ALT)
|
||||
"MBEDTLS_CHACHAPOLY_ALT",
|
||||
#endif /* MBEDTLS_CHACHAPOLY_ALT */
|
||||
#if defined(MBEDTLS_CMAC_ALT)
|
||||
"MBEDTLS_CMAC_ALT",
|
||||
#endif /* MBEDTLS_CMAC_ALT */
|
||||
|
|
@ -126,6 +135,9 @@ static const char *features[] = {
|
|||
#if defined(MBEDTLS_MD5_ALT)
|
||||
"MBEDTLS_MD5_ALT",
|
||||
#endif /* MBEDTLS_MD5_ALT */
|
||||
#if defined(MBEDTLS_POLY1305_ALT)
|
||||
"MBEDTLS_POLY1305_ALT",
|
||||
#endif /* MBEDTLS_POLY1305_ALT */
|
||||
#if defined(MBEDTLS_RIPEMD160_ALT)
|
||||
"MBEDTLS_RIPEMD160_ALT",
|
||||
#endif /* MBEDTLS_RIPEMD160_ALT */
|
||||
|
|
@ -552,6 +564,12 @@ static const char *features[] = {
|
|||
#if defined(MBEDTLS_CERTS_C)
|
||||
"MBEDTLS_CERTS_C",
|
||||
#endif /* MBEDTLS_CERTS_C */
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
"MBEDTLS_CHACHA20_C",
|
||||
#endif /* MBEDTLS_CHACHA20_C */
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
"MBEDTLS_CHACHAPOLY_C",
|
||||
#endif /* MBEDTLS_CHACHAPOLY_C */
|
||||
#if defined(MBEDTLS_CIPHER_C)
|
||||
"MBEDTLS_CIPHER_C",
|
||||
#endif /* MBEDTLS_CIPHER_C */
|
||||
|
|
@ -651,6 +669,9 @@ static const char *features[] = {
|
|||
#if defined(MBEDTLS_PLATFORM_C)
|
||||
"MBEDTLS_PLATFORM_C",
|
||||
#endif /* MBEDTLS_PLATFORM_C */
|
||||
#if defined(MBEDTLS_POLY1305_C)
|
||||
"MBEDTLS_POLY1305_C",
|
||||
#endif /* MBEDTLS_POLY1305_C */
|
||||
#if defined(MBEDTLS_RIPEMD160_C)
|
||||
"MBEDTLS_RIPEMD160_C",
|
||||
#endif /* MBEDTLS_RIPEMD160_C */
|
||||
|
|
|
|||
|
|
@ -61,9 +61,12 @@ int main( void )
|
|||
#include "mbedtls/aria.h"
|
||||
#include "mbedtls/blowfish.h"
|
||||
#include "mbedtls/camellia.h"
|
||||
#include "mbedtls/chacha20.h"
|
||||
#include "mbedtls/gcm.h"
|
||||
#include "mbedtls/ccm.h"
|
||||
#include "mbedtls/chachapoly.h"
|
||||
#include "mbedtls/cmac.h"
|
||||
#include "mbedtls/poly1305.h"
|
||||
|
||||
#include "mbedtls/havege.h"
|
||||
#include "mbedtls/ctr_drbg.h"
|
||||
|
|
@ -98,9 +101,10 @@ int main( void )
|
|||
|
||||
#define OPTIONS \
|
||||
"md4, md5, ripemd160, sha1, sha256, sha512,\n" \
|
||||
"arc4, des3, des, camellia, blowfish,\n" \
|
||||
"aes_cbc, aes_gcm, aes_ccm, aes_cmac, aes_xts,\n" \
|
||||
"des3_cmac, havege, ctr_drbg, hmac_drbg,\n" \
|
||||
"arc4, des3, des, camellia, blowfish, chacha20,\n" \
|
||||
"aes_cbc, aes_gcm, aes_ccm, aes_ctx, chachapoly,\n" \
|
||||
"aes_cmac, des3_cmac, poly1305\n" \
|
||||
"havege, ctr_drbg, hmac_drbg\n" \
|
||||
"rsa, dhm, ecdsa, ecdh.\n"
|
||||
|
||||
#if defined(MBEDTLS_ERROR_C)
|
||||
|
|
@ -115,25 +119,34 @@ int main( void )
|
|||
#define TIME_AND_TSC( TITLE, CODE ) \
|
||||
do { \
|
||||
unsigned long ii, jj, tsc; \
|
||||
int ret = 0; \
|
||||
\
|
||||
mbedtls_printf( HEADER_FORMAT, TITLE ); \
|
||||
fflush( stdout ); \
|
||||
\
|
||||
mbedtls_set_alarm( 1 ); \
|
||||
for( ii = 1; ! mbedtls_timing_alarmed; ii++ ) \
|
||||
for( ii = 1; ret == 0 && ! mbedtls_timing_alarmed; ii++ ) \
|
||||
{ \
|
||||
CODE; \
|
||||
ret = CODE; \
|
||||
} \
|
||||
\
|
||||
tsc = mbedtls_timing_hardclock(); \
|
||||
for( jj = 0; jj < 1024; jj++ ) \
|
||||
for( jj = 0; ret == 0 && jj < 1024; jj++ ) \
|
||||
{ \
|
||||
CODE; \
|
||||
ret = CODE; \
|
||||
} \
|
||||
\
|
||||
if( ret != 0 ) \
|
||||
{ \
|
||||
PRINT_ERROR; \
|
||||
} \
|
||||
else \
|
||||
{ \
|
||||
mbedtls_printf( "%9lu KiB/s, %9lu cycles/byte\n", \
|
||||
ii * BUFSIZE / 1024, \
|
||||
( mbedtls_timing_hardclock() - tsc ) / ( jj * BUFSIZE ) ); \
|
||||
( mbedtls_timing_hardclock() - tsc ) \
|
||||
/ ( jj * BUFSIZE ) ); \
|
||||
} \
|
||||
} while( 0 )
|
||||
|
||||
#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && defined(MBEDTLS_MEMORY_DEBUG)
|
||||
|
|
@ -233,8 +246,10 @@ unsigned char buf[BUFSIZE];
|
|||
typedef struct {
|
||||
char md4, md5, ripemd160, sha1, sha256, sha512,
|
||||
arc4, des3, des,
|
||||
aes_cbc, aes_gcm, aes_ccm, aes_cmac, aes_xts,
|
||||
des3_cmac, aria, camellia, blowfish,
|
||||
aes_cbc, aes_gcm, aes_ccm, aes_xts, chachapoly,
|
||||
aes_cmac, des3_cmac,
|
||||
aria, camellia, blowfish, chacha20,
|
||||
poly1305,
|
||||
havege, ctr_drbg, hmac_drbg,
|
||||
rsa, dhm, ecdsa, ecdh;
|
||||
} todo_list;
|
||||
|
|
@ -285,6 +300,8 @@ int main( int argc, char *argv[] )
|
|||
todo.aes_gcm = 1;
|
||||
else if( strcmp( argv[i], "aes_ccm" ) == 0 )
|
||||
todo.aes_ccm = 1;
|
||||
else if( strcmp( argv[i], "chachapoly" ) == 0 )
|
||||
todo.chachapoly = 1;
|
||||
else if( strcmp( argv[i], "aes_cmac" ) == 0 )
|
||||
todo.aes_cmac = 1;
|
||||
else if( strcmp( argv[i], "des3_cmac" ) == 0 )
|
||||
|
|
@ -295,6 +312,10 @@ int main( int argc, char *argv[] )
|
|||
todo.camellia = 1;
|
||||
else if( strcmp( argv[i], "blowfish" ) == 0 )
|
||||
todo.blowfish = 1;
|
||||
else if( strcmp( argv[i], "chacha20" ) == 0 )
|
||||
todo.chacha20 = 1;
|
||||
else if( strcmp( argv[i], "poly1305" ) == 0 )
|
||||
todo.poly1305 = 1;
|
||||
else if( strcmp( argv[i], "havege" ) == 0 )
|
||||
todo.havege = 1;
|
||||
else if( strcmp( argv[i], "ctr_drbg" ) == 0 )
|
||||
|
|
@ -497,6 +518,26 @@ int main( int argc, char *argv[] )
|
|||
}
|
||||
}
|
||||
#endif
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
if( todo.chachapoly )
|
||||
{
|
||||
mbedtls_chachapoly_context chachapoly;
|
||||
|
||||
mbedtls_chachapoly_init( &chachapoly );
|
||||
memset( buf, 0, sizeof( buf ) );
|
||||
memset( tmp, 0, sizeof( tmp ) );
|
||||
|
||||
mbedtls_snprintf( title, sizeof( title ), "ChaCha20-Poly1305" );
|
||||
|
||||
mbedtls_chachapoly_setkey( &chachapoly, tmp );
|
||||
|
||||
TIME_AND_TSC( title,
|
||||
mbedtls_chachapoly_encrypt_and_tag( &chachapoly,
|
||||
BUFSIZE, tmp, NULL, 0, buf, buf, tmp ) );
|
||||
|
||||
mbedtls_chachapoly_free( &chachapoly );
|
||||
}
|
||||
#endif
|
||||
#if defined(MBEDTLS_CMAC_C)
|
||||
if( todo.aes_cmac )
|
||||
{
|
||||
|
|
@ -574,6 +615,20 @@ int main( int argc, char *argv[] )
|
|||
}
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
if ( todo.chacha20 )
|
||||
{
|
||||
TIME_AND_TSC( "ChaCha20", mbedtls_chacha20_crypt( buf, buf, 0U, BUFSIZE, buf, buf ) );
|
||||
}
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_POLY1305_C)
|
||||
if ( todo.poly1305 )
|
||||
{
|
||||
TIME_AND_TSC( "Poly1305", mbedtls_poly1305_mac( buf, buf, BUFSIZE, buf ) );
|
||||
}
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_BLOWFISH_C) && defined(MBEDTLS_CIPHER_MODE_CBC)
|
||||
if( todo.blowfish )
|
||||
{
|
||||
|
|
@ -618,15 +673,13 @@ int main( int argc, char *argv[] )
|
|||
if( mbedtls_ctr_drbg_seed( &ctr_drbg, myrand, NULL, NULL, 0 ) != 0 )
|
||||
mbedtls_exit(1);
|
||||
TIME_AND_TSC( "CTR_DRBG (NOPR)",
|
||||
if( mbedtls_ctr_drbg_random( &ctr_drbg, buf, BUFSIZE ) != 0 )
|
||||
mbedtls_exit(1) );
|
||||
mbedtls_ctr_drbg_random( &ctr_drbg, buf, BUFSIZE ) );
|
||||
|
||||
if( mbedtls_ctr_drbg_seed( &ctr_drbg, myrand, NULL, NULL, 0 ) != 0 )
|
||||
mbedtls_exit(1);
|
||||
mbedtls_ctr_drbg_set_prediction_resistance( &ctr_drbg, MBEDTLS_CTR_DRBG_PR_ON );
|
||||
TIME_AND_TSC( "CTR_DRBG (PR)",
|
||||
if( mbedtls_ctr_drbg_random( &ctr_drbg, buf, BUFSIZE ) != 0 )
|
||||
mbedtls_exit(1) );
|
||||
mbedtls_ctr_drbg_random( &ctr_drbg, buf, BUFSIZE ) );
|
||||
mbedtls_ctr_drbg_free( &ctr_drbg );
|
||||
}
|
||||
#endif
|
||||
|
|
@ -646,8 +699,7 @@ int main( int argc, char *argv[] )
|
|||
if( mbedtls_hmac_drbg_seed( &hmac_drbg, md_info, myrand, NULL, NULL, 0 ) != 0 )
|
||||
mbedtls_exit(1);
|
||||
TIME_AND_TSC( "HMAC_DRBG SHA-1 (NOPR)",
|
||||
if( mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) != 0 )
|
||||
mbedtls_exit(1) );
|
||||
mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) );
|
||||
mbedtls_hmac_drbg_free( &hmac_drbg );
|
||||
|
||||
if( mbedtls_hmac_drbg_seed( &hmac_drbg, md_info, myrand, NULL, NULL, 0 ) != 0 )
|
||||
|
|
@ -655,8 +707,7 @@ int main( int argc, char *argv[] )
|
|||
mbedtls_hmac_drbg_set_prediction_resistance( &hmac_drbg,
|
||||
MBEDTLS_HMAC_DRBG_PR_ON );
|
||||
TIME_AND_TSC( "HMAC_DRBG SHA-1 (PR)",
|
||||
if( mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) != 0 )
|
||||
mbedtls_exit(1) );
|
||||
mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) );
|
||||
mbedtls_hmac_drbg_free( &hmac_drbg );
|
||||
#endif
|
||||
|
||||
|
|
@ -667,8 +718,7 @@ int main( int argc, char *argv[] )
|
|||
if( mbedtls_hmac_drbg_seed( &hmac_drbg, md_info, myrand, NULL, NULL, 0 ) != 0 )
|
||||
mbedtls_exit(1);
|
||||
TIME_AND_TSC( "HMAC_DRBG SHA-256 (NOPR)",
|
||||
if( mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) != 0 )
|
||||
mbedtls_exit(1) );
|
||||
mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) );
|
||||
mbedtls_hmac_drbg_free( &hmac_drbg );
|
||||
|
||||
if( mbedtls_hmac_drbg_seed( &hmac_drbg, md_info, myrand, NULL, NULL, 0 ) != 0 )
|
||||
|
|
@ -676,8 +726,7 @@ int main( int argc, char *argv[] )
|
|||
mbedtls_hmac_drbg_set_prediction_resistance( &hmac_drbg,
|
||||
MBEDTLS_HMAC_DRBG_PR_ON );
|
||||
TIME_AND_TSC( "HMAC_DRBG SHA-256 (PR)",
|
||||
if( mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) != 0 )
|
||||
mbedtls_exit(1) );
|
||||
mbedtls_hmac_drbg_random( &hmac_drbg, buf, BUFSIZE ) );
|
||||
mbedtls_hmac_drbg_free( &hmac_drbg );
|
||||
#endif
|
||||
}
|
||||
|
|
|
|||
|
|
@ -45,6 +45,9 @@
|
|||
#include "mbedtls/aes.h"
|
||||
#include "mbedtls/camellia.h"
|
||||
#include "mbedtls/aria.h"
|
||||
#include "mbedtls/chacha20.h"
|
||||
#include "mbedtls/poly1305.h"
|
||||
#include "mbedtls/chachapoly.h"
|
||||
#include "mbedtls/base64.h"
|
||||
#include "mbedtls/bignum.h"
|
||||
#include "mbedtls/rsa.h"
|
||||
|
|
@ -208,6 +211,15 @@ const selftest_t selftests[] =
|
|||
#if defined(MBEDTLS_CMAC_C)
|
||||
{"cmac", mbedtls_cmac_self_test},
|
||||
#endif
|
||||
#if defined(MBEDTLS_CHACHA20_C)
|
||||
{"chacha20", mbedtls_chacha20_self_test},
|
||||
#endif
|
||||
#if defined(MBEDTLS_POLY1305_C)
|
||||
{"poly1305", mbedtls_poly1305_self_test},
|
||||
#endif
|
||||
#if defined(MBEDTLS_CHACHAPOLY_C)
|
||||
{"chacha20-poly1305", mbedtls_chachapoly_self_test},
|
||||
#endif
|
||||
#if defined(MBEDTLS_BASE64_C)
|
||||
{"base64", mbedtls_base64_self_test},
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -95,6 +95,7 @@ MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
|
|||
MBEDTLS_ZLIB_SUPPORT
|
||||
MBEDTLS_PKCS11_C
|
||||
MBEDTLS_NO_UDBL_DIVISION
|
||||
MBEDTLS_NO_64BIT_MULTIPLICATION
|
||||
_ALT\s*$
|
||||
);
|
||||
|
||||
|
|
|
|||
|
|
@ -30,9 +30,9 @@ if( @ARGV ) {
|
|||
my $error_format_file = $data_dir.'/error.fmt';
|
||||
|
||||
my @low_level_modules = qw( AES ARC4 ARIA ASN1 BASE64 BIGNUM BLOWFISH
|
||||
CAMELLIA CCM CMAC CTR_DRBG DES
|
||||
CAMELLIA CCM CHACHA20 CHACHAPOLY CMAC CTR_DRBG DES
|
||||
ENTROPY GCM HKDF HMAC_DRBG MD2 MD4 MD5
|
||||
NET OID PADLOCK PBKDF2 RIPEMD160
|
||||
NET OID PADLOCK PBKDF2 POLY1305 RIPEMD160
|
||||
SHA1 SHA256 SHA512 THREADING XTEA );
|
||||
my @high_level_modules = qw( CIPHER DHM ECP MD
|
||||
PEM PK PKCS12 PKCS5
|
||||
|
|
|
|||
|
|
@ -56,11 +56,15 @@ add_test_suite(base64)
|
|||
add_test_suite(blowfish)
|
||||
add_test_suite(camellia)
|
||||
add_test_suite(ccm)
|
||||
add_test_suite(chacha20)
|
||||
add_test_suite(chachapoly)
|
||||
add_test_suite(cipher cipher.aes)
|
||||
add_test_suite(cipher cipher.arc4)
|
||||
add_test_suite(cipher cipher.blowfish)
|
||||
add_test_suite(cipher cipher.camellia)
|
||||
add_test_suite(cipher cipher.ccm)
|
||||
add_test_suite(cipher cipher.chacha20)
|
||||
add_test_suite(cipher cipher.chachapoly)
|
||||
add_test_suite(cipher cipher.des)
|
||||
add_test_suite(cipher cipher.gcm)
|
||||
add_test_suite(cipher cipher.null)
|
||||
|
|
@ -99,6 +103,7 @@ add_test_suite(pkcs5)
|
|||
add_test_suite(pk)
|
||||
add_test_suite(pkparse)
|
||||
add_test_suite(pkwrite)
|
||||
add_test_suite(poly1305)
|
||||
add_test_suite(shax)
|
||||
add_test_suite(ssl)
|
||||
add_test_suite(timing)
|
||||
|
|
|
|||
|
|
@ -48,14 +48,16 @@ endif
|
|||
APPS = test_suite_aes.ecb$(EXEXT) test_suite_aes.cbc$(EXEXT) \
|
||||
test_suite_aes.cfb$(EXEXT) test_suite_aes.ofb$(EXEXT) \
|
||||
test_suite_aes.xts$(EXEXT) \
|
||||
test_suite_aes.rest$(EXEXT) \
|
||||
test_suite_arc4$(EXEXT) test_suite_asn1write$(EXEXT) \
|
||||
test_suite_aes.rest$(EXEXT) test_suite_arc4$(EXEXT) \
|
||||
test_suite_aria$(EXEXT) test_suite_asn1write$(EXEXT) \
|
||||
test_suite_base64$(EXEXT) test_suite_blowfish$(EXEXT) \
|
||||
test_suite_camellia$(EXEXT) test_suite_ccm$(EXEXT) \
|
||||
test_suite_aria$(EXEXT) \
|
||||
test_suite_chacha20$(EXEXT) test_suite_chachapoly$(EXEXT) \
|
||||
test_suite_cmac$(EXEXT) \
|
||||
test_suite_cipher.chachapoly$(EXEXT) \
|
||||
test_suite_cipher.aes$(EXEXT) \
|
||||
test_suite_cipher.arc4$(EXEXT) test_suite_cipher.ccm$(EXEXT) \
|
||||
test_suite_cipher.chacha20$(EXEXT) \
|
||||
test_suite_cipher.gcm$(EXEXT) \
|
||||
test_suite_cipher.blowfish$(EXEXT) \
|
||||
test_suite_cipher.camellia$(EXEXT) \
|
||||
|
|
@ -85,6 +87,7 @@ APPS = test_suite_aes.ecb$(EXEXT) test_suite_aes.cbc$(EXEXT) \
|
|||
test_suite_pkcs1_v21$(EXEXT) test_suite_pkcs5$(EXEXT) \
|
||||
test_suite_pkparse$(EXEXT) test_suite_pkwrite$(EXEXT) \
|
||||
test_suite_pk$(EXEXT) \
|
||||
test_suite_poly1305$(EXEXT) \
|
||||
test_suite_rsa$(EXEXT) test_suite_shax$(EXEXT) \
|
||||
test_suite_ssl$(EXEXT) test_suite_timing$(EXEXT) \
|
||||
test_suite_x509parse$(EXEXT) test_suite_x509write$(EXEXT) \
|
||||
|
|
@ -137,6 +140,14 @@ test_suite_cipher.ccm.c : suites/test_suite_cipher.function suites/test_suite_ci
|
|||
echo " Gen $@"
|
||||
perl scripts/generate_code.pl suites test_suite_cipher test_suite_cipher.ccm
|
||||
|
||||
test_suite_cipher.chacha20.c : suites/test_suite_cipher.function suites/test_suite_cipher.chacha20.data scripts/generate_code.pl suites/helpers.function suites/main_test.function
|
||||
echo " Gen $@"
|
||||
perl scripts/generate_code.pl suites test_suite_cipher test_suite_cipher.chacha20
|
||||
|
||||
test_suite_cipher.chachapoly.c : suites/test_suite_cipher.function suites/test_suite_cipher.chachapoly.data scripts/generate_code.pl suites/helpers.function suites/main_test.function
|
||||
echo " Gen $@"
|
||||
perl scripts/generate_code.pl suites test_suite_cipher test_suite_cipher.chachapoly
|
||||
|
||||
test_suite_cipher.gcm.c : suites/test_suite_cipher.function suites/test_suite_cipher.gcm.data scripts/generate_code.pl suites/helpers.function suites/main_test.function
|
||||
echo " Gen $@"
|
||||
perl scripts/generate_code.pl suites test_suite_cipher test_suite_cipher.gcm
|
||||
|
|
@ -261,6 +272,14 @@ test_suite_ccm$(EXEXT): test_suite_ccm.c $(DEP)
|
|||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_chacha20$(EXEXT): test_suite_chacha20.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_chachapoly$(EXEXT): test_suite_chachapoly.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_cmac$(EXEXT): test_suite_cmac.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
|
@ -277,6 +296,14 @@ test_suite_cipher.ccm$(EXEXT): test_suite_cipher.ccm.c $(DEP)
|
|||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_cipher.chacha20$(EXEXT): test_suite_cipher.chacha20.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_cipher.chachapoly$(EXEXT): test_suite_cipher.chachapoly.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_cipher.gcm$(EXEXT): test_suite_cipher.gcm.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
|
@ -429,6 +456,10 @@ test_suite_pk$(EXEXT): test_suite_pk.c $(DEP)
|
|||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_poly1305$(EXEXT): test_suite_poly1305.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
||||
test_suite_rsa$(EXEXT): test_suite_rsa.c $(DEP)
|
||||
echo " CC $<"
|
||||
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
|
||||
|
|
|
|||
|
|
@ -357,6 +357,12 @@ if_build_succeeded () {
|
|||
fi
|
||||
}
|
||||
|
||||
# to be used instead of ! for commands run with
|
||||
# record_status or if_build_succeeded
|
||||
not() {
|
||||
! "$@"
|
||||
}
|
||||
|
||||
msg "info: $0 configuration"
|
||||
echo "MEMORY: $MEMORY"
|
||||
echo "FORCE: $FORCE"
|
||||
|
|
@ -713,6 +719,31 @@ make CC=gcc CFLAGS='-Werror -Wall -Wextra -DMBEDTLS_HAVE_INT64'
|
|||
msg "test: gcc, force 64-bit bignum limbs"
|
||||
make test
|
||||
|
||||
|
||||
msg "build: MBEDTLS_NO_UDBL_DIVISION native" # ~ 10s
|
||||
cleanup
|
||||
cp "$CONFIG_H" "$CONFIG_BAK"
|
||||
scripts/config.pl full
|
||||
scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests
|
||||
scripts/config.pl set MBEDTLS_NO_UDBL_DIVISION
|
||||
make CFLAGS='-Werror -O1'
|
||||
|
||||
msg "test: MBEDTLS_NO_UDBL_DIVISION native" # ~ 10s
|
||||
make test
|
||||
|
||||
|
||||
msg "build: MBEDTLS_NO_64BIT_MULTIPLICATION native" # ~ 10s
|
||||
cleanup
|
||||
cp "$CONFIG_H" "$CONFIG_BAK"
|
||||
scripts/config.pl full
|
||||
scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests
|
||||
scripts/config.pl set MBEDTLS_NO_64BIT_MULTIPLICATION
|
||||
make CFLAGS='-Werror -O1'
|
||||
|
||||
msg "test: MBEDTLS_NO_64BIT_MULTIPLICATION native" # ~ 10s
|
||||
make test
|
||||
|
||||
|
||||
msg "build: arm-none-eabi-gcc, make" # ~ 10s
|
||||
cleanup
|
||||
cp "$CONFIG_H" "$CONFIG_BAK"
|
||||
|
|
@ -748,7 +779,27 @@ scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C # calls exit
|
|||
scripts/config.pl set MBEDTLS_NO_UDBL_DIVISION
|
||||
make CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld CFLAGS='-Werror -Wall -Wextra' lib
|
||||
echo "Checking that software 64-bit division is not required"
|
||||
! grep __aeabi_uldiv library/*.o
|
||||
if_build_succeeded not grep __aeabi_uldiv library/*.o
|
||||
|
||||
msg "build: arm-none-eabi-gcc MBEDTLS_NO_64BIT_MULTIPLICATION, make" # ~ 10s
|
||||
cleanup
|
||||
cp "$CONFIG_H" "$CONFIG_BAK"
|
||||
scripts/config.pl full
|
||||
scripts/config.pl unset MBEDTLS_NET_C
|
||||
scripts/config.pl unset MBEDTLS_TIMING_C
|
||||
scripts/config.pl unset MBEDTLS_FS_IO
|
||||
scripts/config.pl unset MBEDTLS_ENTROPY_NV_SEED
|
||||
scripts/config.pl set MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
# following things are not in the default config
|
||||
scripts/config.pl unset MBEDTLS_HAVEGE_C # depends on timing.c
|
||||
scripts/config.pl unset MBEDTLS_THREADING_PTHREAD
|
||||
scripts/config.pl unset MBEDTLS_THREADING_C
|
||||
scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # execinfo.h
|
||||
scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C # calls exit
|
||||
scripts/config.pl set MBEDTLS_NO_64BIT_MULTIPLICATION
|
||||
make CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld CFLAGS='-Werror -O1 -march=armv6-m -mthumb' lib
|
||||
echo "Checking that software 64-bit multiplication is not required"
|
||||
if_build_succeeded not grep __aeabi_lmul library/*.o
|
||||
|
||||
msg "build: ARM Compiler 5, make"
|
||||
cleanup
|
||||
|
|
|
|||
29
tests/suites/test_suite_chacha20.data
Normal file
29
tests/suites/test_suite_chacha20.data
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
ChaCha20 RFC 7539 Example and Test Vector (Encrypt)
|
||||
chacha20_crypt:"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f":"000000000000004a00000000":1:"4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73637265656e20776f756c642062652069742e":"6e2e359a2568f98041ba0728dd0d6981e97e7aec1d4360c20a27afccfd9fae0bf91b65c5524733ab8f593dabcd62b3571639d624e65152ab8f530c359f0861d807ca0dbf500d6a6156a38e088a22b65e52bc514d16ccf806818ce91ab77937365af90bbf74a35be6b40b8eedf2785e42874d"
|
||||
|
||||
ChaCha20 RFC 7539 Example and Test Vector (Decrypt)
|
||||
chacha20_crypt:"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f":"000000000000004a00000000":1:"6e2e359a2568f98041ba0728dd0d6981e97e7aec1d4360c20a27afccfd9fae0bf91b65c5524733ab8f593dabcd62b3571639d624e65152ab8f530c359f0861d807ca0dbf500d6a6156a38e088a22b65e52bc514d16ccf806818ce91ab77937365af90bbf74a35be6b40b8eedf2785e42874d":"4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73637265656e20776f756c642062652069742e"
|
||||
|
||||
ChaCha20 RFC 7539 Test Vector #1 (Encrypt)
|
||||
chacha20_crypt:"0000000000000000000000000000000000000000000000000000000000000000":"000000000000000000000000":0:"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586"
|
||||
|
||||
ChaCha20 RFC 7539 Test Vector #1 (Decrypt)
|
||||
chacha20_crypt:"0000000000000000000000000000000000000000000000000000000000000000":"000000000000000000000000":0:"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
|
||||
|
||||
ChaCha20 RFC 7539 Test Vector #2 (Encrypt)
|
||||
chacha20_crypt:"0000000000000000000000000000000000000000000000000000000000000001":"000000000000000000000002":1:"416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f":"a3fbf07df3fa2fde4f376ca23e82737041605d9f4f4f57bd8cff2c1d4b7955ec2a97948bd3722915c8f3d337f7d370050e9e96d647b7c39f56e031ca5eb6250d4042e02785ececfa4b4bb5e8ead0440e20b6e8db09d881a7c6132f420e52795042bdfa7773d8a9051447b3291ce1411c680465552aa6c405b7764d5e87bea85ad00f8449ed8f72d0d662ab052691ca66424bc86d2df80ea41f43abf937d3259dc4b2d0dfb48a6c9139ddd7f76966e928e635553ba76c5c879d7b35d49eb2e62b0871cdac638939e25e8a1e0ef9d5280fa8ca328b351c3c765989cbcf3daa8b6ccc3aaf9f3979c92b3720fc88dc95ed84a1be059c6499b9fda236e7e818b04b0bc39c1e876b193bfe5569753f88128cc08aaa9b63d1a16f80ef2554d7189c411f5869ca52c5b83fa36ff216b9c1d30062bebcfd2dc5bce0911934fda79a86f6e698ced759c3ff9b6477338f3da4f9cd8514ea9982ccafb341b2384dd902f3d1ab7ac61dd29c6f21ba5b862f3730e37cfdc4fd806c22f221"
|
||||
|
||||
ChaCha20 RFC 7539 Test Vector #2 (Decrypt)
|
||||
chacha20_crypt:"0000000000000000000000000000000000000000000000000000000000000001":"000000000000000000000002":1:"a3fbf07df3fa2fde4f376ca23e82737041605d9f4f4f57bd8cff2c1d4b7955ec2a97948bd3722915c8f3d337f7d370050e9e96d647b7c39f56e031ca5eb6250d4042e02785ececfa4b4bb5e8ead0440e20b6e8db09d881a7c6132f420e52795042bdfa7773d8a9051447b3291ce1411c680465552aa6c405b7764d5e87bea85ad00f8449ed8f72d0d662ab052691ca66424bc86d2df80ea41f43abf937d3259dc4b2d0dfb48a6c9139ddd7f76966e928e635553ba76c5c879d7b35d49eb2e62b0871cdac638939e25e8a1e0ef9d5280fa8ca328b351c3c765989cbcf3daa8b6ccc3aaf9f3979c92b3720fc88dc95ed84a1be059c6499b9fda236e7e818b04b0bc39c1e876b193bfe5569753f88128cc08aaa9b63d1a16f80ef2554d7189c411f5869ca52c5b83fa36ff216b9c1d30062bebcfd2dc5bce0911934fda79a86f6e698ced759c3ff9b6477338f3da4f9cd8514ea9982ccafb341b2384dd902f3d1ab7ac61dd29c6f21ba5b862f3730e37cfdc4fd806c22f221":"416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f"
|
||||
|
||||
ChaCha20 RFC 7539 Test Vector #3 (Encrypt)
|
||||
chacha20_crypt:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000000000000000002":42:"2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e":"62e6347f95ed87a45ffae7426f27a1df5fb69110044c0d73118effa95b01e5cf166d3df2d721caf9b21e5fb14c616871fd84c54f9d65b283196c7fe4f60553ebf39c6402c42234e32a356b3e764312a61a5532055716ead6962568f87d3f3f7704c6a8d1bcd1bf4d50d6154b6da731b187b58dfd728afa36757a797ac188d1"
|
||||
|
||||
ChaCha20 RFC 7539 Test Vector #3 (Decrypt)
|
||||
chacha20_crypt:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000000000000000002":42:"62e6347f95ed87a45ffae7426f27a1df5fb69110044c0d73118effa95b01e5cf166d3df2d721caf9b21e5fb14c616871fd84c54f9d65b283196c7fe4f60553ebf39c6402c42234e32a356b3e764312a61a5532055716ead6962568f87d3f3f7704c6a8d1bcd1bf4d50d6154b6da731b187b58dfd728afa36757a797ac188d1":"2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e"
|
||||
|
||||
ChaCha20 Paremeter Validation
|
||||
chacha20_bad_params:
|
||||
|
||||
ChaCha20 Selftest
|
||||
chacha20_self_test:
|
||||
140
tests/suites/test_suite_chacha20.function
Normal file
140
tests/suites/test_suite_chacha20.function
Normal file
|
|
@ -0,0 +1,140 @@
|
|||
/* BEGIN_HEADER */
|
||||
#include "mbedtls/chacha20.h"
|
||||
/* END_HEADER */
|
||||
|
||||
/* BEGIN_DEPENDENCIES
|
||||
* depends_on:MBEDTLS_CHACHA20_C
|
||||
* END_DEPENDENCIES
|
||||
*/
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void chacha20_crypt( char *hex_key_string,
|
||||
char *hex_nonce_string,
|
||||
int counter,
|
||||
char *hex_src_string,
|
||||
char *hex_dst_string )
|
||||
{
|
||||
unsigned char key_str[32]; /* size set by the standard */
|
||||
unsigned char nonce_str[12]; /* size set by the standard */
|
||||
unsigned char src_str[375]; /* max size of binary input */
|
||||
unsigned char dst_str[751]; /* hex expansion of the above */
|
||||
unsigned char output[751];
|
||||
size_t key_len;
|
||||
size_t nonce_len;
|
||||
size_t src_len;
|
||||
size_t dst_len;
|
||||
mbedtls_chacha20_context ctx;
|
||||
|
||||
memset( key_str, 0x00, sizeof( key_str ) );
|
||||
memset( nonce_str, 0x00, sizeof( nonce_str ) );
|
||||
memset( src_str, 0x00, sizeof( src_str ) );
|
||||
memset( dst_str, 0x00, sizeof( dst_str ) );
|
||||
memset( output, 0x00, sizeof( output ) );
|
||||
|
||||
key_len = unhexify( key_str, hex_key_string );
|
||||
nonce_len = unhexify( nonce_str, hex_nonce_string );
|
||||
src_len = unhexify( src_str, hex_src_string );
|
||||
dst_len = unhexify( dst_str, hex_dst_string );
|
||||
|
||||
TEST_ASSERT( src_len == dst_len );
|
||||
TEST_ASSERT( key_len == 32U );
|
||||
TEST_ASSERT( nonce_len == 12U );
|
||||
|
||||
/*
|
||||
* Test the integrated API
|
||||
*/
|
||||
TEST_ASSERT( mbedtls_chacha20_crypt( key_str, nonce_str, counter, src_len, src_str, output ) == 0 );
|
||||
|
||||
hexify( dst_str, output, src_len );
|
||||
TEST_ASSERT( strcmp( (char*) dst_str, hex_dst_string ) == 0 );
|
||||
|
||||
/*
|
||||
* Test the streaming API
|
||||
*/
|
||||
mbedtls_chacha20_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_chacha20_setkey( &ctx, key_str ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_chacha20_starts( &ctx, nonce_str, counter ) == 0 );
|
||||
|
||||
memset( output, 0x00, sizeof( output ) );
|
||||
TEST_ASSERT( mbedtls_chacha20_update( &ctx, src_len, src_str, output ) == 0 );
|
||||
|
||||
hexify( dst_str, output, src_len );
|
||||
TEST_ASSERT( strcmp( (char*) dst_str, hex_dst_string ) == 0 );
|
||||
|
||||
/*
|
||||
* Test the streaming API again, piecewise
|
||||
*/
|
||||
|
||||
/* Don't free/init the context nor set the key again,
|
||||
* in order to test that starts() does the right thing. */
|
||||
TEST_ASSERT( mbedtls_chacha20_starts( &ctx, nonce_str, counter ) == 0 );
|
||||
|
||||
memset( output, 0x00, sizeof( output ) );
|
||||
TEST_ASSERT( mbedtls_chacha20_update( &ctx, 1, src_str, output ) == 0 );
|
||||
TEST_ASSERT( mbedtls_chacha20_update( &ctx, src_len - 1, src_str + 1, output + 1 ) == 0 );
|
||||
|
||||
hexify( dst_str, output, src_len );
|
||||
TEST_ASSERT( strcmp( (char*) dst_str, hex_dst_string ) == 0 );
|
||||
|
||||
mbedtls_chacha20_free( &ctx );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void chacha20_bad_params()
|
||||
{
|
||||
unsigned char key[32];
|
||||
unsigned char nonce[12];
|
||||
unsigned char src[1];
|
||||
unsigned char dst[1];
|
||||
uint32_t counter = 0;
|
||||
size_t len = sizeof( src );
|
||||
mbedtls_chacha20_context ctx;
|
||||
|
||||
mbedtls_chacha20_init( NULL );
|
||||
mbedtls_chacha20_free( NULL );
|
||||
|
||||
mbedtls_chacha20_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_chacha20_setkey( NULL, key )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_setkey( &ctx, NULL )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chacha20_starts( NULL, nonce, counter )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_starts( &ctx, NULL, counter )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chacha20_update( NULL, 0, src, dst )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_update( &ctx, len, NULL, dst )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_update( &ctx, len, src, NULL )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_update( &ctx, 0, NULL, NULL )
|
||||
== 0 );
|
||||
|
||||
mbedtls_chacha20_free( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_chacha20_crypt( NULL, nonce, counter, 0, src, dst )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_crypt( key, NULL, counter, 0, src, dst )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_crypt( key, nonce, counter, len, NULL, dst )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_crypt( key, nonce, counter, len, src, NULL )
|
||||
== MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chacha20_crypt( key, nonce, counter, 0, NULL, NULL )
|
||||
== 0 );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */
|
||||
void chacha20_self_test()
|
||||
{
|
||||
TEST_ASSERT( mbedtls_chacha20_self_test( 1 ) == 0 );
|
||||
}
|
||||
/* END_CASE */
|
||||
27
tests/suites/test_suite_chachapoly.data
Normal file
27
tests/suites/test_suite_chachapoly.data
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
ChaCha20-Poly1305 RFC 7539 Example and Test Vector (Encrypt)
|
||||
mbedtls_chachapoly_enc:"808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f":"070000004041424344454647":"50515253c0c1c2c3c4c5c6c7":"4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73637265656e20776f756c642062652069742e":"d31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee62d63dbea45e8ca9671282fafb69da92728b1a71de0a9e060b2905d6a5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fab324e4fad675945585808b4831d7bc3ff4def08e4b7a9de576d26586cec64b6116":"1ae10b594f09e26a7e902ecbd0600691"
|
||||
|
||||
ChaCha20-Poly1305 RFC 7539 Example and Test Vector (Decrypt)
|
||||
mbedtls_chachapoly_dec:"808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f":"070000004041424344454647":"50515253c0c1c2c3c4c5c6c7":"d31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee62d63dbea45e8ca9671282fafb69da92728b1a71de0a9e060b2905d6a5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fab324e4fad675945585808b4831d7bc3ff4def08e4b7a9de576d26586cec64b6116":"4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73637265656e20776f756c642062652069742e":"1ae10b594f09e26a7e902ecbd0600691":0
|
||||
|
||||
ChaCha20-Poly1305 RFC 7539 Example and Test Vector (Decrypt, not authentic)
|
||||
mbedtls_chachapoly_dec:"808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f":"070000004041424344454647":"50515253c0c1c2c3c4c5c6c7":"d31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee62d63dbea45e8ca9671282fafb69da92728b1a71de0a9e060b2905d6a5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fab324e4fad675945585808b4831d7bc3ff4def08e4b7a9de576d26586cec64b6116":"4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73637265656e20776f756c642062652069742e":"1ae10b594f09e26a7e902ecbd0600690":MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED
|
||||
|
||||
ChaCha20-Poly1305 RFC 7539 Test Vector #1 (Encrypt)
|
||||
mbedtls_chachapoly_enc:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000102030405060708":"f33388860000000000004e91":"496e7465726e65742d4472616674732061726520647261667420646f63756d656e74732076616c696420666f722061206d6178696d756d206f6620736978206d6f6e74687320616e64206d617920626520757064617465642c207265706c616365642c206f72206f62736f6c65746564206279206f7468657220646f63756d656e747320617420616e792074696d652e20497420697320696e617070726f70726961746520746f2075736520496e7465726e65742d447261667473206173207265666572656e6365206d6174657269616c206f7220746f2063697465207468656d206f74686572207468616e206173202fe2809c776f726b20696e2070726f67726573732e2fe2809d":"64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d33bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b3506383606907b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b0047718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa76991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e617d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6f2c29a6ad5cb4022b02709b":"eead9d67890cbb22392336fea1851f38"
|
||||
|
||||
ChaCha20-Poly1305 RFC 7539 Test Vector #1 (Decrypt)
|
||||
mbedtls_chachapoly_dec:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000102030405060708":"f33388860000000000004e91":"64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d33bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b3506383606907b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b0047718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa76991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e617d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6f2c29a6ad5cb4022b02709b":"496e7465726e65742d4472616674732061726520647261667420646f63756d656e74732076616c696420666f722061206d6178696d756d206f6620736978206d6f6e74687320616e64206d617920626520757064617465642c207265706c616365642c206f72206f62736f6c65746564206279206f7468657220646f63756d656e747320617420616e792074696d652e20497420697320696e617070726f70726961746520746f2075736520496e7465726e65742d447261667473206173207265666572656e6365206d6174657269616c206f7220746f2063697465207468656d206f74686572207468616e206173202fe2809c776f726b20696e2070726f67726573732e2fe2809d":"eead9d67890cbb22392336fea1851f38":0
|
||||
|
||||
ChaCha20-Poly1305 RFC 7539 Test Vector #1 (Decrypt, not authentic)
|
||||
mbedtls_chachapoly_dec:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000102030405060708":"f33388860000000000004e91":"64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d33bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b3506383606907b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b0047718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa76991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e617d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6f2c29a6ad5cb4022b02709b":"496e7465726e65742d4472616674732061726520647261667420646f63756d656e74732076616c696420666f722061206d6178696d756d206f6620736978206d6f6e74687320616e64206d617920626520757064617465642c207265706c616365642c206f72206f62736f6c65746564206279206f7468657220646f63756d656e747320617420616e792074696d652e20497420697320696e617070726f70726961746520746f2075736520496e7465726e65742d447261667473206173207265666572656e6365206d6174657269616c206f7220746f2063697465207468656d206f74686572207468616e206173202fe2809c776f726b20696e2070726f67726573732e2fe2809d":"fead9d67890cbb22392336fea1851f38":MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED
|
||||
|
||||
ChaCha20-Poly1305 State Flow
|
||||
chachapoly_state:
|
||||
|
||||
ChaCha20-Poly1305 Parameter Validation
|
||||
chachapoly_bad_params:
|
||||
|
||||
ChaCha20-Poly1305 Selftest
|
||||
depends_on:MBEDTLS_SELF_TEST
|
||||
chachapoly_selftest:
|
||||
347
tests/suites/test_suite_chachapoly.function
Normal file
347
tests/suites/test_suite_chachapoly.function
Normal file
|
|
@ -0,0 +1,347 @@
|
|||
/* BEGIN_HEADER */
|
||||
#include "mbedtls/chachapoly.h"
|
||||
/* END_HEADER */
|
||||
|
||||
/* BEGIN_DEPENDENCIES
|
||||
* depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
* END_DEPENDENCIES
|
||||
*/
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void mbedtls_chachapoly_enc( char *hex_key_string, char *hex_nonce_string, char *hex_aad_string, char *hex_input_string, char *hex_output_string, char *hex_mac_string )
|
||||
{
|
||||
unsigned char key_str[32]; /* size set by the standard */
|
||||
unsigned char nonce_str[12]; /* size set by the standard */
|
||||
unsigned char aad_str[12]; /* max size of test data so far */
|
||||
unsigned char input_str[265]; /* max size of binary input/output so far */
|
||||
unsigned char output_str[265];
|
||||
unsigned char output[265];
|
||||
unsigned char mac_str[16]; /* size set by the standard */
|
||||
unsigned char mac[16]; /* size set by the standard */
|
||||
size_t input_len;
|
||||
size_t output_len;
|
||||
size_t aad_len;
|
||||
size_t key_len;
|
||||
size_t nonce_len;
|
||||
size_t mac_len;
|
||||
mbedtls_chachapoly_context ctx;
|
||||
|
||||
memset( key_str, 0x00, sizeof( key_str ) );
|
||||
memset( nonce_str, 0x00, sizeof( nonce_str ) );
|
||||
memset( aad_str, 0x00, sizeof( aad_str ) );
|
||||
memset( input_str, 0x00, sizeof( input_str ) );
|
||||
memset( output_str, 0x00, sizeof( output_str ) );
|
||||
memset( mac_str, 0x00, sizeof( mac_str ) );
|
||||
|
||||
aad_len = unhexify( aad_str, hex_aad_string );
|
||||
input_len = unhexify( input_str, hex_input_string );
|
||||
output_len = unhexify( output_str, hex_output_string );
|
||||
key_len = unhexify( key_str, hex_key_string );
|
||||
nonce_len = unhexify( nonce_str, hex_nonce_string );
|
||||
mac_len = unhexify( mac_str, hex_mac_string );
|
||||
|
||||
TEST_ASSERT( key_len == 32 );
|
||||
TEST_ASSERT( nonce_len == 12 );
|
||||
TEST_ASSERT( mac_len == 16 );
|
||||
|
||||
mbedtls_chachapoly_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_setkey( &ctx, key_str ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
input_len, nonce_str,
|
||||
aad_str, aad_len,
|
||||
input_str, output, mac ) == 0 );
|
||||
|
||||
TEST_ASSERT( memcmp( output_str, output, output_len ) == 0 );
|
||||
TEST_ASSERT( memcmp( mac_str, mac, 16U ) == 0 );
|
||||
|
||||
exit:
|
||||
mbedtls_chachapoly_free( &ctx );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void mbedtls_chachapoly_dec( char *hex_key_string, char *hex_nonce_string, char *hex_aad_string, char *hex_input_string, char *hex_output_string, char *hex_mac_string, int ret_exp )
|
||||
{
|
||||
unsigned char key_str[32]; /* size set by the standard */
|
||||
unsigned char nonce_str[12]; /* size set by the standard */
|
||||
unsigned char aad_str[12]; /* max size of test data so far */
|
||||
unsigned char input_str[265]; /* max size of binary input/output so far */
|
||||
unsigned char output_str[265];
|
||||
unsigned char output[265];
|
||||
unsigned char mac_str[16]; /* size set by the standard */
|
||||
size_t input_len;
|
||||
size_t output_len;
|
||||
size_t aad_len;
|
||||
size_t key_len;
|
||||
size_t nonce_len;
|
||||
size_t mac_len;
|
||||
int ret;
|
||||
mbedtls_chachapoly_context ctx;
|
||||
|
||||
memset( key_str, 0x00, sizeof( key_str ) );
|
||||
memset( nonce_str, 0x00, sizeof( nonce_str ) );
|
||||
memset( aad_str, 0x00, sizeof( aad_str ) );
|
||||
memset( input_str, 0x00, sizeof( input_str ) );
|
||||
memset( output_str, 0x00, sizeof( output_str ) );
|
||||
memset( mac_str, 0x00, sizeof( mac_str ) );
|
||||
|
||||
aad_len = unhexify( aad_str, hex_aad_string );
|
||||
input_len = unhexify( input_str, hex_input_string );
|
||||
output_len = unhexify( output_str, hex_output_string );
|
||||
key_len = unhexify( key_str, hex_key_string );
|
||||
nonce_len = unhexify( nonce_str, hex_nonce_string );
|
||||
mac_len = unhexify( mac_str, hex_mac_string );
|
||||
|
||||
TEST_ASSERT( key_len == 32 );
|
||||
TEST_ASSERT( nonce_len == 12 );
|
||||
TEST_ASSERT( mac_len == 16 );
|
||||
|
||||
mbedtls_chachapoly_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_setkey( &ctx, key_str ) == 0 );
|
||||
|
||||
ret = mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
input_len, nonce_str,
|
||||
aad_str, aad_len,
|
||||
mac_str, input_str, output );
|
||||
|
||||
TEST_ASSERT( ret == ret_exp );
|
||||
if( ret_exp == 0 )
|
||||
{
|
||||
TEST_ASSERT( memcmp( output_str, output, output_len ) == 0 );
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_chachapoly_free( &ctx );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void chachapoly_bad_params()
|
||||
{
|
||||
unsigned char key[32];
|
||||
unsigned char nonce[12];
|
||||
unsigned char aad[1];
|
||||
unsigned char input[1];
|
||||
unsigned char output[1];
|
||||
unsigned char mac[16];
|
||||
size_t input_len = sizeof( input );
|
||||
size_t aad_len = sizeof( aad );
|
||||
mbedtls_chachapoly_context ctx;
|
||||
|
||||
memset( key, 0x00, sizeof( key ) );
|
||||
memset( nonce, 0x00, sizeof( nonce ) );
|
||||
memset( aad, 0x00, sizeof( aad ) );
|
||||
memset( input, 0x00, sizeof( input ) );
|
||||
memset( output, 0x00, sizeof( output ) );
|
||||
memset( mac, 0x00, sizeof( mac ) );
|
||||
|
||||
mbedtls_chachapoly_init( NULL );
|
||||
mbedtls_chachapoly_free( NULL );
|
||||
|
||||
mbedtls_chachapoly_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_setkey( NULL, key )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_setkey( &ctx, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( NULL,
|
||||
0, nonce,
|
||||
aad, 0,
|
||||
input, output, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
0, NULL,
|
||||
aad, 0,
|
||||
input, output, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
0, nonce,
|
||||
NULL, aad_len,
|
||||
input, output, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
input_len, nonce,
|
||||
aad, 0,
|
||||
NULL, output, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
input_len, nonce,
|
||||
aad, 0,
|
||||
input, NULL, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
0, nonce,
|
||||
aad, 0,
|
||||
input, output, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( NULL,
|
||||
0, nonce,
|
||||
aad, 0,
|
||||
mac, input, output )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
0, NULL,
|
||||
aad, 0,
|
||||
mac, input, output )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
0, nonce,
|
||||
NULL, aad_len,
|
||||
mac, input, output )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
0, nonce,
|
||||
aad, 0,
|
||||
NULL, input, output )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
input_len, nonce,
|
||||
aad, 0,
|
||||
mac, NULL, output )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
input_len, nonce,
|
||||
aad, 0,
|
||||
mac, input, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
0, nonce,
|
||||
aad, aad_len,
|
||||
NULL, NULL, mac )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
0, nonce,
|
||||
aad, aad_len,
|
||||
mac, NULL, NULL )
|
||||
== 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_encrypt_and_tag( &ctx,
|
||||
input_len, nonce,
|
||||
NULL, 0,
|
||||
input, output, mac )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_auth_decrypt( &ctx,
|
||||
input_len, nonce,
|
||||
NULL, 0,
|
||||
mac, input, output )
|
||||
== 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_starts( NULL, nonce, MBEDTLS_CHACHAPOLY_ENCRYPT )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_starts( &ctx, NULL, MBEDTLS_CHACHAPOLY_ENCRYPT )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( NULL, aad, aad_len )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( &ctx, NULL, aad_len )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( NULL, input_len, input, output )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( &ctx, input_len, NULL, output )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( &ctx, input_len, input, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_finish( NULL, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_chachapoly_finish( &ctx, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
exit:
|
||||
mbedtls_chachapoly_free( &ctx );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void chachapoly_state()
|
||||
{
|
||||
unsigned char key[32];
|
||||
unsigned char nonce[12];
|
||||
unsigned char aad[1];
|
||||
unsigned char input[1];
|
||||
unsigned char output[1];
|
||||
unsigned char mac[16];
|
||||
size_t input_len = sizeof( input );
|
||||
size_t aad_len = sizeof( aad );
|
||||
mbedtls_chachapoly_context ctx;
|
||||
|
||||
memset( key, 0x00, sizeof( key ) );
|
||||
memset( nonce, 0x00, sizeof( nonce ) );
|
||||
memset( aad, 0x00, sizeof( aad ) );
|
||||
memset( input, 0x00, sizeof( input ) );
|
||||
memset( output, 0x00, sizeof( output ) );
|
||||
memset( mac, 0x00, sizeof( mac ) );
|
||||
|
||||
/* Initial state: finish, update, update_aad forbidden */
|
||||
mbedtls_chachapoly_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_finish( &ctx, mac )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( &ctx, input_len, input, output )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( &ctx, aad, aad_len )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
|
||||
/* Still initial state: finish, update, update_aad forbidden */
|
||||
TEST_ASSERT( mbedtls_chachapoly_setkey( &ctx, key )
|
||||
== 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_chachapoly_finish( &ctx, mac )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( &ctx, input_len, input, output )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( &ctx, aad, aad_len )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
|
||||
/* Starts -> finish OK */
|
||||
TEST_ASSERT( mbedtls_chachapoly_starts( &ctx, nonce, MBEDTLS_CHACHAPOLY_ENCRYPT )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_finish( &ctx, mac )
|
||||
== 0 );
|
||||
|
||||
/* After finish: update, update_aad forbidden */
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( &ctx, input_len, input, output )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( &ctx, aad, aad_len )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
|
||||
/* Starts -> update* OK */
|
||||
TEST_ASSERT( mbedtls_chachapoly_starts( &ctx, nonce, MBEDTLS_CHACHAPOLY_ENCRYPT )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( &ctx, input_len, input, output )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update( &ctx, input_len, input, output )
|
||||
== 0 );
|
||||
|
||||
/* After update: update_aad forbidden */
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( &ctx, aad, aad_len )
|
||||
== MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
|
||||
|
||||
/* Starts -> update_aad* -> finish OK */
|
||||
TEST_ASSERT( mbedtls_chachapoly_starts( &ctx, nonce, MBEDTLS_CHACHAPOLY_ENCRYPT )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( &ctx, aad, aad_len )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_update_aad( &ctx, aad, aad_len )
|
||||
== 0 );
|
||||
TEST_ASSERT( mbedtls_chachapoly_finish( &ctx, mac )
|
||||
== 0 );
|
||||
|
||||
exit:
|
||||
mbedtls_chachapoly_free( &ctx );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */
|
||||
void chachapoly_selftest()
|
||||
{
|
||||
TEST_ASSERT( mbedtls_chachapoly_self_test( 1 ) == 0 );
|
||||
}
|
||||
/* END_CASE */
|
||||
115
tests/suites/test_suite_cipher.chacha20.data
Normal file
115
tests/suites/test_suite_cipher.chacha20.data
Normal file
|
|
@ -0,0 +1,115 @@
|
|||
Decrypt empty buffer
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
dec_empty_buf:
|
||||
|
||||
Chacha20 RFC 7539 Test Vector #1
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
decrypt_test_vec:MBEDTLS_CIPHER_CHACHA20:-1:"0000000000000000000000000000000000000000000000000000000000000000":"000000000000000000000000":"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"":"":0:0
|
||||
|
||||
ChaCha20 Encrypt and decrypt 0 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:0:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 1 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:1:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 2 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:2:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 7 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:7:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 8 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:8:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 9 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:9:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 15 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:15:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 16 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:16:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 17 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:17:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 31 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:31:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 32 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:32:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 33 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:33:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 47 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:47:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 48 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:48:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 49 bytes
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20:"CHACHA20":256:49:-1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 0 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:0:0:-1:0:0:0:0
|
||||
|
||||
ChaCha20 Encrypt and decrypt 1 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:1:0:-1:1:0:1:0
|
||||
|
||||
ChaCha20 Encrypt and decrypt 1 bytes in multiple parts 2
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:0:1:-1:0:1:0:1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 16 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:16:0:-1:16:0:16:0
|
||||
|
||||
ChaCha20 Encrypt and decrypt 16 bytes in multiple parts 2
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:0:16:-1:0:16:0:16
|
||||
|
||||
ChaCha20 Encrypt and decrypt 16 bytes in multiple parts 3
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:1:15:-1:1:15:1:15
|
||||
|
||||
ChaCha20 Encrypt and decrypt 16 bytes in multiple parts 4
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:15:1:-1:15:1:15:1
|
||||
|
||||
ChaCha20 Encrypt and decrypt 22 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:15:7:-1:15:7:15:7
|
||||
|
||||
ChaCha20 Encrypt and decrypt 22 bytes in multiple parts 2
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:7:15:-1:7:15:7:15
|
||||
|
||||
ChaCha20 Encrypt and decrypt 22 bytes in multiple parts 3
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:16:6:-1:16:6:16:6
|
||||
|
||||
ChaCha20 Encrypt and decrypt 22 bytes in multiple parts 4
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:6:16:-1:6:16:6:16
|
||||
|
||||
ChaCha20 Encrypt and decrypt 32 bytes in multiple parts
|
||||
depends_on:MBEDTLS_CHACHA20_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20:256:16:16:-1:16:16:16:16
|
||||
123
tests/suites/test_suite_cipher.chachapoly.data
Normal file
123
tests/suites/test_suite_cipher.chachapoly.data
Normal file
|
|
@ -0,0 +1,123 @@
|
|||
Decrypt empty buffer
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C:
|
||||
dec_empty_buf:
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 0 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:0:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 1 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:1:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 2 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:2:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 7 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:7:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 8 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:8:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 9 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:9:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 15 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:15:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 16 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:16:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 17 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:17:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 31 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:31:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 32 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:32:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 33 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:33:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 47 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:47:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 48 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:48:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 49 bytes
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305:"CHACHA20-POLY1305":256:49:-1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 0 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:0:0:-1:0:0:0:0
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 1 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:1:0:-1:1:0:1:0
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 1 bytes in multiple parts 2
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:0:1:-1:0:1:0:1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 16 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:16:0:-1:16:0:16:0
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 16 bytes in multiple parts 2
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:0:16:-1:0:16:0:16
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 16 bytes in multiple parts 3
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:1:15:-1:1:15:1:15
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 16 bytes in multiple parts 4
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:15:1:-1:15:1:15:1
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 22 bytes in multiple parts 1
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:15:7:-1:15:7:15:7
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 22 bytes in multiple parts 2
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:7:15:-1:7:15:7:15
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 22 bytes in multiple parts 3
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:16:6:-1:16:6:16:6
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 22 bytes in multiple parts 4
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:6:16:-1:6:16:6:16
|
||||
|
||||
ChaCha20+Poly1305 Encrypt and decrypt 32 bytes in multiple parts
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
enc_dec_buf_multipart:MBEDTLS_CIPHER_CHACHA20_POLY1305:256:16:16:-1:16:16:16:16
|
||||
|
||||
ChaCha20+Poly1305 RFC 7539 Test Vector #1
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
auth_crypt_tv:MBEDTLS_CIPHER_CHACHA20_POLY1305:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000102030405060708":"f33388860000000000004e91":"64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d33bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b3506383606907b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b0047718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa76991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e617d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6f2c29a6ad5cb4022b02709b":"eead9d67890cbb22392336fea1851f38":"496e7465726e65742d4472616674732061726520647261667420646f63756d656e74732076616c696420666f722061206d6178696d756d206f6620736978206d6f6e74687320616e64206d617920626520757064617465642c207265706c616365642c206f72206f62736f6c65746564206279206f7468657220646f63756d656e747320617420616e792074696d652e20497420697320696e617070726f70726961746520746f2075736520496e7465726e65742d447261667473206173207265666572656e6365206d6174657269616c206f7220746f2063697465207468656d206f74686572207468616e206173202fe2809c776f726b20696e2070726f67726573732e2fe2809d"
|
||||
|
||||
ChaCha20+Poly1305 RFC 7539 Test Vector #1 Unauthentic (1st bit flipped)
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
auth_crypt_tv:MBEDTLS_CIPHER_CHACHA20_POLY1305:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000102030405060708":"f33388860000000000004e91":"64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d33bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b3506383606907b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b0047718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa76991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e617d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6f2c29a6ad5cb4022b02709b":"6ead9d67890cbb22392336fea1851f38":"FAIL"
|
||||
|
||||
Chacha20+Poly1305 RFC 7539 Test Vector #1 (streaming)
|
||||
depends_on:MBEDTLS_CHACHAPOLY_C
|
||||
decrypt_test_vec:MBEDTLS_CIPHER_CHACHA20_POLY1305:-1:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000102030405060708":"64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d33bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b3506383606907b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b0047718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa76991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e617d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6f2c29a6ad5cb4022b02709b":"496e7465726e65742d4472616674732061726520647261667420646f63756d656e74732076616c696420666f722061206d6178696d756d206f6620736978206d6f6e74687320616e64206d617920626520757064617465642c207265706c616365642c206f72206f62736f6c65746564206279206f7468657220646f63756d656e747320617420616e792074696d652e20497420697320696e617070726f70726961746520746f2075736520496e7465726e65742d447261667473206173207265666572656e6365206d6174657269616c206f7220746f2063697465207468656d206f74686572207468616e206173202fe2809c776f726b20696e2070726f67726573732e2fe2809d":"f33388860000000000004e91":"eead9d67890cbb22392336fea1851f38":0:0
|
||||
|
|
@ -60,7 +60,7 @@ void cipher_null_args( )
|
|||
TEST_ASSERT( mbedtls_cipher_reset( NULL ) == MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_cipher_reset( &ctx ) == MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( mbedtls_cipher_update_ad( NULL, buf, 0 )
|
||||
== MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_cipher_update_ad( &ctx, buf, 0 )
|
||||
|
|
@ -77,7 +77,7 @@ void cipher_null_args( )
|
|||
TEST_ASSERT( mbedtls_cipher_finish( &ctx, buf, &olen )
|
||||
== MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( mbedtls_cipher_write_tag( NULL, buf, olen )
|
||||
== MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_cipher_write_tag( &ctx, buf, olen )
|
||||
|
|
@ -195,7 +195,7 @@ void enc_dec_buf( int cipher_id, char *cipher_string, int key_len,
|
|||
TEST_ASSERT( 0 == mbedtls_cipher_reset( &ctx_dec ) );
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_reset( &ctx_enc ) );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_update_ad( &ctx_dec, ad, sizeof( ad ) - i ) );
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_update_ad( &ctx_enc, ad, sizeof( ad ) - i ) );
|
||||
#endif
|
||||
|
|
@ -215,7 +215,7 @@ void enc_dec_buf( int cipher_id, char *cipher_string, int key_len,
|
|||
TEST_ASSERT( 0 == mbedtls_cipher_finish( &ctx_enc, encbuf + outlen, &outlen ) );
|
||||
total_len += outlen;
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_write_tag( &ctx_enc, tag, sizeof( tag ) ) );
|
||||
#endif
|
||||
|
||||
|
|
@ -236,7 +236,7 @@ void enc_dec_buf( int cipher_id, char *cipher_string, int key_len,
|
|||
TEST_ASSERT( 0 == mbedtls_cipher_finish( &ctx_dec, decbuf + outlen, &outlen ) );
|
||||
total_len += outlen;
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_check_tag( &ctx_dec, tag, sizeof( tag ) ) );
|
||||
#endif
|
||||
|
||||
|
|
@ -292,7 +292,7 @@ void enc_fail( int cipher_id, int pad_mode, int key_len,
|
|||
#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_set_iv( &ctx, iv, 16 ) );
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_reset( &ctx ) );
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_update_ad( &ctx, NULL, 0 ) );
|
||||
#endif
|
||||
|
||||
|
|
@ -340,7 +340,7 @@ void dec_empty_buf()
|
|||
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_reset( &ctx_dec ) );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_update_ad( &ctx_dec, NULL, 0 ) );
|
||||
#endif
|
||||
|
||||
|
|
@ -416,7 +416,7 @@ void enc_dec_buf_multipart( int cipher_id, int key_len, int first_length_val,
|
|||
TEST_ASSERT( 0 == mbedtls_cipher_reset( &ctx_dec ) );
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_reset( &ctx_enc ) );
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_update_ad( &ctx_dec, NULL, 0 ) );
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_update_ad( &ctx_enc, NULL, 0 ) );
|
||||
#endif
|
||||
|
|
@ -479,16 +479,16 @@ void decrypt_test_vec( int cipher_id, int pad_mode,
|
|||
{
|
||||
unsigned char key[50];
|
||||
unsigned char iv[50];
|
||||
unsigned char cipher[200];
|
||||
unsigned char clear[200];
|
||||
unsigned char cipher[265]; /* max length of test data so far */
|
||||
unsigned char clear[265];
|
||||
unsigned char output[265];
|
||||
unsigned char ad[200];
|
||||
unsigned char tag[20];
|
||||
size_t key_len, iv_len, cipher_len, clear_len;
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
size_t ad_len, tag_len;
|
||||
#endif
|
||||
mbedtls_cipher_context_t ctx;
|
||||
unsigned char output[200];
|
||||
size_t outlen, total_len;
|
||||
|
||||
mbedtls_cipher_init( &ctx );
|
||||
|
|
@ -505,7 +505,7 @@ void decrypt_test_vec( int cipher_id, int pad_mode,
|
|||
iv_len = unhexify( iv, hex_iv );
|
||||
cipher_len = unhexify( cipher, hex_cipher );
|
||||
clear_len = unhexify( clear, hex_clear );
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
ad_len = unhexify( ad, hex_ad );
|
||||
tag_len = unhexify( tag, hex_tag );
|
||||
#else
|
||||
|
|
@ -525,7 +525,7 @@ void decrypt_test_vec( int cipher_id, int pad_mode,
|
|||
#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_set_iv( &ctx, iv, iv_len ) );
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_reset( &ctx ) );
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( 0 == mbedtls_cipher_update_ad( &ctx, ad, ad_len ) );
|
||||
#endif
|
||||
|
||||
|
|
@ -536,7 +536,7 @@ void decrypt_test_vec( int cipher_id, int pad_mode,
|
|||
TEST_ASSERT( finish_result == mbedtls_cipher_finish( &ctx, output + outlen,
|
||||
&outlen ) );
|
||||
total_len += outlen;
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
|
||||
TEST_ASSERT( tag_result == mbedtls_cipher_check_tag( &ctx, tag, tag_len ) );
|
||||
#endif
|
||||
|
||||
|
|
@ -560,14 +560,14 @@ void auth_crypt_tv( int cipher_id, char *hex_key, char *hex_iv,
|
|||
int ret;
|
||||
unsigned char key[50];
|
||||
unsigned char iv[50];
|
||||
unsigned char cipher[200];
|
||||
unsigned char clear[200];
|
||||
unsigned char cipher[265]; /* max size of test data so far */
|
||||
unsigned char clear[265];
|
||||
unsigned char output[267]; /* above + 2 (overwrite check) */
|
||||
unsigned char ad[200];
|
||||
unsigned char tag[20];
|
||||
unsigned char my_tag[20];
|
||||
size_t key_len, iv_len, cipher_len, clear_len, ad_len, tag_len;
|
||||
mbedtls_cipher_context_t ctx;
|
||||
unsigned char output[200];
|
||||
size_t outlen;
|
||||
|
||||
mbedtls_cipher_init( &ctx );
|
||||
|
|
|
|||
42
tests/suites/test_suite_poly1305.data
Normal file
42
tests/suites/test_suite_poly1305.data
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
Poly1305 RFC 7539 Example And Test Vector
|
||||
mbedtls_poly1305:"85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b":"a8061dc1305136c6c22b8baf0c0127a9":"43727970746f6772617068696320466f72756d2052657365617263682047726f7570"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #1
|
||||
mbedtls_poly1305:"0000000000000000000000000000000000000000000000000000000000000000":"00000000000000000000000000000000":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #2
|
||||
mbedtls_poly1305:"0000000000000000000000000000000036e5f6b5c5e06070f0efca96227a863e":"36e5f6b5c5e06070f0efca96227a863e":"416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #3
|
||||
mbedtls_poly1305:"36e5f6b5c5e06070f0efca96227a863e00000000000000000000000000000000":"f3477e7cd95417af89a6b8794c310cf0":"416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #4
|
||||
mbedtls_poly1305:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"4541669a7eaaee61e708dc7cbcc5eb62":"2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #5
|
||||
mbedtls_poly1305:"0200000000000000000000000000000000000000000000000000000000000000":"03000000000000000000000000000000":"ffffffffffffffffffffffffffffffff"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #6
|
||||
mbedtls_poly1305:"02000000000000000000000000000000ffffffffffffffffffffffffffffffff":"03000000000000000000000000000000":"02000000000000000000000000000000"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #7
|
||||
mbedtls_poly1305:"0100000000000000000000000000000000000000000000000000000000000000":"05000000000000000000000000000000":"fffffffffffffffffffffffffffffffff0ffffffffffffffffffffffffffffff11000000000000000000000000000000"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #8
|
||||
mbedtls_poly1305:"0100000000000000000000000000000000000000000000000000000000000000":"00000000000000000000000000000000":"fffffffffffffffffffffffffffffffffbfefefefefefefefefefefefefefefe01010101010101010101010101010101"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #9
|
||||
mbedtls_poly1305:"0200000000000000000000000000000000000000000000000000000000000000":"faffffffffffffffffffffffffffffff":"fdffffffffffffffffffffffffffffff"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #10
|
||||
mbedtls_poly1305:"0100000000000000040000000000000000000000000000000000000000000000":"14000000000000005500000000000000":"e33594d7505e43b900000000000000003394d7505e4379cd01000000000000000000000000000000000000000000000001000000000000000000000000000000"
|
||||
|
||||
Poly1305 RFC 7539 Test Vector #11
|
||||
mbedtls_poly1305:"0100000000000000040000000000000000000000000000000000000000000000":"13000000000000000000000000000000":"e33594d7505e43b900000000000000003394d7505e4379cd010000000000000000000000000000000000000000000000"
|
||||
|
||||
Poly1305 Parameter validation
|
||||
poly1305_bad_params:
|
||||
|
||||
Poly1305 Selftest
|
||||
depends_on:MBEDTLS_SELF_TEST
|
||||
poly1305_selftest:
|
||||
140
tests/suites/test_suite_poly1305.function
Normal file
140
tests/suites/test_suite_poly1305.function
Normal file
|
|
@ -0,0 +1,140 @@
|
|||
/* BEGIN_HEADER */
|
||||
#include "mbedtls/poly1305.h"
|
||||
#include <stddef.h>
|
||||
/* END_HEADER */
|
||||
|
||||
/* BEGIN_DEPENDENCIES
|
||||
* depends_on:MBEDTLS_POLY1305_C
|
||||
* END_DEPENDENCIES
|
||||
*/
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void mbedtls_poly1305( char *hex_key_string, char *hex_mac_string, char *hex_src_string )
|
||||
{
|
||||
unsigned char src_str[375]; /* max size of binary input */
|
||||
unsigned char key[32]; /* size set by the standard */
|
||||
unsigned char mac[16]; /* size set by the standard */
|
||||
unsigned char mac_str[33]; /* hex expansion of the above */
|
||||
size_t src_len;
|
||||
mbedtls_poly1305_context ctx;
|
||||
|
||||
memset( src_str, 0x00, sizeof( src_str ) );
|
||||
memset( mac_str, 0x00, sizeof( mac_str ) );
|
||||
memset( key, 0x00, sizeof( key ) );
|
||||
memset( mac, 0x00, sizeof( mac ) );
|
||||
|
||||
src_len = unhexify( src_str, hex_src_string );
|
||||
unhexify( key, hex_key_string );
|
||||
|
||||
/*
|
||||
* Test the integrated API
|
||||
*/
|
||||
TEST_ASSERT( mbedtls_poly1305_mac( key, src_str, src_len, mac ) == 0 );
|
||||
|
||||
hexify( mac_str, mac, 16 );
|
||||
TEST_ASSERT( strcmp( (char *) mac_str, hex_mac_string ) == 0 );
|
||||
|
||||
/*
|
||||
* Test the streaming API
|
||||
*/
|
||||
mbedtls_poly1305_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_starts( &ctx, key ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, src_str, src_len ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_finish( &ctx, mac ) == 0 );
|
||||
|
||||
hexify( mac_str, mac, 16 );
|
||||
TEST_ASSERT( strcmp( (char *) mac_str, hex_mac_string ) == 0 );
|
||||
|
||||
/*
|
||||
* Test the streaming API again, piecewise
|
||||
*/
|
||||
|
||||
/* Don't free/init the context, in order to test that starts() does the
|
||||
* right thing. */
|
||||
if( src_len >= 1 )
|
||||
{
|
||||
TEST_ASSERT( mbedtls_poly1305_starts( &ctx, key ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, src_str, 1 ) == 0 );
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, src_str + 1, src_len - 1 ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_finish( &ctx, mac ) == 0 );
|
||||
|
||||
hexify( mac_str, mac, 16 );
|
||||
TEST_ASSERT( strcmp( (char *) mac_str, hex_mac_string ) == 0 );
|
||||
}
|
||||
|
||||
/*
|
||||
* Again with more pieces
|
||||
*/
|
||||
if( src_len >= 2 )
|
||||
{
|
||||
TEST_ASSERT( mbedtls_poly1305_starts( &ctx, key ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, src_str, 1 ) == 0 );
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, src_str + 1, 1 ) == 0 );
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, src_str + 2, src_len - 2 ) == 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_finish( &ctx, mac ) == 0 );
|
||||
|
||||
hexify( mac_str, mac, 16 );
|
||||
TEST_ASSERT( strcmp( (char *) mac_str, hex_mac_string ) == 0 );
|
||||
}
|
||||
|
||||
mbedtls_poly1305_free( &ctx );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE */
|
||||
void poly1305_bad_params()
|
||||
{
|
||||
unsigned char src[1];
|
||||
unsigned char key[32];
|
||||
unsigned char mac[16];
|
||||
size_t src_len = sizeof( src );
|
||||
mbedtls_poly1305_context ctx;
|
||||
|
||||
mbedtls_poly1305_init( NULL );
|
||||
mbedtls_poly1305_free( NULL );
|
||||
|
||||
mbedtls_poly1305_init( &ctx );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_starts( NULL, key )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_poly1305_starts( &ctx, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_update( NULL, src, 0 )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, NULL, src_len )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_poly1305_update( &ctx, NULL, 0 )
|
||||
== 0 );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_finish( NULL, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_poly1305_finish( &ctx, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
|
||||
TEST_ASSERT( mbedtls_poly1305_mac( NULL, src, 0, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_poly1305_mac( key, NULL, src_len, mac )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_poly1305_mac( key, src, 0, NULL )
|
||||
== MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
|
||||
TEST_ASSERT( mbedtls_poly1305_mac( key, NULL, 0, mac )
|
||||
== 0 );
|
||||
|
||||
mbedtls_poly1305_free( &ctx );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */
|
||||
void poly1305_selftest()
|
||||
{
|
||||
TEST_ASSERT( mbedtls_poly1305_self_test( 1 ) == 0 );
|
||||
}
|
||||
/* END_CASE */
|
||||
|
|
@ -159,6 +159,8 @@
|
|||
<ClInclude Include="..\..\include\mbedtls\camellia.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\ccm.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\certs.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\chacha20.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\chachapoly.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\check_config.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\cipher.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\cipher_internal.h" />
|
||||
|
|
@ -200,6 +202,7 @@
|
|||
<ClInclude Include="..\..\include\mbedtls\platform.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\platform_time.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\platform_util.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\poly1305.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\ripemd160.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\rsa.h" />
|
||||
<ClInclude Include="..\..\include\mbedtls\rsa_internal.h" />
|
||||
|
|
@ -234,6 +237,8 @@
|
|||
<ClCompile Include="..\..\library\camellia.c" />
|
||||
<ClCompile Include="..\..\library\ccm.c" />
|
||||
<ClCompile Include="..\..\library\certs.c" />
|
||||
<ClCompile Include="..\..\library\chacha20.c" />
|
||||
<ClCompile Include="..\..\library\chachapoly.c" />
|
||||
<ClCompile Include="..\..\library\cipher.c" />
|
||||
<ClCompile Include="..\..\library\cipher_wrap.c" />
|
||||
<ClCompile Include="..\..\library\cmac.c" />
|
||||
|
|
@ -272,6 +277,7 @@
|
|||
<ClCompile Include="..\..\library\pkwrite.c" />
|
||||
<ClCompile Include="..\..\library\platform.c" />
|
||||
<ClCompile Include="..\..\library\platform_util.c" />
|
||||
<ClCompile Include="..\..\library\poly1305.c" />
|
||||
<ClCompile Include="..\..\library\ripemd160.c" />
|
||||
<ClCompile Include="..\..\library\rsa.c" />
|
||||
<ClCompile Include="..\..\library\rsa_internal.c" />
|
||||
|
|
|
|||
Loading…
Reference in a new issue