Fix the bugs in ISAPEngine, PhotonBeetleEngine, and XoodyakEngine about output size calculation

gefeili · gefeili · commit 429e64d4f09c · 2024-11-29T12:36:44.000+10:30
diff --git a/core/src/main/java/org/bouncycastle/crypto/engines/ElephantEngine.java b/core/src/main/java/org/bouncycastle/crypto/engines/ElephantEngine.java
@@ -455,7 +455,8 @@ public int getUpdateOutputSize(int len)
         case EncAad:
         case EncData:
         case EncInit:
-            return inputOff + len + CRYPTO_ABYTES;
+            int total = inputOff + len;
+            return total - total % BLOCK_SIZE;
         case DecData:
             return inputOff + len;
         }
diff --git a/core/src/main/java/org/bouncycastle/crypto/engines/ISAPEngine.java b/core/src/main/java/org/bouncycastle/crypto/engines/ISAPEngine.java
@@ -961,7 +961,8 @@ public byte[] getMac()
     @Override
     public int getUpdateOutputSize(int len)
     {
-        return len + message.size() + (forEncryption ? 16 : -16);
+        int total = Math.max(0, len + message.size() + (forEncryption ? 0 : -16));
+        return total - total % ISAP_rH_SZ;
     }
 
     @Override
diff --git a/core/src/main/java/org/bouncycastle/crypto/engines/PhotonBeetleEngine.java b/core/src/main/java/org/bouncycastle/crypto/engines/PhotonBeetleEngine.java
@@ -270,7 +270,8 @@ public byte[] getMac()
     @Override
     public int getUpdateOutputSize(int len)
     {
-        return len + message.size() + (forEncryption ? TAG_INBYTES : -TAG_INBYTES);
+        int total = Math.max(0, len + message.size() + (forEncryption ? 0 : -TAG_INBYTES));
+        return total - total % RATE_INBYTES;
     }
 
     @Override
diff --git a/core/src/main/java/org/bouncycastle/crypto/engines/XoodyakEngine.java b/core/src/main/java/org/bouncycastle/crypto/engines/XoodyakEngine.java
@@ -36,7 +36,7 @@ public class XoodyakEngine
     private byte[] iv;
     private final int PhaseDown = 1;
     private final int PhaseUp = 2;
-//    private final int NLANES = 12;
+    //    private final int NLANES = 12;
 //    private final int NROWS = 3;
 //    private final int NCOLUMS = 4;
     private final int MAXROUNDS = 12;
@@ -262,7 +262,8 @@ public byte[] getMac()
     @Override
     public int getUpdateOutputSize(int len)
     {
-        return len + message.size() + (forEncryption ? TAGLEN : -TAGLEN);
+        int total = Math.max(0, len + message.size() + (forEncryption ? 0 : -TAGLEN));
+        return total - total % Rkout;
     }
 
     @Override
@@ -371,7 +372,7 @@ private void Up(byte[] Yi, int YiLen, int Cu)
             a3 ^= e3;
             a7 ^= e3;
             a11 ^= e3;
-            
+
             /* Rho-west: plane shift */
             int b0 = a0;
             int b1 = a1;
@@ -390,7 +391,7 @@ private void Up(byte[] Yi, int YiLen, int Cu)
 
             /* Iota: round ant */
             b0 ^= RC[i];
-            
+
             /* Chi: non linear layer */
             a0 = b0 ^ (~b4 & b8);
             a1 = b1 ^ (~b5 & b9);
@@ -406,7 +407,7 @@ private void Up(byte[] Yi, int YiLen, int Cu)
             b9 ^= (~b1 & b5);
             b10 ^= (~b2 & b6);
             b11 ^= (~b3 & b7);
-            
+
             /* Rho-east: plane shift */
             a4 = Integers.rotateLeft(a4, 1);
             a5 = Integers.rotateLeft(a5, 1);
diff --git a/core/src/test/java/org/bouncycastle/crypto/test/CipherTest.java b/core/src/test/java/org/bouncycastle/crypto/test/CipherTest.java
@@ -202,39 +202,39 @@ static void checkAEADCipherOutputSize(int keySize, int ivSize, int blockSize, in
         byte[] ciphertext = new byte[cipher.getOutputSize(plaintext.length)];
         //before the encrypt
         Assert.assertEquals(plaintext.length + tagSize, ciphertext.length);
-        Assert.assertEquals(plaintext.length + tagSize, cipher.getUpdateOutputSize(plaintext.length));
+        Assert.assertEquals(plaintext.length, cipher.getUpdateOutputSize(plaintext.length) + tmpLength);
         //during the encrypt process of the first block
         int len = cipher.processBytes(plaintext, 0, tmpLength, ciphertext, 0);
         Assert.assertEquals(plaintext.length + tagSize, len + cipher.getOutputSize(plaintext.length - tmpLength));
-        Assert.assertEquals(plaintext.length + tagSize, len + cipher.getUpdateOutputSize(plaintext.length - tmpLength));
+        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(plaintext.length - tmpLength) + tmpLength);
         //during the encrypt process of the second block
         len += cipher.processBytes(plaintext, tmpLength , blockSize, ciphertext, len);
         Assert.assertEquals(plaintext.length + tagSize, len + cipher.getOutputSize(plaintext.length - tmpLength - blockSize));
-        Assert.assertEquals(plaintext.length + tagSize, len + cipher.getUpdateOutputSize(plaintext.length - tmpLength - blockSize));
+        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(plaintext.length - tmpLength - blockSize) + tmpLength);
         //process the remaining bytes
         len += cipher.processBytes(plaintext, tmpLength  + blockSize , blockSize, ciphertext, len);
         Assert.assertEquals(plaintext.length + tagSize, len + cipher.getOutputSize(0));
-        Assert.assertEquals(plaintext.length + tagSize, len + cipher.getUpdateOutputSize(0));
+        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(0) + tmpLength);
         //process doFinal
         len += cipher.doFinal(ciphertext, len);
         Assert.assertEquals(len, ciphertext.length);
 
         cipher.init(false, new ParametersWithIV(new KeyParameter(key), iv));
         //before the encrypt
         Assert.assertEquals(plaintext.length, cipher.getOutputSize(ciphertext.length));
-        Assert.assertEquals(plaintext.length, cipher.getUpdateOutputSize(ciphertext.length));
+        Assert.assertEquals(plaintext.length, cipher.getUpdateOutputSize(ciphertext.length) + tmpLength);
         //during the encrypt process of the first block
         len = cipher.processBytes(ciphertext, 0, tmpLength, plaintext, 0);
         Assert.assertEquals(plaintext.length, len + cipher.getOutputSize(ciphertext.length - tmpLength));
-        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(ciphertext.length - tmpLength));
+        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(ciphertext.length - tmpLength) + tmpLength);
         //during the encrypt process of the second block
         len += cipher.processBytes(ciphertext, tmpLength , blockSize, plaintext, len);
         Assert.assertEquals(plaintext.length, len + cipher.getOutputSize(ciphertext.length - tmpLength - blockSize));
-        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(ciphertext.length - tmpLength - blockSize));
+        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(ciphertext.length - tmpLength - blockSize) + tmpLength);
         //process the remaining bytes
         len += cipher.processBytes(ciphertext, tmpLength + blockSize , blockSize + tagSize, plaintext, len);
         Assert.assertEquals(plaintext.length, len + cipher.getOutputSize(0));
-        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(0));
+        Assert.assertEquals(plaintext.length, len + cipher.getUpdateOutputSize(0)  + tmpLength);
         //process doFinal
         len += cipher.doFinal(plaintext, len);
         Assert.assertEquals(len, plaintext.length);
diff --git a/core/src/test/java/org/bouncycastle/crypto/test/ElephantTest.java b/core/src/test/java/org/bouncycastle/crypto/test/ElephantTest.java
@@ -28,6 +28,9 @@ public String getName()
     public void performTest()
         throws Exception
     {
+//        CipherTest.checkAEADCipherOutputSize(16, 12, 20, 8, new ElephantEngine(ElephantEngine.ElephantParameters.elephant160));
+//        CipherTest.checkAEADCipherOutputSize(16, 12, 22, 8, new ElephantEngine(ElephantEngine.ElephantParameters.elephant176));
+//        CipherTest.checkAEADCipherOutputSize(16, 12, 25, 8, new ElephantEngine(ElephantEngine.ElephantParameters.elephant200));
         //testVectors(ElephantEngine.ElephantParameters.elephant160, "v160_2");
         CipherTest.checkCipher(10, 12, 40, 128, new CipherTest.Instace()
         {
diff --git a/core/src/test/java/org/bouncycastle/crypto/test/ISAPTest.java b/core/src/test/java/org/bouncycastle/crypto/test/ISAPTest.java
@@ -51,10 +51,10 @@ public void performTest()
         testVectors("isapk128av20", IsapType.ISAP_K_128A);
         testVectors("isapk128v20", IsapType.ISAP_K_128);
         testVectors();
-        CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new ISAPEngine(IsapType.ISAP_K_128A));
-        CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new ISAPEngine(IsapType.ISAP_K_128));
-        CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new ISAPEngine(IsapType.ISAP_A_128A));
-        CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new ISAPEngine(IsapType.ISAP_A_128));
+        CipherTest.checkAEADCipherOutputSize(16, 16, 18, 16, new ISAPEngine(IsapType.ISAP_K_128A));
+        CipherTest.checkAEADCipherOutputSize(16, 16, 18, 16, new ISAPEngine(IsapType.ISAP_K_128));
+        CipherTest.checkAEADCipherOutputSize(16, 16, 8, 16, new ISAPEngine(IsapType.ISAP_A_128A));
+        CipherTest.checkAEADCipherOutputSize(16, 16, 8, 16, new ISAPEngine(IsapType.ISAP_A_128));
     }
 
     private void testVectors(String filename, IsapType isapType)
diff --git a/core/src/test/java/org/bouncycastle/crypto/test/PhotonBeetleTest.java b/core/src/test/java/org/bouncycastle/crypto/test/PhotonBeetleTest.java
@@ -42,7 +42,7 @@ public void performTest()
         testVectors(PhotonBeetleEngine.PhotonBeetleParameters.pb128, "v128");
         testExceptions(new PhotonBeetleDigest(), 32);
         CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new PhotonBeetleEngine(PhotonBeetleEngine.PhotonBeetleParameters.pb128));
-        CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new PhotonBeetleEngine(PhotonBeetleEngine.PhotonBeetleParameters.pb32));
+        CipherTest.checkAEADCipherOutputSize(16, 16, 4, 16, new PhotonBeetleEngine(PhotonBeetleEngine.PhotonBeetleParameters.pb32));
     }
 
     private void testVectorsHash()
diff --git a/core/src/test/java/org/bouncycastle/crypto/test/XoodyakTest.java b/core/src/test/java/org/bouncycastle/crypto/test/XoodyakTest.java
@@ -39,7 +39,7 @@ public void performTest()
         testExceptions(xoodyak, xoodyak.getKeyBytesSize(), xoodyak.getIVBytesSize(), xoodyak.getBlockSize());
         testParameters(xoodyak, 16, 16, 16);
         testExceptions(new XoodyakDigest(), 32);
-        CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new XoodyakEngine());
+        CipherTest.checkAEADCipherOutputSize(16, 16, 24, 16, new XoodyakEngine());
     }
 
     private void testVectorsHash()

Original file line number	Diff line number	Diff line change
`@@ -961,7 +961,8 @@ public byte[] getMac()`
`961`	`961`	`@Override`
`962`	`962`	`public int getUpdateOutputSize(int len)`
`963`	`963`	`{`
`964`		`- return len + message.size() + (forEncryption ? 16 : -16);`
	`964`	`+ int total = Math.max(0, len + message.size() + (forEncryption ? 0 : -16));`
	`965`	`+ return total - total % ISAP_rH_SZ;`
`965`	`966`	`}`
`966`	`967`
`967`	`968`	`@Override`
Original file line number	Diff line number	Diff line change
`@@ -270,7 +270,8 @@ public byte[] getMac()`
`270`	`270`	`@Override`
`271`	`271`	`public int getUpdateOutputSize(int len)`
`272`	`272`	`{`
`273`		`- return len + message.size() + (forEncryption ? TAG_INBYTES : -TAG_INBYTES);`
	`273`	`+ int total = Math.max(0, len + message.size() + (forEncryption ? 0 : -TAG_INBYTES));`
	`274`	`+ return total - total % RATE_INBYTES;`
`274`	`275`	`}`
`275`	`276`
`276`	`277`	`@Override`
Original file line number	Diff line number	Diff line change
`@@ -28,6 +28,9 @@ public String getName()`
`28`	`28`	`public void performTest()`
`29`	`29`	`throws Exception`
`30`	`30`	`{`
	`31`	`+// CipherTest.checkAEADCipherOutputSize(16, 12, 20, 8, new ElephantEngine(ElephantEngine.ElephantParameters.elephant160));`
	`32`	`+// CipherTest.checkAEADCipherOutputSize(16, 12, 22, 8, new ElephantEngine(ElephantEngine.ElephantParameters.elephant176));`
	`33`	`+// CipherTest.checkAEADCipherOutputSize(16, 12, 25, 8, new ElephantEngine(ElephantEngine.ElephantParameters.elephant200));`
`31`	`34`	`//testVectors(ElephantEngine.ElephantParameters.elephant160, "v160_2");`
`32`	`35`	`CipherTest.checkCipher(10, 12, 40, 128, new CipherTest.Instace()`
`33`	`36`	`{`
Original file line number	Diff line number	Diff line change
`@@ -42,7 +42,7 @@ public void performTest()`
`42`	`42`	`testVectors(PhotonBeetleEngine.PhotonBeetleParameters.pb128, "v128");`
`43`	`43`	`testExceptions(new PhotonBeetleDigest(), 32);`
`44`	`44`	`CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new PhotonBeetleEngine(PhotonBeetleEngine.PhotonBeetleParameters.pb128));`
`45`		`- CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new PhotonBeetleEngine(PhotonBeetleEngine.PhotonBeetleParameters.pb32));`
	`45`	`+ CipherTest.checkAEADCipherOutputSize(16, 16, 4, 16, new PhotonBeetleEngine(PhotonBeetleEngine.PhotonBeetleParameters.pb32));`
`46`	`46`	`}`
`47`	`47`
`48`	`48`	`private void testVectorsHash()`
Original file line number	Diff line number	Diff line change
`@@ -39,7 +39,7 @@ public void performTest()`
`39`	`39`	`testExceptions(xoodyak, xoodyak.getKeyBytesSize(), xoodyak.getIVBytesSize(), xoodyak.getBlockSize());`
`40`	`40`	`testParameters(xoodyak, 16, 16, 16);`
`41`	`41`	`testExceptions(new XoodyakDigest(), 32);`
`42`		`- CipherTest.checkAEADCipherOutputSize(16, 16, 16, 16, new XoodyakEngine());`
	`42`	`+ CipherTest.checkAEADCipherOutputSize(16, 16, 24, 16, new XoodyakEngine());`
`43`	`43`	`}`
`44`	`44`
`45`	`45`	`private void testVectorsHash()`