|
| 1 | +// Copyright (c) 2016 The Bitcoin Core developers |
| 2 | +// Distributed under the MIT software license, see the accompanying |
| 3 | +// file COPYING or http://www.opensource.org/licenses/mit-license.php. |
| 4 | + |
| 5 | +#include "aes.h" |
| 6 | +#include "crypto/common.h" |
| 7 | + |
| 8 | +#include <assert.h> |
| 9 | +#include <string.h> |
| 10 | + |
| 11 | +extern "C" { |
| 12 | +#include "crypto/ctaes/ctaes.c" |
| 13 | +} |
| 14 | + |
| 15 | +AES128Encrypt::AES128Encrypt(const unsigned char key[16]) |
| 16 | +{ |
| 17 | + AES128_init(&ctx, key); |
| 18 | +} |
| 19 | + |
| 20 | +AES128Encrypt::~AES128Encrypt() |
| 21 | +{ |
| 22 | + memset(&ctx, 0, sizeof(ctx)); |
| 23 | +} |
| 24 | + |
| 25 | +void AES128Encrypt::Encrypt(unsigned char ciphertext[16], const unsigned char plaintext[16]) const |
| 26 | +{ |
| 27 | + AES128_encrypt(&ctx, 1, ciphertext, plaintext); |
| 28 | +} |
| 29 | + |
| 30 | +AES128Decrypt::AES128Decrypt(const unsigned char key[16]) |
| 31 | +{ |
| 32 | + AES128_init(&ctx, key); |
| 33 | +} |
| 34 | + |
| 35 | +AES128Decrypt::~AES128Decrypt() |
| 36 | +{ |
| 37 | + memset(&ctx, 0, sizeof(ctx)); |
| 38 | +} |
| 39 | + |
| 40 | +void AES128Decrypt::Decrypt(unsigned char plaintext[16], const unsigned char ciphertext[16]) const |
| 41 | +{ |
| 42 | + AES128_decrypt(&ctx, 1, plaintext, ciphertext); |
| 43 | +} |
| 44 | + |
| 45 | +AES256Encrypt::AES256Encrypt(const unsigned char key[32]) |
| 46 | +{ |
| 47 | + AES256_init(&ctx, key); |
| 48 | +} |
| 49 | + |
| 50 | +AES256Encrypt::~AES256Encrypt() |
| 51 | +{ |
| 52 | + memset(&ctx, 0, sizeof(ctx)); |
| 53 | +} |
| 54 | + |
| 55 | +void AES256Encrypt::Encrypt(unsigned char ciphertext[16], const unsigned char plaintext[16]) const |
| 56 | +{ |
| 57 | + AES256_encrypt(&ctx, 1, ciphertext, plaintext); |
| 58 | +} |
| 59 | + |
| 60 | +AES256Decrypt::AES256Decrypt(const unsigned char key[32]) |
| 61 | +{ |
| 62 | + AES256_init(&ctx, key); |
| 63 | +} |
| 64 | + |
| 65 | +AES256Decrypt::~AES256Decrypt() |
| 66 | +{ |
| 67 | + memset(&ctx, 0, sizeof(ctx)); |
| 68 | +} |
| 69 | + |
| 70 | +void AES256Decrypt::Decrypt(unsigned char plaintext[16], const unsigned char ciphertext[16]) const |
| 71 | +{ |
| 72 | + AES256_decrypt(&ctx, 1, plaintext, ciphertext); |
| 73 | +} |
| 74 | + |
| 75 | + |
| 76 | +template <typename T> |
| 77 | +static int CBCEncrypt(const T& enc, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out) |
| 78 | +{ |
| 79 | + int written = 0; |
| 80 | + int padsize = size % AES_BLOCKSIZE; |
| 81 | + unsigned char mixed[AES_BLOCKSIZE]; |
| 82 | + |
| 83 | + if (!data || !size || !out) |
| 84 | + return 0; |
| 85 | + |
| 86 | + if (!pad && padsize != 0) |
| 87 | + return 0; |
| 88 | + |
| 89 | + memcpy(mixed, iv, AES_BLOCKSIZE); |
| 90 | + |
| 91 | + // Write all but the last block |
| 92 | + while (written + AES_BLOCKSIZE <= size) { |
| 93 | + for (int i = 0; i != AES_BLOCKSIZE; i++) |
| 94 | + mixed[i] ^= *data++; |
| 95 | + enc.Encrypt(out + written, mixed); |
| 96 | + memcpy(mixed, out + written, AES_BLOCKSIZE); |
| 97 | + written += AES_BLOCKSIZE; |
| 98 | + } |
| 99 | + if (pad) { |
| 100 | + // For all that remains, pad each byte with the value of the remaining |
| 101 | + // space. If there is none, pad by a full block. |
| 102 | + for (int i = 0; i != padsize; i++) |
| 103 | + mixed[i] ^= *data++; |
| 104 | + for (int i = padsize; i != AES_BLOCKSIZE; i++) |
| 105 | + mixed[i] ^= AES_BLOCKSIZE - padsize; |
| 106 | + enc.Encrypt(out + written, mixed); |
| 107 | + written += AES_BLOCKSIZE; |
| 108 | + } |
| 109 | + return written; |
| 110 | +} |
| 111 | + |
| 112 | +template <typename T> |
| 113 | +static int CBCDecrypt(const T& dec, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out) |
| 114 | +{ |
| 115 | + unsigned char padsize = 0; |
| 116 | + int written = 0; |
| 117 | + bool fail = false; |
| 118 | + const unsigned char* prev = iv; |
| 119 | + |
| 120 | + if (!data || !size || !out) |
| 121 | + return 0; |
| 122 | + |
| 123 | + if (size % AES_BLOCKSIZE != 0) |
| 124 | + return 0; |
| 125 | + |
| 126 | + // Decrypt all data. Padding will be checked in the output. |
| 127 | + while (written != size) { |
| 128 | + dec.Decrypt(out, data + written); |
| 129 | + for (int i = 0; i != AES_BLOCKSIZE; i++) |
| 130 | + *out++ ^= prev[i]; |
| 131 | + prev = data + written; |
| 132 | + written += AES_BLOCKSIZE; |
| 133 | + } |
| 134 | + |
| 135 | + // When decrypting padding, attempt to run in constant-time |
| 136 | + if (pad) { |
| 137 | + // If used, padding size is the value of the last decrypted byte. For |
| 138 | + // it to be valid, It must be between 1 and AES_BLOCKSIZE. |
| 139 | + padsize = *--out; |
| 140 | + fail = !padsize | (padsize > AES_BLOCKSIZE); |
| 141 | + |
| 142 | + // If not well-formed, treat it as though there's no padding. |
| 143 | + padsize *= !fail; |
| 144 | + |
| 145 | + // All padding must equal the last byte otherwise it's not well-formed |
| 146 | + for (int i = AES_BLOCKSIZE; i != 0; i--) |
| 147 | + fail |= ((i > AES_BLOCKSIZE - padsize) & (*out-- != padsize)); |
| 148 | + |
| 149 | + written -= padsize; |
| 150 | + } |
| 151 | + return written * !fail; |
| 152 | +} |
| 153 | + |
| 154 | +AES256CBCEncrypt::AES256CBCEncrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn) |
| 155 | + : enc(key), pad(padIn) |
| 156 | +{ |
| 157 | + memcpy(iv, ivIn, AES_BLOCKSIZE); |
| 158 | +} |
| 159 | + |
| 160 | +int AES256CBCEncrypt::Encrypt(const unsigned char* data, int size, unsigned char* out) const |
| 161 | +{ |
| 162 | + return CBCEncrypt(enc, iv, data, size, pad, out); |
| 163 | +} |
| 164 | + |
| 165 | +AES256CBCEncrypt::~AES256CBCEncrypt() |
| 166 | +{ |
| 167 | + memset(iv, 0, sizeof(iv)); |
| 168 | +} |
| 169 | + |
| 170 | +AES256CBCDecrypt::AES256CBCDecrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn) |
| 171 | + : dec(key), pad(padIn) |
| 172 | +{ |
| 173 | + memcpy(iv, ivIn, AES_BLOCKSIZE); |
| 174 | +} |
| 175 | + |
| 176 | + |
| 177 | +int AES256CBCDecrypt::Decrypt(const unsigned char* data, int size, unsigned char* out) const |
| 178 | +{ |
| 179 | + return CBCDecrypt(dec, iv, data, size, pad, out); |
| 180 | +} |
| 181 | + |
| 182 | +AES256CBCDecrypt::~AES256CBCDecrypt() |
| 183 | +{ |
| 184 | + memset(iv, 0, sizeof(iv)); |
| 185 | +} |
| 186 | + |
| 187 | +AES128CBCEncrypt::AES128CBCEncrypt(const unsigned char key[AES128_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn) |
| 188 | + : enc(key), pad(padIn) |
| 189 | +{ |
| 190 | + memcpy(iv, ivIn, AES_BLOCKSIZE); |
| 191 | +} |
| 192 | + |
| 193 | +AES128CBCEncrypt::~AES128CBCEncrypt() |
| 194 | +{ |
| 195 | + memset(iv, 0, AES_BLOCKSIZE); |
| 196 | +} |
| 197 | + |
| 198 | +int AES128CBCEncrypt::Encrypt(const unsigned char* data, int size, unsigned char* out) const |
| 199 | +{ |
| 200 | + return CBCEncrypt(enc, iv, data, size, pad, out); |
| 201 | +} |
| 202 | + |
| 203 | +AES128CBCDecrypt::AES128CBCDecrypt(const unsigned char key[AES128_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn) |
| 204 | + : dec(key), pad(padIn) |
| 205 | +{ |
| 206 | + memcpy(iv, ivIn, AES_BLOCKSIZE); |
| 207 | +} |
| 208 | + |
| 209 | +AES128CBCDecrypt::~AES128CBCDecrypt() |
| 210 | +{ |
| 211 | + memset(iv, 0, AES_BLOCKSIZE); |
| 212 | +} |
| 213 | + |
| 214 | +int AES128CBCDecrypt::Decrypt(const unsigned char* data, int size, unsigned char* out) const |
| 215 | +{ |
| 216 | + return CBCDecrypt(dec, iv, data, size, pad, out); |
| 217 | +} |
0 commit comments