v/vlib/crypto/aes/aes_cbc.v

131 lines
3.4 KiB
V
Raw Normal View History

2020-02-03 05:00:36 +01:00
// Copyright (c) 2019-2020 Alexander Medvednikov. All rights reserved.
2019-07-25 17:49:57 +02:00
// Use of this source code is governed by an MIT license
// that can be found in the LICENSE file.
// Cipher block chaining (CBC) mode.
// CBC provides confidentiality by xoring (chaining) each plaintext block
// with the previous ciphertext block before applying the block cipher.
// See NIST SP 800-38A, pp 10-11
// NOTE this will be moved to crypto.cipher interface (joe-c)
module aes
2020-04-26 13:49:31 +02:00
import crypto.cipher
import crypto.internal.subtle
2019-07-25 17:49:57 +02:00
struct AesCbc {
mut:
b AesCipher
block_size int
iv []byte
tmp []byte
}
// internal
fn new_aes_cbc(b AesCipher, iv []byte) AesCbc {
2019-07-25 17:49:57 +02:00
return AesCbc{
b: b,
block_size: b.block_size(),
2019-07-29 16:33:35 +02:00
iv: iv.clone(),
2019-09-23 12:42:20 +02:00
tmp: [byte(0)].repeat(b.block_size()),
2019-07-25 17:49:57 +02:00
}
}
// new_cbc_encrypter returns a BlockMode which encrypts in cipher block chaining
// mode, using the given Block. The length of iv must be the same as the
// Block's block size.
pub fn new_cbc(b AesCipher, iv []byte) AesCbc {
if iv.len != b.block_size() {
panic('crypto.cipher.new_cbc_encrypter: IV length must equal block size')
}
return new_aes_cbc(b, iv)
2019-07-25 17:49:57 +02:00
}
pub fn (x &AesCbc) block_size() int { return x.block_size }
pub fn (x &AesCbc) encrypt_blocks(dst mut []byte, src_ []byte) {
2019-08-07 13:37:07 +02:00
mut src := src_
2019-07-25 17:49:57 +02:00
if src.len%x.block_size != 0 {
panic('crypto.cipher: input not full blocks')
}
if dst.len < src.len {
panic('crypto.cipher: output smaller than input')
}
if subtle.inexact_overlap((*dst)[..src.len], src) {
2019-07-25 17:49:57 +02:00
panic('crypto.cipher: invalid buffer overlap')
}
mut iv := x.iv
for src.len > 0 {
// Write the xor to dst, then encrypt in place.
cipher.xor_bytes(mut (*dst)[..x.block_size], src[..x.block_size], iv)
x.b.encrypt((*dst)[..x.block_size], (*dst)[..x.block_size])
2019-07-25 17:49:57 +02:00
// Move to the next block with this block as the next iv.
iv = (*dst)[..x.block_size]
2019-07-25 17:49:57 +02:00
if x.block_size >= src.len {
2019-11-14 08:00:22 +01:00
src = []
2019-07-25 17:49:57 +02:00
} else {
src = src[x.block_size..]
2019-07-25 17:49:57 +02:00
}
(*dst) = (*dst)[x.block_size..]
2019-07-25 17:49:57 +02:00
}
// Save the iv for the next crypt_blocks call.
2019-07-29 16:33:35 +02:00
copy(x.iv, iv)
2019-07-25 17:49:57 +02:00
}
2019-08-07 13:37:07 +02:00
pub fn (x mut AesCbc) decrypt_blocks(dst mut []byte, src []byte) {
2019-07-25 17:49:57 +02:00
if src.len%x.block_size != 0 {
panic('crypto.cipher: input not full blocks')
}
if dst.len < src.len {
panic('crypto.cipher: output smaller than input')
}
if subtle.inexact_overlap((*dst)[..src.len], src) {
2019-07-25 17:49:57 +02:00
panic('crypto.cipher: invalid buffer overlap')
}
if src.len == 0 {
return
}
// For each block, we need to xor the decrypted data with the previous block's ciphertext (the iv).
// To avoid making a copy each time, we loop over the blocks BACKWARDS.
mut end := src.len
mut start := end - x.block_size
mut prev := start - x.block_size
// Copy the last block of ciphertext in preparation as the new iv.
2019-07-29 16:33:35 +02:00
copy(x.tmp, src.slice(start, end))
2019-07-25 17:49:57 +02:00
// Loop over all but the first block.
for start > 0 {
x.b.decrypt((*dst).slice(start, end), src.slice(start, end))
cipher.xor_bytes(mut (*dst).slice(start, end), (*dst).slice(start, end), src.slice(prev, start))
2019-07-25 17:49:57 +02:00
end = start
start = prev
prev -= x.block_size
}
// The first block is special because it uses the saved iv.
x.b.decrypt((*dst).slice(start, end), src.slice(start, end))
cipher.xor_bytes(mut (*dst).slice(start, end), (*dst).slice(start, end), x.iv)
2019-07-25 17:49:57 +02:00
// Set the new iv to the first block we copied earlier.
x.iv = x.tmp
x.tmp = x.iv
}
fn (x &AesCbc) set_iv(iv []byte) {
2019-07-25 17:49:57 +02:00
if iv.len != x.iv.len {
panic('cipher: incorrect length IV')
}
2019-07-29 16:33:35 +02:00
copy(x.iv, iv)
2019-07-25 17:49:57 +02:00
}