src/crypto/aes.cpp

   1 // Copyright (c) 2016 The Bitcoin Core developers
   2 // Distributed under the MIT software license, see the accompanying
   3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
   4
   5 #include "aes.h"
   6 #include "crypto/common.h"
   7
   8 #include <assert.h>
   9 #include <string.h>
  10
  11 extern "C" {
  12 #include "crypto/ctaes/ctaes.c"
  13 }
  14
  15 AES128Encrypt::AES128Encrypt(const unsigned char key[16])
  16 {
  17     AES128_init(&ctx, key);
  18 }
  19
  20 AES128Encrypt::~AES128Encrypt()
  21 {
  22     memset(&ctx, 0, sizeof(ctx));
  23 }
  24
  25 void AES128Encrypt::Encrypt(unsigned char ciphertext[16], const unsigned char plaintext[16]) const
  26 {
  27     AES128_encrypt(&ctx, 1, ciphertext, plaintext);
  28 }
  29
  30 AES128Decrypt::AES128Decrypt(const unsigned char key[16])
  31 {
  32     AES128_init(&ctx, key);
  33 }
  34
  35 AES128Decrypt::~AES128Decrypt()
  36 {
  37     memset(&ctx, 0, sizeof(ctx));
  38 }
  39
  40 void AES128Decrypt::Decrypt(unsigned char plaintext[16], const unsigned char ciphertext[16]) const
  41 {
  42     AES128_decrypt(&ctx, 1, plaintext, ciphertext);
  43 }
  44
  45 AES256Encrypt::AES256Encrypt(const unsigned char key[32])
  46 {
  47     AES256_init(&ctx, key);
  48 }
  49
  50 AES256Encrypt::~AES256Encrypt()
  51 {
  52     memset(&ctx, 0, sizeof(ctx));
  53 }
  54
  55 void AES256Encrypt::Encrypt(unsigned char ciphertext[16], const unsigned char plaintext[16]) const
  56 {
  57     AES256_encrypt(&ctx, 1, ciphertext, plaintext);
  58 }
  59
  60 AES256Decrypt::AES256Decrypt(const unsigned char key[32])
  61 {
  62     AES256_init(&ctx, key);
  63 }
  64
  65 AES256Decrypt::~AES256Decrypt()
  66 {
  67     memset(&ctx, 0, sizeof(ctx));
  68 }
  69
  70 void AES256Decrypt::Decrypt(unsigned char plaintext[16], const unsigned char ciphertext[16]) const
  71 {
  72     AES256_decrypt(&ctx, 1, plaintext, ciphertext);
  73 }
  74
  75
  76 template <typename T>
  77 static int CBCEncrypt(const T& enc, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out)
  78 {
  79     int written = 0;
  80     int padsize = size % AES_BLOCKSIZE;
  81     unsigned char mixed[AES_BLOCKSIZE];
  82
  83     if (!data || !size || !out)
  84         return 0;
  85
  86     if (!pad && padsize != 0)
  87         return 0;
  88
  89     memcpy(mixed, iv, AES_BLOCKSIZE);
  90
  91     // Write all but the last block
  92     while (written + AES_BLOCKSIZE <= size) {
  93         for (int i = 0; i != AES_BLOCKSIZE; i++)
  94             mixed[i] ^= *data++;
  95         enc.Encrypt(out + written, mixed);
  96         memcpy(mixed, out + written, AES_BLOCKSIZE);
  97         written += AES_BLOCKSIZE;
  98     }
  99     if (pad) {
 100         // For all that remains, pad each byte with the value of the remaining
 101         // space. If there is none, pad by a full block.
 102         for (int i = 0; i != padsize; i++)
 103             mixed[i] ^= *data++;
 104         for (int i = padsize; i != AES_BLOCKSIZE; i++)
 105             mixed[i] ^= AES_BLOCKSIZE - padsize;
 106         enc.Encrypt(out + written, mixed);
 107         written += AES_BLOCKSIZE;
 108     }
 109     return written;
 110 }
 111
 112 template <typename T>
 113 static int CBCDecrypt(const T& dec, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out)
 114 {
 115     int written = 0;
 116     bool fail = false;
 117     const unsigned char* prev = iv;
 118
 119     if (!data || !size || !out)
 120         return 0;
 121
 122     if (size % AES_BLOCKSIZE != 0)
 123         return 0;
 124
 125     // Decrypt all data. Padding will be checked in the output.
 126     while (written != size) {
 127         dec.Decrypt(out, data + written);
 128         for (int i = 0; i != AES_BLOCKSIZE; i++)
 129             *out++ ^= prev[i];
 130         prev = data + written;
 131         written += AES_BLOCKSIZE;
 132     }
 133
 134     // When decrypting padding, attempt to run in constant-time
 135     if (pad) {
 136         // If used, padding size is the value of the last decrypted byte. For
 137         // it to be valid, It must be between 1 and AES_BLOCKSIZE.
 138         unsigned char padsize = *--out;
 139         fail = !padsize | (padsize > AES_BLOCKSIZE);
 140
 141         // If not well-formed, treat it as though there's no padding.
 142         padsize *= !fail;
 143
 144         // All padding must equal the last byte otherwise it's not well-formed
 145         for (int i = AES_BLOCKSIZE; i != 0; i--)
 146             fail |= ((i > AES_BLOCKSIZE - padsize) & (*out-- != padsize));
 147
 148         written -= padsize;
 149     }
 150     return written * !fail;
 151 }
 152
 153 AES256CBCEncrypt::AES256CBCEncrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)
 154     : enc(key), pad(padIn)
 155 {
 156     memcpy(iv, ivIn, AES_BLOCKSIZE);
 157 }
 158
 159 int AES256CBCEncrypt::Encrypt(const unsigned char* data, int size, unsigned char* out) const
 160 {
 161     return CBCEncrypt(enc, iv, data, size, pad, out);
 162 }
 163
 164 AES256CBCEncrypt::~AES256CBCEncrypt()
 165 {
 166     memset(iv, 0, sizeof(iv));
 167 }
 168
 169 AES256CBCDecrypt::AES256CBCDecrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)
 170     : dec(key), pad(padIn)
 171 {
 172     memcpy(iv, ivIn, AES_BLOCKSIZE);
 173 }
 174
 175
 176 int AES256CBCDecrypt::Decrypt(const unsigned char* data, int size, unsigned char* out) const
 177 {
 178     return CBCDecrypt(dec, iv, data, size, pad, out);
 179 }
 180
 181 AES256CBCDecrypt::~AES256CBCDecrypt()
 182 {
 183     memset(iv, 0, sizeof(iv));
 184 }
 185
 186 AES128CBCEncrypt::AES128CBCEncrypt(const unsigned char key[AES128_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)
 187     : enc(key), pad(padIn)
 188 {
 189     memcpy(iv, ivIn, AES_BLOCKSIZE);
 190 }
 191
 192 AES128CBCEncrypt::~AES128CBCEncrypt()
 193 {
 194     memset(iv, 0, AES_BLOCKSIZE);
 195 }
 196
 197 int AES128CBCEncrypt::Encrypt(const unsigned char* data, int size, unsigned char* out) const
 198 {
 199     return CBCEncrypt(enc, iv, data, size, pad, out);
 200 }
 201
 202 AES128CBCDecrypt::AES128CBCDecrypt(const unsigned char key[AES128_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)
 203     : dec(key), pad(padIn)
 204 {
 205     memcpy(iv, ivIn, AES_BLOCKSIZE);
 206 }
 207
 208 AES128CBCDecrypt::~AES128CBCDecrypt()
 209 {
 210     memset(iv, 0, AES_BLOCKSIZE);
 211 }
 212
 213 int AES128CBCDecrypt::Decrypt(const unsigned char* data, int size, unsigned char* out) const
 214 {
 215     return CBCDecrypt(dec, iv, data, size, pad, out);
 216 }