From 1b9f0007eaa44982e90fc06df058a0f83c2f46af Mon Sep 17 00:00:00 2001 From: Alexandr Kitaev Date: Sat, 18 May 2024 17:57:15 +0300 Subject: [PATCH] add belt-dwp --- .github/workflows/belt-dwp.yml | 69 ++++++++ Cargo.lock | 245 ++++++++++++++++++++++++---- Cargo.toml | 1 + README.md | 3 + belt-dwp/Cargo.lock | 272 ++++++++++++++++++++++++++++++++ belt-dwp/Cargo.toml | 39 +++++ belt-dwp/README.md | 59 +++++++ belt-dwp/src/gf.rs | 46 ++++++ belt-dwp/src/gf/gf128_soft64.rs | 104 ++++++++++++ belt-dwp/src/gf/utils.rs | 30 ++++ belt-dwp/src/ghash.rs | 82 ++++++++++ belt-dwp/src/lib.rs | 268 +++++++++++++++++++++++++++++++ belt-dwp/src/utils.rs | 29 ++++ belt-dwp/tests/belt.rs | 47 ++++++ 14 files changed, 1263 insertions(+), 31 deletions(-) create mode 100644 .github/workflows/belt-dwp.yml create mode 100644 belt-dwp/Cargo.lock create mode 100644 belt-dwp/Cargo.toml create mode 100644 belt-dwp/README.md create mode 100644 belt-dwp/src/gf.rs create mode 100644 belt-dwp/src/gf/gf128_soft64.rs create mode 100644 belt-dwp/src/gf/utils.rs create mode 100644 belt-dwp/src/ghash.rs create mode 100644 belt-dwp/src/lib.rs create mode 100644 belt-dwp/src/utils.rs create mode 100644 belt-dwp/tests/belt.rs diff --git a/.github/workflows/belt-dwp.yml b/.github/workflows/belt-dwp.yml new file mode 100644 index 00000000..328c72c6 --- /dev/null +++ b/.github/workflows/belt-dwp.yml @@ -0,0 +1,69 @@ +name: belt-dwp + +on: + pull_request: + paths: + - ".github/workflows/belt-dwp.yml" + - "aes-gcm/**" + - "Cargo.*" + push: + branches: master + +defaults: + run: + working-directory: belt-dwp + +env: + CARGO_INCREMENTAL: 0 + RUSTFLAGS: "-Dwarnings" + +jobs: + build: + runs-on: ubuntu-latest + strategy: + matrix: + rust: + - 1.65.0 # MSRV + - stable + target: + - armv7a-none-eabi + - thumbv7em-none-eabi + - wasm32-unknown-unknown + steps: + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + targets: ${{ matrix.target }} + - run: cargo build --no-default-features --release --target ${{ matrix.target }} + + test: + runs-on: ubuntu-latest + strategy: + matrix: + include: + # 32-bit Linux + - target: i686-unknown-linux-gnu + rust: 1.72.0 # MSRV + deps: sudo apt update && sudo apt install gcc-multilib + - target: i686-unknown-linux-gnu + rust: stable + deps: sudo apt update && sudo apt install gcc-multilib + + # 64-bit Linux + - target: x86_64-unknown-linux-gnu + rust: 1.72.0 # MSRV + - target: x86_64-unknown-linux-gnu + rust: stable + steps: + - uses: actions/checkout@v4 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + targets: ${{ matrix.target }} + - run: ${{ matrix.deps }} + - run: cargo test --target ${{ matrix.target }} --release --no-default-features --lib + - run: cargo test --target ${{ matrix.target }} --release + - run: cargo test --target ${{ matrix.target }} --release --features stream,std,zeroize + - run: cargo test --target ${{ matrix.target }} --release --all-features + - run: cargo build --target ${{ matrix.target }} --benches diff --git a/Cargo.lock b/Cargo.lock index 7737803e..c835d381 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3,6 +3,18 @@ # version = 3 +[[package]] +name = "aead" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0" +dependencies = [ + "arrayvec", + "crypto-common 0.1.6", + "generic-array", + "heapless 0.7.17", +] + [[package]] name = "aead" version = "0.6.0-pre.0" @@ -11,8 +23,8 @@ checksum = "3de53f67567d2692f69357ee20fef7ddf7969d1dff34acefc05db91873aee0ce" dependencies = [ "arrayvec", "blobby", - "crypto-common", - "heapless", + "crypto-common 0.2.0-pre.5", + "heapless 0.8.0", ] [[package]] @@ -22,7 +34,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "25512cae539ab9089dcbd69c4f704e787fdc8c1cea8d9daa68a9d89b02b0501f" dependencies = [ "cfg-if", - "cipher", + "cipher 0.5.0-pre.4", "cpufeatures", ] @@ -30,9 +42,9 @@ dependencies = [ name = "aes-gcm" version = "0.11.0-pre" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "aes", - "cipher", + "cipher 0.5.0-pre.4", "ctr", "ghash", "hex-literal", @@ -44,9 +56,9 @@ dependencies = [ name = "aes-gcm-siv" version = "0.12.0-pre" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "aes", - "cipher", + "cipher 0.5.0-pre.4", "ctr", "polyval", "subtle", @@ -57,10 +69,10 @@ dependencies = [ name = "aes-siv" version = "0.7.0" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "aes", "blobby", - "cipher", + "cipher 0.5.0-pre.4", "cmac", "ctr", "dbl", @@ -89,13 +101,60 @@ dependencies = [ name = "ascon-aead" version = "0.4.2" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "ascon", "hex-literal", "subtle", "zeroize", ] +[[package]] +name = "atomic-polyfill" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4" +dependencies = [ + "critical-section", +] + +[[package]] +name = "autocfg" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0" + +[[package]] +name = "belt-block" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d9aa1eef3994e2ccd304a78fe3fea4a73e5792007f85f09b79bb82143ca5f82b" +dependencies = [ + "cipher 0.4.4", +] + +[[package]] +name = "belt-ctr" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f24134aff90e96a5957a77983e294f7cf9920d6aa67f89f3e846d5521c0480b" +dependencies = [ + "belt-block", + "cipher 0.4.4", +] + +[[package]] +name = "belt-dwp" +version = "0.1.0" +dependencies = [ + "aead 0.5.2", + "belt-block", + "belt-ctr", + "hex-literal", + "opaque-debug", + "universal-hash 0.5.1", + "zeroize", +] + [[package]] name = "blobby" version = "0.3.1" @@ -108,7 +167,7 @@ version = "0.11.0-pre.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3ded684142010808eb980d9974ef794da2bcf97d13396143b1515e9f0fb4a10e" dependencies = [ - "crypto-common", + "crypto-common 0.2.0-pre.5", ] [[package]] @@ -130,9 +189,9 @@ checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610" name = "ccm" version = "0.5.0" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "aes", - "cipher", + "cipher 0.5.0-pre.4", "ctr", "hex-literal", "subtle", @@ -150,7 +209,7 @@ version = "0.10.0-pre" source = "git+https://github.com/RustCrypto/stream-ciphers.git#fea3dd013ee9c35fba56903ad44b411957de8cb2" dependencies = [ "cfg-if", - "cipher", + "cipher 0.5.0-pre.4", "cpufeatures", ] @@ -158,21 +217,31 @@ dependencies = [ name = "chacha20poly1305" version = "0.10.1" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "chacha20", - "cipher", + "cipher 0.5.0-pre.4", "poly1305", "zeroize", ] +[[package]] +name = "cipher" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" +dependencies = [ + "crypto-common 0.1.6", + "inout 0.1.3", +] + [[package]] name = "cipher" version = "0.5.0-pre.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "84fba98785cecd0e308818a87c817576a40f99d8bab6405bf422bacd3efb6c1f" dependencies = [ - "crypto-common", - "inout", + "crypto-common 0.2.0-pre.5", + "inout 0.2.0-pre.4", "zeroize", ] @@ -181,7 +250,7 @@ name = "cmac" version = "0.8.0-pre" source = "git+https://github.com/RustCrypto/MACs.git#43cc597a8881d6924ae56bb22edf19600e981e3e" dependencies = [ - "cipher", + "cipher 0.5.0-pre.4", "dbl", "digest", ] @@ -195,6 +264,23 @@ dependencies = [ "libc", ] +[[package]] +name = "critical-section" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7059fff8937831a9ae6f0fe4d658ffabf58f2ca96aa9dec1c889f936f705f216" + +[[package]] +name = "crypto-common" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3" +dependencies = [ + "generic-array", + "rand_core", + "typenum", +] + [[package]] name = "crypto-common" version = "0.2.0-pre.5" @@ -211,7 +297,7 @@ name = "ctr" version = "0.10.0-pre" source = "git+https://github.com/RustCrypto/block-modes.git#532a46166bcc74bf718ca351cc3b5a86a2fcb2a3" dependencies = [ - "cipher", + "cipher 0.5.0-pre.4", ] [[package]] @@ -227,7 +313,7 @@ dependencies = [ name = "deoxys" version = "0.1.0" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "aes", "hex-literal", "subtle", @@ -241,7 +327,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "065d93ead7c220b85d5b4be4795d8398eac4ff68b5ee63895de0a3c1fb6edf25" dependencies = [ "block-buffer", - "crypto-common", + "crypto-common 0.2.0-pre.5", "subtle", ] @@ -249,14 +335,24 @@ dependencies = [ name = "eax" version = "0.5.0" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "aes", - "cipher", + "cipher 0.5.0-pre.4", "cmac", "ctr", "subtle", ] +[[package]] +name = "generic-array" +version = "0.14.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" +dependencies = [ + "typenum", + "version_check", +] + [[package]] name = "getrandom" version = "0.2.12" @@ -278,6 +374,15 @@ dependencies = [ "polyval", ] +[[package]] +name = "hash32" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67" +dependencies = [ + "byteorder", +] + [[package]] name = "hash32" version = "0.3.1" @@ -287,13 +392,26 @@ dependencies = [ "byteorder", ] +[[package]] +name = "heapless" +version = "0.7.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f" +dependencies = [ + "atomic-polyfill", + "hash32 0.2.1", + "rustc_version", + "spin", + "stable_deref_trait", +] + [[package]] name = "heapless" version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad" dependencies = [ - "hash32", + "hash32 0.3.1", "stable_deref_trait", ] @@ -312,6 +430,15 @@ dependencies = [ "typenum", ] +[[package]] +name = "inout" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5" +dependencies = [ + "generic-array", +] + [[package]] name = "inout" version = "0.2.0-pre.4" @@ -328,13 +455,23 @@ version = "0.2.153" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd" +[[package]] +name = "lock_api" +version = "0.4.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17" +dependencies = [ + "autocfg", + "scopeguard", +] + [[package]] name = "ocb3" version = "0.1.0" dependencies = [ - "aead", + "aead 0.6.0-pre.0", "aes", - "cipher", + "cipher 0.5.0-pre.4", "ctr", "hex-literal", "subtle", @@ -352,7 +489,7 @@ name = "pmac" version = "0.8.0-pre" source = "git+https://github.com/RustCrypto/MACs.git#43cc597a8881d6924ae56bb22edf19600e981e3e" dependencies = [ - "cipher", + "cipher 0.5.0-pre.4", "dbl", "digest", ] @@ -365,7 +502,7 @@ checksum = "c6c08e786072ace4e4498d7e477e9f8f9ea1a64f1a981ca17be7dc4df1361011" dependencies = [ "cpufeatures", "opaque-debug", - "universal-hash", + "universal-hash 0.6.0-pre.0", ] [[package]] @@ -377,7 +514,7 @@ dependencies = [ "cfg-if", "cpufeatures", "opaque-debug", - "universal-hash", + "universal-hash 0.6.0-pre.0", ] [[package]] @@ -407,6 +544,36 @@ dependencies = [ "getrandom", ] +[[package]] +name = "rustc_version" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366" +dependencies = [ + "semver", +] + +[[package]] +name = "scopeguard" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" + +[[package]] +name = "semver" +version = "1.0.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b" + +[[package]] +name = "spin" +version = "0.9.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" +dependencies = [ + "lock_api", +] + [[package]] name = "stable_deref_trait" version = "1.2.0" @@ -442,16 +609,32 @@ version = "1.0.12" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b" +[[package]] +name = "universal-hash" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea" +dependencies = [ + "crypto-common 0.1.6", + "subtle", +] + [[package]] name = "universal-hash" version = "0.6.0-pre.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a05336f34009f6bb1c24794e2c04df87f4a0ced7a091692e395119f34fd3f4c5" dependencies = [ - "crypto-common", + "crypto-common 0.2.0-pre.5", "subtle", ] +[[package]] +name = "version_check" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f" + [[package]] name = "wasi" version = "0.11.0+wasi-snapshot-preview1" diff --git a/Cargo.toml b/Cargo.toml index dfbd126b..96574e7e 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,6 +9,7 @@ members = [ "deoxys", "eax", "ocb3", + "belt-dwp" ] resolver = "2" diff --git a/README.md b/README.md index bf56003a..ad604bc0 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,7 @@ crate. | [`aes-gcm`] | [AES-GCM] | [![crates.io](https://img.shields.io/crates/v/aes-gcm.svg)](https://crates.io/crates/aes-gcm) | [![Documentation](https://docs.rs/aes-gcm/badge.svg)](https://docs.rs/aes-gcm) | 1.51 | | [`aes-siv`] | [AES-SIV] | [![crates.io](https://img.shields.io/crates/v/aes-siv.svg)](https://crates.io/crates/aes-siv) | [![Documentation](https://docs.rs/aes-siv/badge.svg)](https://docs.rs/aes-siv) | 1.51 | | [`ascon-aead`] | [Ascon] | [![crates.io](https://img.shields.io/crates/v/ascon-aead.svg)](https://crates.io/crates/ascon-aead) | [![Documentation](https://docs.rs/ascon-aead/badge.svg)](https://docs.rs/ascon-aead) | 1.56 | +| [`belt-dwp`] | [BeltDwp] | [![crates.io](https://img.shields.io/crates/v/belt-dwp.svg)](https://crates.io/crates/belt-dwp) | [![Documentation](https://docs.rs/belt-dwp/badge.svg)](https://docs.rs/belt-dwp) | 1.56 | | [`ccm`] | [CCM] | [![crates.io](https://img.shields.io/crates/v/ccm.svg)](https://crates.io/crates/ccm) | [![Documentation](https://docs.rs/ccm/badge.svg)](https://docs.rs/ccm) | 1.41 | | [`chacha20poly1305`] | [(X)ChaCha20Poly1305] | [![crates.io](https://img.shields.io/crates/v/chacha20poly1305.svg)](https://crates.io/crates/chacha20poly1305) | [![Documentation](https://docs.rs/chacha20poly1305/badge.svg)](https://docs.rs/chacha20poly1305) | 1.56 | | [`deoxys`] | [Deoxys-I/II] | [![crates.io](https://img.shields.io/crates/v/deoxys.svg)](https://crates.io/crates/deoxys) | [![Documentation](https://docs.rs/deoxys/badge.svg)](https://docs.rs/deoxys) | 1.51 | @@ -68,6 +69,7 @@ dual licensed as above, without any additional terms or conditions. [`aes-gcm-siv`]: https://github.com/RustCrypto/AEADs/tree/master/aes-gcm-siv [`aes-siv`]: https://github.com/RustCrypto/AEADs/tree/master/aes-siv [`ascon-aead`]: https://github.com/RustCrypto/AEADs/tree/master/ascon-aead +[`belt-dwp`]: https://github.com/RustCrypto/AEADs/tree/master/belt-dwp [`ccm`]: https://github.com/RustCrypto/AEADs/tree/master/ccm [`chacha20poly1305`]: https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305 [`deoxys`]: https://github.com/RustCrypto/AEADs/tree/master/deoxys @@ -84,4 +86,5 @@ dual licensed as above, without any additional terms or conditions. [Deoxys-I/II]: https://sites.google.com/view/deoxyscipher [EAX]: https://en.wikipedia.org/wiki/EAX_mode [MGM]: https://eprint.iacr.org/2019/123.pdf +[BeltDwp]: https://apmi.bsu.by/assets/files/std/belt-spec372.pdf [(X)ChaCha20Poly1305]: https://tools.ietf.org/html/rfc8439 diff --git a/belt-dwp/Cargo.lock b/belt-dwp/Cargo.lock new file mode 100644 index 00000000..5ad3f055 --- /dev/null +++ b/belt-dwp/Cargo.lock @@ -0,0 +1,272 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "aead" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0" +dependencies = [ + "arrayvec", + "crypto-common", + "generic-array", + "heapless", +] + +[[package]] +name = "arrayvec" +version = "0.7.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711" + +[[package]] +name = "atomic-polyfill" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4" +dependencies = [ + "critical-section", +] + +[[package]] +name = "autocfg" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0" + +[[package]] +name = "belt-block" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d9aa1eef3994e2ccd304a78fe3fea4a73e5792007f85f09b79bb82143ca5f82b" +dependencies = [ + "cipher", +] + +[[package]] +name = "belt-ctr" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f24134aff90e96a5957a77983e294f7cf9920d6aa67f89f3e846d5521c0480b" +dependencies = [ + "belt-block", + "cipher", +] + +[[package]] +name = "belt-dwp" +version = "0.1.0" +dependencies = [ + "aead", + "belt-block", + "belt-ctr", + "hex-literal", + "opaque-debug", + "universal-hash", + "zeroize", +] + +[[package]] +name = "byteorder" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" + +[[package]] +name = "cfg-if" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" + +[[package]] +name = "cipher" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" +dependencies = [ + "crypto-common", + "inout", +] + +[[package]] +name = "critical-section" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7059fff8937831a9ae6f0fe4d658ffabf58f2ca96aa9dec1c889f936f705f216" + +[[package]] +name = "crypto-common" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3" +dependencies = [ + "generic-array", + "rand_core", + "typenum", +] + +[[package]] +name = "generic-array" +version = "0.14.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" +dependencies = [ + "typenum", + "version_check", +] + +[[package]] +name = "getrandom" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7" +dependencies = [ + "cfg-if", + "libc", + "wasi", +] + +[[package]] +name = "hash32" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67" +dependencies = [ + "byteorder", +] + +[[package]] +name = "heapless" +version = "0.7.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f" +dependencies = [ + "atomic-polyfill", + "hash32", + "rustc_version", + "spin", + "stable_deref_trait", +] + +[[package]] +name = "hex-literal" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46" + +[[package]] +name = "inout" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5" +dependencies = [ + "generic-array", +] + +[[package]] +name = "libc" +version = "0.2.155" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c" + +[[package]] +name = "lock_api" +version = "0.4.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17" +dependencies = [ + "autocfg", + "scopeguard", +] + +[[package]] +name = "opaque-debug" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" + +[[package]] +name = "rand_core" +version = "0.6.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" +dependencies = [ + "getrandom", +] + +[[package]] +name = "rustc_version" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366" +dependencies = [ + "semver", +] + +[[package]] +name = "scopeguard" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" + +[[package]] +name = "semver" +version = "1.0.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b" + +[[package]] +name = "spin" +version = "0.9.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" +dependencies = [ + "lock_api", +] + +[[package]] +name = "stable_deref_trait" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3" + +[[package]] +name = "subtle" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc" + +[[package]] +name = "typenum" +version = "1.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825" + +[[package]] +name = "universal-hash" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea" +dependencies = [ + "crypto-common", + "subtle", +] + +[[package]] +name = "version_check" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f" + +[[package]] +name = "wasi" +version = "0.11.0+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423" + +[[package]] +name = "zeroize" +version = "1.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d" diff --git a/belt-dwp/Cargo.toml b/belt-dwp/Cargo.toml new file mode 100644 index 00000000..e3553736 --- /dev/null +++ b/belt-dwp/Cargo.toml @@ -0,0 +1,39 @@ +[package] +name = "belt-dwp" +version = "0.1.0" +description = "Pure Rust implementation of the Belt-DWP authenticated encryption algorithm (STB 34.101.31-2020)" +edition = "2021" +license = "Apache-2.0 OR MIT" +readme = "README.md" +documentation = "https://docs.rs/belt-dwp" +repository = "https://github.com/RustCrypto/AEADs/tree/master/belt-dwp" +keywords = ["aead", "belt-dwp"] +categories = ["cryptography", "no-std"] +rust-version = "1.56" + +[dependencies] +aead = { version = "0.5", default-features = false } +zeroize = { version = "1.7", default-features = false } +universal-hash = { version = "0.5" } +opaque-debug = { version = "0.3" } + +belt-block = { version = "0.1" } +belt-ctr = { version = "0.1"} + +[dev-dependencies] +hex-literal = "0.4" + +[features] +default = ["alloc", "getrandom"] +std = ["aead/std", "alloc"] +alloc = ["aead/alloc"] +arrayvec = ["aead/arrayvec"] +getrandom = ["aead/getrandom", "rand_core"] +heapless = ["aead/heapless"] +rand_core = ["aead/rand_core"] +reduced-round = [] +stream = ["aead/stream"] + +[package.metadata.docs.rs] +all-features = true +rustdoc-args = ["--cfg", "docsrs"] \ No newline at end of file diff --git a/belt-dwp/README.md b/belt-dwp/README.md new file mode 100644 index 00000000..958c3ada --- /dev/null +++ b/belt-dwp/README.md @@ -0,0 +1,59 @@ +# RustCrypto: BeltDwp + +[![crate][crate-image]][crate-link] +[![Docs][docs-image]][docs-link] +![Apache2/MIT licensed][license-image] +![Rust Version][rustc-image] +[![Project Chat][chat-image]][chat-link] +[![Build Status][build-image]][build-link] + +Pure Rust implementation of **BeltDwp** ([STB 34.101.31-2020][1]): an +[Authenticated Encryption with Associated Data (AEAD)][2]. + +[Documentation][docs-link] + +## About + +BeltDwp is republic of Belarus standard for authenticated encryption with associated data. + +## Security Notes + +No security audits of this crate have ever been performed, and it has not been thoroughly assessed to ensure its operation is constant-time on common CPU architectures. + +USE AT YOUR OWN RISK! + +## License + +Licensed under either of: + +* [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0) +* [MIT license](http://opensource.org/licenses/MIT) + +at your option. + +### Contribution + +Unless you explicitly state otherwise, any contribution intentionally submitted +for inclusion in the work by you, as defined in the Apache-2.0 license, shall be +dual licensed as above, without any additional terms or conditions. + +[//]: # (badges) + +[crate-image]: https://buildstats.info/crate/belt-dwp +[crate-link]: https://crates.io/crates/belt-dwp +[docs-image]: https://docs.rs/belt-dwp/badge.svg +[docs-link]: https://docs.rs/belt-dwp/ +[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg +[rustc-image]: https://img.shields.io/badge/rustc-1.56+-blue.svg +[chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg +[chat-link]: https://rustcrypto.zulipchat.com/#narrow/stream/260038-AEADs +[downloads-image]: https://img.shields.io/crates/d/chacha20poly1305.svg +[build-image]: https://github.com/RustCrypto/AEADs/workflows/belt-dwp/badge.svg?branch=master&event=push +[build-link]: https://github.com/RustCrypto/AEADs/actions + +[//]: # (general links) + +[1]: https://apmi.bsu.by/assets/files/std/belt-spec372.pdf +[2]: https://en.wikipedia.org/wiki/Authenticated_encryption +[3]: https://github.com/RustCrypto/stream-ciphers/tree/master/belt-dwp +[4]: https://github.com/RustCrypto/universal-hashes/tree/master/belt-dwp \ No newline at end of file diff --git a/belt-dwp/src/gf.rs b/belt-dwp/src/gf.rs new file mode 100644 index 00000000..b7ef95ac --- /dev/null +++ b/belt-dwp/src/gf.rs @@ -0,0 +1,46 @@ +use aead::generic_array::{ArrayLength, GenericArray}; + +mod utils; + +pub(crate) mod gf128_soft64; + +pub trait GfElement { + type N: ArrayLength; + + fn new() -> Self; + fn into_bytes(self) -> GenericArray; + fn mul_sum(&mut self, a: &GenericArray, b: &GenericArray); +} + +/// Tests from Appendix A, table 18 of [STB 34.101.31-2020](https://apmi.bsu.by/assets/files/std/belt-spec372.pdf) +#[test] +fn test_a18() { + use crate::gf::gf128_soft64::Element; + use aead::consts::U16; + use hex_literal::hex; + + type Block = GenericArray; + + let test_vectors = [ + ( + hex!("34904055 11BE3297 1343724C 5AB793E9"), + hex!("22481783 8761A9D6 E3EC9689 110FB0F3"), + hex!("0001D107 FC67DE40 04DC2C80 3DFD95C3"), + ), + ( + hex!("703FCCF0 95EE8DF1 C1ABF8EE 8DF1C1AB"), + hex!("2055704E 2EDB48FE 87E74075 A5E77EB1"), + hex!("4A5C9593 8B3FE8F6 74D59BC1 EB356079"), + ), + ]; + for (u, v, w) in test_vectors { + let a = Block::clone_from_slice(&u); + let b = Block::clone_from_slice(&v); + let c = Block::clone_from_slice(&w); + + let mut elem = Element::new(); + elem.mul_sum(&a, &b); + + assert_eq!(c, elem.into_bytes()); + } +} diff --git a/belt-dwp/src/gf/gf128_soft64.rs b/belt-dwp/src/gf/gf128_soft64.rs new file mode 100644 index 00000000..275af0e8 --- /dev/null +++ b/belt-dwp/src/gf/gf128_soft64.rs @@ -0,0 +1,104 @@ +use core::ops::{Add, Mul}; + +use aead::{consts::U16, generic_array::GenericArray}; + +use super::{utils::bmul64, GfElement}; + +#[derive(Copy, Clone, Debug, Default, Eq, PartialEq)] +pub struct Element(u64, u64); + +type Block = GenericArray; + +impl GfElement for Element { + type N = U16; + + #[inline(always)] + fn new() -> Self { + Self(0, 0) + } + + #[inline(always)] + fn into_bytes(self) -> Block { + let mut block = Block::default(); + block[8..].copy_from_slice(&self.0.to_le_bytes()); + block[..8].copy_from_slice(&self.1.to_le_bytes()); + block + } + + #[allow(clippy::many_single_char_names)] + fn mul_sum(&mut self, a: &Block, b: &Block) { + let [a1, a0] = from_block(a); + let [b1, b0] = from_block(b); + + let a2 = a1 ^ a0; + let b2 = b1 ^ b0; + + // Multiply using Karatsuba multiplication + let c = bmul64(a1, b1); + let d = bmul64(a0, b0); + let e = bmul64(a2, b2); + let t = c ^ d ^ e; + let v0 = d as u64; + let v1 = ((d >> 64) ^ t) as u64; + let v2 = (c ^ (t >> 64)) as u64; + let v3 = (c >> 64) as u64; + + // reduce over polynominal f(w) = w^128 + w^7 + w^2 + w + 1 + let d = v2 ^ (v3 >> 63) ^ (v3 >> 62) ^ (v3 >> 57); + self.1 ^= v0 ^ d ^ (d << 1) ^ (d << 2) ^ (d << 7); + self.0 ^= v1 ^ v3 ^ (v3 << 1) ^ (v3 << 2) ^ (v3 << 7) ^ (d >> 63) ^ (d >> 62) ^ (d >> 57); + } +} + +impl From for Element { + fn from(x: u128) -> Self { + Self((x >> 64) as u64, x as u64) + } +} + +impl From for Element { + fn from(block: Block) -> Self { + let [a, b] = from_block(&block); + Self(a, b) + } +} + +impl From for Block { + fn from(element: Element) -> Self { + element.into_bytes() + } +} + +impl From<&Block> for Element { + fn from(block: &Block) -> Self { + let [a, b] = from_block(block); + Self(a, b) + } +} + +#[inline(always)] +fn from_block(block: &Block) -> [u64; 2] { + let (a, b) = block.split_at(8); + [ + u64::from_le_bytes(b.try_into().unwrap()), + u64::from_le_bytes(a.try_into().unwrap()), + ] +} + +impl Add for Element { + type Output = Self; + + fn add(self, rhs: Self) -> Self { + Self(self.0 ^ rhs.0, self.1 ^ rhs.1) + } +} + +impl Mul for Element { + type Output = Self; + + fn mul(self, rhs: Self) -> Self { + let mut res = Self::new(); + res.mul_sum(&self.into_bytes(), &rhs.into_bytes()); + res + } +} diff --git a/belt-dwp/src/gf/utils.rs b/belt-dwp/src/gf/utils.rs new file mode 100644 index 00000000..0c7b7f97 --- /dev/null +++ b/belt-dwp/src/gf/utils.rs @@ -0,0 +1,30 @@ +#![allow(unused)] +use core::num::Wrapping; + +/// Multiplication in GF(2)[X], truncated to the low 64-bits, with β€œholes” +/// (sequences of zeroes) to avoid carry spilling. +/// +/// When carries do occur, they wind up in a "hole" and are subsequently masked +/// out of the result. +pub(super) fn bmul64(x: u64, y: u64) -> u128 { + let x0 = Wrapping((x & 0x1111_1111_1111_1111) as u128); + let x1 = Wrapping((x & 0x2222_2222_2222_2222) as u128); + let x2 = Wrapping((x & 0x4444_4444_4444_4444) as u128); + let x3 = Wrapping((x & 0x8888_8888_8888_8888) as u128); + let y0 = Wrapping((y & 0x1111_1111_1111_1111) as u128); + let y1 = Wrapping((y & 0x2222_2222_2222_2222) as u128); + let y2 = Wrapping((y & 0x4444_4444_4444_4444) as u128); + let y3 = Wrapping((y & 0x8888_8888_8888_8888) as u128); + + let mut z0 = ((x0 * y0) ^ (x1 * y3) ^ (x2 * y2) ^ (x3 * y1)).0; + let mut z1 = ((x0 * y1) ^ (x1 * y0) ^ (x2 * y3) ^ (x3 * y2)).0; + let mut z2 = ((x0 * y2) ^ (x1 * y1) ^ (x2 * y0) ^ (x3 * y3)).0; + let mut z3 = ((x0 * y3) ^ (x1 * y2) ^ (x2 * y1) ^ (x3 * y0)).0; + + z0 &= 0x1111_1111_1111_1111_1111_1111_1111_1111; + z1 &= 0x2222_2222_2222_2222_2222_2222_2222_2222; + z2 &= 0x4444_4444_4444_4444_4444_4444_4444_4444; + z3 &= 0x8888_8888_8888_8888_8888_8888_8888_8888; + + z0 | z1 | z2 | z3 +} diff --git a/belt-dwp/src/ghash.rs b/belt-dwp/src/ghash.rs new file mode 100644 index 00000000..306af3ad --- /dev/null +++ b/belt-dwp/src/ghash.rs @@ -0,0 +1,82 @@ +use aead::{ + consts::U16, + KeyInit, + KeySizeUser, + consts::U1 +}; +use belt_block::cipher::{BlockSizeUser, ParBlocksSizeUser}; +use universal_hash::{Reset, UhfBackend, UhfClosure, UniversalHash}; + +use crate::gf::gf128_soft64::Element; + +/// GHASH keys (16-bytes) +pub type Key = universal_hash::Key; + +/// GHASH blocks (16-bytes) +pub type Block = universal_hash::Block; + +/// GHASH tags (16-bytes) +pub type Tag = universal_hash::Block; + +#[derive(Clone)] +pub(crate) struct GHash { + s: Element, + h: Element, +} + +impl KeySizeUser for GHash { + type KeySize = U16; +} + +impl BlockSizeUser for GHash { + type BlockSize = U16; +} + +impl KeyInit for GHash { + fn new(h: &Key) -> Self { + Self::new_with_init_block(h, 0) + } +} + +impl GHash { + pub(crate) fn new_with_init_block(h: &Key, s: u128) -> Self { + Self { + s: Element::from(s), + h: Element::from(h), + } + } + + pub(crate) fn xor_s(&mut self, x: &Block) { + self.s = self.s + Element::from(x); + } +} + +impl ParBlocksSizeUser for GHash { + type ParBlocksSize = U1; +} + +impl UhfBackend for GHash { + fn proc_block(&mut self, x: &Block) { + self.s = (self.s + Element::from(x)) * self.h; + } +} + +impl UniversalHash for GHash { + fn update_with_backend(&mut self, f: impl UhfClosure) { + f.call(self) + } + + /// Get GHASH output + #[inline] + fn finalize(self) -> Tag { + (self.s * self.h).into() + } +} + +impl Reset for GHash { + fn reset(&mut self) { + self.s = Element::default(); + } +} + +opaque_debug::implement!(GHash); diff --git a/belt-dwp/src/lib.rs b/belt-dwp/src/lib.rs new file mode 100644 index 00000000..62511f83 --- /dev/null +++ b/belt-dwp/src/lib.rs @@ -0,0 +1,268 @@ +#![no_std] +#![cfg_attr(docsrs, feature(doc_cfg))] +#![doc = include_str!("../README.md")] +#![doc( + html_logo_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg", + html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg" +)] +#![warn(missing_docs, rust_2018_idioms)] + +//! # Usage +//! +//! Simple usage (allocating, no associated data): +//! +#![cfg_attr(all(feature = "getrandom", feature = "std"), doc = "```")] +#![cfg_attr(not(all(feature = "getrandom", feature = "std")), doc = "```ignore")] +//! # fn main() -> Result<(), Box> { +//! use belt_dwp::{ +//! aead::{Aead, AeadCore, KeyInit, OsRng}, +//! BeltDwp, Nonce +//! }; +//! +//! let key = BeltDwp::generate_key()?; +//! let cipher = BeltDwp::new(&key); +//! let nonce = BeltDwp::generate_nonce()?; // 96-bits; unique per message +//! let ciphertext = cipher.encrypt(&nonce, b"plaintext message".as_ref())?; +//! let plaintext = cipher.decrypt(&nonce, ciphertext.as_ref())?; +//! assert_eq!(&plaintext, b"plaintext message"); +//! # Ok(()) +//! # } +//! ``` +//! +//! ## In-place Usage (eliminates `alloc` requirement) +//! +//! This crate has an optional `alloc` feature which can be disabled in e.g. +//! microcontroller environments that don't have a heap. +//! +//! The [`AeadInPlace::encrypt_in_place`] and [`AeadInPlace::decrypt_in_place`] +//! methods accept any type that impls the [`aead::Buffer`] trait which +//! contains the plaintext for encryption or ciphertext for decryption. +//! +//! Note that if you enable the `heapless` feature of this crate, +//! you will receive an impl of [`aead::Buffer`] for `heapless::Vec` +//! (re-exported from the [`aead`] crate as [`aead::heapless::Vec`]), +//! which can then be passed as the `buffer` parameter to the in-place encrypt +//! and decrypt methods: +//! +#![cfg_attr( + all(feature = "getrandom", feature = "heapless", feature = "std"), + doc = "```" +)] +#![cfg_attr( + not(all(feature = "getrandom", feature = "heapless", feature = "std")), + doc = "```ignore" +)] +//! # fn main() -> Result<(), Box> { +//! use belt_dwp::{ +//! aead::{AeadInPlace, KeyInit, OsRng, heapless::Vec}, +//! BeltDwp, Nonce +//! }; +//! +//! let key = BeltDwp::generate_key()?; +//! let cipher = BeltDwp::new(&key); +//! let nonce = Nonce::from_slice(b"unique nonce"); // 96-bits; unique per message +//! +//! let mut buffer: Vec = Vec::new(); // Note: buffer needs 16-bytes overhead for auth tag +//! buffer.extend_from_slice(b"plaintext message"); +//! +//! // Encrypt `buffer` in-place, replacing the plaintext contents with ciphertext +//! cipher.encrypt_in_place(nonce, b"", &mut buffer)?; +//! +//! // `buffer` now contains the message ciphertext +//! assert_ne!(&buffer, b"plaintext message"); +//! +//! // Decrypt `buffer` in-place, replacing its ciphertext context with the original plaintext +//! cipher.decrypt_in_place(nonce, b"", &mut buffer)?; +//! assert_eq!(&buffer, b"plaintext message"); +//! # Ok(()) +//! # } +//! ``` +//! +//! Similarly, enabling the `arrayvec` feature of this crate will provide an impl of +//! [`aead::Buffer`] for `arrayvec::ArrayVec` (re-exported from the [`aead`] crate as +//! [`aead::arrayvec::ArrayVec`]). + +pub use aead::{self, AeadCore, AeadInPlace, Error, Key, KeyInit, KeySizeUser}; +use aead:: { + consts::{U0, U16, U32, U8}, +}; + +use belt_block::{belt_block_raw, BeltBlock}; +use belt_ctr::BeltCtr; +use belt_block::cipher::{Block, BlockEncrypt, KeyIvInit, StreamCipher}; +use universal_hash::UniversalHash; + +use crate::{ + ghash::GHash, + utils::{from_u32, to_u32}, +}; + +/// Nonce type for [`BeltDwp`] +pub type Nonce = aead::Nonce; + +/// Tag type for [`BeltDwp`] +pub type Tag = aead::Tag; + +mod gf; +mod ghash; +mod utils; + +/// T from the STB 34.101.31-2020 +const T: u128 = 0xE45D4A588E006D363BF5080AC8BA94B1; + +/// Belt-DWP authenticated encryption with associated data (AEAD) cipher, defined in +/// STB 34.101.31-2020 +pub struct BeltDwp { + key: Key, +} + +impl KeySizeUser for BeltDwp { + type KeySize = U32; +} + +impl AeadInPlace for BeltDwp { + fn encrypt_in_place_detached( + &self, + nonce: &Nonce, + associated_data: &[u8], + buffer: &mut [u8], + ) -> aead::Result { + Cipher::new(self.key, nonce).encrypt_in_place_detached(associated_data, buffer) + } + + fn decrypt_in_place_detached( + &self, + nonce: &Nonce, + associated_data: &[u8], + buffer: &mut [u8], + tag: &Tag, + ) -> aead::Result<()> { + Cipher::new(self.key, nonce).decrypt_in_place_detached(associated_data, buffer, tag) + } +} + +struct Cipher { + enc_cipher: BeltCtr, + mac_cipher: BeltBlock, + ghash: GHash, +} + +impl Cipher { + fn new(key: Key, nonce: &Nonce) -> Self { + let cipher: BeltCtr = BeltCtr::new(&key, nonce); + + let _s = to_u32::<4>(nonce); + let _k = to_u32::<8>(&key); + // 2.1. 𝑠 ← belt-block(𝑆, 𝐾); + let s = belt_block_raw(_s, &_k); + // 2.2. π‘Ÿ ← belt-block(𝑠, 𝐾); + let r = from_u32::<16>(&belt_block_raw(s, &_k)); + + Self { + enc_cipher: cipher, + mac_cipher: BeltBlock::new(&key), + ghash: GHash::new_with_init_block(Key::::from_slice(&r), T), + } + } + + fn encrypt_in_place_detached( + &mut self, + associated_data: &[u8], + buffer: &mut [u8], + ) -> aead::Result { + let sizes_block = + get_sizes_block(associated_data.len() as u64 * 8, buffer.len() as u64 * 8); + + // 3. For 𝑖 = 1, 2, . . . , π‘š do: + // 3.1 𝑑 ← 𝑑 βŠ• (𝐼𝑖 β€– 0^{128βˆ’|𝐼𝑖|}) + // 3.2 𝑑 ← 𝑑 * π‘Ÿ. + self.ghash.update_padded(associated_data); + + // 4. For 𝑖 = 1, 2, . . . , 𝑛 do: + // 4.1 𝑠 ← 𝑠 ⊞ ⟨1⟩_128 + // 4.2 π‘Œπ‘– ← 𝑋𝑖 βŠ• Lo(belt-block(𝑠, 𝐾), |𝑋𝑖|) + // 4.3 𝑑 ← 𝑑 βŠ• (π‘Œπ‘– β€– 0^{128βˆ’|π‘Œπ‘–|}) + // 4.4 𝑑 ← 𝑑 * π‘Ÿ. + buffer.chunks_mut(16).for_each(|block| { + self.enc_cipher.apply_keystream(block); + self.ghash.update_padded(block); + }); + + // 5. 𝑑 ← 𝑑 βŠ• (⟨|𝐼|⟩_64 β€– ⟨|𝑋|⟩_64) + self.ghash.xor_s(&sizes_block); + + // 6. 𝑑 ← belt-block(𝑑 * π‘Ÿ, 𝐾). + let mut tag = self.finish_tag(); + + self.mac_cipher.encrypt_block(&mut tag); + + Ok(*Tag::from_slice(&tag[..8])) + } + + fn decrypt_in_place_detached( + &mut self, + associated_data: &[u8], + buffer: &mut [u8], + tag: &Tag, + ) -> aead::Result<()> { + let sizes_block = + get_sizes_block(associated_data.len() as u64 * 8, buffer.len() as u64 * 8); + + // 3. For 𝑖 = 1, 2, . . . , π‘š do: + // 3.1 𝑑 ← 𝑑 βŠ• (𝐼𝑖 β€– 0^{128βˆ’|𝐼𝑖|}) + // 3.2 𝑑 ← 𝑑 * π‘Ÿ. + self.ghash.update_padded(associated_data); + // 4. For 𝑖 = 1, 2, . . . , 𝑛 do: + // 4.1 𝑑 ← 𝑑 βŠ• (π‘Œπ‘– β€– 0^{128βˆ’|π‘Œπ‘–|}) + // 4.2 𝑑 ← 𝑑 * π‘Ÿ. + self.ghash.update_padded(buffer); + + // 5. 𝑑 ← 𝑑 βŠ• (⟨|𝐼|⟩_64 β€– ⟨|𝑋|⟩_64) + self.ghash.xor_s(&sizes_block); + + let mut tag_exact = self.finish_tag(); + + // 6. 𝑑 ← belt-block(𝑑 * π‘Ÿ, 𝐾). + self.mac_cipher.encrypt_block(&mut tag_exact); + + // 7. If 𝑇 != Lo(𝑑, 64), return βŠ₯ + if tag_exact[..8] != tag[..] { + return Err(aead::Error); + } + + // 8. For 𝑖 = 1,2,...,𝑛 do: + // 8.1. 𝑠 ← 𝑠 ⊞ ⟨1⟩128; + // 8.2. 𝑋𝑖 ← π‘Œπ‘– βŠ• Lo(belt-block(𝑠, 𝐾), |π‘Œπ‘–|) + buffer.chunks_mut(16).for_each(|block| { + self.enc_cipher.apply_keystream(block); + }); + + Ok(()) + } + + pub(crate) fn finish_tag(&mut self) -> Block { + self.ghash.finalize_reset() + } +} + +impl KeyInit for BeltDwp { + fn new(key: &Key) -> Self { + Self { key: *key } + } +} + +impl AeadCore for BeltDwp { + type NonceSize = U16; + type TagSize = U8; + type CiphertextOverhead = U0; +} + +/// Get the sizes block for the GHASH +fn get_sizes_block(plain_cnt: u64, sec_cnt: u64) -> Block { + let mut sizes_block: Block = Default::default(); + + sizes_block[..8].copy_from_slice(&plain_cnt.to_le_bytes()); + sizes_block[8..].copy_from_slice(&sec_cnt.to_le_bytes()); + + sizes_block +} diff --git a/belt-dwp/src/utils.rs b/belt-dwp/src/utils.rs new file mode 100644 index 00000000..8bec06fa --- /dev/null +++ b/belt-dwp/src/utils.rs @@ -0,0 +1,29 @@ +/// Helper function for transforming BelT keys and blocks from a byte array +/// to an array of `u32`s. +/// +/// # Panics +/// If length of `src` is not equal to `4 * N`. +// #[inline(always)] +pub(crate) fn to_u32(src: &[u8]) -> [u32; N] { + assert_eq!(src.len(), 4 * N); + let mut res = [0u32; N]; + res.iter_mut() + .zip(src.chunks_exact(4)) + .for_each(|(dst, src)| *dst = u32::from_le_bytes(src.try_into().unwrap())); + res +} + +/// Helper function for transforming BelT keys and blocks from a array of `u32`s +/// to a byte array. +/// +/// # Panics +/// If length of `src` is not equal to `4 * N`. +// #[inline(always)] +pub(crate) fn from_u32(src: &[u32]) -> [u8; N] { + assert_eq!(N, 4 * src.len()); + let mut res = [0u8; N]; + src.iter() + .zip(res.chunks_exact_mut(4)) + .for_each(|(src, dst)| dst.copy_from_slice(&src.to_le_bytes())); + res +} diff --git a/belt-dwp/tests/belt.rs b/belt-dwp/tests/belt.rs new file mode 100644 index 00000000..ad4dc06f --- /dev/null +++ b/belt-dwp/tests/belt.rs @@ -0,0 +1,47 @@ +use aead::AeadInPlace; +use hex_literal::hex; +use belt_dwp::{BeltDwp, KeyInit}; + +/// Test from Appendix A, tables 19-20 of [STB 34.101.31-2020](https://apmi.bsu.by/assets/files/std/belt-spec372.pdf) +#[test] +fn test_belt_dwp() { + struct TestVector { + i: [u8; 32], + k: [u8; 32], + s: [u8; 16], + x: [u8; 16], + y: [u8; 16], + t: [u8; 8], + } + + let test_vectors = [ + TestVector { + i: hex!("8504FA9D 1BB6C7AC 252E72C2 02FDCE0D 5BE3D612 17B96181 FE6786AD 716B890B"), + k: hex!("E9DEE72C 8F0C0FA6 2DDB49F4 6F739647 06075316 ED247A37 39CBA383 03A98BF6"), + s: hex!("BE329713 43FC9A48 A02A885F 194B09A1"), + x: hex!("B194BAC8 0A08F53B 366D008E 584A5DE4"), + y: hex!("52C9AF96 FF50F644 35FC43DE F56BD797"), + t: hex!("3B2E0AEB 2B91854B"), + }, + TestVector { + i: hex!("C1AB7638 9FE678CA F7C6F860 D5BB9C4F F33C657B 637C306A DD4EA779 9EB23D31"), + k: hex!("92BD9B1C E5D14101 5445FBC9 5E4D0EF2 682080AA 227D642F 2687F934 90405511"), + s: hex!("7ECDA4D0 1544AF8C A58450BF 66D2E88A"), + x: hex!("DF181ED0 08A20F43 DCBBB936 50DAD34B"), + y: hex!("E12BDC1A E28257EC 703FCCF0 95EE8DF1"), + t: hex!("6A2C2C94 C4150DC0"), + } + ]; + + for vec in test_vectors { + let mut x = vec.x; + let beltdwp = BeltDwp::new_from_slice(&vec.k).unwrap(); + let tag = beltdwp.encrypt_in_place_detached(&vec.s.into(), &vec.i, &mut x); + assert_eq!(vec.t, *tag.unwrap()); + assert_eq!(vec.y, x); + beltdwp + .decrypt_in_place_detached(&vec.s.into(), &vec.i, &mut x, &tag.unwrap()) + .unwrap(); + assert_eq!(x, vec.x); + } +} \ No newline at end of file