2 * eax-transform.c: EAX-Serpent bulk data transformation
4 * We use EAX with the following parameters:
8 * Data packet as supplied to us
9 * Zero or more zero bytes ignored by receiver } padding
10 * One byte padding length }
11 * This is a bit like PKCS#5. It helps disguise message lengths.
12 * It also provides a further room for future expansion. When
13 * transmitting we pad the message to the next multiple of
14 * a configurable rounding factor, 16 bytes by default.
16 * Transmitted message:
19 * 32-bit sequence number (initially zero)
20 * The sequence number allows us to discard far-too-old
25 * 32-bit sequence number (big endian)
26 * initial value comes from SHA-512 hash (see below)
27 * 1 byte: 0x01 if sender has setup priority, 0x00 if it doesn't
28 * (ie, the direction of data flow)
33 * 16 bytes (128 bits) by default
36 * The first 32 bytes of the SHA-512 hash of the shared secret
37 * from the DH key exchange (the latter being expressed as
38 * the shortest possible big-endian octet string).
40 * The bytes [32,40> of the hash of the shared secret are used for
41 * initial sequence numbers: [32,36> for those sent by the end without
42 * setup priority, [36,40> for those for the other end.
47 #include "unaligned.h"
51 #include "transform-common.h"
57 struct transform_params
{
58 uint32_t max_seq_skew
, tag_length
, padding_mask
;
63 struct transform_if ops
;
64 struct transform_params p
;
67 struct transform_inst
{
68 struct transform_inst_if ops
;
69 struct transform_params p
;
71 /* remaining valid iff keyed */
75 struct keyInstance key
;
76 uint8_t info_b
[BLOCK_SIZE
], info_p
[BLOCK_SIZE
];
79 static void block_encrypt(struct transform_inst
*transform_inst
,
80 uint8_t dst
[BLOCK_SIZE
],
81 const uint8_t src
[BLOCK_SIZE
])
83 serpent_encrypt(&transform_inst
->key
, src
, dst
);
86 #define INFO struct transform_inst *transform_inst
87 #define I transform_inst
88 #define EAX_ENTRYPOINT_DECL static
89 #define BLOCK_ENCRYPT(dst,src) block_encrypt(transform_inst,dst,src)
90 #define INFO_B (transform_inst->info_b)
91 #define INFO_P (transform_inst->info_p)
97 #define TEAX_DEBUG(ary,sz) teax_debug(__func__,__LINE__,#ary,#sz,ary,sz)
98 static void teax_debug(const char *func
, int line
,
99 const char *aryp
, const char *szp
,
100 const void *ary
, size_t sz
)
102 fprintf(stderr
,"TEAX %s:%-3d %10s %15s : ", func
,line
,aryp
,szp
);
103 hexdebug(stderr
,ary
,sz
);
104 fprintf(stderr
,"\n");
109 #define TEAX_DEBUG(ary,sz) /* empty */
113 static bool_t
transform_setkey(void *sst
, uint8_t *key
, int32_t keylen
,
116 struct transform_inst
*ti
=sst
;
117 struct sha512_ctx hash_ctx
;
118 uint8_t hash_out
[64];
120 TEAX_DEBUG(key
,keylen
);
122 sha512_init_ctx(&hash_ctx
);
123 sha512_process_bytes(key
, keylen
, &hash_ctx
);
124 sha512_finish_ctx(&hash_ctx
, hash_out
);
126 TEAX_DEBUG(hash_out
,32);
127 TEAX_DEBUG(hash_out
+32,8);
129 ti
->direction
=direction
;
130 ti
->sendseq
=get_uint32(hash_out
+32+direction
*4);
131 ti
->lastrecvseq
=get_uint32(hash_out
+32+!direction
*4);
132 serpent_makekey(&ti
->key
, 32*8, hash_out
);
143 static void transform_delkey(void *sst
)
145 struct transform_inst
*ti
=sst
;
148 FILLZERO(ti
->info_b
);
149 FILLZERO(ti
->info_p
);
153 static uint32_t transform_forward(void *sst
, struct buffer_if
*buf
,
156 struct transform_inst
*ti
=sst
;
160 size_t padlen
= ti
->p
.padding_mask
- buf
->size
;
161 padlen
&= ti
->p
.padding_mask
;
164 uint8_t *pad
= buf_append(buf
,padlen
);
165 memset(pad
, 0, padlen
-1);
166 pad
[padlen
-1] = padlen
;
168 uint8_t nonce
[SEQLEN
+1];
169 put_uint32(nonce
,ti
->sendseq
);
170 nonce
[SEQLEN
] = ti
->direction
;
172 TEAX_DEBUG(nonce
,sizeof(nonce
));
173 TEAX_DEBUG(buf
->start
,buf
->size
);
175 assert(buf_append(buf
,ti
->p
.tag_length
));
176 eax_encrypt(ti
, nonce
,sizeof(nonce
), 0,0,
177 buf
->start
,buf
->size
-ti
->p
.tag_length
,
178 ti
->p
.tag_length
, buf
->start
);
180 TEAX_DEBUG(buf
->start
,buf
->size
);
182 memcpy(buf_append(buf
,SEQLEN
), nonce
, SEQLEN
);
184 TEAX_DEBUG(nonce
,SEQLEN
);
191 static uint32_t transform_reverse(void *sst
, struct buffer_if
*buf
,
194 struct transform_inst
*ti
=sst
;
198 TEAX_DEBUG(buf
->start
,buf
->size
);
200 uint8_t nonce
[SEQLEN
+1];
201 const uint8_t *seqp
= buf_unappend(buf
,SEQLEN
);
202 if (!seqp
) goto too_short
;
204 TEAX_DEBUG(seqp
,SEQLEN
);
206 uint32_t seqnum
= get_uint32(seqp
);
208 memcpy(nonce
,seqp
,SEQLEN
);
209 nonce
[4] = !ti
->direction
;
211 TEAX_DEBUG(nonce
,sizeof(nonce
));
212 TEAX_DEBUG(buf
->start
,buf
->size
);
214 bool_t ok
= eax_decrypt(ti
, nonce
,sizeof(nonce
), 0,0, buf
->start
,buf
->size
,
215 ti
->p
.tag_length
, buf
->start
);
218 *errmsg
="EAX decryption failed";
221 assert(buf
->size
>= (int)ti
->p
.tag_length
);
222 buf
->size
-= ti
->p
.tag_length
;
224 TEAX_DEBUG(buf
->start
,buf
->size
);
226 const uint8_t *padp
= buf_unappend(buf
,1);
227 if (!padp
) goto too_short
;
231 size_t padlen
= *padp
;
232 if (!buf_unappend(buf
,padlen
-1)) goto too_short
;
234 SEQNUM_CHECK(seqnum
, ti
->p
.max_seq_skew
);
236 TEAX_DEBUG(buf
->start
,buf
->size
);
241 *errmsg
="ciphertext or plaintext too short";
245 static struct transform_inst_if
*transform_create(void *sst
)
247 struct transform
*st
=sst
;
249 TRANSFORM_CREATE_CORE
;
256 static list_t
*transform_apply(closure_t
*self
, struct cloc loc
,
257 dict_t
*context
, list_t
*args
)
259 struct transform
*st
;
263 st
=safe_malloc(sizeof(*st
),"eax-serpent");
264 st
->cl
.description
="eax-serpent";
265 st
->cl
.type
=CL_TRANSFORM
;
267 st
->cl
.interface
=&st
->ops
;
270 /* First parameter must be a dict */
271 item
=list_elem(args
,0);
272 if (!item
|| item
->type
!=t_dict
)
273 cfgfatal(loc
,"eax-serpent","parameter must be a dictionary\n");
274 dict
=item
->data
.dict
;
276 st
->p
.max_seq_skew
=dict_read_number(dict
, "max-sequence-skew",
277 False
, "eax-serpent", loc
, 10);
279 st
->p
.tag_length
=dict_read_number(dict
, "tag-length-bytes",
280 False
, "eax-serpent", loc
, 128/8);
281 if (st
->p
.tag_length
<1 || st
->p
.tag_length
>BLOCK_SIZE
)
282 cfgfatal(loc
,"eax-serpent","tag-length-bytes out of range 0..%d\n",
285 uint32_t padding_round
=dict_read_number(dict
, "padding-rounding",
286 False
, "eax-serpent", loc
, 16);
287 if (padding_round
& (padding_round
-1))
288 cfgfatal(loc
,"eax-serpent","padding-round not a power of two\n");
289 if (padding_round
> 255)
290 cfgfatal(loc
,"eax-serpent","padding-round must be 1..128\n");
291 if (padding_round
== 0)
293 st
->p
.padding_mask
= padding_round
-1;
295 st
->ops
.max_start_pad
=0;
296 st
->ops
.max_end_pad
= padding_round
+ st
->p
.tag_length
+ SEQLEN
;
299 st
->ops
.create
=transform_create
;
301 return new_closure(&st
->cl
);
304 void transform_eax_module(dict_t
*dict
)
306 add_closure(dict
,"eax-serpent",transform_apply
);