2 * eax-transform.c: EAX-Serpent bulk data transformation
4 * We use EAX with the following parameters:
8 * Data packet as supplied to us
9 * Zero or more zero bytes ignored by receiver } padding
10 * One byte padding length }
11 * This is a bit like PKCS#5. It helps disguise message lengths.
12 * It also provides a further room for future expansion. When
13 * transmitting we pad the message to the next multiple of
14 * a configurable rounding factor, 16 bytes by default.
16 * Transmitted message:
19 * 32-bit sequence number (initially zero)
20 * The sequence number allows us to discard far-too-old
25 * 32-bit sequence number (big endian)
26 * initial value comes from SHA-512 hash (see below)
27 * 1 byte: 0x01 if sender has setup priority, 0x00 if it doesn't
28 * (ie, the direction of data flow)
33 * 16 bytes (128 bits) by default
36 * The first 32 bytes of the SHA-512 hash of the shared secret
37 * from the DH key exchange (the latter being expressed as
38 * the shortest possible big-endian octet string).
40 * The bytes [32,40> of the hash of the shared secret are used for
41 * initial sequence numbers: [32,36> for those sent by the end without
42 * setup priority, [36,40> for those for the other end.
47 #include "unaligned.h"
51 #include "transform-common.h"
57 struct transform_params {
59 uint32_t tag_length, padding_mask;
64 struct transform_if ops;
65 struct transform_params p;
68 struct transform_inst {
69 struct transform_inst_if ops;
70 struct transform_params p;
71 /* remaining valid iff keyed */
74 struct keyInstance key;
75 uint8_t info_b[BLOCK_SIZE], info_p[BLOCK_SIZE];
78 static void block_encrypt(struct transform_inst *transform_inst,
79 uint8_t dst[BLOCK_SIZE],
80 const uint8_t src[BLOCK_SIZE])
82 serpent_encrypt(&transform_inst->key, src, dst);
85 #define INFO struct transform_inst *transform_inst
86 #define I transform_inst
87 #define EAX_ENTRYPOINT_DECL static
88 #define BLOCK_ENCRYPT(dst,src) block_encrypt(transform_inst,dst,src)
89 #define INFO_B (transform_inst->info_b)
90 #define INFO_P (transform_inst->info_p)
96 #define TEAX_DEBUG(ary,sz) teax_debug(__func__,__LINE__,#ary,#sz,ary,sz)
97 static void teax_debug(const char *func, int line,
98 const char *aryp, const char *szp,
99 const void *ary, size_t sz)
101 fprintf(stderr,"TEAX %s:%-3d %10s %15s : ", func,line,aryp,szp);
102 hexdebug(stderr,ary,sz);
103 fprintf(stderr,"\n");
108 #define TEAX_DEBUG(ary,sz) /* empty */
112 static bool_t transform_setkey(void *sst, uint8_t *key, int32_t keylen,
115 struct transform_inst *ti=sst;
116 struct sha512_ctx hash_ctx;
117 uint8_t hash_out[64];
119 TEAX_DEBUG(key,keylen);
121 sha512_init_ctx(&hash_ctx);
122 sha512_process_bytes(key, keylen, &hash_ctx);
123 sha512_finish_ctx(&hash_ctx, hash_out);
125 TEAX_DEBUG(hash_out,32);
126 TEAX_DEBUG(hash_out+32,8);
128 ti->direction=direction;
129 serpent_makekey(&ti->key, 32*8, hash_out);
131 SEQNUM_KEYED_INIT(get_uint32(hash_out+32+!direction*4),
132 get_uint32(hash_out+32+direction*4));
141 static void transform_delkey(void *sst)
143 struct transform_inst *ti=sst;
146 FILLZERO(ti->info_b);
147 FILLZERO(ti->info_p);
151 static uint32_t transform_forward(void *sst, struct buffer_if *buf,
154 struct transform_inst *ti=sst;
158 size_t padlen = ti->p.padding_mask - buf->size;
159 padlen &= ti->p.padding_mask;
162 uint8_t *pad = buf_append(buf,padlen);
163 memset(pad, 0, padlen-1);
164 pad[padlen-1] = padlen;
166 uint8_t nonce[SEQLEN+1];
167 put_uint32(nonce,ti->sendseq);
168 nonce[SEQLEN] = ti->direction;
170 TEAX_DEBUG(nonce,sizeof(nonce));
171 TEAX_DEBUG(buf->start,buf->size);
173 assert(buf_append(buf,ti->p.tag_length));
174 eax_encrypt(ti, nonce,sizeof(nonce), 0,0,
175 buf->start,buf->size-ti->p.tag_length,
176 ti->p.tag_length, buf->start);
178 TEAX_DEBUG(buf->start,buf->size);
180 BUF_ADD_BYTES(append,buf,nonce,SEQLEN);
182 TEAX_DEBUG(nonce,SEQLEN);
189 static uint32_t transform_reverse(void *sst, struct buffer_if *buf,
192 struct transform_inst *ti=sst;
196 TEAX_DEBUG(buf->start,buf->size);
198 uint8_t nonce[SEQLEN+1];
199 const uint8_t *seqp = buf_unappend(buf,SEQLEN);
200 if (!seqp) goto too_short;
202 TEAX_DEBUG(seqp,SEQLEN);
204 uint32_t seqnum = get_uint32(seqp);
206 memcpy(nonce,seqp,SEQLEN);
207 nonce[4] = !ti->direction;
209 TEAX_DEBUG(nonce,sizeof(nonce));
210 TEAX_DEBUG(buf->start,buf->size);
212 bool_t ok = eax_decrypt(ti, nonce,sizeof(nonce), 0,0, buf->start,buf->size,
213 ti->p.tag_length, buf->start);
216 *errmsg="EAX decryption failed";
219 assert(buf->size >= (int)ti->p.tag_length);
220 buf->size -= ti->p.tag_length;
222 TEAX_DEBUG(buf->start,buf->size);
224 const uint8_t *padp = buf_unappend(buf,1);
225 if (!padp) goto too_short;
229 size_t padlen = *padp;
230 if (!buf_unappend(buf,padlen-1)) goto too_short;
232 SEQNUM_CHECK(seqnum, &ti->p);
234 TEAX_DEBUG(buf->start,buf->size);
239 *errmsg="ciphertext or plaintext too short";
243 static struct transform_inst_if *transform_create(void *sst)
245 struct transform *st=sst;
247 TRANSFORM_CREATE_CORE;
254 static list_t *transform_apply(closure_t *self, struct cloc loc,
255 dict_t *context, list_t *args)
257 struct transform *st;
261 st=safe_malloc(sizeof(*st),"eax-serpent");
262 st->cl.description="eax-serpent";
263 st->cl.type=CL_TRANSFORM;
265 st->cl.interface=&st->ops;
268 /* First parameter must be a dict */
269 item=list_elem(args,0);
270 if (!item || item->type!=t_dict)
271 cfgfatal(loc,"eax-serpent","parameter must be a dictionary\n");
272 dict=item->data.dict;
274 SET_CAPAB_TRANSFORMNUM(CAPAB_TRANSFORMNUM_EAXSERPENT);
276 SEQNUM_PARAMS_INIT(dict,&st->p,"eax-serpent",loc);
278 st->p.tag_length=dict_read_number(dict, "tag-length-bytes",
279 False, "eax-serpent", loc, 128/8);
280 if (st->p.tag_length<1 || st->p.tag_length>BLOCK_SIZE)
281 cfgfatal(loc,"eax-serpent","tag-length-bytes out of range 0..%d\n",
284 uint32_t padding_round=dict_read_number(dict, "padding-rounding",
285 False, "eax-serpent", loc, 16);
286 if (padding_round & (padding_round-1))
287 cfgfatal(loc,"eax-serpent","padding-round not a power of two\n");
288 if (padding_round > 255)
289 cfgfatal(loc,"eax-serpent","padding-round must be 1..128\n");
290 if (padding_round == 0)
292 st->p.padding_mask = padding_round-1;
294 update_max_start_pad(&transform_max_start_pad, 0);
297 st->ops.create=transform_create;
299 return new_closure(&st->cl);
302 void transform_eax_module(dict_t *dict)
304 add_closure(dict,"eax-serpent",transform_apply);