eax: Introduce a streaming variant

eax/Cargo.toml

@@ -31,6 +31,7 @@ aead = { version = "0.3", features = ["dev"], default-features = false }
 
 [features]
 default = ["alloc"]
+std = ["aead/std"]
 alloc = ["aead/alloc"]
 heapless = ["aead/heapless"]
 

eax/src/lib.rs

@@ -78,6 +78,9 @@
 #![deny(unsafe_code)]
 #![warn(missing_docs, rust_2018_idioms)]
 
+#[cfg(feature = "std")]
+extern crate std;
+
 pub use aead::{self, AeadInPlace, Error, NewAead};
 
 use block_cipher::{
@@ -103,6 +106,8 @@ pub const C_MAX: u64 = (1 << 36) + 16;
 /// EAX tags
 pub type Tag = GenericArray<u8, U16>;
 
+pub mod stream;
+
 /// EAX: generic over an underlying block cipher implementation.
 ///
 /// This type is generic to support substituting alternative cipher
@@ -146,31 +151,18 @@ where
  associated_data: &[u8],
  buffer: &mut [u8],
  ) -> Result<Tag, Error> {
+ use stream::{EaxStream, Encrypt};
+
  if buffer.len() as u64 > P_MAX || associated_data.len() as u64 > A_MAX {
  return Err(Error);
  }
 
- // https://crypto.stackexchange.com/questions/26948/eax-cipher-mode-with-nonce-equal-header
- // has an explanation of eax.
-
- // l = block cipher size = 128 (for AES-128) = 16 byte
- // 1. n ← OMAC(0 || Nonce)
- // (the 0 means the number zero in l bits)
- let n = Self::cmac_with_iv(&self.key, 0, nonce);
-
- // 2. h ← OMAC(1 || associated data)
- let h = Self::cmac_with_iv(&self.key, 1, associated_data);
+ let mut eax = EaxStream::<Cipher, Encrypt>::with_key_and_nonce(&self.key, nonce);
 
- // 3. enc ← CTR(M) using n as iv
- let mut cipher = ctr::Ctr128::<Cipher>::from_block_cipher(Cipher::new(&self.key), &n);
- cipher.apply_keystream(buffer);
+ eax.update_assoc(associated_data);
+ eax.encrypt(buffer);
 
- // 4. c ← OMAC(2 || enc)
- let c = Self::cmac_with_iv(&self.key, 2, buffer);
-
- // 5. tag ← n ^ h ^ c
- // (^ means xor)
- Ok(n.zip(h, |a, b| a ^ b).zip(c, |a, b| a ^ b))
+ Ok(eax.finish())
  }
 
  fn decrypt_in_place_detached(
@@ -180,57 +172,17 @@ where
  buffer: &mut [u8],
  tag: &Tag,
  ) -> Result<(), Error> {
+ use stream::{Decrypt, EaxStream};
+
  if buffer.len() as u64 > C_MAX || associated_data.len() as u64 > A_MAX {
  return Err(Error);
  }
 
- // 1. n ← OMAC(0 || Nonce)
- let n = Self::cmac_with_iv(&self.key, 0, nonce);
-
- // 2. h ← OMAC(1 || associated data)
- let h = Self::cmac_with_iv(&self.key, 1, associated_data);
-
- // 4. c ← OMAC(2 || enc)
- let c = Self::cmac_with_iv(&self.key, 2, buffer);
+ let mut eax = EaxStream::<Cipher, Decrypt>::with_key_and_nonce(&self.key, nonce);
 
- // 5. tag ← n ^ h ^ c
- // (^ means xor)
- let expected_tag = n.zip(h, |a, b| a ^ b).zip(c, |a, b| a ^ b);
+ eax.update_assoc(associated_data);
+ eax.decrypt(buffer);
 
- let expected_tag = &expected_tag[..tag.len()];
-
- // Check mac using secure comparison
- use subtle::ConstantTimeEq;
- if expected_tag.ct_eq(tag).unwrap_u8() == 1 {
- // Decrypt
- let mut cipher = ctr::Ctr128::<Cipher>::from_block_cipher(Cipher::new(&self.key), &n);
- cipher.apply_keystream(buffer);
- Ok(())
- } else {
- Err(Error)
- }
- }
-}
-
-impl<Cipher> Eax<Cipher>
-where
- Cipher: BlockCipher<BlockSize = U16> + NewBlockCipher + Clone,
- Cipher::ParBlocks: ArrayLength<Block<Cipher>>,
-{
- /// CMAC/OMAC1
- ///
- /// To avoid constructing new buffers on the heap, an iv encoded into 16
- /// bytes is prepended inside this function.
- fn cmac_with_iv(
- key: &GenericArray<u8, Cipher::KeySize>,
- iv: u8,
- data: &[u8],
- ) -> GenericArray<u8, <Cmac<Cipher> as Mac>::OutputSize> {
- let mut mac = Cmac::<Cipher>::new(key);
- mac.update(&[0; 15]);
- mac.update(&[iv]);
- mac.update(data);
-
- mac.finalize().into_bytes()
+ eax.finish(tag)
  }
 }