Implement trait AeadInto for AES-GCM and ChaCha20-Poly1305

aes-gcm/src/lib.rs

@@ -108,7 +108,8 @@
 //! [`aead::Buffer`] for `arrayvec::ArrayVec` (re-exported from the [`aead`] crate as
 //! [`aead::arrayvec::ArrayVec`]).
 
-pub use aead::{self, AeadCore, AeadInPlace, Error, Key, KeyInit, KeySizeUser};
+pub use aead::{self, AeadCore, AeadInto, AeadInPlace, Error, Key, KeyInit, KeySizeUser};
+use ::cipher::inout::InOutBuf;
 
 #[cfg(feature = "aes")]
 pub use aes;
@@ -264,6 +265,63 @@ where
  type CiphertextOverhead = U0;
 }
 
+impl<Aes, NonceSize, TagSize> AeadInto for AesGcm<Aes, NonceSize, TagSize>
+where
+ Aes: BlockCipher + BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt,
+ NonceSize: ArraySize,
+ TagSize: self::TagSize,
+{
+ fn encrypt_into_detached(
+ &self,
+ nonce: &Nonce<NonceSize>,
+ plaintext: &[u8],
+ associated_data: &[u8],
+ ciphertext: &mut [u8],
+ ) -> Result<Tag<TagSize>, Error> {
+ if plaintext.len() as u64 > P_MAX || associated_data.len() as u64 > A_MAX {
+ return Err(Error);
+ }
+
+ let buffer = InOutBuf::new(plaintext, ciphertext).map_err(|_| Error)?;
+ let (ctr, mask) = self.init_ctr(nonce);
+
+ // TODO(tarcieri): interleave encryption with GHASH
+ // See: <https://github.com/RustCrypto/AEADs/issues/74>
+ ctr.apply_keystream_partial(buffer);
+
+ let full_tag = self.compute_tag(mask, associated_data, ciphertext);
+ Ok(Tag::try_from(&full_tag[..TagSize::to_usize()]).expect("tag size mismatch"))
+ }
+
+ fn decrypt_into_detached(
+ &self,
+ nonce: &Nonce<NonceSize>,
+ ciphertext: &[u8],
+ associated_data: &[u8],
+ plaintext: &mut [u8],
+ tag: &Tag<TagSize>,
+ ) -> Result<(), Error> {
+ if ciphertext.len() as u64 > C_MAX || associated_data.len() as u64 > A_MAX {
+ return Err(Error);
+ }
+
+ let buffer = InOutBuf::new(ciphertext, plaintext).map_err(|_| Error)?;
+ let (ctr, mask) = self.init_ctr(nonce);
+
+ // TODO(tarcieri): interleave encryption with GHASH
+ // See: <https://github.com/RustCrypto/AEADs/issues/74>
+ let expected_tag = self.compute_tag(mask, associated_data, ciphertext);
+
+ use subtle::ConstantTimeEq;
+ if expected_tag[..TagSize::to_usize()].ct_eq(tag).into() {
+ ctr.apply_keystream_partial(buffer);
+ Ok(())
+ } else {
+ Err(Error)
+ }
+ }
+}
+
 impl<Aes, NonceSize, TagSize> AeadInPlace for AesGcm<Aes, NonceSize, TagSize>
 where
  Aes: BlockCipher + BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt,

aes-gcm/tests/aead_into.rs

@@ -0,0 +1,52 @@
+use aes_gcm::aead::{ Aead, AeadInto, Payload };
+use aes_gcm::{ Aes256Gcm, KeyInit };
+
+
+/// Confirm that the [AeadInto] implementation produces exactly the same output as the [Aead]
+/// implementation.
+#[test]
+fn test_aeadinto() {
+ let key = [0x60, 0xaf, 0x5d, 0xe1, 0x8b, 0x63, 0xf8, 0xe3, 0xe9, 0xbc, 0xff, 0x93, 0xa1, 0xab, 0x69, 0x1c, 0x8c, 0x2a, 0x87, 0xb5, 0x35, 0xac, 0x2a, 0xa1, 0x4e, 0xba, 0xd1, 0xf1, 0x7d, 0x02, 0xff, 0x92];
+ let aad = [0xbc, 0xf7, 0x7c, 0x42, 0x96, 0xf4, 0x96, 0x63, 0x16, 0x70, 0x02, 0x4e, 0xb2, 0x70, 0xd5, 0x0d, 0x6d, 0xef, 0xa2, 0x82, 0x59, 0xf7, 0x74, 0x60, 0xfc, 0x15, 0x05, 0xa1, 0x4c, 0x97, 0x4d, 0x4c];
+ let data = [0xf6, 0xef, 0x21, 0x88, 0x8c, 0xfa, 0x75, 0x82, 0xda, 0x73, 0x7c, 0xad, 0x6a, 0x08, 0x64, 0x9b, 0xa3, 0x11, 0xfa, 0x27, 0x90, 0xdb, 0x74, 0x6f, 0xf0, 0x70, 0x57, 0xca, 0x15, 0xf8, 0xc8, 0x0a];
+
+ let mut trait_aeadinto_encrypted_output = [0u8; 32 + 16];
+ Aes256Gcm::new((&key).try_into().unwrap())
+ .encrypt_into(
+ (&[0u8; 12]).try_into().unwrap(),
+ &data,
+ &aad,
+ &mut trait_aeadinto_encrypted_output
+ ).unwrap();
+
+ let trait_aead_encrypted_output = Aes256Gcm::new((&key).try_into().unwrap())
+ .encrypt(
+ (&[0u8; 12]).try_into().unwrap(),
+ Payload {
+ msg: &data,
+ aad: &aad
+ }
+ ).unwrap();
+
+ assert_eq!(trait_aead_encrypted_output, trait_aeadinto_encrypted_output);
+
+ let mut trait_aeadinto_decrypted_output = [0u8; 32];
+ Aes256Gcm::new((&key).try_into().unwrap())
+ .decrypt_into(
+ (&[0u8; 12]).try_into().unwrap(),
+ &trait_aeadinto_encrypted_output,
+ &aad,
+ &mut trait_aeadinto_decrypted_output
+ ).unwrap();
+
+ let trait_aead_decrypted_output = Aes256Gcm::new((&key).try_into().unwrap())
+ .decrypt(
+ (&[0u8; 12]).try_into().unwrap(),
+ Payload {
+ msg: &trait_aeadinto_encrypted_output,
+ aad: &aad
+ }
+ ).unwrap();
+
+ assert_eq!(trait_aead_decrypted_output, trait_aeadinto_decrypted_output);
+}

chacha20poly1305/src/cipher.rs

@@ -1,6 +1,7 @@
 //! Core AEAD cipher implementation for (X)ChaCha20Poly1305.
 
 use ::cipher::{StreamCipher, StreamCipherSeek};
+use ::cipher::inout::InOutBuf;
 use aead::array::Array;
 use aead::Error;
 use poly1305::{
@@ -46,6 +47,26 @@ where
  Self { cipher, mac }
  }
 
+ pub(crate) fn encrypt_inout_detached(
+ mut self,
+ associated_data: &[u8],
+ mut buffer: InOutBuf<'_, '_, u8>,
+ ) -> Result<Tag, Error> {
+ if buffer.len() / BLOCK_SIZE >= MAX_BLOCKS {
+ return Err(Error);
+ }
+
+ self.mac.update_padded(associated_data);
+
+ // TODO(tarcieri): interleave encryption with Poly1305
+ // See: <https://github.com/RustCrypto/AEADs/issues/74>
+ self.cipher.apply_keystream_inout(buffer.reborrow());
+ self.mac.update_padded(buffer.get_out());
+
+ self.authenticate_lengths(associated_data, buffer.get_out())?;
+ Ok(self.mac.finalize())
+ }
+
  /// Encrypt the given message in-place, returning the authentication tag
  pub(crate) fn encrypt_in_place_detached(
  mut self,
@@ -67,6 +88,31 @@ where
  Ok(self.mac.finalize())
  }
 
+ pub(crate) fn decrypt_inout_detached(
+ mut self,
+ associated_data: &[u8],
+ buffer: InOutBuf<'_, '_, u8>,
+ tag: &Tag,
+ ) -> Result<(), Error> {
+ if buffer.len() / BLOCK_SIZE >= MAX_BLOCKS {
+ return Err(Error);
+ }
+
+ self.mac.update_padded(associated_data);
+ self.mac.update_padded(buffer.get_in());
+ self.authenticate_lengths(associated_data, buffer.get_in())?;
+
+ // This performs a constant-time comparison using the `subtle` crate
+ if self.mac.verify(tag).is_ok() {
+ // TODO(tarcieri): interleave decryption with Poly1305
+ // See: <https://github.com/RustCrypto/AEADs/issues/74>
+ self.cipher.apply_keystream_inout(buffer);
+ Ok(())
+ } else {
+ Err(Error)
+ }
+ }
+
  /// Decrypt the given message, first authenticating ciphertext integrity
  /// and returning an error if it's been tampered with.
  pub(crate) fn decrypt_in_place_detached(

chacha20poly1305/src/lib.rs

@@ -143,10 +143,11 @@
 
 mod cipher;
 
-pub use aead::{self, consts, AeadCore, AeadInPlace, Error, KeyInit, KeySizeUser};
+pub use aead::{self, consts, AeadCore, AeadInto, AeadInPlace, Error, KeyInit, KeySizeUser};
 
 use self::cipher::Cipher;
 use ::cipher::{KeyIvInit, StreamCipher, StreamCipherSeek};
+use ::cipher::inout::InOutBuf;
 use aead::{
  array::{Array, ArraySize},
  consts::{U0, U12, U16, U24, U32},
@@ -252,6 +253,37 @@ where
  type CiphertextOverhead = U0;
 }
 
+impl<C, N> AeadInto for ChaChaPoly1305<C, N>
+where
+ C: KeyIvInit<KeySize = U32, IvSize = N> + StreamCipher + StreamCipherSeek,
+ N: ArraySize,
+{
+ fn encrypt_into_detached(
+ &self,
+ nonce: &aead::Nonce<Self>,
+ plaintext: &[u8],
+ associated_data: &[u8],
+ ciphertext: &mut [u8],
+ ) -> Result<Tag, Error> {
+ Cipher::new(C::new(&self.key, nonce)).encrypt_inout_detached(associated_data, InOutBuf::new(plaintext, ciphertext).map_err(|_| Error)?)
+ }
+
+ fn decrypt_into_detached(
+ &self,
+ nonce: &aead::Nonce<Self>,
+ ciphertext: &[u8],
+ associated_data: &[u8],
+ plaintext: &mut [u8],
+ tag: &Tag,
+ ) -> Result<(), Error> {
+ Cipher::new(C::new(&self.key, nonce)).decrypt_inout_detached(
+ associated_data,
+ InOutBuf::new(ciphertext, plaintext).map_err(|_| Error)?,
+ tag,
+ )
+ }
+}
+
 impl<C, N> AeadInPlace for ChaChaPoly1305<C, N>
 where
  C: KeyIvInit<KeySize = U32, IvSize = N> + StreamCipher + StreamCipherSeek,

chacha20poly1305/tests/aead_into.rs

@@ -0,0 +1,52 @@
+use chacha20poly1305::aead::{ Aead, AeadInto, Payload };
+use chacha20poly1305::{ ChaCha20Poly1305, KeyInit };
+
+
+/// Confirm that the [AeadInto] implementation produces exactly the same output as the [Aead]
+/// implementation.
+#[test]
+fn test_aeadinto() {
+ let key = [0xfe, 0x14, 0xbc, 0x65, 0x16, 0xd6, 0x4a, 0x80, 0x8d, 0x58, 0xa3, 0x09, 0x8b, 0x0d, 0xa1, 0xc3, 0x2d, 0xf4, 0x62, 0xc0, 0x4d, 0x9e, 0x85, 0x55, 0x70, 0xc6, 0x83, 0xc2, 0x0f, 0xd7, 0xf4, 0x88];
+ let aad = [0xfe, 0xa6, 0xa3, 0xc3, 0xae, 0x1a, 0xab, 0x0f, 0x80, 0xe7, 0xa9, 0xcb, 0x9a, 0x9e, 0x5f, 0x06, 0x16, 0x4d, 0x85, 0x46, 0x43, 0xbf, 0x74, 0xd4, 0x38, 0x19, 0xf6, 0xd3, 0x38, 0xa0, 0x5e, 0xaf];
+ let data = [0xae, 0xfb, 0x8c, 0x8c, 0x38, 0xc9, 0x12, 0x04, 0x0f, 0x1d, 0xc0, 0x10, 0xf1, 0x94, 0xb0, 0x31, 0xcc, 0x00, 0xd8, 0xe4, 0xae, 0x5d, 0x04, 0x70, 0xb3, 0x6b, 0xfa, 0xb8, 0xe1, 0x23, 0x0c, 0x8c];
+
+ let mut trait_aeadinto_encrypted_output = [0u8; 32 + 16];
+ ChaCha20Poly1305::new((&key).try_into().unwrap())
+ .encrypt_into(
+ (&[0u8; 12]).try_into().unwrap(),
+ &data,
+ &aad,
+ &mut trait_aeadinto_encrypted_output
+ ).unwrap();
+
+ let trait_aead_encrypted_output = ChaCha20Poly1305::new((&key).try_into().unwrap())
+ .encrypt(
+ (&[0u8; 12]).try_into().unwrap(),
+ Payload {
+ msg: &data,
+ aad: &aad
+ }
+ ).unwrap();
+
+ assert_eq!(trait_aead_encrypted_output, trait_aeadinto_encrypted_output);
+
+ let mut trait_aeadinto_decrypted_output = [0u8; 32];
+ ChaCha20Poly1305::new((&key).try_into().unwrap())
+ .decrypt_into(
+ (&[0u8; 12]).try_into().unwrap(),
+ &trait_aeadinto_encrypted_output,
+ &aad,
+ &mut trait_aeadinto_decrypted_output
+ ).unwrap();
+
+ let trait_aead_decrypted_output = ChaCha20Poly1305::new((&key).try_into().unwrap())
+ .decrypt(
+ (&[0u8; 12]).try_into().unwrap(),
+ Payload {
+ msg: &trait_aeadinto_encrypted_output,
+ aad: &aad
+ }
+ ).unwrap();
+
+ assert_eq!(trait_aead_decrypted_output, trait_aeadinto_decrypted_output);
+}

chacha20poly1305/tests/lib.rs

@@ -2,6 +2,8 @@
 
 #![cfg(feature = "alloc")]
 
+pub mod aead_into;
+
 use chacha20poly1305::ChaCha20Poly1305;
 use chacha20poly1305::XChaCha20Poly1305;