Setting associated data in the pipe interface

[webmaster128]

I have some AES-128/GCM tests, which work fine using the following code, as long as there is no associated data (AD):

Pipe pipe(get_cipher(cipher, key, iv, direction));
pipe.process_msg(input);
secure_vector<byte> output = pipe.read_all(0);

Is there a simple way to add associated data to the get_cipher() interface? Or do I need to use the way seen in test_aead.cpp?

[randombit]

You can do it through the filter interface by saving a copy of the result of get_cipher and dynamic_casting it to a AEAD_Filter, then calling set_associated_data on the the filter before writing to the pipe.

Doing it through AEAD_Mode is more convenient IMO and avoids memory copies.

The filters code is kind of a dead end IMO. It is convenient and people seem to like it, but it unavoidably has a lot of memory copies and buffering due to its overly general design (when was the last time you added a new filter to a Pipe at runtime?). In practical applications and for auditing it is easier to understand operations on say a HashFunction* and an AEAD_Mode* vs a Pipe which happens to contain a Fork, and so on. It is IMO better to be clear about what is going on at the call site and pipe.process_msg() and co is unavoidably opaque, especially if the configuration of the pipe and the operations being performed are at a remove in the source (consider if say, the TLS stack passed Pipe&s down to the record layer for decryption - are we sure we always passed the right Pipe object down?)

The filter code is not exactly deprecated, but over time I've migrated almost all functionality it used to contain out to other more appropriate interfaces, leaving the filters as purely adaptors, and am avoiding it in new code and even actively rewritten old code to remove it (
3905245). It does still need tests, assuming it stays in for 2.0, which it probably has to since I assume many applications use it.

Was there something about the tests in #344 that required new code?

[webmaster128]

Thanks Jack for clarification.

Was there something about the tests in #344 that required new code?

My current goals is to have an alternative to the openssl enc command line interface, that supports GCM baucause openssl enc doesn't. This cli app is where I use the code above. #344, this one and a lot of my current commits are helping to get there.

[webmaster128]

Thanks, it is working now using the following code

secure_vector<byte> do_crypt(const std::string &cipher,
                             const secure_vector<byte> &input,
                             const SymmetricKey &key,
                             const InitializationVector &iv,
                             const OctetString &ad,
                             Cipher_Dir direction)
{
    if (iv.size() == 0) throw std::invalid_argument("IV must not be empty");

    // TODO: implement streaming

    std::shared_ptr<Botan::Cipher_Mode> processor(Botan::get_cipher_mode(cipher, direction));
    if(!processor) throw std::runtime_error("Cipher algorithm not found");

    // Set key
    processor->set_key(key);

    // Set associated data
    if (cipher.find("/GCM") != std::string::npos)
       {
       auto aead_processor = std::dynamic_pointer_cast<AEAD_Mode>(processor);
       if(!aead_processor) throw std::runtime_error("Cipher algorithm not could not be converted to AEAD");
       aead_processor->set_ad(ad.bits_of());
       }

    // Set IV
    processor->start(iv.bits_of());

    secure_vector<byte> buf(input.begin(), input.end());
    processor->finish(buf);

    return buf;
}