Botan 2.13.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- File List
- File Members

cbc.cpp
Go to the documentation of this file.
1 /*
2 * CBC Mode
3 * (C) 1999-2007,2013,2017 Jack Lloyd
4 * (C) 2016 Daniel Neus, Rohde & Schwarz Cybersecurity
5 * (C) 2018 Ribose Inc
6 *
7 * Botan is released under the Simplified BSD License (see license.txt)
8 */
9
10 #include <botan/cbc.h>
11 #include <botan/mode_pad.h>
12 #include <botan/internal/rounding.h>
13
14 namespace Botan {
15
16 CBC_Mode::CBC_Mode(BlockCipher* cipher, BlockCipherModePaddingMethod* padding) :
17 m_cipher(cipher),
18 m_padding(padding),
19 m_block_size(cipher->block_size())
20 {
21 if(m_padding && !m_padding->valid_blocksize(m_block_size))
22 throw Invalid_Argument("Padding " + m_padding->name() +
23 " cannot be used with " +
24 cipher->name() + "/CBC");
25 }
26
27 void CBC_Mode::clear()
28 {
29 m_cipher->clear();
30 reset();
31 }
32
33 void CBC_Mode::reset()
34 {
35 m_state.clear();
36 }
37
38 std::string CBC_Mode::name() const
39 {
40 if(m_padding)
41 return cipher().name() + "/CBC/" + padding().name();
42 else
43 return cipher().name() + "/CBC/CTS";
44 }
45
46 size_t CBC_Mode::update_granularity() const
47 {
48 return cipher().parallel_bytes();
49 }
50
51 Key_Length_Specification CBC_Mode::key_spec() const
52 {
53 return cipher().key_spec();
54 }
55
56 size_t CBC_Mode::default_nonce_length() const
57 {
58 return block_size();
59 }
60
61 bool CBC_Mode::valid_nonce_length(size_t n) const
62 {
63 return (n == 0 || n == block_size());
64 }
65
66 void CBC_Mode::key_schedule(const uint8_t key[], size_t length)
67 {
68 m_cipher->set_key(key, length);
69 m_state.clear();
70 }
71
72 void CBC_Mode::start_msg(const uint8_t nonce[], size_t nonce_len)
73 {
74 if(!valid_nonce_length(nonce_len))
75 throw Invalid_IV_Length(name(), nonce_len);
76
77 /*
78 * A nonce of zero length means carry the last ciphertext value over
79 * as the new IV, as unfortunately some protocols require this. If
80 * this is the first message then we use an IV of all zeros.
81 */
82 if(nonce_len)
83 m_state.assign(nonce, nonce + nonce_len);
84 else if(m_state.empty())
85 m_state.resize(m_cipher->block_size());
86 // else leave the state alone
87 }
88
89 size_t CBC_Encryption::minimum_final_size() const
90 {
91 return 0;
92 }
93
94 size_t CBC_Encryption::output_length(size_t input_length) const
95 {
96 if(input_length == 0)
97 return block_size();
98 else
99 return round_up(input_length, block_size());
100 }
101
102 size_t CBC_Encryption::process(uint8_t buf[], size_t sz)
103 {
104 BOTAN_STATE_CHECK(state().empty() == false);
105 const size_t BS = block_size();
106
107 BOTAN_ASSERT(sz % BS == 0, "CBC input is full blocks");
108 const size_t blocks = sz / BS;
109
110 if(blocks > 0)
111 {
112 xor_buf(&buf[0], state_ptr(), BS);
113 cipher().encrypt(&buf[0]);
114
115 for(size_t i = 1; i != blocks; ++i)
116 {
117 xor_buf(&buf[BS*i], &buf[BS*(i-1)], BS);
118 cipher().encrypt(&buf[BS*i]);
119 }
120
121 state().assign(&buf[BS*(blocks-1)], &buf[BS*blocks]);
122 }
123
124 return sz;
125 }
126
127 void CBC_Encryption::finish(secure_vector<uint8_t>& buffer, size_t offset)
128 {
129 BOTAN_STATE_CHECK(state().empty() == false);
130 BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane");
131
132 const size_t BS = block_size();
133
134 const size_t bytes_in_final_block = (buffer.size()-offset) % BS;
135
136 padding().add_padding(buffer, bytes_in_final_block, BS);
137
138 if((buffer.size()-offset) % BS)
139 throw Internal_Error("Did not pad to full block size in " + name());
140
141 update(buffer, offset);
142 }
143
144 bool CTS_Encryption::valid_nonce_length(size_t n) const
145 {
146 return (n == block_size());
147 }
148
149 size_t CTS_Encryption::minimum_final_size() const
150 {
151 return block_size() + 1;
152 }
153
154 size_t CTS_Encryption::output_length(size_t input_length) const
155 {
156 return input_length; // no ciphertext expansion in CTS
157 }
158
159 void CTS_Encryption::finish(secure_vector<uint8_t>& buffer, size_t offset)
160 {
161 BOTAN_STATE_CHECK(state().empty() == false);
162 BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane");
163 uint8_t* buf = buffer.data() + offset;
164 const size_t sz = buffer.size() - offset;
165
166 const size_t BS = block_size();
167
168 if(sz < BS + 1)
169 throw Encoding_Error(name() + ": insufficient data to encrypt");
170
171 if(sz % BS == 0)
172 {
173 update(buffer, offset);
174
175 // swap last two blocks
176 for(size_t i = 0; i != BS; ++i)
177 std::swap(buffer[buffer.size()-BS+i], buffer[buffer.size()-2*BS+i]);
178 }
179 else
180 {
181 const size_t full_blocks = ((sz / BS) - 1) * BS;
182 const size_t final_bytes = sz - full_blocks;
183 BOTAN_ASSERT(final_bytes > BS && final_bytes < 2*BS, "Left over size in expected range");
184
185 secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);
186 buffer.resize(full_blocks + offset);
187 update(buffer, offset);
188
189 xor_buf(last.data(), state_ptr(), BS);
190 cipher().encrypt(last.data());
191
192 for(size_t i = 0; i != final_bytes - BS; ++i)
193 {
194 last[i] ^= last[i + BS];
195 last[i + BS] ^= last[i];
196 }
197
198 cipher().encrypt(last.data());
199
200 buffer += last;
201 }
202 }
203
204 size_t CBC_Decryption::output_length(size_t input_length) const
205 {
206 return input_length; // precise for CTS, worst case otherwise
207 }
208
209 size_t CBC_Decryption::minimum_final_size() const
210 {
211 return block_size();
212 }
213
214 size_t CBC_Decryption::process(uint8_t buf[], size_t sz)
215 {
216 BOTAN_STATE_CHECK(state().empty() == false);
217
218 const size_t BS = block_size();
219
220 BOTAN_ASSERT(sz % BS == 0, "Input is full blocks");
221 size_t blocks = sz / BS;
222
223 while(blocks)
224 {
225 const size_t to_proc = std::min(BS * blocks, m_tempbuf.size());
226
227 cipher().decrypt_n(buf, m_tempbuf.data(), to_proc / BS);
228
229 xor_buf(m_tempbuf.data(), state_ptr(), BS);
230 xor_buf(&m_tempbuf[BS], buf, to_proc - BS);
231 copy_mem(state_ptr(), buf + (to_proc - BS), BS);
232
233 copy_mem(buf, m_tempbuf.data(), to_proc);
234
235 buf += to_proc;
236 blocks -= to_proc / BS;
237 }
238
239 return sz;
240 }
241
242 void CBC_Decryption::finish(secure_vector<uint8_t>& buffer, size_t offset)
243 {
244 BOTAN_STATE_CHECK(state().empty() == false);
245 BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane");
246 const size_t sz = buffer.size() - offset;
247
248 const size_t BS = block_size();
249
250 if(sz == 0 || sz % BS)
251 throw Decoding_Error(name() + ": Ciphertext not a multiple of block size");
252
253 update(buffer, offset);
254
255 const size_t pad_bytes = BS - padding().unpad(&buffer[buffer.size()-BS], BS);
256 buffer.resize(buffer.size() - pad_bytes); // remove padding
257 if(pad_bytes == 0 && padding().name() != "NoPadding")
258 {
259 throw Decoding_Error("Invalid CBC padding");
260 }
261 }
262
263 void CBC_Decryption::reset()
264 {
265 CBC_Mode::reset();
266 zeroise(m_tempbuf);
267 }
268
269 bool CTS_Decryption::valid_nonce_length(size_t n) const
270 {
271 return (n == block_size());
272 }
273
274 size_t CTS_Decryption::minimum_final_size() const
275 {
276 return block_size() + 1;
277 }
278
279 void CTS_Decryption::finish(secure_vector<uint8_t>& buffer, size_t offset)
280 {
281 BOTAN_STATE_CHECK(state().empty() == false);
282 BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane");
283 const size_t sz = buffer.size() - offset;
284 uint8_t* buf = buffer.data() + offset;
285
286 const size_t BS = block_size();
287
288 if(sz < BS + 1)
289 throw Encoding_Error(name() + ": insufficient data to decrypt");
290
291 if(sz % BS == 0)
292 {
293 // swap last two blocks
294
295 for(size_t i = 0; i != BS; ++i)
296 std::swap(buffer[buffer.size()-BS+i], buffer[buffer.size()-2*BS+i]);
297
298 update(buffer, offset);
299 }
300 else
301 {
302 const size_t full_blocks = ((sz / BS) - 1) * BS;
303 const size_t final_bytes = sz - full_blocks;
304 BOTAN_ASSERT(final_bytes > BS && final_bytes < 2*BS, "Left over size in expected range");
305
306 secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);
307 buffer.resize(full_blocks + offset);
308 update(buffer, offset);
309
310 cipher().decrypt(last.data());
311
312 xor_buf(last.data(), &last[BS], final_bytes - BS);
313
314 for(size_t i = 0; i != final_bytes - BS; ++i)
315 std::swap(last[i], last[i + BS]);
316
317 cipher().decrypt(last.data());
318 xor_buf(last.data(), state_ptr(), BS);
319
320 buffer += last;
321 }
322 }
323
324 }
Botan::CTS_Encryption::finish
void finish(secure_vector< uint8_t > &final_block, size_t offset=0) override
Definition: cbc.cpp:159
Botan::CBC_Mode::state
secure_vector< uint8_t > & state()
Definition: cbc.h:53
Botan::BlockCipher::encrypt
void encrypt(const uint8_t in[], uint8_t out[]) const
Definition: block_cipher.h:82
Botan::Invalid_Argument
Definition: exceptn.h:136
Botan::CBC_Mode::key_spec
Key_Length_Specification key_spec() const override
Definition: cbc.cpp:51
Botan::BlockCipher::decrypt
void decrypt(const uint8_t in[], uint8_t out[]) const
Definition: block_cipher.h:92
Botan::CBC_Mode::clear
void clear() override
Definition: cbc.cpp:27
Botan::CBC_Decryption::finish
void finish(secure_vector< uint8_t > &final_block, size_t offset=0) override
Definition: cbc.cpp:242
Botan::CBC_Mode::name
std::string name() const override
Definition: cbc.cpp:38
m_cipher
CCCryptorRef m_cipher
Definition: commoncrypto_mode.cpp:50
Botan::BlockCipherModePaddingMethod::unpad
virtual size_t unpad(const uint8_t block[], size_t len) const =0
Botan::CBC_Mode::valid_nonce_length
bool valid_nonce_length(size_t n) const override
Definition: cbc.cpp:61
Botan::BlockCipher::decrypt_n
virtual void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const =0
Botan::CBC_Mode::update_granularity
size_t update_granularity() const override
Definition: cbc.cpp:46
Botan::CBC_Mode::CBC_Mode
CBC_Mode(BlockCipher *cipher, BlockCipherModePaddingMethod *padding)
Definition: cbc.cpp:16
Botan::Cipher_Mode::update
void update(secure_vector< uint8_t > &buffer, size_t offset=0)
Definition: cipher_mode.h:112
Botan::Key_Length_Specification
Definition: key_spec.h:18
Botan::CBC_Mode::padding
const BlockCipherModePaddingMethod & padding() const
Definition: cbc.h:45
BOTAN_STATE_CHECK
#define BOTAN_STATE_CHECK(expr)
Definition: assert.h:49
Botan::Internal_Error
Definition: exceptn.h:341
Botan::CBC_Mode::default_nonce_length
size_t default_nonce_length() const override
Definition: cbc.cpp:56
BOTAN_ASSERT
#define BOTAN_ASSERT(expr, assertion_made)
Definition: assert.h:55
Botan::Decoding_Error
Definition: exceptn.h:199
Botan::CBC_Decryption::minimum_final_size
size_t minimum_final_size() const override
Definition: cbc.cpp:209
Botan::CTS_Encryption::valid_nonce_length
bool valid_nonce_length(size_t n) const override
Definition: cbc.cpp:144
Botan::secure_vector
std::vector< T, secure_allocator< T >> secure_vector
Definition: secmem.h:65
Botan::CBC_Decryption::reset
void reset() override
Definition: cbc.cpp:263
Botan::CBC_Mode::block_size
size_t block_size() const
Definition: cbc.h:51
Botan::xor_buf
void xor_buf(uint8_t out[], const uint8_t in[], size_t length)
Definition: mem_ops.h:232
Botan::SymmetricAlgorithm::name
virtual std::string name() const =0
Botan::CBC_Mode::reset
void reset() override
Definition: cbc.cpp:33
Botan::CBC_Decryption::output_length
size_t output_length(size_t input_length) const override
Definition: cbc.cpp:204
Botan::CBC_Mode::state_ptr
uint8_t * state_ptr()
Definition: cbc.h:55
Botan::CBC_Encryption::process
size_t process(uint8_t buf[], size_t size) override
Definition: cbc.cpp:102
Botan::BlockCipher::parallel_bytes
size_t parallel_bytes() const
Definition: block_cipher.h:64
Botan::copy_mem
void copy_mem(T *out, const T *in, size_t n)
Definition: mem_ops.h:132
Botan
Definition: alg_id.cpp:13
Botan::BlockCipherModePaddingMethod
Definition: mode_pad.h:28
Botan::SymmetricAlgorithm::key_spec
virtual Key_Length_Specification key_spec() const =0
Botan::Encoding_Error
Definition: exceptn.h:184
Botan::CBC_Mode::cipher
const BlockCipher & cipher() const
Definition: cbc.h:43
Botan::BlockCipherModePaddingMethod::add_padding
virtual void add_padding(secure_vector< uint8_t > &buffer, size_t final_block_bytes, size_t block_size) const =0
Botan::CBC_Encryption::finish
void finish(secure_vector< uint8_t > &final_block, size_t offset=0) override
Definition: cbc.cpp:127
Botan::CBC_Encryption::minimum_final_size
size_t minimum_final_size() const override
Definition: cbc.cpp:89
Botan::CTS_Decryption::finish
void finish(secure_vector< uint8_t > &final_block, size_t offset=0) override
Definition: cbc.cpp:279
m_block_size
size_t m_block_size
Definition: openssl_mode.cpp:47
Botan::CTS_Encryption::minimum_final_size
size_t minimum_final_size() const override
Definition: cbc.cpp:149
Botan::CTS_Encryption::output_length
size_t output_length(size_t input_length) const override
Definition: cbc.cpp:154
Botan::round_up
size_t round_up(size_t n, size_t align_to)
Definition: rounding.h:21
Botan::BlockCipherModePaddingMethod::name
virtual std::string name() const =0
Botan::CBC_Encryption::output_length
size_t output_length(size_t input_length) const override
Definition: cbc.cpp:94
Botan::CBC_Decryption::process
size_t process(uint8_t buf[], size_t size) override
Definition: cbc.cpp:214
Botan::CTS_Decryption::valid_nonce_length
bool valid_nonce_length(size_t n) const override
Definition: cbc.cpp:269
Botan::CTS_Decryption::minimum_final_size
size_t minimum_final_size() const override
Definition: cbc.cpp:274
Botan::BlockCipher
Definition: block_cipher.h:21
Botan::zeroise
void zeroise(std::vector< T, Alloc > &vec)
Definition: secmem.h:160