From 390b7a8ac7c14f73bf216561416f444109f24ec4 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Wed, 12 Jun 2019 17:34:41 +0200 Subject: Changement de la concaténation des chaînes de bits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit L'implémentation précédente n'était pas cohérente. Étant données deux chaînes X et Y de longueur x et y, et Z=X∥Y de longueur z=x+y, - pad10* et la construction des tweaks fonctionnaient selon la logique "indices faibles = LSB", donc Z[0] = Y[0] Z[z-1] = X[x-1] - le découpage de M, C et A en blocs fonctionnait selon la logique "indices faibles = premiers blocs", donc Z[0] = X[0] Z[z-1] = Y[y-1] En conséquence, la façon dont M, C et A étaient paddés n'avait aucun sens, e.g. pour un message M de taille 35, pad10*(M*) donnait : { M[34], M[33], M[32], 0b10000000, 0, … } Les deux seules façons logiques de padder M* sont { M[32], M[33], M[34], 0b10000000, 0, … } ou { M[2], M[1], M[0], 0b10000000, 0, … } Après revue d'autres implémentations de ΘCB3 et SCT-2, j'ai choisi de suivre la convention MSB. En conséquence, quand la spécification dit Z = X∥Y L'implémentation traduira : Z[] = { X[0], … X[x-1], Y[0], … Y[y-1] } Dans la même logique, les compteurs de blocs seront insérés MSB d'abord et paddés en conséquence, e.g. j=0x01020304 ≡ J[] = { 0, …, 0x01, 0x02, 0x03, 0x04 } --- src/ref/lilliput-ae-utils.h | 62 ++++++++++++++++++++--------------------- src/ref/lilliput-i.c | 67 +++++++++++++++++++++++++-------------------- src/ref/lilliput-ii.c | 40 +++++++++++++-------------- 3 files changed, 87 insertions(+), 82 deletions(-) diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index 0efb776..a66b75c 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -28,16 +28,6 @@ This file provides functions used by both authenticated encryption modes. #include "constants.h" -static inline uint8_t upper_nibble(uint8_t i) -{ - return i >> 4; -} - -static inline uint8_t lower_nibble(uint8_t i) -{ - return i & 0x0f; -} - static inline void encrypt(const uint8_t K[KEY_BYTES], const uint8_t T[TWEAK_BYTES], const uint8_t M[BLOCK_BYTES], @@ -68,35 +58,41 @@ static inline void xor_arrays(size_t len, uint8_t out[len], const uint8_t a[len] static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BLOCK_BYTES]) { - /* pad10*(X) = X || 1 || 0^{n-|X|-1} */ - - /* For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 } + /* Assuming 0 < |X| < n: + * + * pad10*(X) = X || 1 || 0^{n-|X|-1} + * + * For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 } * * pad10*(X) = - * X[2] X[1] X[0] 1 0* - * 00000011 00000010 00000001 1 0000000 00000000... + * X[0] X[1] X[2] 1 0* + * 00000001 00000010 00000011 1 0000000 00000000... * - * - padded[0, 11]: zeroes - * - padded[12]: 10000000 - * - padded[13, 15]: X[0, 2] + * - padded[0, 2]: X[0, 2] + * - padded[3]: 10000000 + * - padded[4, 15]: zeroes */ - /* Assume that X_len> 8*i & 0xff; + dest[i] = index >> 8*(s-1-i); } } @@ -108,17 +104,17 @@ static inline void fill_index_tweak( { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-4]: block index - * [ 1, s]: actual block index - * [s+1, t-4]: 0-padding - * - bits [t-3, t]: 4-bit prefix + * [ 1, 4]: 4-bit prefix + * [ 5, t]: block index + * [ 5, t-s]: 0-padding + * [t-s+1, t]: actual block index, from MSB to LSB */ - copy_block_index(block_index, tweak); + tweak[0] = prefix<<4; /* Assume padding bytes have already been set to 0. */ - tweak[TWEAK_BYTES-1] |= prefix << 4; + copy_block_index(block_index, tweak); } static void process_associated_data( diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index 6f869c3..fb06237 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -32,58 +32,67 @@ static const uint8_t _0n[BLOCK_BYTES] = { }; +static uint8_t _upper_nibble(uint8_t i) +{ + return i >> 4; +} + +static uint8_t _lower_nibble(uint8_t i) +{ + return i & 0x0f; +} + static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES]) { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-|N|-4]: block index - * [ 1, s]: actual block index - * [ s+1, t-|N|-4]: 0-padding - * - bits [t-|N|-3, t-4]: nonce - * - bits [ t-3, t]: 4-bit prefix + * [ 1, 4]: 4-bit prefix + * [ 5, |N|+4]: nonce + * [ |N|+5, t]: block index + * [|N|+5, t-s]: 0-padding + * [t-s+1, t]: actual block index, from MSB to LSB * - * This function sets bits s+1 to t-4 once and for all. + * This function sets bits 5 to t-s once and for all. */ - size_t N_start = TWEAK_BYTES - NONCE_BYTES - 1; - - for (size_t i=sizeof(size_t); i Date: Thu, 13 Jun 2019 15:16:19 +0200 Subject: Adaptation des tests et des traces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - mise à jour des vecteurs de test i-128/test-ae-*crypt - affichage des tableaux d'octets par indices croissants --- test/debug.h | 24 ++++++++++-------------- test/i-128/test-ae-decrypt.c | 42 +++++++++++++++++++++--------------------- test/i-128/test-ae-encrypt.c | 42 +++++++++++++++++++++--------------------- test/i-128/traces-ae.c | 4 ++-- test/i-192/traces-ae.c | 4 ++-- test/i-256/traces-ae.c | 4 ++-- test/ii-128/traces-ae.c | 4 ++-- test/ii-192/traces-ae.c | 4 ++-- test/ii-256/traces-ae.c | 4 ++-- 9 files changed, 64 insertions(+), 68 deletions(-) diff --git a/test/debug.h b/test/debug.h index 24b7787..d958475 100644 --- a/test/debug.h +++ b/test/debug.h @@ -17,9 +17,7 @@ static inline void debug_dump_lanes(const char *header, size_t len, const uint8_ fprintf(DUMP, "%*s", indent, ""); for (size_t b=0; b<8; b++) { - /* start with MSB */ - size_t byte_index = len-(1+line*8+b); - fprintf(DUMP, "%*s%02x", 5, "", buf[byte_index]); + fprintf(DUMP, "%*s%02x", 5, "", buf[line*8+b]); } fprintf(DUMP, "\n"); } @@ -30,26 +28,24 @@ static inline void debug_dump_buffer(const char *header, size_t len, const uint8 { fprintf(DUMP, "%*s%s\n", indent, "", header); - if (len%8 != 0) + for (size_t line=0; line %zu]", line, b, line*8+b); */ + fprintf(DUMP, "%02x ", buf[line*8+b]); } fprintf(DUMP, "\n"); } - for (size_t line=0; line %zu]", line, b, byte_index); */ - fprintf(DUMP, "%02x ", buf[byte_index]); + fprintf(DUMP, "%02x ", buf[len-rest+b]); } fprintf(DUMP, "\n"); } diff --git a/test/i-128/test-ae-decrypt.c b/test/i-128/test-ae-decrypt.c index 0a5934a..812eda2 100644 --- a/test/i-128/test-ae-decrypt.c +++ b/test/i-128/test-ae-decrypt.c @@ -47,18 +47,18 @@ const vector VECTORS[] = { }, .ciphertext_len = 64, .ciphertext = (uint8_t[]) { - 0xca, 0x16, 0x03, 0x71, 0x0c, 0xca, 0x10, 0x2f, - 0xac, 0x46, 0x0c, 0xb4, 0x13, 0x2a, 0x55, 0x0d, - 0xc0, 0x59, 0x90, 0xb7, 0xca, 0xf2, 0x17, 0x9f, - 0x8f, 0xd6, 0x5a, 0x73, 0x49, 0x65, 0x14, 0xec, - 0x3e, 0xf4, 0xc5, 0xd0, 0x08, 0x3d, 0x85, 0x5c, - 0x11, 0x70, 0x42, 0x3b, 0x91, 0x61, 0xa7, 0xf2, - 0x7a, 0xbf, 0x51, 0x2c, 0xe3, 0x88, 0xc9, 0x97, - 0x34, 0x92, 0xed, 0xf9, 0x5b, 0xb4, 0x2a, 0x80 + 0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90, + 0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12, + 0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48, + 0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3, + 0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f, + 0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0, + 0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c, + 0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62 }, .tag = { - 0x47, 0x5b, 0x2c, 0x0e, 0x5f, 0xcf, 0x6f, 0xc0, - 0xab, 0x3c, 0x24, 0xc1, 0x66, 0x88, 0x83, 0x38 + 0x04, 0xaa, 0xc8, 0x19, 0x32, 0x70, 0x32, 0x24, + 0xe8, 0x27, 0xb7, 0xab, 0xec, 0xd8, 0x2f, 0x6c }, .message = (uint8_t[]) { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, @@ -95,19 +95,19 @@ const vector VECTORS[] = { }, .ciphertext_len = 66, .ciphertext = (uint8_t[]) { - 0xca, 0x16, 0x03, 0x71, 0x0c, 0xca, 0x10, 0x2f, - 0xac, 0x46, 0x0c, 0xb4, 0x13, 0x2a, 0x55, 0x0d, - 0xc0, 0x59, 0x90, 0xb7, 0xca, 0xf2, 0x17, 0x9f, - 0x8f, 0xd6, 0x5a, 0x73, 0x49, 0x65, 0x14, 0xec, - 0x3e, 0xf4, 0xc5, 0xd0, 0x08, 0x3d, 0x85, 0x5c, - 0x11, 0x70, 0x42, 0x3b, 0x91, 0x61, 0xa7, 0xf2, - 0x7a, 0xbf, 0x51, 0x2c, 0xe3, 0x88, 0xc9, 0x97, - 0x34, 0x92, 0xed, 0xf9, 0x5b, 0xb4, 0x2a, 0x80, - 0x27, 0x3f + 0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90, + 0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12, + 0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48, + 0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3, + 0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f, + 0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0, + 0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c, + 0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62, + 0x88, 0x5a }, .tag = { - 0xd4, 0xef, 0x1f, 0x11, 0x81, 0x90, 0xbe, 0xfd, - 0x1e, 0xa7, 0x32, 0xbe, 0x63, 0xe2, 0x18, 0x90 + 0x64, 0xa2, 0x24, 0x03, 0xc5, 0x79, 0x4f, 0xec, + 0xe7, 0x7d, 0xc1, 0xf6, 0xc9, 0xc6, 0x77, 0x2c }, .message = (uint8_t[]) { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, diff --git a/test/i-128/test-ae-encrypt.c b/test/i-128/test-ae-encrypt.c index 06f3b88..09fbb32 100644 --- a/test/i-128/test-ae-encrypt.c +++ b/test/i-128/test-ae-encrypt.c @@ -57,18 +57,18 @@ const vector VECTORS[] = { 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, }, .ciphertext = (uint8_t[]) { - 0xca, 0x16, 0x03, 0x71, 0x0c, 0xca, 0x10, 0x2f, - 0xac, 0x46, 0x0c, 0xb4, 0x13, 0x2a, 0x55, 0x0d, - 0xc0, 0x59, 0x90, 0xb7, 0xca, 0xf2, 0x17, 0x9f, - 0x8f, 0xd6, 0x5a, 0x73, 0x49, 0x65, 0x14, 0xec, - 0x3e, 0xf4, 0xc5, 0xd0, 0x08, 0x3d, 0x85, 0x5c, - 0x11, 0x70, 0x42, 0x3b, 0x91, 0x61, 0xa7, 0xf2, - 0x7a, 0xbf, 0x51, 0x2c, 0xe3, 0x88, 0xc9, 0x97, - 0x34, 0x92, 0xed, 0xf9, 0x5b, 0xb4, 0x2a, 0x80 + 0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90, + 0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12, + 0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48, + 0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3, + 0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f, + 0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0, + 0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c, + 0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62 }, .tag = { - 0x47, 0x5b, 0x2c, 0x0e, 0x5f, 0xcf, 0x6f, 0xc0, - 0xab, 0x3c, 0x24, 0xc1, 0x66, 0x88, 0x83, 0x38 + 0x04, 0xaa, 0xc8, 0x19, 0x32, 0x70, 0x32, 0x24, + 0xe8, 0x27, 0xb7, 0xab, 0xec, 0xd8, 0x2f, 0x6c } }, { @@ -106,19 +106,19 @@ const vector VECTORS[] = { 0x40, 0x01 }, .ciphertext = (uint8_t[]) { - 0xca, 0x16, 0x03, 0x71, 0x0c, 0xca, 0x10, 0x2f, - 0xac, 0x46, 0x0c, 0xb4, 0x13, 0x2a, 0x55, 0x0d, - 0xc0, 0x59, 0x90, 0xb7, 0xca, 0xf2, 0x17, 0x9f, - 0x8f, 0xd6, 0x5a, 0x73, 0x49, 0x65, 0x14, 0xec, - 0x3e, 0xf4, 0xc5, 0xd0, 0x08, 0x3d, 0x85, 0x5c, - 0x11, 0x70, 0x42, 0x3b, 0x91, 0x61, 0xa7, 0xf2, - 0x7a, 0xbf, 0x51, 0x2c, 0xe3, 0x88, 0xc9, 0x97, - 0x34, 0x92, 0xed, 0xf9, 0x5b, 0xb4, 0x2a, 0x80, - 0x27, 0x3f + 0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90, + 0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12, + 0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48, + 0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3, + 0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f, + 0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0, + 0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c, + 0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62, + 0x88, 0x5a }, .tag = { - 0xd4, 0xef, 0x1f, 0x11, 0x81, 0x90, 0xbe, 0xfd, - 0x1e, 0xa7, 0x32, 0xbe, 0x63, 0xe2, 0x18, 0x90 + 0x64, 0xa2, 0x24, 0x03, 0xc5, 0x79, 0x4f, 0xec, + 0xe7, 0x7d, 0xc1, 0xf6, 0xc9, 0xc6, 0x77, 0x2c } } }; diff --git a/test/i-128/traces-ae.c b/test/i-128/traces-ae.c index 441ae37..a22260d 100644 --- a/test/i-128/traces-ae.c +++ b/test/i-128/traces-ae.c @@ -78,7 +78,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 }, .message_len = 66, .message = (uint8_t[]) { @@ -90,7 +90,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 } } }; diff --git a/test/i-192/traces-ae.c b/test/i-192/traces-ae.c index 6448928..328204a 100644 --- a/test/i-192/traces-ae.c +++ b/test/i-192/traces-ae.c @@ -80,7 +80,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 }, .message_len = 66, .message = (uint8_t[]) { @@ -92,7 +92,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 } } }; diff --git a/test/i-256/traces-ae.c b/test/i-256/traces-ae.c index 946518e..9b75273 100644 --- a/test/i-256/traces-ae.c +++ b/test/i-256/traces-ae.c @@ -82,7 +82,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 }, .message_len = 66, .message = (uint8_t[]) { @@ -94,7 +94,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 } } }; diff --git a/test/ii-128/traces-ae.c b/test/ii-128/traces-ae.c index 441ae37..a22260d 100644 --- a/test/ii-128/traces-ae.c +++ b/test/ii-128/traces-ae.c @@ -78,7 +78,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 }, .message_len = 66, .message = (uint8_t[]) { @@ -90,7 +90,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 } } }; diff --git a/test/ii-192/traces-ae.c b/test/ii-192/traces-ae.c index 6448928..328204a 100644 --- a/test/ii-192/traces-ae.c +++ b/test/ii-192/traces-ae.c @@ -80,7 +80,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 }, .message_len = 66, .message = (uint8_t[]) { @@ -92,7 +92,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 } } }; diff --git a/test/ii-256/traces-ae.c b/test/ii-256/traces-ae.c index 946518e..9b75273 100644 --- a/test/ii-256/traces-ae.c +++ b/test/ii-256/traces-ae.c @@ -82,7 +82,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 }, .message_len = 66, .message = (uint8_t[]) { @@ -94,7 +94,7 @@ const vector VECTORS[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, - 0x40, 0x01 + 0x40, 0x41 } } }; -- cgit v1.2.3 From 2d6201940ff6cf318ba4117de7c2664643930bd7 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Fri, 14 Jun 2019 09:08:43 +0200 Subject: Adaptation de l'implémentation Python MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/add_python/lilliput/ae_common.py | 10 +++++----- src/add_python/lilliput/ae_mode_1.py | 25 ++++++++++++------------- src/add_python/lilliput/ae_mode_2.py | 32 +++++++++++++++++--------------- 3 files changed, 34 insertions(+), 33 deletions(-) diff --git a/src/add_python/lilliput/ae_common.py b/src/add_python/lilliput/ae_common.py index b94be1b..db14ec3 100644 --- a/src/add_python/lilliput/ae_common.py +++ b/src/add_python/lilliput/ae_common.py @@ -15,7 +15,7 @@ """Helper functions used in both Lilliput-I and Lilliput-II.""" -from .constants import BLOCK_BITS, BLOCK_BYTES +from .constants import BLOCK_BYTES from .helpers import xor from . import tbc @@ -48,11 +48,11 @@ def block_matrix_to_bytes(matrix): def pad10(X): zeroes = [0] * (BLOCK_BYTES-len(X)-1) - return zeroes + [0b10000000] + X + return X + [0b10000000] + zeroes def integer_to_byte_array(i, n): - return list(i.to_bytes(n, 'little')) + return list(i.to_bytes(n, 'big')) def _tweak_associated_data(t, i, padded): @@ -61,8 +61,8 @@ def _tweak_associated_data(t, i, padded): prefix = 0b0110 if padded else 0b0010 # Clear upper 4 bits and set them to prefix. - tweak[-1] &= 0b00001111 - tweak[-1] = prefix << 4 + tweak[0] &= 0b00001111 + tweak[0] |= prefix << 4 return tweak diff --git a/src/add_python/lilliput/ae_mode_1.py b/src/add_python/lilliput/ae_mode_1.py index 4a40b78..197bf37 100644 --- a/src/add_python/lilliput/ae_mode_1.py +++ b/src/add_python/lilliput/ae_mode_1.py @@ -52,27 +52,26 @@ def _lower_nibble(i): return i & 0b00001111 -def _byte_from_nibbles(lower, upper): - return upper<<4 | lower +def _byte(high, low): + return high<<4 ^ low def _tweak_message(N, j, prefix): - # j is encoded on 68 bits; get 72 and clear the upper 4. - j_len = (TWEAK_BITS-NONCE_BITS-4)//8 + 1 - tweak = integer_to_byte_array(j, j_len) - tweak[-1] &= 0b00001111 + tweak = [_byte(prefix.value, _upper_nibble(N[0]))] - # Add nonce. - tweak[-1] |= _lower_nibble(N[0]) << 4 tweak.extend( - _byte_from_nibbles(_upper_nibble(N[i-1]), _lower_nibble(N[i])) + _byte(_lower_nibble(N[i-1]), _upper_nibble(N[i])) for i in range(1, NONCE_BITS//8) ) - # Add last nibble from nonce and prefix. - tweak.append( - _byte_from_nibbles(_upper_nibble(N[-1]), prefix.value) - ) + # j is encoded on 68 bits; get 72 then set the upper 4 to the + # nonce's lower 4. + j_len = (TWEAK_BITS-NONCE_BITS-4)//8 + 1 + j_array = integer_to_byte_array(j, j_len) + j_array[0] &= 0b00001111 + j_array[0] |= _lower_nibble(N[-1]) << 4 + + tweak.extend(j_array) return tweak diff --git a/src/add_python/lilliput/ae_mode_2.py b/src/add_python/lilliput/ae_mode_2.py index 79d1bcd..a55ecb8 100644 --- a/src/add_python/lilliput/ae_mode_2.py +++ b/src/add_python/lilliput/ae_mode_2.py @@ -18,6 +18,8 @@ This module provides the functions for authenticated encryption and decryption using Lilliput-AE's nonce-misuse-resistant mode based on SCT-2. """ +from enum import Enum + from .constants import BLOCK_BYTES from .ae_common import ( bytes_to_block_matrix, @@ -35,22 +37,24 @@ TWEAK_BITS = 128 TWEAK_BYTES = TWEAK_BITS//8 -def _tweak_tag(j, padded): - tweak = integer_to_byte_array(j, TWEAK_BYTES) +class _TagTweak(Enum): + BLOCK = 0b0000 + PAD = 0b0100 - prefix = 0b0100 if padded else 0b0000 + +def _tweak_tag(j, prefix): + tweak = integer_to_byte_array(j, TWEAK_BYTES) # Clear upper 4 bits and set them to prefix. - tweak[-1] &= 0b00001111 - tweak[-1] = prefix << 4 + tweak[0] &= 0b00001111 + tweak[0] |= prefix.value << 4 return tweak def _add_tag_j(tag, j): - array_j = integer_to_byte_array(j, TWEAK_BYTES) - tweak = xor(tag, array_j) - tweak[-1] |= 0b10000000 + tweak = xor(tag, integer_to_byte_array(j, TWEAK_BYTES)) + tweak[0] |= 0b10000000 return tweak @@ -63,18 +67,16 @@ def _message_auth_tag(M, N, Auth, key): M = bytes_to_block_matrix(M) for j in range(0, l): - tweak = _tweak_tag(j, False) + tweak = _tweak_tag(j, _TagTweak.BLOCK) encryption = tbc.encrypt(tweak, key, M[j]) tag = xor(tag, encryption) if need_padding: - tweak = _tweak_tag(l, True) + tweak = _tweak_tag(l, _TagTweak.PAD) encryption = tbc.encrypt(tweak, key, pad10(M[l])) tag = xor(tag, encryption) - tweak = N + [0b00010000] - encryption = tbc.encrypt(tweak, key, tag) - tag = encryption + tag = tbc.encrypt([0b00010000]+N, key, tag) return tag @@ -88,12 +90,12 @@ def _message_encryption(M, N, tag, key): for j in range(0, l): tweak = _add_tag_j(tag, j) - encryption = tbc.encrypt(tweak, key, N+[0b00000000]) + encryption = tbc.encrypt(tweak, key, [0b00000000]+N) C.append(xor(M[j], encryption)) if need_padding: tweak = _add_tag_j(tag, l) - encryption = tbc.encrypt(tweak, key, N+[0b00000000]) + encryption = tbc.encrypt(tweak, key, [0b00000000]+N) C.append(xor(M[l], encryption)) return C -- cgit v1.2.3 From c616151cbfdd3c7b3882c16656b4f8af74d48519 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Thu, 27 Jun 2019 16:36:11 +0200 Subject: Réécriture des commentaires schématiques sur les tweaks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/ref/lilliput-ae-utils.h | 13 ++++++++----- src/ref/lilliput-i.c | 28 ++++++++++++++++------------ src/ref/lilliput-ii.c | 30 ++++++++++++++++++------------ 3 files changed, 42 insertions(+), 29 deletions(-) diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index a66b75c..19b4623 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -102,12 +102,15 @@ static inline void fill_index_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, t]: block index - * [ 5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 t + * [ prefix || block index ] + * + * The s-bit block index is encoded as follows: + * + * 5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] */ tweak[0] = prefix<<4; diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index fb06237..3358b10 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -44,13 +44,15 @@ static uint8_t _lower_nibble(uint8_t i) static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: + * + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function sets bits 5 to t-s once and for all. */ @@ -77,13 +79,15 @@ static void _fill_msg_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function assumes bits 5 to t-s have already been set, and * only sets bits 1 to 4 and t-s+1 to t. diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index 9ed17a2..bb43d08 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -28,12 +28,15 @@ This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2. static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag[ 2, t] XOR block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function sets bits 1 to t-s once and for all. */ @@ -44,12 +47,15 @@ static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BY static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag + block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function assumes bits 1 to t-s have already been set, and * only sets bits t-s+1 to t. @@ -67,8 +73,8 @@ static void _fill_tag_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BY { /* The t-bit tweak is filled as follows: * - * [ 1, 8]: 0001||0^4 - * [t-|N|+1, t]: N + * 1 4 5 8 t-|N|+1 t + * [ 0001 || 0^4 || nonce ] */ tweak[0] = 0x10; -- cgit v1.2.3 From 6539c825b51dcb1bf5181e5aba91cdc41ff0850f Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Thu, 4 Jul 2019 17:24:52 +0200 Subject: Ajout d'indices dans les traces --- test/debug.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/debug.h b/test/debug.h index d958475..56cd123 100644 --- a/test/debug.h +++ b/test/debug.h @@ -30,7 +30,7 @@ static inline void debug_dump_buffer(const char *header, size_t len, const uint8 for (size_t line=0; line %zu]", line, b, line*8+b); */ @@ -42,7 +42,7 @@ static inline void debug_dump_buffer(const char *header, size_t len, const uint8 size_t rest = len%8; if (rest != 0) { - fprintf(DUMP, "%*s", indent, ""); + fprintf(DUMP, "%*s[0x%02zx] ", indent, "", len-rest); for (size_t b=0; b Date: Fri, 5 Jul 2019 11:06:43 +0200 Subject: Ajout d'une explication dans le changelog --- CHANGELOG.txt | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/CHANGELOG.txt b/CHANGELOG.txt index 5a15c61..2e92008 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -38,6 +38,25 @@ ref - lane 6: M_R^3 (unchanged) (multiplications.h, tweakey.c) +[break] +- Make byte string concatenation more consistent in AE modes: + + - v1 mixed two interpretations of concatenation: + 1. M_0 || M_1 was interpreted as { M[0], ... M[15] } || { M[16], ... M[31] }, + 2. pad(10*) and tweak-building functions interpreted X||Y as { Y[0], ... Y[ylen-1] } || { X[0], ... X[xlen-1] }. + + This was potentially confusing, and also led to inefficient hardware implementations. E.g. a message M of length 34 bytes was padded as follows: + + M_0 M_1 pad10*(M_*) + { M[0], ... M[15] } || { M[16], ... M[31] } || { 0, ... 0, 0x80, M[32], M[33] } + + - v1.1 sticks to the first interpretation. The same message M is now padded as follows: + + M_0 M_1 pad10*(M_*) + { M[0], ... M[15] } || { M[16], ... M[31] } || { M[32], M[33], 0x80, 0, ... 0 } + + (lilliput-ae-utils.h, lilliput-i.c, lilliput-ii.c) + add_felicsref ------------- -- cgit v1.2.3