From 12fb79910fd7072571e9de1e5c34353d564bc047 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Wed, 12 Jun 2019 17:34:41 +0200 Subject: Changement de la concaténation des chaînes de bits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit L'implémentation précédente n'était pas cohérente. Étant données deux chaînes X et Y de longueur x et y, et Z=X∥Y de longueur z=x+y, - pad10* et la construction des tweaks fonctionnaient selon la logique "indices faibles = LSB", donc Z[0] = Y[0] Z[z-1] = X[x-1] - le découpage de M, C et A en blocs fonctionnait selon la logique "indices faibles = premiers blocs", donc Z[0] = X[0] Z[z-1] = Y[y-1] En conséquence, la façon dont M, C et A étaient paddés n'avait aucun sens, e.g. pour un message M de taille 35, pad10*(M*) donnait : { M[34], M[33], M[32], 0b10000000, 0, … } Les deux seules façons logiques de padder M* sont { M[32], M[33], M[34], 0b10000000, 0, … } ou { M[2], M[1], M[0], 0b10000000, 0, … } Après revue d'autres implémentations de ΘCB3 et SCT-2, j'ai choisi de suivre la convention MSB. En conséquence, quand la spécification dit Z = X∥Y L'implémentation traduira : Z[] = { X[0], … X[x-1], Y[0], … Y[y-1] } Dans la même logique, les compteurs de blocs seront insérés MSB d'abord et paddés en conséquence, e.g. j=0x01020304 ≡ J[] = { 0, …, 0x01, 0x02, 0x03, 0x04 } --- src/ref/lilliput-ae-utils.h | 62 ++++++++++++++++++++--------------------- src/ref/lilliput-i.c | 67 +++++++++++++++++++++++++-------------------- src/ref/lilliput-ii.c | 40 +++++++++++++-------------- 3 files changed, 87 insertions(+), 82 deletions(-) (limited to 'src') diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index 0efb776..a66b75c 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -28,16 +28,6 @@ This file provides functions used by both authenticated encryption modes. #include "constants.h" -static inline uint8_t upper_nibble(uint8_t i) -{ - return i >> 4; -} - -static inline uint8_t lower_nibble(uint8_t i) -{ - return i & 0x0f; -} - static inline void encrypt(const uint8_t K[KEY_BYTES], const uint8_t T[TWEAK_BYTES], const uint8_t M[BLOCK_BYTES], @@ -68,35 +58,41 @@ static inline void xor_arrays(size_t len, uint8_t out[len], const uint8_t a[len] static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BLOCK_BYTES]) { - /* pad10*(X) = X || 1 || 0^{n-|X|-1} */ - - /* For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 } + /* Assuming 0 < |X| < n: + * + * pad10*(X) = X || 1 || 0^{n-|X|-1} + * + * For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 } * * pad10*(X) = - * X[2] X[1] X[0] 1 0* - * 00000011 00000010 00000001 1 0000000 00000000... + * X[0] X[1] X[2] 1 0* + * 00000001 00000010 00000011 1 0000000 00000000... * - * - padded[0, 11]: zeroes - * - padded[12]: 10000000 - * - padded[13, 15]: X[0, 2] + * - padded[0, 2]: X[0, 2] + * - padded[3]: 10000000 + * - padded[4, 15]: zeroes */ - /* Assume that X_len> 8*i & 0xff; + dest[i] = index >> 8*(s-1-i); } } @@ -108,17 +104,17 @@ static inline void fill_index_tweak( { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-4]: block index - * [ 1, s]: actual block index - * [s+1, t-4]: 0-padding - * - bits [t-3, t]: 4-bit prefix + * [ 1, 4]: 4-bit prefix + * [ 5, t]: block index + * [ 5, t-s]: 0-padding + * [t-s+1, t]: actual block index, from MSB to LSB */ - copy_block_index(block_index, tweak); + tweak[0] = prefix<<4; /* Assume padding bytes have already been set to 0. */ - tweak[TWEAK_BYTES-1] |= prefix << 4; + copy_block_index(block_index, tweak); } static void process_associated_data( diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index 6f869c3..fb06237 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -32,58 +32,67 @@ static const uint8_t _0n[BLOCK_BYTES] = { }; +static uint8_t _upper_nibble(uint8_t i) +{ + return i >> 4; +} + +static uint8_t _lower_nibble(uint8_t i) +{ + return i & 0x0f; +} + static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES]) { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-|N|-4]: block index - * [ 1, s]: actual block index - * [ s+1, t-|N|-4]: 0-padding - * - bits [t-|N|-3, t-4]: nonce - * - bits [ t-3, t]: 4-bit prefix + * [ 1, 4]: 4-bit prefix + * [ 5, |N|+4]: nonce + * [ |N|+5, t]: block index + * [|N|+5, t-s]: 0-padding + * [t-s+1, t]: actual block index, from MSB to LSB * - * This function sets bits s+1 to t-4 once and for all. + * This function sets bits 5 to t-s once and for all. */ - size_t N_start = TWEAK_BYTES - NONCE_BYTES - 1; - - for (size_t i=sizeof(size_t); i Date: Fri, 14 Jun 2019 09:08:43 +0200 Subject: Adaptation de l'implémentation Python MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/add_python/lilliput/ae_common.py | 10 +++++----- src/add_python/lilliput/ae_mode_1.py | 25 ++++++++++++------------- src/add_python/lilliput/ae_mode_2.py | 32 +++++++++++++++++--------------- 3 files changed, 34 insertions(+), 33 deletions(-) (limited to 'src') diff --git a/src/add_python/lilliput/ae_common.py b/src/add_python/lilliput/ae_common.py index b94be1b..db14ec3 100644 --- a/src/add_python/lilliput/ae_common.py +++ b/src/add_python/lilliput/ae_common.py @@ -15,7 +15,7 @@ """Helper functions used in both Lilliput-I and Lilliput-II.""" -from .constants import BLOCK_BITS, BLOCK_BYTES +from .constants import BLOCK_BYTES from .helpers import xor from . import tbc @@ -48,11 +48,11 @@ def block_matrix_to_bytes(matrix): def pad10(X): zeroes = [0] * (BLOCK_BYTES-len(X)-1) - return zeroes + [0b10000000] + X + return X + [0b10000000] + zeroes def integer_to_byte_array(i, n): - return list(i.to_bytes(n, 'little')) + return list(i.to_bytes(n, 'big')) def _tweak_associated_data(t, i, padded): @@ -61,8 +61,8 @@ def _tweak_associated_data(t, i, padded): prefix = 0b0110 if padded else 0b0010 # Clear upper 4 bits and set them to prefix. - tweak[-1] &= 0b00001111 - tweak[-1] = prefix << 4 + tweak[0] &= 0b00001111 + tweak[0] |= prefix << 4 return tweak diff --git a/src/add_python/lilliput/ae_mode_1.py b/src/add_python/lilliput/ae_mode_1.py index 4a40b78..197bf37 100644 --- a/src/add_python/lilliput/ae_mode_1.py +++ b/src/add_python/lilliput/ae_mode_1.py @@ -52,27 +52,26 @@ def _lower_nibble(i): return i & 0b00001111 -def _byte_from_nibbles(lower, upper): - return upper<<4 | lower +def _byte(high, low): + return high<<4 ^ low def _tweak_message(N, j, prefix): - # j is encoded on 68 bits; get 72 and clear the upper 4. - j_len = (TWEAK_BITS-NONCE_BITS-4)//8 + 1 - tweak = integer_to_byte_array(j, j_len) - tweak[-1] &= 0b00001111 + tweak = [_byte(prefix.value, _upper_nibble(N[0]))] - # Add nonce. - tweak[-1] |= _lower_nibble(N[0]) << 4 tweak.extend( - _byte_from_nibbles(_upper_nibble(N[i-1]), _lower_nibble(N[i])) + _byte(_lower_nibble(N[i-1]), _upper_nibble(N[i])) for i in range(1, NONCE_BITS//8) ) - # Add last nibble from nonce and prefix. - tweak.append( - _byte_from_nibbles(_upper_nibble(N[-1]), prefix.value) - ) + # j is encoded on 68 bits; get 72 then set the upper 4 to the + # nonce's lower 4. + j_len = (TWEAK_BITS-NONCE_BITS-4)//8 + 1 + j_array = integer_to_byte_array(j, j_len) + j_array[0] &= 0b00001111 + j_array[0] |= _lower_nibble(N[-1]) << 4 + + tweak.extend(j_array) return tweak diff --git a/src/add_python/lilliput/ae_mode_2.py b/src/add_python/lilliput/ae_mode_2.py index 79d1bcd..a55ecb8 100644 --- a/src/add_python/lilliput/ae_mode_2.py +++ b/src/add_python/lilliput/ae_mode_2.py @@ -18,6 +18,8 @@ This module provides the functions for authenticated encryption and decryption using Lilliput-AE's nonce-misuse-resistant mode based on SCT-2. """ +from enum import Enum + from .constants import BLOCK_BYTES from .ae_common import ( bytes_to_block_matrix, @@ -35,22 +37,24 @@ TWEAK_BITS = 128 TWEAK_BYTES = TWEAK_BITS//8 -def _tweak_tag(j, padded): - tweak = integer_to_byte_array(j, TWEAK_BYTES) +class _TagTweak(Enum): + BLOCK = 0b0000 + PAD = 0b0100 - prefix = 0b0100 if padded else 0b0000 + +def _tweak_tag(j, prefix): + tweak = integer_to_byte_array(j, TWEAK_BYTES) # Clear upper 4 bits and set them to prefix. - tweak[-1] &= 0b00001111 - tweak[-1] = prefix << 4 + tweak[0] &= 0b00001111 + tweak[0] |= prefix.value << 4 return tweak def _add_tag_j(tag, j): - array_j = integer_to_byte_array(j, TWEAK_BYTES) - tweak = xor(tag, array_j) - tweak[-1] |= 0b10000000 + tweak = xor(tag, integer_to_byte_array(j, TWEAK_BYTES)) + tweak[0] |= 0b10000000 return tweak @@ -63,18 +67,16 @@ def _message_auth_tag(M, N, Auth, key): M = bytes_to_block_matrix(M) for j in range(0, l): - tweak = _tweak_tag(j, False) + tweak = _tweak_tag(j, _TagTweak.BLOCK) encryption = tbc.encrypt(tweak, key, M[j]) tag = xor(tag, encryption) if need_padding: - tweak = _tweak_tag(l, True) + tweak = _tweak_tag(l, _TagTweak.PAD) encryption = tbc.encrypt(tweak, key, pad10(M[l])) tag = xor(tag, encryption) - tweak = N + [0b00010000] - encryption = tbc.encrypt(tweak, key, tag) - tag = encryption + tag = tbc.encrypt([0b00010000]+N, key, tag) return tag @@ -88,12 +90,12 @@ def _message_encryption(M, N, tag, key): for j in range(0, l): tweak = _add_tag_j(tag, j) - encryption = tbc.encrypt(tweak, key, N+[0b00000000]) + encryption = tbc.encrypt(tweak, key, [0b00000000]+N) C.append(xor(M[j], encryption)) if need_padding: tweak = _add_tag_j(tag, l) - encryption = tbc.encrypt(tweak, key, N+[0b00000000]) + encryption = tbc.encrypt(tweak, key, [0b00000000]+N) C.append(xor(M[l], encryption)) return C -- cgit v1.2.3 From de866ad56fd465e89c9df6c6e12e0819098be386 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Thu, 27 Jun 2019 16:36:11 +0200 Subject: Réécriture des commentaires schématiques sur les tweaks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/ref/lilliput-ae-utils.h | 13 ++++++++----- src/ref/lilliput-i.c | 28 ++++++++++++++++------------ src/ref/lilliput-ii.c | 30 ++++++++++++++++++------------ 3 files changed, 42 insertions(+), 29 deletions(-) (limited to 'src') diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index a66b75c..19b4623 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -102,12 +102,15 @@ static inline void fill_index_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, t]: block index - * [ 5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 t + * [ prefix || block index ] + * + * The s-bit block index is encoded as follows: + * + * 5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] */ tweak[0] = prefix<<4; diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index fb06237..3358b10 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -44,13 +44,15 @@ static uint8_t _lower_nibble(uint8_t i) static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: + * + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function sets bits 5 to t-s once and for all. */ @@ -77,13 +79,15 @@ static void _fill_msg_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function assumes bits 5 to t-s have already been set, and * only sets bits 1 to 4 and t-s+1 to t. diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index 9ed17a2..bb43d08 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -28,12 +28,15 @@ This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2. static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag[ 2, t] XOR block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function sets bits 1 to t-s once and for all. */ @@ -44,12 +47,15 @@ static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BY static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag + block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function assumes bits 1 to t-s have already been set, and * only sets bits t-s+1 to t. @@ -67,8 +73,8 @@ static void _fill_tag_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BY { /* The t-bit tweak is filled as follows: * - * [ 1, 8]: 0001||0^4 - * [t-|N|+1, t]: N + * 1 4 5 8 t-|N|+1 t + * [ 0001 || 0^4 || nonce ] */ tweak[0] = 0x10; -- cgit v1.2.3