aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/hkdf.c45
-rw-r--r--src/hkdf.h8
-rw-r--r--src/nc-crypto.c42
-rw-r--r--src/nc-crypto.h8
-rw-r--r--src/nc-util.h179
-rw-r--r--src/noscrypt.c274
-rw-r--r--src/noscryptutil.c939
-rw-r--r--src/providers/bcrypt.c33
-rw-r--r--src/providers/mbedtls.c44
-rw-r--r--src/providers/monocypher.c2
-rw-r--r--src/providers/openssl.c281
11 files changed, 1595 insertions, 260 deletions
diff --git a/src/hkdf.c b/src/hkdf.c
index 0d91d14..7b0b822 100644
--- a/src/hkdf.c
+++ b/src/hkdf.c
@@ -21,23 +21,10 @@
#include "hkdf.h"
-/* Include string for memmove */
-#include <string.h>
-
#define HKDF_MIN(a, b) (a < b ? a : b)
STATIC_ASSERT(HKDF_IN_BUF_SIZE > SHA256_DIGEST_SIZE, "HDK Buffer must be at least the size of the underlying hashing alg output")
-static _nc_fn_inline void ncWriteSpanS(span_t* span, uint32_t offset, const uint8_t* data, uint32_t size)
-{
- DEBUG_ASSERT2(span != NULL, "Expected span to be non-null")
- DEBUG_ASSERT2(data != NULL, "Expected data to be non-null")
- DEBUG_ASSERT2(offset + size <= span->size, "Expected offset + size to be less than span size")
-
- /* Copy data to span */
- memmove(span->data + offset, data, size);
-}
-
static _nc_fn_inline void debugValidateHandler(const struct nc_hkdf_fn_cb_struct* handler)
{
DEBUG_ASSERT(handler != NULL)
@@ -55,16 +42,15 @@ static _nc_fn_inline void debugValidateHandler(const struct nc_hkdf_fn_cb_struct
cstatus_t hkdfExpandProcess(
const struct nc_hkdf_fn_cb_struct* handler,
void* ctx,
- const cspan_t* info,
- span_t* okm
+ cspan_t info,
+ span_t okm
)
{
cstatus_t result;
-
- uint8_t counter;
+ cspan_t tSpan, counterSpan;
uint32_t tLen, okmOffset;
+ uint8_t counter[1];
uint8_t t[HKDF_IN_BUF_SIZE];
- cspan_t tSpan, counterSpan;
debugValidateHandler(handler);
@@ -72,18 +58,18 @@ cstatus_t hkdfExpandProcess(
tLen = 0; /* T(0) is an empty string(zero length) */
okmOffset = 0;
- counter = 1; /* counter is offset by 1 for init */
+ counter[0] = 1; /* counter is offset by 1 for init */
result = CSTATUS_FAIL; /* Start in fail state */
- /* counter as a span */
- ncSpanInitC(&counterSpan, &counter, sizeof(counter));
+ /* span over counter value that points to the counter buffer */
+ ncSpanInitC(&counterSpan, counter, sizeof(counter));
/* Compute T(N) = HMAC(prk, T(n-1) | info | n) */
- while (okmOffset < okm->size)
+ while (okmOffset < okm.size)
{
ncSpanInitC(&tSpan, t, tLen);
- if (handler->update(ctx, &tSpan) != CSTATUS_OK)
+ if (handler->update(ctx, tSpan) != CSTATUS_OK)
{
goto Exit;
}
@@ -93,7 +79,7 @@ cstatus_t hkdfExpandProcess(
goto Exit;
}
- if (handler->update(ctx, &counterSpan) != CSTATUS_OK)
+ if (handler->update(ctx, counterSpan) != CSTATUS_OK)
{
goto Exit;
}
@@ -109,18 +95,15 @@ cstatus_t hkdfExpandProcess(
}
/* tlen becomes the hash size or remaining okm size */
- tLen = HKDF_MIN(okm->size - okmOffset, SHA256_DIGEST_SIZE);
+ tLen = HKDF_MIN(ncSpanGetSize(okm) - okmOffset, SHA256_DIGEST_SIZE);
DEBUG_ASSERT(tLen <= sizeof(t));
- /* write the T buffer back to okm */
- ncWriteSpanS(okm, okmOffset, t, tLen);
-
- /* shift base okm pointer by T */
- okmOffset += tLen;
+ /* write the T buffer back to okm and advance okmOffset by tLen */
+ ncSpanAppend(okm, &okmOffset, t, tLen);
/* increment counter */
- counter++;
+ (*counter)++;
}
result = CSTATUS_OK; /* HMAC operation completed, so set success */
diff --git a/src/hkdf.h b/src/hkdf.h
index 460e203..50ee6e8 100644
--- a/src/hkdf.h
+++ b/src/hkdf.h
@@ -42,20 +42,20 @@
/* typedefs for hdkf callback functions */
-typedef cstatus_t (*hmac_hash_func)(void* ctx, const cspan_t* data);
+typedef cstatus_t (*hmac_hash_fn)(void* ctx, cspan_t data);
typedef cstatus_t (*hmac_finish_fn)(void* ctx, sha256_t hmacOut32);
struct nc_hkdf_fn_cb_struct
{
- hmac_hash_func update;
+ hmac_hash_fn update;
hmac_finish_fn finish;
};
cstatus_t hkdfExpandProcess(
const struct nc_hkdf_fn_cb_struct* handler,
void* ctx,
- const cspan_t* info,
- span_t* okm
+ cspan_t info,
+ span_t okm
);
#endif /* !_NC_HKDF_H */
diff --git a/src/nc-crypto.c b/src/nc-crypto.c
index 99c072d..56bdf75 100644
--- a/src/nc-crypto.c
+++ b/src/nc-crypto.c
@@ -134,7 +134,7 @@ _IMPLSTB cstatus_t _dummyAesFunc(
#define _IMPL_CRYPTO_SHA256_HKDF_EXTRACT _fallbackHkdfExtract
- _IMPLSTB cstatus_t _fallbackHkdfExtract(const cspan_t* salt, const cspan_t* ikm, sha256_t prk)
+ _IMPLSTB cstatus_t _fallbackHkdfExtract(cspan_t salt, cspan_t ikm, sha256_t prk)
{
return _IMPL_CRYPTO_SHA256_HMAC(salt, ikm, prk);
}
@@ -217,11 +217,11 @@ uint32_t ncCryptoFixedTimeComp(const uint8_t* a, const uint8_t* b, uint32_t size
return _IMPL_CRYPTO_FIXED_TIME_COMPARE(a, b, size);
}
-cstatus_t ncCryptoDigestSha256(const cspan_t* data, sha256_t digestOut32)
+cstatus_t ncCryptoDigestSha256(cspan_t data, sha256_t digestOut32)
{
/* Debug arg validate */
- DEBUG_ASSERT2(data != NULL && data->data != NULL, "Expected data to be non-null")
- DEBUG_ASSERT2(digestOut32 != NULL, "Expected digestOut32 to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValidC(data), "Expected data to be non-null")
+ DEBUG_ASSERT2(digestOut32 != NULL, "Expected digestOut32 to be non-null")
#ifndef _IMPL_CRYPTO_SHA256_DIGEST
#error "No SHA256 implementation defined"
@@ -230,12 +230,12 @@ cstatus_t ncCryptoDigestSha256(const cspan_t* data, sha256_t digestOut32)
return _IMPL_CRYPTO_SHA256_DIGEST(data, digestOut32);
}
-cstatus_t ncCryptoHmacSha256(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32)
+cstatus_t ncCryptoHmacSha256(cspan_t key, cspan_t data, sha256_t hmacOut32)
{
/* Debug arg validate */
- DEBUG_ASSERT2(key != NULL && key->data != NULL, "Expected key to be non-null")
- DEBUG_ASSERT2(data != NULL && data->data != NULL, "Expected data to be non-null")
- DEBUG_ASSERT2(hmacOut32 != NULL && data->data != NULL, "Expected hmacOut32 to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValidC(key), "Expected key to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValidC(data), "Expected data to be non-null")
+ DEBUG_ASSERT2(hmacOut32 != NULL, "Expected hmacOut32 to be non-null")
#ifndef _IMPL_CRYPTO_SHA256_HMAC
#error "No SHA256 HMAC implementation defined"
@@ -244,12 +244,12 @@ cstatus_t ncCryptoHmacSha256(const cspan_t* key, const cspan_t* data, sha256_t h
return _IMPL_CRYPTO_SHA256_HMAC(key, data, hmacOut32);
}
-cstatus_t ncCryptoSha256HkdfExpand(const cspan_t* prk, const cspan_t* info, span_t* okm)
+cstatus_t ncCryptoSha256HkdfExpand(cspan_t prk, cspan_t info, span_t okm)
{
/* Debug arg validate */
- DEBUG_ASSERT2(prk != NULL && prk->data != NULL, "Expected prk to be non-null")
- DEBUG_ASSERT2(info != NULL && info->data != NULL, "Expected info to be non-null")
- DEBUG_ASSERT2(okm != NULL && okm->data != NULL, "Expected okm to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValidC(prk), "Expected prk to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValidC(info), "Expected info to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValid(okm), "Expected okm to be non-null")
/*
* RFC 5869: 2.3
@@ -258,7 +258,7 @@ cstatus_t ncCryptoSha256HkdfExpand(const cspan_t* prk, const cspan_t* info, span
* important as the counter is 1 byte, so it cannot overflow
*/
- if(okm->size > (uint32_t)(0xFFu * SHA256_DIGEST_SIZE))
+ if(okm.size > (uint32_t)(0xFFu * SHA256_DIGEST_SIZE))
{
return CSTATUS_FAIL;
}
@@ -270,12 +270,12 @@ cstatus_t ncCryptoSha256HkdfExpand(const cspan_t* prk, const cspan_t* info, span
return _IMPL_CRYPTO_SHA256_HKDF_EXPAND(prk, info, okm);
}
-cstatus_t ncCryptoSha256HkdfExtract(const cspan_t* salt, const cspan_t* ikm, sha256_t prk)
+cstatus_t ncCryptoSha256HkdfExtract(cspan_t salt, cspan_t ikm, sha256_t prk)
{
/* Debug arg validate */
- DEBUG_ASSERT2(salt != NULL, "Expected salt to be non-null")
- DEBUG_ASSERT2(ikm != NULL, "Expected ikm to be non-null")
- DEBUG_ASSERT2(prk != NULL, "Expected prk to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValidC(salt), "Expected salt to be non-null")
+ DEBUG_ASSERT2(ncSpanIsValidC(ikm), "Expected ikm to be non-null")
+ DEBUG_ASSERT2(prk != NULL, "Expected prk to be non-null")
#ifndef _IMPL_CRYPTO_SHA256_HKDF_EXTRACT
#error "No SHA256 HKDF extract implementation defined"
@@ -292,10 +292,10 @@ cstatus_t ncCryptoChacha20(
uint32_t dataSize
)
{
- DEBUG_ASSERT2(key != NULL, "Expected key to be non-null")
- DEBUG_ASSERT2(nonce != NULL, "Expected nonce to be non-null")
- DEBUG_ASSERT2(input != NULL, "Expected input to be non-null")
- DEBUG_ASSERT2(output != NULL, "Expected output to be non-null")
+ DEBUG_ASSERT2(key != NULL, "Expected key to be non-null");
+ DEBUG_ASSERT2(nonce != NULL, "Expected nonce to be non-null");
+ DEBUG_ASSERT2(input != NULL, "Expected input to be non-null");
+ DEBUG_ASSERT2(output != NULL, "Expected output to be non-null");
#ifndef _IMPL_CHACHA20_CRYPT
#error "No chacha20 implementation defined"
diff --git a/src/nc-crypto.h b/src/nc-crypto.h
index 11da6d3..a1545de 100644
--- a/src/nc-crypto.h
+++ b/src/nc-crypto.h
@@ -42,13 +42,13 @@ uint32_t ncCryptoFixedTimeComp(const uint8_t* a, const uint8_t* b, uint32_t size
void ncCryptoSecureZero(void* ptr, uint32_t size);
-cstatus_t ncCryptoDigestSha256(const cspan_t* data, sha256_t digestOut32);
+cstatus_t ncCryptoDigestSha256(cspan_t data, sha256_t digestOut32);
-cstatus_t ncCryptoHmacSha256(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32);
+cstatus_t ncCryptoHmacSha256(cspan_t key, cspan_t data, sha256_t hmacOut32);
-cstatus_t ncCryptoSha256HkdfExpand(const cspan_t* prk, const cspan_t* info, span_t* okm);
+cstatus_t ncCryptoSha256HkdfExpand(cspan_t prk, cspan_t info, span_t okm);
-cstatus_t ncCryptoSha256HkdfExtract(const cspan_t* salt, const cspan_t* ikm, sha256_t prk);
+cstatus_t ncCryptoSha256HkdfExtract(cspan_t salt, cspan_t ikm, sha256_t prk);
cstatus_t ncCryptoChacha20(
const uint8_t key[CHACHA_KEY_SIZE],
diff --git a/src/nc-util.h b/src/nc-util.h
index dd319c7..36d26de 100644
--- a/src/nc-util.h
+++ b/src/nc-util.h
@@ -68,6 +68,32 @@
#define _overflow_check(x)
#endif
+#ifdef NC_EXTREME_COMPAT
+
+ void _nc_memmove(void* dst, const void* src, uint32_t size)
+ {
+ uint32_t i;
+
+ for (i = 0; i < size; i++)
+ {
+ ((uint8_t*)dst)[i] = ((uint8_t*)src)[i];
+ }
+ }
+
+ #define MEMMOV _nc_memmove
+
+#else
+
+ /* Include string for memmove */
+ #include <string.h>
+ #define MEMMOV(dst, src, size) memmove(dst, src, size)
+
+#endif /* NC_EXTREME_COMPAT */
+
+#ifndef EMPTY_SPANS
+ #define EMPTY_SPANS 1
+#endif
+
typedef struct memory_span_struct
{
uint8_t* data;
@@ -80,6 +106,26 @@ typedef struct read_only_memory_span_struct
uint32_t size;
} cspan_t;
+static _nc_fn_inline int ncSpanIsValid(span_t span)
+{
+ return span.data != NULL;
+}
+
+static _nc_fn_inline int ncSpanIsValidC(cspan_t span)
+{
+ return span.data != NULL;
+}
+
+static _nc_fn_inline int ncSpanIsValidRange(span_t span, uint32_t offset, uint32_t size)
+{
+ return ncSpanIsValid(span) && offset + size <= span.size;
+}
+
+static _nc_fn_inline int ncSpanIsValidRangeC(cspan_t span, uint32_t offset, uint32_t size)
+{
+ return ncSpanIsValidC(span) && offset + size <= span.size;
+}
+
static _nc_fn_inline void ncSpanInitC(cspan_t* span, const uint8_t* data, uint32_t size)
{
span->data = data;
@@ -92,4 +138,137 @@ static _nc_fn_inline void ncSpanInit(span_t* span, uint8_t* data, uint32_t size)
span->size = size;
}
+static _nc_fn_inline const uint8_t* ncSpanGetOffsetC(cspan_t span, uint32_t offset)
+{
+
+#if EMPTY_SPANS
+
+ /*
+ * Allow passing null pointers for empty spans, if enabled,
+ * otherwise debug guards will catch empty spans
+ */
+ if (span.size == 0 && offset == 0)
+ {
+ return NULL;
+ }
+
+#endif /* !EMPTY_SPANS */
+
+ DEBUG_ASSERT2(ncSpanIsValidC(span), "Expected span to be non-null");
+ DEBUG_ASSERT2(offset < span.size, "Expected offset to be less than span size");
+
+ return span.data + offset;
+}
+
+static _nc_fn_inline uint8_t* ncSpanGetOffset(span_t span, uint32_t offset)
+{
+ cspan_t cspan;
+ ncSpanInitC(&cspan, span.data, span.size);
+ return (uint8_t*)ncSpanGetOffsetC(cspan, offset);
+}
+
+static _nc_fn_inline uint32_t ncSpanGetSizeC(cspan_t span)
+{
+ return ncSpanIsValidC(span)
+ ? span.size
+ : 0;
+}
+
+static _nc_fn_inline uint32_t ncSpanGetSize(span_t span)
+{
+ return ncSpanIsValid(span)
+ ? span.size
+ : 0;
+}
+
+static _nc_fn_inline void ncSpanWrite(span_t span, uint32_t offset, const uint8_t* data, uint32_t size)
+{
+ DEBUG_ASSERT2(ncSpanIsValid(span), "Expected span to be non-null")
+ DEBUG_ASSERT2(data != NULL, "Expected data to be non-null")
+ DEBUG_ASSERT2(offset + size <= span.size, "Expected offset + size to be less than span size")
+
+ /* Copy data to span */
+ MEMMOV(span.data + offset, data, size);
+}
+
+static _nc_fn_inline void ncSpanAppend(span_t span, uint32_t* offset, const uint8_t* data, uint32_t size)
+{
+ DEBUG_ASSERT2(offset != NULL, "Expected offset to be non-null")
+
+ /* Copy data to span (also performs argument assertions) */
+ ncSpanWrite(span, *offset, data, size);
+
+ /* Increment offset */
+ *offset += size;
+}
+
+static _nc_fn_inline span_t ncSpanSlice(span_t span, uint32_t offset, uint32_t size)
+{
+ span_t slice;
+
+ DEBUG_ASSERT2(ncSpanIsValid(span), "Expected span to be non-null");
+ DEBUG_ASSERT2(offset + size <= span.size, "Expected offset + size to be less than span size")
+
+ /* Initialize slice, offset input data by the specified offset */
+ ncSpanInit(
+ &slice,
+ ncSpanGetOffset(span, offset),
+ size
+ );
+
+ return slice;
+}
+
+static _nc_fn_inline cspan_t ncSpanSliceC(cspan_t span, uint32_t offset, uint32_t size)
+{
+ cspan_t slice;
+
+ DEBUG_ASSERT2(ncSpanIsValidC(span), "Expected span to be non-null");
+ DEBUG_ASSERT2(offset + size <= span.size, "Expected offset + size to be less than span size")
+
+ /* Initialize slice, offset input data by the specified offset */
+ ncSpanInitC(
+ &slice,
+ ncSpanGetOffsetC(span, offset),
+ size
+ );
+
+ return slice;
+}
+
+static _nc_fn_inline void ncSpanCopyC(cspan_t src, span_t dest)
+{
+ DEBUG_ASSERT2(ncSpanIsValidC(src), "Expected span to be non-null");
+ DEBUG_ASSERT2(ncSpanIsValid(dest), "Expected offset + size to be less than span size");
+ DEBUG_ASSERT2(dest.size >= src.size, "Output buffer too small. Overrun detected");
+
+ /* Copy data to span */
+ MEMMOV(dest.data, src.data, src.size);
+}
+
+static _nc_fn_inline void ncSpanCopy(span_t src, span_t dest)
+{
+ cspan_t csrc;
+
+ ncSpanInitC(&csrc, src.data, src.size);
+ ncSpanCopyC(csrc, dest);
+}
+
+static _nc_fn_inline void ncSpanReadC(cspan_t src, uint8_t* dest, uint32_t size)
+{
+ span_t dsts;
+
+ ncSpanInit(&dsts, dest, size);
+ ncSpanCopyC(src, dsts);
+}
+
+static _nc_fn_inline void ncSpanRead(span_t src, uint8_t* dest, uint32_t size)
+{
+ cspan_t srcs;
+
+ ncSpanInitC(&srcs, src.data, src.size);
+ ncSpanReadC(srcs, dest, size);
+}
+
+
#endif /* !_NC_UTIL_H */ \ No newline at end of file
diff --git a/src/noscrypt.c b/src/noscrypt.c
index 4254ee2..fededaf 100644
--- a/src/noscrypt.c
+++ b/src/noscrypt.c
@@ -32,10 +32,6 @@
*/
#define ZERO_FILL(x, size) ncCryptoSecureZero(x, size)
-/* Include string for memmove */
-#include <string.h>
-#define MEMMOV(dst, src, size) memmove(dst, src, size)
-
/*
* Validation macros
*/
@@ -44,7 +40,6 @@
#define CHECK_INVALID_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_INVALID_ARG, argPos);
#define CHECK_NULL_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_NULL_PTR, argPos);
#define CHECK_ARG_RANGE(x, min, max, argPos) if(x < min || x > max) return NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, argPos);
- #define CHECK_CONTEXT_STATE(ctx, argPos) CHECK_INVALID_ARG(ctx->secpCtx, argPos)
#else
/* empty macros */
#define CHECK_INVALID_ARG(x)
@@ -52,6 +47,8 @@
#define CHECK_ARG_RANGE(x, min, max, argPos)
#endif /* !NC_DISABLE_INPUT_VALIDATION */
+#define CHECK_CONTEXT_STATE(ctx, argPos) CHECK_INVALID_ARG(ctx->secpCtx, argPos)
+
/*
* Actual, private defintion of the NCContext structure
* to allow for future development and ABI backords
@@ -247,7 +244,9 @@ static _nc_fn_inline NCResult _computeConversationKey(
ncSpanInitC(&saltSpan, Nip44ConstantSalt, sizeof(Nip44ConstantSalt));
ncSpanInitC(&ikmSpan, sharedSecret->value, NC_SHARED_SEC_SIZE);
- return ncCryptoSha256HkdfExtract(&saltSpan, &ikmSpan, ck->value) == CSTATUS_OK ? NC_SUCCESS : E_OPERATION_FAILED;
+ return ncCryptoSha256HkdfExtract(saltSpan, ikmSpan, ck->value) == CSTATUS_OK
+ ? NC_SUCCESS
+ : E_OPERATION_FAILED;
}
@@ -275,14 +274,13 @@ static cstatus_t _chachaEncipher(const struct nc_expand_keys* keys, NCEncryption
static _nc_fn_inline cstatus_t _getMessageKey(
const struct conversation_key* converstationKey,
- const cspan_t* nonce,
+ cspan_t nonce,
struct message_key* messageKey
)
{
cspan_t prkSpan;
span_t okmSpan;
- DEBUG_ASSERT2(nonce != NULL, "Expected valid nonce buffer")
DEBUG_ASSERT2(converstationKey != NULL, "Expected valid conversation key")
DEBUG_ASSERT2(messageKey != NULL, "Expected valid message key buffer")
@@ -290,7 +288,7 @@ static _nc_fn_inline cstatus_t _getMessageKey(
ncSpanInit(&okmSpan, messageKey->value, sizeof(struct message_key)); /* Output produces a message key (write it directly to struct memory) */
/* Nonce is the info */
- return ncCryptoSha256HkdfExpand(&prkSpan, nonce, &okmSpan);
+ return ncCryptoSha256HkdfExpand(prkSpan, nonce, okmSpan);
}
static _nc_fn_inline NCResult _encryptNip44Ex(
@@ -312,10 +310,10 @@ static _nc_fn_inline NCResult _encryptNip44Ex(
result = NC_SUCCESS;
- ncSpanInitC(&nonceSpan, args->nonceData, NC_ENCRYPTION_NONCE_SIZE);
+ ncSpanInitC(&nonceSpan, args->nonceData, NC_NIP44_IV_SIZE);
/* Message key will be derrived on every encryption call */
- if (_getMessageKey(ck, &nonceSpan, &messageKey) != CSTATUS_OK)
+ if (_getMessageKey(ck, nonceSpan, &messageKey) != CSTATUS_OK)
{
result = E_OPERATION_FAILED;
goto Cleanup;
@@ -346,15 +344,16 @@ static _nc_fn_inline NCResult _decryptNip44Ex(const NCContext* ctx, const struct
struct message_key messageKey;
const struct nc_expand_keys* cipherKeys;
- DEBUG_ASSERT2(ctx != NULL, "Expected valid context")
- DEBUG_ASSERT2(ck != NULL, "Expected valid conversation key")
- DEBUG_ASSERT2(args != NULL, "Expected valid encryption args")
+ DEBUG_ASSERT2(ctx != NULL, "Expected valid context");
+ DEBUG_ASSERT2(ck != NULL, "Expected valid conversation key");
+ DEBUG_ASSERT2(args != NULL, "Expected valid encryption args");
+ DEBUG_ASSERT(args->version == NC_ENC_VERSION_NIP44);
result = NC_SUCCESS;
- ncSpanInitC(&nonceSpan, args->nonceData, NC_ENCRYPTION_NONCE_SIZE);
+ ncSpanInitC(&nonceSpan, args->nonceData, NC_NIP44_IV_SIZE);
- if (_getMessageKey(ck, &nonceSpan, &messageKey) != CSTATUS_OK)
+ if (_getMessageKey(ck, nonceSpan, &messageKey) != CSTATUS_OK)
{
result = E_OPERATION_FAILED;
goto Cleanup;
@@ -375,17 +374,16 @@ Cleanup:
return result;
}
-static _nc_fn_inline cstatus_t _computeHmac(const uint8_t key[NC_HMAC_KEY_SIZE], const cspan_t* payload, sha256_t hmacOut)
+static _nc_fn_inline cstatus_t _computeHmac(const uint8_t key[NC_HMAC_KEY_SIZE], cspan_t payload, sha256_t hmacOut)
{
cspan_t keySpan;
DEBUG_ASSERT2(key != NULL, "Expected valid hmac key")
- DEBUG_ASSERT2(payload != NULL, "Expected valid mac verification args")
DEBUG_ASSERT2(hmacOut != NULL, "Expected valid hmac output buffer")
ncSpanInitC(&keySpan, key, NC_HMAC_KEY_SIZE);
- return ncCryptoHmacSha256(&keySpan, payload, hmacOut);
+ return ncCryptoHmacSha256(keySpan, payload, hmacOut);
}
static NCResult _verifyMacEx(
@@ -404,14 +402,14 @@ static NCResult _verifyMacEx(
DEBUG_ASSERT2(conversationKey != NULL, "Expected valid conversation key")
DEBUG_ASSERT2(args != NULL, "Expected valid mac verification args")
- ncSpanInitC(&nonceSpan, args->nonce32, NC_ENCRYPTION_NONCE_SIZE);
+ ncSpanInitC(&nonceSpan, args->nonce32, NC_NIP44_IV_SIZE);
ncSpanInitC(&payloadSpan, args->payload, args->payloadSize);
/*
* Message key is again required for the hmac verification
*/
- if (_getMessageKey((struct conversation_key*)conversationKey, &nonceSpan, &messageKey) != CSTATUS_OK)
+ if (_getMessageKey((struct conversation_key*)conversationKey, nonceSpan, &messageKey) != CSTATUS_OK)
{
result = E_OPERATION_FAILED;
goto Cleanup;
@@ -423,7 +421,7 @@ static NCResult _verifyMacEx(
/*
* Compute the hmac of the data using the computed hmac key
*/
- if (_computeHmac(keys->hmac_key, &payloadSpan, hmacOut) != CSTATUS_OK)
+ if (_computeHmac(keys->hmac_key, payloadSpan, hmacOut) != CSTATUS_OK)
{
result = E_OPERATION_FAILED;
goto Cleanup;
@@ -442,6 +440,40 @@ Cleanup:
/*
* EXTERNAL API FUNCTIONS
*/
+
+
+NC_EXPORT NCResult NC_CC NCResultWithArgPosition(NCResult err, uint8_t argPosition)
+{
+ return -(((NCResult)argPosition << NC_ARG_POSITION_OFFSET) | -err);
+}
+
+NC_EXPORT int NC_CC NCParseErrorCode(NCResult result, uint8_t* argPositionOut)
+{
+ NCResult asPositive;
+ int code;
+
+ /* convert result to a positive value*/
+ asPositive = -result;
+
+ /* Get the error code from the lower 8 bits and the argument position from the upper 8 bits*/
+ code = -(asPositive & NC_ERROR_CODE_MASK);
+
+ /* Allow argument position assignment to be null */
+ if (argPositionOut)
+ {
+ *argPositionOut = (asPositive >> NC_ARG_POSITION_OFFSET) & 0xFF;
+ }
+
+ return code;
+}
+
+/* =============================
+*
+* Context functions
+*
+* =============================
+*/
+
NC_EXPORT uint32_t NC_CC NCGetContextStructSize(void)
{
return sizeof(NCContext);
@@ -499,7 +531,13 @@ NC_EXPORT NCResult NC_CC NCDestroyContext(NCContext* ctx)
return NC_SUCCESS;
}
-/* KEY Functions */
+/* =============================
+*
+* ECDSA functions
+*
+* =============================
+*/
+
NC_EXPORT NCResult NC_CC NCGetPublicKey(
const NCContext* ctx,
const NCSecretKey* sk,
@@ -615,7 +653,7 @@ NC_EXPORT NCResult NC_CC NCSignData(
ncSpanInitC(&dataSpan, data, dataSize);
/* Compute sha256 of the data before signing */
- if(ncCryptoDigestSha256(&dataSpan, digest) != CSTATUS_OK)
+ if(ncCryptoDigestSha256(dataSpan, digest) != CSTATUS_OK)
{
return E_INVALID_ARG;
}
@@ -673,7 +711,7 @@ NC_EXPORT NCResult NC_CC NCVerifyData(
ncSpanInitC(&dataSpan, data, dataSize);
/* Compute sha256 of the data before verifying */
- if (ncCryptoDigestSha256(&dataSpan, digest) != CSTATUS_OK)
+ if (ncCryptoDigestSha256(dataSpan, digest) != CSTATUS_OK)
{
return E_INVALID_ARG;
}
@@ -681,7 +719,12 @@ NC_EXPORT NCResult NC_CC NCVerifyData(
return NCVerifyDigest(ctx, pk, digest, sig64);
}
-/* ECDH Functions */
+/* =============================
+*
+* ECDH functions
+*
+* =============================
+*/
NC_EXPORT NCResult NC_CC NCGetSharedSecret(
const NCContext* ctx,
@@ -774,7 +817,12 @@ NC_EXPORT NCResult NC_CC NCEncryptEx(
return E_VERSION_NOT_SUPPORTED;
case NC_ENC_VERSION_NIP44:
- return _encryptNip44Ex(ctx, (struct conversation_key*)conversationKey, args->keyData, args);
+ return _encryptNip44Ex(
+ ctx,
+ (struct conversation_key*)conversationKey,
+ args->keyData,
+ args
+ );
default:
return E_VERSION_NOT_SUPPORTED;
@@ -803,8 +851,6 @@ NC_EXPORT NCResult NC_CC NCEncrypt(
CHECK_INVALID_ARG(args->inputData, 3)
CHECK_INVALID_ARG(args->outputData, 3)
CHECK_INVALID_ARG(args->nonceData, 3)
- CHECK_INVALID_ARG(args->keyData, 3)
- CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3)
result = E_OPERATION_FAILED;
@@ -812,6 +858,10 @@ NC_EXPORT NCResult NC_CC NCEncrypt(
{
case NC_ENC_VERSION_NIP44:
{
+ /* Mac key output is only needed for nip44 */
+ CHECK_INVALID_ARG(args->keyData, 3)
+ CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3)
+
/* Compute the shared point */
if ((result = _computeSharedSecret(ctx, sk, pk, &sharedSecret)) != NC_SUCCESS)
{
@@ -846,8 +896,8 @@ Cleanup:
}
NC_EXPORT NCResult NC_CC NCDecryptEx(
- const NCContext* ctx,
- const uint8_t conversationKey[NC_CONV_KEY_SIZE],
+ const NCContext* ctx,
+ const uint8_t conversationKey[NC_CONV_KEY_SIZE],
NCEncryptionArgs* args
)
{
@@ -864,12 +914,12 @@ NC_EXPORT NCResult NC_CC NCDecryptEx(
switch (args->version)
{
- case NC_ENC_VERSION_NIP44:
- return _decryptNip44Ex(ctx, (struct conversation_key*)conversationKey, args);
+ case NC_ENC_VERSION_NIP44:
+ return _decryptNip44Ex(ctx, (struct conversation_key*)conversationKey, args);
- case NC_ENC_VERSION_NIP04:
- default:
- return E_VERSION_NOT_SUPPORTED;
+ case NC_ENC_VERSION_NIP04:
+ default:
+ return E_VERSION_NOT_SUPPORTED;
}
}
@@ -900,26 +950,26 @@ NC_EXPORT NCResult NC_CC NCDecrypt(
switch (args->version)
{
- case NC_ENC_VERSION_NIP44:
+ case NC_ENC_VERSION_NIP44:
+ {
+ if ((result = _computeSharedSecret(ctx, sk, pk, &sharedSecret)) != NC_SUCCESS)
{
- if ((result = _computeSharedSecret(ctx, sk, pk, &sharedSecret)) != NC_SUCCESS)
- {
- goto Cleanup;
- }
-
- if ((result = _computeConversationKey(ctx, &sharedSecret, &conversationKey)) != NC_SUCCESS)
- {
- goto Cleanup;
- }
+ goto Cleanup;
+ }
- result = _decryptNip44Ex(ctx, &conversationKey, args);
+ if ((result = _computeConversationKey(ctx, &sharedSecret, &conversationKey)) != NC_SUCCESS)
+ {
+ goto Cleanup;
}
- break;
- case NC_ENC_VERSION_NIP04:
- default:
- result = E_VERSION_NOT_SUPPORTED;
- break;
+ result = _decryptNip44Ex(ctx, &conversationKey, args);
+ }
+ break;
+
+ case NC_ENC_VERSION_NIP04:
+ default:
+ result = E_VERSION_NOT_SUPPORTED;
+ break;
}
Cleanup:
@@ -930,7 +980,7 @@ Cleanup:
return result;
}
-NC_EXPORT NCResult NCComputeMac(
+NC_EXPORT NCResult NC_CC NCComputeMac(
const NCContext* ctx,
const uint8_t hmacKey[NC_HMAC_KEY_SIZE],
const uint8_t* payload,
@@ -952,7 +1002,7 @@ NC_EXPORT NCResult NCComputeMac(
/*
* Compute the hmac of the data using the supplied hmac key
*/
- return _computeHmac(hmacKey, &payloadSpan, hmacOut) == CSTATUS_OK ? NC_SUCCESS : E_OPERATION_FAILED;
+ return _computeHmac(hmacKey, payloadSpan, hmacOut) == CSTATUS_OK ? NC_SUCCESS : E_OPERATION_FAILED;
}
@@ -1020,99 +1070,88 @@ Cleanup:
#define ENSURE_ENC_MODE(args, mode) if(args->version != mode) return E_VERSION_NOT_SUPPORTED;
-NC_EXPORT NCResult NCSetEncryptionPropertyEx(
+NC_EXPORT NCResult NC_CC NCEncryptionSetPropertyEx(
NCEncryptionArgs* args,
uint32_t property,
uint8_t* value,
uint32_t valueLen
)
{
+ uint32_t ivSize;
CHECK_NULL_ARG(args, 0)
CHECK_NULL_ARG(value, 2)
switch (property)
{
- case NC_ENC_SET_VERSION:
-
- /* Ensure version is proper length */
- CHECK_ARG_RANGE(valueLen, sizeof(uint32_t), sizeof(uint32_t), 2)
-
- args->version = *((uint32_t*)value);
-
- return NC_SUCCESS;
+ case NC_ENC_SET_VERSION:
- case NC_ENC_SET_NIP04_IV:
- /*
- * The safest way to store the nip04 IV is in the nonce
- * field. An IV is essentially a nonce. A secure random
- * number used to encrypt the first block of a CBC chain.
- */
-
- CHECK_ARG_RANGE(valueLen, AES_IV_SIZE, UINT32_MAX, 3)
+ /* Ensure version is proper length */
+ CHECK_ARG_RANGE(valueLen, sizeof(uint32_t), sizeof(uint32_t), 2)
- ENSURE_ENC_MODE(args, NC_ENC_VERSION_NIP04)
+ args->version = *((uint32_t*)value);
- args->nonceData = value;
+ return NC_SUCCESS;
- return NC_SUCCESS;
-
+ case NC_ENC_SET_NIP04_KEY:
+ /*
+ * The AES key is stored in the hmac key field, since
+ * it won't be used for the operating and should be the same size
+ * as the hmac key.
+ */
- case NC_ENC_SET_NIP04_KEY:
- /*
- * The AES key is stored in the hmac key field, since
- * it won't be used for the operating and should be the same size
- * as the hmac key.
- */
-
- CHECK_ARG_RANGE(valueLen, AES_KEY_SIZE, UINT32_MAX, 3)
+ CHECK_ARG_RANGE(valueLen, AES_KEY_SIZE, UINT32_MAX, 3)
- ENSURE_ENC_MODE(args, NC_ENC_VERSION_NIP04)
+ ENSURE_ENC_MODE(args, NC_ENC_VERSION_NIP04)
- args->keyData = value;
+ args->keyData = value;
- return NC_SUCCESS;
+ return NC_SUCCESS;
- case NC_ENC_SET_NIP44_NONCE:
+ case NC_ENC_SET_IV:
- /* Nonce buffer must be at least the size, max doesnt matter */
- CHECK_ARG_RANGE(valueLen, NC_ENCRYPTION_NONCE_SIZE, UINT32_MAX, 3)
+ ivSize = NCEncryptionGetIvSize(args->version);
+
+ /* Gaurd invalid version */
+ if (ivSize == 0)
+ {
+ return E_VERSION_NOT_SUPPORTED;
+ }
- /* Nonce is only used in nip44 mode */
- ENSURE_ENC_MODE(args, NC_ENC_VERSION_NIP44)
+ CHECK_ARG_RANGE(valueLen, ivSize, ivSize, 3)
- args->nonceData = value;
+ args->nonceData = value;
- return NC_SUCCESS;
+ return NC_SUCCESS;
- case NC_ENC_SET_NIP44_MAC_KEY:
-
- /* The maximum size of the buffer doesn't matter as long as its larger than the key size */
- CHECK_ARG_RANGE(valueLen, NC_HMAC_KEY_SIZE, UINT32_MAX, 3)
+ case NC_ENC_SET_NIP44_MAC_KEY:
- /* Mac key is only used in nip44 mode */
- ENSURE_ENC_MODE(args, NC_ENC_VERSION_NIP44)
+ /* The maximum size of the buffer doesn't matter as long as its larger than the key size */
+ CHECK_ARG_RANGE(valueLen, NC_HMAC_KEY_SIZE, UINT32_MAX, 3)
- /*
- * During encryption the key data buffer is used
- * to write the hmac hey used for MAC computation
- * operations.
- */
- args->keyData = value;
+ /* Mac key is only used in nip44 mode */
+ ENSURE_ENC_MODE(args, NC_ENC_VERSION_NIP44)
- return NC_SUCCESS;
+ /*
+ * During encryption the key data buffer is used
+ * to write the hmac hey used for MAC computation
+ * operations.
+ */
+ args->keyData = value;
+
+ return NC_SUCCESS;
}
return E_INVALID_ARG;
}
-NC_EXPORT NCResult NCSetEncryptionProperty(
+NC_EXPORT NCResult NC_CC NCEncryptionSetProperty(
NCEncryptionArgs* args,
uint32_t property,
uint32_t value
)
{
- return NCSetEncryptionPropertyEx(
+ return NCEncryptionSetPropertyEx(
args,
property,
(uint8_t*)&value,
@@ -1120,7 +1159,7 @@ NC_EXPORT NCResult NCSetEncryptionProperty(
);
}
-NC_EXPORT NCResult NCSetEncryptionData(
+NC_EXPORT NCResult NC_CC NCEncryptionSetData(
NCEncryptionArgs* args,
const uint8_t* input,
uint8_t* output,
@@ -1137,4 +1176,19 @@ NC_EXPORT NCResult NCSetEncryptionData(
args->dataSize = dataSize;
return NC_SUCCESS;
-} \ No newline at end of file
+}
+
+NC_EXPORT uint32_t NC_CC NCEncryptionGetIvSize(uint32_t version)
+{
+ switch (version)
+ {
+ case NC_ENC_VERSION_NIP04:
+ return NC_NIP04_IV_SIZE;
+
+ case NC_ENC_VERSION_NIP44:
+ return NC_NIP44_IV_SIZE;
+
+ default:
+ return 0;
+ }
+}
diff --git a/src/noscryptutil.c b/src/noscryptutil.c
new file mode 100644
index 0000000..89e0f35
--- /dev/null
+++ b/src/noscryptutil.c
@@ -0,0 +1,939 @@
+/*
+* Copyright (c) 2024 Vaughn Nugent
+*
+* Package: noscrypt
+* File: noscryptutil.h
+*
+* This library is free software; you can redistribute it and/or
+* modify it under the terms of the GNU Lesser General Public License
+* as published by the Free Software Foundation; either version 2.1
+* of the License, or (at your option) any later version.
+*
+* This library is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public License
+* along with noscrypt. If not, see http://www.gnu.org/licenses/.
+*/
+
+
+#include <stdlib.h>
+
+#include "nc-util.h"
+#include "nc-crypto.h"
+
+#include <noscryptutil.h>
+
+/*
+* Validation macros
+*/
+
+#ifdef NC_EXTREME_COMPAT
+ #error "Utilities library must be disabled when using extreme compat mode"
+#endif /* NC_EXTREME_COMPAT */
+
+#define MIN_PADDING_SIZE 0x20u
+#define NIP44_VERSION_SIZE 0x01u
+#define NIP44_PT_LEN_SIZE sizeof(uint16_t)
+#define NIP44_NONCE_SIZE NC_NIP44_IV_SIZE
+
+/*
+* minimum size for a valid nip44 payload
+* 1 byte version + 32 byte nonce + 32 byte mac + 2 byte ptSize + 32bytes minimum length
+*/
+#define NIP44_MIN_PAYLOAD_SIZE (NIP44_VERSION_SIZE + 0x20 + 0x02 + 0x20 + 0x02)
+
+/*
+* Max payload size is the maximum size of the encrypted message
+* 1 byte version + 32 byte nonce + 32 byte mac + maximum ciphertext size
+*/
+#define NIP44_MAX_PAYLOAD_SIZE (NIP44_VERSION_SIZE + 0x20 + 0x20 + NIP44_MAX_ENC_MESSAGE_SIZE)
+
+/*
+* The minimum ciphertext size is the minimum padded size + the minimum
+* size of the plaintext length field
+*/
+#define NIP44_MIN_CIPHERTEXT_SIZE (MIN_PADDING_SIZE + NIP44_PT_LEN_SIZE)
+
+
+#define _nc_mem_free(x) if(x != NULL) { free(x); x = NULL; }
+#define _nc_mem_alloc(elements, size) calloc(elements, size);
+#define ZERO_FILL ncCryptoSecureZero
+
+#ifndef NC_INPUT_VALIDATION_OFF
+ #define CHECK_INVALID_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_INVALID_ARG, argPos);
+ #define CHECK_NULL_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_NULL_PTR, argPos);
+ #define CHECK_ARG_RANGE(x, min, max, argPos) if(x < min || x > max) return NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, argPos);
+ #define CHECK_ARG_IS(exp, argPos) if(!(exp)) return NCResultWithArgPosition(E_INVALID_ARG, argPos);
+#else
+ /* empty macros */
+ #define CHECK_INVALID_ARG(x)
+ #define CHECK_NULL_ARG(x, argPos)
+ #define CHECK_ARG_RANGE(x, min, max, argPos)
+ #define CHECK_ARG_IS(is, expected, argPos)
+#endif /* !NC_DISABLE_INPUT_VALIDATION */
+
+#ifdef _NC_IS_WINDOWS
+
+ #include <math.h>
+
+ /* performs a log2 on integer types */
+ #define _math_int_log2(x) (uint32_t)log2((double)x)
+
+#else
+ /*
+ * GCC/clang does not expose log2 so we can use the __builtin_clz
+ * to find leading zeros of an integer and subtract that from 31
+ * (bit positions) for int32
+ */
+ static _nc_fn_inline uint32_t _math_int_log2(uint32_t val)
+ {
+ DEBUG_ASSERT(val < UINT32_MAX);
+
+ return 31 - __builtin_clz(val);
+ }
+#endif
+
+/* Currently were on nip44 version 2 */
+static const uint8_t Nip44VersionValue[1] = { 0x02u };
+
+struct cipher_buffer_state {
+
+ cspan_t input;
+ span_t output;
+
+ cspan_t actualOutput;
+};
+
+struct nc_util_enc_struct {
+
+ uint32_t _flags;
+
+ NCEncryptionArgs encArgs;
+
+ struct cipher_buffer_state buffer;
+};
+
+static _nc_fn_inline span_t _ncUtilAllocSpan(uint32_t count, size_t size)
+{
+ span_t span;
+
+#if SIZE_MAX < UINT32_MAX
+
+ if (count > SIZE_MAX)
+ {
+ return span;
+ }
+
+#endif
+
+ span.data = _nc_mem_alloc((size_t)count, size);
+ span.size = (uint32_t)count;
+
+ return span;
+}
+
+static _nc_fn_inline void _ncUtilZeroSpan(span_t span)
+{
+ ZERO_FILL(span.data, span.size);
+}
+
+static _nc_fn_inline void _ncUtilFreeSpan(span_t span)
+{
+ _nc_mem_free(span.data);
+}
+
+static _nc_fn_inline uint32_t _calcNip44PtPadding(uint32_t plaintextSize)
+{
+ uint32_t chunk, nextPower, factor;
+
+ /*
+ * Taken from https://github.com/nostr-protocol/nips/blob/master/44.md
+ *
+ * I believe the idea is to add consisten padding for some better
+ * disgusing of the plainText data.
+ */
+
+ if (plaintextSize <= MIN_PADDING_SIZE)
+ {
+ return MIN_PADDING_SIZE;
+ }
+
+ /* Safe to subtract because pt > 0 */
+ nextPower = _math_int_log2(plaintextSize - 1);
+
+ nextPower += 1u;
+
+ nextPower = 1 << nextPower;
+
+ if (nextPower <= 256u)
+ {
+ chunk = 32u;
+ }
+ else
+ {
+ chunk = nextPower / 8u;
+ }
+
+ factor = plaintextSize - 1;
+
+ factor /= chunk;
+
+ factor += 1;
+
+ return chunk * factor;
+}
+
+static _nc_fn_inline uint32_t _calcNip44TotalOutSize(uint32_t inputSize)
+{
+ uint32_t bufferSize;
+
+ /*
+ * Buffer size for nip44 is calculated as follows:
+ * 1 byte for the version
+ * 32 bytes for the nonce
+ * 2 bytes for the length of the plainText
+ * ... padding size
+ * 32 bytes for the MAC
+ */
+
+ bufferSize = NIP44_VERSION_SIZE;
+
+ bufferSize += NIP44_NONCE_SIZE;
+
+ bufferSize += NIP44_PT_LEN_SIZE;
+
+ bufferSize += _calcNip44PtPadding(inputSize);
+
+ bufferSize += NC_ENCRYPTION_MAC_SIZE;
+
+ return bufferSize;
+}
+
+static _nc_fn_inline span_t _nip44GetMacData(span_t payload)
+{
+ DEBUG_ASSERT(payload.size > NIP44_VERSION_SIZE + NC_ENCRYPTION_MAC_SIZE);
+
+ /*
+ * The nip44 mac is computed over the nonce+encrypted ciphertext
+ *
+ * the ciphertext is the entire message buffer, so it includes
+ * version, nonce, data, padding, and mac space available.
+ *
+ * This function will return a span that points to the nonce+data
+ * segment of the buffer for mac computation.
+ *
+ * The nonce sits directly after the version byte, ct is after,
+ * and the remaining 32 bytes are for the mac. So that means
+ * macData = ct.size - version.size + mac.size
+ */
+
+ return ncSpanSlice(
+ payload,
+ NIP44_VERSION_SIZE,
+ payload.size - (NIP44_VERSION_SIZE + NC_ENCRYPTION_MAC_SIZE)
+ );
+}
+
+static _nc_fn_inline span_t _nip44GetMacOutput(span_t payload)
+{
+ DEBUG_ASSERT(payload.size > NC_ENCRYPTION_MAC_SIZE);
+
+ /*
+ * Mac is the final 32 bytes of the ciphertext buffer
+ */
+ return ncSpanSlice(
+ payload,
+ payload.size - NC_ENCRYPTION_MAC_SIZE,
+ NC_ENCRYPTION_MAC_SIZE
+ );
+}
+
+static _nc_fn_inline int _nip44ParseSegments(
+ cspan_t payload,
+ cspan_t* nonce,
+ cspan_t* mac,
+ cspan_t* macData,
+ cspan_t* cipherText
+)
+{
+ if (payload.size < NIP44_MIN_PAYLOAD_SIZE)
+ {
+ return 0;
+ }
+
+ /* slice after the version and before the mac segments */
+ *nonce = ncSpanSliceC(
+ payload,
+ NIP44_VERSION_SIZE,
+ NIP44_NONCE_SIZE
+ );
+
+ /*
+ * Mac is the final 32 bytes of the ciphertext buffer
+ */
+ *mac = ncSpanSliceC(
+ payload,
+ payload.size - NC_ENCRYPTION_MAC_SIZE,
+ NC_ENCRYPTION_MAC_SIZE
+ );
+
+ /*
+ * The mac data is the nonce+ct segment of the buffer for mac computation.
+ */
+ *macData = ncSpanSliceC(
+ payload,
+ NIP44_VERSION_SIZE,
+ payload.size - (NIP44_VERSION_SIZE + NC_ENCRYPTION_MAC_SIZE)
+ );
+
+ /*
+ * Ciphertext is after the nonce segment and before the mac segment
+ */
+ *cipherText = ncSpanSliceC(
+ payload,
+ NIP44_VERSION_SIZE + NIP44_NONCE_SIZE,
+ payload.size - (NIP44_VERSION_SIZE + NIP44_NONCE_SIZE + NC_ENCRYPTION_MAC_SIZE)
+ );
+
+ return 1;
+}
+
+
+static _nc_fn_inline void _cipherPublishOutput(NCUtilCipherContext* buffer, uint32_t offset, uint32_t size)
+{
+ span_t slice;
+
+ DEBUG_ASSERT(ncSpanIsValid(buffer->buffer.output));
+
+ if (size == 0)
+ {
+ ncSpanInitC(&buffer->buffer.actualOutput, NULL, 0);
+ }
+ else
+ {
+ /* use slice for debug guards */
+ slice = ncSpanSlice(buffer->buffer.output, offset, size);
+
+ /* init readonly span from mutable */
+ ncSpanInitC(
+ &buffer->buffer.actualOutput,
+ ncSpanGetOffset(slice, 0),
+ ncSpanGetSize(slice)
+ );
+ }
+}
+
+/*
+* I want the encryption/decyption functions to be indempodent
+* meaning all mutations that happen can be repeated without
+* side effects. IE no perminent state changes that can't be
+* undone.
+*/
+
+static NCResult _nip44EncryptCompleteCore(
+ const NCContext* libContext,
+ const NCSecretKey* sk,
+ const NCPublicKey* pk,
+ NCUtilCipherContext* state
+)
+{
+
+ NCResult result;
+ cspan_t plainText;
+ span_t macData, macOutput, message;
+ uint32_t outPos;
+ uint8_t ptSize[NIP44_PT_LEN_SIZE];
+ uint8_t hmacKeyOut[NC_ENCRYPTION_MAC_SIZE];
+ NCEncryptionArgs encArgs;
+
+ outPos = 0;
+ encArgs = state->encArgs;
+ message = state->buffer.output;
+ plainText = state->buffer.input;
+
+ DEBUG_ASSERT(encArgs.version == NC_ENC_VERSION_NIP44);
+
+ ZERO_FILL(hmacKeyOut, sizeof(hmacKeyOut));
+
+ /* Get the nonce/iv size so we know how much nonce data to write */
+ result = NCUtilCipherGetIvSize(state);
+ DEBUG_ASSERT(result > 0);
+
+ /* Start by appending the version number */
+ ncSpanAppend(message, &outPos, Nip44VersionValue, sizeof(Nip44VersionValue));
+
+ /* next is nonce data */
+ ncSpanAppend(message, &outPos, encArgs.nonceData, (uint32_t)result);
+
+ /*
+ * Assert the output points to the end of the nonce segment
+ * for nip44 this is exactly 33 bytes. This assert also doubles
+ * to check the output of NCUtilCipherGetIvSize() to ensure
+ * it's returning the correct size for nip44
+ */
+ DEBUG_ASSERT(outPos == 1 + NIP44_NONCE_SIZE);
+
+ /*
+ * Assign the hmac key from the stack buffer. Since the args structure
+ * is copied, it won't leak the address to the stack buffer.
+ *
+ * Should always return success for nip44 because all properties are valid
+ * addresses.
+ */
+
+ result = NCEncryptionSetPropertyEx(
+ &encArgs,
+ NC_ENC_SET_NIP44_MAC_KEY,
+ hmacKeyOut,
+ sizeof(hmacKeyOut)
+ );
+
+ DEBUG_ASSERT(result == NC_SUCCESS);
+
+ /*
+ * So this is the tricky part. The encryption operation appens directly
+ * on the ciphertext segment
+ *
+ * All current implementations allow overlapping input and output buffers
+ * so we can assign the pt segment on the encryption args
+ */
+
+ /*
+ * Since the message size and padding bytes will get encrypted,
+ * the buffer should currently point to the start of the encryption segment
+ *
+ * The size of the data to encrypt is the padded size plus the size of the
+ * plainText size field.
+ */
+
+ result = NCEncryptionSetData(
+ &encArgs,
+ ncSpanGetOffset(message, outPos), /* in place encryption */
+ ncSpanGetOffset(message, outPos),
+ NIP44_PT_LEN_SIZE + _calcNip44PtPadding(plainText.size) /* Plaintext + pt size must be encrypted */
+ );
+
+ DEBUG_ASSERT(result == NC_SUCCESS);
+
+ /* big endian plaintext size */
+ ptSize[0] = (uint8_t)(ncSpanGetSizeC(plainText) >> 8);
+ ptSize[1] = (uint8_t)(ncSpanGetSizeC(plainText) & 0xFF);
+
+ /*
+ * Written position must point to the end of the padded ciphertext
+ * area which the plaintext is written to.
+ *
+ * The plaintext data will be encrypted in place. The encrypted
+ * data is the entired padded region containing the leading byte count
+ * the plaintext data, followed by zero padding.
+ */
+
+ ncSpanWrite(message, outPos, ptSize, sizeof(ptSize));
+
+ ncSpanWrite(
+ message,
+ outPos + NIP44_PT_LEN_SIZE, /* write pt directly after length */
+ ncSpanGetOffsetC(plainText, 0),
+ ncSpanGetSizeC(plainText)
+ );
+
+ /* Move position pointer directly after final padding bytes */
+ outPos += encArgs.dataSize;
+
+ result = NCEncrypt(libContext, sk, pk, &encArgs);
+
+ if (result != NC_SUCCESS)
+ {
+ return result;
+ }
+
+ /*
+ MAC is computed over the nonce+encrypted data
+ this helper captures that data segment into a span
+ */
+
+ macData = _nip44GetMacData(message);
+ macOutput = _nip44GetMacOutput(message);
+
+ result = NCComputeMac(
+ libContext,
+ hmacKeyOut,
+ ncSpanGetOffset(macData, 0),
+ ncSpanGetSize(macData),
+ ncSpanGetOffset(macOutput, 0)
+ );
+
+ if (result != NC_SUCCESS)
+ {
+ return result;
+ }
+
+ outPos += NC_ENCRYPTION_MAC_SIZE;
+
+ DEBUG_ASSERT2(outPos == message.size, "Buffer under/overflow detected");
+
+ /* publish all message bytes to output */
+ _cipherPublishOutput(state, 0, outPos);
+
+ /* zero hmac key before returning */
+ ZERO_FILL(hmacKeyOut, sizeof(hmacKeyOut));
+
+ return NC_SUCCESS;
+}
+
+static NCResult _nip44DecryptCompleteCore(
+ const NCContext* libContext,
+ const NCSecretKey* recvKey,
+ const NCPublicKey* sendKey,
+ NCUtilCipherContext* state
+)
+{
+ NCResult result;
+ NCMacVerifyArgs macArgs;
+ NCEncryptionArgs encArgs;
+ cspan_t macData, macValue, nonce, payload, cipherText;
+ span_t output;
+ uint16_t ptSize;
+
+ DEBUG_ASSERT(libContext && recvKey && sendKey && state);
+ DEBUG_ASSERT(state->encArgs.version == NC_ENC_VERSION_NIP44);
+ DEBUG_ASSERT(ncSpanGetSizeC(state->buffer.input) >= NIP44_MIN_PAYLOAD_SIZE);
+
+ /* ensure decryption mode */
+ DEBUG_ASSERT(state->_flags & NC_UTIL_CIPHER_MODE_DECRYPT);
+
+ /* store local stack copy for safe mutation */
+ encArgs = state->encArgs;
+ payload = state->buffer.input;
+ output = state->buffer.output;
+
+ /*
+ * Copy the input buffer to the output buffer because the
+ * decryption happens in-place and needs a writable buffer
+ *
+ * After the operation is complete, we will assign the actual plaintext
+ * data to the actual output buffer
+ */
+
+ DEBUG_ASSERT2(ncSpanIsValid(output), "Output buffer was not allocated");
+
+ if (!_nip44ParseSegments(payload, &nonce, &macValue, &macData, &cipherText))
+ {
+ return E_CIPHER_INVALID_FORMAT;
+ }
+
+ /* Verify mac if the user allowed it */
+ if ((state->_flags & NC_UTIL_CIPHER_MAC_NO_VERIFY) == 0)
+ {
+ DEBUG_ASSERT(ncSpanGetSizeC(macValue) == NC_ENCRYPTION_MAC_SIZE);
+ DEBUG_ASSERT(ncSpanGetSizeC(macData) > NIP44_NONCE_SIZE + MIN_PADDING_SIZE);
+
+ /* Assign the mac data to the mac verify args */
+ macArgs.mac32 = ncSpanGetOffsetC(macValue, 0);
+ macArgs.nonce32 = ncSpanGetOffsetC(nonce, 0);
+
+ /* message for verifying a mac in nip44 is the nonce+ciphertext */
+ macArgs.payload = ncSpanGetOffsetC(macData, 0);
+ macArgs.payloadSize = ncSpanGetSizeC(macData);
+
+ /* Verify the mac */
+ result = NCVerifyMac(libContext, recvKey, sendKey, &macArgs);
+
+ /* When the mac is invlaid */
+ if (result == E_OPERATION_FAILED)
+ {
+ return E_CIPHER_MAC_INVALID;
+ }
+ /* argument errors */
+ else if (result != NC_SUCCESS)
+ {
+ return result;
+ }
+ }
+
+ /*
+ * manually assign nonce because it's a constant pointer which
+ * is not allowed when calling setproperty
+ */
+ encArgs.nonceData = ncSpanGetOffsetC(nonce, 0);
+
+ DEBUG_ASSERT2(cipherText.size >= MIN_PADDING_SIZE, "Cipertext segment was parsed incorrectly. Too small");
+
+ result = NCEncryptionSetData(
+ &encArgs,
+ ncSpanGetOffsetC(cipherText, 0),
+ ncSpanGetOffset(output, 0), /*decrypt ciphertext and write directly to the output buffer */
+ ncSpanGetSizeC(cipherText)
+ );
+
+ DEBUG_ASSERT(result == NC_SUCCESS);
+
+ /*
+ * If decryption was successful, the data should be written
+ * directly to the output buffer
+ */
+ result = NCDecrypt(libContext, recvKey, sendKey, &encArgs);
+
+ if (result != NC_SUCCESS)
+ {
+ return result;
+ }
+
+ /*
+ * Parse CT length and assign the output buffer.
+ *
+ * PT size is stored at the beginning of the ciphertext
+ * segment and is 2 bytes in size, big endian.
+ */
+
+ ptSize = (uint16_t)(output.data[0] << 8 | output.data[1]);
+
+ /*
+ * If the PT is corrupted or set maliciously, it can overrun
+ * the current buffer. The PT size must be less than the
+ * ciphertext size.
+ */
+ if (!ncSpanIsValidRange(output, NIP44_PT_LEN_SIZE, ptSize))
+ {
+ return E_OPERATION_FAILED;
+ }
+
+ /*
+ * actual output span should now point to the decrypted plaintext
+ * data segment
+ */
+ _cipherPublishOutput(state, NIP44_PT_LEN_SIZE, ptSize);
+
+ DEBUG_ASSERT(ncSpanGetSizeC(state->buffer.actualOutput) < cipherText.size);
+
+ return NC_SUCCESS;
+}
+
+NC_EXPORT NCResult NC_CC NCUtilGetEncryptionPaddedSize(uint32_t encVersion, uint32_t plaintextSize)
+{
+ switch (encVersion)
+ {
+ default:
+ return E_VERSION_NOT_SUPPORTED;
+
+ case NC_ENC_VERSION_NIP04:
+ return plaintextSize;
+
+ case NC_ENC_VERSION_NIP44:
+
+ /*
+ * Ensure the plaintext size if a nip44 message does not exceed the maximum size
+ */
+ CHECK_ARG_IS(plaintextSize - 1 <= NIP44_MAX_ENC_MESSAGE_SIZE, 1);
+
+ return (NCResult)(_calcNip44PtPadding(plaintextSize));
+ }
+}
+
+NC_EXPORT NCResult NC_CC NCUtilGetEncryptionBufferSize(uint32_t encVersion, uint32_t plaintextSize)
+{
+
+ switch (encVersion)
+ {
+ default:
+ return E_VERSION_NOT_SUPPORTED;
+
+ /*
+ * NIP-04 simply uses AES to 1:1 encrypt the plainText
+ * to ciphertext.
+ */
+ case NC_ENC_VERSION_NIP04:
+ return plaintextSize;
+
+ case NC_ENC_VERSION_NIP44:
+ return (NCResult)(_calcNip44TotalOutSize(plaintextSize));
+ }
+}
+
+
+NC_EXPORT NCUtilCipherContext* NC_CC NCUtilCipherAlloc(uint32_t encVersion, uint32_t flags)
+{
+ NCUtilCipherContext* encCtx;
+
+ /*
+ * Alloc context on heap
+ */
+ encCtx = (NCUtilCipherContext*)_nc_mem_alloc(1, sizeof(NCUtilCipherContext));
+
+ if (encCtx != NULL)
+ {
+ /*
+ * Technically I should be using the NCEncSetProperty but this
+ * is an acceptable shortcut for now, may break in future
+ */
+ encCtx->encArgs.version = encVersion;
+ encCtx->_flags = flags;
+ }
+
+ return encCtx;
+}
+
+NC_EXPORT void NC_CC NCUtilCipherFree(NCUtilCipherContext* encCtx)
+{
+ if (!encCtx)
+ {
+ return;
+ }
+
+ /*
+ * If zero on free flag is set, we can zero all output memory
+ * before returning the buffer back to the heap
+ */
+ if ((encCtx->_flags & NC_UTIL_CIPHER_ZERO_ON_FREE) > 0 && ncSpanIsValid(encCtx->buffer.output))
+ {
+ _ncUtilZeroSpan(encCtx->buffer.output);
+ }
+
+ /* Free output buffers (null buffers are allowed) */
+ _ncUtilFreeSpan(encCtx->buffer.output);
+
+ /* context can be released */
+ _nc_mem_free(encCtx);
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherInit(
+ NCUtilCipherContext* encCtx,
+ const uint8_t* inputData,
+ uint32_t inputSize
+)
+{
+ NCResult outputSize;
+
+ CHECK_NULL_ARG(encCtx, 0);
+ CHECK_NULL_ARG(inputData, 1);
+
+ if ((encCtx->_flags & NC_UTIL_CIPHER_MODE) == NC_UTIL_CIPHER_MODE_DECRYPT)
+ {
+ /*
+ * Validate the input data for proper format for
+ * the current state version
+ */
+ switch (encCtx->encArgs.version)
+ {
+ case NC_ENC_VERSION_NIP44:
+ {
+ if (inputSize < NIP44_MIN_PAYLOAD_SIZE)
+ {
+ return E_CIPHER_BAD_INPUT_SIZE;
+ }
+
+ if (inputSize > NIP44_MAX_PAYLOAD_SIZE)
+ {
+ return E_CIPHER_BAD_INPUT_SIZE;
+ }
+
+ /* Ensure the first byte is a valid version */
+ if (inputData[0] != Nip44VersionValue[0])
+ {
+ return E_VERSION_NOT_SUPPORTED;
+ }
+
+ break;
+ }
+ default:
+ return E_VERSION_NOT_SUPPORTED;
+ }
+
+ /*
+ * Alloc a the output buffer to be the same size as the input
+ * data for decryption because the output will always be equal
+ * or smaller than the input data. This is an over-alloc but
+ * that should be fine
+ */
+
+ outputSize = inputSize;
+ }
+ else
+ {
+ /*
+ * Calculate the correct output size to store the encryption
+ * data for the given state version
+ */
+ outputSize = NCUtilGetEncryptionBufferSize(encCtx->encArgs.version, inputSize);
+
+ if (outputSize < 0)
+ {
+ return E_CIPHER_BAD_INPUT_SIZE;
+ }
+ }
+
+ DEBUG_ASSERT(outputSize > 0);
+
+ /*
+ * If the buffer was previously allocated, the reuseable flag
+ * must be set to allow the buffer to be re-used for another
+ * operation.
+ */
+
+ if (ncSpanIsValid(encCtx->buffer.output))
+ {
+ CHECK_ARG_IS((encCtx->_flags & NC_UTIL_CIPHER_REUSEABLE) > 0, 0);
+
+ /*
+ * if the existing buffer is large enough to hold the new
+ * data reuse it, otherwise free it and allocate a new buffer
+ */
+
+ if (outputSize <= encCtx->buffer.output.size)
+ {
+ _ncUtilZeroSpan(encCtx->buffer.output);
+
+ goto AssignInputAndExit;
+ }
+ else
+ {
+ _ncUtilFreeSpan(encCtx->buffer.output);
+ }
+ }
+
+ /* Alloc output buffer within the struct */
+ encCtx->buffer.output = _ncUtilAllocSpan((uint32_t)outputSize, sizeof(uint8_t));
+
+ if (!ncSpanIsValid(encCtx->buffer.output))
+ {
+ return E_OUT_OF_MEMORY;
+ }
+
+AssignInputAndExit:
+
+ /* Confirm output was allocated */
+ DEBUG_ASSERT(ncSpanIsValid(encCtx->buffer.output));
+
+ /* Assign the input data span to point to the assigned input data */
+ ncSpanInitC(&encCtx->buffer.input, inputData, inputSize);
+
+ return NC_SUCCESS;
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherGetFlags(const NCUtilCipherContext* ctx)
+{
+ CHECK_NULL_ARG(ctx, 0);
+
+ return (NCResult)(ctx->_flags);
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherGetOutputSize(const NCUtilCipherContext* encCtx)
+{
+ CHECK_NULL_ARG(encCtx, 0);
+
+ if (!ncSpanIsValidC(encCtx->buffer.actualOutput))
+ {
+ return E_CIPHER_NO_OUTPUT;
+ }
+
+ return (NCResult)(encCtx->buffer.actualOutput.size);
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherReadOutput(
+ const NCUtilCipherContext* encCtx,
+ uint8_t* output,
+ uint32_t outputSize
+)
+{
+ CHECK_NULL_ARG(encCtx, 0);
+ CHECK_NULL_ARG(output, 1);
+
+ if (!ncSpanIsValidC(encCtx->buffer.actualOutput))
+ {
+ return E_CIPHER_NO_OUTPUT;
+ }
+
+ /* Buffer must be as large as the output data */
+ CHECK_ARG_RANGE(outputSize, encCtx->buffer.actualOutput.size, UINT32_MAX, 2);
+
+ ncSpanReadC(
+ encCtx->buffer.actualOutput,
+ output,
+ outputSize
+ );
+
+ return (NCResult)encCtx->buffer.actualOutput.size;
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherSetProperty(
+ NCUtilCipherContext* ctx,
+ uint32_t property,
+ uint8_t* value,
+ uint32_t valueLen
+)
+{
+ CHECK_NULL_ARG(ctx, 0)
+
+ /* All other arguments are verified */
+ return NCEncryptionSetPropertyEx(
+ &ctx->encArgs,
+ property,
+ value,
+ valueLen
+ );
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherUpdate(
+ NCUtilCipherContext* encCtx,
+ const NCContext* libContext,
+ const NCSecretKey* sk,
+ const NCPublicKey* pk
+)
+{
+ CHECK_NULL_ARG(encCtx, 0);
+ CHECK_NULL_ARG(libContext, 1);
+ CHECK_NULL_ARG(sk, 2);
+ CHECK_NULL_ARG(pk, 3);
+
+ /* Make sure input & output buffers have been assigned/allocated */
+ if (!ncSpanIsValid(encCtx->buffer.output))
+ {
+ return E_INVALID_CONTEXT;
+ }
+ if (!ncSpanIsValidC(encCtx->buffer.input))
+ {
+ return E_INVALID_CONTEXT;
+ }
+
+ /* Reset output data pointer incase it has been moved */
+ _cipherPublishOutput(encCtx, 0, 0);
+
+ switch (encCtx->encArgs.version)
+ {
+ case NC_ENC_VERSION_NIP44:
+
+ if ((encCtx->_flags & NC_UTIL_CIPHER_MODE) == NC_UTIL_CIPHER_MODE_DECRYPT)
+ {
+ return _nip44DecryptCompleteCore(libContext, sk, pk, encCtx);
+ }
+ else
+ {
+ /* Ensure the user manually specified a nonce buffer for encryption mode */
+ if (!encCtx->encArgs.nonceData)
+ {
+ return E_CIPHER_BAD_NONCE;
+ }
+
+ return _nip44EncryptCompleteCore(libContext, sk, pk, encCtx);
+ }
+
+ default:
+ return E_VERSION_NOT_SUPPORTED;
+ }
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherGetIvSize(const NCUtilCipherContext* encCtx)
+{
+ uint32_t ivSize;
+
+ CHECK_NULL_ARG(encCtx, 0);
+
+ ivSize = NCEncryptionGetIvSize(encCtx->encArgs.version);
+
+ return ivSize == 0
+ ? E_VERSION_NOT_SUPPORTED
+ : (NCResult)ivSize;
+}
diff --git a/src/providers/bcrypt.c b/src/providers/bcrypt.c
index d1b9aa5..b9c370b 100644
--- a/src/providers/bcrypt.c
+++ b/src/providers/bcrypt.c
@@ -2,7 +2,7 @@
* Copyright (c) 2024 Vaughn Nugent
*
* Package: noscrypt
-* File: impl/bcrypt.c
+* File: providers/bcrypt.c
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
@@ -63,7 +63,7 @@ _IMPLSTB NTSTATUS _bcInitSha256(struct _bcrypt_ctx* ctx, DWORD flags)
return result;
}
-_IMPLSTB NTSTATUS _bcCreateHmac(struct _bcrypt_ctx* ctx, const cspan_t* key)
+_IMPLSTB NTSTATUS _bcCreateHmac(struct _bcrypt_ctx* ctx, cspan_t key)
{
/*
* NOTE:
@@ -79,8 +79,8 @@ _IMPLSTB NTSTATUS _bcCreateHmac(struct _bcrypt_ctx* ctx, const cspan_t* key)
&ctx->hHash,
NULL,
0,
- (uint8_t*)key->data,
- key->size,
+ (uint8_t*)ncSpanGetOffsetC(key, 0),
+ ncSpanGetSizeC(key),
BCRYPT_HASH_REUSABLE_FLAG /* Enable reusable for expand function */
);
}
@@ -92,7 +92,7 @@ _IMPLSTB NTSTATUS _bcCreate(struct _bcrypt_ctx* ctx)
/* Zero out key span for 0 size and NULL data ptr */
SecureZeroMemory(&key, sizeof(cspan_t));
- return _bcCreateHmac(ctx, &key);
+ return _bcCreateHmac(ctx, key);
}
_IMPLSTB NTSTATUS _bcHashDataRaw(const struct _bcrypt_ctx* ctx, const uint8_t* data, uint32_t len)
@@ -100,9 +100,13 @@ _IMPLSTB NTSTATUS _bcHashDataRaw(const struct _bcrypt_ctx* ctx, const uint8_t* d
return BCryptHashData(ctx->hHash, (uint8_t*)data, len, 0);
}
-_IMPLSTB NTSTATUS _bcHashData(const struct _bcrypt_ctx* ctx, const cspan_t* data)
+_IMPLSTB NTSTATUS _bcHashData(const struct _bcrypt_ctx* ctx, cspan_t data)
{
- return _bcHashDataRaw(ctx, data->data, data->size);
+ return _bcHashDataRaw(
+ ctx,
+ ncSpanGetOffsetC(data, 0),
+ ncSpanGetSizeC(data)
+ );
}
_IMPLSTB NTSTATUS _bcFinishHash(const struct _bcrypt_ctx* ctx, sha256_t digestOut32)
@@ -118,8 +122,8 @@ _IMPLSTB void _bcDestroyCtx(struct _bcrypt_ctx* ctx)
/* Close the algorithm provider */
if (ctx->hAlg) BCryptCloseAlgorithmProvider(ctx->hAlg, 0);
- ctx->hAlg = NULL;
ctx->hHash = NULL;
+ ctx->hAlg = NULL;
}
#ifndef _IMPL_SECURE_ZERO_MEMSET
@@ -146,7 +150,7 @@ _IMPLSTB void _bcDestroyCtx(struct _bcrypt_ctx* ctx)
/* Export function fallack */
#define _IMPL_CRYPTO_SHA256_DIGEST _bcrypt_sha256_digest
- _IMPLSTB cstatus_t _bcrypt_sha256_digest(const cspan_t* data, sha256_t digestOut32)
+ _IMPLSTB cstatus_t _bcrypt_sha256_digest(cspan_t data, sha256_t digestOut32)
{
cstatus_t result;
struct _bcrypt_ctx ctx;
@@ -177,7 +181,7 @@ _IMPLSTB void _bcDestroyCtx(struct _bcrypt_ctx* ctx)
/* Export function */
#define _IMPL_CRYPTO_SHA256_HMAC _bcrypt_hmac_sha256
- _IMPLSTB cstatus_t _bcrypt_hmac_sha256(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32)
+ _IMPLSTB cstatus_t _bcrypt_hmac_sha256(cspan_t key, cspan_t data, sha256_t hmacOut32)
{
cstatus_t result;
struct _bcrypt_ctx ctx;
@@ -213,7 +217,7 @@ _IMPLSTB void _bcDestroyCtx(struct _bcrypt_ctx* ctx)
#define _IMPL_CRYPTO_SHA256_HKDF_EXPAND _bcrypt_fallback_hkdf_expand
- cstatus_t _bcrypt_hkdf_update(void* ctx, const cspan_t* data)
+ static cstatus_t _bcrypt_hkdf_update(void* ctx, cspan_t data)
{
DEBUG_ASSERT(ctx != NULL)
@@ -221,15 +225,16 @@ _IMPLSTB void _bcDestroyCtx(struct _bcrypt_ctx* ctx)
return CSTATUS_OK;
}
- cstatus_t _bcrypt_hkdf_finish(void* ctx, sha256_t hmacOut32)
+ static cstatus_t _bcrypt_hkdf_finish(void* ctx, sha256_t hmacOut32)
{
- DEBUG_ASSERT(ctx != NULL)
+ DEBUG_ASSERT(ctx != NULL);
+ DEBUG_ASSERT(hmacOut32 != NULL);
BC_FAIL(_bcFinishHash((struct _bcrypt_ctx*)ctx, hmacOut32))
return CSTATUS_OK;
}
- _IMPLSTB cstatus_t _bcrypt_fallback_hkdf_expand(const cspan_t* prk, const cspan_t* info, span_t* okm)
+ _IMPLSTB cstatus_t _bcrypt_fallback_hkdf_expand(cspan_t prk, cspan_t info, span_t okm)
{
cstatus_t result;
struct _bcrypt_ctx ctx;
diff --git a/src/providers/mbedtls.c b/src/providers/mbedtls.c
index df5201f..ead3279 100644
--- a/src/providers/mbedtls.c
+++ b/src/providers/mbedtls.c
@@ -2,7 +2,7 @@
* Copyright (c) 2024 Vaughn Nugent
*
* Package: noscrypt
-* File: mbedtls.c
+* File: providers/mbedtls.c
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
@@ -95,13 +95,13 @@ _IMPLSTB const mbedtls_md_info_t* _mbed_sha256_alg(void)
#define _IMPL_CRYPTO_SHA256_DIGEST _mbed_sha256_digest
- _IMPLSTB cstatus_t _mbed_sha256_digest(const cspan_t* data, sha256_t digestOut32)
+ _IMPLSTB cstatus_t _mbed_sha256_digest(cspan_t data, sha256_t digestOut32)
{
- _overflow_check(data->size)
+ _overflow_check(data.size)
return mbedtls_sha256(
- data->data,
- data->size,
+ data.data,
+ data.size,
digestOut32,
0 /* Set 0 for sha256 mode */
) == 0 ? CSTATUS_OK : CSTATUS_FAIL;
@@ -114,19 +114,19 @@ _IMPLSTB const mbedtls_md_info_t* _mbed_sha256_alg(void)
#define _IMPL_CRYPTO_SHA256_HMAC _mbed_sha256_hmac
- _IMPLSTB cstatus_t _mbed_sha256_hmac(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32)
+ _IMPLSTB cstatus_t _mbed_sha256_hmac(cspan_t key, cspan_t data, sha256_t hmacOut32)
{
- _overflow_check(data->size)
+ _overflow_check(data.size)
/* Keys should never be large enough for this to matter, but sanity check. */
- DEBUG_ASSERT2(key->size < SIZE_MAX, "Expected key size to be less than SIZE_MAX")
+ DEBUG_ASSERT2(key.size < SIZE_MAX, "Expected key size to be less than SIZE_MAX")
return mbedtls_md_hmac(
_mbed_sha256_alg(),
- key->data,
- key->size,
- data->data,
- data->size,
+ key.data,
+ key.size,
+ data.data,
+ data.size,
hmacOut32
) == 0 ? CSTATUS_OK : CSTATUS_FAIL;
}
@@ -137,21 +137,21 @@ _IMPLSTB const mbedtls_md_info_t* _mbed_sha256_alg(void)
#define _IMPL_CRYPTO_SHA256_HKDF_EXPAND _mbed_sha256_hkdf_expand
- _IMPLSTB cstatus_t _mbed_sha256_hkdf_expand(const cspan_t* prk, const cspan_t* info, span_t* okm)
+ _IMPLSTB cstatus_t _mbed_sha256_hkdf_expand(cspan_t prk, cspan_t info, span_t okm)
{
/* These sizes should never be large enough to overflow on <64bit platforms, but sanity check */
- DEBUG_ASSERT(okm->size < SIZE_MAX)
- DEBUG_ASSERT(prk->size < SIZE_MAX)
- DEBUG_ASSERT(info->size < SIZE_MAX)
+ DEBUG_ASSERT(okm.size < SIZE_MAX)
+ DEBUG_ASSERT(prk.size < SIZE_MAX)
+ DEBUG_ASSERT(info.size < SIZE_MAX)
return mbedtls_hkdf_expand(
_mbed_sha256_alg(),
- prk->data,
- prk->size,
- info->data,
- info->size,
- okm->data,
- okm->size
+ prk.data,
+ prk.size,
+ info.data,
+ info.size,
+ okm.data,
+ okm.size
) == 0 ? CSTATUS_OK : CSTATUS_FAIL;
}
diff --git a/src/providers/monocypher.c b/src/providers/monocypher.c
index 8ffe048..c35f63e 100644
--- a/src/providers/monocypher.c
+++ b/src/providers/monocypher.c
@@ -2,7 +2,7 @@
* Copyright (c) 2024 Vaughn Nugent
*
* Package: noscrypt
-* File: impl/monocypher.c
+* File: providers/monocypher.c
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
diff --git a/src/providers/openssl.c b/src/providers/openssl.c
index 1f31796..c2933fb 100644
--- a/src/providers/openssl.c
+++ b/src/providers/openssl.c
@@ -2,7 +2,7 @@
* Copyright (c) 2024 Vaughn Nugent
*
* Package: noscrypt
-* File: impl/openssl.c
+* File: providers/openssl.c
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
@@ -26,6 +26,10 @@
#define _OSSL_FAIL(x) if(!(x)) return CSTATUS_FAIL;
+#define ossl_md_sha256() EVP_MD_fetch(NULL, "SHA2-256", NULL)
+#define ossl_evp_fetch_chacha20() EVP_CIPHER_fetch(NULL, "ChaCha20", NULL)
+#define ossl_mac_fetch_hmac() EVP_MAC_fetch(NULL, "hmac", NULL)
+
#ifndef _IMPL_SECURE_ZERO_MEMSET
#define _IMPL_SECURE_ZERO_MEMSET _ossl_secure_zero_memset
@@ -63,11 +67,20 @@
#define _IMPL_CRYPTO_SHA256_DIGEST _ossl_sha256_digest
- _IMPLSTB cstatus_t _ossl_sha256_digest(const cspan_t* data, sha256_t digestOut32)
+ _IMPLSTB cstatus_t _ossl_sha256_digest(cspan_t data, sha256_t digestOut32)
{
- _overflow_check(data->size)
+ _overflow_check(data.size);
+
+ DEBUG_ASSERT(digestOut32 != NULL);
+ DEBUG_ASSERT(ncSpanIsValidC(data));
- _OSSL_FAIL(SHA256(data->data, data->size, digestOut32))
+ _OSSL_FAIL(
+ SHA256(
+ ncSpanGetOffsetC(data, 0),
+ ncSpanGetSizeC(data),
+ digestOut32
+ )
+ );
return CSTATUS_OK;
}
@@ -81,29 +94,29 @@
/* Export function */
#define _IMPL_CRYPTO_SHA256_HMAC _ossl_hmac_sha256
- _IMPLSTB cstatus_t _ossl_hmac_sha256(const cspan_t* key, const cspan_t* data, sha256_t hmacOut32)
+ _IMPLSTB cstatus_t _ossl_hmac_sha256(cspan_t key, cspan_t data, sha256_t hmacOut32)
{
unsigned int hmacLen;
- _overflow_check(key->size)
- _overflow_check(data->size)
+ _overflow_check(key.size)
+ _overflow_check(data.size)
hmacLen = sizeof(sha256_t);
_OSSL_FAIL(
HMAC(
- EVP_sha256(),
- key->data,
- key->size,
- data->data,
- data->size,
+ ossl_md_sha256(),
+ ncSpanGetOffsetC(key, 0),
+ ncSpanGetSizeC(key),
+ ncSpanGetOffsetC(data, 0),
+ ncSpanGetSizeC(data),
hmacOut32,
&hmacLen
)
- )
+ );
/* digest length should match the actual digest size */
- DEBUG_ASSERT(hmacLen == sizeof(sha256_t))
+ DEBUG_ASSERT(hmacLen == sizeof(sha256_t));
return CSTATUS_OK;
}
@@ -112,73 +125,144 @@
#ifndef _IMPL_CRYPTO_SHA256_HKDF_EXPAND
- #include <openssl/hmac.h>
+ #include <openssl/evp.h>
#define _IMPL_CRYPTO_SHA256_HKDF_EXPAND _ossl_sha256_hkdf_expand
- cstatus_t _ossl_hkdf_update(void* ctx, const cspan_t* data)
+ struct ossl_hmac_state {
+ EVP_MAC_CTX* libCtx;
+ OSSL_PARAM params[2];
+ cspan_t prk;
+ };
+
+ static cstatus_t _ossl_hmac_init(const struct ossl_hmac_state* osslCtx)
{
- DEBUG_ASSERT(ctx != NULL)
+ DEBUG_ASSERT(ncSpanIsValidC(osslCtx->prk));
+ DEBUG_ASSERT(osslCtx->params != NULL);
- _overflow_check(data->size)
+ _OSSL_FAIL(
+ EVP_MAC_init(
+ osslCtx->libCtx,
+ ncSpanGetOffsetC(osslCtx->prk, 0),
+ ncSpanGetSizeC(osslCtx->prk),
+ osslCtx->params
+ )
+ );
- _OSSL_FAIL(EVP_DigestUpdate((EVP_MD_CTX*)ctx, data->data, data->size))
-
return CSTATUS_OK;
}
- cstatus_t _ossl_hkdf_finish(void* ctx, sha256_t hmacOut32)
+ static cstatus_t _ossl_hkdf_update(void* ctx, cspan_t data)
{
- unsigned int hmacSize;
+ const struct ossl_hmac_state* osslCtx;
- DEBUG_ASSERT(ctx != NULL)
+ DEBUG_ASSERT(ctx != NULL);
+ _overflow_check(data.size);
- hmacSize = sizeof(sha256_t);
+ osslCtx = (const struct ossl_hmac_state*)ctx;
- _OSSL_FAIL(EVP_DigestFinal_ex((EVP_MD_CTX*)ctx, hmacOut32, &hmacSize))
+ DEBUG_ASSERT(osslCtx->libCtx != NULL);
- /* When configured for sha256, should always be the same size in/out */
- DEBUG_ASSERT(hmacSize == sizeof(sha256_t))
+ _OSSL_FAIL(
+ EVP_MAC_update(
+ osslCtx->libCtx,
+ ncSpanGetOffsetC(data, 0),
+ ncSpanGetSizeC(data)
+ )
+ );
return CSTATUS_OK;
}
- _IMPLSTB cstatus_t _ossl_sha256_hkdf_expand(const cspan_t* prk, const cspan_t* info, span_t* okm)
+ static cstatus_t _ossl_hkdf_finish(void* ctx, sha256_t hmacOut32)
{
- EVP_MD_CTX* ctx;
+ const struct ossl_hmac_state* osslCtx;
+ size_t hmacSize;
+
+ DEBUG_ASSERT(ctx != NULL);
+ DEBUG_ASSERT(hmacOut32 != NULL);
+
+ osslCtx = (const struct ossl_hmac_state*)ctx;
+ hmacSize = 0;
+
+ DEBUG_ASSERT(osslCtx->libCtx != NULL);
+
+ _OSSL_FAIL(
+ EVP_MAC_final(
+ osslCtx->libCtx,
+ hmacOut32,
+ &hmacSize,
+ sizeof(sha256_t)
+ )
+ );
+
+ /* When configured for sha256, should always be the same size in/out */
+ DEBUG_ASSERT(hmacSize == sizeof(sha256_t));
+
+ /*
+ * Context must be re-initalized after finalize
+ * See lifecycle https://docs.openssl.org/3.0/man7/life_cycle-mac/#copyright
+ */
+
+ return _ossl_hmac_init(osslCtx);
+ }
+
+
+ _IMPLSTB cstatus_t _ossl_sha256_hkdf_expand(cspan_t prk, cspan_t info, span_t okm)
+ {
+ EVP_MAC* mac;
cstatus_t result;
- struct nc_hkdf_fn_cb_struct handler;
+ struct ossl_hmac_state hkdfState;
+ struct nc_hkdf_fn_cb_struct handler;
result = CSTATUS_FAIL;
+
+ handler.update = _ossl_hkdf_update;
+ handler.finish = _ossl_hkdf_finish;
+ _overflow_check(prk.size);
+ _overflow_check(info.size);
+ _overflow_check(okm.size);
+
+ hkdfState.params[0] = OSSL_PARAM_construct_utf8_string("digest", "sha256", 0);
+ hkdfState.params[1] = OSSL_PARAM_construct_end();
+
+ hkdfState.prk = prk;
+
/*
- * NOTE! Hmac reusable flag must be set to allow for multiple
- * calls to the finish function without losing the context.
+ * Silly openssl stuff. Enable hmac with sha256 using the system default
+ * security provider. The one-shot flag must also be disabled (0) because
+ * we need to call update multiple times.
*/
- if ((ctx = EVP_MD_CTX_create()) == NULL)
+ mac = ossl_mac_fetch_hmac();
+
+ if (mac == NULL)
{
- return CSTATUS_FAIL;
+ goto Cleanup;
}
- if (!EVP_DigestInit_ex2(ctx, EVP_sha256(), NULL))
+ hkdfState.libCtx = EVP_MAC_CTX_new(mac);
+
+ if (hkdfState.libCtx == NULL)
{
goto Cleanup;
}
- if (!EVP_DigestUpdate(ctx, prk->data, prk->size))
+ if (_ossl_hmac_init(&hkdfState) != CSTATUS_OK)
{
goto Cleanup;
}
-
- handler.update = _ossl_hkdf_update;
- handler.finish = _ossl_hkdf_finish;
- result = hkdfExpandProcess(&handler, ctx, info, okm);
+ DEBUG_ASSERT(EVP_MAC_CTX_get_mac_size(hkdfState.libCtx) == sizeof(sha256_t));
- Cleanup:
+ /* Pass the library */
+ result = hkdfExpandProcess(&handler, &hkdfState, info, okm);
- EVP_MD_CTX_destroy(ctx);
+ Cleanup:
+
+ if (hkdfState.libCtx) EVP_MAC_CTX_free(hkdfState.libCtx);
+ if (mac) EVP_MAC_free(mac);
return result;
}
@@ -191,39 +275,130 @@
#define _IMPL_CHACHA20_CRYPT _ossl_chacha20_crypt
- _IMPLSTB cstatus_t _ossl_chacha20_crypt(
- const uint8_t* key,
- const uint8_t* nonce,
- const uint8_t* input,
- uint8_t* output,
- uint32_t dataLen
+ _IMPLSTB cstatus_t _ossl_cipher_core(
+ const EVP_CIPHER* cipher,
+ cspan_t key,
+ cspan_t iv,
+ cspan_t input,
+ span_t output
)
{
cstatus_t result;
EVP_CIPHER_CTX* ctx;
+ int tempLen, osslResult;
+
+ DEBUG_ASSERT2(ncSpanGetSize(output) <= ncSpanGetSizeC(input), "Output buffer must be equal or larger than the input buffer");
+ DEBUG_ASSERT(cipher != NULL);
+
+ DEBUG_ASSERT((uint32_t)EVP_CIPHER_get_key_length(cipher) == ncSpanGetSizeC(key));
+ DEBUG_ASSERT((uint32_t)EVP_CIPHER_iv_length(cipher) == ncSpanGetSizeC(iv));
result = CSTATUS_FAIL;
- if ((ctx = EVP_CIPHER_CTX_new()) == NULL)
+ ctx = EVP_CIPHER_CTX_new();
+
+ if (ctx == NULL)
{
- return CSTATUS_FAIL;
+ goto Cleanup;
}
- if (!EVP_EncryptInit_ex(ctx, EVP_chacha20(), NULL, key, nonce))
+ osslResult = EVP_EncryptInit_ex2(
+ ctx,
+ cipher,
+ ncSpanGetOffsetC(key, 0),
+ ncSpanGetOffsetC(iv, 0),
+ NULL
+ );
+
+ if (!osslResult)
{
goto Cleanup;
}
- if (!EVP_EncryptUpdate(ctx, output, (int*)&dataLen, input, dataLen))
+ osslResult = EVP_EncryptUpdate(
+ ctx,
+ ncSpanGetOffset(output, 0),
+ &tempLen,
+ ncSpanGetOffsetC(input, 0),
+ ncSpanGetSizeC(input)
+ );
+
+ if (!osslResult)
{
goto Cleanup;
}
+ /*
+ * We can't get a pointer outside the range of the
+ * output buffer
+ */
+ if (((uint32_t)tempLen) < ncSpanGetSize(output))
+ {
+ if (!EVP_EncryptFinal_ex(ctx, ncSpanGetOffset(output, tempLen), &tempLen))
+ {
+ goto Cleanup;
+ }
+ }
+
result = CSTATUS_OK;
Cleanup:
- EVP_CIPHER_CTX_free(ctx);
+ if (ctx) EVP_CIPHER_CTX_free(ctx);
+
+ return result;
+ }
+
+ _IMPLSTB cstatus_t _ossl_chacha20_crypt(
+ const uint8_t* key,
+ const uint8_t* nonce,
+ const uint8_t* input,
+ uint8_t* output,
+ uint32_t dataLen
+ )
+ {
+ cstatus_t result;
+ EVP_CIPHER* cipher;
+ uint8_t chaChaIv[CHACHA_NONCE_SIZE + 4];
+ cspan_t keySpan, nonceSpan, inputSpan;
+ span_t outputSpan;
+
+ result = CSTATUS_FAIL;
+
+ /*
+ * RFC 7539 ChaCha20 requires a 16 byte initialization vector. A
+ * counter value is preprended to the nonce to make up the 16 byte
+ * size.
+ *
+ * The counter is always set to 0 for the nonce.
+ */
+
+ ncCryptoSecureZero(chaChaIv, sizeof(chaChaIv));
+ MEMMOV(chaChaIv + 4, nonce, CHACHA_NONCE_SIZE);
+
+ ncSpanInitC(&keySpan, key, CHACHA_KEY_SIZE);
+ ncSpanInitC(&nonceSpan, chaChaIv, sizeof(chaChaIv));
+ ncSpanInitC(&inputSpan, input, dataLen);
+ ncSpanInit(&outputSpan, output, dataLen);
+
+ cipher = ossl_evp_fetch_chacha20();
+
+ if (cipher == NULL)
+ {
+ goto Cleanup;
+ }
+
+ result = _ossl_cipher_core(
+ cipher,
+ keySpan,
+ nonceSpan,
+ inputSpan,
+ outputSpan
+ );
+
+ Cleanup:
+
+ if (cipher) EVP_CIPHER_free(cipher);
return result;
}
generated by cgit (git 2.46.0) at 2024-11-16 17:49:06 +0000