Line data    Source code

       1             : // Copyright (c) 2016-2019 The Bitcoin Core developers
       2             : // Distributed under the MIT software license, see the accompanying
       3             : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       4             : 
       5             : #include <crypto/aes.h>
       6             : 
       7             : #include <string.h>
       8             : 
       9             : extern "C" {
      10             : #include <crypto/ctaes/ctaes.c>
      11             : }
      12             : 
      13        6700 : AES256Encrypt::AES256Encrypt(const unsigned char key[32])
      14        3350 : {
      15        3350 :     AES256_init(&ctx, key);
      16        6700 : }
      17             : 
      18        6700 : AES256Encrypt::~AES256Encrypt()
      19        3350 : {
      20        3350 :     memset(&ctx, 0, sizeof(ctx));
      21        6700 : }
      22             : 
      23        5450 : void AES256Encrypt::Encrypt(unsigned char ciphertext[16], const unsigned char plaintext[16]) const
      24             : {
      25        5450 :     AES256_encrypt(&ctx, 1, ciphertext, plaintext);
      26        5450 : }
      27             : 
      28        6912 : AES256Decrypt::AES256Decrypt(const unsigned char key[32])
      29        3456 : {
      30        3456 :     AES256_init(&ctx, key);
      31        6912 : }
      32             : 
      33        6912 : AES256Decrypt::~AES256Decrypt()
      34        3456 : {
      35        3456 :     memset(&ctx, 0, sizeof(ctx));
      36        6912 : }
      37             : 
      38        5662 : void AES256Decrypt::Decrypt(unsigned char plaintext[16], const unsigned char ciphertext[16]) const
      39             : {
      40        5662 :     AES256_decrypt(&ctx, 1, plaintext, ciphertext);
      41        5662 : }
      42             : 
      43             : 
      44             : template <typename T>
      45        3473 : static int CBCEncrypt(const T& enc, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out)
      46             : {
      47        3473 :     int written = 0;
      48        3473 :     int padsize = size % AES_BLOCKSIZE;
      49             :     unsigned char mixed[AES_BLOCKSIZE];
      50             : 
      51        3473 :     if (!data || !size || !out)
      52           0 :         return 0;
      53             : 
      54        3473 :     if (!pad && padsize != 0)
      55          60 :         return 0;
      56             : 
      57        3413 :     memcpy(mixed, iv, AES_BLOCKSIZE);
      58             : 
      59             :     // Write all but the last block
      60        5453 :     while (written + AES_BLOCKSIZE <= size) {
      61       34680 :         for (int i = 0; i != AES_BLOCKSIZE; i++)
      62       32640 :             mixed[i] ^= *data++;
      63        2040 :         enc.Encrypt(out + written, mixed);
      64        2040 :         memcpy(mixed, out + written, AES_BLOCKSIZE);
      65        2040 :         written += AES_BLOCKSIZE;
      66             :     }
      67        3413 :     if (pad) {
      68             :         // For all that remains, pad each byte with the value of the remaining
      69             :         // space. If there is none, pad by a full block.
      70       28125 :         for (int i = 0; i != padsize; i++)
      71       24720 :             mixed[i] ^= *data++;
      72       33165 :         for (int i = padsize; i != AES_BLOCKSIZE; i++)
      73       29760 :             mixed[i] ^= AES_BLOCKSIZE - padsize;
      74        3405 :         enc.Encrypt(out + written, mixed);
      75        3405 :         written += AES_BLOCKSIZE;
      76        3405 :     }
      77        3413 :     return written;
      78        3473 : }
      79             : 
      80             : template <typename T>
      81        3519 : static int CBCDecrypt(const T& dec, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out)
      82             : {
      83        3519 :     int written = 0;
      84        3519 :     bool fail = false;
      85        3519 :     const unsigned char* prev = iv;
      86             : 
      87        3519 :     if (!data || !size || !out)
      88           0 :         return 0;
      89             : 
      90        3519 :     if (size % AES_BLOCKSIZE != 0)
      91           0 :         return 0;
      92             : 
      93             :     // Decrypt all data. Padding will be checked in the output.
      94        9176 :     while (written != size) {
      95        5657 :         dec.Decrypt(out, data + written);
      96       96169 :         for (int i = 0; i != AES_BLOCKSIZE; i++)
      97       90512 :             *out++ ^= prev[i];
      98        5657 :         prev = data + written;
      99        5657 :         written += AES_BLOCKSIZE;
     100             :     }
     101             : 
     102             :     // When decrypting padding, attempt to run in constant-time
     103        3519 :     if (pad) {
     104             :         // If used, padding size is the value of the last decrypted byte. For
     105             :         // it to be valid, It must be between 1 and AES_BLOCKSIZE.
     106        3511 :         unsigned char padsize = *--out;
     107        3511 :         fail = !padsize | (padsize > AES_BLOCKSIZE);
     108             : 
     109             :         // If not well-formed, treat it as though there's no padding.
     110        3511 :         padsize *= !fail;
     111             : 
     112             :         // All padding must equal the last byte otherwise it's not well-formed
     113       59687 :         for (int i = AES_BLOCKSIZE; i != 0; i--)
     114       56176 :             fail |= ((i > AES_BLOCKSIZE - padsize) & (*out-- != padsize));
     115             : 
     116        3511 :         written -= padsize;
     117        3511 :     }
     118        3519 :     return written * !fail;
     119        3519 : }
     120             : 
     121        6690 : AES256CBCEncrypt::AES256CBCEncrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)
     122        3345 :     : enc(key), pad(padIn)
     123        3345 : {
     124        3345 :     memcpy(iv, ivIn, AES_BLOCKSIZE);
     125        6690 : }
     126             : 
     127        3473 : int AES256CBCEncrypt::Encrypt(const unsigned char* data, int size, unsigned char* out) const
     128             : {
     129        3473 :     return CBCEncrypt(enc, iv, data, size, pad, out);
     130             : }
     131             : 
     132        6690 : AES256CBCEncrypt::~AES256CBCEncrypt()
     133        3345 : {
     134        3345 :     memset(iv, 0, sizeof(iv));
     135        6690 : }
     136             : 
     137        6902 : AES256CBCDecrypt::AES256CBCDecrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn)
     138        3451 :     : dec(key), pad(padIn)
     139        3451 : {
     140        3451 :     memcpy(iv, ivIn, AES_BLOCKSIZE);
     141        6902 : }
     142             : 
     143             : 
     144        3519 : int AES256CBCDecrypt::Decrypt(const unsigned char* data, int size, unsigned char* out) const
     145             : {
     146        3519 :     return CBCDecrypt(dec, iv, data, size, pad, out);
     147             : }
     148             : 
     149        6902 : AES256CBCDecrypt::~AES256CBCDecrypt()
     150        3451 : {
     151        3451 :     memset(iv, 0, sizeof(iv));
     152        6902 : }