bip151: add chacha20 and poly1305.
This commit is contained in:
Christopher Jeffrey
parent
2cbe8ff411
commit
1984bc178c
597
lib/bcoin/chachapoly.js
Normal file
597
lib/bcoin/chachapoly.js
Normal file
@ -0,0 +1,597 @@
|
||||
/*!
|
||||
* chachapoly.js - chacha20/poly1305 for bcoin
|
||||
* Copyright (c) 2014-2015, Fedor Indutny (MIT License)
|
||||
* Copyright (c) 2014-2016, Christopher Jeffrey (MIT License).
|
||||
* https://github.com/indutny/bcoin
|
||||
*/
|
||||
|
||||
var assert = require('assert');
|
||||
|
||||
/**
|
||||
* ChaCha20 (used for bip151)
|
||||
* @see https://tools.ietf.org/html/rfc7539#section-2
|
||||
* @exports ChaCha20
|
||||
* @constructor
|
||||
*/
|
||||
|
||||
function ChaCha20() {
|
||||
if (!(this instanceof ChaCha20))
|
||||
return new ChaCha20();
|
||||
|
||||
this.state = new Uint32Array(16);
|
||||
this.stream = new Uint32Array(16);
|
||||
this.bytes = new Buffer(64);
|
||||
this.pos = 0;
|
||||
this.ivSize = 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize chacha20 with a key, iv, and counter.
|
||||
* @param {Buffer} key
|
||||
* @param {Buffer} iv
|
||||
* @param {Number} counter
|
||||
*/
|
||||
|
||||
ChaCha20.prototype.init = function init(key, iv, counter) {
|
||||
this.state[0] = 0x61707865;
|
||||
this.state[1] = 0x3320646e;
|
||||
this.state[2] = 0x79622d32;
|
||||
this.state[3] = 0x6b206574;
|
||||
|
||||
this.state[4] = key.readUInt32LE(0, true);
|
||||
this.state[5] = key.readUInt32LE(4, true);
|
||||
this.state[6] = key.readUInt32LE(8, true);
|
||||
this.state[7] = key.readUInt32LE(12, true);
|
||||
this.state[8] = key.readUInt32LE(16, true);
|
||||
this.state[9] = key.readUInt32LE(20, true);
|
||||
this.state[10] = key.readUInt32LE(24, true);
|
||||
this.state[11] = key.readUInt32LE(28, true);
|
||||
|
||||
this.state[12] = 0;
|
||||
|
||||
if (iv.length === 8) {
|
||||
this.state[13] = 0;
|
||||
this.state[14] = iv.readUInt32LE(0, true);
|
||||
this.state[15] = iv.readUInt32LE(4, true);
|
||||
} else if (iv.length === 12) {
|
||||
this.state[13] = iv.readUInt32LE(0, true);
|
||||
this.state[14] = iv.readUInt32LE(4, true);
|
||||
this.state[15] = iv.readUInt32LE(8, true);
|
||||
} else {
|
||||
assert(false, 'Bad iv size.');
|
||||
}
|
||||
|
||||
this.pos = 0xffffffff;
|
||||
this.ivSize = iv.length * 8;
|
||||
|
||||
this.setCounter(counter);
|
||||
};
|
||||
|
||||
/**
|
||||
* Encrypt/decrypt data.
|
||||
* @param {Buffer} data - Will be mutated.
|
||||
*/
|
||||
|
||||
ChaCha20.prototype.encrypt = function encrypt(data) {
|
||||
var i, j;
|
||||
|
||||
for (i = 0; i < data.length; i++) {
|
||||
if (this.pos >= 64) {
|
||||
for (j = 0; j < 16; j++)
|
||||
this.stream[j] = this.state[j];
|
||||
|
||||
for (j = 0; j < 10; j++) {
|
||||
qround(this.stream, 0, 4, 8, 12);
|
||||
qround(this.stream, 1, 5, 9, 13);
|
||||
qround(this.stream, 2, 6, 10, 14);
|
||||
qround(this.stream, 3, 7, 11, 15);
|
||||
qround(this.stream, 0, 5, 10, 15);
|
||||
qround(this.stream, 1, 6, 11, 12);
|
||||
qround(this.stream, 2, 7, 8, 13);
|
||||
qround(this.stream, 3, 4, 9, 14);
|
||||
}
|
||||
|
||||
for (j = 0; j < 16; j++) {
|
||||
this.stream[j] += this.state[j];
|
||||
this.bytes.writeUInt32LE(this.stream[j], j * 4);
|
||||
}
|
||||
|
||||
this.state[12]++;
|
||||
|
||||
if (this.state[12] === 0) {
|
||||
assert(this.ivSize === 64, 'Counter overflow.');
|
||||
this.state[13]++;
|
||||
assert(this.state[13] !== 0, 'Counter overflow.');
|
||||
}
|
||||
|
||||
this.pos = 0;
|
||||
}
|
||||
|
||||
data[i] ^= this.bytes[this.pos++];
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Artificially set the counter.
|
||||
* @param {Number} counter
|
||||
*/
|
||||
|
||||
ChaCha20.prototype.setCounter = function setCounter(counter) {
|
||||
var lo, hi;
|
||||
|
||||
if (!counter)
|
||||
counter = 0;
|
||||
|
||||
lo = counter % 0x100000000;
|
||||
hi = (counter - lo) / 0x100000000;
|
||||
|
||||
this.state[12] = lo;
|
||||
|
||||
if (this.ivSize === 64)
|
||||
this.state[13] = hi;
|
||||
};
|
||||
|
||||
/**
|
||||
* Get the counter as a uint64.
|
||||
* @returns {Number}
|
||||
*/
|
||||
|
||||
ChaCha20.prototype.getCounter = function getCounter() {
|
||||
var lo = this.state[12];
|
||||
var hi = this.state[13];
|
||||
if (this.ivSize === 64)
|
||||
return hi * 0x100000000 + lo;
|
||||
return lo;
|
||||
};
|
||||
|
||||
/*
|
||||
* Helpers
|
||||
*/
|
||||
|
||||
function qround(x, a, b, c, d) {
|
||||
x[a] += x[b]; x[d] = rotl32(x[d] ^ x[a], 16);
|
||||
x[c] += x[d]; x[b] = rotl32(x[b] ^ x[c], 12);
|
||||
x[a] += x[b]; x[d] = rotl32(x[d] ^ x[a], 8);
|
||||
x[c] += x[d]; x[b] = rotl32(x[b] ^ x[c], 7);
|
||||
}
|
||||
|
||||
function rotl32(w, b) {
|
||||
return (w << b) | (w >>> (32 - b));
|
||||
}
|
||||
|
||||
/**
|
||||
* Poly1305 (used for bip151)
|
||||
* @see https://github.com/floodyberry/poly1305-donna
|
||||
* @see https://tools.ietf.org/html/rfc7539#section-2.5
|
||||
* @exports Poly1305
|
||||
* @constructor
|
||||
*/
|
||||
|
||||
function Poly1305() {
|
||||
if (!(this instanceof Poly1305))
|
||||
return new Poly1305();
|
||||
|
||||
this.r = new Uint16Array(10);
|
||||
this.h = new Uint16Array(10);
|
||||
this.pad = new Uint16Array(8);
|
||||
this.fin = 0;
|
||||
this.leftover = 0;
|
||||
this.buffer = new Buffer(16);
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize poly1305 with a key.
|
||||
* @param {Buffer} key
|
||||
*/
|
||||
|
||||
Poly1305.prototype.init = function init(key) {
|
||||
var t0, t1, t2, t3, t4, t5, t6, t7, i;
|
||||
|
||||
// r &= 0xffffffc0ffffffc0ffffffc0fffffff
|
||||
t0 = key.readUInt16LE(0, true);
|
||||
t1 = key.readUInt16LE(2, true);
|
||||
t2 = key.readUInt16LE(4, true);
|
||||
t3 = key.readUInt16LE(6, true);
|
||||
t4 = key.readUInt16LE(8, true);
|
||||
t5 = key.readUInt16LE(10, true);
|
||||
t6 = key.readUInt16LE(12, true);
|
||||
t7 = key.readUInt16LE(14, true);
|
||||
|
||||
this.r[0] = t0 & 0x1fff;
|
||||
this.r[1] = ((t0 >>> 13) | (t1 << 3)) & 0x1fff;
|
||||
this.r[2] = ((t1 >>> 10) | (t2 << 6)) & 0x1f03;
|
||||
this.r[3] = ((t2 >>> 7) | (t3 << 9)) & 0x1fff;
|
||||
this.r[4] = ((t3 >>> 4) | (t4 << 12)) & 0x00ff;
|
||||
this.r[5] = (t4 >>> 1) & 0x1ffe;
|
||||
this.r[6] = ((t4 >>> 14) | (t5 << 2)) & 0x1fff;
|
||||
this.r[7] = ((t5 >>> 11) | (t6 << 5)) & 0x1f81;
|
||||
this.r[8] = ((t6 >>> 8) | (t7 << 8)) & 0x1fff;
|
||||
this.r[9] = (t7 >>> 5) & 0x007f;
|
||||
|
||||
// h = 0
|
||||
for (i = 0; i < 10; i++)
|
||||
this.h[i] = 0;
|
||||
|
||||
// save pad for later
|
||||
for (i = 0; i < 8; i++)
|
||||
this.pad[i] = key.readUInt16LE(16 + (2 * i), true);
|
||||
|
||||
this.leftover = 0;
|
||||
this.fin = 0;
|
||||
};
|
||||
|
||||
/**
|
||||
* Process 16 byte blocks.
|
||||
* @param {Buffer} data - Blocks.
|
||||
* @param {Number} bytes - Size.
|
||||
* @param {Number} m - Offset pointer.
|
||||
*/
|
||||
|
||||
Poly1305.prototype.blocks = function blocks(data, bytes, m) {
|
||||
var hibit = this.fin ? 0 : (1 << 11); // 1 << 128
|
||||
var d = new Uint32Array(10);
|
||||
var i, j, t0, t1, t2, t3, t4, t5, t6, t7, c;
|
||||
|
||||
while (bytes >= 16) {
|
||||
// h += m[i]
|
||||
t0 = data.readUInt16LE(m + 0, true);
|
||||
t1 = data.readUInt16LE(m + 2, true);
|
||||
t2 = data.readUInt16LE(m + 4, true);
|
||||
t3 = data.readUInt16LE(m + 6, true);
|
||||
t4 = data.readUInt16LE(m + 8, true);
|
||||
t5 = data.readUInt16LE(m + 10, true);
|
||||
t6 = data.readUInt16LE(m + 12, true);
|
||||
t7 = data.readUInt16LE(m + 14, true);
|
||||
|
||||
this.h[0] += t0 & 0x1fff;
|
||||
this.h[1] += ((t0 >>> 13) | (t1 << 3)) & 0x1fff;
|
||||
this.h[2] += ((t1 >>> 10) | (t2 << 6)) & 0x1fff;
|
||||
this.h[3] += ((t2 >>> 7) | (t3 << 9)) & 0x1fff;
|
||||
this.h[4] += ((t3 >>> 4) | (t4 << 12)) & 0x1fff;
|
||||
this.h[5] += ((t4 >>> 1)) & 0x1fff;
|
||||
this.h[6] += ((t4 >>> 14) | (t5 << 2)) & 0x1fff;
|
||||
this.h[7] += ((t5 >>> 11) | (t6 << 5)) & 0x1fff;
|
||||
this.h[8] += ((t6 >>> 8) | (t7 << 8)) & 0x1fff;
|
||||
this.h[9] += ((t7 >>> 5)) | hibit;
|
||||
|
||||
// h *= r, (partial) h %= p
|
||||
for (i = 0, c = 0; i < 10; i++) {
|
||||
d[i] = c;
|
||||
for (j = 0; j < 10; j++) {
|
||||
d[i] += this.h[j] * ((j <= i)
|
||||
? this.r[i - j]
|
||||
: (5 * this.r[i + 10 - j]));
|
||||
// Sum(h[i] * r[i] * 5) will overflow slightly
|
||||
// above 6 products with an unclamped r, so
|
||||
// carry at 5
|
||||
if (j === 4) {
|
||||
c = (d[i] >>> 13);
|
||||
d[i] &= 0x1fff;
|
||||
}
|
||||
}
|
||||
c += (d[i] >>> 13);
|
||||
d[i] &= 0x1fff;
|
||||
}
|
||||
c = ((c << 2) + c); // c *= 5
|
||||
c += d[0];
|
||||
d[0] = (c & 0x1fff);
|
||||
c = (c >>> 13);
|
||||
d[1] += c;
|
||||
|
||||
for (i = 0; i < 10; i++)
|
||||
this.h[i] = d[i];
|
||||
|
||||
m += 16;
|
||||
bytes -= 16;
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Update the MAC with data (will be
|
||||
* processed as 16 byte blocks).
|
||||
* @param {Buffer} data
|
||||
*/
|
||||
|
||||
Poly1305.prototype.update = function update(data) {
|
||||
var bytes = data.length;
|
||||
var m = 0;
|
||||
var i, want;
|
||||
|
||||
// handle leftover
|
||||
if (this.leftover) {
|
||||
want = (16 - this.leftover);
|
||||
if (want > bytes)
|
||||
want = bytes;
|
||||
for (i = 0; i < want; i++)
|
||||
this.buffer[this.leftover + i] = data[m + i];
|
||||
bytes -= want;
|
||||
m += want;
|
||||
this.leftover += want;
|
||||
if (this.leftover < 16)
|
||||
return;
|
||||
this.blocks(this.buffer, 16, 0);
|
||||
this.leftover = 0;
|
||||
}
|
||||
|
||||
// process full blocks
|
||||
if (bytes >= 16) {
|
||||
want = (bytes & ~(16 - 1));
|
||||
this.blocks(data, want, m);
|
||||
m += want;
|
||||
bytes -= want;
|
||||
}
|
||||
|
||||
// store leftover
|
||||
if (bytes) {
|
||||
for (i = 0; i < bytes; i++)
|
||||
this.buffer[this.leftover + i] = data[m + i];
|
||||
this.leftover += bytes;
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Finalize and return a 16-byte MAC.
|
||||
* @returns {Buffer}
|
||||
*/
|
||||
|
||||
Poly1305.prototype.finish = function finish() {
|
||||
var mac = new Buffer(16);
|
||||
var g = new Uint16Array(10);
|
||||
var c, mask, f, i;
|
||||
|
||||
// process the remaining block
|
||||
if (this.leftover) {
|
||||
i = this.leftover;
|
||||
this.buffer[i++] = 1;
|
||||
for (; i < 16; i++)
|
||||
this.buffer[i] = 0;
|
||||
this.fin = 1;
|
||||
this.blocks(this.buffer, 16, 0);
|
||||
}
|
||||
|
||||
// fully carry h
|
||||
c = this.h[1] >>> 13;
|
||||
this.h[1] &= 0x1fff;
|
||||
for (i = 2; i < 10; i++) {
|
||||
this.h[i] += c;
|
||||
c = this.h[i] >>> 13;
|
||||
this.h[i] &= 0x1fff;
|
||||
}
|
||||
this.h[0] += (c * 5);
|
||||
c = this.h[0] >>> 13;
|
||||
this.h[0] &= 0x1fff;
|
||||
this.h[1] += c;
|
||||
c = this.h[1] >>> 13;
|
||||
this.h[1] &= 0x1fff;
|
||||
this.h[2] += c;
|
||||
|
||||
// compute h + -p
|
||||
g[0] = this.h[0] + 5;
|
||||
c = g[0] >>> 13;
|
||||
g[0] &= 0x1fff;
|
||||
for (i = 1; i < 10; i++) {
|
||||
g[i] = this.h[i] + c;
|
||||
c = g[i] >>> 13;
|
||||
g[i] &= 0x1fff;
|
||||
}
|
||||
|
||||
// select h if h < p, or h + -p if h >= p
|
||||
mask = (c ^ 1) - 1;
|
||||
for (i = 0; i < 10; i++)
|
||||
g[i] &= mask;
|
||||
mask = ~mask;
|
||||
for (i = 0; i < 10; i++)
|
||||
this.h[i] = (this.h[i] & mask) | g[i];
|
||||
|
||||
// h = h % (2^128)
|
||||
this.h[0] = ((this.h[0]) | (this.h[1] << 13)) & 0xffff;
|
||||
this.h[1] = ((this.h[1] >>> 3) | (this.h[2] << 10)) & 0xffff;
|
||||
this.h[2] = ((this.h[2] >>> 6) | (this.h[3] << 7)) & 0xffff;
|
||||
this.h[3] = ((this.h[3] >>> 9) | (this.h[4] << 4)) & 0xffff;
|
||||
this.h[4] = ((this.h[4] >>> 12)
|
||||
| (this.h[5] << 1) | (this.h[6] << 14)) & 0xffff;
|
||||
this.h[5] = ((this.h[6] >>> 2) | (this.h[7] << 11)) & 0xffff;
|
||||
this.h[6] = ((this.h[7] >>> 5) | (this.h[8] << 8)) & 0xffff;
|
||||
this.h[7] = ((this.h[8] >>> 8) | (this.h[9] << 5)) & 0xffff;
|
||||
|
||||
// mac = (h + pad) % (2^128)
|
||||
f = this.h[0] + this.pad[0];
|
||||
this.h[0] = f;
|
||||
for (i = 1; i < 8; i++) {
|
||||
f = this.h[i] + this.pad[i] + (f >>> 16);
|
||||
this.h[i] = f;
|
||||
}
|
||||
|
||||
for (i = 0; i < 8; i++)
|
||||
mac.writeUInt16LE(this.h[i], i * 2, true);
|
||||
|
||||
// zero out the state
|
||||
for (i = 0; i < 10; i++)
|
||||
this.h[i] = 0;
|
||||
for (i = 0; i < 10; i++)
|
||||
this.r[i] = 0;
|
||||
for (i = 0; i < 8; i++)
|
||||
this.pad[i] = 0;
|
||||
|
||||
return mac;
|
||||
};
|
||||
|
||||
/**
|
||||
* Return a MAC for a message and key.
|
||||
* @param {Buffer} msg
|
||||
* @param {Buffer} key
|
||||
* @returns {Buffer} MAC
|
||||
*/
|
||||
|
||||
Poly1305.auth = function auth(msg, key) {
|
||||
var poly = new Poly1305();
|
||||
poly.init(key);
|
||||
poly.update(msg);
|
||||
return poly.finish();
|
||||
};
|
||||
|
||||
/**
|
||||
* Compare two MACs in constant time.
|
||||
* @param {Buffer} mac1
|
||||
* @param {Buffer} mac2
|
||||
* @returns {Boolean}
|
||||
*/
|
||||
|
||||
Poly1305.verify = function verify(mac1, mac2) {
|
||||
var dif = 0;
|
||||
var i;
|
||||
|
||||
// Compare in constant time.
|
||||
for (i = 0; i < 16; i++)
|
||||
dif |= mac1[i] ^ mac2[i];
|
||||
|
||||
dif = (dif - 1) >>> 31;
|
||||
|
||||
return (dif & 1) !== 0;
|
||||
};
|
||||
|
||||
/**
|
||||
* AEAD (used for bip151)
|
||||
* @exports AEAD
|
||||
* @see https://github.com/openssh/openssh-portable
|
||||
* @see https://tools.ietf.org/html/rfc7539#section-2.8
|
||||
* @constructor
|
||||
*/
|
||||
|
||||
function AEAD() {
|
||||
if (!(this instanceof AEAD))
|
||||
return new AEAD();
|
||||
|
||||
this.chacha20 = new ChaCha20();
|
||||
this.poly1305 = new Poly1305();
|
||||
this.aadLen = 0;
|
||||
this.cipherLen = 0;
|
||||
this.polyKey = null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize the AEAD with a key and iv.
|
||||
* @param {Buffer} key
|
||||
* @param {Buffer} iv - IV / packet sequence number.
|
||||
*/
|
||||
|
||||
AEAD.prototype.init = function init(key, iv) {
|
||||
var polyKey = new Buffer(32);
|
||||
polyKey.fill(0);
|
||||
|
||||
this.chacha20.init(key, iv);
|
||||
this.chacha20.encrypt(polyKey);
|
||||
this.poly1305.init(polyKey);
|
||||
|
||||
// We need to encrypt a full block
|
||||
// to get the cipher in the correct state.
|
||||
this.chacha20.encrypt(new Buffer(32));
|
||||
|
||||
// Counter should be one.
|
||||
assert(this.chacha20.state[12] === 1);
|
||||
|
||||
// Expose for debugging.
|
||||
this.polyKey = polyKey;
|
||||
|
||||
this.aadLen = 0;
|
||||
this.cipherLen = 0;
|
||||
};
|
||||
|
||||
/**
|
||||
* Update the aad (will be finalized
|
||||
* on an encrypt/decrypt call).
|
||||
* @param {Buffer} aad
|
||||
*/
|
||||
|
||||
AEAD.prototype.aad = function _aad(aad) {
|
||||
assert(this.cipherLen === 0, 'Cannot update aad.');
|
||||
this.poly1305.update(aad);
|
||||
this.aadLen += aad.length;
|
||||
};
|
||||
|
||||
/**
|
||||
* Encrypt a piece of data.
|
||||
* @param {Buffer} data
|
||||
*/
|
||||
|
||||
AEAD.prototype.encrypt = function encrypt(data) {
|
||||
if (this.cipherLen === 0)
|
||||
this.pad16(this.aadLen);
|
||||
|
||||
this.chacha20.encrypt(data);
|
||||
this.poly1305.update(data);
|
||||
this.cipherLen += data.length;
|
||||
};
|
||||
|
||||
/**
|
||||
* Decrypt a piece of data.
|
||||
* @param {Buffer} data
|
||||
*/
|
||||
|
||||
AEAD.prototype.decrypt = function decrypt(data) {
|
||||
if (this.cipherLen === 0)
|
||||
this.pad16(this.aadLen);
|
||||
|
||||
this.cipherLen += data.length;
|
||||
this.poly1305.update(data);
|
||||
this.chacha20.encrypt(data);
|
||||
};
|
||||
|
||||
/**
|
||||
* Finalize the aead and generate a MAC.
|
||||
* @returns {Buffer} MAC
|
||||
*/
|
||||
|
||||
AEAD.prototype.finish = function finish() {
|
||||
var len = new Buffer(16);
|
||||
var lo, hi;
|
||||
|
||||
if (this.cipherLen === 0)
|
||||
this.pad16(this.aadLen);
|
||||
|
||||
// The RFC says these are supposed to be
|
||||
// uint32le, but their own fucking test
|
||||
// cases fail unless they are uint64le's.
|
||||
lo = this.aadLen % 0x100000000;
|
||||
hi = (this.aadLen - lo) / 0x100000000;
|
||||
len.writeUInt32LE(lo, 0, true);
|
||||
len.writeUInt32LE(hi, 4, true);
|
||||
|
||||
lo = this.cipherLen % 0x100000000;
|
||||
hi = (this.cipherLen - lo) / 0x100000000;
|
||||
len.writeUInt32LE(lo, 8, true);
|
||||
len.writeUInt32LE(hi, 12, true);
|
||||
|
||||
this.pad16(this.cipherLen);
|
||||
this.poly1305.update(len);
|
||||
|
||||
return this.poly1305.finish();
|
||||
};
|
||||
|
||||
/**
|
||||
* Pad a chunk before updating mac.
|
||||
* @private
|
||||
* @param {Number} size
|
||||
*/
|
||||
|
||||
AEAD.prototype.pad16 = function pad16(size) {
|
||||
var pad;
|
||||
|
||||
size %= 16;
|
||||
|
||||
if (size === 0)
|
||||
return;
|
||||
|
||||
pad = new Buffer(16 - size);
|
||||
pad.fill(0);
|
||||
|
||||
this.poly1305.update(pad);
|
||||
};
|
||||
|
||||
/*
|
||||
* Expose
|
||||
*/
|
||||
|
||||
exports.ChaCha20 = ChaCha20;
|
||||
exports.Poly1305 = Poly1305;
|
||||
exports.AEAD = AEAD;
|
||||
240
test/chachapoly-test.js
Normal file
240
test/chachapoly-test.js
Normal file
@ -0,0 +1,240 @@
|
||||
var assert = require('assert');
|
||||
var chachapoly = require('../lib/bcoin/chachapoly');
|
||||
var ChaCha20 = chachapoly.ChaCha20;
|
||||
var Poly1305 = chachapoly.Poly1305;
|
||||
var AEAD = chachapoly.AEAD;
|
||||
|
||||
describe('ChaCha20 / Poly1305 / AEAD', function() {
|
||||
function testChaCha(options) {
|
||||
var key = options.key;
|
||||
var nonce = options.nonce;
|
||||
var plain = options.plain;
|
||||
var ciphertext = options.ciphertext;
|
||||
var counter = options.counter;
|
||||
|
||||
key = new Buffer(key, 'hex');
|
||||
nonce = new Buffer(nonce, 'hex');
|
||||
plain = new Buffer(plain, 'hex');
|
||||
ciphertext = new Buffer(ciphertext, 'hex');
|
||||
|
||||
var chacha = new ChaCha20();
|
||||
chacha.init(key, nonce, counter);
|
||||
var plainenc = new Buffer(plain);
|
||||
chacha.encrypt(plainenc);
|
||||
assert.deepEqual(plainenc, ciphertext);
|
||||
|
||||
var chacha = new ChaCha20();
|
||||
chacha.init(key, nonce, counter);
|
||||
chacha.encrypt(ciphertext);
|
||||
assert.deepEqual(plain, ciphertext);
|
||||
}
|
||||
|
||||
function testAEAD(options) {
|
||||
var plain = options.plain;
|
||||
var aad = options.aad;
|
||||
var key = options.key;
|
||||
var nonce = options.nonce;
|
||||
var pk = options.pk;
|
||||
var ciphertext = options.ciphertext;
|
||||
var tag = options.tag;
|
||||
|
||||
plain = new Buffer(plain, 'hex');
|
||||
aad = new Buffer(aad, 'hex');
|
||||
key = new Buffer(key, 'hex');
|
||||
nonce = new Buffer(nonce, 'hex');
|
||||
pk = new Buffer(pk, 'hex');
|
||||
ciphertext = new Buffer(ciphertext, 'hex');
|
||||
tag = new Buffer(tag, 'hex');
|
||||
|
||||
var aead = new AEAD();
|
||||
aead.init(key, nonce);
|
||||
assert.equal(aead.chacha20.state[12], 1);
|
||||
assert.deepEqual(aead.polyKey, pk);
|
||||
aead.aad(aad);
|
||||
var plainenc = new Buffer(plain);
|
||||
aead.encrypt(plainenc);
|
||||
assert.deepEqual(plainenc, ciphertext);
|
||||
assert.deepEqual(aead.finish(), tag);
|
||||
|
||||
var aead = new AEAD();
|
||||
aead.init(key, nonce);
|
||||
assert.equal(aead.chacha20.state[12], 1);
|
||||
assert.deepEqual(aead.polyKey, pk);
|
||||
aead.aad(aad);
|
||||
aead.decrypt(ciphertext);
|
||||
assert.deepEqual(ciphertext, plain);
|
||||
assert.deepEqual(aead.finish(), tag);
|
||||
}
|
||||
|
||||
it('should perform chacha20', function() {
|
||||
testChaCha({
|
||||
key: '000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f',
|
||||
nonce: '000000000000004a00000000',
|
||||
plain: ''
|
||||
+ '4c616469657320616e642047656e746c656d656e206f6620746865206'
|
||||
+ '36c617373206f66202739393a204966204920636f756c64206f6666657220796'
|
||||
+ 'f75206f6e6c79206f6e652074697020666f7220746865206675747572652c207'
|
||||
+ '3756e73637265656e20776f756c642062652069742e',
|
||||
ciphertext: ''
|
||||
+ '6e2e359a2568f98041ba0728dd0d6981e97e7aec1d4360c20a27afcc'
|
||||
+ 'fd9fae0bf91b65c5524733ab8f593dabcd62b3571639d624e65152ab'
|
||||
+ '8f530c359f0861d807ca0dbf500d6a6156a38e088a22b65e52bc514d'
|
||||
+ '16ccf806818ce91ab77937365af90bbf74a35be6b40b8eedf2785e42874d',
|
||||
counter: 1
|
||||
});
|
||||
});
|
||||
|
||||
it('should perform chacha20', function() {
|
||||
testChaCha({
|
||||
key: '0000000000000000000000000000000000000000000000000000000000000000',
|
||||
nonce: '000000000000000000000000',
|
||||
plain: ''
|
||||
+ '0000000000000000000000000000000000000000000000000000000000000000'
|
||||
+ '0000000000000000000000000000000000000000000000000000000000000000',
|
||||
ciphertext: ''
|
||||
+ '76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b77'
|
||||
+ '0dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586',
|
||||
counter: 0
|
||||
});
|
||||
});
|
||||
|
||||
it('should perform chacha20', function() {
|
||||
testChaCha({
|
||||
key: '0000000000000000000000000000000000000000000000000000000000000001',
|
||||
nonce: '000000000000000000000002',
|
||||
plain: ''
|
||||
+ '416e79207375626d697373696f6e20746f20746865204945544620696e'
|
||||
+ '74656e6465642062792074686520436f6e7472696275746f7220666f722'
|
||||
+ '07075626c69636174696f6e20617320616c6c206f722070617274206f'
|
||||
+ '6620616e204945544620496e7465726e65742d4472616674206f7220524'
|
||||
+ '64320616e6420616e792073746174656d656e74206d6164652077697468696'
|
||||
+ 'e2074686520636f6e74657874206f6620616e2049455446206163746976'
|
||||
+ '69747920697320636f6e7369646572656420616e20224945544620436f6'
|
||||
+ 'e747269627574696f6e222e20537563682073746174656d656e747320696e'
|
||||
+ '636c756465206f72616c2073746174656d656e747320696e204945544620'
|
||||
+ '73657373696f6e732c2061732077656c6c206173207772697474656e2061'
|
||||
+ '6e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d'
|
||||
+ '61646520617420616e792074696d65206f7220706c6163652c2077686963'
|
||||
+ '68206172652061646472657373656420746f',
|
||||
ciphertext: ''
|
||||
+ 'a3fbf07df3fa2fde4f376ca23e82737041605d9f4f4f57bd8cff2c1d'
|
||||
+ '4b7955ec2a97948bd3722915c8f3d337f7d370050e9e96d647b7c39f'
|
||||
+ '56e031ca5eb6250d4042e02785ececfa4b4bb5e8ead0440e20b6e8db'
|
||||
+ '09d881a7c6132f420e52795042bdfa7773d8a9051447b3291ce1411c'
|
||||
+ '680465552aa6c405b7764d5e87bea85ad00f8449ed8f72d0d662ab05'
|
||||
+ '2691ca66424bc86d2df80ea41f43abf937d3259dc4b2d0dfb48a6c91'
|
||||
+ '39ddd7f76966e928e635553ba76c5c879d7b35d49eb2e62b0871cdac'
|
||||
+ '638939e25e8a1e0ef9d5280fa8ca328b351c3c765989cbcf3daa8b6c'
|
||||
+ 'cc3aaf9f3979c92b3720fc88dc95ed84a1be059c6499b9fda236e7e8'
|
||||
+ '18b04b0bc39c1e876b193bfe5569753f88128cc08aaa9b63d1a16f80'
|
||||
+ 'ef2554d7189c411f5869ca52c5b83fa36ff216b9c1d30062bebcfd'
|
||||
+ '2dc5bce0911934fda79a86f6e698ced759c3ff9b6477338f3da4f9'
|
||||
+ 'cd8514ea9982ccafb341b2384dd902f3d1ab7ac61dd29c6f21ba5b'
|
||||
+ '862f3730e37cfdc4fd806c22f221',
|
||||
counter: 1
|
||||
});
|
||||
});
|
||||
|
||||
it('should perform chacha20', function() {
|
||||
testChaCha({
|
||||
key: '1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0',
|
||||
nonce: '000000000000000000000002',
|
||||
plain: ''
|
||||
+ '2754776173206272696c6c69672c20616e642074686520736c6974687920746f76'
|
||||
+ '65730a446964206779726520616e642067696d626c6520696e207468'
|
||||
+ '6520776162653a0a416c6c206d696d73792077657265207468652062'
|
||||
+ '6f726f676f7665732c0a416e6420746865206d6f6d65207261746873'
|
||||
+ '206f757467726162652e',
|
||||
ciphertext: ''
|
||||
+ '62e6347f95ed87a45ffae7426f27a1df5fb69110044c0d73118effa95b01e5cf16'
|
||||
+ '6d3df2d721caf9b21e5fb14c616871fd84c54f9d65b283196c7fe4f6'
|
||||
+ '0553ebf39c6402c42234e32a356b3e764312a61a5532055716ead696'
|
||||
+ '2568f87d3f3f7704c6a8d1bcd1bf4d50d6154b6da731b187b58dfd72'
|
||||
+ '8afa36757a797ac188d1',
|
||||
counter: 42
|
||||
});
|
||||
});
|
||||
|
||||
it('should perform poly1305', function() {
|
||||
var expected = new Buffer('ddb9da7ddd5e52792730ed5cda5f90a4', 'hex');
|
||||
var key = new Buffer(32);
|
||||
var msg = new Buffer(73);
|
||||
var mac;
|
||||
var i;
|
||||
|
||||
for (i = 0; i < key.length; i++)
|
||||
key[i] = i + 221;
|
||||
|
||||
for (i = 0; i < msg.length; i++)
|
||||
msg[i] = i + 121;
|
||||
|
||||
mac = Poly1305.auth(msg, key);
|
||||
assert(Poly1305.verify(mac, expected));
|
||||
assert.deepEqual(mac, expected);
|
||||
});
|
||||
|
||||
it('should perform poly1305', function() {
|
||||
var key = '85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b';
|
||||
var msg = 'Cryptographic Forum Research Group';
|
||||
var tag = 'a8061dc1305136c6c22b8baf0c0127a9';
|
||||
key = new Buffer(key, 'hex');
|
||||
msg = new Buffer(msg, 'ascii');
|
||||
tag = new Buffer(tag, 'hex');
|
||||
mac = Poly1305.auth(msg, key);
|
||||
assert(Poly1305.verify(mac, tag));
|
||||
});
|
||||
|
||||
it('should create an AEAD and encrypt', function() {
|
||||
testAEAD({
|
||||
// 'Ladies and Gentlemen of the class of \'99: If I could'
|
||||
// + ' offer you only one tip for the future, sunscreen would be it.';
|
||||
plain: ''
|
||||
+ '4c616469657320616e642047656e746c656d656e206f662074686520636c6'
|
||||
+ '17373206f66202739393a204966204920636f756c64206f666665722'
|
||||
+ '0796f75206f6e6c79206f6e652074697020666f72207468652066757'
|
||||
+ '47572652c2073756e73637265656e20776f756c642062652069742e',
|
||||
aad: '50515253c0c1c2c3c4c5c6c7',
|
||||
key: '808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f',
|
||||
nonce: '07000000' + '4041424344454647',
|
||||
pk: '7bac2b252db447af09b67a55a4e955840ae1d6731075d9eb2a9375783ed553ff',
|
||||
ciphertext: ''
|
||||
+ 'd31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee6'
|
||||
+ '2d63dbea45e8ca9671282fafb69da92728b1a71de0a9e060b2905d6a'
|
||||
+ '5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fab324e4fad67'
|
||||
+ '5945585808b4831d7bc3ff4def08e4b7a9de576d26586cec64b6116',
|
||||
tag: '1ae10b594f09e26a7e902ecbd0600691'
|
||||
});
|
||||
});
|
||||
|
||||
it('should create an AEAD and encrypt', function() {
|
||||
testAEAD({
|
||||
key: '1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0',
|
||||
ciphertext: ''
|
||||
+ '64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8'
|
||||
+ 'cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03'
|
||||
+ 'b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d3'
|
||||
+ '3bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b35063836069'
|
||||
+ '07b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a'
|
||||
+ '4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b004'
|
||||
+ '7718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa7'
|
||||
+ '6991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e61'
|
||||
+ '7d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6'
|
||||
+ 'f2c29a6ad5cb4022b02709b',
|
||||
nonce: '000000000102030405060708',
|
||||
aad: 'f33388860000000000004e91',
|
||||
tag: 'eead9d67890cbb22392336fea1851f38',
|
||||
pk: 'bdf04aa95ce4de8995b14bb6a18fecaf26478f50c054f563dbc0a21e261572aa',
|
||||
plain: ''
|
||||
+ '496e7465726e65742d4472616674732061726520647261667420646f63756'
|
||||
+ 'd656e74732076616c696420666f722061206d6178696d756d206f662'
|
||||
+ '0736978206d6f6e74687320616e64206d61792062652075706461746'
|
||||
+ '5642c207265706c616365642c206f72206f62736f6c6574656420627'
|
||||
+ '9206f7468657220646f63756d656e747320617420616e792074696d6'
|
||||
+ '52e20497420697320696e617070726f70726961746520746f2075736'
|
||||
+ '520496e7465726e65742d447261667473206173207265666572656e6'
|
||||
+ '365206d6174657269616c206f7220746f2063697465207468656d206'
|
||||
+ 'f74686572207468616e206173202fe2809c776f726b20696e2070726'
|
||||
+ 'f67726573732e2fe2809d'
|
||||
});
|
||||
});
|
||||
});
|
||||
Loading…
Reference in New Issue
Block a user