Skip to content

Commit efad5d7

Browse files
dhruvdhruv
committed
RFC8439 implementation and tests
1 parent 8f0e926 commit efad5d7

8 files changed

+296
-1
lines changed

‎src/Makefile.am

+2
Original file line numberDiff line numberDiff line change
@@ -532,6 +532,8 @@ crypto_libbitcoin_crypto_base_la_SOURCES = \
532532
crypto/poly1305.cpp \
533533
crypto/muhash.h \
534534
crypto/muhash.cpp \
535+
crypto/rfc8439.h \
536+
crypto/rfc8439.cpp \
535537
crypto/ripemd160.cpp \
536538
crypto/ripemd160.h \
537539
crypto/sha1.cpp \

‎src/Makefile.bench.include

+1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ bench_bench_bitcoin_SOURCES = \
4343
bench/peer_eviction.cpp \
4444
bench/poly1305.cpp \
4545
bench/prevector.cpp \
46+
bench/rfc8439.cpp \
4647
bench/rollingbloom.cpp \
4748
bench/rpc_blockchain.cpp \
4849
bench/rpc_mempool.cpp \

‎src/Makefile.test.include

+1
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,7 @@ test_fuzz_fuzz_SOURCES = \
259259
test/fuzz/crypto_diff_fuzz_chacha20.cpp \
260260
test/fuzz/crypto_hkdf_hmac_sha256_l32.cpp \
261261
test/fuzz/crypto_poly1305.cpp \
262+
test/fuzz/crypto_rfc8439.cpp \
262263
test/fuzz/cuckoocache.cpp \
263264
test/fuzz/decode_tx.cpp \
264265
test/fuzz/descriptor_parse.cpp \

‎src/bench/rfc8439.cpp

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
// Copyright (c) 2022 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <assert.h>
6+
#include <bench/bench.h>
7+
#include <crypto/rfc8439.h>
8+
9+
#include <array>
10+
#include <cstddef>
11+
#include <vector>
12+
13+
static constexpr uint64_t AAD_SIZE = 32;
14+
static constexpr uint64_t PLAINTEXT_SIZE_TINY = 64;
15+
static constexpr uint64_t PLAINTEXT_SIZE_SMALL = 256;
16+
static constexpr uint64_t PLAINTEXT_SIZE_LARGE = 1024 * 1024;
17+
18+
static std::vector<std::byte> zero_key(32, std::byte{0x00});
19+
static std::vector<std::byte> aad(AAD_SIZE, std::byte{0x00});
20+
std::array<std::byte, 12> nonce = {std::byte{0x00}, std::byte{0x01}, std::byte{0x02}, std::byte{0x03},
21+
std::byte{0x04}, std::byte{0x05}, std::byte{0x06}, std::byte{0x07},
22+
std::byte{0x08}, std::byte{0x09}, std::byte{0x0a}, std::byte{0x0b}};
23+
24+
static void RFC8439_AEAD(benchmark::Bench& bench, size_t plaintext_size, bool include_decryption)
25+
{
26+
std::vector<std::byte> plaintext_in(plaintext_size, std::byte{0x00});
27+
std::vector<std::byte> output(plaintext_size + POLY1305_TAGLEN, std::byte{0x00});
28+
29+
bench.batch(plaintext_size).unit("byte").run([&] {
30+
RFC8439Encrypt(aad, zero_key, nonce, plaintext_in, output);
31+
32+
if (include_decryption) {
33+
std::vector<std::byte> decrypted_plaintext(plaintext_size);
34+
auto authenticated = RFC8439Decrypt(aad, zero_key, nonce, output, decrypted_plaintext);
35+
assert(authenticated);
36+
assert(memcmp(decrypted_plaintext.data(), plaintext_in.data(), plaintext_in.size()) == 0);
37+
}
38+
});
39+
}
40+
41+
static void RFC8439_AEAD_64BYTES_ONLY_ENCRYPT(benchmark::Bench& bench)
42+
{
43+
RFC8439_AEAD(bench, PLAINTEXT_SIZE_TINY, false);
44+
}
45+
46+
static void RFC8439_AEAD_256BYTES_ONLY_ENCRYPT(benchmark::Bench& bench)
47+
{
48+
RFC8439_AEAD(bench, PLAINTEXT_SIZE_SMALL, false);
49+
}
50+
51+
static void RFC8439_AEAD_1MB_ONLY_ENCRYPT(benchmark::Bench& bench)
52+
{
53+
RFC8439_AEAD(bench, PLAINTEXT_SIZE_LARGE, false);
54+
}
55+
56+
static void RFC8439_AEAD_64BYTES_ENCRYPT_DECRYPT(benchmark::Bench& bench)
57+
{
58+
RFC8439_AEAD(bench, PLAINTEXT_SIZE_TINY, true);
59+
}
60+
61+
static void RFC8439_AEAD_256BYTES_ENCRYPT_DECRYPT(benchmark::Bench& bench)
62+
{
63+
RFC8439_AEAD(bench, PLAINTEXT_SIZE_SMALL, true);
64+
}
65+
66+
static void RFC8439_AEAD_1MB_ENCRYPT_DECRYPT(benchmark::Bench& bench)
67+
{
68+
RFC8439_AEAD(bench, PLAINTEXT_SIZE_LARGE, true);
69+
}
70+
71+
BENCHMARK(RFC8439_AEAD_64BYTES_ONLY_ENCRYPT, benchmark::PriorityLevel::HIGH);
72+
BENCHMARK(RFC8439_AEAD_256BYTES_ONLY_ENCRYPT, benchmark::PriorityLevel::HIGH);
73+
BENCHMARK(RFC8439_AEAD_1MB_ONLY_ENCRYPT, benchmark::PriorityLevel::HIGH);
74+
BENCHMARK(RFC8439_AEAD_64BYTES_ENCRYPT_DECRYPT, benchmark::PriorityLevel::HIGH);
75+
BENCHMARK(RFC8439_AEAD_256BYTES_ENCRYPT_DECRYPT, benchmark::PriorityLevel::HIGH);
76+
BENCHMARK(RFC8439_AEAD_1MB_ENCRYPT_DECRYPT, benchmark::PriorityLevel::HIGH);

‎src/crypto/rfc8439.cpp

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
// Copyright (c) 2021 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <crypto/rfc8439.h>
6+
7+
#include <crypto/chacha20.h>
8+
#include <crypto/common.h>
9+
10+
#include <cstring>
11+
12+
#ifndef RFC8439_TIMINGSAFE_BCMP
13+
#define RFC8439_TIMINGSAFE_BCMP
14+
15+
int rfc8439_timingsafe_bcmp(const unsigned char* b1, const unsigned char* b2, size_t n)
16+
{
17+
const unsigned char *p1 = b1, *p2 = b2;
18+
int ret = 0;
19+
20+
for (; n > 0; n--)
21+
ret |= *p1++ ^ *p2++;
22+
return (ret != 0);
23+
}
24+
25+
#endif // RFC8439_TIMINGSAFE_BCMP
26+
27+
inline size_t padded16_size(size_t len)
28+
{
29+
return (len % 16 == 0) ? len : (len / 16 + 1) * 16;
30+
}
31+
32+
void ComputeRFC8439Tag(const std::array<std::byte, POLY1305_KEYLEN>& polykey,
33+
Span<const std::byte> aad, Span<const std::byte> ciphertext,
34+
Span<std::byte> tag_out)
35+
{
36+
assert(tag_out.size() == POLY1305_TAGLEN);
37+
std::vector<std::byte> bytes_to_authenticate;
38+
auto padded_aad_size = padded16_size(aad.size());
39+
auto padded_ciphertext_size = padded16_size(ciphertext.size());
40+
bytes_to_authenticate.resize(padded_aad_size + padded_ciphertext_size + 16, std::byte{0x00});
41+
std::copy(aad.begin(), aad.end(), bytes_to_authenticate.begin());
42+
std::copy(ciphertext.begin(), ciphertext.end(), bytes_to_authenticate.begin() + padded_aad_size);
43+
WriteLE64(reinterpret_cast<unsigned char*>(bytes_to_authenticate.data()) + padded_aad_size + padded_ciphertext_size, aad.size());
44+
WriteLE64(reinterpret_cast<unsigned char*>(bytes_to_authenticate.data()) + padded_aad_size + padded_ciphertext_size + 8, ciphertext.size());
45+
46+
poly1305_auth(reinterpret_cast<unsigned char*>(tag_out.data()),
47+
reinterpret_cast<const unsigned char*>(bytes_to_authenticate.data()),
48+
bytes_to_authenticate.size(),
49+
reinterpret_cast<const unsigned char*>(polykey.data()));
50+
}
51+
52+
std::array<std::byte, POLY1305_KEYLEN> GetPoly1305Key(ChaCha20& c20)
53+
{
54+
c20.SeekRFC8439(0);
55+
std::array<std::byte, POLY1305_KEYLEN> polykey;
56+
c20.Keystream(reinterpret_cast<unsigned char*>(polykey.data()), POLY1305_KEYLEN);
57+
return polykey;
58+
}
59+
60+
void RFC8439Crypt(ChaCha20& c20, const Span<const std::byte> in_bytes, Span<std::byte> out_bytes)
61+
{
62+
assert(in_bytes.size() <= out_bytes.size());
63+
c20.SeekRFC8439(1);
64+
c20.Crypt(reinterpret_cast<const unsigned char*>(in_bytes.data()), reinterpret_cast<unsigned char*>(out_bytes.data()), in_bytes.size());
65+
}
66+
67+
void RFC8439Encrypt(const Span<const std::byte> aad, const Span<const std::byte> key, const std::array<std::byte, 12>& nonce, const Span<const std::byte> plaintext, Span<std::byte> output)
68+
{
69+
assert(key.size() == RFC8439_KEYLEN);
70+
assert(output.size() >= plaintext.size() + POLY1305_TAGLEN);
71+
72+
ChaCha20 c20{reinterpret_cast<const unsigned char*>(key.data())};
73+
c20.SetRFC8439Nonce(nonce);
74+
75+
std::array<std::byte, POLY1305_KEYLEN> polykey{GetPoly1305Key(c20)};
76+
77+
RFC8439Crypt(c20, plaintext, output);
78+
ComputeRFC8439Tag(polykey, aad,
79+
{output.data(), plaintext.size()},
80+
{output.data() + plaintext.size(), POLY1305_TAGLEN});
81+
}
82+
83+
bool RFC8439Decrypt(const Span<const std::byte> aad, const Span<const std::byte> key, const std::array<std::byte, 12>& nonce, const Span<const std::byte> input, Span<std::byte> plaintext)
84+
{
85+
assert(key.size() == RFC8439_KEYLEN);
86+
assert(plaintext.size() >= input.size() - POLY1305_TAGLEN);
87+
88+
ChaCha20 c20{reinterpret_cast<const unsigned char*>(key.data())};
89+
c20.SetRFC8439Nonce(nonce);
90+
91+
std::array<std::byte, POLY1305_KEYLEN> polykey{GetPoly1305Key(c20)};
92+
std::array<std::byte, POLY1305_TAGLEN> tag;
93+
94+
ComputeRFC8439Tag(polykey, aad, {input.data(), input.size() - POLY1305_TAGLEN}, tag);
95+
96+
if (rfc8439_timingsafe_bcmp(reinterpret_cast<const unsigned char*>(input.data() + input.size() - POLY1305_TAGLEN),
97+
reinterpret_cast<const unsigned char*>(tag.data()), POLY1305_TAGLEN) != 0) {
98+
return false;
99+
}
100+
101+
RFC8439Crypt(c20, {input.data(), input.size() - POLY1305_TAGLEN}, plaintext);
102+
return true;
103+
}

‎src/crypto/rfc8439.h

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Copyright (c) 2021 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#ifndef BITCOIN_CRYPTO_RFC8439_H
6+
#define BITCOIN_CRYPTO_RFC8439_H
7+
8+
#include <crypto/poly1305.h>
9+
#include <span.h>
10+
11+
#include <array>
12+
#include <cstddef>
13+
#include <vector>
14+
15+
constexpr static size_t RFC8439_KEYLEN = 32;
16+
17+
void RFC8439Encrypt(const Span<const std::byte> aad, const Span<const std::byte> key, const std::array<std::byte, 12>& nonce, const Span<const std::byte> plaintext, Span<std::byte> output);
18+
19+
// returns false if authentication fails
20+
bool RFC8439Decrypt(const Span<const std::byte> aad, const Span<const std::byte> key, const std::array<std::byte, 12>& nonce, const Span<const std::byte> input, Span<std::byte> plaintext);
21+
#endif // BITCOIN_CRYPTO_RFC8439_H

‎src/test/crypto_tests.cpp

+41-1
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,16 @@
88
#include <crypto/hkdf_sha256_32.h>
99
#include <crypto/hmac_sha256.h>
1010
#include <crypto/hmac_sha512.h>
11+
#include <crypto/muhash.h>
1112
#include <crypto/poly1305.h>
13+
#include <crypto/rfc8439.h>
1214
#include <crypto/ripemd160.h>
1315
#include <crypto/sha1.h>
1416
#include <crypto/sha256.h>
1517
#include <crypto/sha3.h>
1618
#include <crypto/sha512.h>
17-
#include <crypto/muhash.h>
1819
#include <random.h>
20+
#include <span.h>
1921
#include <streams.h>
2022
#include <test/util/setup_common.h>
2123
#include <util/strencodings.h>
@@ -1123,4 +1125,42 @@ BOOST_AUTO_TEST_CASE(muhash_tests)
11231125
BOOST_CHECK_EQUAL(HexStr(out4), "3a31e6903aff0de9f62f9a9f7f8b861de76ce2cda09822b90014319ae5dc2271");
11241126
}
11251127

1128+
static void TestRFC8439AEAD(const std::string& hex_aad, const std::string& hex_key, const std::string& hex_nonce, const std::string& hex_plaintext, const std::string& hex_expected_ciphertext, const std::string& hex_expected_auth_tag)
1129+
{
1130+
auto aad = ParseHex(hex_aad);
1131+
auto key = ParseHex(hex_key);
1132+
auto nonce = ParseHex(hex_nonce);
1133+
std::array<std::byte, 12> nonce_arr;
1134+
memcpy(nonce_arr.data(), nonce.data(), 12);
1135+
auto plaintext = ParseHex(hex_plaintext);
1136+
std::vector<std::byte> output(plaintext.size() + POLY1305_TAGLEN, std::byte{0x00});
1137+
RFC8439Encrypt(MakeByteSpan(aad), MakeByteSpan(key), nonce_arr, MakeByteSpan(plaintext), output);
1138+
1139+
BOOST_CHECK_EQUAL(HexStr({output.data(), output.size() - POLY1305_TAGLEN}), hex_expected_ciphertext);
1140+
BOOST_CHECK_EQUAL(HexStr({output.data() + output.size() - POLY1305_TAGLEN, POLY1305_TAGLEN}), hex_expected_auth_tag);
1141+
1142+
std::vector<std::byte> decrypted_plaintext(plaintext.size(), std::byte{0x00});
1143+
auto authenticated = RFC8439Decrypt(MakeByteSpan(aad), MakeByteSpan(key), nonce_arr, output, decrypted_plaintext);
1144+
BOOST_CHECK(authenticated);
1145+
BOOST_CHECK_EQUAL(0, memcmp(decrypted_plaintext.data(), plaintext.data(), plaintext.size()));
1146+
}
1147+
1148+
BOOST_AUTO_TEST_CASE(rfc8439_tests)
1149+
{
1150+
// Test vector from https://datatracker.ietf.org/doc/html/rfc8439#section-2.8.2
1151+
TestRFC8439AEAD("50515253c0c1c2c3c4c5c6c7",
1152+
"808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f",
1153+
"070000004041424344454647",
1154+
"4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73637265656e20776f756c642062652069742e",
1155+
"d31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee62d63dbea45e8ca9671282fafb69da92728b1a71de0a9e060b2905d6a5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fab324e4fad675945585808b4831d7bc3ff4def08e4b7a9de576d26586cec64b6116",
1156+
"1ae10b594f09e26a7e902ecbd0600691");
1157+
1158+
// Test vector from https://datatracker.ietf.org/doc/html/rfc8439#appendix-A.5
1159+
TestRFC8439AEAD("f33388860000000000004e91",
1160+
"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0",
1161+
"000000000102030405060708",
1162+
"496e7465726e65742d4472616674732061726520647261667420646f63756d656e74732076616c696420666f722061206d6178696d756d206f6620736978206d6f6e74687320616e64206d617920626520757064617465642c207265706c616365642c206f72206f62736f6c65746564206279206f7468657220646f63756d656e747320617420616e792074696d652e20497420697320696e617070726f70726961746520746f2075736520496e7465726e65742d447261667473206173207265666572656e6365206d6174657269616c206f7220746f2063697465207468656d206f74686572207468616e206173202fe2809c776f726b20696e2070726f67726573732e2fe2809d",
1163+
"64a0861575861af460f062c79be643bd5e805cfd345cf389f108670ac76c8cb24c6cfc18755d43eea09ee94e382d26b0bdb7b73c321b0100d4f03b7f355894cf332f830e710b97ce98c8a84abd0b948114ad176e008d33bd60f982b1ff37c8559797a06ef4f0ef61c186324e2b3506383606907b6a7c02b0f9f6157b53c867e4b9166c767b804d46a59b5216cde7a4e99040c5a40433225ee282a1b0a06c523eaf4534d7f83fa1155b0047718cbc546a0d072b04b3564eea1b422273f548271a0bb2316053fa76991955ebd63159434ecebb4e466dae5a1073a6727627097a1049e617d91d361094fa68f0ff77987130305beaba2eda04df997b714d6c6f2c29a6ad5cb4022b02709b",
1164+
"eead9d67890cbb22392336fea1851f38");
1165+
}
11261166
BOOST_AUTO_TEST_SUITE_END()

‎src/test/fuzz/crypto_rfc8439.cpp

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright (c) 2022 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <crypto/rfc8439.h>
6+
#include <test/fuzz/FuzzedDataProvider.h>
7+
#include <test/fuzz/fuzz.h>
8+
#include <test/fuzz/util.h>
9+
10+
#include <cstddef>
11+
#include <vector>
12+
13+
FUZZ_TARGET(crypto_rfc8439)
14+
{
15+
FuzzedDataProvider fdp{buffer.data(), buffer.size()};
16+
auto aad_len = fdp.ConsumeIntegralInRange(0, 1023);
17+
auto aad = fdp.ConsumeBytes<std::byte>(aad_len);
18+
aad.resize(aad_len);
19+
20+
auto key = fdp.ConsumeBytes<std::byte>(RFC8439_KEYLEN);
21+
key.resize(RFC8439_KEYLEN);
22+
23+
auto nonce_vec = fdp.ConsumeBytes<std::byte>(12);
24+
nonce_vec.resize(12);
25+
std::array<std::byte, 12> nonce;
26+
memcpy(nonce.data(), nonce_vec.data(), 12);
27+
28+
auto plaintext_len = fdp.ConsumeIntegralInRange(0, 4095);
29+
auto plaintext = fdp.ConsumeBytes<std::byte>(plaintext_len);
30+
plaintext.resize(plaintext_len);
31+
32+
std::vector<std::byte> output(plaintext.size() + POLY1305_TAGLEN, std::byte{0x00});
33+
RFC8439Encrypt(aad, key, nonce, plaintext, output);
34+
35+
auto bit_flip_attack = !plaintext.empty() && fdp.ConsumeBool();
36+
if (bit_flip_attack) {
37+
auto byte_to_flip = fdp.ConsumeIntegralInRange(0, static_cast<int>(output.size() - POLY1305_TAGLEN - 1));
38+
output[byte_to_flip] = output[byte_to_flip] ^ std::byte{0xFF};
39+
}
40+
41+
std::vector<std::byte> decrypted_plaintext(plaintext.size(), std::byte{0x00});
42+
auto authenticated = RFC8439Decrypt(aad, key, nonce, output, decrypted_plaintext);
43+
if (bit_flip_attack) {
44+
assert(!authenticated);
45+
} else {
46+
assert(authenticated);
47+
if (!plaintext.empty()) {
48+
assert(memcmp(decrypted_plaintext.data(), plaintext.data(), plaintext.size()) == 0);
49+
}
50+
}
51+
}

0 commit comments

Comments
 (0)