|
| 1 | +// Copyright (c) 2019-2021 The Bitcoin Core developers |
| 2 | +// Distributed under the MIT software license, see the accompanying |
| 3 | +// file COPYING or http://www.opensource.org/licenses/mit-license.php. |
| 4 | + |
| 5 | +#include <crypto/bip324_suite.h> |
| 6 | + |
| 7 | +#include <crypto/common.h> |
| 8 | +#include <crypto/poly1305.h> |
| 9 | +#include <crypto/sha256.h> |
| 10 | +#include <span.h> |
| 11 | +#include <support/cleanse.h> |
| 12 | + |
| 13 | +#include <assert.h> |
| 14 | +#include <cstring> |
| 15 | +#include <string.h> |
| 16 | + |
| 17 | +#ifndef HAVE_TIMINGSAFE_BCMP |
| 18 | + |
| 19 | +int timingsafe_bcmp(const unsigned char* b1, const unsigned char* b2, size_t n) |
| 20 | +{ |
| 21 | + const unsigned char *p1 = b1, *p2 = b2; |
| 22 | + int ret = 0; |
| 23 | + |
| 24 | + for (; n > 0; n--) |
| 25 | + ret |= *p1++ ^ *p2++; |
| 26 | + return (ret != 0); |
| 27 | +} |
| 28 | + |
| 29 | +#endif // TIMINGSAFE_BCMP |
| 30 | + |
| 31 | +BIP324CipherSuite::~BIP324CipherSuite() |
| 32 | +{ |
| 33 | + memory_cleanse(payload_key.data(), payload_key.size()); |
| 34 | + memory_cleanse(rekey_salt.data(), rekey_salt.size()); |
| 35 | +} |
| 36 | + |
| 37 | +bool BIP324CipherSuite::Crypt(Span<const std::byte> input, Span<std::byte> output, |
| 38 | + BIP324HeaderFlags& flags, bool encrypt) |
| 39 | +{ |
| 40 | + // check buffer boundaries |
| 41 | + if ( |
| 42 | + // if we encrypt, make sure the destination has the space for the length field, header, ciphertext and MAC |
| 43 | + (encrypt && (output.size() < BIP324_LENGTH_FIELD_LEN + BIP324_HEADER_LEN + input.size() + RFC8439_TAGLEN)) || |
| 44 | + // if we decrypt, make sure the source contains at least the header + mac and the destination has the space for the source - MAC - header |
| 45 | + (!encrypt && (input.size() < BIP324_HEADER_LEN + RFC8439_TAGLEN || output.size() < input.size() - BIP324_HEADER_LEN - RFC8439_TAGLEN))) { |
| 46 | + return false; |
| 47 | + } |
| 48 | + |
| 49 | + if (encrypt) { |
| 50 | + // input is just the payload |
| 51 | + // output will be encrypted length + encrypted (header and payload) + mac tag |
| 52 | + uint32_t ciphertext_len = BIP324_HEADER_LEN + input.size(); |
| 53 | + WriteLE32(reinterpret_cast<unsigned char*>(&ciphertext_len), ciphertext_len); |
| 54 | + |
| 55 | + std::vector<std::byte> input_vec; |
| 56 | + input_vec.resize(BIP324_HEADER_LEN + input.size()); |
| 57 | + |
| 58 | + // TODO: this can be optimized by changing the RFC8439Encrypt interface to accept a list of inputs. |
| 59 | + // But, at the moment, there's a potential bug in out ChaCha20 implementation for plaintexts that |
| 60 | + // are not a multiple of 64 bytes -- the rest of the "block" is discarded. An update is in progress |
| 61 | + // which will help here. |
| 62 | + memcpy(input_vec.data(), &flags, BIP324_HEADER_LEN); |
| 63 | + if (!input.empty()) { |
| 64 | + memcpy(input_vec.data() + BIP324_HEADER_LEN, input.data(), input.size()); |
| 65 | + } |
| 66 | + |
| 67 | + auto encrypted = RFC8439Encrypt({}, payload_key, nonce, input_vec); |
| 68 | + |
| 69 | + auto write_pos = output.data(); |
| 70 | + fsc20.Crypt({reinterpret_cast<std::byte*>(&ciphertext_len), BIP324_LENGTH_FIELD_LEN}, |
| 71 | + {write_pos, BIP324_LENGTH_FIELD_LEN}); |
| 72 | + write_pos += BIP324_LENGTH_FIELD_LEN; |
| 73 | + memcpy(write_pos, encrypted.ciphertext.data(), encrypted.ciphertext.size()); |
| 74 | + write_pos += encrypted.ciphertext.size(); |
| 75 | + memcpy(write_pos, encrypted.tag.data(), encrypted.tag.size()); |
| 76 | + write_pos += encrypted.tag.size(); |
| 77 | + } else { |
| 78 | + // we must use BIP324CipherSuite::DecryptLength before calling BIP324CipherSuite::Crypt |
| 79 | + // input is encrypted (header + payload) and the mac tag |
| 80 | + // decrypted header will be put in flags and output will be payload. |
| 81 | + auto ciphertext_size = input.size() - RFC8439_TAGLEN; |
| 82 | + RFC8439Encrypted encrypted; |
| 83 | + encrypted.ciphertext.resize(ciphertext_size); |
| 84 | + memcpy(encrypted.ciphertext.data(), input.data(), ciphertext_size); |
| 85 | + memcpy(encrypted.tag.data(), input.data() + ciphertext_size, RFC8439_TAGLEN); |
| 86 | + auto decrypted = RFC8439Decrypt({}, payload_key, nonce, encrypted); |
| 87 | + if (!decrypted.success) { |
| 88 | + return false; |
| 89 | + } |
| 90 | + |
| 91 | + memcpy(&flags, decrypted.plaintext.data(), BIP324_HEADER_LEN); |
| 92 | + if (!output.empty()) { |
| 93 | + memcpy(output.data(), decrypted.plaintext.data() + BIP324_HEADER_LEN, ciphertext_size - BIP324_HEADER_LEN); |
| 94 | + } |
| 95 | + } |
| 96 | + |
| 97 | + msg_ctr++; |
| 98 | + if (msg_ctr == REKEY_INTERVAL) { |
| 99 | + unsigned char new_key[CSHA256::OUTPUT_SIZE]; |
| 100 | + assert(CSHA256::OUTPUT_SIZE == BIP324_KEY_LEN); |
| 101 | + auto hasher = CSHA256().Write(UCharCast(rekey_salt.data()), rekey_salt.size()); |
| 102 | + hasher.Write(UCharCast(payload_key.data()), payload_key.size()).Finalize(new_key); |
| 103 | + memcpy(payload_key.data(), new_key, BIP324_KEY_LEN); |
| 104 | + rekey_ctr++; |
| 105 | + msg_ctr = 0; |
| 106 | + } |
| 107 | + set_nonce(); |
| 108 | + return true; |
| 109 | +} |
| 110 | + |
| 111 | +uint32_t BIP324CipherSuite::DecryptLength(const std::array<std::byte, BIP324_LENGTH_FIELD_LEN>& ciphertext) |
| 112 | +{ |
| 113 | + std::array<uint8_t, BIP324_LENGTH_FIELD_LEN> length_buffer; |
| 114 | + fsc20.Crypt(ciphertext, MakeWritableByteSpan(length_buffer)); |
| 115 | + |
| 116 | + return (uint32_t{length_buffer[0]}) | |
| 117 | + (uint32_t{length_buffer[1]} << 8) | |
| 118 | + (uint32_t{length_buffer[2]} << 16); |
| 119 | +} |
0 commit comments