diff --git a/chacha20poly1305/chacha20poly1305_generic.go b/chacha20poly1305/chacha20poly1305_generic.go index 91b3856..fe191d3 100644 --- a/chacha20poly1305/chacha20poly1305_generic.go +++ b/chacha20poly1305/chacha20poly1305_generic.go @@ -12,56 +12,64 @@ import ( "golang.org/x/crypto/poly1305" ) -func roundTo16(n int) int { - return 16 * ((n + 15) / 16) +func writeWithPadding(p *poly1305.MAC, b []byte) { + p.Write(b) + if rem := len(b) % 16; rem != 0 { + var buf [16]byte + padLen := 16 - rem + p.Write(buf[:padLen]) + } +} + +func writeUint64(p *poly1305.MAC, n int) { + var buf [8]byte + binary.LittleEndian.PutUint64(buf[:], uint64(n)) + p.Write(buf[:]) } func (c *chacha20poly1305) sealGeneric(dst, nonce, plaintext, additionalData []byte) []byte { ret, out := sliceForAppend(dst, len(plaintext)+poly1305.TagSize) + ciphertext, tag := out[:len(plaintext)], out[len(plaintext):] if subtle.InexactOverlap(out, plaintext) { panic("chacha20poly1305: invalid buffer overlap") } - var polyKey, discardBuf [32]byte + var polyKey [32]byte s, _ := chacha20.NewUnauthenticatedCipher(c.key[:], nonce) s.XORKeyStream(polyKey[:], polyKey[:]) - s.XORKeyStream(discardBuf[:], discardBuf[:]) // skip the next 32 bytes - s.XORKeyStream(out, plaintext) + s.SetCounter(1) // set the counter to 1, skipping 32 bytes + s.XORKeyStream(ciphertext, plaintext) - polyInput := make([]byte, roundTo16(len(additionalData))+roundTo16(len(plaintext))+8+8) - copy(polyInput, additionalData) - copy(polyInput[roundTo16(len(additionalData)):], out[:len(plaintext)]) - binary.LittleEndian.PutUint64(polyInput[len(polyInput)-16:], uint64(len(additionalData))) - binary.LittleEndian.PutUint64(polyInput[len(polyInput)-8:], uint64(len(plaintext))) - - var tag [poly1305.TagSize]byte - poly1305.Sum(&tag, polyInput, &polyKey) - copy(out[len(plaintext):], tag[:]) + p := poly1305.New(&polyKey) + writeWithPadding(p, additionalData) + writeWithPadding(p, ciphertext) + writeUint64(p, len(additionalData)) + writeUint64(p, len(plaintext)) + p.Sum(tag[:0]) return ret } func (c *chacha20poly1305) openGeneric(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) { - var tag [poly1305.TagSize]byte - copy(tag[:], ciphertext[len(ciphertext)-16:]) + tag := ciphertext[len(ciphertext)-16:] ciphertext = ciphertext[:len(ciphertext)-16] - var polyKey, discardBuf [32]byte + var polyKey [32]byte s, _ := chacha20.NewUnauthenticatedCipher(c.key[:], nonce) s.XORKeyStream(polyKey[:], polyKey[:]) - s.XORKeyStream(discardBuf[:], discardBuf[:]) // skip the next 32 bytes + s.SetCounter(1) // set the counter to 1, skipping 32 bytes - polyInput := make([]byte, roundTo16(len(additionalData))+roundTo16(len(ciphertext))+8+8) - copy(polyInput, additionalData) - copy(polyInput[roundTo16(len(additionalData)):], ciphertext) - binary.LittleEndian.PutUint64(polyInput[len(polyInput)-16:], uint64(len(additionalData))) - binary.LittleEndian.PutUint64(polyInput[len(polyInput)-8:], uint64(len(ciphertext))) + p := poly1305.New(&polyKey) + writeWithPadding(p, additionalData) + writeWithPadding(p, ciphertext) + writeUint64(p, len(additionalData)) + writeUint64(p, len(ciphertext)) ret, out := sliceForAppend(dst, len(ciphertext)) if subtle.InexactOverlap(out, ciphertext) { panic("chacha20poly1305: invalid buffer overlap") } - if !poly1305.Verify(&tag, polyInput, &polyKey) { + if !p.Verify(tag) { for i := range out { out[i] = 0 } diff --git a/poly1305/mac_noasm.go b/poly1305/mac_noasm.go index b0c2cd0..347c8b1 100644 --- a/poly1305/mac_noasm.go +++ b/poly1305/mac_noasm.go @@ -7,5 +7,3 @@ package poly1305 type mac struct{ macGeneric } - -func newMAC(key *[32]byte) mac { return mac{newMACGeneric(key)} } diff --git a/poly1305/poly1305.go b/poly1305/poly1305.go index 066159b..3c75c2a 100644 --- a/poly1305/poly1305.go +++ b/poly1305/poly1305.go @@ -46,10 +46,9 @@ func Verify(mac *[16]byte, m []byte, key *[32]byte) bool { // two different messages with the same key allows an attacker // to forge messages at will. func New(key *[32]byte) *MAC { - return &MAC{ - mac: newMAC(key), - finalized: false, - } + m := &MAC{} + initialize(key, &m.macState) + return m } // MAC is an io.Writer computing an authentication tag @@ -58,7 +57,7 @@ func New(key *[32]byte) *MAC { // MAC cannot be used like common hash.Hash implementations, // because using a poly1305 key twice breaks its security. // Therefore writing data to a running MAC after calling -// Sum causes it to panic. +// Sum or Verify causes it to panic. type MAC struct { mac // platform-dependent implementation @@ -71,10 +70,10 @@ func (h *MAC) Size() int { return TagSize } // Write adds more data to the running message authentication code. // It never returns an error. // -// It must not be called after the first call of Sum. +// It must not be called after the first call of Sum or Verify. func (h *MAC) Write(p []byte) (n int, err error) { if h.finalized { - panic("poly1305: write to MAC after Sum") + panic("poly1305: write to MAC after Sum or Verify") } return h.mac.Write(p) } @@ -87,3 +86,12 @@ func (h *MAC) Sum(b []byte) []byte { h.finalized = true return append(b, mac[:]...) } + +// Verify returns whether the authenticator of all data written to +// the message authentication code matches the expected value. +func (h *MAC) Verify(expected []byte) bool { + var mac [TagSize]byte + h.mac.Sum(&mac) + h.finalized = true + return subtle.ConstantTimeCompare(expected, mac[:]) == 1 +} diff --git a/poly1305/poly1305_test.go b/poly1305/poly1305_test.go index b258eed..721a262 100644 --- a/poly1305/poly1305_test.go +++ b/poly1305/poly1305_test.go @@ -60,6 +60,30 @@ func testSum(t *testing.T, unaligned bool, sumImpl func(tag *[TagSize]byte, msg if tag != v.Tag() { t.Errorf("%d: expected %x, got %x", i, v.Tag(), tag[:]) } + if !Verify(&tag, in, &key) { + t.Errorf("%d: tag didn't verify", i) + } + // If the key is zero, the tag will always be zero, independent of the input. + if len(in) > 0 && key != [32]byte{} { + in[0] ^= 0xff + if Verify(&tag, in, &key) { + t.Errorf("%d: tag verified after altering the input", i) + } + in[0] ^= 0xff + } + // If the input is empty, the tag only depends on the second half of the key. + if len(in) > 0 { + key[0] ^= 0xff + if Verify(&tag, in, &key) { + t.Errorf("%d: tag verified after altering the key", i) + } + key[0] ^= 0xff + } + tag[0] ^= 0xff + if Verify(&tag, in, &key) { + t.Errorf("%d: tag verified after altering the tag", i) + } + tag[0] ^= 0xff } } @@ -150,9 +174,17 @@ func testWrite(t *testing.T, unaligned bool) { t.Errorf("#%d: unexpected Write results: n = %d, err = %v", i, n, err) } h.Sum(out[:0]) - if tag := v.Tag(); out != tag { + tag := v.Tag() + if out != tag { t.Errorf("%d: expected %x, got %x", i, tag[:], out[:]) } + if !h.Verify(tag[:]) { + t.Errorf("%d: Verify failed", i) + } + tag[0] ^= 0xff + if h.Verify(tag[:]) { + t.Errorf("%d: Verify succeeded after modifying the tag", i) + } } } diff --git a/poly1305/sum_amd64.go b/poly1305/sum_amd64.go index 35b9e38..99e5a1d 100644 --- a/poly1305/sum_amd64.go +++ b/poly1305/sum_amd64.go @@ -9,17 +9,6 @@ package poly1305 //go:noescape func update(state *macState, msg []byte) -func sum(out *[16]byte, m []byte, key *[32]byte) { - h := newMAC(key) - h.Write(m) - h.Sum(out) -} - -func newMAC(key *[32]byte) (h mac) { - initialize(key, &h.r, &h.s) - return -} - // mac is a wrapper for macGeneric that redirects calls that would have gone to // updateGeneric to update. // diff --git a/poly1305/sum_generic.go b/poly1305/sum_generic.go index 1187eab..c77ff17 100644 --- a/poly1305/sum_generic.go +++ b/poly1305/sum_generic.go @@ -31,9 +31,10 @@ func sumGeneric(out *[TagSize]byte, msg []byte, key *[32]byte) { h.Sum(out) } -func newMACGeneric(key *[32]byte) (h macGeneric) { - initialize(key, &h.r, &h.s) - return +func newMACGeneric(key *[32]byte) macGeneric { + m := macGeneric{} + initialize(key, &m.macState) + return m } // macState holds numbers in saturated 64-bit little-endian limbs. That is, @@ -97,11 +98,12 @@ const ( rMask1 = 0x0FFFFFFC0FFFFFFC ) -func initialize(key *[32]byte, r, s *[2]uint64) { - r[0] = binary.LittleEndian.Uint64(key[0:8]) & rMask0 - r[1] = binary.LittleEndian.Uint64(key[8:16]) & rMask1 - s[0] = binary.LittleEndian.Uint64(key[16:24]) - s[1] = binary.LittleEndian.Uint64(key[24:32]) +// initialize loads the 256-bit key into the two 128-bit secret values r and s. +func initialize(key *[32]byte, m *macState) { + m.r[0] = binary.LittleEndian.Uint64(key[0:8]) & rMask0 + m.r[1] = binary.LittleEndian.Uint64(key[8:16]) & rMask1 + m.s[0] = binary.LittleEndian.Uint64(key[16:24]) + m.s[1] = binary.LittleEndian.Uint64(key[24:32]) } // uint128 holds a 128-bit number as two 64-bit limbs, for use with the diff --git a/poly1305/sum_noasm.go b/poly1305/sum_noasm.go index 2e3ae34..2b55a29 100644 --- a/poly1305/sum_noasm.go +++ b/poly1305/sum_noasm.go @@ -2,12 +2,17 @@ // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. -// +build s390x,!go1.11 !amd64,!s390x,!ppc64le gccgo purego +// At this point only s390x has an assembly implementation of sum. All other +// platforms have assembly implementations of mac, and just define sum as using +// that through New. Once s390x is ported, this file can be deleted and the body +// of sum moved into Sum. + +// +build !go1.11 !s390x gccgo purego package poly1305 func sum(out *[TagSize]byte, msg []byte, key *[32]byte) { - h := newMAC(key) + h := New(key) h.Write(msg) - h.Sum(out) + h.Sum(out[:0]) } diff --git a/poly1305/sum_ppc64le.go b/poly1305/sum_ppc64le.go index 92597bb..2e7a120 100644 --- a/poly1305/sum_ppc64le.go +++ b/poly1305/sum_ppc64le.go @@ -9,17 +9,6 @@ package poly1305 //go:noescape func update(state *macState, msg []byte) -func sum(out *[16]byte, m []byte, key *[32]byte) { - h := newMAC(key) - h.Write(m) - h.Sum(out) -} - -func newMAC(key *[32]byte) (h mac) { - initialize(key, &h.r, &h.s) - return -} - // mac is a wrapper for macGeneric that redirects calls that would have gone to // updateGeneric to update. //