_ Git - BoarSSL/blob - SSLTLS/RecordDecryptChaPol.cs

   1 /*
   2  * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
   3  *
   4  * Permission is hereby granted, free of charge, to any person obtaining
   5  * a copy of this software and associated documentation files (the
   6  * "Software"), to deal in the Software without restriction, including
   7  * without limitation the rights to use, copy, modify, merge, publish,
   8  * distribute, sublicense, and/or sell copies of the Software, and to
   9  * permit persons to whom the Software is furnished to do so, subject to
  10  * the following conditions:
  11  *
  12  * The above copyright notice and this permission notice shall be
  13  * included in all copies or substantial portions of the Software.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  16  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  17  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  18  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  19  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  20  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  22  * SOFTWARE.
  23  */
  24
  25 using System;
  26 using System.Text;
  27
  28 using Crypto;
  29
  30 namespace SSLTLS {
  31
  32 internal class RecordDecryptChaPol : RecordDecrypt {
  33
  34         Poly1305 pp;
  35         byte[] iv;
  36         byte[] nonce;
  37         byte[] tmp;
  38         byte[] tag;
  39         ulong seq;
  40
  41         internal RecordDecryptChaPol(Poly1305 pp, byte[] iv)
  42         {
  43                 this.pp = pp;
  44                 this.iv = new byte[12];
  45                 Array.Copy(iv, 0, this.iv, 0, 12);
  46                 nonce = new byte[12];
  47                 tmp = new byte[13];
  48                 tag = new byte[16];
  49                 seq = 0;
  50         }
  51
  52         internal override bool CheckLength(int len)
  53         {
  54                 return len >= 16 && len <= (16384 + 16);
  55         }
  56
  57         internal override bool Decrypt(int recordType, int version,
  58                 byte[] data, ref int off, ref int len)
  59         {
  60                 /*
  61                  * Make the "additional data" for the MAC:
  62                  *  -- sequence number (8 bytes, big-endian)
  63                  *  -- header with plaintext length (5 bytes)
  64                  */
  65                 len -= 16;
  66                 IO.Enc64be(seq, tmp, 0);
  67                 IO.WriteHeader(recordType, version, len, tmp, 8);
  68
  69                 /*
  70                  * The ChaCha20+Poly1305 IV consists in the
  71                  * implicit IV (12 bytes), with the sequence number
  72                  * "XORed" in the last 8 bytes (big-endian).
  73                  */
  74                 Array.Copy(iv, 0, nonce, 0, 12);
  75                 for (int i = 0; i < 8; i ++) {
  76                         nonce[i + 4] ^= tmp[i];
  77                 }
  78
  79                 /*
  80                  * Do encryption and compute tag.
  81                  */
  82                 pp.Run(nonce, data, off, len, tmp, 0, 13, tag, false);
  83
  84                 /*
  85                  * Each record has its own sequence number.
  86                  */
  87                 seq ++;
  88
  89                 /*
  90                  * Compare the tag value.
  91                  */
  92                 int z = 0;
  93                 for (int i = 0; i < 16; i ++) {
  94                         z |= tag[i] ^ data[off + len + i];
  95                 }
  96                 return z == 0;
  97         }
  98 }
  99
 100 }