randombit/botan | Build 29673219783 | source/src/lib/modes/cbc/cbc.cpp | Coveralls

20

CBC_Mode::CBC_Mode(std::unique_ptr<BlockCipher> cipher, std::unique_ptr<BlockCipherModePaddingMethod> padding) :

3,396✔

21

      m_cipher(std::move(cipher)), m_padding(std::move(padding)), m_block_size(m_cipher->block_size()) {

3,396✔

22

   if(m_padding && !m_padding->valid_blocksize(m_block_size)) {

3,396✔

25

3,396✔

27

void CBC_Mode::clear() {

660✔

28

   m_cipher->clear();

660✔

29

   reset();

660✔

30

660✔

32

void CBC_Mode::reset() {

1,976✔

33

   m_state.clear();

989✔

34

989✔

36

std::string CBC_Mode::name() const {

1,402✔

37

   if(m_padding) {

1,402✔

38

      return fmt("{}/CBC/{}", cipher().name(), padding().name());

1,210✔

40

      return fmt("{}/CBC/CTS", cipher().name());

192✔

44

size_t CBC_Mode::update_granularity() const {

2,308✔

45

   return cipher().block_size();

4,616✔

48

size_t CBC_Mode::ideal_granularity() const {

3,412✔

49

   return cipher().parallel_bytes();

3,412✔

52

Key_Length_Specification CBC_Mode::key_spec() const {

7,204✔

53

   return cipher().key_spec();

7,204✔

56

size_t CBC_Mode::default_nonce_length() const {

1,666✔

57

   return block_size();

1,666✔

60

bool CBC_Mode::valid_nonce_length(size_t n) const {

10,174✔

61

   return (n == 0 || n == block_size());

10,174✔

64

bool CBC_Mode::has_keying_material() const {

1,974✔

65

   return m_cipher->has_keying_material();

1,974✔

68

void CBC_Mode::key_schedule(std::span<const uint8_t> key) {

5,105✔

69

   m_cipher->set_key(key);

5,105✔

70

   m_state.clear();

5,105✔

71

5,105✔

73

void CBC_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {

9,968✔

74

   if(!valid_nonce_length(nonce_len)) {

9,968✔

75

      throw Invalid_IV_Length(name(), nonce_len);

1,316✔

83

   if(nonce_len > 0) {

9,310✔

84

      m_state.assign(nonce, nonce + nonce_len);

9,290✔

85

   } else if(m_state.empty()) {

20✔

86

      m_state.resize(m_cipher->block_size());

14✔

89

9,310✔

91

size_t CBC_Encryption::minimum_final_size() const {

284✔

92

   return 0;

284✔

95

size_t CBC_Encryption::output_length(size_t input_length) const {

586✔

96

   return padding().output_length(input_length, block_size());

586✔

99

size_t CBC_Encryption::process_msg(uint8_t buf[], size_t sz) {

7,101✔

100

   BOTAN_STATE_CHECK(state().empty() == false);

7,101✔

101

   const size_t BS = block_size();

5,785✔

103

   BOTAN_ARG_CHECK(sz % BS == 0, "CBC input is not full blocks");

5,785✔

104

   const size_t blocks = sz / BS;

5,785✔

106

   if(blocks > 0) {

5,785✔

107

      xor_buf(&buf[0], state_ptr(), BS);

5,571✔

108

      cipher().encrypt(&buf[0]);

5,571✔

110

      for(size_t i = 1; i != blocks; ++i) {

182,351✔

111

         xor_buf(&buf[BS * i], &buf[BS * (i - 1)], BS);

176,780✔

112

         cipher().encrypt(&buf[BS * i]);

176,780✔

115

      state().assign(&buf[BS * (blocks - 1)], &buf[BS * blocks]);

5,571✔

118

   return sz;

5,785✔

121

void CBC_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {

3,331✔

122

   BOTAN_STATE_CHECK(state().empty() == false);

3,331✔

123

   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");

2,207✔

125

   const size_t BS = block_size();

2,207✔

127

   const size_t output_bytes =

2,207✔

128

      add_or_throw(offset, padding().output_length(buffer.size() - offset, BS), "CBC input too large");

2,207✔

129

   const size_t bytes_in_final_block = (buffer.size() - offset) % BS;

2,207✔

130

   buffer.resize(output_bytes);

2,207✔

131

   padding().add_padding(std::span(buffer).subspan(offset), bytes_in_final_block, BS);

2,207✔

135

   BOTAN_ARG_CHECK(buffer.size() % BS == offset % BS, "CBC input is not full blocks (NoPadding)");

2,207✔

137

   update(buffer, offset);

2,207✔

138

2,207✔

140

bool CTS_Encryption::valid_nonce_length(size_t n) const {

559✔

141

   return (n == block_size());

559✔

144

size_t CTS_Encryption::minimum_final_size() const {

48✔

145

   return block_size() + 1;

48✔

148

size_t CTS_Encryption::output_length(size_t input_length) const {

48✔

149

   return input_length;  // no ciphertext expansion in CTS

48✔

152

void CTS_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {

463✔

153

   BOTAN_STATE_CHECK(state().empty() == false);

463✔

154

   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");

271✔

155

   uint8_t* buf = buffer.data() + offset;

271✔

156

   const size_t sz = buffer.size() - offset;

271✔

158

   const size_t BS = block_size();

271✔

160

   if(sz < BS + 1) {

271✔

164

   if(sz % BS == 0) {

271✔

165

      update(buffer, offset);

44✔

168

      for(size_t i = 0; i != BS; ++i) {

524✔

169

         std::swap(buffer[buffer.size() - BS + i], buffer[buffer.size() - 2 * BS + i]);

480✔

172

      const size_t full_blocks = ((sz / BS) - 1) * BS;

227✔

173

      const size_t final_bytes = sz - full_blocks;

227✔

174

      BOTAN_ASSERT(final_bytes > BS && final_bytes < 2 * BS, "Left over size in expected range");

227✔

176

      secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);

227✔

177

      buffer.resize(full_blocks + offset);

227✔

178

      update(buffer, offset);

227✔

180

      xor_buf(last.data(), state_ptr(), BS);

227✔

181

      cipher().encrypt(last.data());

227✔

183

      for(size_t i = 0; i != final_bytes - BS; ++i) {

1,195✔

184

         last[i] ^= last[i + BS];

968✔

185

         last[i + BS] ^= last[i];

968✔

188

      cipher().encrypt(last.data());

227✔

190

      buffer += last;

227✔

191

227✔

192

271✔

194

size_t CBC_Decryption::output_length(size_t input_length) const {

390✔

195

   return input_length;  // precise for CTS, worst case otherwise

390✔

198

size_t CBC_Decryption::minimum_final_size() const {

285✔

199

   return block_size();

285✔

202

size_t CBC_Decryption::process_msg(uint8_t buf[], size_t sz) {

7,320✔

203

   BOTAN_STATE_CHECK(state().empty() == false);

7,320✔

205

   const size_t BS = block_size();

6,004✔

207

   BOTAN_ARG_CHECK(sz % BS == 0, "Input is not full blocks");

6,004✔

208

   size_t blocks = sz / BS;

6,004✔

210

   while(blocks > 0) {

15,555✔

211

      const size_t to_proc = std::min(BS * blocks, m_tempbuf.size());

9,551✔

213

      cipher().decrypt_n(buf, m_tempbuf.data(), to_proc / BS);

9,551✔

215

      xor_buf(m_tempbuf.data(), state_ptr(), BS);

9,551✔

216

      xor_buf(&m_tempbuf[BS], buf, to_proc - BS);

9,551✔

217

      copy_mem(state_ptr(), buf + (to_proc - BS), BS);

9,551✔

219

      copy_mem(buf, m_tempbuf.data(), to_proc);

9,551✔

221

      buf += to_proc;

9,551✔

222

      blocks -= to_proc / BS;

9,551✔

225

   return sz;

6,004✔

228

void CBC_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {

3,317✔

229

   BOTAN_STATE_CHECK(state().empty() == false);

3,317✔

230

   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");

2,193✔

231

   const size_t sz = buffer.size() - offset;

2,193✔

233

   const size_t BS = block_size();

2,193✔

235

   if(sz == 0 || sz % BS != 0) {

2,193✔

239

   update(buffer, offset);

2,193✔

241

   const size_t pad_bytes = BS - padding().unpad(std::span{buffer}.last(BS));

2,193✔

242

   buffer.resize(buffer.size() - pad_bytes);  // remove padding

2,193✔

243

   if(pad_bytes == 0 && padding().name() != "NoPadding") {

2,315✔

244

      clear_mem(std::span{buffer}.subspan(offset));

1✔

245

      throw Decoding_Error("Invalid CBC padding");

1✔

247

2,192✔

249

void CBC_Decryption::reset() {

987✔

250

   CBC_Mode::reset();

578,934✔

251

   zeroise(m_tempbuf);

987✔

252

987✔

254

bool CTS_Decryption::valid_nonce_length(size_t n) const {

559✔

255

   return (n == block_size());

559✔

258

size_t CTS_Decryption::minimum_final_size() const {

48✔

259

   return block_size() + 1;

48✔

262

void CTS_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {

463✔

263

   BOTAN_STATE_CHECK(state().empty() == false);

463✔

264

   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");

271✔

265

   const size_t sz = buffer.size() - offset;

271✔

266

   uint8_t* buf = buffer.data() + offset;

271✔

268

   const size_t BS = block_size();

271✔

270

   if(sz < BS + 1) {

271✔

274

   if(sz % BS == 0) {

271✔

277

      for(size_t i = 0; i != BS; ++i) {

524✔

278

         std::swap(buffer[buffer.size() - BS + i], buffer[buffer.size() - 2 * BS + i]);

480✔

281

      update(buffer, offset);

44✔

283

      const size_t full_blocks = ((sz / BS) - 1) * BS;

227✔

284

      const size_t final_bytes = sz - full_blocks;

227✔

285

      BOTAN_ASSERT(final_bytes > BS && final_bytes < 2 * BS, "Left over size in expected range");

227✔

287

      secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);

227✔

288

      buffer.resize(full_blocks + offset);

227✔

289

      update(buffer, offset);

227✔

291

      cipher().decrypt(last.data());

227✔

293

      xor_buf(last.data(), &last[BS], final_bytes - BS);

227✔

295

      for(size_t i = 0; i != final_bytes - BS; ++i) {

1,195✔

296

         std::swap(last[i], last[i + BS]);

968✔

299

      cipher().decrypt(last.data());

227✔

300

      xor_buf(last.data(), state_ptr(), BS);

227✔

302

      buffer += last;

227✔

303

227✔

304

271✔

randombit / botan / 29673219783

Source File
Press 'n' to go to next uncovered line, 'b' for previous

1	/*
2	* CBC Mode
3	* (C) 1999-2007,2013,2017 Jack Lloyd
4	* (C) 2016 Daniel Neus, Rohde & Schwarz Cybersecurity
5	* (C) 2018 Ribose Inc
6	*
7	* Botan is released under the Simplified BSD License (see license.txt)
8	*/
9
10	#include <botan/internal/cbc.h>
11
12	#include <botan/exceptn.h>
13	#include <botan/mem_ops.h>
14	#include <botan/internal/fmt.h>
15	#include <botan/internal/int_utils.h>
16	#include <botan/internal/mode_pad.h>
17
18	namespace Botan {
19
20	CBC_Mode::CBC_Mode(std::unique_ptr<BlockCipher> cipher, std::unique_ptr<BlockCipherModePaddingMethod> padding) :	3,396✔
21	m_cipher(std::move(cipher)), m_padding(std::move(padding)), m_block_size(m_cipher->block_size()) {	3,396✔
22	if(m_padding && !m_padding->valid_blocksize(m_block_size)) {	3,396✔
23	throw Invalid_Argument(fmt("Padding {} cannot be used with {} in CBC mode", m_padding->name(), m_cipher->name()));	×
24	}
25	}	3,396✔
26
27	void CBC_Mode::clear() {	660✔
28	m_cipher->clear();	660✔
29	reset();	660✔
30	}	660✔
31
32	void CBC_Mode::reset() {	1,976✔
33	m_state.clear();	989✔
34	}	989✔
35
36	std::string CBC_Mode::name() const {	1,402✔
37	if(m_padding) {	1,402✔
38	return fmt("{}/CBC/{}", cipher().name(), padding().name());	1,210✔
39	} else {
40	return fmt("{}/CBC/CTS", cipher().name());	192✔
41	}
42	}
43
44	size_t CBC_Mode::update_granularity() const {	2,308✔
45	return cipher().block_size();	4,616✔
46	}
47
48	size_t CBC_Mode::ideal_granularity() const {	3,412✔
49	return cipher().parallel_bytes();	3,412✔
50	}
51
52	Key_Length_Specification CBC_Mode::key_spec() const {	7,204✔
53	return cipher().key_spec();	7,204✔
54	}
55
56	size_t CBC_Mode::default_nonce_length() const {	1,666✔
57	return block_size();	1,666✔
58	}
59
60	bool CBC_Mode::valid_nonce_length(size_t n) const {	10,174✔
61	return (n == 0 \|\| n == block_size());	10,174✔
62	}
63
64	bool CBC_Mode::has_keying_material() const {	1,974✔
65	return m_cipher->has_keying_material();	1,974✔
66	}
67
68	void CBC_Mode::key_schedule(std::span<const uint8_t> key) {	5,105✔
69	m_cipher->set_key(key);	5,105✔
70	m_state.clear();	5,105✔
71	}	5,105✔
72
73	void CBC_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {	9,968✔
74	if(!valid_nonce_length(nonce_len)) {	9,968✔
75	throw Invalid_IV_Length(name(), nonce_len);	1,316✔
76	}
77
78	/*
79	* A nonce of zero length means carry the last ciphertext value over
80	* as the new IV, as unfortunately some protocols require this. If
81	* this is the first message then we use an IV of all zeros.
82	*/
83	if(nonce_len > 0) {	9,310✔
84	m_state.assign(nonce, nonce + nonce_len);	9,290✔
85	} else if(m_state.empty()) {	20✔
86	m_state.resize(m_cipher->block_size());	14✔
87	}
88	// else leave the state alone
89	}	9,310✔
90
91	size_t CBC_Encryption::minimum_final_size() const {	284✔
92	return 0;	284✔
93	}
94
95	size_t CBC_Encryption::output_length(size_t input_length) const {	586✔
96	return padding().output_length(input_length, block_size());	586✔
97	}
98
99	size_t CBC_Encryption::process_msg(uint8_t buf[], size_t sz) {	7,101✔
100	BOTAN_STATE_CHECK(state().empty() == false);	7,101✔
101	const size_t BS = block_size();	5,785✔
102
103	BOTAN_ARG_CHECK(sz % BS == 0, "CBC input is not full blocks");	5,785✔
104	const size_t blocks = sz / BS;	5,785✔
105
106	if(blocks > 0) {	5,785✔
107	xor_buf(&buf[0], state_ptr(), BS);	5,571✔
108	cipher().encrypt(&buf[0]);	5,571✔
109
110	for(size_t i = 1; i != blocks; ++i) {	182,351✔
111	xor_buf(&buf[BS * i], &buf[BS * (i - 1)], BS);	176,780✔
112	cipher().encrypt(&buf[BS * i]);	176,780✔
113	}
114
115	state().assign(&buf[BS * (blocks - 1)], &buf[BS * blocks]);	5,571✔
116	}
117
118	return sz;	5,785✔
119	}
120
121	void CBC_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {	3,331✔
122	BOTAN_STATE_CHECK(state().empty() == false);	3,331✔
123	BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");	2,207✔
124
125	const size_t BS = block_size();	2,207✔
126
127	const size_t output_bytes =	2,207✔
128	add_or_throw(offset, padding().output_length(buffer.size() - offset, BS), "CBC input too large");	2,207✔
129	const size_t bytes_in_final_block = (buffer.size() - offset) % BS;	2,207✔
130	buffer.resize(output_bytes);	2,207✔
131	padding().add_padding(std::span(buffer).subspan(offset), bytes_in_final_block, BS);	2,207✔
132
133	// With NoPadding a non-block-multiple input reaches here un-padded; reject it
134	// as an argument error rather than tripping the assertion.
135	BOTAN_ARG_CHECK(buffer.size() % BS == offset % BS, "CBC input is not full blocks (NoPadding)");	2,207✔
136
137	update(buffer, offset);	2,207✔
138	}	2,207✔
139
140	bool CTS_Encryption::valid_nonce_length(size_t n) const {	559✔
141	return (n == block_size());	559✔
142	}
143
144	size_t CTS_Encryption::minimum_final_size() const {	48✔
145	return block_size() + 1;	48✔
146	}
147
148	size_t CTS_Encryption::output_length(size_t input_length) const {	48✔
149	return input_length; // no ciphertext expansion in CTS	48✔
150	}
151
152	void CTS_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {	463✔
153	BOTAN_STATE_CHECK(state().empty() == false);	463✔
154	BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");	271✔
155	uint8_t* buf = buffer.data() + offset;	271✔
156	const size_t sz = buffer.size() - offset;	271✔
157
158	const size_t BS = block_size();	271✔
159
160	if(sz < BS + 1) {	271✔
161	throw Encoding_Error(name() + ": insufficient data to encrypt");	×
162	}
163
164	if(sz % BS == 0) {	271✔
165	update(buffer, offset);	44✔
166
167	// swap last two blocks
168	for(size_t i = 0; i != BS; ++i) {	524✔
169	std::swap(buffer[buffer.size() - BS + i], buffer[buffer.size() - 2 * BS + i]);	480✔
170	}
171	} else {
172	const size_t full_blocks = ((sz / BS) - 1) * BS;	227✔
173	const size_t final_bytes = sz - full_blocks;	227✔
174	BOTAN_ASSERT(final_bytes > BS && final_bytes < 2 * BS, "Left over size in expected range");	227✔
175
176	secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);	227✔
177	buffer.resize(full_blocks + offset);	227✔
178	update(buffer, offset);	227✔
179
180	xor_buf(last.data(), state_ptr(), BS);	227✔
181	cipher().encrypt(last.data());	227✔
182
183	for(size_t i = 0; i != final_bytes - BS; ++i) {	1,195✔
184	last[i] ^= last[i + BS];	968✔
185	last[i + BS] ^= last[i];	968✔
186	}
187
188	cipher().encrypt(last.data());	227✔
189
190	buffer += last;	227✔
191	}	227✔
192	}	271✔
193
194	size_t CBC_Decryption::output_length(size_t input_length) const {	390✔
195	return input_length; // precise for CTS, worst case otherwise	390✔
196	}
197
198	size_t CBC_Decryption::minimum_final_size() const {	285✔
199	return block_size();	285✔
200	}
201
202	size_t CBC_Decryption::process_msg(uint8_t buf[], size_t sz) {	7,320✔
203	BOTAN_STATE_CHECK(state().empty() == false);	7,320✔
204
205	const size_t BS = block_size();	6,004✔
206
207	BOTAN_ARG_CHECK(sz % BS == 0, "Input is not full blocks");	6,004✔
208	size_t blocks = sz / BS;	6,004✔
209
210	while(blocks > 0) {	15,555✔
211	const size_t to_proc = std::min(BS * blocks, m_tempbuf.size());	9,551✔
212
213	cipher().decrypt_n(buf, m_tempbuf.data(), to_proc / BS);	9,551✔
214
215	xor_buf(m_tempbuf.data(), state_ptr(), BS);	9,551✔
216	xor_buf(&m_tempbuf[BS], buf, to_proc - BS);	9,551✔
217	copy_mem(state_ptr(), buf + (to_proc - BS), BS);	9,551✔
218
219	copy_mem(buf, m_tempbuf.data(), to_proc);	9,551✔
220
221	buf += to_proc;	9,551✔
222	blocks -= to_proc / BS;	9,551✔
223	}
224
225	return sz;	6,004✔
226	}
227
228	void CBC_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {	3,317✔
229	BOTAN_STATE_CHECK(state().empty() == false);	3,317✔
230	BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");	2,193✔
231	const size_t sz = buffer.size() - offset;	2,193✔
232
233	const size_t BS = block_size();	2,193✔
234
235	if(sz == 0 \|\| sz % BS != 0) {	2,193✔
236	throw Decoding_Error(name() + ": Ciphertext not a multiple of block size");	×
237	}
238
239	update(buffer, offset);	2,193✔
240
241	const size_t pad_bytes = BS - padding().unpad(std::span{buffer}.last(BS));	2,193✔
242	buffer.resize(buffer.size() - pad_bytes); // remove padding	2,193✔
243	if(pad_bytes == 0 && padding().name() != "NoPadding") {	2,315✔
244	clear_mem(std::span{buffer}.subspan(offset));	1✔
245	throw Decoding_Error("Invalid CBC padding");	1✔
246	}
247	}	2,192✔
248
249	void CBC_Decryption::reset() {	987✔
250	CBC_Mode::reset();	578,934✔
251	zeroise(m_tempbuf);	987✔
252	}	987✔
253
254	bool CTS_Decryption::valid_nonce_length(size_t n) const {	559✔
255	return (n == block_size());	559✔
256	}
257
258	size_t CTS_Decryption::minimum_final_size() const {	48✔
259	return block_size() + 1;	48✔
260	}
261
262	void CTS_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {	463✔
263	BOTAN_STATE_CHECK(state().empty() == false);	463✔
264	BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");	271✔
265	const size_t sz = buffer.size() - offset;	271✔
266	uint8_t* buf = buffer.data() + offset;	271✔
267
268	const size_t BS = block_size();	271✔
269
270	if(sz < BS + 1) {	271✔
271	throw Encoding_Error(name() + ": insufficient data to decrypt");	×
272	}
273
274	if(sz % BS == 0) {	271✔
275	// swap last two blocks
276
277	for(size_t i = 0; i != BS; ++i) {	524✔
278	std::swap(buffer[buffer.size() - BS + i], buffer[buffer.size() - 2 * BS + i]);	480✔
279	}
280
281	update(buffer, offset);	44✔
282	} else {
283	const size_t full_blocks = ((sz / BS) - 1) * BS;	227✔
284	const size_t final_bytes = sz - full_blocks;	227✔
285	BOTAN_ASSERT(final_bytes > BS && final_bytes < 2 * BS, "Left over size in expected range");	227✔
286
287	secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);	227✔
288	buffer.resize(full_blocks + offset);	227✔
289	update(buffer, offset);	227✔
290
291	cipher().decrypt(last.data());	227✔
292
293	xor_buf(last.data(), &last[BS], final_bytes - BS);	227✔
294
295	for(size_t i = 0; i != final_bytes - BS; ++i) {	1,195✔
296	std::swap(last[i], last[i + BS]);	968✔
297	}
298
299	cipher().decrypt(last.data());	227✔
300	xor_buf(last.data(), state_ptr(), BS);	227✔
301
302	buffer += last;	227✔
303	}	227✔
304	}	271✔
305
306	} // namespace Botan

randombit / botan / 29673219783

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous