CryptoinoCipher.cpp

/*
 * CryptoinoCipher.cpp - This file is part of Cryptoino
 * Copyright (C) 2014 Matthias Kruk
 *
 * Cryptoino is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published
 * by the Free Software Foundation; either version 3, or (at your
 * option) any later version.
 *
 * Cryptoino is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Cryptoino; see the file COPYING.  If not, write to the
 * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
 * Boston, MA 02111-1307, USA.
 */

/* !!! HERE BE DRAGONS !!!
 * 
 * Cryptoino is a library that implements some cryptographic primitives
 * and mechanisms for use with Arduino boards. IT HAS NEVER BEEN AUDITED
 * OR OTHERWISE SCRUTINISED. YOU SHOULD CONSIDER IT UNSAFE AND PRONE TO
 * ANY KIND OF SIDE CHANNEL ATTACKS AND ABSOLUTELY NOT USE IT IN ANY KIND
 * OF ADVERSARIAL ENVIRONMENT. FURTHERMORE, IT HAS NEVER BEEN OPTIMISED
 * FOR PERFORMANCE. USE IT AT YOUR OWN RISK AND FOR TESTING/EDUCATIONAL
 * PURPOSES ONLY! YOU HAVE BEEN WARNED.
 */
 
#include <CryptoinoTwofish.h>
#include <CryptoinoCipher.h>
#include <CryptoinoErrno.h>
#include <string.h>
#include <stdint.h>

Cipher::Cipher(void)
{
	this->destroy();

	return;
}

Cipher::~Cipher(void)
{
	this->ci_context.destroy();
	this->destroy();

	return;
}

int Cipher::init(const uint32_t *key, const uint8_t len)
{
	this->ci_errno = this->ci_context.init(key, len);

	if(this->ci_errno == 0) {
		this->__init = 1;
		return(0);
	}
			
	return(-1);
}

void Cipher::destroy(void)
{
	memset(this->ci_iv, 0, sizeof(this->ci_iv));
	this->ci_ctr = 0;
	this->ci_mode = CIPHER_MODE_NONE;
	this->__init = 0;
	this->ci_errno = 0;
	
	return;
}

int Cipher::setMode(cipher_mode_t mode)
{
	if(mode < CIPHER_MODE_CBC || mode > CIPHER_MODE_CTR) {
		this->ci_errno = CEINVALMODE;
		return(-1);
	}
	
	this->ci_errno = 0;
	this->ci_mode = mode;

	return(0);
}

cipher_mode_t Cipher::getMode(void)
{
	return(this->ci_mode);
}

int Cipher::setIV(const uint32_t *iv, const uint8_t len)
{
	if(len != sizeof(this->ci_iv)) {
		this->ci_errno = CEINVALIVLEN;
		return(-1);
	}
	
	this->ci_errno = 0;
	memcpy(this->ci_iv, iv, len);
	
	return(0);
}

int Cipher::setCounter(const uint32_t ctr)
{
	if(ctr == 0) {
		this->ci_errno = CEINVALCTR;
		return(-1);
	}
	
	this->ci_ctr = ctr;
	this->ci_errno = 0;
	
	return(0);
}

int32_t	Cipher::encrypt(const void *plain, const uint32_t plen, void *ctext, const uint32_t csize)
{
	uint32_t block[TWOFISH_BLOCK_SIZE / sizeof(uint32_t)];
	int32_t clen;

	if(!this->__init) {
		this->ci_errno = CEINVALSTATE;
		return(-1);
	}

	clen = 0;

	switch(this->ci_mode) {
		case CIPHER_MODE_CBC:
			/* *** Cipher Block Chaining (CBC) Mode ***
			 *
			 * The plaintext blocks are XOR'ed with the preceeding ciphertext block (or the IV in
			 * case of the first block) and then encrypted. The caller has to make sure that the
			 * plaintext is padded.
			 */

			/* in CBC mode, we don't accept unpadded plaintexts */
			if(plen & (TWOFISH_BLOCK_SIZE - 1)) {
				clen = -1;
				this->ci_errno = CEINVALPAD;
				break;
			}

			while(clen < plen) {
				memcpy(block, plain+clen, TWOFISH_BLOCK_SIZE);

				/* XOR the plaintext block with the IV or the last block */
				block[0] ^= this->ci_iv[0];
				block[1] ^= this->ci_iv[1];
				block[2] ^= this->ci_iv[2];
				block[3] ^= this->ci_iv[3];

				/* we update the IV first and then write the ciphertext to the output */
				if(this->ci_context.encrypt((const uint32_t*)block, (uint32_t*)&(this->ci_iv)) != 0) {
					clen = -1;
					this->ci_errno = CEINVALSTATE;
					break;
				}
				memcpy(ctext+clen, &(this->ci_iv), TWOFISH_BLOCK_SIZE);

				clen += TWOFISH_BLOCK_SIZE;
			}
			break;
		case CIPHER_MODE_CTR: {
			/* *** Counter (CTR) Mode ***
			 *
			 * The cipher is used to generate a key stream, which is then XOR'ed with
			 * the plaintext. The key stream is generated by encrypting blocks as follows:
			 *
			 * struct ctr_block {
			 * 	uint32_t	i;
			 * 	uint32_t	seq;
			 * 	u64_t	zero;
			 * };
			 *
			 * The seq member is the sequence number of the message, and the i member is
			 * set to the number of the current block (starting at 1) and is incremented
			 * after each block. For each new message, i starts at 1.
			 * The zero member is set to all-zeroes (duh) and serves as padding.
			 */

			struct {
				uint32_t	i;
				uint32_t	seq;
				uint32_t	_zero;
				uint32_t	__zero;
			} __attribute__((packed)) key_block;

			/* The caller (i.e. the secure socket) should make sure that the counter does not
			 * wrap, and reinitialise the connection with a new key, if it does. As the counter
			 * should start at 1 and it'll be zero if it overflows, we'll just assert here that
			 * it isn't zero. Note that we don't exit gracefully because the developer who uses
			 * this API *must* be punished if they just blindly increment the counter */
			if(!this->ci_ctr) {
				clen = -1;
				this->ci_errno = CEINVALCTR;
				break;
			}

			if(csize < plen) {
				clen = -1;
				this->ci_errno = CENOSPC;
				break;
			}

			memset(&key_block, 0, sizeof(key_block));
			key_block.seq = this->ci_ctr;
			key_block.i = 1;

			/* 
			 * We're not checking if i is overflowing because that'd require a message with a
			 * length greater or equal to 2^36. I don't see that happening on this platform
			 */

			while(clen < plen) {
				/* generate TWOFISH_BLOCK_SIZE bytes of key stream */
				if(this->ci_context.encrypt((const uint32_t*)&key_block, (uint32_t*)&block) != 0) {
					clen = -1;
					this->ci_errno = CEINVALSTATE;
					break;
				}

				/* check if we have at least TWOFISH_BLOCK_SIZE bytes left to encrypt */
				if(plen - clen < TWOFISH_BLOCK_SIZE) {
					int remaining;
					uint32_t *cptr;
					uint32_t *kptr;
					uint32_t *pptr;

					remaining = plen - clen;
					cptr = (uint32_t*)(ctext+clen);
					pptr = (uint32_t*)(plain+clen);
					kptr = block;
					clen += remaining;

					while(remaining >= 4) {
						*cptr++ = *pptr++ ^ *kptr++;
						remaining -= 4;
					}
					if(remaining & 2) {
						*((uint16_t*)cptr) = *((uint16_t*)pptr) ^ *((uint16_t*)kptr);
						cptr = (uint32_t*)(((uint8_t*)cptr)+2);
						kptr = (uint32_t*)(((uint8_t*)kptr)+2);
						pptr = (uint32_t*)(((uint8_t*)pptr)+2);
					}
					if(remaining & 1) {
						*((uint8_t*)cptr) = *((uint8_t*)pptr) ^ *((uint8_t*)kptr);
					}
				} else {
					((uint32_t*)(ctext+clen))[0] = ((uint32_t*)(plain+clen))[0] ^ block[0];
					((uint32_t*)(ctext+clen))[1] = ((uint32_t*)(plain+clen))[1] ^ block[1];
					((uint32_t*)(ctext+clen))[2] = ((uint32_t*)(plain+clen))[2] ^ block[2];
					((uint32_t*)(ctext+clen))[3] = ((uint32_t*)(plain+clen))[3] ^ block[3];

					clen += TWOFISH_BLOCK_SIZE;
				}
				key_block.i++;
			}

			/* clean up anything we've left on the stack, just in case */
			memset(&key_block, 0, sizeof(key_block));
			break;
		}
		default:
			clen = -1;
			this->ci_errno = CEINVALMODE;
			break;
	}
	/* 
	 * Don't leave any traces of our stack to the caller - the last ciphertext block
	 * remains as the IV for the next encryption (only with CBC mode, obviously) 
	 */
	memset(&block, 0, sizeof(block));

	/* 
	 * We're deliberately not cleaning up the twofish context, in case it will be used later on. This
	 * makes perfect sense since it is very unlikely that it won't be reused, and it'd cause a lot of overhead
	 * to recompute the key schedule for every single packet that we're going to send out. Still, it leaves more
	 * sensitive information in the memory. However, it reduces the number of times the secret keys are floating
	 * around somewhere on the stack. 
	 */
	if(clen >= 0) {
		this->ci_errno = 0;
	}
	
	return(clen);
}

int32_t Cipher::decrypt(const void *ctext, const uint32_t clen, void *plain, const uint32_t psize)
{
	int32_t plen;

	plen = 0;

	switch(this->ci_mode) {
		case CIPHER_MODE_CBC: {
			uint8_t b[TWOFISH_BLOCK_SIZE];
			
			/* in CBC mode, the length of the ciphertext has to be a multiple of TWOFISH_BLOCK_SIZE */
			if(clen % TWOFISH_BLOCK_SIZE) {
				plen = -1;
				this->ci_errno = CEINVALPAD;
				break;
			}

			/* make sure we have enough space for the plaintext */
			if(psize < clen) {
				plen = -1;
				this->ci_errno = CENOSPC;
				break;
			}

			while(plen < clen) {				
				memcpy(b, ctext+plen, TWOFISH_BLOCK_SIZE);

				if(this->ci_context.decrypt((const uint32_t*)(ctext+plen), (uint32_t*)(plain+plen)) != 0) {
					plen = -1;
					this->ci_errno = CEINVALSTATE;
					break;
				}

				/* XOR the decrypted block with the preceeding block, or with the IV in case of the first block */
				((uint32_t*)(plain+plen))[0] ^= this->ci_iv[0];
				((uint32_t*)(plain+plen))[1] ^= this->ci_iv[1];
				((uint32_t*)(plain+plen))[2] ^= this->ci_iv[2];
				((uint32_t*)(plain+plen))[3] ^= this->ci_iv[3];

				/* update the IV */
				memcpy(this->ci_iv, b, TWOFISH_BLOCK_SIZE);
				
				plen += TWOFISH_BLOCK_SIZE;
			}			
			memset(b, 0, TWOFISH_BLOCK_SIZE);
			break;
		}
			
		case CIPHER_MODE_CTR: {
			struct {
				uint32_t i;
				uint32_t seq;
				uint32_t _zero;
				uint32_t __zero;
			} __attribute__((packed)) key_block;
			uint32_t key_stream[TWOFISH_BLOCK_SIZE / sizeof(uint32_t)];

			/* the caller must make sure that the counter doesn't hit zero */
			if(!this->ci_ctr) {
				plen = -1;
				this->ci_errno = CEINVALCTR;
				break;
			}

			memset(&key_block, 0, sizeof(key_block));
			key_block.i = 1;
			key_block.seq = this->ci_ctr;

			while(plen < clen) {
				if(this->ci_context.encrypt((const uint32_t*)&key_block, (uint32_t*)key_stream) != 0) {
					this->ci_errno = CEINVALSTATE;
					plen = -1;
					break;
				}

				if(clen - plen < TWOFISH_BLOCK_SIZE) {
					uint32_t *pptr;
					uint32_t *cptr;
					uint32_t *kptr;
					int remaining;

					remaining = clen - plen;
					pptr = (uint32_t*)(plain+plen);
					cptr = (uint32_t*)(ctext+plen);
					kptr = key_stream;
					plen += remaining;

					while(remaining >= 4) {
						*pptr++ = *cptr++ ^ *kptr++;
						remaining -= 4;
					}
					if(remaining & 2) {
						*((uint16_t*)pptr) = *((uint16_t*)cptr) ^ *((uint16_t*)kptr);
						pptr = (uint32_t*)(((uint8_t*)pptr)+2);
						cptr = (uint32_t*)(((uint8_t*)cptr)+2);
						kptr = (uint32_t*)(((uint8_t*)kptr)+2);
					}
					if(remaining & 1) {
						*((uint8_t*)pptr) = *((uint8_t*)cptr) ^ *((uint8_t*)kptr);
					}
				} else {
					((uint32_t*)(plain+plen))[0] = ((uint32_t*)(ctext+plen))[0] ^ key_stream[0];
					((uint32_t*)(plain+plen))[1] = ((uint32_t*)(ctext+plen))[1] ^ key_stream[1];
					((uint32_t*)(plain+plen))[2] = ((uint32_t*)(ctext+plen))[2] ^ key_stream[2];
					((uint32_t*)(plain+plen))[3] = ((uint32_t*)(ctext+plen))[3] ^ key_stream[3];

					plen += TWOFISH_BLOCK_SIZE;
				}

				key_block.i++;
			}

			memset(&key_block, 0, sizeof(key_block));
			break;
		}
			
		default:
			this->ci_errno = CEINVALMODE;
			plen = -1;
			break;
	}

	if(plen >= 0) {
		this->ci_errno = 0;
	}

	return(plen);
}

const char* Cipher::strerror(void)
{
	return(strcerror(this->ci_errno));
}