~/jendhub

aes_modes.bend

bend-osdev-cipher-modes@0.1.0.0 · 73 lines · 9 definitions

1# The modes with AES as the cipher: the named defaults. Each takes the raw key
2# as Octets and picks AES-128 or AES-256 by its length (XTS: the two keys
3# joined, 32 or 64 bytes), so a wrong length answers CmBadKeyLength. To
4# expand a key once and use it many times, call CmAes.key (aes.bend; and
5# CmAes.prepare before decrypting) and the generic mode with ~X.CmAesKey,
6# ~X.CmAes.encrypt, ~X.CmAes.decrypt.
7import Base
8import bend-osdev-bytes@0.1.0.0/bytes.bend as B
9import bend-osdev-cipher-modes@0.1.0.0/cipher_modes.bend as M
10import bend-osdev-cipher-modes@0.1.0.0/aes.bend as X
11import bend-osdev-cipher-modes@0.1.0.0/cbc.bend as C
12import bend-osdev-cipher-modes@0.1.0.0/xts.bend as T
13import bend-osdev-cipher-modes@0.1.0.0/ccm.bend as CC
14import bend-osdev-cipher-modes@0.1.0.0/cmac.bend as CM
15
16def CmAes.cbc_encrypt(key: B.Octets, iv: B.Octets, m: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
17  do Result<&2, &2, M.CmError, B.Octets>:
18    k : X.CmAesKey <- X.CmAes.key(key)
19    C.Cbc.encrypt(~X.CmAesKey, ~X.CmAes.encrypt, k, iv, m)
20
21def CmAes.cbc_decrypt(key: B.Octets, iv: B.Octets, c: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
22  do Result<&2, &2, M.CmError, B.Octets>:
23    k : X.CmAesKey <- X.CmAes.key(key)
24    C.Cbc.decrypt(~X.CmAesKey, ~X.CmAes.decrypt, X.CmAes.prepare(k), iv, c)
25
26def CmAes.cbc_encrypt_padded(key: B.Octets, iv: B.Octets, m: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
27  do Result<&2, &2, M.CmError, B.Octets>:
28    k : X.CmAesKey <- X.CmAes.key(key)
29    C.Cbc.encrypt_padded(~X.CmAesKey, ~X.CmAes.encrypt, k, iv, m)
30
31def CmAes.cbc_decrypt_padded(key: B.Octets, iv: B.Octets, c: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
32  do Result<&2, &2, M.CmError, B.Octets>:
33    k : X.CmAesKey <- X.CmAes.key(key)
34    C.Cbc.decrypt_padded(~X.CmAesKey, ~X.CmAes.decrypt, X.CmAes.prepare(k), iv, c)
35
36# XTS-AES-128 (a 32-byte key) or XTS-AES-256 (64 bytes): Key1 (data) then
37# Key2 (tweak), as IEEE 1619 writes them
38
39# the data unit p with 16-byte sequence number i (Xts.sector(n) for sector n)
40def CmAes.xts_encrypt(+key: B.Octets, i: B.Octets, p: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
41  +n = B.Octets.len(key)
42  +h = Nat.div(n, 2n)
43  do Result<&2, &2, M.CmError, B.Octets>:
44    M.cm.check(Bool.or(Nat.is_eq(n, 32n), Nat.is_eq(n, 64n)), M.CmBadKeyLength{n})
45    k1 : X.CmAesKey <- X.CmAes.key(B.Octets.take(h, key))
46    k2 : X.CmAesKey <- X.CmAes.key(B.Octets.drop(h, key))
47    T.Xts.encrypt(~X.CmAesKey, ~X.CmAes.encrypt, k1, k2, i, p)
48
49def CmAes.xts_decrypt(+key: B.Octets, i: B.Octets, c: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
50  +n = B.Octets.len(key)
51  +h = Nat.div(n, 2n)
52  do Result<&2, &2, M.CmError, B.Octets>:
53    M.cm.check(Bool.or(Nat.is_eq(n, 32n), Nat.is_eq(n, 64n)), M.CmBadKeyLength{n})
54    k1 : X.CmAesKey <- X.CmAes.key(B.Octets.take(h, key))
55    k2 : X.CmAesKey <- X.CmAes.key(B.Octets.drop(h, key))
56    T.Xts.decrypt(~X.CmAesKey, ~X.CmAes.encrypt, ~X.CmAes.decrypt, X.CmAes.prepare(k1), k2, i, c)
57
58# CCM with an m-byte tag: the ciphertext, then the tag
59def CmAes.ccm_encrypt(key: B.Octets, +m: Nat, nonce: B.Octets, aad: B.Octets, p: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
60  do Result<&2, &2, M.CmError, B.Octets>:
61    k : X.CmAesKey <- X.CmAes.key(key)
62    CC.Ccm.encrypt(~X.CmAesKey, ~X.CmAes.encrypt, k, m, nonce, aad, p)
63
64def CmAes.ccm_decrypt(key: B.Octets, +m: Nat, nonce: B.Octets, aad: B.Octets, c: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
65  do Result<&2, &2, M.CmError, B.Octets>:
66    k : X.CmAesKey <- X.CmAes.key(key)
67    CC.Ccm.decrypt(~X.CmAesKey, ~X.CmAes.encrypt, k, m, nonce, aad, c)
68
69# AES-CMAC (RFC 4493 with a 16-byte key): the 16-byte MAC
70def CmAes.cmac(key: B.Octets, m: B.Octets) -> Result<&2, &2, M.CmError, B.Octets>:
71  do Result<&2, &2, M.CmError, B.Octets>:
72    k : X.CmAesKey <- X.CmAes.key(key)
73    return CM.Cmac.mac(~X.CmAesKey, ~X.CmAes.encrypt, k, m)