bend-osdev-aead

Releases (1)

• 0.1.0.0 indexed

Definitions (226)

aegis128.bend

• def ad.ae.plain
• def ad.ae.check
• def ad.ae.open.go
• def ad.ae.open
• def AdAegis128.openc (the ciphertext with its tag) opened: the plaintext, or CrTagMismatch (no plaintext released)

aesround.bend

• type AdBlkA 16-byte block (open type)
• def AdBlk.zero
• def AdBlk.xor
• def AdBlk.and
• def ad.blk.at
• def ad.blk.word
• def AdBlk.of_listthe block of the first 16 bytes of xs (zeros past the end)
• def AdBlk.to_lista block's 16 bytes
• def AdBlk.of_octets
• def AdBlk.to_octets
• def AdBlk.hex
• def ad.aes.sbox.listBEGIN GENERATED by gen/tables.py: sbox
• type AdTaba table of 2^d words, read by the bits of an index (internal)
• def ad.tab.leaves
• def ad.tab.pairs
• def ad.tab.up
• def ad.tab.root
• def ad.tab.pick
• def ad.tab.get
• type AdSboxThe S-box as a table (opaque)
• def AdAes.sbox
• def ad.aes.s
• def ad.aes.x2x times 2 in GF(2^8) (xtime, FIPS 197 4.2.1)
• def ad.aes.mixMixColumns of one column a0 ..
• def ad.aes.colone column of the round: rows 0 ..
• def AdAes.roundAESRound(a, k)

authenc.bend

• type AdAuthencKeyThe two keys
• def AdAuthenc.input_kernel
• def ad.au.mcgrew
• def AdAuthenc.input_mcgrew
• def ad.au.fitthe first n bytes of xs, zero-padded to n
• def AdAuthenc.tagThe tag of the ciphertext c: the MAC's first tlen bytes (zero-padded)
• def ad.au.sealed
• def ad.au.ke
• def ad.au.seal
• def AdAuthenc.sealp sealed under the IV: C || T
• def ad.au.check
• def ad.au.open.go
• def ad.au.open
• def AdAuthenc.openC || T opened: P, or CrTagMismatch (the cipher is not run), CrTooShort
• def AdAuthenc.key_ofThe key from the two raw keys
• def ad.au.key
• def AdAuthenc.keyThe key from one raw key: the MAC key, then the cipher key of elen bytes (CrBadKeyLength for fewer than elen bytes, or a key either refuses)

check.bend

• def cat
• def err
• def show
• def ad.check.base
• def ad.check.nib
• def ad.check.hex
• def hx
• def bothsealed (or encrypted), then opened back: "<sealed> <opened>"
• def aegis
• def aegis_seal
• def aegis_open
• def au.enc
• def au.dec
• def au.encp
• def au.decp
• def au.mac
• def au.mkey
• def au.key
• def au.seal_kthe kernel's authenc(hmac(sha256), cbc(aes)): A || C authenticated, the whole tag
• def au.open_k
• def au.seal_mRFC 7518's AES_128_CBC_HMAC_SHA_256: A || IV || C || AL, a 16-byte tag
• def au.open_m
• def authenc
• def authenc_open
• def es.key
• def es.enc
• def es.dec
• def essiv
• def ccm.seal
• def ccm.open
• def sq.key
• def seqiv
• def seqiv_open
• def ec.key
• def echainiv
• def echainiv_open
• def main

echainiv.bend

• type AdEchainivKeyThe key: the AEAD's key, the IV cipher's key schedule, and the salt
• def ad.ec.ka
• def ad.ec.e
• def AdEchainiv.ivThe IV of sequence number seq: E(Kc, salt xor seq right-aligned)
• def AdEchainiv.keyThe key from the AEAD's raw key, the IV cipher's raw key and the salt
• def ad.ec.seal
• def AdEchainiv.sealp sealed under the sequence number seq: IV || the AEAD's ciphertext
• def ad.ec.open.go
• def ad.ec.open
• def AdEchainiv.openIV || C opened: the AEAD's open of C under the first ivlen bytes and A || IV, or CrTooShort

essiv.bend

• type AdEssivKeyThe key: the wrapped algorithm's key, and the salt cipher's key schedule
• def ad.es.e
• def ad.es.iv
• def AdEssiv.ivIV' = E(salt, IV) (an IV the salt cipher's format refuses is used as it is)
• def ad.es.kd