From 12fb79910fd7072571e9de1e5c34353d564bc047 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Wed, 12 Jun 2019 17:34:41 +0200 Subject: Changement de la concaténation des chaînes de bits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit L'implémentation précédente n'était pas cohérente. Étant données deux chaînes X et Y de longueur x et y, et Z=X∥Y de longueur z=x+y, - pad10* et la construction des tweaks fonctionnaient selon la logique "indices faibles = LSB", donc Z[0] = Y[0] Z[z-1] = X[x-1] - le découpage de M, C et A en blocs fonctionnait selon la logique "indices faibles = premiers blocs", donc Z[0] = X[0] Z[z-1] = Y[y-1] En conséquence, la façon dont M, C et A étaient paddés n'avait aucun sens, e.g. pour un message M de taille 35, pad10*(M*) donnait : { M[34], M[33], M[32], 0b10000000, 0, … } Les deux seules façons logiques de padder M* sont { M[32], M[33], M[34], 0b10000000, 0, … } ou { M[2], M[1], M[0], 0b10000000, 0, … } Après revue d'autres implémentations de ΘCB3 et SCT-2, j'ai choisi de suivre la convention MSB. En conséquence, quand la spécification dit Z = X∥Y L'implémentation traduira : Z[] = { X[0], … X[x-1], Y[0], … Y[y-1] } Dans la même logique, les compteurs de blocs seront insérés MSB d'abord et paddés en conséquence, e.g. j=0x01020304 ≡ J[] = { 0, …, 0x01, 0x02, 0x03, 0x04 } --- src/ref/lilliput-ii.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) (limited to 'src/ref/lilliput-ii.c') diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index 6811d49..9ed17a2 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -30,34 +30,34 @@ static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BY { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-1]: tag + block index - * [ 1, s]: tag[1..s] XOR block index - * [s+1, t-1]: tag[s+1..t-1] - * - bit t: 1 + * 1: 1 + * [ 2, t]: tag[ 2, t] XOR block index + * [ 2, t-s]: tag[ 2, t-s] + * [t-s+1, t]: tag[t-s+1, t] XOR block index * - * This function sets bits s+1 to t once and for all. + * This function sets bits 1 to t-s once and for all. */ - memcpy(tweak+sizeof(size_t), tag+sizeof(size_t), TAG_BYTES-sizeof(size_t)); - tweak[TWEAK_BYTES-1] |= 0x80; + memcpy(tweak, tag, TAG_BYTES-sizeof(size_t)); + tweak[0] |= 0x80; } static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES]) { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-1]: tag + block index - * [ 1, s]: tag[1..s] XOR block index - * [s+1, t-1]: tag[s+1..t-1] - * - bit t: 1 + * 1: 1 + * [ 2, t]: tag + block index + * [ 2, t-s]: tag[ 2, t-s] + * [t-s+1, t]: tag[t-s+1, t] XOR block index * - * This function assumes bits s+1 to t have already been set, and - * only sets bits 1 to s. + * This function assumes bits 1 to t-s have already been set, and + * only sets bits t-s+1 to t. */ copy_block_index(block_index, tweak); - for (size_t i=0; i Date: Thu, 27 Jun 2019 16:36:11 +0200 Subject: Réécriture des commentaires schématiques sur les tweaks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/ref/lilliput-ae-utils.h | 13 ++++++++----- src/ref/lilliput-i.c | 28 ++++++++++++++++------------ src/ref/lilliput-ii.c | 30 ++++++++++++++++++------------ 3 files changed, 42 insertions(+), 29 deletions(-) (limited to 'src/ref/lilliput-ii.c') diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index a66b75c..19b4623 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -102,12 +102,15 @@ static inline void fill_index_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, t]: block index - * [ 5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 t + * [ prefix || block index ] + * + * The s-bit block index is encoded as follows: + * + * 5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] */ tweak[0] = prefix<<4; diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index fb06237..3358b10 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -44,13 +44,15 @@ static uint8_t _lower_nibble(uint8_t i) static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: + * + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function sets bits 5 to t-s once and for all. */ @@ -77,13 +79,15 @@ static void _fill_msg_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function assumes bits 5 to t-s have already been set, and * only sets bits 1 to 4 and t-s+1 to t. diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index 9ed17a2..bb43d08 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -28,12 +28,15 @@ This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2. static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag[ 2, t] XOR block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function sets bits 1 to t-s once and for all. */ @@ -44,12 +47,15 @@ static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BY static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag + block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function assumes bits 1 to t-s have already been set, and * only sets bits t-s+1 to t. @@ -67,8 +73,8 @@ static void _fill_tag_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BY { /* The t-bit tweak is filled as follows: * - * [ 1, 8]: 0001||0^4 - * [t-|N|+1, t]: N + * 1 4 5 8 t-|N|+1 t + * [ 0001 || 0^4 || nonce ] */ tweak[0] = 0x10; -- cgit v1.2.3