Source: cbc.js

  1. /** @fileOverview CBC mode implementation
  2.  *
  3.  * @author Emily Stark
  4.  * @author Mike Hamburg
  5.  * @author Dan Boneh
  6.  */
  8. if (sjcl.beware === undefined) {
  9.   sjcl.beware = {};
  10. }
  11. sjcl.beware["CBC mode is dangerous because it doesn't protect message integrity."
  12. ] = function() {
  13.   /**
  14.    * Dangerous: CBC mode with PKCS#5 padding.
  15.    * @namespace
  16.    * @author Emily Stark
  17.    * @author Mike Hamburg
  18.    * @author Dan Boneh
  19.    */
  20.   sjcl.mode.cbc = {
  21.     /** The name of the mode.
  22.      * @constant
  23.      */
  24.     name: "cbc",
  25.     
  26.     /** Encrypt in CBC mode with PKCS#5 padding.
  27.      * @param {Object} prp The block cipher.  It must have a block size of 16 bytes.
  28.      * @param {bitArray} plaintext The plaintext data.
  29.      * @param {bitArray} iv The initialization value.
  30.      * @param {bitArray} [adata=[]] The authenticated data.  Must be empty.
  31.      * @return The encrypted data, an array of bytes.
  32.      * @throws {sjcl.exception.invalid} if the IV isn't exactly 128 bits, or if any adata is specified.
  33.      */
  34.     encrypt: function(prp, plaintext, iv, adata) {
  35.       if (adata && adata.length) {
  36.         throw new sjcl.exception.invalid("cbc can't authenticate data");
  37.       }
  38.       if (sjcl.bitArray.bitLength(iv) !== 128) {
  39.         throw new sjcl.exception.invalid("cbc iv must be 128 bits");
  40.       }
  41.       var i,
  42.           w = sjcl.bitArray,
  43.           xor = w._xor4,
  44.           bl = w.bitLength(plaintext),
  45.           bp = 0,
  46.           output = [];
  48.       if (bl&7) {
  49.         throw new sjcl.exception.invalid("pkcs#5 padding only works for multiples of a byte");
  50.       }
  51.     
  52.       for (i=0; bp+128 <= bl; i+=4, bp+=128) {
  53.         /* Encrypt a non-final block */
  54.         iv = prp.encrypt(xor(iv, plaintext.slice(i,i+4)));
  55.         output.splice(i,0,iv[0],iv[1],iv[2],iv[3]);
  56.       }
  57.       
  58.       /* Construct the pad. */
  59.       bl = (16 - ((bl >> 3) & 15)) * 0x1010101;
  61.       /* Pad and encrypt. */
  62.       iv = prp.encrypt(xor(iv,w.concat(plaintext,[bl,bl,bl,bl]).slice(i,i+4)));
  63.       output.splice(i,0,iv[0],iv[1],iv[2],iv[3]);
  64.       return output;
  65.     },
  66.     
  67.     /** Decrypt in CBC mode.
  68.      * @param {Object} prp The block cipher.  It must have a block size of 16 bytes.
  69.      * @param {bitArray} ciphertext The ciphertext data.
  70.      * @param {bitArray} iv The initialization value.
  71.      * @param {bitArray} [adata=[]] The authenticated data.  It must be empty.
  72.      * @return The decrypted data, an array of bytes.
  73.      * @throws {sjcl.exception.invalid} if the IV isn't exactly 128 bits, or if any adata is specified.
  74.      * @throws {sjcl.exception.corrupt} if if the message is corrupt.
  75.      */
  76.     decrypt: function(prp, ciphertext, iv, adata) {
  77.       if (adata && adata.length) {
  78.         throw new sjcl.exception.invalid("cbc can't authenticate data");
  79.       }
  80.       if (sjcl.bitArray.bitLength(iv) !== 128) {
  81.         throw new sjcl.exception.invalid("cbc iv must be 128 bits");
  82.       }
  83.       if ((sjcl.bitArray.bitLength(ciphertext) & 127) || !ciphertext.length) {
  84.         throw new sjcl.exception.corrupt("cbc ciphertext must be a positive multiple of the block size");
  85.       }
  86.       var i,
  87.           w = sjcl.bitArray,
  88.           xor = w._xor4,
  89.           bi, bo,
  90.           output = [];
  91.           
  92.       adata = adata || [];
  93.     
  94.       for (i=0; i<ciphertext.length; i+=4) {
  95.         bi = ciphertext.slice(i,i+4);
  96.         bo = xor(iv,prp.decrypt(bi));
  97.         output.splice(i,0,bo[0],bo[1],bo[2],bo[3]);
  98.         iv = bi;
  99.       }
  101.       /* check and remove the pad */
  102.       bi = output[i-1] & 255;
  103.       if (bi === 0 || bi > 16) {
  104.         throw new sjcl.exception.corrupt("pkcs#5 padding corrupt");
  105.       }
  106.       bo = bi * 0x1010101;
  107.       if (!w.equal(w.bitSlice([bo,bo,bo,bo], 0, bi*8),
  108.                    w.bitSlice(output, output.length*32 - bi*8, output.length*32))) {
  109.         throw new sjcl.exception.corrupt("pkcs#5 padding corrupt");
  110.       }
  112.       return w.bitSlice(output, 0, output.length*32 - bi*8);
  113.     }
  114.   };
  115. };