Source: ccm.js

  1. /** @fileOverview CCM mode implementation.
  2.  *
  3.  * Special thanks to Roy Nicholson for pointing out a bug in our
  4.  * implementation.
  5.  *
  6.  * @author Emily Stark
  7.  * @author Mike Hamburg
  8.  * @author Dan Boneh
  9.  */
  11. /**
  12.  * CTR mode with CBC MAC.
  13.  * @namespace
  14.  */
  15. sjcl.mode.ccm = {
  16.   /** The name of the mode.
  17.    * @constant
  18.    */
  19.   name: "ccm",
  20.   
  21.   _progressListeners: [],
  23.   listenProgress: function (cb) {
  24.     sjcl.mode.ccm._progressListeners.push(cb);
  25.   },
  27.   unListenProgress: function (cb) {
  28.     var index = sjcl.mode.ccm._progressListeners.indexOf(cb);
  29.     if (index > -1) {
  30.       sjcl.mode.ccm._progressListeners.splice(index, 1);
  31.     }
  32.   },
  34.   _callProgressListener: function (val) {
  35.     var p = sjcl.mode.ccm._progressListeners.slice(), i;
  37.     for (i = 0; i < p.length; i += 1) {
  38.       p[i](val);
  39.     }
  40.   },
  42.   /** Encrypt in CCM mode.
  43.    * @static
  44.    * @param {Object} prf The pseudorandom function.  It must have a block size of 16 bytes.
  45.    * @param {bitArray} plaintext The plaintext data.
  46.    * @param {bitArray} iv The initialization value.
  47.    * @param {bitArray} [adata=[]] The authenticated data.
  48.    * @param {Number} [tlen=64] the desired tag length, in bits.
  49.    * @return {bitArray} The encrypted data, an array of bytes.
  50.    */
  51.   encrypt: function(prf, plaintext, iv, adata, tlen) {
  52.     var L, out = plaintext.slice(0), tag, w=sjcl.bitArray, ivl = w.bitLength(iv) / 8, ol = w.bitLength(out) / 8;
  53.     tlen = tlen || 64;
  54.     adata = adata || [];
  55.     
  56.     if (ivl < 7) {
  57.       throw new sjcl.exception.invalid("ccm: iv must be at least 7 bytes");
  58.     }
  59.     
  60.     // compute the length of the length
  61.     for (L=2; L<4 && ol >>> 8*L; L++) {}
  62.     if (L < 15 - ivl) { L = 15-ivl; }
  63.     iv = w.clamp(iv,8*(15-L));
  64.     
  65.     // compute the tag
  66.     tag = sjcl.mode.ccm._computeTag(prf, plaintext, iv, adata, tlen, L);
  67.     
  68.     // encrypt
  69.     out = sjcl.mode.ccm._ctrMode(prf, out, iv, tag, tlen, L);
  70.     
  71.     return w.concat(out.data, out.tag);
  72.   },
  73.   
  74.   /** Decrypt in CCM mode.
  75.    * @static
  76.    * @param {Object} prf The pseudorandom function.  It must have a block size of 16 bytes.
  77.    * @param {bitArray} ciphertext The ciphertext data.
  78.    * @param {bitArray} iv The initialization value.
  79.    * @param {bitArray} [adata=[]] adata The authenticated data.
  80.    * @param {Number} [tlen=64] tlen the desired tag length, in bits.
  81.    * @return {bitArray} The decrypted data.
  82.    */
  83.   decrypt: function(prf, ciphertext, iv, adata, tlen) {
  84.     tlen = tlen || 64;
  85.     adata = adata || [];
  86.     var L,
  87.         w=sjcl.bitArray,
  88.         ivl = w.bitLength(iv) / 8,
  89.         ol = w.bitLength(ciphertext), 
  90.         out = w.clamp(ciphertext, ol - tlen),
  91.         tag = w.bitSlice(ciphertext, ol - tlen), tag2;
  92.     
  94.     ol = (ol - tlen) / 8;
  95.         
  96.     if (ivl < 7) {
  97.       throw new sjcl.exception.invalid("ccm: iv must be at least 7 bytes");
  98.     }
  99.     
  100.     // compute the length of the length
  101.     for (L=2; L<4 && ol >>> 8*L; L++) {}
  102.     if (L < 15 - ivl) { L = 15-ivl; }
  103.     iv = w.clamp(iv,8*(15-L));
  104.     
  105.     // decrypt
  106.     out = sjcl.mode.ccm._ctrMode(prf, out, iv, tag, tlen, L);
  107.     
  108.     // check the tag
  109.     tag2 = sjcl.mode.ccm._computeTag(prf, out.data, iv, adata, tlen, L);
  110.     if (!w.equal(out.tag, tag2)) {
  111.       throw new sjcl.exception.corrupt("ccm: tag doesn't match");
  112.     }
  113.     
  114.     return out.data;
  115.   },
  117.   _macAdditionalData: function (prf, adata, iv, tlen, ol, L) {
  118.     var mac, tmp, i, macData = [], w=sjcl.bitArray, xor = w._xor4;
  120.     // mac the flags
  121.     mac = [w.partial(8, (adata.length ? 1<<6 : 0) | (tlen-2) << 2 | L-1)];
  123.     // mac the iv and length
  124.     mac = w.concat(mac, iv);
  125.     mac[3] |= ol;
  126.     mac = prf.encrypt(mac);
  127.   
  128.     if (adata.length) {
  129.       // mac the associated data.  start with its length...
  130.       tmp = w.bitLength(adata)/8;
  131.       if (tmp <= 0xFEFF) {
  132.         macData = [w.partial(16, tmp)];
  133.       } else if (tmp <= 0xFFFFFFFF) {
  134.         macData = w.concat([w.partial(16,0xFFFE)], [tmp]);
  135.       } // else ...
  136.     
  137.       // mac the data itself
  138.       macData = w.concat(macData, adata);
  139.       for (i=0; i<macData.length; i += 4) {
  140.         mac = prf.encrypt(xor(mac, macData.slice(i,i+4).concat([0,0,0])));
  141.       }
  142.     }
  144.     return mac;
  145.   },
  147.   /* Compute the (unencrypted) authentication tag, according to the CCM specification
  148.    * @param {Object} prf The pseudorandom function.
  149.    * @param {bitArray} plaintext The plaintext data.
  150.    * @param {bitArray} iv The initialization value.
  151.    * @param {bitArray} adata The authenticated data.
  152.    * @param {Number} tlen the desired tag length, in bits.
  153.    * @return {bitArray} The tag, but not yet encrypted.
  154.    * @private
  155.    */
  156.   _computeTag: function(prf, plaintext, iv, adata, tlen, L) {
  157.     // compute B[0]
  158.     var mac, i, w=sjcl.bitArray, xor = w._xor4;
  160.     tlen /= 8;
  161.   
  162.     // check tag length and message length
  163.     if (tlen % 2 || tlen < 4 || tlen > 16) {
  164.       throw new sjcl.exception.invalid("ccm: invalid tag length");
  165.     }
  166.   
  167.     if (adata.length > 0xFFFFFFFF || plaintext.length > 0xFFFFFFFF) {
  168.       // I don't want to deal with extracting high words from doubles.
  169.       throw new sjcl.exception.bug("ccm: can't deal with 4GiB or more data");
  170.     }
  172.     mac = sjcl.mode.ccm._macAdditionalData(prf, adata, iv, tlen, w.bitLength(plaintext)/8, L);
  174.     // mac the plaintext
  175.     for (i=0; i<plaintext.length; i+=4) {
  176.       mac = prf.encrypt(xor(mac, plaintext.slice(i,i+4).concat([0,0,0])));
  177.     }
  179.     return w.clamp(mac, tlen * 8);
  180.   },
  182.   /** CCM CTR mode.
  183.    * Encrypt or decrypt data and tag with the prf in CCM-style CTR mode.
  184.    * May mutate its arguments.
  185.    * @param {Object} prf The PRF.
  186.    * @param {bitArray} data The data to be encrypted or decrypted.
  187.    * @param {bitArray} iv The initialization vector.
  188.    * @param {bitArray} tag The authentication tag.
  189.    * @param {Number} tlen The length of th etag, in bits.
  190.    * @param {Number} L The CCM L value.
  191.    * @return {Object} An object with data and tag, the en/decryption of data and tag values.
  192.    * @private
  193.    */
  194.   _ctrMode: function(prf, data, iv, tag, tlen, L) {
  195.     var enc, i, w=sjcl.bitArray, xor = w._xor4, ctr, l = data.length, bl=w.bitLength(data), n = l/50, p = n;
  197.     // start the ctr
  198.     ctr = w.concat([w.partial(8,L-1)],iv).concat([0,0,0]).slice(0,4);
  199.     
  200.     // en/decrypt the tag
  201.     tag = w.bitSlice(xor(tag,prf.encrypt(ctr)), 0, tlen);
  202.   
  203.     // en/decrypt the data
  204.     if (!l) { return {tag:tag, data:[]}; }
  205.     
  206.     for (i=0; i<l; i+=4) {
  207.       if (i > n) {
  208.         sjcl.mode.ccm._callProgressListener(i/l);
  209.         n += p;
  210.       }
  211.       ctr[3]++;
  212.       enc = prf.encrypt(ctr);
  213.       data[i]   ^= enc[0];
  214.       data[i+1] ^= enc[1];
  215.       data[i+2] ^= enc[2];
  216.       data[i+3] ^= enc[3];
  217.     }
  218.     return { tag:tag, data:w.clamp(data,bl) };
  219.   }
  220. };