Botan 3.3.0
Crypto and TLS for C&
cryptobox.cpp
Go to the documentation of this file.
1/*
2* Cryptobox Message Routines
3* (C) 2009 Jack Lloyd
4*
5* Botan is released under the Simplified BSD License (see license.txt)
6*/
7
8#include <botan/cryptobox.h>
9
10#include <botan/cipher_mode.h>
11#include <botan/data_src.h>
12#include <botan/mac.h>
13#include <botan/mem_ops.h>
14#include <botan/pem.h>
15#include <botan/pwdhash.h>
16#include <botan/rng.h>
17#include <botan/internal/ct_utils.h>
18#include <botan/internal/loadstor.h>
19
21
22namespace {
23
24/*
25First 24 bits of SHA-256("Botan Cryptobox"), followed by 8 0 bits
26for later use as flags, etc if needed
27*/
28const uint32_t CRYPTOBOX_VERSION_CODE = 0xEFC22400;
29
30const size_t VERSION_CODE_LEN = 4;
31const size_t CIPHER_KEY_LEN = 32;
32const size_t CIPHER_IV_LEN = 16;
33const size_t MAC_KEY_LEN = 32;
34const size_t MAC_OUTPUT_LEN = 20;
35const size_t PBKDF_SALT_LEN = 10;
36const size_t PBKDF_ITERATIONS = 8 * 1024;
37
38const size_t CRYPTOBOX_HEADER_LEN = VERSION_CODE_LEN + PBKDF_SALT_LEN + MAC_OUTPUT_LEN;
39
40} // namespace
41
42std::string encrypt(const uint8_t input[], size_t input_len, std::string_view passphrase, RandomNumberGenerator& rng) {
43 /*
44 Output format is:
45 version # (4 bytes)
46 salt (10 bytes)
47 mac (20 bytes)
48 ciphertext
49 */
50 secure_vector<uint8_t> out_buf(CRYPTOBOX_HEADER_LEN + input_len);
51 store_be(CRYPTOBOX_VERSION_CODE, out_buf.data());
52 rng.randomize(&out_buf[VERSION_CODE_LEN], PBKDF_SALT_LEN);
53 // space left for MAC here
54 if(input_len > 0) {
55 copy_mem(&out_buf[CRYPTOBOX_HEADER_LEN], input, input_len);
56 }
57
58 // Generate the keys and IV
59
60 auto pbkdf_fam = PasswordHashFamily::create_or_throw("PBKDF2(HMAC(SHA-512))");
61 auto pbkdf = pbkdf_fam->from_params(PBKDF_ITERATIONS);
62
63 secure_vector<uint8_t> master_key(CIPHER_KEY_LEN + MAC_KEY_LEN + CIPHER_IV_LEN);
64
65 pbkdf->derive_key(master_key.data(),
66 master_key.size(),
67 passphrase.data(),
68 passphrase.size(),
69 &out_buf[VERSION_CODE_LEN],
70 PBKDF_SALT_LEN);
71
72 const uint8_t* mk = master_key.data();
73 const uint8_t* cipher_key = mk;
74 const uint8_t* mac_key = mk + CIPHER_KEY_LEN;
75 const uint8_t* iv = mk + CIPHER_KEY_LEN + MAC_KEY_LEN;
76
77 // Now encrypt and authenticate
78 auto ctr = Cipher_Mode::create_or_throw("Serpent/CTR-BE", Cipher_Dir::Encryption);
79 ctr->set_key(cipher_key, CIPHER_KEY_LEN);
80 ctr->start(iv, CIPHER_IV_LEN);
81 ctr->finish(out_buf, CRYPTOBOX_HEADER_LEN);
82
83 std::unique_ptr<MessageAuthenticationCode> hmac = MessageAuthenticationCode::create_or_throw("HMAC(SHA-512)");
84 hmac->set_key(mac_key, MAC_KEY_LEN);
85 if(input_len > 0) {
86 hmac->update(&out_buf[CRYPTOBOX_HEADER_LEN], input_len);
87 }
88
89 // Can't write directly because of MAC truncation
90 secure_vector<uint8_t> mac = hmac->final();
91 copy_mem(&out_buf[VERSION_CODE_LEN + PBKDF_SALT_LEN], mac.data(), MAC_OUTPUT_LEN);
92
93 return PEM_Code::encode(out_buf, "BOTAN CRYPTOBOX MESSAGE");
94}
95
96secure_vector<uint8_t> decrypt_bin(const uint8_t input[], size_t input_len, std::string_view passphrase) {
97 DataSource_Memory input_src(input, input_len);
98 secure_vector<uint8_t> ciphertext = PEM_Code::decode_check_label(input_src, "BOTAN CRYPTOBOX MESSAGE");
99
100 if(ciphertext.size() < CRYPTOBOX_HEADER_LEN) {
101 throw Decoding_Error("Invalid CryptoBox input");
102 }
103
104 for(size_t i = 0; i != VERSION_CODE_LEN; ++i) {
105 uint32_t version = load_be<uint32_t>(ciphertext.data(), 0);
106 if(version != CRYPTOBOX_VERSION_CODE) {
107 throw Decoding_Error("Bad CryptoBox version");
108 }
109 }
110
111 const uint8_t* pbkdf_salt = &ciphertext[VERSION_CODE_LEN];
112 const uint8_t* box_mac = &ciphertext[VERSION_CODE_LEN + PBKDF_SALT_LEN];
113
114 auto pbkdf_fam = PasswordHashFamily::create_or_throw("PBKDF2(HMAC(SHA-512))");
115 auto pbkdf = pbkdf_fam->from_params(PBKDF_ITERATIONS);
116
117 secure_vector<uint8_t> master_key(CIPHER_KEY_LEN + MAC_KEY_LEN + CIPHER_IV_LEN);
118
119 pbkdf->derive_key(
120 master_key.data(), master_key.size(), passphrase.data(), passphrase.size(), pbkdf_salt, PBKDF_SALT_LEN);
121
122 const uint8_t* mk = master_key.data();
123 const uint8_t* cipher_key = mk;
124 const uint8_t* mac_key = mk + CIPHER_KEY_LEN;
125 const uint8_t* iv = mk + CIPHER_KEY_LEN + MAC_KEY_LEN;
126
127 // Now authenticate and decrypt
128 std::unique_ptr<MessageAuthenticationCode> hmac = MessageAuthenticationCode::create_or_throw("HMAC(SHA-512)");
129 hmac->set_key(mac_key, MAC_KEY_LEN);
130
131 if(ciphertext.size() > CRYPTOBOX_HEADER_LEN) {
132 hmac->update(&ciphertext[CRYPTOBOX_HEADER_LEN], ciphertext.size() - CRYPTOBOX_HEADER_LEN);
133 }
134 secure_vector<uint8_t> computed_mac = hmac->final();
135
136 if(!CT::is_equal(computed_mac.data(), box_mac, MAC_OUTPUT_LEN).as_bool()) {
137 throw Decoding_Error("CryptoBox integrity failure");
138 }
139
140 auto ctr = Cipher_Mode::create_or_throw("Serpent/CTR-BE", Cipher_Dir::Decryption);
141 ctr->set_key(cipher_key, CIPHER_KEY_LEN);
142 ctr->start(iv, CIPHER_IV_LEN);
143 ctr->finish(ciphertext, CRYPTOBOX_HEADER_LEN);
144
145 ciphertext.erase(ciphertext.begin(), ciphertext.begin() + CRYPTOBOX_HEADER_LEN);
146 return ciphertext;
147}
148
151
152secure_vector<uint8_t> decrypt_bin(std::string_view input, std::string_view passphrase) {
153 return decrypt_bin(cast_char_ptr_to_uint8(input.data()), input.size(), passphrase);
154}
155
156std::string decrypt(const uint8_t input[], size_t input_len, std::string_view passphrase) {
157 const secure_vector<uint8_t> bin = decrypt_bin(input, input_len, passphrase);
158
159 return std::string(cast_uint8_ptr_to_char(&bin[0]), bin.size());
160}
161
162std::string decrypt(std::string_view input, std::string_view passphrase) {
163 return decrypt(cast_char_ptr_to_uint8(input.data()), input.size(), passphrase);
164}
165
167
168} // namespace Botan::CryptoBox
static std::unique_ptr< Cipher_Mode > create_or_throw(std::string_view algo, Cipher_Dir direction, std::string_view provider="")
static std::unique_ptr< MessageAuthenticationCode > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition mac.cpp:148
static std::unique_ptr< PasswordHashFamily > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition pwdhash.cpp:109
void randomize(std::span< uint8_t > output)
Definition rng.h:52
#define BOTAN_DIAGNOSTIC_POP
Definition compiler.h:191
#define BOTAN_DIAGNOSTIC_PUSH
Definition compiler.h:188
#define BOTAN_DIAGNOSTIC_IGNORE_DEPRECATED_DECLARATIONS
Definition compiler.h:189
CT::Mask< T > is_equal(const T x[], const T y[], size_t len)
Definition ct_utils.h:339
secure_vector< uint8_t > decrypt_bin(const uint8_t input[], size_t input_len, std::string_view passphrase)
Definition cryptobox.cpp:96
std::string encrypt(const uint8_t input[], size_t input_len, std::string_view passphrase, RandomNumberGenerator &rng)
Definition cryptobox.cpp:42
std::string decrypt(const uint8_t input[], size_t input_len, std::string_view passphrase)
std::string encode(const uint8_t der[], size_t length, std::string_view label, size_t width)
Definition pem.cpp:39
secure_vector< uint8_t > decode_check_label(DataSource &source, std::string_view label_want)
Definition pem.cpp:49
constexpr void store_be(T in, OutR &&out_range)
Definition loadstor.h:358
const char * cast_uint8_ptr_to_char(const uint8_t *b)
Definition mem_ops.h:276
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:61
constexpr void copy_mem(T *out, const T *in, size_t n)
Definition mem_ops.h:146
const uint8_t * cast_char_ptr_to_uint8(const char *s)
Definition mem_ops.h:272