Expose AesGcm bits necessary to build a constant time decrypt

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html

[xoloki]

As discussed in #184, aes-gcm decrypt is not constant time. @tarcieri suggested that for our use case, it would be better to build a custom crate rather than put a constant time decrypt in the base repo, since overwriting the buffer if the mac check fails is necessary to avoid leaking information.

We attempted to build a constant time decrypt module without duplicating the entire aes-gcm crate; unfortunately, the AesGcm struct does not allow access to the critical data and functions. So I'm offering this PR, which simply makes one struct field and two functions pub.

[tarcieri]

I'd be okay with moving Ctr32 somewhere it can be pub, possibly the ctr crate (it could be unified with the Ctr32 used by AES-GCM-SIV, which is effectively the same thing, but little endian).

I'm somewhat reluctant to expose methods like init_ctr and compute_tag though, as these are effectively internals of the implementation.

[tarcieri]

See this comment re: extracting Ctr32 into the ctr crate:

RustCrypto/stream-ciphers#41

If you had that, would you be okay with duplicating the rest of the crate? Especially if you went back to a slightly earlier version of aes-gcm before support for variable-sized nonces was added, the bulk of the remaining implementation is ~80 LOC, much of which I imagine you'd want to customize to get the behavior you desire:

AEADs/aes-gcm/src/lib.rs

Lines 181 to 254 in 5a28e70

	impl<B>AeadforAesGcm<B>
	where
	B:BlockCipher<BlockSize = U16>,
	B::ParBlocks:ArrayLength<GenericArray<u8,B::BlockSize>>,
	{
	typeNonceSize = U12;
	typeTagSize = U16;
	typeCiphertextOverhead = U0;
	fnencrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	) -> Result<Tag,Error>{
	if buffer.len()asu64 > P_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut ctr = Ctr32::new(nonce);
	ctr.seek(1);
	ctr.apply_keystream(&self.cipher, buffer);
	letmut tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	ctr.seek(0);
	ctr.apply_keystream(&self.cipher, tag.as_mut_slice());
	Ok(tag)
	}
	fndecrypt_in_place_detached(
	&self,
	nonce:&GenericArray<u8,Self::NonceSize>,
	associated_data:&[u8],
	buffer:&mut[u8],
	tag:&Tag,
	) -> Result<(),Error>{
	if buffer.len()asu64 > C_MAX || associated_data.len()asu64 > A_MAX{
	returnErr(Error);
	}
	// TODO(tarcieri): interleave encryption with GHASH
	// See: <https://github.com/RustCrypto/AEADs/issues/74>
	letmut expected_tag = compute_tag(&mutself.ghash.clone(), associated_data, buffer);
	letmut ctr = Ctr32::new(nonce);
	ctr.apply_keystream(&self.cipher, expected_tag.as_mut_slice());
	use subtle::ConstantTimeEq;
	if expected_tag.ct_eq(&tag).unwrap_u8() == 1{
	ctr.apply_keystream(&self.cipher, buffer);
	Ok(())
	}else{
	Err(Error)
	}
	}
	}
	/// Authenticate the given plaintext and associated data using GHASH
	fncompute_tag(ghash:&mutGHash,associated_data:&[u8],buffer:&[u8]) -> Tag{
	ghash.update_padded(associated_data);
	ghash.update_padded(buffer);
	let associated_data_bits = (associated_data.len()asu64)*8;
	let buffer_bits = (buffer.len()asu64)*8;
	letmut block = GenericArray::default();
	block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
	block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
	ghash.update_block(&block);
	ghash.result_reset().into_bytes()
	}

[xoloki]

If you had that, would you be okay with duplicating the rest of the crate?

Yeah that's cool, thanks!

[tarcieri]

PR to extract Ctr32 into the ctr crate (as Ctr32BE):

RustCrypto/stream-ciphers#170

If that's sufficient and you can do the rest yourselves in a 3rd party crate, I'll go ahead and close this.

[tarcieri]

Note: in ctr v0.6.0-pre, there's now Ctr32BE: https://docs.rs/ctr/0.6.0-pre/ctr/struct.Ctr32BE.html