deoxys: rewrite the internals to use inout

[baloo]

This is to prepare the migration to AeadInOut, following RustCrypto/traits#1793

Note: there is a strong chance this could actually use the StreamCipherCore api, but I couldn't not make it fit.

[baloo]

Eventually this should drop and use aead::inout

[tarcieri]

@baloo can you add one or more tests that actually exercise InOutBuf with separate backing buffers?

[baloo]

Yeah, found a misuse of get_in haha ><

[newpavlov]

This PR includes a fair amount of changes which are not directly relevant to the inout support. Ideally, I would prefer to have them in a separate PR, but it's fine to merge it as-is, if you don't wan to bother with the split.

[baloo]

I think this one is ready to merge, unless you have anything other to say.

[newpavlov]

buffer_len % 16 == 0 is always true when !data.is_empty() is false. I think it would be better to write this part like this:

if tail.is_empty(){// Without incomplete last block
...}else{// With incomplete last block
...}

Same for decrypt_inout.

[baloo]

the best I can do will look this:

diff --git a/deoxys/src/modes.rs b/deoxys/src/modes.rs
index 0f91ec36e0..e6ed2cd000 100644
--- a/deoxys/src/modes.rs
+++ b/deoxys/src/modes.rs
@@ -111,12 +111,11 @@
tweak[8] = nonce[7] << 4;
// Message authentication and encryption
- if !buffer.is_empty() {
+ let (data_blocks, mut tail) = buffer.into_chunks();
+ let data_blocks_len = data_blocks.len();
+ if !data_blocks.is_empty() || !tail.is_empty() {
tweak[0] = (tweak[0] & 0xf) | TWEAK_M;
- let (data_blocks, tail) = buffer.into_chunks();
- let data_blocks_len = data_blocks.len();
-
for (index, data) in data_blocks.into_iter().enumerate() {
// Copy block number
let tmp = tweak[8] & 0xf0;
@@ -130,9 +129,8 @@
B::encrypt_inout(data, &tweak, subkeys);
}
- let mut data = tail;
let index = data_blocks_len;
- if !data.is_empty() {
+ if !tail.is_empty() {
// Last block, incomplete
// Copy block number
@@ -144,9 +142,9 @@
tweak[0] = (tweak[0] & 0xf) | TWEAK_M_LAST;
let mut block = Block::default();
- block[0..data.len()].copy_from_slice(data.get_in());
+ block[0..tail.len()].copy_from_slice(tail.get_in());
- block[data.len()] = 0x80;
+ block[tail.len()] = 0x80;
for (c, d) in checksum.iter_mut().zip(block.iter()) {
*c ^= d;
@@ -157,24 +155,23 @@
// Last block encryption
B::encrypt_inout((&mut block).into(), &tweak, subkeys);
- data.xor_in2out((block[..data.len()]).into());
-
- // Tag computing.
- tweak[0] = (tweak[0] & 0xf) | TWEAK_CHKSUM;
-
- let tmp = tweak[8] & 0xf0;
- tweak[8..].copy_from_slice(&((index + 1) as u64).to_be_bytes());
- tweak[8] = (tweak[8] & 0xf) | tmp;
-
- B::encrypt_inout((&mut checksum).into(), tweak.as_ref(), subkeys);
-
- for (t, c) in tag.iter_mut().zip(checksum.iter()) {
- *t ^= c;
- }
+ tail.xor_in2out((block[..tail.len()]).into());
}
}
- if buffer_len % 16 == 0 {
+ if !tail.is_empty() {
+ tweak[0] = (tweak[0] & 0xf) | TWEAK_CHKSUM;
+
+ let tmp = tweak[8] & 0xf0;
+ tweak[8..].copy_from_slice(&((data_blocks_len + 1) as u64).to_be_bytes());
+ tweak[8] = (tweak[8] & 0xf) | tmp;
+
+ B::encrypt_inout((&mut checksum).into(), tweak.as_ref(), subkeys);
+
+ for (t, c) in tag.iter_mut().zip(checksum.iter()) {
+ *t ^= c;
+ }
+ } else {
// Tag computing without last block
tweak[0] = (tweak[0] & 0xf) | TWEAK_TAG;

That makes the whole patch series a lot less readable in my opinion (even when ignoring whitespace).

[newpavlov]

Ok, we can do it in a different PR then.