Commit f0531f1

Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63411 Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1

8 files changed

Lines changed: 610 additions & 72 deletions

File tree

‎deps/ncrypto/ncrypto.cc‎

Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
: cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
} else {
4420+
cipher_ = nullptr;
4421+
}
4422+
}
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
} else {
4433+
fetched_cipher_.reset();
4434+
cipher_ = nullptr;
4435+
return *this;
4436+
}
4437+
} else {
4438+
fetched_cipher_.reset();
4439+
}
4440+
#endif
4441+
cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
}
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
&context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
context.cb(name);
6320+
};
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
}
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
}
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
fetched_cipher_.reset();
457+
#endif
443458
cipher_ = cipher;
444459
return *this;
445460
}
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,

0 commit comments

Comments
 (0)
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Commit f0531f1
Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63411
Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1
8 files changed
Lines changed: 610 additions & 72 deletions
File tree
‎deps/ncrypto/ncrypto.cc‎
Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
 : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
 } else {
4420+
 cipher_ = nullptr;
4421+
 }
4422+
 }
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
 } else {
4433+
 fetched_cipher_.reset();
4434+
 cipher_ = nullptr;
4435+
return *this;
4436+
 }
4437+
 } else {
4438+
 fetched_cipher_.reset();
4439+
 }
4440+
#endif
4441+
 cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
 MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
 mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
 mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
 }
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
 TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
 array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
 &context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
 context.cb(name);
6320+
 };
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
 }
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
 }
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎
Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
 Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
 Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
 fetched_cipher_.reset();
457+
#endif
443458
 cipher_ = cipher;
444459
return *this;
445460
 }
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit f0531f1
Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63411
Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1
8 files changed
Lines changed: 610 additions & 72 deletions
File tree
‎deps/ncrypto/ncrypto.cc‎
Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
 : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
 } else {
4420+
 cipher_ = nullptr;
4421+
 }
4422+
 }
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
 } else {
4433+
 fetched_cipher_.reset();
4434+
 cipher_ = nullptr;
4435+
return *this;
4436+
 }
4437+
 } else {
4438+
 fetched_cipher_.reset();
4439+
 }
4440+
#endif
4441+
 cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
 MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
 mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
 mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
 }
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
 TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
 array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
 &context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
 context.cb(name);
6320+
 };
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
 }
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
 }
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎
Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
 Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
 Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
 fetched_cipher_.reset();
457+
#endif
443458
 cipher_ = cipher;
444459
return *this;
445460
 }
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit f0531f1
Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63411
Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1
8 files changed
Lines changed: 610 additions & 72 deletions
File tree
‎deps/ncrypto/ncrypto.cc‎
Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
 : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
 } else {
4420+
 cipher_ = nullptr;
4421+
 }
4422+
 }
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
 } else {
4433+
 fetched_cipher_.reset();
4434+
 cipher_ = nullptr;
4435+
return *this;
4436+
 }
4437+
 } else {
4438+
 fetched_cipher_.reset();
4439+
 }
4440+
#endif
4441+
 cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
 MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
 mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
 mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
 }
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
 TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
 array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
 &context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
 context.cb(name);
6320+
 };
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
 }
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
 }
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎
Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
 Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
 Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
 fetched_cipher_.reset();
457+
#endif
443458
 cipher_ = cipher;
444459
return *this;
445460
 }
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Commit f0531f1
Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63411
Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1
8 files changed
Lines changed: 610 additions & 72 deletions
File tree
‎deps/ncrypto/ncrypto.cc‎
Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
 : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
 } else {
4420+
 cipher_ = nullptr;
4421+
 }
4422+
 }
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
 } else {
4433+
 fetched_cipher_.reset();
4434+
 cipher_ = nullptr;
4435+
return *this;
4436+
 }
4437+
 } else {
4438+
 fetched_cipher_.reset();
4439+
 }
4440+
#endif
4441+
 cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
 MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
 mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
 mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
 }
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
 TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
 array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
 &context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
 context.cb(name);
6320+
 };
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
 }
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
 }
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎
Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
 Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
 Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
 fetched_cipher_.reset();
457+
#endif
443458
 cipher_ = cipher;
444459
return *this;
445460
 }
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit f0531f1
Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63411
Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1
8 files changed
Lines changed: 610 additions & 72 deletions
File tree
‎deps/ncrypto/ncrypto.cc‎
Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
 : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
 } else {
4420+
 cipher_ = nullptr;
4421+
 }
4422+
 }
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
 } else {
4433+
 fetched_cipher_.reset();
4434+
 cipher_ = nullptr;
4435+
return *this;
4436+
 }
4437+
 } else {
4438+
 fetched_cipher_.reset();
4439+
 }
4440+
#endif
4441+
 cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
 MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
 mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
 mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
 }
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
 TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
 array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
 &context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
 context.cb(name);
6320+
 };
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
 }
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
 }
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎
Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
 Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
 Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
 fetched_cipher_.reset();
457+
#endif
443458
 cipher_ = cipher;
444459
return *this;
445460
 }
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit f0531f1
Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63411
Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1
8 files changed
Lines changed: 610 additions & 72 deletions
File tree
‎deps/ncrypto/ncrypto.cc‎
Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
 : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
 } else {
4420+
 cipher_ = nullptr;
4421+
 }
4422+
 }
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
 } else {
4433+
 fetched_cipher_.reset();
4434+
 cipher_ = nullptr;
4435+
return *this;
4436+
 }
4437+
 } else {
4438+
 fetched_cipher_.reset();
4439+
 }
4440+
#endif
4441+
 cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
 MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
 mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
 mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
 }
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
 TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
 array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
 &context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
 context.cb(name);
6320+
 };
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
 }
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
 }
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎
Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
 Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
 Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
 fetched_cipher_.reset();
457+
#endif
443458
 cipher_ = cipher;
444459
return *this;
445460
 }
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Commit f0531f1
Browse files
panvaaduh95
panva
authored and
aduh95
committed
crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
Closes#63393
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63411
Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 7670c81 commit f0531f1
8 files changed
Lines changed: 610 additions & 72 deletions
File tree
‎deps/ncrypto/ncrypto.cc‎
Lines changed: 163 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4406,12 +4406,79 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
44064406

44074407
// ============================================================================
44084408

4409+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4410+
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
4411+
 : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
4412+
#endif
4413+
4414+
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
4415+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4416+
if (other.fetched_cipher_ != nullptr) {
4417+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4418+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4419+
 } else {
4420+
 cipher_ = nullptr;
4421+
 }
4422+
 }
4423+
#endif
4424+
}
4425+
4426+
Cipher& Cipher::operator=(const Cipher& other) {
4427+
if (this == &other) return *this;
4428+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4429+
if (other.fetched_cipher_ != nullptr) {
4430+
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
4431+
 fetched_cipher_.reset(other.fetched_cipher_.get());
4432+
 } else {
4433+
 fetched_cipher_.reset();
4434+
 cipher_ = nullptr;
4435+
return *this;
4436+
 }
4437+
 } else {
4438+
 fetched_cipher_.reset();
4439+
 }
4440+
#endif
4441+
 cipher_ = other.cipher_;
4442+
return *this;
4443+
}
4444+
44094445
const Cipher Cipher::FromName(constchar* name) {
4410-
returnCipher(EVP_get_cipherbyname(name));
4446+
constEVP_CIPHER* cipher = EVP_get_cipherbyname(name);
4447+
if (cipher != nullptr) returnCipher(cipher);
4448+
4449+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4450+
 MarkPopErrorOnReturn mark_pop_error_on_return;
4451+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
4452+
EVP_CIPHER_fetch(nullptr, name, nullptr));
4453+
if (fetched == nullptr) returnCipher();
4454+
4455+
constint mode = EVP_CIPHER_mode(fetched.get());
4456+
constbool is_siv_mode =
4457+
#if OPENSSL_WITH_AES_SIV
4458+
 mode == EVP_CIPH_SIV_MODE ||
4459+
#endif
4460+
#if OPENSSL_WITH_AES_GCM_SIV
4461+
 mode == EVP_CIPH_GCM_SIV_MODE ||
4462+
#endif
4463+
false;
4464+
if (is_siv_mode) returnCipher(std::move(fetched));
4465+
4466+
returnCipher();
4467+
#else
4468+
returnCipher();
4469+
#endif
44114470
}
44124471

44134472
const Cipher Cipher::FromNid(int nid) {
4414-
returnCipher(EVP_get_cipherbynid(nid));
4473+
constEVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
4474+
if (cipher != nullptr) returnCipher(cipher);
4475+
4476+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4477+
constchar* name = OBJ_nid2sn(nid);
4478+
if (name != nullptr) returnFromName(name);
4479+
#endif
4480+
4481+
returnCipher();
44154482
}
44164483

44174484
const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
@@ -4465,6 +4532,24 @@ bool Cipher::isOcbMode() const {
44654532
returngetMode() == EVP_CIPH_OCB_MODE;
44664533
}
44674534

4535+
boolCipher::isSivMode() const {
4536+
if (!cipher_) returnfalse;
4537+
#if OPENSSL_WITH_AES_SIV
4538+
returngetMode() == EVP_CIPH_SIV_MODE;
4539+
#else
4540+
returnfalse;
4541+
#endif
4542+
}
4543+
4544+
boolCipher::isGcmSivMode() const {
4545+
if (!cipher_) returnfalse;
4546+
#if OPENSSL_WITH_AES_GCM_SIV
4547+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4548+
#else
4549+
returnfalse;
4550+
#endif
4551+
}
4552+
44684553
boolCipher::isStreamMode() const {
44694554
if (!cipher_) returnfalse;
44704555
returngetMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4519,6 +4604,14 @@ std::string_view Cipher::getModeLabel() const {
45194604
return"ocb";
45204605
caseEVP_CIPH_OFB_MODE:
45214606
return"ofb";
4607+
#if OPENSSL_WITH_AES_SIV
4608+
caseEVP_CIPH_SIV_MODE:
4609+
return"siv";
4610+
#endif
4611+
#if OPENSSL_WITH_AES_GCM_SIV
4612+
caseEVP_CIPH_GCM_SIV_MODE:
4613+
return"gcm-siv";
4614+
#endif
45224615
caseEVP_CIPH_WRAP_MODE:
45234616
return"wrap";
45244617
caseEVP_CIPH_XTS_MODE:
@@ -4533,7 +4626,16 @@ const char* Cipher::getName() const {
45334626
if (!cipher_) return {};
45344627
// OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
45354628
// EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
4536-
returnOBJ_nid2sn(getNid());
4629+
constint nid = getNid();
4630+
if (nid != NID_undef) {
4631+
constchar* name = OBJ_nid2sn(nid);
4632+
if (name != nullptr) return name;
4633+
 }
4634+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
4635+
returnEVP_CIPHER_get0_name(cipher_);
4636+
#else
4637+
return {};
4638+
#endif
45374639
}
45384640

45394641
boolCipher::isSupportedAuthenticatedMode() const {
@@ -4542,6 +4644,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
45424644
caseEVP_CIPH_GCM_MODE:
45434645
#ifndef OPENSSL_NO_OCB
45444646
caseEVP_CIPH_OCB_MODE:
4647+
#endif
4648+
#if OPENSSL_WITH_AES_SIV
4649+
caseEVP_CIPH_SIV_MODE:
4650+
#endif
4651+
#if OPENSSL_WITH_AES_GCM_SIV
4652+
caseEVP_CIPH_GCM_SIV_MODE:
45454653
#endif
45464654
returntrue;
45474655
caseEVP_CIPH_STREAM_CIPHER:
@@ -4655,6 +4763,24 @@ bool CipherCtxPointer::isWrapMode() const {
46554763
returngetMode() == EVP_CIPH_WRAP_MODE;
46564764
}
46574765

4766+
boolCipherCtxPointer::isSivMode() const {
4767+
if (!ctx_) returnfalse;
4768+
#if OPENSSL_WITH_AES_SIV
4769+
returngetMode() == EVP_CIPH_SIV_MODE;
4770+
#else
4771+
returnfalse;
4772+
#endif
4773+
}
4774+
4775+
boolCipherCtxPointer::isGcmSivMode() const {
4776+
if (!ctx_) returnfalse;
4777+
#if OPENSSL_WITH_AES_GCM_SIV
4778+
returngetMode() == EVP_CIPH_GCM_SIV_MODE;
4779+
#else
4780+
returnfalse;
4781+
#endif
4782+
}
4783+
46584784
boolCipherCtxPointer::isChaCha20Poly1305() const {
46594785
if (!ctx_) returnfalse;
46604786
returngetNid() == NID_chacha20_poly1305;
@@ -6103,6 +6229,22 @@ struct CipherCallbackContext {
61036229
voidoperator()(constchar* name) { cb(name); }
61046230
};
61056231

6232+
#if OPENSSL_WITH_AES_SIV
6233+
constexprconstchar* kProviderOnlyAesSivCiphers[] = {
6234+
"aes-128-siv",
6235+
"aes-192-siv",
6236+
"aes-256-siv",
6237+
};
6238+
#endif
6239+
6240+
#if OPENSSL_WITH_AES_GCM_SIV
6241+
constexprconstchar* kProviderOnlyAesGcmSivCiphers[] = {
6242+
"aes-128-gcm-siv",
6243+
"aes-192-gcm-siv",
6244+
"aes-256-gcm-siv",
6245+
};
6246+
#endif
6247+
61066248
#if OPENSSL_VERSION_MAJOR >= 3
61076249
template <classTypeName,
61086250
 TypeName* fetch_type(OSSL_LIB_CTX*, constchar*, constchar*),
@@ -6169,6 +6311,24 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
61696311
 array_push_back<EVP_CIPHER>,
61706312
#endif
61716313
 &context);
6314+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
6315+
auto maybe_push_provider_only_cipher = [&](constchar* name) {
6316+
EVP_CIPHER* cipher = EVP_CIPHER_fetch(nullptr, name, nullptr);
6317+
if (cipher == nullptr) return;
6318+
EVP_CIPHER_free(cipher);
6319+
 context.cb(name);
6320+
 };
6321+
#endif
6322+
#if OPENSSL_WITH_AES_SIV
6323+
for (constchar* name : kProviderOnlyAesSivCiphers) {
6324+
maybe_push_provider_only_cipher(name);
6325+
 }
6326+
#endif
6327+
#if OPENSSL_WITH_AES_GCM_SIV
6328+
for (constchar* name : kProviderOnlyAesGcmSivCiphers) {
6329+
maybe_push_provider_only_cipher(name);
6330+
 }
6331+
#endif
61726332
#endif
61736333
}
61746334

‎deps/ncrypto/ncrypto.h‎
Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,18 @@
105105
#defineOPENSSL_WITH_EVP_MAC0
106106
#endif
107107

108+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
109+
#defineOPENSSL_WITH_AES_SIV1
110+
#else
111+
#defineOPENSSL_WITH_AES_SIV0
112+
#endif
113+
114+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
115+
#defineOPENSSL_WITH_AES_GCM_SIV1
116+
#else
117+
#defineOPENSSL_WITH_AES_GCM_SIV0
118+
#endif
119+
108120
#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
109121
#defineOPENSSL_WITH_SIGNATURE_CONTEXT_STRING1
110122
#else
@@ -437,9 +449,12 @@ class Cipher final {
437449

438450
Cipher() = default;
439451
Cipher(constEVP_CIPHER* cipher) : cipher_(cipher) {}
440-
Cipher(const Cipher&) = default;
441-
 Cipher& operator=(const Cipher&) = default;
452+
Cipher(const Cipher& other);
453+
 Cipher& operator=(const Cipher& other);
442454
inline Cipher& operator=(constEVP_CIPHER* cipher) {
455+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
456+
 fetched_cipher_.reset();
457+
#endif
443458
 cipher_ = cipher;
444459
return *this;
445460
 }
@@ -462,6 +477,8 @@ class Cipher final {
462477
boolisCtrMode() const;
463478
boolisCcmMode() const;
464479
boolisOcbMode() const;
480+
boolisSivMode() const;
481+
boolisGcmSivMode() const;
465482
boolisStreamMode() const;
466483
boolisChaCha20Poly1305() const;
467484

@@ -533,6 +550,10 @@ class Cipher final {
533550

534551
private:
535552
constEVP_CIPHER* cipher_ = nullptr;
553+
#if OPENSSL_WITH_AES_SIV || OPENSSL_WITH_AES_GCM_SIV
554+
explicitCipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
555+
 DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
556+
#endif
536557
};
537558

538559
// ============================================================================
@@ -933,6 +954,8 @@ class CipherCtxPointer final {
933954
boolisOcbMode() const;
934955
boolisCcmMode() const;
935956
boolisWrapMode() const;
957+
boolisSivMode() const;
958+
boolisGcmSivMode() const;
936959
boolisChaCha20Poly1305() const;
937960

938961
boolupdate(const Buffer<constunsignedchar>& in,
0 commit comments
Comments
 (0)