aboutsummaryrefslogtreecommitdiff
path: root/crypto-vala/src
diff options
context:
space:
mode:
Diffstat (limited to 'crypto-vala/src')
-rw-r--r--crypto-vala/src/cipher.vala159
-rw-r--r--crypto-vala/src/cipher_converter.vala50
-rw-r--r--crypto-vala/src/cipher_gcrypt.vala137
-rw-r--r--crypto-vala/src/cipher_openssl.vala156
-rw-r--r--crypto-vala/src/error.vala6
-rw-r--r--crypto-vala/src/gcrypt.vala21
-rw-r--r--crypto-vala/src/openssl.vala19
-rw-r--r--crypto-vala/src/random.vala5
8 files changed, 376 insertions, 177 deletions
diff --git a/crypto-vala/src/cipher.vala b/crypto-vala/src/cipher.vala
index 306dafa8..f7aee100 100644
--- a/crypto-vala/src/cipher.vala
+++ b/crypto-vala/src/cipher.vala
@@ -1,152 +1,19 @@
namespace Crypto {
-public class SymmetricCipher {
- private GCrypt.Cipher.Cipher cipher;
- public static bool supports(string algo_name) {
- GCrypt.Cipher.Algorithm algo;
- GCrypt.Cipher.Mode mode;
- GCrypt.Cipher.Flag flags;
- return parse(algo_name, out algo, out mode, out flags);
- }
-
- private static unowned string mode_to_string(GCrypt.Cipher.Mode mode) {
- switch (mode) {
- case GCrypt.Cipher.Mode.ECB: return "ECB";
- case GCrypt.Cipher.Mode.CFB: return "CFB";
- case GCrypt.Cipher.Mode.CBC: return "CBC";
- case GCrypt.Cipher.Mode.STREAM: return "STREAM";
- case GCrypt.Cipher.Mode.OFB: return "OFB";
- case GCrypt.Cipher.Mode.CTR: return "CTR";
- case GCrypt.Cipher.Mode.AESWRAP: return "AESWRAP";
- case GCrypt.Cipher.Mode.GCM: return "GCM";
- case GCrypt.Cipher.Mode.POLY1305: return "POLY1305";
- case GCrypt.Cipher.Mode.OCB: return "OCB";
- case GCrypt.Cipher.Mode.CFB8: return "CFB8";
- // case GCrypt.Cipher.Mode.XTS: return "XTS"; // Not supported in gcrypt < 1.8
- }
- return "NONE";
- }
-
- private static GCrypt.Cipher.Mode mode_from_string(string name) {
- switch (name) {
- case "ECB": return GCrypt.Cipher.Mode.ECB;
- case "CFB": return GCrypt.Cipher.Mode.CFB;
- case "CBC": return GCrypt.Cipher.Mode.CBC;
- case "STREAM": return GCrypt.Cipher.Mode.STREAM;
- case "OFB": return GCrypt.Cipher.Mode.OFB;
- case "CTR": return GCrypt.Cipher.Mode.CTR;
- case "AESWRAP": return GCrypt.Cipher.Mode.AESWRAP;
- case "GCM": return GCrypt.Cipher.Mode.GCM;
- case "POLY1305": return GCrypt.Cipher.Mode.POLY1305;
- case "OCB": return GCrypt.Cipher.Mode.OCB;
- case "CFB8": return GCrypt.Cipher.Mode.CFB8;
- // case "XTS": return GCrypt.Cipher.Mode.XTS; // Not supported in gcrypt < 1.8
- }
- return GCrypt.Cipher.Mode.NONE;
- }
-
- private static string flags_to_string(GCrypt.Cipher.Flag flags) {
- string? s = null;
- if ((GCrypt.Cipher.Flag.CBC_MAC & flags) != 0) s = (s == null ? "" : @"$s-") + "MAC";
- if ((GCrypt.Cipher.Flag.CBC_CTS & flags) != 0) s = (s == null ? "" : @"$s-") + "CTS";
- if ((GCrypt.Cipher.Flag.ENABLE_SYNC & flags) != 0) s = (s == null ? "" : @"$s-") + "SYNC";
- if ((GCrypt.Cipher.Flag.SECURE & flags) != 0) s = (s == null ? "" : @"$s-") + "SECURE";
- return s ?? "NONE";
- }
-
- private static GCrypt.Cipher.Flag flag_from_string(string flag_name) {
- if (flag_name == "SECURE") return GCrypt.Cipher.Flag.SECURE;
- if (flag_name == "SYNC") return GCrypt.Cipher.Flag.ENABLE_SYNC;
- if (flag_name == "CTS") return GCrypt.Cipher.Flag.CBC_CTS;
- if (flag_name == "MAC") return GCrypt.Cipher.Flag.CBC_MAC;
- return 0;
- }
-
- private static GCrypt.Cipher.Flag flags_from_string(string flag_names) {
- GCrypt.Cipher.Flag flags = 0;
- foreach(string flag in flag_names.split("-")) {
- flags |= flag_from_string(flag);
- }
- return flags;
- }
-
- private static bool parse(string algo_name, out GCrypt.Cipher.Algorithm algo, out GCrypt.Cipher.Mode mode, out GCrypt.Cipher.Flag flags) {
- algo = GCrypt.Cipher.Algorithm.NONE;
- mode = GCrypt.Cipher.Mode.NONE;
- flags = 0;
- string[] algo_parts = algo_name.split("-", 3);
-
- algo = GCrypt.Cipher.Algorithm.from_string(algo_parts[0]);
- if (algo_parts.length >= 2) {
- mode = mode_from_string(algo_parts[1]);
- }
- if (algo_parts.length == 3) {
- flags |= flags_from_string(algo_parts[2]);
- }
- return to_algo_name(algo, mode, flags) == algo_name;
- }
-
- private static string to_algo_name(GCrypt.Cipher.Algorithm algo = GCrypt.Cipher.Algorithm.NONE, GCrypt.Cipher.Mode mode = GCrypt.Cipher.Mode.NONE, GCrypt.Cipher.Flag flags = 0) {
- if (flags != 0) {
- return @"$algo-$(mode_to_string(mode))-$(flags_to_string(flags))";
- } else if (mode != GCrypt.Cipher.Mode.NONE) {
- return @"$algo-$(mode_to_string(mode))";
- } else {
- return algo.to_string();
- }
- }
-
- public SymmetricCipher(string algo_name) throws Error {
- GCrypt.Cipher.Algorithm algo;
- GCrypt.Cipher.Mode mode;
- GCrypt.Cipher.Flag flags;
- if (parse(algo_name, out algo, out mode, out flags)) {
- this.gcrypt(algo, mode, flags);
- } else {
- throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
- }
- }
-
- private SymmetricCipher.gcrypt(GCrypt.Cipher.Algorithm algo, GCrypt.Cipher.Mode mode, GCrypt.Cipher.Flag flags) throws Error {
- may_throw_gcrypt_error(GCrypt.Cipher.Cipher.open(out this.cipher, algo, mode, flags));
- }
-
- public void set_key(uint8[] key) throws Error {
- may_throw_gcrypt_error(cipher.set_key(key));
- }
-
- public void set_iv(uint8[] iv) throws Error {
- may_throw_gcrypt_error(cipher.set_iv(iv));
- }
-
- public void set_counter_vector(uint8[] ctr) throws Error {
- may_throw_gcrypt_error(cipher.set_counter_vector(ctr));
- }
-
- public void reset() throws Error {
- may_throw_gcrypt_error(cipher.reset());
- }
-
- public uint8[] get_tag(size_t taglen) throws Error {
- uint8[] tag = new uint8[taglen];
- may_throw_gcrypt_error(cipher.get_tag(tag));
- return tag;
- }
-
- public void check_tag(uint8[] tag) throws Error {
- may_throw_gcrypt_error(cipher.check_tag(tag));
- }
-
- public void encrypt(uint8[] output, uint8[] input) throws Error {
- may_throw_gcrypt_error(cipher.encrypt(output, input));
- }
+public interface SymmetricCipher {
+ public abstract void set_key(uint8[] key) throws Error;
+ public abstract void set_iv(uint8[] iv) throws Error;
+ public abstract void reset() throws Error;
+}
- public void decrypt(uint8[] output, uint8[] input) throws Error {
- may_throw_gcrypt_error(cipher.decrypt(output, input));
- }
+public interface SymmetricCipherEncryption : SymmetricCipher, Object {
+ public abstract int encrypt(uint8[] output, uint8[] input) throws Error;
+ public abstract uint8[] get_tag(size_t taglen) throws Error;
+}
- public void sync() throws Error {
- may_throw_gcrypt_error(cipher.sync());
- }
+public interface SymmetricCipherDecryption : SymmetricCipher, Object {
+ public abstract int decrypt(uint8[] output, uint8[] input) throws Error;
+ public abstract void check_tag(uint8[] tag) throws Error;
}
+
}
diff --git a/crypto-vala/src/cipher_converter.vala b/crypto-vala/src/cipher_converter.vala
index 5fb1f548..49e7af71 100644
--- a/crypto-vala/src/cipher_converter.vala
+++ b/crypto-vala/src/cipher_converter.vala
@@ -1,18 +1,14 @@
using GLib;
namespace Crypto {
-public abstract class SymmetricCipherConverter : Converter, Object {
- internal SymmetricCipher cipher;
- internal size_t attached_taglen;
- public abstract ConverterResult convert(uint8[] inbuf, uint8[] outbuf, ConverterFlags flags, out size_t bytes_read, out size_t bytes_written) throws IOError;
+public class SymmetricCipherEncrypter : Converter, Object {
+ private SymmetricCipherEncryption cipher;
+ private size_t attached_taglen;
- public uint8[] get_tag(size_t taglen) throws Error {
- return cipher.get_tag(taglen);
- }
-
- public void check_tag(uint8[] tag) throws Error {
- cipher.check_tag(tag);
+ public SymmetricCipherEncrypter(owned SymmetricCipherEncryption cipher, size_t attached_taglen = 0) {
+ this.cipher = (owned) cipher;
+ this.attached_taglen = attached_taglen;
}
public void reset() {
@@ -22,15 +18,12 @@ public abstract class SymmetricCipherConverter : Converter, Object {
warning(@"$(e.domain) error while resetting cipher: $(e.message)");
}
}
-}
-public class SymmetricCipherEncrypter : SymmetricCipherConverter {
- public SymmetricCipherEncrypter(owned SymmetricCipher cipher, size_t attached_taglen = 0) {
- this.cipher = (owned) cipher;
- this.attached_taglen = attached_taglen;
+ public uint8[] get_tag(size_t taglen) throws Error {
+ return ((SymmetricCipherEncryption)cipher).get_tag(taglen);
}
- public override ConverterResult convert(uint8[] inbuf, uint8[] outbuf, ConverterFlags flags, out size_t bytes_read, out size_t bytes_written) throws IOError {
+ public ConverterResult convert(uint8[] inbuf, uint8[] outbuf, ConverterFlags flags, out size_t bytes_read, out size_t bytes_written) throws IOError {
if (inbuf.length > outbuf.length) {
throw new IOError.NO_SPACE("CipherConverter needs at least the size of input as output space");
}
@@ -39,7 +32,7 @@ public class SymmetricCipherEncrypter : SymmetricCipherConverter {
}
try {
if (inbuf.length > 0) {
- cipher.encrypt(outbuf, inbuf);
+ ((SymmetricCipherEncryption)cipher).encrypt(outbuf, inbuf);
}
bytes_read = inbuf.length;
bytes_written = inbuf.length;
@@ -60,13 +53,28 @@ public class SymmetricCipherEncrypter : SymmetricCipherConverter {
}
}
-public class SymmetricCipherDecrypter : SymmetricCipherConverter {
- public SymmetricCipherDecrypter(owned SymmetricCipher cipher, size_t attached_taglen = 0) {
+public class SymmetricCipherDecrypter : Converter, Object {
+ private SymmetricCipherDecryption cipher;
+ private size_t attached_taglen;
+
+ public SymmetricCipherDecrypter(owned SymmetricCipherDecryption cipher, size_t attached_taglen = 0) {
this.cipher = (owned) cipher;
this.attached_taglen = attached_taglen;
}
- public override ConverterResult convert(uint8[] inbuf, uint8[] outbuf, ConverterFlags flags, out size_t bytes_read, out size_t bytes_written) throws IOError {
+ public void reset() {
+ try {
+ cipher.reset();
+ } catch (Crypto.Error e) {
+ warning(@"$(e.domain) error while resetting cipher: $(e.message)");
+ }
+ }
+
+ public void check_tag(uint8[] tag) throws Error {
+ ((SymmetricCipherDecryption)cipher).check_tag(tag);
+ }
+
+ public ConverterResult convert(uint8[] inbuf, uint8[] outbuf, ConverterFlags flags, out size_t bytes_read, out size_t bytes_written) throws IOError {
if (inbuf.length > outbuf.length + attached_taglen) {
throw new IOError.NO_SPACE("CipherConverter needs at least the size of input as output space");
}
@@ -78,7 +86,7 @@ public class SymmetricCipherDecrypter : SymmetricCipherConverter {
try {
inbuf.length -= (int) attached_taglen;
if (inbuf.length > 0) {
- cipher.decrypt(outbuf, inbuf);
+ ((SymmetricCipherDecryption)cipher).decrypt(outbuf, inbuf);
}
bytes_read = inbuf.length;
bytes_written = inbuf.length;
diff --git a/crypto-vala/src/cipher_gcrypt.vala b/crypto-vala/src/cipher_gcrypt.vala
new file mode 100644
index 00000000..3e811d29
--- /dev/null
+++ b/crypto-vala/src/cipher_gcrypt.vala
@@ -0,0 +1,137 @@
+namespace Crypto {
+
+internal class SymmetricCipherGcrypt : SymmetricCipher, SymmetricCipherEncryption, SymmetricCipherDecryption, Object {
+ private GCrypt.Cipher.Cipher cipher;
+
+ private static unowned string mode_to_string(GCrypt.Cipher.Mode mode) {
+ switch (mode) {
+ case GCrypt.Cipher.Mode.ECB: return "ECB";
+ case GCrypt.Cipher.Mode.CFB: return "CFB";
+ case GCrypt.Cipher.Mode.CBC: return "CBC";
+ case GCrypt.Cipher.Mode.STREAM: return "STREAM";
+ case GCrypt.Cipher.Mode.OFB: return "OFB";
+ case GCrypt.Cipher.Mode.CTR: return "CTR";
+ case GCrypt.Cipher.Mode.AESWRAP: return "AESWRAP";
+ case GCrypt.Cipher.Mode.GCM: return "GCM";
+ case GCrypt.Cipher.Mode.POLY1305: return "POLY1305";
+ case GCrypt.Cipher.Mode.OCB: return "OCB";
+ case GCrypt.Cipher.Mode.CFB8: return "CFB8";
+ // case GCrypt.Cipher.Mode.XTS: return "XTS"; // Not supported in gcrypt < 1.8
+ }
+ return "NONE";
+ }
+
+ private static GCrypt.Cipher.Mode mode_from_string(string name) {
+ switch (name) {
+ case "ECB": return GCrypt.Cipher.Mode.ECB;
+ case "CFB": return GCrypt.Cipher.Mode.CFB;
+ case "CBC": return GCrypt.Cipher.Mode.CBC;
+ case "STREAM": return GCrypt.Cipher.Mode.STREAM;
+ case "OFB": return GCrypt.Cipher.Mode.OFB;
+ case "CTR": return GCrypt.Cipher.Mode.CTR;
+ case "AESWRAP": return GCrypt.Cipher.Mode.AESWRAP;
+ case "GCM": return GCrypt.Cipher.Mode.GCM;
+ case "POLY1305": return GCrypt.Cipher.Mode.POLY1305;
+ case "OCB": return GCrypt.Cipher.Mode.OCB;
+ case "CFB8": return GCrypt.Cipher.Mode.CFB8;
+ // case "XTS": return GCrypt.Cipher.Mode.XTS; // Not supported in gcrypt < 1.8
+ }
+ return GCrypt.Cipher.Mode.NONE;
+ }
+
+ private static string flags_to_string(GCrypt.Cipher.Flag flags) {
+ string? s = null;
+ if ((GCrypt.Cipher.Flag.CBC_MAC & flags) != 0) s = (s == null ? "" : @"$s-") + "MAC";
+ if ((GCrypt.Cipher.Flag.CBC_CTS & flags) != 0) s = (s == null ? "" : @"$s-") + "CTS";
+ if ((GCrypt.Cipher.Flag.ENABLE_SYNC & flags) != 0) s = (s == null ? "" : @"$s-") + "SYNC";
+ if ((GCrypt.Cipher.Flag.SECURE & flags) != 0) s = (s == null ? "" : @"$s-") + "SECURE";
+ return s ?? "NONE";
+ }
+
+ private static GCrypt.Cipher.Flag flag_from_string(string flag_name) {
+ if (flag_name == "SECURE") return GCrypt.Cipher.Flag.SECURE;
+ if (flag_name == "SYNC") return GCrypt.Cipher.Flag.ENABLE_SYNC;
+ if (flag_name == "CTS") return GCrypt.Cipher.Flag.CBC_CTS;
+ if (flag_name == "MAC") return GCrypt.Cipher.Flag.CBC_MAC;
+ return 0;
+ }
+
+ private static GCrypt.Cipher.Flag flags_from_string(string flag_names) {
+ GCrypt.Cipher.Flag flags = 0;
+ foreach(string flag in flag_names.split("-")) {
+ flags |= flag_from_string(flag);
+ }
+ return flags;
+ }
+
+ private static bool parse(string algo_name, out GCrypt.Cipher.Algorithm algo, out GCrypt.Cipher.Mode mode, out GCrypt.Cipher.Flag flags) {
+ algo = GCrypt.Cipher.Algorithm.NONE;
+ mode = GCrypt.Cipher.Mode.NONE;
+ flags = 0;
+ string[] algo_parts = algo_name.split("-", 3);
+
+ algo = GCrypt.Cipher.Algorithm.from_string(algo_parts[0]);
+ if (algo_parts.length >= 2) {
+ mode = mode_from_string(algo_parts[1]);
+ }
+ if (algo_parts.length == 3) {
+ flags |= flags_from_string(algo_parts[2]);
+ }
+ return to_algo_name(algo, mode, flags) == algo_name;
+ }
+
+ private static string to_algo_name(GCrypt.Cipher.Algorithm algo = GCrypt.Cipher.Algorithm.NONE, GCrypt.Cipher.Mode mode = GCrypt.Cipher.Mode.NONE, GCrypt.Cipher.Flag flags = 0) {
+ if (flags != 0) {
+ return @"$algo-$(mode_to_string(mode))-$(flags_to_string(flags))";
+ } else if (mode != GCrypt.Cipher.Mode.NONE) {
+ return @"$algo-$(mode_to_string(mode))";
+ } else {
+ return algo.to_string();
+ }
+ }
+
+ public SymmetricCipherGcrypt(string algo_name) throws Error {
+ GCrypt.Cipher.Algorithm algo;
+ GCrypt.Cipher.Mode mode;
+ GCrypt.Cipher.Flag flags;
+ if (parse(algo_name, out algo, out mode, out flags)) {
+ may_throw_gcrypt_error(GCrypt.Cipher.Cipher.open(out this.cipher, algo, mode, flags));
+ } else {
+ throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+ }
+ }
+
+ public void set_key(uint8[] key) throws Error {
+ may_throw_gcrypt_error(cipher.set_key(key));
+ }
+
+ public void set_iv(uint8[] iv) throws Error {
+ may_throw_gcrypt_error(cipher.set_iv(iv));
+ }
+
+ public void reset() throws Error {
+ may_throw_gcrypt_error(cipher.reset());
+ }
+
+ public uint8[] get_tag(size_t taglen) throws Error {
+ uint8[] tag = new uint8[taglen];
+ may_throw_gcrypt_error(cipher.get_tag(tag));
+ return tag;
+ }
+
+ public void check_tag(uint8[] tag) throws Error {
+ may_throw_gcrypt_error(cipher.check_tag(tag));
+ }
+
+ public int encrypt(uint8[] output, uint8[] input) throws Error {
+ may_throw_gcrypt_error(cipher.encrypt(output, input));
+ return input.length;
+ }
+
+ public int decrypt(uint8[] output, uint8[] input) throws Error {
+ may_throw_gcrypt_error(cipher.decrypt(output, input));
+ return input.length;
+ }
+}
+
+}
diff --git a/crypto-vala/src/cipher_openssl.vala b/crypto-vala/src/cipher_openssl.vala
new file mode 100644
index 00000000..75a0ef9a
--- /dev/null
+++ b/crypto-vala/src/cipher_openssl.vala
@@ -0,0 +1,156 @@
+namespace Crypto {
+
+internal class SymmetricCipherEncryptionOpenssl : SymmetricCipher, SymmetricCipherEncryption, Object {
+ private OpenSSL.EVP.CipherContext? cipher;
+ private bool is_finalized = false;
+
+ public SymmetricCipherEncryptionOpenssl(string algo_name) throws Error {
+ if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+ cipher = new OpenSSL.EVP.CipherContext();
+ }
+
+ public void set_key(uint8[] key) throws Error {
+ unowned OpenSSL.EVP.Cipher algo;
+ if (key.length == 16) {
+ algo = OpenSSL.EVP.aes_128_gcm();
+ } else if (key.length == 32) {
+ algo = OpenSSL.EVP.aes_256_gcm();
+ } else {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM");
+ }
+ try {
+ cipher.encrypt_init(algo, null, null);
+ cipher.encrypt_init(null, key, null);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ }
+
+ public void set_iv(uint8[] iv) throws Error {
+ if (iv.length != 12) {
+ cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null);
+ }
+ try {
+ cipher.encrypt_init(null, null, iv);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ }
+
+ public void reset() throws Error {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context");
+ }
+
+ public uint8[] get_tag(size_t taglen) throws Error {
+ uint8[] tag = new uint8[taglen];
+ if (!is_finalized) {
+ uint8[] empty = new uint8[0];
+ int empty_len = 0;
+ try {
+ cipher.encrypt_final(empty, out empty_len);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ if (empty_len != 0) {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("get_tag called on a stream with remaining data");
+ }
+ }
+ if (cipher.ctrl(OpenSSL.EVP.Control.GCM_GET_TAG, (int)taglen, tag) != 1) {
+ openssl_error();
+ }
+ return tag;
+ }
+
+ public int encrypt(uint8[] output, uint8[] input) throws Error {
+ int output_length = output.length;
+ if (is_finalized) {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("encrypt called after get_tag");
+ }
+ try {
+ cipher.encrypt_update(output, out output_length, input);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ return output_length;
+ }
+}
+
+internal class SymmetricCipherDecryptionOpenssl : SymmetricCipher, SymmetricCipherDecryption, Object {
+ private OpenSSL.EVP.CipherContext? cipher;
+ private bool is_finalized = false;
+
+ public SymmetricCipherDecryptionOpenssl(string algo_name) throws Error {
+ if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+ cipher = new OpenSSL.EVP.CipherContext();
+ try {
+ cipher.decrypt_init(OpenSSL.EVP.aes_128_gcm(), null, null);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ }
+
+ public void set_key(uint8[] key) throws Error {
+ unowned OpenSSL.EVP.Cipher algo;
+ if (key.length == 16) {
+ algo = OpenSSL.EVP.aes_128_gcm();
+ } else if (key.length == 32) {
+ algo = OpenSSL.EVP.aes_256_gcm();
+ } else {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM");
+ }
+ try {
+ cipher.decrypt_init(algo, null, null);
+ cipher.decrypt_init(null, key, null);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ }
+
+ public void set_iv(uint8[] iv) throws Error {
+ if (iv.length != 12) {
+ cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null);
+ }
+ try {
+ cipher.decrypt_init(null, null, iv);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ }
+
+ public void reset() throws Error {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context");
+ }
+
+ public void check_tag(uint8[] tag) throws Error {
+ if (cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_TAG, tag.length, tag) != 1) {
+ openssl_error();
+ }
+ if (!is_finalized) {
+ uint8[] empty = new uint8[0];
+ int empty_len = 0;
+ try {
+ cipher.decrypt_final(empty, out empty_len);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ if (empty_len != 0) {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("check_tag called on a stream with remaining data");
+ }
+ }
+ }
+
+ public int decrypt(uint8[] output, uint8[] input) throws Error {
+ if (is_finalized) {
+ throw new Crypto.Error.ILLEGAL_ARGUMENTS("decrypt called after check_tag");
+ }
+ int output_length = output.length;
+ try {
+ cipher.decrypt_update(output, out output_length, input);
+ } catch (GLib.Error e) {
+ throw new Crypto.Error.OPENSSL(e.message);
+ }
+ return output_length;
+ }
+}
+
+}
diff --git a/crypto-vala/src/error.vala b/crypto-vala/src/error.vala
index 5007d725..a26f39c3 100644
--- a/crypto-vala/src/error.vala
+++ b/crypto-vala/src/error.vala
@@ -3,13 +3,9 @@ namespace Crypto {
public errordomain Error {
ILLEGAL_ARGUMENTS,
GCRYPT,
+ OPENSSL,
AUTHENTICATION_FAILED,
UNKNOWN
}
-internal void may_throw_gcrypt_error(GCrypt.Error e) throws Error {
- if (((int)e) != 0) {
- throw new Crypto.Error.GCRYPT(e.to_string());
- }
}
-} \ No newline at end of file
diff --git a/crypto-vala/src/gcrypt.vala b/crypto-vala/src/gcrypt.vala
new file mode 100644
index 00000000..1997a5e1
--- /dev/null
+++ b/crypto-vala/src/gcrypt.vala
@@ -0,0 +1,21 @@
+namespace Crypto {
+
+public static void randomize(uint8[] buffer) {
+ GCrypt.Random.randomize(buffer);
+}
+
+internal void may_throw_gcrypt_error(GCrypt.Error e) throws Error {
+ if (((int)e) != 0) {
+ throw new Crypto.Error.GCRYPT(e.to_string());
+ }
+}
+
+public SymmetricCipherEncryption create_symmetric_cipher_encryption(string algo_name) throws Error {
+ return new SymmetricCipherGcrypt(algo_name);
+}
+
+public SymmetricCipherDecryption create_symmetric_cipher_decryption(string algo_name) throws Error {
+ return new SymmetricCipherGcrypt(algo_name);
+}
+
+}
diff --git a/crypto-vala/src/openssl.vala b/crypto-vala/src/openssl.vala
new file mode 100644
index 00000000..4a288467
--- /dev/null
+++ b/crypto-vala/src/openssl.vala
@@ -0,0 +1,19 @@
+namespace Crypto {
+
+public static void randomize(uint8[] buffer) {
+ OpenSSL.RAND.bytes(buffer);
+}
+
+internal void openssl_error() throws Error {
+ throw new Crypto.Error.OPENSSL(OpenSSL.ERR.reason_error_string(OpenSSL.ERR.get_error()));
+}
+
+public SymmetricCipherEncryption create_symmetric_cipher_encryption(string algo_name) throws Error {
+ return new SymmetricCipherEncryptionOpenssl(algo_name);
+}
+
+public SymmetricCipherDecryption create_symmetric_cipher_decryption(string algo_name) throws Error {
+ return new SymmetricCipherDecryptionOpenssl(algo_name);
+}
+
+}
diff --git a/crypto-vala/src/random.vala b/crypto-vala/src/random.vala
deleted file mode 100644
index 3f5d3ba9..00000000
--- a/crypto-vala/src/random.vala
+++ /dev/null
@@ -1,5 +0,0 @@
-namespace Crypto {
-public static void randomize(uint8[] buffer) {
- GCrypt.Random.randomize(buffer);
-}
-} \ No newline at end of file
generated by cgit v1.3 (git 2.53.0) at 2026-11-04 08:34:06 +0000