From 76a91fca2fc7dd5975e8ff0e6695f27c98539dba Mon Sep 17 00:00:00 2001 From: hrxi Date: Fri, 24 Nov 2023 20:53:50 +0100 Subject: Add support for OpenSSL Uses work by @hrxi in https://github.com/dino/dino/pull/1515 Co-Authored-By: hrxi --- crypto-vala/src/cipher_openssl.vala | 156 ++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 crypto-vala/src/cipher_openssl.vala (limited to 'crypto-vala/src/cipher_openssl.vala') diff --git a/crypto-vala/src/cipher_openssl.vala b/crypto-vala/src/cipher_openssl.vala new file mode 100644 index 00000000..75a0ef9a --- /dev/null +++ b/crypto-vala/src/cipher_openssl.vala @@ -0,0 +1,156 @@ +namespace Crypto { + +internal class SymmetricCipherEncryptionOpenssl : SymmetricCipher, SymmetricCipherEncryption, Object { + private OpenSSL.EVP.CipherContext? cipher; + private bool is_finalized = false; + + public SymmetricCipherEncryptionOpenssl(string algo_name) throws Error { + if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported"); + cipher = new OpenSSL.EVP.CipherContext(); + } + + public void set_key(uint8[] key) throws Error { + unowned OpenSSL.EVP.Cipher algo; + if (key.length == 16) { + algo = OpenSSL.EVP.aes_128_gcm(); + } else if (key.length == 32) { + algo = OpenSSL.EVP.aes_256_gcm(); + } else { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM"); + } + try { + cipher.encrypt_init(algo, null, null); + cipher.encrypt_init(null, key, null); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + } + + public void set_iv(uint8[] iv) throws Error { + if (iv.length != 12) { + cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null); + } + try { + cipher.encrypt_init(null, null, iv); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + } + + public void reset() throws Error { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context"); + } + + public uint8[] get_tag(size_t taglen) throws Error { + uint8[] tag = new uint8[taglen]; + if (!is_finalized) { + uint8[] empty = new uint8[0]; + int empty_len = 0; + try { + cipher.encrypt_final(empty, out empty_len); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + if (empty_len != 0) { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("get_tag called on a stream with remaining data"); + } + } + if (cipher.ctrl(OpenSSL.EVP.Control.GCM_GET_TAG, (int)taglen, tag) != 1) { + openssl_error(); + } + return tag; + } + + public int encrypt(uint8[] output, uint8[] input) throws Error { + int output_length = output.length; + if (is_finalized) { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("encrypt called after get_tag"); + } + try { + cipher.encrypt_update(output, out output_length, input); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + return output_length; + } +} + +internal class SymmetricCipherDecryptionOpenssl : SymmetricCipher, SymmetricCipherDecryption, Object { + private OpenSSL.EVP.CipherContext? cipher; + private bool is_finalized = false; + + public SymmetricCipherDecryptionOpenssl(string algo_name) throws Error { + if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported"); + cipher = new OpenSSL.EVP.CipherContext(); + try { + cipher.decrypt_init(OpenSSL.EVP.aes_128_gcm(), null, null); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + } + + public void set_key(uint8[] key) throws Error { + unowned OpenSSL.EVP.Cipher algo; + if (key.length == 16) { + algo = OpenSSL.EVP.aes_128_gcm(); + } else if (key.length == 32) { + algo = OpenSSL.EVP.aes_256_gcm(); + } else { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM"); + } + try { + cipher.decrypt_init(algo, null, null); + cipher.decrypt_init(null, key, null); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + } + + public void set_iv(uint8[] iv) throws Error { + if (iv.length != 12) { + cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null); + } + try { + cipher.decrypt_init(null, null, iv); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + } + + public void reset() throws Error { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context"); + } + + public void check_tag(uint8[] tag) throws Error { + if (cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_TAG, tag.length, tag) != 1) { + openssl_error(); + } + if (!is_finalized) { + uint8[] empty = new uint8[0]; + int empty_len = 0; + try { + cipher.decrypt_final(empty, out empty_len); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + if (empty_len != 0) { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("check_tag called on a stream with remaining data"); + } + } + } + + public int decrypt(uint8[] output, uint8[] input) throws Error { + if (is_finalized) { + throw new Crypto.Error.ILLEGAL_ARGUMENTS("decrypt called after check_tag"); + } + int output_length = output.length; + try { + cipher.decrypt_update(output, out output_length, input); + } catch (GLib.Error e) { + throw new Crypto.Error.OPENSSL(e.message); + } + return output_length; + } +} + +} -- cgit v1.3