Skip to content

Commit dc3b60b

Browse files
boazsegevboazsegev
committed
use encryption function pointers with asymmetric ED25519 encryption
1 parent f7748af commit dc3b60b

File tree

5 files changed

+251
-75
lines changed

5 files changed

+251
-75
lines changed

‎fio-stl.h‎

Lines changed: 41 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4189,8 +4189,9 @@ FIO_BASIC Basic Kitchen Sink Inclusion
41894189
/* *****************************************************************************
41904190
FIO_CRYPT Poor-man's Cryptographic Elements
41914191
***************************************************************************** */
4192-
#if defined(FIO_CRYPT)
4192+
#if defined(FIO_CRYPT) || defined(FIO_CRYPTO)
41934193
#undef FIO_CRYPT
4194+
#undef FIO_CRYPTO
41944195
#undef FIO_AES
41954196
#undef FIO_CRYPTO_CORE
41964197
#undef FIO_CHACHA
@@ -4208,7 +4209,7 @@ FIO_CRYPT Poor-man's Cryptographic Elements
42084209
#define FIO_SECRET
42094210
#define FIO_OTP
42104211

4211-
#endif /* FIO_CRYPT */
4212+
#endif /* FIO_CRYPT || defined(FIO_CRYPTO) */
42124213

42134214
/* *****************************************************************************
42144215
FIO_CORE Core Inclusion
@@ -4428,7 +4429,7 @@ FIO_MAP Ordering & Naming Shortcut
44284429

44294430

44304431
***************************************************************************** */
4431-
#if defined(FIO_PUBSUB) || defined(FIO_ED25519)
4432+
#if defined(FIO_PUBSUB)
44324433
#define FIO_CHACHA
44334434
#define FIO_SECRET
44344435
#endif
@@ -23052,6 +23053,21 @@ Copyright and License: see header file (000 copyright.h) or top of file
2305223053
***************************************************************************** */
2305323054
#define H___FIO_CRYPTO_CORE___H
2305423055

23056+
typedef void(fio_crypto_enc_fn)(void *restrict mac,
23057+
void *restrict data,
23058+
size_t len,
23059+
const void *ad, /* additional data */
23060+
size_t adlen,
23061+
const void *key,
23062+
const void *nonce);
23063+
typedef int(fio_crypto_dec_fn)(void *restrict mac,
23064+
void *restrict data,
23065+
size_t len,
23066+
const void *ad, /* additional data */
23067+
size_t adlen,
23068+
const void *key,
23069+
const void *nonce);
23070+
2305523071
/* *****************************************************************************
2305623072
Module Implementation - possibly externed functions.
2305723073
***************************************************************************** */
@@ -27936,12 +27952,10 @@ their private key. No prior key exchange or handshake is required.
2793627952
The scheme uses:
2793727953
- X25519 for ephemeral key agreement
2793827954
- SHA-256 for key derivation (HKDF-like)
27939-
- ChaCha20-Poly1305 for authenticated encryption
27955+
- ChaCha20-Poly1305 or AES256-GCM for authenticated encryption
2794027956

2794127957
Ciphertext format: [32-byte ephemeral public key][16-byte MAC][encrypted data]
2794227958
Total overhead: 48 bytes
27943-
27944-
Note: Requires FIO_CHACHA to be defined for ChaCha20-Poly1305 support.
2794527959
***************************************************************************** */
2794627960

2794727961
/**
@@ -27957,12 +27971,14 @@ Note: Requires FIO_CHACHA to be defined for ChaCha20-Poly1305 support.
2795727971
* @param ciphertext Output buffer (must be at least message_len + 48 bytes)
2795827972
* @param message The plaintext message to encrypt
2795927973
* @param message_len Length of the message
27974+
* @param encryption_function Encryption function (fio_chacha20_poly1305_enc)
2796027975
* @param recipient_pk The recipient's X25519 public key (32 bytes)
2796127976
* @return 0 on success, -1 on failure
2796227977
*/
2796327978
SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
2796427979
const void *message,
2796527980
size_t message_len,
27981+
fio_crypto_enc_fn encryption_function,
2796627982
const uint8_t recipient_pk[32]);
2796727983

2796827984
/**
@@ -27971,12 +27987,14 @@ SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
2797127987
* @param plaintext Output buffer (must be at least ciphertext_len - 48 bytes)
2797227988
* @param ciphertext The ciphertext (ephemeral_pk || mac || encrypted_data)
2797327989
* @param ciphertext_len Length of the ciphertext (must be >= 48)
27990+
* @param decryption_function Decryption function (fio_chacha20_poly1305_dec)
2797427991
* @param recipient_sk The recipient's X25519 secret key (32 bytes)
2797527992
* @return 0 on success, -1 on failure (authentication failed or invalid input)
2797627993
*/
2797727994
SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
2797827995
const uint8_t *ciphertext,
2797927996
size_t ciphertext_len,
27997+
fio_crypto_dec_fn decryption_function,
2798027998
const uint8_t recipient_sk[32]);
2798127999

2798228000
/**
@@ -27990,7 +28008,7 @@ SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
2799028008
* Returns 0 if ciphertext_len < 48 (invalid ciphertext).
2799128009
*/
2799228010
#define FIO_X25519_PLAINTEXT_LEN(ciphertext_len) \
27993-
((ciphertext_len) >= 48 ? ((ciphertext_len)-48) : 0)
28011+
((ciphertext_len) > 48 ? ((ciphertext_len)-48) : 0)
2799428012

2799528013
/* *****************************************************************************
2799628014
Implementation - possibly externed functions.
@@ -29054,6 +29072,7 @@ Format: [32-byte ephemeral public key][16-byte MAC][encrypted data]
2905429072
SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
2905529073
const void *message,
2905629074
size_t message_len,
29075+
fio_crypto_enc_fn encryption_function,
2905729076
const uint8_t recipient_pk[32]) {
2905829077
/* generate ephemeral key pair */
2905929078
uint8_t eph_sk[32], eph_pk[32];
@@ -29085,13 +29104,13 @@ SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
2908529104

2908629105
/* encrypt with chacha20-poly1305 */
2908729106
/* nonce: first 12 bytes of ephemeral public key (unique per encryption) */
29088-
fio_chacha20_poly1305_enc(ciphertext + 32, /* mac output */
29089-
ciphertext + 48, /* data to encrypt */
29090-
message_len, /* data length */
29091-
ciphertext, /* additional data: eph_pk */
29092-
32, /* ad length */
29093-
key.u8, /* encryption key */
29094-
eph_pk); /* nonce (first 12 bytes) */
29107+
encryption_function(ciphertext + 32, /* mac output */
29108+
ciphertext + 48, /* data to encrypt */
29109+
message_len, /* data length */
29110+
ciphertext, /* additional data: eph_pk */
29111+
32, /* ad length */
29112+
key.u8, /* encryption key */
29113+
eph_pk); /* nonce (first 12 bytes) */
2909529114

2909629115
fio_secure_zero(&key, sizeof(key));
2909729116
return 0;
@@ -29100,6 +29119,7 @@ SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
2910029119
SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
2910129120
const uint8_t *ciphertext,
2910229121
size_t ciphertext_len,
29122+
fio_crypto_dec_fn decryption_function,
2910329123
const uint8_t recipient_sk[32]) {
2910429124
/* validate minimum ciphertext length */
2910529125
if (ciphertext_len < 48)
@@ -29133,13 +29153,13 @@ SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
2913329153
fio_memcpy16(mac_copy, mac);
2913429154

2913529155
/* decrypt and verify with chacha20-poly1305 */
29136-
int result = fio_chacha20_poly1305_dec(mac_copy, /* mac to verify */
29137-
plaintext, /* data to decrypt */
29138-
message_len, /* data length */
29139-
eph_pk, /* additional data */
29140-
32, /* ad length */
29141-
key.u8, /* decryption key */
29142-
eph_pk); /* nonce */
29156+
int result = decryption_function(mac_copy, /* mac to verify */
29157+
plaintext, /* data to decrypt */
29158+
message_len, /* data length */
29159+
eph_pk, /* additional data */
29160+
32, /* ad length */
29161+
key.u8, /* decryption key */
29162+
eph_pk); /* nonce */
2914329163

2914429164
fio_secure_zero(&key, sizeof(key));
2914529165
return result;

‎fio-stl/000 dependencies.h‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,9 @@ FIO_BASIC Basic Kitchen Sink Inclusion
128128
/* *****************************************************************************
129129
FIO_CRYPT Poor-man's Cryptographic Elements
130130
***************************************************************************** */
131-
#if defined(FIO_CRYPT)
131+
#if defined(FIO_CRYPT) || defined(FIO_CRYPTO)
132132
#undef FIO_CRYPT
133+
#undef FIO_CRYPTO
133134
#undef FIO_AES
134135
#undef FIO_CRYPTO_CORE
135136
#undef FIO_CHACHA
@@ -147,7 +148,7 @@ FIO_CRYPT Poor-man's Cryptographic Elements
147148
#define FIO_SECRET
148149
#define FIO_OTP
149150

150-
#endif /* FIO_CRYPT */
151+
#endif /* FIO_CRYPT || defined(FIO_CRYPTO) */
151152

152153
/* *****************************************************************************
153154
FIO_CORE Core Inclusion
@@ -367,7 +368,7 @@ FIO_MAP Ordering & Naming Shortcut
367368
368369
369370
***************************************************************************** */
370-
#if defined(FIO_PUBSUB) || defined(FIO_ED25519)
371+
#if defined(FIO_PUBSUB)
371372
#define FIO_CHACHA
372373
#define FIO_SECRET
373374
#endif

‎fio-stl/150 crypto core.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,21 @@ Copyright and License: see header file (000 copyright.h) or top of file
2323
***************************************************************************** */
2424
#define H___FIO_CRYPTO_CORE___H
2525

26+
typedef void(fio_crypto_enc_fn)(void *restrict mac,
27+
void *restrict data,
28+
size_t len,
29+
const void *ad, /* additional data */
30+
size_t adlen,
31+
const void *key,
32+
const void *nonce);
33+
typedef int(fio_crypto_dec_fn)(void *restrict mac,
34+
void *restrict data,
35+
size_t len,
36+
const void *ad, /* additional data */
37+
size_t adlen,
38+
const void *key,
39+
const void *nonce);
40+
2641
/* *****************************************************************************
2742
Module Implementation - possibly externed functions.
2843
***************************************************************************** */

‎fio-stl/154 ed25519.h‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -165,12 +165,10 @@ their private key. No prior key exchange or handshake is required.
165165
The scheme uses:
166166
- X25519 for ephemeral key agreement
167167
- SHA-256 for key derivation (HKDF-like)
168-
- ChaCha20-Poly1305 for authenticated encryption
168+
- ChaCha20-Poly1305 or AES256-GCM for authenticated encryption
169169
170170
Ciphertext format: [32-byte ephemeral public key][16-byte MAC][encrypted data]
171171
Total overhead: 48 bytes
172-
173-
Note: Requires FIO_CHACHA to be defined for ChaCha20-Poly1305 support.
174172
***************************************************************************** */
175173

176174
/**
@@ -186,12 +184,14 @@ Note: Requires FIO_CHACHA to be defined for ChaCha20-Poly1305 support.
186184
* @param ciphertext Output buffer (must be at least message_len + 48 bytes)
187185
* @param message The plaintext message to encrypt
188186
* @param message_len Length of the message
187+
* @param encryption_function Encryption function (fio_chacha20_poly1305_enc)
189188
* @param recipient_pk The recipient's X25519 public key (32 bytes)
190189
* @return 0 on success, -1 on failure
191190
*/
192191
SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
193192
const void *message,
194193
size_t message_len,
194+
fio_crypto_enc_fn encryption_function,
195195
const uint8_t recipient_pk[32]);
196196

197197
/**
@@ -200,12 +200,14 @@ SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
200200
* @param plaintext Output buffer (must be at least ciphertext_len - 48 bytes)
201201
* @param ciphertext The ciphertext (ephemeral_pk || mac || encrypted_data)
202202
* @param ciphertext_len Length of the ciphertext (must be >= 48)
203+
* @param decryption_function Decryption function (fio_chacha20_poly1305_dec)
203204
* @param recipient_sk The recipient's X25519 secret key (32 bytes)
204205
* @return 0 on success, -1 on failure (authentication failed or invalid input)
205206
*/
206207
SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
207208
const uint8_t *ciphertext,
208209
size_t ciphertext_len,
210+
fio_crypto_dec_fn decryption_function,
209211
const uint8_t recipient_sk[32]);
210212

211213
/**
@@ -219,7 +221,7 @@ SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
219221
* Returns 0 if ciphertext_len < 48 (invalid ciphertext).
220222
*/
221223
#define FIO_X25519_PLAINTEXT_LEN(ciphertext_len) \
222-
((ciphertext_len) >= 48 ? ((ciphertext_len)-48) : 0)
224+
((ciphertext_len) > 48 ? ((ciphertext_len)-48) : 0)
223225

224226
/* *****************************************************************************
225227
Implementation - possibly externed functions.
@@ -1283,6 +1285,7 @@ Format: [32-byte ephemeral public key][16-byte MAC][encrypted data]
12831285
SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
12841286
const void *message,
12851287
size_t message_len,
1288+
fio_crypto_enc_fn encryption_function,
12861289
const uint8_t recipient_pk[32]) {
12871290
/* generate ephemeral key pair */
12881291
uint8_t eph_sk[32], eph_pk[32];
@@ -1314,13 +1317,13 @@ SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
13141317

13151318
/* encrypt with chacha20-poly1305 */
13161319
/* nonce: first 12 bytes of ephemeral public key (unique per encryption) */
1317-
fio_chacha20_poly1305_enc(ciphertext + 32, /* mac output */
1318-
ciphertext + 48, /* data to encrypt */
1319-
message_len, /* data length */
1320-
ciphertext, /* additional data: eph_pk */
1321-
32, /* ad length */
1322-
key.u8, /* encryption key */
1323-
eph_pk); /* nonce (first 12 bytes) */
1320+
encryption_function(ciphertext + 32, /* mac output */
1321+
ciphertext + 48, /* data to encrypt */
1322+
message_len, /* data length */
1323+
ciphertext, /* additional data: eph_pk */
1324+
32, /* ad length */
1325+
key.u8, /* encryption key */
1326+
eph_pk); /* nonce (first 12 bytes) */
13241327

13251328
fio_secure_zero(&key, sizeof(key));
13261329
return 0;
@@ -1329,6 +1332,7 @@ SFUNC int fio_x25519_encrypt(uint8_t *ciphertext,
13291332
SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
13301333
const uint8_t *ciphertext,
13311334
size_t ciphertext_len,
1335+
fio_crypto_dec_fn decryption_function,
13321336
const uint8_t recipient_sk[32]) {
13331337
/* validate minimum ciphertext length */
13341338
if (ciphertext_len < 48)
@@ -1362,13 +1366,13 @@ SFUNC int fio_x25519_decrypt(uint8_t *plaintext,
13621366
fio_memcpy16(mac_copy, mac);
13631367

13641368
/* decrypt and verify with chacha20-poly1305 */
1365-
int result = fio_chacha20_poly1305_dec(mac_copy, /* mac to verify */
1366-
plaintext, /* data to decrypt */
1367-
message_len, /* data length */
1368-
eph_pk, /* additional data */
1369-
32, /* ad length */
1370-
key.u8, /* decryption key */
1371-
eph_pk); /* nonce */
1369+
int result = decryption_function(mac_copy, /* mac to verify */
1370+
plaintext, /* data to decrypt */
1371+
message_len, /* data length */
1372+
eph_pk, /* additional data */
1373+
32, /* ad length */
1374+
key.u8, /* decryption key */
1375+
eph_pk); /* nonce */
13721376

13731377
fio_secure_zero(&key, sizeof(key));
13741378
return result;

0 commit comments

Comments
 (0)