From 1c2135506825ae80966fe2797613806916b7e3c0 Mon Sep 17 00:00:00 2001

From: Daiki Ueno <dueno@redhat.com>

Date: Wed, 6 Nov 2019 12:07:24 +0100

Subject: [PATCH 1/2] nettle: backport fixes to cfb8_decrypt

cfb8: don't truncate output IV if input is shorter than block size:

https://git.lysator.liu.se/nettle/nettle/commit/f4a9c842621baf5d71aa9cc3989851f44dc46861

Signed-off-by: Daiki Ueno <dueno@redhat.com>

---

 lib/nettle/backport/cfb8.c | 10 ++++++----

 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/nettle/backport/cfb8.c b/lib/nettle/backport/cfb8.c

index e9816feb7..1762192f4 100644

--- a/lib/nettle/backport/cfb8.c

+++ b/lib/nettle/backport/cfb8.c

@@ -110,10 +110,12 @@ cfb8_decrypt(const void *ctx, nettle_cipher_func *f,

       src += i;

       dst += i;

-      memcpy(buffer, buffer + block_size, block_size);

-      memcpy(buffer + block_size, src,

-	     length < block_size ? length : block_size);

-

+      if (i == block_size)

+	{

+	  memcpy(buffer, buffer + block_size, block_size);

+	  memcpy(buffer + block_size, src,

+		 length < block_size ? length : block_size);

+	}

     }

   memcpy(iv, buffer + i, block_size);

-- 

2.21.0

From cc01347302678719f0bcfb4f3383fe0f1e905ed8 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>

Date: Wed, 6 Nov 2019 13:17:57 +0100

Subject: [PATCH 2/2] crypto-selftests: test CFB8 ciphers with different

 chunksizes

Signed-off-by: Guenther Deschner <gd@samba.org>

Signed-off-by: Daiki Ueno <dueno@redhat.com>

---

 lib/crypto-selftests.c | 124 +++++++++++++++++++++++++++++++++++++++--

 1 file changed, 118 insertions(+), 6 deletions(-)

diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c

index 6caf817e8..5f0a4ec8b 100644

--- a/lib/crypto-selftests.c

+++ b/lib/crypto-selftests.c

@@ -710,6 +710,107 @@ static int test_cipher(gnutls_cipher_algorithm_t cipher,

 	return 0;

 }

+static int test_cipher_all_block_sizes(gnutls_cipher_algorithm_t cipher,

+				       const struct cipher_vectors_st *vectors,

+				       size_t vectors_size, unsigned flags)

+{

+	gnutls_cipher_hd_t hd;

+	int ret;

+	unsigned int i;

+	uint8_t tmp[384];

+	gnutls_datum_t key, iv = {NULL, 0};

+	size_t block;

+	size_t offset;

+

+	for (i = 0; i < vectors_size; i++) {

+		for (block = 1; block <= vectors[i].plaintext_size; block++) {

+			key.data = (void *) vectors[i].key;

+			key.size = vectors[i].key_size;

+

+			iv.data = (void *) vectors[i].iv;

+			iv.size = gnutls_cipher_get_iv_size(cipher);

+

+			if (iv.size != vectors[i].iv_size)

+				return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);

+

+			ret = gnutls_cipher_init(&hd, cipher, &key, &iv;;

+			if (ret < 0) {

+				_gnutls_debug_log("error initializing: %s\n",

+						  gnutls_cipher_get_name(cipher));

+				return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);

+			}

+

+			for (offset = 0;

+			     offset < vectors[i].plaintext_size;

+			     offset += block) {

+				ret =

+				    gnutls_cipher_encrypt2(hd,

+							   vectors[i].plaintext + offset,

+							   MIN(block, vectors[i].plaintext_size - offset),

+							   tmp + offset,

+							   sizeof(tmp) - offset);

+				if (ret < 0)

+					return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);

+			}

+

+			if (memcmp

+			    (tmp, vectors[i].ciphertext,

+			     vectors[i].plaintext_size) != 0) {

+				_gnutls_debug_log("%s encryption of test vector %d failed with block size %d/%d!\n",

+						  gnutls_cipher_get_name(cipher),

+						  i, (int)block, (int)vectors[i].plaintext_size);

+				return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);

+			}

+

+			gnutls_cipher_deinit(hd);

+		}

+	}

+

+	for (i = 0; i < vectors_size; i++) {

+		for (block = 1; block <= vectors[i].plaintext_size; block++) {

+			key.data = (void *) vectors[i].key;

+			key.size = vectors[i].key_size;

+

+			iv.data = (void *) vectors[i].iv;

+			iv.size = gnutls_cipher_get_iv_size(cipher);

+

+			ret = gnutls_cipher_init(&hd, cipher, &key, &iv;;

+			if (ret < 0)

+				return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);

+

+			for (offset = 0;

+			     offset + block <= vectors[i].plaintext_size;

+			     offset += block) {

+				ret =

+				    gnutls_cipher_decrypt2(hd,

+							   vectors[i].ciphertext + offset,

+							   MIN(block, vectors[i].plaintext_size - offset),

+							   tmp + offset,

+							   sizeof(tmp) - offset);

+				if (ret < 0)

+					return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);

+			}

+

+			if (memcmp

+			    (tmp, vectors[i].plaintext,

+			     vectors[i].plaintext_size) != 0) {

+				_gnutls_debug_log("%s decryption of test vector %d failed with block size %d!\n",

+						  gnutls_cipher_get_name(cipher),

+						  i, (int)block);

+				return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);

+			}

+

+			gnutls_cipher_deinit(hd);

+		}

+	}

+

+	_gnutls_debug_log

+	    ("%s self check succeeded\n",

+	     gnutls_cipher_get_name(cipher));

+

+	return 0;

+}

+

 /* AEAD modes (compat APIs) */

 static int test_cipher_aead_compat(gnutls_cipher_algorithm_t cipher,

 			    const struct cipher_aead_vectors_st *vectors,

@@ -1721,6 +1822,14 @@ static int test_mac(gnutls_mac_algorithm_t mac,

 			if (!(flags & GNUTLS_SELF_TEST_FLAG_ALL) || ret < 0) \

 				return ret

+#define CASE2(x, func, func2, vectors) case x:	  \

+			ret = func(x, V(vectors), flags); \

+			if (!(flags & GNUTLS_SELF_TEST_FLAG_ALL) || ret < 0) \

+				return ret; \

+			ret = func2(x, V(vectors), flags); \

+			if (!(flags & GNUTLS_SELF_TEST_FLAG_ALL) || ret < 0) \

+				return ret

+

 #define NON_FIPS_CASE(x, func, vectors) case x: \

 			if (_gnutls_fips_mode_enabled() == 0) { \

 				ret = func(x, V(vectors), flags); \

@@ -1786,14 +1895,17 @@ int gnutls_cipher_self_test(unsigned flags, gnutls_cipher_algorithm_t cipher)

 		NON_FIPS_CASE(GNUTLS_CIPHER_CHACHA20_POLY1305, test_cipher_aead,

 		     chacha_poly1305_vectors);

 		FALLTHROUGH;

-		CASE(GNUTLS_CIPHER_AES_128_CFB8, test_cipher,

-		     aes128_cfb8_vectors);

+		CASE2(GNUTLS_CIPHER_AES_128_CFB8, test_cipher,

+		      test_cipher_all_block_sizes,

+		      aes128_cfb8_vectors);

 		FALLTHROUGH;

-		CASE(GNUTLS_CIPHER_AES_192_CFB8, test_cipher,

-		     aes192_cfb8_vectors);

+		CASE2(GNUTLS_CIPHER_AES_192_CFB8, test_cipher,

+		      test_cipher_all_block_sizes,

+		      aes192_cfb8_vectors);

 		FALLTHROUGH;

-		CASE(GNUTLS_CIPHER_AES_256_CFB8, test_cipher,

-		     aes256_cfb8_vectors);

+		CASE2(GNUTLS_CIPHER_AES_256_CFB8, test_cipher,

+		      test_cipher_all_block_sizes,

+		      aes256_cfb8_vectors);

 		FALLTHROUGH;

 		CASE(GNUTLS_CIPHER_AES_128_XTS, test_cipher,

 		     aes128_xts_vectors);

-- 

2.21.0