FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: make authTagLength optional for CC20P1305 · nodejs/node@7124f91 · GitHub

/ node Public

Commit 7124f91

Browse files
tniessen
authored and
juanarbol
committed
crypto: make authTagLength optional for CC20P1305
PR-URL: #42427 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
1 parent 334cc19 commit 7124f91

3 files changed

Lines changed: 80 additions & 15 deletions

File tree

‎doc/api/crypto.md‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2926,6 +2926,10 @@ Checks the primality of the `candidate`.
29262926
added: v0.1.94
29272927
deprecated: v10.0.0
29282928
changes:
2929+
- version: REPLACEME
2930+
pr-url: https://github.com/nodejs/node/pull/42427
2931+
description: The `authTagLength` option is now optional when using the
2932+
`chacha20-poly1305` cipher and defaults to 16 bytes.
29292933
- version: v15.0.0
29302934
pr-url: https://github.com/nodejs/node/pull/35093
29312935
description: The password argument can be an ArrayBuffer and is limited to
@@ -2950,12 +2954,12 @@ Creates and returns a `Cipher` object that uses the given `algorithm` and
29502954
`password`.
29512955

29522956
The `options` argument controls stream behavior and is optional except when a
2953-
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) or `chacha20-poly1305` is used.
2954-
In that case, the
2957+
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
29552958
`authTagLength` option is required and specifies the length of the
29562959
authentication tag in bytes, see [CCM mode][]. In GCM mode, the `authTagLength`
29572960
option is not required but can be used to set the length of the authentication
29582961
tag that will be returned by `getAuthTag()` and defaults to 16 bytes.
2962+
For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
29592963

29602964
The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
29612965
recent OpenSSL releases, `openssl list -cipher-algorithms` will
@@ -2986,6 +2990,10 @@ Adversaries][] for details.
29862990
<!-- YAML
29872991
added: v0.1.94
29882992
changes:
2993+
- version: REPLACEME
2994+
pr-url: https://github.com/nodejs/node/pull/42427
2995+
description: The `authTagLength` option is now optional when using the
2996+
`chacha20-poly1305` cipher and defaults to 16 bytes.
29892997
- version: v15.0.0
29902998
pr-url: https://github.com/nodejs/node/pull/35093
29912999
description: The password and iv arguments can be an ArrayBuffer and are
@@ -3022,12 +3030,12 @@ Creates and returns a `Cipher` object, with the given `algorithm`, `key` and
30223030
initialization vector (`iv`).
30233031

30243032
The `options` argument controls stream behavior and is optional except when a
3025-
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) or `chacha20-poly1305` is used.
3026-
In that case, the
3033+
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
30273034
`authTagLength` option is required and specifies the length of the
30283035
authentication tag in bytes, see [CCM mode][]. In GCM mode, the `authTagLength`
30293036
option is not required but can be used to set the length of the authentication
30303037
tag that will be returned by `getAuthTag()` and defaults to 16 bytes.
3038+
For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
30313039

30323040
The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
30333041
recent OpenSSL releases, `openssl list -cipher-algorithms` will
@@ -3055,6 +3063,10 @@ given IV will be.
30553063
added: v0.1.94
30563064
deprecated: v10.0.0
30573065
changes:
3066+
- version: REPLACEME
3067+
pr-url: https://github.com/nodejs/node/pull/42427
3068+
description: The `authTagLength` option is now optional when using the
3069+
`chacha20-poly1305` cipher and defaults to 16 bytes.
30583070
- version: v10.10.0
30593071
pr-url: https://github.com/nodejs/node/pull/21447
30603072
description: Ciphers in OCB mode are now supported.
@@ -3071,10 +3083,10 @@ Creates and returns a `Decipher` object that uses the given `algorithm` and
30713083
`password` (key).
30723084

30733085
The `options` argument controls stream behavior and is optional except when a
3074-
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) or `chacha20-poly1305` is used.
3075-
In that case, the
3086+
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
30763087
`authTagLength` option is required and specifies the length of the
30773088
authentication tag in bytes, see [CCM mode][].
3089+
For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
30783090

30793091
The implementation of `crypto.createDecipher()` derives keys using the OpenSSL
30803092
function [`EVP_BytesToKey`][] with the digest algorithm set to MD5, one
@@ -3093,6 +3105,10 @@ to create the `Decipher` object.
30933105
<!-- YAML
30943106
added: v0.1.94
30953107
changes:
3108+
- version: REPLACEME
3109+
pr-url: https://github.com/nodejs/node/pull/42427
3110+
description: The `authTagLength` option is now optional when using the
3111+
`chacha20-poly1305` cipher and defaults to 16 bytes.
30963112
- version: v11.6.0
30973113
pr-url: https://github.com/nodejs/node/pull/24234
30983114
description: The `key` argument can now be a `KeyObject`.
@@ -3125,12 +3141,12 @@ Creates and returns a `Decipher` object that uses the given `algorithm`, `key`
31253141
and initialization vector (`iv`).
31263142

31273143
The `options` argument controls stream behavior and is optional except when a
3128-
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) or `chacha20-poly1305` is used.
3129-
In that case, the
3144+
cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
31303145
`authTagLength` option is required and specifies the length of the
31313146
authentication tag in bytes, see [CCM mode][]. In GCM mode, the `authTagLength`
31323147
option is not required but can be used to restrict accepted authentication tags
31333148
to those with the specified length.
3149+
For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
31343150

31353151
The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
31363152
recent OpenSSL releases, `openssl list -cipher-algorithms` will

‎src/crypto/crypto_cipher.cc‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -571,9 +571,17 @@ bool CipherBase::InitAuthenticated(
571571
}
572572
} else {
573573
if (auth_tag_len == kNoAuthTagLength) {
574-
THROW_ERR_CRYPTO_INVALID_AUTH_TAG(
575-
env(), "authTagLength required for %s", cipher_type);
576-
return false;
574+
// We treat ChaCha20-Poly1305 specially. Like GCM, the authentication tag
575+
// length defaults to 16 bytes when encrypting. Unlike GCM, the
576+
// authentication tag length also defaults to 16 bytes when decrypting,
577+
// whereas GCM would accept any valid authentication tag length.
578+
if (EVP_CIPHER_CTX_nid(ctx_.get()) == NID_chacha20_poly1305) {
579+
auth_tag_len = 16;
580+
} else {
581+
THROW_ERR_CRYPTO_INVALID_AUTH_TAG(
582+
env(), "authTagLength required for %s", cipher_type);
583+
return false;
584+
}
577585
}
578586

579587
// TODO(tniessen) Support CCM decryption in FIPS mode

‎test/parallel/test-crypto-authenticated.js‎

Lines changed: 45 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,9 @@ for (const test of TEST_CASES) {
9696

9797
const isCCM = /^aes-(128|192|256)-ccm$/.test(test.algo);
9898
const isOCB = /^aes-(128|192|256)-ocb$/.test(test.algo);
99-
const isChacha20Poly1305 = test.algo === 'chacha20-poly1305';
10099

101100
let options;
102-
if (isCCM || isOCB || isChacha20Poly1305)
101+
if (isCCM || isOCB)
103102
options = { authTagLength: test.tag.length / 2 };
104103

105104
const inputEncoding = test.plainIsHex ? 'hex' : 'ascii';
@@ -659,8 +658,7 @@ for (const test of TEST_CASES) {
659658
assert.throws(() => crypto.createCipheriv(
660659
valid.algo,
661660
Buffer.from(valid.key, 'hex'),
662-
Buffer.from(H(prefix) + valid.iv, 'hex'),
663-
{ authTagLength: valid.tag.length / 2 }
661+
Buffer.from(H(prefix) + valid.iv, 'hex')
664662
), errMessages.length, `iv length ${ivLength} was not rejected`);
665663

666664
function H(length) { return '00'.repeat(length); }
@@ -745,3 +743,46 @@ for (const test of TEST_CASES) {
745743
}
746744
}
747745
}
746+
747+
// ChaCha20-Poly1305 should default to an authTagLength of 16. When encrypting,
748+
// this matches the behavior of GCM ciphers. When decrypting, however, it is
749+
// stricter than GCM in that it only allows authentication tags that are exactly
750+
// 16 bytes long, whereas, when no authTagLength was specified, GCM would accept
751+
// shorter tags as long as their length was valid according to NIST SP 800-38D.
752+
// For ChaCha20-Poly1305, we intentionally deviate from that because there are
753+
// no recommended or approved authentication tag lengths below 16 bytes.
754+
{
755+
const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
756+
return algo === 'chacha20-poly1305' && tampered === false;
757+
});
758+
assert.strictEqual(rfcTestCases.length, 1);
759+
760+
const [testCase] = rfcTestCases;
761+
const key = Buffer.from(testCase.key, 'hex');
762+
const iv = Buffer.from(testCase.iv, 'hex');
763+
const aad = Buffer.from(testCase.aad, 'hex');
764+
765+
for (const opt of [
766+
undefined,
767+
{ authTagLength: undefined },
768+
{ authTagLength: 16 },
769+
]) {
770+
const cipher = crypto.createCipheriv('chacha20-poly1305', key, iv, opt);
771+
const ciphertext = Buffer.concat([
772+
cipher.setAAD(aad).update(testCase.plain, 'hex'),
773+
cipher.final(),
774+
]);
775+
const authTag = cipher.getAuthTag();
776+
777+
assert.strictEqual(ciphertext.toString('hex'), testCase.ct);
778+
assert.strictEqual(authTag.toString('hex'), testCase.tag);
779+
780+
const decipher = crypto.createDecipheriv('chacha20-poly1305', key, iv, opt);
781+
const plaintext = Buffer.concat([
782+
decipher.setAAD(aad).update(ciphertext),
783+
decipher.setAuthTag(authTag).final(),
784+
]);
785+
786+
assert.strictEqual(plaintext.toString('hex'), testCase.plain);
787+
}
788+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL