Skip to content

Commit 9d0edfb

Browse files
dghgitdghgit
committed
Pulled Poly1305 into compliance with RFC7539
1 parent 8bd25dd commit 9d0edfb

6 files changed

Lines changed: 258 additions & 141 deletions

File tree

‎bc-build.properties‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11

2-
release.suffix: 154
3-
release.name: 1.54
4-
release.version: 1.54
5-
release.debug: false
2+
release.suffix: 155b02
3+
release.name: 1.55b02
4+
release.version: 1.55.0.2
5+
release.debug: true
66

77
mail.jar.home: /opt/javamail/mail.jar
88
activation.jar.home: /opt/jaf/activation.jar

‎core/src/main/java/org/bouncycastle/crypto/generators/Poly1305KeyGenerator.java‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -68,17 +68,17 @@ public static void clamp(byte[] key)
6868
/*
6969
* r[3], r[7], r[11], r[15] have top four bits clear (i.e., are {0, 1, . . . , 15})
7070
*/
71-
key[19] &= R_MASK_HIGH_4;
72-
key[23] &= R_MASK_HIGH_4;
73-
key[27] &= R_MASK_HIGH_4;
74-
key[31] &= R_MASK_HIGH_4;
71+
key[3] &= R_MASK_HIGH_4;
72+
key[7] &= R_MASK_HIGH_4;
73+
key[11] &= R_MASK_HIGH_4;
74+
key[15] &= R_MASK_HIGH_4;
7575

7676
/*
7777
* r[4], r[8], r[12] have bottom two bits clear (i.e., are in {0, 4, 8, . . . , 252}).
7878
*/
79-
key[20] &= R_MASK_LOW_2;
80-
key[24] &= R_MASK_LOW_2;
81-
key[28] &= R_MASK_LOW_2;
79+
key[4] &= R_MASK_LOW_2;
80+
key[8] &= R_MASK_LOW_2;
81+
key[12] &= R_MASK_LOW_2;
8282
}
8383

8484
/**
@@ -96,14 +96,14 @@ public static void checkKey(byte[] key)
9696
throw new IllegalArgumentException("Poly1305 key must be 256 bits.");
9797
}
9898

99-
checkMask(key[19], R_MASK_HIGH_4);
100-
checkMask(key[23], R_MASK_HIGH_4);
101-
checkMask(key[27], R_MASK_HIGH_4);
102-
checkMask(key[31], R_MASK_HIGH_4);
99+
checkMask(key[3], R_MASK_HIGH_4);
100+
checkMask(key[7], R_MASK_HIGH_4);
101+
checkMask(key[11], R_MASK_HIGH_4);
102+
checkMask(key[15], R_MASK_HIGH_4);
103103

104-
checkMask(key[20], R_MASK_LOW_2);
105-
checkMask(key[24], R_MASK_LOW_2);
106-
checkMask(key[28], R_MASK_LOW_2);
104+
checkMask(key[4], R_MASK_LOW_2);
105+
checkMask(key[8], R_MASK_LOW_2);
106+
checkMask(key[12], R_MASK_LOW_2);
107107
}
108108

109109
private static void checkMask(byte b, byte mask)

‎core/src/main/java/org/bouncycastle/crypto/macs/Poly1305.java‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -116,13 +116,13 @@ private void setKey(final byte[] key, final byte[] nonce)
116116
throw new IllegalArgumentException("Poly1305 requires a 128 bit IV.");
117117
}
118118

119-
Poly1305KeyGenerator.checkKey(key);
119+
Poly1305KeyGenerator.clamp(key);
120120

121121
// Extract r portion of key
122-
int t0 = Pack.littleEndianToInt(key, BLOCK_SIZE + 0);
123-
int t1 = Pack.littleEndianToInt(key, BLOCK_SIZE + 4);
124-
int t2 = Pack.littleEndianToInt(key, BLOCK_SIZE + 8);
125-
int t3 = Pack.littleEndianToInt(key, BLOCK_SIZE + 12);
122+
int t0 = Pack.littleEndianToInt(key, 0);
123+
int t1 = Pack.littleEndianToInt(key, 4);
124+
int t2 = Pack.littleEndianToInt(key, 8);
125+
int t3 = Pack.littleEndianToInt(key, 12);
126126

127127
r0 = t0 & 0x3ffffff; t0 >>>= 26; t0 |= t1 << 6;
128128
r1 = t0 & 0x3ffff03; t1 >>>= 20; t1 |= t2 << 12;
@@ -140,19 +140,24 @@ private void setKey(final byte[] key, final byte[] nonce)
140140
if (cipher == null)
141141
{
142142
kBytes = key;
143+
144+
k0 = Pack.littleEndianToInt(kBytes, BLOCK_SIZE + 0);
145+
k1 = Pack.littleEndianToInt(kBytes, BLOCK_SIZE + 4);
146+
k2 = Pack.littleEndianToInt(kBytes, BLOCK_SIZE + 8);
147+
k3 = Pack.littleEndianToInt(kBytes, BLOCK_SIZE + 12);
143148
}
144149
else
145150
{
146151
// Compute encrypted nonce
147152
kBytes = new byte[BLOCK_SIZE];
148-
cipher.init(true, new KeyParameter(key, 0, BLOCK_SIZE));
153+
cipher.init(true, new KeyParameter(key, BLOCK_SIZE, BLOCK_SIZE));
149154
cipher.processBlock(nonce, 0, kBytes, 0);
150-
}
151155

152-
k0 = Pack.littleEndianToInt(kBytes, 0);
153-
k1 = Pack.littleEndianToInt(kBytes, 4);
154-
k2 = Pack.littleEndianToInt(kBytes, 8);
155-
k3 = Pack.littleEndianToInt(kBytes, 12);
156+
k0 = Pack.littleEndianToInt(kBytes, 0);
157+
k1 = Pack.littleEndianToInt(kBytes, 4);
158+
k2 = Pack.littleEndianToInt(kBytes, 8);
159+
k3 = Pack.littleEndianToInt(kBytes, 12);
160+
}
156161
}
157162

158163
public String getAlgorithmName()

‎core/src/main/java/org/bouncycastle/crypto/tls/Chacha20Poly1305.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -150,9 +150,7 @@ protected KeyParameter generateRecordMACKey(StreamCipher cipher)
150150
byte[] firstBlock = new byte[64];
151151
cipher.processBytes(firstBlock, 0, firstBlock.length, firstBlock, 0);
152152

153-
// NOTE: The BC implementation puts 'r' after 'k'
154-
System.arraycopy(firstBlock, 0, firstBlock, 32, 16);
155-
KeyParameter macKey = new KeyParameter(firstBlock, 16, 32);
153+
KeyParameter macKey = new KeyParameter(firstBlock, 0, 32);
156154
Arrays.fill(firstBlock, (byte)0);
157155
Poly1305KeyGenerator.clamp(macKey.getKey());
158156
return macKey;

0 commit comments

Comments
 (0)