From 4482067df9238ef827e4c3e666c15014acbbef6f Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Sun, 11 Dec 2022 23:44:50 +0100 Subject: [PATCH] Add a test for aes256gcm_decrypt with long inputs, make it pass --- .../armcrypto/aead_aes256gcm_armcrypto.c | 7 +-- test/default/aead_aes256gcm.c | 43 +++++++++++++++++++ 2 files changed, 47 insertions(+), 3 deletions(-) diff --git a/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c b/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c index 5d177535..df968a16 100644 --- a/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c +++ b/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c @@ -616,7 +616,7 @@ aes_gcm_decrypt_generic(const State *st, GHash *sth, unsigned char mac[ABYTES], /* 2*PARALLEL_BLOCKS aggregation */ - for (; i + 2 * PARALLEL_BLOCKS * 16 <= src_len; i += 2 * PARALLEL_BLOCKS * 16) { + while (i + 2 * PARALLEL_BLOCKS * 16 <= src_len) { counter = incr_counters(rev_counters, counter, PARALLEL_BLOCKS); u = gh_update0(sth, src + i, st->hx[2 * PARALLEL_BLOCKS - 1 - 0]); @@ -628,13 +628,14 @@ aes_gcm_decrypt_generic(const State *st, GHash *sth, unsigned char mac[ABYTES], counter = incr_counters(rev_counters, counter, PARALLEL_BLOCKS); + i += PARALLEL_BLOCKS * 16; for (j = 0; j < PARALLEL_BLOCKS; j += 1) { gh_update(&u, src + i + j * 16, st->hx[PARALLEL_BLOCKS - 1 - j]); } sth->acc = gcm_reduce(u); - encrypt_xor_wide(st, dst + i + PARALLEL_BLOCKS * 16, src + i + PARALLEL_BLOCKS * 16, - rev_counters); + encrypt_xor_wide(st, dst + i, src + i, rev_counters); + i += PARALLEL_BLOCKS * 16; } /* PARALLEL_BLOCKS aggregation */ diff --git a/test/default/aead_aes256gcm.c b/test/default/aead_aes256gcm.c index e2607a7f..51328a32 100644 --- a/test/default/aead_aes256gcm.c +++ b/test/default/aead_aes256gcm.c @@ -3267,11 +3267,54 @@ tv(void) return 0; } +static int +tv2(void) +{ + unsigned char *ciphertext; + unsigned char *message; + unsigned char *message2; + unsigned char *nonce; + unsigned char *key; + size_t message_len; + size_t ciphertext_len; + int i; + + for (i = 0; i < 250; i++) { + message_len = randombytes_uniform(1000); + ciphertext_len = message_len + crypto_aead_aes256gcm_ABYTES; + message = (unsigned char *) sodium_malloc(message_len); + message2 = (unsigned char *) sodium_malloc(message_len); + ciphertext = (unsigned char *) sodium_malloc(ciphertext_len); + nonce = (unsigned char *) sodium_malloc(crypto_aead_aes256gcm_NPUBBYTES); + key = (unsigned char *) sodium_malloc(crypto_aead_aes256gcm_KEYBYTES); + + crypto_aead_aes256gcm_keygen(key); + randombytes_buf(nonce, crypto_aead_aes256gcm_NPUBBYTES); + randombytes_buf(message, message_len); + crypto_aead_aes256gcm_encrypt(ciphertext, NULL, message, message_len, + NULL, 0, NULL, nonce, key); + if (crypto_aead_aes256gcm_decrypt(message2, NULL, NULL, + ciphertext, ciphertext_len, + NULL, 0, nonce, key) != 0) { + printf("Decryption of random ciphertext failed"); + } + assert(memcmp(message, message2, message_len) == 0); + sodium_free(key); + sodium_free(nonce); + sodium_free(ciphertext); + sodium_free(message2); + sodium_free(message); + } + + return 0; +} + int main(void) { if (crypto_aead_aes256gcm_is_available()) { tv(); + tv2(); } assert(crypto_aead_aes256gcm_keybytes() == crypto_aead_aes256gcm_KEYBYTES); assert(crypto_aead_aes256gcm_nsecbytes() == crypto_aead_aes256gcm_NSECBYTES);