| 111 | |
| 112 | template <typename T> |
| 113 | static int CBCDecrypt(const T& dec, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out) |
| 114 | { |
| 115 | int written = 0; |
| 116 | bool fail = false; |
| 117 | const unsigned char* prev = iv; |
| 118 | |
| 119 | if (!data || !size || !out) |
| 120 | return 0; |
| 121 | |
| 122 | if (size % AES_BLOCKSIZE != 0) |
| 123 | return 0; |
| 124 | |
| 125 | // Decrypt all data. Padding will be checked in the output. |
| 126 | while (written != size) { |
| 127 | dec.Decrypt(out, data + written); |
| 128 | for (int i = 0; i != AES_BLOCKSIZE; i++) |
| 129 | *out++ ^= prev[i]; |
| 130 | prev = data + written; |
| 131 | written += AES_BLOCKSIZE; |
| 132 | } |
| 133 | |
| 134 | // When decrypting padding, attempt to run in constant-time |
| 135 | if (pad) { |
| 136 | // If used, padding size is the value of the last decrypted byte. For |
| 137 | // it to be valid, It must be between 1 and AES_BLOCKSIZE. |
| 138 | unsigned char padsize = *--out; |
| 139 | fail = !padsize | (padsize > AES_BLOCKSIZE); |
| 140 | |
| 141 | // If not well-formed, treat it as though there's no padding. |
| 142 | padsize *= !fail; |
| 143 | |
| 144 | // All padding must equal the last byte otherwise it's not well-formed |
| 145 | for (int i = AES_BLOCKSIZE; i != 0; i--) |
| 146 | fail |= ((i > AES_BLOCKSIZE - padsize) & (*out-- != padsize)); |
| 147 | |
| 148 | written -= padsize; |
| 149 | } |
| 150 | return written * !fail; |
| 151 | } |
| 152 | |
| 153 | AES256CBCEncrypt::AES256CBCEncrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn) |
| 154 | : enc(key), pad(padIn) |