| 79 | |
| 80 | template <typename T> |
| 81 | static int CBCDecrypt(const T& dec, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out) |
| 82 | { |
| 83 | int written = 0; |
| 84 | bool fail = false; |
| 85 | const unsigned char* prev = iv; |
| 86 | |
| 87 | if (!data || !size || !out) |
| 88 | return 0; |
| 89 | |
| 90 | if (size % AES_BLOCKSIZE != 0) |
| 91 | return 0; |
| 92 | |
| 93 | // Decrypt all data. Padding will be checked in the output. |
| 94 | while (written != size) { |
| 95 | dec.Decrypt(out, data + written); |
| 96 | for (int i = 0; i != AES_BLOCKSIZE; i++) |
| 97 | *out++ ^= prev[i]; |
| 98 | prev = data + written; |
| 99 | written += AES_BLOCKSIZE; |
| 100 | } |
| 101 | |
| 102 | // When decrypting padding, attempt to run in constant-time |
| 103 | if (pad) { |
| 104 | // If used, padding size is the value of the last decrypted byte. For |
| 105 | // it to be valid, It must be between 1 and AES_BLOCKSIZE. |
| 106 | unsigned char padsize = *--out; |
| 107 | fail = !padsize | (padsize > AES_BLOCKSIZE); |
| 108 | |
| 109 | // If not well-formed, treat it as though there's no padding. |
| 110 | padsize *= !fail; |
| 111 | |
| 112 | // All padding must equal the last byte otherwise it's not well-formed |
| 113 | for (int i = AES_BLOCKSIZE; i != 0; i--) |
| 114 | fail |= ((i > AES_BLOCKSIZE - padsize) & (*out-- != padsize)); |
| 115 | |
| 116 | written -= padsize; |
| 117 | } |
| 118 | return written * !fail; |
| 119 | } |
| 120 | |
| 121 | AES256CBCEncrypt::AES256CBCEncrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn) |
| 122 | : enc(key), pad(padIn) |