| 82 | |
| 83 | template <typename T> |
| 84 | static int CBCDecrypt(const T& dec, const unsigned char iv[AES_BLOCKSIZE], const unsigned char* data, int size, bool pad, unsigned char* out) |
| 85 | { |
| 86 | int written = 0; |
| 87 | bool fail = false; |
| 88 | const unsigned char* prev = iv; |
| 89 | |
| 90 | if (!data || !size || !out) |
| 91 | return 0; |
| 92 | |
| 93 | if (size % AES_BLOCKSIZE != 0) |
| 94 | return 0; |
| 95 | |
| 96 | // Decrypt all data. Padding will be checked in the output. |
| 97 | while (written != size) { |
| 98 | dec.Decrypt(out, data + written); |
| 99 | for (int i = 0; i != AES_BLOCKSIZE; i++) |
| 100 | *out++ ^= prev[i]; |
| 101 | prev = data + written; |
| 102 | written += AES_BLOCKSIZE; |
| 103 | } |
| 104 | |
| 105 | // When decrypting padding, attempt to run in constant-time |
| 106 | if (pad) { |
| 107 | // If used, padding size is the value of the last decrypted byte. For |
| 108 | // it to be valid, It must be between 1 and AES_BLOCKSIZE. |
| 109 | unsigned char padsize = *--out; |
| 110 | fail = !padsize | (padsize > AES_BLOCKSIZE); |
| 111 | |
| 112 | // If not well-formed, treat it as though there's no padding. |
| 113 | padsize *= !fail; |
| 114 | |
| 115 | // All padding must equal the last byte otherwise it's not well-formed |
| 116 | for (int i = AES_BLOCKSIZE; i != 0; i--) |
| 117 | fail |= ((i > AES_BLOCKSIZE - padsize) & (*out-- != padsize)); |
| 118 | |
| 119 | written -= padsize; |
| 120 | } |
| 121 | return written * !fail; |
| 122 | } |
| 123 | |
| 124 | AES256CBCEncrypt::AES256CBCEncrypt(const unsigned char key[AES256_KEYSIZE], const unsigned char ivIn[AES_BLOCKSIZE], bool padIn) |
| 125 | : enc(key), pad(padIn) |