Function ParseAuthenticatorBody

ntp/protocol/nts/authenticator.go:122–142

ParseAuthenticatorBody decodes the body of an NTS Authenticator EF. Trailing bytes past the declared nonce + ciphertext are silently accepted: RFC 8915 §5.6 explicitly allows "Additional Padding (if any)" after the ciphertext, and we have no way to distinguish legitimate padding from stray bytes wi

(body []byte)

// stray bytes without protocol-specific knowledge that doesn't belong at
// this layer.
func ParseAuthenticatorBody(body []byte) (AuthenticatorBody, error) {
	var ab AuthenticatorBody
	if len(body) < authenticatorHeaderLen {
		return ab, fmt.Errorf("%w: header needs %d bytes, have %d",
			ErrAuthenticatorTruncated, authenticatorHeaderLen, len(body))
	}
	nonceLen := int(binary.BigEndian.Uint16(body[0:2]))
	cipherLen := int(binary.BigEndian.Uint16(body[2:4]))
	paddedNonceLen := padTo4(nonceLen)
	paddedCipherLen := padTo4(cipherLen)
	required := authenticatorHeaderLen + paddedNonceLen + paddedCipherLen
	if required > len(body) {
		return ab, fmt.Errorf("%w: required=%d body_len=%d nonce_len=%d cipher_len=%d",
			ErrAuthenticatorTruncated, required, len(body), nonceLen, cipherLen)
	}
	ab.Nonce = make([]byte, nonceLen)
	copy(ab.Nonce, body[authenticatorHeaderLen:authenticatorHeaderLen+nonceLen])
	ab.Ciphertext = make([]byte, cipherLen)
	copy(ab.Ciphertext, body[authenticatorHeaderLen+paddedNonceLen:authenticatorHeaderLen+paddedNonceLen+cipherLen])
	return ab, nil
}

// SealAuthenticator encrypts plaintext under the given AEAD, authenticating ad
// as associated data, and returns the result as an NTS Authenticator extension