Method encrypt

scapy/layers/ipsec.py:395–443

Encrypt an ESP packet :param sa: the SecurityAssociation associated with the ESP packet. :param esp: an unencrypted _ESPPlain packet with valid padding :param key: the secret key used for encryption :param icv_size: the length of the icv used for integri

(self, sa, esp, key, icv_size=None, esn_en=False, esn=0)

        return esp

    def encrypt(self, sa, esp, key, icv_size=None, esn_en=False, esn=0):
        """
        Encrypt an ESP packet

        :param sa:   the SecurityAssociation associated with the ESP packet.
        :param esp:  an unencrypted _ESPPlain packet with valid padding
        :param key:  the secret key used for encryption
        :param icv_size: the length of the icv used for integrity check
        :esn_en:     extended sequence number enable which allows to use 64-bit
                     sequence number instead of 32-bit when using an AEAD
                     algorithm
        :esn:        extended sequence number (32 MSB)
        :return:    a valid ESP packet encrypted with this algorithm
        """
        if icv_size is None:
            icv_size = self.icv_size if self.is_aead else 0
        data = esp.data_for_encryption()

        if self.cipher:
            mode_iv = self._format_mode_iv(algo=self, sa=sa, iv=esp.iv)
            aad = None
            if self.is_aead:
                if esn_en:
                    aad = struct.pack('!LLL', esp.spi, esn, esp.seq)
                else:
                    aad = struct.pack('!LL', esp.spi, esp.seq)
            if self.ciphers_aead_api:
                # New API
                if self.cipher == aead.AESCCM:
                    cipher = self.cipher(key, tag_length=icv_size)
                else:
                    cipher = self.cipher(key)
                if self.name == 'AES-NULL-GMAC':
                    # Special case for GMAC (rfc 4543 sect 3)
                    data = data + cipher.encrypt(mode_iv, b"", aad + esp.iv + data)
                else:
                    data = cipher.encrypt(mode_iv, data, aad)
            else:
                cipher = self.new_cipher(key, mode_iv)
                encryptor = cipher.encryptor()

                if self.is_aead:
                    encryptor.authenticate_additional_data(aad)
                    data = encryptor.update(data) + encryptor.finalize()
                    data += encryptor.tag[:icv_size]
                else:
                    data = encryptor.update(data) + encryptor.finalize()

        return ESP(spi=esp.spi, seq=esp.seq, data=esp.iv + data)

    def decrypt(self, sa, esp, key, icv_size=None, esn_en=False, esn=0):
        """