Handle IV carryover in CBC, CFB, and stream ciphers

Allow an empty nonce to mean "continue using the current cipher state".

GH #864

3 files changed, 205 insertions, 8 deletions

diff --git a/src/tests/data/stream/ctr.vec b/src/tests/data/stream/ctr.vec
index a7275aa79..9fddf1cfc 100644
--- a/src/tests/data/stream/ctr.vec
+++ b/src/tests/data/stream/ctr.vec
@@ -286,6 +286,11 @@ Nonce = F0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF
 In = 6BC1BEE22E409F96E93D7E117393172AAE2D8A571E03AC9C9EB76FAC45AF8E5130C81C46A35CE411E5FBC1191A0A52EFF69F2445DF4F9B17AD2B417BE66C3710
 Out = 874D6191B620E3261BEF6864990DB6CE9806F66B7970FDFF8617187BB9FFFDFF5AE4DF3EDBD5D35E5B4F09020DB03EAB1E031DDA2FBE03D1792170A0F3009CEE
 
+Key = 2B7E151628AED2A6ABF7158809CF4F3C
+Nonce = F0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF
+In =  00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+Out = EC8CDF7398607CB0F2D21675EA9EA1E4362B7C3C6773516318A077D7FC5073AE6A2CC3787889374FBEB4C81B17BA6C44E89C399FF0F198C6D40A31DB156CABFE
+
 Seek = 0
 Key = 2B7E151628AED2A6ABF7158809CF4F3C
 Nonce = F0F1F2F3F4F5F6F7F8F9FAFBFCFDFF
diff --git a/src/tests/test_filters.cpp b/src/tests/test_filters.cpp
index 3c50d94ce..6199f88e2 100644
--- a/src/tests/test_filters.cpp
+++ b/src/tests/test_filters.cpp
@@ -1,6 +1,6 @@
 /*
 * (C) 2016 Daniel Neus
-*     2016 Jack Lloyd
+*     2016,2017 Jack Lloyd
 *     2017 René Korthaus
 *     2017 Philippe Lieser
 *
@@ -42,7 +42,7 @@ class Filter_Tests : public Test
          results.push_back(test_pipe_hash());
          results.push_back(test_pipe_mac());
          results.push_back(test_pipe_stream());
-         results.push_back(test_pipe_cipher());
+         results.push_back(test_pipe_cbc());
          results.push_back(test_pipe_compress());
          results.push_back(test_pipe_codec());
          results.push_back(test_fork());
@@ -274,9 +274,9 @@ class Filter_Tests : public Test
          return result;
          }
 
-      Test::Result test_pipe_cipher()
+      Test::Result test_pipe_cbc()
          {
-         Test::Result result("Pipe");
+         Test::Result result("Pipe CBC");
 
 #if defined(BOTAN_HAS_AES) && defined(BOTAN_HAS_MODE_CBC) && defined(BOTAN_HAS_CIPHER_MODE_PADDING)
          Botan::Cipher_Mode_Filter* cipher =
@@ -303,13 +303,24 @@ class Filter_Tests : public Test
          auto ciphertext = pipe.read_all();
          result.test_eq("Bytes read after", pipe.get_bytes_read(), ciphertext.size());
 
-         result.test_eq("Ciphertext", ciphertext, "9BDD7300E0CB61CA71FFF957A71605DB6836159C36781246A1ADF50982757F4B");
+         result.test_eq("Ciphertext", ciphertext, "9BDD7300E0CB61CA71FFF957A71605DB 6836159C36781246A1ADF50982757F4B");
+
+         pipe.process_msg("IV carryover");
+         auto ciphertext2 = pipe.read_all(1);
+         pipe.process_msg("IV carryover2");
+         auto ciphertext3 = pipe.read_all(2);
+
+         // These values tested against PyCrypto
+         result.test_eq("Ciphertext2", ciphertext2, "AA8D682958A4A044735DAC502B274DB2");
+         result.test_eq("Ciphertext3", ciphertext3, "1241B9976F73051BCF809525D6E86C25");
 
          Botan::Cipher_Mode_Filter* dec_cipher =
             new Botan::Cipher_Mode_Filter(Botan::get_cipher_mode("AES-128/CBC/PKCS7", Botan::DECRYPTION));
          pipe.append(dec_cipher);
          dec_cipher->set_key(Botan::SymmetricKey("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"));
          dec_cipher->set_iv(Botan::InitializationVector("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB"));
+
+         // reset the IV on the encryption filter
          cipher->set_iv(Botan::InitializationVector("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB"));
 
          const std::vector<uint8_t> zeros_in(1024);
@@ -318,7 +329,7 @@ class Filter_Tests : public Test
          pipe.write(src);
          pipe.end_msg();
 
-         pipe.set_default_msg(1);
+         pipe.set_default_msg(3);
          result.test_eq("Bytes read", pipe.get_bytes_read(), 0);
          Botan::secure_vector<uint8_t> zeros_out = pipe.read_all();
          result.test_eq("Bytes read", pipe.get_bytes_read(), zeros_out.size());
@@ -440,7 +451,7 @@ class Filter_Tests : public Test
 
       Test::Result test_pipe_stream()
          {
-         Test::Result result("Pipe");
+         Test::Result result("Pipe CTR");
 
 #if defined(BOTAN_HAS_CTR_BE)
          Botan::Keyed_Filter* aes = nullptr;
@@ -456,6 +467,9 @@ class Filter_Tests : public Test
 
          result.test_eq("Message count", pipe.message_count(), 1);
          result.test_eq("Ciphertext", pipe.read_all(), "FDFD6238F7C6");
+
+         pipe.process_msg("ABCDEF");
+         result.test_eq("Ciphertext", pipe.read_all(1), "8E72F1153514");
 #endif
          return result;
          }
diff --git a/src/tests/test_modes.cpp b/src/tests/test_modes.cpp
index 74b04f7ac..015aafa16 100644
--- a/src/tests/test_modes.cpp
+++ b/src/tests/test_modes.cpp
@@ -1,5 +1,5 @@
 /*
-* (C) 2014,2015 Jack Lloyd
+* (C) 2014,2015,2017 Jack Lloyd
 * (C) 2016 Daniel Neus, Rohde & Schwarz Cybersecurity
 *
 * Botan is released under the Simplified BSD License (see license.txt)
@@ -151,6 +151,184 @@ class Cipher_Mode_Tests : public Text_Based_Test
 
 BOTAN_REGISTER_TEST("modes", Cipher_Mode_Tests);
 
+class Cipher_Mode_IV_Carry_Tests : public Test
+   {
+   public:
+      std::vector<Test::Result> run() override
+         {
+         std::vector<Test::Result> results;
+         results.push_back(test_cbc_iv_carry());
+         results.push_back(test_cfb_iv_carry());
+         results.push_back(test_ctr_iv_carry());
+         return results;
+         }
+
+   private:
+      Test::Result test_cbc_iv_carry()
+         {
+         Test::Result result("CBC IV carry");
+
+#if defined(BOTAN_HAS_MODE_CBC) && defined(BOTAN_HAS_AES)
+         std::unique_ptr<Botan::Cipher_Mode> enc(
+            Botan::get_cipher_mode("AES-128/CBC/PKCS7", Botan::ENCRYPTION));
+         std::unique_ptr<Botan::Cipher_Mode> dec(
+            Botan::get_cipher_mode("AES-128/CBC/PKCS7", Botan::DECRYPTION));
+
+         const std::vector<uint8_t> key(16, 0xAA);
+         const std::vector<uint8_t> iv(16, 0xAA);
+
+         Botan::secure_vector<uint8_t> msg1 =
+            Botan::hex_decode_locked("446F6E27742075736520706C61696E20434243206D6F6465");
+         Botan::secure_vector<uint8_t> msg2 =
+            Botan::hex_decode_locked("49562063617272796F766572");
+         Botan::secure_vector<uint8_t> msg3 =
+            Botan::hex_decode_locked("49562063617272796F76657232");
+
+         enc->set_key(key);
+         dec->set_key(key);
+
+         enc->start(iv);
+         enc->finish(msg1);
+         result.test_eq("First ciphertext", msg1,
+                        "9BDD7300E0CB61CA71FFF957A71605DB6836159C36781246A1ADF50982757F4B");
+
+         enc->start();
+         enc->finish(msg2);
+
+         result.test_eq("Second ciphertext", msg2,
+                        "AA8D682958A4A044735DAC502B274DB2");
+
+         enc->start();
+         enc->finish(msg3);
+
+         result.test_eq("Third ciphertext", msg3,
+                        "1241B9976F73051BCF809525D6E86C25");
+
+         dec->start(iv);
+         dec->finish(msg1);
+
+         dec->start();
+         dec->finish(msg2);
+
+         dec->start();
+         dec->finish(msg3);
+         result.test_eq("Third plaintext", msg3, "49562063617272796F76657232");
+
+#endif
+         return result;
+         }
+
+      Test::Result test_cfb_iv_carry()
+         {
+         Test::Result result("CFB IV carry");
+#if defined(BOTAN_HAS_MODE_CFB) && defined(BOTAN_HAS_AES)
+         std::unique_ptr<Botan::Cipher_Mode> enc(
+            Botan::get_cipher_mode("AES-128/CFB(8)", Botan::ENCRYPTION));
+         std::unique_ptr<Botan::Cipher_Mode> dec(
+            Botan::get_cipher_mode("AES-128/CFB(8)", Botan::DECRYPTION));
+
+         const std::vector<uint8_t> key(16, 0xAA);
+         const std::vector<uint8_t> iv(16, 0xAB);
+
+         Botan::secure_vector<uint8_t> msg1 = Botan::hex_decode_locked("ABCDEF01234567");
+         Botan::secure_vector<uint8_t> msg2 = Botan::hex_decode_locked("0000123456ABCDEF");
+         Botan::secure_vector<uint8_t> msg3 = Botan::hex_decode_locked("012345");
+
+         enc->set_key(key);
+         dec->set_key(key);
+
+         enc->start(iv);
+         enc->finish(msg1);
+         result.test_eq("First ciphertext", msg1, "a51522387c4c9b");
+
+         enc->start();
+         enc->finish(msg2);
+
+         result.test_eq("Second ciphertext", msg2, "105457dc2e0649d4");
+
+         enc->start();
+         enc->finish(msg3);
+
+         result.test_eq("Third ciphertext", msg3, "53bd65");
+
+         dec->start(iv);
+         dec->finish(msg1);
+         result.test_eq("First plaintext", msg1, "ABCDEF01234567");
+
+         dec->start();
+         dec->finish(msg2);
+         result.test_eq("Second plaintext", msg2, "0000123456ABCDEF");
+
+         dec->start();
+         dec->finish(msg3);
+         result.test_eq("Third plaintext", msg3, "012345");
+#endif
+         return result;
+         }
+
+      Test::Result test_ctr_iv_carry()
+         {
+         Test::Result result("CTR IV carry");
+#if defined(BOTAN_HAS_CTR_BE) && defined(BOTAN_HAS_AES)
+
+         std::unique_ptr<Botan::Cipher_Mode> enc(
+            Botan::get_cipher_mode("AES-128/CTR-BE", Botan::ENCRYPTION));
+         std::unique_ptr<Botan::Cipher_Mode> dec(
+            Botan::get_cipher_mode("AES-128/CTR-BE", Botan::DECRYPTION));
+
+         const std::vector<uint8_t> key =
+            Botan::hex_decode("2B7E151628AED2A6ABF7158809CF4F3C");
+         const std::vector<uint8_t> iv =
+            Botan::hex_decode("F0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF");
+
+         enc->set_key(key);
+         dec->set_key(key);
+
+         const std::vector<std::string> exp_ciphertext = {
+            "EC",
+            "8CDF",
+            "739860",
+            "7CB0F2D2",
+            "1675EA9EA1",
+            "E4362B7C3C67",
+            "73516318A077D7",
+            "FC5073AE6A2CC378",
+            "7889374FBEB4C81B17",
+            "BA6C44E89C399FF0F198C",
+         };
+
+         for(size_t i = 1; i != 10; ++i)
+            {
+            if(i == 1)
+               {
+               enc->start(iv);
+               dec->start(iv);
+               }
+            else
+               {
+               enc->start();
+               dec->start();
+               }
+
+            Botan::secure_vector<uint8_t> msg(i, 0);
+            enc->finish(msg);
+
+            result.test_eq("Ciphertext", msg, exp_ciphertext[i-1].c_str());
+
+            dec->finish(msg);
+
+            for(size_t i = 0; i != msg.size(); ++i)
+               result.test_eq("Plaintext zeros", static_cast<size_t>(msg[i]), 0);
+
+            }
+#endif
+         return result;
+         }
+   };
+
+
+BOTAN_REGISTER_TEST("iv_carryover", Cipher_Mode_IV_Carry_Tests);
+
 #endif
 
 }