Merge pull request #52 from andyk555/master

Fix: the iv/counter CTR mode should be big-endian

diff --git a/gost_grasshopper_cipher.c b/gost_grasshopper_cipher.c
index 23ba575a66d424bcd56420992f285deda77a7b40..c797fe1ca042d364767ba8f5e14a8d32cd9c1dfa 100644 (file)
--- a/gost_grasshopper_cipher.c
+++ b/gost_grasshopper_cipher.c
@@ -138,8 +138,6 @@ static GRASSHOPPER_INLINE void gost_grasshopper_cipher_destroy_ctr(gost_grasshop
 
     grasshopper_zero128(&ctx->iv_buffer);
     grasshopper_zero128(&ctx->partial_buffer);
-
-    ctx->counter = 0;
 }
 
 int gost_grasshopper_cipher_init(EVP_CIPHER_CTX* ctx, const unsigned char* key,
@@ -214,8 +212,6 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX* ctx, con
     grasshopper_zero128(&c->iv_buffer);
     grasshopper_zero128(&c->partial_buffer);
 
-    c->counter = 0;
-
     return gost_grasshopper_cipher_init(ctx, key, iv, enc);
 }
 
@@ -283,6 +279,21 @@ int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX* ctx, unsigned char* out,
     return 1;
 }
 
+/* increment counter (128-bit int) by 1 */
+static void ctr128_inc(unsigned char *counter)
+{
+    unsigned int n = 16;
+    unsigned char c;
+
+    do {
+        --n;
+        c = counter[n];
+        ++c;
+        counter[n] = c;
+        if (c) return;
+    } while (n);
+}
+
 int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX* ctx, unsigned char* out,
                                           const unsigned char* in, size_t inl) {
     gost_grasshopper_cipher_ctx_ctr* c = (gost_grasshopper_cipher_ctx_ctr*) EVP_CIPHER_CTX_get_cipher_data(ctx);
@@ -301,10 +312,9 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX* ctx, unsigned char* out,
     for (i = 0; i < blocks; i++) {
         currentInputBlock = (grasshopper_w128_t*) current_in;
         currentOutputBlock = (grasshopper_w128_t*) current_out;
-        memcpy(c->iv_buffer.b + 8, &c->counter, 8);
         grasshopper_encrypt_block(&c->c.encrypt_round_keys, &c->iv_buffer, currentOutputBlock, &c->c.buffer);
         grasshopper_append128(currentOutputBlock, currentInputBlock);
-        c->counter += 1;
+        ctr128_inc(c->iv_buffer.b);
         current_in += GRASSHOPPER_BLOCK_SIZE;
         current_out += GRASSHOPPER_BLOCK_SIZE;
     }
@@ -314,12 +324,11 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX* ctx, unsigned char* out,
     if (lasted > 0) {
         currentInputBlock = (grasshopper_w128_t*) current_in;
         currentOutputBlock = (grasshopper_w128_t*) current_out;
-        memcpy(c->iv_buffer.b + 8, &c->counter, 8);
         grasshopper_encrypt_block(&c->c.encrypt_round_keys, &c->iv_buffer, &c->partial_buffer, &c->c.buffer);
         for (i = 0; i < lasted; i++) {
             currentOutputBlock->b[i] = c->partial_buffer.b[i] ^ currentInputBlock->b[i];
         }
-        c->counter += 1;
+        ctr128_inc(c->iv_buffer.b);
     }
 
     return 1;

diff --git a/gost_grasshopper_cipher.h b/gost_grasshopper_cipher.h
index 7f775a24b8ff2f7576c4d1317f79e70566d581e0..edd45a42af8cfb77dda134b700e3a23e2b3123dd 100644 (file)
--- a/gost_grasshopper_cipher.h
+++ b/gost_grasshopper_cipher.h
@@ -35,7 +35,6 @@ typedef struct {
     gost_grasshopper_cipher_ctx c;
     grasshopper_w128_t iv_buffer;
     grasshopper_w128_t partial_buffer;
-    uint64_t counter;
 } gost_grasshopper_cipher_ctx_ctr;
 
 typedef int (* grasshopper_init_cipher_func)(EVP_CIPHER_CTX* ctx, const unsigned char* key, const unsigned char* iv,