@amritk/nish-x86_64-linux 0.15.0 → 0.17.0

package/std/crypto/aes.ts

@@ -59,10 +59,11 @@
  *
  * **What is refused.** A key of any length but 16 or 32 bytes (AES-192 is out
  * of scope), a block or a sample that is not 16 bytes, an empty IV (SP 800-38D
- * §5.2.1.1 asks for at least one bit), a sealed input shorter than its tag and
- * a plaintext too long for its sealed form to be an array answer `null`; so
- * does a tag that does not verify. An IV of any other non-zero
- * length is hashed into the first counter block as §7.1 says.
+ * §5.2.1.1 asks for at least one bit), a sealed input shorter than its tag, a
+ * plaintext too long for its sealed form to be an array, and an `AesKey`
+ * `aesKey` did not make answer `null`; so does a tag that does not verify. An
+ * IV of any other non-zero length is hashed into the first counter block as
+ * §7.1 says.
  *
  * Private names carry the `aes` / `ghash` prefix because a `std/` module's
  * private functions share the importing program's flat symbol namespace
@@ -80,6 +81,12 @@ const AES_BATCH: i32 = 64
 /**
  * An AES key, expanded: the round keys already bitsliced, and GCM's hash key
  * H = E(K, 0^128), so a key used for many messages is expanded once.
+ *
+ * Make one with `aesKey`. The constructor and the fields are public only
+ * because the language has no private ones, and a key built or edited by hand
+ * is not trusted: one whose shape is not what `aesKey` makes answers `null`
+ * everywhere (`aesKeyUsable`), and one whose H is zero opens nothing
+ * (`aesGcmOpen`).
  */
 export class AesKey {
   /** Nr: 10 for AES-128, 14 for AES-256. */
@@ -406,14 +413,15 @@ const aesMixColumns = (q: u64[]): void => {
 
 /** AddRoundKey (FIPS 197 §5.1.4): the eight words of `rk` from `at` into the state. */
 const aesAddRoundKey = (q: u64[], rk: u64[], at: i32): void => {
-  q[0] = q[0] ^ rk[at]
-  q[1] = q[1] ^ rk[at + 1]
-  q[2] = q[2] ^ rk[at + 2]
-  q[3] = q[3] ^ rk[at + 3]
-  q[4] = q[4] ^ rk[at + 4]
-  q[5] = q[5] ^ rk[at + 5]
-  q[6] = q[6] ^ rk[at + 6]
-  q[7] = q[7] ^ rk[at + 7]
+  const p: u32 = toU32(at)
+  q[0] = q[0] ^ rk[p]
+  q[1] = q[1] ^ rk[p + 1]
+  q[2] = q[2] ^ rk[p + 2]
+  q[3] = q[3] ^ rk[p + 3]
+  q[4] = q[4] ^ rk[p + 4]
+  q[5] = q[5] ^ rk[p + 5]
+  q[6] = q[6] ^ rk[p + 6]
+  q[7] = q[7] ^ rk[p + 7]
 }
 
 /**
@@ -574,6 +582,19 @@ const aesCopyPrefix = (dst: u8[], src: u8[], count: i32): void => {
   }
 }
 
+/**
+ * Whether `key` has the shape `aesKey` makes: 10 or 14 rounds and the
+ * `(rounds + 1) * 8` round-key words the cipher reads. A key of another shape
+ * could only have been built or edited by hand, and would index past its round
+ * keys and panic, so every entry point answers `null` for it instead. The
+ * branch is on the shape, which is not secret.
+ */
+const aesKeyUsable = (key: AesKey): boolean => {
+  const rounds: i32 = key.rounds
+  const words: i32 = (rounds + 1) * 8
+  return (rounds === 10 || rounds === 14) && toI32(key.roundKeys.length) === words
+}
+
 /**
  * The first 16 bytes of `block` encrypted, in the first 16 bytes of a fresh
  * batch; the rest of the batch is the cipher of zeros and is not read.
@@ -603,9 +624,51 @@ export const aesKey = (key: u8[]): AesKey | null => {
   return expanded
 }
 
+/**
+ * `aesKey` into an `AesKey` the caller already holds: the key schedule of a
+ * 16-byte (AES-128) or 32-byte (AES-256) `key`, bitsliced, and H = E(K,
+ * 0^128) for GCM, written into `out`, whose `roundKeys` must already be the
+ * `8 * (rounds + 1)` words that key length needs (88 or 120). It answers
+ * whether it did; a key of another length, or a schedule array of the wrong
+ * size for it, answers `false` and leaves `out` as it was.
+ *
+ * `aesKey` makes a fresh `AesKey` and stores its schedule into it, which no
+ * arena scope may be put around; this stores numbers only, so a caller that
+ * keeps one `AesKey` per connection installs every key inside a `using a =
+ * arena()` block and leaves the arena where it was. The schedule and H are
+ * secret: the caller wipes `out` when it is done with the key. The working
+ * copy of the schedule is zeroed before it is released, by stores that stand
+ * no better than `aesKey`'s own temporaries do.
+ */
+export const aesKeyInto = (key: u8[], out: AesKey): boolean => {
+  const length: i32 = toI32(key.length)
+  if (length !== 16 && length !== 32) {
+    return false
+  }
+  const rounds: i32 = length === 16 ? 10 : 14
+  const roundKeys: u64[] = out.roundKeys
+  const words: i32 = (rounds + 1) * 8
+  if (toI32(roundKeys.length) !== words) {
+    return false
+  }
+  const expanded: u64[] = aesExpand(key, rounds)
+  for (let i: i32 = 0; i < toI32(roundKeys.length) && i < toI32(expanded.length); i++) {
+    roundKeys[i] = expanded[i]
+    expanded[i] = 0
+  }
+  out.rounds = rounds
+  const buf: u8[] = aesEncryptOne(out, [])
+  out.hHi = aesLoad64(buf, 0, 8)
+  out.hLo = aesLoad64(buf, 8, 16)
+  for (let i: i32 = 0; i < toI32(buf.length); i++) {
+    buf[i] = 0
+  }
+  return true
+}
+
 /** One block encrypted (FIPS 197 §5.1, ECB): 16 bytes in, 16 fresh bytes out, or `null` for another length. */
 export const aesEncryptBlock = (key: AesKey, block: u8[]): u8[] | null => {
-  if (toI32(block.length) !== AES_BLOCK) {
+  if (!aesKeyUsable(key) || toI32(block.length) !== AES_BLOCK) {
     return null
   }
   const out: u8[] = new Array<u8>(AES_BLOCK)
@@ -619,7 +682,7 @@ export const aesEncryptBlock = (key: AesKey, block: u8[]): u8[] | null => {
  * a sample of another length.
  */
 export const aesHeaderMask = (key: AesKey, sample: u8[]): u8[] | null => {
-  if (toI32(sample.length) !== AES_BLOCK) {
+  if (!aesKeyUsable(key) || toI32(sample.length) !== AES_BLOCK) {
     return null
   }
   const mask: u8[] = new Array<u8>(5)
@@ -781,6 +844,17 @@ const aesGcmJ0 = (key: AesKey, iv: u8[]): u8[] => {
   return j0
 }
 
+/**
+ * Whether GCTR can encrypt `length` bytes from inc32(J0) without its 32-bit
+ * counter coming back round to J0's, whose block masks the tag: SP 800-38D
+ * §5.2.1.1 caps a plaintext at 2^32 - 2 blocks (2^39 - 256 bits). An array
+ * length is below 2^31, so this never refuses today; it is here so that the
+ * bound is stated where the counter is, rather than left to the width of an
+ * array length.
+ */
+const aesGcmLengthFits = (length: i32): boolean =>
+  (toI64(length) + toI64(15)) >> toI64(4) <= (toI64(1) << toI64(32)) - toI64(2)
+
 /**
  * GCTR (SP 800-38D §6.5) from inc32(J0): `dst[i] = src[i] ⊕ keystream[i]` for
  * `i` below `length`, four blocks per pass of the cipher. The counter is the
@@ -844,16 +918,16 @@ export const aesGcmTagMask = (tagHi: u64, tagLo: u64, gotHi: u64, gotLo: u64): u
 /**
  * GCM authenticated encryption (SP 800-38D §7.1): the ciphertext followed by
  * the 16-byte tag, in one fresh array. The IV may be any non-zero length; 12
- * bytes is the fast and usual one. `null` for an empty IV, and for a
- * plaintext longer than 2^31 - 17 bytes, whose sealed form would not fit in an
- * array.
+ * bytes is the fast and usual one. `null` for an empty IV, for a key
+ * `aesKey` did not make, and for a plaintext longer than 2^31 - 17 bytes,
+ * whose sealed form would not fit in an array.
  */
 export const aesGcmSeal = (key: AesKey, iv: u8[], aad: u8[], plaintext: u8[]): u8[] | null => {
   const length: i32 = toI32(plaintext.length)
   // 2^31 - 17: the longest plaintext whose sealed form, sixteen bytes longer,
   // is still an array length.
   const longest: i32 = 0x7fffffef
-  if (toI32(iv.length) === 0 || length > longest) {
+  if (!aesKeyUsable(key) || toI32(iv.length) === 0 || length > longest || !aesGcmLengthFits(length)) {
     return null
   }
   const j0: u8[] = aesGcmJ0(key, iv)
@@ -869,18 +943,22 @@ export const aesGcmSeal = (key: AesKey, iv: u8[], aad: u8[], plaintext: u8[]): u
 /**
  * GCM authenticated decryption (SP 800-38D §7.2): `sealed` is the ciphertext
  * followed by its 16-byte tag, and the answer is the plaintext, or `null` when
- * the tag does not verify, the IV is empty or `sealed` is shorter than a tag.
+ * the tag does not verify, the IV is empty, `sealed` is shorter than a tag or
+ * the key is not one `aesKey` made.
  * The tag is computed over the received ciphertext and compared in constant
  * time before anything is decrypted, so a forgery yields no plaintext at all.
  */
 export const aesGcmOpen = (key: AesKey, iv: u8[], aad: u8[], sealed: u8[]): u8[] | null => {
   const total: i32 = toI32(sealed.length)
-  if (toI32(iv.length) === 0 || total < AES_GCM_TAG_SIZE) {
+  if (!aesKeyUsable(key) || toI32(iv.length) === 0 || total < AES_GCM_TAG_SIZE) {
     return null
   }
   // `total` is an array length and at least a tag, so neither this nor the
   // tag's second word at `length + 8` can leave the range of an `i32`.
   const length: i32 = total - AES_GCM_TAG_SIZE
+  if (!aesGcmLengthFits(length)) {
+    return null
+  }
   const j0: u8[] = aesGcmJ0(key, iv)
   const tag: u64[] = new Array<u64>(2)
   aesGcmTag(tag, key, j0, aad, sealed, length)
@@ -890,7 +968,12 @@ export const aesGcmOpen = (key: AesKey, iv: u8[], aad: u8[], sealed: u8[]): u8[]
     aesLoad64(sealed, length, total),
     aesLoad64(sealed, length + 8, total)
   )
-  if (same === toU64(0)) {
+  // Under H = 0 GHASH is zero for every input, so the tag E(K, J0) would
+  // authenticate any ciphertext and AAD. Only a key built or edited by hand
+  // has it (for one from `aesKey` the chance is 2^-128), and such a key opens
+  // nothing. H is secret, so this is folded into the mask, not branched on.
+  const hashKeySet: u64 = ~ctEq(key.hHi | key.hLo, toU64(0))
+  if ((same & hashKeySet) === toU64(0)) {
     return null
   }
   const out: u8[] = new Array<u8>(length)

package/std/crypto/base64url.ts

@@ -9,9 +9,10 @@
  * **Decoding is strict, so that each byte string has exactly one spelling.**
  * `base64urlDecode` answers `null` for a `=` anywhere, for any character outside
  * the alphabet (whitespace included), for a length of 1 mod 4 — six bits, not a
- * byte — and for a final character whose unused low bits are not zero (RFC 4648
- * §3.5). A lenient decoder would let `AB` and `AA` both mean `00`, and a token
- * compared or cached by its text would then have two identities.
+ * byte — for a final character whose unused low bits are not zero (RFC 4648
+ * §3.5), and for a text longer than 2^31 - 1 bytes. A lenient decoder would let
+ * `AB` and `AA` both mean `00`, and a token compared or cached by its text
+ * would then have two identities.
  *
  * **Neither direction indexes or branches on the data.** What is encoded here
  * is usually a key, a nonce or a MAC, and a lookup table indexed by a secret
@@ -28,9 +29,14 @@
 
 /**
  * All ones when `lo <= c <= hi`, else zero, without a branch. `c` is a byte or
- * a sextet, so neither subtraction can overflow.
+ * a sextet, so neither subtraction could leave `i32`; they are written in
+ * `u32`, which wraps by definition, because a signed one would be checked for
+ * an overflow it cannot have, and the check is a branch on the secret. The
+ * sign bit `>> 31` reads is the same either way. `base64urlCharOf` and
+ * `base64urlSextetOf` do their sums in `u32` for the same reason.
  */
-const base64urlRangeMask = (c: i32, lo: i32, hi: i32): i32 => ((lo - 1 - c) & (c - hi - 1)) >> 31
+const base64urlRangeMask = (c: i32, lo: i32, hi: i32): i32 =>
+  toI32((toU32(lo) - 1 - toU32(c)) & (toU32(c) - toU32(hi) - 1)) >> 31
 
 /**
  * The URL-alphabet character for the sextet `v` (`0 <= v <= 63`).
@@ -40,12 +46,14 @@ const base64urlRangeMask = (c: i32, lo: i32, hi: i32): i32 => ((lo - 1 - c) & (c
  * on `0`, 62 on `-` and 63 on `_`.
  */
 const base64urlCharOf = (v: i32): i32 =>
-  65 +
-  v +
-  (base64urlRangeMask(v, 26, 63) & 6) -
-  (base64urlRangeMask(v, 52, 63) & 75) -
-  (base64urlRangeMask(v, 62, 63) & 13) +
-  (base64urlRangeMask(v, 63, 63) & 49)
+  toI32(
+    65 +
+      toU32(v) +
+      toU32(base64urlRangeMask(v, 26, 63) & 6) -
+      toU32(base64urlRangeMask(v, 52, 63) & 75) -
+      toU32(base64urlRangeMask(v, 62, 63) & 13) +
+      toU32(base64urlRangeMask(v, 63, 63) & 49)
+  )
 
 /**
  * The sextet the byte `c` stands for, or `-1` when `c` is not in the alphabet.
@@ -59,7 +67,11 @@ const base64urlSextetOf = (c: i32): i32 => {
   const dash: i32 = base64urlRangeMask(c, 45, 45)
   const underscore: i32 = base64urlRangeMask(c, 95, 95)
   const value: i32 =
-    (upper & (c - 65)) | (lower & (c - 71)) | (digit & (c + 4)) | (dash & 62) | (underscore & 63)
+    (upper & toI32(toU32(c) - 65)) |
+    (lower & toI32(toU32(c) - 71)) |
+    (digit & toI32(toU32(c) + 4)) |
+    (dash & 62) |
+    (underscore & 63)
   return value | ~(upper | lower | digit | dash | underscore)
 }
 
@@ -69,12 +81,20 @@ const base64urlSextetOf = (c: i32): i32 => {
  *
  * Bytes go into a bit accumulator eight at a time and come out six at a time,
  * so one index walks the input and the only branches are on how many bits are
- * waiting — which depends on the position, never on the bytes.
+ * waiting — which depends on the position, never on the bytes. An array longer
+ * than 2^31 - 1 bytes panics.
  */
 export const base64urlEncode = (data: u8[]): string => {
+  // Refused before `toI32`, which saturates a longer length under
+  // `--number-mode f64` and would end the loop at a prefix.
+  if (data.length > 2147483647) {
+    panic("base64urlEncode: more than 2^31 - 1 bytes")
+  }
   const parts: string[] = []
   let acc: i32 = 0
-  let bits: i32 = 0
+  // Unsigned, so that counting bits in and out is never checked for an
+  // overflow: it is never more than twelve.
+  let bits: u32 = 0
   for (let k: i32 = 0; k < toI32(data.length); k++) {
     // At most four bits wait from the bytes before, so twelve are live here;
     // the mask keeps the accumulator from growing without bound.
@@ -82,13 +102,13 @@ export const base64urlEncode = (data: u8[]): string => {
     bits += 8
     while (bits >= 6) {
       bits -= 6
-      parts.push(String.fromCharCode(base64urlCharOf((acc >> bits) & 63)))
+      parts.push(String.fromCharCode(base64urlCharOf((acc >> toI32(bits)) & 63)))
     }
   }
   // Two or four bits of a final byte are left: they go out as the high bits of
   // one more sextet, filled out with zeros.
   if (bits > 0) {
-    parts.push(String.fromCharCode(base64urlCharOf((acc << (6 - bits)) & 63)))
+    parts.push(String.fromCharCode(base64urlCharOf((acc << toI32(6 - bits)) & 63)))
   }
   return parts.join("")
 }
@@ -96,12 +116,18 @@ export const base64urlEncode = (data: u8[]): string => {
 /**
  * The bytes `text` spells in unpadded base64url, or `null` when it is not the
  * one canonical spelling of any byte string — see the module comment for the
- * four refusals.
+ * five refusals.
  *
  * The same accumulator as `base64urlEncode`, run the other way: six bits in per
  * character, eight out per byte.
  */
 export const base64urlDecode = (text: string): u8[] | null => {
+  // A text past 2^31 - 1 bytes is refused before `toI32`, which would
+  // saturate it under `--number-mode f64` and decode only a prefix: a second
+  // spelling of that prefix's bytes, which strictness exists to refuse.
+  if (text.length > 2147483647) {
+    return null
+  }
   const n: i32 = toI32(text.length)
   const tail: i32 = n & 3
   // Six bits cannot finish a byte, so a single character after the last full

package/std/crypto/chacha20poly1305.ts

@@ -85,9 +85,18 @@ const POLY1305_HIGH_BIT: i32 = 0x1000000
 /** `x` rotated left by `n` bits, `n` in 1 to 31. */
 const chacha20Rotl = (x: u32, n: u32): u32 => (x << n) | (x >>> (32 - n))
 
-/** The little-endian `u32` at `buf[at]` to `buf[at + 3]`. */
-const chacha20Word = (buf: u8[], at: i32): u32 =>
-  toU32(buf[at]) | (toU32(buf[at + 1]) << 8) | (toU32(buf[at + 2]) << 16) | (toU32(buf[at + 3]) << 24)
+/**
+ * The little-endian `u32` at `buf[at]` to `buf[at + 3]`. The offsets are
+ * summed in `u32`, which wraps by definition, rather than as checked `i32`
+ * sums: every caller passes a window inside `buf`, a wrapped offset would
+ * index past it rather than reach another byte, and a check is a branch that
+ * `tests/cases/ct_asm_chacha20poly1305` refuses. `poly1305Le64`,
+ * `poly1305Block` and `chacha20Poly1305TagMatch` sum theirs the same way.
+ */
+const chacha20Word = (buf: u8[], at: i32): u32 => {
+  const p: u32 = toU32(at)
+  return toU32(buf[p]) | (toU32(buf[p + 1]) << 8) | (toU32(buf[p + 2]) << 16) | (toU32(buf[p + 3]) << 24)
+}
 
 /**
  * The sixteen-word state of RFC 8439 §2.3: the four constant words
@@ -274,7 +283,10 @@ const chacha20Poly1305Setup = (state: u32[]): u8[] => {
  * Whether the blocks `len` bytes need, from `counter` on, fit before the
  * 32-bit counter wraps.
  * RFC 8439 §2.4 leaves a wrap undefined, and a wrapped counter repeats the
- * keystream, so a request that would need one answers `null` instead.
+ * keystream, so a request that would need one answers `null` instead. The
+ * AEAD asks it too, from counter 1: an array length is below 2^31, so that
+ * never refuses today, but the bound is then stated where the counter is
+ * rather than left to the width of an array length.
  */
 const chacha20CounterFits = (counter: u32, len: i32): boolean => {
   const blocks: i64 = (toI64(len) + toI64(63)) >> toI64(6)
@@ -343,15 +355,19 @@ export const chacha20 = (key: u8[], counter: u32, nonce: u8[], data: u8[]): u8[]
 }
 
 /** The little-endian `u64` at `buf[at]` to `buf[at + 7]`. */
-const poly1305Le64 = (buf: u8[], at: i32): u64 =>
-  toU64(buf[at]) |
-  (toU64(buf[at + 1]) << 8) |
-  (toU64(buf[at + 2]) << 16) |
-  (toU64(buf[at + 3]) << 24) |
-  (toU64(buf[at + 4]) << 32) |
-  (toU64(buf[at + 5]) << 40) |
-  (toU64(buf[at + 6]) << 48) |
-  (toU64(buf[at + 7]) << 56)
+const poly1305Le64 = (buf: u8[], at: i32): u64 => {
+  const p: u32 = toU32(at)
+  return (
+    toU64(buf[p]) |
+    (toU64(buf[p + 1]) << 8) |
+    (toU64(buf[p + 2]) << 16) |
+    (toU64(buf[p + 3]) << 24) |
+    (toU64(buf[p + 4]) << 32) |
+    (toU64(buf[p + 5]) << 40) |
+    (toU64(buf[p + 6]) << 48) |
+    (toU64(buf[p + 7]) << 56)
+  )
+}
 
 /**
  * `r` from the first 16 bytes of a one-time key, clamped as RFC 8439 §2.5
@@ -394,7 +410,7 @@ const poly1305Clamp = (key: u8[], r: u64[]): void => {
  */
 const poly1305Block = (h: u64[], r: u64[], m: u8[], at: i32, high: u64): void => {
   const lo: u64 = poly1305Le64(m, at)
-  const hi: u64 = poly1305Le64(m, at + 8)
+  const hi: u64 = poly1305Le64(m, toI32(toU32(at) + 8))
   const h0: u64 = h[0] + (lo & 0x3ffffff)
   const h1: u64 = h[1] + ((lo >>> 26) & 0x3ffffff)
   const h2: u64 = h[2] + (((lo >>> 52) | (hi << 12)) & 0x3ffffff)
@@ -599,23 +615,24 @@ const chacha20Poly1305Tag = (polyKey: u8[], aad: u8[], ct: u8[], at: i32, len: i
  * disassembly check; the caller has checked that `sealed` holds the window.
  */
 const chacha20Poly1305TagMatch = (tag: u8[], sealed: u8[], at: i32): u32 => {
+  const p: u32 = toU32(at)
   const diff: u32 =
-    toU32(tag[0] ^ sealed[at]) |
-    toU32(tag[1] ^ sealed[at + 1]) |
-    toU32(tag[2] ^ sealed[at + 2]) |
-    toU32(tag[3] ^ sealed[at + 3]) |
-    toU32(tag[4] ^ sealed[at + 4]) |
-    toU32(tag[5] ^ sealed[at + 5]) |
-    toU32(tag[6] ^ sealed[at + 6]) |
-    toU32(tag[7] ^ sealed[at + 7]) |
-    toU32(tag[8] ^ sealed[at + 8]) |
-    toU32(tag[9] ^ sealed[at + 9]) |
-    toU32(tag[10] ^ sealed[at + 10]) |
-    toU32(tag[11] ^ sealed[at + 11]) |
-    toU32(tag[12] ^ sealed[at + 12]) |
-    toU32(tag[13] ^ sealed[at + 13]) |
-    toU32(tag[14] ^ sealed[at + 14]) |
-    toU32(tag[15] ^ sealed[at + 15])
+    toU32(tag[0] ^ sealed[p]) |
+    toU32(tag[1] ^ sealed[p + 1]) |
+    toU32(tag[2] ^ sealed[p + 2]) |
+    toU32(tag[3] ^ sealed[p + 3]) |
+    toU32(tag[4] ^ sealed[p + 4]) |
+    toU32(tag[5] ^ sealed[p + 5]) |
+    toU32(tag[6] ^ sealed[p + 6]) |
+    toU32(tag[7] ^ sealed[p + 7]) |
+    toU32(tag[8] ^ sealed[p + 8]) |
+    toU32(tag[9] ^ sealed[p + 9]) |
+    toU32(tag[10] ^ sealed[p + 10]) |
+    toU32(tag[11] ^ sealed[p + 11]) |
+    toU32(tag[12] ^ sealed[p + 12]) |
+    toU32(tag[13] ^ sealed[p + 13]) |
+    toU32(tag[14] ^ sealed[p + 14]) |
+    toU32(tag[15] ^ sealed[p + 15])
   return ctEq(diff, 0)
 }
 
@@ -634,7 +651,8 @@ export const chacha20Poly1305Seal = (key: u8[], nonce: u8[], aad: u8[], plaintex
   if (
     toI32(key.length) !== CHACHA20_KEY_SIZE ||
     toI32(nonce.length) !== CHACHA20POLY1305_NONCE_SIZE ||
-    len > longest
+    len > longest ||
+    !chacha20CounterFits(1, len)
   ) {
     return null
   }
@@ -668,6 +686,9 @@ export const chacha20Poly1305Open = (key: u8[], nonce: u8[], aad: u8[], sealed:
     return null
   }
   const len: i32 = total - POLY1305_TAG_SIZE
+  if (!chacha20CounterFits(1, len)) {
+    return null
+  }
   const state: u32[] = chacha20State(key, 0, nonce, 0)
   const polyKey: u8[] = chacha20Poly1305Setup(state)
   const tag: u8[] = chacha20Poly1305Tag(polyKey, aad, sealed, 0, len)

package/std/crypto/ct.ts

@@ -23,12 +23,18 @@
  *
  * Arrays of different lengths answer `false` at once, because a length is
  * public; arrays of one length are compared in full, with no early exit.
+ *
+ * The lengths are compared as the `number`s they are, before any `toI32`:
+ * under `--number-mode f64` `toI32` saturates at 2^31 - 1, so two arrays past
+ * it would have looked the same length and been compared only that far. An
+ * array longer than that answers `false` too — no `i32` index reaches its end,
+ * and a compare that cannot read every byte must not say "equal".
  */
 export const timingSafeEqual = (a: u8[], b: u8[]): boolean => {
-  const n: i32 = toI32(a.length)
-  if (n !== toI32(b.length)) {
+  if (a.length !== b.length || a.length > 2147483647) {
     return false
   }
+  const n: i32 = toI32(a.length)
   let diff: i32 = 0
   // Bounded by both lengths, which are equal here, so the prover drops both
   // bounds checks rather than trusting the comparison above.
@@ -56,9 +62,14 @@ export const timingSafeEqualAt = (a: u8[], aOff: i32, b: u8[], bOff: i32, len: i
   if (aOff < 0 || bOff < 0 || len < 0 || aOff > aLen - len || bOff > bLen - len) {
     return false
   }
+  // The offsets are summed in `u32`, which wraps by definition, rather than
+  // as checked `i32` sums: the test above already put every `off + k` inside
+  // its array, so neither can wrap, and a check would only add a branch.
+  const aAt: u32 = toU32(aOff)
+  const bAt: u32 = toU32(bOff)
   let diff: i32 = 0
   for (let k: i32 = 0; k < len; k++) {
-    diff = diff | toI32(a[aOff + k] ^ b[bOff + k])
+    diff = diff | toI32(a[aAt + toU32(k)] ^ b[bAt + toU32(k)])
   }
   return diff === 0
 }