@amritk/nish-x86_64-linux 0.16.0 → 0.18.0

package/std/crypto/chacha20poly1305.ts

@@ -85,9 +85,18 @@ const POLY1305_HIGH_BIT: i32 = 0x1000000
 /** `x` rotated left by `n` bits, `n` in 1 to 31. */
 const chacha20Rotl = (x: u32, n: u32): u32 => (x << n) | (x >>> (32 - n))
 
-/** The little-endian `u32` at `buf[at]` to `buf[at + 3]`. */
-const chacha20Word = (buf: u8[], at: i32): u32 =>
-  toU32(buf[at]) | (toU32(buf[at + 1]) << 8) | (toU32(buf[at + 2]) << 16) | (toU32(buf[at + 3]) << 24)
+/**
+ * The little-endian `u32` at `buf[at]` to `buf[at + 3]`. The offsets are
+ * summed in `u32`, which wraps by definition, rather than as checked `i32`
+ * sums: every caller passes a window inside `buf`, a wrapped offset would
+ * index past it rather than reach another byte, and a check is a branch that
+ * `tests/cases/ct_asm_chacha20poly1305` refuses. `poly1305Le64`,
+ * `poly1305Block` and `chacha20Poly1305TagMatch` sum theirs the same way.
+ */
+const chacha20Word = (buf: u8[], at: i32): u32 => {
+  const p: u32 = toU32(at)
+  return toU32(buf[p]) | (toU32(buf[p + 1]) << 8) | (toU32(buf[p + 2]) << 16) | (toU32(buf[p + 3]) << 24)
+}
 
 /**
  * The sixteen-word state of RFC 8439 §2.3: the four constant words
@@ -346,15 +355,19 @@ export const chacha20 = (key: u8[], counter: u32, nonce: u8[], data: u8[]): u8[]
 }
 
 /** The little-endian `u64` at `buf[at]` to `buf[at + 7]`. */
-const poly1305Le64 = (buf: u8[], at: i32): u64 =>
-  toU64(buf[at]) |
-  (toU64(buf[at + 1]) << 8) |
-  (toU64(buf[at + 2]) << 16) |
-  (toU64(buf[at + 3]) << 24) |
-  (toU64(buf[at + 4]) << 32) |
-  (toU64(buf[at + 5]) << 40) |
-  (toU64(buf[at + 6]) << 48) |
-  (toU64(buf[at + 7]) << 56)
+const poly1305Le64 = (buf: u8[], at: i32): u64 => {
+  const p: u32 = toU32(at)
+  return (
+    toU64(buf[p]) |
+    (toU64(buf[p + 1]) << 8) |
+    (toU64(buf[p + 2]) << 16) |
+    (toU64(buf[p + 3]) << 24) |
+    (toU64(buf[p + 4]) << 32) |
+    (toU64(buf[p + 5]) << 40) |
+    (toU64(buf[p + 6]) << 48) |
+    (toU64(buf[p + 7]) << 56)
+  )
+}
 
 /**
  * `r` from the first 16 bytes of a one-time key, clamped as RFC 8439 §2.5
@@ -397,7 +410,7 @@ const poly1305Clamp = (key: u8[], r: u64[]): void => {
  */
 const poly1305Block = (h: u64[], r: u64[], m: u8[], at: i32, high: u64): void => {
   const lo: u64 = poly1305Le64(m, at)
-  const hi: u64 = poly1305Le64(m, at + 8)
+  const hi: u64 = poly1305Le64(m, toI32(toU32(at) + 8))
   const h0: u64 = h[0] + (lo & 0x3ffffff)
   const h1: u64 = h[1] + ((lo >>> 26) & 0x3ffffff)
   const h2: u64 = h[2] + (((lo >>> 52) | (hi << 12)) & 0x3ffffff)
@@ -602,23 +615,24 @@ const chacha20Poly1305Tag = (polyKey: u8[], aad: u8[], ct: u8[], at: i32, len: i
  * disassembly check; the caller has checked that `sealed` holds the window.
  */
 const chacha20Poly1305TagMatch = (tag: u8[], sealed: u8[], at: i32): u32 => {
+  const p: u32 = toU32(at)
   const diff: u32 =
-    toU32(tag[0] ^ sealed[at]) |
-    toU32(tag[1] ^ sealed[at + 1]) |
-    toU32(tag[2] ^ sealed[at + 2]) |
-    toU32(tag[3] ^ sealed[at + 3]) |
-    toU32(tag[4] ^ sealed[at + 4]) |
-    toU32(tag[5] ^ sealed[at + 5]) |
-    toU32(tag[6] ^ sealed[at + 6]) |
-    toU32(tag[7] ^ sealed[at + 7]) |
-    toU32(tag[8] ^ sealed[at + 8]) |
-    toU32(tag[9] ^ sealed[at + 9]) |
-    toU32(tag[10] ^ sealed[at + 10]) |
-    toU32(tag[11] ^ sealed[at + 11]) |
-    toU32(tag[12] ^ sealed[at + 12]) |
-    toU32(tag[13] ^ sealed[at + 13]) |
-    toU32(tag[14] ^ sealed[at + 14]) |
-    toU32(tag[15] ^ sealed[at + 15])
+    toU32(tag[0] ^ sealed[p]) |
+    toU32(tag[1] ^ sealed[p + 1]) |
+    toU32(tag[2] ^ sealed[p + 2]) |
+    toU32(tag[3] ^ sealed[p + 3]) |
+    toU32(tag[4] ^ sealed[p + 4]) |
+    toU32(tag[5] ^ sealed[p + 5]) |
+    toU32(tag[6] ^ sealed[p + 6]) |
+    toU32(tag[7] ^ sealed[p + 7]) |
+    toU32(tag[8] ^ sealed[p + 8]) |
+    toU32(tag[9] ^ sealed[p + 9]) |
+    toU32(tag[10] ^ sealed[p + 10]) |
+    toU32(tag[11] ^ sealed[p + 11]) |
+    toU32(tag[12] ^ sealed[p + 12]) |
+    toU32(tag[13] ^ sealed[p + 13]) |
+    toU32(tag[14] ^ sealed[p + 14]) |
+    toU32(tag[15] ^ sealed[p + 15])
   return ctEq(diff, 0)
 }
 

package/std/crypto/ct.ts

@@ -62,9 +62,14 @@ export const timingSafeEqualAt = (a: u8[], aOff: i32, b: u8[], bOff: i32, len: i
   if (aOff < 0 || bOff < 0 || len < 0 || aOff > aLen - len || bOff > bLen - len) {
     return false
   }
+  // The offsets are summed in `u32`, which wraps by definition, rather than
+  // as checked `i32` sums: the test above already put every `off + k` inside
+  // its array, so neither can wrap, and a check would only add a branch.
+  const aAt: u32 = toU32(aOff)
+  const bAt: u32 = toU32(bOff)
   let diff: i32 = 0
   for (let k: i32 = 0; k < len; k++) {
-    diff = diff | toI32(a[aOff + k] ^ b[bOff + k])
+    diff = diff | toI32(a[aAt + toU32(k)] ^ b[bAt + toU32(k)])
   }
   return diff === 0
 }

package/std/crypto/hkdf.ts

@@ -22,10 +22,60 @@
  * shorter than HashLen, which §2.3 does not allow: an empty one is a key
  * anybody can compute with.
  *
- * HKDF-Expand-Label, TLS 1.3's wrapper around `expand`, belongs with TLS and is
- * not here. Written from RFC 5869, not ported from another implementation.
+ * HKDF-Expand-Label is TLS 1.3's wrapper around `expand` (RFC 8446 §7.1), and
+ * QUIC derives its packet keys with it too (RFC 9001 §5.1), so it is here once
+ * for both rather than in each:
+ *
+ *     HKDF-Expand-Label(Secret, Label, Context, Length) =
+ *         HKDF-Expand(Secret, HkdfLabel, Length)
+ *     struct {
+ *         uint16 length = Length;
+ *         opaque label<7..255> = "tls13 " + Label;
+ *         opaque context<0..255> = Context;
+ *     } HkdfLabel;
+ *
+ *     const key: u8[] = hkdfExpandLabelSha256(secret, "quic key", [], 16);
+ *
+ * `label` is given without the `"tls13 "` prefix, which the function adds. Its
+ * arguments come from the program rather than from the peer — a label is a
+ * literal, a length a key or hash size, a context a transcript hash — so one
+ * out of range is a bug in the caller, and it panics rather than answering
+ * `null`: a length below 0 or above 255, a label empty or longer than 249
+ * bytes (the struct's 7 to 255 less the prefix), a context longer than 255
+ * bytes, and a secret shorter than HashLen.
+ *
+ * **Caller-owned scratch.** The functions above make their HMAC objects and
+ * their output fresh on every call, which stores allocations no arena scope
+ * may release around them. `hkdfExtractInto`, `hkdfExpandInto` and
+ * `hkdfExpandLabelInto` compute the same bytes in an `HkdfScratch` the caller
+ * allocates once, over the hash `hashLength` names (32 for SHA-256, 48 for
+ * SHA-384), and write them into the caller's array, so that a loop of key
+ * derivations inside one `using a = arena()` block leaves the arena where it
+ * was. Each wipes the scratch before it returns, its last block and the
+ * keyed hashers of the hash it ran over, so no key material outlives the
+ * call there:
+ *
+ *     const kdf = new HkdfScratch();                         // once
+ *     hkdfExtractInto(kdf, 32, salt, ikm, prk, 0);           // 32 bytes at prk[0]
+ *     hkdfExpandLabelInto(kdf, 32, prk, "key", context, 0, 0, key, 0, 16);
+ *
+ * They refuse what the functions above refuse, the same way: `hkdfExpandInto`
+ * answers `false` where `hkdfExpandSha256` answers `null`, and
+ * `hkdfExpandLabelInto` panics where `hkdfExpandLabelSha256` does. A hash
+ * length other than 32 or 48, or an output window outside its array, is the
+ * caller's bug and panics.
+ *
+ * Written from RFC 5869 and RFC 8446 §7.1, not ported from another
+ * implementation.
  */
-import { HmacSha256, HmacSha384, hmacSha256, hmacSha384 } from "nish/crypto/hmac"
+import {
+  HmacSha256,
+  HmacSha256Scratch,
+  HmacSha384,
+  HmacSha384Scratch,
+  hmacSha256,
+  hmacSha384,
+} from "nish/crypto/hmac"
 import { SHA256_SIZE } from "nish/crypto/sha256"
 import { SHA384_SIZE } from "nish/crypto/sha512"
 
@@ -35,6 +85,9 @@ const HKDF_MAX_BLOCKS: i32 = 255
 /** A typed zero for the offsets below: a bare literal is an `f64` under `--number-mode f64`. */
 const HKDF_FROM: i32 = 0
 
+/** What HKDF-Expand-Label puts before every label (RFC 8446 §7.1). */
+const HKDF_LABEL_PREFIX: string = "tls13 "
+
 /**
  * The salt `extract` keys HMAC with: `salt` itself, or HashLen zero bytes when
  * it is empty (RFC 5869 §2.2, "if not provided"). HMAC zero-pads a short key to
@@ -132,3 +185,311 @@ export const hkdfExpandSha384 = (prk: u8[], info: u8[], length: i32): u8[] | nul
   }
   return out
 }
+
+/**
+ * The `HkdfLabel` struct of RFC 8446 §7.1, the `info` HKDF-Expand-Label hands
+ * to `expand`, or a panic naming `caller` when `length`, `label` or `context`
+ * is outside the range the module docs give: 249 is `label<7..255>`'s 255 less
+ * the prefix's 6 bytes. The lengths of `label` and `context` are compared as
+ * the `number`s they are, before any `toI32`, which would saturate them under
+ * `--number-mode f64`; so the bounds are literals rather than `i32` constants.
+ */
+const hkdfLabel = (caller: string, label: string, context: u8[], length: i32): u8[] => {
+  if (length < 0 || length > 255) {
+    panic(`${caller}: a length of ${length} bytes, outside 0 to 255`)
+  }
+  if (label.length === 0 || label.length > 249) {
+    panic(`${caller}: a label of ${toI32(label.length)} bytes, outside 1 to 249`)
+  }
+  if (context.length > 255) {
+    panic(`${caller}: a context of more than 255 bytes`)
+  }
+  const full: string = `${HKDF_LABEL_PREFIX}${label}`
+  const fullLength: i32 = toI32(full.length)
+  const contextLength: i32 = toI32(context.length)
+  const out: u8[] = new Array<u8>(4 + fullLength + contextLength)
+  out[0] = toU8(length >> 8)
+  out[1] = toU8(length & 0xff)
+  out[2] = toU8(fullLength)
+  for (let k: i32 = 0; k < fullLength; k += 1) {
+    out[3 + k] = toU8(toI32(full.charCodeAt(k)))
+  }
+  out[3 + fullLength] = toU8(contextLength)
+  hkdfAppend(out, 4 + fullLength, context)
+  return out
+}
+
+/**
+ * HKDF-Expand-Label with HMAC-SHA-256 (RFC 8446 §7.1): `length` bytes from
+ * `secret`, `"tls13 " + label` and `context`. Panics on an argument out of the
+ * range the module docs give, a secret shorter than 32 bytes among them.
+ */
+export const hkdfExpandLabelSha256 = (secret: u8[], label: string, context: u8[], length: i32): u8[] => {
+  const okm: u8[] | null = hkdfExpandSha256(
+    secret,
+    hkdfLabel("hkdfExpandLabelSha256", label, context, length),
+    length
+  )
+  if (okm === null) {
+    panic("hkdfExpandLabelSha256: a secret shorter than 32 bytes")
+  }
+  return okm
+}
+
+/**
+ * HKDF-Expand-Label with HMAC-SHA-384 (RFC 8446 §7.1): `length` bytes from
+ * `secret`, `"tls13 " + label` and `context`. Panics on an argument out of the
+ * range the module docs give, a secret shorter than 48 bytes among them.
+ */
+export const hkdfExpandLabelSha384 = (secret: u8[], label: string, context: u8[], length: i32): u8[] => {
+  const okm: u8[] | null = hkdfExpandSha384(
+    secret,
+    hkdfLabel("hkdfExpandLabelSha384", label, context, length),
+    length
+  )
+  if (okm === null) {
+    panic("hkdfExpandLabelSha384: a secret shorter than 48 bytes")
+  }
+  return okm
+}
+
+// ---- Caller-owned scratch ----------------------------------------------------
+
+/** The longest `HkdfLabel`: two length bytes, `label<7..255>` and `context<0..255>`, each with its length byte. */
+const HKDF_LABEL_MAX: i32 = 514
+
+/**
+ * What the `*Into` functions compute in: an HMAC scratch for each hash, the
+ * previous output block T(i - 1), and the `HkdfLabel` HKDF-Expand-Label
+ * builds. Allocate one per long-lived owner — a connection slot, say — and
+ * hand it to every derivation; it carries nothing from one call to the next.
+ */
+export class HkdfScratch {
+  sha256: HmacSha256Scratch
+  sha384: HmacSha384Scratch
+  /** T(i - 1), HashLen bytes of it; wiped before every function returns. */
+  previous: u8[]
+  /** The one-byte block counter `i`. */
+  counter: u8[]
+  /** HKDF-Expand-Label's `info`, built here: public, so it is not wiped. */
+  label: u8[]
+
+  constructor() {
+    this.sha256 = new HmacSha256Scratch()
+    this.sha384 = new HmacSha384Scratch()
+    this.previous = new Array<u8>(SHA384_SIZE)
+    this.counter = new Array<u8>(1)
+    this.label = new Array<u8>(HKDF_LABEL_MAX)
+  }
+
+  /** Zeroes the key material the last derivation left: T(i - 1) and both keyed hashers. */
+  wipe(): void {
+    secureZero(this.previous)
+    this.sha256.wipe()
+    this.sha384.wipe()
+  }
+}
+
+/** Panics unless `hashLength` is 32 or 48, the two hashes HKDF runs over here. */
+const hkdfCheckHash = (caller: string, hashLength: i32): void => {
+  if (hashLength !== SHA256_SIZE && hashLength !== SHA384_SIZE) {
+    panic(`${caller}: a hash length of ${hashLength}, not 32 or 48`)
+  }
+}
+
+/** Panics unless `out[at .. at + length)` is a window inside `out`. */
+const hkdfCheckOutput = (caller: string, out: u8[], at: i32, length: i32): void => {
+  if (at < 0 || length < 0 || at > toI32(out.length) - length) {
+    panic(`${caller}: the output window is outside its array`)
+  }
+}
+
+/** Zeroes what the last derivation over `hashLength` left in `s`: T(i - 1) and that hash's keyed hashers. */
+const hkdfWipe = (s: HkdfScratch, hashLength: i32): void => {
+  secureZero(s.previous)
+  if (hashLength === SHA384_SIZE) {
+    s.sha384.wipe()
+  } else {
+    s.sha256.wipe()
+  }
+}
+
+/** Keys the scratch's HMAC for `hashLength` with `key[off .. off + len)`. */
+const hkdfMacBegin = (s: HkdfScratch, hashLength: i32, key: u8[], off: i32, len: i32): void => {
+  if (hashLength === SHA384_SIZE) {
+    s.sha384.begin(key, off, len)
+  } else {
+    s.sha256.begin(key, off, len)
+  }
+}
+
+/** Feeds `data[off .. off + len)` to the scratch's HMAC for `hashLength`. */
+const hkdfMacUpdate = (s: HkdfScratch, hashLength: i32, data: u8[], off: i32, len: i32): void => {
+  if (hashLength === SHA384_SIZE) {
+    s.sha384.update(data, off, len)
+  } else {
+    s.sha256.update(data, off, len)
+  }
+}
+
+/** Writes the HMAC for `hashLength`'s tag at `out[at]`. */
+const hkdfMacFinish = (s: HkdfScratch, hashLength: i32, out: u8[], at: i32): void => {
+  if (hashLength === SHA384_SIZE) {
+    s.sha384.finishInto(out, at)
+  } else {
+    s.sha256.finishInto(out, at)
+  }
+}
+
+/**
+ * HKDF-Extract (RFC 5869 §2.2) over the hash `hashLength` names, the PRK's
+ * HashLen bytes written at `out[at]`. An empty `salt` keys HMAC with no bytes,
+ * which HMAC pads to the block with zeros, exactly as the HashLen zeros §2.2
+ * asks for would be. An `ikm` longer than 2^31 - 1 bytes panics, as
+ * `hmacSha256` does.
+ */
+export const hkdfExtractInto = (
+  s: HkdfScratch,
+  hashLength: i32,
+  salt: u8[],
+  ikm: u8[],
+  out: u8[],
+  at: i32
+): void => {
+  hkdfCheckHash("hkdfExtractInto", hashLength)
+  hkdfCheckOutput("hkdfExtractInto", out, at, hashLength)
+  if (ikm.length > 2147483647) {
+    panic("hkdfExtractInto: input keying material longer than 2^31 - 1 bytes")
+  }
+  hkdfMacBegin(s, hashLength, salt, HKDF_FROM, toI32(salt.length))
+  hkdfMacUpdate(s, hashLength, ikm, HKDF_FROM, toI32(ikm.length))
+  hkdfMacFinish(s, hashLength, out, at)
+  hkdfWipe(s, hashLength)
+}
+
+/**
+ * The T(1) | T(2) | … loop of RFC 5869 §2.3, `length` bytes of it at
+ * `out[at]`, with `info` the first `infoLen` bytes of `info`.
+ * The callers have checked every bound.
+ */
+const hkdfExpandWindow = (
+  s: HkdfScratch,
+  hashLength: i32,
+  prk: u8[],
+  info: u8[],
+  infoLen: i32,
+  out: u8[],
+  at: i32,
+  length: i32
+): void => {
+  const counterLength: i32 = 1
+  let done: i32 = 0
+  let i: i32 = 1
+  while (done < length) {
+    hkdfMacBegin(s, hashLength, prk, HKDF_FROM, toI32(prk.length))
+    if (i > 1) {
+      hkdfMacUpdate(s, hashLength, s.previous, HKDF_FROM, hashLength)
+    }
+    hkdfMacUpdate(s, hashLength, info, HKDF_FROM, infoLen)
+    s.counter[0] = toU8(i)
+    hkdfMacUpdate(s, hashLength, s.counter, HKDF_FROM, counterLength)
+    hkdfMacFinish(s, hashLength, s.previous, HKDF_FROM)
+    for (let k: i32 = 0; k < hashLength && done < length && k < toI32(s.previous.length); k += 1) {
+      out[at + done] = s.previous[k]
+      done += 1
+    }
+    i += 1
+  }
+  hkdfWipe(s, hashLength)
+}
+
+/**
+ * HKDF-Expand (RFC 5869 §2.3) over the hash `hashLength` names: `length`
+ * bytes from `prk` and `info`, written at `out[at]`. `false`, writing nothing,
+ * where `hkdfExpandSha256` answers `null`: a `length` negative or past
+ * 255 × HashLen, an `info` longer than 2^31 - 1 bytes, or a `prk` shorter than
+ * HashLen.
+ */
+export const hkdfExpandInto = (
+  s: HkdfScratch,
+  hashLength: i32,
+  prk: u8[],
+  info: u8[],
+  out: u8[],
+  at: i32,
+  length: i32
+): boolean => {
+  hkdfCheckHash("hkdfExpandInto", hashLength)
+  if (
+    length < 0 ||
+    length > HKDF_MAX_BLOCKS * hashLength ||
+    info.length > 2147483647 ||
+    toI32(prk.length) < hashLength
+  ) {
+    return false
+  }
+  hkdfCheckOutput("hkdfExpandInto", out, at, length)
+  hkdfExpandWindow(s, hashLength, prk, info, toI32(info.length), out, at, length)
+  return true
+}
+
+/**
+ * HKDF-Expand-Label (RFC 8446 §7.1) over the hash `hashLength` names: `length`
+ * bytes from `secret`, `"tls13 " + label` and the context
+ * `context[contextOff .. contextOff + contextLen)`, written at `out[at]`. It
+ * panics where `hkdfExpandLabelSha256` does — a length outside 0 to 255, a
+ * label empty or past 249 bytes, a context past 255, a secret shorter than
+ * HashLen — and on a context window outside its array.
+ */
+export const hkdfExpandLabelInto = (
+  s: HkdfScratch,
+  hashLength: i32,
+  secret: u8[],
+  label: string,
+  context: u8[],
+  contextOff: i32,
+  contextLen: i32,
+  out: u8[],
+  at: i32,
+  length: i32
+): void => {
+  hkdfCheckHash("hkdfExpandLabelInto", hashLength)
+  if (length < 0 || length > 255) {
+    panic(`hkdfExpandLabelInto: a length of ${length} bytes, outside 0 to 255`)
+  }
+  if (label.length === 0 || label.length > 249) {
+    panic(`hkdfExpandLabelInto: a label of ${toI32(label.length)} bytes, outside 1 to 249`)
+  }
+  if (
+    contextOff < 0 ||
+    contextLen < 0 ||
+    contextOff > toI32(context.length) - contextLen ||
+    contextLen > 255
+  ) {
+    panic("hkdfExpandLabelInto: the context window is outside its array or longer than 255 bytes")
+  }
+  if (toI32(secret.length) < hashLength) {
+    panic("hkdfExpandLabelInto: a secret shorter than HashLen")
+  }
+  hkdfCheckOutput("hkdfExpandLabelInto", out, at, length)
+  // The `HkdfLabel` struct, as `hkdfLabel` builds it, into the scratch.
+  const prefixLength: i32 = toI32(HKDF_LABEL_PREFIX.length)
+  const labelLength: i32 = toI32(label.length)
+  const fullLength: i32 = prefixLength + labelLength
+  const info: u8[] = s.label
+  info[0] = toU8(length >> 8)
+  info[1] = toU8(length & 0xff)
+  info[2] = toU8(fullLength)
+  for (let k: i32 = 0; k < prefixLength && 3 + k < toI32(info.length); k += 1) {
+    info[3 + k] = toU8(toI32(HKDF_LABEL_PREFIX.charCodeAt(k)))
+  }
+  for (let k: i32 = 0; k < labelLength && 3 + prefixLength + k < toI32(info.length); k += 1) {
+    info[3 + prefixLength + k] = toU8(toI32(label.charCodeAt(k)))
+  }
+  const contextAt: i32 = 3 + fullLength
+  info[contextAt] = toU8(contextLen)
+  for (let k: i32 = 0; k < contextLen && contextAt + 1 + k < toI32(info.length); k += 1) {
+    info[contextAt + 1 + k] = context[contextOff + k]
+  }
+  hkdfExpandWindow(s, hashLength, secret, info, contextAt + 1 + contextLen, out, at, length)
+}