@electerm/ssh2 0.8.11 → 1.5.0

package/lib/protocol/crypto/src/binding.cc

@@ -0,0 +1,2003 @@
+// TODO: switch from obsolete EVP_* APIs in CCP
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+
+#include <node.h>
+#include <node_buffer.h>
+#include <nan.h>
+
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+
+using namespace node;
+using namespace v8;
+using namespace std;
+
+struct MarkPopErrorOnReturn {
+  MarkPopErrorOnReturn() { ERR_set_mark(); }
+  ~MarkPopErrorOnReturn() { ERR_pop_to_mark(); }
+};
+
+enum ErrorType {
+  kErrNone,
+  kErrOpenSSL,
+  kErrBadIVLen,
+  kErrBadKeyLen,
+  kErrAADFailure,
+  kErrTagFailure,
+  kErrPartialEncrypt,
+  kErrBadCipherName,
+  kErrBadHMACName,
+  kErrBadHMACLen,
+  kErrBadInit,
+  kErrPartialDecrypt,
+  kErrInvalidMAC,
+  kErrBadBlockLen
+};
+
+#define MAX_MAC_LEN 64
+
+#define POLY1305_KEYLEN   32
+#define POLY1305_TAGLEN   16
+class ChaChaPolyCipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("ChaChaPolyCipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "encrypt", Encrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("ChaChaPolyCipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit ChaChaPolyCipher()
+    : ctx_main_(nullptr),
+      ctx_pktlen_(nullptr),
+      md_ctx_(nullptr),
+      polykey_(nullptr) {}
+
+  ~ChaChaPolyCipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_pktlen_) {
+      EVP_CIPHER_CTX_cleanup(ctx_pktlen_);
+      EVP_CIPHER_CTX_free(ctx_pktlen_);
+      ctx_pktlen_ = nullptr;
+    }
+    if (ctx_main_) {
+      EVP_CIPHER_CTX_cleanup(ctx_main_);
+      EVP_CIPHER_CTX_free(ctx_main_);
+      ctx_main_ = nullptr;
+    }
+    if (polykey_) {
+      EVP_PKEY_free(polykey_);
+      polykey_ = nullptr;
+    }
+    if (md_ctx_) {
+      EVP_MD_CTX_free(md_ctx_);
+      md_ctx_ = nullptr;
+    }
+    // `polykey_ctx_` is not explicitly freed as it is freed implicitly when
+    // `md_ctx_` is freed
+  }
+
+  ErrorType init(unsigned char* keys, size_t keys_len) {
+    ErrorType r = kErrNone;
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname("chacha20");
+
+    if (keys_len != 64) {
+      r = kErrBadKeyLen;
+      goto out;
+    }
+
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if ((ctx_pktlen_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (ctx_main_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (md_ctx_ = EVP_MD_CTX_new()) == nullptr
+        || EVP_EncryptInit_ex(ctx_pktlen_,
+                              cipher,
+                              nullptr,
+                              keys + 32,
+                              nullptr) != 1
+        || EVP_EncryptInit_ex(ctx_main_,
+                              cipher,
+                              nullptr,
+                              keys,
+                              nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_CIPHER_CTX_iv_length(ctx_pktlen_) != 16) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  ErrorType encrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    uint32_t seqno) {
+    ErrorType r = kErrNone;
+    size_t sig_len = 16;
+    int outlen = 0;
+
+    // `packet` layout:
+    //   <packet length> <padding length> <payload> <padding> <poly1305 mac>
+    uint32_t data_len = packet_len - POLY1305_TAGLEN;
+
+    unsigned char polykey[POLY1305_KEYLEN] = {0};
+
+    uint8_t seqbuf[16] = {0};
+    ((uint8_t*)(seqbuf))[12] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[13] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[14] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[15] = seqno & 0xff;
+
+    // Generate Poly1305 key
+    if (EVP_EncryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_main_,
+                          polykey,
+                          &outlen,
+                          polykey,
+                          sizeof(polykey)) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != sizeof(polykey)) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Encrypt packet length
+    if (EVP_EncryptInit_ex(ctx_pktlen_,
+                           nullptr,
+                           nullptr,
+                           nullptr,
+                           seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_pktlen_, packet, &outlen, packet, 4) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != 4) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Encrypt rest of packet
+    seqbuf[0] = 1;
+    if (EVP_EncryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_main_,
+                          packet + 4,
+                          &outlen,
+                          packet + 4,
+                          data_len - 4) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != data_len - 4) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Poly1305 over ciphertext
+    if (polykey_) {
+      if (EVP_PKEY_CTX_ctrl(polykey_ctx_,
+                            -1,
+                            EVP_PKEY_OP_SIGNCTX,
+                            EVP_PKEY_CTRL_SET_MAC_KEY,
+                            sizeof(polykey),
+                            (void*)polykey) <= 0) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    } else {
+      polykey_ = EVP_PKEY_new_raw_private_key(EVP_PKEY_POLY1305,
+                                              nullptr,
+                                              polykey,
+                                              sizeof(polykey));
+      if (polykey_ == nullptr) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+
+      if (!EVP_DigestSignInit(md_ctx_,
+                              &polykey_ctx_,
+                              nullptr,
+                              nullptr,
+                              polykey_)) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    }
+
+    // Generate and write Poly1305 tag
+    if (EVP_DigestSign(md_ctx_,
+                       packet + data_len,
+                       &sig_len,
+                       packet,
+                       data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+  out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid keys");
+
+    ChaChaPolyCipher* obj = new ChaChaPolyCipher();
+    ErrorType r = obj->init(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0])
+    );
+    if (r != kErrNone) {
+      if (r == kErrOpenSSL) {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        obj->clear();
+        delete obj;
+        return Nan::ThrowError(msg_buf);
+      }
+      obj->clear();
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Encrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    ChaChaPolyCipher* obj = ObjectWrap::Unwrap<ChaChaPolyCipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    ErrorType r = obj->encrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust()
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown encrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    ChaChaPolyCipher* obj = ObjectWrap::Unwrap<ChaChaPolyCipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_main_;
+  EVP_CIPHER_CTX* ctx_pktlen_;
+  EVP_MD_CTX* md_ctx_;
+  EVP_PKEY* polykey_;
+  EVP_PKEY_CTX* polykey_ctx_;
+};
+
+class AESGCMCipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("AESGCMCipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "encrypt", Encrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("AESGCMCipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit AESGCMCipher() : ctx_(nullptr) {}
+
+  ~AESGCMCipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len) {
+    ErrorType r = kErrNone;
+
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (cipher != EVP_aes_128_gcm() && cipher != EVP_aes_256_gcm()) {
+      r = kErrBadCipherName;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_EncryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_AEAD_SET_IVLEN, iv_len, nullptr)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    //~ if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      //~ r = kErrBadIVLen;
+      //~ goto out;
+    //~ }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_EncryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_SET_IV_FIXED, -1, iv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+out:
+    return r;
+  }
+
+  ErrorType encrypt(unsigned char* packet, uint32_t packet_len) {
+    ErrorType r = kErrNone;
+
+    // `packet` layout:
+    //   <packet length> <padding length> <payload> <padding> <mac>
+    uint32_t data_len = packet_len - 16;
+
+    int outlen = 0;
+
+    // Increment IV
+    unsigned char lastiv[1];
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_IV_GEN, 1, lastiv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Set AAD (the packet length)
+    if (!EVP_EncryptUpdate(ctx_, nullptr, &outlen, packet, 4)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (outlen != 4) {
+      r = kErrAADFailure;
+      goto out;
+    }
+
+    // Encrypt everything but the packet length
+    if (EVP_EncryptUpdate(ctx_,
+                          packet + 4,
+                          &outlen,
+                          packet + 4,
+                          data_len - 4) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != data_len - 4) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Generate authentication tag
+    if (!EVP_EncryptFinal_ex(ctx_, nullptr, &outlen)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Write authentication tag
+    if (EVP_CIPHER_CTX_ctrl(ctx_,
+                            EVP_CTRL_AEAD_GET_TAG,
+                            16,
+                            packet + data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid OpenSSL cipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid iv");
+
+    const Nan::Utf8String cipher_name(info[0]);
+
+    AESGCMCipher* obj = new AESGCMCipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2])
+    );
+    if (r != kErrNone) {
+      if (r == kErrOpenSSL) {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        obj->clear();
+        delete obj;
+        return Nan::ThrowError(msg_buf);
+      }
+      obj->clear();
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid AES GCM cipher name");
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Encrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    AESGCMCipher* obj = ObjectWrap::Unwrap<AESGCMCipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    ErrorType r = obj->encrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0])
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrAADFailure:
+        return Nan::ThrowError("Error setting AAD");
+      case kErrPartialEncrypt:
+        return Nan::ThrowError("Failed to completely encrypt packet");
+      case kErrTagFailure:
+        return Nan::ThrowError("Error generating authentication tag");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown encrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    AESGCMCipher* obj = ObjectWrap::Unwrap<AESGCMCipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+};
+
+class GenericCipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("GenericCipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "encrypt", Encrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("GenericCipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit GenericCipher()
+    : ctx_(nullptr),
+      ctx_hmac_(nullptr),
+      hmac_len_(0),
+      is_etm_(0) {}
+
+  ~GenericCipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+    if (ctx_hmac_) {
+      HMAC_CTX_free(ctx_hmac_);
+      ctx_hmac_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len,
+                 const char* hmac_name,
+                 unsigned char* hmac_key,
+                 size_t hmac_key_len,
+                 int is_etm) {
+    ErrorType r = kErrNone;
+
+    const EVP_MD* md;
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_EncryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_EncryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+    if (cipher == EVP_rc4()) {
+      /* The "arcfour128" algorithm is the RC4 cipher, as described in
+         [SCHNEIER], using a 128-bit key.  The first 1536 bytes of keystream
+         generated by the cipher MUST be discarded, and the first byte of the
+         first encrypted packet MUST be encrypted using the 1537th byte of
+         keystream.
+
+         -- http://tools.ietf.org/html/rfc4345#section-4 */
+      unsigned char zeros[1536] = {0};
+      int outlen = sizeof(zeros);
+      if (EVP_EncryptUpdate(ctx_,
+                            zeros,
+                            &outlen,
+                            zeros,
+                            sizeof(zeros)) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != sizeof(zeros)) {
+        r = kErrBadInit;
+        goto out;
+      }
+    }
+
+    md = EVP_get_digestbyname(hmac_name);
+    if (md == nullptr) {
+      r = kErrBadHMACName;
+      goto out;
+    }
+
+    if ((ctx_hmac_ = HMAC_CTX_new()) == nullptr
+        || HMAC_Init_ex(ctx_hmac_, hmac_key, hmac_key_len, md, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    hmac_len_ = HMAC_size(ctx_hmac_);
+    is_etm_ = is_etm;
+
+out:
+    return r;
+  }
+
+  ErrorType encrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    uint32_t seqno) {
+    ErrorType r = kErrNone;
+
+    // `packet` layout:
+    //   <packet length> <padding length> <payload> <padding> <mac>
+    uint32_t data_len = packet_len - hmac_len_;
+
+    int outlen;
+
+    uint8_t seqbuf[4] = {0};
+    ((uint8_t*)(seqbuf))[0] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[1] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[2] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[3] = seqno & 0xff;
+
+    if (is_etm_) {
+      // Encrypt everything but packet length
+      if (EVP_EncryptUpdate(ctx_,
+                            packet + 4,
+                            &outlen,
+                            packet + 4,
+                            data_len - 4) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != data_len - 4) {
+        r = kErrPartialEncrypt;
+        goto out;
+      }
+
+      // HMAC over unencrypted packet length and ciphertext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, packet, data_len) != 1
+            || HMAC_Final(ctx_hmac_, packet + data_len, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+        if (outlen != hmac_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+      }
+    } else {
+      // HMAC over plaintext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, packet, data_len) != 1
+            || HMAC_Final(ctx_hmac_, packet + data_len, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+        if (outlen != hmac_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+      }
+
+      // Encrypt packet
+      if (EVP_EncryptUpdate(ctx_,
+                            packet,
+                            &outlen,
+                            packet,
+                            data_len) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != data_len) {
+        
+        r = kErrPartialEncrypt;
+        goto out;
+      }
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid cipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid cipher key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid cipher IV");
+
+    if (!info[3]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC name");
+
+    if (!Buffer::HasInstance(info[4]))
+      return Nan::ThrowTypeError("Missing/Invalid HMAC key");
+
+    if (!info[5]->IsBoolean())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC ETM flag");
+
+    const Nan::Utf8String cipher_name(info[0]);
+    const Nan::Utf8String mac_name(info[3]);
+    int is_etm = (Nan::To<bool>(info[5]).FromJust() ? 1 : 0);
+
+    GenericCipher* obj = new GenericCipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2]),
+      *mac_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[4])),
+      Buffer::Length(info[4]),
+      is_etm
+    );
+    if (r != kErrNone) {
+      if (r == kErrOpenSSL) {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        obj->clear();
+        delete obj;
+        return Nan::ThrowError(msg_buf);
+      }
+      obj->clear();
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid cipher name");
+        case kErrBadHMACName:
+          return Nan::ThrowError("Invalid MAC name");
+        case kErrBadInit:
+          return Nan::ThrowError("Failed to properly initialize cipher");
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Encrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    GenericCipher* obj = ObjectWrap::Unwrap<GenericCipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    ErrorType r = obj->encrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust()
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrPartialEncrypt:
+        return Nan::ThrowError("Failed to completely encrypt packet");
+      case kErrBadHMACLen:
+        return Nan::ThrowError("Unexpected HMAC length");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown encrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    GenericCipher* obj = ObjectWrap::Unwrap<GenericCipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+  HMAC_CTX* ctx_hmac_;
+  unsigned int hmac_len_;
+  int is_etm_;
+};
+
+// =============================================================================
+
+class ChaChaPolyDecipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("ChaChaPolyDecipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "decrypt", Decrypt);
+    SetPrototypeMethod(tpl, "decryptLen", DecryptLen);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("ChaChaPolyDecipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit ChaChaPolyDecipher()
+    : ctx_main_(nullptr),
+      ctx_pktlen_(nullptr),
+      md_ctx_(nullptr),
+      polykey_(nullptr) {}
+
+  ~ChaChaPolyDecipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_pktlen_) {
+      EVP_CIPHER_CTX_cleanup(ctx_pktlen_);
+      EVP_CIPHER_CTX_free(ctx_pktlen_);
+      ctx_pktlen_ = nullptr;
+    }
+    if (ctx_main_) {
+      EVP_CIPHER_CTX_cleanup(ctx_main_);
+      EVP_CIPHER_CTX_free(ctx_main_);
+      ctx_main_ = nullptr;
+    }
+    if (polykey_) {
+      EVP_PKEY_free(polykey_);
+      polykey_ = nullptr;
+    }
+    if (md_ctx_) {
+      EVP_MD_CTX_free(md_ctx_);
+      md_ctx_ = nullptr;
+    }
+    // `polykey_ctx_` is not explicitly freed as it is freed implicitly when
+    // `md_ctx_` is freed
+  }
+
+  ErrorType init(unsigned char* keys, size_t keys_len) {
+    ErrorType r = kErrNone;
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname("chacha20");
+
+    if (keys_len != 64) {
+      r = kErrBadKeyLen;
+      goto out;
+    }
+
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if ((ctx_pktlen_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (ctx_main_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (md_ctx_ = EVP_MD_CTX_new()) == nullptr
+        || EVP_DecryptInit_ex(ctx_pktlen_,
+                              cipher,
+                              nullptr,
+                              keys + 32,
+                              nullptr) != 1
+        || EVP_DecryptInit_ex(ctx_main_,
+                              cipher,
+                              nullptr,
+                              keys,
+                              nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_CIPHER_CTX_iv_length(ctx_pktlen_) != 16) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  ErrorType decrypt_length(unsigned char* data,
+                           size_t data_len,
+                           uint32_t seqno,
+                           uint32_t* packet_length) {
+    ErrorType r = kErrNone;
+    int outlen;
+
+    unsigned char dec_length_bytes[4];
+
+    uint8_t seqbuf[16] = {0};
+    ((uint8_t*)(seqbuf))[12] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[13] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[14] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[15] = seqno & 0xff;
+
+    if (EVP_DecryptInit_ex(ctx_pktlen_,
+                           nullptr,
+                           nullptr,
+                           nullptr,
+                           seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_DecryptUpdate(ctx_pktlen_,
+                          dec_length_bytes,
+                          &outlen,
+                          data,
+                          data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != 4) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+    *packet_length = (uint32_t)dec_length_bytes[0] << 24
+                     | (uint32_t)dec_length_bytes[1] << 16
+                     | (uint32_t)dec_length_bytes[2] << 8
+                     | (uint32_t)dec_length_bytes[3];
+    memcpy(length_bytes, data, data_len);
+out:
+    return r;
+  }
+
+  ErrorType decrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    unsigned char* mac,
+                    uint32_t seqno) {
+    ErrorType r = kErrNone;
+    size_t sig_len = 16;
+    int outlen = 0;
+
+    // `packet` layout:
+    //   <padding length> <payload> <padding>
+
+    unsigned char polykey[POLY1305_KEYLEN] = {0};
+    unsigned char calc_mac[POLY1305_TAGLEN] = {0};
+
+    uint8_t seqbuf[16] = {0};
+    ((uint8_t*)(seqbuf))[12] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[13] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[14] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[15] = seqno & 0xff;
+
+    // Generate Poly1305 key
+    if (EVP_EncryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_main_,
+                          polykey,
+                          &outlen,
+                          polykey,
+                          sizeof(polykey)) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != sizeof(polykey)) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Poly1305 over ciphertext
+    if (polykey_) {
+      if (EVP_PKEY_CTX_ctrl(polykey_ctx_,
+                            -1,
+                            EVP_PKEY_OP_SIGNCTX,
+                            EVP_PKEY_CTRL_SET_MAC_KEY,
+                            sizeof(polykey),
+                            (void*)polykey) <= 0) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    } else {
+      polykey_ = EVP_PKEY_new_raw_private_key(EVP_PKEY_POLY1305,
+                                              nullptr,
+                                              polykey,
+                                              sizeof(polykey));
+      if (polykey_ == nullptr) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+
+      if (!EVP_DigestSignInit(md_ctx_,
+                              &polykey_ctx_,
+                              nullptr,
+                              nullptr,
+                              polykey_)) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    }
+    if (EVP_DigestSignUpdate(md_ctx_,
+                             length_bytes,
+                             sizeof(length_bytes)) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_DigestSignUpdate(md_ctx_, packet, packet_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Generate Poly1305 MAC
+    if (EVP_DigestSignFinal(md_ctx_, calc_mac, &sig_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Compare MACs
+    if (CRYPTO_memcmp(mac, calc_mac, sizeof(calc_mac))) {
+      r = kErrInvalidMAC;
+      goto out;
+    }
+
+    // Decrypt packet
+    seqbuf[0] = 1;
+    if (EVP_DecryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_DecryptUpdate(ctx_main_,
+                          packet,
+                          &outlen,
+                          packet,
+                          packet_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != packet_len) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+  out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid keys");
+
+    ChaChaPolyDecipher* obj = new ChaChaPolyDecipher();
+    ErrorType r = obj->init(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0])
+    );
+    if (r != kErrNone) {
+      if (r == kErrOpenSSL) {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        obj->clear();
+        delete obj;
+        return Nan::ThrowError(msg_buf);
+      }
+      obj->clear();
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(DecryptLen) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    ChaChaPolyDecipher* obj =
+      ObjectWrap::Unwrap<ChaChaPolyDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]) || Buffer::Length(info[0]) != 4)
+      return Nan::ThrowTypeError("Missing/Invalid length bytes");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    unsigned char* length_bytes =
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0]));
+
+    uint32_t dec_packet_length;
+    ErrorType r = obj->decrypt_length(
+      length_bytes,
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust(),
+      &dec_packet_length
+    );
+
+    switch (r) {
+      case kErrNone:
+        return info.GetReturnValue().Set(dec_packet_length);
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet length");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Decrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    ChaChaPolyDecipher* obj =
+      ObjectWrap::Unwrap<ChaChaPolyDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!Buffer::HasInstance(info[1])
+        || Buffer::Length(info[1]) != POLY1305_TAGLEN) {
+      return Nan::ThrowTypeError("Missing/Invalid mac");
+    }
+
+    if (!info[2]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    ErrorType r = obj->decrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Nan::To<uint32_t>(info[2]).FromJust()
+    );
+
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrInvalidMAC:
+        return Nan::ThrowError("Invalid MAC");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet length");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    ChaChaPolyDecipher* obj =
+      ObjectWrap::Unwrap<ChaChaPolyDecipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  unsigned char length_bytes[4];
+  EVP_CIPHER_CTX* ctx_main_;
+  EVP_CIPHER_CTX* ctx_pktlen_;
+  EVP_MD_CTX* md_ctx_;
+  EVP_PKEY* polykey_;
+  EVP_PKEY_CTX* polykey_ctx_;
+};
+
+class AESGCMDecipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("AESGCMDecipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "decrypt", Decrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("AESGCMDecipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit AESGCMDecipher() : ctx_(nullptr) {}
+
+  ~AESGCMDecipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len) {
+    ErrorType r = kErrNone;
+
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (cipher != EVP_aes_128_gcm() && cipher != EVP_aes_256_gcm()) {
+      r = kErrBadCipherName;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_DecryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_AEAD_SET_IVLEN, iv_len, nullptr)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    //~ if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      //~ r = kErrBadIVLen;
+      //~ goto out;
+    //~ }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_DecryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_SET_IV_FIXED, -1, iv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+out:
+    return r;
+  }
+
+  ErrorType decrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    unsigned char* length_bytes,
+                    unsigned char* tag) {
+    ErrorType r = kErrNone;
+
+    // `packet` layout:
+    //   <padding length> <payload> <padding>
+
+    int outlen;
+
+    // Increment IV
+    unsigned char lastiv[1];
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_IV_GEN, 1, lastiv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Set AAD (the packet length)
+    if (!EVP_DecryptUpdate(ctx_, nullptr, &outlen, length_bytes, 4)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (outlen != 4) {
+      r = kErrAADFailure;
+      goto out;
+    }
+
+    // Decrypt everything but the packet length
+    if (EVP_DecryptUpdate(ctx_, packet, &outlen, packet, packet_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != packet_len) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+    // Set authentication tag
+    if (EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_AEAD_SET_TAG, 16, tag) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Verify authentication tag
+    if (!EVP_DecryptFinal_ex(ctx_, nullptr, &outlen)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid OpenSSL cipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid iv");
+
+    const Nan::Utf8String cipher_name(info[0]);
+
+    AESGCMDecipher* obj = new AESGCMDecipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2])
+    );
+    if (r != kErrNone) {
+      if (r == kErrOpenSSL) {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        obj->clear();
+        delete obj;
+        return Nan::ThrowError(msg_buf);
+      }
+      obj->clear();
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid AES GCM cipher name");
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Decrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    AESGCMDecipher* obj = ObjectWrap::Unwrap<AESGCMDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid length");
+
+    if (!Buffer::HasInstance(info[2]) || Buffer::Length(info[2]) != 16)
+      return Nan::ThrowTypeError("Missing/Invalid tag");
+
+    uint32_t length = Nan::To<uint32_t>(info[1]).FromJust();
+    unsigned char length_bytes[4];
+    length_bytes[0] = (length >> 24) & 0xFF;
+    length_bytes[1] = (length >> 16) & 0xFF;
+    length_bytes[2] = (length >> 8) & 0xFF;
+    length_bytes[3] = length & 0xFF;
+
+    ErrorType r = obj->decrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      length_bytes,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2]))
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrAADFailure:
+        return Nan::ThrowError("Error setting AAD");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet");
+      case kErrTagFailure:
+        return Nan::ThrowError("Error generating authentication tag");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    AESGCMDecipher* obj = ObjectWrap::Unwrap<AESGCMDecipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+};
+
+class GenericDecipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("GenericDecipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "decryptBlock", DecryptBlock);
+    SetPrototypeMethod(tpl, "decrypt", Decrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("GenericDecipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit GenericDecipher()
+    : ctx_(nullptr),
+      ctx_hmac_(nullptr),
+      hmac_len_(0),
+      is_etm_(0) {}
+
+  ~GenericDecipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+    if (ctx_hmac_) {
+      HMAC_CTX_free(ctx_hmac_);
+      ctx_hmac_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len,
+                 const char* hmac_name,
+                 unsigned char* hmac_key,
+                 size_t hmac_key_len,
+                 int is_etm,
+                 size_t hmac_actual_len) {
+    ErrorType r = kErrNone;
+
+    const EVP_MD* md;
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_DecryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_DecryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+    if (cipher == EVP_rc4()) {
+      /* The "arcfour128" algorithm is the RC4 cipher, as described in
+         [SCHNEIER], using a 128-bit key.  The first 1536 bytes of keystream
+         generated by the cipher MUST be discarded, and the first byte of the
+         first encrypted packet MUST be encrypted using the 1537th byte of
+         keystream.
+
+         -- http://tools.ietf.org/html/rfc4345#section-4 */
+      unsigned char zeros[1536] = {0};
+      int outlen = sizeof(zeros);
+      if (EVP_DecryptUpdate(ctx_,
+                            zeros,
+                            &outlen,
+                            zeros,
+                            sizeof(zeros)) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != sizeof(zeros)) {
+        r = kErrBadInit;
+        goto out;
+      }
+    }
+
+    md = EVP_get_digestbyname(hmac_name);
+    if (md == nullptr) {
+      r = kErrBadHMACName;
+      goto out;
+    }
+
+    if ((ctx_hmac_ = HMAC_CTX_new()) == nullptr
+        || HMAC_Init_ex(ctx_hmac_, hmac_key, hmac_key_len, md, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    hmac_len_ = HMAC_size(ctx_hmac_);
+    hmac_actual_len_ = hmac_actual_len;
+    is_etm_ = is_etm;
+    switch (EVP_CIPHER_CTX_mode(ctx_)) {
+      case EVP_CIPH_STREAM_CIPHER:
+      case EVP_CIPH_CTR_MODE:
+        is_stream_ = 1;
+        break;
+      default:
+        is_stream_ = 0;
+    }
+    block_size_ = EVP_CIPHER_CTX_block_size(ctx_);
+
+out:
+    return r;
+  }
+
+  ErrorType decrypt_block(unsigned char* data, uint32_t data_len) {
+    ErrorType r = kErrNone;
+
+    int outlen;
+
+    if (!is_stream_ && data_len != block_size_) {
+      r = kErrBadBlockLen;
+      goto out;
+    }
+
+    // Decrypt block
+    if (EVP_DecryptUpdate(ctx_, data, &outlen, data, data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != data_len) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  ErrorType decrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    uint32_t seqno,
+                    unsigned char* first_block,
+                    uint32_t first_block_len,
+                    unsigned char* mac,
+                    uint32_t mac_len) {
+    ErrorType r = kErrNone;
+
+    int outlen;
+    unsigned char calc_mac[MAX_MAC_LEN] = {0};
+
+    uint8_t seqbuf[4] = {0};
+    ((uint8_t*)(seqbuf))[0] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[1] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[2] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[3] = seqno & 0xff;
+
+    if (is_etm_) {
+      // `first_block` for ETM should just be the unencrypted packet length
+      if (first_block_len != 4) {
+        r = kErrBadBlockLen;
+        goto out;
+      }
+
+      // HMAC over unencrypted packet length and ciphertext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, first_block, 4) != 1
+            || HMAC_Update(ctx_hmac_, packet, packet_len) != 1
+            || HMAC_Final(ctx_hmac_, calc_mac, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+
+        if (outlen != hmac_len_ || mac_len != hmac_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+
+        // Compare MACs
+        if (CRYPTO_memcmp(mac, calc_mac, hmac_len_)) {
+          r = kErrInvalidMAC;
+          goto out;
+        }
+      }
+
+      // Decrypt packet
+      if (EVP_DecryptUpdate(ctx_, packet, &outlen, packet, packet_len) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != packet_len) {
+        r = kErrPartialDecrypt;
+        goto out;
+      }
+    } else {
+      // `first_block` for non-ETM should be a completely decrypted first block
+      if (!is_stream_ && first_block_len != block_size_) {
+        r = kErrBadBlockLen;
+        goto out;
+      }
+
+      const int offset = (is_stream_ ? 0 : block_size_ - 4);
+      // Decrypt the rest of the packet
+      if (EVP_DecryptUpdate(ctx_,
+                            packet + offset,
+                            &outlen,
+                            packet + offset,
+                            packet_len - offset) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != packet_len - offset) {
+        r = kErrPartialDecrypt;
+        goto out;
+      }
+
+      // HMAC over plaintext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, first_block, 4) != 1
+            || HMAC_Update(ctx_hmac_, packet, packet_len) != 1
+            || HMAC_Final(ctx_hmac_, calc_mac, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+
+        if (outlen != hmac_len_ || mac_len != hmac_actual_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+
+        // Compare MACs
+        if (CRYPTO_memcmp(mac, calc_mac, hmac_actual_len_)) {
+          r = kErrInvalidMAC;
+          goto out;
+        }
+      }
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid decipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid decipher key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid decipher IV");
+
+    if (!info[3]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC name");
+
+    if (!Buffer::HasInstance(info[4]))
+      return Nan::ThrowTypeError("Missing/Invalid HMAC key");
+
+    if (!info[5]->IsBoolean())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC ETM flag");
+
+    if (!info[6]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC ETM flag");
+
+    const Nan::Utf8String cipher_name(info[0]);
+    const Nan::Utf8String mac_name(info[3]);
+    int is_etm = (Nan::To<bool>(info[5]).FromJust() ? 1 : 0);
+
+    GenericDecipher* obj = new GenericDecipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2]),
+      *mac_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[4])),
+      Buffer::Length(info[4]),
+      is_etm,
+      Nan::To<uint32_t>(info[6]).FromJust()
+    );
+    if (r != kErrNone) {
+      if (r == kErrOpenSSL) {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        obj->clear();
+        delete obj;
+        return Nan::ThrowError(msg_buf);
+      }
+      obj->clear();
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid decipher key length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid decipher IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid decipher name");
+        case kErrBadHMACName:
+          return Nan::ThrowError("Invalid MAC name");
+        case kErrBadInit:
+          return Nan::ThrowError("Failed to properly initialize decipher");
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(DecryptBlock) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    GenericDecipher* obj = ObjectWrap::Unwrap<GenericDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid block");
+
+    ErrorType r = obj->decrypt_block(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0])
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrBadBlockLen:
+        return Nan::ThrowError("Invalid block length");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Decrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    GenericDecipher* obj = ObjectWrap::Unwrap<GenericDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid first block");
+
+    if (!Buffer::HasInstance(info[3]))
+      return Nan::ThrowTypeError("Missing/Invalid MAC");
+
+    ErrorType r = obj->decrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust(),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[3])),
+      Buffer::Length(info[3])
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrBadBlockLen:
+        return Nan::ThrowError("Invalid block length");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet");
+      case kErrBadHMACLen:
+        return Nan::ThrowError("Unexpected HMAC length");
+      case kErrInvalidMAC:
+        return Nan::ThrowError("Invalid MAC");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        ERR_clear_error();
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    GenericDecipher* obj = ObjectWrap::Unwrap<GenericDecipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+  HMAC_CTX* ctx_hmac_;
+  unsigned int hmac_len_;
+  unsigned int hmac_actual_len_;
+  uint8_t is_etm_;
+  uint8_t is_stream_;
+  uint32_t block_size_;
+};
+
+
+NAN_MODULE_INIT(init) {
+  ChaChaPolyCipher::Init(target);
+  AESGCMCipher::Init(target);
+  GenericCipher::Init(target);
+
+  ChaChaPolyDecipher::Init(target);
+  AESGCMDecipher::Init(target);
+  GenericDecipher::Init(target);
+}
+
+NODE_MODULE(sshcrypto, init)