@li0ard/gost 0.1.6 → 0.1.8

package/modes/mac.js

@@ -1,10 +1,19 @@
-import {} from "@noble/hashes/utils.js";
+import { concatBytes } from "@noble/hashes/utils.js";
 import { pad1, pad3, xorBytes } from "../utils.js";
-import { bytesToNumberBE, numberToVarBytesBE } from "@noble/curves/utils.js";
+import { bytesToNumberBE, bytesToNumberLE, numberToBytesLE, numberToVarBytesBE } from "@noble/curves/utils.js";
 import { magmaKeySequences, Magma } from "../magma/index.js";
 import { acpkm_master } from "./_keytransform.js";
 const Rb64 = 0b11011;
 const Rb128 = 0b10000111;
+const shift1 = (src, dst) => {
+    let b = 0;
+    for (let i = src.length - 1; i >= 0; i--) {
+        const bb = src[i] >> 7;
+        dst[i] = src[i] << 1 | b;
+        b = bb;
+    }
+    return b;
+};
 /**
  * **EN:** Message Authentication Code (MAC) mode
  *
@@ -12,36 +21,36 @@ const Rb128 = 0b10000111;
  */
 export const mac = (cipher) => {
     const encrypter = cipher.encrypt.bind(cipher);
-    const macShift = (data, xorLsb = 0) => numberToVarBytesBE((bytesToNumberBE(data) * BigInt(2)) ^ BigInt(xorLsb)).slice(-cipher.blockSize);
-    const macKs = () => {
-        const Rb = cipher.blockSize === 16 ? Rb128 : Rb64;
-        const l = encrypter(new Uint8Array(cipher.blockSize));
-        let k1;
-        if ((l[0] & 0x80) !== 0)
-            k1 = macShift(l, Rb);
-        else
-            k1 = macShift(l);
-        let k2;
-        if ((k1[0] & 0x80) !== 0)
-            k2 = macShift(k1, Rb);
-        else
-            k2 = macShift(k1);
-        return [k1, k2];
-    };
+    const Rb = cipher.blockSize === 16 ? Rb128 : Rb64;
+    const L = encrypter(new Uint8Array(cipher.blockSize));
     return {
         compute: (msg) => {
-            const [k1, k2] = macKs();
-            let tailOffset;
-            if (msg.length % cipher.blockSize === 0)
-                tailOffset = msg.length - cipher.blockSize;
-            else
-                tailOffset = msg.length - (msg.length % cipher.blockSize);
-            let prev = new Uint8Array(cipher.blockSize);
-            for (let i = 0; i < tailOffset; i += cipher.blockSize)
-                prev = encrypter(xorBytes(msg.subarray(i, i + cipher.blockSize), prev));
-            const tail = msg.subarray(tailOffset);
-            const xorWithPrev = xorBytes(pad3(tail, cipher.blockSize), prev);
-            return encrypter(xorBytes(xorWithPrev, (tail.length === cipher.blockSize ? k1 : k2)));
+            const k1 = new Uint8Array(cipher.blockSize);
+            const msb = shift1(L, k1);
+            if (msb)
+                k1[cipher.blockSize - 1] ^= Rb;
+            const k2 = new Uint8Array(cipher.blockSize);
+            const msb2 = shift1(k1, k2);
+            if (msb2)
+                k2[cipher.blockSize - 1] ^= Rb;
+            const n = Math.ceil(msg.length / cipher.blockSize) || 1;
+            const lastBlockComplete = msg.length > 0 && msg.length % cipher.blockSize === 0;
+            let buf = new Uint8Array(cipher.blockSize);
+            for (let i = 0; i < n - 1; i++) {
+                const m = msg.subarray(i * cipher.blockSize, (i + 1) * cipher.blockSize);
+                buf = encrypter(xorBytes(buf, m));
+            }
+            let lastBlock;
+            if (lastBlockComplete && msg.length > 0)
+                lastBlock = xorBytes(msg.subarray((n - 1) * cipher.blockSize, n * cipher.blockSize), k1);
+            else {
+                const padded = new Uint8Array(cipher.blockSize);
+                const remaining = msg.length - (n - 1) * cipher.blockSize;
+                padded.set(msg.subarray((n - 1) * cipher.blockSize));
+                padded[remaining] = 0x80;
+                lastBlock = xorBytes(padded, k2);
+            }
+            return encrypter(xorBytes(buf, lastBlock));
         }
     };
 };
@@ -52,19 +61,16 @@ export const mac = (cipher) => {
  */
 export const mac_legacy = (cipher, iv = new Uint8Array(cipher.blockSize)) => {
     const split = (data) => [
-        (data[0] | data[1] << 8 | data[2] << 16 | data[3] << 24) >>> 0,
-        (data[4] | data[5] << 8 | data[6] << 16 | data[7] << 24) >>> 0
+        Number(bytesToNumberLE(data.subarray(0, 4))),
+        Number(bytesToNumberLE(data.subarray(4, 8)))
     ];
-    const join = (ns) => new Uint8Array([
-        (ns[1] >> 0) & 0xFF, (ns[1] >> 8) & 0xFF, (ns[1] >> 16) & 0xFF, (ns[1] >> 24) & 0xFF,
-        (ns[0] >> 0) & 0xFF, (ns[0] >> 8) & 0xFF, (ns[0] >> 16) & 0xFF, (ns[0] >> 24) & 0xFF
-    ]);
+    const join = (ns) => concatBytes(numberToBytesLE(ns[1], 4), numberToBytesLE(ns[0], 4));
     return {
         compute: (msg) => {
             const paddedData = pad1(msg, cipher.blockSize);
             let prev = split(iv).reverse();
             for (let i = 0; i < paddedData.length; i += cipher.blockSize)
-                prev = split(Magma.reverseChunks(cipher.proceedBlock(Magma.reverseChunks(xorBytes(paddedData.subarray(i, i + cipher.blockSize), join(prev))), magmaKeySequences.MAC)));
+                prev = split(cipher.proceedBlock(xorBytes(paddedData.subarray(i, i + cipher.blockSize), join(prev)), magmaKeySequences.MAC));
             return join(prev);
         }
     };

package/modes/mgm.js

@@ -1,6 +1,7 @@
 import { concatBytes } from "@noble/hashes/utils.js";
 import { bytesToNumberBE, equalBytes, numberToBytesBE } from "@noble/curves/utils.js";
 import { pad1, xorBytes } from "../utils.js";
+import { gf64Multiply, gf128Multiply } from "../gf/index.js";
 /**
  * **EN:** Multilinear Galois (MGM) mode (AEAD)
  *
@@ -15,29 +16,13 @@ export const mgm = (cipher, nonce, tagSize = cipher.blockSize) => {
         throw new Error("Invalid tagSize");
     const encrypter = cipher.encrypt.bind(cipher);
     const maxSize = (1n << BigInt(cipher.blockSize * 4)) - 1n;
-    const r = (cipher.blockSize == 8 ? 0x1B : 0x87);
     const validateSizes = (plaintext, additional) => {
         if (plaintext.length == 0 && additional.length == 0)
             throw new Error("At least one of plaintext or additional_data required");
         if ((plaintext.length + additional.length) > maxSize)
             throw new Error("plaintext+additional_data are too big");
     };
-    const mul = (a, b) => {
-        let x = bytesToNumberBE(a);
-        let y = bytesToNumberBE(b);
-        let z = 0n;
-        const max_bit = 1n << (BigInt(cipher.blockSize) * 8n - 1n);
-        while (y > 0n) {
-            if ((y & 1n) == 1n)
-                z ^= x;
-            if ((x & max_bit) > 0n)
-                x = ((x ^ max_bit) << 1n) ^ BigInt(r);
-            else
-                x <<= 1n;
-            y >>= 1n;
-        }
-        return numberToBytesBE(z, cipher.blockSize);
-    };
+    const mul = (cipher.blockSize == 8 ? gf64Multiply : gf128Multiply);
     const crypt = (icn, data) => {
         icn[0] &= 0x7F;
         let enc = encrypter(icn);

package/modes/wrap.d.ts

@@ -11,4 +11,4 @@ export declare const kexp15: (cipherEnc: Cipher, cipherMac: Cipher, iv: TArg<Uin
  *
  * **RU:** Режим обёртки ключей шифрования согласно ГОСТ 28147-89
  */
-export declare const kwp: (kek: TArg<Uint8Array>, isCryptoPro?: boolean, sbox?: TArg<Uint8Array>[]) => WrapModeMagma;
+export declare const kwp: (kek: TArg<Uint8Array>, isCryptoPro?: boolean, sbox?: TArg<Uint8Array>) => WrapModeMagma;

package/modes/wrap.js

@@ -2,7 +2,7 @@ import { concatBytes } from "@noble/hashes/utils.js";
 import { mac as _mac, mac_legacy } from "./mac.js";
 import { ctr } from "./ctr.js";
 import { equalBytes } from "@noble/curves/utils.js";
-import { ID_GOST_28147_89_CRYPTO_PRO_A_PARAM_SET } from "../magma/const";
+import { ID_GOST_28147_89_CRYPTO_PRO_A_PARAM_SET } from "../magma/const.js";
 import { Magma } from "../magma/index.js";
 import { ecb } from "./ecb.js";
 import { cp_kek_diversify } from "./_keytransform.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@li0ard/gost",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "main": "index.js",
   "types": "index.d.ts",
   "type": "module",

package/streebog/index.d.ts

@@ -15,7 +15,11 @@ declare abstract class Streebog<T extends Streebog<T>> implements Hash<Streebog<
     digest(): TRet<Uint8Array>;
     digestInto(buf: TArg<Uint8Array>): void;
 }
-/** Streebog-256 (GOST R 34.11-2012) hash function */
+/**
+ * **Streebog-256 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */
 export declare class Streebog256 extends Streebog<Streebog256> {
     /** Streebog-256 (GOST R 34.11-2012) hash function */
     constructor();
@@ -24,7 +28,11 @@ export declare class Streebog256 extends Streebog<Streebog256> {
     clone(): Streebog256;
     _cloneInto(to?: Streebog256): Streebog256;
 }
-/** Streebog-512 (GOST R 34.11-2012) hash function */
+/**
+ * **Streebog-512 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */
 export declare class Streebog512 extends Streebog<Streebog512> {
     /** Streebog-512 (GOST R 34.11-2012) hash function */
     constructor();
@@ -33,8 +41,11 @@ export declare class Streebog512 extends Streebog<Streebog512> {
     clone(): Streebog512;
     _cloneInto(to?: Streebog512): Streebog512;
 }
-/** Streebog-256 (GOST R 34.11-2012) hash function */
-export declare const streebog256: {
+/**
+ * **Streebog-256 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */ export declare const streebog256: {
     outputLen: number;
     blockLen: number;
     canXOF: boolean;
@@ -48,8 +59,11 @@ export declare const streebog256: {
     oid?: TRet<Uint8Array> | undefined;
     create: () => Streebog256;
 };
-/** Streebog-512 (GOST R 34.11-2012) hash function */
-export declare const streebog512: {
+/**
+ * **Streebog-512 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */ export declare const streebog512: {
     outputLen: number;
     blockLen: number;
     canXOF: boolean;

package/streebog/index.js

@@ -1,4 +1,4 @@
-import { concatBytes, createHasher } from "@noble/hashes/utils.js";
+import { concatBytes, copyBytes, createHasher } from "@noble/hashes/utils.js";
 import { A, C, TAU } from "./const.js";
 import { PI } from "../kuznyechik/const.js";
 import { pad1, xorBytes } from "../utils.js";
@@ -8,8 +8,7 @@ const _0020 = new Uint8Array([0, 0, 2, 0]);
 const _0 = new Uint8Array(64);
 const add512 = (a, b) => {
     const c = new Uint8Array(64);
-    const tmpA = new Uint8Array(64);
-    const tmpB = new Uint8Array(64);
+    const tmpA = new Uint8Array(64), tmpB = new Uint8Array(64);
     for (let i = 0; i < a.length; i++)
         tmpA[63 - i] = a[a.length - i - 1];
     for (let i = 0; i < b.length; i++)
@@ -122,7 +121,7 @@ class Streebog {
         return buffer;
     }
     digestInto(buf) {
-        const message = this.buffer.slice().reverse();
+        const message = copyBytes(this.buffer).reverse();
         let n = new Uint8Array(this.blockLen);
         let sigma = new Uint8Array(this.blockLen);
         let hash = new Uint8Array(this.blockLen).fill(this.is512 ? 0 : 1);
@@ -144,13 +143,17 @@ class Streebog {
         }
         hash = G(_0, G(_0, G(n, hash, paddedMsg), add512(n, numberToBytesBE(msg.length * 8, 4))), add512(sigma, paddedMsg));
         if (this.is512)
-            buf.set(hash.slice().reverse());
+            buf.set(copyBytes(hash).reverse());
         else
             buf.set(hash.slice(0, 32).reverse());
         this.destroy();
     }
 }
-/** Streebog-256 (GOST R 34.11-2012) hash function */
+/**
+ * **Streebog-256 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */
 export class Streebog256 extends Streebog {
     /** Streebog-256 (GOST R 34.11-2012) hash function */
     constructor() { super(false); }
@@ -163,7 +166,11 @@ export class Streebog256 extends Streebog {
         return to;
     }
 }
-/** Streebog-512 (GOST R 34.11-2012) hash function */
+/**
+ * **Streebog-512 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */
 export class Streebog512 extends Streebog {
     /** Streebog-512 (GOST R 34.11-2012) hash function */
     constructor() { super(true); }
@@ -176,7 +183,13 @@ export class Streebog512 extends Streebog {
         return to;
     }
 }
-/** Streebog-256 (GOST R 34.11-2012) hash function */
-export const streebog256 = createHasher(Streebog256.create);
-/** Streebog-512 (GOST R 34.11-2012) hash function */
-export const streebog512 = createHasher(Streebog512.create);
+/**
+ * **Streebog-256 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */ export const streebog256 = createHasher(Streebog256.create);
+/**
+ * **Streebog-512 hash function**
+ *
+ * Described by GOST R 34.11-2012 ([RFC 6986](https://datatracker.ietf.org/doc/html/rfc6986.html))
+ */ export const streebog512 = createHasher(Streebog512.create);