visaljs 0.0.0-stage → 0.0.2

package/runtime/src/crypto_cipher.c

@@ -0,0 +1,671 @@
+/* The crypto primitives' ciphers (ADR 0018): one streaming context for every cipher node:crypto
+ * offers on BearSSL (AES in ECB, CBC, CFB, CFB1, CFB8, OFB, CTR, GCM, CCM and key wrap; 2- and
+ * 3-key DES-EDE; ChaCha20 and ChaCha20-Poly1305), with OpenSSL's padding, chunking and checks.
+ * Web Crypto's AES runs on it too. BearSSL gives the block functions (through its CBC classes,
+ * the fastest implementation the CPU has: AES-NI, else constant-time 64-bit), GCM, CCM, ChaCha20
+ * and Poly1305; the modes BearSSL lacks (CFB, OFB, a 128-bit CTR, key wrap) are ours. */
+#include <stdlib.h>
+#include <string.h>
+
+#include "crypto_internal.h"
+#include "js_builtins.h"
+#include "js_exception.h"
+
+/* ---- The table (getCiphers, getCipherInfo: Node's values for each name) ------------------------- */
+
+#define AES(name, info, mode, nid, bs, iv, kl, m) { name, info, mode, nid, JS_CIPHER_##m, 0, kl, iv, bs }
+#define DES(name, info, mode, nid, bs, iv, kl, m) { name, info, mode, nid, JS_CIPHER_##m, 1, kl, iv, bs }
+
+static const JSCipherAlg CIPHERS[] = {
+    AES("aes-128-cbc", "aes-128-cbc", "cbc", 419, 16, 16, 16, CBC),
+    AES("aes-128-ccm", "id-aes128-ccm", "ccm", 896, 1, 12, 16, CCM),
+    AES("aes-128-cfb", "aes-128-cfb", "cfb", 421, 1, 16, 16, CFB),
+    AES("aes-128-cfb1", "aes-128-cfb1", "cfb", 650, 1, 16, 16, CFB1),
+    AES("aes-128-cfb8", "aes-128-cfb8", "cfb", 653, 1, 16, 16, CFB8),
+    AES("aes-128-ctr", "aes-128-ctr", "ctr", 904, 1, 16, 16, CTR),
+    AES("aes-128-ecb", "aes-128-ecb", "ecb", 418, 16, 0, 16, ECB),
+    AES("aes-128-gcm", "id-aes128-gcm", "gcm", 895, 1, 12, 16, GCM),
+    AES("aes-128-ofb", "aes-128-ofb", "ofb", 420, 1, 16, 16, OFB),
+    AES("aes-192-cbc", "aes-192-cbc", "cbc", 423, 16, 16, 24, CBC),
+    AES("aes-192-ccm", "id-aes192-ccm", "ccm", 899, 1, 12, 24, CCM),
+    AES("aes-192-cfb", "aes-192-cfb", "cfb", 425, 1, 16, 24, CFB),
+    AES("aes-192-cfb1", "aes-192-cfb1", "cfb", 651, 1, 16, 24, CFB1),
+    AES("aes-192-cfb8", "aes-192-cfb8", "cfb", 654, 1, 16, 24, CFB8),
+    AES("aes-192-ctr", "aes-192-ctr", "ctr", 905, 1, 16, 24, CTR),
+    AES("aes-192-ecb", "aes-192-ecb", "ecb", 422, 16, 0, 24, ECB),
+    AES("aes-192-gcm", "id-aes192-gcm", "gcm", 898, 1, 12, 24, GCM),
+    AES("aes-192-ofb", "aes-192-ofb", "ofb", 424, 1, 16, 24, OFB),
+    AES("aes-256-cbc", "aes-256-cbc", "cbc", 427, 16, 16, 32, CBC),
+    AES("aes-256-ccm", "id-aes256-ccm", "ccm", 902, 1, 12, 32, CCM),
+    AES("aes-256-cfb", "aes-256-cfb", "cfb", 429, 1, 16, 32, CFB),
+    AES("aes-256-cfb1", "aes-256-cfb1", "cfb", 652, 1, 16, 32, CFB1),
+    AES("aes-256-cfb8", "aes-256-cfb8", "cfb", 655, 1, 16, 32, CFB8),
+    AES("aes-256-ctr", "aes-256-ctr", "ctr", 906, 1, 16, 32, CTR),
+    AES("aes-256-ecb", "aes-256-ecb", "ecb", 426, 16, 0, 32, ECB),
+    AES("aes-256-gcm", "id-aes256-gcm", "gcm", 901, 1, 12, 32, GCM),
+    AES("aes-256-ofb", "aes-256-ofb", "ofb", 428, 1, 16, 32, OFB),
+    AES("aes128", "aes-128-cbc", "cbc", 419, 16, 16, 16, CBC),
+    AES("aes128-wrap", "id-aes128-wrap", "wrap", 788, 8, 8, 16, WRAP),
+    AES("aes128-wrap-pad", "id-aes128-wrap-pad", "wrap", 897, 8, 4, 16, WRAP_PAD),
+    AES("aes192", "aes-192-cbc", "cbc", 423, 16, 16, 24, CBC),
+    AES("aes192-wrap", "id-aes192-wrap", "wrap", 789, 8, 8, 24, WRAP),
+    AES("aes192-wrap-pad", "id-aes192-wrap-pad", "wrap", 900, 8, 4, 24, WRAP_PAD),
+    AES("aes256", "aes-256-cbc", "cbc", 427, 16, 16, 32, CBC),
+    AES("aes256-wrap", "id-aes256-wrap", "wrap", 790, 8, 8, 32, WRAP),
+    AES("aes256-wrap-pad", "id-aes256-wrap-pad", "wrap", 903, 8, 4, 32, WRAP_PAD),
+    { "chacha20", "chacha20", "stream", 1019, JS_CIPHER_CHACHA20, 2, 32, 16, 0 },
+    { "chacha20-poly1305", "chacha20-poly1305", "stream", 1018, JS_CIPHER_CHACHA20_POLY1305, 2, 32, 12, 0 },
+    DES("des-ede", "des-ede", "ecb", 32, 8, 0, 16, ECB),
+    DES("des-ede-cbc", "des-ede-cbc", "cbc", 43, 8, 8, 16, CBC),
+    DES("des-ede-cfb", "des-ede-cfb", "cfb", 60, 1, 8, 16, CFB),
+    DES("des-ede-ecb", "des-ede", "ecb", 32, 8, 0, 16, ECB),
+    DES("des-ede-ofb", "des-ede-ofb", "ofb", 62, 1, 8, 16, OFB),
+    DES("des-ede3", "des-ede3", "ecb", 33, 8, 0, 24, ECB),
+    DES("des-ede3-cbc", "des-ede3-cbc", "cbc", 44, 8, 8, 24, CBC),
+    DES("des-ede3-cfb", "des-ede3-cfb", "cfb", 61, 1, 8, 24, CFB),
+    DES("des-ede3-cfb1", "des-ede3-cfb1", "cfb", 658, 1, 8, 24, CFB1),
+    DES("des-ede3-cfb8", "des-ede3-cfb8", "cfb", 659, 1, 8, 24, CFB8),
+    DES("des-ede3-ecb", "des-ede3", "ecb", 33, 8, 0, 24, ECB),
+    DES("des-ede3-ofb", "des-ede3-ofb", "ofb", 63, 1, 8, 24, OFB),
+    DES("des3", "des-ede3-cbc", "cbc", 44, 8, 8, 24, CBC),
+    AES("id-aes128-CCM", "id-aes128-ccm", "ccm", 896, 1, 12, 16, CCM),
+    AES("id-aes128-GCM", "id-aes128-gcm", "gcm", 895, 1, 12, 16, GCM),
+    AES("id-aes128-wrap", "id-aes128-wrap", "wrap", 788, 8, 8, 16, WRAP),
+    AES("id-aes128-wrap-pad", "id-aes128-wrap-pad", "wrap", 897, 8, 4, 16, WRAP_PAD),
+    AES("id-aes192-CCM", "id-aes192-ccm", "ccm", 899, 1, 12, 24, CCM),
+    AES("id-aes192-GCM", "id-aes192-gcm", "gcm", 898, 1, 12, 24, GCM),
+    AES("id-aes192-wrap", "id-aes192-wrap", "wrap", 789, 8, 8, 24, WRAP),
+    AES("id-aes192-wrap-pad", "id-aes192-wrap-pad", "wrap", 900, 8, 4, 24, WRAP_PAD),
+    AES("id-aes256-CCM", "id-aes256-ccm", "ccm", 902, 1, 12, 32, CCM),
+    AES("id-aes256-GCM", "id-aes256-gcm", "gcm", 901, 1, 12, 32, GCM),
+    AES("id-aes256-wrap", "id-aes256-wrap", "wrap", 790, 8, 8, 32, WRAP),
+    AES("id-aes256-wrap-pad", "id-aes256-wrap-pad", "wrap", 903, 8, 4, 32, WRAP_PAD),
+};
+
+const size_t js_cipher_count = JS_COUNTOF(CIPHERS);
+
+const JSCipherAlg *js_cipher_at(size_t i) { return i < JS_COUNTOF(CIPHERS) ? &CIPHERS[i] : NULL; }
+
+static bool same_ci(const char *a, const char *b) {
+    for (; *a && *b; a++, b++) {
+        char x = *a >= 'A' && *a <= 'Z' ? (char)(*a + 32) : *a, y = *b >= 'A' && *b <= 'Z' ? (char)(*b + 32) : *b;
+        if (x != y) return false;
+    }
+    return *a == *b;
+}
+
+const JSCipherAlg *js_cipher_by_name(const char *name) {
+    for (size_t i = 0; i < JS_COUNTOF(CIPHERS); i++)
+        if (same_ci(name, CIPHERS[i].name) || same_ci(name, CIPHERS[i].info_name)) return &CIPHERS[i];
+    return NULL;
+}
+
+const JSCipherAlg *js_cipher_by_nid(int nid) {
+    for (size_t i = 0; i < JS_COUNTOF(CIPHERS); i++)
+        if (CIPHERS[i].nid == nid) return &CIPHERS[i];
+    return NULL;
+}
+
+/* An AES cipher of this mode and key length (Web Crypto's). */
+const JSCipherAlg *js_cipher_aes(uint8_t mode, size_t key_len) {
+    for (size_t i = 0; i < JS_COUNTOF(CIPHERS); i++)
+        if (CIPHERS[i].mode == mode && CIPHERS[i].prim == 0 && CIPHERS[i].key_len == key_len) return &CIPHERS[i];
+    return NULL;
+}
+
+/* ---- Block functions ----------------------------------------------------------------------------- */
+
+static const br_block_cbcenc_class *aes_enc_class(void) {
+    const br_block_cbcenc_class *c = br_aes_x86ni_cbcenc_get_vtable();
+    return c ? c : &br_aes_ct64_cbcenc_vtable;
+}
+static const br_block_cbcdec_class *aes_dec_class(void) {
+    const br_block_cbcdec_class *c = br_aes_x86ni_cbcdec_get_vtable();
+    return c ? c : &br_aes_ct64_cbcdec_vtable;
+}
+static const br_block_ctr_class *aes_ctr_class(void) {
+    const br_block_ctr_class *c = br_aes_x86ni_ctr_get_vtable();
+    return c ? c : &br_aes_ct64_ctr_vtable;
+}
+static const br_block_ctrcbc_class *aes_ctrcbc_class(void) {
+    const br_block_ctrcbc_class *c = br_aes_x86ni_ctrcbc_get_vtable();
+    return c ? c : &br_aes_ct64_ctrcbc_vtable;
+}
+static br_ghash ghash_impl(void) {
+    br_ghash g = br_ghash_pclmul_get();
+    return g ? g : br_ghash_ctmul64;
+}
+
+/* One block encrypted (decrypted) in place: CBC with a zero IV over one block. */
+static void block_enc(JSCipherCtx *c, uint8_t *b) {
+    uint8_t iv[16] = { 0 };
+    c->enc.vtable->run(&c->enc.vtable, iv, b, c->blk);
+}
+static void block_dec(JSCipherCtx *c, uint8_t *b) {
+    uint8_t iv[16] = { 0 };
+    c->dec.vtable->run(&c->dec.vtable, iv, b, c->blk);
+}
+
+/* ---- Output buffer ------------------------------------------------------------------------------- */
+
+static void out_put(JSBytesOut *o, const uint8_t *p, size_t n) {
+    if (o->n + n > o->cap) {
+        size_t cap = o->cap ? o->cap : 64;
+        while (cap < o->n + n) cap *= 2;
+        uint8_t *q = realloc(o->p, cap);
+        if (!q) js_fatal("out of memory in crypto");
+        o->p = q;
+        o->cap = cap;
+    }
+    if (n) memcpy(o->p + o->n, p, n);
+    o->n += n;
+}
+
+static void buf_put(JSBytesOut *b, const uint8_t *p, size_t n) { out_put(b, p, n); }
+
+/* ---- Setup ----------------------------------------------------------------------------------------- */
+
+static bool valid_ccm_tag(size_t n) { return n >= 4 && n <= 16 && n % 2 == 0; }
+static bool valid_gcm_tag(size_t n) { return n == 4 || n == 8 || (n >= 12 && n <= 16); }
+
+int js_cipher_init(JSCipherCtx *c, const JSCipherAlg *alg, bool encrypt, const uint8_t *key, size_t key_len, const uint8_t *iv,
+                   size_t iv_len, bool has_iv, long tag_len) {
+    memset(c, 0, sizeof *c);
+    c->alg = alg;
+    c->encrypt = encrypt;
+    c->padding = true;
+    c->blk = alg->prim == 1 ? 8 : 16;
+    if (key_len != alg->key_len) return JS_CIPHER_ERR_KEYLEN;
+    /* the IV: AEAD modes take a range of lengths, the others exactly theirs (ECB none) */
+    switch (alg->mode) {
+    case JS_CIPHER_GCM:
+        if (!has_iv || iv_len == 0) return JS_CIPHER_ERR_IV;
+        break;
+    case JS_CIPHER_CCM:
+        if (!has_iv || iv_len < 7 || iv_len > 13) return JS_CIPHER_ERR_IV;
+        break;
+    case JS_CIPHER_ECB:
+        if (has_iv && iv_len != 0) return JS_CIPHER_ERR_IV;
+        break;
+    default:
+        if (!has_iv || iv_len != alg->iv_len) return JS_CIPHER_ERR_IV;
+        break;
+    }
+    if (alg->mode != JS_CIPHER_GCM) {  /* GCM takes any length, straight into br_gcm_reset */
+        if (iv_len > sizeof c->nonce) return JS_CIPHER_ERR_IV;
+        if (iv_len) memcpy(c->nonce, iv, iv_len);
+        c->nonce_len = iv_len;
+    }
+    /* the tag length (-1: not given) */
+    c->tag_len = 16;
+    if (alg->mode == JS_CIPHER_CCM) {
+        if (tag_len < 0) return JS_CIPHER_ERR_TAG_REQUIRED;
+        if (!valid_ccm_tag((size_t)tag_len)) return JS_CIPHER_ERR_TAG_LENGTH;
+        c->tag_len = (size_t)tag_len;
+    } else if (alg->mode == JS_CIPHER_GCM) {
+        if (tag_len >= 0 && !valid_gcm_tag((size_t)tag_len)) return JS_CIPHER_ERR_TAG_LENGTH;
+        if (tag_len >= 0) c->tag_len = (size_t)tag_len, c->tag_len_given = true;
+    } else if (alg->mode == JS_CIPHER_CHACHA20_POLY1305) {
+        if (tag_len >= 0 && (tag_len < 1 || tag_len > 16)) return JS_CIPHER_ERR_TAG_LENGTH;
+        if (tag_len >= 0) c->tag_len = (size_t)tag_len;
+    }
+    memcpy(c->key, key, key_len);
+    if (alg->prim == 0) {
+        const br_block_cbcenc_class *e = aes_enc_class();
+        e->init(&c->enc.vtable, key, key_len);
+        const br_block_cbcdec_class *d = aes_dec_class();
+        d->init(&c->dec.vtable, key, key_len);
+    } else if (alg->prim == 1) {
+        br_des_ct_cbcenc_vtable.init(&c->enc.vtable, key, key_len);
+        br_des_ct_cbcdec_vtable.init(&c->dec.vtable, key, key_len);
+    }
+    if (iv_len && alg->mode != JS_CIPHER_GCM && alg->mode != JS_CIPHER_CCM) memcpy(c->iv, iv, iv_len < 16 ? iv_len : 16);
+    switch (alg->mode) {
+    case JS_CIPHER_GCM:
+        aes_ctr_class()->init(&c->ctr.vtable, key, key_len);
+        br_gcm_init(&c->gcm, &c->ctr.vtable, ghash_impl());
+        br_gcm_reset(&c->gcm, iv, iv_len);
+        break;
+    case JS_CIPHER_CCM:
+        aes_ctrcbc_class()->init(&c->ctrcbc.vtable, key, key_len);
+        br_ccm_init(&c->ccm, &c->ctrcbc.vtable);
+        break;
+    case JS_CIPHER_CHACHA20:
+        c->counter = (uint32_t)iv[0] | (uint32_t)iv[1] << 8 | (uint32_t)iv[2] << 16 | (uint32_t)iv[3] << 24;
+        memcpy(c->nonce, iv + 4, 12);
+        c->ks_pos = 64;
+        break;
+    case JS_CIPHER_CHACHA20_POLY1305:
+        c->counter = 1;  /* block 0 makes the Poly1305 key */
+        c->ks_pos = 64;
+        break;
+    default:
+        c->ks_pos = c->blk;
+        break;
+    }
+    return 0;
+}
+
+void js_cipher_free(JSCipherCtx *c) {
+    free(c->aad.p);
+    free(c->data.p);
+    memset(c->key, 0, sizeof c->key);
+    c->aad.p = c->data.p = NULL;
+}
+
+/* ---- Streams of keystream ----------------------------------------------------------------------- */
+
+static void chacha_block(JSCipherCtx *c) {
+    memset(c->ks, 0, 64);
+    br_chacha20_ct_run(c->key, c->nonce, c->counter++, c->ks, 64);
+    c->ks_pos = 0;
+}
+
+static void ctr_increment(uint8_t *ctr, size_t n) {
+    for (size_t i = n; i-- > 0;)
+        if (++ctr[i]) break;
+}
+
+/* ---- Update ------------------------------------------------------------------------------------- */
+
+/* PKCS#7 blocks (ECB, CBC): whole blocks go through, a partial one waits; decrypting with padding
+ * holds back the last whole block for final. */
+static void blocks_update(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
+    size_t blk = c->blk;
+    bool hold = !c->encrypt && c->padding;
+    while (n > 0) {
+        size_t take = blk - c->buf_len < n ? blk - c->buf_len : n;
+        memcpy(c->buf + c->buf_len, p, take);
+        c->buf_len += take;
+        p += take;
+        n -= take;
+        if (c->buf_len < blk || (hold && n == 0)) break;
+        uint8_t b[16];
+        memcpy(b, c->buf, blk);
+        if (c->alg->mode == JS_CIPHER_ECB) {
+            if (c->encrypt) block_enc(c, b);
+            else block_dec(c, b);
+        } else if (c->encrypt) {
+            c->enc.vtable->run(&c->enc.vtable, c->iv, b, blk);
+        } else {
+            c->dec.vtable->run(&c->dec.vtable, c->iv, b, blk);
+        }
+        out_put(out, b, blk);
+        c->buf_len = 0;
+    }
+}
+
+static void stream_update(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
+    size_t blk = c->blk;
+    for (size_t i = 0; i < n; i++) {
+        uint8_t x = p[i], y;
+        switch (c->alg->mode) {
+        case JS_CIPHER_CTR:
+            if (c->ks_pos == blk) {
+                memcpy(c->ks, c->iv, blk);
+                block_enc(c, c->ks);
+                ctr_increment(c->iv, blk);
+                c->ks_pos = 0;
+            }
+            y = x ^ c->ks[c->ks_pos++];
+            break;
+        case JS_CIPHER_OFB:
+            if (c->ks_pos == blk) {
+                block_enc(c, c->iv);
+                memcpy(c->ks, c->iv, blk);
+                c->ks_pos = 0;
+            }
+            y = x ^ c->ks[c->ks_pos++];
+            break;
+        case JS_CIPHER_CFB:
+            if (c->ks_pos == blk) {
+                memcpy(c->ks, c->iv, blk);
+                block_enc(c, c->ks);
+                c->ks_pos = 0;
+            }
+            y = x ^ c->ks[c->ks_pos];
+            c->iv[c->ks_pos++] = c->encrypt ? y : x;  /* the next register: this block's ciphertext */
+            break;
+        case JS_CIPHER_CFB8: {
+            uint8_t k[16];
+            memcpy(k, c->iv, blk);
+            block_enc(c, k);
+            y = x ^ k[0];
+            memmove(c->iv, c->iv + 1, blk - 1);
+            c->iv[blk - 1] = c->encrypt ? y : x;
+            break;
+        }
+        case JS_CIPHER_CFB1: {
+            y = 0;
+            for (int bit = 7; bit >= 0; bit--) {
+                uint8_t k[16];
+                memcpy(k, c->iv, blk);
+                block_enc(c, k);
+                uint8_t in = (uint8_t)((x >> bit) & 1), o = (uint8_t)(in ^ (k[0] >> 7));
+                y |= (uint8_t)(o << bit);
+                uint8_t shifted = c->encrypt ? o : in;  /* the register takes the ciphertext bit */
+                for (size_t j = 0; j < blk; j++) c->iv[j] = (uint8_t)(c->iv[j] << 1 | (j + 1 < blk ? c->iv[j + 1] >> 7 : shifted));
+            }
+            break;
+        }
+        default: /* ChaCha20, and ChaCha20-Poly1305's encryption */
+            if (c->ks_pos == 64) chacha_block(c);
+            y = x ^ c->ks[c->ks_pos++];
+            break;
+        }
+        out_put(out, &y, 1);
+    }
+}
+
+/* AES key wrap (RFC 3394) and with padding (RFC 5649): the whole input of one update. */
+static int wrap(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
+    bool pad = c->alg->mode == JS_CIPHER_WRAP_PAD;
+    uint8_t a[8];
+    size_t len = n;
+    if (pad) {
+        if (n == 0) return JS_CIPHER_ERR_STATE;
+        memcpy(a, c->iv, 4);
+        a[4] = (uint8_t)(n >> 24), a[5] = (uint8_t)(n >> 16), a[6] = (uint8_t)(n >> 8), a[7] = (uint8_t)n;
+        len = (n + 7) / 8 * 8;
+    } else {
+        if (n < 16 || n % 8) return JS_CIPHER_ERR_STATE;
+        memcpy(a, c->iv, 8);
+    }
+    uint8_t *r = calloc(len + 8, 1);
+    if (!r) js_fatal("out of memory in crypto");
+    memcpy(r + 8, p, n);
+    size_t blocks = len / 8;
+    if (pad && blocks == 1) {  /* one block: encrypted once, with A in front */
+        memcpy(r, a, 8);
+        block_enc(c, r);
+    } else {
+        for (size_t j = 0; j < 6; j++) {
+            for (size_t i = 1; i <= blocks; i++) {
+                uint8_t b[16];
+                memcpy(b, a, 8);
+                memcpy(b + 8, r + 8 * i, 8);
+                block_enc(c, b);
+                uint64_t t = (uint64_t)(blocks * j + i);
+                memcpy(a, b, 8);
+                for (int k = 0; k < 8; k++) a[7 - k] ^= (uint8_t)(t >> (8 * k));
+                memcpy(r + 8 * i, b + 8, 8);
+            }
+        }
+        memcpy(r, a, 8);
+    }
+    out_put(out, r, len + 8);
+    free(r);
+    return 0;
+}
+
+static int unwrap(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
+    bool pad = c->alg->mode == JS_CIPHER_WRAP_PAD;
+    if (n % 8 || n < (pad ? 16u : 24u)) return JS_CIPHER_ERR_STATE;
+    size_t blocks = n / 8 - 1;
+    uint8_t a[8], *r = malloc(n);
+    if (!r) js_fatal("out of memory in crypto");
+    memcpy(r, p, n);
+    if (pad && blocks == 1) {
+        uint8_t b[16];
+        memcpy(b, r, 16);
+        block_dec(c, b);
+        memcpy(a, b, 8);
+        memcpy(r + 8, b + 8, 8);
+    } else {
+        memcpy(a, r, 8);
+        for (size_t j = 6; j-- > 0;) {
+            for (size_t i = blocks; i >= 1; i--) {
+                uint8_t b[16];
+                uint64_t t = (uint64_t)(blocks * j + i);
+                memcpy(b, a, 8);
+                for (int k = 0; k < 8; k++) b[7 - k] ^= (uint8_t)(t >> (8 * k));
+                memcpy(b + 8, r + 8 * i, 8);
+                block_dec(c, b);
+                memcpy(a, b, 8);
+                memcpy(r + 8 * i, b + 8, 8);
+            }
+        }
+    }
+    int err = 0;
+    size_t len = blocks * 8;
+    if (pad) {
+        size_t mli = (size_t)a[4] << 24 | (size_t)a[5] << 16 | (size_t)a[6] << 8 | a[7];
+        if (memcmp(a, c->iv, 4) != 0 || mli > len || mli + 8 <= len) err = JS_CIPHER_ERR_STATE;
+        else {
+            for (size_t i = mli; i < len; i++)
+                if (r[8 + i]) err = JS_CIPHER_ERR_STATE;
+            len = mli;
+        }
+    } else if (!js_crypto_equal(a, c->iv, 8)) {
+        err = JS_CIPHER_ERR_STATE;
+    }
+    if (!err) out_put(out, r + 8, len);
+    free(r);
+    return err;
+}
+
+/* The CCM run, done at its one update: the lengths are known only now. */
+static int ccm_run(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
+    size_t L = 15 - c->nonce_len;
+    if (L < 8 && n >= (1ULL << (8 * L))) return JS_CIPHER_ERR_MESSAGE_LENGTH;
+    if (c->ccm_length_set && n != c->ccm_length) return JS_CIPHER_ERR_STATE;
+    if (!br_ccm_reset(&c->ccm, c->nonce, c->nonce_len, c->aad.n, n, c->tag_len)) return JS_CIPHER_ERR_STATE;
+    br_ccm_aad_inject(&c->ccm, c->aad.p, c->aad.n);
+    br_ccm_flip(&c->ccm);
+    uint8_t *d = malloc(n ? n : 1);
+    if (!d) js_fatal("out of memory in crypto");
+    if (n) memcpy(d, p, n);
+    br_ccm_run(&c->ccm, c->encrypt, d, n);
+    if (c->encrypt) {
+        br_ccm_get_tag(&c->ccm, c->tag);
+        out_put(out, d, n);
+    } else if (c->tag_set && br_ccm_check_tag(&c->ccm, c->tag)) {
+        out_put(out, d, n);
+    } else {
+        c->auth_failed = true;  /* the output is nothing; final reports it */
+    }
+    free(d);
+    return 0;
+}
+
+int js_cipher_update(JSCipherCtx *c, const uint8_t *p, size_t n, JSBytesOut *out) {
+    if (c->state == JS_CIPHER_FINAL) return JS_CIPHER_ERR_STATE;
+    switch (c->alg->mode) {
+    case JS_CIPHER_ECB:
+    case JS_CIPHER_CBC:
+        blocks_update(c, p, n, out);
+        break;
+    case JS_CIPHER_GCM:
+        if (c->state == JS_CIPHER_INIT) br_gcm_flip(&c->gcm);
+        if (n) {
+            size_t start = out->n;
+            out_put(out, p, n);
+            br_gcm_run(&c->gcm, c->encrypt, out->p + start, n);
+        }
+        break;
+    case JS_CIPHER_CCM: {
+        if (c->state == JS_CIPHER_UPDATED) return JS_CIPHER_ERR_STATE;  /* CCM takes its data at once */
+        int e = ccm_run(c, p, n, out);
+        if (e) return e;
+        break;
+    }
+    case JS_CIPHER_WRAP:
+    case JS_CIPHER_WRAP_PAD: {
+        int e = c->encrypt ? wrap(c, p, n, out) : unwrap(c, p, n, out);
+        if (e) return e;
+        break;
+    }
+    case JS_CIPHER_CHACHA20_POLY1305: {
+        size_t start = out->n;
+        stream_update(c, p, n, out);
+        buf_put(&c->data, c->encrypt ? out->p + start : p, n);  /* Poly1305 runs over the ciphertext at final */
+        break;
+    }
+    default:
+        stream_update(c, p, n, out);
+        break;
+    }
+    c->state = JS_CIPHER_UPDATED;
+    return 0;
+}
+
+/* ---- Final -------------------------------------------------------------------------------------- */
+
+int js_cipher_final(JSCipherCtx *c, JSBytesOut *out) {
+    if (c->state == JS_CIPHER_FINAL) return JS_CIPHER_ERR_FINALIZED;
+    bool updated = c->state == JS_CIPHER_UPDATED;
+    c->state = JS_CIPHER_FINAL;
+    size_t blk = c->blk;
+    switch (c->alg->mode) {
+    case JS_CIPHER_ECB:
+    case JS_CIPHER_CBC: {
+        uint8_t b[16];
+        if (c->encrypt) {
+            if (!c->padding) return c->buf_len ? JS_CIPHER_ERR_FINAL_BLOCK : 0;
+            uint8_t pad = (uint8_t)(blk - c->buf_len);
+            memcpy(b, c->buf, c->buf_len);
+            memset(b + c->buf_len, pad, pad);
+            c->buf_len = 0;
+            if (c->alg->mode == JS_CIPHER_ECB) block_enc(c, b);
+            else c->enc.vtable->run(&c->enc.vtable, c->iv, b, blk);
+            out_put(out, b, blk);
+            return 0;
+        }
+        if (!c->padding) return c->buf_len ? JS_CIPHER_ERR_FINAL_BLOCK : 0;
+        if (c->buf_len != blk) return JS_CIPHER_ERR_FINAL_BLOCK;
+        memcpy(b, c->buf, blk);
+        if (c->alg->mode == JS_CIPHER_ECB) block_dec(c, b);
+        else c->dec.vtable->run(&c->dec.vtable, c->iv, b, blk);
+        uint8_t pad = b[blk - 1];
+        if (pad == 0 || pad > blk) return JS_CIPHER_ERR_BAD_DECRYPT;
+        for (size_t i = blk - pad; i < blk; i++)
+            if (b[i] != pad) return JS_CIPHER_ERR_BAD_DECRYPT;
+        out_put(out, b, blk - pad);
+        return 0;
+    }
+    case JS_CIPHER_GCM: {
+        if (!updated) br_gcm_flip(&c->gcm);
+        uint8_t tag[16];
+        br_gcm_get_tag(&c->gcm, tag);
+        if (c->encrypt) {
+            memcpy(c->tag, tag, 16);
+            c->tag_ready = true;
+            return 0;
+        }
+        if (!c->tag_set || !js_crypto_equal(tag, c->tag, c->given_tag_len)) return JS_CIPHER_ERR_AUTH;
+        return 0;
+    }
+    case JS_CIPHER_CCM:
+        if (c->encrypt) {
+            if (!updated) return JS_CIPHER_ERR_TAG_NOT_SET;
+            c->tag_ready = true;
+            return 0;
+        }
+        return !updated || c->auth_failed ? JS_CIPHER_ERR_AUTH : 0;
+    case JS_CIPHER_CHACHA20_POLY1305: {
+        uint8_t tag[16], *copy = malloc(c->data.n ? c->data.n : 1);
+        if (!copy) js_fatal("out of memory in crypto");
+        if (c->data.n) memcpy(copy, c->data.p, c->data.n);
+        br_poly1305_ctmul_run(c->key, c->nonce, copy, c->data.n, c->aad.p ? c->aad.p : (const uint8_t *)"", c->aad.n, tag,
+                              br_chacha20_ct_run, 0);
+        free(copy);
+        if (c->encrypt) {
+            memcpy(c->tag, tag, 16);
+            c->tag_ready = true;
+            return 0;
+        }
+        if (!c->tag_set || !js_crypto_equal(tag, c->tag, c->given_tag_len)) return JS_CIPHER_ERR_AUTH;
+        return 0;
+    }
+    default:
+        return 0;
+    }
+}
+
+/* ---- AEAD -------------------------------------------------------------------------------------- */
+
+int js_cipher_set_aad(JSCipherCtx *c, const uint8_t *p, size_t n, long plaintext_length) {
+    switch (c->alg->mode) {
+    case JS_CIPHER_GCM:
+        if (c->state != JS_CIPHER_INIT) return JS_CIPHER_ERR_STATE;
+        br_gcm_aad_inject(&c->gcm, p, n);
+        return 0;
+    case JS_CIPHER_CCM:
+        if (c->state != JS_CIPHER_INIT) return JS_CIPHER_ERR_STATE;
+        if (plaintext_length < 0) return JS_CIPHER_ERR_PLAINTEXT_LENGTH;
+        {
+            size_t L = 15 - c->nonce_len;
+            if (L < 8 && (uint64_t)plaintext_length >= (1ULL << (8 * L))) return JS_CIPHER_ERR_MESSAGE_LENGTH;
+        }
+        c->ccm_length = (size_t)plaintext_length;
+        c->ccm_length_set = true;
+        buf_put(&c->aad, p, n);
+        return 0;
+    case JS_CIPHER_CHACHA20_POLY1305:
+        if (c->state != JS_CIPHER_INIT) return JS_CIPHER_ERR_STATE;
+        buf_put(&c->aad, p, n);
+        return 0;
+    default:
+        return JS_CIPHER_ERR_STATE;
+    }
+}
+
+int js_cipher_set_auth_tag(JSCipherCtx *c, const uint8_t *p, size_t n) {
+    uint8_t mode = c->alg->mode;
+    if (c->encrypt || (mode != JS_CIPHER_GCM && mode != JS_CIPHER_CCM && mode != JS_CIPHER_CHACHA20_POLY1305) || c->tag_set ||
+        c->state == JS_CIPHER_FINAL)
+        return JS_CIPHER_ERR_STATE;
+    bool ok = mode == JS_CIPHER_GCM ? (c->tag_len_given ? n == c->tag_len : valid_gcm_tag(n)) : n == c->tag_len;
+    if (!ok) return JS_CIPHER_ERR_TAG_LENGTH;
+    memcpy(c->tag, p, n);
+    c->given_tag_len = n;
+    c->tag_set = true;
+    return 0;
+}
+
+bool js_cipher_get_auth_tag(JSCipherCtx *c, const uint8_t **p, size_t *n) {
+    if (!c->encrypt || !c->tag_ready) return false;
+    *p = c->tag;
+    *n = c->tag_len;
+    return true;
+}
+
+bool js_cipher_set_padding(JSCipherCtx *c, bool padding) {
+    if (c->state == JS_CIPHER_FINAL) return false;
+    c->padding = padding;
+    return true;
+}
+
+/* ---- Web Crypto's AES-CTR ---------------------------------------------------------------------- */
+
+/* The rightmost `bits` bits of the counter block count (wrapping within them), the rest stay;
+ * false when the data needs more blocks than the counter has values (they would repeat). */
+bool js_aes_ctr_masked(const uint8_t *key, size_t key_len, const uint8_t counter[16], unsigned bits, const uint8_t *in, size_t n,
+                       uint8_t *out) {
+    size_t blocks = (n + 15) / 16;
+    if (bits < 64 && blocks > (1ULL << bits)) return false;
+    JSCipherCtx c;
+    memset(&c, 0, sizeof c);
+    c.blk = 16;
+    aes_enc_class()->init(&c.enc.vtable, key, key_len);
+    uint8_t ctr[16];
+    memcpy(ctr, counter, 16);
+    for (size_t i = 0; i < n; i += 16) {
+        uint8_t ks[16];
+        memcpy(ks, ctr, 16);
+        block_enc(&c, ks);
+        size_t take = n - i < 16 ? n - i : 16;
+        for (size_t j = 0; j < take; j++) out[i + j] = in[i + j] ^ ks[j];
+        /* increment the low `bits` bits, big-endian, carrying no further */
+        unsigned left = bits;
+        for (int b = 15; b >= 0 && left > 0; b--) {
+            unsigned width = left >= 8 ? 8 : left;
+            uint8_t mask = (uint8_t)((1u << width) - 1);
+            uint8_t v = (uint8_t)(((ctr[b] & mask) + 1) & mask);
+            ctr[b] = (uint8_t)((ctr[b] & ~mask) | v);
+            left -= width;
+            if (v != 0) break;  /* no carry */
+        }
+    }
+    return true;
+}