antonkueltz/rfc7539

AEAD cipher based on ChaCha20 stream cipher and Poly1305 MAC

RFC7539

About

RFC7539 is an IETF specification for an authenticated encryption algorithm that will be incorporated into TLSv1.3. It is comprised of a stream cipher (ChaCha20) and a MAC (Poly1305), both written by Daniel J. Bernstein. The C implementations for both of these primitives are taken from the NSS library (the reason being that openSSL has license incompatibilities and also requires the openSSL headers which is more overhead than we need to implement these fairly basic primitives). The NSS code has been slightly modified to account for the 96 bit nonce and 32 bit counter specified in the RFC.

Installation

Method 1

pip install rfc7539

Method 2

git clone https://github.com/AntonKueltz/rfc7539.git
cd rfc7539
python setup.py install

Basic API

aead.encrypt_and_tag

Takes a key, nonce, plaintext and additional data and returns a ciphertext and MAC.

def encrypt_and_tag(
    key: bytes,
    nonce: bytes,
    plaintext: bytes,
    aad: bytes
) -> (bytes, bytes)

aead.verify_and_decrypt

Takes a key, nonce, ciphertext, MAC and additional data and returns a plaintext.

def verify_and_decrypt(
    key: bytes,
    nonce: bytes,
    ciphertext: bytes,
    mac: bytes, 
    aad: bytes
) -> bytes

Example Usage

You should use the authenticated encryption mode unless you really need to use one of the primitives by itself:

from rfc7539 import aead
from os import urandom

key = urandom(32)  # key is 32 bytes
nonce = b'thisisanonce'  # nonce is 12 bytes (DO NOT REUSE A NONCE WITH THE SAME KEY)
message = b'Some message to be encrypted'
additional_data = b'Some additional data'  # this will not be encrypted but will be verified for integrity

# encryption
ciphertext, mac = aead.encrypt_and_tag(key, nonce, message, additional_data)

# decryption (which yields plaintext == message)
plaintext = aead.verify_and_decrypt(key, nonce, ciphertext, mac, additional_data)

Note that all operations in this package work on bytes. You'll need to call e.g. encode() on strings before passing them as arguments.

rfc7539's Issues

_tag_data() function incorrectly applies padding

Per RFC 7539, no padding should be applied to the AAD or ciphertext if they are already an integral multiple of 16 bytes (which includes a zero-length AAD):

• Finally, the Poly1305 function is called with the Poly1305 key
  calculated above, and a message constructed as a concatenation of
  the following:
  • The AAD
  • padding1 -- the padding is up to 15 zero bytes, and it brings
    the total length so far to an integral multiple of 16. If the
    length of the AAD was already an integral multiple of 16 bytes,
    this field is zero-length.
  • The ciphertext
  • padding2 -- the padding is up to 15 zero bytes, and it brings
    the total length so far to an integral multiple of 16. If the
    length of the ciphertext was already an integral multiple of 16
    bytes, this field is zero-length.
  • The length of the additional data in octets (as a 64-bit
    little-endian integer).
  • The length of the ciphertext in octets (as a 64-bit little-
    endian integer).

Pseudocode:

pad16(x):
    if (len(x) % 16)==0
        then return NULL
        else return copies(0, 16-(len(x)%16))
    end

However, the current implementation applies 16 bytes of padding in this case:

rfc7539/rfc7539/aead.py

Lines 30 to 32 in 10e0284

	def _tag_data(aad, ciphertext):
	tag_data = aad + b'\x00' * (16 - (len(aad) % 16))
	tag_data += ciphertext + b'\x00' * (16 - (len(ciphertext) % 16))

Pip version not up to date

Hello !

It seems that the version on pip is not up to date with the current repository, preventing it to work with Python 3.10. Coud you update it please?
Thanx a lot! :-)

Header files aren't included in the package on PyPI

pip install rfc7539 fails with:

    running install
    running build
    running build_py
    creating build
    creating build/lib.linux-x86_64-3.6
    creating build/lib.linux-x86_64-3.6/rfc7539
    copying rfc7539/test.py -> build/lib.linux-x86_64-3.6/rfc7539
    copying rfc7539/cipher.py -> build/lib.linux-x86_64-3.6/rfc7539
    copying rfc7539/mac.py -> build/lib.linux-x86_64-3.6/rfc7539
    copying rfc7539/__init__.py -> build/lib.linux-x86_64-3.6/rfc7539
    copying rfc7539/util.py -> build/lib.linux-x86_64-3.6/rfc7539
    copying rfc7539/aead.py -> build/lib.linux-x86_64-3.6/rfc7539
    running build_ext
    building 'rfc7539._chacha20' extension
    creating build/temp.linux-x86_64-3.6
    creating build/temp.linux-x86_64-3.6/src
    x86_64-linux-gnu-gcc -pthread -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -Isrc/ -I/usr/include/python3.6m -I/home/str4d/env/include/python3.6m -c src/_chacha20.c -o build/temp.linux-x86_64-3.6/src/_chacha20.o -std=c99 -O2
    src/_chacha20.c:13:10: fatal error: _chacha20.h: No such file or directory
     #include "_chacha20.h"
              ^~~~~~~~~~~~~
    compilation terminated.
    error: command 'x86_64-linux-gnu-gcc' failed with exit status 1

Looking at the log output, it is using the tarball from https://files.pythonhosted.org/packages/f8/e1/212ca9b09c017b767c09a553380eb2ff4af6bf7443f3dc134888ead469f4/rfc7539-1.1.0.tar.gz which appears to not contain the header files.

Failure building

Hi,

I've been trying to pip install rfc7539 and failing miserably today on multiple systems with the error below. I've tried installing multiple libgcrypt/libgcrypt20 libraries, but no change. Any help would be appreciated. I can post the full pip error logs if you want them. I see this may be similar to Issue #2.

  gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -Isrc/ -I/usr/local/include/python2.7 -c src/_chacha20.c -o build/temp.linux-x86_64-2.7/src/_chacha20.o -std=c99 -O2
  In file included from /usr/local/include/python2.7/Python.h:8,
                   from src/_chacha20.c:10:
  /usr/local/include/python2.7/pyconfig.h:1223: warning: "_POSIX_C_SOURCE" redefined
   #define _POSIX_C_SOURCE 200112L
  
  In file included from /usr/include/x86_64-linux-gnu/bits/libc-header-start.h:33,
                   from /usr/include/string.h:26,
                   from src/_chacha20.c:7:
  /usr/include/features.h:294: note: this is the location of the previous definition
   # define _POSIX_C_SOURCE 199506L
  
  src/_chacha20.c:141:15: error: variable ‘moduledef’ has initializer but incomplete type
   static struct PyModuleDef moduledef = {
                 ^~~~~~~~~~~
  src/_chacha20.c:142:5: error: ‘PyModuleDef_HEAD_INIT’ undeclared here (not in a function); did you mean ‘PyObject_HEAD_INIT’?
       PyModuleDef_HEAD_INIT,
       ^~~~~~~~~~~~~~~~~~~~~
       PyObject_HEAD_INIT