Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactored client's symmetric_decrypt_and_verify() #378

Closed
wants to merge 7 commits into from
Closed

Refactored client's symmetric_decrypt_and_verify() #378

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
cc327b6
removing redundant slice range and comment when security mode is none
BogdanYarotsky Aug 29, 2024
5e0b7bc
removed redundant range ..src.len() or copying
BogdanYarotsky Aug 29, 2024
5fc479b
making signature veryifing consistent
BogdanYarotsky Aug 29, 2024
7a38ca6
futher normalized signature veryfing
BogdanYarotsky Aug 29, 2024
8a4b138
extracted checking of signature with tracing to avoid duplication
BogdanYarotsky Aug 29, 2024
b4514c1
removed commented out ciphertext_size
BogdanYarotsky Aug 29, 2024
5b8a87b
removed another commented out line of code
BogdanYarotsky Aug 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 27 additions & 35 deletions lib/src/core/comms/secure_channel.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1182,40 +1182,22 @@ impl SecureChannel {
) -> Result<usize, StatusCode> {
match self.security_mode {
MessageSecurityMode::None => {
// Just copy everything from src to dst
dst[..].copy_from_slice(src);
dst.copy_from_slice(src);
Ok(src.len())
}
MessageSecurityMode::Sign => {
self.expect_supported_security_policy();
// Copy everything
let all = ..src.len();
trace!("copying from slice {:?}", all);
dst[all].copy_from_slice(&src[all]);
// Verify signature
trace!(
"Verifying range from {:?} to signature {}..",
signed_range,
signed_range.end
);
let verification_key = self.verification_key();
self.security_policy.symmetric_verify_signature(
verification_key,
&dst[signed_range.clone()],
&dst[signed_range.end..],
)?;

trace!("copying from slice {:?}", ..src.len());
dst.copy_from_slice(src);
let signature_range = signed_range.end..dst.len();
self.symmetric_verify_signature_with_trace(dst, signed_range, signature_range)?;
Ok(encrypted_range.end)
}
MessageSecurityMode::SignAndEncrypt => {
self.expect_supported_security_policy();

// There is an expectation that the block is padded so, this is a quick test
let ciphertext_size = encrypted_range.end - encrypted_range.start;
// if ciphertext_size % 16 != 0 {
// error!("The cipher text size is not padded properly, size = {}", ciphertext_size);
// return Err(StatusCode::BadUnexpectedError);
// }

// Copy security header
dst[..encrypted_range.start].copy_from_slice(&src[..encrypted_range.start]);
Expand All @@ -1235,7 +1217,6 @@ impl SecureChannel {
&mut decrypted_tmp[..],
)?;

// Self::log_crypto_data("Encrypted buffer", &src[..encrypted_range.end]);
let encrypted_range =
encrypted_range.start..(encrypted_range.start + decrypted_size);
dst[encrypted_range.clone()].copy_from_slice(&decrypted_tmp[..decrypted_size]);
Expand All @@ -1245,17 +1226,8 @@ impl SecureChannel {
let signature_range = (encrypted_range.end
- self.security_policy.symmetric_signature_size())
..encrypted_range.end;
trace!(
"signed range = {:?}, signature range = {:?}",
signed_range,
signature_range
);
let verification_key = self.verification_key();
self.security_policy.symmetric_verify_signature(
verification_key,
&dst[signed_range],
&dst[signature_range],
)?;

self.symmetric_verify_signature_with_trace(dst, signed_range, signature_range)?;
Ok(encrypted_range.end)
}
MessageSecurityMode::Invalid => {
Expand All @@ -1265,6 +1237,26 @@ impl SecureChannel {
}
}

fn symmetric_verify_signature_with_trace(
&self,
bytes: &[u8],
data_range: Range<usize>,
signature_range: Range<usize>
) -> Result<bool, StatusCode> {
trace!(
"Verifying signed range = {:?}, signature range = {:?}",
data_range,
signature_range
);

let verification_key = self.verification_key();
self.security_policy.symmetric_verify_signature(
verification_key,
&bytes[data_range],
&bytes[signature_range],
)
}

// Panic code which requires a policy
fn expect_supported_security_policy(&self) {
match self.security_policy {
Expand Down