Comments (6)
Thanks for this, this is a reasonable ask.
For the 4-byte Counter
, this will need to be discussed with the CryptoKit team, I'll take that suggestion to them. For the AES-ECB use-case, I'll note that swift-crypto provides an AES block function primitive in _CryptoExtras
(
from swift-crypto.
Hey @btoms20,
Thanks for this proposal. As @Lukasa said, we swift-crypto already provides the AES permutation function, from which you can do one-block ECB since you only need a single block for header protection.
Regarding the proposal to expose counters, the challenge is that counter
is really an internal construct of ChaCha20
(which we don't officially support with POLY1305 authentication).
The swift-crypto
API is really designed to be misuse resistant and exposing the counter through an API is clearly very risky, so we would likely make this some sort of an Insecure
-prefixed extension function.
However, as it currently stands, we are not supporting stream ciphers without authentication. And therefore, it would be a bit of a stretch to have a way to set the counter on top of our existing AEAD
API.
But we can keep this request to revisit this if we have any developments on unauthenticated stream ciphers.
from swift-crypto.
It may be worth double-checking whether BoringSSL supports setting this flag. I did a quick scan earlier today and couldn't see an interface for it, but I might have missed something. If they don't, we'd want to make sure that they added that support. If they do, then you're welcome to open a PR to _CryptoExtras
to add the feature directly.
from swift-crypto.
Hey @Lukasa, I followed your advice, did some digging, and found the BoringSSL function required to support this change. I implemented a rough PR #169 that I'd appreciate your feedback on when you get the chance.
from swift-crypto.
@Lukasa, thanks for pointing that out!
@FredericJacobs, sounds good and understood. Hopefully it can make its way into the Insecure API in the future.
Thanks for the quick responses!
from swift-crypto.
I had completely overlooked _CryptoExtras. Maybe if / when the Insecure ChaCha20 Counter extension gets implemented, it could be tucked away in _CryptoExtras with a not-so-public API and all of the appropriate / necessary warnings. That might help deter your average user from unknowingly misusing it.
from swift-crypto.
Related Issues (20)
- missing symbols needed for SPM HOT 3
- Possible Over-Iteration in PrettyBytes HOT 2
- AES-CBC Support HOT 3
- Point validation HOT 5
- Add SecureEnclave stub
- Add sendable conformance to appropriate types HOT 7
- Umbrella: Update Wycheproof test vectors to v1 HOT 3
- Handling Non Standard Keys Test Failed HOT 3
- Noncopyable / moveonly `PrivateKey` API? HOT 4
- New API Proposal: X.509 Certificate Support HOT 2
- Consider adding `_CRT_SECURE_NO_WARNINGS` to disable warnings on Windows. HOT 1
- Build failure with BUILD_LIBRARY_FOR_DISTRIBUTION=YES HOT 23
- No way to get PKCS#8 representation of private RSA key HOT 3
- Add Sendable annotation to Crypto Extras HOT 3
- How to set CBC padding behavior? HOT 6
- Validating HMACs with incremental computation HOT 1
- Linux armv7 support HOT 9
- Privacy manifest support HOT 6
- CBOR decoding and encoding?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from swift-crypto.