fixed tests
[mono.git] / mcs / class / Mono.Security / Mono.Security.Cryptography / SymmetricTransform.cs
1 //
2 // Mono.Security.Cryptography.SymmetricTransform implementation
3 //
4 // Authors:
5 //      Thomas Neidhart (tome@sbox.tugraz.at)
6 //      Sebastien Pouliot <sebastien@ximian.com>
7 //
8 // Portions (C) 2002, 2003 Motus Technologies Inc. (http://www.motus.com)
9 // Copyright (C) 2004-2007 Novell, Inc (http://www.novell.com)
10 //
11 // Permission is hereby granted, free of charge, to any person obtaining
12 // a copy of this software and associated documentation files (the
13 // "Software"), to deal in the Software without restriction, including
14 // without limitation the rights to use, copy, modify, merge, publish,
15 // distribute, sublicense, and/or sell copies of the Software, and to
16 // permit persons to whom the Software is furnished to do so, subject to
17 // the following conditions:
18 // 
19 // The above copyright notice and this permission notice shall be
20 // included in all copies or substantial portions of the Software.
21 // 
22 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
23 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
24 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
25 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
26 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
27 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
28 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
29 //
30
31 using System;
32 using System.Security.Cryptography;
33
34 namespace Mono.Security.Cryptography {
35
36         // This class implement most of the common code required for symmetric
37         // algorithm transforms, like:
38         // - CipherMode: Builds CBC and CFB on top of (descendant supplied) ECB
39         // - PaddingMode, transform properties, multiple blocks, reuse...
40         //
41         // Descendants MUST:
42         // - intialize themselves (like key expansion, ...)
43         // - override the ECB (Electronic Code Book) method which will only be
44         //   called using BlockSize byte[] array.
45         internal abstract class SymmetricTransform : ICryptoTransform {
46                 protected SymmetricAlgorithm algo;
47                 protected bool encrypt;
48                 private int BlockSizeByte;
49                 private byte[] temp;
50                 private byte[] temp2;
51                 private byte[] workBuff;
52                 private byte[] workout;
53                 private int FeedBackByte;
54                 private int FeedBackIter;
55                 private bool m_disposed = false;
56                 private bool lastBlock;
57
58                 public SymmetricTransform (SymmetricAlgorithm symmAlgo, bool encryption, byte[] rgbIV) 
59                 {
60                         algo = symmAlgo;
61                         encrypt = encryption;
62                         BlockSizeByte = (algo.BlockSize >> 3);
63
64                         if (rgbIV == null) {
65                                 rgbIV = KeyBuilder.IV (BlockSizeByte);
66                         } else {
67                                 rgbIV = (byte[]) rgbIV.Clone ();
68                         }
69 #if NET_2_0
70                         // compare the IV length with the "currently selected" block size and *ignore* IV that are too big
71                         if (rgbIV.Length < BlockSizeByte) {
72                                 string msg = Locale.GetText ("IV is too small ({0} bytes), it should be {1} bytes long.",
73                                         rgbIV.Length, BlockSizeByte);
74                                 throw new CryptographicException (msg);
75                         }
76 #endif
77                         // mode buffers
78                         temp = new byte [BlockSizeByte];
79                         Buffer.BlockCopy (rgbIV, 0, temp, 0, System.Math.Min (BlockSizeByte, rgbIV.Length));
80                         temp2 = new byte [BlockSizeByte];
81                         FeedBackByte = (algo.FeedbackSize >> 3);
82                         if (FeedBackByte != 0)
83                                 FeedBackIter = (int) BlockSizeByte / FeedBackByte;
84                         // transform buffers
85                         workBuff = new byte [BlockSizeByte];
86                         workout =  new byte [BlockSizeByte];
87                 }
88
89                 ~SymmetricTransform () 
90                 {
91                         Dispose (false);
92                 }
93
94                 void IDisposable.Dispose () 
95                 {
96                         Dispose (true);
97                         GC.SuppressFinalize (this);  // Finalization is now unnecessary
98                 }
99
100                 // MUST be overriden by classes using unmanaged ressources
101                 // the override method must call the base class
102                 protected virtual void Dispose (bool disposing) 
103                 {
104                         if (!m_disposed) {
105                                 if (disposing) {
106                                         // dispose managed object: zeroize and free
107                                         Array.Clear (temp, 0, BlockSizeByte);
108                                         temp = null;
109                                         Array.Clear (temp2, 0, BlockSizeByte);
110                                         temp2 = null;
111                                 }
112                                 m_disposed = true;
113                         }
114                 }
115
116                 public virtual bool CanTransformMultipleBlocks {
117                         get { return true; }
118                 }
119
120                 public virtual bool CanReuseTransform {
121                         get { return false; }
122                 }
123
124                 public virtual int InputBlockSize {
125                         get { return BlockSizeByte; }
126                 }
127
128                 public virtual int OutputBlockSize {
129                         get { return BlockSizeByte; }
130                 }
131
132                 // note: Each block MUST be BlockSizeValue in size!!!
133                 // i.e. Any padding must be done before calling this method
134                 protected virtual void Transform (byte[] input, byte[] output) 
135                 {
136                         switch (algo.Mode) {
137                         case CipherMode.ECB:
138                                 ECB (input, output);
139                                 break;
140                         case CipherMode.CBC:
141                                 CBC (input, output);
142                                 break;
143                         case CipherMode.CFB:
144                                 CFB (input, output);
145                                 break;
146                         case CipherMode.OFB:
147                                 OFB (input, output);
148                                 break;
149                         case CipherMode.CTS:
150                                 CTS (input, output);
151                                 break;
152                         default:
153                                 throw new NotImplementedException ("Unkown CipherMode" + algo.Mode.ToString ());
154                         }
155                 }
156
157                 // Electronic Code Book (ECB)
158                 protected abstract void ECB (byte[] input, byte[] output); 
159
160                 // Cipher-Block-Chaining (CBC)
161                 protected virtual void CBC (byte[] input, byte[] output) 
162                 {
163                         if (encrypt) {
164                                 for (int i = 0; i < BlockSizeByte; i++)
165                                         temp[i] ^= input[i];
166                                 ECB (temp, output);
167                                 Buffer.BlockCopy (output, 0, temp, 0, BlockSizeByte);
168                         }
169                         else {
170                                 Buffer.BlockCopy (input, 0, temp2, 0, BlockSizeByte);
171                                 ECB (input, output);
172                                 for (int i = 0; i < BlockSizeByte; i++)
173                                         output[i] ^= temp[i];
174                                 Buffer.BlockCopy (temp2, 0, temp, 0, BlockSizeByte);
175                         }
176                 }
177
178                 // Cipher-FeedBack (CFB)
179                 protected virtual void CFB (byte[] input, byte[] output) 
180                 {
181                         if (encrypt) {
182                                 for (int x = 0; x < FeedBackIter; x++) {
183                                         // temp is first initialized with the IV
184                                         ECB (temp, temp2);
185
186                                         for (int i = 0; i < FeedBackByte; i++)
187                                                 output[i + x] = (byte)(temp2[i] ^ input[i + x]);
188                                         Buffer.BlockCopy (temp, FeedBackByte, temp, 0, BlockSizeByte - FeedBackByte);
189                                         Buffer.BlockCopy (output, x, temp, BlockSizeByte - FeedBackByte, FeedBackByte);
190                                 }
191                         }
192                         else {
193                                 for (int x = 0; x < FeedBackIter; x++) {
194                                         // we do not really decrypt this data!
195                                         encrypt = true;
196                                         // temp is first initialized with the IV
197                                         ECB (temp, temp2);
198                                         encrypt = false;
199
200                                         Buffer.BlockCopy (temp, FeedBackByte, temp, 0, BlockSizeByte - FeedBackByte);
201                                         Buffer.BlockCopy (input, x, temp, BlockSizeByte - FeedBackByte, FeedBackByte);
202                                         for (int i = 0; i < FeedBackByte; i++)
203                                                 output[i + x] = (byte)(temp2[i] ^ input[i + x]);
204                                 }
205                         }
206                 }
207
208                 // Output-FeedBack (OFB)
209                 protected virtual void OFB (byte[] input, byte[] output) 
210                 {
211                         throw new CryptographicException ("OFB isn't supported by the framework");
212                 }
213
214                 // Cipher Text Stealing (CTS)
215                 protected virtual void CTS (byte[] input, byte[] output) 
216                 {
217                         throw new CryptographicException ("CTS isn't supported by the framework");
218                 }
219
220                 private void CheckInput (byte[] inputBuffer, int inputOffset, int inputCount)
221                 {
222                         if (inputBuffer == null)
223                                 throw new ArgumentNullException ("inputBuffer");
224                         if (inputOffset < 0)
225                                 throw new ArgumentOutOfRangeException ("inputOffset", "< 0");
226                         if (inputCount < 0)
227                                 throw new ArgumentOutOfRangeException ("inputCount", "< 0");
228                         // ordered to avoid possible integer overflow
229                         if (inputOffset > inputBuffer.Length - inputCount)
230                                 throw new ArgumentException ("inputBuffer", Locale.GetText ("Overflow"));
231                 }
232
233                 // this method may get called MANY times so this is the one to optimize
234                 public virtual int TransformBlock (byte[] inputBuffer, int inputOffset, int inputCount, byte[] outputBuffer, int outputOffset) 
235                 {
236                         if (m_disposed)
237                                 throw new ObjectDisposedException ("Object is disposed");
238                         CheckInput (inputBuffer, inputOffset, inputCount);
239                         // check output parameters
240                         if (outputBuffer == null)
241                                 throw new ArgumentNullException ("outputBuffer");
242                         if (outputOffset < 0)
243                                 throw new ArgumentOutOfRangeException ("outputOffset", "< 0");
244
245                         // ordered to avoid possible integer overflow
246                         int len = outputBuffer.Length - inputCount - outputOffset;
247                         if (!encrypt && (0 > len) && ((algo.Padding == PaddingMode.None) || (algo.Padding == PaddingMode.Zeros))) {
248                                 throw new CryptographicException ("outputBuffer", Locale.GetText ("Overflow"));
249                         } else  if (KeepLastBlock) {
250                                 if (0 > len + BlockSizeByte)
251                                         throw new CryptographicException ("outputBuffer", Locale.GetText ("Overflow"));
252                         } else {
253                                 if (0 > len) {
254                                         // there's a special case if this is the end of the decryption process
255                                         if (inputBuffer.Length - inputOffset - outputBuffer.Length == BlockSizeByte)
256                                                 inputCount = outputBuffer.Length - outputOffset;
257                                         else
258                                                 throw new CryptographicException ("outputBuffer", Locale.GetText ("Overflow"));
259                                 }
260                         }
261                         return InternalTransformBlock (inputBuffer, inputOffset, inputCount, outputBuffer, outputOffset);
262                 }
263
264                 private bool KeepLastBlock {
265                         get {
266                                 return ((!encrypt) && (algo.Mode != CipherMode.ECB) && (algo.Padding != PaddingMode.None));
267                         }
268                 }
269
270                 private int InternalTransformBlock (byte[] inputBuffer, int inputOffset, int inputCount, byte[] outputBuffer, int outputOffset) 
271                 {
272                         int offs = inputOffset;
273                         int full;
274
275                         // this way we don't do a modulo every time we're called
276                         // and we may save a division
277                         if (inputCount != BlockSizeByte) {
278                                 if ((inputCount % BlockSizeByte) != 0)
279                                         throw new CryptographicException ("Invalid input block size.");
280
281                                 full = inputCount / BlockSizeByte;
282                         }
283                         else
284                                 full = 1;
285
286                         if (KeepLastBlock)
287                                 full--;
288
289                         int total = 0;
290
291                         if (lastBlock) {
292                                 Transform (workBuff, workout);
293                                 Buffer.BlockCopy (workout, 0, outputBuffer, outputOffset, BlockSizeByte);
294                                 outputOffset += BlockSizeByte;
295                                 total += BlockSizeByte;
296                                 lastBlock = false;
297                         }
298
299                         for (int i = 0; i < full; i++) {
300                                 Buffer.BlockCopy (inputBuffer, offs, workBuff, 0, BlockSizeByte);
301                                 Transform (workBuff, workout);
302                                 Buffer.BlockCopy (workout, 0, outputBuffer, outputOffset, BlockSizeByte);
303                                 offs += BlockSizeByte;
304                                 outputOffset += BlockSizeByte;
305                                 total += BlockSizeByte;
306                         }
307
308                         if (KeepLastBlock) {
309                                 Buffer.BlockCopy (inputBuffer, offs, workBuff, 0, BlockSizeByte);
310                                 lastBlock = true;
311                         }
312
313                         return total;
314                 }
315
316 #if NET_2_0
317                 RandomNumberGenerator _rng;
318
319                 private void Random (byte[] buffer, int start, int length)
320                 {
321                         if (_rng == null) {
322                                 _rng = RandomNumberGenerator.Create ();
323                         }
324                         byte[] random = new byte [length];
325                         _rng.GetBytes (random);
326                         Buffer.BlockCopy (random, 0, buffer, start, length);
327                 }
328
329                 private void ThrowBadPaddingException (PaddingMode padding, int length, int position)
330                 {
331                         string msg = String.Format (Locale.GetText ("Bad {0} padding."), padding);
332                         if (length >= 0)
333                                 msg += String.Format (Locale.GetText (" Invalid length {0}."), length);
334                         if (position >= 0)
335                                 msg += String.Format (Locale.GetText (" Error found at position {0}."), position);
336                         throw new CryptographicException (msg);
337                 }
338 #endif
339
340                 private byte[] FinalEncrypt (byte[] inputBuffer, int inputOffset, int inputCount) 
341                 {
342                         // are there still full block to process ?
343                         int full = (inputCount / BlockSizeByte) * BlockSizeByte;
344                         int rem = inputCount - full;
345                         int total = full;
346
347                         switch (algo.Padding) {
348 #if NET_2_0
349                         case PaddingMode.ANSIX923:
350                         case PaddingMode.ISO10126:
351 #endif
352                         case PaddingMode.PKCS7:
353                                 // we need to add an extra block for padding
354                                 total += BlockSizeByte;
355                                 break;
356                         default:
357                                 if (inputCount == 0)
358                                         return new byte [0];
359                                 if (rem != 0) {
360                                         if (algo.Padding == PaddingMode.None)
361                                                 throw new CryptographicException ("invalid block length");
362                                         // zero padding the input (by adding a block for the partial data)
363                                         byte[] paddedInput = new byte [full + BlockSizeByte];
364                                         Buffer.BlockCopy (inputBuffer, inputOffset, paddedInput, 0, inputCount);
365                                         inputBuffer = paddedInput;
366                                         inputOffset = 0;
367                                         inputCount = paddedInput.Length;
368                                         total = inputCount;
369                                 }
370                                 break;
371                         }
372
373                         byte[] res = new byte [total];
374                         int outputOffset = 0;
375
376                         // process all blocks except the last (final) block
377                         while (total > BlockSizeByte) {
378                                 InternalTransformBlock (inputBuffer, inputOffset, BlockSizeByte, res, outputOffset);
379                                 inputOffset += BlockSizeByte;
380                                 outputOffset += BlockSizeByte;
381                                 total -= BlockSizeByte;
382                         }
383
384                         // now we only have a single last block to encrypt
385                         byte padding = (byte) (BlockSizeByte - rem);
386                         switch (algo.Padding) {
387 #if NET_2_0
388                         case PaddingMode.ANSIX923:
389                                 // XX 00 00 00 00 00 00 07 (zero + padding length)
390                                 res [res.Length - 1] = padding;
391                                 Buffer.BlockCopy (inputBuffer, inputOffset, res, full, rem);
392                                 // the last padded block will be transformed in-place
393                                 InternalTransformBlock (res, full, BlockSizeByte, res, full);
394                                 break;
395                         case PaddingMode.ISO10126:
396                                 // XX 3F 52 2A 81 AB F7 07 (random + padding length)
397                                 Random (res, res.Length - padding, padding - 1);
398                                 res [res.Length - 1] = padding;
399                                 Buffer.BlockCopy (inputBuffer, inputOffset, res, full, rem);
400                                 // the last padded block will be transformed in-place
401                                 InternalTransformBlock (res, full, BlockSizeByte, res, full);
402                                 break;
403 #endif
404                         case PaddingMode.PKCS7:
405                                 // XX 07 07 07 07 07 07 07 (padding length)
406                                 for (int i = res.Length; --i >= (res.Length - padding);) 
407                                         res [i] = padding;
408                                 Buffer.BlockCopy (inputBuffer, inputOffset, res, full, rem);
409                                 // the last padded block will be transformed in-place
410                                 InternalTransformBlock (res, full, BlockSizeByte, res, full);
411                                 break;
412                         default:
413                                 InternalTransformBlock (inputBuffer, inputOffset, BlockSizeByte, res, outputOffset);
414                                 break;
415                         }
416                         return res;
417                 }
418
419                 private byte[] FinalDecrypt (byte[] inputBuffer, int inputOffset, int inputCount) 
420                 {
421                         if ((inputCount % BlockSizeByte) > 0)
422                                 throw new CryptographicException ("Invalid input block size.");
423
424                         int total = inputCount;
425                         if (lastBlock)
426                                 total += BlockSizeByte;
427
428                         byte[] res = new byte [total];
429                         int outputOffset = 0;
430
431                         while (inputCount > 0) {
432                                 int len = InternalTransformBlock (inputBuffer, inputOffset, BlockSizeByte, res, outputOffset);
433                                 inputOffset += BlockSizeByte;
434                                 outputOffset += len;
435                                 inputCount -= BlockSizeByte;
436                         }
437
438                         if (lastBlock) {
439                                 Transform (workBuff, workout);
440                                 Buffer.BlockCopy (workout, 0, res, outputOffset, BlockSizeByte);
441                                 outputOffset += BlockSizeByte;
442                                 lastBlock = false;
443                         }
444
445                         // total may be 0 (e.g. PaddingMode.None)
446                         byte padding = ((total > 0) ? res [total - 1] : (byte) 0);
447                         switch (algo.Padding) {
448 #if NET_2_0
449                         case PaddingMode.ANSIX923:
450                                 if ((padding == 0) || (padding > BlockSizeByte))
451                                         ThrowBadPaddingException (algo.Padding, padding, -1);
452                                 for (int i=padding; i > 0; i--) {
453                                         if (res [total - 1 - i] != 0x00)
454                                                 ThrowBadPaddingException (algo.Padding, -1, i);
455                                 }
456                                 total -= padding;
457                                 break;
458                         case PaddingMode.ISO10126:
459                                 if ((padding == 0) || (padding > BlockSizeByte))
460                                         ThrowBadPaddingException (algo.Padding, padding, -1);
461                                 total -= padding;
462                                 break;
463                         case PaddingMode.PKCS7:
464                                 if ((padding == 0) || (padding > BlockSizeByte))
465                                         ThrowBadPaddingException (algo.Padding, padding, -1);
466                                 for (int i=padding - 1; i > 0; i--) {
467                                         if (res [total - 1 - i] != padding)
468                                                 ThrowBadPaddingException (algo.Padding, -1, i);
469                                 }
470                                 total -= padding;
471                                 break;
472 #else
473                         case PaddingMode.PKCS7:
474                                 total -= padding;
475                                 break;
476 #endif
477                         case PaddingMode.None:  // nothing to do - it's a multiple of block size
478                         case PaddingMode.Zeros: // nothing to do - user must unpad himself
479                                 break;
480                         }
481
482                         // return output without padding
483                         if (total > 0) {
484                                 byte[] data = new byte [total];
485                                 Buffer.BlockCopy (res, 0, data, 0, total);
486                                 // zeroize decrypted data (copy with padding)
487                                 Array.Clear (res, 0, res.Length);
488                                 return data;
489                         }
490                         else
491                                 return new byte [0];
492                 }
493
494                 public virtual byte[] TransformFinalBlock (byte[] inputBuffer, int inputOffset, int inputCount) 
495                 {
496                         if (m_disposed)
497                                 throw new ObjectDisposedException ("Object is disposed");
498                         CheckInput (inputBuffer, inputOffset, inputCount);
499
500                         if (encrypt)
501                                 return FinalEncrypt (inputBuffer, inputOffset, inputCount);
502                         else
503                                 return FinalDecrypt (inputBuffer, inputOffset, inputCount);
504                 }
505         }
506 }