-
Notifications
You must be signed in to change notification settings - Fork 161
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for CBC without padding #210
Conversation
@swift-server-bot test this please |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Generally looks good, got one small note for you.
@swift-server-bot test this please |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One final suggestion here: these tests encrypt and decrypt only inputs that are a single block in size, or that are not an even multiple. Can you add a few tests that use multi-block-size inputs?
Sure, I've added a few more with 2-16x block sizes |
Anything left for me to do @Lukasa? |
Hi @lovetodream, sorry about the delay, I've been swamped. I'll take a look now. |
@swift-server-bot test this please |
Nice change, thanks for your hard work! |
This PR adds support for CBC de- and encryption without padding, as discussed in #209
Checklist
If you've made changes to
gyb
files.script/generate_boilerplate_files_with_gyb
and included updated generated files in a commit of this pull requestMotivation:
As described in #209, I personally need this to migrate an oracle driver from a third party crypto lib to swift-crypto. I think other users might benefit from this addition too.
Modifications:
I've added an overload to the
encrypt
anddecrypt
methods ofAES._CBC
, allowing the user to configure if padding should be added or not. WithnoPadding
set totrue
, an error will be thrown if theplaintext
isn't a multiple of the block size. I've added the corresponding inline documentation.I've also added tests to ensure both encrypting and decrypting without padding work as expected. Although those tests might not be sufficient enough, because I couldn't find good resources online. I've created a bunch of random hex strings and encrypted/decrypted them using another implementation of paddingless CBC and checked if I receive the expected results. To further validate the feature, I've tested it as part of the authentication in oracle-nio, which worked in all test scenarios I've been running.
Result:
After merging this, it will be possible to use CBC without padding. This closes #209