introduce a separate AEAD for short header crypto

internal/handshake/updatable_aead_test.go

@@ -0,0 +1,83 @@
+package handshake
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Updatable AEAD", func() {
+	getAEAD := func() *updatableAEAD {
+		key := make([]byte, 16)
+		hpKey := make([]byte, 16)
+		rand.Read(key)
+		rand.Read(hpKey)
+		block, err := aes.NewCipher(key)
+		Expect(err).ToNot(HaveOccurred())
+		aead, err := cipher.NewGCM(block)
+		Expect(err).ToNot(HaveOccurred())
+		hpBlock, err := aes.NewCipher(hpKey)
+		Expect(err).ToNot(HaveOccurred())
+
+		iv := make([]byte, 12)
+		rand.Read(iv)
+
+		u := newUpdatableAEAD()
+		u.SetReadKey(aead, hpBlock)
+		u.SetWriteKey(aead, hpBlock)
+		return u
+	}
+
+	Context("message encryption", func() {
+		msg := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.")
+		ad := []byte("Donec in velit neque.")
+
+		It("encrypts and decrypts a message", func() {
+			aead := getAEAD()
+			encrypted := aead.Seal(nil, msg, 0x1337, ad)
+			opened, err := aead.Open(nil, encrypted, 0x1337, protocol.KeyPhaseZero, ad)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(opened).To(Equal(msg))
+		})
+
+		It("fails to open a message if the associated data is not the same", func() {
+			aead := getAEAD()
+			encrypted := aead.Seal(nil, msg, 0x1337, ad)
+			_, err := aead.Open(nil, encrypted, 0x1337, protocol.KeyPhaseZero, []byte("wrong ad"))
+			Expect(err).To(MatchError("cipher: message authentication failed"))
+		})
+
+		It("fails to open a message if the packet number is not the same", func() {
+			aead := getAEAD()
+			encrypted := aead.Seal(nil, msg, 0x1337, ad)
+			_, err := aead.Open(nil, encrypted, 0x42, protocol.KeyPhaseZero, ad)
+			Expect(err).To(MatchError("cipher: message authentication failed"))
+		})
+	})
+
+	Context("header encryption", func() {
+		It("encrypts and decrypts the header", func() {
+			aead := getAEAD()
+			var lastFiveBitsDifferent int
+			for i := 0; i < 100; i++ {
+				sample := make([]byte, 16)
+				rand.Read(sample)
+				header := []byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}
+				aead.EncryptHeader(sample, &header[0], header[9:13])
+				if header[0]&0x1f != 0xb5&0x1f {
+					lastFiveBitsDifferent++
+				}
+				Expect(header[0] & 0xe0).To(Equal(byte(0xb5 & 0xe0)))
+				Expect(header[1:9]).To(Equal([]byte{1, 2, 3, 4, 5, 6, 7, 8}))
+				Expect(header[9:13]).ToNot(Equal([]byte{0xde, 0xad, 0xbe, 0xef}))
+				aead.DecryptHeader(sample, &header[0], header[9:13])
+				Expect(header).To(Equal([]byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}))
+			}
+			Expect(lastFiveBitsDifferent).To(BeNumerically(">", 75))
+		})
+	})
+})