feat: encrypt works

src/encryptor.rs

@@ -0,0 +1,148 @@
+use ghash::GHash;
+use ghash::universal_hash::UniversalHash;
+use sm4::cipher::{Block, BlockEncrypt, KeyInit};
+use sm4::cipher::generic_array::GenericArray;
+use sm4::Sm4;
+use zeroize::Zeroize;
+
+use crate::util::{BLOCK_SIZE, inc_32, msb_s, normalize_nonce, Sm4Block, u8to128};
+
+pub fn sm4_gcm_encrypt(key: [u8; 16], nonce: &[u8], message: &[u8]) -> Vec<u8> {
+    sm4_gcm_aad_encrypt(key, nonce, &[], message)
+}
+
+pub fn sm4_gcm_aad_encrypt(key: [u8; 16], nonce: &[u8], aad: &[u8], message: &[u8]) -> Vec<u8> {
+    let mut encryptor = Sm4GcmStreamEncryptor::new(key, nonce);
+    if aad.len() > 0 {
+        encryptor.init_adata(aad);
+    }
+    let mut enc1 = encryptor.update(message);
+    let (enc2, tag) = encryptor.finalize();
+    enc1.extend_from_slice(&enc2);
+    enc1.extend_from_slice(&tag);
+    enc1
+}
+
+pub struct Sm4GcmStreamEncryptor {
+    cipher: Sm4,
+    message_buffer: Vec<u8>,
+    ghash: GHash,
+    init_nonce: u128,
+    encryption_nonce: u128,
+    adata_len: usize,
+    message_len: usize,
+}
+
+impl Sm4GcmStreamEncryptor {
+    pub fn new(key: [u8; 16], nonce: &[u8]) -> Self {
+        let key = GenericArray::from(key);
+        let aes = Sm4::new(&key);
+
+        let mut ghash_key = ghash::Key::default();
+        aes.encrypt_block(&mut ghash_key);
+        let ghash = GHash::new(&ghash_key);
+        ghash_key.zeroize();
+
+        let mut s = Self {
+            cipher: aes,
+            message_buffer: vec![],
+            ghash,
+            init_nonce: 0,
+            encryption_nonce: 0,
+            adata_len: 0,
+            message_len: 0,
+        };
+        let (_, normalized_nonce) = s.normalize_nonce(nonce);
+        s.init_nonce = normalized_nonce;
+        s.encryption_nonce = normalized_nonce;
+        s
+    }
+
+    pub fn init_adata(&mut self, adata: &[u8]) {
+        if adata.len() > 0 {
+            self.adata_len += adata.len();
+            self.ghash.update_padded(adata);
+        }
+    }
+
+    pub fn update(&mut self, message: &[u8]) -> Vec<u8> {
+        self.message_buffer.extend_from_slice(message);
+        let message_buffer_slice = self.message_buffer.as_slice();
+        if message_buffer_slice.len() < BLOCK_SIZE {
+            return Vec::with_capacity(0);
+        }
+        let blocks_count = message_buffer_slice.len() / BLOCK_SIZE;
+        let mut blocks = Vec::with_capacity(blocks_count);
+        for _ in 0..blocks_count {
+            self.encryption_nonce = inc_32(self.encryption_nonce);
+            let ctr = self.encryption_nonce.to_be_bytes();
+            blocks.push(Block::<Sm4Block>::clone_from_slice(&ctr));
+        }
+        self.cipher.encrypt_blocks(&mut blocks);
+
+        let mut encrypted_message = message_buffer_slice[0..blocks_count * BLOCK_SIZE].to_vec();
+        for i in 0..blocks_count {
+            let chunk = &mut encrypted_message[i * BLOCK_SIZE..(i + 1) * BLOCK_SIZE];
+            let block = blocks[i].as_slice();
+            for k in 0..BLOCK_SIZE {
+                chunk[k] ^= block[k];
+            }
+        }
+        self.ghash.update_padded(&encrypted_message);
+        self.message_buffer = message_buffer_slice[blocks_count * BLOCK_SIZE..].to_vec();
+        self.message_len += encrypted_message.len();
+
+        encrypted_message
+    }
+
+    pub fn finalize(&mut self) -> (Vec<u8>, Vec<u8>) {
+        let mut final_encrypted_message = Vec::with_capacity(BLOCK_SIZE);
+        if !self.message_buffer.is_empty() {
+            // last block and this block len may less than 128 bits (16 bytes)
+            self.encryption_nonce = inc_32(self.encryption_nonce);
+            let mut ctr = self.encryption_nonce.to_be_bytes();
+            let block = Block::<Sm4Block>::from_mut_slice(&mut ctr);
+            self.cipher.encrypt_block(block);
+
+            let chunk = self.message_buffer.as_slice();
+            let msb = msb_s(chunk.len() * 8, block.as_slice());
+            let y = u8to128(chunk) ^ u8to128(&msb);
+            final_encrypted_message.extend_from_slice(&y.to_be_bytes()[16 - chunk.len()..16]);
+            self.ghash.update_padded(&final_encrypted_message);
+            self.message_len += final_encrypted_message.len();
+        }
+        let adata_bit_len = self.adata_len * 8;
+        let message_bit_len = self.message_len * 8;
+        let mut adata_and_message_len = Vec::with_capacity(BLOCK_SIZE);
+        adata_and_message_len.extend_from_slice(&(adata_bit_len as u64).to_be_bytes());
+        adata_and_message_len.extend_from_slice(&(message_bit_len as u64).to_be_bytes());
+        self.ghash.update_padded(&adata_and_message_len);
+
+
+        let tag = self.compute_tag();
+
+        (final_encrypted_message, tag)
+    }
+
+    fn compute_tag(&mut self) -> Vec<u8> {
+        let mut bs = self.init_nonce.to_be_bytes().clone();
+        let block = Block::<Sm4Block>::from_mut_slice(&mut bs);
+        self.cipher.encrypt_block(block);
+        let ghash = self.ghash.clone().finalize();
+        let tag_trunk = ghash.as_slice();
+        let y = u8to128(&tag_trunk) ^ u8to128(&block.as_slice());
+        y.to_be_bytes().to_vec()
+    }
+
+    fn ghash_key(&mut self) -> u128 {
+        let mut block = [0u8; BLOCK_SIZE];
+        let block = Block::<Sm4Block>::from_mut_slice(&mut block);
+        self.cipher.encrypt_block(block);
+        u8to128(&block.as_slice())
+    }
+
+    fn normalize_nonce(&mut self, nonce_bytes: &[u8]) -> (u128, u128) {
+        let ghash_key = self.ghash_key();
+        normalize_nonce(ghash_key, nonce_bytes)
+    }
+}

src/lib.rs

@@ -0,0 +1,17 @@
+mod util;
+mod encryptor;
+
+pub use encryptor::Sm4GcmStreamEncryptor;
+use crate::encryptor::sm4_gcm_aad_encrypt;
+
+#[test]
+fn test_encrypt() {
+    let data = vec![
+        ([0u8; 16], [0u8; 12], &[], &b"hello world", "1587c6137e306fed6a6a5f49539b6dd6fe2b7872c3279636db07c2")
+    ];
+
+    for (key, nonce, aad, message, expected) in data {
+        let encrypted = hex::encode(sm4_gcm_aad_encrypt(key, &nonce, aad, *message));
+        assert_eq!(expected, &encrypted);
+    }
+}

src/main.rs

@@ -1,3 +0,0 @@
-fn main() {
-    println!("Hello, world!");
-}

src/util.rs

@@ -0,0 +1,84 @@
+use sm4::cipher::BlockSizeUser;
+use sm4::cipher::consts::U16;
+
+pub(crate) struct Sm4Block {}
+
+impl BlockSizeUser for Sm4Block {
+    type BlockSize = U16;
+}
+
+pub(crate) const BLOCK_SIZE: usize = 16;
+
+
+// R = 11100001 || 0(120)
+const R: u128 = 0b11100001 << 120;
+
+pub(crate) fn gmul_128(x: u128, y: u128) -> u128 {
+    let mut z = 0u128;
+    let mut v = y;
+    for i in (0..128).rev() {
+        let xi = (x >> i) & 1;
+        if xi != 0 {
+            z ^= v;
+        }
+        v = match v & 1 == 0 {
+            true => { v >> 1 }
+            false => { (v >> 1) ^ R }
+        };
+    }
+    z
+}
+
+pub(crate) fn ghash(key: u128, messages: &[u128]) -> u128 {
+    let mut y = 0u128;
+    for message in messages {
+        let yi = gmul_128(y ^ message, key);
+        y = yi;
+    }
+    y
+}
+
+pub(crate) fn normalize_nonce(ghash_key: u128, nonce_bytes: &[u8]) -> (u128, u128) {
+    let nonce = u8to128(nonce_bytes);
+    let normalized_nonce = match nonce_bytes.len() == 12 {
+        true => {
+            nonce << 32 | 0x00000001
+        }
+        false => {
+            let mut iv_padding = vec![];
+            // s = 128[len(iv) / 128] - len(iv)
+            let s = 128 * (((nonce_bytes.len() * 8) + 128 - 1) / 128) - (nonce_bytes.len() * 8);
+            iv_padding.push(nonce << s);
+            iv_padding.push((nonce_bytes.len() * 8) as u128);
+            ghash(ghash_key, &iv_padding)
+        }
+    };
+    (ghash_key, normalized_nonce)
+}
+
+pub(crate) fn msb_s(s: usize, bytes: &[u8]) -> Vec<u8> {
+    let mut result = vec![];
+    let n = s / 8;
+    let remain = s % 8;
+    result.extend_from_slice(&bytes[0..n]);
+    if remain > 0 {
+        result.push(bytes[n] >> (8 - remain));
+    }
+    result
+}
+
+#[inline]
+pub(crate) fn u8to128(bytes: &[u8]) -> u128 {
+    bytes.iter().rev().enumerate().fold(0, |acc, (i, &byte)| {
+        acc | (byte as u128) << (i * 8)
+    })
+}
+
+// incs(X)=MSBlen(X)-s(X) || [int(LSBs(X))+1 mod 2^s]s
+#[inline]
+pub(crate) fn inc_32(bits: u128) -> u128 {
+    let msb = bits >> 32;
+    let mut lsb = (bits & 0xffffffff) as u32;
+    lsb = lsb.wrapping_add(1);
+    msb << 32 | lsb as u128
+}