296 lines
13 KiB
JavaScript
296 lines
13 KiB
JavaScript
|
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
|
|||
|
|
/* AES counter-mode (CTR) implementation in JavaScript (c) Chris Veness 2005-2019 */
|
|||
|
|
/* MIT Licence */
|
|||
|
|
/* www.movable-type.co.uk/scripts/aes.html */
|
|||
|
|
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
|
|||
|
|
|
|||
|
|
/* global WorkerGlobalScope */
|
|||
|
|
|
|||
|
|
|
|||
|
|
import Aes from './aes.js';
|
|||
|
|
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* AesCtr: Counter-mode (CTR) wrapper for AES.
|
|||
|
|
*
|
|||
|
|
* This encrypts a Unicode string to produces a base64 ciphertext using 128/192/256-bit AES,
|
|||
|
|
* and the converse to decrypt an encrypted ciphertext.
|
|||
|
|
*
|
|||
|
|
* See csrc.nist.gov/publications/detail/sp/800-38a/final
|
|||
|
|
*/
|
|||
|
|
class AesCtr extends Aes {
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* Encrypt a text using AES encryption in Counter mode of operation.
|
|||
|
|
*
|
|||
|
|
* Unicode multi-byte character safe.
|
|||
|
|
*
|
|||
|
|
* @param {string} plaintext - Source text to be encrypted.
|
|||
|
|
* @param {string} password - The password to use to generate a key for encryption.
|
|||
|
|
* @param {number} nBits - Number of bits to be used in the key; 128 / 192 / 256.
|
|||
|
|
* @returns {string} Encrypted text, base-64 encoded.
|
|||
|
|
*
|
|||
|
|
* @example
|
|||
|
|
* const encr = AesCtr.encrypt('big secret', 'pāşšŵōřđ', 256); // 'lwGl66VVwVObKIr6of8HVqJr'
|
|||
|
|
*/
|
|||
|
|
static encrypt(plaintext, password, nBits) {
|
|||
|
|
if (![ 128, 192, 256 ].includes(nBits)) throw new Error('Key size is not 128 / 192 / 256');
|
|||
|
|
plaintext = AesCtr.utf8Encode(String(plaintext));
|
|||
|
|
password = AesCtr.utf8Encode(String(password));
|
|||
|
|
|
|||
|
|
// use AES itself to encrypt password to get cipher key (using plain password as source for key
|
|||
|
|
// expansion) to give us well encrypted key (in real use hashed password could be used for key)
|
|||
|
|
const nBytes = nBits/8; // no bytes in key (16/24/32)
|
|||
|
|
const pwBytes = new Array(nBytes);
|
|||
|
|
for (let i=0; i<nBytes; i++) { // use 1st 16/24/32 chars of password for key
|
|||
|
|
pwBytes[i] = i<password.length ? password.charCodeAt(i) : 0;
|
|||
|
|
}
|
|||
|
|
let key = Aes.cipher(pwBytes, Aes.keyExpansion(pwBytes)); // gives us 16-byte key
|
|||
|
|
key = key.concat(key.slice(0, nBytes-16)); // expand key to 16/24/32 bytes long
|
|||
|
|
|
|||
|
|
// initialise 1st 8 bytes of counter block with nonce (NIST SP 800-38A §B.2): [0-1] = millisec,
|
|||
|
|
// [2-3] = random, [4-7] = seconds, together giving full sub-millisec uniqueness up to Feb 2106
|
|||
|
|
const timestamp = (new Date()).getTime(); // milliseconds since 1-Jan-1970
|
|||
|
|
const nonceMs = timestamp%1000;
|
|||
|
|
const nonceSec = Math.floor(timestamp/1000);
|
|||
|
|
const nonceRnd = Math.floor(Math.random()*0xffff);
|
|||
|
|
// for debugging: const [ nonceMs, nonceSec, nonceRnd ] = [ 0, 0, 0 ];
|
|||
|
|
const counterBlock = [ // 16-byte array; blocksize is fixed at 16 for AES
|
|||
|
|
nonceMs & 0xff, nonceMs >>>8 & 0xff,
|
|||
|
|
nonceRnd & 0xff, nonceRnd>>>8 & 0xff,
|
|||
|
|
nonceSec & 0xff, nonceSec>>>8 & 0xff, nonceSec>>>16 & 0xff, nonceSec>>>24 & 0xff,
|
|||
|
|
0, 0, 0, 0, 0, 0, 0, 0,
|
|||
|
|
];
|
|||
|
|
|
|||
|
|
// and convert nonce to a string to go on the front of the ciphertext
|
|||
|
|
const nonceStr = counterBlock.slice(0, 8).map(i => String.fromCharCode(i)).join('');
|
|||
|
|
|
|||
|
|
// convert (utf-8) plaintext to byte array
|
|||
|
|
const plaintextBytes = plaintext.split('').map(ch => ch.charCodeAt(0));
|
|||
|
|
|
|||
|
|
// ------------ perform encryption ------------
|
|||
|
|
const ciphertextBytes = AesCtr.nistEncryption(plaintextBytes, key, counterBlock);
|
|||
|
|
|
|||
|
|
// convert byte array to (utf-8) ciphertext string
|
|||
|
|
const ciphertextUtf8 = ciphertextBytes.map(i => String.fromCharCode(i)).join('');
|
|||
|
|
|
|||
|
|
// base-64 encode ciphertext
|
|||
|
|
const ciphertextB64 = AesCtr.base64Encode(nonceStr+ciphertextUtf8);
|
|||
|
|
|
|||
|
|
return ciphertextB64;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* NIST SP 800-38A sets out recommendations for block cipher modes of operation in terms of byte
|
|||
|
|
* operations. This implements the §6.5 Counter Mode (CTR).
|
|||
|
|
*
|
|||
|
|
* Oⱼ = CIPHₖ(Tⱼ) for j = 1, 2 … n
|
|||
|
|
* Cⱼ = Pⱼ ⊕ Oⱼ for j = 1, 2 … n-1
|
|||
|
|
* C*ₙ = P* ⊕ MSBᵤ(Oₙ) final (partial?) block
|
|||
|
|
* where CIPHₖ is the forward cipher function, O output blocks, P plaintext blocks, C
|
|||
|
|
* ciphertext blocks
|
|||
|
|
*
|
|||
|
|
* @param {number[]} plaintext - Plaintext to be encrypted, as byte array.
|
|||
|
|
* @param {number[]} key - Key to be used to encrypt plaintext.
|
|||
|
|
* @param {number[]} counterBlock - Initial 16-byte CTR counter block (with nonce & 0 counter).
|
|||
|
|
* @returns {number[]} Ciphertext as byte array.
|
|||
|
|
*
|
|||
|
|
* @private
|
|||
|
|
*/
|
|||
|
|
static nistEncryption(plaintext, key, counterBlock) {
|
|||
|
|
const blockSize = 16; // block size fixed at 16 bytes / 128 bits (Nb=4) for AES
|
|||
|
|
|
|||
|
|
// generate key schedule - an expansion of the key into distinct Key Rounds for each round
|
|||
|
|
const keySchedule = Aes.keyExpansion(key);
|
|||
|
|
|
|||
|
|
const blockCount = Math.ceil(plaintext.length/blockSize);
|
|||
|
|
const ciphertext = new Array(plaintext.length);
|
|||
|
|
|
|||
|
|
for (let b=0; b<blockCount; b++) {
|
|||
|
|
// ---- encrypt counter block; Oⱼ = CIPHₖ(Tⱼ) ----
|
|||
|
|
const cipherCntr = Aes.cipher(counterBlock, keySchedule);
|
|||
|
|
|
|||
|
|
// block size is reduced on final block
|
|||
|
|
const blockLength = b<blockCount-1 ? blockSize : (plaintext.length-1)%blockSize + 1;
|
|||
|
|
|
|||
|
|
// ---- xor plaintext with ciphered counter byte-by-byte; Cⱼ = Pⱼ ⊕ Oⱼ ----
|
|||
|
|
for (let i=0; i<blockLength; i++) {
|
|||
|
|
ciphertext[b*blockSize + i] = cipherCntr[i] ^ plaintext[b*blockSize + i];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// increment counter block (counter in 2nd 8 bytes of counter block, big-endian)
|
|||
|
|
counterBlock[blockSize-1]++;
|
|||
|
|
// and propagate carry digits
|
|||
|
|
for (let i=blockSize-1; i>=8; i--) {
|
|||
|
|
counterBlock[i-1] += counterBlock[i] >> 8;
|
|||
|
|
counterBlock[i] &= 0xff;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// if within web worker, announce progress every 1000 blocks (roughly every 50ms)
|
|||
|
|
if (typeof WorkerGlobalScope != 'undefined' && self instanceof WorkerGlobalScope) {
|
|||
|
|
if (b%1000 == 0) self.postMessage({ progress: b/blockCount });
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return ciphertext;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* Decrypt a text encrypted by AES in counter mode of operation.
|
|||
|
|
*
|
|||
|
|
* @param {string} ciphertext - Cipher text to be decrypted.
|
|||
|
|
* @param {string} password - Password to use to generate a key for decryption.
|
|||
|
|
* @param {number} nBits - Number of bits to be used in the key; 128 / 192 / 256.
|
|||
|
|
* @returns {string} Decrypted text
|
|||
|
|
*
|
|||
|
|
* @example
|
|||
|
|
* const decr = AesCtr.decrypt('lwGl66VVwVObKIr6of8HVqJr', 'pāşšŵōřđ', 256); // 'big secret'
|
|||
|
|
*/
|
|||
|
|
static decrypt(ciphertext, password, nBits) {
|
|||
|
|
if (![ 128, 192, 256 ].includes(nBits)) throw new Error('Key size is not 128 / 192 / 256');
|
|||
|
|
ciphertext = AesCtr.base64Decode(String(ciphertext));
|
|||
|
|
password = AesCtr.utf8Encode(String(password));
|
|||
|
|
|
|||
|
|
// use AES to encrypt password (mirroring encrypt routine)
|
|||
|
|
const nBytes = nBits/8; // no bytes in key
|
|||
|
|
const pwBytes = new Array(nBytes);
|
|||
|
|
for (let i=0; i<nBytes; i++) { // use 1st nBytes chars of password for key
|
|||
|
|
pwBytes[i] = i<password.length ? password.charCodeAt(i) : 0;
|
|||
|
|
}
|
|||
|
|
let key = Aes.cipher(pwBytes, Aes.keyExpansion(pwBytes));
|
|||
|
|
key = key.concat(key.slice(0, nBytes-16)); // expand key to 16/24/32 bytes long
|
|||
|
|
|
|||
|
|
// recover nonce from 1st 8 bytes of ciphertext into 1st 8 bytes of counter block
|
|||
|
|
const counterBlock = [ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ];
|
|||
|
|
for (let i=0; i<8; i++) counterBlock[i] = ciphertext.charCodeAt(i);
|
|||
|
|
|
|||
|
|
// convert ciphertext to byte array (skipping past initial 8 bytes)
|
|||
|
|
const ciphertextBytes = new Array(ciphertext.length-8);
|
|||
|
|
for (let i=8; i<ciphertext.length; i++) ciphertextBytes[i-8] = ciphertext.charCodeAt(i);
|
|||
|
|
|
|||
|
|
// ------------ perform decryption ------------
|
|||
|
|
const plaintextBytes = AesCtr.nistDecryption(ciphertextBytes, key, counterBlock);
|
|||
|
|
|
|||
|
|
// convert byte array to (utf-8) plaintext string
|
|||
|
|
const plaintextUtf8 = plaintextBytes.map(i => String.fromCharCode(i)).join('');
|
|||
|
|
|
|||
|
|
// decode from UTF8 back to Unicode multi-byte chars
|
|||
|
|
const plaintext = AesCtr.utf8Decode(plaintextUtf8);
|
|||
|
|
|
|||
|
|
return plaintext;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* NIST SP 800-38A sets out recommendations for block cipher modes of operation in terms of byte
|
|||
|
|
* operations. This implements the §6.5 Counter Mode (CTR).
|
|||
|
|
*
|
|||
|
|
* Oⱼ = CIPHₖ(Tⱼ) for j = 1, 2 … n
|
|||
|
|
* Pⱼ = Cⱼ ⊕ Oⱼ for j = 1, 2 … n-1
|
|||
|
|
* P*ₙ = C* ⊕ MSBᵤ(Oₙ) final (partial?) block
|
|||
|
|
* where CIPHₖ is the forward cipher function, O output blocks, C ciphertext blocks, P
|
|||
|
|
* plaintext blocks
|
|||
|
|
*
|
|||
|
|
* @param {number[]} ciphertext - Ciphertext to be decrypted, as byte array.
|
|||
|
|
* @param {number[]} key - Key to be used to decrypt ciphertext.
|
|||
|
|
* @param {number[]} counterBlock - Initial 16-byte CTR counter block (with nonce & 0 counter).
|
|||
|
|
* @returns {number[]} Plaintext as byte array.
|
|||
|
|
*
|
|||
|
|
* @private
|
|||
|
|
*/
|
|||
|
|
static nistDecryption(ciphertext, key, counterBlock) {
|
|||
|
|
const blockSize = 16; // block size fixed at 16 bytes / 128 bits (Nb=4) for AES
|
|||
|
|
|
|||
|
|
// generate key schedule - an expansion of the key into distinct Key Rounds for each round
|
|||
|
|
const keySchedule = Aes.keyExpansion(key);
|
|||
|
|
|
|||
|
|
const blockCount = Math.ceil(ciphertext.length/blockSize);
|
|||
|
|
const plaintext = new Array(ciphertext.length);
|
|||
|
|
|
|||
|
|
for (let b=0; b<blockCount; b++) {
|
|||
|
|
// ---- decrypt counter block; Oⱼ = CIPHₖ(Tⱼ) ----
|
|||
|
|
const cipherCntr = Aes.cipher(counterBlock, keySchedule);
|
|||
|
|
|
|||
|
|
// block size is reduced on final block
|
|||
|
|
const blockLength = b<blockCount-1 ? blockSize : (ciphertext.length-1)%blockSize + 1;
|
|||
|
|
|
|||
|
|
// ---- xor ciphertext with ciphered counter byte-by-byte; Pⱼ = Cⱼ ⊕ Oⱼ ----
|
|||
|
|
for (let i=0; i<blockLength; i++) {
|
|||
|
|
plaintext[b*blockSize + i] = cipherCntr[i] ^ ciphertext[b*blockSize + i];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// increment counter block (counter in 2nd 8 bytes of counter block, big-endian)
|
|||
|
|
counterBlock[blockSize-1]++;
|
|||
|
|
// and propagate carry digits
|
|||
|
|
for (let i=blockSize-1; i>=8; i--) {
|
|||
|
|
counterBlock[i-1] += counterBlock[i] >> 8;
|
|||
|
|
counterBlock[i] &= 0xff;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// if within web worker, announce progress every 1000 blocks (roughly every 50ms)
|
|||
|
|
if (typeof WorkerGlobalScope != 'undefined' && self instanceof WorkerGlobalScope) {
|
|||
|
|
if (b%1000 == 0) self.postMessage({ progress: b/blockCount });
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return plaintext;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
|
|||
|
|
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* Encodes multi-byte string to utf8.
|
|||
|
|
*
|
|||
|
|
* Note utf8Encode is an identity function with 7-bit ascii strings, but not with 8-bit strings;
|
|||
|
|
* utf8Encode('x') = 'x', but utf8Encode('ça') = 'ça', and utf8Encode('ça') = 'ça'.
|
|||
|
|
*/
|
|||
|
|
static utf8Encode(str) {
|
|||
|
|
try {
|
|||
|
|
return new TextEncoder().encode(str, 'utf-8').reduce((prev, curr) => prev + String.fromCharCode(curr), '');
|
|||
|
|
} catch (e) { // no TextEncoder available?
|
|||
|
|
return unescape(encodeURIComponent(str)); // monsur.hossa.in/2012/07/20/utf-8-in-javascript.html
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* Decodes utf8 string to multi-byte.
|
|||
|
|
*/
|
|||
|
|
static utf8Decode(str) {
|
|||
|
|
try {
|
|||
|
|
return new TextEncoder().decode(str, 'utf-8').reduce((prev, curr) => prev + String.fromCharCode(curr), '');
|
|||
|
|
} catch (e) { // no TextEncoder available?
|
|||
|
|
return decodeURIComponent(escape(str)); // monsur.hossa.in/2012/07/20/utf-8-in-javascript.html
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/*
|
|||
|
|
* Encodes string as base-64.
|
|||
|
|
*
|
|||
|
|
* - developer.mozilla.org/en-US/docs/Web/API/window.btoa, nodejs.org/api/buffer.html
|
|||
|
|
* - note: btoa & Buffer/binary work on single-byte Unicode (C0/C1), so ok for utf8 strings, not for general Unicode...
|
|||
|
|
* - note: if btoa()/atob() are not available (eg IE9-), try github.com/davidchambers/Base64.js
|
|||
|
|
*/
|
|||
|
|
static base64Encode(str) {
|
|||
|
|
if (typeof btoa != 'undefined') return btoa(str); // browser
|
|||
|
|
if (typeof Buffer != 'undefined') return new Buffer(str, 'binary').toString('base64'); // Node.js
|
|||
|
|
throw new Error('No Base64 Encode');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/*
|
|||
|
|
* Decodes base-64 encoded string.
|
|||
|
|
*/
|
|||
|
|
static base64Decode(str) {
|
|||
|
|
if (typeof atob != 'undefined') return atob(str); // browser
|
|||
|
|
if (typeof Buffer != 'undefined') return new Buffer(str, 'base64').toString('binary'); // Node.js
|
|||
|
|
throw new Error('No Base64 Decode');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
|
|||
|
|
|
|||
|
|
export default AesCtr;
|