sm4: add bouncycastle-sm4, a constant-time SM4 block cipher

Cargo.toml

@@ -31,6 +31,7 @@ bouncycastle-rng = { path = "./crypto/rng" }
 bouncycastle-sha2 = { path = "./crypto/sha2" }
 bouncycastle-sha3 = { path = "./crypto/sha3" }
 bouncycastle-sm3 = { path = "./crypto/sm3" }
+bouncycastle-sm4 = { path = "./crypto/sm4" }
 bouncycastle-utils = { path = "./crypto/utils" }
 
 
@@ -75,3 +76,4 @@ bouncycastle-rng.workspace = true
 bouncycastle-sha2.workspace = true
 bouncycastle-sha3.workspace = true
 bouncycastle-sm3.workspace = true
+bouncycastle-sm4.workspace = true

cli/src/aes_ccm_cmd.rs

@@ -63,7 +63,7 @@ use crate::helpers::block_mode_helpers::{CipherDirection, load_key};
 /// The one-shots this command uses are on the key's role traits, and the key type carries the
 /// nonce and tag lengths as const parameters, so a generic `run` over the key length needs a way
 /// to name the key type for an `(N, T)` it chooses at run time: this generic associated type.
-trait CcmKeys<const KEY_LEN: usize> {
+pub(crate) trait CcmKeys<const KEY_LEN: usize> {
     /// The key type at nonce length `N` and tag length `T`.
     type Key<const N: usize, const T: usize>: FromKeyMaterial<KEY_LEN>
         + AeadDeclaredEncryptionKey<KEY_LEN, N, T, T>
@@ -227,7 +227,7 @@ fn load_aad(aad: &Option<String>, aad_file: &Option<String>) -> Vec<u8> {
 /// be matched into one of the permitted instantiations. The two nested matches are the price of
 /// that, and they are exhaustive over A.1's sets: 7 nonce lengths x 7 tag lengths.
 #[allow(clippy::too_many_arguments)] // the three key lengths' inputs, already parsed
-fn run<F: CcmKeys<KEY_LEN>, const KEY_LEN: usize>(
+pub(crate) fn run<F: CcmKeys<KEY_LEN>, const KEY_LEN: usize>(
     action: &CipherDirection,
     key: &KeyMaterial<KEY_LEN>,
     nonce: &Option<String>,

cli/src/sm4_cbc_cmd.rs

@@ -0,0 +1,42 @@
+//! SM4-CBC encryption and decryption, streaming stdin to stdout.
+//!
+//! Only the cipher wiring lives here: the IV convention, key loading and stdin framing are all
+//! in [`crate::helpers::block_mode_helpers`], shared with the `aes*-cbc` and `aes*-ecb`
+//! commands. See that module for the command-line contract. Input is padded with PKCS7, so it
+//! may be any length.
+//!
+//! `sm4-cbc` is the same command as `aes128-cbc` over the SM4 permutation (GB/T 32907-2016;
+//! 16-byte key, 16-byte block), so every remark there applies unchanged. CBC (NIST SP 800-38A
+//! Sec 6.2) provides confidentiality only: neither the ciphertext nor the IV is authenticated,
+//! and a flipped ciphertext bit flips the same bit of the *next* block's plaintext (Appendix D).
+//! Do not decrypt data you have not authenticated separately.
+
+use crate::helpers::block_mode_helpers::{
+    CipherDirection, decrypt_stream, encrypt_stream, load_iv, load_key_object, start_encryptor,
+};
+use bouncycastle::cipher::modes::CBC;
+use bouncycastle::cipher::padding::PKCS7;
+use bouncycastle::core::symmetric_key::{SymmetricDecryptionKey, SymmetricEncryptionKey};
+use bouncycastle::sm4::{BLOCK_LEN, KEY_LEN, SM4Key};
+
+/// Dispatches to the shared streaming loops under the key's padded CBC mode.
+pub(crate) fn sm4_cbc_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    let key = load_key_object::<SM4Key<CBC<PKCS7>>, KEY_LEN>(key, key_file, "SM4");
+    let iv = load_iv::<BLOCK_LEN>(iv, iv_file);
+    match action {
+        CipherDirection::Encrypt => {
+            let (enc, generated_iv) = start_encryptor(iv, |rng| key.create_encryptor(rng));
+            encrypt_stream::<_, BLOCK_LEN>(enc, generated_iv.as_ref(), output_hex, None)
+        }
+        CipherDirection::Decrypt => {
+            decrypt_stream::<_, BLOCK_LEN>(iv, |iv| key.create_decryptor(iv), output_hex, None)
+        }
+    }
+}

cli/src/sm4_ccm_cmd.rs

@@ -0,0 +1,42 @@
+//! SM4-CCM authenticated encryption and decryption: the `aes*-ccm` command over the SM4 key
+//! (GB/T 32907-2016; with the default 12-byte nonce and 16-byte tag it is RFC 8998 Sec 3.5.2's
+//! `AEAD_SM4_CCM`), with the same contract -- the whole input read first, the nonce supplied
+//! rather than generated, `ciphertext || tag` out. See [`crate::aes_ccm_cmd`] for why CCM cannot
+//! stream and for the nonce and length rules; this file only names the SM4 key type for that
+//! module's runner.
+
+use crate::aes_ccm_cmd::{CcmKeys, run};
+use crate::helpers::block_mode_helpers::{CipherDirection, load_key};
+use bouncycastle::cipher::modes::CCM;
+use bouncycastle::sm4::{KEY_LEN, SM4Key};
+
+struct Sm4;
+
+impl CcmKeys<KEY_LEN> for Sm4 {
+    type Key<const N: usize, const T: usize> = SM4Key<CCM<N, T>>;
+}
+
+/// SM4 CCM. See the module docs and the subcommand help.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn sm4_ccm_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    nonce: &Option<String>,
+    nonce_file: &Option<String>,
+    aad: &Option<String>,
+    aad_file: &Option<String>,
+    tag_len: usize,
+    output_hex: bool,
+) {
+    run::<Sm4, KEY_LEN>(
+        action,
+        &load_key::<KEY_LEN>(key, key_file, "SM4"),
+        nonce,
+        nonce_file,
+        aad,
+        aad_file,
+        tag_len,
+        output_hex,
+    );
+}

cli/src/sm4_cfb8_cmd.rs

@@ -0,0 +1,36 @@
+//! SM4-CFB8 encryption and decryption, streaming stdin to stdout.
+//!
+//! Only the cipher wiring lives here: the IV convention, key loading and stdin framing are in
+//! [`crate::helpers::stream_mode_helpers`] (and [`crate::helpers::block_mode_helpers`] for the
+//! key and IV loaders), shared with the `aes*-cfb8` commands. See those modules for the
+//! command-line contract.
+//!
+//! `sm4-cfb8` is the same command as `aes128-cfb8` over the SM4 permutation (GB/T 32907-2016;
+//! 16-byte key, 16-byte block), so every remark there applies unchanged. The segment size is one
+//! byte: this is draft-ribose-cfrg-sm4-10's **SM4-CFB-8** (Sec 8.5.1), a different and
+//! non-interoperable mode from the SM4-CFB-128 of `sm4-cfb`, and it costs a full SM4 call per byte,
+//! sixteen times the work. Prefer `sm4-cfb` unless a byte-granular self-synchronising stream is
+//! required or the format demands CFB8.
+//!
+//! # Warning
+//!
+//! CFB8 provides confidentiality only. It does not detect tampering, and neither the ciphertext nor
+//! the IV is authenticated. Do not decrypt data you have not authenticated separately.
+
+use crate::helpers::block_mode_helpers::{CipherDirection, load_iv, load_key_object};
+use crate::helpers::stream_mode_helpers::run_stream_mode;
+use bouncycastle::cipher::modes::CFB8;
+use bouncycastle::sm4::{BLOCK_LEN, KEY_LEN, SM4Key};
+
+/// Dispatches to the shared streaming loops under the key's `CFB8` mode.
+pub(crate) fn sm4_cfb8_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    let key = load_key_object::<SM4Key<CFB8>, KEY_LEN>(key, key_file, "SM4");
+    run_stream_mode::<_, KEY_LEN, BLOCK_LEN>(action, &key, load_iv(iv, iv_file), output_hex)
+}

cli/src/sm4_cfb_cmd.rs

@@ -0,0 +1,40 @@
+//! SM4-CFB128 encryption and decryption, streaming stdin to stdout.
+//!
+//! Only the cipher wiring lives here: the IV convention, key loading and stdin framing are in
+//! [`crate::helpers::stream_mode_helpers`] (and [`crate::helpers::block_mode_helpers`] for the
+//! key and IV loaders), shared with the `aes*-cfb` commands. See those modules for the
+//! command-line contract.
+//!
+//! `sm4-cfb` is the same command as `aes128-cfb` over the SM4 permutation (GB/T 32907-2016;
+//! 16-byte key, 16-byte block), so every remark there applies unchanged. The segment size is the
+//! full block, i.e. draft-ribose-cfrg-sm4-10's **SM4-CFB-128** (Sec 8.5.1); the draft's 8-bit
+//! variant is a different, non-interoperable mode and has its own command, `sm4-cfb8`.
+//!
+//! CFB is a stream cipher, so this command accepts input of any length and pads nothing; the
+//! ciphertext is exactly as long as the plaintext.
+//!
+//! # Warning
+//!
+//! CFB provides confidentiality only. It does not detect tampering, and neither the ciphertext nor
+//! the IV is authenticated. Flipping a ciphertext bit flips the *same* bit of the plaintext in the
+//! *same* block (NIST SP 800-38A Appendix D, Table D.2), at the cost of randomising the next one,
+//! so an attacker edits the block they aimed at. Do not decrypt data you have not authenticated
+//! separately.
+
+use crate::helpers::block_mode_helpers::{CipherDirection, load_iv, load_key_object};
+use crate::helpers::stream_mode_helpers::run_stream_mode;
+use bouncycastle::cipher::modes::CFB;
+use bouncycastle::sm4::{BLOCK_LEN, KEY_LEN, SM4Key};
+
+/// Dispatches to the shared streaming loops under the key's `CFB` mode.
+pub(crate) fn sm4_cfb_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    let key = load_key_object::<SM4Key<CFB>, KEY_LEN>(key, key_file, "SM4");
+    run_stream_mode::<_, KEY_LEN, BLOCK_LEN>(action, &key, load_iv(iv, iv_file), output_hex)
+}

cli/src/sm4_ctr_cmd.rs

@@ -0,0 +1,44 @@
+//! SM4-CTR encryption and decryption, streaming stdin to stdout.
+//!
+//! Only the cipher wiring lives here: the nonce convention, key loading and stdin framing are in
+//! [`crate::helpers::stream_mode_helpers`] (and [`crate::helpers::block_mode_helpers`] for the
+//! key and nonce loaders), shared with the `aes*-ctr` commands. See those modules for the
+//! command-line contract.
+//!
+//! `sm4-ctr` is the same command as `aes128-ctr` over the SM4 permutation (GB/T 32907-2016;
+//! 16-byte key, 16-byte block), so every remark there applies unchanged, including the split of
+//! the counter block: the nonce is **12 bytes** and the counter the remaining 4, giving 2^32
+//! blocks -- 64 GiB -- in a single message. draft-ribose-cfrg-sm4-10 Sec 8.7 takes the counter
+//! sequence as an input and requires only that it "does not repeat within the block size", so
+//! this is one admissible choice; it is NIST SP 800-38A Appendix B.2's.
+//!
+//! `encrypt` writes that 12-byte nonce as the first bytes of its output and `decrypt` reads it
+//! back, exactly as the other modes do with their IVs; note that it is 12 bytes here, not 16.
+//!
+//! # Warning
+//!
+//! CTR provides confidentiality only and is the most malleable mode here: flipping any ciphertext
+//! bit flips exactly the corresponding plaintext bit and affects nothing else (SP 800-38A
+//! Appendix D, Table D.2), so an attacker can edit the plaintext at will with no garbling to give
+//! it away. A repeated nonce under one key is fatal rather than merely unwise -- the same keystream
+//! twice leaks the XOR of the two messages -- which is why the nonce is drawn from the OS-backed
+//! DRBG unless `--iv` / `--iv-file` supplies one, and then its uniqueness under the key is the
+//! caller's to keep. Do not decrypt data you have not authenticated separately.
+
+use crate::helpers::block_mode_helpers::{CipherDirection, load_iv, load_key_object};
+use crate::helpers::stream_mode_helpers::run_stream_mode;
+use bouncycastle::cipher::modes::CTR;
+use bouncycastle::sm4::{CTR_NONCE_LEN, KEY_LEN, SM4Key};
+
+/// Dispatches to the shared streaming loops under the key's `CTR` mode.
+pub(crate) fn sm4_ctr_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    let key = load_key_object::<SM4Key<CTR>, KEY_LEN>(key, key_file, "SM4");
+    run_stream_mode::<_, KEY_LEN, CTR_NONCE_LEN>(action, &key, load_iv(iv, iv_file), output_hex)
+}

cli/src/sm4_gcm_cmd.rs

@@ -0,0 +1,37 @@
+//! SM4-GCM authenticated encryption and decryption, streaming stdin to stdout.
+//!
+//! Only the mode wiring lives here: the IV/tag framing, AAD loading and stdin streaming are in
+//! [`crate::helpers::aead_cipher_helpers`], shared with the `aes*-gcm` commands. See that module
+//! for the command-line contract (`IV || ciphertext || tag`, the AAD flags, and why a tag failure
+//! may be reported after plaintext has already reached stdout).
+//!
+//! `sm4-gcm` is the same command as `aes128-gcm` over the SM4 permutation (GB/T 32907-2016;
+//! 16-byte key, 16-byte block), which is RFC 8998 Sec 3.5.1's `AEAD_SM4_GCM`: a 12-byte nonce and
+//! a 16-byte tag. Every remark there applies unchanged, above all that a repeated IV under one
+//! key lets an attacker recover the hash subkey (SP 800-38D Appendix A).
+
+use crate::helpers::aead_cipher_helpers::{decrypt_gcm, encrypt_gcm, load_aad};
+use crate::helpers::block_mode_helpers::{CipherDirection, load_iv, load_key_object};
+use bouncycastle::cipher::modes::{GCM, GCM_NONCE_LEN};
+use bouncycastle::sm4::{KEY_LEN, SM4Key};
+
+/// Dispatches to the shared AEAD streaming loops with `Gcm`'s 128-bit tag.
+#[allow(clippy::too_many_arguments)] // one flag per input, each inline or from a file
+pub(crate) fn sm4_gcm_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    aad: &Option<String>,
+    aad_file: &Option<String>,
+    output_hex: bool,
+) {
+    let key = load_key_object::<SM4Key<GCM>, KEY_LEN>(key, key_file, "SM4");
+    let nonce = load_iv::<GCM_NONCE_LEN>(iv, iv_file);
+    let aad = load_aad(aad, aad_file);
+    match action {
+        CipherDirection::Encrypt => encrypt_gcm::<_, KEY_LEN, 16>(&key, nonce, &aad, output_hex),
+        CipherDirection::Decrypt => decrypt_gcm::<_, KEY_LEN, 16>(&key, nonce, &aad, output_hex),
+    }
+}