camellia: add bouncycastle-camellia, a constant-time Camellia block cipher

Cargo.toml

@@ -12,6 +12,7 @@ version = "0.1.4"
 # *** Internal Dependencies ***
 bouncycastle = { path = "./" }
 bouncycastle-aes = { path = "./crypto/aes" }
+bouncycastle-camellia = { path = "./crypto/camellia" }
 bouncycastle-ascon = { path = "./crypto/ascon" }
 bouncycastle-base64 = { path = "./crypto/base64" }
 bouncycastle-cipher = { path = "./crypto/cipher" }
@@ -59,6 +60,7 @@ edition.workspace = true
 
 [dependencies]
 bouncycastle-aes.workspace = true
+bouncycastle-camellia.workspace = true
 bouncycastle-ascon.workspace = true
 bouncycastle-base64.workspace = true
 bouncycastle-cipher.workspace = true

cli/src/aes_ccm_cmd.rs

@@ -63,7 +63,7 @@ use crate::helpers::block_mode_helpers::{CipherDirection, load_key};
 /// The one-shots this command uses are on the key's role traits, and the key type carries the
 /// nonce and tag lengths as const parameters, so a generic `run` over the key length needs a way
 /// to name the key type for an `(N, T)` it chooses at run time: this generic associated type.
-trait CcmKeys<const KEY_LEN: usize> {
+pub(crate) trait CcmKeys<const KEY_LEN: usize> {
     /// The key type at nonce length `N` and tag length `T`.
     type Key<const N: usize, const T: usize>: FromKeyMaterial<KEY_LEN>
         + AeadDeclaredEncryptionKey<KEY_LEN, N, T, T>
@@ -227,7 +227,7 @@ fn load_aad(aad: &Option<String>, aad_file: &Option<String>) -> Vec<u8> {
 /// be matched into one of the permitted instantiations. The two nested matches are the price of
 /// that, and they are exhaustive over A.1's sets: 7 nonce lengths x 7 tag lengths.
 #[allow(clippy::too_many_arguments)] // the three key lengths' inputs, already parsed
-fn run<F: CcmKeys<KEY_LEN>, const KEY_LEN: usize>(
+pub(crate) fn run<F: CcmKeys<KEY_LEN>, const KEY_LEN: usize>(
     action: &CipherDirection,
     key: &KeyMaterial<KEY_LEN>,
     nonce: &Option<String>,

cli/src/camellia_cbc_cmd.rs

@@ -0,0 +1,89 @@
+//! Camellia-CBC encryption and decryption, streaming stdin to stdout.
+//!
+//! Only the cipher wiring lives here: the IV convention, key loading and stdin framing are all
+//! in [`crate::helpers::block_mode_helpers`], shared with the `aes*-cbc` and `aes*-ecb`
+//! commands. See that module for the command-line contract. Input is padded with PKCS7, so it
+//! may be any length.
+//!
+//! `camellia128-cbc` / `camellia192-cbc` / `camellia256-cbc` are the same command as `aes*-cbc`
+//! over the Camellia permutation (RFC 3713; 16-, 24- or 32-byte key, 16-byte block -- the
+//! `id-camellia*-cbc` algorithms of RFC 3713 Sec 3), so every remark there applies unchanged. CBC
+//! (NIST SP 800-38A Sec 6.2) provides confidentiality only: neither the ciphertext nor the IV is
+//! authenticated. Do not decrypt data you have not authenticated separately.
+
+use crate::helpers::block_mode_helpers::{
+    CipherDirection, decrypt_stream, encrypt_stream, load_iv, load_key_object, start_encryptor,
+};
+use bouncycastle::camellia::{BLOCK_LEN, Camellia128Key, Camellia192Key, Camellia256Key};
+use bouncycastle::cipher::modes::CBC;
+use bouncycastle::cipher::padding::PKCS7;
+use bouncycastle::core::symmetric_key::{SymmetricDecryptionKey, SymmetricEncryptionKey};
+
+pub(crate) fn camellia128_cbc_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    run::<_, 16>(
+        action,
+        &load_key_object::<Camellia128Key<CBC<PKCS7>>, 16>(key, key_file, "Camellia-128"),
+        load_iv::<BLOCK_LEN>(iv, iv_file),
+        output_hex,
+    );
+}
+
+pub(crate) fn camellia192_cbc_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    run::<_, 24>(
+        action,
+        &load_key_object::<Camellia192Key<CBC<PKCS7>>, 24>(key, key_file, "Camellia-192"),
+        load_iv::<BLOCK_LEN>(iv, iv_file),
+        output_hex,
+    );
+}
+
+pub(crate) fn camellia256_cbc_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    run::<_, 32>(
+        action,
+        &load_key_object::<Camellia256Key<CBC<PKCS7>>, 32>(key, key_file, "Camellia-256"),
+        load_iv::<BLOCK_LEN>(iv, iv_file),
+        output_hex,
+    );
+}
+
+/// Dispatches to the shared streaming loops under the key's padded CBC mode.
+fn run<K, const KEY_LEN: usize>(
+    action: &CipherDirection,
+    key: &K,
+    iv: Option<[u8; BLOCK_LEN]>,
+    output_hex: bool,
+) where
+    K: SymmetricEncryptionKey<KEY_LEN, BLOCK_LEN, BLOCK_LEN>
+        + SymmetricDecryptionKey<KEY_LEN, BLOCK_LEN, BLOCK_LEN>,
+{
+    match action {
+        CipherDirection::Encrypt => {
+            let (enc, generated_iv) = start_encryptor(iv, |rng| key.create_encryptor(rng));
+            encrypt_stream::<_, BLOCK_LEN>(enc, generated_iv.as_ref(), output_hex, None)
+        }
+        CipherDirection::Decrypt => {
+            decrypt_stream::<_, BLOCK_LEN>(iv, |iv| key.create_decryptor(iv), output_hex, None)
+        }
+    }
+}

cli/src/camellia_ccm_cmd.rs

@@ -0,0 +1,101 @@
+//! Camellia-CCM authenticated encryption and decryption: the `aes*-ccm` commands over the Camellia
+//! permutation (RFC 3713; the Camellia-CCM of RFC 5528), with the same contract -- the whole
+//! input read first, the nonce supplied rather than generated, `ciphertext || tag` out. See
+//! [`crate::aes_ccm_cmd`] for why CCM cannot stream and for the nonce and length rules; this
+//! file only names the Camellia key types for that module's runner.
+
+use crate::aes_ccm_cmd::{CcmKeys, run};
+use crate::helpers::block_mode_helpers::{CipherDirection, load_key};
+use bouncycastle::camellia::{Camellia128Key, Camellia192Key, Camellia256Key};
+use bouncycastle::cipher::modes::CCM;
+
+struct Aria128;
+struct Aria192;
+struct Aria256;
+
+impl CcmKeys<16> for Aria128 {
+    type Key<const N: usize, const T: usize> = Camellia128Key<CCM<N, T>>;
+}
+
+impl CcmKeys<24> for Aria192 {
+    type Key<const N: usize, const T: usize> = Camellia192Key<CCM<N, T>>;
+}
+
+impl CcmKeys<32> for Aria256 {
+    type Key<const N: usize, const T: usize> = Camellia256Key<CCM<N, T>>;
+}
+
+/// Camellia-128 CCM. See the module docs and the subcommand help.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn camellia128_ccm_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    nonce: &Option<String>,
+    nonce_file: &Option<String>,
+    aad: &Option<String>,
+    aad_file: &Option<String>,
+    tag_len: usize,
+    output_hex: bool,
+) {
+    run::<Aria128, 16>(
+        action,
+        &load_key::<16>(key, key_file, "Camellia-128"),
+        nonce,
+        nonce_file,
+        aad,
+        aad_file,
+        tag_len,
+        output_hex,
+    );
+}
+
+/// Camellia-192 CCM. See [`camellia128_ccm_cmd`].
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn camellia192_ccm_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    nonce: &Option<String>,
+    nonce_file: &Option<String>,
+    aad: &Option<String>,
+    aad_file: &Option<String>,
+    tag_len: usize,
+    output_hex: bool,
+) {
+    run::<Aria192, 24>(
+        action,
+        &load_key::<24>(key, key_file, "Camellia-192"),
+        nonce,
+        nonce_file,
+        aad,
+        aad_file,
+        tag_len,
+        output_hex,
+    );
+}
+
+/// Camellia-256 CCM. See [`camellia128_ccm_cmd`].
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn camellia256_ccm_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    nonce: &Option<String>,
+    nonce_file: &Option<String>,
+    aad: &Option<String>,
+    aad_file: &Option<String>,
+    tag_len: usize,
+    output_hex: bool,
+) {
+    run::<Aria256, 32>(
+        action,
+        &load_key::<32>(key, key_file, "Camellia-256"),
+        nonce,
+        nonce_file,
+        aad,
+        aad_file,
+        tag_len,
+        output_hex,
+    );
+}

cli/src/camellia_cfb8_cmd.rs

@@ -0,0 +1,88 @@
+//! Camellia-CFB8 encryption and decryption, streaming stdin to stdout.
+//!
+//! Only the cipher wiring lives here: the IV convention, key loading and stdin framing are in
+//! [`crate::helpers::stream_mode_helpers`] (and [`crate::helpers::block_mode_helpers`] for the
+//! key and IV loaders), shared with the `aes*-cfb8` commands. See those modules for the
+//! command-line contract.
+//!
+//! `camellia128-cfb8` / `camellia192-cfb8` / `camellia256-cfb8` are the same command as `aes*-cfb8`
+//! over the Camellia permutation (RFC 3713; 16-, 24- or 32-byte key, 16-byte block), so every
+//! remark there applies unchanged. The segment size is one byte (NIST SP 800-38A Sec 6.3 with
+//! `s = 8`): a DIFFERENT, NON-INTEROPERABLE mode from the CFB128 of `camellia*-cfb`, costing a full
+//! Camellia call per byte, sixteen times the work. Prefer `camellia*-cfb` unless a byte-granular
+//! self-synchronising stream is required or the format demands CFB8.
+//!
+//! # Warning
+//!
+//! CFB8 provides confidentiality only. It does not detect tampering, and neither the ciphertext nor
+//! the IV is authenticated. Do not decrypt data you have not authenticated separately.
+
+use crate::helpers::block_mode_helpers::{CipherDirection, load_iv, load_key_object};
+use crate::helpers::stream_mode_helpers::run_stream_mode;
+use bouncycastle::camellia::{BLOCK_LEN, Camellia128Key, Camellia192Key, Camellia256Key};
+use bouncycastle::cipher::modes::CFB8;
+use bouncycastle::core::symmetric_key::{SymmetricDecryptionKey, SymmetricEncryptionKey};
+use bouncycastle::core::traits::{StreamCipherDecryptor, StreamCipherEncryptor};
+
+pub(crate) fn camellia128_cfb8_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    run::<_, 16>(
+        action,
+        &load_key_object::<Camellia128Key<CFB8>, 16>(key, key_file, "Camellia-128"),
+        load_iv::<BLOCK_LEN>(iv, iv_file),
+        output_hex,
+    );
+}
+
+pub(crate) fn camellia192_cfb8_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    run::<_, 24>(
+        action,
+        &load_key_object::<Camellia192Key<CFB8>, 24>(key, key_file, "Camellia-192"),
+        load_iv::<BLOCK_LEN>(iv, iv_file),
+        output_hex,
+    );
+}
+
+pub(crate) fn camellia256_cfb8_cmd(
+    action: &CipherDirection,
+    key: &Option<String>,
+    key_file: &Option<String>,
+    iv: &Option<String>,
+    iv_file: &Option<String>,
+    output_hex: bool,
+) {
+    run::<_, 32>(
+        action,
+        &load_key_object::<Camellia256Key<CFB8>, 32>(key, key_file, "Camellia-256"),
+        load_iv::<BLOCK_LEN>(iv, iv_file),
+        output_hex,
+    );
+}
+
+/// Dispatches to the shared streaming loops with `Cfb8` filled in as the mode.
+fn run<'k, K, const KEY_LEN: usize>(
+    action: &CipherDirection,
+    key: &'k K,
+    iv: Option<[u8; BLOCK_LEN]>,
+    output_hex: bool,
+) where
+    K: SymmetricEncryptionKey<KEY_LEN, BLOCK_LEN, 0>
+        + SymmetricDecryptionKey<KEY_LEN, BLOCK_LEN, 0>,
+    K::Encryptor<'k>: StreamCipherEncryptor<BLOCK_LEN>,
+    K::Decryptor<'k>: StreamCipherDecryptor<BLOCK_LEN>,
+{
+    run_stream_mode::<K, KEY_LEN, BLOCK_LEN>(action, key, iv, output_hex)
+}