cipher.hh File Reference

Block and stream cipher abstractions for KeePass encryption. More...

#include <array>
#include <cassert>
#include <cstdint>
#include <iostream>
#include <memory>
#include "libkeepass/export.hh"

Go to the source code of this file.

Classes
class	keepass::Cipher< N >
	Abstract base class for 16-byte block ciphers. More...
class	keepass::AesCipher
	AES-256-ECB block cipher using OpenSSL's EVP interface. More...
class	keepass::TwofishCipher
	Twofish-256 block cipher implementation. More...
class	keepass::Salsa20Cipher
	Salsa20 stream cipher implementation. More...
class	keepass::ChaCha20Cipher
	ChaCha20 stream cipher implementation (RFC 8439, 32-bit counter). More...

Typedefs
typedef struct evp_cipher_ctx_st	EVP_CIPHER_CTX

Functions
LIBKEEPASS_API std::array< uint8_t, 32 >	keepass::encrypt_ecb (const std::array< uint8_t, 32 > &src, const Cipher< 16 > &cipher)
	Encrypts a 32-byte block using ECB mode with the given cipher.
LIBKEEPASS_API std::array< uint8_t, 32 >	keepass::decrypt_ecb (const std::array< uint8_t, 32 > &src, const Cipher< 16 > &cipher)
	Decrypts a 32-byte block using ECB mode with the given cipher.
LIBKEEPASS_API void	keepass::encrypt_cbc (std::istream &src, std::ostream &dst, const Cipher< 16 > &cipher)
	Encrypts a stream using CBC mode with PKCS #7 padding.
LIBKEEPASS_API void	keepass::decrypt_cbc (std::istream &src, std::ostream &dst, const Cipher< 16 > &cipher)
	Decrypts a stream using CBC mode with PKCS #7 padding removal.
LIBKEEPASS_API void	keepass::decrypt_cbc_stream (std::istream &src, std::ostream &dst, const Cipher< 16 > &cipher)
	Decrypts a stream using CBC mode with PKCS #7 padding removal.

Detailed Description

Block and stream cipher abstractions for KeePass encryption.

Function Documentation

decrypt_cbc()

LIBKEEPASS_API void keepass::decrypt_cbc	(	std::istream &	src,
		std::ostream &	dst,
		const Cipher< 16 > &	cipher
	)

Decrypts a stream using CBC mode with PKCS #7 padding removal.

Reads from src, decrypts block-by-block using cipher, and writes the plaintext to dst. The initialization vector is obtained from the cipher. PKCS #7 padding is validated and stripped from the last block.

Parameters

src	Input stream containing the ciphertext.
dst	Output stream receiving the plaintext.
cipher	The block cipher used for each block decryption.

Exceptions

IoError

If decryption fails, padding is invalid, or an I/O error occurs.

decrypt_cbc_stream()

LIBKEEPASS_API void keepass::decrypt_cbc_stream	(	std::istream &	src,
		std::ostream &	dst,
		const Cipher< 16 > &	cipher
	)

Decrypts a stream using CBC mode with PKCS #7 padding removal.

Unlike decrypt_cbc this variant reads from a non-seekable input stream and decrypts incrementally in bounded-size chunks, so that a large payload never has to be materialized in memory at once. The ciphertext is expected to be a multiple of the block size; every block is decrypted as soon as it has been read, only the final block is held back until EOF so that its PKCS #7 padding can be validated and stripped.

Parameters

src	Input stream containing the ciphertext.
dst	Output stream receiving the plaintext.
cipher	The block cipher used for each block decryption.

Exceptions

IoError

If decryption fails, padding is invalid, or an I/O error occurs.

decrypt_ecb()

LIBKEEPASS_API std::array< uint8_t, 32 > keepass::decrypt_ecb	(	const std::array< uint8_t, 32 > &	src,
		const Cipher< 16 > &	cipher
	)

Decrypts a 32-byte block using ECB mode with the given cipher.

Parameters

src	The 32-byte ciphertext block (two 16-byte blocks).
cipher	The block cipher to use for decryption.

Returns

The 32-byte plaintext block.

encrypt_cbc()

LIBKEEPASS_API void keepass::encrypt_cbc	(	std::istream &	src,
		std::ostream &	dst,
		const Cipher< 16 > &	cipher
	)

Encrypts a stream using CBC mode with PKCS #7 padding.

Reads from src, encrypts block-by-block using cipher, and writes the ciphertext to dst. An initialization vector is obtained from the cipher. A full PKCS #7 padding block is always appended.

Parameters

src	Input stream containing the plaintext.
dst	Output stream receiving the ciphertext.
cipher	The block cipher used for each block encryption.

Exceptions

IoError	If an I/O error occurs.
InternalError	If an internal error occurs.

encrypt_ecb()

LIBKEEPASS_API std::array< uint8_t, 32 > keepass::encrypt_ecb	(	const std::array< uint8_t, 32 > &	src,
		const Cipher< 16 > &	cipher
	)

Encrypts a 32-byte block using ECB mode with the given cipher.

Parameters

src	The 32-byte plaintext block (two 16-byte blocks).
cipher	The block cipher to use for encryption.

Returns

The 32-byte ciphertext block.