Implement AES-CTR for NSS.

crypto/encryptor.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CRYPTO_ENCRYPTOR_H_
 #define CRYPTO_ENCRYPTOR_H_
 #pragma once
 
 #include <string>
 
+#include "base/basictypes.h"
+#include "base/scoped_ptr.h"
 #include "build/build_config.h"
 #include "crypto/crypto_api.h"
 
 #if defined(USE_NSS)
 #include "crypto/scoped_nss_types.h"
 #elif defined(OS_WIN)
 #include "crypto/scoped_capi_types.h"
 #endif
 
 namespace crypto {
 
 class SymmetricKey;
 
 class CRYPTO_API Encryptor {
  public:
   enum Mode {
-    CBC
+    CBC,
+    CTR,
   };
+
+  // This class implements a 128-bits counter to be used in AES-CTR encryption.
+  // Only 128-bits counter is supported in this class.
+  class Counter {
+   public:
+    Counter(const std::string& counter);
+    ~Counter();
+
+    // Increment the counter value.
+    void Increment();
+
+    // Write the content of the counter to |buf|. |buf| should have enough
+    // space for |GetLengthInBytes()|.
+    void Write(void* buf);
+
+    // Return the length of this counter.
+    size_t GetLengthInBytes() const;
+
+   private:
+    size_t counter_bits_;
+    uint8 counter_buf_[16];

[wtc, 2011/06/22 22:12:28]

IMPORTANT: in the crypto/encryptor.cc you cast this byte
buffer to a uint64:
  reinterpret_cast<uint64*>(counter_buf_)

This is only safe if the byte buffer is aligned for uint64.
You need to force alignment with a union:

  union {
    uint8 counter_buf_[16];
    uint64 force_align_[2];
  } u;

x86 and x64 CPUs allow unaligned access, but some CPUs will
generate a SIGBUS signal and kill the process.

It's also bad to write code that only works on little endian
processes when portable code can be written.  Your previous
patch set is portable.  What you need is hton macros
(host to network byte order conversion) that call bswap
on little endian systems and are no-op on big-endian systems.

[Alpha Left Google, 2011/06/22 22:22:58]

Done.
I've discussed with brett about byte order, it turns out our code is mostly
little endian. He suggested that it's better to assume little endian and give an
error if otherwise, rather than having some untested code path.

+  };
+
   Encryptor();
   virtual ~Encryptor();
 
   // Initializes the encryptor using |key| and |iv|. Returns false if either the
   // key or the initialization vector cannot be used.
+  //
+  // When |mode| is CTR then |iv| should be empty.
   bool Init(SymmetricKey* key, Mode mode, const std::string& iv);
 
   // Encrypts |plaintext| into |ciphertext|.
   bool Encrypt(const std::string& plaintext, std::string* ciphertext);
 
   // Decrypts |ciphertext| into |plaintext|.
   bool Decrypt(const std::string& ciphertext, std::string* plaintext);
 
+  // Update the counter value when in CTR mode. Currently only 128-bits
+  // counter value is supported.
+  //
+  // Return true only if update was successful.
+  bool UpdateCounter(const std::string& counter);
+
   // TODO(albertb): Support streaming encryption.
 
  private:
+  // Generate a mask using |counter_| to be used for encryption in CTR mode.
+  // Resulting mask will be written to |mask| with |mask_len| bytes.
+  //
+  // Make sure there's enough space in mask when calling this method.
+  // Reserve at least |plaintext_len| + 16 bytes for |mask|.
+  //
+  // The generated mask will always have at least |plaintext_len| bytes and
+  // will be a multiple of the counter length.
+  //
+  // This method is used only in CTR mode.
+  void GenerateCounterMask(size_t plaintext_len,
+                           uint8* mask,
+                           size_t* mask_len);
+
+  // Mask the |plaintext| message using |mask|. The output will be written to
+  // |ciphertext|. |ciphertext| must have at least |plaintext_len| bytes.
+  void MaskMessage(const void* plaintext,
+                   size_t plaintext_len,
+                   const void* mask,
+                   void* ciphertext) const;
+
   SymmetricKey* key_;
   Mode mode_;
+  scoped_ptr<Counter> counter_;
 
 #if defined(USE_OPENSSL)
   bool Crypt(bool encrypt,  // Pass true to encrypt, false to decrypt.
              const std::string& input,
              std::string* output);
   std::string iv_;
 #elif defined(USE_NSS)
+  bool Crypt(PK11Context* context,
+             const std::string& input,
+             std::string* output);
+  bool CryptCTR(PK11Context* context,
+                const std::string& input,
+                std::string* output);
   ScopedPK11Slot slot_;
   ScopedSECItem param_;
 #elif defined(OS_MACOSX)
   bool Crypt(int /*CCOperation*/ op,
              const std::string& input,
              std::string* output);
 
   std::string iv_;
 #elif defined(OS_WIN)
   ScopedHCRYPTKEY capi_key_;
   DWORD block_size_;
 #endif
 };
 
 }  // namespace crypto
 
 #endif  // CRYPTO_ENCRYPTOR_H_