Skip to content

Commit d7482eb

Browse files
kwvgkwvg
committed
merge bitcoin#27985: Add support for RFC8439 variant of ChaCha20
1 parent 2773611 commit d7482eb

File tree

7 files changed

+174
-71
lines changed

7 files changed

+174
-71
lines changed

‎src/bench/chacha20.cpp‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@ static void CHACHA20(benchmark::Bench& bench, size_t buffersize)
1515
{
1616
std::vector<uint8_t> key(32,0);
1717
ChaCha20 ctx(key.data());
18-
ctx.SetIV(0);
19-
ctx.Seek64(0);
18+
ctx.Seek64({0, 0}, 0);
2019
std::vector<uint8_t> in(buffersize,0);
2120
std::vector<uint8_t> out(buffersize,0);
2221
bench.batch(in.size()).unit("byte").run([&] {

‎src/crypto/chacha20.cpp‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -47,16 +47,12 @@ ChaCha20Aligned::ChaCha20Aligned(const unsigned char* key32)
4747
SetKey32(key32);
4848
}
4949

50-
void ChaCha20Aligned::SetIV(uint64_t iv)
50+
void ChaCha20Aligned::Seek64(Nonce96 nonce, uint32_t block_counter)
5151
{
52-
input[10] = iv;
53-
input[11] = iv >> 32;
54-
}
55-
56-
void ChaCha20Aligned::Seek64(uint64_t pos)
57-
{
58-
input[8] = pos;
59-
input[9] = pos >> 32;
52+
input[8] = block_counter;
53+
input[9] = nonce.first;
54+
input[10] = nonce.second;
55+
input[11] = nonce.second >> 32;
6056
}
6157

6258
inline void ChaCha20Aligned::Keystream64(unsigned char* c, size_t blocks)

‎src/crypto/chacha20.h‎

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,15 @@
77

88
#include <stdint.h>
99
#include <stdlib.h>
10+
#include <utility>
1011

1112
// classes for ChaCha20 256-bit stream cipher developed by Daniel J. Bernstein
12-
// https://cr.yp.to/chacha/chacha-20080128.pdf */
13+
// https://cr.yp.to/chacha/chacha-20080128.pdf.
14+
//
15+
// The 128-bit input is here implemented as a 96-bit nonce and a 32-bit block
16+
// counter, as in RFC8439 Section 2.3. When the 32-bit block counter overflows
17+
// the first 32-bit part of the nonce is automatically incremented, making it
18+
// conceptually compatible with variants that use a 64/64 split instead.
1319

1420
/** ChaCha20 cipher that only operates on multiples of 64 bytes. */
1521
class ChaCha20Aligned
@@ -26,11 +32,22 @@ class ChaCha20Aligned
2632
/** set 32-byte key. */
2733
void SetKey32(const unsigned char* key32);
2834

29-
/** set the 64-bit nonce. */
30-
void SetIV(uint64_t iv);
35+
/** Type for 96-bit nonces used by the Set function below.
36+
*
37+
* The first field corresponds to the LE32-encoded first 4 bytes of the nonce, also referred
38+
* to as the '32-bit fixed-common part' in Example 2.8.2 of RFC8439.
39+
*
40+
* The second field corresponds to the LE64-encoded last 8 bytes of the nonce.
41+
*
42+
*/
43+
using Nonce96 = std::pair<uint32_t, uint64_t>;
3144

32-
/** set the 64bit block counter (pos seeks to byte position 64*pos). */
33-
void Seek64(uint64_t pos);
45+
/** Set the 96-bit nonce and 32-bit block counter.
46+
*
47+
* Block_counter selects a position to seek to (to byte 64*block_counter). After 256 GiB, the
48+
* block counter overflows, and nonce.first is incremented.
49+
*/
50+
void Seek64(Nonce96 nonce, uint32_t block_counter);
3451

3552
/** outputs the keystream of size <64*blocks> into <c> */
3653
void Keystream64(unsigned char* c, size_t blocks);
@@ -62,13 +79,13 @@ class ChaCha20
6279
m_bufleft = 0;
6380
}
6481

65-
/** set the 64-bit nonce. */
66-
void SetIV(uint64_t iv) { m_aligned.SetIV(iv); }
82+
/** 96-bit nonce type. */
83+
using Nonce96 = ChaCha20Aligned::Nonce96;
6784

68-
/** set the 64bit block counter (pos seeks to byte position 64*pos). */
69-
void Seek64(uint64_t pos)
85+
/** Set the 96-bit nonce and 32-bit block counter. */
86+
void Seek64(Nonce96 nonce, uint32_t block_counter)
7087
{
71-
m_aligned.Seek64(pos);
88+
m_aligned.Seek64(nonce, block_counter);
7289
m_bufleft = 0;
7390
}
7491

‎src/crypto/chacha_poly_aead.cpp‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,12 +57,11 @@ bool ChaCha20Poly1305AEAD::Crypt(uint64_t seqnr_payload, uint64_t seqnr_aad, int
5757

5858
unsigned char expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];
5959
memset(poly_key, 0, sizeof(poly_key));
60-
m_chacha_main.SetIV(seqnr_payload);
6160

6261
// block counter 0 for the poly1305 key
6362
// use lower 32bytes for the poly1305 key
6463
// (throws away 32 unused bytes (upper 32) from this ChaCha20 round)
65-
m_chacha_main.Seek64(0);
64+
m_chacha_main.Seek64({0, seqnr_payload}, 0);
6665
m_chacha_main.Crypt(poly_key, poly_key, sizeof(poly_key));
6766

6867
// if decrypting, verify the tag prior to decryption
@@ -84,8 +83,7 @@ bool ChaCha20Poly1305AEAD::Crypt(uint64_t seqnr_payload, uint64_t seqnr_aad, int
8483
// calculate and cache the next 64byte keystream block if requested sequence number is not yet the cache
8584
if (m_cached_aad_seqnr != seqnr_aad) {
8685
m_cached_aad_seqnr = seqnr_aad;
87-
m_chacha_header.SetIV(seqnr_aad);
88-
m_chacha_header.Seek64(0);
86+
m_chacha_header.Seek64({0, seqnr_aad}, 0);
8987
m_chacha_header.Keystream(m_aad_keystream_buffer, CHACHA20_ROUND_OUTPUT);
9088
}
9189
// crypt the AAD (3 bytes message length) with given position in AAD cipher instance keystream
@@ -94,7 +92,7 @@ bool ChaCha20Poly1305AEAD::Crypt(uint64_t seqnr_payload, uint64_t seqnr_aad, int
9492
dest[2] = src[2] ^ m_aad_keystream_buffer[aad_pos + 2];
9593

9694
// Set the playload ChaCha instance block counter to 1 and crypt the payload
97-
m_chacha_main.Seek64(1);
95+
m_chacha_main.Seek64({0, seqnr_payload}, 1);
9896
m_chacha_main.Crypt(src + CHACHA20_POLY1305_AEAD_AAD_LEN, dest + CHACHA20_POLY1305_AEAD_AAD_LEN, src_len - CHACHA20_POLY1305_AEAD_AAD_LEN);
9997

10098
// If encrypting, calculate and append tag
@@ -116,8 +114,7 @@ bool ChaCha20Poly1305AEAD::GetLength(uint32_t* len24_out, uint64_t seqnr_aad, in
116114
if (m_cached_aad_seqnr != seqnr_aad) {
117115
// we need to calculate the 64 keystream bytes since we reached a new aad sequence number
118116
m_cached_aad_seqnr = seqnr_aad;
119-
m_chacha_header.SetIV(seqnr_aad); // use LE for the nonce
120-
m_chacha_header.Seek64(0); // block counter 0
117+
m_chacha_header.Seek64({0, seqnr_aad}, 0); // use LE for the nonce
121118
m_chacha_header.Keystream(m_aad_keystream_buffer, CHACHA20_ROUND_OUTPUT); // write keystream to the cache
122119
}
123120

‎src/test/crypto_tests.cpp‎

Lines changed: 101 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -131,14 +131,13 @@ static void TestAES256CBC(const std::string &hexkey, const std::string &hexiv, b
131131
}
132132
}
133133

134-
static void TestChaCha20(const std::string &hex_message, const std::string &hexkey, uint64_t nonce, uint64_t seek, const std::string& hexout)
134+
static void TestChaCha20(const std::string &hex_message, const std::string &hexkey, ChaCha20::Nonce96 nonce, uint32_t seek, const std::string& hexout)
135135
{
136136
std::vector<unsigned char> key = ParseHex(hexkey);
137137
assert(key.size() == 32);
138138
std::vector<unsigned char> m = ParseHex(hex_message);
139139
ChaCha20 rng(key.data());
140-
rng.SetIV(nonce);
141-
rng.Seek64(seek);
140+
rng.Seek64(nonce, seek);
142141
std::vector<unsigned char> outres;
143142
outres.resize(hexout.size() / 2);
144143
assert(hex_message.empty() || m.size() * 2 == hexout.size());
@@ -152,8 +151,7 @@ static void TestChaCha20(const std::string &hex_message, const std::string &hexk
152151
BOOST_CHECK_EQUAL(hexout, HexStr(outres));
153152
if (!hex_message.empty()) {
154153
// Manually XOR with the keystream and compare the output
155-
rng.SetIV(nonce);
156-
rng.Seek64(seek);
154+
rng.Seek64(nonce, seek);
157155
std::vector<unsigned char> only_keystream(outres.size());
158156
rng.Keystream(only_keystream.data(), only_keystream.size());
159157
for (size_t i = 0; i != m.size(); i++) {
@@ -169,7 +167,7 @@ static void TestChaCha20(const std::string &hex_message, const std::string &hexk
169167
lens[1] = InsecureRandRange(hexout.size() / 2U + 1U - lens[0]);
170168
lens[2] = hexout.size() / 2U - lens[0] - lens[1];
171169

172-
rng.Seek64(seek);
170+
rng.Seek64(nonce, seek);
173171
outres.assign(hexout.size() / 2U, 0);
174172
size_t pos = 0;
175173
for (int j = 0; j < 3; ++j) {
@@ -505,46 +503,65 @@ BOOST_AUTO_TEST_CASE(pbkdf2_hmac_sha512_test) {
505503

506504
BOOST_AUTO_TEST_CASE(chacha20_testvector)
507505
{
506+
/* Example from RFC8439 section 2.3.2. */
507+
TestChaCha20("",
508+
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
509+
{0x09000000, 0x4a000000}, 1,
510+
"10f1e7e4d13b5915500fdd1fa32071c4c7d1f4c733c068030422aa9ac3d46c4e"
511+
"d2826446079faa0914c2d705d98b02a2b5129cd1de164eb9cbd083e8a2503c4e");
512+
513+
/* Example from RFC8439 section 2.4.2. */
514+
TestChaCha20("4c616469657320616e642047656e746c656d656e206f662074686520636c6173"
515+
"73206f66202739393a204966204920636f756c64206f6666657220796f75206f"
516+
"6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73"
517+
"637265656e20776f756c642062652069742e",
518+
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
519+
{0, 0x4a000000}, 1,
520+
"6e2e359a2568f98041ba0728dd0d6981e97e7aec1d4360c20a27afccfd9fae0b"
521+
"f91b65c5524733ab8f593dabcd62b3571639d624e65152ab8f530c359f0861d8"
522+
"07ca0dbf500d6a6156a38e088a22b65e52bc514d16ccf806818ce91ab7793736"
523+
"5af90bbf74a35be6b40b8eedf2785e42874d");
524+
508525
// RFC 7539/8439 A.1 Test Vector #1:
509526
TestChaCha20("",
510527
"0000000000000000000000000000000000000000000000000000000000000000",
511-
0, 0,
528+
{0, 0}, 0,
512529
"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7"
513530
"da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586");
514531

515532
// RFC 7539/8439 A.1 Test Vector #2:
516533
TestChaCha20("",
517534
"0000000000000000000000000000000000000000000000000000000000000000",
518-
0, 1,
535+
{0, 0}, 1,
519536
"9f07e7be5551387a98ba977c732d080dcb0f29a048e3656912c6533e32ee7aed"
520537
"29b721769ce64e43d57133b074d839d531ed1f28510afb45ace10a1f4b794d6f");
521538

522539
// RFC 7539/8439 A.1 Test Vector #3:
523540
TestChaCha20("",
524541
"0000000000000000000000000000000000000000000000000000000000000001",
525-
0, 1,
542+
{0, 0}, 1,
526543
"3aeb5224ecf849929b9d828db1ced4dd832025e8018b8160b82284f3c949aa5a"
527544
"8eca00bbb4a73bdad192b5c42f73f2fd4e273644c8b36125a64addeb006c13a0");
528545

529546
// RFC 7539/8439 A.1 Test Vector #4:
530547
TestChaCha20("",
531548
"00ff000000000000000000000000000000000000000000000000000000000000",
532-
0, 2,
549+
{0, 0}, 2,
533550
"72d54dfbf12ec44b362692df94137f328fea8da73990265ec1bbbea1ae9af0ca"
534551
"13b25aa26cb4a648cb9b9d1be65b2c0924a66c54d545ec1b7374f4872e99f096");
535552

536553
// RFC 7539/8439 A.1 Test Vector #5:
537554
TestChaCha20("",
538555
"0000000000000000000000000000000000000000000000000000000000000000",
539-
0x200000000000000, 0,
556+
{0, 0x200000000000000}, 0,
540557
"c2c64d378cd536374ae204b9ef933fcd1a8b2288b3dfa49672ab765b54ee27c7"
541558
"8a970e0e955c14f3a88e741b97c286f75f8fc299e8148362fa198a39531bed6d");
542559

543560
// RFC 7539/8439 A.2 Test Vector #1:
544561
TestChaCha20("0000000000000000000000000000000000000000000000000000000000000000"
545562
"0000000000000000000000000000000000000000000000000000000000000000",
546563
"0000000000000000000000000000000000000000000000000000000000000000",
547-
0, 0,
564+
{0, 0}, 0,
548565
"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7"
549566
"da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586");
550567

@@ -562,7 +579,7 @@ BOOST_AUTO_TEST_CASE(chacha20_testvector)
562579
"74696f6e73206d61646520617420616e792074696d65206f7220706c6163652c"
563580
"207768696368206172652061646472657373656420746f",
564581
"0000000000000000000000000000000000000000000000000000000000000001",
565-
0x200000000000000, 1,
582+
{0, 0x200000000000000}, 1,
566583
"a3fbf07df3fa2fde4f376ca23e82737041605d9f4f4f57bd8cff2c1d4b7955ec"
567584
"2a97948bd3722915c8f3d337f7d370050e9e96d647b7c39f56e031ca5eb6250d"
568585
"4042e02785ececfa4b4bb5e8ead0440e20b6e8db09d881a7c6132f420e527950"
@@ -582,27 +599,93 @@ BOOST_AUTO_TEST_CASE(chacha20_testvector)
582599
"6162653a0a416c6c206d696d737920776572652074686520626f726f676f7665"
583600
"732c0a416e6420746865206d6f6d65207261746873206f757467726162652e",
584601
"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0",
585-
0x200000000000000, 42,
602+
{0, 0x200000000000000}, 42,
586603
"62e6347f95ed87a45ffae7426f27a1df5fb69110044c0d73118effa95b01e5cf"
587604
"166d3df2d721caf9b21e5fb14c616871fd84c54f9d65b283196c7fe4f60553eb"
588605
"f39c6402c42234e32a356b3e764312a61a5532055716ead6962568f87d3f3f77"
589606
"04c6a8d1bcd1bf4d50d6154b6da731b187b58dfd728afa36757a797ac188d1");
590607

608+
// RFC 7539/8439 A.4 Test Vector #1:
609+
TestChaCha20("",
610+
"0000000000000000000000000000000000000000000000000000000000000000",
611+
{0, 0}, 0,
612+
"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7");
613+
614+
// RFC 7539/8439 A.4 Test Vector #2:
615+
TestChaCha20("",
616+
"0000000000000000000000000000000000000000000000000000000000000001",
617+
{0, 0x200000000000000}, 0,
618+
"ecfa254f845f647473d3cb140da9e87606cb33066c447b87bc2666dde3fbb739");
619+
620+
// RFC 7539/8439 A.4 Test Vector #3:
621+
TestChaCha20("",
622+
"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0",
623+
{0, 0x200000000000000}, 0,
624+
"965e3bc6f9ec7ed9560808f4d229f94b137ff275ca9b3fcbdd59deaad23310ae");
625+
591626
// test encryption
592627
TestChaCha20("4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756"
593628
"c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73637265656e"
594629
"20776f756c642062652069742e",
595-
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", 0x4a000000UL, 1,
630+
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", {0, 0x4a000000UL}, 1,
596631
"6e2e359a2568f98041ba0728dd0d6981e97e7aec1d4360c20a27afccfd9fae0bf91b65c5524733ab8f593dabcd62b3571639d"
597632
"624e65152ab8f530c359f0861d807ca0dbf500d6a6156a38e088a22b65e52bc514d16ccf806818ce91ab77937365af90bbf74"
598633
"a35be6b40b8eedf2785e42874d"
599634
);
600635

601636
// test keystream output
602-
TestChaCha20("", "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", 0x4a000000UL, 1,
637+
TestChaCha20("", "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", {0, 0x4a000000UL}, 1,
603638
"224f51f3401bd9e12fde276fb8631ded8c131f823d2c06e27e4fcaec9ef3cf788a3b0aa372600a92b57974cded2b9334794cb"
604639
"a40c63e34cdea212c4cf07d41b769a6749f3f630f4122cafe28ec4dc47e26d4346d70b98c73f3e9c53ac40c5945398b6eda1a"
605640
"832c89c167eacd901d7e2bf363");
641+
642+
// Test vectors from https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04#section-7
643+
// The first one is identical to the above one from the RFC8439 A.1 vectors, but repeated here
644+
// for completeness.
645+
TestChaCha20("",
646+
"0000000000000000000000000000000000000000000000000000000000000000",
647+
{0, 0}, 0,
648+
"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7"
649+
"da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586");
650+
TestChaCha20("",
651+
"0000000000000000000000000000000000000000000000000000000000000001",
652+
{0, 0}, 0,
653+
"4540f05a9f1fb296d7736e7b208e3c96eb4fe1834688d2604f450952ed432d41"
654+
"bbe2a0b6ea7566d2a5d1e7e20d42af2c53d792b1c43fea817e9ad275ae546963");
655+
TestChaCha20("",
656+
"0000000000000000000000000000000000000000000000000000000000000000",
657+
{0, 0x0100000000000000ULL}, 0,
658+
"de9cba7bf3d69ef5e786dc63973f653a0b49e015adbff7134fcb7df137821031"
659+
"e85a050278a7084527214f73efc7fa5b5277062eb7a0433e445f41e3");
660+
TestChaCha20("",
661+
"0000000000000000000000000000000000000000000000000000000000000000",
662+
{0, 1}, 0,
663+
"ef3fdfd6c61578fbf5cf35bd3dd33b8009631634d21e42ac33960bd138e50d32"
664+
"111e4caf237ee53ca8ad6426194a88545ddc497a0b466e7d6bbdb0041b2f586b");
665+
TestChaCha20("",
666+
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
667+
{0, 0x0706050403020100ULL}, 0,
668+
"f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c1"
669+
"34a4547b733b46413042c9440049176905d3be59ea1c53f15916155c2be8241a"
670+
"38008b9a26bc35941e2444177c8ade6689de95264986d95889fb60e84629c9bd"
671+
"9a5acb1cc118be563eb9b3a4a472f82e09a7e778492b562ef7130e88dfe031c7"
672+
"9db9d4f7c7a899151b9a475032b63fc385245fe054e3dd5a97a5f576fe064025"
673+
"d3ce042c566ab2c507b138db853e3d6959660996546cc9c4a6eafdc777c040d7"
674+
"0eaf46f76dad3979e5c5360c3317166a1c894c94a371876a94df7628fe4eaaf2"
675+
"ccb27d5aaae0ad7ad0f9d4b6ad3b54098746d4524d38407a6deb3ab78fab78c9");
676+
677+
// Test overflow of 32-bit block counter, should increment the first 32-bit
678+
// part of the nonce to retain compatibility with >256 GiB output.
679+
// The test data was generated with an implementation that uses a 64-bit
680+
// counter and a 64-bit initialization vector (PyCryptodome's ChaCha20 class
681+
// with 8 bytes nonce length).
682+
TestChaCha20("",
683+
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
684+
{0, 0xdeadbeef12345678}, 0xffffffff,
685+
"2d292c880513397b91221c3a647cfb0765a4815894715f411e3df5e0dd0ba9df"
686+
"fd565dea5addbdb914208fde7950f23e0385f9a727143f6a6ac51d84b1c0fb3e"
687+
"2e3b00b63d6841a1cc6d1538b1d3a74bef1eb2f54c7b7281e36e484dba89b351"
688+
"c8f572617e61e342879f211b0e4c515df50ea9d0771518fad96cd0baee62deb6");
606689
}
607690

608691
BOOST_AUTO_TEST_CASE(chacha20_midblock)
@@ -753,8 +836,7 @@ static void TestChaCha20Poly1305AEAD(bool must_succeed, unsigned int expected_aa
753836
BOOST_CHECK(memcmp(ciphertext_buf.data(), expected_ciphertext_and_mac.data(), ciphertext_buf.size()) == 0);
754837

755838
// manually construct the AAD keystream
756-
cmp_ctx.SetIV(seqnr_aad);
757-
cmp_ctx.Seek64(0);
839+
cmp_ctx.Seek64({0, seqnr_aad}, 0);
758840
cmp_ctx.Keystream(cmp_ctx_buffer.data(), 64);
759841
BOOST_CHECK(memcmp(expected_aad_keystream.data(), cmp_ctx_buffer.data(), expected_aad_keystream.size()) == 0);
760842
// crypt the 3 length bytes and compare the length
@@ -781,8 +863,7 @@ static void TestChaCha20Poly1305AEAD(bool must_succeed, unsigned int expected_aa
781863
BOOST_CHECK(memcmp(ciphertext_buf.data(), expected_ciphertext_and_mac_sequence999.data(), expected_ciphertext_and_mac_sequence999.size()) == 0);
782864
}
783865
// set nonce and block counter, output the keystream
784-
cmp_ctx.SetIV(seqnr_aad);
785-
cmp_ctx.Seek64(0);
866+
cmp_ctx.Seek64({0, seqnr_aad}, 0);
786867
cmp_ctx.Keystream(cmp_ctx_buffer.data(), 64);
787868

788869
// crypt the 3 length bytes and compare the length

0 commit comments

Comments
 (0)