121 lines
4.0 KiB
TypeScript
121 lines
4.0 KiB
TypeScript
/**
|
|
* GHash from AES-GCM and its little-endian "mirror image" Polyval from AES-SIV.
|
|
*
|
|
* Implemented in terms of GHash with conversion function for keys
|
|
* GCM GHASH from
|
|
* {@link https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf | NIST SP800-38d},
|
|
* SIV from
|
|
* {@link https://www.rfc-editor.org/rfc/rfc8452 | RFC 8452}.
|
|
*
|
|
* GHASH modulo: x^128 + x^7 + x^2 + x + 1
|
|
* POLYVAL modulo: x^128 + x^127 + x^126 + x^121 + 1
|
|
*
|
|
* @module
|
|
*/
|
|
import { type CMac, type IHash2, type TArg, type TRet } from './utils.ts';
|
|
/**
|
|
* `mulX_GHASH(ByteReverse(H))` from RFC 8452 Appendix A.
|
|
* @param k mutated in place
|
|
*/
|
|
export declare function _toGHASHKey(k: TArg<Uint8Array>): TRet<Uint8Array>;
|
|
type Value = {
|
|
s0: number;
|
|
s1: number;
|
|
s2: number;
|
|
s3: number;
|
|
};
|
|
/**
|
|
* Incremental GHASH state for AES-GCM.
|
|
* @param key - 16-byte GHASH key.
|
|
* @param expectedLength - Expected message length for table sizing.
|
|
* Chunking is segment-based, not hash-streaming: every `update()` call is zero-padded
|
|
* to the next 16-byte boundary before it is absorbed. This matches the internal AES/GCM
|
|
* use where AAD, payload, and length block are separate padded segments.
|
|
* @example
|
|
* Feeds one ciphertext block into an incremental GHASH state with a fresh hash key.
|
|
*
|
|
* ```ts
|
|
* import { GHASH } from '@noble/ciphers/_polyval.js';
|
|
* import { randomBytes } from '@noble/ciphers/utils.js';
|
|
* const key = randomBytes(16);
|
|
* const mac = new GHASH(key);
|
|
* mac.update(new Uint8Array(16));
|
|
* mac.digest();
|
|
* ```
|
|
*/
|
|
export declare class GHASH implements IHash2 {
|
|
readonly blockLen: number;
|
|
readonly outputLen: number;
|
|
protected s0: number;
|
|
protected s1: number;
|
|
protected s2: number;
|
|
protected s3: number;
|
|
protected finished: boolean;
|
|
protected destroyed: boolean;
|
|
protected t: Value[];
|
|
private W;
|
|
private windowSize;
|
|
constructor(key: TArg<Uint8Array>, expectedLength?: number);
|
|
protected _updateBlock(s0: number, s1: number, s2: number, s3: number): void;
|
|
update(data: TArg<Uint8Array>): this;
|
|
destroy(): void;
|
|
digestInto(out: TArg<Uint8Array>): void;
|
|
digest(): TRet<Uint8Array>;
|
|
}
|
|
/**
|
|
* Incremental POLYVAL state for AES-SIV.
|
|
* @param key - 16-byte POLYVAL key.
|
|
* @param expectedLength - Expected message length for table sizing.
|
|
* Inherits GHASH's segment-padded `update()` behavior: each call is padded
|
|
* independently to a 16-byte boundary before absorption.
|
|
* @example
|
|
* Feeds one block into an incremental POLYVAL state with a fresh hash key.
|
|
*
|
|
* ```ts
|
|
* import { Polyval } from '@noble/ciphers/_polyval.js';
|
|
* import { randomBytes } from '@noble/ciphers/utils.js';
|
|
* const key = randomBytes(16);
|
|
* const mac = new Polyval(key);
|
|
* mac.update(new Uint8Array(16));
|
|
* mac.digest();
|
|
* ```
|
|
*/
|
|
export declare class Polyval extends GHASH {
|
|
constructor(key: TArg<Uint8Array>, expectedLength?: number);
|
|
update(data: TArg<Uint8Array>): this;
|
|
digestInto(out: TArg<Uint8Array>): void;
|
|
}
|
|
/**
|
|
* GHash MAC for AES-GCM.
|
|
* @param msg - Message bytes to authenticate.
|
|
* @param key - 16-byte GHASH key.
|
|
* @returns 16-byte authentication tag.
|
|
* @example
|
|
* Authenticates a short message with GHASH and a fresh hash key.
|
|
*
|
|
* ```ts
|
|
* import { ghash } from '@noble/ciphers/_polyval.js';
|
|
* import { randomBytes } from '@noble/ciphers/utils.js';
|
|
* const key = randomBytes(16);
|
|
* ghash(new Uint8Array(), key);
|
|
* ```
|
|
*/
|
|
export declare const ghash: TRet<CMac<GHASH, [expectedLength?: number]>>;
|
|
/**
|
|
* POLYVAL MAC for AES-SIV.
|
|
* @param msg - Message bytes to authenticate.
|
|
* @param key - 16-byte POLYVAL key.
|
|
* @returns 16-byte authentication tag.
|
|
* @example
|
|
* Authenticates a short message with POLYVAL and a fresh hash key.
|
|
*
|
|
* ```ts
|
|
* import { polyval } from '@noble/ciphers/_polyval.js';
|
|
* import { randomBytes } from '@noble/ciphers/utils.js';
|
|
* const key = randomBytes(16);
|
|
* polyval(new Uint8Array(), key);
|
|
* ```
|
|
*/
|
|
export declare const polyval: TRet<CMac<Polyval, [expectedLength?: number]>>;
|
|
export {};
|
|
//# sourceMappingURL=_polyval.d.ts.map
|