SLIDE 21 21
1 :
parse K as (Ke, Km, IV )
2 :
if e-seqnr = 0
3 :
e-ctr Ω IV / / initialise on first call
4 :
mlen Ω |m|B
5 :
/ / calculate padding length
6 :
padlen Ω blocksize ≠ (5 + mlen)%blocksize
7 :
if padlen < 4
8 :
padlen Ω padlen + blocksize
9 :
/ / encode the message
10 :
pad ⌘ {0, 1}padlen·8
11 :
len Ω 1 + mlen + padlen
12 :
ptxt Ω ÈlenÍ32 Î ÈpadlenÍ8 Î m Î pad
13 :
/ / encrypt and mac
14 :
τ Ω MAC(Km, Èe-seqnrÍ32 Î ptxt)
15 :
z Ω ε
16 :
while |z| < |ptxt|
17 :
z Ω z Î BC(Ke, e-ctr)
18 :
e-ctr Ω e-ctr + 1
19 :
c Ω (ptxt ü z) Î τ
20 :
e-seqnr Ω e-seqnr + 1
21 :
return c
1 :
parse K as (Ke, Km, IV )
2 :
if d-seqnr = 0 · α = ε
3 :
d-ctr Ω IV / / initialise on first call
4 :
if closed
5 :
- ut Ω (‹, CONN_CLOSED); break
6 :
α Ω α Î f; out Ω ε / / update buffer and reset output
7 :
while (true) / / process buffer (α)
8 :
if |α|B < blocksize
9 :
break / / first ciphertext block is incomplete
10 :
/ / decrypt first ciphertext block
11 :
ptxtÕ Ω α[1, blocksize] ü BC(Ke, d-ctr)
12 :
d-ctr Ω d-ctr + 1
13 :
clen Ω ÈptxtÕ[1, 32]Í≠1 + 4 + macsize
14 :
inRange Ω (16 + macsize Æ clen Æ 35000)
15 :
isMult Ω ((clen ≠ macsize)%blocksize ”= 0)
16 :
if ¬ inRange ‚ isMult / / validate length
17 :
- ut Ω out Î (‹, INVALID_LENGTH)
18 :
closed Ω true; break
19 :
if |α|B < clen
20 :
break / / wait to complete ciphertext
21 :
z Ω ε / / decrypt and verify mac
22 :
while |z| < (clen ≠ blocksize ≠ macsize)
23 :
z Ω z Î BC(Ke, e-ctr)
24 :
d-ctr Ω d-ctr + 1
25 :
ptxtÕ Ω ptxtÕ Î z ü α[blocksize + 1, clen ≠ macsize]B
26 :
τ Õ Ω α[clen ≠ macsize + 1, clen]B
27 :
α Ω α[clen + 1, ú]B / / remove decrypted ciphertext
28 :
if τ Õ ”= MAC(Km, Èd-seqnrÍ32 Î ptxtÕ)
29 :
- ut Ω out Î (‹, INVALID_MAC)
30 :
closed Ω true; break
31 :
padlen Ω ÈptxtÕ[5, 5]BÍ≠1 / / validate padding length
32 :
mlenÕ Ω clen ≠ padlen ≠ 4 ≠ 1 ≠ macsize
33 :
if (mlenÕ > 32789) ‚ (mlenÕ < 1)
34 :
- ut Ω out Î (‹, INVALID_PAD_LENGTH)
35 :
closed Ω true; break
36 :
mÕ Ω ptxtÕ[6, clen ≠ macsize ≠ padlen]B
37 :
38 :
d-seqnr Ω d-seqnr + 1
39 :
return out
36
analysed in [PW10] using a different security model supporting fragmentation.
- We provide a considerably
simpler proof showing that SSH-CTR is CS-I secure.
universally composable.
