blob: a4cc9efe8eb313e1e83f85cf8019a98aa04b9956 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef NET_QUIC_CRYPTO_QUIC_ENCRYPTER_H_
#define NET_QUIC_CRYPTO_QUIC_ENCRYPTER_H_
#include <stddef.h>
#include "net/base/net_export.h"
#include "net/quic/quic_protocol.h"
namespace net {
class NET_EXPORT_PRIVATE QuicEncrypter {
public:
virtual ~QuicEncrypter() {}
static QuicEncrypter* Create(QuicTag algorithm);
// Sets the encryption key. Returns true on success, false on failure.
//
// NOTE: The key is the client_write_key or server_write_key derived from
// the master secret.
virtual bool SetKey(base::StringPiece key) = 0;
// Sets the fixed initial bytes of the nonce. Returns true on success,
// false on failure.
//
// NOTE: The nonce prefix is the client_write_iv or server_write_iv
// derived from the master secret. A 64-bit packet number will
// be appended to form the nonce.
//
// <------------ 64 bits ----------->
// +---------------------+----------------------------------+
// | Fixed prefix | packet number |
// +---------------------+----------------------------------+
// Nonce format
//
// The security of the nonce format requires that QUIC never reuse a
// packet number, even when retransmitting a lost packet.
virtual bool SetNoncePrefix(base::StringPiece nonce_prefix) = 0;
// Writes encrypted |plaintext| and a MAC over |plaintext| and
// |associated_data| into output. Sets |output_length| to the number of
// bytes written. Returns true on success or false if there was an error.
// |packet_number| is appended to the |nonce_prefix| value provided in
// SetNoncePrefix() to form the nonce. |output| must not overlap with
// |associated_data|. If |output| overlaps with |plaintext| then
// |plaintext| must be <= |output|.
virtual bool EncryptPacket(QuicPathId path_id,
QuicPacketNumber packet_number,
base::StringPiece associated_data,
base::StringPiece plaintext,
char* output,
size_t* output_length,
size_t max_output_length) = 0;
// GetKeySize() and GetNoncePrefixSize() tell the HKDF class how many bytes
// of key material needs to be derived from the master secret.
// NOTE: the sizes returned by GetKeySize() and GetNoncePrefixSize() are
// also correct for the QuicDecrypter of the same algorithm. So only
// QuicEncrypter has these two methods.
// Returns the size in bytes of a key for the algorithm.
virtual size_t GetKeySize() const = 0;
// Returns the size in bytes of the fixed initial part of the nonce.
virtual size_t GetNoncePrefixSize() const = 0;
// Returns the maximum length of plaintext that can be encrypted
// to ciphertext no larger than |ciphertext_size|.
virtual size_t GetMaxPlaintextSize(size_t ciphertext_size) const = 0;
// Returns the length of the ciphertext that would be generated by encrypting
// to plaintext of size |plaintext_size|.
virtual size_t GetCiphertextSize(size_t plaintext_size) const = 0;
// For use by unit tests only.
virtual base::StringPiece GetKey() const = 0;
virtual base::StringPiece GetNoncePrefix() const = 0;
};
} // namespace net
#endif // NET_QUIC_CRYPTO_QUIC_ENCRYPTER_H_
|
