AesWrap: update from bc-java

- fix wrap/unwrap of 64-bit keys

2 files changed, 98 insertions, 80 deletions

diff --git a/crypto/src/crypto/engines/AesWrapEngine.cs b/crypto/src/crypto/engines/AesWrapEngine.cs
index bf9e724cd..641e22f78 100644
--- a/crypto/src/crypto/engines/AesWrapEngine.cs
+++ b/crypto/src/crypto/engines/AesWrapEngine.cs
@@ -1,16 +1,30 @@
 namespace Org.BouncyCastle.Crypto.Engines
 {
-	/// <remarks>
-	/// An implementation of the AES Key Wrapper from the NIST Key Wrap Specification.
-	/// <p/>
-	/// For further details see: <a href="http://csrc.nist.gov/encryption/kms/key-wrap.pdf">http://csrc.nist.gov/encryption/kms/key-wrap.pdf</a>.
-	/// </remarks>
-	public class AesWrapEngine
+    /// <remarks>
+    /// An implementation of the AES Key Wrapper from the NIST Key Wrap Specification.
+    /// <p/>
+    /// For further details see: <a href="http://csrc.nist.gov/encryption/kms/key-wrap.pdf">http://csrc.nist.gov/encryption/kms/key-wrap.pdf</a>.
+    /// </remarks>
+    public class AesWrapEngine
 		: Rfc3394WrapEngine
 	{
-		public AesWrapEngine()
+        /// <summary>
+        /// Create a regular AesWrapEngine specifying the encrypt for wrapping, decrypt for unwrapping.
+        /// </summary>
+        public AesWrapEngine()
 			: base(AesUtilities.CreateEngine())
 		{
 		}
-	}
+
+        /// <summary>
+        /// Create an AESWrapEngine where the underlying cipher is (optionally) set to decrypt for wrapping, encrypt for
+        /// unwrapping.
+        /// </summary>
+        /// <param name="useReverseDirection">true if underlying cipher should be used in decryption mode, false
+        /// otherwise.</param>
+        public AesWrapEngine(bool useReverseDirection)
+            : base(AesUtilities.CreateEngine(), useReverseDirection)
+        {
+        }
+    }
 }
diff --git a/crypto/src/crypto/engines/RFC3394WrapEngine.cs b/crypto/src/crypto/engines/RFC3394WrapEngine.cs
index ff3a4e0a0..9744130d2 100644
--- a/crypto/src/crypto/engines/RFC3394WrapEngine.cs
+++ b/crypto/src/crypto/engines/RFC3394WrapEngine.cs
@@ -16,22 +16,24 @@ namespace Org.BouncyCastle.Crypto.Engines
 		: IWrapper
 	{
 		private readonly IBlockCipher engine;
+        private readonly bool wrapCipherMode;
 
-		private KeyParameter	param;
+        private KeyParameter	param;
 		private bool			forWrapping;
 
-		private byte[] iv =
-		{
-			0xa6, 0xa6, 0xa6, 0xa6,
-			0xa6, 0xa6, 0xa6, 0xa6
-		};
+		private byte[] iv = { 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6 };
 
-		public Rfc3394WrapEngine(
-			IBlockCipher engine)
+		public Rfc3394WrapEngine(IBlockCipher engine)
+			: this(engine, false)
 		{
-			this.engine = engine;
 		}
 
+        public Rfc3394WrapEngine(IBlockCipher engine, bool useReverseDirection)
+        {
+            this.engine = engine;
+            this.wrapCipherMode = !useReverseDirection;
+        }
+
         public virtual void Init(
 			bool				forWrapping,
 			ICipherParameters	parameters)
@@ -69,111 +71,113 @@ namespace Org.BouncyCastle.Crypto.Engines
 			get { return engine.AlgorithmName; }
 		}
 
-        public virtual byte[] Wrap(
-			byte[]	input,
-			int		inOff,
-			int		inLen)
+        public virtual byte[] Wrap(byte[] input, int inOff, int inLen)
 		{
 			if (!forWrapping)
-			{
 				throw new InvalidOperationException("not set for wrapping");
-			}
+            if (inLen < 8)
+                throw new DataLengthException("wrap data must be at least 8 bytes");
 
-			int n = inLen / 8;
+            int n = inLen / 8;
 
 			if ((n * 8) != inLen)
-			{
 				throw new DataLengthException("wrap data must be a multiple of 8 bytes");
-			}
 
-			byte[] block = new byte[inLen + iv.Length];
-			byte[] buf = new byte[8 + iv.Length];
+            engine.Init(wrapCipherMode, param);
 
+            byte[] block = new byte[inLen + iv.Length];
 			Array.Copy(iv, 0, block, 0, iv.Length);
 			Array.Copy(input, inOff, block, iv.Length, inLen);
 
-			engine.Init(true, param);
-
-			for (int j = 0; j != 6; j++)
+			if (n == 1)
 			{
-				for (int i = 1; i <= n; i++)
-				{
-					Array.Copy(block, 0, buf, 0, iv.Length);
-					Array.Copy(block, 8 * i, buf, iv.Length, 8);
-					engine.ProcessBlock(buf, 0, buf, 0);
+                engine.ProcessBlock(block, 0, block, 0);
+            }
+            else
+			{
+                byte[] buf = new byte[8 + iv.Length];
 
-					int t = n * j + i;
-					for (int k = 1; t != 0; k++)
+                for (int j = 0; j != 6; j++)
+				{
+					for (int i = 1; i <= n; i++)
 					{
-						byte v = (byte)t;
+						Array.Copy(block, 0, buf, 0, iv.Length);
+						Array.Copy(block, 8 * i, buf, iv.Length, 8);
+						engine.ProcessBlock(buf, 0, buf, 0);
 
-						buf[iv.Length - k] ^= v;
-						t = (int) ((uint)t >> 8);
-					}
+						int t = n * j + i;
+						for (int k = 1; t != 0; k++)
+						{
+							byte v = (byte)t;
 
-					Array.Copy(buf, 0, block, 0, 8);
-					Array.Copy(buf, 8, block, 8 * i, 8);
+							buf[iv.Length - k] ^= v;
+							t = (int) ((uint)t >> 8);
+						}
+
+						Array.Copy(buf, 0, block, 0, 8);
+						Array.Copy(buf, 8, block, 8 * i, 8);
+					}
 				}
-			}
+            }
 
-			return block;
+            return block;
 		}
 
-        public virtual byte[] Unwrap(
-			byte[]  input,
-			int     inOff,
-			int     inLen)
+        public virtual byte[] Unwrap(byte[] input, int inOff, int inLen)
 		{
 			if (forWrapping)
-			{
 				throw new InvalidOperationException("not set for unwrapping");
-			}
-            if (inLen < iv.Length)
-            {
+            if (inLen < 16)
                 throw new InvalidCipherTextException("unwrap data too short");
-            }
 
 			int n = inLen / 8;
 
 			if ((n * 8) != inLen)
-			{
 				throw new InvalidCipherTextException("unwrap data must be a multiple of 8 bytes");
-			}
-
-			byte[]  block = new byte[inLen - iv.Length];
-			byte[]  a = new byte[iv.Length];
-			byte[]  buf = new byte[8 + iv.Length];
 
-			Array.Copy(input, inOff, a, 0, iv.Length);
-            Array.Copy(input, inOff + iv.Length, block, 0, inLen - iv.Length);
+            engine.Init(!wrapCipherMode, param);
 
-			engine.Init(false, param);
+            byte[] block = new byte[inLen - iv.Length];
+			byte[] a = new byte[iv.Length];
+			byte[] buf = new byte[8 + iv.Length];
 
 			n = n - 1;
 
-			for (int j = 5; j >= 0; j--)
+			if (n == 1)
 			{
-				for (int i = n; i >= 1; i--)
-				{
-					Array.Copy(a, 0, buf, 0, iv.Length);
-					Array.Copy(block, 8 * (i - 1), buf, iv.Length, 8);
+                engine.ProcessBlock(input, inOff, buf, 0);
+                Array.Copy(buf, 0, a, 0, iv.Length);
+                Array.Copy(buf, iv.Length, block, 0, 8);
+            }
+            else
+			{
+                Array.Copy(input, inOff, a, 0, iv.Length);
+                Array.Copy(input, inOff + iv.Length, block, 0, inLen - iv.Length);
 
-					int t = n * j + i;
-					for (int k = 1; t != 0; k++)
+				for (int j = 5; j >= 0; j--)
+				{
+					for (int i = n; i >= 1; i--)
 					{
-						byte v = (byte)t;
+						Array.Copy(a, 0, buf, 0, iv.Length);
+						Array.Copy(block, 8 * (i - 1), buf, iv.Length, 8);
 
-						buf[iv.Length - k] ^= v;
-						t = (int) ((uint)t >> 8);
-					}
+						int t = n * j + i;
+						for (int k = 1; t != 0; k++)
+						{
+							byte v = (byte)t;
 
-					engine.ProcessBlock(buf, 0, buf, 0);
-					Array.Copy(buf, 0, a, 0, 8);
-					Array.Copy(buf, 8, block, 8 * (i - 1), 8);
+							buf[iv.Length - k] ^= v;
+							t = (int) ((uint)t >> 8);
+						}
+
+						engine.ProcessBlock(buf, 0, buf, 0);
+						Array.Copy(buf, 0, a, 0, 8);
+						Array.Copy(buf, 8, block, 8 * (i - 1), 8);
+					}
 				}
-			}
+            }
 
-			if (!Arrays.FixedTimeEquals(a, iv))
+            if (!Arrays.FixedTimeEquals(a, iv))
 				throw new InvalidCipherTextException("checksum failed");
 
 			return block;