nestedaes

README

nestedaes

Go module that implements updatable re-encryption using nested AES based on the ASIACRYPT'20 paper "Improving Speed and Security in Updatable Encryption Schemes" by Boneh et al.

Documentation

Overview

The format of a blob is:

BLOB := HEADER || PAYLOAD
HEADER := PLAIN_HEADER || ENCRYPTED_HEADER
PLAIN_HEADER := SIZE || IV
ENCRYPTED_HEADER := TAG || ENTRIES...
ENTRY := KEK || DEK

The PAYLOAD is encrypted plaintext.

Index

• Constants
• func Decrypt(blob, kek []byte, additionalData []byte) ([]byte, error)
• func Encrypt(plaintext, kek, iv, additionalData []byte) ([]byte, error)
• func Reencrypt(blob, kek []byte) ([]byte, []byte, error)
• func SplitHeaderPayload(blob []byte) ([]byte, []byte, error)
• type EncryptedHeader
• type Header
  • func NewHeader(iv, dataTag, dek []byte) (*Header, error)
  • func UnmarshalHeader(kek, data []byte) (*Header, error)
  • func (h *Header) AddDEK(dek []byte)
  • func (h *Header) Marshal(kek []byte) ([]byte, error)
  • func (h *Header) String() string
• type PlainHeader

Constants

const KeySize = aes256.KeySize

Functions

func Decrypt

func Decrypt(blob, kek []byte, additionalData []byte) ([]byte, error)

decrypted payload, and error TODO: does Decrypt modify the blob and kek inputs?

func Encrypt

func Encrypt(plaintext, kek, iv, additionalData []byte) ([]byte, error)

Encrypt encrypts the plaintext and returns the Blob. The function encrypts the plaintext with a randomly generated Data Encryptoin Key (KEK), and uses the input Key Encryption Key (KEK) to encrypt the DEK in the Blob's header. The IV is the BaseIV. The caller should randomly generate it; each subsequent layer of encryption uses a different IV derived from the BaseIV. The same IV must never be passed to this function more than once. TODO: does Encrypt modify the plaintext input?

func Reencrypt

func Reencrypt(blob, kek []byte) ([]byte, []byte, error)

output: new blob, new kek, error TODO: does Rencrypt modify the blob and kek inputs?

func SplitHeaderPayload

func SplitHeaderPayload(blob []byte) ([]byte, []byte, error)

SplitHeaderPayload takes a slice of the Blob of returns it's two components: the Header bytes and the Payload bytes.

Types

type EncryptedHeader

type EncryptedHeader struct {
	DataTag []byte   // aes256.TagSize
	DEKs    [][]byte //aes256.KeySize
}

type Header

type Header struct {
	PlainHeader
	EncryptedHeader
}

func NewHeader

func NewHeader(iv, dataTag, dek []byte) (*Header, error)

New creates a new Header and initializes the BaseIV, DataTag, and first DEK entry.

func UnmarshalHeader

func UnmarshalHeader(kek, data []byte) (*Header, error)

Unmarshal takes a marshalled version of the header and the current Key Encryption Key (KEK) and deserializes and decrypts the header.

func (*Header) AddDEK

func (h *Header) AddDEK(dek []byte)

AddDEK adds a new data key entry to the header.

func (*Header) Marshal

func (h *Header) Marshal(kek []byte) ([]byte, error)

Marshal marshals the header to a []byte. As part of marshaling, this method takes care of encrypting the "encrypted" portion of the header.

func (*Header) String

func (h *Header) String() string

String satisfies the fmt.Stringer interface.

type PlainHeader

type PlainHeader struct {
	Size   uint32
	BaseIV []byte // aes256.IVSize
}