Initial constant-time implementation of Base64 for generic & AVX2

.gitignore

@@ -0,0 +1,3 @@
+/target
+**/*.rs.bk
+Cargo.lock

.travis.yml

@@ -0,0 +1,19 @@
+branches:
+  only:
+    # This is where pull requests from "bors r+" are built.
+    - staging
+    # This is where pull requests from "bors try" are built.
+    - trying
+    # Not really necessary, just to get a green badge on “master”
+    - master
+language: rust
+
+jobs:
+  include:
+    - rust: stable
+    - rust: beta
+    - rust: nightly
+      env: FEATURES=--features=nightly
+script:
+  - cargo test --no-default-features
+  - cargo test $FEATURES

Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "b64-ct"
+version = "0.1.0"
+authors = ["Fortanix, Inc."]
+license = "MPL-2.0"
+edition = "2018"
+description = """
+Fast and secure Base64 encoding/decoding.
+
+This crate provides an implementation of Base64 encoding/decoding that is
+designed to be resistant against software side-channel attacks (such as timing
+& cache attacks), see the documentation for details. On certain platforms it
+also uses SIMD making it very fast. This makes it suitable for e.g. decoding
+cryptographic private keys in PEM format.
+
+The API is very similar to the base64 implementation in the old rustc-serialize
+crate, making it easy to use in existing projects.
+"""
+repository = "https://github.com/fortanix/b64-ct/"
+keywords = ["base64", "constant-time"]
+categories = ["cryptography", "encoding", "no-std"]
+readme = "README.md"
+
+[features]
+default = ["std"]
+std = []
+nightly = [] # Used only for testing
+
+[dev-dependencies]
+rand = "0.6"
+paste = "0.1"

LICENSE

@@ -1,3 +1,65 @@
+This project as a whole is licensed under the terms of the Mozilla Public 
+License, Version 2.0, see below. This project includes code written by The Rust 
+Project Developers and Wojciech Muła, license terms below.
+
+----------------------------------------------------------------------------
+
+Copyright (c) 2014 The Rust Project Developers
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+----------------------------------------------------------------------------
+
+Copyright (c) 2015-2018, Wojciech Muła
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+----------------------------------------------------------------------------
+
 Mozilla Public License Version 2.0
 ==================================
 

README.md

@@ -1,3 +1,32 @@
+# Fast and secure Base64 encoding/decoding
+
+This crate provides an implementation of Base64 encoding/decoding that is
+designed to be resistant against software side-channel attacks (such as timing
+& cache attacks), see the [documentation] for details. On certain platforms it
+also uses SIMD making it very fast. This makes it suitable for e.g. decoding
+cryptographic private keys in PEM format.
+
+The API is very similar to the base64 implementation in the old rustc-serialize
+crate, making it easy to use in existing projects.
+
+[documentation]: https://docs.rs/b64-ct
+
+# Implementation
+
+Depending on the runtime CPU architecture, this crate uses different
+implementations with different security properties.
+
+* x86 with AVX2: All lookup tables are implemented with SIMD
+  instructions. No secret-dependent memory accceses.
+* Other platforms: Lookups are limited to 64-byte aligned lookup tables. On
+  platforms with 64-byte cache lines this may be sufficient to prevent
+  certain cache side-channel attacks. However, it's known that this is [not
+  sufficient for all platforms].
+
+We graciously welcome contributed support for other platforms!
+
+[not sufficient on some platforms]: https://ts.data61.csiro.au/projects/TS/cachebleed/
+
 # Contributing
 
 We gratefully accept bug reports and contributions from the community.

bors.toml

@@ -0,0 +1,3 @@
+status = [
+  "continuous-integration/travis-ci/push",
+]

src/avx2.rs

@@ -0,0 +1,39 @@
+/* Copyright (c) Fortanix, Inc.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+use core::arch::x86_64::*;
+
+#[rustfmt::skip]
+pub(crate) unsafe fn dup_mm_setr_epi8(e: [i8; 16]) -> __m256i {
+    _mm256_setr_epi8(
+        e[0x0], e[0x1], e[0x2], e[0x3], e[0x4], e[0x5], e[0x6], e[0x7], 
+        e[0x8], e[0x9], e[0xa], e[0xb], e[0xc], e[0xd], e[0xe], e[0xf], 
+        e[0x0], e[0x1], e[0x2], e[0x3], e[0x4], e[0x5], e[0x6], e[0x7], 
+        e[0x8], e[0x9], e[0xa], e[0xb], e[0xc], e[0xd], e[0xe], e[0xf], 
+    )
+}
+
+#[rustfmt::skip]
+pub(crate) unsafe fn dup_mm_setr_epu8(e: [u8; 16]) -> __m256i {
+    _mm256_setr_epi8(
+        e[0x0] as _, e[0x1] as _, e[0x2] as _, e[0x3] as _, e[0x4] as _, e[0x5] as _, e[0x6] as _, e[0x7] as _, 
+        e[0x8] as _, e[0x9] as _, e[0xa] as _, e[0xb] as _, e[0xc] as _, e[0xd] as _, e[0xe] as _, e[0xf] as _, 
+        e[0x0] as _, e[0x1] as _, e[0x2] as _, e[0x3] as _, e[0x4] as _, e[0x5] as _, e[0x6] as _, e[0x7] as _, 
+        e[0x8] as _, e[0x9] as _, e[0xa] as _, e[0xb] as _, e[0xc] as _, e[0xd] as _, e[0xe] as _, e[0xf] as _, 
+    )
+}
+
+pub(crate) unsafe fn _mm256_not_si256(i: __m256i) -> __m256i {
+    _mm256_xor_si256(i, _mm256_set1_epi8(!0))
+}
+
+pub(crate) unsafe fn array_as_m256i(v: [u8; 32]) -> __m256i {
+    core::mem::transmute(v)
+}
+
+pub(crate) unsafe fn m256i_as_array(v: __m256i) -> [u8; 32] {
+    core::mem::transmute(v)
+}