Documentation
¶
Overview ¶
Package gcmsiv implements AES-256-GCM-SIV, the nonce-misuse-resistant AEAD of RFC 8452. It is a self-contained pure-Go implementation (no cgo): AES is the standard library's constant-time/hardware AES, and the POLYVAL universal hash is implemented here with a constant-time, limb-based carry-less multiply (see polyval.go and design note D4 — this is the project's riskiest self-written crypto surface).
Only the 256-bit key variant is provided, the only one the Signal protocol's sealed-sender v2 uses. Every step cites the relevant RFC 8452 section.
Reuse evaluation (recorded per design requirement) ¶
Before writing this, vetted pure-Go reuse was evaluated: the Go standard library and golang.org/x/crypto ship no public AES-GCM-SIV; the only third-party pure-Go ports found (secure-io/siv-go, ericlagergren/siv) are tiny (<10 stars), unreleased, unaudited, and one is self-described as an experimental proof-of-concept "not optimized for ... (side channel) security" — none meet the vetted/maintained/constant-time bar (D4). Outcome: implement in-repo, as the plan anticipated.
Index ¶
Constants ¶
const ( // KeySize is the AES-256-GCM-SIV key length in bytes (the key-generating // key, RFC 8452 §4). KeySize = 32 // NonceSize is the GCM-SIV nonce length: 96 bits (RFC 8452 §4). NonceSize = 12 // TagSize is the GCM-SIV authentication tag length: 128 bits (RFC 8452 §4). TagSize = 16 )
Variables ¶
var ( // ErrKeySize is returned when the key is not KeySize bytes. ErrKeySize = errors.New("gcmsiv: invalid key size") // ErrNonceSize is returned when the nonce is not NonceSize bytes. ErrNonceSize = errors.New("gcmsiv: invalid nonce size") // ErrOpen is returned when authentication fails or the ciphertext is too // short to contain a tag. ErrOpen = errors.New("gcmsiv: message authentication failed") // ErrInputTooLong is returned when plaintext or additional data exceeds the // RFC 8452 §6 limits. ErrInputTooLong = errors.New("gcmsiv: input exceeds RFC 8452 length limit") )
Sentinel errors. ErrOpen is intentionally singular for every authentication failure (wrong key/nonce/AAD/tag or tampered ciphertext) so the cases are not distinguishable to an attacker, matching GCM-SIV's all-or-nothing decryption.
Functions ¶
Types ¶
This section is empty.
Source Files