NAME

Crypt::EAX - Encrypt and authenticate data in EAX mode

SYNOPSIS

        use Crypt::EAX;

        my $c = Crypt::EAX->new(
                key => $key,
                cipher => "Crypt::Rijndael",
                header => $header, # optional
                nonce => $nonce, # optional but reccomended
                fatal => 1,
        );

        my $ciphertext = $c->encrypt( $message );

        $ciphertext ^= "moose"; # corrupt it

        $c->decrypt( $ciphertext ); # dies

        $ciphertext ^= "moose"; # xor is reversible

        is( $c->decrypt( $ciphertext ), $msg );

DESCRIPTION

EAX is a cipher chaining mode with integrated message authentication. This type of encryption mode is called AEAD, or Authenticated Encryption with Associated Data.

The purpuse of AEAD modes is that you can safely encrypt and sign a value with a shared key. The message will not decrypt if it has been tampered with.

There are various reasons why just encrypt(mac($message)) is not safe, but I don't exactly know them since I'm not a crptographer. For more info use The Oracle Google.

Read more about EAX AEAD here:

http://en.wikipedia.org/wiki/EAX_mode

http://en.wikipedia.org/wiki/AEAD_block_cipher_modes_of_operation

CONFIGURATION

key

The key used to encrypt/decrypt and authenticate. Passed verbatim to Crypt::Ctr::FullWidth and Digest::CMAC.

cipher

Defaults to Crypt::Rijndael. Likewise passed verbatim.

fatal

Whether or not failed verification dies or returns a false value.

header

Additional data to be authenticated but not encrypted.

Note that it's also possible to incrementally add the header using add_header.

If the header option is passed instead then add_header will be called with it as an argument every time reset is called.

This will not be included in the resulting ciphertext, but the ciphertext must be authenticated against it.

Presumably you are supposed to encode the ciphertext and header together in your message.

This is the Associated Data part of AEAD.

Be careful if you deconstruct the message naively, like this:

        my ( $header, $ciphertext ) = unpack("N/a a*", $message);

since you are inherently trusting the input data already, before it's been verified (the N/ part can be altered, and though knowing Perl this is probably safe, I wouldn't count on it). The specific attack in this case is if a large number is encoded by the attacker in the N field then it could trick your program into trying allocate 4GB of memory in this particular example.

At any rate do not trust the header till the ciphertext has been successfully decrypted.

nonce

The nonce to use for authentication. Should be unique. See http://en.wikipedia.org/wiki/Cryptographic_nonce.

It is OK to pass this along with the ciphertext, much like the salt bit in crypt.

An empty value is allowed and is in fact the default, but this is not safe against replay attacks.

METHODS

new %args

Instantiate a new Crypt::EAX object.

See "CONFIGURATION".

encrypt $plaintext

decrypt $ciphertext

Single step encryption/decryption.

The tag is appended to the ciphertext.

encrypt_parts $plaintext

Returns the ciphertext and tag as separate tags.

decrypt_parts $ciphertext, $tag

Decrypts and verifies the message.

start $mode

Takes either encrypting or decrypting.

finish ?$tag

If encrypting, returns the tag.

If decrypting, checks that $tag is equal to the calculated tag.

Used by encrypt_parts and decrypt_parts.

add_encrypt $text

add_decrypt $ciphertext

Streaming mode of operation. Requires a call to start before and finish after. Used by decrypt_parts and encrypt_parts.

add_header $header

Add header data that will be authenticated as well. See header for more details.

verification_failed

Called when verification fails. Dies when fatal is set, returns a false value otherwise.

TODO

• Consider disallowing an empty nonce.

  Can anyone advise on this?

SEE ALSO

Digest::CMAC, Crypt::Ctr, Crypt::Ctr::FullWidth, Crypt::Util

VERSION CONTROL

This module is maintained using Darcs. You can get the latest version from http://nothingmuch.woobling.org/code, and use darcs send to commit changes.

AUTHOR

Yuval Kogman <nothingmuch@woobling.org>

COPYRIGHT & LICENSE

        Copyright (c) 2007 Yuval Kogman. All rights reserved
        This program is free software; you can redistribute it and/or modify it
        under the terms of the MIT license or the same terms as Perl itself.