From 6e9f2ba1dc1caff8daf989675cebe1107e839a8a Mon Sep 17 00:00:00 2001 From: Eric Blankenhorn Date: Mon, 2 Mar 2026 11:54:06 -0600 Subject: [PATCH] Fixes from review --- tests/test_chacha20poly1305.py | 18 ++++++++++++++++++ wolfcrypt/ciphers.py | 7 +++++++ 2 files changed, 25 insertions(+) diff --git a/tests/test_chacha20poly1305.py b/tests/test_chacha20poly1305.py index d9149bf..adba98d 100644 --- a/tests/test_chacha20poly1305.py +++ b/tests/test_chacha20poly1305.py @@ -50,6 +50,24 @@ if _lib.CHACHA20_POLY1305_ENABLED: with pytest.raises(ValueError): ChaCha20Poly1305(b"tooshort") + def test_encrypt_invalid_iv_length(): + key = h2b("808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f") + chacha = ChaCha20Poly1305(key) + with pytest.raises(ValueError): + chacha.encrypt(b"aad", b"short", b"plaintext") + + def test_decrypt_invalid_iv_length(): + key = h2b("808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f") + chacha = ChaCha20Poly1305(key) + with pytest.raises(ValueError): + chacha.decrypt(b"aad", b"short", b"\x00" * 16, b"ciphertext") + + def test_decrypt_invalid_tag_length(): + key = h2b("808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f") + chacha = ChaCha20Poly1305(key) + with pytest.raises(ValueError): + chacha.decrypt(b"aad", b"\x00" * 12, b"short", b"ciphertext") + def test_decrypt_bad_tag(): key = h2b("808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f") iv = h2b("07000000404142434445464748") diff --git a/wolfcrypt/ciphers.py b/wolfcrypt/ciphers.py index eaf4efd..412e9b1 100644 --- a/wolfcrypt/ciphers.py +++ b/wolfcrypt/ciphers.py @@ -561,6 +561,8 @@ if _lib.CHACHA20_POLY1305_ENABLED: """ aad = t2b(aad) iv = t2b(iv) + if len(iv) != 12: + raise ValueError("iv must be 12 bytes, got %d" % len(iv)) plaintext = t2b(plaintext) ciphertext = _ffi.new("byte[%d]" % len(plaintext)) authTag = _ffi.new("byte[%d]" % self._tag_bytes) @@ -587,7 +589,12 @@ if _lib.CHACHA20_POLY1305_ENABLED: """ aad = t2b(aad) iv = t2b(iv) + if len(iv) != 12: + raise ValueError("iv must be 12 bytes, got %d" % len(iv)) authTag = t2b(authTag) + if len(authTag) != self._tag_bytes: + raise ValueError("authTag must be %d bytes, got %d" % + (self._tag_bytes, len(authTag))) ciphertext = t2b(ciphertext) plaintext = _ffi.new("byte[%d]" % len(ciphertext)) ret = _lib.wc_ChaCha20Poly1305_Decrypt(