deoxys: rewrite the internals to use inout

[baloo]

This is to prepare the migration to AeadInOut, following RustCrypto/traits#1793

Note: there is a strong chance this could actually use the StreamCipherCore api, but I couldn't not make it fit.

[baloo]

Eventually this should drop and use aead::inout

[tarcieri]

@baloo can you add one or more tests that actually exercise InOutBuf with separate backing buffers?

[baloo]

Yeah, found a misuse of get_in haha ><

[newpavlov]

This PR includes a fair amount of changes which are not directly relevant to the inout support. Ideally, I would prefer to have them in a separate PR, but it's fine to merge it as-is, if you don't wan to bother with the split.

[baloo]

I think this one is ready to merge, unless you have anything other to say.

[newpavlov]

buffer_len % 16 == 0 is always true when !data.is_empty() is false. I think it would be better to write this part like this:

if tail.is_empty() {
    // Without incomplete last block
    ...
} else {
    // With incomplete last block
    ...
}

Same for decrypt_inout.

[baloo]

the best I can do will look this:

diff --git a/deoxys/src/modes.rs b/deoxys/src/modes.rs
index 0f91ec36e0..e6ed2cd000 100644
--- a/deoxys/src/modes.rs
+++ b/deoxys/src/modes.rs
@@ -111,12 +111,11 @@
         tweak[8] = nonce[7] << 4;

         // Message authentication and encryption
-        if !buffer.is_empty() {
+        let (data_blocks, mut tail) = buffer.into_chunks();
+        let data_blocks_len = data_blocks.len();
+        if !data_blocks.is_empty() || !tail.is_empty() {
             tweak[0] = (tweak[0] & 0xf) | TWEAK_M;

-            let (data_blocks, tail) = buffer.into_chunks();
-            let data_blocks_len = data_blocks.len();
-
             for (index, data) in data_blocks.into_iter().enumerate() {
                 // Copy block number
                 let tmp = tweak[8] & 0xf0;
@@ -130,9 +129,8 @@
                 B::encrypt_inout(data, &tweak, subkeys);
             }

-            let mut data = tail;
             let index = data_blocks_len;
-            if !data.is_empty() {
+            if !tail.is_empty() {
                 // Last block, incomplete

                 // Copy block number
@@ -144,9 +142,9 @@
                 tweak[0] = (tweak[0] & 0xf) | TWEAK_M_LAST;

                 let mut block = Block::default();
-                block[0..data.len()].copy_from_slice(data.get_in());
+                block[0..tail.len()].copy_from_slice(tail.get_in());

-                block[data.len()] = 0x80;
+                block[tail.len()] = 0x80;

                 for (c, d) in checksum.iter_mut().zip(block.iter()) {
                     *c ^= d;
@@ -157,24 +155,23 @@
                 // Last block encryption
                 B::encrypt_inout((&mut block).into(), &tweak, subkeys);

-                data.xor_in2out((block[..data.len()]).into());
-
-                // Tag computing.
-                tweak[0] = (tweak[0] & 0xf) | TWEAK_CHKSUM;
-
-                let tmp = tweak[8] & 0xf0;
-                tweak[8..].copy_from_slice(&((index + 1) as u64).to_be_bytes());
-                tweak[8] = (tweak[8] & 0xf) | tmp;
-
-                B::encrypt_inout((&mut checksum).into(), tweak.as_ref(), subkeys);
-
-                for (t, c) in tag.iter_mut().zip(checksum.iter()) {
-                    *t ^= c;
-                }
+                tail.xor_in2out((block[..tail.len()]).into());
             }
         }

-        if buffer_len % 16 == 0 {
+        if !tail.is_empty() {
+            tweak[0] = (tweak[0] & 0xf) | TWEAK_CHKSUM;
+
+            let tmp = tweak[8] & 0xf0;
+            tweak[8..].copy_from_slice(&((data_blocks_len + 1) as u64).to_be_bytes());
+            tweak[8] = (tweak[8] & 0xf) | tmp;
+
+            B::encrypt_inout((&mut checksum).into(), tweak.as_ref(), subkeys);
+
+            for (t, c) in tag.iter_mut().zip(checksum.iter()) {
+                *t ^= c;
+            }
+        } else {
             // Tag computing without last block
             tweak[0] = (tweak[0] & 0xf) | TWEAK_TAG;

That makes the whole patch series a lot less readable in my opinion (even when ignoring whitespace).

[newpavlov]

Ok, we can do it in a different PR then.