aes128 completely done.

ish. done-ish. it's entirely untested. CTR should work as i modeled it after PoC, and CBC *probably* works as it's straightforward, but I have no idea about the GCM. TODO.

cipher/aes/aes128/gcm/funcs.go

@@ -1,17 +1,25 @@
 package gcm
 
 import (
-	`bytes`
-	`io`
+	"bytes"
+	gCipher "crypto/cipher"
 
-	`r00t2.io/sshkeys/cipher/aes`
-	`r00t2.io/sshkeys/cipher/aes/aes128`
-	`r00t2.io/sshkeys/internal`
+	"r00t2.io/sshkeys/internal"
+	"r00t2.io/sshkeys/internal/ciphers/aesCommon"
 )
 
+// Setup populates a Cipher from a key. The key must include the IV suffixed to the actual key.
 func (c *Cipher) Setup(key []byte) (err error) {
 
-	// TODO
+	if c == nil {
+		*c = Cipher{
+			&aesCommon.AesCipher{},
+		}
+	}
+
+	if err = c.CipherSetup(key, aesCommon.Aes128Bits); err != nil {
+		return
+	}
 
 	return
 }
@@ -36,22 +44,6 @@ func (c *Cipher) NameBytes() (name []byte) {
 	return
 }
 
-// BlockSize returns the blocksize of this Cipher.
-func (c *Cipher) BlockSize() (size int) {
-
-	size = aes.BlockSize
-
-	return
-}
-
-// KdfKeySize returns the target key length from KDF to use with this Cipher.
-func (c *Cipher) KdfKeySize() (size int) {
-
-	size = aes128.KeySize
-
-	return
-}
-
 /*
 	Encrypt encrypts data (a string, []byte, byte, *bytes.Buffer, or *bytes.Reader) to the *bytes.Reader encrypted.
 
@@ -64,27 +56,22 @@ func (c *Cipher) KdfKeySize() (size int) {
 */
 func (c *Cipher) Encrypt(data interface{}) (encrypted *bytes.Reader, err error) {
 
-	var b []byte
+	var padded []byte
 	var cryptDst []byte
-	var padded *bytes.Reader
+	var cryptBlock gCipher.Block
+	var crypter gCipher.AEAD
 
-	if b, err = internal.SerializeData(data); err != nil {
+	if cryptDst, padded, cryptBlock, err = c.GetCryptBlock(data); err != nil {
 		return
 	}
 
-	if padded, err = c.Pad(b); err != nil {
+	if crypter, err = gCipher.NewGCM(cryptBlock); err != nil {
 		return
 	}
 
-	b = make([]byte, padded.Len())
-	if b, err = io.ReadAll(padded); err != nil {
-		return
-	}
+	cryptDst = crypter.Seal(cryptDst, c.IV, padded, nil)
 
-	cryptDst = make([]byte, len(b))
-
-	// TODO
-	_ = cryptDst
+	encrypted = bytes.NewReader(cryptDst)
 
 	return
 }
@@ -124,22 +111,6 @@ func (c *Cipher) AllocateEncrypt(data interface{}) (encrypted *bytes.Reader, err
 	return
 }
 
-/*
-	Pad will pad data (a string, []byte, byte, or *bytes.Buffer) to the Cipher.BlockSize (if necessary).
-	The resulting padded buffer is returned.
-
-	NOTE: If data is a *bytes.Buffer, no bytes will be consumed -- the bytes are taken in entirety without consuming them (Buffer.Bytes()).
-		  It is up to the caller to consume the buffer as desired beforehand or isolate to a specific sub-buffer beforehand to pass to Cipher.Pad.
-
-	NOTE: If data is a *bytes.Reader, ALL bytes WILL be consumed.
-*/
-func (c *Cipher) Pad(data interface{}) (paddedBuf *bytes.Reader, err error) {
-
-	// TODO
-
-	return
-}
-
 /*
 	Decrypt takes a raw byte slice, a *bytes.Buffer, or a *bytes.Reader and returns a plain/decrypted *bytes.Reader.
 
@@ -152,17 +123,24 @@ func (c *Cipher) Pad(data interface{}) (paddedBuf *bytes.Reader, err error) {
 */
 func (c *Cipher) Decrypt(data interface{}) (decrypted *bytes.Reader, err error) {
 
-	var b []byte
-	var decryptDst []byte
+	var plain []byte
+	var padded []byte
+	var cryptBlock gCipher.Block
+	var decrypter gCipher.AEAD
 
-	if b, err = internal.SerializeData(data); err != nil {
+	if plain, padded, cryptBlock, err = c.GetDecryptBlock(data); err != nil {
 		return
 	}
 
-	decryptDst = make([]byte, len(b))
+	if decrypter, err = gCipher.NewGCM(cryptBlock); err != nil {
+		return
+	}
 
-	// TODO
-	_ = decryptDst
+	if plain, err = decrypter.Open(plain, c.IV, padded, nil); err != nil {
+		return
+	}
+
+	decrypted = bytes.NewReader(plain)
 
 	return
 }
@@ -191,15 +169,3 @@ func (c *Cipher) AllocatedDecrypt(data interface{}) (decrypted *bytes.Reader, er
 
 	return
 }
-
-/*
-	IsPlain indicates if this Cipher is a plain/null encryption (cipher.null.Null).
-
-	It will always return false. It is included for interface compatability.
-*/
-func (c *Cipher) IsPlain() (plain bool) {
-
-	plain = false
-
-	return
-}

cipher/aes/aes128/gcm/types.go

@@ -0,0 +1,10 @@
+package gcm
+
+import (
+	"r00t2.io/sshkeys/internal/ciphers/aesCommon"
+)
+
+// Cipher is an AES128-GCM cipher.Cipher.
+type Cipher struct {
+	*aesCommon.AesCipher
+}