gostcrypto

README

go-gostcrypto

Pure-Go GOST cryptographic primitives — Streebog (GOST R 34.11-2012), Kuznyechik and Magma (GOST R 34.12-2015), GOST 28147-89, GOST R 34.10 sign/verify, VKO key agreement, MGM, OMAC, CTR-ACPKM, KDFTree, TLSTree, KEG, KExp15, CryptoPro key wrap, and GOST R 34.11-94 — plus GOST-signed X.509 parsing and verification.

Pure-Go, BSD-2-Clause, zero third-party dependencies (CGO_ENABLED=0). Every primitive is a clean-room re-implementation; no GPL code is linked and none appears in this module's go.mod/go.sum.

Quick start

go get github.com/tarantool/go-gostcrypto

import "github.com/tarantool/go-gostcrypto"

// Hash with Streebog-256.
digest := gostcrypto.Streebog256([]byte("hello"))

// Encrypt and decrypt with Kuznyechik.
ciphertext, err := gostcrypto.KuznyechikEncrypt(key, plaintext)
if err != nil {
	// handle error
}
plaintext, err = gostcrypto.KuznyechikDecrypt(key, ciphertext)

The root package is a stable []byte-in/[]byte-out facade; for the idiomatic cipher.Block / hash.Hash API import the primitive packages directly (see below). Full API reference: pkg.go.dev.

Layout

gostcrypto/                  package gostcrypto — the public facade (clean-room)
  *.go                       stable []byte-in/[]byte-out API, delegates to the primitives
  streebog/ kuznyechik/ …    BSD clean-room primitives, each importable directly;
                             each has a README.md (overview) and DESIGN.md (detail)
  x509gost/…                 GOST-signed X.509 parse/verify
  internal/ct/               shared branch-free masking primitives for the constant-time paths

• Facade (root gostcrypto package): a stable []byte-in/[]byte-out API. Consumers that want a simple call surface import this.
• Primitive packages (streebog/, kuznyechik/, …): each primitive as its own package with an idiomatic cipher.Block / hash.Hash API, importable directly.
• x509gost: GOST X.509. ParseCertificate returns a *Certificate wrapping the stdlib cert plus GOST metadata; non-GOST DER passes through unchanged.

Packages

Each package name links to its README.md — a short overview with the public API and a usage example — which in turn links to the package's DESIGN.md: the full algorithm description, specification, implementation notes, and test vectors.

The Spec(s) column links to the copy of each standard committed alongside the code, under that package's rfc/ directory.

Package	Primitive	Spec(s)
gost28147	GOST 28147-89 block cipher core (ECB, key schedule, S-boxes)	RFC 5830, RFC 4357
magma	Magma — GOST R 34.12-2015, 64-bit block	RFC 8891
kuznyechik	Kuznyechik — GOST R 34.12-2015, 128-bit block	RFC 7801
gost28147cnt	GOST 28147-89 CNT counter/gamma stream	RFC 5830, RFC 4357
gost28147imit	GOST 28147-89 IMIT MAC + CryptoPro key meshing	RFC 5830, RFC 4357
ctracpkm	CTR mode + ACPKM key meshing	RFC 8645; GOST R 34.13-2015
omac	OMAC / CMAC (GOST R 34.13-2015 MAC)	RFC 4493; GOST R 34.13-2015
mgm	MGM AEAD (Multilinear Galois Mode)	RFC 9058; R 1323565.1.026-2019
streebog	Streebog hash — GOST R 34.11-2012, 256 & 512	RFC 6986
gostr341194	GOST R 34.11-94 legacy hash (CryptoPro param set)	RFC 5831, RFC 4357
kdftree	KDF_TREE_GOSTR3411_2012_256	RFC 7836
tlstree	TLSTree per-record key derivation	RFC 9189, RFC 7836
gost3410sign	GOST R 34.10-2001/2012 signature (sign + verify)	RFC 7091, RFC 5832
gost3410curves	GOST R 34.10 curve parameter sets (CryptoPro + TC26)	RFC 4357, RFC 7836
vko	VKO key agreement (GOST 34.10-2001 & 2012)	RFC 4357, RFC 7836
keywrap	CryptoPro KeyWrap + key diversification	RFC 4357 §6
keg	KEG — key export generation (TLS GOST KEX)	RFC 9189; R 1323565.1.020-2018
kexp15	KExp15 / KImp15 key export wrapping	RFC 9189; R 1323565.1.017-2018
x509gost	GOST-signed X.509 parse/verify	RFC 9215, RFC 4491

A byte-order trap that cuts across all of them: GOST serializes integers, keys, public-key coordinates, and signatures little-endian on the wire (public keys are LE(X) || LE(Y), signatures are s || r), while the underlying math and the RFC constant tables are big-endian. When a test vector fails, check byte order first — each package's DESIGN.md implementation notes list the traps for that primitive.

Constant-time / side channels

The default primitives are table-driven and not constant-time — they leak the key/plaintext through cache timing, matching the GOST software norm (gogost, gost-engine) and the table-driven AES shipped everywhere. Two experimental, leak-free paths exist alongside them, sharing the branch-free masking vocabulary in internal/ct:

• kuznyechik.NewCipherCT(key) — a constant-time Kuznyechik whose Encrypt/Decrypt and key schedule have no secret-dependent memory access (SWAR full-scan S-box + GF(2)-linear L columns, no fused 64 KiB tables). Byte-for-byte identical to the table cipher; ≈36× slower. See kuznyechik/SECURITY.md.
• gost3410curves.(*Curve).ScalarMultCT(k, p) — a constant-time EC scalar multiply for secret scalars (signing nonce, private key), built on fixed-limb Montgomery field arithmetic and complete short-Weierstrass formulas. The variable-time big.Int ScalarMult remains the default; opt in per Curve via the ConstantTime flag. See gost3410curves/SECURITY.md and gost3410curves/EXPERIMENT-ct.md.

Both are exercised by a verification harness in CI: ctgrind (valgrind/memcheck, instruction-level — fails if any branch/address depends on the poisoned secret) and dudect (statistical timing-leak sweep). Each runs a variable-time positive control that must be flagged, so a broken detector can't pass silently.

Build & test

CGO_ENABLED=0 go build ./...
CGO_ENABLED=0 go test ./...
make lint    # golangci-lint v2 (config in .golangci.yml)
make fuzz    # drive every Fuzz target (FUZZTIME=1m by default)

The KAT tests run oracle-free. CI (GitHub Actions) runs the test, lint, and fuzz workflows (status shown by the badges above), plus parity / parity-fuzz differentials and the ctgrind + dudect constant-time checks on every pull request.

Contributing

Contributions are welcome. See CONTRIBUTING.md for the development workflow, coding conventions, and the pre-push checklist. Notable changes are tracked in CHANGELOG.md.

Licensing

BSD 2-Clause — see LICENSE.

Reference material

• <package>/README.md → <package>/DESIGN.md — per-package overview and the full algorithm description, specification, implementation notes, and test vectors (see the Packages table above).
• gost3410curves/SECURITY.md — constant-time status of ScalarMult and the experimental ScalarMultCT.
• gost3410curves/EXPERIMENT-ct.md — design and verification methodology for the constant-time EC scalar multiply (shared by both CT paths and the CI harness).
• kuznyechik/SECURITY.md — cache-timing of the table-driven S-L rounds and the experimental constant-time NewCipherCT path.

Known gogost/gost-engine vector divergences (S-box row order, GOST R 34.11-94 empty-input finalization, CryptoPro key meshing) are described in the relevant package DESIGN.md files, next to the code they affect.

Documentation

Overview

Package gostcrypto provides pure-Go GOST cryptographic primitives and GOST-signed X.509 support.

The package is a clean-room, BSD-2-Clause implementation with zero third-party dependencies (built with CGO_ENABLED=0). No GPL code is linked and none appears in this module's go.mod/go.sum.

Primitives

• Streebog (GOST R 34.11-2012, 256/512-bit) and legacy GOST R 34.11-94 hashes.
• Kuznyechik and Magma block ciphers (GOST R 34.12-2015) and GOST 28147-89.
• GOST R 34.10 sign/verify and VKO key agreement over the standard curves.
• Modes and MACs: CTR, CTR-ACPKM, OMAC, MGM, IMIT, KDFTree, TLSTree, KEG, KExp15 and CryptoPro key wrap.

The root gostcrypto package is a stable []byte-in/[]byte-out facade that delegates to the primitive subpackages. Those subpackages (streebog, kuznyechik, magma, …) are also importable directly for the idiomatic crypto/cipher.Block and hash.Hash APIs. GOST-signed X.509 parsing and verification lives in the github.com/tarantool/go-gostcrypto/x509gost package.

Quick Example

digest := gostcrypto.Streebog256([]byte("hello"))

ciphertext, err := gostcrypto.KuznyechikEncrypt(key, plaintext)
if err != nil {
    // handle error
}
plaintext, err = gostcrypto.KuznyechikDecrypt(key, ciphertext)

GOST wire format is little-endian (LE(X)||LE(Y) public keys, s||r signatures) while the underlying math and the RFC tables are big-endian; the facade handles the conversion so callers work in the wire byte order throughout.

Index

• Constants
• Variables
• func GOST28147_IMIT(key, msg []byte) ([]byte, error)
• func GOST2814789Decrypt(key, ciphertext []byte) ([]byte, error)
• func GOST2814789Encrypt(key, plaintext []byte) ([]byte, error)
• func GOSTR341194(msg []byte) []byte
• func GenerateEphemeralKey(curve *Curve, rnd io.Reader) (privRaw, pubRaw []byte, err error)
• func KDFTree2012_256(key, label, seed []byte, keyOutLen int) []byte
• func KEG2012_256(curve *Curve, serverPubRaw, clientPrivRaw, ukmSource []byte) ([64]byte, error)
• func Kexp15(variant KexpVariant, sharedKey, cipherKey, macKey, iv []byte) ([]byte, error)
• func KeyWrapCryptoPro(sbox *Sbox, kek, ukm, sessionKey []byte) ([]byte, error)
• func KuznyechikDecrypt(key, ciphertext []byte) ([]byte, error)
• func KuznyechikEncrypt(key, plaintext []byte) ([]byte, error)
• func MagmaDecrypt(key, ciphertext []byte) ([]byte, error)
• func MagmaEncrypt(key, plaintext []byte) ([]byte, error)
• func NewGOST28147IMITPlaceholderHash() hash.Hash
• func NewGOST28147_CNT(key, iv []byte) (cipher.Stream, error)
• func NewGOSTR341194CryptoProHash() hash.Hash
• func NewKuznyechikCipher(key []byte) cipher.Block
• func NewMagmaCipher(key []byte) cipher.Block
• func NewStreebog256Hash() hash.Hash
• func NewStreebog512Hash() hash.Hash
• func PublicKeyRawFromPrivate(curve *Curve, prvRaw []byte) ([]byte, error)
• func PublicKeyRawFromPrivate2001Test(prvRaw []byte) ([]byte, error)
• func R341012Sign(prvRaw, digest []byte) ([]byte, error)
• func R341012Verify(prvRaw, digest, sig []byte) (bool, error)
• func R342001Verify(pubRaw, digest, sig []byte) (bool, error)
• func SignDigestOnCurve(curve *Curve, prvRaw, digest []byte, rnd io.Reader) ([]byte, error)
• func Streebog256(msg []byte) []byte
• func Streebog512(msg []byte) []byte
• func VKO2001(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)
• func VKO2001OnCurve(curve *Curve, prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)
• func VKO2001TestCurve(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)
• func VKO2012_256(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)
• func VKO2012_256OnCurve(curve *Curve, prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)
• func VKO2012_512(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)
• func VerifyDigestOnCurve(curve *Curve, pubRaw, digest, sig []byte) (bool, error)
• type CTR
  • func NewCTR(block cipher.Block, iv []byte) (*CTR, error)
  • func NewCTRACPKM(newBlock func([]byte) cipher.Block, key, iv []byte, sectionSize int) (*CTR, error)
  • func (c *CTR) XORKeyStream(dst, src []byte)
• type Curve
  • func CurveByOID(oid asn1.ObjectIdentifier) (*Curve, error)
  • func GOST2001CryptoProAParamSetCurve() *Curve
  • func GOST2001TestParamSetCurve() *Curve
  • func (c *Curve) Name() string
  • func (c *Curve) PointSize() int
• type GOST28147Cipher
  • func NewGOST28147Cipher(key []byte, sbox *Sbox) *GOST28147Cipher
  • func (c *GOST28147Cipher) Decrypt(dst, src []byte)
  • func (c *GOST28147Cipher) Encrypt(dst, src []byte)
  • func (c *GOST28147Cipher) SeqMACBlock(block []byte) []byte
• type KexpVariant
• type OMAC
  • func NewOMAC(block cipher.Block, tagSize int) (*OMAC, error)
  • func (o *OMAC) BlockSize() int
  • func (o *OMAC) Reset()
  • func (o *OMAC) Size() int
  • func (o *OMAC) Sum(b []byte) []byte
  • func (o *OMAC) Write(p []byte) (int, error)
• type Sbox
• type TLSTree
  • func NewTLSTreeKuznyechikCTROMAC(masterKey []byte) *TLSTree
  • func NewTLSTreeMagmaCTROMAC(masterKey []byte) *TLSTree
  • func (t *TLSTree) Derive(seqNum uint64) []byte

Constants

const (
	GOST28147BlockSize  = crgost28147.BlockSize // 8
	GOST28147KeySize    = crgost28147.KeySize   // 32
	KuznyechikBlockSize = kuznyechik.BlockSize  // 16
	MagmaBlockSize      = magma.BlockSize       // 8
)

Block-cipher dimensions, re-exported so callers size buffers without naming the backend packages.

Variables

var SboxCryptoProA = &Sbox{inner: crgost28147.SboxCryptoProA}

SboxCryptoProA is the GOST 28147-89 CryptoPro-A S-box.

var SboxTC26Z = &Sbox{inner: crgost28147.SboxTC26Z}

SboxTC26Z is the GOST 28147-89 tc26 param-Z S-box.

Functions

func GOST28147_IMIT

func GOST28147_IMIT(key, msg []byte) ([]byte, error)

GOST28147_IMIT computes the GOST 28147-89 IMIT MAC over msg using the given key and CryptoPro-A S-box with CryptoPro key meshing. Output is 4 bytes.

func GOST2814789Decrypt

func GOST2814789Decrypt(key, ciphertext []byte) ([]byte, error)

GOST2814789Decrypt decrypts one 8-byte block with the given 32-byte key using the default (CryptoPro-A) S-box. Returns an error if the input is not exactly 8 bytes.

func GOST2814789Encrypt

func GOST2814789Encrypt(key, plaintext []byte) ([]byte, error)

GOST2814789Encrypt encrypts one 8-byte block with the given 32-byte key using the default (CryptoPro-A) S-box. Returns an error if the input is not exactly 8 bytes.

func GOSTR341194

func GOSTR341194(msg []byte) []byte

GOSTR341194 computes the GOST R 34.11-94 hash using the CryptoPro parameter set.

func GenerateEphemeralKey

func GenerateEphemeralKey(curve *Curve, rnd io.Reader) (privRaw, pubRaw []byte, err error)

GenerateEphemeralKey generates an ephemeral GOST R 34.10-2012 key pair on curve using rnd. Returns privRaw (LE, PointSize bytes) and pubRaw (LE(X)||LE(Y), 2×PointSize bytes).

The scalar is drawn exactly as gogost's GenPrivateKey does: read PointSize raw bytes from rnd, interpret little-endian, reduce mod q. This keeps the two backends byte-for-byte identical for a given rnd stream (the pinned-seed TLS key-exchange tests depend on it).

func KDFTree2012_256

func KDFTree2012_256(key, label, seed []byte, keyOutLen int) []byte

KDFTree2012_256 derives keyOutLen bytes of key material from key + label + seed. keyOutLen must be a positive multiple of 32.

func KEG2012_256

func KEG2012_256(curve *Curve, serverPubRaw, clientPrivRaw, ukmSource []byte) ([64]byte, error)

KEG2012_256 derives a 64-byte shared secret using the GOST 2018 KEG algorithm (R 1323565.1.020-2018 §6.4.5.1) on the supplied 256-bit curve.

It honors the caller's curve (extracted from the server certificate), delegating to the clean-room keg package, which performs the UKM adjustment, VKO-2012-256 agreement and KDFTree expansion. A 512-bit curve is rejected by keg with an error.

func Kexp15

func Kexp15(variant KexpVariant, sharedKey, cipherKey, macKey, iv []byte) ([]byte, error)

Kexp15 wraps a shared key for transport using gost_kexp15.

func KeyWrapCryptoPro

func KeyWrapCryptoPro(sbox *Sbox, kek, ukm, sessionKey []byte) ([]byte, error)

KeyWrapCryptoPro implements the CryptoPro key wrap algorithm (RFC 4357 §6.3 wrap + §6.5 diversification). Returns a 44-byte buffer: [ukm(8) | encryptedSessionKey(32) | MAC(4)].

func KuznyechikDecrypt

func KuznyechikDecrypt(key, ciphertext []byte) ([]byte, error)

KuznyechikDecrypt decrypts one 16-byte block with the given 32-byte key. Returns an error if the input is not exactly 16 bytes.

func KuznyechikEncrypt

func KuznyechikEncrypt(key, plaintext []byte) ([]byte, error)

KuznyechikEncrypt encrypts one 16-byte block with the given 32-byte key. Returns an error if the input is not exactly 16 bytes.

func MagmaDecrypt

func MagmaDecrypt(key, ciphertext []byte) ([]byte, error)

MagmaDecrypt decrypts one 8-byte block with the given 32-byte key. Returns an error if the input is not exactly 8 bytes.

func MagmaEncrypt

func MagmaEncrypt(key, plaintext []byte) ([]byte, error)

MagmaEncrypt encrypts one 8-byte block with the given 32-byte key. Returns an error if the input is not exactly 8 bytes.

func NewGOST28147IMITPlaceholderHash

func NewGOST28147IMITPlaceholderHash() hash.Hash

NewGOST28147IMITPlaceholderHash returns a GOST 28147-89 IMIT placeholder hash.Hash. It exists solely to satisfy the suite registry's MACSpec.Hash metadata field (consulted for KeyLen / MACLen reporting); the real record-layer MAC is computed by the protector with the session key.

func NewGOST28147_CNT

func NewGOST28147_CNT(key, iv []byte) (cipher.Stream, error)

NewGOST28147_CNT returns a cipher.Stream implementing GOST 28147-89 in CNT (counter stream) mode with the CryptoPro-A S-box. key must be 32 bytes; iv must be 8 bytes.

func NewGOSTR341194CryptoProHash

func NewGOSTR341194CryptoProHash() hash.Hash

NewGOSTR341194CryptoProHash returns a fresh GOST R 34.11-94 hash using the CryptoPro parameter-set S-box.

func NewKuznyechikCipher

func NewKuznyechikCipher(key []byte) cipher.Block

NewKuznyechikCipher returns a Kuznyechik (GOST R 34.12-2015, 128-bit) block cipher for the given 32-byte key.

func NewMagmaCipher

func NewMagmaCipher(key []byte) cipher.Block

NewMagmaCipher returns a Magma (GOST R 34.12-2015, 64-bit) block cipher for the given 32-byte key.

func NewStreebog256Hash

func NewStreebog256Hash() hash.Hash

NewStreebog256Hash returns a fresh Streebog-256 (GOST R 34.11-2012) hash.

func NewStreebog512Hash

func NewStreebog512Hash() hash.Hash

NewStreebog512Hash returns a fresh Streebog-512 (GOST R 34.11-2012) hash.

func PublicKeyRawFromPrivate

func PublicKeyRawFromPrivate(curve *Curve, prvRaw []byte) ([]byte, error)

PublicKeyRawFromPrivate derives the LE-encoded public key from prvRaw on the given curve. It returns errDegeneratePrivateKey if prvRaw is degenerate (reduces to zero mod q, or yields the point at infinity).

func PublicKeyRawFromPrivate2001Test

func PublicKeyRawFromPrivate2001Test(prvRaw []byte) ([]byte, error)

PublicKeyRawFromPrivate2001Test derives the LE-encoded GOST R 34.10-2001 public key from prvRaw on the test parameter set curve. It returns errDegeneratePrivateKey if prvRaw is degenerate (reduces to zero mod q, or yields the point at infinity).

func R341012Sign

func R341012Sign(prvRaw, digest []byte) ([]byte, error)

R341012Sign signs digest with a GOST R 34.10-2012 256-bit private key on the 2001 test parameter set curve.

func R341012Verify

func R341012Verify(prvRaw, digest, sig []byte) (bool, error)

R341012Verify verifies a GOST R 34.10-2012 256-bit signature on the 2001 test parameter set curve. prvRaw is the LE private key; the public key is derived.

func R342001Verify

func R342001Verify(pubRaw, digest, sig []byte) (bool, error)

R342001Verify verifies a GOST R 34.10-2001 signature on the id-GostR3410-2001-CryptoPro-A parameter set.

func SignDigestOnCurve

func SignDigestOnCurve(curve *Curve, prvRaw, digest []byte, rnd io.Reader) ([]byte, error)

SignDigestOnCurve signs digest with the GOST R 34.10 private key prvRaw on the given curve, returning the raw signature. rnd supplies the per-signature nonce.

func Streebog256

func Streebog256(msg []byte) []byte

Streebog256 computes the Streebog-256 (GOST R 34.11-2012, 256-bit) hash.

func Streebog512

func Streebog512(msg []byte) []byte

Streebog512 computes the Streebog-512 (GOST R 34.11-2012, 512-bit) hash.

func VKO2001

func VKO2001(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)

VKO2001 computes the VKO GOST R 34.10-2001 shared KEK (RFC 4357) on the id-GostR3410-2001-CryptoPro-A curve.

func VKO2001OnCurve

func VKO2001OnCurve(curve *Curve, prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)

VKO2001OnCurve is the curve-aware variant of VKO2001.

func VKO2001TestCurve

func VKO2001TestCurve(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)

VKO2001TestCurve computes VKO GOST R 34.10-2001 shared KEK using the test parameter set curve.

func VKO2012_256

func VKO2012_256(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)

VKO2012_256 computes VKO GOST R 34.10-2012 with 256-bit KEK output (RFC 7836) on the id-tc26-gost-3410-2012-512-paramSetA curve.

func VKO2012_256OnCurve

func VKO2012_256OnCurve(curve *Curve, prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)

VKO2012_256OnCurve is the curve-aware variant of VKO2012_256.

func VKO2012_512

func VKO2012_512(prvRaw, pubRaw, ukmRaw []byte) ([]byte, error)

VKO2012_512 computes VKO GOST R 34.10-2012 with 512-bit KEK output (RFC 7836) on the id-tc26-gost-3410-2012-512-paramSetA curve.

func VerifyDigestOnCurve

func VerifyDigestOnCurve(curve *Curve, pubRaw, digest, sig []byte) (bool, error)

VerifyDigestOnCurve verifies a GOST R 34.10 signature over digest using the public key pubRaw on the given curve.

Types

type CTR

type CTR struct {
	// contains filtered or unexported fields
}

CTR holds per-record CTR state. Create one per record via NewCTR or NewCTRACPKM; discard after the record is processed.

func NewCTR

func NewCTR(block cipher.Block, iv []byte) (*CTR, error)

NewCTR creates a new CTR stream cipher over block with the given iv. iv must be exactly block.BlockSize() bytes.

func NewCTRACPKM

func NewCTRACPKM(newBlock func([]byte) cipher.Block, key, iv []byte, sectionSize int) (*CTR, error)

NewCTRACPKM creates a CTR with intra-record ACPKM key meshing enabled. newBlock builds a cipher.Block from a 32-byte key. sectionSize is the number of keystream bytes after which the key is refreshed (0 disables ACPKM).

func (*CTR) XORKeyStream

func (c *CTR) XORKeyStream(dst, src []byte)

XORKeyStream XORs each byte of src with the CTR gamma stream, writing the result into dst.

type Curve

type Curve struct {
	// contains filtered or unexported fields
}

Curve is an opaque handle for a GOST R 34.10 curve. It wraps the clean-room curve type so callers in tls/internal/ke, tls/internal/handshake, and x509gost can pass a curve around without naming the backend. Obtain one via CurveByOID or GOST2001TestParamSetCurve.

func CurveByOID

func CurveByOID(oid asn1.ObjectIdentifier) (*Curve, error)

CurveByOID resolves a GOST R 34.10 curve from its ASN.1 OID. Returns errUnsupportedCurveOID when the OID is not a known GOST curve.

func GOST2001CryptoProAParamSetCurve

func GOST2001CryptoProAParamSetCurve() *Curve

GOST2001CryptoProAParamSetCurve returns the GOST R 34.10-2001 CryptoPro-A parameter set curve (id-GostR3410-2001-CryptoPro-A-ParamSet).

func GOST2001TestParamSetCurve

func GOST2001TestParamSetCurve() *Curve

GOST2001TestParamSetCurve returns the GOST R 34.10-2001 test parameter set curve.

func (*Curve) Name

func (c *Curve) Name() string

Name returns the underlying curve's parameter-set name.

func (*Curve) PointSize

func (c *Curve) PointSize() int

PointSize returns the curve's coordinate size in bytes.

type GOST28147Cipher

type GOST28147Cipher struct {
	// contains filtered or unexported fields
}

GOST28147Cipher is an opaque GOST 28147-89 block cipher. It exposes the single-block primitives the record-layer CNT mode and IMIT MAC need.

func NewGOST28147Cipher

func NewGOST28147Cipher(key []byte, sbox *Sbox) *GOST28147Cipher

NewGOST28147Cipher builds a GOST 28147-89 cipher from a 32-byte key and the given S-box.

func (*GOST28147Cipher) Decrypt

func (c *GOST28147Cipher) Decrypt(dst, src []byte)

Decrypt decrypts one 8-byte block (32-round schedule) from src into dst.

func (*GOST28147Cipher) Encrypt

func (c *GOST28147Cipher) Encrypt(dst, src []byte)

Encrypt encrypts one 8-byte block (32-round schedule) from src into dst.

func (*GOST28147Cipher) SeqMACBlock

func (c *GOST28147Cipher) SeqMACBlock(block []byte) []byte

SeqMACBlock runs the 16-round SeqMAC encryption of a single 8-byte block with a zero IV — the per-block step of the GOST 28147-89 IMIT MAC. block must be 8 bytes; returns 8 bytes.

type KexpVariant

type KexpVariant int

KexpVariant selects the underlying block cipher for kexp15.

const (
	// KexpKuznyechik uses Kuznyechik (128-bit block). iv_len=8, mac_len=16.
	KexpKuznyechik KexpVariant = iota
	// KexpMagma uses Magma (64-bit block). iv_len=4, mac_len=8.
	KexpMagma
)

type OMAC

type OMAC struct {
	// contains filtered or unexported fields
}

OMAC wraps the clean-room OMAC/CMAC implementation. It implements hash.Hash (Write / Sum / Reset / BlockSize / Size) with non-destructive Sum.

func NewOMAC

func NewOMAC(block cipher.Block, tagSize int) (*OMAC, error)

NewOMAC returns an OMAC/CMAC instance using the given block cipher. tagSize must be in [1, block.BlockSize()].

func (*OMAC) BlockSize

func (o *OMAC) BlockSize() int

BlockSize returns the block size of the underlying cipher.

func (*OMAC) Reset

func (o *OMAC) Reset()

Reset re-initialises the OMAC state to zero (as if freshly constructed). The clean-room OMAC has no in-place reset by design, so a fresh instance is built over the same block and tag size.

func (*OMAC) Size

func (o *OMAC) Size() int

Size returns the tag size in bytes.

func (*OMAC) Sum

func (o *OMAC) Sum(b []byte) []byte

Sum appends the current MAC to b and returns the result. Non-destructive.

func (*OMAC) Write

func (o *OMAC) Write(p []byte) (int, error)

Write adds data to the running MAC state.

type Sbox

type Sbox struct {
	// contains filtered or unexported fields
}

Sbox is an opaque handle for a GOST 28147-89 S-box. It wraps the clean-room S-box value so callers select a wrap / session S-box by identity without naming the backend. Use the SboxCryptoProA / SboxTC26Z package variables.

type TLSTree

type TLSTree struct {
	// contains filtered or unexported fields
}

TLSTree wraps the clean-room TLSTree.

func NewTLSTreeKuznyechikCTROMAC

func NewTLSTreeKuznyechikCTROMAC(masterKey []byte) *TLSTree

NewTLSTreeKuznyechikCTROMAC creates a TLSTree for the TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC cipher suite (RFC 9367 §4.3).

func NewTLSTreeMagmaCTROMAC

func NewTLSTreeMagmaCTROMAC(masterKey []byte) *TLSTree

NewTLSTreeMagmaCTROMAC creates a TLSTree for the TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC cipher suite (RFC 9367 §4.4).

func (*TLSTree) Derive

func (t *TLSTree) Derive(seqNum uint64) []byte

Derive returns a fresh 32-byte key for the given TLS record sequence number.