sys/crypto: fix OCB mode

[LP-HAW]

Contribution description

This PR fixes the Offset_0 calculation in OCB mode. There was a failed attempt to discard the upper two bits of nonce_padded[15]. The tests did not catch this because all nonces have zeros in those positions.

Perhaps we should just remove OCB mode, as it has apparently never been used by anyone (including its authors) since it was merged 5 years ago.

Testing procedure

make -C tests/sys/crypto all test

Issues/PRs references

None

[riot-ci]

Murdock results

✔️ PASSED

b51d8e3 sys/crypto: fix OCB mode

Success	Failures	Total	Runtime
10178	0	10178	17m:10s

Artifacts

• Documentation preview

[mguetschow]

Thanks for finding and fixing, and special kudos for adding a dedicated test for it, well done! :)

Is the reason of the failed attempt that the left- and right-shift operations got optimized away by the compiler? If so, is this line another instance of the same problem? Just found it by searching for the same pattern.

https:/RIOT-OS/RIOT/blob/master/drivers/my9221/my9221.c#L126

[LP-HAW]

Is the reason of the failed attempt that the left- and right-shift operations got optimized away by the compiler?

Its because of integer promotion. Before the shift operations, nonce_padded[15] is converted to an int which is either 16 or 32 bit depending on the platform.

If so, is this line another instance of the same problem? Just found it by searching for the same pattern.

I think the code in my9221.c should be fine because after the left shift, the result is cast to an uint16_t, which should cut off the upper bits. We could add braces to make it clear that the cast is applied after the shift left and before the shift right.

[mguetschow]

I see, thanks for the explanation :)