2 files changed, 152 insertions, 0 deletions
diff --git a/ext/node/crypto/cipher.rs b/ext/node/crypto/cipher.rs
new file mode 100644
index 000000000..0833cb591
--- /dev/null
+++ b/ext/node/crypto/cipher.rs
@@ -0,0 +1,108 @@
+// Copyright 2018-2023 the Deno authors. All rights reserved. MIT license.
+
+use aes::cipher::block_padding::Pkcs7;
+use aes::cipher::BlockEncryptMut;
+use aes::cipher::KeyIvInit;
+use deno_core::error::type_error;
+use deno_core::error::AnyError;
+use deno_core::Resource;
+
+use std::borrow::Cow;
+use std::cell::RefCell;
+use std::rc::Rc;
+
+enum Cipher {
+  Aes128Cbc(Box<cbc::Encryptor<aes::Aes128>>),
+  // TODO(kt3k): add more algorithms Aes192Cbc, Aes256Cbc, Aes128ECB, Aes128GCM, etc.
+}
+
+enum Decipher {
+  // TODO(kt3k): implement Deciphers
+  // Aes128Cbc(Box<cbc::Decryptor<aes::Aes128>>),
+}
+
+pub struct CipherContext {
+  cipher: Rc<RefCell<Cipher>>,
+}
+
+pub struct DecipherContext {
+  _decipher: Rc<RefCell<Decipher>>,
+}
+
+impl CipherContext {
+  pub fn new(algorithm: &str, key: &[u8], iv: &[u8]) -> Result<Self, AnyError> {
+    Ok(Self {
+      cipher: Rc::new(RefCell::new(Cipher::new(algorithm, key, iv)?)),
+    })
+  }
+
+  pub fn encrypt(&self, input: &[u8], output: &mut [u8]) {
+    self.cipher.borrow_mut().encrypt(input, output);
+  }
+
+  pub fn r#final(
+    self,
+    input: &[u8],
+    output: &mut [u8],
+  ) -> Result<(), AnyError> {
+    Rc::try_unwrap(self.cipher)
+      .map_err(|_| type_error("Cipher context is already in use"))?
+      .into_inner()
+      .r#final(input, output)
+  }
+}
+
+impl Resource for CipherContext {
+  fn name(&self) -> Cow<str> {
+    "cryptoCipher".into()
+  }
+}
+
+impl Resource for DecipherContext {
+  fn name(&self) -> Cow<str> {
+    "cryptoDecipher".into()
+  }
+}
+
+impl Cipher {
+  fn new(
+    algorithm_name: &str,
+    key: &[u8],
+    iv: &[u8],
+  ) -> Result<Self, AnyError> {
+    use Cipher::*;
+    Ok(match algorithm_name {
+      "aes-128-cbc" => {
+        Aes128Cbc(Box::new(cbc::Encryptor::new(key.into(), iv.into())))
+      }
+      _ => return Err(type_error(format!("Unknown cipher {algorithm_name}"))),
+    })
+  }
+
+  /// encrypt encrypts the data in the middle of the input.
+  fn encrypt(&mut self, input: &[u8], output: &mut [u8]) {
+    use Cipher::*;
+    match self {
+      Aes128Cbc(encryptor) => {
+        assert!(input.len() % 16 == 0);
+        for (input, output) in input.chunks(16).zip(output.chunks_mut(16)) {
+          encryptor.encrypt_block_b2b_mut(input.into(), output.into());
+        }
+      }
+    }
+  }
+
+  /// r#final encrypts the last block of the input data.
+  fn r#final(self, input: &[u8], output: &mut [u8]) -> Result<(), AnyError> {
+    assert!(input.len() < 16);
+    use Cipher::*;
+    match self {
+      Aes128Cbc(encryptor) => {
+        let _ = (*encryptor)
+          .encrypt_padded_b2b_mut::<Pkcs7>(input, output)
+          .map_err(|_| type_error("Cannot pad the input data"))?;
+        Ok(())
+      }
+    }
+  }
+}
diff --git a/ext/node/crypto/mod.rs b/ext/node/crypto/mod.rs
index f9a61b456..3e6af9b4b 100644
--- a/ext/node/crypto/mod.rs
+++ b/ext/node/crypto/mod.rs
@@ -15,6 +15,7 @@ use rsa::PublicKey;
 use rsa::RsaPrivateKey;
 use rsa::RsaPublicKey;
 
+mod cipher;
 mod digest;
 
 #[op(fast)]
@@ -153,3 +154,46 @@ pub fn op_node_public_encrypt(
     _ => Err(type_error("Unknown padding")),
   }
 }
+
+#[op(fast)]
+pub fn op_node_create_cipheriv(
+  state: &mut OpState,
+  algorithm: &str,
+  key: &[u8],
+  iv: &[u8],
+) -> u32 {
+  state.resource_table.add(
+    match cipher::CipherContext::new(algorithm, key, iv) {
+      Ok(context) => context,
+      Err(_) => return 0,
+    },
+  )
+}
+
+#[op(fast)]
+pub fn op_node_cipheriv_encrypt(
+  state: &mut OpState,
+  rid: u32,
+  input: &[u8],
+  output: &mut [u8],
+) -> bool {
+  let context = match state.resource_table.get::<cipher::CipherContext>(rid) {
+    Ok(context) => context,
+    Err(_) => return false,
+  };
+  context.encrypt(input, output);
+  true
+}
+
+#[op]
+pub fn op_node_cipheriv_final(
+  state: &mut OpState,
+  rid: u32,
+  input: &[u8],
+  output: &mut [u8],
+) -> Result<(), AnyError> {
+  let context = state.resource_table.take::<cipher::CipherContext>(rid)?;
+  let context = Rc::try_unwrap(context)
+    .map_err(|_| type_error("Cipher context is already in use"))?;
+  context.r#final(input, output)
+}