/* * NIST SP800-38D compliant GCM implementation * * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ /* * http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf * * See also: * [MGV] http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf * * We use the algorithm described as Shoup's method with 4-bit tables in * [MGV] 4.1, pp. 12-13, to enhance speed without using too much memory. */ #include "common.h" #if defined(MBEDTLS_GCM_C) #include "mbedtls/gcm.h" #include "mbedtls/platform.h" #include "mbedtls/platform_util.h" #include "mbedtls/error.h" #include "mbedtls/constant_time.h" #if defined(MBEDTLS_BLOCK_CIPHER_C) #include "block_cipher_internal.h" #endif #include <string.h> #if defined(MBEDTLS_AESNI_C) #include "aesni.h" #endif #if defined(MBEDTLS_AESCE_C) #include "aesce.h" #endif #if !defined(MBEDTLS_GCM_ALT) /* Used to select the acceleration mechanism */ #define MBEDTLS_GCM_ACC_SMALLTABLE … #define MBEDTLS_GCM_ACC_LARGETABLE … #define MBEDTLS_GCM_ACC_AESNI … #define MBEDTLS_GCM_ACC_AESCE … /* * Initialize a context */ void mbedtls_gcm_init(mbedtls_gcm_context *ctx) { … } static inline void gcm_set_acceleration(mbedtls_gcm_context *ctx) { … } static inline void gcm_gen_table_rightshift(uint64_t dst[2], const uint64_t src[2]) { … } /* * Precompute small multiples of H, that is set * HH[i] || HL[i] = H times i, * where i is seen as a field element as in [MGV], ie high-order bits * correspond to low powers of P. The result is stored in the same way, that * is the high-order bit of HH corresponds to P^0 and the low-order bit of HL * corresponds to P^127. */ static int gcm_gen_table(mbedtls_gcm_context *ctx) { … } int mbedtls_gcm_setkey(mbedtls_gcm_context *ctx, mbedtls_cipher_id_t cipher, const unsigned char *key, unsigned int keybits) { … } #if defined(MBEDTLS_GCM_LARGE_TABLE) static const uint16_t last8[256] = { 0x0000, 0xc201, 0x8403, 0x4602, 0x0807, 0xca06, 0x8c04, 0x4e05, 0x100e, 0xd20f, 0x940d, 0x560c, 0x1809, 0xda08, 0x9c0a, 0x5e0b, 0x201c, 0xe21d, 0xa41f, 0x661e, 0x281b, 0xea1a, 0xac18, 0x6e19, 0x3012, 0xf213, 0xb411, 0x7610, 0x3815, 0xfa14, 0xbc16, 0x7e17, 0x4038, 0x8239, 0xc43b, 0x063a, 0x483f, 0x8a3e, 0xcc3c, 0x0e3d, 0x5036, 0x9237, 0xd435, 0x1634, 0x5831, 0x9a30, 0xdc32, 0x1e33, 0x6024, 0xa225, 0xe427, 0x2626, 0x6823, 0xaa22, 0xec20, 0x2e21, 0x702a, 0xb22b, 0xf429, 0x3628, 0x782d, 0xba2c, 0xfc2e, 0x3e2f, 0x8070, 0x4271, 0x0473, 0xc672, 0x8877, 0x4a76, 0x0c74, 0xce75, 0x907e, 0x527f, 0x147d, 0xd67c, 0x9879, 0x5a78, 0x1c7a, 0xde7b, 0xa06c, 0x626d, 0x246f, 0xe66e, 0xa86b, 0x6a6a, 0x2c68, 0xee69, 0xb062, 0x7263, 0x3461, 0xf660, 0xb865, 0x7a64, 0x3c66, 0xfe67, 0xc048, 0x0249, 0x444b, 0x864a, 0xc84f, 0x0a4e, 0x4c4c, 0x8e4d, 0xd046, 0x1247, 0x5445, 0x9644, 0xd841, 0x1a40, 0x5c42, 0x9e43, 0xe054, 0x2255, 0x6457, 0xa656, 0xe853, 0x2a52, 0x6c50, 0xae51, 0xf05a, 0x325b, 0x7459, 0xb658, 0xf85d, 0x3a5c, 0x7c5e, 0xbe5f, 0x00e1, 0xc2e0, 0x84e2, 0x46e3, 0x08e6, 0xcae7, 0x8ce5, 0x4ee4, 0x10ef, 0xd2ee, 0x94ec, 0x56ed, 0x18e8, 0xdae9, 0x9ceb, 0x5eea, 0x20fd, 0xe2fc, 0xa4fe, 0x66ff, 0x28fa, 0xeafb, 0xacf9, 0x6ef8, 0x30f3, 0xf2f2, 0xb4f0, 0x76f1, 0x38f4, 0xfaf5, 0xbcf7, 0x7ef6, 0x40d9, 0x82d8, 0xc4da, 0x06db, 0x48de, 0x8adf, 0xccdd, 0x0edc, 0x50d7, 0x92d6, 0xd4d4, 0x16d5, 0x58d0, 0x9ad1, 0xdcd3, 0x1ed2, 0x60c5, 0xa2c4, 0xe4c6, 0x26c7, 0x68c2, 0xaac3, 0xecc1, 0x2ec0, 0x70cb, 0xb2ca, 0xf4c8, 0x36c9, 0x78cc, 0xbacd, 0xfccf, 0x3ece, 0x8091, 0x4290, 0x0492, 0xc693, 0x8896, 0x4a97, 0x0c95, 0xce94, 0x909f, 0x529e, 0x149c, 0xd69d, 0x9898, 0x5a99, 0x1c9b, 0xde9a, 0xa08d, 0x628c, 0x248e, 0xe68f, 0xa88a, 0x6a8b, 0x2c89, 0xee88, 0xb083, 0x7282, 0x3480, 0xf681, 0xb884, 0x7a85, 0x3c87, 0xfe86, 0xc0a9, 0x02a8, 0x44aa, 0x86ab, 0xc8ae, 0x0aaf, 0x4cad, 0x8eac, 0xd0a7, 0x12a6, 0x54a4, 0x96a5, 0xd8a0, 0x1aa1, 0x5ca3, 0x9ea2, 0xe0b5, 0x22b4, 0x64b6, 0xa6b7, 0xe8b2, 0x2ab3, 0x6cb1, 0xaeb0, 0xf0bb, 0x32ba, 0x74b8, 0xb6b9, 0xf8bc, 0x3abd, 0x7cbf, 0xbebe }; static void gcm_mult_largetable(uint8_t *output, const uint8_t *x, uint64_t H[256][2]) { int i; uint64_t u64z[2]; uint16_t *u16z = (uint16_t *) u64z; uint8_t *u8z = (uint8_t *) u64z; uint8_t rem; u64z[0] = 0; u64z[1] = 0; if (MBEDTLS_IS_BIG_ENDIAN) { for (i = 15; i > 0; i--) { mbedtls_xor_no_simd(u8z, u8z, (uint8_t *) H[x[i]], 16); rem = u8z[15]; u64z[1] >>= 8; u8z[8] = u8z[7]; u64z[0] >>= 8; u16z[0] ^= MBEDTLS_GET_UINT16_LE(&last8[rem], 0); } } else { for (i = 15; i > 0; i--) { mbedtls_xor_no_simd(u8z, u8z, (uint8_t *) H[x[i]], 16); rem = u8z[15]; u64z[1] <<= 8; u8z[8] = u8z[7]; u64z[0] <<= 8; u16z[0] ^= last8[rem]; } } mbedtls_xor_no_simd(output, u8z, (uint8_t *) H[x[0]], 16); } #else /* * Shoup's method for multiplication use this table with * last4[x] = x times P^128 * where x and last4[x] are seen as elements of GF(2^128) as in [MGV] */ static const uint16_t last4[16] = …; static void gcm_mult_smalltable(uint8_t *output, const uint8_t *x, uint64_t H[16][2]) { … } #endif /* * Sets output to x times H using the precomputed tables. * x and output are seen as elements of GF(2^128) as in [MGV]. */ static void gcm_mult(mbedtls_gcm_context *ctx, const unsigned char x[16], unsigned char output[16]) { … } int mbedtls_gcm_starts(mbedtls_gcm_context *ctx, int mode, const unsigned char *iv, size_t iv_len) { … } /** * mbedtls_gcm_context::buf contains the partial state of the computation of * the authentication tag. * mbedtls_gcm_context::add_len and mbedtls_gcm_context::len indicate * different stages of the computation: * * len == 0 && add_len == 0: initial state * * len == 0 && add_len % 16 != 0: the first `add_len % 16` bytes have * a partial block of AD that has been * xored in but not yet multiplied in. * * len == 0 && add_len % 16 == 0: the authentication tag is correct if * the data ends now. * * len % 16 != 0: the first `len % 16` bytes have * a partial block of ciphertext that has * been xored in but not yet multiplied in. * * len > 0 && len % 16 == 0: the authentication tag is correct if * the data ends now. */ int mbedtls_gcm_update_ad(mbedtls_gcm_context *ctx, const unsigned char *add, size_t add_len) { … } /* Increment the counter. */ static void gcm_incr(unsigned char y[16]) { … } /* Calculate and apply the encryption mask. Process use_len bytes of data, * starting at position offset in the mask block. */ static int gcm_mask(mbedtls_gcm_context *ctx, unsigned char ectr[16], size_t offset, size_t use_len, const unsigned char *input, unsigned char *output) { … } int mbedtls_gcm_update(mbedtls_gcm_context *ctx, const unsigned char *input, size_t input_length, unsigned char *output, size_t output_size, size_t *output_length) { … } int mbedtls_gcm_finish(mbedtls_gcm_context *ctx, unsigned char *output, size_t output_size, size_t *output_length, unsigned char *tag, size_t tag_len) { … } int mbedtls_gcm_crypt_and_tag(mbedtls_gcm_context *ctx, int mode, size_t length, const unsigned char *iv, size_t iv_len, const unsigned char *add, size_t add_len, const unsigned char *input, unsigned char *output, size_t tag_len, unsigned char *tag) { … } int mbedtls_gcm_auth_decrypt(mbedtls_gcm_context *ctx, size_t length, const unsigned char *iv, size_t iv_len, const unsigned char *add, size_t add_len, const unsigned char *tag, size_t tag_len, const unsigned char *input, unsigned char *output) { … } void mbedtls_gcm_free(mbedtls_gcm_context *ctx) { … } #endif /* !MBEDTLS_GCM_ALT */ #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_CCM_GCM_CAN_AES) /* * AES-GCM test vectors from: * * http://csrc.nist.gov/groups/STM/cavp/documents/mac/gcmtestvectors.zip */ #define MAX_TESTS … static const int key_index_test_data[MAX_TESTS] = …; static const unsigned char key_test_data[][32] = …; static const size_t iv_len_test_data[MAX_TESTS] = …; static const int iv_index_test_data[MAX_TESTS] = …; static const unsigned char iv_test_data[][64] = …; static const size_t add_len_test_data[MAX_TESTS] = …; static const int add_index_test_data[MAX_TESTS] = …; static const unsigned char additional_test_data[][64] = …; static const size_t pt_len_test_data[MAX_TESTS] = …; static const int pt_index_test_data[MAX_TESTS] = …; static const unsigned char pt_test_data[][64] = …; static const unsigned char ct_test_data[][64] = …; static const unsigned char tag_test_data[][16] = …; int mbedtls_gcm_self_test(int verbose) { … } #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ #endif /* MBEDTLS_GCM_C */
Codebase Browser
godot