/* Copyright (c) 2017, Google Inc. * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ #include <openssl/aead.h> #include <assert.h> #include <openssl/cipher.h> #include <openssl/crypto.h> #include <openssl/err.h> #include "../fipsmodule/cipher/internal.h" #include "../internal.h" #define EVP_AEAD_AES_GCM_SIV_NONCE_LEN … #define EVP_AEAD_AES_GCM_SIV_TAG_LEN … // TODO(davidben): AES-GCM-SIV assembly is not correct for Windows. It must save // and restore xmm6 through xmm15. #if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM) && \ !defined(OPENSSL_WINDOWS) #define AES_GCM_SIV_ASM // Optimised AES-GCM-SIV struct aead_aes_gcm_siv_asm_ctx { … }; // The assembly code assumes 8-byte alignment of the EVP_AEAD_CTX's state, and // aligns to 16 bytes itself. static_assert; static_assert; // asm_ctx_from_ctx returns a 16-byte aligned context pointer from |ctx|. static struct aead_aes_gcm_siv_asm_ctx *asm_ctx_from_ctx( const EVP_AEAD_CTX *ctx) { … } // aes128gcmsiv_aes_ks writes an AES-128 key schedule for |key| to // |out_expanded_key|. extern void aes128gcmsiv_aes_ks( const uint8_t key[16], uint8_t out_expanded_key[16*15]); // aes256gcmsiv_aes_ks writes an AES-256 key schedule for |key| to // |out_expanded_key|. extern void aes256gcmsiv_aes_ks( const uint8_t key[32], uint8_t out_expanded_key[16*15]); static int aead_aes_gcm_siv_asm_init(EVP_AEAD_CTX *ctx, const uint8_t *key, size_t key_len, size_t tag_len) { … } static void aead_aes_gcm_siv_asm_cleanup(EVP_AEAD_CTX *ctx) { … } // aesgcmsiv_polyval_horner updates the POLYVAL value in |in_out_poly| to // include a number (|in_blocks|) of 16-byte blocks of data from |in|, given // the POLYVAL key in |key|. extern void aesgcmsiv_polyval_horner(const uint8_t in_out_poly[16], const uint8_t key[16], const uint8_t *in, size_t in_blocks); // aesgcmsiv_htable_init writes powers 1..8 of |auth_key| to |out_htable|. extern void aesgcmsiv_htable_init(uint8_t out_htable[16 * 8], const uint8_t auth_key[16]); // aesgcmsiv_htable6_init writes powers 1..6 of |auth_key| to |out_htable|. extern void aesgcmsiv_htable6_init(uint8_t out_htable[16 * 6], const uint8_t auth_key[16]); // aesgcmsiv_htable_polyval updates the POLYVAL value in |in_out_poly| to // include |in_len| bytes of data from |in|. (Where |in_len| must be a multiple // of 16.) It uses the precomputed powers of the key given in |htable|. extern void aesgcmsiv_htable_polyval(const uint8_t htable[16 * 8], const uint8_t *in, size_t in_len, uint8_t in_out_poly[16]); // aes128gcmsiv_dec decrypts |in_len| & ~15 bytes from |out| and writes them to // |in|. |in| and |out| may be equal, but must not otherwise alias. // // |in_out_calculated_tag_and_scratch|, on entry, must contain: // 1. The current value of the calculated tag, which will be updated during // decryption and written back to the beginning of this buffer on exit. // 2. The claimed tag, which is needed to derive counter values. // // While decrypting, the whole of |in_out_calculated_tag_and_scratch| may be // used for other purposes. In order to decrypt and update the POLYVAL value, it // uses the expanded key from |key| and the table of powers in |htable|. extern void aes128gcmsiv_dec(const uint8_t *in, uint8_t *out, uint8_t in_out_calculated_tag_and_scratch[16 * 8], const uint8_t htable[16 * 6], const struct aead_aes_gcm_siv_asm_ctx *key, size_t in_len); // aes256gcmsiv_dec acts like |aes128gcmsiv_dec|, but for AES-256. extern void aes256gcmsiv_dec(const uint8_t *in, uint8_t *out, uint8_t in_out_calculated_tag_and_scratch[16 * 8], const uint8_t htable[16 * 6], const struct aead_aes_gcm_siv_asm_ctx *key, size_t in_len); // aes128gcmsiv_kdf performs the AES-GCM-SIV KDF given the expanded key from // |key_schedule| and the nonce in |nonce|. Note that, while only 12 bytes of // the nonce are used, 16 bytes are read and so the value must be // right-padded. extern void aes128gcmsiv_kdf(const uint8_t nonce[16], uint64_t out_key_material[8], const uint8_t *key_schedule); // aes256gcmsiv_kdf acts like |aes128gcmsiv_kdf|, but for AES-256. extern void aes256gcmsiv_kdf(const uint8_t nonce[16], uint64_t out_key_material[12], const uint8_t *key_schedule); // aes128gcmsiv_aes_ks_enc_x1 performs a key expansion of the AES-128 key in // |key|, writes the expanded key to |out_expanded_key| and encrypts a single // block from |in| to |out|. extern void aes128gcmsiv_aes_ks_enc_x1(const uint8_t in[16], uint8_t out[16], uint8_t out_expanded_key[16 * 15], const uint64_t key[2]); // aes256gcmsiv_aes_ks_enc_x1 acts like |aes128gcmsiv_aes_ks_enc_x1|, but for // AES-256. extern void aes256gcmsiv_aes_ks_enc_x1(const uint8_t in[16], uint8_t out[16], uint8_t out_expanded_key[16 * 15], const uint64_t key[4]); // aes128gcmsiv_ecb_enc_block encrypts a single block from |in| to |out| using // the expanded key in |expanded_key|. extern void aes128gcmsiv_ecb_enc_block( const uint8_t in[16], uint8_t out[16], const struct aead_aes_gcm_siv_asm_ctx *expanded_key); // aes256gcmsiv_ecb_enc_block acts like |aes128gcmsiv_ecb_enc_block|, but for // AES-256. extern void aes256gcmsiv_ecb_enc_block( const uint8_t in[16], uint8_t out[16], const struct aead_aes_gcm_siv_asm_ctx *expanded_key); // aes128gcmsiv_enc_msg_x4 encrypts |in_len| bytes from |in| to |out| using the // expanded key from |key|. (The value of |in_len| must be a multiple of 16.) // The |in| and |out| buffers may be equal but must not otherwise overlap. The // initial counter is constructed from the given |tag| as required by // AES-GCM-SIV. extern void aes128gcmsiv_enc_msg_x4(const uint8_t *in, uint8_t *out, const uint8_t *tag, const struct aead_aes_gcm_siv_asm_ctx *key, size_t in_len); // aes256gcmsiv_enc_msg_x4 acts like |aes128gcmsiv_enc_msg_x4|, but for // AES-256. extern void aes256gcmsiv_enc_msg_x4(const uint8_t *in, uint8_t *out, const uint8_t *tag, const struct aead_aes_gcm_siv_asm_ctx *key, size_t in_len); // aes128gcmsiv_enc_msg_x8 acts like |aes128gcmsiv_enc_msg_x4|, but is // optimised for longer messages. extern void aes128gcmsiv_enc_msg_x8(const uint8_t *in, uint8_t *out, const uint8_t *tag, const struct aead_aes_gcm_siv_asm_ctx *key, size_t in_len); // aes256gcmsiv_enc_msg_x8 acts like |aes256gcmsiv_enc_msg_x4|, but is // optimised for longer messages. extern void aes256gcmsiv_enc_msg_x8(const uint8_t *in, uint8_t *out, const uint8_t *tag, const struct aead_aes_gcm_siv_asm_ctx *key, size_t in_len); // gcm_siv_asm_polyval evaluates POLYVAL at |auth_key| on the given plaintext // and AD. The result is written to |out_tag|. static void gcm_siv_asm_polyval(uint8_t out_tag[16], const uint8_t *in, size_t in_len, const uint8_t *ad, size_t ad_len, const uint8_t auth_key[16], const uint8_t nonce[12]) { … } // aead_aes_gcm_siv_asm_crypt_last_block handles the encryption/decryption // (same thing in CTR mode) of the final block of a plaintext/ciphertext. It // writes |in_len| & 15 bytes to |out| + |in_len|, based on an initial counter // derived from |tag|. static void aead_aes_gcm_siv_asm_crypt_last_block( int is_128_bit, uint8_t *out, const uint8_t *in, size_t in_len, const uint8_t tag[16], const struct aead_aes_gcm_siv_asm_ctx *enc_key_expanded) { … } // aead_aes_gcm_siv_kdf calculates the record encryption and authentication // keys given the |nonce|. static void aead_aes_gcm_siv_kdf( int is_128_bit, const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx, uint64_t out_record_auth_key[2], uint64_t out_record_enc_key[4], const uint8_t nonce[12]) { … } static int aead_aes_gcm_siv_asm_seal_scatter( const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag, size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce, size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in, size_t extra_in_len, const uint8_t *ad, size_t ad_len) { … } static int aead_aes_gcm_siv_asm_open_gather( const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce, size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag, size_t in_tag_len, const uint8_t *ad, size_t ad_len) { … } static const EVP_AEAD aead_aes_128_gcm_siv_asm = …; static const EVP_AEAD aead_aes_256_gcm_siv_asm = …; #endif // X86_64 && !NO_ASM && !WINDOWS struct aead_aes_gcm_siv_ctx { … }; static_assert; static_assert; static int aead_aes_gcm_siv_init(EVP_AEAD_CTX *ctx, const uint8_t *key, size_t key_len, size_t tag_len) { … } static void aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX *ctx) { … } // gcm_siv_crypt encrypts (or decrypts—it's the same thing) |in_len| bytes from // |in| to |out|, using the block function |enc_block| with |key| in counter // mode, starting at |initial_counter|. This differs from the traditional // counter mode code in that the counter is handled little-endian, only the // first four bytes are used and the GCM-SIV tweak to the final byte is // applied. The |in| and |out| pointers may be equal but otherwise must not // alias. static void gcm_siv_crypt(uint8_t *out, const uint8_t *in, size_t in_len, const uint8_t initial_counter[AES_BLOCK_SIZE], block128_f enc_block, const AES_KEY *key) { … } // gcm_siv_polyval evaluates POLYVAL at |auth_key| on the given plaintext and // AD. The result is written to |out_tag|. static void gcm_siv_polyval( uint8_t out_tag[16], const uint8_t *in, size_t in_len, const uint8_t *ad, size_t ad_len, const uint8_t auth_key[16], const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) { … } // gcm_siv_record_keys contains the keys used for a specific GCM-SIV record. struct gcm_siv_record_keys { … }; // gcm_siv_keys calculates the keys for a specific GCM-SIV record with the // given nonce and writes them to |*out_keys|. static void gcm_siv_keys( const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx, struct gcm_siv_record_keys *out_keys, const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) { … } static int aead_aes_gcm_siv_seal_scatter( const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag, size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce, size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in, size_t extra_in_len, const uint8_t *ad, size_t ad_len) { … } static int aead_aes_gcm_siv_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce, size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag, size_t in_tag_len, const uint8_t *ad, size_t ad_len) { … } static const EVP_AEAD aead_aes_128_gcm_siv = …; static const EVP_AEAD aead_aes_256_gcm_siv = …; #if defined(AES_GCM_SIV_ASM) const EVP_AEAD *EVP_aead_aes_128_gcm_siv(void) { … } const EVP_AEAD *EVP_aead_aes_256_gcm_siv(void) { … } #else const EVP_AEAD *EVP_aead_aes_128_gcm_siv(void) { return &aead_aes_128_gcm_siv; } const EVP_AEAD *EVP_aead_aes_256_gcm_siv(void) { return &aead_aes_256_gcm_siv; } #endif // AES_GCM_SIV_ASM
Codebase Browser
chromium