1 /* $NetBSD: gmac.c,v 1.4 2020/06/29 23:34:48 riastradh Exp $ */ 2 /* OpenBSD: gmac.c,v 1.3 2011/01/11 15:44:23 deraadt Exp */ 3 4 /* 5 * Copyright (c) 2010 Mike Belopuhov <mike (at) vantronix.net> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 /* 21 * This code implements the Message Authentication part of the 22 * Galois/Counter Mode (as being described in the RFC 4543) using 23 * the AES cipher. FIPS SP 800-38D describes the algorithm details. 24 */ 25 26 #include <sys/param.h> 27 #include <sys/systm.h> 28 29 #include <crypto/aes/aes.h> 30 31 #include <opencrypto/gmac.h> 32 33 void ghash_gfmul(const GMAC_INT *, const GMAC_INT *, GMAC_INT *); 34 void ghash_update(GHASH_CTX *, const uint8_t *, size_t); 35 36 /* Computes a block multiplication in the GF(2^128) */ 37 void 38 ghash_gfmul(const GMAC_INT *X, const GMAC_INT *Y, GMAC_INT *product) 39 { 40 GMAC_INT v[GMAC_BLOCK_LEN/GMAC_INTLEN]; 41 uint32_t mul; 42 int i; 43 44 memcpy(v, Y, GMAC_BLOCK_LEN); 45 memset(product, 0, GMAC_BLOCK_LEN); 46 47 for (i = 0; i < GMAC_BLOCK_LEN * 8; i++) { 48 /* update Z */ 49 #if GMAC_INTLEN == 8 50 if (X[i >> 6] & (1ULL << (~i & 63))) { 51 product[0] ^= v[0]; 52 product[1] ^= v[1]; 53 } /* else: we preserve old values */ 54 #else 55 if (X[i >> 5] & (1 << (~i & 31))) { 56 product[0] ^= v[0]; 57 product[1] ^= v[1]; 58 product[2] ^= v[2]; 59 product[3] ^= v[3]; 60 } /* else: we preserve old values */ 61 #endif 62 /* update V */ 63 #if GMAC_INTLEN == 8 64 mul = v[1] & 1; 65 v[1] = (v[0] << 63) | (v[1] >> 1); 66 v[0] = (v[0] >> 1) ^ (0xe100000000000000ULL * mul); 67 #else 68 mul = v[3] & 1; 69 v[3] = (v[2] << 31) | (v[3] >> 1); 70 v[2] = (v[1] << 31) | (v[2] >> 1); 71 v[1] = (v[0] << 31) | (v[1] >> 1); 72 v[0] = (v[0] >> 1) ^ (0xe1000000 * mul); 73 #endif 74 } 75 } 76 77 void 78 ghash_update(GHASH_CTX *ctx, const uint8_t *X, size_t len) 79 { 80 GMAC_INT x; 81 GMAC_INT *s = ctx->S; 82 GMAC_INT *y = ctx->Z; 83 int i, j, k; 84 85 for (i = 0; i < len / GMAC_BLOCK_LEN; i++) { 86 for (j = 0; j < GMAC_BLOCK_LEN/GMAC_INTLEN; j++) { 87 x = 0; 88 for (k = 0; k < GMAC_INTLEN; k++) { 89 x <<= 8; 90 x |= X[k]; 91 } 92 s[j] = y[j] ^ x; 93 X += GMAC_INTLEN; 94 } 95 96 ghash_gfmul(ctx->H, ctx->S, ctx->S); 97 98 y = s; 99 } 100 101 memcpy(ctx->Z, ctx->S, GMAC_BLOCK_LEN); 102 } 103 104 #define AESCTR_NONCESIZE 4 105 106 void 107 AES_GMAC_Init(AES_GMAC_CTX *ctx) 108 { 109 110 memset(ctx, 0, sizeof(AES_GMAC_CTX)); 111 } 112 113 void 114 AES_GMAC_Setkey(AES_GMAC_CTX *ctx, const uint8_t *key, uint16_t klen) 115 { 116 int i; 117 118 switch (klen) { 119 case 16 + AESCTR_NONCESIZE: 120 ctx->rounds = aes_setenckey128(&ctx->K, key); 121 break; 122 case 24 + AESCTR_NONCESIZE: 123 ctx->rounds = aes_setenckey192(&ctx->K, key); 124 break; 125 case 32 + AESCTR_NONCESIZE: 126 ctx->rounds = aes_setenckey256(&ctx->K, key); 127 break; 128 default: 129 panic("invalid AES_GMAC_Setkey length in bytes: %u", 130 (unsigned)klen); 131 } 132 /* copy out salt to the counter block */ 133 memcpy(ctx->J, key + klen - AESCTR_NONCESIZE, AESCTR_NONCESIZE); 134 /* prepare a hash subkey */ 135 aes_enc(&ctx->K, (const void *)ctx->ghash.H, (void *)ctx->ghash.H, 136 ctx->rounds); 137 #if GMAC_INTLEN == 8 138 for (i = 0; i < 2; i++) 139 ctx->ghash.H[i] = be64toh(ctx->ghash.H[i]); 140 #else 141 for (i = 0; i < 4; i++) 142 ctx->ghash.H[i] = be32toh(ctx->ghash.H[i]); 143 #endif 144 } 145 146 void 147 AES_GMAC_Reinit(AES_GMAC_CTX *ctx, const uint8_t *iv, uint16_t ivlen) 148 { 149 /* copy out IV to the counter block */ 150 memcpy(ctx->J + AESCTR_NONCESIZE, iv, ivlen); 151 } 152 153 int 154 AES_GMAC_Update(AES_GMAC_CTX *ctx, const uint8_t *data, uint16_t len) 155 { 156 uint8_t blk[16] = { 0 }; 157 int plen; 158 159 if (len > 0) { 160 plen = len % GMAC_BLOCK_LEN; 161 if (len >= GMAC_BLOCK_LEN) 162 ghash_update(&ctx->ghash, data, len - plen); 163 if (plen) { 164 memcpy(blk, data + (len - plen), plen); 165 ghash_update(&ctx->ghash, blk, GMAC_BLOCK_LEN); 166 } 167 } 168 return (0); 169 } 170 171 void 172 AES_GMAC_Final(uint8_t digest[GMAC_DIGEST_LEN], AES_GMAC_CTX *ctx) 173 { 174 uint8_t keystream[GMAC_BLOCK_LEN], *k, *d; 175 int i; 176 177 /* do one round of GCTR */ 178 ctx->J[GMAC_BLOCK_LEN - 1] = 1; 179 aes_enc(&ctx->K, ctx->J, keystream, ctx->rounds); 180 k = keystream; 181 d = digest; 182 #if GMAC_INTLEN == 8 183 for (i = 0; i < GMAC_DIGEST_LEN/8; i++) { 184 d[0] = (uint8_t)(ctx->ghash.S[i] >> 56) ^ k[0]; 185 d[1] = (uint8_t)(ctx->ghash.S[i] >> 48) ^ k[1]; 186 d[2] = (uint8_t)(ctx->ghash.S[i] >> 40) ^ k[2]; 187 d[3] = (uint8_t)(ctx->ghash.S[i] >> 32) ^ k[3]; 188 d[4] = (uint8_t)(ctx->ghash.S[i] >> 24) ^ k[4]; 189 d[5] = (uint8_t)(ctx->ghash.S[i] >> 16) ^ k[5]; 190 d[6] = (uint8_t)(ctx->ghash.S[i] >> 8) ^ k[6]; 191 d[7] = (uint8_t)ctx->ghash.S[i] ^ k[7]; 192 d += 8; 193 k += 8; 194 } 195 #else 196 for (i = 0; i < GMAC_DIGEST_LEN/4; i++) { 197 d[0] = (uint8_t)(ctx->ghash.S[i] >> 24) ^ k[0]; 198 d[1] = (uint8_t)(ctx->ghash.S[i] >> 16) ^ k[1]; 199 d[2] = (uint8_t)(ctx->ghash.S[i] >> 8) ^ k[2]; 200 d[3] = (uint8_t)ctx->ghash.S[i] ^ k[3]; 201 d += 4; 202 k += 4; 203 } 204 #endif 205 memset(keystream, 0, sizeof(keystream)); 206 } 207
Indexes created Sat Sep 20 22:09:52 GMT 2025