1 /* $NetBSD: gmac.c,v 1.4 2020/06/29 23:34:48 riastradh Exp $ */
2 /* OpenBSD: gmac.c,v 1.3 2011/01/11 15:44:23 deraadt Exp */
3
4 /*
5 * Copyright (c) 2010 Mike Belopuhov <mike@vantronix.net>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20 /*
21 * This code implements the Message Authentication part of the
22 * Galois/Counter Mode (as being described in the RFC 4543) using
23 * the AES cipher. FIPS SP 800-38D describes the algorithm details.
24 */
25
26 #include <sys/param.h>
27 #include <sys/systm.h>
28
29 #include <crypto/aes/aes.h>
30
31 #include <opencrypto/gmac.h>
32
33 void ghash_gfmul(const GMAC_INT *, const GMAC_INT *, GMAC_INT *);
34 void ghash_update(GHASH_CTX *, const uint8_t *, size_t);
35
36 /* Computes a block multiplication in the GF(2^128) */
37 void
ghash_gfmul(const GMAC_INT * X,const GMAC_INT * Y,GMAC_INT * product)38 ghash_gfmul(const GMAC_INT *X, const GMAC_INT *Y, GMAC_INT *product)
39 {
40 GMAC_INT v[GMAC_BLOCK_LEN/GMAC_INTLEN];
41 uint32_t mul;
42 int i;
43
44 memcpy(v, Y, GMAC_BLOCK_LEN);
45 memset(product, 0, GMAC_BLOCK_LEN);
46
47 for (i = 0; i < GMAC_BLOCK_LEN * 8; i++) {
48 /* update Z */
49 #if GMAC_INTLEN == 8
50 if (X[i >> 6] & (1ULL << (~i & 63))) {
51 product[0] ^= v[0];
52 product[1] ^= v[1];
53 } /* else: we preserve old values */
54 #else
55 if (X[i >> 5] & (1 << (~i & 31))) {
56 product[0] ^= v[0];
57 product[1] ^= v[1];
58 product[2] ^= v[2];
59 product[3] ^= v[3];
60 } /* else: we preserve old values */
61 #endif
62 /* update V */
63 #if GMAC_INTLEN == 8
64 mul = v[1] & 1;
65 v[1] = (v[0] << 63) | (v[1] >> 1);
66 v[0] = (v[0] >> 1) ^ (0xe100000000000000ULL * mul);
67 #else
68 mul = v[3] & 1;
69 v[3] = (v[2] << 31) | (v[3] >> 1);
70 v[2] = (v[1] << 31) | (v[2] >> 1);
71 v[1] = (v[0] << 31) | (v[1] >> 1);
72 v[0] = (v[0] >> 1) ^ (0xe1000000 * mul);
73 #endif
74 }
75 }
76
77 void
ghash_update(GHASH_CTX * ctx,const uint8_t * X,size_t len)78 ghash_update(GHASH_CTX *ctx, const uint8_t *X, size_t len)
79 {
80 GMAC_INT x;
81 GMAC_INT *s = ctx->S;
82 GMAC_INT *y = ctx->Z;
83 int i, j, k;
84
85 for (i = 0; i < len / GMAC_BLOCK_LEN; i++) {
86 for (j = 0; j < GMAC_BLOCK_LEN/GMAC_INTLEN; j++) {
87 x = 0;
88 for (k = 0; k < GMAC_INTLEN; k++) {
89 x <<= 8;
90 x |= X[k];
91 }
92 s[j] = y[j] ^ x;
93 X += GMAC_INTLEN;
94 }
95
96 ghash_gfmul(ctx->H, ctx->S, ctx->S);
97
98 y = s;
99 }
100
101 memcpy(ctx->Z, ctx->S, GMAC_BLOCK_LEN);
102 }
103
104 #define AESCTR_NONCESIZE 4
105
106 void
AES_GMAC_Init(AES_GMAC_CTX * ctx)107 AES_GMAC_Init(AES_GMAC_CTX *ctx)
108 {
109
110 memset(ctx, 0, sizeof(AES_GMAC_CTX));
111 }
112
113 void
AES_GMAC_Setkey(AES_GMAC_CTX * ctx,const uint8_t * key,uint16_t klen)114 AES_GMAC_Setkey(AES_GMAC_CTX *ctx, const uint8_t *key, uint16_t klen)
115 {
116 int i;
117
118 switch (klen) {
119 case 16 + AESCTR_NONCESIZE:
120 ctx->rounds = aes_setenckey128(&ctx->K, key);
121 break;
122 case 24 + AESCTR_NONCESIZE:
123 ctx->rounds = aes_setenckey192(&ctx->K, key);
124 break;
125 case 32 + AESCTR_NONCESIZE:
126 ctx->rounds = aes_setenckey256(&ctx->K, key);
127 break;
128 default:
129 panic("invalid AES_GMAC_Setkey length in bytes: %u",
130 (unsigned)klen);
131 }
132 /* copy out salt to the counter block */
133 memcpy(ctx->J, key + klen - AESCTR_NONCESIZE, AESCTR_NONCESIZE);
134 /* prepare a hash subkey */
135 aes_enc(&ctx->K, (const void *)ctx->ghash.H, (void *)ctx->ghash.H,
136 ctx->rounds);
137 #if GMAC_INTLEN == 8
138 for (i = 0; i < 2; i++)
139 ctx->ghash.H[i] = be64toh(ctx->ghash.H[i]);
140 #else
141 for (i = 0; i < 4; i++)
142 ctx->ghash.H[i] = be32toh(ctx->ghash.H[i]);
143 #endif
144 }
145
146 void
AES_GMAC_Reinit(AES_GMAC_CTX * ctx,const uint8_t * iv,uint16_t ivlen)147 AES_GMAC_Reinit(AES_GMAC_CTX *ctx, const uint8_t *iv, uint16_t ivlen)
148 {
149 /* copy out IV to the counter block */
150 memcpy(ctx->J + AESCTR_NONCESIZE, iv, ivlen);
151 }
152
153 int
AES_GMAC_Update(AES_GMAC_CTX * ctx,const uint8_t * data,uint16_t len)154 AES_GMAC_Update(AES_GMAC_CTX *ctx, const uint8_t *data, uint16_t len)
155 {
156 uint8_t blk[16] = { 0 };
157 int plen;
158
159 if (len > 0) {
160 plen = len % GMAC_BLOCK_LEN;
161 if (len >= GMAC_BLOCK_LEN)
162 ghash_update(&ctx->ghash, data, len - plen);
163 if (plen) {
164 memcpy(blk, data + (len - plen), plen);
165 ghash_update(&ctx->ghash, blk, GMAC_BLOCK_LEN);
166 }
167 }
168 return (0);
169 }
170
171 void
AES_GMAC_Final(uint8_t digest[GMAC_DIGEST_LEN],AES_GMAC_CTX * ctx)172 AES_GMAC_Final(uint8_t digest[GMAC_DIGEST_LEN], AES_GMAC_CTX *ctx)
173 {
174 uint8_t keystream[GMAC_BLOCK_LEN], *k, *d;
175 int i;
176
177 /* do one round of GCTR */
178 ctx->J[GMAC_BLOCK_LEN - 1] = 1;
179 aes_enc(&ctx->K, ctx->J, keystream, ctx->rounds);
180 k = keystream;
181 d = digest;
182 #if GMAC_INTLEN == 8
183 for (i = 0; i < GMAC_DIGEST_LEN/8; i++) {
184 d[0] = (uint8_t)(ctx->ghash.S[i] >> 56) ^ k[0];
185 d[1] = (uint8_t)(ctx->ghash.S[i] >> 48) ^ k[1];
186 d[2] = (uint8_t)(ctx->ghash.S[i] >> 40) ^ k[2];
187 d[3] = (uint8_t)(ctx->ghash.S[i] >> 32) ^ k[3];
188 d[4] = (uint8_t)(ctx->ghash.S[i] >> 24) ^ k[4];
189 d[5] = (uint8_t)(ctx->ghash.S[i] >> 16) ^ k[5];
190 d[6] = (uint8_t)(ctx->ghash.S[i] >> 8) ^ k[6];
191 d[7] = (uint8_t)ctx->ghash.S[i] ^ k[7];
192 d += 8;
193 k += 8;
194 }
195 #else
196 for (i = 0; i < GMAC_DIGEST_LEN/4; i++) {
197 d[0] = (uint8_t)(ctx->ghash.S[i] >> 24) ^ k[0];
198 d[1] = (uint8_t)(ctx->ghash.S[i] >> 16) ^ k[1];
199 d[2] = (uint8_t)(ctx->ghash.S[i] >> 8) ^ k[2];
200 d[3] = (uint8_t)ctx->ghash.S[i] ^ k[3];
201 d += 4;
202 k += 4;
203 }
204 #endif
205 memset(keystream, 0, sizeof(keystream));
206 }
207