3 * The GCM authenticated encryption mode
5 * (c) 2018 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software: you can redistribute it and/or modify it
13 * under the terms of the GNU Library General Public License as published
14 * by the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb. If not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
28 #ifndef CATACOMB_GCM_DEF_H
29 #define CATACOMB_GCM_DEF_H
35 /*----- Header files ------------------------------------------------------*/
39 #include <mLib/bits.h>
42 #ifndef CATACOMB_ARENA_H
46 #ifndef CATACOMB_BLKC_H
54 #ifndef CATACOMB_KEYSZ_H
58 #ifndef CATACOMB_PARANOIA_H
59 # include "paranoia.h"
62 #ifndef CATACOMB_RSVR_H
66 /*----- Type definitions --------------------------------------------------*/
68 typedef struct gcm_params
{
69 unsigned f
; /* flags */
70 #define GCMF_SWAP 1u /* swap byte order? */
71 unsigned n
; /* number of words in block */
72 uint32 poly
; /* selected polynomial mask */
75 /*----- Utilities ---------------------------------------------------------*/
77 /* Supported block sizes. */
78 #define GCM_WIDTHS(_) _(64) _(96) _(128) _(192) _(256)
81 /* Polynomial tails for the supported block sizes. */
82 #define GCM_POLY_64 0xd8000000
83 #define GCM_POLY_96 0x82600000
84 #define GCM_POLY_128 0xe1000000
85 #define GCM_POLY_192 0xe1000000
86 #define GCM_POLY_256 0xa4200000
88 /* Determine whether to set the @GCMF_SWAP@ flag. */
89 #define GCM_SWAP_L GCMF_SWAP
92 /* --- @gcm_mktable@ --- *
94 * Arguments: @const gcm_params *p@ = pointer to the parameters
95 * @uint32 *ktab@ = where to write the table; there must be
96 * space for %$32 n$% $%n$%-word entries, i.e.,
97 * %$32 n^2$% 32-bit words in total, where %$n$% is
98 * @p->n@, the block size in words
99 * @const uint32 *k@ = input field element
103 * Use: Construct a table for use by @gcm_mulk_...@ below, to
104 * multiply (vaguely) efficiently by @k@.
107 extern void gcm_mktable(const gcm_params */
*p*/
,
108 uint32 */
*ktab*/
, const uint32 */
*k*/
);
110 /* --- @gcm_mulk_N@ --- *
112 * Arguments: @uint32 *a@ = accumulator to multiply
113 * @const uint32 *ktab@ = table constructed by @gcm_mktable@
117 * Use: Multiply @a@ by @k@ (implicitly represented in @ktab@),
118 * updating @a@ in-place. There are separate functions for each
119 * supported block size because this is the function whose
120 * performance actually matters.
123 #define GCM_DECL_MULK(nbits) \
124 extern void gcm_mulk_##nbits(uint32 */*a*/, const uint32 */*ktab*/);
125 GCM_WIDTHS(GCM_DECL_MULK
)
128 /* Dispatch to the appropriate variant of @gcm_mulk@. */
129 #define GCM_MULK(PRE, a, ktab) BLKC_GLUE(gcm_mulk_, BLKC_BITS(PRE))(a, ktab)
131 /* --- @gcm_ghashdone@ --- *
133 * Arguments: @const gcm_params *p@ = pointer to the parameters
134 * @uint32 *a@ = GHASH accumulator
135 * @const uint32 *ktab@ = multiplication table, built by
137 * @unsigned long xblocks, yblocks@ = number of whole blocks in
139 * @unsigned xbytes, ybytes@ = number of trailing bytes in the
144 * Use: Finishes a GHASH operation by appending the appropriately
145 * encoded lengths of the two constituent messages.
148 extern void gcm_ghashdone(const gcm_params */
*p*/
,
149 uint32 */
*a*/
, const uint32 */
*ktab*/
,
150 unsigned long /*xblocks*/, unsigned /*xbytes*/,
151 unsigned long /*yblocks*/, unsigned /*ybytes*/);
153 /* --- @gcm_concat@ --- *
155 * Arguments: @const gcm_params *p@ = pointer to the parameters
156 * @uint32 *z@ = GHASH accumulator for suffix, updated
157 * @const uint32 *x@ = GHASH accumulator for prefix
158 * @const uint32 *ktab@ = multiplication table, built by
160 * @unsigned long n@ = length of suffix in whole blocks
164 * Use: On entry, @x@ and @z@ are the results of hashing two strings
165 * %$a$% and %$b$%, each a whole number of blocks long; in
166 * particular, %$b$% is @n@ blocks long. On exit, @z@ is
167 * updated to be the hash of %$a \cat b$%.
170 extern void gcm_concat(const gcm_params */
*p*/
,
171 uint32 */
*z*/
, const uint32 */
*x*/
,
172 const uint32 */
*ktab*/
, unsigned long /*n*/);
174 /* Step the counter using GCM's strange only-the-last-32-bits convention. */
175 #define GCM_STEP(PRE, w) BLKC_GLUE(GCM_STEP_, BLKC_ENDIAN(PRE))(PRE, w)
176 #define GCM_STEP_B(PRE, w) GCM_STEP_X(PRE, BLKC_ID, w)
177 #define GCM_STEP_L(PRE, w) GCM_STEP_X(PRE, ENDSWAP32, w)
178 #define GCM_STEP_X(PRE, op, w) do { \
180 _w[PRE##_BLKSZ/4 - 1] = op(op(_w[PRE##_BLKSZ/4 - 1]) + 1); \
183 /*----- Macros ------------------------------------------------------------*/
185 /* --- @GCM_DEF@ --- *
187 * Arguments: @PRE@, @pre@ = prefixes for the underlying block cipher
189 * Use: Creates an implementation for the GCM authenticated-
193 #define GCM_DEF(PRE, pre) GCM_DEFX(PRE, pre, #pre, #pre)
195 #define GCM_DEFX(PRE, pre, name, fname) \
197 static const gcm_params pre##_gcmparams = { \
198 BLKC_GLUE(GCM_SWAP_, BLKC_ENDIAN(PRE)), \
200 BLKC_GLUE(GCM_POLY_, BLKC_BITS(PRE)) \
204 pre##_gcmnoncesz[] = { KSZ_ANY, PRE##_BLKSZ - 4 }, \
205 pre##_gcmtagsz[] = { KSZ_RANGE, PRE##_BLKSZ, 0, PRE##_BLKSZ, 1 }; \
207 static const rsvr_policy pre##_gcmpolicy = { 0, PRE##_BLKSZ, PRE##_BLKSZ }; \
209 /* --- @pre_gcmsetkey@ --- * \
211 * Arguments: @pre_gcmkey *key@ = pointer to key block to fill in \
212 * @const void *k@ = pointer to key material \
213 * @size_t ksz@ = size of key material \
217 * Use: Initializes an GCM key block. \
220 void pre##_gcmsetkey(pre##_gcmkey *key, const void *k, size_t ksz) \
222 uint32 t[PRE##_BLKSZ/4]; \
224 /* Initialize the block cipher. */ \
225 pre##_init(&key->ctx, k, ksz); \
227 /* Set up the GHASH multiplication table. */ \
228 BLKC_ZERO(PRE, t); pre##_eblk(&key->ctx, t, t); \
229 gcm_mktable(&pre##_gcmparams, key->ktab, t); \
232 /* --- @pre_gcmaadinit@ --- * \
234 * Arguments: @pre_gcmaadctx *aad@ = pointer to AAD context \
235 * @const pre_gcmkey *key@ = pointer to key block \
239 * Use: Initializes an GCM AAD (`additional authenticated \
240 * data') context associated with a given key. AAD \
241 * contexts can be copied and/or reused, saving time if \
242 * the AAD for a number of messages has a common prefix. \
244 * The @key@ doesn't need to be kept around, though \
245 * usually there'll at least be another copy in some GCM \
246 * operation context because the AAD on its own isn't much \
250 void pre##_gcmaadinit(pre##_gcmaadctx *aad, const pre##_gcmkey *key) \
251 { aad->k = *key; aad->off = 0; aad->len = 0; BLKC_ZERO(PRE, aad->a); } \
253 /* --- @pre_gcmaadhash@ --- * \
255 * Arguments: @pre_gcmaadctx *aad@ = pointer to AAD context \
256 * @const void *p@ = pointer to AAD material \
257 * @size_t sz@ = length of AAD material \
261 * Use: Feeds AAD into the context. \
264 void pre##_gcmaadhash(pre##_gcmaadctx *aad, const void *p, size_t sz) \
269 rsvr_setup(&st, &pre##_gcmpolicy, aad->b, &aad->off, p, sz); \
270 RSVR_DO(&st) while ((q = RSVR_NEXT(&st, PRE##_BLKSZ)) != 0) { \
271 BLKC_XLOAD(PRE, aad->a, q); GCM_MULK(PRE, aad->a, aad->k.ktab); \
276 /* --- @pre_gcminit@ --- * \
278 * Arguments: @pre_gcmctx *ctx@ = pointer to GCM context \
279 * @const pre_gcmkey *key@ = pointer to key block \
280 * @const void *n@ = pointer to nonce \
281 * @size_t nsz@ = size of nonce \
285 * Use: Initialize an GCM operation context with a given key. \
287 * The original key needn't be kept around any more. \
290 void pre##_gcminit(pre##_gcmctx *ctx, const pre##_gcmkey *k, \
291 const void *n, size_t nsz) \
292 { ctx->k = *k; pre##_gcmreinit(ctx, n, nsz); } \
294 /* --- @pre_gcmreinit@ --- * \
296 * Arguments: @pre_gcmctx *ctx@ = pointer to GCM context \
297 * @const void *n@ = pointer to nonce \
298 * @size_t nsz@ = size of nonce \
302 * Use: Reinitialize an GCM operation context, changing the \
306 void pre##_gcmreinit(pre##_gcmctx *ctx, const void *n, size_t nsz) \
308 octet b[PRE##_BLKSZ]; \
309 const octet *q = n; \
313 /* Zero the counters. */ \
314 ctx->off = 0; ctx->len = 0; \
315 BLKC_ZERO(PRE, ctx->a); \
317 /* Calculate the initial counter from the nonce. */ \
318 if (nsz == PRE##_BLKSZ - 4) { \
319 /* Easy version: initialize the final word to 1 and copy the \
320 * remaining words from the nonce. (The spec shows the nonce and \
321 * counter the other way around for 64-bit block ciphers, but I'm \
322 * sure this is just a mistake.) \
325 for (i = 0; i < PRE##_BLKSZ/4 - 1; i++) \
326 { ctx->c0[i] = BLKC_LOAD_E(PRE)(q); q += 4; } \
327 ctx->c0[PRE##_BLKSZ/4 - 1] = BLKC_BWORD(PRE, 1); \
329 /* Harder version: hash the nonce down with GHASH. */ \
331 BLKC_ZERO(PRE, ctx->c0); nblocks = 0; \
332 while (nsz >= PRE##_BLKSZ) { \
333 BLKC_XLOAD(PRE, ctx->c0, q); q += PRE##_BLKSZ; \
334 GCM_MULK(PRE, ctx->c0, ctx->k.ktab); \
335 nsz -= PRE##_BLKSZ; nblocks++; \
338 memcpy(b, q, nsz); memset(b + nsz, 0, PRE##_BLKSZ - nsz); \
339 BLKC_XLOAD(PRE, ctx->c0, b); \
340 GCM_MULK(PRE, ctx->c0, ctx->k.ktab); \
342 gcm_ghashdone(&pre##_gcmparams, ctx->c0, ctx->k.ktab, \
343 0, 0, nblocks, nsz); \
346 /* We must remember the initial counter for the final tag \
347 * calculation. (I conjecture that storing the final counter instead \
348 * would be just as secure, and require less state, but I've not \
349 * proven this, and anyway it wouldn't interoperate.) Copy it to \
350 * make the working counter. \
352 BLKC_MOVE(PRE, ctx->c, ctx->c0); \
355 /* --- @pre_gcmencrypt@ --- * \
357 * Arguments: @pre_gcmctx *ctx@ = pointer to GCM operation context \
358 * @const void *src@ = pointer to plaintext message chunk \
359 * @size_t sz@ = size of the plaintext \
360 * @buf *dst@ = a buffer to write the ciphertext to \
362 * Returns: Zero on success; @-1@ on failure. \
364 * Use: Encrypts a chunk of a plaintext message, writing a \
365 * chunk of ciphertext to the output buffer and updating \
366 * the operation state. \
368 * For GCM, we always write a ciphertext chunk the same \
369 * size as the plaintext. The messing about with @buf@ \
370 * objects makes the interface consistent with other AEAD \
371 * schemes which can't do this. \
374 int pre##_gcmencrypt(pre##_gcmctx *ctx, \
375 const void *src, size_t sz, buf *dst) \
378 uint32 t[PRE##_BLKSZ/4]; \
379 const octet *p = src; \
382 /* Allocate space for the ciphertext. */ \
383 if (sz) { q = buf_get(dst, sz); if (!q) return (-1); } \
386 /* Determine the buffering plan. Our buffer is going to do double- \
387 * duty here. The end portion is going to contain mask from the \
388 * encrypted counter which we mix into the plaintext to encrypt it; \
389 * the start portion, which originally mask bytes we've already used, \
390 * will hold the output ciphertext, which will eventually be \
391 * collected into the GHASH state. \
393 rsvr_mkplan(&plan, &pre##_gcmpolicy, ctx->off, sz); \
395 /* Initial portion, fulfilled from the buffer. If the buffer is \
396 * empty, then that means that we haven't yet encrypted the current \
397 * counter, so we should do that and advance it. \
401 GCM_STEP(PRE, ctx->c); pre##_eblk(&ctx->k.ctx, ctx->c, t); \
402 BLKC_STORE(PRE, ctx->b, t); \
404 r = ctx->b + ctx->off; ctx->off += plan.head; \
405 while (plan.head--) { y = *p++ ^ *r; *r++ = *q++ = y; } \
408 /* If we've filled up the buffer then we need to cycle the MAC and \
409 * reset the offset. \
411 if (plan.from_rsvr) { \
412 BLKC_XLOAD(PRE, ctx->a, ctx->b); GCM_MULK(PRE, ctx->a, ctx->k.ktab); \
413 ctx->len++; ctx->off = 0; \
416 /* Now to process the main body of the input. */ \
417 while (plan.from_input) { \
418 GCM_STEP(PRE, ctx->c); pre##_eblk(&ctx->k.ctx, ctx->c, t); \
419 BLKC_XLOAD(PRE, t, p); p += PRE##_BLKSZ; \
420 BLKC_STORE(PRE, q, t); q += PRE##_BLKSZ; \
421 BLKC_XMOVE(PRE, ctx->a, t); GCM_MULK(PRE, ctx->a, ctx->k.ktab); \
422 plan.from_input -= PRE##_BLKSZ; ctx->len++; \
425 /* Finally, deal with any final portion. If there is one, we know \
426 * that the buffer is empty: we must have filled it above, or this \
427 * would all count as `initial' data. \
430 GCM_STEP(PRE, ctx->c); pre##_eblk(&ctx->k.ctx, ctx->c, t); \
431 BLKC_STORE(PRE, ctx->b, t); \
432 r = ctx->b; ctx->off += plan.tail; \
433 while (plan.tail--) { y = *p++ ^ *r; *r++ = *q++ = y; } \
436 /* And we're done. */ \
440 /* --- @pre_gcmdecrypt@ --- * \
442 * Arguments: @pre_gcmctx *ctx@ = pointer to GCM operation context \
443 * @const void *src@ = pointer to ciphertext message chunk \
444 * @size_t sz@ = size of the ciphertext \
445 * @buf *dst@ = a buffer to write the plaintext to \
447 * Returns: Zero on success; @-1@ on failure. \
449 * Use: Decrypts a chunk of a ciphertext message, writing a \
450 * chunk of plaintext to the output buffer and updating \
451 * the operation state. \
453 * For GCM, we always write a plaintext chunk the same \
454 * size as the ciphertext. The messing about with @buf@ \
455 * objects makes the interface consistent with other AEAD \
456 * schemes which can't do this. \
459 int pre##_gcmdecrypt(pre##_gcmctx *ctx, \
460 const void *src, size_t sz, buf *dst) \
463 uint32 t[PRE##_BLKSZ/4], u[PRE##_BLKSZ]; \
464 const octet *p = src; \
467 /* Allocate space for the plaintext. */ \
468 if (sz) { q = buf_get(dst, sz); if (!q) return (-1); } \
471 /* Determine the buffering plan. Our buffer is going to do double- \
472 * duty here. The end portion is going to contain mask from the \
473 * encrypted counter which we mix into the plaintext to encrypt it; \
474 * the start portion, which originally mask bytes we've already used, \
475 * will hold the input ciphertext, which will eventually be \
476 * collected into the GHASH state. \
478 rsvr_mkplan(&plan, &pre##_gcmpolicy, ctx->off, sz); \
480 /* Initial portion, fulfilled from the buffer. If the buffer is \
481 * empty, then that means that we haven't yet encrypted the current \
482 * counter, so we should do that and advance it. \
486 GCM_STEP(PRE, ctx->c); pre##_eblk(&ctx->k.ctx, ctx->c, t); \
487 BLKC_STORE(PRE, ctx->b, t); \
489 r = ctx->b + ctx->off; ctx->off += plan.head; \
490 while (plan.head--) { y = *p++; *q++ = y ^ *r; *r++ = y; } \
493 /* If we've filled up the buffer then we need to cycle the MAC and \
494 * reset the offset. \
496 if (plan.from_rsvr) { \
497 BLKC_XLOAD(PRE, ctx->a, ctx->b); GCM_MULK(PRE, ctx->a, ctx->k.ktab); \
498 ctx->len++; ctx->off = 0; \
501 /* Now to process the main body of the input. */ \
502 while (plan.from_input) { \
503 GCM_STEP(PRE, ctx->c); pre##_eblk(&ctx->k.ctx, ctx->c, t); \
504 BLKC_LOAD(PRE, u, p); p += PRE##_BLKSZ; \
505 BLKC_XSTORE(PRE, q, t, u); q += PRE##_BLKSZ; \
506 BLKC_XMOVE(PRE, ctx->a, u); GCM_MULK(PRE, ctx->a, ctx->k.ktab); \
507 plan.from_input -= PRE##_BLKSZ; ctx->len++; \
510 /* Finally, deal with any final portion. If there is one, we know \
511 * that the buffer is empty: we must have filled it above, or this \
512 * would all count as `initial' data. \
515 GCM_STEP(PRE, ctx->c); pre##_eblk(&ctx->k.ctx, ctx->c, t); \
516 BLKC_STORE(PRE, ctx->b, t); \
517 r = ctx->b; ctx->off += plan.tail; \
518 while (plan.tail--) { y = *p++; *q++ = y ^ *r; *r++ = y; } \
521 /* And we're done. */ \
525 /* --- @pre_gcmtag@ --- * \
527 * Arguments: @pre_gcmctx *ctx@ = pointer to an GCM context \
528 * @const pre_gcmaadctx *aad@ = pointer to AAD context, or \
530 * @octet *t@ = where to write a (full-length) tag \
534 * Use: Finishes an GCM operation, by calculating the tag. \
537 static void pre##_gcmtag(pre##_gcmctx *ctx, \
538 const pre##_gcmaadctx *aad, octet *t) \
540 octet b[PRE##_BLKSZ]; \
541 uint32 u[PRE##_BLKSZ/4]; \
544 /* Finish tagging the ciphertext. */ \
546 memcpy(b, ctx->b, ctx->off); \
547 memset(b + ctx->off, 0, PRE##_BLKSZ - ctx->off); \
548 BLKC_XLOAD(PRE, ctx->a, b); GCM_MULK(PRE, ctx->a, ctx->k.ktab); \
551 /* If there's no AAD, because the pointer is null or no data was \
552 * supplied, then apply that to the GHASH state. (Otherwise there's \
553 * nothing to do here.) \
555 if (aad && (aad->len || aad->off)) { \
556 BLKC_MOVE(PRE, u, aad->a); \
558 memcpy(b, aad->b, aad->off); \
559 memset(b + aad->off, 0, PRE##_BLKSZ - aad->off); \
560 BLKC_XLOAD(PRE, u, b); GCM_MULK(PRE, u, ctx->k.ktab); \
562 n = ctx->len; if (ctx->off) n++; \
563 gcm_concat(&pre##_gcmparams, ctx->a, u, ctx->k.ktab, n); \
566 /* Finish off the hash by appending the length. */ \
567 gcm_ghashdone(&pre##_gcmparams, ctx->a, ctx->k.ktab, \
568 aad ? aad->len : 0, aad ? aad->off : 0, \
569 ctx->len, ctx->off); \
571 /* Mask the hash and store. */ \
572 pre##_eblk(&ctx->k.ctx, ctx->c0, u); \
573 BLKC_XSTORE(PRE, t, ctx->a, u); \
576 /* --- @pre_gcmencryptdone@ --- * \
578 * Arguments: @pre_gcmctx *ctx@ = pointer to an GCM context \
579 * @const pre_gcmaadctx *aad@ = pointer to AAD context, or \
581 * @buf *dst@ = buffer for remaining ciphertext \
582 * @void *tag@ = where to write the tag \
583 * @size_t tsz@ = length of tag to store \
585 * Returns: Zero on success; @-1@ on failure. \
587 * Use: Completes an GCM encryption operation. The @aad@ \
588 * pointer may be null if there is no additional \
589 * authenticated data. GCM doesn't buffer ciphertext, but \
590 * the output buffer is provided anyway for consistency \
591 * with other AEAD schemes which don't have this property; \
592 * the function will fail if the output buffer is broken. \
595 int pre##_gcmencryptdone(pre##_gcmctx *ctx, \
596 const pre##_gcmaadctx *aad, buf *dst, \
597 void *tag, size_t tsz) \
599 octet t[PRE##_BLKSZ]; \
601 if (tsz > PRE##_BLKSZ) return (-1); \
602 if (!BOK(dst)) return (-1); \
603 pre##_gcmtag(ctx, aad, t); memcpy(tag, t, tsz); \
607 /* --- @pre_gcmdecryptdone@ --- * \
609 * Arguments: @pre_gcmctx *ctx@ = pointer to an GCM context \
610 * @const pre_gcmaadctx *aad@ = pointer to AAD context, or \
612 * @buf *dst@ = buffer for remaining plaintext \
613 * @const void *tag@ = tag to verify \
614 * @size_t tsz@ = length of tag \
616 * Returns: @+1@ for complete success; @0@ if tag verification \
617 * failed; @-1@ for other kinds of errors. \
619 * Use: Completes an GCM decryption operation. The @aad@ \
620 * pointer may be null if there is no additional \
621 * authenticated data. GCM doesn't buffer plaintext, but \
622 * the output buffer is provided anyway for consistency \
623 * with other AEAD schemes which don't have this property; \
624 * the function will fail if the output buffer is broken. \
627 int pre##_gcmdecryptdone(pre##_gcmctx *ctx, \
628 const pre##_gcmaadctx *aad, buf *dst, \
629 const void *tag, size_t tsz) \
631 octet t[PRE##_BLKSZ]; \
633 if (tsz > PRE##_BLKSZ) return (-1); \
634 if (!BOK(dst)) return (-1); \
635 pre##_gcmtag(ctx, aad, t); \
636 if (!ct_memeq(tag, t, tsz)) return (0); \
640 /* --- Generic AEAD interface --- */ \
642 typedef struct gactx { \
644 pre##_gcmaadctx aad; \
647 static gaead_aad *gadup(const gaead_aad *a) \
648 { gactx *aad = S_CREATE(gactx); *aad = *(gactx *)a; return (&aad->a); } \
650 static void gahash(gaead_aad *a, const void *h, size_t hsz) \
651 { gactx *aad = (gactx *)a; pre##_gcmaadhash(&aad->aad, h, hsz); } \
653 static void gadestroy(gaead_aad *a) \
654 { gactx *aad = (gactx *)a; BURN(*aad); S_DESTROY(aad); } \
656 static const gaead_aadops gaops = \
657 { &pre##_gcm, gadup, gahash, gadestroy }; \
659 static gaead_aad *gaad(const pre##_gcmkey *k) \
661 gactx *aad = S_CREATE(gactx); \
662 aad->a.ops = &gaops; \
663 pre##_gcmaadinit(&aad->aad, k); \
667 typedef struct gectx { \
672 static gaead_aad *geaad(gaead_enc *e) \
673 { gectx *enc = (gectx *)e; return (gaad(&enc->ctx.k)); } \
675 static int gereinit(gaead_enc *e, const void *n, size_t nsz, \
676 size_t hsz, size_t msz, size_t tsz) \
678 gectx *enc = (gectx *)e; \
680 if (tsz > PRE##_BLKSZ) return (-1); \
681 pre##_gcmreinit(&enc->ctx, n, nsz); \
685 static int geenc(gaead_enc *e, const void *m, size_t msz, buf *b) \
687 gectx *enc = (gectx *)e; \
688 return (pre##_gcmencrypt(&enc->ctx, m, msz, b)); \
691 static int gedone(gaead_enc *e, const gaead_aad *a, \
692 buf *b, void *t, size_t tsz) \
694 gectx *enc = (gectx *)e; gactx *aad = (gactx *)a; \
695 assert(!a || a->ops == &gaops); \
696 return (pre##_gcmencryptdone(&enc->ctx, a ? &aad->aad : 0, b, t, tsz)); \
699 static void gedestroy(gaead_enc *e) \
700 { gectx *enc = (gectx *)e; BURN(*enc); S_DESTROY(enc); } \
702 static const gaead_encops geops = \
703 { &pre##_gcm, geaad, gereinit, geenc, gedone, gedestroy }; \
705 typedef struct gdctx { \
710 static gaead_aad *gdaad(gaead_dec *d) \
711 { gdctx *dec = (gdctx *)d; return (gaad(&dec->ctx.k)); } \
713 static int gdreinit(gaead_dec *d, const void *n, size_t nsz, \
714 size_t hsz, size_t csz, size_t tsz) \
716 gdctx *dec = (gdctx *)d; \
718 if (tsz > PRE##_BLKSZ) return (-1); \
719 pre##_gcmreinit(&dec->ctx, n, nsz); \
723 static int gddec(gaead_dec *d, const void *c, size_t csz, buf *b) \
725 gdctx *dec = (gdctx *)d; \
726 return (pre##_gcmdecrypt(&dec->ctx, c, csz, b)); \
729 static int gddone(gaead_dec *d, const gaead_aad *a, \
730 buf *b, const void *t, size_t tsz) \
732 gdctx *dec = (gdctx *)d; gactx *aad = (gactx *)a; \
733 assert(!a || a->ops == &gaops); \
734 return (pre##_gcmdecryptdone(&dec->ctx, a ? &aad->aad : 0, b, t, tsz)); \
737 static void gddestroy(gaead_dec *d) \
738 { gdctx *dec = (gdctx *)d; BURN(*dec); S_DESTROY(dec); } \
740 static const gaead_decops gdops = \
741 { &pre##_gcm, gdaad, gdreinit, gddec, gddone, gddestroy }; \
743 typedef struct gkctx { \
748 static gaead_aad *gkaad(const gaead_key *k) \
749 { gkctx *key = (gkctx *)k; return (gaad(&key->key)); } \
751 static gaead_enc *gkenc(const gaead_key *k, const void *n, size_t nsz, \
752 size_t hsz, size_t msz, size_t tsz) \
754 gkctx *key = (gkctx *)k; \
755 gectx *enc = S_CREATE(gectx); \
757 enc->e.ops = &geops; \
758 pre##_gcminit(&enc->ctx, &key->key, n, nsz); \
762 static gaead_dec *gkdec(const gaead_key *k, const void *n, size_t nsz, \
763 size_t hsz, size_t csz, size_t tsz) \
765 gkctx *key = (gkctx *)k; \
766 gdctx *dec = S_CREATE(gdctx); \
768 dec->d.ops = &gdops; \
769 pre##_gcminit(&dec->ctx, &key->key, n, nsz); \
773 static void gkdestroy(gaead_key *k) \
774 { gkctx *key = (gkctx *)k; BURN(*key); S_DESTROY(key); } \
776 static const gaead_keyops gkops = \
777 { &pre##_gcm, gkaad, gkenc, gkdec, gkdestroy }; \
779 static gaead_key *gckey(const void *k, size_t ksz) \
781 gkctx *key = S_CREATE(gkctx); \
782 key->k.ops = &gkops; \
783 pre##_gcmsetkey(&key->key, k, ksz); \
787 const gcaead pre##_gcm = { \
789 pre##_keysz, pre##_gcmnoncesz, pre##_gcmtagsz, \
790 PRE##_BLKSZ, 0, 0, 0, \
794 GCM_TESTX(PRE, pre, name, fname)
796 /*----- Test rig ----------------------------------------------------------*/
798 #define GCM_TEST(PRE, pre) GCM_TESTX(PRE, pre, #pre, #pre)
800 /* --- @GCM_TEST@ --- *
802 * Arguments: @PRE, pre@ = prefixes for the underlying block cipher
804 * Use: Standard test rig for GCM functions.
811 #include <mLib/dstr.h>
812 #include <mLib/quis.h>
813 #include <mLib/testrig.h>
815 #define GCM_TESTX(PRE, pre, name, fname) \
817 static int gcmverify(dstr *v) \
820 pre##_gcmaadctx aad; \
825 int szs[] = { 1, 7, 192, -1, 0 }, *ip; \
827 dstr d = DSTR_INIT, t = DSTR_INIT; \
830 dstr_ensure(&d, v[4].len > v[3].len ? v[4].len : v[3].len); \
831 dstr_ensure(&t, v[5].len); t.len = v[5].len; \
833 pre##_gcmsetkey(&key, v[0].buf, v[0].len); \
835 for (ip = szs; *ip; ip++) { \
837 pre##_gcminit(&ctx, &key, (octet *)v[1].buf, v[1].len); \
841 if (i == -1) i = hsz; \
842 if (i > hsz) continue; \
843 p = (octet *)v[2].buf; \
844 pre##_gcmaadinit(&aad, &key); \
846 if (i > hsz) i = hsz; \
847 pre##_gcmaadhash(&aad, p, i); \
851 buf_init(&b, d.buf, d.sz); \
854 if (i == -1) i = msz; \
855 if (i > msz) continue; \
856 p = (octet *)v[3].buf; \
858 if (i > msz) i = msz; \
859 if (pre##_gcmencrypt(&ctx, p, i, &b)) { \
860 puts("!! gcmencrypt reports failure"); \
866 if (pre##_gcmencryptdone(&ctx, &aad, &b, (octet *)t.buf, t.len)) { \
867 puts("!! gcmencryptdone reports failure"); \
872 if (d.len != v[4].len || \
873 memcmp(d.buf, v[4].buf, v[4].len) != 0 || \
874 memcmp(t.buf, v[5].buf, v[5].len) != 0) { \
876 printf("\nfail encrypt:\n\tstep = %i", *ip); \
877 fputs("\n\tkey = ", stdout); type_hex.dump(&v[0], stdout); \
878 fputs("\n\tnonce = ", stdout); type_hex.dump(&v[1], stdout); \
879 fputs("\n\theader = ", stdout); type_hex.dump(&v[2], stdout); \
880 fputs("\n\tmessage = ", stdout); type_hex.dump(&v[3], stdout); \
881 fputs("\n\texp ct = ", stdout); type_hex.dump(&v[4], stdout); \
882 fputs("\n\tcalc ct = ", stdout); type_hex.dump(&d, stdout); \
883 fputs("\n\texp tag = ", stdout); type_hex.dump(&v[5], stdout); \
884 fputs("\n\tcalc tag = ", stdout); type_hex.dump(&t, stdout); \
889 pre##_gcminit(&ctx, &key, (octet *)v[1].buf, v[1].len); \
891 buf_init(&b, d.buf, d.sz); \
894 if (i == -1) i = msz; \
895 if (i > msz) continue; \
896 p = (octet *)v[4].buf; \
898 if (i > msz) i = msz; \
899 if (pre##_gcmdecrypt(&ctx, p, i, &b)) { \
900 puts("!! gcmdecrypt reports failure"); \
901 win = 0; goto fail_dec; \
906 win = pre##_gcmdecryptdone(&ctx, &aad, &b, \
907 (octet *)v[5].buf, v[5].len); \
909 puts("!! gcmdecryptdone reports failure"); \
914 if (d.len != v[3].len || !win || \
915 memcmp(d.buf, v[3].buf, v[3].len) != 0) { \
917 printf("\nfail decrypt:\n\tstep = %i", *ip); \
918 fputs("\n\tkey = ", stdout); type_hex.dump(&v[0], stdout); \
919 fputs("\n\tnonce = ", stdout); type_hex.dump(&v[1], stdout); \
920 fputs("\n\theader = ", stdout); type_hex.dump(&v[2], stdout); \
921 fputs("\n\tciphertext = ", stdout); type_hex.dump(&v[4], stdout); \
922 fputs("\n\texp pt = ", stdout); type_hex.dump(&v[3], stdout); \
923 fputs("\n\tcalc pt = ", stdout); type_hex.dump(&d, stdout); \
924 fputs("\n\ttag = ", stdout); type_hex.dump(&v[5], stdout); \
925 printf("\n\tverify %s", win ? "ok" : "FAILED"); \
931 dstr_destroy(&d); dstr_destroy(&t); \
935 static test_chunk aeaddefs[] = { \
936 { name "-gcm", gcmverify, \
937 { &type_hex, &type_hex, &type_hex, &type_hex, \
938 &type_hex, &type_hex, 0 } }, \
942 int main(int argc, char *argv[]) \
945 test_run(argc, argv, aeaddefs, SRCDIR"/t/" fname); \
950 # define GCM_TESTX(PRE, pre, name, fname)
953 /*----- That's all, folks -------------------------------------------------*/