extern void gcm_mktable(const gcm_params */*p*/,
uint32 */*ktab*/, const uint32 */*k*/);
-/* --- @gcm_mulk_N@ --- *
+/* --- @gcm_mulk_N{b,l}@ --- *
*
* Arguments: @uint32 *a@ = accumulator to multiply
* @const uint32 *ktab@ = table constructed by @gcm_mktable@
*
* Use: Multiply @a@ by @k@ (implicitly represented in @ktab@),
* updating @a@ in-place. There are separate functions for each
- * supported block size because this is the function whose
- * performance actually matters.
+ * supported block size and endianness because this is the
+ * function whose performance actually matters.
*/
#define GCM_DECL_MULK(nbits) \
- extern void gcm_mulk_##nbits(uint32 */*a*/, const uint32 */*ktab*/);
+ extern void gcm_mulk_##nbits##b(uint32 */*a*/, const uint32 */*ktab*/); \
+ extern void gcm_mulk_##nbits##l(uint32 */*a*/, const uint32 */*ktab*/);
GCM_WIDTHS(GCM_DECL_MULK)
#undef GCM_DECL_MULK
/* Dispatch to the appropriate variant of @gcm_mulk@. */
-#define GCM_MULK(PRE, a, ktab) BLKC_GLUE(gcm_mulk_, BLKC_BITS(PRE))(a, ktab)
+#define GCM_MULK(PRE, a, ktab) \
+ BLKC_GLUE(GCM_MULK_, BLKC_ENDIAN(PRE))(BLKC_BITS(PRE), a, ktab)
+#define GCM_MULK_B(nbits, a, ktab) \
+ BLKC_GLUE(BLKC_GLUE(gcm_mulk_, nbits), b)(a, ktab)
+#define GCM_MULK_L(nbits, a, ktab) \
+ BLKC_GLUE(BLKC_GLUE(gcm_mulk_, nbits), l)(a, ktab)
/* --- @gcm_ghashdone@ --- *
*
/* Determine the buffering plan. Our buffer is going to do double- \
* duty here. The end portion is going to contain mask from the \
* encrypted counter which we mix into the plaintext to encrypt it; \
- * the start portion, which originally mask bytes we've already used, \
- * will hold the output ciphertext, which will eventually be \
- * collected into the GHASH state. \
+ * the start portion, which originally contained mask bytes we've \
+ * already used, will hold the output ciphertext, which will \
+ * eventually be collected into the GHASH state. \
*/ \
rsvr_mkplan(&plan, &pre##_gcmpolicy, ctx->off, sz); \
\
/* Determine the buffering plan. Our buffer is going to do double- \
* duty here. The end portion is going to contain mask from the \
* encrypted counter which we mix into the plaintext to encrypt it; \
- * the start portion, which originally mask bytes we've already used, \
- * will hold the input ciphertext, which will eventually be \
- * collected into the GHASH state. \
+ * the start portion, which originally contained mask bytes we've \
+ * already used, will hold the input ciphertext, which will \
+ * eventually be collected into the GHASH state. \
*/ \
rsvr_mkplan(&plan, &pre##_gcmpolicy, ctx->off, sz); \
\
return (&key->k); \
} \
\
+static int gcszok(size_t nsz, size_t hsz, size_t msz, size_t tsz) \
+ { return (gaead_szokcommon(&pre##_gcm, nsz, hsz, msz, tsz)); } \
+ \
const gcaead pre##_gcm = { \
name "-gcm", \
pre##_keysz, pre##_gcmnoncesz, pre##_gcmtagsz, \
PRE##_BLKSZ, 0, 0, 0, \
- gckey \
+ gckey, gcszok \
}; \
\
GCM_TESTX(PRE, pre, name, fname)
#include <stdio.h>
#include <mLib/dstr.h>
+#include <mLib/macros.h>
#include <mLib/quis.h>
#include <mLib/testrig.h>
d.len = BLEN(&b); \
\
if (d.len != v[4].len || \
- memcmp(d.buf, v[4].buf, v[4].len) != 0 || \
- memcmp(t.buf, v[5].buf, v[5].len) != 0) { \
+ MEMCMP(d.buf, !=, v[4].buf, v[4].len) || \
+ MEMCMP(t.buf, !=, v[5].buf, v[5].len)) { \
fail_enc: \
printf("\nfail encrypt:\n\tstep = %i", *ip); \
fputs("\n\tkey = ", stdout); type_hex.dump(&v[0], stdout); \
d.len = BLEN(&b); \
\
if (d.len != v[3].len || !win || \
- memcmp(d.buf, v[3].buf, v[3].len) != 0) { \
+ MEMCMP(d.buf, !=, v[3].buf, v[3].len)) { \
fail_dec: \
printf("\nfail decrypt:\n\tstep = %i", *ip); \
fputs("\n\tkey = ", stdout); type_hex.dump(&v[0], stdout); \