David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 1 | /* Copyright (c) 2016, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
| 15 | #include <openssl/base.h> |
| 16 | |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 17 | #include <assert.h> |
| 18 | #include <string.h> |
| 19 | |
| 20 | #include "internal.h" |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 21 | #include "../../internal.h" |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 22 | |
| 23 | |
| 24 | /* byte_reverse reverses the order of the bytes in |b->c|. */ |
| 25 | static void byte_reverse(polyval_block *b) { |
| 26 | const uint64_t t = CRYPTO_bswap8(b->u[0]); |
| 27 | b->u[0] = CRYPTO_bswap8(b->u[1]); |
| 28 | b->u[1] = t; |
| 29 | } |
| 30 | |
| 31 | /* reverse_and_mulX_ghash interprets the bytes |b->c| as a reversed element of |
| 32 | * the GHASH field, multiplies that by 'x' and serialises the result back into |
| 33 | * |b|, but with GHASH's backwards bit ordering. */ |
| 34 | static void reverse_and_mulX_ghash(polyval_block *b) { |
| 35 | uint64_t hi = b->u[0]; |
| 36 | uint64_t lo = b->u[1]; |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 37 | const crypto_word_t carry = constant_time_eq_w(hi & 1, 1); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 38 | hi >>= 1; |
| 39 | hi |= lo << 63; |
| 40 | lo >>= 1; |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 41 | lo ^= ((uint64_t) constant_time_select_w(carry, 0xe1, 0)) << 56; |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 42 | |
| 43 | b->u[0] = CRYPTO_bswap8(lo); |
| 44 | b->u[1] = CRYPTO_bswap8(hi); |
| 45 | } |
| 46 | |
| 47 | /* POLYVAL(H, X_1, ..., X_n) = |
| 48 | * ByteReverse(GHASH(mulX_GHASH(ByteReverse(H)), ByteReverse(X_1), ..., |
| 49 | * ByteReverse(X_n))). |
| 50 | * |
| 51 | * See https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-02#appendix-A. */ |
| 52 | |
| 53 | void CRYPTO_POLYVAL_init(struct polyval_ctx *ctx, const uint8_t key[16]) { |
| 54 | polyval_block H; |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 55 | OPENSSL_memcpy(H.c, key, 16); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 56 | reverse_and_mulX_ghash(&H); |
| 57 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 58 | int is_avx; |
| 59 | CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, &ctx->H, ctx->Htable, &is_avx, |
| 60 | H.c); |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 61 | OPENSSL_memset(&ctx->S, 0, sizeof(ctx->S)); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 62 | } |
| 63 | |
| 64 | void CRYPTO_POLYVAL_update_blocks(struct polyval_ctx *ctx, const uint8_t *in, |
| 65 | size_t in_len) { |
| 66 | assert((in_len & 15) == 0); |
| 67 | polyval_block reversed[32]; |
| 68 | |
| 69 | while (in_len > 0) { |
| 70 | size_t todo = in_len; |
| 71 | if (todo > sizeof(reversed)) { |
| 72 | todo = sizeof(reversed); |
| 73 | } |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 74 | OPENSSL_memcpy(reversed, in, todo); |
| 75 | in += todo; |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 76 | in_len -= todo; |
| 77 | |
| 78 | size_t blocks = todo / sizeof(polyval_block); |
| 79 | for (size_t i = 0; i < blocks; i++) { |
| 80 | byte_reverse(&reversed[i]); |
| 81 | } |
| 82 | |
| 83 | ctx->ghash(ctx->S.u, ctx->Htable, (const uint8_t *) reversed, todo); |
| 84 | } |
| 85 | } |
| 86 | |
| 87 | void CRYPTO_POLYVAL_finish(const struct polyval_ctx *ctx, uint8_t out[16]) { |
| 88 | polyval_block S = ctx->S; |
| 89 | byte_reverse(&S); |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 90 | OPENSSL_memcpy(out, &S.c, sizeof(polyval_block)); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 91 | } |