David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 1 | /* Copyright (c) 2016, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
| 15 | #include <openssl/base.h> |
| 16 | |
| 17 | #if !defined(OPENSSL_SMALL) |
| 18 | |
| 19 | #include <assert.h> |
| 20 | #include <string.h> |
| 21 | |
| 22 | #include "internal.h" |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 23 | #include "../../internal.h" |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 24 | |
| 25 | |
| 26 | /* byte_reverse reverses the order of the bytes in |b->c|. */ |
| 27 | static void byte_reverse(polyval_block *b) { |
| 28 | const uint64_t t = CRYPTO_bswap8(b->u[0]); |
| 29 | b->u[0] = CRYPTO_bswap8(b->u[1]); |
| 30 | b->u[1] = t; |
| 31 | } |
| 32 | |
| 33 | /* reverse_and_mulX_ghash interprets the bytes |b->c| as a reversed element of |
| 34 | * the GHASH field, multiplies that by 'x' and serialises the result back into |
| 35 | * |b|, but with GHASH's backwards bit ordering. */ |
| 36 | static void reverse_and_mulX_ghash(polyval_block *b) { |
| 37 | uint64_t hi = b->u[0]; |
| 38 | uint64_t lo = b->u[1]; |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 39 | const crypto_word_t carry = constant_time_eq_w(hi & 1, 1); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 40 | hi >>= 1; |
| 41 | hi |= lo << 63; |
| 42 | lo >>= 1; |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 43 | lo ^= ((uint64_t) constant_time_select_w(carry, 0xe1, 0)) << 56; |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 44 | |
| 45 | b->u[0] = CRYPTO_bswap8(lo); |
| 46 | b->u[1] = CRYPTO_bswap8(hi); |
| 47 | } |
| 48 | |
| 49 | /* POLYVAL(H, X_1, ..., X_n) = |
| 50 | * ByteReverse(GHASH(mulX_GHASH(ByteReverse(H)), ByteReverse(X_1), ..., |
| 51 | * ByteReverse(X_n))). |
| 52 | * |
| 53 | * See https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-02#appendix-A. */ |
| 54 | |
| 55 | void CRYPTO_POLYVAL_init(struct polyval_ctx *ctx, const uint8_t key[16]) { |
| 56 | polyval_block H; |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 57 | OPENSSL_memcpy(H.c, key, 16); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 58 | reverse_and_mulX_ghash(&H); |
| 59 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 60 | int is_avx; |
| 61 | CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, &ctx->H, ctx->Htable, &is_avx, |
| 62 | H.c); |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 63 | OPENSSL_memset(&ctx->S, 0, sizeof(ctx->S)); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 64 | } |
| 65 | |
| 66 | void CRYPTO_POLYVAL_update_blocks(struct polyval_ctx *ctx, const uint8_t *in, |
| 67 | size_t in_len) { |
| 68 | assert((in_len & 15) == 0); |
| 69 | polyval_block reversed[32]; |
| 70 | |
| 71 | while (in_len > 0) { |
| 72 | size_t todo = in_len; |
| 73 | if (todo > sizeof(reversed)) { |
| 74 | todo = sizeof(reversed); |
| 75 | } |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 76 | OPENSSL_memcpy(reversed, in, todo); |
| 77 | in += todo; |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 78 | in_len -= todo; |
| 79 | |
| 80 | size_t blocks = todo / sizeof(polyval_block); |
| 81 | for (size_t i = 0; i < blocks; i++) { |
| 82 | byte_reverse(&reversed[i]); |
| 83 | } |
| 84 | |
| 85 | ctx->ghash(ctx->S.u, ctx->Htable, (const uint8_t *) reversed, todo); |
| 86 | } |
| 87 | } |
| 88 | |
| 89 | void CRYPTO_POLYVAL_finish(const struct polyval_ctx *ctx, uint8_t out[16]) { |
| 90 | polyval_block S = ctx->S; |
| 91 | byte_reverse(&S); |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 92 | OPENSSL_memcpy(out, &S.c, sizeof(polyval_block)); |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 93 | } |
| 94 | |
| 95 | |
| 96 | #endif /* !OPENSSL_SMALL */ |