1 // SPDX-License-Identifier: GPL-2.0-only
5  * Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
14  * takes a 16-byte hash key H, additional authenticated data A, and a ciphertext
19  * is the already-formatted byte string containing both A and C.
21  * "ghash" in the Linux crypto API uses the 'X' (pre-formatted) convention,
28  * an "ε-almost-XOR-universal hash function", not a cryptographic hash function.
29  * It can only be used securely in crypto modes specially designed to use it.
34  *     (https://csrc.nist.gov/publications/detail/sp/800-38d/final)
62 		return -EINVAL;  in ghash_setkey()
64 	if (ctx->gf128)  in ghash_setkey()
65 		gf128mul_free_4k(ctx->gf128);  in ghash_setkey()
69 	ctx->gf128 = gf128mul_init_4k_lle(&k);  in ghash_setkey()
72 	if (!ctx->gf128)  in ghash_setkey()
73 		return -ENOMEM;  in ghash_setkey()
82 	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);  in ghash_update()
83 	u8 *dst = dctx->buffer;  in ghash_update()
85 	if (dctx->bytes) {  in ghash_update()
86 		int n = min(srclen, dctx->bytes);  in ghash_update()
87 		u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes);  in ghash_update()
89 		dctx->bytes -= n;  in ghash_update()
90 		srclen -= n;  in ghash_update()
92 		while (n--)  in ghash_update()
95 		if (!dctx->bytes)  in ghash_update()
96 			gf128mul_4k_lle((be128 *)dst, ctx->gf128);  in ghash_update()
101 		gf128mul_4k_lle((be128 *)dst, ctx->gf128);  in ghash_update()
103 		srclen -= GHASH_BLOCK_SIZE;  in ghash_update()
107 		dctx->bytes = GHASH_BLOCK_SIZE - srclen;  in ghash_update()
108 		while (srclen--)  in ghash_update()
117 	u8 *dst = dctx->buffer;  in ghash_flush()
119 	if (dctx->bytes) {  in ghash_flush()
120 		u8 *tmp = dst + (GHASH_BLOCK_SIZE - dctx->bytes);  in ghash_flush()
122 		while (dctx->bytes--)  in ghash_flush()
125 		gf128mul_4k_lle((be128 *)dst, ctx->gf128);  in ghash_flush()
128 	dctx->bytes = 0;  in ghash_flush()
134 	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);  in ghash_final()
135 	u8 *buf = dctx->buffer;  in ghash_final()
146 	if (ctx->gf128)  in ghash_exit_tfm()
147 		gf128mul_free_4k(ctx->gf128);  in ghash_exit_tfm()
159 		.cra_driver_name	= "ghash-generic",
184 MODULE_ALIAS_CRYPTO("ghash-generic");