1 /*
2 * Copyright 2010-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* This header can move into provider when legacy support is removed */
11 #include <openssl/modes.h>
12
13 #if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
14 typedef __int64 i64;
15 typedef unsigned __int64 u64;
16 #define U64(C) C##UI64
17 #elif defined(__arch64__)
18 typedef long i64;
19 typedef unsigned long u64;
20 #define U64(C) C##UL
21 #else
22 typedef long long i64;
23 typedef unsigned long long u64;
24 #define U64(C) C##ULL
25 #endif
26
27 typedef unsigned int u32;
28 typedef unsigned char u8;
29
30 #define STRICT_ALIGNMENT 1
31 #ifndef PEDANTIC
32 #if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__) || defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64) || defined(__aarch64__) || defined(__s390__) || defined(__s390x__)
33 #undef STRICT_ALIGNMENT
34 #endif
35 #endif
36
37 #if !defined(PEDANTIC) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
38 #if defined(__GNUC__) && __GNUC__ >= 2
39 #if defined(__x86_64) || defined(__x86_64__)
40 #define BSWAP8(x) ({ u64 ret_=(x); \
41 asm ("bswapq %0" \
42 : "+r"(ret_)); ret_; })
43 #define BSWAP4(x) ({ u32 ret_=(x); \
44 asm ("bswapl %0" \
45 : "+r"(ret_)); ret_; })
46 #elif (defined(__i386) || defined(__i386__)) && !defined(I386_ONLY)
47 #define BSWAP8(x) ({ u32 lo_=(u64)(x)>>32,hi_=(x); \
48 asm ("bswapl %0; bswapl %1" \
49 : "+r"(hi_),"+r"(lo_)); \
50 (u64)hi_<<32|lo_; })
51 #define BSWAP4(x) ({ u32 ret_=(x); \
52 asm ("bswapl %0" \
53 : "+r"(ret_)); ret_; })
54 #elif defined(__aarch64__)
55 #if defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__) && __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
56 #define BSWAP8(x) ({ u64 ret_; \
57 asm ("rev %0,%1" \
58 : "=r"(ret_) : "r"(x)); ret_; })
59 #define BSWAP4(x) ({ u32 ret_; \
60 asm ("rev %w0,%w1" \
61 : "=r"(ret_) : "r"(x)); ret_; })
62 #endif
63 #elif (defined(__arm__) || defined(__arm)) && !defined(STRICT_ALIGNMENT)
64 #define BSWAP8(x) ({ u32 lo_=(u64)(x)>>32,hi_=(x); \
65 asm ("rev %0,%0; rev %1,%1" \
66 : "+r"(hi_),"+r"(lo_)); \
67 (u64)hi_<<32|lo_; })
68 #define BSWAP4(x) ({ u32 ret_; \
69 asm ("rev %0,%1" \
70 : "=r"(ret_) : "r"((u32)(x))); \
71 ret_; })
72 #elif (defined(__riscv_zbb) || defined(__riscv_zbkb)) && __riscv_xlen == 64
73 #define BSWAP8(x) ({ u64 ret_=(x); \
74 asm ("rev8 %0,%0" \
75 : "+r"(ret_)); ret_; })
76 #define BSWAP4(x) ({ u32 ret_=(x); \
77 asm ("rev8 %0,%0; srli %0,%0,32"\
78 : "+&r"(ret_)); ret_; })
79 #endif
80 #elif defined(_MSC_VER)
81 #if _MSC_VER >= 1300
82 #include <stdlib.h>
83 #pragma intrinsic(_byteswap_uint64, _byteswap_ulong)
84 #define BSWAP8(x) _byteswap_uint64((u64)(x))
85 #define BSWAP4(x) _byteswap_ulong((u32)(x))
86 #elif defined(_M_IX86)
_bswap4(u32 val)87 __inline u32 _bswap4(u32 val) {
88 _asm mov eax, val _asm bswap eax
89 }
90 #define BSWAP4(x) _bswap4(x)
91 #endif
92 #endif
93 #endif
94 #if defined(BSWAP4) && !defined(STRICT_ALIGNMENT)
95 #define GETU32(p) BSWAP4(*(const u32 *)(p))
96 #define PUTU32(p, v) *(u32 *)(p) = BSWAP4(v)
97 #else
98 #define GETU32(p) ((u32)(p)[0] << 24 | (u32)(p)[1] << 16 | (u32)(p)[2] << 8 | (u32)(p)[3])
99 #define PUTU32(p, v) ((p)[0] = (u8)((v) >> 24), (p)[1] = (u8)((v) >> 16), (p)[2] = (u8)((v) >> 8), (p)[3] = (u8)(v))
100 #endif
101 /*- GCM definitions */ typedef struct {
102 u64 hi, lo;
103 } u128;
104
105 typedef void (*gcm_init_fn)(u128 Htable[16], const u64 H[2]);
106 typedef void (*gcm_ghash_fn)(u64 Xi[2], const u128 Htable[16], const u8 *inp, size_t len);
107 typedef void (*gcm_gmult_fn)(u64 Xi[2], const u128 Htable[16]);
108 struct gcm_funcs_st {
109 gcm_init_fn ginit;
110 gcm_ghash_fn ghash;
111 gcm_gmult_fn gmult;
112 };
113
114 struct gcm128_context {
115 /* Following 6 names follow names in GCM specification */
116 union {
117 u64 u[2];
118 u32 d[4];
119 u8 c[16];
120 size_t t[16 / sizeof(size_t)];
121 } Yi, EKi, EK0, len, Xi, H;
122 /*
123 * Relative position of Yi, EKi, EK0, len, Xi, H and pre-computed Htable is
124 * used in some assembler modules, i.e. don't change the order!
125 */
126 u128 Htable[16];
127 struct gcm_funcs_st funcs;
128 unsigned int mres, ares;
129 block128_f block;
130 void *key;
131 #if !defined(OPENSSL_SMALL_FOOTPRINT)
132 unsigned char Xn[48];
133 #endif
134 };
135
136 /* GHASH functions */
137 void ossl_gcm_init_4bit(u128 Htable[16], const u64 H[2]);
138 void ossl_gcm_ghash_4bit(u64 Xi[2], const u128 Htable[16],
139 const u8 *inp, size_t len);
140 void ossl_gcm_gmult_4bit(u64 Xi[2], const u128 Htable[16]);
141
142 /*
143 * The maximum permitted number of cipher blocks per data unit in XTS mode.
144 * Reference IEEE Std 1619-2018.
145 */
146 #define XTS_MAX_BLOCKS_PER_DATA_UNIT (1 << 20)
147
148 struct xts128_context {
149 void *key1, *key2;
150 block128_f block1, block2;
151 };
152
153 /* XTS mode for SM4 algorithm specified by GB/T 17964-2021 */
154 int ossl_crypto_xts128gb_encrypt(const XTS128_CONTEXT *ctx,
155 const unsigned char iv[16],
156 const unsigned char *inp, unsigned char *out,
157 size_t len, int enc);
158
159 struct ccm128_context {
160 union {
161 u64 u[2];
162 u8 c[16];
163 } nonce, cmac;
164 u64 blocks;
165 block128_f block;
166 void *key;
167 };
168
169 #ifndef OPENSSL_NO_OCB
170
171 typedef union {
172 u64 a[2];
173 unsigned char c[16];
174 } OCB_BLOCK;
175 #define ocb_block16_xor(in1, in2, out) \
176 ((out)->a[0] = (in1)->a[0] ^ (in2)->a[0], \
177 (out)->a[1] = (in1)->a[1] ^ (in2)->a[1])
178 #if STRICT_ALIGNMENT
179 #define ocb_block16_xor_misaligned(in1, in2, out) \
180 ocb_block_xor((in1)->c, (in2)->c, 16, (out)->c)
181 #else
182 #define ocb_block16_xor_misaligned ocb_block16_xor
183 #endif
184
185 struct ocb128_context {
186 /* Need both encrypt and decrypt key schedules for decryption */
187 block128_f encrypt;
188 block128_f decrypt;
189 void *keyenc;
190 void *keydec;
191 ocb128_f stream; /* direction dependent */
192 /* Key dependent variables. Can be reused if key remains the same */
193 size_t l_index;
194 size_t max_l_index;
195 OCB_BLOCK l_star;
196 OCB_BLOCK l_dollar;
197 OCB_BLOCK *l;
198 /* Must be reset for each session */
199 struct {
200 u64 blocks_hashed;
201 u64 blocks_processed;
202 OCB_BLOCK offset_aad;
203 OCB_BLOCK sum;
204 OCB_BLOCK offset;
205 OCB_BLOCK checksum;
206 } sess;
207 };
208 #endif /* OPENSSL_NO_OCB */
209
210 #ifndef OPENSSL_NO_SIV
211
212 #define SIV_LEN 16
213
214 typedef union siv_block_u {
215 uint64_t word[SIV_LEN / sizeof(uint64_t)];
216 unsigned char byte[SIV_LEN];
217 } SIV_BLOCK;
218
219 struct siv128_context {
220 /* d stores intermediate results of S2V; it corresponds to D from the
221 pseudocode in section 2.4 of RFC 5297. */
222 SIV_BLOCK d;
223 SIV_BLOCK tag;
224 EVP_CIPHER_CTX *cipher_ctx;
225 EVP_MAC *mac;
226 EVP_MAC_CTX *mac_ctx_init;
227 int final_ret;
228 int crypto_ok;
229 };
230
231 #endif /* OPENSSL_NO_SIV */
232