1*e7be843bSPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
3*e7be843bSPierre Pronchery *
4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*e7be843bSPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*e7be843bSPierre Pronchery * in the file LICENSE in the source distribution or at
7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html
8*e7be843bSPierre Pronchery */
9*e7be843bSPierre Pronchery
10*e7be843bSPierre Pronchery #include <openssl/aes.h>
11*e7be843bSPierre Pronchery #include "prov/ciphercommon.h"
12*e7be843bSPierre Pronchery #include "crypto/aes_platform.h"
13*e7be843bSPierre Pronchery
14*e7be843bSPierre Pronchery #define BLOCK_SIZE 16
15*e7be843bSPierre Pronchery #define NONCE_SIZE 12
16*e7be843bSPierre Pronchery #define TAG_SIZE 16
17*e7be843bSPierre Pronchery
18*e7be843bSPierre Pronchery /* AAD manipulation macros */
19*e7be843bSPierre Pronchery #define UP16(x) (((x) + 15) & ~0x0F)
20*e7be843bSPierre Pronchery #define DOWN16(x) ((x) & ~0x0F)
21*e7be843bSPierre Pronchery #define REMAINDER16(x) ((x) & 0x0F)
22*e7be843bSPierre Pronchery #define IS16(x) (((x) & 0x0F) == 0)
23*e7be843bSPierre Pronchery
24*e7be843bSPierre Pronchery typedef struct prov_cipher_hw_aes_gcm_siv_st {
25*e7be843bSPierre Pronchery int (*initkey)(void *vctx);
26*e7be843bSPierre Pronchery int (*cipher)(void *vctx, unsigned char *out, const unsigned char *in,
27*e7be843bSPierre Pronchery size_t len);
28*e7be843bSPierre Pronchery int (*dup_ctx)(void *vdst, void *vsrc);
29*e7be843bSPierre Pronchery void (*clean_ctx)(void *vctx);
30*e7be843bSPierre Pronchery } PROV_CIPHER_HW_AES_GCM_SIV;
31*e7be843bSPierre Pronchery
32*e7be843bSPierre Pronchery /* Arranged for alignment purposes */
33*e7be843bSPierre Pronchery typedef struct prov_aes_gcm_siv_ctx_st {
34*e7be843bSPierre Pronchery EVP_CIPHER_CTX *ecb_ctx;
35*e7be843bSPierre Pronchery const PROV_CIPHER_HW_AES_GCM_SIV *hw; /* maybe not used, yet? */
36*e7be843bSPierre Pronchery uint8_t *aad; /* Allocated, rounded up to 16 bytes, from user */
37*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx;
38*e7be843bSPierre Pronchery OSSL_PROVIDER *provctx;
39*e7be843bSPierre Pronchery size_t aad_len; /* actual AAD length */
40*e7be843bSPierre Pronchery size_t key_len;
41*e7be843bSPierre Pronchery uint8_t key_gen_key[32]; /* from user */
42*e7be843bSPierre Pronchery uint8_t msg_enc_key[32]; /* depends on key size */
43*e7be843bSPierre Pronchery uint8_t msg_auth_key[BLOCK_SIZE];
44*e7be843bSPierre Pronchery uint8_t tag[TAG_SIZE]; /* generated tag, given to user or compared to user */
45*e7be843bSPierre Pronchery uint8_t user_tag[TAG_SIZE]; /* from user */
46*e7be843bSPierre Pronchery uint8_t nonce[NONCE_SIZE]; /* from user */
47*e7be843bSPierre Pronchery u128 Htable[16]; /* Polyval calculations via ghash */
48*e7be843bSPierre Pronchery unsigned int enc : 1; /* Set to 1 if we are encrypting or 0 otherwise */
49*e7be843bSPierre Pronchery unsigned int have_user_tag : 1;
50*e7be843bSPierre Pronchery unsigned int generated_tag : 1;
51*e7be843bSPierre Pronchery unsigned int used_enc : 1;
52*e7be843bSPierre Pronchery unsigned int used_dec : 1;
53*e7be843bSPierre Pronchery unsigned int speed : 1;
54*e7be843bSPierre Pronchery } PROV_AES_GCM_SIV_CTX;
55*e7be843bSPierre Pronchery
56*e7be843bSPierre Pronchery const PROV_CIPHER_HW_AES_GCM_SIV *ossl_prov_cipher_hw_aes_gcm_siv(size_t keybits);
57*e7be843bSPierre Pronchery
58*e7be843bSPierre Pronchery void ossl_polyval_ghash_init(u128 Htable[16], const uint64_t H[2]);
59*e7be843bSPierre Pronchery void ossl_polyval_ghash_hash(const u128 Htable[16], uint8_t *tag, const uint8_t *inp, size_t len);
60*e7be843bSPierre Pronchery
61*e7be843bSPierre Pronchery /* Define GSWAP8/GSWAP4 - used for BOTH little and big endian architectures */
GSWAP4(uint32_t n)62*e7be843bSPierre Pronchery static ossl_inline uint32_t GSWAP4(uint32_t n)
63*e7be843bSPierre Pronchery {
64*e7be843bSPierre Pronchery return (((n & 0x000000FF) << 24)
65*e7be843bSPierre Pronchery | ((n & 0x0000FF00) << 8)
66*e7be843bSPierre Pronchery | ((n & 0x00FF0000) >> 8)
67*e7be843bSPierre Pronchery | ((n & 0xFF000000) >> 24));
68*e7be843bSPierre Pronchery }
GSWAP8(uint64_t n)69*e7be843bSPierre Pronchery static ossl_inline uint64_t GSWAP8(uint64_t n)
70*e7be843bSPierre Pronchery {
71*e7be843bSPierre Pronchery uint64_t result;
72*e7be843bSPierre Pronchery
73*e7be843bSPierre Pronchery result = GSWAP4(n & 0x0FFFFFFFF);
74*e7be843bSPierre Pronchery result <<= 32;
75*e7be843bSPierre Pronchery return result | GSWAP4(n >> 32);
76*e7be843bSPierre Pronchery }
77