1*1f2d69a3SEric Biggers /* SPDX-License-Identifier: GPL-2.0 */ 2*1f2d69a3SEric Biggers /* 3*1f2d69a3SEric Biggers * AES-CTR and AES-XCTR stream ciphers 4*1f2d69a3SEric Biggers * 5*1f2d69a3SEric Biggers * Copyright 2026 Google LLC 6*1f2d69a3SEric Biggers */ 7*1f2d69a3SEric Biggers #ifndef _CRYPTO_AES_CTR_H 8*1f2d69a3SEric Biggers #define _CRYPTO_AES_CTR_H 9*1f2d69a3SEric Biggers 10*1f2d69a3SEric Biggers #include <crypto/aes.h> 11*1f2d69a3SEric Biggers 12*1f2d69a3SEric Biggers /** 13*1f2d69a3SEric Biggers * aes_ctr() - AES-CTR en/decryption 14*1f2d69a3SEric Biggers * @dst: The destination buffer. Can be in-place or out-of-place. For other 15*1f2d69a3SEric Biggers * overlaps the behavior is unspecified. 16*1f2d69a3SEric Biggers * @src: The source data 17*1f2d69a3SEric Biggers * @len: Number of bytes to en/decrypt 18*1f2d69a3SEric Biggers * @ctr: The counter. It will be incremented by ceil(@len / AES_BLOCK_SIZE). 19*1f2d69a3SEric Biggers * @key: The key, already prepared using aes_preparekey() or aes_prepareenckey() 20*1f2d69a3SEric Biggers * 21*1f2d69a3SEric Biggers * This implements AES in counter mode with a 128-bit big endian counter. 22*1f2d69a3SEric Biggers * 23*1f2d69a3SEric Biggers * This exists only for use by the implementation of modes built on top of CTR 24*1f2d69a3SEric Biggers * (e.g., GCM and CCM) and some legacy protocols that use CTR mode directly. 25*1f2d69a3SEric Biggers * Callers are expected to know how to use CTR mode appropriately, including 26*1f2d69a3SEric Biggers * choosing (key, counter) pairs appropriately to avoid keystream reuse. 27*1f2d69a3SEric Biggers * 28*1f2d69a3SEric Biggers * This supports incremental en/decryption. The length of each non-final chunk 29*1f2d69a3SEric Biggers * must be a multiple of AES_BLOCK_SIZE, and the updated @ctr must be passed in 30*1f2d69a3SEric Biggers * each time. 31*1f2d69a3SEric Biggers * 32*1f2d69a3SEric Biggers * Context: Any context. 33*1f2d69a3SEric Biggers */ 34*1f2d69a3SEric Biggers void aes_ctr(u8 *dst, const u8 *src, size_t len, 35*1f2d69a3SEric Biggers u8 ctr[at_least AES_BLOCK_SIZE], aes_encrypt_arg key); 36*1f2d69a3SEric Biggers 37*1f2d69a3SEric Biggers /** 38*1f2d69a3SEric Biggers * aes_xctr() - AES-XCTR en/decryption 39*1f2d69a3SEric Biggers * @dst: The destination buffer. Can be in-place or out-of-place. For other 40*1f2d69a3SEric Biggers * overlaps the behavior is unspecified. 41*1f2d69a3SEric Biggers * @src: The source data 42*1f2d69a3SEric Biggers * @len: Number of bytes to en/decrypt 43*1f2d69a3SEric Biggers * @ctr: The block counter (in host endianness). For the first call, set it to 44*1f2d69a3SEric Biggers * 1. It will be incremented by ceil(@len / AES_BLOCK_SIZE). 45*1f2d69a3SEric Biggers * @iv: The initialization vector 46*1f2d69a3SEric Biggers * @key: The key, already prepared using aes_preparekey() or aes_prepareenckey() 47*1f2d69a3SEric Biggers * 48*1f2d69a3SEric Biggers * This implements AES in XOR Counter mode, as specified in the paper 49*1f2d69a3SEric Biggers * "Length-preserving encryption with HCTR2" 50*1f2d69a3SEric Biggers * (https://eprint.iacr.org/2021/1441.pdf). 51*1f2d69a3SEric Biggers * 52*1f2d69a3SEric Biggers * This exists only for use by the implementation of modes built on top of XCTR. 53*1f2d69a3SEric Biggers * Callers are expected to know how to use XCTR mode appropriately, including 54*1f2d69a3SEric Biggers * choosing (key, IV) pairs appropriately to avoid keystream reuse. 55*1f2d69a3SEric Biggers * 56*1f2d69a3SEric Biggers * This supports incremental en/decryption. The length of each non-final chunk 57*1f2d69a3SEric Biggers * must be a multiple of AES_BLOCK_SIZE, and the updated @ctr must be passed in 58*1f2d69a3SEric Biggers * each time. 59*1f2d69a3SEric Biggers * 60*1f2d69a3SEric Biggers * Context: Any context. 61*1f2d69a3SEric Biggers */ 62*1f2d69a3SEric Biggers void aes_xctr(u8 *dst, const u8 *src, size_t len, u64 *ctr, 63*1f2d69a3SEric Biggers const u8 iv[at_least AES_BLOCK_SIZE], aes_encrypt_arg key); 64*1f2d69a3SEric Biggers 65*1f2d69a3SEric Biggers #endif /* _CRYPTO_AES_CTR_H */ 66