1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * AES-CTR and AES-XCTR stream ciphers 4 * 5 * Copyright 2026 Google LLC 6 */ 7 #ifndef _CRYPTO_AES_CTR_H 8 #define _CRYPTO_AES_CTR_H 9 10 #include <crypto/aes.h> 11 12 /** 13 * aes_ctr() - AES-CTR en/decryption 14 * @dst: The destination buffer. Can be in-place or out-of-place. For other 15 * overlaps the behavior is unspecified. 16 * @src: The source data 17 * @len: Number of bytes to en/decrypt 18 * @ctr: The counter. It will be incremented by ceil(@len / AES_BLOCK_SIZE). 19 * @key: The key, already prepared using aes_preparekey() or aes_prepareenckey() 20 * 21 * This implements AES in counter mode with a 128-bit big endian counter. 22 * 23 * This exists only for use by the implementation of modes built on top of CTR 24 * (e.g., GCM and CCM) and some legacy protocols that use CTR mode directly. 25 * Callers are expected to know how to use CTR mode appropriately, including 26 * choosing (key, counter) pairs appropriately to avoid keystream reuse. 27 * 28 * This supports incremental en/decryption. The length of each non-final chunk 29 * must be a multiple of AES_BLOCK_SIZE, and the updated @ctr must be passed in 30 * each time. 31 * 32 * Context: Any context. 33 */ 34 void aes_ctr(u8 *dst, const u8 *src, size_t len, 35 u8 ctr[at_least AES_BLOCK_SIZE], aes_encrypt_arg key); 36 37 /** 38 * aes_xctr() - AES-XCTR en/decryption 39 * @dst: The destination buffer. Can be in-place or out-of-place. For other 40 * overlaps the behavior is unspecified. 41 * @src: The source data 42 * @len: Number of bytes to en/decrypt 43 * @ctr: The block counter (in host endianness). For the first call, set it to 44 * 1. It will be incremented by ceil(@len / AES_BLOCK_SIZE). 45 * @iv: The initialization vector 46 * @key: The key, already prepared using aes_preparekey() or aes_prepareenckey() 47 * 48 * This implements AES in XOR Counter mode, as specified in the paper 49 * "Length-preserving encryption with HCTR2" 50 * (https://eprint.iacr.org/2021/1441.pdf). 51 * 52 * This exists only for use by the implementation of modes built on top of XCTR. 53 * Callers are expected to know how to use XCTR mode appropriately, including 54 * choosing (key, IV) pairs appropriately to avoid keystream reuse. 55 * 56 * This supports incremental en/decryption. The length of each non-final chunk 57 * must be a multiple of AES_BLOCK_SIZE, and the updated @ctr must be passed in 58 * each time. 59 * 60 * Context: Any context. 61 */ 62 void aes_xctr(u8 *dst, const u8 *src, size_t len, u64 *ctr, 63 const u8 iv[at_least AES_BLOCK_SIZE], aes_encrypt_arg key); 64 65 #endif /* _CRYPTO_AES_CTR_H */ 66