1 /* $OpenBSD: gmac.c,v 1.3 2011/01/11 15:44:23 deraadt Exp $ */
2
3 /*
4 * Copyright (c) 2010 Mike Belopuhov <mike@vantronix.net>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 /*
20 * This code implements the Message Authentication part of the
21 * Galois/Counter Mode (as being described in the RFC 4543) using
22 * the AES cipher. FIPS SP 800-38D describes the algorithm details.
23 */
24
25 #include <sys/param.h>
26 #include <sys/systm.h>
27 #include <sys/endian.h>
28
29 #include <crypto/rijndael/rijndael.h>
30 #include <opencrypto/gmac.h>
31
32 void ghash_gfmul(uint32_t *, uint32_t *, uint32_t *);
33 void ghash_update(GHASH_CTX *, uint8_t *, size_t);
34
35 /* Computes a block multiplication in the GF(2^128) */
36 void
ghash_gfmul(uint32_t * X,uint32_t * Y,uint32_t * product)37 ghash_gfmul(uint32_t *X, uint32_t *Y, uint32_t *product)
38 {
39 uint32_t v[4];
40 uint32_t z[4] = { 0, 0, 0, 0};
41 uint8_t *x = (uint8_t *)X;
42 uint32_t mul;
43 int i;
44
45 v[0] = be32toh(Y[0]);
46 v[1] = be32toh(Y[1]);
47 v[2] = be32toh(Y[2]);
48 v[3] = be32toh(Y[3]);
49
50 for (i = 0; i < GMAC_BLOCK_LEN * 8; i++) {
51 /* update Z */
52 if (x[i >> 3] & (1 << (~i & 7))) {
53 z[0] ^= v[0];
54 z[1] ^= v[1];
55 z[2] ^= v[2];
56 z[3] ^= v[3];
57 } /* else: we preserve old values */
58
59 /* update V */
60 mul = v[3] & 1;
61 v[3] = (v[2] << 31) | (v[3] >> 1);
62 v[2] = (v[1] << 31) | (v[2] >> 1);
63 v[1] = (v[0] << 31) | (v[1] >> 1);
64 v[0] = (v[0] >> 1) ^ (0xe1000000 * mul);
65 }
66
67 product[0] = htobe32(z[0]);
68 product[1] = htobe32(z[1]);
69 product[2] = htobe32(z[2]);
70 product[3] = htobe32(z[3]);
71 }
72
73 void
ghash_update(GHASH_CTX * ctx,uint8_t * X,size_t len)74 ghash_update(GHASH_CTX *ctx, uint8_t *X, size_t len)
75 {
76 uint32_t *x = (uint32_t *)X;
77 uint32_t *s = (uint32_t *)ctx->S;
78 uint32_t *y = (uint32_t *)ctx->Z;
79 int i;
80
81 for (i = 0; i < len / GMAC_BLOCK_LEN; i++) {
82 s[0] = y[0] ^ x[0];
83 s[1] = y[1] ^ x[1];
84 s[2] = y[2] ^ x[2];
85 s[3] = y[3] ^ x[3];
86
87 ghash_gfmul((uint32_t *)ctx->S, (uint32_t *)ctx->H,
88 (uint32_t *)ctx->S);
89
90 y = s;
91 x += 4;
92 }
93
94 bcopy(ctx->S, ctx->Z, GMAC_BLOCK_LEN);
95 }
96
97 #define AESCTR_NONCESIZE 4
98
99 void
AES_GMAC_Init(AES_GMAC_CTX * ctx)100 AES_GMAC_Init(AES_GMAC_CTX *ctx)
101 {
102 bzero(ctx->ghash.H, GMAC_BLOCK_LEN);
103 bzero(ctx->ghash.S, GMAC_BLOCK_LEN);
104 bzero(ctx->ghash.Z, GMAC_BLOCK_LEN);
105 bzero(ctx->J, GMAC_BLOCK_LEN);
106 }
107
108 int
AES_GMAC_Setkey(AES_GMAC_CTX * ctx,const uint8_t * key,uint16_t klen)109 AES_GMAC_Setkey(AES_GMAC_CTX *ctx, const uint8_t *key, uint16_t klen)
110 {
111 ctx->rounds = rijndaelKeySetupEnc(ctx->K, __DECONST(u_char *, key),
112 (klen - AESCTR_NONCESIZE) * 8);
113 /* copy out salt to the counter block */
114 bcopy(key + klen - AESCTR_NONCESIZE, ctx->J, AESCTR_NONCESIZE);
115 /* prepare a hash subkey */
116 rijndaelEncrypt(ctx->K, ctx->rounds, ctx->ghash.H, ctx->ghash.H);
117 return (0);
118 }
119
120 void
AES_GMAC_Reinit(AES_GMAC_CTX * ctx,const uint8_t * iv,uint16_t ivlen)121 AES_GMAC_Reinit(AES_GMAC_CTX *ctx, const uint8_t *iv, uint16_t ivlen)
122 {
123 /* copy out IV to the counter block */
124 bcopy(iv, ctx->J + AESCTR_NONCESIZE, ivlen);
125 }
126
127 int
AES_GMAC_Update(AES_GMAC_CTX * ctx,uint8_t * data,uint16_t len)128 AES_GMAC_Update(AES_GMAC_CTX *ctx, uint8_t *data, uint16_t len)
129 {
130 uint32_t blk[4] = { 0, 0, 0, 0 };
131 int plen;
132
133 if (len > 0) {
134 plen = len % GMAC_BLOCK_LEN;
135 if (len >= GMAC_BLOCK_LEN)
136 ghash_update(&ctx->ghash, data, len - plen);
137 if (plen) {
138 bcopy(data + (len - plen), (uint8_t *)blk, plen);
139 ghash_update(&ctx->ghash, (uint8_t *)blk,
140 GMAC_BLOCK_LEN);
141 }
142 }
143 return (0);
144 }
145
146 void
AES_GMAC_Final(uint8_t digest[GMAC_DIGEST_LEN],AES_GMAC_CTX * ctx)147 AES_GMAC_Final(uint8_t digest[GMAC_DIGEST_LEN], AES_GMAC_CTX *ctx)
148 {
149 uint8_t keystream[GMAC_BLOCK_LEN];
150 int i;
151
152 /* do one round of GCTR */
153 ctx->J[GMAC_BLOCK_LEN - 1] = 1;
154 rijndaelEncrypt(ctx->K, ctx->rounds, ctx->J, keystream);
155 for (i = 0; i < GMAC_DIGEST_LEN; i++)
156 digest[i] = ctx->ghash.S[i] ^ keystream[i];
157 bzero(keystream, sizeof(keystream));
158 }
159
160