/src/botan/src/lib/modes/aead/ocb/ocb.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * OCB Mode |
3 | | * (C) 2013,2017 Jack Lloyd |
4 | | * (C) 2016 Daniel Neus, Rohde & Schwarz Cybersecurity |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #include <botan/ocb.h> |
10 | | #include <botan/block_cipher.h> |
11 | | #include <botan/internal/poly_dbl.h> |
12 | | #include <botan/internal/bit_ops.h> |
13 | | |
14 | | namespace Botan { |
15 | | |
16 | | // Has to be in Botan namespace so unique_ptr can reference it |
17 | | class L_computer final |
18 | | { |
19 | | public: |
20 | | explicit L_computer(const BlockCipher& cipher) : |
21 | | m_BS(cipher.block_size()), |
22 | | m_max_blocks(cipher.parallel_bytes() / m_BS) |
23 | 483 | { |
24 | 483 | m_L_star.resize(m_BS); |
25 | 483 | cipher.encrypt(m_L_star); |
26 | 483 | m_L_dollar = poly_double(star()); |
27 | 483 | m_L.push_back(poly_double(dollar())); |
28 | 483 | |
29 | 3.86k | while(m_L.size() < 8) |
30 | 3.38k | m_L.push_back(poly_double(m_L.back())); |
31 | 483 | |
32 | 483 | m_offset_buf.resize(m_BS * m_max_blocks); |
33 | 483 | } |
34 | | |
35 | | void init(const secure_vector<uint8_t>& offset) |
36 | 601 | { |
37 | 601 | m_offset = offset; |
38 | 601 | } |
39 | | |
40 | 592 | bool initialized() const { return m_offset.empty() == false; } |
41 | | |
42 | 1.40k | const secure_vector<uint8_t>& star() const { return m_L_star; } |
43 | 1.08k | const secure_vector<uint8_t>& dollar() const { return m_L_dollar; } |
44 | 601 | const secure_vector<uint8_t>& offset() const { return m_offset; } |
45 | | |
46 | | const secure_vector<uint8_t>& get(size_t i) const |
47 | 7.02k | { |
48 | 7.04k | while(m_L.size() <= i) |
49 | 16 | m_L.push_back(poly_double(m_L.back())); |
50 | 7.02k | |
51 | 7.02k | return m_L[i]; |
52 | 7.02k | } |
53 | | |
54 | | const uint8_t* |
55 | | compute_offsets(size_t block_index, size_t blocks) |
56 | 1.31k | { |
57 | 1.31k | BOTAN_ASSERT(blocks <= m_max_blocks, "OCB offsets"); |
58 | 1.31k | |
59 | 1.31k | uint8_t* offsets = m_offset_buf.data(); |
60 | 1.31k | |
61 | 1.31k | if(block_index % 4 == 0) |
62 | 1.31k | { |
63 | 1.31k | const secure_vector<uint8_t>& L0 = get(0); |
64 | 1.31k | const secure_vector<uint8_t>& L1 = get(1); |
65 | 1.31k | |
66 | 5.24k | while(blocks >= 4) |
67 | 3.92k | { |
68 | 3.92k | // ntz(4*i+1) == 0 |
69 | 3.92k | // ntz(4*i+2) == 1 |
70 | 3.92k | // ntz(4*i+3) == 0 |
71 | 3.92k | block_index += 4; |
72 | 3.92k | const size_t ntz4 = var_ctz32(static_cast<uint32_t>(block_index)); |
73 | 3.92k | |
74 | 3.92k | xor_buf(offsets, m_offset.data(), L0.data(), m_BS); |
75 | 3.92k | offsets += m_BS; |
76 | 3.92k | |
77 | 3.92k | xor_buf(offsets, offsets - m_BS, L1.data(), m_BS); |
78 | 3.92k | offsets += m_BS; |
79 | 3.92k | |
80 | 3.92k | xor_buf(m_offset.data(), L1.data(), m_BS); |
81 | 3.92k | copy_mem(offsets, m_offset.data(), m_BS); |
82 | 3.92k | offsets += m_BS; |
83 | 3.92k | |
84 | 3.92k | xor_buf(m_offset.data(), get(ntz4).data(), m_BS); |
85 | 3.92k | copy_mem(offsets, m_offset.data(), m_BS); |
86 | 3.92k | offsets += m_BS; |
87 | 3.92k | |
88 | 3.92k | blocks -= 4; |
89 | 3.92k | } |
90 | 1.31k | } |
91 | 1.31k | |
92 | 1.78k | for(size_t i = 0; i != blocks; ++i) |
93 | 471 | { // could be done in parallel |
94 | 471 | const size_t ntz = var_ctz32(static_cast<uint32_t>(block_index + i + 1)); |
95 | 471 | xor_buf(m_offset.data(), get(ntz).data(), m_BS); |
96 | 471 | copy_mem(offsets, m_offset.data(), m_BS); |
97 | 471 | offsets += m_BS; |
98 | 471 | } |
99 | 1.31k | |
100 | 1.31k | return m_offset_buf.data(); |
101 | 1.31k | } |
102 | | |
103 | | private: |
104 | | secure_vector<uint8_t> poly_double(const secure_vector<uint8_t>& in) const |
105 | 4.36k | { |
106 | 4.36k | secure_vector<uint8_t> out(in.size()); |
107 | 4.36k | poly_double_n(out.data(), in.data(), out.size()); |
108 | 4.36k | return out; |
109 | 4.36k | } |
110 | | |
111 | | const size_t m_BS, m_max_blocks; |
112 | | secure_vector<uint8_t> m_L_dollar, m_L_star; |
113 | | secure_vector<uint8_t> m_offset; |
114 | | mutable std::vector<secure_vector<uint8_t>> m_L; |
115 | | secure_vector<uint8_t> m_offset_buf; |
116 | | }; |
117 | | |
118 | | namespace { |
119 | | |
120 | | /* |
121 | | * OCB's HASH |
122 | | */ |
123 | | secure_vector<uint8_t> ocb_hash(const L_computer& L, |
124 | | const BlockCipher& cipher, |
125 | | const uint8_t ad[], size_t ad_len) |
126 | 601 | { |
127 | 601 | const size_t BS = cipher.block_size(); |
128 | 601 | secure_vector<uint8_t> sum(BS); |
129 | 601 | secure_vector<uint8_t> offset(BS); |
130 | 601 | |
131 | 601 | secure_vector<uint8_t> buf(BS); |
132 | 601 | |
133 | 601 | const size_t ad_blocks = (ad_len / BS); |
134 | 601 | const size_t ad_remainder = (ad_len % BS); |
135 | 601 | |
136 | 601 | for(size_t i = 0; i != ad_blocks; ++i) |
137 | 0 | { |
138 | 0 | // this loop could run in parallel |
139 | 0 | offset ^= L.get(var_ctz32(static_cast<uint32_t>(i+1))); |
140 | 0 | buf = offset; |
141 | 0 | xor_buf(buf.data(), &ad[BS*i], BS); |
142 | 0 | cipher.encrypt(buf); |
143 | 0 | sum ^= buf; |
144 | 0 | } |
145 | 601 | |
146 | 601 | if(ad_remainder) |
147 | 601 | { |
148 | 601 | offset ^= L.star(); |
149 | 601 | buf = offset; |
150 | 601 | xor_buf(buf.data(), &ad[BS*ad_blocks], ad_remainder); |
151 | 601 | buf[ad_remainder] ^= 0x80; |
152 | 601 | cipher.encrypt(buf); |
153 | 601 | sum ^= buf; |
154 | 601 | } |
155 | 601 | |
156 | 601 | return sum; |
157 | 601 | } |
158 | | |
159 | | } |
160 | | |
161 | | OCB_Mode::OCB_Mode(BlockCipher* cipher, size_t tag_size) : |
162 | | m_cipher(cipher), |
163 | | m_checksum(m_cipher->parallel_bytes()), |
164 | | m_ad_hash(m_cipher->block_size()), |
165 | | m_tag_size(tag_size), |
166 | | m_block_size(m_cipher->block_size()), |
167 | | m_par_blocks(m_cipher->parallel_bytes() / m_block_size) |
168 | 483 | { |
169 | 483 | const size_t BS = block_size(); |
170 | 483 | |
171 | 483 | /* |
172 | 483 | * draft-krovetz-ocb-wide-d1 specifies OCB for several other block |
173 | 483 | * sizes but only 128, 192, 256 and 512 bit are currently supported |
174 | 483 | * by this implementation. |
175 | 483 | */ |
176 | 483 | BOTAN_ARG_CHECK(BS == 16 || BS == 24 || BS == 32 || BS == 64, |
177 | 483 | "Invalid block size for OCB"); |
178 | 483 | |
179 | 483 | BOTAN_ARG_CHECK(m_tag_size % 4 == 0 && |
180 | 483 | m_tag_size >= 8 && m_tag_size <= BS && |
181 | 483 | m_tag_size <= 32, |
182 | 483 | "Invalid OCB tag length"); |
183 | 483 | } |
184 | | |
185 | 483 | OCB_Mode::~OCB_Mode() { /* for unique_ptr destructor */ } |
186 | | |
187 | | void OCB_Mode::clear() |
188 | 0 | { |
189 | 0 | m_cipher->clear(); |
190 | 0 | m_L.reset(); // add clear here? |
191 | 0 | reset(); |
192 | 0 | } |
193 | | |
194 | | void OCB_Mode::reset() |
195 | 0 | { |
196 | 0 | m_block_index = 0; |
197 | 0 | zeroise(m_ad_hash); |
198 | 0 | zeroise(m_checksum); |
199 | 0 | m_last_nonce.clear(); |
200 | 0 | m_stretch.clear(); |
201 | 0 | } |
202 | | |
203 | | bool OCB_Mode::valid_nonce_length(size_t length) const |
204 | 601 | { |
205 | 601 | if(length == 0) |
206 | 0 | return false; |
207 | 601 | if(block_size() == 16) |
208 | 601 | return length < 16; |
209 | 0 | else |
210 | 0 | return length < (block_size() - 1); |
211 | 601 | } |
212 | | |
213 | | std::string OCB_Mode::name() const |
214 | 0 | { |
215 | 0 | return m_cipher->name() + "/OCB"; // include tag size? |
216 | 0 | } |
217 | | |
218 | | size_t OCB_Mode::update_granularity() const |
219 | 0 | { |
220 | 0 | return (m_par_blocks * block_size()); |
221 | 0 | } |
222 | | |
223 | | Key_Length_Specification OCB_Mode::key_spec() const |
224 | 483 | { |
225 | 483 | return m_cipher->key_spec(); |
226 | 483 | } |
227 | | |
228 | | void OCB_Mode::key_schedule(const uint8_t key[], size_t length) |
229 | 483 | { |
230 | 483 | m_cipher->set_key(key, length); |
231 | 483 | m_L.reset(new L_computer(*m_cipher)); |
232 | 483 | } |
233 | | |
234 | | void OCB_Mode::set_associated_data(const uint8_t ad[], size_t ad_len) |
235 | 601 | { |
236 | 601 | verify_key_set(m_L != nullptr); |
237 | 601 | m_ad_hash = ocb_hash(*m_L, *m_cipher, ad, ad_len); |
238 | 601 | } |
239 | | |
240 | | secure_vector<uint8_t> |
241 | | OCB_Mode::update_nonce(const uint8_t nonce[], size_t nonce_len) |
242 | 601 | { |
243 | 601 | const size_t BS = block_size(); |
244 | 601 | |
245 | 601 | BOTAN_ASSERT(BS == 16 || BS == 24 || BS == 32 || BS == 64, |
246 | 601 | "OCB block size is supported"); |
247 | 601 | |
248 | 601 | const size_t MASKLEN = (BS == 16 ? 6 : ((BS == 24) ? 7 : 8)); |
249 | 601 | |
250 | 601 | const uint8_t BOTTOM_MASK = |
251 | 601 | static_cast<uint8_t>((static_cast<uint16_t>(1) << MASKLEN) - 1); |
252 | 601 | |
253 | 601 | secure_vector<uint8_t> nonce_buf(BS); |
254 | 601 | |
255 | 601 | copy_mem(&nonce_buf[BS - nonce_len], nonce, nonce_len); |
256 | 601 | nonce_buf[0] = static_cast<uint8_t>(((tag_size()*8) % (BS*8)) << (BS <= 16 ? 1 : 0)); |
257 | 601 | |
258 | 601 | nonce_buf[BS - nonce_len - 1] ^= 1; |
259 | 601 | |
260 | 601 | const uint8_t bottom = nonce_buf[BS-1] & BOTTOM_MASK; |
261 | 601 | nonce_buf[BS-1] &= ~BOTTOM_MASK; |
262 | 601 | |
263 | 601 | const bool need_new_stretch = (m_last_nonce != nonce_buf); |
264 | 601 | |
265 | 601 | if(need_new_stretch) |
266 | 416 | { |
267 | 416 | m_last_nonce = nonce_buf; |
268 | 416 | |
269 | 416 | m_cipher->encrypt(nonce_buf); |
270 | 416 | |
271 | 416 | /* |
272 | 416 | The loop bounds (BS vs BS/2) are derived from the relation |
273 | 416 | between the block size and the MASKLEN. Using the terminology |
274 | 416 | of draft-krovetz-ocb-wide, we have to derive enough bits in |
275 | 416 | ShiftedKtop to read up to BLOCKLEN+bottom bits from Stretch. |
276 | 416 | |
277 | 416 | +----------+---------+-------+---------+ |
278 | 416 | | BLOCKLEN | RESIDUE | SHIFT | MASKLEN | |
279 | 416 | +----------+---------+-------+---------+ |
280 | 416 | | 32 | 141 | 17 | 4 | |
281 | 416 | | 64 | 27 | 25 | 5 | |
282 | 416 | | 96 | 1601 | 33 | 6 | |
283 | 416 | | 128 | 135 | 8 | 6 | |
284 | 416 | | 192 | 135 | 40 | 7 | |
285 | 416 | | 256 | 1061 | 1 | 8 | |
286 | 416 | | 384 | 4109 | 80 | 8 | |
287 | 416 | | 512 | 293 | 176 | 8 | |
288 | 416 | | 1024 | 524355 | 352 | 9 | |
289 | 416 | +----------+---------+-------+---------+ |
290 | 416 | */ |
291 | 416 | if(BS == 16) |
292 | 416 | { |
293 | 3.74k | for(size_t i = 0; i != BS / 2; ++i) |
294 | 3.32k | nonce_buf.push_back(nonce_buf[i] ^ nonce_buf[i+1]); |
295 | 416 | } |
296 | 0 | else if(BS == 24) |
297 | 0 | { |
298 | 0 | for(size_t i = 0; i != 16; ++i) |
299 | 0 | nonce_buf.push_back(nonce_buf[i] ^ nonce_buf[i+5]); |
300 | 0 | } |
301 | 0 | else if(BS == 32) |
302 | 0 | { |
303 | 0 | for(size_t i = 0; i != BS; ++i) |
304 | 0 | nonce_buf.push_back(nonce_buf[i] ^ (nonce_buf[i] << 1) ^ (nonce_buf[i+1] >> 7)); |
305 | 0 | } |
306 | 0 | else if(BS == 64) |
307 | 0 | { |
308 | 0 | for(size_t i = 0; i != BS / 2; ++i) |
309 | 0 | nonce_buf.push_back(nonce_buf[i] ^ nonce_buf[i+22]); |
310 | 0 | } |
311 | 416 | |
312 | 416 | m_stretch = nonce_buf; |
313 | 416 | } |
314 | 601 | |
315 | 601 | // now set the offset from stretch and bottom |
316 | 601 | const size_t shift_bytes = bottom / 8; |
317 | 601 | const size_t shift_bits = bottom % 8; |
318 | 601 | |
319 | 601 | BOTAN_ASSERT(m_stretch.size() >= BS + shift_bytes + 1, "Size ok"); |
320 | 601 | |
321 | 601 | secure_vector<uint8_t> offset(BS); |
322 | 10.2k | for(size_t i = 0; i != BS; ++i) |
323 | 9.61k | { |
324 | 9.61k | offset[i] = (m_stretch[i+shift_bytes] << shift_bits); |
325 | 9.61k | offset[i] |= (m_stretch[i+shift_bytes+1] >> (8-shift_bits)); |
326 | 9.61k | } |
327 | 601 | |
328 | 601 | return offset; |
329 | 601 | } |
330 | | |
331 | | void OCB_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) |
332 | 601 | { |
333 | 601 | if(!valid_nonce_length(nonce_len)) |
334 | 0 | throw Invalid_IV_Length(name(), nonce_len); |
335 | 601 | |
336 | 601 | verify_key_set(m_L != nullptr); |
337 | 601 | |
338 | 601 | m_L->init(update_nonce(nonce, nonce_len)); |
339 | 601 | zeroise(m_checksum); |
340 | 601 | m_block_index = 0; |
341 | 601 | } |
342 | | |
343 | | void OCB_Encryption::encrypt(uint8_t buffer[], size_t blocks) |
344 | 415 | { |
345 | 415 | verify_key_set(m_L != nullptr); |
346 | 415 | BOTAN_STATE_CHECK(m_L->initialized()); |
347 | 415 | |
348 | 415 | const size_t BS = block_size(); |
349 | 415 | |
350 | 645 | while(blocks) |
351 | 230 | { |
352 | 230 | const size_t proc_blocks = std::min(blocks, par_blocks()); |
353 | 230 | const size_t proc_bytes = proc_blocks * BS; |
354 | 230 | |
355 | 230 | const uint8_t* offsets = m_L->compute_offsets(m_block_index, proc_blocks); |
356 | 230 | |
357 | 230 | xor_buf(m_checksum.data(), buffer, proc_bytes); |
358 | 230 | |
359 | 230 | m_cipher->encrypt_n_xex(buffer, offsets, proc_blocks); |
360 | 230 | |
361 | 230 | buffer += proc_bytes; |
362 | 230 | blocks -= proc_blocks; |
363 | 230 | m_block_index += proc_blocks; |
364 | 230 | } |
365 | 415 | } |
366 | | |
367 | | size_t OCB_Encryption::process(uint8_t buf[], size_t sz) |
368 | 0 | { |
369 | 0 | BOTAN_ASSERT(sz % update_granularity() == 0, "Invalid OCB input size"); |
370 | 0 | encrypt(buf, sz / block_size()); |
371 | 0 | return sz; |
372 | 0 | } |
373 | | |
374 | | void OCB_Encryption::finish(secure_vector<uint8_t>& buffer, size_t offset) |
375 | 415 | { |
376 | 415 | verify_key_set(m_L != nullptr); |
377 | 415 | |
378 | 415 | const size_t BS = block_size(); |
379 | 415 | |
380 | 415 | BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane"); |
381 | 415 | const size_t sz = buffer.size() - offset; |
382 | 415 | uint8_t* buf = buffer.data() + offset; |
383 | 415 | |
384 | 415 | secure_vector<uint8_t> mac(BS); |
385 | 415 | |
386 | 415 | if(sz) |
387 | 415 | { |
388 | 415 | const size_t final_full_blocks = sz / BS; |
389 | 415 | const size_t remainder_bytes = sz - (final_full_blocks * BS); |
390 | 415 | |
391 | 415 | encrypt(buf, final_full_blocks); |
392 | 415 | mac = m_L->offset(); |
393 | 415 | |
394 | 415 | if(remainder_bytes) |
395 | 185 | { |
396 | 185 | BOTAN_ASSERT(remainder_bytes < BS, "Only a partial block left"); |
397 | 185 | uint8_t* remainder = &buf[sz - remainder_bytes]; |
398 | 185 | |
399 | 185 | xor_buf(m_checksum.data(), remainder, remainder_bytes); |
400 | 185 | m_checksum[remainder_bytes] ^= 0x80; |
401 | 185 | |
402 | 185 | // Offset_* |
403 | 185 | mac ^= m_L->star(); |
404 | 185 | |
405 | 185 | secure_vector<uint8_t> pad(BS); |
406 | 185 | m_cipher->encrypt(mac, pad); |
407 | 185 | xor_buf(remainder, pad.data(), remainder_bytes); |
408 | 185 | } |
409 | 415 | } |
410 | 0 | else |
411 | 0 | { |
412 | 0 | mac = m_L->offset(); |
413 | 0 | } |
414 | 415 | |
415 | 415 | // now compute the tag |
416 | 415 | |
417 | 415 | // fold checksum |
418 | 7.05k | for(size_t i = 0; i != m_checksum.size(); i += BS) |
419 | 6.64k | { |
420 | 6.64k | xor_buf(mac.data(), m_checksum.data() + i, BS); |
421 | 6.64k | } |
422 | 415 | |
423 | 415 | xor_buf(mac.data(), m_L->dollar().data(), BS); |
424 | 415 | m_cipher->encrypt(mac); |
425 | 415 | xor_buf(mac.data(), m_ad_hash.data(), BS); |
426 | 415 | |
427 | 415 | buffer += std::make_pair(mac.data(), tag_size()); |
428 | 415 | |
429 | 415 | zeroise(m_checksum); |
430 | 415 | m_block_index = 0; |
431 | 415 | } |
432 | | |
433 | | void OCB_Decryption::decrypt(uint8_t buffer[], size_t blocks) |
434 | 177 | { |
435 | 177 | verify_key_set(m_L != nullptr); |
436 | 177 | BOTAN_STATE_CHECK(m_L->initialized()); |
437 | 177 | |
438 | 177 | const size_t BS = block_size(); |
439 | 177 | |
440 | 1.26k | while(blocks) |
441 | 1.08k | { |
442 | 1.08k | const size_t proc_blocks = std::min(blocks, par_blocks()); |
443 | 1.08k | const size_t proc_bytes = proc_blocks * BS; |
444 | 1.08k | |
445 | 1.08k | const uint8_t* offsets = m_L->compute_offsets(m_block_index, proc_blocks); |
446 | 1.08k | |
447 | 1.08k | m_cipher->decrypt_n_xex(buffer, offsets, proc_blocks); |
448 | 1.08k | |
449 | 1.08k | xor_buf(m_checksum.data(), buffer, proc_bytes); |
450 | 1.08k | |
451 | 1.08k | buffer += proc_bytes; |
452 | 1.08k | blocks -= proc_blocks; |
453 | 1.08k | m_block_index += proc_blocks; |
454 | 1.08k | } |
455 | 177 | } |
456 | | |
457 | | size_t OCB_Decryption::process(uint8_t buf[], size_t sz) |
458 | 0 | { |
459 | 0 | BOTAN_ASSERT(sz % update_granularity() == 0, "Invalid OCB input size"); |
460 | 0 | decrypt(buf, sz / block_size()); |
461 | 0 | return sz; |
462 | 0 | } |
463 | | |
464 | | void OCB_Decryption::finish(secure_vector<uint8_t>& buffer, size_t offset) |
465 | 186 | { |
466 | 186 | verify_key_set(m_L != nullptr); |
467 | 186 | |
468 | 186 | const size_t BS = block_size(); |
469 | 186 | |
470 | 186 | BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane"); |
471 | 186 | const size_t sz = buffer.size() - offset; |
472 | 186 | uint8_t* buf = buffer.data() + offset; |
473 | 186 | |
474 | 186 | BOTAN_ASSERT(sz >= tag_size(), "We have the tag"); |
475 | 186 | |
476 | 186 | const size_t remaining = sz - tag_size(); |
477 | 186 | |
478 | 186 | secure_vector<uint8_t> mac(BS); |
479 | 186 | |
480 | 186 | if(remaining) |
481 | 177 | { |
482 | 177 | const size_t final_full_blocks = remaining / BS; |
483 | 177 | const size_t final_bytes = remaining - (final_full_blocks * BS); |
484 | 177 | |
485 | 177 | decrypt(buf, final_full_blocks); |
486 | 177 | mac ^= m_L->offset(); |
487 | 177 | |
488 | 177 | if(final_bytes) |
489 | 133 | { |
490 | 133 | BOTAN_ASSERT(final_bytes < BS, "Only a partial block left"); |
491 | 133 | |
492 | 133 | uint8_t* remainder = &buf[remaining - final_bytes]; |
493 | 133 | |
494 | 133 | mac ^= m_L->star(); |
495 | 133 | secure_vector<uint8_t> pad(BS); |
496 | 133 | m_cipher->encrypt(mac, pad); // P_* |
497 | 133 | xor_buf(remainder, pad.data(), final_bytes); |
498 | 133 | |
499 | 133 | xor_buf(m_checksum.data(), remainder, final_bytes); |
500 | 133 | m_checksum[final_bytes] ^= 0x80; |
501 | 133 | } |
502 | 177 | } |
503 | 9 | else |
504 | 9 | mac = m_L->offset(); |
505 | 186 | |
506 | 186 | // compute the mac |
507 | 186 | |
508 | 186 | // fold checksum |
509 | 3.16k | for(size_t i = 0; i != m_checksum.size(); i += BS) |
510 | 2.97k | { |
511 | 2.97k | xor_buf(mac.data(), m_checksum.data() + i, BS); |
512 | 2.97k | } |
513 | 186 | |
514 | 186 | mac ^= m_L->dollar(); |
515 | 186 | m_cipher->encrypt(mac); |
516 | 186 | mac ^= m_ad_hash; |
517 | 186 | |
518 | 186 | // reset state |
519 | 186 | zeroise(m_checksum); |
520 | 186 | m_block_index = 0; |
521 | 186 | |
522 | 186 | // compare mac |
523 | 186 | const uint8_t* included_tag = &buf[remaining]; |
524 | 186 | |
525 | 186 | if(!constant_time_compare(mac.data(), included_tag, tag_size())) |
526 | 186 | throw Invalid_Authentication_Tag("OCB tag check failed"); |
527 | 0 | |
528 | 0 | // remove tag from end of message |
529 | 0 | buffer.resize(remaining + offset); |
530 | 0 | } |
531 | | |
532 | | } |