Coverage Report

Created: 2020-05-23 13:54

/src/botan/src/lib/stream/ctr/ctr.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* Counter mode
3
* (C) 1999-2011,2014 Jack Lloyd
4
*
5
* Botan is released under the Simplified BSD License (see license.txt)
6
*/
7
8
#include <botan/ctr.h>
9
#include <botan/exceptn.h>
10
#include <botan/loadstor.h>
11
#include <botan/internal/bit_ops.h>
12
13
namespace Botan {
14
15
CTR_BE::CTR_BE(BlockCipher* ciph) :
16
   m_cipher(ciph),
17
   m_block_size(m_cipher->block_size()),
18
   m_ctr_size(m_block_size),
19
   m_ctr_blocks(m_cipher->parallel_bytes() / m_block_size),
20
   m_counter(m_cipher->parallel_bytes()),
21
   m_pad(m_counter.size()),
22
   m_pad_pos(0)
23
0
   {
24
0
   }
25
26
CTR_BE::CTR_BE(BlockCipher* cipher, size_t ctr_size) :
27
   m_cipher(cipher),
28
   m_block_size(m_cipher->block_size()),
29
   m_ctr_size(ctr_size),
30
   m_ctr_blocks(m_cipher->parallel_bytes() / m_block_size),
31
   m_counter(m_cipher->parallel_bytes()),
32
   m_pad(m_counter.size()),
33
   m_pad_pos(0)
34
899
   {
35
899
   BOTAN_ARG_CHECK(m_ctr_size >= 4 && m_ctr_size <= m_block_size,
36
899
                   "Invalid CTR-BE counter size");
37
899
   }
38
39
void CTR_BE::clear()
40
0
   {
41
0
   m_cipher->clear();
42
0
   zeroise(m_pad);
43
0
   zeroise(m_counter);
44
0
   zap(m_iv);
45
0
   m_pad_pos = 0;
46
0
   }
47
48
size_t CTR_BE::default_iv_length() const
49
0
   {
50
0
   return m_block_size;
51
0
   }
52
53
bool CTR_BE::valid_iv_length(size_t iv_len) const
54
2.88k
   {
55
2.88k
   return (iv_len <= m_block_size);
56
2.88k
   }
57
58
Key_Length_Specification CTR_BE::key_spec() const
59
1.79k
   {
60
1.79k
   return m_cipher->key_spec();
61
1.79k
   }
62
63
CTR_BE* CTR_BE::clone() const
64
0
   {
65
0
   return new CTR_BE(m_cipher->clone(), m_ctr_size);
66
0
   }
67
68
void CTR_BE::key_schedule(const uint8_t key[], size_t key_len)
69
899
   {
70
899
   m_cipher->set_key(key, key_len);
71
899
72
899
   // Set a default all-zeros IV
73
899
   set_iv(nullptr, 0);
74
899
   }
75
76
std::string CTR_BE::name() const
77
0
   {
78
0
   if(m_ctr_size == m_block_size)
79
0
      return ("CTR-BE(" + m_cipher->name() + ")");
80
0
   else
81
0
      return ("CTR-BE(" + m_cipher->name() + "," + std::to_string(m_ctr_size) + ")");
82
0
83
0
   }
84
85
void CTR_BE::cipher(const uint8_t in[], uint8_t out[], size_t length)
86
3.06k
   {
87
3.06k
   verify_key_set(m_iv.empty() == false);
88
3.06k
89
3.06k
   const uint8_t* pad_bits = &m_pad[0];
90
3.06k
   const size_t pad_size = m_pad.size();
91
3.06k
92
3.06k
   if(m_pad_pos > 0)
93
1.08k
      {
94
1.08k
      const size_t avail = pad_size - m_pad_pos;
95
1.08k
      const size_t take = std::min(length, avail);
96
1.08k
      xor_buf(out, in, pad_bits + m_pad_pos, take);
97
1.08k
      length -= take;
98
1.08k
      in += take;
99
1.08k
      out += take;
100
1.08k
      m_pad_pos += take;
101
1.08k
102
1.08k
      if(take == avail)
103
204
         {
104
204
         add_counter(m_ctr_blocks);
105
204
         m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks);
106
204
         m_pad_pos = 0;
107
204
         }
108
1.08k
      }
109
3.06k
110
8.00k
   while(length >= pad_size)
111
4.93k
      {
112
4.93k
      xor_buf(out, in, pad_bits, pad_size);
113
4.93k
      length -= pad_size;
114
4.93k
      in += pad_size;
115
4.93k
      out += pad_size;
116
4.93k
117
4.93k
      add_counter(m_ctr_blocks);
118
4.93k
      m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks);
119
4.93k
      }
120
3.06k
121
3.06k
   xor_buf(out, in, pad_bits, length);
122
3.06k
   m_pad_pos += length;
123
3.06k
   }
124
125
void CTR_BE::set_iv(const uint8_t iv[], size_t iv_len)
126
2.88k
   {
127
2.88k
   if(!valid_iv_length(iv_len))
128
0
      throw Invalid_IV_Length(name(), iv_len);
129
2.88k
130
2.88k
   m_iv.resize(m_block_size);
131
2.88k
   zeroise(m_iv);
132
2.88k
   buffer_insert(m_iv, 0, iv, iv_len);
133
2.88k
134
2.88k
   seek(0);
135
2.88k
   }
136
137
void CTR_BE::add_counter(const uint64_t counter)
138
5.13k
   {
139
5.13k
   const size_t ctr_size = m_ctr_size;
140
5.13k
   const size_t ctr_blocks = m_ctr_blocks;
141
5.13k
   const size_t BS = m_block_size;
142
5.13k
143
5.13k
   if(ctr_size == 4)
144
5.13k
      {
145
5.13k
      const size_t off = (BS - 4);
146
5.13k
      const uint32_t low32 = static_cast<uint32_t>(counter + load_be<uint32_t>(&m_counter[off], 0));
147
5.13k
148
28.6k
      for(size_t i = 0; i != ctr_blocks; ++i)
149
23.4k
         {
150
23.4k
         store_be(uint32_t(low32 + i), &m_counter[i*BS+off]);
151
23.4k
         }
152
5.13k
      }
153
0
   else if(ctr_size == 8)
154
0
      {
155
0
      const size_t off = (BS - 8);
156
0
      const uint64_t low64 = counter + load_be<uint64_t>(&m_counter[off], 0);
157
0
158
0
      for(size_t i = 0; i != ctr_blocks; ++i)
159
0
         {
160
0
         store_be(uint64_t(low64 + i), &m_counter[i*BS+off]);
161
0
         }
162
0
      }
163
0
   else if(ctr_size == 16)
164
0
      {
165
0
      const size_t off = (BS - 16);
166
0
      uint64_t b0 = load_be<uint64_t>(&m_counter[off], 0);
167
0
      uint64_t b1 = load_be<uint64_t>(&m_counter[off], 1);
168
0
      b1 += counter;
169
0
      b0 += (b1 < counter) ? 1 : 0; // carry
170
0
171
0
      for(size_t i = 0; i != ctr_blocks; ++i)
172
0
         {
173
0
         store_be(b0, &m_counter[i*BS+off]);
174
0
         store_be(b1, &m_counter[i*BS+off+8]);
175
0
         b1 += 1;
176
0
         b0 += (b1 == 0); // carry
177
0
         }
178
0
      }
179
0
   else
180
0
      {
181
0
      for(size_t i = 0; i != ctr_blocks; ++i)
182
0
         {
183
0
         uint64_t local_counter = counter;
184
0
         uint16_t carry = static_cast<uint8_t>(local_counter);
185
0
         for(size_t j = 0; (carry || local_counter) && j != ctr_size; ++j)
186
0
            {
187
0
            const size_t off = i*BS + (BS-1-j);
188
0
            const uint16_t cnt = static_cast<uint16_t>(m_counter[off]) + carry;
189
0
            m_counter[off] = static_cast<uint8_t>(cnt);
190
0
            local_counter = (local_counter >> 8);
191
0
            carry = (cnt >> 8) + static_cast<uint8_t>(local_counter);
192
0
            }
193
0
         }
194
0
      }
195
5.13k
   }
196
197
void CTR_BE::seek(uint64_t offset)
198
2.88k
   {
199
2.88k
   verify_key_set(m_iv.empty() == false);
200
2.88k
201
2.88k
   const uint64_t base_counter = m_ctr_blocks * (offset / m_counter.size());
202
2.88k
203
2.88k
   zeroise(m_counter);
204
2.88k
   buffer_insert(m_counter, 0, m_iv);
205
2.88k
206
2.88k
   const size_t BS = m_block_size;
207
2.88k
208
2.88k
   // Set m_counter blocks to IV, IV + 1, ... IV + n
209
2.88k
210
2.88k
   if(m_ctr_size == 4 && BS >= 8)
211
2.88k
      {
212
2.88k
      const uint32_t low32 = load_be<uint32_t>(&m_counter[BS-4], 0);
213
2.88k
214
2.88k
      if(m_ctr_blocks >= 4 && is_power_of_2(m_ctr_blocks))
215
2.88k
         {
216
2.88k
         size_t written = 1;
217
11.2k
         while(written < m_ctr_blocks)
218
8.36k
            {
219
8.36k
            copy_mem(&m_counter[written*BS], &m_counter[0], BS*written);
220
8.36k
            written *= 2;
221
8.36k
            }
222
2.88k
         }
223
0
      else
224
0
         {
225
0
         for(size_t i = 1; i != m_ctr_blocks; ++i)
226
0
            {
227
0
            copy_mem(&m_counter[i*BS], &m_counter[0], BS - 4);
228
0
            }
229
0
         }
230
2.88k
231
27.1k
      for(size_t i = 1; i != m_ctr_blocks; ++i)
232
24.2k
         {
233
24.2k
         const uint32_t c = static_cast<uint32_t>(low32 + i);
234
24.2k
         store_be(c, &m_counter[(BS-4)+i*BS]);
235
24.2k
         }
236
2.88k
      }
237
0
   else
238
0
      {
239
0
      // do everything sequentially:
240
0
      for(size_t i = 1; i != m_ctr_blocks; ++i)
241
0
         {
242
0
         buffer_insert(m_counter, i*BS, &m_counter[(i-1)*BS], BS);
243
0
244
0
         for(size_t j = 0; j != m_ctr_size; ++j)
245
0
            if(++m_counter[i*BS + (BS - 1 - j)])
246
0
               break;
247
0
         }
248
0
      }
249
2.88k
250
2.88k
   if(base_counter > 0)
251
0
      add_counter(base_counter);
252
2.88k
253
2.88k
   m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks);
254
2.88k
   m_pad_pos = offset % m_counter.size();
255
2.88k
   }
256
}