//

// BlockCipherModes.c   generic implementation of all block cipher modes

//

// Copyright (c) Microsoft Corporation. Licensed under the MIT license.

//

#include "precomp.h"

VOID

SYMCRYPT_CALL

SymCryptEcbEncrypt(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

    _In_                        PCVOID                  pExpandedKey,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

{

    SIZE_T i;

    SIZE_T cbToDo = cbData & ~(pBlockCipher->blockSize - 1);

    if( pBlockCipher->ecbEncryptFunc != NULL )

    {

        //

        // Use optimized implementation if available

        //

        (*pBlockCipher->ecbEncryptFunc)( pExpandedKey, pbSrc, pbDst, cbData );

        return;

    }

    //

    // To avoid buffer overruns we truncate the work to an integral number of blocks.

    //

    for( i=0; i<cbToDo; i+= pBlockCipher->blockSize )

    {

        (*pBlockCipher->encryptFunc)( pExpandedKey, pbSrc + i, pbDst + i );

    }

}

VOID

SYMCRYPT_CALL

SymCryptEcbDecrypt(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

    _In_                        PCVOID                  pExpandedKey,

    _In_reads_( cbData )       PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

{

    SIZE_T i;

    SIZE_T cbToDo = cbData & ~(pBlockCipher->blockSize - 1);

    if( pBlockCipher->ecbDecryptFunc != NULL )

    {

        //

        // Use optimized implementation if available

        //

        (*pBlockCipher->ecbDecryptFunc)( pExpandedKey, pbSrc, pbDst, cbData );

        return;

    }

    for( i=0; i<cbToDo; i+= pBlockCipher->blockSize )

    {

        (*pBlockCipher->decryptFunc)( pExpandedKey, pbSrc + i, pbDst + i );

    }

}

//

// SymCryptCbcEncrypt

//

// Generic CBC encryption routine for block ciphers.

// The following restrictions must be obeyed:

//  - blockSize <= 32 and must be a power of 2

//  - cbData must be a multiple of the block size

//

VOID

SYMCRYPT_CALL

SymCryptCbcEncrypt(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

    _In_                        PCVOID                  pExpandedKey,

    _Inout_updates_( pBlockCipher->blockSize )

                                PBYTE                   pbChainingValue,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

{

    SYMCRYPT_ALIGN BYTE    buf[SYMCRYPT_MAX_BLOCK_SIZE];

    SIZE_T blockSize;

    PCBYTE pbSrcEnd;

    PCBYTE pSrc = pbSrc;

    PBYTE  pDst = pbDst;

    if( pBlockCipher->cbcEncryptFunc != NULL )

    {

        //

        // Use optimized implementation if available

        //

        (*pBlockCipher->cbcEncryptFunc)( pExpandedKey, pbChainingValue, pSrc, pDst, cbData );

        return;

    }

    blockSize = pBlockCipher->blockSize;

    SYMCRYPT_ASSERT( blockSize <= SYMCRYPT_MAX_BLOCK_SIZE );

    //

    // Compute the end of the data, rounding the size down to a multiple of the block size.

    //

    pbSrcEnd = &pbSrc[ cbData & ~(blockSize - 1) ];

    //

    // We keep the chaining state in a local buffer to enforce the read-once write-once rule.

    //

    memcpy( buf, pbChainingValue, blockSize );

    while( pSrc < pbSrcEnd )

    {

        SYMCRYPT_ASSERT( pSrc <= pbSrc + cbData - blockSize );  // help PreFast

        SYMCRYPT_ASSERT( pDst <= pbDst + cbData - blockSize );  // help PreFast

        SYMCRYPT_ASSERT( blockSize <= cbData );                 // help PreFast

        SymCryptXorBytes( pSrc, buf, buf, blockSize );

        (*pBlockCipher->encryptFunc)( pExpandedKey, buf, buf );

        memcpy( pDst, buf, blockSize );

        pSrc += blockSize;

        pDst += blockSize;

    }

    memcpy( pbChainingValue, buf, blockSize );

    SymCryptWipeKnownSize( buf, sizeof( buf ));

}

//

// SymCryptCbcDecrypt

//

// Generic CBC decryption routine for block ciphers.

// The following restrictions must be obeyed:

//  - blockSize <= 32 and must be a power of 2

//  - cbData must be a multiple of the block size

//

VOID

SYMCRYPT_CALL

SymCryptCbcDecrypt(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

    _In_                        PCVOID                  pExpandedKey,

    _Inout_updates_( pBlockCipher->blockSize )

                                PBYTE                   pbChainingValue,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

{

    SYMCRYPT_ALIGN BYTE buf[3 * SYMCRYPT_MAX_BLOCK_SIZE];

    PBYTE chain = &buf[0];

    PBYTE ciphertext = &buf[SYMCRYPT_MAX_BLOCK_SIZE];

    PBYTE tmp = &buf[2*SYMCRYPT_MAX_BLOCK_SIZE];

    SIZE_T blockSize;

    PCBYTE pbSrcEnd;

    if( pBlockCipher->cbcDecryptFunc != NULL )

    {

        (*pBlockCipher->cbcDecryptFunc)( pExpandedKey, pbChainingValue, pbSrc, pbDst, cbData );

        return;

    }

    blockSize = pBlockCipher->blockSize;

    SYMCRYPT_ASSERT( blockSize <= SYMCRYPT_MAX_BLOCK_SIZE );

    //

    // Compute the end of the data, rounding the size down to a multiple of the block size.

    //

    pbSrcEnd = &pbSrc[ cbData & ~(blockSize-1) ];

#pragma warning(suppress: 22105)

    memcpy( chain, pbChainingValue, blockSize );

    //

    // Loop structured to obey the read-once/write-once rule

    //

    while( pbSrc < pbSrcEnd )

    {

        SYMCRYPT_ASSERT( pbSrc <= pbSrcEnd - blockSize );   // help PreFast

        memcpy( ciphertext, pbSrc, blockSize );

        (*pBlockCipher->decryptFunc)( pExpandedKey, ciphertext, tmp );

        SymCryptXorBytes( tmp, chain, pbDst, blockSize );

        memcpy( chain, ciphertext, blockSize );

        pbDst += blockSize;

        pbSrc += blockSize;

    }

    memcpy( pbChainingValue, chain, blockSize );

    SymCryptWipeKnownSize( buf, sizeof( buf ));

}

VOID

SYMCRYPT_CALL

SymCryptCbcMac(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

    _In_                        PCVOID                  pExpandedKey,

    _Inout_updates_( pBlockCipher->blockSize )

                                PBYTE                   pbChainingValue,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

                                SIZE_T                  cbData )

{

    SYMCRYPT_ALIGN BYTE    buf[32];

    SIZE_T blockSize;

    PCBYTE pbSrcEnd;

    PCBYTE p;

    if( pBlockCipher->cbcMacFunc != NULL )

    {

        //

        // Use optimized implementation if available

        //

        (*pBlockCipher->cbcMacFunc)( pExpandedKey, pbChainingValue, pbSrc, cbData );

        return;

    }

    blockSize = pBlockCipher->blockSize;

    SYMCRYPT_ASSERT( blockSize <= SYMCRYPT_MAX_BLOCK_SIZE );

    //

    // Compute the end of the data, rounding the size down to a multiple of the block size.

    //

    pbSrcEnd = &pbSrc[ cbData & ~(blockSize - 1) ];

    //

    // We keep the chaining state in a local buffer to enforce the read-once write-once rule.

    // It also improves memory locality.

    //

    memcpy( buf, pbChainingValue, blockSize );

    p = pbSrc;

    while( p < pbSrcEnd )

    {

        SYMCRYPT_ASSERT( p <= pbSrc + cbData - blockSize );

        SymCryptXorBytes( p, buf, buf, blockSize );

        (*pBlockCipher->encryptFunc)( pExpandedKey, buf, buf );

        p += blockSize;

    }

    memcpy( pbChainingValue, buf, blockSize );

    SymCryptWipeKnownSize( buf, sizeof( buf ));

}

VOID

SYMCRYPT_CALL

SymCryptCtrMsb32(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

    _In_                        PCVOID                  pExpandedKey,

    _Inout_updates_( pBlockCipher->blockSize )

                                PBYTE                   pbChainingValue,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

{

    SYMCRYPT_ALIGN BYTE buf[2 * SYMCRYPT_MAX_BLOCK_SIZE];

    PBYTE count = &buf[0];

    PBYTE keystream= &buf[SYMCRYPT_MAX_BLOCK_SIZE];

    SIZE_T blockSize;

    PCBYTE pbSrcEnd;

    blockSize = pBlockCipher->blockSize;

    SYMCRYPT_ASSERT( blockSize <= SYMCRYPT_MAX_BLOCK_SIZE );

    //

    // Compute the end of the data, rounding the size down to a multiple of the block size.

    //

    pbSrcEnd = &pbSrc[ cbData & ~(blockSize - 1) ];

    //

    // We keep the chaining state in a local buffer to enforce the read-once write-once rule.

    // It also improves memory locality.

    //

    #pragma warning(suppress: 22105)

    memcpy( count, pbChainingValue, blockSize );

    while( pbSrc < pbSrcEnd )

    {

        SYMCRYPT_ASSERT( pbSrc <= pbSrcEnd - blockSize );   // help PreFast

        (*pBlockCipher->encryptFunc)( pExpandedKey, count, keystream );

        SymCryptXorBytes( keystream, pbSrc, pbDst, blockSize );

        //

        // We only need to increment the last 32 bits of the counter value.

        //

        SYMCRYPT_STORE_MSBFIRST32( &count[ blockSize-4 ], 1 + SYMCRYPT_LOAD_MSBFIRST32( &count[ blockSize-4 ] ) );

        pbSrc += blockSize;

        pbDst += blockSize;

    }

    memcpy( pbChainingValue, count, blockSize );

    SymCryptWipeKnownSize( buf, sizeof( buf ));

}

VOID

SYMCRYPT_CALL

SymCryptCtrMsb64(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

    _In_                        PCVOID                  pExpandedKey,

    _Inout_updates_( pBlockCipher->blockSize )

                                PBYTE                   pbChainingValue,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

{

    SYMCRYPT_ALIGN BYTE    buf[2 * SYMCRYPT_MAX_BLOCK_SIZE];

    PBYTE   count = &buf[0];

    PBYTE   keystream= &buf[SYMCRYPT_MAX_BLOCK_SIZE];

    SIZE_T blockSize;

    PCBYTE pbSrcEnd;

    if( pBlockCipher->ctrMsb64Func != NULL )

    {

        //

        // Use optimized implementation if available

        //

        (*pBlockCipher->ctrMsb64Func)( pExpandedKey, pbChainingValue, pbSrc, pbDst, cbData );

        return;

    }

    blockSize = pBlockCipher->blockSize;

    SYMCRYPT_ASSERT( blockSize <= SYMCRYPT_MAX_BLOCK_SIZE );

    //

    // Compute the end of the data, rounding the size down to a multiple of the block size.

    //

    pbSrcEnd = &pbSrc[ cbData & ~(blockSize - 1) ];

    //

    // We keep the chaining state in a local buffer to enforce the read-once write-once rule.

    // It also improves memory locality.

    //

    #pragma warning(suppress: 22105)

    memcpy( count, pbChainingValue, blockSize );

    while( pbSrc < pbSrcEnd )

    {

        SYMCRYPT_ASSERT( pbSrc <= pbSrcEnd - blockSize );   // help PreFast

        (*pBlockCipher->encryptFunc)( pExpandedKey, count, keystream );

        SymCryptXorBytes( keystream, pbSrc, pbDst, blockSize );

        //

        // We only need to increment the last 64 bits of the counter value.

        //

        SYMCRYPT_STORE_MSBFIRST64( &count[ blockSize-8 ], 1 + SYMCRYPT_LOAD_MSBFIRST64( &count[ blockSize-8 ] ) );

        pbSrc += blockSize;

        pbDst += blockSize;

    }

    memcpy( pbChainingValue, count, blockSize );

    SymCryptWipeKnownSize( buf, sizeof( buf ));

}

VOID

SYMCRYPT_CALL

SymCryptCfbEncrypt(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

                                SIZE_T                  cbShift,

    _In_                        PCVOID                  pExpandedKey,

        _Inout_updates_( pBlockCipher->blockSize )

                                PBYTE                   pbChainingValue,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

//

// Encrypt a buffer using the CFB cipher mode.

//

// This implements the CFB mode using a 1-byte feedback shift.

// This requires a block cipher encryption call for each byte, which is very slow.

// Use of this cipher mode is not recommended.

//

// - pBlockCipher is a pointer to the block cipher description table.

//      Suitable description tables for all ciphers in this library have been pre-defined.

// - pExpandedKey points to the expanded key to use. This generic function uses PVOID so there

//      is no type safety to ensure that the expanded key and the encryption function match.

// - pbChainingValue points to the chaining value. On entry and exit it

//      contains the last blockSize ciphertext bytes.

// - pbSrc is the input data buffer that will be encrypted/decrypted.

// - cbData. Number of bytes to encrypt/decrypt. This must be a multiple of the block size.

// - pbDst is the output buffer that receives the encrypted/decrypted data. The input and output

//      buffers may be the same or non-overlapping, but may not partially overlap.

//

{

    SYMCRYPT_ALIGN BYTE buf[2*SYMCRYPT_MAX_BLOCK_SIZE];

    PBYTE   chain = &buf[0];

    PBYTE   tmp   = &buf[SYMCRYPT_MAX_BLOCK_SIZE];

    SIZE_T  blockSize;

    blockSize = pBlockCipher->blockSize;

    SYMCRYPT_ASSERT( blockSize <= SYMCRYPT_MAX_BLOCK_SIZE );

    // Force cbShift to either be 1 or blockSize

    if(cbShift != 1)

    {

        cbShift = blockSize;

    }

    memcpy( chain, pbChainingValue, blockSize );

    while( cbData >= cbShift )

    {

        (*pBlockCipher->encryptFunc)( pExpandedKey, chain, tmp );

        SymCryptXorBytes( pbSrc, tmp, tmp, cbShift );           // tmp[0..cbShift-1] ^= pbSrc[0..cbShift-1]

        memcpy( pbDst, tmp, cbShift );

        memmove( chain, chain + cbShift, blockSize - cbShift );

        memcpy( chain + blockSize - cbShift, tmp, cbShift );

        pbDst += cbShift;

        pbSrc += cbShift;

        cbData -= cbShift;

    }

    memcpy( pbChainingValue, chain, blockSize );

}

VOID

SYMCRYPT_CALL

SymCryptCfbDecrypt(

    _In_                        PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,

                                SIZE_T                  cbShift,

    _In_                        PCVOID                  pExpandedKey,

    _Inout_updates_( pBlockCipher->blockSize )

                                PBYTE                   pbChainingValue,

    _In_reads_( cbData )        PCBYTE                  pbSrc,

    _Out_writes_( cbData )      PBYTE                   pbDst,

                                SIZE_T                  cbData )

{

    SYMCRYPT_ALIGN BYTE buf[2*SYMCRYPT_MAX_BLOCK_SIZE];

    PBYTE   chain = &buf[0];

    PBYTE   tmp   = &buf[SYMCRYPT_MAX_BLOCK_SIZE];

    SIZE_T  blockSize;

    blockSize = pBlockCipher->blockSize;

    SYMCRYPT_ASSERT( blockSize <= SYMCRYPT_MAX_BLOCK_SIZE );

    // Force cbShift to either be 1 or blockSize

    if(cbShift != 1)

    {

        cbShift = blockSize;

    }

    memcpy( chain, pbChainingValue, blockSize );

    while( cbData >= cbShift )

    {

        (*pBlockCipher->encryptFunc)( pExpandedKey, chain, tmp );

        //

        // First we update the chain block

        //

        memmove( chain, chain + cbShift, blockSize - cbShift );

        memcpy( chain + blockSize - cbShift, pbSrc, cbShift );

        //

        // To obey the read-once rule, we take the ciphertext from the updated chain block.

        //

        SymCryptXorBytes( chain + blockSize - cbShift, tmp, pbDst, cbShift );

        pbDst += cbShift;

        pbSrc += cbShift;

        cbData -= cbShift;

    }

    memcpy( pbChainingValue, chain, blockSize );

}