/src/boringssl/crypto/fipsmodule/modes/polyval.c.inc
Line | Count | Source (jump to first uncovered line) |
1 | | /* Copyright (c) 2016, Google Inc. |
2 | | * |
3 | | * Permission to use, copy, modify, and/or distribute this software for any |
4 | | * purpose with or without fee is hereby granted, provided that the above |
5 | | * copyright notice and this permission notice appear in all copies. |
6 | | * |
7 | | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
8 | | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
9 | | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
10 | | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
11 | | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
12 | | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
13 | | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
14 | | |
15 | | #include <openssl/base.h> |
16 | | |
17 | | #include <assert.h> |
18 | | #include <string.h> |
19 | | |
20 | | #include "internal.h" |
21 | | #include "../../internal.h" |
22 | | |
23 | | |
24 | | // byte_reverse reverses the order of the bytes in |b->c|. |
25 | 0 | static void byte_reverse(uint8_t b[16]) { |
26 | 0 | uint64_t hi = CRYPTO_load_u64_le(b); |
27 | 0 | uint64_t lo = CRYPTO_load_u64_le(b + 8); |
28 | 0 | CRYPTO_store_u64_le(b, CRYPTO_bswap8(lo)); |
29 | 0 | CRYPTO_store_u64_le(b + 8, CRYPTO_bswap8(hi)); |
30 | 0 | } |
31 | | |
32 | | // reverse_and_mulX_ghash interprets |b| as a reversed element of the GHASH |
33 | | // field, multiplies that by 'x' and serialises the result back into |b|, but |
34 | | // with GHASH's backwards bit ordering. |
35 | 0 | static void reverse_and_mulX_ghash(uint8_t b[16]) { |
36 | 0 | uint64_t hi = CRYPTO_load_u64_le(b); |
37 | 0 | uint64_t lo = CRYPTO_load_u64_le(b + 8); |
38 | 0 | const crypto_word_t carry = constant_time_eq_w(hi & 1, 1); |
39 | 0 | hi >>= 1; |
40 | 0 | hi |= lo << 63; |
41 | 0 | lo >>= 1; |
42 | 0 | lo ^= ((uint64_t) constant_time_select_w(carry, 0xe1, 0)) << 56; |
43 | |
|
44 | 0 | CRYPTO_store_u64_le(b, CRYPTO_bswap8(lo)); |
45 | 0 | CRYPTO_store_u64_le(b + 8, CRYPTO_bswap8(hi)); |
46 | 0 | } |
47 | | |
48 | | // POLYVAL(H, X_1, ..., X_n) = |
49 | | // ByteReverse(GHASH(mulX_GHASH(ByteReverse(H)), ByteReverse(X_1), ..., |
50 | | // ByteReverse(X_n))). |
51 | | // |
52 | | // See https://www.rfc-editor.org/rfc/rfc8452.html#appendix-A. |
53 | | |
54 | 0 | void CRYPTO_POLYVAL_init(struct polyval_ctx *ctx, const uint8_t key[16]) { |
55 | 0 | alignas(8) uint8_t H[16]; |
56 | 0 | OPENSSL_memcpy(H, key, 16); |
57 | 0 | reverse_and_mulX_ghash(H); |
58 | |
|
59 | 0 | int is_avx; |
60 | 0 | CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, ctx->Htable, &is_avx, H); |
61 | 0 | OPENSSL_memset(&ctx->S, 0, sizeof(ctx->S)); |
62 | 0 | } |
63 | | |
64 | | void CRYPTO_POLYVAL_update_blocks(struct polyval_ctx *ctx, const uint8_t *in, |
65 | 0 | size_t in_len) { |
66 | 0 | assert((in_len & 15) == 0); |
67 | 0 | alignas(8) uint8_t buf[32 * 16]; |
68 | |
|
69 | 0 | while (in_len > 0) { |
70 | 0 | size_t todo = in_len; |
71 | 0 | if (todo > sizeof(buf)) { |
72 | 0 | todo = sizeof(buf); |
73 | 0 | } |
74 | 0 | OPENSSL_memcpy(buf, in, todo); |
75 | 0 | in += todo; |
76 | 0 | in_len -= todo; |
77 | |
|
78 | 0 | size_t blocks = todo / 16; |
79 | 0 | for (size_t i = 0; i < blocks; i++) { |
80 | 0 | byte_reverse(buf + 16 * i); |
81 | 0 | } |
82 | |
|
83 | 0 | ctx->ghash(ctx->S, ctx->Htable, buf, todo); |
84 | 0 | } |
85 | 0 | } |
86 | | |
87 | 0 | void CRYPTO_POLYVAL_finish(const struct polyval_ctx *ctx, uint8_t out[16]) { |
88 | 0 | OPENSSL_memcpy(out, &ctx->S, 16); |
89 | 0 | byte_reverse(out); |
90 | 0 | } |