/* cipher-cbc.c  - Generic CBC mode implementation

 * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003

 *               2005, 2007, 2008, 2009, 2011 Free Software Foundation, Inc.

 *

 * This file is part of Libgcrypt.

 *

 * Libgcrypt is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser general Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * Libgcrypt is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, see <http://www.gnu.org/licenses/>.

 */

#include <config.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#include "g10lib.h"

#include "cipher.h"

#include "./cipher-internal.h"

#include "bufhelp.h"

static inline unsigned int

cbc_encrypt_inner(gcry_cipher_hd_t c, unsigned char *outbuf,

                  const unsigned char *inbuf, size_t nblocks, size_t blocksize,

                  int is_cbc_cmac)

{

  unsigned int burn, nburn;

  size_t n;

  burn = 0;

  if (c->bulk.cbc_enc)

    {

      c->bulk.cbc_enc (&c->context.c, c->u_iv.iv, outbuf, inbuf, nblocks,

                       is_cbc_cmac);

    }

  else

    {

      gcry_cipher_encrypt_t enc_fn = c->spec->encrypt;

      unsigned char *ivp;

      ivp = c->u_iv.iv;

      for (n=0; n < nblocks; n++ )

        {

          cipher_block_xor (outbuf, inbuf, ivp, blocksize);

          nburn = enc_fn ( &c->context.c, outbuf, outbuf );

          burn = nburn > burn ? nburn : burn;

          ivp = outbuf;

          inbuf += blocksize;

          if (!is_cbc_cmac)

            outbuf += blocksize;

        }

      if (ivp != c->u_iv.iv)

        cipher_block_cpy (c->u_iv.iv, ivp, blocksize);

    }

  return burn;

}

gcry_err_code_t

_gcry_cipher_cbc_encrypt (gcry_cipher_hd_t c,

                          unsigned char *outbuf, size_t outbuflen,

                          const unsigned char *inbuf, size_t inbuflen)

{

  size_t blocksize_shift = _gcry_blocksize_shift(c);

  size_t blocksize = 1 << blocksize_shift;

  size_t blocksize_mask = blocksize - 1;

  size_t nblocks = inbuflen >> blocksize_shift;

  int is_cbc_cmac = !!(c->flags & GCRY_CIPHER_CBC_MAC);

  unsigned int burn;

  if (outbuflen < (is_cbc_cmac ? blocksize : inbuflen))

    return GPG_ERR_BUFFER_TOO_SHORT;

  if (inbuflen & blocksize_mask)

    return GPG_ERR_INV_LENGTH;

  burn = cbc_encrypt_inner(c, outbuf, inbuf, nblocks, blocksize, is_cbc_cmac);

  if (burn > 0)

    _gcry_burn_stack (burn + 4 * sizeof(void *));

  return 0;

}

gcry_err_code_t

_gcry_cipher_cbc_cts_encrypt (gcry_cipher_hd_t c,

                              unsigned char *outbuf, size_t outbuflen,

                              const unsigned char *inbuf, size_t inbuflen)

{

  size_t blocksize_shift = _gcry_blocksize_shift(c);

  size_t blocksize = 1 << blocksize_shift;

  size_t blocksize_mask = blocksize - 1;

  gcry_cipher_encrypt_t enc_fn = c->spec->encrypt;

  size_t nblocks = inbuflen >> blocksize_shift;

  unsigned int burn, nburn;

  unsigned char *ivp;

  int i;

  if (outbuflen < inbuflen)

    return GPG_ERR_BUFFER_TOO_SHORT;

  if ((inbuflen & blocksize_mask) && !(inbuflen > blocksize))

    return GPG_ERR_INV_LENGTH;

  burn = 0;

  if (inbuflen > blocksize)

    {

      if ((inbuflen & blocksize_mask) == 0)

  nblocks--;

    }

  burn = cbc_encrypt_inner(c, outbuf, inbuf, nblocks, blocksize, 0);

  inbuf += nblocks << blocksize_shift;

  outbuf += nblocks << blocksize_shift;

  if (inbuflen > blocksize)

    {

      /* We have to be careful here, since outbuf might be equal to

         inbuf.  */

      size_t restbytes;

      unsigned char b;

      if ((inbuflen & blocksize_mask) == 0)

        restbytes = blocksize;

      else

        restbytes = inbuflen & blocksize_mask;

      outbuf -= blocksize;

      for (ivp = c->u_iv.iv, i = 0; i < restbytes; i++)

        {

          b = inbuf[i];

          outbuf[blocksize + i] = outbuf[i];

          outbuf[i] = b ^ *ivp++;

        }

      for (; i < blocksize; i++)

        outbuf[i] = 0 ^ *ivp++;

      nburn = enc_fn (&c->context.c, outbuf, outbuf);

      burn = nburn > burn ? nburn : burn;

      cipher_block_cpy (c->u_iv.iv, outbuf, blocksize);

    }

  if (burn > 0)

    _gcry_burn_stack (burn + 4 * sizeof(void *));

  return 0;

}

static inline unsigned int

cbc_decrypt_inner(gcry_cipher_hd_t c, unsigned char *outbuf,

                  const unsigned char *inbuf, size_t nblocks, size_t blocksize)

{

  unsigned int burn, nburn;

  size_t n;

  burn = 0;

  if (c->bulk.cbc_dec)

    {

      c->bulk.cbc_dec (&c->context.c, c->u_iv.iv, outbuf, inbuf, nblocks);

    }

  else

    {

      gcry_cipher_decrypt_t dec_fn = c->spec->decrypt;

      for (n = 0; n < nblocks; n++)

        {

          /* Because outbuf and inbuf might be the same, we must not overwrite

             the original ciphertext block.  We use LASTIV as intermediate

             storage here because it is not used otherwise.  */

          nburn = dec_fn ( &c->context.c, c->lastiv, inbuf );

          burn = nburn > burn ? nburn : burn;

          cipher_block_xor_n_copy_2 (outbuf, c->lastiv, c->u_iv.iv, inbuf,

                                     blocksize);

          inbuf  += blocksize;

          outbuf += blocksize;

        }

    }

  return burn;

}

gcry_err_code_t

_gcry_cipher_cbc_decrypt (gcry_cipher_hd_t c,

                          unsigned char *outbuf, size_t outbuflen,

                          const unsigned char *inbuf, size_t inbuflen)

{

  size_t blocksize_shift = _gcry_blocksize_shift(c);

  size_t blocksize = 1 << blocksize_shift;

  size_t blocksize_mask = blocksize - 1;

  size_t nblocks = inbuflen >> blocksize_shift;

  unsigned int burn;

  if (outbuflen < inbuflen)

    return GPG_ERR_BUFFER_TOO_SHORT;

  if (inbuflen & blocksize_mask)

    return GPG_ERR_INV_LENGTH;

  burn = cbc_decrypt_inner(c, outbuf, inbuf, nblocks, blocksize);

  if (burn > 0)

    _gcry_burn_stack (burn + 4 * sizeof(void *));

  return 0;

}

gcry_err_code_t

_gcry_cipher_cbc_cts_decrypt (gcry_cipher_hd_t c,

                              unsigned char *outbuf, size_t outbuflen,

                              const unsigned char *inbuf, size_t inbuflen)

{

  size_t blocksize_shift = _gcry_blocksize_shift(c);

  size_t blocksize = 1 << blocksize_shift;

  size_t blocksize_mask = blocksize - 1;

  gcry_cipher_decrypt_t dec_fn = c->spec->decrypt;

  size_t nblocks = inbuflen >> blocksize_shift;

  unsigned int burn, nburn;

  int i;

  if (outbuflen < inbuflen)

    return GPG_ERR_BUFFER_TOO_SHORT;

  if ((inbuflen & blocksize_mask) && !(inbuflen > blocksize))

    return GPG_ERR_INV_LENGTH;

  burn = 0;

  if (inbuflen > blocksize)

    {

      nblocks--;

      if ((inbuflen & blocksize_mask) == 0)

  nblocks--;

      cipher_block_cpy (c->lastiv, c->u_iv.iv, blocksize);

    }

  burn = cbc_decrypt_inner(c, outbuf, inbuf, nblocks, blocksize);

  inbuf  += nblocks << blocksize_shift;

  outbuf += nblocks << blocksize_shift;

  if (inbuflen > blocksize)

    {

      size_t restbytes;

      if ((inbuflen & blocksize_mask) == 0)

        restbytes = blocksize;

      else

        restbytes = inbuflen & blocksize_mask;

      cipher_block_cpy (c->lastiv, c->u_iv.iv, blocksize ); /* Save Cn-2. */

      buf_cpy (c->u_iv.iv, inbuf + blocksize, restbytes ); /* Save Cn. */

      nburn = dec_fn ( &c->context.c, outbuf, inbuf );

      burn = nburn > burn ? nburn : burn;

      buf_xor(outbuf, outbuf, c->u_iv.iv, restbytes);

      buf_cpy (outbuf + blocksize, outbuf, restbytes);

      for(i=restbytes; i < blocksize; i++)

        c->u_iv.iv[i] = outbuf[i];

      nburn = dec_fn (&c->context.c, outbuf, c->u_iv.iv);

      burn = nburn > burn ? nburn : burn;

      cipher_block_xor(outbuf, outbuf, c->lastiv, blocksize);

      /* c->lastiv is now really lastlastiv, does this matter? */

    }

  if (burn > 0)

    _gcry_burn_stack (burn + 4 * sizeof(void *));

  return 0;

}