/* cipher-gcm-siv.c  - GCM-SIV implementation (RFC 8452)

 * Copyright (C) 2021 Jussi Kivilinna <jussi.kivilinna@iki.fi>

 *

 * This file is part of Libgcrypt.

 *

 * Libgcrypt is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser general Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * Libgcrypt is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, see <http://www.gnu.org/licenses/>.

 */

#include <config.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#include "g10lib.h"

#include "cipher.h"

#include "bufhelp.h"

#include "./cipher-internal.h"

#define GCM_SIV_NONCE_LENGTH (96 / 8)

static inline void

mulx_ghash (byte *a)

{

  u64 t[2], mask;

  t[0] = buf_get_be64(a + 0);

  t[1] = buf_get_be64(a + 8);

  mask = -(t[1] & 1) & 0xe1;

  mask <<= 56;

  buf_put_be64(a + 8, (t[1] >> 1) ^ (t[0] << 63));

  buf_put_be64(a + 0, (t[0] >> 1) ^ mask);

}

static inline void

gcm_siv_bytecounter_add (u32 ctr[2], size_t add)

{

  if (sizeof(add) > sizeof(u32))

    {

      u32 high_add = ((add >> 31) >> 1) & 0xffffffff;

      ctr[1] += high_add;

    }

  ctr[0] += add;

  if (ctr[0] >= add)

    return;

  ++ctr[1];

}

static inline int

gcm_siv_check_len (u32 ctr[2])

{

  /* len(plaintext/aadlen) <= 2^39-256 bits == 2^36-32 bytes == 2^32-2 blocks */

  if (ctr[1] > 0xfU)

    return 0;

  if (ctr[1] < 0xfU)

    return 1;

  if (ctr[0] <= 0xffffffe0U)

    return 1;

  return 0;

}

static void

polyval_set_key (gcry_cipher_hd_t c, const byte *auth_key)

{

  cipher_block_bswap (c->u_mode.gcm.u_ghash_key.key, auth_key,

          GCRY_SIV_BLOCK_LEN);

  mulx_ghash (c->u_mode.gcm.u_ghash_key.key);

  _gcry_cipher_gcm_setupM (c);

}

static void

do_polyval_buf(gcry_cipher_hd_t c, byte *hash, const byte *buf,

         size_t buflen, int do_padding)

{

  unsigned int blocksize = GCRY_SIV_BLOCK_LEN;

  unsigned int unused = c->u_mode.gcm.mac_unused;

  ghash_fn_t ghash_fn = c->u_mode.gcm.ghash_fn;

  ghash_fn_t polyval_fn = c->u_mode.gcm.polyval_fn;

  byte tmp_blocks[16][GCRY_SIV_BLOCK_LEN];

  size_t nblocks, n;

  unsigned int burn = 0, nburn;

  unsigned int num_blks_used = 0;

  if (buflen == 0 && (unused == 0 || !do_padding))

    return;

  do

    {

      if (buflen > 0 && (buflen + unused < blocksize || unused > 0))

        {

          n = blocksize - unused;

          n = n < buflen ? n : buflen;

          buf_cpy (&c->u_mode.gcm.macbuf[unused], buf, n);

          unused += n;

          buf += n;

          buflen -= n;

        }

      if (!buflen)

        {

          if (!do_padding && unused < blocksize)

      {

        break;

      }

    n = blocksize - unused;

    if (n > 0)

      {

        memset (&c->u_mode.gcm.macbuf[unused], 0, n);

        unused = blocksize;

      }

        }

      if (unused > 0)

        {

          gcry_assert (unused == blocksize);

          /* Process one block from macbuf.  */

          if (polyval_fn)

            {

              nburn = polyval_fn (c, hash, c->u_mode.gcm.macbuf, 1);

            }

          else

            {

              cipher_block_bswap (c->u_mode.gcm.macbuf, c->u_mode.gcm.macbuf,

                                  blocksize);

              nburn = ghash_fn (c, hash, c->u_mode.gcm.macbuf, 1);

            }

          burn = nburn > burn ? nburn : burn;

          unused = 0;

        }

      nblocks = buflen / blocksize;

      while (nblocks)

        {

          if (polyval_fn)

            {

              n = nblocks;

              nburn = polyval_fn (c, hash, buf, n);

            }

          else

            {

              for (n = 0; n < (nblocks > 16 ? 16 : nblocks); n++)

                cipher_block_bswap (tmp_blocks[n], buf + n * blocksize,

                                    blocksize);

              num_blks_used = n > num_blks_used ? n : num_blks_used;

              nburn = ghash_fn (c, hash, tmp_blocks[0], n);

            }

          burn = nburn > burn ? nburn : burn;

          buf += n * blocksize;

          buflen -= n * blocksize;

          nblocks -= n;

        }

    }

  while (buflen > 0);

  c->u_mode.gcm.mac_unused = unused;

  if (num_blks_used)

    wipememory (tmp_blocks, num_blks_used * blocksize);

  if (burn)

    _gcry_burn_stack (burn);

}

static void

do_ctr_le32 (gcry_cipher_hd_t c, byte *outbuf, const byte *inbuf,

       size_t inbuflen)

{

  gcry_cipher_encrypt_t enc_fn = c->spec->encrypt;

  unsigned char tmp[GCRY_SIV_BLOCK_LEN];

  unsigned int burn = 0, nburn;

  size_t nblocks;

  if (inbuflen == 0)

    return;

  /* Use a bulk method if available.  */

  nblocks = inbuflen / GCRY_SIV_BLOCK_LEN;

  if (nblocks && c->bulk.ctr32le_enc)

    {

      c->bulk.ctr32le_enc (c->context.c, c->u_ctr.ctr, outbuf, inbuf, nblocks);

      inbuf  += nblocks * GCRY_SIV_BLOCK_LEN;

      outbuf += nblocks * GCRY_SIV_BLOCK_LEN;

      inbuflen -= nblocks * GCRY_SIV_BLOCK_LEN;

    }

  do

    {

      nburn = enc_fn (c->context.c, tmp, c->u_ctr.ctr);

      burn = nburn > burn ? nburn : burn;

      buf_put_le32(c->u_ctr.ctr, buf_get_le32(c->u_ctr.ctr) + 1);

      if (inbuflen < GCRY_SIV_BLOCK_LEN)

  break;

      cipher_block_xor(outbuf, inbuf, tmp, GCRY_SIV_BLOCK_LEN);

      inbuflen -= GCRY_SIV_BLOCK_LEN;

      outbuf += GCRY_SIV_BLOCK_LEN;

      inbuf += GCRY_SIV_BLOCK_LEN;

    }

  while (inbuflen);

  if (inbuflen)

    {

      buf_xor(outbuf, inbuf, tmp, inbuflen);

      outbuf += inbuflen;

      inbuf += inbuflen;

      inbuflen -= inbuflen;

    }

  wipememory (tmp, sizeof(tmp));

  if (burn > 0)

    _gcry_burn_stack (burn + 4 * sizeof(void *));

}

static int

gcm_siv_selftest (gcry_cipher_hd_t c)

{

  static const byte in1[GCRY_SIV_BLOCK_LEN] =

      "\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

  static const byte out1[GCRY_SIV_BLOCK_LEN] =

      "\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

  static const byte in2[GCRY_SIV_BLOCK_LEN] =

      "\x9c\x98\xc0\x4d\xf9\x38\x7d\xed\x82\x81\x75\xa9\x2b\xa6\x52\xd8";

  static const byte out2[GCRY_SIV_BLOCK_LEN] =

      "\x4e\x4c\x60\x26\xfc\x9c\x3e\xf6\xc1\x40\xba\xd4\x95\xd3\x29\x6c";

  static const byte polyval_key[GCRY_SIV_BLOCK_LEN] =

      "\x25\x62\x93\x47\x58\x92\x42\x76\x1d\x31\xf8\x26\xba\x4b\x75\x7b";

  static const byte ghash_key[GCRY_SIV_BLOCK_LEN] =

      "\xdc\xba\xa5\xdd\x13\x7c\x18\x8e\xbb\x21\x49\x2c\x23\xc9\xb1\x12";

  static const byte polyval_data[GCRY_SIV_BLOCK_LEN * 2] =

      "\x4f\x4f\x95\x66\x8c\x83\xdf\xb6\x40\x17\x62\xbb\x2d\x01\xa2\x62"

      "\xd1\xa2\x4d\xdd\x27\x21\xd0\x06\xbb\xe4\x5f\x20\xd3\xc9\xf3\x62";

  static const byte polyval_tag[GCRY_SIV_BLOCK_LEN] =

      "\xf7\xa3\xb4\x7b\x84\x61\x19\xfa\xe5\xb7\x86\x6c\xf5\xe5\xb7\x7e";

  byte tmp[GCRY_SIV_BLOCK_LEN];

  /* Test mulx_ghash */

  memcpy (tmp, in1, GCRY_SIV_BLOCK_LEN);

  mulx_ghash (tmp);

  if (memcmp (tmp, out1, GCRY_SIV_BLOCK_LEN) != 0)

    return -1;

  memcpy (tmp, in2, GCRY_SIV_BLOCK_LEN);

  mulx_ghash (tmp);

  if (memcmp (tmp, out2, GCRY_SIV_BLOCK_LEN) != 0)

    return -1;

  /* Test GHASH key generation */

  memcpy (tmp, polyval_key, GCRY_SIV_BLOCK_LEN);

  cipher_block_bswap (tmp, tmp, GCRY_SIV_BLOCK_LEN);

  mulx_ghash (tmp);

  if (memcmp (tmp, ghash_key, GCRY_SIV_BLOCK_LEN) != 0)

    return -1;

  /* Test POLYVAL */

  memset (&c->u_mode.gcm, 0, sizeof(c->u_mode.gcm));

  polyval_set_key (c, polyval_key);

  memset (&tmp, 0, sizeof(tmp));

  do_polyval_buf (c, tmp, polyval_data, GCRY_SIV_BLOCK_LEN * 2, 1);

  cipher_block_bswap (tmp, tmp, GCRY_SIV_BLOCK_LEN);

  if (memcmp (tmp, polyval_tag, GCRY_SIV_BLOCK_LEN) != 0)

    return -1;

  return 0;

}

gcry_err_code_t

_gcry_cipher_gcm_siv_setkey (gcry_cipher_hd_t c, unsigned int keylen)

{

  static int done;

  if (keylen != 16 && keylen != 32)

    return GPG_ERR_INV_KEYLEN;

  if (!done)

    {

      if (gcm_siv_selftest (c))

  return GPG_ERR_SELFTEST_FAILED;

      done = 1;

    }

  c->marks.iv = 0;

  c->marks.tag = 0;

  memset (&c->u_mode.gcm, 0, sizeof(c->u_mode.gcm));

  c->u_mode.gcm.siv_keylen = keylen;

  return 0;

}

gcry_err_code_t

_gcry_cipher_gcm_siv_set_nonce (gcry_cipher_hd_t c, const byte *iv,

        size_t ivlen)

{

  byte auth_key[GCRY_SIV_BLOCK_LEN];

  byte tmp_in[GCRY_SIV_BLOCK_LEN];

  byte tmp[GCRY_SIV_BLOCK_LEN];

  byte enc_key[32];

  gcry_err_code_t err;

  if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)

    return GPG_ERR_CIPHER_ALGO;

  if (ivlen != GCM_SIV_NONCE_LENGTH)

    return GPG_ERR_INV_ARG;

  if (c->u_mode.gcm.siv_keylen == 0)

    return GPG_ERR_INV_STATE;

  if (c->marks.iv)

    {

      /* If nonce is already set, use cipher_reset or setkey first to reset

       * cipher state. */

      return GPG_ERR_INV_STATE;

    }

  memset (c->u_mode.gcm.aadlen, 0, sizeof(c->u_mode.gcm.aadlen));

  memset (c->u_mode.gcm.datalen, 0, sizeof(c->u_mode.gcm.datalen));

  memset (c->u_mode.gcm.u_tag.tag, 0, sizeof(c->u_mode.gcm.u_tag.tag));

  c->u_mode.gcm.datalen_over_limits = 0;

  c->u_mode.gcm.ghash_data_finalized = 0;

  c->u_mode.gcm.ghash_aad_finalized = 0;

  memset (c->u_iv.iv, 0, GCRY_SIV_BLOCK_LEN);

  memcpy (c->u_iv.iv, iv, ivlen);

  memcpy (tmp_in + 4, iv, ivlen);

  /* Derive message authentication key */

  buf_put_le32(tmp_in, 0);

  c->spec->encrypt (&c->context.c, tmp, tmp_in);

  memcpy (auth_key + 0, tmp, 8);

  buf_put_le32(tmp_in, 1);

  c->spec->encrypt (&c->context.c, tmp, tmp_in);

  memcpy (auth_key + 8, tmp, 8);

  polyval_set_key (c, auth_key);

  wipememory (auth_key, sizeof(auth_key));

  /* Derive message encryption key */

  buf_put_le32(tmp_in, 2);

  c->spec->encrypt (&c->context.c, tmp, tmp_in);

  memcpy (enc_key + 0, tmp, 8);

  buf_put_le32(tmp_in, 3);

  c->spec->encrypt (&c->context.c, tmp, tmp_in);

  memcpy (enc_key + 8, tmp, 8);

  if (c->u_mode.gcm.siv_keylen >= 24)

    {

      buf_put_le32(tmp_in, 4);

      c->spec->encrypt (&c->context.c, tmp, tmp_in);

      memcpy (enc_key + 16, tmp, 8);

    }

  if (c->u_mode.gcm.siv_keylen >= 32)

    {

      buf_put_le32(tmp_in, 5);

      c->spec->encrypt (&c->context.c, tmp, tmp_in);

      memcpy (enc_key + 24, tmp, 8);

    }

  wipememory (tmp, sizeof(tmp));

  wipememory (tmp_in, sizeof(tmp_in));

  err = c->spec->setkey (&c->context.c, enc_key, c->u_mode.gcm.siv_keylen,

       &c->bulk);

  wipememory (enc_key, sizeof(enc_key));

  if (err)

    return err;

  c->marks.iv = 1;

  return 0;

}

gcry_err_code_t

_gcry_cipher_gcm_siv_authenticate (gcry_cipher_hd_t c,

           const byte *aadbuf, size_t aadbuflen)

{

  if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)

    return GPG_ERR_CIPHER_ALGO;

  if (c->u_mode.gcm.datalen_over_limits)

    return GPG_ERR_INV_LENGTH;

  if (c->marks.tag

      || !c->marks.iv

      || c->u_mode.gcm.ghash_aad_finalized

      || c->u_mode.gcm.ghash_data_finalized

      || !c->u_mode.gcm.ghash_fn)

    return GPG_ERR_INV_STATE;

  gcm_siv_bytecounter_add (c->u_mode.gcm.aadlen, aadbuflen);

  if (!gcm_siv_check_len (c->u_mode.gcm.aadlen))

    {

      c->u_mode.gcm.datalen_over_limits = 1;

      return GPG_ERR_INV_LENGTH;

    }

  do_polyval_buf (c, c->u_mode.gcm.u_tag.tag, aadbuf, aadbuflen, 0);

  return 0;

}

gcry_err_code_t

_gcry_cipher_gcm_siv_encrypt (gcry_cipher_hd_t c,

            byte *outbuf, size_t outbuflen,

            const byte *inbuf, size_t inbuflen)

{

  u32 bitlengths[2][2];

  if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)

    return GPG_ERR_CIPHER_ALGO;

  if (outbuflen < inbuflen)

    return GPG_ERR_BUFFER_TOO_SHORT;

  if (c->u_mode.gcm.datalen_over_limits)

    return GPG_ERR_INV_LENGTH;

  if (c->marks.tag

      || !c->marks.iv

      || c->u_mode.gcm.ghash_data_finalized

      || !c->u_mode.gcm.ghash_fn)

    return GPG_ERR_INV_STATE;

  if (!c->u_mode.gcm.ghash_aad_finalized)

    {

      /* Start of encryption marks end of AAD stream. */

      do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, NULL, 0, 1);

      c->u_mode.gcm.ghash_aad_finalized = 1;

    }

  gcm_siv_bytecounter_add (c->u_mode.gcm.datalen, inbuflen);

  if (!gcm_siv_check_len (c->u_mode.gcm.datalen))

    {

      c->u_mode.gcm.datalen_over_limits = 1;

      return GPG_ERR_INV_LENGTH;

    }

  /* Plaintext and padding to POLYVAL. */

  do_polyval_buf (c, c->u_mode.gcm.u_tag.tag, inbuf, inbuflen, 1);

  c->u_mode.gcm.ghash_data_finalized = 1;

  /* aad length */

  bitlengths[0][0] = le_bswap32(c->u_mode.gcm.aadlen[0] << 3);

  bitlengths[0][1] = le_bswap32((c->u_mode.gcm.aadlen[0] >> 29) |

                                (c->u_mode.gcm.aadlen[1] << 3));

  /* data length */

  bitlengths[1][0] = le_bswap32(c->u_mode.gcm.datalen[0] << 3);

  bitlengths[1][1] = le_bswap32((c->u_mode.gcm.datalen[0] >> 29) |

                                (c->u_mode.gcm.datalen[1] << 3));

  /* Length block to POLYVAL. */

  do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, (byte *)bitlengths,

     GCRY_SIV_BLOCK_LEN, 1);

  wipememory (bitlengths, sizeof(bitlengths));

  /* Prepare tag and counter. */

  cipher_block_bswap (c->u_mode.gcm.u_tag.tag, c->u_mode.gcm.u_tag.tag,

          GCRY_SIV_BLOCK_LEN);

  cipher_block_xor (c->u_mode.gcm.tagiv, c->u_iv.iv, c->u_mode.gcm.u_tag.tag,

        GCRY_SIV_BLOCK_LEN);

  c->u_mode.gcm.tagiv[GCRY_SIV_BLOCK_LEN - 1] &= 0x7f;

  c->spec->encrypt (&c->context.c, c->u_mode.gcm.tagiv, c->u_mode.gcm.tagiv);

  c->marks.tag = 1;

  memcpy (c->u_ctr.ctr, c->u_mode.gcm.tagiv, GCRY_SIV_BLOCK_LEN);

  c->u_ctr.ctr[GCRY_SIV_BLOCK_LEN - 1] |= 0x80;

  /* Encrypt data */

  do_ctr_le32 (c, outbuf, inbuf, inbuflen);

  return 0;

}

gcry_err_code_t

_gcry_cipher_gcm_siv_set_decryption_tag (gcry_cipher_hd_t c,

           const byte *tag, size_t taglen)

{

  if (taglen != GCRY_SIV_BLOCK_LEN)

    return GPG_ERR_INV_ARG;

  if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)

    return GPG_ERR_CIPHER_ALGO;

  if (c->marks.tag)

    return GPG_ERR_INV_STATE;

  memcpy (c->u_mode.gcm.tagiv, tag, GCRY_SIV_BLOCK_LEN);

  c->marks.tag = 1;

  return 0;

}

gcry_err_code_t

_gcry_cipher_gcm_siv_decrypt (gcry_cipher_hd_t c,

            byte *outbuf, size_t outbuflen,

            const byte *inbuf, size_t inbuflen)

{

  byte expected_tag[GCRY_SIV_BLOCK_LEN];

  u32 bitlengths[2][2];

  gcry_err_code_t rc = 0;

  if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)

    return GPG_ERR_CIPHER_ALGO;

  if (outbuflen < inbuflen)

    return GPG_ERR_BUFFER_TOO_SHORT;

  if (c->u_mode.gcm.datalen_over_limits)

    return GPG_ERR_INV_LENGTH;

  if (!c->marks.tag

      || !c->marks.iv

      || c->u_mode.gcm.ghash_data_finalized

      || !c->u_mode.gcm.ghash_fn)

    return GPG_ERR_INV_STATE;

  if (!c->u_mode.gcm.ghash_aad_finalized)

    {

      /* Start of encryption marks end of AAD stream. */

      do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, NULL, 0, 1);

      c->u_mode.gcm.ghash_aad_finalized = 1;

    }

  gcm_siv_bytecounter_add (c->u_mode.gcm.datalen, inbuflen);

  if (!gcm_siv_check_len (c->u_mode.gcm.datalen))

    {

      c->u_mode.gcm.datalen_over_limits = 1;

      return GPG_ERR_INV_LENGTH;

    }

  /* Prepare counter. */

  memcpy (c->u_ctr.ctr, c->u_mode.gcm.tagiv, GCRY_SIV_BLOCK_LEN);

  c->u_ctr.ctr[GCRY_SIV_BLOCK_LEN - 1] |= 0x80;

  /* Decrypt data. */

  do_ctr_le32 (c, outbuf, inbuf, inbuflen);

  /* Plaintext and padding to POLYVAL. */

  do_polyval_buf (c, c->u_mode.gcm.u_tag.tag, outbuf, inbuflen, 1);

  c->u_mode.gcm.ghash_data_finalized = 1;

  /* aad length */

  bitlengths[0][0] = le_bswap32(c->u_mode.gcm.aadlen[0] << 3);

  bitlengths[0][1] = le_bswap32((c->u_mode.gcm.aadlen[0] >> 29) |

                                (c->u_mode.gcm.aadlen[1] << 3));

  /* data length */

  bitlengths[1][0] = le_bswap32(c->u_mode.gcm.datalen[0] << 3);

  bitlengths[1][1] = le_bswap32((c->u_mode.gcm.datalen[0] >> 29) |

                                (c->u_mode.gcm.datalen[1] << 3));

  /* Length block to POLYVAL. */

  do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, (byte *)bitlengths,

     GCRY_SIV_BLOCK_LEN, 1);

  wipememory (bitlengths, sizeof(bitlengths));

  /* Prepare tag. */

  cipher_block_bswap (c->u_mode.gcm.u_tag.tag, c->u_mode.gcm.u_tag.tag,

          GCRY_SIV_BLOCK_LEN);

  cipher_block_xor (expected_tag, c->u_iv.iv, c->u_mode.gcm.u_tag.tag,

        GCRY_SIV_BLOCK_LEN);

  expected_tag[GCRY_SIV_BLOCK_LEN - 1] &= 0x7f;

  c->spec->encrypt (&c->context.c, expected_tag, expected_tag);

  if (!buf_eq_const(c->u_mode.gcm.tagiv, expected_tag, GCRY_SIV_BLOCK_LEN))

    {

      wipememory (outbuf, inbuflen);

      rc = GPG_ERR_CHECKSUM;

    }

  wipememory (expected_tag, sizeof(expected_tag));

  return rc;

}

static gcry_err_code_t

_gcry_cipher_gcm_siv_tag (gcry_cipher_hd_t c,

        byte * outbuf, size_t outbuflen, int check)

{

  gcry_err_code_t err;

  if (!c->marks.tag)

    {

      if (!c->u_mode.gcm.ghash_fn)

        return GPG_ERR_INV_STATE;

      if (!c->marks.tag)

        {

          /* Finalize GCM-SIV with zero-length plaintext. */

          err = _gcry_cipher_gcm_siv_encrypt (c, NULL, 0, NULL, 0);

          if (err != 0)

            return err;

        }

    }

  if (c->u_mode.gcm.datalen_over_limits)

    return GPG_ERR_INV_LENGTH;

  if (!c->u_mode.gcm.ghash_data_finalized)

    return GPG_ERR_INV_STATE;

  if (!c->marks.tag)

    return GPG_ERR_INV_STATE;

  if (!check)

    {

      if (outbuflen > GCRY_SIV_BLOCK_LEN)

        outbuflen = GCRY_SIV_BLOCK_LEN;

      /* NB: We already checked that OUTBUF is large enough to hold

       * the result or has valid truncated length.  */

      memcpy (outbuf, c->u_mode.gcm.tagiv, outbuflen);

    }

  else

    {

      /* OUTBUFLEN gives the length of the user supplied tag in OUTBUF

       * and thus we need to compare its length first.  */

      if (outbuflen != GCRY_SIV_BLOCK_LEN

          || !buf_eq_const (outbuf, c->u_mode.gcm.tagiv, outbuflen))

        return GPG_ERR_CHECKSUM;

    }

  return 0;

}

gcry_err_code_t

_gcry_cipher_gcm_siv_get_tag (gcry_cipher_hd_t c, unsigned char *outtag,

            size_t taglen)

{

  return _gcry_cipher_gcm_siv_tag (c, outtag, taglen, 0);

}

gcry_err_code_t

_gcry_cipher_gcm_siv_check_tag (gcry_cipher_hd_t c,

           const unsigned char *intag,

           size_t taglen)

{

  return _gcry_cipher_gcm_siv_tag (c, (unsigned char *)intag, taglen, 1);

}