xref: /reactos/sdk/include/reactos/libs/mbedtls/aes.h (revision cbda039f)
1 /**
2  * \file aes.h
3  *
4  * \brief   This file contains AES definitions and functions.
5  *
6  *          The Advanced Encryption Standard (AES) specifies a FIPS-approved
7  *          cryptographic algorithm that can be used to protect electronic
8  *          data.
9  *
10  *          The AES algorithm is a symmetric block cipher that can
11  *          encrypt and decrypt information. For more information, see
12  *          <em>FIPS Publication 197: Advanced Encryption Standard</em> and
13  *          <em>ISO/IEC 18033-2:2006: Information technology -- Security
14  *          techniques -- Encryption algorithms -- Part 2: Asymmetric
15  *          ciphers</em>.
16  *
17  *          The AES-XTS block mode is standardized by NIST SP 800-38E
18  *          <https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-38e.pdf>
19  *          and described in detail by IEEE P1619
20  *          <https://ieeexplore.ieee.org/servlet/opac?punumber=4375278>.
21  */
22 
23 /*
24  *  Copyright The Mbed TLS Contributors
25  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
26  *
27  *  This file is provided under the Apache License 2.0, or the
28  *  GNU General Public License v2.0 or later.
29  *
30  *  **********
31  *  Apache License 2.0:
32  *
33  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
34  *  not use this file except in compliance with the License.
35  *  You may obtain a copy of the License at
36  *
37  *  http://www.apache.org/licenses/LICENSE-2.0
38  *
39  *  Unless required by applicable law or agreed to in writing, software
40  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
41  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
42  *  See the License for the specific language governing permissions and
43  *  limitations under the License.
44  *
45  *  **********
46  *
47  *  **********
48  *  GNU General Public License v2.0 or later:
49  *
50  *  This program is free software; you can redistribute it and/or modify
51  *  it under the terms of the GNU General Public License as published by
52  *  the Free Software Foundation; either version 2 of the License, or
53  *  (at your option) any later version.
54  *
55  *  This program is distributed in the hope that it will be useful,
56  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
57  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
58  *  GNU General Public License for more details.
59  *
60  *  You should have received a copy of the GNU General Public License along
61  *  with this program; if not, write to the Free Software Foundation, Inc.,
62  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
63  *
64  *  **********
65  */
66 
67 #ifndef MBEDTLS_AES_H
68 #define MBEDTLS_AES_H
69 
70 #if !defined(MBEDTLS_CONFIG_FILE)
71 #include "config.h"
72 #else
73 #include MBEDTLS_CONFIG_FILE
74 #endif
75 
76 #include <stddef.h>
77 #include <stdint.h>
78 
79 /* padlock.c and aesni.c rely on these values! */
80 #define MBEDTLS_AES_ENCRYPT     1 /**< AES encryption. */
81 #define MBEDTLS_AES_DECRYPT     0 /**< AES decryption. */
82 
83 /* Error codes in range 0x0020-0x0022 */
84 #define MBEDTLS_ERR_AES_INVALID_KEY_LENGTH                -0x0020  /**< Invalid key length. */
85 #define MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH              -0x0022  /**< Invalid data input length. */
86 
87 /* Error codes in range 0x0021-0x0025 */
88 #define MBEDTLS_ERR_AES_BAD_INPUT_DATA                    -0x0021  /**< Invalid input data. */
89 
90 /* MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE is deprecated and should not be used. */
91 #define MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE               -0x0023  /**< Feature not available. For example, an unsupported AES key size. */
92 
93 /* MBEDTLS_ERR_AES_HW_ACCEL_FAILED is deprecated and should not be used. */
94 #define MBEDTLS_ERR_AES_HW_ACCEL_FAILED                   -0x0025  /**< AES hardware accelerator failed. */
95 
96 #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
97     !defined(inline) && !defined(__cplusplus)
98 #define inline __inline
99 #endif
100 
101 #ifdef __cplusplus
102 extern "C" {
103 #endif
104 
105 #if !defined(MBEDTLS_AES_ALT)
106 // Regular implementation
107 //
108 
109 /**
110  * \brief The AES context-type definition.
111  */
112 typedef struct mbedtls_aes_context
113 {
114     int nr;                     /*!< The number of rounds. */
115     uint32_t *rk;               /*!< AES round keys. */
116     uint32_t buf[68];           /*!< Unaligned data buffer. This buffer can
117                                      hold 32 extra Bytes, which can be used for
118                                      one of the following purposes:
119                                      <ul><li>Alignment if VIA padlock is
120                                              used.</li>
121                                      <li>Simplifying key expansion in the 256-bit
122                                          case by generating an extra round key.
123                                          </li></ul> */
124 }
125 mbedtls_aes_context;
126 
127 #if defined(MBEDTLS_CIPHER_MODE_XTS)
128 /**
129  * \brief The AES XTS context-type definition.
130  */
131 typedef struct mbedtls_aes_xts_context
132 {
133     mbedtls_aes_context crypt; /*!< The AES context to use for AES block
134                                         encryption or decryption. */
135     mbedtls_aes_context tweak; /*!< The AES context used for tweak
136                                         computation. */
137 } mbedtls_aes_xts_context;
138 #endif /* MBEDTLS_CIPHER_MODE_XTS */
139 
140 #else  /* MBEDTLS_AES_ALT */
141 #include "aes_alt.h"
142 #endif /* MBEDTLS_AES_ALT */
143 
144 /**
145  * \brief          This function initializes the specified AES context.
146  *
147  *                 It must be the first API called before using
148  *                 the context.
149  *
150  * \param ctx      The AES context to initialize. This must not be \c NULL.
151  */
152 void mbedtls_aes_init( mbedtls_aes_context *ctx );
153 
154 /**
155  * \brief          This function releases and clears the specified AES context.
156  *
157  * \param ctx      The AES context to clear.
158  *                 If this is \c NULL, this function does nothing.
159  *                 Otherwise, the context must have been at least initialized.
160  */
161 void mbedtls_aes_free( mbedtls_aes_context *ctx );
162 
163 #if defined(MBEDTLS_CIPHER_MODE_XTS)
164 /**
165  * \brief          This function initializes the specified AES XTS context.
166  *
167  *                 It must be the first API called before using
168  *                 the context.
169  *
170  * \param ctx      The AES XTS context to initialize. This must not be \c NULL.
171  */
172 void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx );
173 
174 /**
175  * \brief          This function releases and clears the specified AES XTS context.
176  *
177  * \param ctx      The AES XTS context to clear.
178  *                 If this is \c NULL, this function does nothing.
179  *                 Otherwise, the context must have been at least initialized.
180  */
181 void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx );
182 #endif /* MBEDTLS_CIPHER_MODE_XTS */
183 
184 /**
185  * \brief          This function sets the encryption key.
186  *
187  * \param ctx      The AES context to which the key should be bound.
188  *                 It must be initialized.
189  * \param key      The encryption key.
190  *                 This must be a readable buffer of size \p keybits bits.
191  * \param keybits  The size of data passed in bits. Valid options are:
192  *                 <ul><li>128 bits</li>
193  *                 <li>192 bits</li>
194  *                 <li>256 bits</li></ul>
195  *
196  * \return         \c 0 on success.
197  * \return         #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
198  */
199 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
200                     unsigned int keybits );
201 
202 /**
203  * \brief          This function sets the decryption key.
204  *
205  * \param ctx      The AES context to which the key should be bound.
206  *                 It must be initialized.
207  * \param key      The decryption key.
208  *                 This must be a readable buffer of size \p keybits bits.
209  * \param keybits  The size of data passed. Valid options are:
210  *                 <ul><li>128 bits</li>
211  *                 <li>192 bits</li>
212  *                 <li>256 bits</li></ul>
213  *
214  * \return         \c 0 on success.
215  * \return         #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
216  */
217 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
218                     unsigned int keybits );
219 
220 #if defined(MBEDTLS_CIPHER_MODE_XTS)
221 /**
222  * \brief          This function prepares an XTS context for encryption and
223  *                 sets the encryption key.
224  *
225  * \param ctx      The AES XTS context to which the key should be bound.
226  *                 It must be initialized.
227  * \param key      The encryption key. This is comprised of the XTS key1
228  *                 concatenated with the XTS key2.
229  *                 This must be a readable buffer of size \p keybits bits.
230  * \param keybits  The size of \p key passed in bits. Valid options are:
231  *                 <ul><li>256 bits (each of key1 and key2 is a 128-bit key)</li>
232  *                 <li>512 bits (each of key1 and key2 is a 256-bit key)</li></ul>
233  *
234  * \return         \c 0 on success.
235  * \return         #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
236  */
237 int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx,
238                                 const unsigned char *key,
239                                 unsigned int keybits );
240 
241 /**
242  * \brief          This function prepares an XTS context for decryption and
243  *                 sets the decryption key.
244  *
245  * \param ctx      The AES XTS context to which the key should be bound.
246  *                 It must be initialized.
247  * \param key      The decryption key. This is comprised of the XTS key1
248  *                 concatenated with the XTS key2.
249  *                 This must be a readable buffer of size \p keybits bits.
250  * \param keybits  The size of \p key passed in bits. Valid options are:
251  *                 <ul><li>256 bits (each of key1 and key2 is a 128-bit key)</li>
252  *                 <li>512 bits (each of key1 and key2 is a 256-bit key)</li></ul>
253  *
254  * \return         \c 0 on success.
255  * \return         #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
256  */
257 int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx,
258                                 const unsigned char *key,
259                                 unsigned int keybits );
260 #endif /* MBEDTLS_CIPHER_MODE_XTS */
261 
262 /**
263  * \brief          This function performs an AES single-block encryption or
264  *                 decryption operation.
265  *
266  *                 It performs the operation defined in the \p mode parameter
267  *                 (encrypt or decrypt), on the input data buffer defined in
268  *                 the \p input parameter.
269  *
270  *                 mbedtls_aes_init(), and either mbedtls_aes_setkey_enc() or
271  *                 mbedtls_aes_setkey_dec() must be called before the first
272  *                 call to this API with the same context.
273  *
274  * \param ctx      The AES context to use for encryption or decryption.
275  *                 It must be initialized and bound to a key.
276  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
277  *                 #MBEDTLS_AES_DECRYPT.
278  * \param input    The buffer holding the input data.
279  *                 It must be readable and at least \c 16 Bytes long.
280  * \param output   The buffer where the output data will be written.
281  *                 It must be writeable and at least \c 16 Bytes long.
282 
283  * \return         \c 0 on success.
284  */
285 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
286                     int mode,
287                     const unsigned char input[16],
288                     unsigned char output[16] );
289 
290 #if defined(MBEDTLS_CIPHER_MODE_CBC)
291 /**
292  * \brief  This function performs an AES-CBC encryption or decryption operation
293  *         on full blocks.
294  *
295  *         It performs the operation defined in the \p mode
296  *         parameter (encrypt/decrypt), on the input data buffer defined in
297  *         the \p input parameter.
298  *
299  *         It can be called as many times as needed, until all the input
300  *         data is processed. mbedtls_aes_init(), and either
301  *         mbedtls_aes_setkey_enc() or mbedtls_aes_setkey_dec() must be called
302  *         before the first call to this API with the same context.
303  *
304  * \note   This function operates on full blocks, that is, the input size
305  *         must be a multiple of the AES block size of \c 16 Bytes.
306  *
307  * \note   Upon exit, the content of the IV is updated so that you can
308  *         call the same function again on the next
309  *         block(s) of data and get the same result as if it was
310  *         encrypted in one call. This allows a "streaming" usage.
311  *         If you need to retain the contents of the IV, you should
312  *         either save it manually or use the cipher module instead.
313  *
314  *
315  * \param ctx      The AES context to use for encryption or decryption.
316  *                 It must be initialized and bound to a key.
317  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
318  *                 #MBEDTLS_AES_DECRYPT.
319  * \param length   The length of the input data in Bytes. This must be a
320  *                 multiple of the block size (\c 16 Bytes).
321  * \param iv       Initialization vector (updated after use).
322  *                 It must be a readable and writeable buffer of \c 16 Bytes.
323  * \param input    The buffer holding the input data.
324  *                 It must be readable and of size \p length Bytes.
325  * \param output   The buffer holding the output data.
326  *                 It must be writeable and of size \p length Bytes.
327  *
328  * \return         \c 0 on success.
329  * \return         #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH
330  *                 on failure.
331  */
332 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
333                     int mode,
334                     size_t length,
335                     unsigned char iv[16],
336                     const unsigned char *input,
337                     unsigned char *output );
338 #endif /* MBEDTLS_CIPHER_MODE_CBC */
339 
340 #if defined(MBEDTLS_CIPHER_MODE_XTS)
341 /**
342  * \brief      This function performs an AES-XTS encryption or decryption
343  *             operation for an entire XTS data unit.
344  *
345  *             AES-XTS encrypts or decrypts blocks based on their location as
346  *             defined by a data unit number. The data unit number must be
347  *             provided by \p data_unit.
348  *
349  *             NIST SP 800-38E limits the maximum size of a data unit to 2^20
350  *             AES blocks. If the data unit is larger than this, this function
351  *             returns #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH.
352  *
353  * \param ctx          The AES XTS context to use for AES XTS operations.
354  *                     It must be initialized and bound to a key.
355  * \param mode         The AES operation: #MBEDTLS_AES_ENCRYPT or
356  *                     #MBEDTLS_AES_DECRYPT.
357  * \param length       The length of a data unit in Bytes. This can be any
358  *                     length between 16 bytes and 2^24 bytes inclusive
359  *                     (between 1 and 2^20 block cipher blocks).
360  * \param data_unit    The address of the data unit encoded as an array of 16
361  *                     bytes in little-endian format. For disk encryption, this
362  *                     is typically the index of the block device sector that
363  *                     contains the data.
364  * \param input        The buffer holding the input data (which is an entire
365  *                     data unit). This function reads \p length Bytes from \p
366  *                     input.
367  * \param output       The buffer holding the output data (which is an entire
368  *                     data unit). This function writes \p length Bytes to \p
369  *                     output.
370  *
371  * \return             \c 0 on success.
372  * \return             #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH if \p length is
373  *                     smaller than an AES block in size (16 Bytes) or if \p
374  *                     length is larger than 2^20 blocks (16 MiB).
375  */
376 int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx,
377                            int mode,
378                            size_t length,
379                            const unsigned char data_unit[16],
380                            const unsigned char *input,
381                            unsigned char *output );
382 #endif /* MBEDTLS_CIPHER_MODE_XTS */
383 
384 #if defined(MBEDTLS_CIPHER_MODE_CFB)
385 /**
386  * \brief This function performs an AES-CFB128 encryption or decryption
387  *        operation.
388  *
389  *        It performs the operation defined in the \p mode
390  *        parameter (encrypt or decrypt), on the input data buffer
391  *        defined in the \p input parameter.
392  *
393  *        For CFB, you must set up the context with mbedtls_aes_setkey_enc(),
394  *        regardless of whether you are performing an encryption or decryption
395  *        operation, that is, regardless of the \p mode parameter. This is
396  *        because CFB mode uses the same key schedule for encryption and
397  *        decryption.
398  *
399  * \note  Upon exit, the content of the IV is updated so that you can
400  *        call the same function again on the next
401  *        block(s) of data and get the same result as if it was
402  *        encrypted in one call. This allows a "streaming" usage.
403  *        If you need to retain the contents of the
404  *        IV, you must either save it manually or use the cipher
405  *        module instead.
406  *
407  *
408  * \param ctx      The AES context to use for encryption or decryption.
409  *                 It must be initialized and bound to a key.
410  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
411  *                 #MBEDTLS_AES_DECRYPT.
412  * \param length   The length of the input data in Bytes.
413  * \param iv_off   The offset in IV (updated after use).
414  *                 It must point to a valid \c size_t.
415  * \param iv       The initialization vector (updated after use).
416  *                 It must be a readable and writeable buffer of \c 16 Bytes.
417  * \param input    The buffer holding the input data.
418  *                 It must be readable and of size \p length Bytes.
419  * \param output   The buffer holding the output data.
420  *                 It must be writeable and of size \p length Bytes.
421  *
422  * \return         \c 0 on success.
423  */
424 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
425                        int mode,
426                        size_t length,
427                        size_t *iv_off,
428                        unsigned char iv[16],
429                        const unsigned char *input,
430                        unsigned char *output );
431 
432 /**
433  * \brief This function performs an AES-CFB8 encryption or decryption
434  *        operation.
435  *
436  *        It performs the operation defined in the \p mode
437  *        parameter (encrypt/decrypt), on the input data buffer defined
438  *        in the \p input parameter.
439  *
440  *        Due to the nature of CFB, you must use the same key schedule for
441  *        both encryption and decryption operations. Therefore, you must
442  *        use the context initialized with mbedtls_aes_setkey_enc() for
443  *        both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT.
444  *
445  * \note  Upon exit, the content of the IV is updated so that you can
446  *        call the same function again on the next
447  *        block(s) of data and get the same result as if it was
448  *        encrypted in one call. This allows a "streaming" usage.
449  *        If you need to retain the contents of the
450  *        IV, you should either save it manually or use the cipher
451  *        module instead.
452  *
453  *
454  * \param ctx      The AES context to use for encryption or decryption.
455  *                 It must be initialized and bound to a key.
456  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
457  *                 #MBEDTLS_AES_DECRYPT
458  * \param length   The length of the input data.
459  * \param iv       The initialization vector (updated after use).
460  *                 It must be a readable and writeable buffer of \c 16 Bytes.
461  * \param input    The buffer holding the input data.
462  *                 It must be readable and of size \p length Bytes.
463  * \param output   The buffer holding the output data.
464  *                 It must be writeable and of size \p length Bytes.
465  *
466  * \return         \c 0 on success.
467  */
468 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
469                     int mode,
470                     size_t length,
471                     unsigned char iv[16],
472                     const unsigned char *input,
473                     unsigned char *output );
474 #endif /*MBEDTLS_CIPHER_MODE_CFB */
475 
476 #if defined(MBEDTLS_CIPHER_MODE_OFB)
477 /**
478  * \brief       This function performs an AES-OFB (Output Feedback Mode)
479  *              encryption or decryption operation.
480  *
481  *              For OFB, you must set up the context with
482  *              mbedtls_aes_setkey_enc(), regardless of whether you are
483  *              performing an encryption or decryption operation. This is
484  *              because OFB mode uses the same key schedule for encryption and
485  *              decryption.
486  *
487  *              The OFB operation is identical for encryption or decryption,
488  *              therefore no operation mode needs to be specified.
489  *
490  * \note        Upon exit, the content of iv, the Initialisation Vector, is
491  *              updated so that you can call the same function again on the next
492  *              block(s) of data and get the same result as if it was encrypted
493  *              in one call. This allows a "streaming" usage, by initialising
494  *              iv_off to 0 before the first call, and preserving its value
495  *              between calls.
496  *
497  *              For non-streaming use, the iv should be initialised on each call
498  *              to a unique value, and iv_off set to 0 on each call.
499  *
500  *              If you need to retain the contents of the initialisation vector,
501  *              you must either save it manually or use the cipher module
502  *              instead.
503  *
504  * \warning     For the OFB mode, the initialisation vector must be unique
505  *              every encryption operation. Reuse of an initialisation vector
506  *              will compromise security.
507  *
508  * \param ctx      The AES context to use for encryption or decryption.
509  *                 It must be initialized and bound to a key.
510  * \param length   The length of the input data.
511  * \param iv_off   The offset in IV (updated after use).
512  *                 It must point to a valid \c size_t.
513  * \param iv       The initialization vector (updated after use).
514  *                 It must be a readable and writeable buffer of \c 16 Bytes.
515  * \param input    The buffer holding the input data.
516  *                 It must be readable and of size \p length Bytes.
517  * \param output   The buffer holding the output data.
518  *                 It must be writeable and of size \p length Bytes.
519  *
520  * \return         \c 0 on success.
521  */
522 int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
523                        size_t length,
524                        size_t *iv_off,
525                        unsigned char iv[16],
526                        const unsigned char *input,
527                        unsigned char *output );
528 
529 #endif /* MBEDTLS_CIPHER_MODE_OFB */
530 
531 #if defined(MBEDTLS_CIPHER_MODE_CTR)
532 /**
533  * \brief      This function performs an AES-CTR encryption or decryption
534  *             operation.
535  *
536  *             This function performs the operation defined in the \p mode
537  *             parameter (encrypt/decrypt), on the input data buffer
538  *             defined in the \p input parameter.
539  *
540  *             Due to the nature of CTR, you must use the same key schedule
541  *             for both encryption and decryption operations. Therefore, you
542  *             must use the context initialized with mbedtls_aes_setkey_enc()
543  *             for both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT.
544  *
545  * \warning    You must never reuse a nonce value with the same key. Doing so
546  *             would void the encryption for the two messages encrypted with
547  *             the same nonce and key.
548  *
549  *             There are two common strategies for managing nonces with CTR:
550  *
551  *             1. You can handle everything as a single message processed over
552  *             successive calls to this function. In that case, you want to
553  *             set \p nonce_counter and \p nc_off to 0 for the first call, and
554  *             then preserve the values of \p nonce_counter, \p nc_off and \p
555  *             stream_block across calls to this function as they will be
556  *             updated by this function.
557  *
558  *             With this strategy, you must not encrypt more than 2**128
559  *             blocks of data with the same key.
560  *
561  *             2. You can encrypt separate messages by dividing the \p
562  *             nonce_counter buffer in two areas: the first one used for a
563  *             per-message nonce, handled by yourself, and the second one
564  *             updated by this function internally.
565  *
566  *             For example, you might reserve the first 12 bytes for the
567  *             per-message nonce, and the last 4 bytes for internal use. In that
568  *             case, before calling this function on a new message you need to
569  *             set the first 12 bytes of \p nonce_counter to your chosen nonce
570  *             value, the last 4 to 0, and \p nc_off to 0 (which will cause \p
571  *             stream_block to be ignored). That way, you can encrypt at most
572  *             2**96 messages of up to 2**32 blocks each with the same key.
573  *
574  *             The per-message nonce (or information sufficient to reconstruct
575  *             it) needs to be communicated with the ciphertext and must be unique.
576  *             The recommended way to ensure uniqueness is to use a message
577  *             counter. An alternative is to generate random nonces, but this
578  *             limits the number of messages that can be securely encrypted:
579  *             for example, with 96-bit random nonces, you should not encrypt
580  *             more than 2**32 messages with the same key.
581  *
582  *             Note that for both stategies, sizes are measured in blocks and
583  *             that an AES block is 16 bytes.
584  *
585  * \warning    Upon return, \p stream_block contains sensitive data. Its
586  *             content must not be written to insecure storage and should be
587  *             securely discarded as soon as it's no longer needed.
588  *
589  * \param ctx              The AES context to use for encryption or decryption.
590  *                         It must be initialized and bound to a key.
591  * \param length           The length of the input data.
592  * \param nc_off           The offset in the current \p stream_block, for
593  *                         resuming within the current cipher stream. The
594  *                         offset pointer should be 0 at the start of a stream.
595  *                         It must point to a valid \c size_t.
596  * \param nonce_counter    The 128-bit nonce and counter.
597  *                         It must be a readable-writeable buffer of \c 16 Bytes.
598  * \param stream_block     The saved stream block for resuming. This is
599  *                         overwritten by the function.
600  *                         It must be a readable-writeable buffer of \c 16 Bytes.
601  * \param input            The buffer holding the input data.
602  *                         It must be readable and of size \p length Bytes.
603  * \param output           The buffer holding the output data.
604  *                         It must be writeable and of size \p length Bytes.
605  *
606  * \return                 \c 0 on success.
607  */
608 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
609                        size_t length,
610                        size_t *nc_off,
611                        unsigned char nonce_counter[16],
612                        unsigned char stream_block[16],
613                        const unsigned char *input,
614                        unsigned char *output );
615 #endif /* MBEDTLS_CIPHER_MODE_CTR */
616 
617 /**
618  * \brief           Internal AES block encryption function. This is only
619  *                  exposed to allow overriding it using
620  *                  \c MBEDTLS_AES_ENCRYPT_ALT.
621  *
622  * \param ctx       The AES context to use for encryption.
623  * \param input     The plaintext block.
624  * \param output    The output (ciphertext) block.
625  *
626  * \return          \c 0 on success.
627  */
628 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
629                                   const unsigned char input[16],
630                                   unsigned char output[16] );
631 
632 /**
633  * \brief           Internal AES block decryption function. This is only
634  *                  exposed to allow overriding it using see
635  *                  \c MBEDTLS_AES_DECRYPT_ALT.
636  *
637  * \param ctx       The AES context to use for decryption.
638  * \param input     The ciphertext block.
639  * \param output    The output (plaintext) block.
640  *
641  * \return          \c 0 on success.
642  */
643 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
644                                   const unsigned char input[16],
645                                   unsigned char output[16] );
646 
647 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
648 #if defined(MBEDTLS_DEPRECATED_WARNING)
649 #define MBEDTLS_DEPRECATED      __attribute__((deprecated))
650 #else
651 #define MBEDTLS_DEPRECATED
652 #endif
653 /**
654  * \brief           Deprecated internal AES block encryption function
655  *                  without return value.
656  *
657  * \deprecated      Superseded by mbedtls_internal_aes_encrypt()
658  *
659  * \param ctx       The AES context to use for encryption.
660  * \param input     Plaintext block.
661  * \param output    Output (ciphertext) block.
662  */
663 MBEDTLS_DEPRECATED void mbedtls_aes_encrypt( mbedtls_aes_context *ctx,
664                                              const unsigned char input[16],
665                                              unsigned char output[16] );
666 
667 /**
668  * \brief           Deprecated internal AES block decryption function
669  *                  without return value.
670  *
671  * \deprecated      Superseded by mbedtls_internal_aes_decrypt()
672  *
673  * \param ctx       The AES context to use for decryption.
674  * \param input     Ciphertext block.
675  * \param output    Output (plaintext) block.
676  */
677 MBEDTLS_DEPRECATED void mbedtls_aes_decrypt( mbedtls_aes_context *ctx,
678                                              const unsigned char input[16],
679                                              unsigned char output[16] );
680 
681 #undef MBEDTLS_DEPRECATED
682 #endif /* !MBEDTLS_DEPRECATED_REMOVED */
683 
684 
685 #if defined(MBEDTLS_SELF_TEST)
686 /**
687  * \brief          Checkup routine.
688  *
689  * \return         \c 0 on success.
690  * \return         \c 1 on failure.
691  */
692 int mbedtls_aes_self_test( int verbose );
693 
694 #endif /* MBEDTLS_SELF_TEST */
695 
696 #ifdef __cplusplus
697 }
698 #endif
699 
700 #endif /* aes.h */
701