1 /** 2 * \file gcm.h 3 * 4 * \brief This file contains GCM definitions and functions. 5 * 6 * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined 7 * in <em>D. McGrew, J. Viega, The Galois/Counter Mode of Operation 8 * (GCM), Natl. Inst. Stand. Technol.</em> 9 * 10 * For more information on GCM, see <em>NIST SP 800-38D: Recommendation for 11 * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC</em>. 12 * 13 */ 14 /* 15 * Copyright The Mbed TLS Contributors 16 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 17 * 18 * This file is provided under the Apache License 2.0, or the 19 * GNU General Public License v2.0 or later. 20 * 21 * ********** 22 * Apache License 2.0: 23 * 24 * Licensed under the Apache License, Version 2.0 (the "License"); you may 25 * not use this file except in compliance with the License. 26 * You may obtain a copy of the License at 27 * 28 * http://www.apache.org/licenses/LICENSE-2.0 29 * 30 * Unless required by applicable law or agreed to in writing, software 31 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 32 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 33 * See the License for the specific language governing permissions and 34 * limitations under the License. 35 * 36 * ********** 37 * 38 * ********** 39 * GNU General Public License v2.0 or later: 40 * 41 * This program is free software; you can redistribute it and/or modify 42 * it under the terms of the GNU General Public License as published by 43 * the Free Software Foundation; either version 2 of the License, or 44 * (at your option) any later version. 45 * 46 * This program is distributed in the hope that it will be useful, 47 * but WITHOUT ANY WARRANTY; without even the implied warranty of 48 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 49 * GNU General Public License for more details. 50 * 51 * You should have received a copy of the GNU General Public License along 52 * with this program; if not, write to the Free Software Foundation, Inc., 53 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 54 * 55 * ********** 56 */ 57 58 #ifndef MBEDTLS_GCM_H 59 #define MBEDTLS_GCM_H 60 61 #if !defined(MBEDTLS_CONFIG_FILE) 62 #include "config.h" 63 #else 64 #include MBEDTLS_CONFIG_FILE 65 #endif 66 67 #include "cipher.h" 68 69 #include <stdint.h> 70 71 #define MBEDTLS_GCM_ENCRYPT 1 72 #define MBEDTLS_GCM_DECRYPT 0 73 74 #define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 /**< Authenticated decryption failed. */ 75 76 /* MBEDTLS_ERR_GCM_HW_ACCEL_FAILED is deprecated and should not be used. */ 77 #define MBEDTLS_ERR_GCM_HW_ACCEL_FAILED -0x0013 /**< GCM hardware accelerator failed. */ 78 79 #define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 /**< Bad input parameters to function. */ 80 81 #ifdef __cplusplus 82 extern "C" { 83 #endif 84 85 #if !defined(MBEDTLS_GCM_ALT) 86 87 /** 88 * \brief The GCM context structure. 89 */ 90 typedef struct mbedtls_gcm_context 91 { 92 mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ 93 uint64_t HL[16]; /*!< Precalculated HTable low. */ 94 uint64_t HH[16]; /*!< Precalculated HTable high. */ 95 uint64_t len; /*!< The total length of the encrypted data. */ 96 uint64_t add_len; /*!< The total length of the additional data. */ 97 unsigned char base_ectr[16]; /*!< The first ECTR for tag. */ 98 unsigned char y[16]; /*!< The Y working value. */ 99 unsigned char buf[16]; /*!< The buf working value. */ 100 int mode; /*!< The operation to perform: 101 #MBEDTLS_GCM_ENCRYPT or 102 #MBEDTLS_GCM_DECRYPT. */ 103 } 104 mbedtls_gcm_context; 105 106 #else /* !MBEDTLS_GCM_ALT */ 107 #include "gcm_alt.h" 108 #endif /* !MBEDTLS_GCM_ALT */ 109 110 /** 111 * \brief This function initializes the specified GCM context, 112 * to make references valid, and prepares the context 113 * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). 114 * 115 * The function does not bind the GCM context to a particular 116 * cipher, nor set the key. For this purpose, use 117 * mbedtls_gcm_setkey(). 118 * 119 * \param ctx The GCM context to initialize. This must not be \c NULL. 120 */ 121 void mbedtls_gcm_init( mbedtls_gcm_context *ctx ); 122 123 /** 124 * \brief This function associates a GCM context with a 125 * cipher algorithm and a key. 126 * 127 * \param ctx The GCM context. This must be initialized. 128 * \param cipher The 128-bit block cipher to use. 129 * \param key The encryption key. This must be a readable buffer of at 130 * least \p keybits bits. 131 * \param keybits The key size in bits. Valid options are: 132 * <ul><li>128 bits</li> 133 * <li>192 bits</li> 134 * <li>256 bits</li></ul> 135 * 136 * \return \c 0 on success. 137 * \return A cipher-specific error code on failure. 138 */ 139 int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx, 140 mbedtls_cipher_id_t cipher, 141 const unsigned char *key, 142 unsigned int keybits ); 143 144 /** 145 * \brief This function performs GCM encryption or decryption of a buffer. 146 * 147 * \note For encryption, the output buffer can be the same as the 148 * input buffer. For decryption, the output buffer cannot be 149 * the same as input buffer. If the buffers overlap, the output 150 * buffer must trail at least 8 Bytes behind the input buffer. 151 * 152 * \warning When this function performs a decryption, it outputs the 153 * authentication tag and does not verify that the data is 154 * authentic. You should use this function to perform encryption 155 * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. 156 * 157 * \param ctx The GCM context to use for encryption or decryption. This 158 * must be initialized. 159 * \param mode The operation to perform: 160 * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. 161 * The ciphertext is written to \p output and the 162 * authentication tag is written to \p tag. 163 * - #MBEDTLS_GCM_DECRYPT to perform decryption. 164 * The plaintext is written to \p output and the 165 * authentication tag is written to \p tag. 166 * Note that this mode is not recommended, because it does 167 * not verify the authenticity of the data. For this reason, 168 * you should use mbedtls_gcm_auth_decrypt() instead of 169 * calling this function in decryption mode. 170 * \param length The length of the input data, which is equal to the length 171 * of the output data. 172 * \param iv The initialization vector. This must be a readable buffer of 173 * at least \p iv_len Bytes. 174 * \param iv_len The length of the IV. 175 * \param add The buffer holding the additional data. This must be of at 176 * least that size in Bytes. 177 * \param add_len The length of the additional data. 178 * \param input The buffer holding the input data. If \p length is greater 179 * than zero, this must be a readable buffer of at least that 180 * size in Bytes. 181 * \param output The buffer for holding the output data. If \p length is greater 182 * than zero, this must be a writable buffer of at least that 183 * size in Bytes. 184 * \param tag_len The length of the tag to generate. 185 * \param tag The buffer for holding the tag. This must be a writable 186 * buffer of at least \p tag_len Bytes. 187 * 188 * \return \c 0 if the encryption or decryption was performed 189 * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, 190 * this does not indicate that the data is authentic. 191 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 192 * not valid or a cipher-specific error code if the encryption 193 * or decryption failed. 194 */ 195 int mbedtls_gcm_crypt_and_tag( mbedtls_gcm_context *ctx, 196 int mode, 197 size_t length, 198 const unsigned char *iv, 199 size_t iv_len, 200 const unsigned char *add, 201 size_t add_len, 202 const unsigned char *input, 203 unsigned char *output, 204 size_t tag_len, 205 unsigned char *tag ); 206 207 /** 208 * \brief This function performs a GCM authenticated decryption of a 209 * buffer. 210 * 211 * \note For decryption, the output buffer cannot be the same as 212 * input buffer. If the buffers overlap, the output buffer 213 * must trail at least 8 Bytes behind the input buffer. 214 * 215 * \param ctx The GCM context. This must be initialized. 216 * \param length The length of the ciphertext to decrypt, which is also 217 * the length of the decrypted plaintext. 218 * \param iv The initialization vector. This must be a readable buffer 219 * of at least \p iv_len Bytes. 220 * \param iv_len The length of the IV. 221 * \param add The buffer holding the additional data. This must be of at 222 * least that size in Bytes. 223 * \param add_len The length of the additional data. 224 * \param tag The buffer holding the tag to verify. This must be a 225 * readable buffer of at least \p tag_len Bytes. 226 * \param tag_len The length of the tag to verify. 227 * \param input The buffer holding the ciphertext. If \p length is greater 228 * than zero, this must be a readable buffer of at least that 229 * size. 230 * \param output The buffer for holding the decrypted plaintext. If \p length 231 * is greater than zero, this must be a writable buffer of at 232 * least that size. 233 * 234 * \return \c 0 if successful and authenticated. 235 * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. 236 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 237 * not valid or a cipher-specific error code if the decryption 238 * failed. 239 */ 240 int mbedtls_gcm_auth_decrypt( mbedtls_gcm_context *ctx, 241 size_t length, 242 const unsigned char *iv, 243 size_t iv_len, 244 const unsigned char *add, 245 size_t add_len, 246 const unsigned char *tag, 247 size_t tag_len, 248 const unsigned char *input, 249 unsigned char *output ); 250 251 /** 252 * \brief This function starts a GCM encryption or decryption 253 * operation. 254 * 255 * \param ctx The GCM context. This must be initialized. 256 * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or 257 * #MBEDTLS_GCM_DECRYPT. 258 * \param iv The initialization vector. This must be a readable buffer of 259 * at least \p iv_len Bytes. 260 * \param iv_len The length of the IV. 261 * \param add The buffer holding the additional data, or \c NULL 262 * if \p add_len is \c 0. 263 * \param add_len The length of the additional data. If \c 0, 264 * \p add may be \c NULL. 265 * 266 * \return \c 0 on success. 267 */ 268 int mbedtls_gcm_starts( mbedtls_gcm_context *ctx, 269 int mode, 270 const unsigned char *iv, 271 size_t iv_len, 272 const unsigned char *add, 273 size_t add_len ); 274 275 /** 276 * \brief This function feeds an input buffer into an ongoing GCM 277 * encryption or decryption operation. 278 * 279 * ` The function expects input to be a multiple of 16 280 * Bytes. Only the last call before calling 281 * mbedtls_gcm_finish() can be less than 16 Bytes. 282 * 283 * \note For decryption, the output buffer cannot be the same as 284 * input buffer. If the buffers overlap, the output buffer 285 * must trail at least 8 Bytes behind the input buffer. 286 * 287 * \param ctx The GCM context. This must be initialized. 288 * \param length The length of the input data. This must be a multiple of 289 * 16 except in the last call before mbedtls_gcm_finish(). 290 * \param input The buffer holding the input data. If \p length is greater 291 * than zero, this must be a readable buffer of at least that 292 * size in Bytes. 293 * \param output The buffer for holding the output data. If \p length is 294 * greater than zero, this must be a writable buffer of at 295 * least that size in Bytes. 296 * 297 * \return \c 0 on success. 298 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. 299 */ 300 int mbedtls_gcm_update( mbedtls_gcm_context *ctx, 301 size_t length, 302 const unsigned char *input, 303 unsigned char *output ); 304 305 /** 306 * \brief This function finishes the GCM operation and generates 307 * the authentication tag. 308 * 309 * It wraps up the GCM stream, and generates the 310 * tag. The tag can have a maximum length of 16 Bytes. 311 * 312 * \param ctx The GCM context. This must be initialized. 313 * \param tag The buffer for holding the tag. This must be a writable 314 * buffer of at least \p tag_len Bytes. 315 * \param tag_len The length of the tag to generate. This must be at least 316 * four. 317 * 318 * \return \c 0 on success. 319 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. 320 */ 321 int mbedtls_gcm_finish( mbedtls_gcm_context *ctx, 322 unsigned char *tag, 323 size_t tag_len ); 324 325 /** 326 * \brief This function clears a GCM context and the underlying 327 * cipher sub-context. 328 * 329 * \param ctx The GCM context to clear. If this is \c NULL, the call has 330 * no effect. Otherwise, this must be initialized. 331 */ 332 void mbedtls_gcm_free( mbedtls_gcm_context *ctx ); 333 334 #if defined(MBEDTLS_SELF_TEST) 335 336 /** 337 * \brief The GCM checkup routine. 338 * 339 * \return \c 0 on success. 340 * \return \c 1 on failure. 341 */ 342 int mbedtls_gcm_self_test( int verbose ); 343 344 #endif /* MBEDTLS_SELF_TEST */ 345 346 #ifdef __cplusplus 347 } 348 #endif 349 350 351 #endif /* gcm.h */ 352