1 /* $OpenBSD: xts128.c,v 1.8 2021/11/09 18:40:21 bcook Exp $ */
2 /* ====================================================================
3 * Copyright (c) 2011 The OpenSSL Project. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * 3. All advertising materials mentioning features or use of this
18 * software must display the following acknowledgment:
19 * "This product includes software developed by the OpenSSL Project
20 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
21 *
22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 * endorse or promote products derived from this software without
24 * prior written permission. For written permission, please contact
25 * openssl-core@openssl.org.
26 *
27 * 5. Products derived from this software may not be called "OpenSSL"
28 * nor may "OpenSSL" appear in their names without prior written
29 * permission of the OpenSSL Project.
30 *
31 * 6. Redistributions of any form whatsoever must retain the following
32 * acknowledgment:
33 * "This product includes software developed by the OpenSSL Project
34 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
35 *
36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 * OF THE POSSIBILITY OF SUCH DAMAGE.
48 * ====================================================================
49 */
50
51 #include <openssl/crypto.h>
52 #include "modes_lcl.h"
53
54 #include <endian.h>
55 #include <string.h>
56
57 #ifndef MODES_DEBUG
58 # ifndef NDEBUG
59 # define NDEBUG
60 # endif
61 #endif
62
CRYPTO_xts128_encrypt(const XTS128_CONTEXT * ctx,const unsigned char iv[16],const unsigned char * inp,unsigned char * out,size_t len,int enc)63 int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16],
64 const unsigned char *inp, unsigned char *out,
65 size_t len, int enc)
66 {
67 union { u64 u[2]; u32 d[4]; u8 c[16]; } tweak, scratch;
68 unsigned int i;
69
70 if (len<16) return -1;
71
72 memcpy(tweak.c, iv, 16);
73
74 (*ctx->block2)(tweak.c,tweak.c,ctx->key2);
75
76 if (!enc && (len%16)) len-=16;
77
78 while (len>=16) {
79 #ifdef __STRICT_ALIGNMENT
80 memcpy(scratch.c,inp,16);
81 scratch.u[0] ^= tweak.u[0];
82 scratch.u[1] ^= tweak.u[1];
83 #else
84 scratch.u[0] = ((u64*)inp)[0]^tweak.u[0];
85 scratch.u[1] = ((u64*)inp)[1]^tweak.u[1];
86 #endif
87 (*ctx->block1)(scratch.c,scratch.c,ctx->key1);
88 #ifdef __STRICT_ALIGNMENT
89 scratch.u[0] ^= tweak.u[0];
90 scratch.u[1] ^= tweak.u[1];
91 memcpy(out,scratch.c,16);
92 #else
93 ((u64*)out)[0] = scratch.u[0]^=tweak.u[0];
94 ((u64*)out)[1] = scratch.u[1]^=tweak.u[1];
95 #endif
96 inp += 16;
97 out += 16;
98 len -= 16;
99
100 if (len==0) return 0;
101
102 #if BYTE_ORDER == LITTLE_ENDIAN
103 unsigned int carry,res;
104
105 res = 0x87&(((int)tweak.d[3])>>31);
106 carry = (unsigned int)(tweak.u[0]>>63);
107 tweak.u[0] = (tweak.u[0]<<1)^res;
108 tweak.u[1] = (tweak.u[1]<<1)|carry;
109 #else /* BIG_ENDIAN */
110 size_t c;
111
112 for (c=0,i=0;i<16;++i) {
113 /*+ substitutes for |, because c is 1 bit */
114 c += ((size_t)tweak.c[i])<<1;
115 tweak.c[i] = (u8)c;
116 c = c>>8;
117 }
118 tweak.c[0] ^= (u8)(0x87&(0-c));
119 #endif
120 }
121 if (enc) {
122 for (i=0;i<len;++i) {
123 u8 c = inp[i];
124 out[i] = scratch.c[i];
125 scratch.c[i] = c;
126 }
127 scratch.u[0] ^= tweak.u[0];
128 scratch.u[1] ^= tweak.u[1];
129 (*ctx->block1)(scratch.c,scratch.c,ctx->key1);
130 scratch.u[0] ^= tweak.u[0];
131 scratch.u[1] ^= tweak.u[1];
132 memcpy(out-16,scratch.c,16);
133 }
134 else {
135 union { u64 u[2]; u8 c[16]; } tweak1;
136
137 #if BYTE_ORDER == LITTLE_ENDIAN
138 unsigned int carry,res;
139
140 res = 0x87&(((int)tweak.d[3])>>31);
141 carry = (unsigned int)(tweak.u[0]>>63);
142 tweak1.u[0] = (tweak.u[0]<<1)^res;
143 tweak1.u[1] = (tweak.u[1]<<1)|carry;
144 #else
145 size_t c;
146
147 for (c=0,i=0;i<16;++i) {
148 /*+ substitutes for |, because c is 1 bit */
149 c += ((size_t)tweak.c[i])<<1;
150 tweak1.c[i] = (u8)c;
151 c = c>>8;
152 }
153 tweak1.c[0] ^= (u8)(0x87&(0-c));
154 #endif
155 #ifdef __STRICT_ALIGNMENT
156 memcpy(scratch.c,inp,16);
157 scratch.u[0] ^= tweak1.u[0];
158 scratch.u[1] ^= tweak1.u[1];
159 #else
160 scratch.u[0] = ((u64*)inp)[0]^tweak1.u[0];
161 scratch.u[1] = ((u64*)inp)[1]^tweak1.u[1];
162 #endif
163 (*ctx->block1)(scratch.c,scratch.c,ctx->key1);
164 scratch.u[0] ^= tweak1.u[0];
165 scratch.u[1] ^= tweak1.u[1];
166
167 for (i=0;i<len;++i) {
168 u8 c = inp[16+i];
169 out[16+i] = scratch.c[i];
170 scratch.c[i] = c;
171 }
172 scratch.u[0] ^= tweak.u[0];
173 scratch.u[1] ^= tweak.u[1];
174 (*ctx->block1)(scratch.c,scratch.c,ctx->key1);
175 #ifdef __STRICT_ALIGNMENT
176 scratch.u[0] ^= tweak.u[0];
177 scratch.u[1] ^= tweak.u[1];
178 memcpy (out,scratch.c,16);
179 #else
180 ((u64*)out)[0] = scratch.u[0]^tweak.u[0];
181 ((u64*)out)[1] = scratch.u[1]^tweak.u[1];
182 #endif
183 }
184
185 return 0;
186 }
187