1 /* $OpenBSD: gmac.c,v 1.3 2011/01/11 15:44:23 deraadt Exp $ */ 2 3 /* 4 * Copyright (c) 2010 Mike Belopuhov <mike@vantronix.net> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 /* 20 * This code implements the Message Authentication part of the 21 * Galois/Counter Mode (as being described in the RFC 4543) using 22 * the AES cipher. FIPS SP 800-38D describes the algorithm details. 23 */ 24 25 #include <sys/param.h> 26 #include <sys/systm.h> 27 #include <sys/endian.h> 28 29 #include <crypto/rijndael/rijndael.h> 30 #include <opencrypto/gmac.h> 31 32 void ghash_gfmul(uint32_t *, uint32_t *, uint32_t *); 33 void ghash_update(GHASH_CTX *, uint8_t *, size_t); 34 35 /* Computes a block multiplication in the GF(2^128) */ 36 void 37 ghash_gfmul(uint32_t *X, uint32_t *Y, uint32_t *product) 38 { 39 uint32_t v[4]; 40 uint32_t z[4] = { 0, 0, 0, 0}; 41 uint8_t *x = (uint8_t *)X; 42 uint32_t mul; 43 int i; 44 45 v[0] = be32toh(Y[0]); 46 v[1] = be32toh(Y[1]); 47 v[2] = be32toh(Y[2]); 48 v[3] = be32toh(Y[3]); 49 50 for (i = 0; i < GMAC_BLOCK_LEN * 8; i++) { 51 /* update Z */ 52 if (x[i >> 3] & (1 << (~i & 7))) { 53 z[0] ^= v[0]; 54 z[1] ^= v[1]; 55 z[2] ^= v[2]; 56 z[3] ^= v[3]; 57 } /* else: we preserve old values */ 58 59 /* update V */ 60 mul = v[3] & 1; 61 v[3] = (v[2] << 31) | (v[3] >> 1); 62 v[2] = (v[1] << 31) | (v[2] >> 1); 63 v[1] = (v[0] << 31) | (v[1] >> 1); 64 v[0] = (v[0] >> 1) ^ (0xe1000000 * mul); 65 } 66 67 product[0] = htobe32(z[0]); 68 product[1] = htobe32(z[1]); 69 product[2] = htobe32(z[2]); 70 product[3] = htobe32(z[3]); 71 } 72 73 void 74 ghash_update(GHASH_CTX *ctx, uint8_t *X, size_t len) 75 { 76 uint32_t *x = (uint32_t *)X; 77 uint32_t *s = (uint32_t *)ctx->S; 78 uint32_t *y = (uint32_t *)ctx->Z; 79 int i; 80 81 for (i = 0; i < len / GMAC_BLOCK_LEN; i++) { 82 s[0] = y[0] ^ x[0]; 83 s[1] = y[1] ^ x[1]; 84 s[2] = y[2] ^ x[2]; 85 s[3] = y[3] ^ x[3]; 86 87 ghash_gfmul((uint32_t *)ctx->S, (uint32_t *)ctx->H, 88 (uint32_t *)ctx->S); 89 90 y = s; 91 x += 4; 92 } 93 94 bcopy(ctx->S, ctx->Z, GMAC_BLOCK_LEN); 95 } 96 97 #define AESCTR_NONCESIZE 4 98 99 void 100 AES_GMAC_Init(AES_GMAC_CTX *ctx) 101 { 102 bzero(ctx->ghash.H, GMAC_BLOCK_LEN); 103 bzero(ctx->ghash.S, GMAC_BLOCK_LEN); 104 bzero(ctx->ghash.Z, GMAC_BLOCK_LEN); 105 bzero(ctx->J, GMAC_BLOCK_LEN); 106 } 107 108 int 109 AES_GMAC_Setkey(AES_GMAC_CTX *ctx, const uint8_t *key, uint16_t klen) 110 { 111 ctx->rounds = rijndaelKeySetupEnc(ctx->K, __DECONST(u_char *, key), 112 (klen - AESCTR_NONCESIZE) * 8); 113 /* copy out salt to the counter block */ 114 bcopy(key + klen - AESCTR_NONCESIZE, ctx->J, AESCTR_NONCESIZE); 115 /* prepare a hash subkey */ 116 rijndaelEncrypt(ctx->K, ctx->rounds, ctx->ghash.H, ctx->ghash.H); 117 return (0); 118 } 119 120 void 121 AES_GMAC_Reinit(AES_GMAC_CTX *ctx, const uint8_t *iv, uint16_t ivlen) 122 { 123 /* copy out IV to the counter block */ 124 bcopy(iv, ctx->J + AESCTR_NONCESIZE, ivlen); 125 } 126 127 int 128 AES_GMAC_Update(AES_GMAC_CTX *ctx, uint8_t *data, uint16_t len) 129 { 130 uint32_t blk[4] = { 0, 0, 0, 0 }; 131 int plen; 132 133 if (len > 0) { 134 plen = len % GMAC_BLOCK_LEN; 135 if (len >= GMAC_BLOCK_LEN) 136 ghash_update(&ctx->ghash, data, len - plen); 137 if (plen) { 138 bcopy(data + (len - plen), (uint8_t *)blk, plen); 139 ghash_update(&ctx->ghash, (uint8_t *)blk, 140 GMAC_BLOCK_LEN); 141 } 142 } 143 return (0); 144 } 145 146 void 147 AES_GMAC_Final(uint8_t digest[GMAC_DIGEST_LEN], AES_GMAC_CTX *ctx) 148 { 149 uint8_t keystream[GMAC_BLOCK_LEN]; 150 int i; 151 152 /* do one round of GCTR */ 153 ctx->J[GMAC_BLOCK_LEN - 1] = 1; 154 rijndaelEncrypt(ctx->K, ctx->rounds, ctx->J, keystream); 155 for (i = 0; i < GMAC_DIGEST_LEN; i++) 156 digest[i] = ctx->ghash.S[i] ^ keystream[i]; 157 bzero(keystream, sizeof(keystream)); 158 } 159 160