eax.c 4.69 KB
Newer Older
Niels Möller's avatar
Niels Möller committed
1
/* eax.c
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

   EAX mode, see http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf

   Copyright (C) 2013 Niels Möller

   This file is part of GNU Nettle.

   GNU Nettle is free software: you can redistribute it and/or
   modify it under the terms of either:

     * the GNU Lesser General Public License as published by the Free
       Software Foundation; either version 3 of the License, or (at your
       option) any later version.

   or

     * the GNU General Public License as published by the Free
       Software Foundation; either version 2 of the License, or (at your
       option) any later version.

   or both in parallel, as here.

   GNU Nettle is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   General Public License for more details.

   You should have received copies of the GNU General Public License and
   the GNU Lesser General Public License along with this program.  If
   not, see http://www.gnu.org/licenses/.
*/
Niels Möller's avatar
Niels Möller committed
33 34 35 36 37 38 39 40 41 42

#if HAVE_CONFIG_H
# include "config.h"
#endif

#include <assert.h>
#include <string.h>

#include "eax.h"

43
#include "block-internal.h"
Niels Möller's avatar
Niels Möller committed
44 45 46 47
#include "ctr.h"
#include "memxor.h"

static void
48
omac_init (union nettle_block16 *state, unsigned t)
Niels Möller's avatar
Niels Möller committed
49
{
50 51
  memset (state->b, 0, EAX_BLOCK_SIZE - 1);
  state->b[EAX_BLOCK_SIZE - 1] = t;
Niels Möller's avatar
Niels Möller committed
52 53
}

54 55
static void
omac_update (union nettle_block16 *state, const struct eax_key *key,
56
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
57 58 59 60 61
	     size_t length, const uint8_t *data)
{
  for (; length >= EAX_BLOCK_SIZE;
       length -= EAX_BLOCK_SIZE, data += EAX_BLOCK_SIZE)
    {
62 63
      f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
      memxor (state->b, data, EAX_BLOCK_SIZE);
Niels Möller's avatar
Niels Möller committed
64 65 66 67
    }
  if (length > 0)
    {
      /* Allowed only for the last call */
68 69 70
      f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
      memxor (state->b, data, length);
      state->b[length] ^= 0x80;
Niels Möller's avatar
Niels Möller committed
71 72
      /* XOR with (P ^ B), since the digest processing
       * unconditionally XORs with B */
73
      block16_xor (state, &key->pad_partial);
Niels Möller's avatar
Niels Möller committed
74 75 76 77
    }
}

static void
78
omac_final (union nettle_block16 *state, const struct eax_key *key,
79
	    const void *cipher, nettle_cipher_func *f)
Niels Möller's avatar
Niels Möller committed
80
{
81 82
  block16_xor (state, &key->pad_block);
  f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
Niels Möller's avatar
Niels Möller committed
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
}

/* Allows r == a */
static void
gf2_double (uint8_t *r, const uint8_t *a)
{
  unsigned high = - (a[0] >> 7);
  unsigned i;
  /* Shift left */
  for (i = 0; i < EAX_BLOCK_SIZE - 1; i++)
    r[i] = (a[i] << 1) + (a[i+1] >> 7);

  /* Wrap around for x^{128} = x^7 + x^2 + x + 1 */
  r[EAX_BLOCK_SIZE - 1] = (a[EAX_BLOCK_SIZE - 1] << 1) ^ (high & 0x87);
}

void
100
eax_set_key (struct eax_key *key, const void *cipher, nettle_cipher_func *f)
Niels Möller's avatar
Niels Möller committed
101
{
102 103 104 105 106
  static const union nettle_block16 zero_block;
  f (cipher, EAX_BLOCK_SIZE, key->pad_block.b, zero_block.b);
  gf2_double (key->pad_block.b, key->pad_block.b);
  gf2_double (key->pad_partial.b, key->pad_block.b);
  block16_xor (&key->pad_partial, &key->pad_block);
Niels Möller's avatar
Niels Möller committed
107 108 109 110
}

void
eax_set_nonce (struct eax_ctx *eax, const struct eax_key *key,
111
	       const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
112 113
	       size_t nonce_length, const uint8_t *nonce)
{
114 115 116 117
  omac_init (&eax->omac_nonce, 0);
  omac_update (&eax->omac_nonce, key, cipher, f, nonce_length, nonce);
  omac_final (&eax->omac_nonce, key, cipher, f);
  memcpy (eax->ctr.b, eax->omac_nonce.b, EAX_BLOCK_SIZE);
Niels Möller's avatar
Niels Möller committed
118

119 120
  omac_init (&eax->omac_data, 1);
  omac_init (&eax->omac_message, 2);
Niels Möller's avatar
Niels Möller committed
121 122 123 124
}

void
eax_update (struct eax_ctx *eax, const struct eax_key *key,
125
	    const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
126 127
	    size_t data_length, const uint8_t *data)
{
128
  omac_update (&eax->omac_data, key, cipher, f, data_length, data);
Niels Möller's avatar
Niels Möller committed
129 130 131 132
}

void
eax_encrypt (struct eax_ctx *eax, const struct eax_key *key,
133
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
134 135
	     size_t length, uint8_t *dst, const uint8_t *src)
{
136 137
  ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr.b, length, dst, src);
  omac_update (&eax->omac_message, key, cipher, f, length, dst);
Niels Möller's avatar
Niels Möller committed
138 139 140 141
}

void
eax_decrypt (struct eax_ctx *eax, const struct eax_key *key,
142
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
143 144
	     size_t length, uint8_t *dst, const uint8_t *src)
{
145 146
  omac_update (&eax->omac_message, key, cipher, f, length, src);
  ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr.b, length, dst, src);
Niels Möller's avatar
Niels Möller committed
147 148 149 150
}

void
eax_digest (struct eax_ctx *eax, const struct eax_key *key,
151
	    const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
152 153 154 155
	    size_t length, uint8_t *digest)
{
  assert (length > 0);
  assert (length <= EAX_BLOCK_SIZE);
156 157
  omac_final (&eax->omac_data, key, cipher, f);
  omac_final (&eax->omac_message, key, cipher, f);
Niels Möller's avatar
Niels Möller committed
158

159 160
  block16_xor (&eax->omac_nonce, &eax->omac_data);
  memxor3 (digest, eax->omac_nonce.b, eax->omac_message.b, length);
Niels Möller's avatar
Niels Möller committed
161
}