eax.c 4.84 KB
Newer Older
Niels Möller's avatar
Niels Möller committed
1
/* eax.c
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

   EAX mode, see http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf

   Copyright (C) 2013 Niels Möller

   This file is part of GNU Nettle.

   GNU Nettle is free software: you can redistribute it and/or
   modify it under the terms of either:

     * the GNU Lesser General Public License as published by the Free
       Software Foundation; either version 3 of the License, or (at your
       option) any later version.

   or

     * the GNU General Public License as published by the Free
       Software Foundation; either version 2 of the License, or (at your
       option) any later version.

   or both in parallel, as here.

   GNU Nettle is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   General Public License for more details.

   You should have received copies of the GNU General Public License and
   the GNU Lesser General Public License along with this program.  If
   not, see http://www.gnu.org/licenses/.
*/
Niels Möller's avatar
Niels Möller committed
33 34 35 36 37 38 39 40 41 42 43 44 45 46

#if HAVE_CONFIG_H
# include "config.h"
#endif

#include <assert.h>
#include <string.h>

#include "eax.h"

#include "ctr.h"
#include "memxor.h"

static void
47
omac_init (union nettle_block16 *state, unsigned t)
Niels Möller's avatar
Niels Möller committed
48
{
49 50
  memset (state->b, 0, EAX_BLOCK_SIZE - 1);
  state->b[EAX_BLOCK_SIZE - 1] = t;
Niels Möller's avatar
Niels Möller committed
51 52
}

53
/* Almost the same as gcm_gf_add */
Niels Möller's avatar
Niels Möller committed
54
static void
55 56
block16_xor (union nettle_block16 *dst, const union nettle_block16 *src)
{
57 58
  dst->u64[0] ^= src->u64[0];
  dst->u64[1] ^= src->u64[1];
59 60 61 62
}

static void
omac_update (union nettle_block16 *state, const struct eax_key *key,
63
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
64 65 66 67 68
	     size_t length, const uint8_t *data)
{
  for (; length >= EAX_BLOCK_SIZE;
       length -= EAX_BLOCK_SIZE, data += EAX_BLOCK_SIZE)
    {
69 70
      f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
      memxor (state->b, data, EAX_BLOCK_SIZE);
Niels Möller's avatar
Niels Möller committed
71 72 73 74
    }
  if (length > 0)
    {
      /* Allowed only for the last call */
75 76 77
      f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
      memxor (state->b, data, length);
      state->b[length] ^= 0x80;
Niels Möller's avatar
Niels Möller committed
78 79
      /* XOR with (P ^ B), since the digest processing
       * unconditionally XORs with B */
80
      block16_xor (state, &key->pad_partial);
Niels Möller's avatar
Niels Möller committed
81 82 83 84
    }
}

static void
85
omac_final (union nettle_block16 *state, const struct eax_key *key,
86
	    const void *cipher, nettle_cipher_func *f)
Niels Möller's avatar
Niels Möller committed
87
{
88 89
  block16_xor (state, &key->pad_block);
  f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
Niels Möller's avatar
Niels Möller committed
90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106
}

/* Allows r == a */
static void
gf2_double (uint8_t *r, const uint8_t *a)
{
  unsigned high = - (a[0] >> 7);
  unsigned i;
  /* Shift left */
  for (i = 0; i < EAX_BLOCK_SIZE - 1; i++)
    r[i] = (a[i] << 1) + (a[i+1] >> 7);

  /* Wrap around for x^{128} = x^7 + x^2 + x + 1 */
  r[EAX_BLOCK_SIZE - 1] = (a[EAX_BLOCK_SIZE - 1] << 1) ^ (high & 0x87);
}

void
107
eax_set_key (struct eax_key *key, const void *cipher, nettle_cipher_func *f)
Niels Möller's avatar
Niels Möller committed
108
{
109 110 111 112 113
  static const union nettle_block16 zero_block;
  f (cipher, EAX_BLOCK_SIZE, key->pad_block.b, zero_block.b);
  gf2_double (key->pad_block.b, key->pad_block.b);
  gf2_double (key->pad_partial.b, key->pad_block.b);
  block16_xor (&key->pad_partial, &key->pad_block);
Niels Möller's avatar
Niels Möller committed
114 115 116 117
}

void
eax_set_nonce (struct eax_ctx *eax, const struct eax_key *key,
118
	       const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
119 120
	       size_t nonce_length, const uint8_t *nonce)
{
121 122 123 124
  omac_init (&eax->omac_nonce, 0);
  omac_update (&eax->omac_nonce, key, cipher, f, nonce_length, nonce);
  omac_final (&eax->omac_nonce, key, cipher, f);
  memcpy (eax->ctr.b, eax->omac_nonce.b, EAX_BLOCK_SIZE);
Niels Möller's avatar
Niels Möller committed
125

126 127
  omac_init (&eax->omac_data, 1);
  omac_init (&eax->omac_message, 2);
Niels Möller's avatar
Niels Möller committed
128 129 130 131
}

void
eax_update (struct eax_ctx *eax, const struct eax_key *key,
132
	    const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
133 134
	    size_t data_length, const uint8_t *data)
{
135
  omac_update (&eax->omac_data, key, cipher, f, data_length, data);
Niels Möller's avatar
Niels Möller committed
136 137 138 139
}

void
eax_encrypt (struct eax_ctx *eax, const struct eax_key *key,
140
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
141 142
	     size_t length, uint8_t *dst, const uint8_t *src)
{
143 144
  ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr.b, length, dst, src);
  omac_update (&eax->omac_message, key, cipher, f, length, dst);
Niels Möller's avatar
Niels Möller committed
145 146 147 148
}

void
eax_decrypt (struct eax_ctx *eax, const struct eax_key *key,
149
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
150 151
	     size_t length, uint8_t *dst, const uint8_t *src)
{
152 153
  omac_update (&eax->omac_message, key, cipher, f, length, src);
  ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr.b, length, dst, src);
Niels Möller's avatar
Niels Möller committed
154 155 156 157
}

void
eax_digest (struct eax_ctx *eax, const struct eax_key *key,
158
	    const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
159 160 161 162
	    size_t length, uint8_t *digest)
{
  assert (length > 0);
  assert (length <= EAX_BLOCK_SIZE);
163 164
  omac_final (&eax->omac_data, key, cipher, f);
  omac_final (&eax->omac_message, key, cipher, f);
Niels Möller's avatar
Niels Möller committed
165

166 167
  block16_xor (&eax->omac_nonce, &eax->omac_data);
  memxor3 (digest, eax->omac_nonce.b, eax->omac_message.b, length);
Niels Möller's avatar
Niels Möller committed
168
}