eax.c 4.35 KB
Newer Older
Niels Möller's avatar
Niels Möller committed
1
/* eax.c
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

   EAX mode, see http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf

   Copyright (C) 2013 Niels Möller

   This file is part of GNU Nettle.

   GNU Nettle is free software: you can redistribute it and/or
   modify it under the terms of either:

     * the GNU Lesser General Public License as published by the Free
       Software Foundation; either version 3 of the License, or (at your
       option) any later version.

   or

     * the GNU General Public License as published by the Free
       Software Foundation; either version 2 of the License, or (at your
       option) any later version.

   or both in parallel, as here.

   GNU Nettle is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   General Public License for more details.

   You should have received copies of the GNU General Public License and
   the GNU Lesser General Public License along with this program.  If
   not, see http://www.gnu.org/licenses/.
*/
Niels Möller's avatar
Niels Möller committed
33 34 35 36 37 38 39 40 41 42

#if HAVE_CONFIG_H
# include "config.h"
#endif

#include <assert.h>
#include <string.h>

#include "eax.h"

43
#include "block-internal.h"
Niels Möller's avatar
Niels Möller committed
44 45 46 47
#include "ctr.h"
#include "memxor.h"

static void
48
omac_init (union nettle_block16 *state, unsigned t)
Niels Möller's avatar
Niels Möller committed
49
{
50 51
  memset (state->b, 0, EAX_BLOCK_SIZE - 1);
  state->b[EAX_BLOCK_SIZE - 1] = t;
Niels Möller's avatar
Niels Möller committed
52 53
}

54 55
static void
omac_update (union nettle_block16 *state, const struct eax_key *key,
56
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
57 58 59 60 61
	     size_t length, const uint8_t *data)
{
  for (; length >= EAX_BLOCK_SIZE;
       length -= EAX_BLOCK_SIZE, data += EAX_BLOCK_SIZE)
    {
62 63
      f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
      memxor (state->b, data, EAX_BLOCK_SIZE);
Niels Möller's avatar
Niels Möller committed
64 65 66 67
    }
  if (length > 0)
    {
      /* Allowed only for the last call */
68 69 70
      f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
      memxor (state->b, data, length);
      state->b[length] ^= 0x80;
Niels Möller's avatar
Niels Möller committed
71 72
      /* XOR with (P ^ B), since the digest processing
       * unconditionally XORs with B */
73
      block16_xor (state, &key->pad_partial);
Niels Möller's avatar
Niels Möller committed
74 75 76 77
    }
}

static void
78
omac_final (union nettle_block16 *state, const struct eax_key *key,
79
	    const void *cipher, nettle_cipher_func *f)
Niels Möller's avatar
Niels Möller committed
80
{
81 82
  block16_xor (state, &key->pad_block);
  f (cipher, EAX_BLOCK_SIZE, state->b, state->b);
Niels Möller's avatar
Niels Möller committed
83 84 85
}

void
86
eax_set_key (struct eax_key *key, const void *cipher, nettle_cipher_func *f)
Niels Möller's avatar
Niels Möller committed
87
{
88 89
  static const union nettle_block16 zero_block;
  f (cipher, EAX_BLOCK_SIZE, key->pad_block.b, zero_block.b);
90 91
  block16_mulx_be (&key->pad_block, &key->pad_block);
  block16_mulx_be (&key->pad_partial, &key->pad_block);
92
  block16_xor (&key->pad_partial, &key->pad_block);
Niels Möller's avatar
Niels Möller committed
93 94 95 96
}

void
eax_set_nonce (struct eax_ctx *eax, const struct eax_key *key,
97
	       const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
98 99
	       size_t nonce_length, const uint8_t *nonce)
{
100 101 102 103
  omac_init (&eax->omac_nonce, 0);
  omac_update (&eax->omac_nonce, key, cipher, f, nonce_length, nonce);
  omac_final (&eax->omac_nonce, key, cipher, f);
  memcpy (eax->ctr.b, eax->omac_nonce.b, EAX_BLOCK_SIZE);
Niels Möller's avatar
Niels Möller committed
104

105 106
  omac_init (&eax->omac_data, 1);
  omac_init (&eax->omac_message, 2);
Niels Möller's avatar
Niels Möller committed
107 108 109 110
}

void
eax_update (struct eax_ctx *eax, const struct eax_key *key,
111
	    const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
112 113
	    size_t data_length, const uint8_t *data)
{
114
  omac_update (&eax->omac_data, key, cipher, f, data_length, data);
Niels Möller's avatar
Niels Möller committed
115 116 117 118
}

void
eax_encrypt (struct eax_ctx *eax, const struct eax_key *key,
119
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
120 121
	     size_t length, uint8_t *dst, const uint8_t *src)
{
122 123
  ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr.b, length, dst, src);
  omac_update (&eax->omac_message, key, cipher, f, length, dst);
Niels Möller's avatar
Niels Möller committed
124 125 126 127
}

void
eax_decrypt (struct eax_ctx *eax, const struct eax_key *key,
128
	     const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
129 130
	     size_t length, uint8_t *dst, const uint8_t *src)
{
131 132
  omac_update (&eax->omac_message, key, cipher, f, length, src);
  ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr.b, length, dst, src);
Niels Möller's avatar
Niels Möller committed
133 134 135 136
}

void
eax_digest (struct eax_ctx *eax, const struct eax_key *key,
137
	    const void *cipher, nettle_cipher_func *f,
Niels Möller's avatar
Niels Möller committed
138 139 140 141
	    size_t length, uint8_t *digest)
{
  assert (length > 0);
  assert (length <= EAX_BLOCK_SIZE);
142 143
  omac_final (&eax->omac_data, key, cipher, f);
  omac_final (&eax->omac_message, key, cipher, f);
Niels Möller's avatar
Niels Möller committed
144

145 146
  block16_xor (&eax->omac_nonce, &eax->omac_data);
  memxor3 (digest, eax->omac_nonce.b, eax->omac_message.b, length);
Niels Möller's avatar
Niels Möller committed
147
}