/
githubmirror
/
libgcrypt
Обзор
Документация
Войти
/
githubmirror
/
libgcrypt
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
libgcrypt-1.11.3
cipher/cipher-eax.c
293 строки
7 KB
Andreas Metzler
Unify capitalization of LGPL copyright statements.
12 дек 2023, 08:35
Не верифицирован
12 дек 2023, 08:35
ca56893
Код
Авторство
О чём код?
/* cipher-eax.c - EAX implementation * Copyright (C) 2018 Jussi Kivilinna <jussi.kivilinna@iki.fi> * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see <http://www.gnu.org/licenses/>. */ #include <config.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include "g10lib.h" #include "cipher.h" #include "bufhelp.h" #include "./cipher-internal.h" gcry_err_code_t _gcry_cipher_eax_encrypt (gcry_cipher_hd_t c, byte *outbuf, size_t outbuflen, const byte *inbuf, size_t inbuflen) { gcry_err_code_t err; if (outbuflen < inbuflen) return GPG_ERR_BUFFER_TOO_SHORT; if (c->marks.tag) return GPG_ERR_INV_STATE; if (!c->marks.iv) { err = _gcry_cipher_eax_set_nonce (c, NULL, 0); if (err != 0) return err; } while (inbuflen) { size_t currlen = inbuflen; /* Since checksumming is done after encryption, process input in 24KiB * chunks to keep data loaded in L1 cache for checksumming. However * only do splitting if input is large enough so that last chunks does * not end up being short.*/ if (currlen > 32 * 1024) currlen = 24 * 1024; err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen); if (err != 0) return err; err = _gcry_cmac_write (c, &c->u_mode.eax.cmac_ciphertext, outbuf, currlen); if (err != 0) return err; outbuf += currlen; inbuf += currlen; outbuflen -= currlen; inbuflen -= currlen; } return 0; } gcry_err_code_t _gcry_cipher_eax_decrypt (gcry_cipher_hd_t c, byte *outbuf, size_t outbuflen, const byte *inbuf, size_t inbuflen) { gcry_err_code_t err; if (outbuflen < inbuflen) return GPG_ERR_BUFFER_TOO_SHORT; if (c->marks.tag) return GPG_ERR_INV_STATE; if (!c->marks.iv) { err = _gcry_cipher_eax_set_nonce (c, NULL, 0); if (err != 0) return err; } while (inbuflen) { size_t currlen = inbuflen; /* Since checksumming is done before decryption, process input in 24KiB * chunks to keep data loaded in L1 cache for decryption. However only * do splitting if input is large enough so that last chunks does not * end up being short. */ if (currlen > 32 * 1024) currlen = 24 * 1024; err = _gcry_cmac_write (c, &c->u_mode.eax.cmac_ciphertext, inbuf, currlen); if (err != 0) return err; err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen); if (err != 0) return err; outbuf += currlen; inbuf += currlen; outbuflen -= currlen; inbuflen -= currlen; } return 0; } gcry_err_code_t _gcry_cipher_eax_authenticate (gcry_cipher_hd_t c, const byte * aadbuf, size_t aadbuflen) { gcry_err_code_t err; if (c->marks.tag) return GPG_ERR_INV_STATE; if (!c->marks.iv) { err = _gcry_cipher_eax_set_nonce (c, NULL, 0); if (err != 0) return err; } return _gcry_cmac_write (c, &c->u_mode.eax.cmac_header, aadbuf, aadbuflen); } gcry_err_code_t _gcry_cipher_eax_setkey (gcry_cipher_hd_t c) { gcry_err_code_t err; err = _gcry_cmac_generate_subkeys (c, &c->u_mode.eax.cmac_header); if (err != 0) return err; buf_cpy (c->u_mode.eax.cmac_ciphertext.subkeys, c->u_mode.eax.cmac_header.subkeys, sizeof(c->u_mode.eax.cmac_header.subkeys)); return 0; } gcry_err_code_t _gcry_cipher_eax_set_nonce (gcry_cipher_hd_t c, const byte *nonce, size_t noncelen) { gcry_cmac_context_t nonce_cmac; unsigned char initbuf[MAX_BLOCKSIZE]; gcry_err_code_t err; c->marks.iv = 0; c->marks.tag = 0; _gcry_cmac_reset (&c->u_mode.eax.cmac_header); _gcry_cmac_reset (&c->u_mode.eax.cmac_ciphertext); /* Calculate nonce CMAC */ memset(&nonce_cmac, 0, sizeof(nonce_cmac)); memset(&initbuf, 0, sizeof(initbuf)); buf_cpy (&nonce_cmac.subkeys, c->u_mode.eax.cmac_header.subkeys, sizeof(c->u_mode.eax.cmac_header.subkeys)); err = _gcry_cmac_write (c, &nonce_cmac, initbuf, c->spec->blocksize); if (err != 0) return err; if (noncelen != 0) { err = _gcry_cmac_write (c, &nonce_cmac, nonce, noncelen); if (err != 0) return err; } err = _gcry_cmac_final (c, &nonce_cmac); if (err != 0) return err; cipher_block_cpy (c->u_iv.iv, nonce_cmac.u_iv.iv, MAX_BLOCKSIZE); cipher_block_cpy (c->u_ctr.ctr, nonce_cmac.u_iv.iv, MAX_BLOCKSIZE); wipememory (&nonce_cmac, sizeof(nonce_cmac)); /* Prepare header CMAC */ initbuf[c->spec->blocksize - 1] = 1; err = _gcry_cmac_write (c, &c->u_mode.eax.cmac_header, initbuf, c->spec->blocksize); if (err != 0) return err; /* Prepare ciphertext CMAC */ initbuf[c->spec->blocksize - 1] = 2; err = _gcry_cmac_write (c, &c->u_mode.eax.cmac_ciphertext, initbuf, c->spec->blocksize); if (err != 0) return err; c->marks.iv = 1; c->marks.tag = 0; return 0; } static gcry_err_code_t _gcry_cipher_eax_tag (gcry_cipher_hd_t c, byte *outbuf, size_t outbuflen, int check) { gcry_err_code_t err; if (!c->marks.tag) { err = _gcry_cmac_final (c, &c->u_mode.eax.cmac_header); if (err != 0) return err; err = _gcry_cmac_final (c, &c->u_mode.eax.cmac_ciphertext); if (err != 0) return err; cipher_block_xor_1 (c->u_iv.iv, c->u_mode.eax.cmac_header.u_iv.iv, MAX_BLOCKSIZE); cipher_block_xor_1 (c->u_iv.iv, c->u_mode.eax.cmac_ciphertext.u_iv.iv, MAX_BLOCKSIZE); _gcry_cmac_reset (&c->u_mode.eax.cmac_header); _gcry_cmac_reset (&c->u_mode.eax.cmac_ciphertext); c->marks.tag = 1; } if (!check) { if (outbuflen > c->spec->blocksize) outbuflen = c->spec->blocksize; /* NB: We already checked that OUTBUF is large enough to hold * the result or has valid truncated length. */ memcpy (outbuf, c->u_iv.iv, outbuflen); } else { /* OUTBUFLEN gives the length of the user supplied tag in OUTBUF * and thus we need to compare its length first. */ if (!(outbuflen <= c->spec->blocksize) || !buf_eq_const (outbuf, c->u_iv.iv, outbuflen)) return GPG_ERR_CHECKSUM; } return 0; } gcry_err_code_t _gcry_cipher_eax_get_tag (gcry_cipher_hd_t c, unsigned char *outtag, size_t taglen) { return _gcry_cipher_eax_tag (c, outtag, taglen, 0); } gcry_err_code_t _gcry_cipher_eax_check_tag (gcry_cipher_hd_t c, const unsigned char *intag, size_t taglen) { return _gcry_cipher_eax_tag (c, (unsigned char *) intag, taglen, 1); }