1 /** 2 * \file gcm.h 3 * 4 * \brief This file contains GCM definitions and functions. 5 * 6 * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined 7 * in <em>D. McGrew, J. Viega, The Galois/Counter Mode of Operation 8 * (GCM), Natl. Inst. Stand. Technol.</em> 9 * 10 * For more information on GCM, see <em>NIST SP 800-38D: Recommendation for 11 * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC</em>. 12 * 13 */ 14 /* 15 * Copyright The Mbed TLS Contributors 16 * SPDX-License-Identifier: Apache-2.0 17 * 18 * Licensed under the Apache License, Version 2.0 (the "License"); you may 19 * not use this file except in compliance with the License. 20 * You may obtain a copy of the License at 21 * 22 * http://www.apache.org/licenses/LICENSE-2.0 23 * 24 * Unless required by applicable law or agreed to in writing, software 25 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 26 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 27 * See the License for the specific language governing permissions and 28 * limitations under the License. 29 */ 30 31 #ifndef MBEDTLS_GCM_H 32 #define MBEDTLS_GCM_H 33 #include "mbedtls/private_access.h" 34 35 #include "mbedtls/build_info.h" 36 37 #include "mbedtls/cipher.h" 38 39 #include <stdint.h> 40 41 #define MBEDTLS_GCM_ENCRYPT 1 42 #define MBEDTLS_GCM_DECRYPT 0 43 44 /** Authenticated decryption failed. */ 45 #define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 46 /** Bad input parameters to function. */ 47 #define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 48 /** An output buffer is too small. */ 49 #define MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL -0x0016 50 51 #ifdef __cplusplus 52 extern "C" { 53 #endif 54 55 #if !defined(MBEDTLS_GCM_ALT) 56 57 /** 58 * \brief The GCM context structure. 59 */ 60 typedef struct mbedtls_gcm_context 61 { 62 mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher_ctx); /*!< The cipher context used. */ 63 uint64_t MBEDTLS_PRIVATE(HL)[16]; /*!< Precalculated HTable low. */ 64 uint64_t MBEDTLS_PRIVATE(HH)[16]; /*!< Precalculated HTable high. */ 65 uint64_t MBEDTLS_PRIVATE(len); /*!< The total length of the encrypted data. */ 66 uint64_t MBEDTLS_PRIVATE(add_len); /*!< The total length of the additional data. */ 67 unsigned char MBEDTLS_PRIVATE(base_ectr)[16]; /*!< The first ECTR for tag. */ 68 unsigned char MBEDTLS_PRIVATE(y)[16]; /*!< The Y working value. */ 69 unsigned char MBEDTLS_PRIVATE(buf)[16]; /*!< The buf working value. */ 70 int MBEDTLS_PRIVATE(mode); /*!< The operation to perform: 71 #MBEDTLS_GCM_ENCRYPT or 72 #MBEDTLS_GCM_DECRYPT. */ 73 } 74 mbedtls_gcm_context; 75 76 #else /* !MBEDTLS_GCM_ALT */ 77 #include "gcm_alt.h" 78 #endif /* !MBEDTLS_GCM_ALT */ 79 80 /** 81 * \brief This function initializes the specified GCM context, 82 * to make references valid, and prepares the context 83 * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). 84 * 85 * The function does not bind the GCM context to a particular 86 * cipher, nor set the key. For this purpose, use 87 * mbedtls_gcm_setkey(). 88 * 89 * \param ctx The GCM context to initialize. This must not be \c NULL. 90 */ 91 void mbedtls_gcm_init( mbedtls_gcm_context *ctx ); 92 93 /** 94 * \brief This function associates a GCM context with a 95 * cipher algorithm and a key. 96 * 97 * \param ctx The GCM context. This must be initialized. 98 * \param cipher The 128-bit block cipher to use. 99 * \param key The encryption key. This must be a readable buffer of at 100 * least \p keybits bits. 101 * \param keybits The key size in bits. Valid options are: 102 * <ul><li>128 bits</li> 103 * <li>192 bits</li> 104 * <li>256 bits</li></ul> 105 * 106 * \return \c 0 on success. 107 * \return A cipher-specific error code on failure. 108 */ 109 int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx, 110 mbedtls_cipher_id_t cipher, 111 const unsigned char *key, 112 unsigned int keybits ); 113 114 /** 115 * \brief This function performs GCM encryption or decryption of a buffer. 116 * 117 * \note For encryption, the output buffer can be the same as the 118 * input buffer. For decryption, the output buffer cannot be 119 * the same as input buffer. If the buffers overlap, the output 120 * buffer must trail at least 8 Bytes behind the input buffer. 121 * 122 * \warning When this function performs a decryption, it outputs the 123 * authentication tag and does not verify that the data is 124 * authentic. You should use this function to perform encryption 125 * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. 126 * 127 * \param ctx The GCM context to use for encryption or decryption. This 128 * must be initialized. 129 * \param mode The operation to perform: 130 * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. 131 * The ciphertext is written to \p output and the 132 * authentication tag is written to \p tag. 133 * - #MBEDTLS_GCM_DECRYPT to perform decryption. 134 * The plaintext is written to \p output and the 135 * authentication tag is written to \p tag. 136 * Note that this mode is not recommended, because it does 137 * not verify the authenticity of the data. For this reason, 138 * you should use mbedtls_gcm_auth_decrypt() instead of 139 * calling this function in decryption mode. 140 * \param length The length of the input data, which is equal to the length 141 * of the output data. 142 * \param iv The initialization vector. This must be a readable buffer of 143 * at least \p iv_len Bytes. 144 * \param iv_len The length of the IV. 145 * \param add The buffer holding the additional data. This must be of at 146 * least that size in Bytes. 147 * \param add_len The length of the additional data. 148 * \param input The buffer holding the input data. If \p length is greater 149 * than zero, this must be a readable buffer of at least that 150 * size in Bytes. 151 * \param output The buffer for holding the output data. If \p length is greater 152 * than zero, this must be a writable buffer of at least that 153 * size in Bytes. 154 * \param tag_len The length of the tag to generate. 155 * \param tag The buffer for holding the tag. This must be a writable 156 * buffer of at least \p tag_len Bytes. 157 * 158 * \return \c 0 if the encryption or decryption was performed 159 * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, 160 * this does not indicate that the data is authentic. 161 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 162 * not valid or a cipher-specific error code if the encryption 163 * or decryption failed. 164 */ 165 int mbedtls_gcm_crypt_and_tag( mbedtls_gcm_context *ctx, 166 int mode, 167 size_t length, 168 const unsigned char *iv, 169 size_t iv_len, 170 const unsigned char *add, 171 size_t add_len, 172 const unsigned char *input, 173 unsigned char *output, 174 size_t tag_len, 175 unsigned char *tag ); 176 177 /** 178 * \brief This function performs a GCM authenticated decryption of a 179 * buffer. 180 * 181 * \note For decryption, the output buffer cannot be the same as 182 * input buffer. If the buffers overlap, the output buffer 183 * must trail at least 8 Bytes behind the input buffer. 184 * 185 * \param ctx The GCM context. This must be initialized. 186 * \param length The length of the ciphertext to decrypt, which is also 187 * the length of the decrypted plaintext. 188 * \param iv The initialization vector. This must be a readable buffer 189 * of at least \p iv_len Bytes. 190 * \param iv_len The length of the IV. 191 * \param add The buffer holding the additional data. This must be of at 192 * least that size in Bytes. 193 * \param add_len The length of the additional data. 194 * \param tag The buffer holding the tag to verify. This must be a 195 * readable buffer of at least \p tag_len Bytes. 196 * \param tag_len The length of the tag to verify. 197 * \param input The buffer holding the ciphertext. If \p length is greater 198 * than zero, this must be a readable buffer of at least that 199 * size. 200 * \param output The buffer for holding the decrypted plaintext. If \p length 201 * is greater than zero, this must be a writable buffer of at 202 * least that size. 203 * 204 * \return \c 0 if successful and authenticated. 205 * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. 206 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 207 * not valid or a cipher-specific error code if the decryption 208 * failed. 209 */ 210 int mbedtls_gcm_auth_decrypt( mbedtls_gcm_context *ctx, 211 size_t length, 212 const unsigned char *iv, 213 size_t iv_len, 214 const unsigned char *add, 215 size_t add_len, 216 const unsigned char *tag, 217 size_t tag_len, 218 const unsigned char *input, 219 unsigned char *output ); 220 221 /** 222 * \brief This function starts a GCM encryption or decryption 223 * operation. 224 * 225 * \param ctx The GCM context. This must be initialized. 226 * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or 227 * #MBEDTLS_GCM_DECRYPT. 228 * \param iv The initialization vector. This must be a readable buffer of 229 * at least \p iv_len Bytes. 230 * \param iv_len The length of the IV. 231 * 232 * \return \c 0 on success. 233 */ 234 int mbedtls_gcm_starts( mbedtls_gcm_context *ctx, 235 int mode, 236 const unsigned char *iv, 237 size_t iv_len ); 238 239 /** 240 * \brief This function feeds an input buffer as associated data 241 * (authenticated but not encrypted data) in a GCM 242 * encryption or decryption operation. 243 * 244 * Call this function after mbedtls_gcm_starts() to pass 245 * the associated data. If the associated data is empty, 246 * you do not need to call this function. You may not 247 * call this function after calling mbedtls_cipher_update(). 248 * 249 * \param ctx The GCM context. This must have been started with 250 * mbedtls_gcm_starts() and must not have yet received 251 * any input with mbedtls_gcm_update(). 252 * \param add The buffer holding the additional data, or \c NULL 253 * if \p add_len is \c 0. 254 * \param add_len The length of the additional data. If \c 0, 255 * \p add may be \c NULL. 256 * 257 * \return \c 0 on success. 258 */ 259 int mbedtls_gcm_update_ad( mbedtls_gcm_context *ctx, 260 const unsigned char *add, 261 size_t add_len ); 262 263 /** 264 * \brief This function feeds an input buffer into an ongoing GCM 265 * encryption or decryption operation. 266 * 267 * You may call this function zero, one or more times 268 * to pass successive parts of the input: the plaintext to 269 * encrypt, or the ciphertext (not including the tag) to 270 * decrypt. After the last part of the input, call 271 * mbedtls_gcm_finish(). 272 * 273 * This function may produce output in one of the following 274 * ways: 275 * - Immediate output: the output length is always equal 276 * to the input length. 277 * - Buffered output: the output consists of a whole number 278 * of 16-byte blocks. If the total input length so far 279 * (not including associated data) is 16 \* *B* + *A* 280 * with *A* < 16 then the total output length is 16 \* *B*. 281 * 282 * In particular: 283 * - It is always correct to call this function with 284 * \p output_size >= \p input_length + 15. 285 * - If \p input_length is a multiple of 16 for all the calls 286 * to this function during an operation, then it is 287 * correct to use \p output_size = \p input_length. 288 * 289 * \note For decryption, the output buffer cannot be the same as 290 * input buffer. If the buffers overlap, the output buffer 291 * must trail at least 8 Bytes behind the input buffer. 292 * 293 * \param ctx The GCM context. This must be initialized. 294 * \param input The buffer holding the input data. If \p input_length 295 * is greater than zero, this must be a readable buffer 296 * of at least \p input_length bytes. 297 * \param input_length The length of the input data in bytes. 298 * \param output The buffer for the output data. If \p output_size 299 * is greater than zero, this must be a writable buffer of 300 * of at least \p output_size bytes. 301 * \param output_size The size of the output buffer in bytes. 302 * See the function description regarding the output size. 303 * \param output_length On success, \p *output_length contains the actual 304 * length of the output written in \p output. 305 * On failure, the content of \p *output_length is 306 * unspecified. 307 * 308 * \return \c 0 on success. 309 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: 310 * total input length too long, 311 * unsupported input/output buffer overlap detected, 312 * or \p output_size too small. 313 */ 314 int mbedtls_gcm_update( mbedtls_gcm_context *ctx, 315 const unsigned char *input, size_t input_length, 316 unsigned char *output, size_t output_size, 317 size_t *output_length ); 318 319 /** 320 * \brief This function finishes the GCM operation and generates 321 * the authentication tag. 322 * 323 * It wraps up the GCM stream, and generates the 324 * tag. The tag can have a maximum length of 16 Bytes. 325 * 326 * \param ctx The GCM context. This must be initialized. 327 * \param tag The buffer for holding the tag. This must be a writable 328 * buffer of at least \p tag_len Bytes. 329 * \param tag_len The length of the tag to generate. This must be at least 330 * four. 331 * \param output The buffer for the final output. 332 * If \p output_size is nonzero, this must be a writable 333 * buffer of at least \p output_size bytes. 334 * \param output_size The size of the \p output buffer in bytes. 335 * This must be large enough for the output that 336 * mbedtls_gcm_update() has not produced. In particular: 337 * - If mbedtls_gcm_update() produces immediate output, 338 * or if the total input size is a multiple of \c 16, 339 * then mbedtls_gcm_finish() never produces any output, 340 * so \p output_size can be \c 0. 341 * - \p output_size never needs to be more than \c 15. 342 * \param output_length On success, \p *output_length contains the actual 343 * length of the output written in \p output. 344 * On failure, the content of \p *output_length is 345 * unspecified. 346 * 347 * \return \c 0 on success. 348 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: 349 * invalid value of \p tag_len, 350 * or \p output_size too small. 351 */ 352 int mbedtls_gcm_finish( mbedtls_gcm_context *ctx, 353 unsigned char *output, size_t output_size, 354 size_t *output_length, 355 unsigned char *tag, size_t tag_len ); 356 357 /** 358 * \brief This function clears a GCM context and the underlying 359 * cipher sub-context. 360 * 361 * \param ctx The GCM context to clear. If this is \c NULL, the call has 362 * no effect. Otherwise, this must be initialized. 363 */ 364 void mbedtls_gcm_free( mbedtls_gcm_context *ctx ); 365 366 #if defined(MBEDTLS_SELF_TEST) 367 368 /** 369 * \brief The GCM checkup routine. 370 * 371 * \return \c 0 on success. 372 * \return \c 1 on failure. 373 */ 374 int mbedtls_gcm_self_test( int verbose ); 375 376 #endif /* MBEDTLS_SELF_TEST */ 377 378 #ifdef __cplusplus 379 } 380 #endif 381 382 383 #endif /* gcm.h */ 384