1 /*
2 * Copyright 2014-2022 The GmSSL Project. All Rights Reserved.
3 *
4 * Licensed under the Apache License, Version 2.0 (the License); you may
5 * not use this file except in compliance with the License.
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 */
9
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <stdlib.h>
14 #include <gmssl/gf128.h>
15 #include <gmssl/gcm.h>
16 #include <gmssl/oid.h>
17 #include <gmssl/error.h>
18 #include <gmssl/aes.h>
19 #include <gmssl/endian.h>
20
21
22 /*
23 * GHASH(H, A, C) = X_{m + n + 1}
24 * A additional authenticated data, A = A_1, ..., A_{m-1}, A_{m^*}, nbits(A_{m^*}) = v
25 * C ciphertext, C = C_1, ..., C_{n-1}, C_{n^*}, nbits(C_{n^*}) = u
26 * H = E_K(0^128)
27 *
28 * X_i = 0 for i = 0
29 * = (X_{i-1} xor A_i ) * H for i = 1, ..., m-1
30 * = (X_{m-1} xor (A_m^* || 0^{128-v})) * H for i = m
31 * = (X_{i-1} xor C_i ) * H for i = m+1, ..., m + n − 1
32 * = (X_{m+n-1} xor (C_m^* || 0^{128-u})) * H for i = m + n
33 * = (X_{m+n} xor (nbits(A)||nbits(C))) * H for i = m + n + 1
34 */
ghash(const uint8_t h[16],const uint8_t * aad,size_t aadlen,const uint8_t * c,size_t clen,uint8_t out[16])35 void ghash(const uint8_t h[16], const uint8_t *aad, size_t aadlen, const uint8_t *c, size_t clen, uint8_t out[16])
36 {
37 gf128_t H = gf128_from_bytes(h);
38 gf128_t X = gf128_zero();
39 gf128_t L;
40
41 PUTU64(out, (uint64_t)aadlen << 3);
42 PUTU64(out + 8, (uint64_t)clen << 3);
43 L = gf128_from_bytes(out);
44
45 while (aadlen) {
46 gf128_t A;
47 if (aadlen >= 16) {
48 A = gf128_from_bytes(aad);
49 aad += 16;
50 aadlen -= 16;
51 } else {
52 memset(out, 0, 16);
53 memcpy(out, aad, aadlen);
54 A = gf128_from_bytes(out);
55 aadlen = 0;
56 }
57 X = gf128_add(X, A);
58 X = gf128_mul(X, H);
59 }
60
61 while (clen) {
62 gf128_t C;
63 if (clen >= 16) {
64 C = gf128_from_bytes(c);
65 c += 16;
66 clen -= 16;
67 } else {
68 memset(out, 0, 16);
69 memcpy(out, c, clen);
70 C = gf128_from_bytes(out);
71 clen = 0;
72 }
73 X = gf128_add(X, C);
74 X = gf128_mul(X, H);
75 }
76
77 X = gf128_add(X, L);
78 H = gf128_mul(X, H);
79 gf128_to_bytes(H, out);
80 }
81
gcm_encrypt(const BLOCK_CIPHER_KEY * key,const uint8_t * iv,size_t ivlen,const uint8_t * aad,size_t aadlen,const uint8_t * in,size_t inlen,uint8_t * out,size_t taglen,uint8_t * tag)82 int gcm_encrypt(const BLOCK_CIPHER_KEY *key, const uint8_t *iv, size_t ivlen,
83 const uint8_t *aad, size_t aadlen, const uint8_t *in, size_t inlen,
84 uint8_t *out, size_t taglen, uint8_t *tag)
85 {
86 if (key->cipher == BLOCK_CIPHER_sm4()) {
87 if (sm4_gcm_encrypt(&(key->u.sm4_key), iv, ivlen, aad, aadlen, in, inlen, out, taglen, tag) != 1) {
88 error_print();
89 return -1;
90 }
91 } else if (key->cipher == BLOCK_CIPHER_aes128()) {
92 if (aes_gcm_encrypt(&(key->u.aes_key), iv, ivlen, aad, aadlen, in, inlen, out, taglen, tag) != 1) {
93 error_print();
94 return -1;
95 }
96 }
97 return 1;
98 }
99
gcm_decrypt(const BLOCK_CIPHER_KEY * key,const uint8_t * iv,size_t ivlen,const uint8_t * aad,size_t aadlen,const uint8_t * in,size_t inlen,const uint8_t * tag,size_t taglen,uint8_t * out)100 int gcm_decrypt(const BLOCK_CIPHER_KEY *key, const uint8_t *iv, size_t ivlen,
101 const uint8_t *aad, size_t aadlen, const uint8_t *in, size_t inlen,
102 const uint8_t *tag, size_t taglen, uint8_t *out)
103 {
104 if (key->cipher == BLOCK_CIPHER_sm4()) {
105 if (sm4_gcm_decrypt(&(key->u.sm4_key), iv, ivlen, aad, aadlen, in, inlen, tag, taglen, out) != 1) {
106 error_print();
107 return -1;
108 }
109 } else if (key->cipher == BLOCK_CIPHER_aes128()) {
110 if (aes_gcm_decrypt(&(key->u.aes_key), iv, ivlen, aad, aadlen, in, inlen, tag, taglen, out) != 1) {
111 error_print();
112 return -1;
113 }
114 }
115 return 1;
116 }
117