1 /** 2 * \file gcm.h 3 * 4 * \brief This file contains GCM definitions and functions. 5 * 6 * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined 7 * in <em>D. McGrew, J. Viega, The Galois/Counter Mode of Operation 8 * (GCM), Natl. Inst. Stand. Technol.</em> 9 * 10 * For more information on GCM, see <em>NIST SP 800-38D: Recommendation for 11 * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC</em>. 12 * 13 */ 14 /* 15 * Copyright The Mbed TLS Contributors 16 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 17 */ 18 19 #ifndef MBEDTLS_GCM_H 20 #define MBEDTLS_GCM_H 21 22 #if !defined(MBEDTLS_CONFIG_FILE) 23 #include "mbedtls/config.h" 24 #else 25 #include MBEDTLS_CONFIG_FILE 26 #endif 27 28 #include "mbedtls/cipher.h" 29 30 #include <stdint.h> 31 32 #define MBEDTLS_GCM_ENCRYPT 1 33 #define MBEDTLS_GCM_DECRYPT 0 34 35 /** Authenticated decryption failed. */ 36 #define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 37 38 /* MBEDTLS_ERR_GCM_HW_ACCEL_FAILED is deprecated and should not be used. */ 39 /** GCM hardware accelerator failed. */ 40 #define MBEDTLS_ERR_GCM_HW_ACCEL_FAILED -0x0013 41 42 /** Bad input parameters to function. */ 43 #define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 44 45 #ifdef __cplusplus 46 extern "C" { 47 #endif 48 49 #if !defined(MBEDTLS_GCM_ALT) 50 51 /** 52 * \brief The GCM context structure. 53 */ 54 typedef struct mbedtls_gcm_context { 55 mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ 56 uint64_t HL[16]; /*!< Precalculated HTable low. */ 57 uint64_t HH[16]; /*!< Precalculated HTable high. */ 58 uint64_t len; /*!< The total length of the encrypted data. */ 59 uint64_t add_len; /*!< The total length of the additional data. */ 60 unsigned char base_ectr[16]; /*!< The first ECTR for tag. */ 61 unsigned char y[16]; /*!< The Y working value. */ 62 unsigned char buf[16]; /*!< The buf working value. */ 63 int mode; /*!< The operation to perform: 64 #MBEDTLS_GCM_ENCRYPT or 65 #MBEDTLS_GCM_DECRYPT. */ 66 } 67 mbedtls_gcm_context; 68 69 #else /* !MBEDTLS_GCM_ALT */ 70 #include "gcm_alt.h" 71 #endif /* !MBEDTLS_GCM_ALT */ 72 73 /** 74 * \brief This function initializes the specified GCM context, 75 * to make references valid, and prepares the context 76 * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). 77 * 78 * The function does not bind the GCM context to a particular 79 * cipher, nor set the key. For this purpose, use 80 * mbedtls_gcm_setkey(). 81 * 82 * \param ctx The GCM context to initialize. This must not be \c NULL. 83 */ 84 void mbedtls_gcm_init(mbedtls_gcm_context *ctx); 85 86 /** 87 * \brief This function associates a GCM context with a 88 * cipher algorithm and a key. 89 * 90 * \param ctx The GCM context. This must be initialized. 91 * \param cipher The 128-bit block cipher to use. 92 * \param key The encryption key. This must be a readable buffer of at 93 * least \p keybits bits. 94 * \param keybits The key size in bits. Valid options are: 95 * <ul><li>128 bits</li> 96 * <li>192 bits</li> 97 * <li>256 bits</li></ul> 98 * 99 * \return \c 0 on success. 100 * \return A cipher-specific error code on failure. 101 */ 102 int mbedtls_gcm_setkey(mbedtls_gcm_context *ctx, 103 mbedtls_cipher_id_t cipher, 104 const unsigned char *key, 105 unsigned int keybits); 106 107 /** 108 * \brief This function performs GCM encryption or decryption of a buffer. 109 * 110 * \note For encryption, the output buffer can be the same as the 111 * input buffer. For decryption, the output buffer cannot be 112 * the same as input buffer. If the buffers overlap, the output 113 * buffer must trail at least 8 Bytes behind the input buffer. 114 * 115 * \warning When this function performs a decryption, it outputs the 116 * authentication tag and does not verify that the data is 117 * authentic. You should use this function to perform encryption 118 * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. 119 * 120 * \param ctx The GCM context to use for encryption or decryption. This 121 * must be initialized. 122 * \param mode The operation to perform: 123 * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. 124 * The ciphertext is written to \p output and the 125 * authentication tag is written to \p tag. 126 * - #MBEDTLS_GCM_DECRYPT to perform decryption. 127 * The plaintext is written to \p output and the 128 * authentication tag is written to \p tag. 129 * Note that this mode is not recommended, because it does 130 * not verify the authenticity of the data. For this reason, 131 * you should use mbedtls_gcm_auth_decrypt() instead of 132 * calling this function in decryption mode. 133 * \param length The length of the input data, which is equal to the length 134 * of the output data. 135 * \param iv The initialization vector. This must be a readable buffer of 136 * at least \p iv_len Bytes. 137 * \param iv_len The length of the IV. 138 * \param add The buffer holding the additional data. This must be of at 139 * least that size in Bytes. 140 * \param add_len The length of the additional data. 141 * \param input The buffer holding the input data. If \p length is greater 142 * than zero, this must be a readable buffer of at least that 143 * size in Bytes. 144 * \param output The buffer for holding the output data. If \p length is greater 145 * than zero, this must be a writable buffer of at least that 146 * size in Bytes. 147 * \param tag_len The length of the tag to generate. 148 * \param tag The buffer for holding the tag. This must be a writable 149 * buffer of at least \p tag_len Bytes. 150 * 151 * \return \c 0 if the encryption or decryption was performed 152 * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, 153 * this does not indicate that the data is authentic. 154 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 155 * not valid or a cipher-specific error code if the encryption 156 * or decryption failed. 157 */ 158 int mbedtls_gcm_crypt_and_tag(mbedtls_gcm_context *ctx, 159 int mode, 160 size_t length, 161 const unsigned char *iv, 162 size_t iv_len, 163 const unsigned char *add, 164 size_t add_len, 165 const unsigned char *input, 166 unsigned char *output, 167 size_t tag_len, 168 unsigned char *tag); 169 170 /** 171 * \brief This function performs a GCM authenticated decryption of a 172 * buffer. 173 * 174 * \note For decryption, the output buffer cannot be the same as 175 * input buffer. If the buffers overlap, the output buffer 176 * must trail at least 8 Bytes behind the input buffer. 177 * 178 * \param ctx The GCM context. This must be initialized. 179 * \param length The length of the ciphertext to decrypt, which is also 180 * the length of the decrypted plaintext. 181 * \param iv The initialization vector. This must be a readable buffer 182 * of at least \p iv_len Bytes. 183 * \param iv_len The length of the IV. 184 * \param add The buffer holding the additional data. This must be of at 185 * least that size in Bytes. 186 * \param add_len The length of the additional data. 187 * \param tag The buffer holding the tag to verify. This must be a 188 * readable buffer of at least \p tag_len Bytes. 189 * \param tag_len The length of the tag to verify. 190 * \param input The buffer holding the ciphertext. If \p length is greater 191 * than zero, this must be a readable buffer of at least that 192 * size. 193 * \param output The buffer for holding the decrypted plaintext. If \p length 194 * is greater than zero, this must be a writable buffer of at 195 * least that size. 196 * 197 * \return \c 0 if successful and authenticated. 198 * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. 199 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 200 * not valid or a cipher-specific error code if the decryption 201 * failed. 202 */ 203 int mbedtls_gcm_auth_decrypt(mbedtls_gcm_context *ctx, 204 size_t length, 205 const unsigned char *iv, 206 size_t iv_len, 207 const unsigned char *add, 208 size_t add_len, 209 const unsigned char *tag, 210 size_t tag_len, 211 const unsigned char *input, 212 unsigned char *output); 213 214 /** 215 * \brief This function starts a GCM encryption or decryption 216 * operation. 217 * 218 * \param ctx The GCM context. This must be initialized. 219 * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or 220 * #MBEDTLS_GCM_DECRYPT. 221 * \param iv The initialization vector. This must be a readable buffer of 222 * at least \p iv_len Bytes. 223 * \param iv_len The length of the IV. 224 * \param add The buffer holding the additional data, or \c NULL 225 * if \p add_len is \c 0. 226 * \param add_len The length of the additional data. If \c 0, 227 * \p add may be \c NULL. 228 * 229 * \return \c 0 on success. 230 */ 231 int mbedtls_gcm_starts(mbedtls_gcm_context *ctx, 232 int mode, 233 const unsigned char *iv, 234 size_t iv_len, 235 const unsigned char *add, 236 size_t add_len); 237 238 /** 239 * \brief This function feeds an input buffer into an ongoing GCM 240 * encryption or decryption operation. 241 * 242 * ` The function expects input to be a multiple of 16 243 * Bytes. Only the last call before calling 244 * mbedtls_gcm_finish() can be less than 16 Bytes. 245 * 246 * \note For decryption, the output buffer cannot be the same as 247 * input buffer. If the buffers overlap, the output buffer 248 * must trail at least 8 Bytes behind the input buffer. 249 * 250 * \param ctx The GCM context. This must be initialized. 251 * \param length The length of the input data. This must be a multiple of 252 * 16 except in the last call before mbedtls_gcm_finish(). 253 * \param input The buffer holding the input data. If \p length is greater 254 * than zero, this must be a readable buffer of at least that 255 * size in Bytes. 256 * \param output The buffer for holding the output data. If \p length is 257 * greater than zero, this must be a writable buffer of at 258 * least that size in Bytes. 259 * 260 * \return \c 0 on success. 261 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. 262 */ 263 int mbedtls_gcm_update(mbedtls_gcm_context *ctx, 264 size_t length, 265 const unsigned char *input, 266 unsigned char *output); 267 268 /** 269 * \brief This function finishes the GCM operation and generates 270 * the authentication tag. 271 * 272 * It wraps up the GCM stream, and generates the 273 * tag. The tag can have a maximum length of 16 Bytes. 274 * 275 * \param ctx The GCM context. This must be initialized. 276 * \param tag The buffer for holding the tag. This must be a writable 277 * buffer of at least \p tag_len Bytes. 278 * \param tag_len The length of the tag to generate. This must be at least 279 * four. 280 * 281 * \return \c 0 on success. 282 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. 283 */ 284 int mbedtls_gcm_finish(mbedtls_gcm_context *ctx, 285 unsigned char *tag, 286 size_t tag_len); 287 288 /** 289 * \brief This function clears a GCM context and the underlying 290 * cipher sub-context. 291 * 292 * \param ctx The GCM context to clear. If this is \c NULL, the call has 293 * no effect. Otherwise, this must be initialized. 294 */ 295 void mbedtls_gcm_free(mbedtls_gcm_context *ctx); 296 297 #if defined(MBEDTLS_SELF_TEST) 298 299 /** 300 * \brief The GCM checkup routine. 301 * 302 * \return \c 0 on success. 303 * \return \c 1 on failure. 304 */ 305 int mbedtls_gcm_self_test(int verbose); 306 307 #endif /* MBEDTLS_SELF_TEST */ 308 309 #ifdef __cplusplus 310 } 311 #endif 312 313 314 #endif /* gcm.h */ 315