1 | /* Copyright (c) (2022) Apple Inc. All rights reserved. |
2 | * |
3 | * corecrypto is licensed under Apple Inc.’s Internal Use License Agreement (which |
4 | * is contained in the License.txt file distributed with corecrypto) and only to |
5 | * people who accept that license. IMPORTANT: Any license rights granted to you by |
6 | * Apple Inc. (if any) are limited to internal use within your organization only on |
7 | * devices and computers you own or control, for the sole purpose of verifying the |
8 | * security characteristics and correct functioning of the Apple Software. You may |
9 | * not, directly or indirectly, redistribute the Apple Software or any portions thereof. |
10 | */ |
11 | |
12 | #ifndef _CORECRYPTO_CCMODE_GCM_INTERNAL_H_ |
13 | #define _CORECRYPTO_CCMODE_GCM_INTERNAL_H_ |
14 | |
15 | #include <corecrypto/ccmode_impl.h> |
16 | |
17 | #define CCGCM_IV_NBYTES 12 |
18 | #define CCGCM_BLOCK_NBYTES 16 |
19 | |
20 | /* Create a gcm key from a gcm mode object. |
21 | * key must point to at least sizeof(CCMODE_GCM_KEY(ecb)) bytes of free |
22 | * storage. */ |
23 | int ccmode_gcm_init(const struct ccmode_gcm *gcm, ccgcm_ctx *ctx, |
24 | size_t rawkey_len, const void *rawkey); |
25 | int ccmode_gcm_set_iv(ccgcm_ctx *ctx, size_t iv_nbytes, const void *iv); |
26 | int ccmode_gcm_aad(ccgcm_ctx *ctx, size_t nbytes, const void *in); |
27 | int ccmode_gcm_decrypt(ccgcm_ctx *ctx, size_t nbytes, const void *in, |
28 | void *out); |
29 | int ccmode_gcm_encrypt(ccgcm_ctx *ctx, size_t nbytes, const void *in, |
30 | void *out); |
31 | |
32 | /*! |
33 | * @function ccmode_gcm_finalize() finalizes AES-GCM call sequence |
34 | * @param key encryption or decryption key |
35 | * @param tag_nbytes length of tag in bytes |
36 | * @param tag authentication tag |
37 | * @result 0=success or non zero= error |
38 | * @discussion For decryption, the tag parameter must be the expected-tag. A secure compare is performed between the provided expected-tag and the computed-tag. If they are the same, 0 is returned. Otherwise, non zero is returned. For encryption, tag is output and provides the authentication tag. |
39 | * |
40 | */ |
41 | int ccmode_gcm_finalize(ccgcm_ctx *key, size_t tag_nbytes, void *tag); |
42 | int ccmode_gcm_reset(ccgcm_ctx *key); |
43 | |
44 | #define GCM_ECB_KEY_SIZE(ECB_ENCRYPT) \ |
45 | ((5 * ccn_sizeof_size((ECB_ENCRYPT)->block_size)) \ |
46 | + ccn_sizeof_size((ECB_ENCRYPT)->size)) |
47 | |
48 | #define CCGCM_FLAGS_INIT_WITH_IV 1 |
49 | |
50 | // Here is what the structure looks like in memory |
51 | // [ temp space | length | *ecb | *ecb_key | table | ecb_key ] |
52 | // size of table depends on the implementation (VNG vs factory) |
53 | // currently, VNG and factory share the same "header" described here |
54 | // VNG may add additional data after the header |
55 | struct _ccmode_gcm_key { |
56 | // 5 blocks of temp space. |
57 | unsigned char H[16]; /* multiplier */ |
58 | unsigned char X[16]; /* accumulator */ |
59 | unsigned char Y[16]; /* counter */ |
60 | unsigned char Y_0[16]; /* initial counter */ |
61 | unsigned char buf[16]; /* buffer for stuff */ |
62 | |
63 | // State and length |
64 | uint16_t state; /* state the GCM code is in */ |
65 | uint16_t flags; /* flags (persistent across reset) */ |
66 | uint32_t buf_nbytes; /* length of data in buf */ |
67 | |
68 | uint64_t aad_nbytes; /* 64-bit counter used for IV and AAD */ |
69 | uint64_t text_nbytes; /* 64-bit counter for the plaintext PT */ |
70 | |
71 | // ECB |
72 | const struct ccmode_ecb *ecb; // ecb mode |
73 | // Pointer to the ECB key in the buffer |
74 | void *ecb_key; // address of the ecb_key in u, set in init function |
75 | int encdec; //is it an encrypt or decrypt object |
76 | |
77 | // Buffer with ECB key and H table if applicable |
78 | CC_ALIGNED(16) unsigned char u[]; // ecb key + tables |
79 | }; |
80 | |
81 | /* Macros for accessing a CCMODE_GCM_KEY. |
82 | * Common to the generic (factory) and the VNG implementation |
83 | */ |
84 | |
85 | #define _CCMODE_GCM_KEY(K) ((struct _ccmode_gcm_key *)(K)) |
86 | #define CCMODE_GCM_KEY_H(K) (_CCMODE_GCM_KEY(K)->H) |
87 | #define CCMODE_GCM_KEY_X(K) (_CCMODE_GCM_KEY(K)->X) |
88 | #define CCMODE_GCM_KEY_Y(K) (_CCMODE_GCM_KEY(K)->Y) |
89 | #define CCMODE_GCM_KEY_Y_0(K) (_CCMODE_GCM_KEY(K)->Y_0) |
90 | #define CCMODE_GCM_KEY_PAD_LEN(K) (_CCMODE_GCM_KEY(K)->buf_nbytes) |
91 | #define CCMODE_GCM_KEY_PAD(K) (_CCMODE_GCM_KEY(K)->buf) |
92 | |
93 | #define _CCMODE_GCM_ECB_MODE(K) ((struct _ccmode_gcm_key *)(K)) |
94 | #define CCMODE_GCM_KEY_ECB(K) (_CCMODE_GCM_ECB_MODE(K)->ecb) |
95 | #define CCMODE_GCM_KEY_ECB_KEY(K) ((ccecb_ctx *)_CCMODE_GCM_ECB_MODE(K)->ecb_key) // set in init function |
96 | |
97 | #define CCMODE_GCM_STATE_IV 1 |
98 | #define CCMODE_GCM_STATE_AAD 2 |
99 | #define CCMODE_GCM_STATE_TEXT 3 |
100 | #define CCMODE_GCM_STATE_FINAL 4 |
101 | |
102 | void ccmode_gcm_gf_mult(const unsigned char *a, const unsigned char *b, unsigned char *c); |
103 | void ccmode_gcm_gf_mult_32(const unsigned char *a, const unsigned char *b, unsigned char *c); |
104 | void ccmode_gcm_gf_mult_64(const unsigned char *a, const unsigned char *b, unsigned char *c); |
105 | void ccmode_gcm_mult_h(ccgcm_ctx *key, unsigned char *I); |
106 | |
107 | CC_NONNULL_ALL |
108 | void inc_uint(uint8_t *buf, size_t nbytes); |
109 | |
110 | CC_NONNULL_ALL |
111 | void ccmode_gcm_update_pad(ccgcm_ctx *key); |
112 | |
113 | CC_NONNULL_ALL |
114 | void ccmode_gcm_aad_finalize(ccgcm_ctx *key); |
115 | |
116 | #endif // _CORECRYPTO_CCMODE_GCM_INTERNAL_H_ |
117 | |