1/* Copyright (c) (2022) Apple Inc. All rights reserved.
2 *
3 * corecrypto is licensed under Apple Inc.’s Internal Use License Agreement (which
4 * is contained in the License.txt file distributed with corecrypto) and only to
5 * people who accept that license. IMPORTANT: Any license rights granted to you by
6 * Apple Inc. (if any) are limited to internal use within your organization only on
7 * devices and computers you own or control, for the sole purpose of verifying the
8 * security characteristics and correct functioning of the Apple Software. You may
9 * not, directly or indirectly, redistribute the Apple Software or any portions thereof.
10 */
11
12#ifndef _CORECRYPTO_CCMODE_GCM_INTERNAL_H_
13#define _CORECRYPTO_CCMODE_GCM_INTERNAL_H_
14
15#include <corecrypto/ccmode_impl.h>
16
17#define CCGCM_IV_NBYTES 12
18#define CCGCM_BLOCK_NBYTES 16
19
20/* Create a gcm key from a gcm mode object.
21 * key must point to at least sizeof(CCMODE_GCM_KEY(ecb)) bytes of free
22 * storage. */
23int ccmode_gcm_init(const struct ccmode_gcm *gcm, ccgcm_ctx *ctx,
24 size_t rawkey_len, const void *rawkey);
25int ccmode_gcm_set_iv(ccgcm_ctx *ctx, size_t iv_nbytes, const void *iv);
26int ccmode_gcm_aad(ccgcm_ctx *ctx, size_t nbytes, const void *in);
27int ccmode_gcm_decrypt(ccgcm_ctx *ctx, size_t nbytes, const void *in,
28 void *out);
29int ccmode_gcm_encrypt(ccgcm_ctx *ctx, size_t nbytes, const void *in,
30 void *out);
31
32/*!
33 * @function ccmode_gcm_finalize() finalizes AES-GCM call sequence
34 * @param key encryption or decryption key
35 * @param tag_nbytes length of tag in bytes
36 * @param tag authentication tag
37 * @result 0=success or non zero= error
38 * @discussion For decryption, the tag parameter must be the expected-tag. A secure compare is performed between the provided expected-tag and the computed-tag. If they are the same, 0 is returned. Otherwise, non zero is returned. For encryption, tag is output and provides the authentication tag.
39 *
40 */
41int ccmode_gcm_finalize(ccgcm_ctx *key, size_t tag_nbytes, void *tag);
42int ccmode_gcm_reset(ccgcm_ctx *key);
43
44#define GCM_ECB_KEY_SIZE(ECB_ENCRYPT) \
45 ((5 * ccn_sizeof_size((ECB_ENCRYPT)->block_size)) \
46 + ccn_sizeof_size((ECB_ENCRYPT)->size))
47
48#define CCGCM_FLAGS_INIT_WITH_IV 1
49
50// Here is what the structure looks like in memory
51// [ temp space | length | *ecb | *ecb_key | table | ecb_key ]
52// size of table depends on the implementation (VNG vs factory)
53// currently, VNG and factory share the same "header" described here
54// VNG may add additional data after the header
55struct _ccmode_gcm_key {
56 // 5 blocks of temp space.
57 unsigned char H[16]; /* multiplier */
58 unsigned char X[16]; /* accumulator */
59 unsigned char Y[16]; /* counter */
60 unsigned char Y_0[16]; /* initial counter */
61 unsigned char buf[16]; /* buffer for stuff */
62
63 // State and length
64 uint16_t state; /* state the GCM code is in */
65 uint16_t flags; /* flags (persistent across reset) */
66 uint32_t buf_nbytes; /* length of data in buf */
67
68 uint64_t aad_nbytes; /* 64-bit counter used for IV and AAD */
69 uint64_t text_nbytes; /* 64-bit counter for the plaintext PT */
70
71 // ECB
72 const struct ccmode_ecb *ecb; // ecb mode
73 // Pointer to the ECB key in the buffer
74 void *ecb_key; // address of the ecb_key in u, set in init function
75 int encdec; //is it an encrypt or decrypt object
76
77 // Buffer with ECB key and H table if applicable
78 CC_ALIGNED(16) unsigned char u[]; // ecb key + tables
79};
80
81/* Macros for accessing a CCMODE_GCM_KEY.
82 * Common to the generic (factory) and the VNG implementation
83 */
84
85#define _CCMODE_GCM_KEY(K) ((struct _ccmode_gcm_key *)(K))
86#define CCMODE_GCM_KEY_H(K) (_CCMODE_GCM_KEY(K)->H)
87#define CCMODE_GCM_KEY_X(K) (_CCMODE_GCM_KEY(K)->X)
88#define CCMODE_GCM_KEY_Y(K) (_CCMODE_GCM_KEY(K)->Y)
89#define CCMODE_GCM_KEY_Y_0(K) (_CCMODE_GCM_KEY(K)->Y_0)
90#define CCMODE_GCM_KEY_PAD_LEN(K) (_CCMODE_GCM_KEY(K)->buf_nbytes)
91#define CCMODE_GCM_KEY_PAD(K) (_CCMODE_GCM_KEY(K)->buf)
92
93#define _CCMODE_GCM_ECB_MODE(K) ((struct _ccmode_gcm_key *)(K))
94#define CCMODE_GCM_KEY_ECB(K) (_CCMODE_GCM_ECB_MODE(K)->ecb)
95#define CCMODE_GCM_KEY_ECB_KEY(K) ((ccecb_ctx *)_CCMODE_GCM_ECB_MODE(K)->ecb_key) // set in init function
96
97#define CCMODE_GCM_STATE_IV 1
98#define CCMODE_GCM_STATE_AAD 2
99#define CCMODE_GCM_STATE_TEXT 3
100#define CCMODE_GCM_STATE_FINAL 4
101
102void ccmode_gcm_gf_mult(const unsigned char *a, const unsigned char *b, unsigned char *c);
103void ccmode_gcm_gf_mult_32(const unsigned char *a, const unsigned char *b, unsigned char *c);
104void ccmode_gcm_gf_mult_64(const unsigned char *a, const unsigned char *b, unsigned char *c);
105void ccmode_gcm_mult_h(ccgcm_ctx *key, unsigned char *I);
106
107CC_NONNULL_ALL
108void inc_uint(uint8_t *buf, size_t nbytes);
109
110CC_NONNULL_ALL
111void ccmode_gcm_update_pad(ccgcm_ctx *key);
112
113CC_NONNULL_ALL
114void ccmode_gcm_aad_finalize(ccgcm_ctx *key);
115
116#endif // _CORECRYPTO_CCMODE_GCM_INTERNAL_H_
117