ctr128.c 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212
  1. /*
  2. * Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <string.h>
  10. #include <openssl/crypto.h>
  11. #include "internal/endian.h"
  12. #include "crypto/modes.h"
  13. #if defined(__GNUC__) && !defined(STRICT_ALIGNMENT)
  14. typedef size_t size_t_aX __attribute((__aligned__(1)));
  15. #else
  16. typedef size_t size_t_aX;
  17. #endif
  18. /*
  19. * NOTE: the IV/counter CTR mode is big-endian. The code itself is
  20. * endian-neutral.
  21. */
  22. /* increment counter (128-bit int) by 1 */
  23. static void ctr128_inc(unsigned char *counter)
  24. {
  25. u32 n = 16, c = 1;
  26. do {
  27. --n;
  28. c += counter[n];
  29. counter[n] = (u8)c;
  30. c >>= 8;
  31. } while (n);
  32. }
  33. #if !defined(OPENSSL_SMALL_FOOTPRINT)
  34. static void ctr128_inc_aligned(unsigned char *counter)
  35. {
  36. size_t *data, c, d, n;
  37. DECLARE_IS_ENDIAN;
  38. if (IS_LITTLE_ENDIAN || ((size_t)counter % sizeof(size_t)) != 0) {
  39. ctr128_inc(counter);
  40. return;
  41. }
  42. data = (size_t *)counter;
  43. c = 1;
  44. n = 16 / sizeof(size_t);
  45. do {
  46. --n;
  47. d = data[n] += c;
  48. /* did addition carry? */
  49. c = ((d - c) & ~d) >> (sizeof(size_t) * 8 - 1);
  50. } while (n);
  51. }
  52. #endif
  53. /*
  54. * The input encrypted as though 128bit counter mode is being used. The
  55. * extra state information to record how much of the 128bit block we have
  56. * used is contained in *num, and the encrypted counter is kept in
  57. * ecount_buf. Both *num and ecount_buf must be initialised with zeros
  58. * before the first call to CRYPTO_ctr128_encrypt(). This algorithm assumes
  59. * that the counter is in the x lower bits of the IV (ivec), and that the
  60. * application has full control over overflow and the rest of the IV. This
  61. * implementation takes NO responsibility for checking that the counter
  62. * doesn't overflow into the rest of the IV when incremented.
  63. */
  64. void CRYPTO_ctr128_encrypt(const unsigned char *in, unsigned char *out,
  65. size_t len, const void *key,
  66. unsigned char ivec[16],
  67. unsigned char ecount_buf[16], unsigned int *num,
  68. block128_f block)
  69. {
  70. unsigned int n;
  71. size_t l = 0;
  72. n = *num;
  73. #if !defined(OPENSSL_SMALL_FOOTPRINT)
  74. if (16 % sizeof(size_t) == 0) { /* always true actually */
  75. do {
  76. while (n && len) {
  77. *(out++) = *(in++) ^ ecount_buf[n];
  78. --len;
  79. n = (n + 1) % 16;
  80. }
  81. # if defined(STRICT_ALIGNMENT)
  82. if (((size_t)in | (size_t)out | (size_t)ecount_buf)
  83. % sizeof(size_t) != 0)
  84. break;
  85. # endif
  86. while (len >= 16) {
  87. (*block) (ivec, ecount_buf, key);
  88. ctr128_inc_aligned(ivec);
  89. for (n = 0; n < 16; n += sizeof(size_t))
  90. *(size_t_aX *)(out + n) =
  91. *(size_t_aX *)(in + n)
  92. ^ *(size_t_aX *)(ecount_buf + n);
  93. len -= 16;
  94. out += 16;
  95. in += 16;
  96. n = 0;
  97. }
  98. if (len) {
  99. (*block) (ivec, ecount_buf, key);
  100. ctr128_inc_aligned(ivec);
  101. while (len--) {
  102. out[n] = in[n] ^ ecount_buf[n];
  103. ++n;
  104. }
  105. }
  106. *num = n;
  107. return;
  108. } while (0);
  109. }
  110. /* the rest would be commonly eliminated by x86* compiler */
  111. #endif
  112. while (l < len) {
  113. if (n == 0) {
  114. (*block) (ivec, ecount_buf, key);
  115. ctr128_inc(ivec);
  116. }
  117. out[l] = in[l] ^ ecount_buf[n];
  118. ++l;
  119. n = (n + 1) % 16;
  120. }
  121. *num = n;
  122. }
  123. /* increment upper 96 bits of 128-bit counter by 1 */
  124. static void ctr96_inc(unsigned char *counter)
  125. {
  126. u32 n = 12, c = 1;
  127. do {
  128. --n;
  129. c += counter[n];
  130. counter[n] = (u8)c;
  131. c >>= 8;
  132. } while (n);
  133. }
  134. void CRYPTO_ctr128_encrypt_ctr32(const unsigned char *in, unsigned char *out,
  135. size_t len, const void *key,
  136. unsigned char ivec[16],
  137. unsigned char ecount_buf[16],
  138. unsigned int *num, ctr128_f func)
  139. {
  140. unsigned int n, ctr32;
  141. n = *num;
  142. while (n && len) {
  143. *(out++) = *(in++) ^ ecount_buf[n];
  144. --len;
  145. n = (n + 1) % 16;
  146. }
  147. ctr32 = GETU32(ivec + 12);
  148. while (len >= 16) {
  149. size_t blocks = len / 16;
  150. /*
  151. * 1<<28 is just a not-so-small yet not-so-large number...
  152. * Below condition is practically never met, but it has to
  153. * be checked for code correctness.
  154. */
  155. if (sizeof(size_t) > sizeof(unsigned int) && blocks > (1U << 28))
  156. blocks = (1U << 28);
  157. /*
  158. * As (*func) operates on 32-bit counter, caller
  159. * has to handle overflow. 'if' below detects the
  160. * overflow, which is then handled by limiting the
  161. * amount of blocks to the exact overflow point...
  162. */
  163. ctr32 += (u32)blocks;
  164. if (ctr32 < blocks) {
  165. blocks -= ctr32;
  166. ctr32 = 0;
  167. }
  168. (*func) (in, out, blocks, key, ivec);
  169. /* (*ctr) does not update ivec, caller does: */
  170. PUTU32(ivec + 12, ctr32);
  171. /* ... overflow was detected, propagate carry. */
  172. if (ctr32 == 0)
  173. ctr96_inc(ivec);
  174. blocks *= 16;
  175. len -= blocks;
  176. out += blocks;
  177. in += blocks;
  178. }
  179. if (len) {
  180. memset(ecount_buf, 0, 16);
  181. (*func) (ecount_buf, ecount_buf, 1, key, ivec);
  182. ++ctr32;
  183. PUTU32(ivec + 12, ctr32);
  184. if (ctr32 == 0)
  185. ctr96_inc(ivec);
  186. while (len--) {
  187. out[n] = in[n] ^ ecount_buf[n];
  188. ++n;
  189. }
  190. }
  191. *num = n;
  192. }