modes.h 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236
  1. /*
  2. * Copyright 2010-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /* This header can move into provider when legacy support is removed */
  10. #include <openssl/modes.h>
  11. #if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
  12. typedef __int64 i64;
  13. typedef unsigned __int64 u64;
  14. # define U64(C) C##UI64
  15. #elif defined(__arch64__)
  16. typedef long i64;
  17. typedef unsigned long u64;
  18. # define U64(C) C##UL
  19. #else
  20. typedef long long i64;
  21. typedef unsigned long long u64;
  22. # define U64(C) C##ULL
  23. #endif
  24. typedef unsigned int u32;
  25. typedef unsigned char u8;
  26. #define STRICT_ALIGNMENT 1
  27. #ifndef PEDANTIC
  28. # if defined(__i386) || defined(__i386__) || \
  29. defined(__x86_64) || defined(__x86_64__) || \
  30. defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64) || \
  31. defined(__aarch64__) || \
  32. defined(__s390__) || defined(__s390x__)
  33. # undef STRICT_ALIGNMENT
  34. # endif
  35. #endif
  36. #if !defined(PEDANTIC) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
  37. # if defined(__GNUC__) && __GNUC__>=2
  38. # if defined(__x86_64) || defined(__x86_64__)
  39. # define BSWAP8(x) ({ u64 ret_=(x); \
  40. asm ("bswapq %0" \
  41. : "+r"(ret_)); ret_; })
  42. # define BSWAP4(x) ({ u32 ret_=(x); \
  43. asm ("bswapl %0" \
  44. : "+r"(ret_)); ret_; })
  45. # elif (defined(__i386) || defined(__i386__)) && !defined(I386_ONLY)
  46. # define BSWAP8(x) ({ u32 lo_=(u64)(x)>>32,hi_=(x); \
  47. asm ("bswapl %0; bswapl %1" \
  48. : "+r"(hi_),"+r"(lo_)); \
  49. (u64)hi_<<32|lo_; })
  50. # define BSWAP4(x) ({ u32 ret_=(x); \
  51. asm ("bswapl %0" \
  52. : "+r"(ret_)); ret_; })
  53. # elif defined(__aarch64__)
  54. # if defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__) && \
  55. __BYTE_ORDER__==__ORDER_LITTLE_ENDIAN__
  56. # define BSWAP8(x) ({ u64 ret_; \
  57. asm ("rev %0,%1" \
  58. : "=r"(ret_) : "r"(x)); ret_; })
  59. # define BSWAP4(x) ({ u32 ret_; \
  60. asm ("rev %w0,%w1" \
  61. : "=r"(ret_) : "r"(x)); ret_; })
  62. # endif
  63. # elif (defined(__arm__) || defined(__arm)) && !defined(STRICT_ALIGNMENT)
  64. # define BSWAP8(x) ({ u32 lo_=(u64)(x)>>32,hi_=(x); \
  65. asm ("rev %0,%0; rev %1,%1" \
  66. : "+r"(hi_),"+r"(lo_)); \
  67. (u64)hi_<<32|lo_; })
  68. # define BSWAP4(x) ({ u32 ret_; \
  69. asm ("rev %0,%1" \
  70. : "=r"(ret_) : "r"((u32)(x))); \
  71. ret_; })
  72. # elif (defined(__riscv_zbb) || defined(__riscv_zbkb)) && __riscv_xlen == 64
  73. # define BSWAP8(x) ({ u64 ret_=(x); \
  74. asm ("rev8 %0,%0" \
  75. : "+r"(ret_)); ret_; })
  76. # define BSWAP4(x) ({ u32 ret_=(x); \
  77. asm ("rev8 %0,%0; srli %0,%0,32"\
  78. : "+&r"(ret_)); ret_; })
  79. # endif
  80. # elif defined(_MSC_VER)
  81. # if _MSC_VER>=1300
  82. # include <stdlib.h>
  83. # pragma intrinsic(_byteswap_uint64,_byteswap_ulong)
  84. # define BSWAP8(x) _byteswap_uint64((u64)(x))
  85. # define BSWAP4(x) _byteswap_ulong((u32)(x))
  86. # elif defined(_M_IX86)
  87. __inline u32 _bswap4(u32 val)
  88. {
  89. _asm mov eax, val _asm bswap eax}
  90. # define BSWAP4(x) _bswap4(x)
  91. # endif
  92. # endif
  93. #endif
  94. #if defined(BSWAP4) && !defined(STRICT_ALIGNMENT)
  95. # define GETU32(p) BSWAP4(*(const u32 *)(p))
  96. # define PUTU32(p,v) *(u32 *)(p) = BSWAP4(v)
  97. #else
  98. # define GETU32(p) ((u32)(p)[0]<<24|(u32)(p)[1]<<16|(u32)(p)[2]<<8|(u32)(p)[3])
  99. # define PUTU32(p,v) ((p)[0]=(u8)((v)>>24),(p)[1]=(u8)((v)>>16),(p)[2]=(u8)((v)>>8),(p)[3]=(u8)(v))
  100. #endif
  101. /*- GCM definitions */ typedef struct {
  102. u64 hi, lo;
  103. } u128;
  104. typedef void (*gcm_init_fn)(u128 Htable[16], const u64 H[2]);
  105. typedef void (*gcm_ghash_fn)(u64 Xi[2], const u128 Htable[16], const u8 *inp, size_t len);
  106. typedef void (*gcm_gmult_fn)(u64 Xi[2], const u128 Htable[16]);
  107. struct gcm_funcs_st {
  108. gcm_init_fn ginit;
  109. gcm_ghash_fn ghash;
  110. gcm_gmult_fn gmult;
  111. };
  112. struct gcm128_context {
  113. /* Following 6 names follow names in GCM specification */
  114. union {
  115. u64 u[2];
  116. u32 d[4];
  117. u8 c[16];
  118. size_t t[16 / sizeof(size_t)];
  119. } Yi, EKi, EK0, len, Xi, H;
  120. /*
  121. * Relative position of Yi, EKi, EK0, len, Xi, H and pre-computed Htable is
  122. * used in some assembler modules, i.e. don't change the order!
  123. */
  124. u128 Htable[16];
  125. struct gcm_funcs_st funcs;
  126. unsigned int mres, ares;
  127. block128_f block;
  128. void *key;
  129. #if !defined(OPENSSL_SMALL_FOOTPRINT)
  130. unsigned char Xn[48];
  131. #endif
  132. };
  133. /* GHASH functions */
  134. void ossl_gcm_init_4bit(u128 Htable[16], const u64 H[2]);
  135. void ossl_gcm_ghash_4bit(u64 Xi[2], const u128 Htable[16],
  136. const u8 *inp, size_t len);
  137. void ossl_gcm_gmult_4bit(u64 Xi[2], const u128 Htable[16]);
  138. /*
  139. * The maximum permitted number of cipher blocks per data unit in XTS mode.
  140. * Reference IEEE Std 1619-2018.
  141. */
  142. #define XTS_MAX_BLOCKS_PER_DATA_UNIT (1<<20)
  143. struct xts128_context {
  144. void *key1, *key2;
  145. block128_f block1, block2;
  146. };
  147. /* XTS mode for SM4 algorithm specified by GB/T 17964-2021 */
  148. int ossl_crypto_xts128gb_encrypt(const XTS128_CONTEXT *ctx,
  149. const unsigned char iv[16],
  150. const unsigned char *inp, unsigned char *out,
  151. size_t len, int enc);
  152. struct ccm128_context {
  153. union {
  154. u64 u[2];
  155. u8 c[16];
  156. } nonce, cmac;
  157. u64 blocks;
  158. block128_f block;
  159. void *key;
  160. };
  161. #ifndef OPENSSL_NO_OCB
  162. typedef union {
  163. u64 a[2];
  164. unsigned char c[16];
  165. } OCB_BLOCK;
  166. # define ocb_block16_xor(in1,in2,out) \
  167. ( (out)->a[0]=(in1)->a[0]^(in2)->a[0], \
  168. (out)->a[1]=(in1)->a[1]^(in2)->a[1] )
  169. # if STRICT_ALIGNMENT
  170. # define ocb_block16_xor_misaligned(in1,in2,out) \
  171. ocb_block_xor((in1)->c,(in2)->c,16,(out)->c)
  172. # else
  173. # define ocb_block16_xor_misaligned ocb_block16_xor
  174. # endif
  175. struct ocb128_context {
  176. /* Need both encrypt and decrypt key schedules for decryption */
  177. block128_f encrypt;
  178. block128_f decrypt;
  179. void *keyenc;
  180. void *keydec;
  181. ocb128_f stream; /* direction dependent */
  182. /* Key dependent variables. Can be reused if key remains the same */
  183. size_t l_index;
  184. size_t max_l_index;
  185. OCB_BLOCK l_star;
  186. OCB_BLOCK l_dollar;
  187. OCB_BLOCK *l;
  188. /* Must be reset for each session */
  189. struct {
  190. u64 blocks_hashed;
  191. u64 blocks_processed;
  192. OCB_BLOCK offset_aad;
  193. OCB_BLOCK sum;
  194. OCB_BLOCK offset;
  195. OCB_BLOCK checksum;
  196. } sess;
  197. };
  198. #endif /* OPENSSL_NO_OCB */
  199. #ifndef OPENSSL_NO_SIV
  200. #define SIV_LEN 16
  201. typedef union siv_block_u {
  202. uint64_t word[SIV_LEN/sizeof(uint64_t)];
  203. unsigned char byte[SIV_LEN];
  204. } SIV_BLOCK;
  205. struct siv128_context {
  206. /* d stores intermediate results of S2V; it corresponds to D from the
  207. pseudocode in section 2.4 of RFC 5297. */
  208. SIV_BLOCK d;
  209. SIV_BLOCK tag;
  210. EVP_CIPHER_CTX *cipher_ctx;
  211. EVP_MAC *mac;
  212. EVP_MAC_CTX *mac_ctx_init;
  213. int final_ret;
  214. int crypto_ok;
  215. };
  216. #endif /* OPENSSL_NO_SIV */