The Tor Browser / annotate

security/nss/lib/freebl/intel-gcm-wrap.c@6474c204b198 (annotated)

security/nss/lib/freebl/intel-gcm-wrap.c

Wed, 31 Dec 2014 06:09:35 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Wed, 31 Dec 2014 06:09:35 +0100
changeset 0
6474c204b198
permissions
-rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

michael@0 1 /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0 2 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 4 /* Copyright(c) 2013, Intel Corp. */
michael@0 5
michael@0 6 /* Wrapper functions for Intel optimized implementation of AES-GCM */
michael@0 7
michael@0 8 #ifdef USE_HW_AES
michael@0 9
michael@0 10 #ifdef FREEBL_NO_DEPEND
michael@0 11 #include "stubs.h"
michael@0 12 #endif
michael@0 13
michael@0 14 #include "blapii.h"
michael@0 15 #include "blapit.h"
michael@0 16 #include "gcm.h"
michael@0 17 #include "ctr.h"
michael@0 18 #include "secerr.h"
michael@0 19 #include "prtypes.h"
michael@0 20 #include "pkcs11t.h"
michael@0 21
michael@0 22 #include <limits.h>
michael@0 23
michael@0 24 #include "intel-gcm.h"
michael@0 25 #include "rijndael.h"
michael@0 26
michael@0 27 #include <emmintrin.h>
michael@0 28 #include <tmmintrin.h>
michael@0 29
michael@0 30
michael@0 31 struct intel_AES_GCMContextStr{
michael@0 32 unsigned char Htbl[16*AES_BLOCK_SIZE];
michael@0 33 unsigned char X0[AES_BLOCK_SIZE];
michael@0 34 unsigned char T[AES_BLOCK_SIZE];
michael@0 35 unsigned char CTR[AES_BLOCK_SIZE];
michael@0 36 AESContext *aes_context;
michael@0 37 unsigned long tagBits;
michael@0 38 unsigned long Alen;
michael@0 39 unsigned long Mlen;
michael@0 40 };
michael@0 41
michael@0 42 intel_AES_GCMContext *intel_AES_GCM_CreateContext(void *context,
michael@0 43 freeblCipherFunc cipher,
michael@0 44 const unsigned char *params,
michael@0 45 unsigned int blocksize)
michael@0 46 {
michael@0 47 intel_AES_GCMContext *gcm = NULL;
michael@0 48 AESContext *aes = (AESContext*)context;
michael@0 49 const CK_GCM_PARAMS *gcmParams = (const CK_GCM_PARAMS *)params;
michael@0 50 unsigned char buff[AES_BLOCK_SIZE]; /* aux buffer */
michael@0 51
michael@0 52 unsigned long IV_whole_len = gcmParams->ulIvLen & (~0xful);
michael@0 53 unsigned int IV_remainder_len = gcmParams->ulIvLen & 0xful;
michael@0 54 unsigned long AAD_whole_len = gcmParams->ulAADLen & (~0xful);
michael@0 55 unsigned int AAD_remainder_len = gcmParams->ulAADLen & 0xful;
michael@0 56
michael@0 57 __m128i BSWAP_MASK = _mm_setr_epi8(15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0);
michael@0 58 __m128i ONE = _mm_set_epi32(0,0,0,1);
michael@0 59 unsigned int j;
michael@0 60 SECStatus rv;
michael@0 61
michael@0 62 if (blocksize != AES_BLOCK_SIZE) {
michael@0 63 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0 64 return NULL;
michael@0 65 }
michael@0 66 gcm = PORT_ZNew(intel_AES_GCMContext);
michael@0 67
michael@0 68 if (gcm == NULL) {
michael@0 69 return NULL;
michael@0 70 }
michael@0 71
michael@0 72 /* initialize context fields */
michael@0 73 gcm->aes_context = aes;
michael@0 74 gcm->tagBits = gcmParams->ulTagBits;
michael@0 75 gcm->Alen = 0;
michael@0 76 gcm->Mlen = 0;
michael@0 77
michael@0 78 /* first prepare H and its derivatives for ghash */
michael@0 79 intel_aes_gcmINIT(gcm->Htbl, (unsigned char*)aes->expandedKey, aes->Nr);
michael@0 80
michael@0 81 /* Initial TAG value is zero */
michael@0 82 _mm_storeu_si128((__m128i*)gcm->T, _mm_setzero_si128());
michael@0 83 _mm_storeu_si128((__m128i*)gcm->X0, _mm_setzero_si128());
michael@0 84
michael@0 85 /* Init the counter */
michael@0 86 if (gcmParams->ulIvLen == 12) {
michael@0 87 _mm_storeu_si128((__m128i*)gcm->CTR,
michael@0 88 _mm_setr_epi32(((unsigned int*)gcmParams->pIv)[0],
michael@0 89 ((unsigned int*)gcmParams->pIv)[1],
michael@0 90 ((unsigned int*)gcmParams->pIv)[2],
michael@0 91 0x01000000));
michael@0 92 } else {
michael@0 93 /* If IV size is not 96 bits, then the initial counter value is GHASH
michael@0 94 * of the IV */
michael@0 95 intel_aes_gcmAAD(gcm->Htbl, gcmParams->pIv, IV_whole_len, gcm->T);
michael@0 96
michael@0 97 /* Partial block */
michael@0 98 if (IV_remainder_len) {
michael@0 99 PORT_Memset(buff, 0, AES_BLOCK_SIZE);
michael@0 100 PORT_Memcpy(buff, gcmParams->pIv + IV_whole_len, IV_remainder_len);
michael@0 101 intel_aes_gcmAAD(gcm->Htbl, buff, AES_BLOCK_SIZE, gcm->T);
michael@0 102 }
michael@0 103
michael@0 104 intel_aes_gcmTAG(
michael@0 105 gcm->Htbl,
michael@0 106 gcm->T,
michael@0 107 gcmParams->ulIvLen,
michael@0 108 0,
michael@0 109 gcm->X0,
michael@0 110 gcm->CTR);
michael@0 111
michael@0 112 /* TAG should be zero again */
michael@0 113 _mm_storeu_si128((__m128i*)gcm->T, _mm_setzero_si128());
michael@0 114 }
michael@0 115
michael@0 116 /* Encrypt the initial counter, will be used to encrypt the GHASH value,
michael@0 117 * in the end */
michael@0 118 rv = (*cipher)(context, gcm->X0, &j, AES_BLOCK_SIZE, gcm->CTR,
michael@0 119 AES_BLOCK_SIZE, AES_BLOCK_SIZE);
michael@0 120 if (rv != SECSuccess) {
michael@0 121 goto loser;
michael@0 122 }
michael@0 123
michael@0 124 /* Promote the counter by 1 */
michael@0 125 _mm_storeu_si128((__m128i*)gcm->CTR, _mm_shuffle_epi8(_mm_add_epi32(ONE, _mm_shuffle_epi8(_mm_loadu_si128((__m128i*)gcm->CTR), BSWAP_MASK)), BSWAP_MASK));
michael@0 126
michael@0 127 /* Now hash AAD - it would actually make sense to seperate the context
michael@0 128 * creation from the AAD, because that would allow to reuse the H, which
michael@0 129 * only changes when the AES key changes, and not every package, like the
michael@0 130 * IV and AAD */
michael@0 131 intel_aes_gcmAAD(gcm->Htbl, gcmParams->pAAD, AAD_whole_len, gcm->T);
michael@0 132 if (AAD_remainder_len) {
michael@0 133 PORT_Memset(buff, 0, AES_BLOCK_SIZE);
michael@0 134 PORT_Memcpy(buff, gcmParams->pAAD + AAD_whole_len, AAD_remainder_len);
michael@0 135 intel_aes_gcmAAD(gcm->Htbl, buff, AES_BLOCK_SIZE, gcm->T);
michael@0 136 }
michael@0 137 gcm->Alen += gcmParams->ulAADLen;
michael@0 138 return gcm;
michael@0 139
michael@0 140 loser:
michael@0 141 if (gcm) {
michael@0 142 PORT_Free(gcm);
michael@0 143 }
michael@0 144 return NULL;
michael@0 145 }
michael@0 146
michael@0 147 void intel_AES_GCM_DestroyContext(intel_AES_GCMContext *gcm, PRBool freeit)
michael@0 148 {
michael@0 149 if (freeit) {
michael@0 150 PORT_Free(gcm);
michael@0 151 }
michael@0 152 }
michael@0 153
michael@0 154 SECStatus intel_AES_GCM_EncryptUpdate(intel_AES_GCMContext *gcm,
michael@0 155 unsigned char *outbuf,
michael@0 156 unsigned int *outlen, unsigned int maxout,
michael@0 157 const unsigned char *inbuf, unsigned int inlen,
michael@0 158 unsigned int blocksize)
michael@0 159 {
michael@0 160 unsigned int tagBytes;
michael@0 161 unsigned char T[AES_BLOCK_SIZE];
michael@0 162 unsigned int j;
michael@0 163
michael@0 164 tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE - 1)) / PR_BITS_PER_BYTE;
michael@0 165 if (UINT_MAX - inlen < tagBytes) {
michael@0 166 PORT_SetError(SEC_ERROR_INPUT_LEN);
michael@0 167 return SECFailure;
michael@0 168 }
michael@0 169 if (maxout < inlen + tagBytes) {
michael@0 170 *outlen = inlen + tagBytes;
michael@0 171 PORT_SetError(SEC_ERROR_OUTPUT_LEN);
michael@0 172 return SECFailure;
michael@0 173 }
michael@0 174
michael@0 175 intel_aes_gcmENC(
michael@0 176 inbuf,
michael@0 177 outbuf,
michael@0 178 gcm,
michael@0 179 inlen);
michael@0 180
michael@0 181 gcm->Mlen += inlen;
michael@0 182
michael@0 183 intel_aes_gcmTAG(
michael@0 184 gcm->Htbl,
michael@0 185 gcm->T,
michael@0 186 gcm->Mlen,
michael@0 187 gcm->Alen,
michael@0 188 gcm->X0,
michael@0 189 T);
michael@0 190
michael@0 191 *outlen = inlen + tagBytes;
michael@0 192
michael@0 193 for (j = 0; j < tagBytes; j++) {
michael@0 194 outbuf[inlen + j] = T[j];
michael@0 195 }
michael@0 196 return SECSuccess;
michael@0 197 }
michael@0 198
michael@0 199 SECStatus intel_AES_GCM_DecryptUpdate(intel_AES_GCMContext *gcm,
michael@0 200 unsigned char *outbuf,
michael@0 201 unsigned int *outlen, unsigned int maxout,
michael@0 202 const unsigned char *inbuf, unsigned int inlen,
michael@0 203 unsigned int blocksize)
michael@0 204 {
michael@0 205 unsigned int tagBytes;
michael@0 206 unsigned char T[AES_BLOCK_SIZE];
michael@0 207 const unsigned char *intag;
michael@0 208
michael@0 209 tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE - 1)) / PR_BITS_PER_BYTE;
michael@0 210
michael@0 211 /* get the authentication block */
michael@0 212 if (inlen < tagBytes) {
michael@0 213 PORT_SetError(SEC_ERROR_INPUT_LEN);
michael@0 214 return SECFailure;
michael@0 215 }
michael@0 216
michael@0 217 inlen -= tagBytes;
michael@0 218 intag = inbuf + inlen;
michael@0 219
michael@0 220 if (maxout < inlen) {
michael@0 221 *outlen = inlen;
michael@0 222 PORT_SetError(SEC_ERROR_OUTPUT_LEN);
michael@0 223 return SECFailure;
michael@0 224 }
michael@0 225
michael@0 226 intel_aes_gcmDEC(
michael@0 227 inbuf,
michael@0 228 outbuf,
michael@0 229 gcm,
michael@0 230 inlen);
michael@0 231
michael@0 232 gcm->Mlen += inlen;
michael@0 233 intel_aes_gcmTAG(
michael@0 234 gcm->Htbl,
michael@0 235 gcm->T,
michael@0 236 gcm->Mlen,
michael@0 237 gcm->Alen,
michael@0 238 gcm->X0,
michael@0 239 T);
michael@0 240
michael@0 241 if (NSS_SecureMemcmp(T, intag, tagBytes) != 0) {
michael@0 242 memset(outbuf, 0, inlen);
michael@0 243 *outlen = 0;
michael@0 244 /* force a CKR_ENCRYPTED_DATA_INVALID error at in softoken */
michael@0 245 PORT_SetError(SEC_ERROR_BAD_DATA);
michael@0 246 return SECFailure;
michael@0 247 }
michael@0 248 *outlen = inlen;
michael@0 249
michael@0 250 return SECSuccess;
michael@0 251 }
michael@0 252
michael@0 253 #endif

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial