The Tor Browser / file revision

 /* This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 /* Copyright(c) 2013, Intel Corp. */

 /* Wrapper functions for Intel optimized implementation of AES-GCM */

 #ifdef USE_HW_AES

 #ifdef FREEBL_NO_DEPEND

 #include "stubs.h"

 #endif

 #include "blapii.h"

 #include "blapit.h"

 #include "gcm.h"

 #include "ctr.h"

 #include "secerr.h"

 #include "prtypes.h"

 #include "pkcs11t.h"

 #include <limits.h>

 #include "intel-gcm.h"

 #include "rijndael.h"

 #include <emmintrin.h>

 #include <tmmintrin.h>

 struct intel_AES_GCMContextStr{

     unsigned char Htbl[16*AES_BLOCK_SIZE];

     unsigned char X0[AES_BLOCK_SIZE];

     unsigned char T[AES_BLOCK_SIZE];

     unsigned char CTR[AES_BLOCK_SIZE];

     AESContext *aes_context;

     unsigned long tagBits;

     unsigned long Alen;

     unsigned long Mlen;

 };

 intel_AES_GCMContext *intel_AES_GCM_CreateContext(void *context,

                freeblCipherFunc cipher,

                const unsigned char *params,

                unsigned int blocksize)

 {

     intel_AES_GCMContext *gcm = NULL;

     AESContext *aes = (AESContext*)context;

     const CK_GCM_PARAMS *gcmParams = (const CK_GCM_PARAMS *)params;

     unsigned char buff[AES_BLOCK_SIZE]; /* aux buffer */

     unsigned long IV_whole_len = gcmParams->ulIvLen & (~0xful);

     unsigned int IV_remainder_len = gcmParams->ulIvLen & 0xful;

     unsigned long AAD_whole_len = gcmParams->ulAADLen & (~0xful);

     unsigned int AAD_remainder_len = gcmParams->ulAADLen & 0xful;

     __m128i BSWAP_MASK = _mm_setr_epi8(15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0);

     __m128i ONE = _mm_set_epi32(0,0,0,1);

     unsigned int j;

     SECStatus rv;

     if (blocksize != AES_BLOCK_SIZE) {

       PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

       return NULL;

     }

     gcm = PORT_ZNew(intel_AES_GCMContext);

     if (gcm == NULL) {

         return NULL;

     }

     /* initialize context fields */

     gcm->aes_context = aes;

     gcm->tagBits = gcmParams->ulTagBits;

     gcm->Alen = 0;

     gcm->Mlen = 0;

     /* first prepare H and its derivatives for ghash */

     intel_aes_gcmINIT(gcm->Htbl, (unsigned char*)aes->expandedKey, aes->Nr);

     /* Initial TAG value is zero */

     _mm_storeu_si128((__m128i*)gcm->T, _mm_setzero_si128());

     _mm_storeu_si128((__m128i*)gcm->X0, _mm_setzero_si128());

     /* Init the counter */

     if (gcmParams->ulIvLen == 12) {

         _mm_storeu_si128((__m128i*)gcm->CTR,

                          _mm_setr_epi32(((unsigned int*)gcmParams->pIv)[0],

                                         ((unsigned int*)gcmParams->pIv)[1],

                                         ((unsigned int*)gcmParams->pIv)[2],

                                         0x01000000));

     } else {

         /* If IV size is not 96 bits, then the initial counter value is GHASH

          * of the IV */

         intel_aes_gcmAAD(gcm->Htbl, gcmParams->pIv, IV_whole_len, gcm->T);

         /* Partial block */

         if (IV_remainder_len) {

             PORT_Memset(buff, 0, AES_BLOCK_SIZE);

             PORT_Memcpy(buff, gcmParams->pIv + IV_whole_len, IV_remainder_len);

             intel_aes_gcmAAD(gcm->Htbl, buff, AES_BLOCK_SIZE, gcm->T);

         }

         intel_aes_gcmTAG(

             gcm->Htbl,

             gcm->T,

             gcmParams->ulIvLen,

             0,

             gcm->X0,

             gcm->CTR);

         /* TAG should be zero again */

         _mm_storeu_si128((__m128i*)gcm->T, _mm_setzero_si128());

     }

     /* Encrypt the initial counter, will be used to encrypt the GHASH value,

      * in the end */

     rv = (*cipher)(context, gcm->X0, &j, AES_BLOCK_SIZE, gcm->CTR,

                    AES_BLOCK_SIZE, AES_BLOCK_SIZE);

     if (rv != SECSuccess) {

         goto loser;

     }

     /* Promote the counter by 1 */

     _mm_storeu_si128((__m128i*)gcm->CTR, _mm_shuffle_epi8(_mm_add_epi32(ONE, _mm_shuffle_epi8(_mm_loadu_si128((__m128i*)gcm->CTR), BSWAP_MASK)), BSWAP_MASK));

     /* Now hash AAD - it would actually make sense to seperate the context

      * creation from the AAD, because that would allow to reuse the H, which

      * only changes when the AES key changes, and not every package, like the

      * IV and AAD */

     intel_aes_gcmAAD(gcm->Htbl, gcmParams->pAAD, AAD_whole_len, gcm->T);

     if (AAD_remainder_len) {

         PORT_Memset(buff, 0, AES_BLOCK_SIZE);

         PORT_Memcpy(buff, gcmParams->pAAD + AAD_whole_len, AAD_remainder_len);

         intel_aes_gcmAAD(gcm->Htbl, buff, AES_BLOCK_SIZE, gcm->T);

     }

     gcm->Alen += gcmParams->ulAADLen;

     return gcm;

 loser:

     if (gcm) {

         PORT_Free(gcm);

     }

     return NULL;

 }

 void intel_AES_GCM_DestroyContext(intel_AES_GCMContext *gcm, PRBool freeit)

 {

     if (freeit) {

         PORT_Free(gcm);

     }

 }

 SECStatus intel_AES_GCM_EncryptUpdate(intel_AES_GCMContext *gcm,

             unsigned char *outbuf,

             unsigned int *outlen, unsigned int maxout,

             const unsigned char *inbuf, unsigned int inlen,

             unsigned int blocksize)

 {

     unsigned int tagBytes;

     unsigned char T[AES_BLOCK_SIZE];

     unsigned int j;

     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE - 1)) / PR_BITS_PER_BYTE;

     if (UINT_MAX - inlen < tagBytes) {

         PORT_SetError(SEC_ERROR_INPUT_LEN);

         return SECFailure;

     }

     if (maxout < inlen + tagBytes) {

         *outlen = inlen + tagBytes;

         PORT_SetError(SEC_ERROR_OUTPUT_LEN);

         return SECFailure;

     }

     intel_aes_gcmENC(

         inbuf,

         outbuf,

         gcm,

         inlen);

     gcm->Mlen += inlen;

     intel_aes_gcmTAG(

         gcm->Htbl,

         gcm->T,

         gcm->Mlen,

         gcm->Alen,

         gcm->X0,

         T);

     *outlen = inlen + tagBytes;

     for (j = 0; j < tagBytes; j++) {

         outbuf[inlen + j] = T[j];

     }

     return SECSuccess;

 }

 SECStatus intel_AES_GCM_DecryptUpdate(intel_AES_GCMContext *gcm,

             unsigned char *outbuf,

             unsigned int *outlen, unsigned int maxout,

             const unsigned char *inbuf, unsigned int inlen,

             unsigned int blocksize)

 {

     unsigned int tagBytes;

     unsigned char T[AES_BLOCK_SIZE];

     const unsigned char *intag;

     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE - 1)) / PR_BITS_PER_BYTE;

     /* get the authentication block */

     if (inlen < tagBytes) {

         PORT_SetError(SEC_ERROR_INPUT_LEN);

         return SECFailure;

     }

     inlen -= tagBytes;

     intag = inbuf + inlen;

     if (maxout < inlen) {

         *outlen = inlen;

         PORT_SetError(SEC_ERROR_OUTPUT_LEN);

         return SECFailure;

     }

     intel_aes_gcmDEC(

          inbuf,

          outbuf,

          gcm,

          inlen);

     gcm->Mlen += inlen;

     intel_aes_gcmTAG(

          gcm->Htbl,

          gcm->T,

          gcm->Mlen,

          gcm->Alen,

          gcm->X0,

          T);

     if (NSS_SecureMemcmp(T, intag, tagBytes) != 0) {

         memset(outbuf, 0, inlen);

         *outlen = 0;

         /* force a CKR_ENCRYPTED_DATA_INVALID error at in softoken */

         PORT_SetError(SEC_ERROR_BAD_DATA);

         return SECFailure;

     }

     *outlen = inlen;

     return SECSuccess;

 }

 #endif