michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: #ifdef FREEBL_NO_DEPEND
michael@0: #include "stubs.h"
michael@0: #endif
michael@0: #include "blapii.h"
michael@0: #include "blapit.h"
michael@0: #include "gcm.h"
michael@0: #include "ctr.h"
michael@0: #include "secerr.h"
michael@0: #include "prtypes.h"
michael@0: #include "pkcs11t.h"
michael@0: 
michael@0: #include <limits.h>
michael@0: 
michael@0: /**************************************************************************
michael@0:  *          First implement the Galois hash function of GCM (gcmHash)     *
michael@0:  **************************************************************************/
michael@0: #define GCM_HASH_LEN_LEN 8 /* gcm hash defines lengths to be 64 bits */
michael@0: 
michael@0: typedef struct gcmHashContextStr gcmHashContext;
michael@0: 
michael@0: static SECStatus gcmHash_InitContext(gcmHashContext *hash,
michael@0: 				     const unsigned char *H,
michael@0: 				     unsigned int blocksize);
michael@0: static void gcmHash_DestroyContext(gcmHashContext *ghash, PRBool freeit);
michael@0: static SECStatus gcmHash_Update(gcmHashContext *ghash,
michael@0: 				const unsigned char *buf, unsigned int len,
michael@0: 				unsigned int blocksize);
michael@0: static SECStatus gcmHash_Sync(gcmHashContext *ghash, unsigned int blocksize);
michael@0: static SECStatus gcmHash_Final(gcmHashContext *gcm, unsigned char *outbuf,
michael@0: 			       unsigned int *outlen, unsigned int maxout,
michael@0: 			       unsigned int blocksize);
michael@0: static SECStatus gcmHash_Reset(gcmHashContext *ghash,
michael@0: 			       const unsigned char *inbuf,
michael@0: 			       unsigned int inbufLen, unsigned int blocksize);
michael@0: 
michael@0: /* compile time defines to select how the GF2 multiply is calculated.
michael@0:  * There are currently 2 algorithms implemented here: MPI and ALGORITHM_1.
michael@0:  *
michael@0:  * MPI uses the GF2m implemented in mpi to support GF2 ECC.
michael@0:  * ALGORITHM_1 is the Algorithm 1 in both NIST SP 800-38D and
michael@0:  * "The Galois/Counter Mode of Operation (GCM)", McGrew & Viega.
michael@0:  */
michael@0: #if !defined(GCM_USE_ALGORITHM_1) && !defined(GCM_USE_MPI)
michael@0: #define GCM_USE_MPI 1 /* MPI is about 5x faster with the
michael@0: 		       * same or less complexity. It's possible to use
michael@0: 		       * tables to speed things up even more */
michael@0: #endif
michael@0: 
michael@0: /* GCM defines the bit string to be LSB first, which is exactly
michael@0:  * opposite everyone else, including hardware. build array
michael@0:  * to reverse everything. */
michael@0: static const unsigned char gcm_byte_rev[256] = {
michael@0:     0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
michael@0:     0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0,
michael@0:     0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8,
michael@0:     0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8,
michael@0:     0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4,
michael@0:     0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4,
michael@0:     0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec,
michael@0:     0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc,
michael@0:     0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2,
michael@0:     0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2,
michael@0:     0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea,
michael@0:     0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa,
michael@0:     0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6,
michael@0:     0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6,
michael@0:     0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee,
michael@0:     0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe,
michael@0:     0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1,
michael@0:     0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1,
michael@0:     0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9,
michael@0:     0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9,
michael@0:     0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5,
michael@0:     0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5,
michael@0:     0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed,
michael@0:     0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd,
michael@0:     0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3,
michael@0:     0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3,
michael@0:     0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb,
michael@0:     0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb,
michael@0:     0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7,
michael@0:     0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7,
michael@0:     0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef,
michael@0:     0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff
michael@0: };
michael@0: 
michael@0: 
michael@0: #ifdef GCM_TRACE
michael@0: #include <stdio.h>
michael@0: 
michael@0: #define GCM_TRACE_X(ghash,label) { \
michael@0: 	unsigned char _X[MAX_BLOCK_SIZE]; int i; \
michael@0: 	gcm_getX(ghash, _X, blocksize); \
michael@0: 	printf(label,(ghash)->m); \
michael@0: 	for (i=0; i < blocksize; i++) printf("%02x",_X[i]); \
michael@0: 	printf("\n"); }
michael@0: #define GCM_TRACE_BLOCK(label,buf,blocksize) {\
michael@0: 	printf(label); \
michael@0: 	for (i=0; i < blocksize; i++) printf("%02x",buf[i]); \
michael@0: 	printf("\n"); }
michael@0: #else
michael@0: #define GCM_TRACE_X(ghash,label)
michael@0: #define GCM_TRACE_BLOCK(label,buf,blocksize)
michael@0: #endif
michael@0: 
michael@0: #ifdef GCM_USE_MPI
michael@0: 
michael@0: #ifdef GCM_USE_ALGORITHM_1
michael@0: #error "Only define one of GCM_USE_MPI, GCM_USE_ALGORITHM_1"
michael@0: #endif
michael@0: /* use the MPI functions to calculate Xn = (Xn-1^C_i)*H mod poly */
michael@0: #include "mpi.h"
michael@0: #include "secmpi.h"
michael@0: #include "mplogic.h"
michael@0: #include "mp_gf2m.h"
michael@0: 
michael@0: /* state needed to handle GCM Hash function */
michael@0: struct gcmHashContextStr {
michael@0:      mp_int H;
michael@0:      mp_int X;
michael@0:      mp_int C_i;
michael@0:      const unsigned int *poly;
michael@0:      unsigned char buffer[MAX_BLOCK_SIZE];
michael@0:      unsigned int bufLen;
michael@0:      int m; /* XXX what is m? */
michael@0:      unsigned char counterBuf[2*GCM_HASH_LEN_LEN];
michael@0:      PRUint64 cLen;
michael@0: };
michael@0: 
michael@0: /* f = x^128 + x^7 + x^2 + x + 1 */
michael@0: static const unsigned int poly_128[] = { 128, 7, 2, 1, 0 };
michael@0: 
michael@0: /* sigh, GCM defines the bit strings exactly backwards from everything else */
michael@0: static void
michael@0: gcm_reverse(unsigned char *target, const unsigned char *src,
michael@0: 							unsigned int blocksize)
michael@0: {
michael@0:     unsigned int i;
michael@0:     for (i=0; i < blocksize; i++) {
michael@0: 	target[blocksize-i-1] = gcm_byte_rev[src[i]];
michael@0:     }
michael@0: }
michael@0: 
michael@0: /* Initialize a gcmHashContext */
michael@0: static SECStatus
michael@0: gcmHash_InitContext(gcmHashContext *ghash, const unsigned char *H,
michael@0: 		    unsigned int blocksize)
michael@0: {
michael@0:     mp_err err = MP_OKAY;
michael@0:     unsigned char H_rev[MAX_BLOCK_SIZE];
michael@0: 
michael@0:     MP_DIGITS(&ghash->H) = 0;
michael@0:     MP_DIGITS(&ghash->X) = 0;
michael@0:     MP_DIGITS(&ghash->C_i) = 0;
michael@0:     CHECK_MPI_OK( mp_init(&ghash->H) );
michael@0:     CHECK_MPI_OK( mp_init(&ghash->X) );
michael@0:     CHECK_MPI_OK( mp_init(&ghash->C_i) );
michael@0: 
michael@0:     mp_zero(&ghash->X);
michael@0:     gcm_reverse(H_rev, H, blocksize);
michael@0:     CHECK_MPI_OK( mp_read_unsigned_octets(&ghash->H, H_rev, blocksize) );
michael@0: 
michael@0:     /* set the irreducible polynomial. Each blocksize has its own polynomial.
michael@0:      * for now only blocksize 16 (=128 bits) is defined */
michael@0:     switch (blocksize) {
michael@0:     case 16: /* 128 bits */
michael@0: 	ghash->poly = poly_128;
michael@0: 	break;
michael@0:     default:
michael@0: 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
michael@0: 	goto cleanup;
michael@0:     }
michael@0:     ghash->cLen = 0;
michael@0:     ghash->bufLen = 0;
michael@0:     ghash->m = 0;
michael@0:     PORT_Memset(ghash->counterBuf, 0, sizeof(ghash->counterBuf));
michael@0:     return SECSuccess;
michael@0: cleanup:
michael@0:     gcmHash_DestroyContext(ghash, PR_FALSE);
michael@0:     return SECFailure;
michael@0: }
michael@0: 
michael@0: /* Destroy a HashContext (Note we zero the digits so this function
michael@0:  * is idempotent if called with freeit == PR_FALSE */
michael@0: static void
michael@0: gcmHash_DestroyContext(gcmHashContext *ghash, PRBool freeit)
michael@0: {
michael@0:     mp_clear(&ghash->H);
michael@0:     mp_clear(&ghash->X);
michael@0:     mp_clear(&ghash->C_i);
michael@0:     MP_DIGITS(&ghash->H) = 0;
michael@0:     MP_DIGITS(&ghash->X) = 0;
michael@0:     MP_DIGITS(&ghash->C_i) = 0;
michael@0:     if (freeit) {
michael@0: 	PORT_Free(ghash);
michael@0:     }
michael@0: }
michael@0: 
michael@0: static SECStatus
michael@0: gcm_getX(gcmHashContext *ghash, unsigned char *T, unsigned int blocksize)
michael@0: {
michael@0:     int len;
michael@0:     mp_err err;
michael@0:     unsigned char tmp_buf[MAX_BLOCK_SIZE];
michael@0:     unsigned char *X;
michael@0: 
michael@0:     len = mp_unsigned_octet_size(&ghash->X);
michael@0:     if (len <= 0) {
michael@0: 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     X = tmp_buf;
michael@0:     PORT_Assert((unsigned int)len <= blocksize);
michael@0:     if ((unsigned int)len > blocksize) {
michael@0: 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     /* zero pad the result */
michael@0:     if (len != blocksize) {
michael@0: 	PORT_Memset(X,0,blocksize-len);
michael@0: 	X += blocksize-len;
michael@0:     }
michael@0: 
michael@0:     err = mp_to_unsigned_octets(&ghash->X, X, len);
michael@0:     if (err < 0) {
michael@0: 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     gcm_reverse(T, tmp_buf, blocksize);
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: static SECStatus
michael@0: gcm_HashMult(gcmHashContext *ghash, const unsigned char *buf,
michael@0: 		unsigned int count, unsigned int blocksize)
michael@0: {
michael@0:     SECStatus rv = SECFailure;
michael@0:     mp_err err = MP_OKAY;
michael@0:     unsigned char tmp_buf[MAX_BLOCK_SIZE];
michael@0:     unsigned int i;
michael@0: 
michael@0:     for (i=0; i < count; i++, buf += blocksize) {
michael@0: 	ghash->m++;
michael@0: 	gcm_reverse(tmp_buf, buf, blocksize);
michael@0: 	CHECK_MPI_OK(mp_read_unsigned_octets(&ghash->C_i, tmp_buf, blocksize));
michael@0: 	CHECK_MPI_OK(mp_badd(&ghash->X, &ghash->C_i, &ghash->C_i));
michael@0: 	/*
michael@0: 	 * Looking to speed up GCM, this the the place to do it.
michael@0: 	 * There are two areas that can be exploited to speed up this code.
michael@0: 	 *
michael@0: 	 * 1) H is a constant in this multiply. We can precompute H * (0 - 255)
michael@0: 	 * at init time and this becomes an blockize xors of our table lookup.
michael@0: 	 *
michael@0: 	 * 2) poly is a constant for each blocksize. We can calculate the
michael@0: 	 * modulo reduction by a series of adds and shifts.
michael@0: 	 *
michael@0: 	 * For now we are after functionality, so we will go ahead and use
michael@0: 	 * the builtin bmulmod from mpi
michael@0: 	 */
michael@0:         CHECK_MPI_OK(mp_bmulmod(&ghash->C_i, &ghash->H,
michael@0: 					ghash->poly, &ghash->X));
michael@0: 	GCM_TRACE_X(ghash, "X%d = ")
michael@0:     }
michael@0:     rv = SECSuccess;
michael@0: cleanup:
michael@0:     if (rv != SECSuccess) {
michael@0: 	MP_TO_SEC_ERROR(err);
michael@0:     }
michael@0:     return rv;
michael@0: }
michael@0: 
michael@0: static void
michael@0: gcm_zeroX(gcmHashContext *ghash)
michael@0: {
michael@0:     mp_zero(&ghash->X);
michael@0:     ghash->m = 0;
michael@0: }
michael@0: 
michael@0: #endif
michael@0: 
michael@0: #ifdef GCM_USE_ALGORITHM_1
michael@0: /* use algorithm 1 of McGrew & Viega "The Galois/Counter Mode of Operation" */
michael@0: 
michael@0: #define GCM_ARRAY_SIZE (MAX_BLOCK_SIZE/sizeof(unsigned long))
michael@0: 
michael@0: struct gcmHashContextStr {
michael@0:      unsigned long H[GCM_ARRAY_SIZE];
michael@0:      unsigned long X[GCM_ARRAY_SIZE];
michael@0:      unsigned long R;
michael@0:      unsigned char buffer[MAX_BLOCK_SIZE];
michael@0:      unsigned int bufLen;
michael@0:      int m;
michael@0:      unsigned char counterBuf[2*GCM_HASH_LEN_LEN];
michael@0:      PRUint64 cLen;
michael@0: };
michael@0: 
michael@0: static void
michael@0: gcm_bytes_to_longs(unsigned long *l, const unsigned char *c, unsigned int len)
michael@0: {
michael@0:     int i,j;
michael@0:     int array_size = len/sizeof(unsigned long);
michael@0: 
michael@0:     PORT_Assert(len % sizeof(unsigned long) == 0);
michael@0:     for (i=0; i < array_size; i++) {
michael@0: 	unsigned long tmp = 0;
michael@0: 	int byte_offset = i * sizeof(unsigned long);
michael@0: 	for (j=sizeof(unsigned long)-1; j >= 0; j--) {
michael@0: 	    tmp = (tmp << PR_BITS_PER_BYTE) | gcm_byte_rev[c[byte_offset+j]];
michael@0: 	}
michael@0: 	l[i] = tmp;
michael@0:     }
michael@0: }
michael@0: 
michael@0: static void
michael@0: gcm_longs_to_bytes(const unsigned long *l, unsigned char *c, unsigned int len)
michael@0: {
michael@0:     int i,j;
michael@0:     int array_size = len/sizeof(unsigned long);
michael@0: 
michael@0:     PORT_Assert(len % sizeof(unsigned long) == 0);
michael@0:     for (i=0; i < array_size; i++) {
michael@0: 	unsigned long tmp = l[i];
michael@0: 	int byte_offset = i * sizeof(unsigned long);
michael@0: 	for (j=0; j < sizeof(unsigned long); j++) {
michael@0: 	    c[byte_offset+j] = gcm_byte_rev[tmp & 0xff];
michael@0: 	    tmp = (tmp >> PR_BITS_PER_BYTE);
michael@0: 	}
michael@0:     }
michael@0: }
michael@0: 
michael@0: 
michael@0: /* Initialize a gcmHashContext */
michael@0: static SECStatus
michael@0: gcmHash_InitContext(gcmHashContext *ghash, const unsigned char *H,
michael@0: 		    unsigned int blocksize)
michael@0: {
michael@0:     PORT_Memset(ghash->X, 0, sizeof(ghash->X));
michael@0:     PORT_Memset(ghash->H, 0, sizeof(ghash->H));
michael@0:     gcm_bytes_to_longs(ghash->H, H, blocksize);
michael@0: 
michael@0:     /* set the irreducible polynomial. Each blocksize has its own polynommial
michael@0:      * for now only blocksize 16 (=128 bits) is defined */
michael@0:     switch (blocksize) {
michael@0:     case 16: /* 128 bits */
michael@0: 	ghash->R = (unsigned long) 0x87; /* x^7 + x^2 + x +1 */
michael@0: 	break;
michael@0:     default:
michael@0: 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
michael@0: 	goto cleanup;
michael@0:     }
michael@0:     ghash->cLen = 0;
michael@0:     ghash->bufLen = 0;
michael@0:     ghash->m = 0;
michael@0:     PORT_Memset(ghash->counterBuf, 0, sizeof(ghash->counterBuf));
michael@0:     return SECSuccess;
michael@0: cleanup:
michael@0:     return SECFailure;
michael@0: }
michael@0: 
michael@0: /* Destroy a HashContext (Note we zero the digits so this function
michael@0:  * is idempotent if called with freeit == PR_FALSE */
michael@0: static void
michael@0: gcmHash_DestroyContext(gcmHashContext *ghash, PRBool freeit)
michael@0: {
michael@0:     if (freeit) {
michael@0: 	PORT_Free(ghash);
michael@0:     }
michael@0: }
michael@0: 
michael@0: static unsigned long
michael@0: gcm_shift_one(unsigned long *t, unsigned int count)
michael@0: {
michael@0:     unsigned long carry = 0;
michael@0:     unsigned long nextcarry = 0;
michael@0:     unsigned int i;
michael@0:     for (i=0; i < count; i++) {
michael@0: 	nextcarry = t[i] >> ((sizeof(unsigned long)*PR_BITS_PER_BYTE)-1);
michael@0: 	t[i] = (t[i] << 1) | carry;
michael@0: 	carry = nextcarry;
michael@0:     }
michael@0:     return carry;
michael@0: }
michael@0: 
michael@0: static SECStatus
michael@0: gcm_getX(gcmHashContext *ghash, unsigned char *T, unsigned int blocksize)
michael@0: {
michael@0:     gcm_longs_to_bytes(ghash->X, T, blocksize);
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: #define GCM_XOR(t, s, len) \
michael@0: 	for (l=0; l < len; l++) t[l] ^= s[l]
michael@0: 
michael@0: static SECStatus
michael@0: gcm_HashMult(gcmHashContext *ghash, const unsigned char *buf,
michael@0: 		unsigned int count, unsigned int blocksize)
michael@0: {
michael@0:     unsigned long C_i[GCM_ARRAY_SIZE];
michael@0:     unsigned int arraysize = blocksize/sizeof(unsigned long);
michael@0:     unsigned int i, j, k, l;
michael@0: 
michael@0:     for (i=0; i < count; i++, buf += blocksize) {
michael@0: 	ghash->m++;
michael@0: 	gcm_bytes_to_longs(C_i, buf, blocksize);
michael@0: 	GCM_XOR(C_i, ghash->X, arraysize);
michael@0: 	/* multiply X = C_i * H */
michael@0: 	PORT_Memset(ghash->X, 0, sizeof(ghash->X));
michael@0: 	for (j=0; j < arraysize; j++) {
michael@0: 	    unsigned long H = ghash->H[j];
michael@0: 	    for (k=0; k < sizeof(unsigned long)*PR_BITS_PER_BYTE; k++) {
michael@0: 		if (H & 1) {
michael@0: 		    GCM_XOR(ghash->X, C_i, arraysize);
michael@0: 		}
michael@0: 		if (gcm_shift_one(C_i, arraysize)) {
michael@0: 		    C_i[0] = C_i[0] ^ ghash->R;
michael@0: 		}
michael@0: 		H = H >> 1;
michael@0: 	    }
michael@0: 	}
michael@0: 	GCM_TRACE_X(ghash, "X%d = ")
michael@0:     }
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: 
michael@0: static void
michael@0: gcm_zeroX(gcmHashContext *ghash)
michael@0: {
michael@0:     PORT_Memset(ghash->X, 0, sizeof(ghash->X));
michael@0:     ghash->m = 0;
michael@0: }
michael@0: #endif
michael@0: 
michael@0: /*
michael@0:  * implement GCM GHASH using the freebl GHASH function. The gcm_HashMult
michael@0:  * function always takes blocksize lengths of data. gcmHash_Update will
michael@0:  * format the data properly.
michael@0:  */
michael@0: static SECStatus
michael@0: gcmHash_Update(gcmHashContext *ghash, const unsigned char *buf,
michael@0: 	       unsigned int len, unsigned int blocksize)
michael@0: {
michael@0:     unsigned int blocks;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     ghash->cLen += (len*PR_BITS_PER_BYTE);
michael@0: 
michael@0:     /* first deal with the current buffer of data. Try to fill it out so
michael@0:      * we can hash it */
michael@0:     if (ghash->bufLen) {
michael@0: 	unsigned int needed = PR_MIN(len, blocksize - ghash->bufLen);
michael@0: 	if (needed != 0) {
michael@0: 	    PORT_Memcpy(ghash->buffer+ghash->bufLen, buf, needed);
michael@0: 	}
michael@0: 	buf += needed;
michael@0: 	len -= needed;
michael@0: 	ghash->bufLen += needed;
michael@0: 	if (len == 0) {
michael@0: 	    /* didn't add enough to hash the data, nothing more do do */
michael@0: 	    return SECSuccess;
michael@0: 	}
michael@0: 	PORT_Assert(ghash->bufLen == blocksize);
michael@0: 	/* hash the buffer and clear it */
michael@0: 	rv = gcm_HashMult(ghash, ghash->buffer, 1, blocksize);
michael@0: 	PORT_Memset(ghash->buffer, 0, blocksize);
michael@0: 	ghash->bufLen = 0;
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0:     }
michael@0:     /* now hash any full blocks remaining in the data stream */
michael@0:     blocks = len/blocksize;
michael@0:     if (blocks) {
michael@0: 	rv = gcm_HashMult(ghash, buf, blocks, blocksize);
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0: 	buf += blocks*blocksize;
michael@0: 	len -= blocks*blocksize;
michael@0:     }
michael@0: 
michael@0:     /* save any remainder in the buffer to be hashed with the next call */
michael@0:     if (len != 0) {
michael@0: 	PORT_Memcpy(ghash->buffer, buf, len);
michael@0: 	ghash->bufLen = len;
michael@0:     }
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * write out any partial blocks zero padded through the GHASH engine,
michael@0:  * save the lengths for the final completion of the hash
michael@0:  */
michael@0: static SECStatus
michael@0: gcmHash_Sync(gcmHashContext *ghash, unsigned int blocksize)
michael@0: {
michael@0:     int i;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     /* copy the previous counter to the upper block */
michael@0:     PORT_Memcpy(ghash->counterBuf, &ghash->counterBuf[GCM_HASH_LEN_LEN],
michael@0: 							GCM_HASH_LEN_LEN);
michael@0:     /* copy the current counter in the lower block */
michael@0:     for (i=0; i < GCM_HASH_LEN_LEN; i++) {
michael@0: 	ghash->counterBuf[GCM_HASH_LEN_LEN+i] =
michael@0: 	    (ghash->cLen >> ((GCM_HASH_LEN_LEN-1-i)*PR_BITS_PER_BYTE)) & 0xff;
michael@0:     }
michael@0:     ghash->cLen = 0;
michael@0: 
michael@0:     /* now zero fill the buffer and hash the last block */
michael@0:     if (ghash->bufLen) {
michael@0: 	PORT_Memset(ghash->buffer+ghash->bufLen, 0, blocksize - ghash->bufLen);
michael@0: 	rv = gcm_HashMult(ghash, ghash->buffer, 1, blocksize);
michael@0: 	PORT_Memset(ghash->buffer, 0, blocksize);
michael@0: 	ghash->bufLen = 0;
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0:     }
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * This does the final sync, hashes the lengths, then returns
michael@0:  * "T", the hashed output.
michael@0:  */
michael@0: static SECStatus
michael@0: gcmHash_Final(gcmHashContext *ghash, unsigned char *outbuf,
michael@0: 		unsigned int *outlen, unsigned int maxout,
michael@0: 		unsigned int blocksize)
michael@0: {
michael@0:     unsigned char T[MAX_BLOCK_SIZE];
michael@0:     SECStatus rv;
michael@0: 
michael@0:     rv = gcmHash_Sync(ghash, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     rv = gcm_HashMult(ghash, ghash->counterBuf, (GCM_HASH_LEN_LEN*2)/blocksize,
michael@0: 								blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     GCM_TRACE_X(ghash, "GHASH(H,A,C) = ")
michael@0: 
michael@0:     rv = gcm_getX(ghash, T, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     if (maxout > blocksize) maxout = blocksize;
michael@0:     PORT_Memcpy(outbuf, T, maxout);
michael@0:     *outlen = maxout;
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: SECStatus
michael@0: gcmHash_Reset(gcmHashContext *ghash, const unsigned char *AAD,
michael@0: 	      unsigned int AADLen, unsigned int blocksize)
michael@0: {
michael@0:     SECStatus rv;
michael@0: 
michael@0:     ghash->cLen = 0;
michael@0:     PORT_Memset(ghash->counterBuf, 0, GCM_HASH_LEN_LEN*2);
michael@0:     ghash->bufLen = 0;
michael@0:     gcm_zeroX(ghash);
michael@0: 
michael@0:     /* now kick things off by hashing the Additional Authenticated Data */
michael@0:     if (AADLen != 0) {
michael@0: 	rv = gcmHash_Update(ghash, AAD, AADLen, blocksize);
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0: 	rv = gcmHash_Sync(ghash, blocksize);
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    return SECFailure;
michael@0: 	}
michael@0:     }
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: /**************************************************************************
michael@0:  *           Now implement the GCM using gcmHash and CTR                  *
michael@0:  **************************************************************************/
michael@0: 
michael@0: /* state to handle the full GCM operation (hash and counter) */
michael@0: struct GCMContextStr {
michael@0:     gcmHashContext ghash_context;
michael@0:     CTRContext ctr_context;
michael@0:     unsigned long tagBits;
michael@0:     unsigned char tagKey[MAX_BLOCK_SIZE];
michael@0: };
michael@0: 
michael@0: GCMContext *
michael@0: GCM_CreateContext(void *context, freeblCipherFunc cipher,
michael@0: 		  const unsigned char *params, unsigned int blocksize)
michael@0: {
michael@0:     GCMContext *gcm = NULL;
michael@0:     gcmHashContext *ghash;
michael@0:     unsigned char H[MAX_BLOCK_SIZE];
michael@0:     unsigned int tmp;
michael@0:     PRBool freeCtr = PR_FALSE;
michael@0:     PRBool freeHash = PR_FALSE;
michael@0:     const CK_GCM_PARAMS *gcmParams = (const CK_GCM_PARAMS *)params;
michael@0:     CK_AES_CTR_PARAMS ctrParams;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     if (blocksize > MAX_BLOCK_SIZE || blocksize > sizeof(ctrParams.cb)) {
michael@0: 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0: 	return NULL;
michael@0:     }
michael@0:     gcm = PORT_ZNew(GCMContext);
michael@0:     if (gcm == NULL) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     /* first fill in the ghash context */
michael@0:     ghash = &gcm->ghash_context;
michael@0:     PORT_Memset(H, 0, blocksize);
michael@0:     rv = (*cipher)(context, H, &tmp, blocksize, H, blocksize, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     rv = gcmHash_InitContext(ghash, H, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     freeHash = PR_TRUE;
michael@0: 
michael@0:     /* fill in the Counter context */
michael@0:     ctrParams.ulCounterBits = 32;
michael@0:     PORT_Memset(ctrParams.cb, 0, sizeof(ctrParams.cb));
michael@0:     if ((blocksize == 16) && (gcmParams->ulIvLen == 12)) {
michael@0: 	PORT_Memcpy(ctrParams.cb, gcmParams->pIv, gcmParams->ulIvLen);
michael@0: 	ctrParams.cb[blocksize-1] = 1;
michael@0:     } else {
michael@0: 	rv = gcmHash_Update(ghash, gcmParams->pIv, gcmParams->ulIvLen,
michael@0: 			    blocksize);
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    goto loser;
michael@0: 	}
michael@0: 	rv = gcmHash_Final(ghash, ctrParams.cb, &tmp, blocksize, blocksize);
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    goto loser;
michael@0: 	}
michael@0:     }
michael@0:     rv = CTR_InitContext(&gcm->ctr_context, context, cipher,
michael@0: 				(unsigned char *)&ctrParams, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     freeCtr = PR_TRUE;
michael@0: 
michael@0:     /* fill in the gcm structure */
michael@0:     gcm->tagBits = gcmParams->ulTagBits; /* save for final step */
michael@0:     /* calculate the final tag key. NOTE: gcm->tagKey is zero to start with.
michael@0:      * if this assumption changes, we would need to explicitly clear it here */
michael@0:     rv = CTR_Update(&gcm->ctr_context, gcm->tagKey, &tmp, blocksize,
michael@0: 		    gcm->tagKey, blocksize, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	goto loser;
michael@0:     }
michael@0: 
michael@0:     /* finally mix in the AAD data */
michael@0:     rv = gcmHash_Reset(ghash, gcmParams->pAAD, gcmParams->ulAADLen, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	goto loser;
michael@0:     }
michael@0: 
michael@0:     return gcm;
michael@0: 
michael@0: loser:
michael@0:     if (freeCtr) {
michael@0: 	CTR_DestroyContext(&gcm->ctr_context, PR_FALSE);
michael@0:     }
michael@0:     if (freeHash) {
michael@0: 	gcmHash_DestroyContext(&gcm->ghash_context, PR_FALSE);
michael@0:     }
michael@0:     if (gcm) {
michael@0: 	PORT_Free(gcm);
michael@0:     }
michael@0:     return NULL;
michael@0: }
michael@0: 
michael@0: void
michael@0: GCM_DestroyContext(GCMContext *gcm, PRBool freeit)
michael@0: {
michael@0:     /* these two are statically allocated and will be freed when we free
michael@0:      * gcm. call their destroy functions to free up any locally
michael@0:      * allocated data (like mp_int's) */
michael@0:     CTR_DestroyContext(&gcm->ctr_context, PR_FALSE);
michael@0:     gcmHash_DestroyContext(&gcm->ghash_context, PR_FALSE);
michael@0:     if (freeit) {
michael@0: 	PORT_Free(gcm);
michael@0:     }
michael@0: }
michael@0: 
michael@0: static SECStatus
michael@0: gcm_GetTag(GCMContext *gcm, unsigned char *outbuf,
michael@0: 	unsigned int *outlen, unsigned int maxout,
michael@0: 	unsigned int blocksize)
michael@0: {
michael@0:     unsigned int tagBytes;
michael@0:     unsigned int extra;
michael@0:     unsigned int i;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE-1)) / PR_BITS_PER_BYTE;
michael@0:     extra = tagBytes*PR_BITS_PER_BYTE - gcm->tagBits;
michael@0: 
michael@0:     if (outbuf == NULL) {
michael@0: 	*outlen = tagBytes;
michael@0: 	PORT_SetError(SEC_ERROR_OUTPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     if (maxout < tagBytes) {
michael@0: 	*outlen = tagBytes;
michael@0: 	PORT_SetError(SEC_ERROR_OUTPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     maxout = tagBytes;
michael@0:     rv = gcmHash_Final(&gcm->ghash_context, outbuf, outlen, maxout, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     GCM_TRACE_BLOCK("GHASH=", outbuf, blocksize);
michael@0:     GCM_TRACE_BLOCK("Y0=", gcm->tagKey, blocksize);
michael@0:     for (i=0; i < *outlen; i++) {
michael@0: 	outbuf[i] ^= gcm->tagKey[i];
michael@0:     }
michael@0:     GCM_TRACE_BLOCK("Y0=", gcm->tagKey, blocksize);
michael@0:     GCM_TRACE_BLOCK("T=", outbuf, blocksize);
michael@0:     /* mask off any extra bits we got */
michael@0:     if (extra) {
michael@0: 	outbuf[tagBytes-1] &= ~((1 << extra)-1);
michael@0:     }
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * See The Galois/Counter Mode of Operation, McGrew and Viega.
michael@0:  *  GCM is basically counter mode with a specific initialization and
michael@0:  *  built in macing operation.
michael@0:  */
michael@0: SECStatus
michael@0: GCM_EncryptUpdate(GCMContext *gcm, unsigned char *outbuf,
michael@0: 		unsigned int *outlen, unsigned int maxout,
michael@0: 		const unsigned char *inbuf, unsigned int inlen,
michael@0: 		unsigned int blocksize)
michael@0: {
michael@0:     SECStatus rv;
michael@0:     unsigned int tagBytes;
michael@0:     unsigned int len;
michael@0: 
michael@0:     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE-1)) / PR_BITS_PER_BYTE;
michael@0:     if (UINT_MAX - inlen < tagBytes) {
michael@0: 	PORT_SetError(SEC_ERROR_INPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     if (maxout < inlen + tagBytes) {
michael@0: 	*outlen = inlen + tagBytes;
michael@0: 	PORT_SetError(SEC_ERROR_OUTPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     rv = CTR_Update(&gcm->ctr_context, outbuf, outlen, maxout,
michael@0: 			inbuf, inlen, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     rv = gcmHash_Update(&gcm->ghash_context, outbuf, *outlen, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	PORT_Memset(outbuf, 0, *outlen); /* clear the output buffer */
michael@0: 	*outlen = 0;
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     rv = gcm_GetTag(gcm, outbuf + *outlen, &len, maxout - *outlen, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	PORT_Memset(outbuf, 0, *outlen); /* clear the output buffer */
michael@0: 	*outlen = 0;
michael@0: 	return SECFailure;
michael@0:     };
michael@0:     *outlen += len;
michael@0:     return SECSuccess;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * See The Galois/Counter Mode of Operation, McGrew and Viega.
michael@0:  *  GCM is basically counter mode with a specific initialization and
michael@0:  *  built in macing operation. NOTE: the only difference between Encrypt
michael@0:  *  and Decrypt is when we calculate the mac. That is because the mac must
michael@0:  *  always be calculated on the cipher text, not the plain text, so for
michael@0:  *  encrypt, we do the CTR update first and for decrypt we do the mac first.
michael@0:  */
michael@0: SECStatus
michael@0: GCM_DecryptUpdate(GCMContext *gcm, unsigned char *outbuf,
michael@0: 		unsigned int *outlen, unsigned  int maxout,
michael@0: 		const unsigned char *inbuf, unsigned int inlen,
michael@0: 		unsigned int blocksize)
michael@0: {
michael@0:     SECStatus rv;
michael@0:     unsigned int tagBytes;
michael@0:     unsigned char tag[MAX_BLOCK_SIZE];
michael@0:     const unsigned char *intag;
michael@0:     unsigned int len;
michael@0: 
michael@0:     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE-1)) / PR_BITS_PER_BYTE;
michael@0: 
michael@0:     /* get the authentication block */
michael@0:     if (inlen < tagBytes) {
michael@0: 	PORT_SetError(SEC_ERROR_INPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     inlen -= tagBytes;
michael@0:     intag = inbuf + inlen;
michael@0: 
michael@0:     /* verify the block */
michael@0:     rv = gcmHash_Update(&gcm->ghash_context, inbuf, inlen, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     rv = gcm_GetTag(gcm, tag, &len, blocksize, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     /* Don't decrypt if we can't authenticate the encrypted data!
michael@0:      * This assumes that if tagBits is not a multiple of 8, intag will
michael@0:      * preserve the masked off missing bits.  */
michael@0:     if (NSS_SecureMemcmp(tag, intag, tagBytes) != 0) {
michael@0: 	/* force a CKR_ENCRYPTED_DATA_INVALID error at in softoken */
michael@0: 	PORT_SetError(SEC_ERROR_BAD_DATA);
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     /* finish the decryption */
michael@0:     return CTR_Update(&gcm->ctr_context, outbuf, outlen, maxout,
michael@0: 			  inbuf, inlen, blocksize);
michael@0: }