michael@0: /******************************************************************************/
michael@0: /* LICENSE:                                                                   */
michael@0: /* This submission to NSS is to be made available under the terms of the      */
michael@0: /* Mozilla Public License, v. 2.0. You can obtain one at http:                */
michael@0: /* //mozilla.org/MPL/2.0/.                                                    */
michael@0: /******************************************************************************/
michael@0: /* Copyright(c) 2013, Intel Corp.                                             */
michael@0: /******************************************************************************/
michael@0: /* Reference:                                                                 */
michael@0: /* [1] Shay Gueron, Michael E. Kounavis: Intel® Carry-Less Multiplication     */
michael@0: /*     Instruction and its Usage for Computing the GCM Mode (Rev. 2.01)       */
michael@0: /*     http://software.intel.com/sites/default/files/article/165685/clmul-wp-r*/
michael@0: /*ev-2.01-2012-09-21.pdf                                                      */
michael@0: /* [2] S. Gueron, M. E. Kounavis: Efficient Implementation of the Galois      */
michael@0: /*     Counter Mode Using a Carry-less Multiplier and a Fast Reduction        */
michael@0: /*     Algorithm. Information Processing Letters 110: 549–553 (2010).         */
michael@0: /* [3] S. Gueron: AES Performance on the 2nd Generation Intel® Core™ Processor*/
michael@0: /*     Family (to be posted) (2012).                                          */
michael@0: /* [4] S. Gueron: Fast GHASH computations for speeding up AES-GCM (to be      */
michael@0: /*     published) (2012).                                                     */
michael@0: 
michael@0: #ifndef INTEL_GCM_H
michael@0: #define INTEL_GCM_H 1
michael@0: 
michael@0: #include "blapii.h"
michael@0: 
michael@0: typedef struct intel_AES_GCMContextStr intel_AES_GCMContext;
michael@0: 
michael@0: intel_AES_GCMContext *intel_AES_GCM_CreateContext(void *context, freeblCipherFunc cipher,
michael@0: 			const unsigned char *params, unsigned int blocksize);
michael@0: 
michael@0: void intel_AES_GCM_DestroyContext(intel_AES_GCMContext *gcm, PRBool freeit);
michael@0: 
michael@0: SECStatus intel_AES_GCM_EncryptUpdate(intel_AES_GCMContext *gcm, unsigned char *outbuf,
michael@0: 			unsigned int *outlen, unsigned int maxout,
michael@0: 			const unsigned char *inbuf, unsigned int inlen,
michael@0: 			unsigned int blocksize);
michael@0: 
michael@0: SECStatus intel_AES_GCM_DecryptUpdate(intel_AES_GCMContext *gcm, unsigned char *outbuf,
michael@0: 			unsigned int *outlen, unsigned int maxout,
michael@0: 			const unsigned char *inbuf, unsigned int inlen,
michael@0: 			unsigned int blocksize);
michael@0: 
michael@0: /* Prorotypes of functions in the assembler file for fast AES-GCM, using 
michael@0:    Intel AES-NI and CLMUL-NI, as described in [1]
michael@0:    [1] Shay Gueron, Michael E. Kounavis: Intel® Carry-Less Multiplication 
michael@0:        Instruction and its Usage for Computing the GCM Mode                */
michael@0:        
michael@0: /* Prepares the constants used in the aggregated reduction method */
michael@0: void intel_aes_gcmINIT(unsigned char Htbl[16*16],
michael@0:                        unsigned char *KS,
michael@0:                        int NR);
michael@0: 
michael@0: /* Produces the final GHASH value */
michael@0: void intel_aes_gcmTAG(unsigned char Htbl[16*16], 
michael@0:                       unsigned char *Tp, 
michael@0:                       unsigned long Mlen, 
michael@0:                       unsigned long Alen, 
michael@0:                       unsigned char* X0, 
michael@0:                       unsigned char* TAG);
michael@0: 
michael@0: /* Hashes the Additional Authenticated Data, should be used before enc/dec.
michael@0:    Operates on whole blocks only. Partial blocks should be padded externally. */
michael@0: void intel_aes_gcmAAD(unsigned char Htbl[16*16], 
michael@0:                       unsigned char *AAD, 
michael@0:                       unsigned long Alen, 
michael@0:                       unsigned char *Tp);
michael@0: 
michael@0: /* Encrypts and hashes the Plaintext. 
michael@0:    Operates on any length of data, however partial block should only be encrypted
michael@0:    at the last call, otherwise the result will be incorrect. */
michael@0: void intel_aes_gcmENC(const unsigned char* PT, 
michael@0:                       unsigned char* CT, 
michael@0:                       void *Gctx, 
michael@0:                       unsigned long len);
michael@0:                   
michael@0: /* Similar to ENC, but decrypts the Ciphertext. */
michael@0: void intel_aes_gcmDEC(const unsigned char* CT, 
michael@0:                       unsigned char* PT, 
michael@0:                       void *Gctx, 
michael@0:                       unsigned long len);
michael@0: 
michael@0: #endif