diff options
| -rw-r--r-- | src/ref/lilliput-ae-utils.h | 29 | ||||
| -rw-r--r-- | src/ref/lilliput-i.c | 26 | ||||
| -rw-r--r-- | src/ref/lilliput-ii.c | 27 |
3 files changed, 42 insertions, 40 deletions
diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index ce3f154..0efb776 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -90,24 +90,31 @@ static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BL memcpy(padded+pad_len, X, X_len); } +static inline void copy_block_index(size_t index, uint8_t tweak[TWEAK_BYTES]) +{ + /* NB: little-endian architectures can simply use: + * memcpy(tweak, &index, sizeof(index)); */ + for (size_t i=0; i<sizeof(index); i++) + { + tweak[i] = index >> 8*i & 0xff; + } +} + static inline void fill_index_tweak( - uint8_t prefix, - uint64_t block_index, - uint8_t tweak[TWEAK_BYTES] + uint8_t prefix, + size_t block_index, + uint8_t tweak[TWEAK_BYTES] ) { - /* The t-bit tweak is filled as follows: + /* With an s-bit block index, the t-bit tweak is filled as follows: * * - bits [ 1, t-4]: block index - * [ 1, 64]: actual 64-bit block index - * [ 65, t-4]: 0-padding - * - bits [t-3, t]: constant 4-bit prefix + * [ 1, s]: actual block index + * [s+1, t-4]: 0-padding + * - bits [t-3, t]: 4-bit prefix */ - for (size_t i=0; i<sizeof(block_index); i++) - { - tweak[i] = block_index >> 8*i & 0xff; - } + copy_block_index(block_index, tweak); /* Assume padding bytes have already been set to 0. */ diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index 97c2117..3ba7ea2 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -35,32 +35,26 @@ static const uint8_t _0n[BLOCK_BYTES] = { static void _fill_msg_tweak( uint8_t prefix, const uint8_t N[NONCE_BYTES], - uint64_t block_nb, + size_t block_index, uint8_t tweak[TWEAK_BYTES] ) { - /* The 192-bit tweak is filled as follows: + /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits 1- 68: block number - * 1- 64: actual 64-bit block number - * 64- 68: 0-padding - * - bits 67-188: nonce - * - bits 189-192: constant 4-bit prefix + * - bits [ 1, t-|N|-4]: block index + * [ 1, s]: actual 64-bit block index + * [ s+1, t-|N|-4]: 0-padding + * - bits [t-|N|-4, t-4]: nonce + * - bits [ t-3, t]: 4-bit prefix */ - for (size_t i=0; i<sizeof(block_nb); i++) - { - uint64_t mask = (uint64_t)0xff << 8*i; - uint8_t b = (mask & block_nb) >> 8*i; - - tweak[i] = b; - } + copy_block_index(block_index, tweak); - tweak[sizeof(block_nb)] = lower_nibble(N[0]) << 4; + tweak[sizeof(block_index)] = lower_nibble(N[0]) << 4; for (size_t i=1; i<NONCE_BYTES; i++) { - tweak[sizeof(block_nb)+i] = lower_nibble(N[i]) << 4 ^ upper_nibble(N[i-1]); + tweak[sizeof(block_index)+i] = lower_nibble(N[i]) << 4 ^ upper_nibble(N[i-1]); } tweak[TWEAK_BYTES-1] = prefix << 4 ^ upper_nibble(N[NONCE_BYTES-1]); diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index a371521..6811d49 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -28,37 +28,38 @@ This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2. static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* The t-bit tweak is filled as follows: + /* With an s-bit block index, the t-bit tweak is filled as follows: * * - bits [ 1, t-1]: tag + block index - * [ 1, 64]: tag[ 1.. 64] XOR block index - * [ 65, t-1]: tag[65..t-1] + * [ 1, s]: tag[1..s] XOR block index + * [s+1, t-1]: tag[s+1..t-1] * - bit t: 1 * - * This function sets bits 65 to t once and for all. + * This function sets bits s+1 to t once and for all. */ - memcpy(tweak+sizeof(uint64_t), tag+sizeof(uint64_t), TAG_BYTES-sizeof(uint64_t)); + memcpy(tweak+sizeof(size_t), tag+sizeof(size_t), TAG_BYTES-sizeof(size_t)); tweak[TWEAK_BYTES-1] |= 0x80; } -static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], uint64_t block_index, uint8_t tweak[TWEAK_BYTES]) +static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES]) { - /* The t-bit tweak is filled as follows: + /* With an s-bit block index, the t-bit tweak is filled as follows: * * - bits [ 1, t-1]: tag + block index - * [ 1, 64]: tag[ 1.. 64] XOR block index - * [ 65, t-1]: tag[65..t-1] + * [ 1, s]: tag[1..s] XOR block index + * [s+1, t-1]: tag[s+1..t-1] * - bit t: 1 * - * This function assumes bits 65 to t have already been set, and - * only sets bits 1 to 64. + * This function assumes bits s+1 to t have already been set, and + * only sets bits 1 to s. */ + copy_block_index(block_index, tweak); + for (size_t i=0; i<sizeof(block_index); i++) { - uint8_t index_i = block_index >> i*8 & 0xff; - tweak[i] = tag[i] ^ index_i; + tweak[i] ^= tag[i]; } } |