diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/ae-common.h | 61 | ||||
| -rw-r--r-- | src/lilliput-ae-i.c | 64 | ||||
| -rw-r--r-- | src/lilliput-ae-ii.c | 13 |
3 files changed, 66 insertions, 72 deletions
diff --git a/src/ae-common.h b/src/ae-common.h index 6343f98..da5d04d 100644 --- a/src/ae-common.h +++ b/src/ae-common.h @@ -65,5 +65,66 @@ static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BL } } +static inline void _fill_ad_tweak( + uint8_t prefix, + uint64_t block_nb, + uint8_t tweak[TWEAK_BYTES] +) +{ + /* The t-bit tweak is filled as follows: + * + * - bits [ 1, t-4]: block number + * [ 1, 64]: actual 64-bit block number + * [ 65, t-4]: 0-padding + * - bits [t-3, t]: constant 4-bit prefix + */ + + for (size_t i=0; i<sizeof(block_nb); i++) + { + uint64_t mask = (uint64_t)0xff << 8*i; + uint8_t b = (mask & block_nb) >> 8*i; + + tweak[i] = b; + } + + /* Assume padding bytes have already been memset to 0. */ + + tweak[TWEAK_BYTES-1] |= prefix << 4; +} + +static void process_associated_data( + const uint8_t key[KEY_BYTES], + size_t A_len, + const uint8_t A[A_len], + uint8_t Auth[BLOCK_BYTES] +) +{ + uint8_t Ek_Ai[BLOCK_BYTES]; + uint8_t tweak[TWEAK_BYTES]; + + memset(tweak, 0, TWEAK_BYTES); + memset(Auth, 0, BLOCK_BYTES); + + size_t l_a = A_len / BLOCK_BYTES; + size_t rest = A_len % BLOCK_BYTES; + + for (size_t i=0; i<l_a; i++) + { + _fill_ad_tweak(0x2, i, tweak); + encrypt(key, tweak, &A[i*BLOCK_BYTES], Ek_Ai); + xor_into(Auth, Ek_Ai); + } + + if (rest != 0) + { + uint8_t A_rest[BLOCK_BYTES]; + pad10(rest, &A[l_a*BLOCK_BYTES], A_rest); + _fill_ad_tweak(0x6, l_a, tweak); + encrypt(key, tweak, A_rest, Ek_Ai); + xor_into(Auth, Ek_Ai); + } +} + + #endif /* AE_COMMON_H */ diff --git a/src/lilliput-ae-i.c b/src/lilliput-ae-i.c index 5d1a630..b1758c9 100644 --- a/src/lilliput-ae-i.c +++ b/src/lilliput-ae-i.c @@ -13,33 +13,6 @@ static const uint8_t _0n[BLOCK_BYTES] = { }; -static void _fill_ad_tweak( - uint8_t prefix, - uint64_t block_nb, - uint8_t tweak[TWEAK_BYTES] -) -{ - /* The 192-bit tweak is filled as follows: - * - * - bits 1-188: block number - * 1- 64: actual 64-bit block number - * 65-188: 0-padding - * - bits 189-192: constant 4-bit prefix - */ - - for (size_t i=0; i<sizeof(block_nb); i++) - { - uint64_t mask = (uint64_t)0xff << 8*i; - uint8_t b = (mask & block_nb) >> 8*i; - - tweak[i] = b; - } - - /* Assume padding bytes have already been memset to 0. */ - - tweak[TWEAK_BYTES-1] |= prefix << 4; -} - static void _fill_msg_tweak( uint8_t prefix, const uint8_t N[NONCE_BYTES], @@ -74,39 +47,6 @@ static void _fill_msg_tweak( tweak[TWEAK_BYTES-1] = prefix << 4 ^ upper_nibble(N[NONCE_BYTES-1]); } -static void _process_associated_data( - const uint8_t key[KEY_BYTES], - size_t A_len, - const uint8_t A[A_len], - uint8_t Auth[BLOCK_BYTES] -) -{ - uint8_t Ek_Ai[BLOCK_BYTES]; - uint8_t tweak[TWEAK_BYTES]; - - memset(tweak, 0, TWEAK_BYTES); - memset(Auth, 0, BLOCK_BYTES); - - size_t l_a = A_len / BLOCK_BYTES; - size_t rest = A_len % BLOCK_BYTES; - - for (size_t i=0; i<l_a; i++) - { - _fill_ad_tweak(0x2, i, tweak); - encrypt(key, tweak, &A[i*BLOCK_BYTES], Ek_Ai); - xor_into(Auth, Ek_Ai); - } - - if (rest != 0) - { - uint8_t A_rest[BLOCK_BYTES]; - pad10(rest, &A[l_a*BLOCK_BYTES], A_rest); - _fill_ad_tweak(0x6, l_a, tweak); - encrypt(key, tweak, A_rest, Ek_Ai); - xor_into(Auth, Ek_Ai); - } -} - static void _encrypt_message( const uint8_t key[KEY_BYTES], size_t M_len, @@ -223,7 +163,7 @@ void lilliput_ae_encrypt( ) { uint8_t auth[BLOCK_BYTES]; - _process_associated_data(key, auth_data_len, auth_data, auth); + process_associated_data(key, auth_data_len, auth_data, auth); uint8_t final[BLOCK_BYTES]; _encrypt_message(key, message_len, message, nonce, ciphertext, final); @@ -243,7 +183,7 @@ bool lilliput_ae_decrypt( ) { uint8_t auth[BLOCK_BYTES]; - _process_associated_data(key, auth_data_len, auth_data, auth); + process_associated_data(key, auth_data_len, auth_data, auth); uint8_t final[BLOCK_BYTES]; _decrypt_message(key, ciphertext_len, ciphertext, nonce, message, final); diff --git a/src/lilliput-ae-ii.c b/src/lilliput-ae-ii.c index 23ff27e..fc50211 100644 --- a/src/lilliput-ae-ii.c +++ b/src/lilliput-ae-ii.c @@ -2,18 +2,11 @@ #include <stdint.h> #include <string.h> +#include "ae-common.h" #include "cipher.h" #include "lilliput-ae.h" -static void _process_associated_data( - const uint8_t key[KEY_BYTES], - size_t A_len, - const uint8_t A[A_len], - uint8_t Auth[BLOCK_BYTES] -) -{ -} static void _generate_tag( const uint8_t key[KEY_BYTES], @@ -61,7 +54,7 @@ void lilliput_ae_encrypt( ) { uint8_t auth[BLOCK_BYTES]; - _process_associated_data(key, auth_data_len, auth_data, auth); + process_associated_data(key, auth_data_len, auth_data, auth); _generate_tag(key, message_len, message, nonce, auth, tag); @@ -82,7 +75,7 @@ bool lilliput_ae_decrypt( _decrypt_message(key, ciphertext_len, ciphertext, nonce, tag, message); uint8_t auth[BLOCK_BYTES]; - _process_associated_data(key, auth_data_len, auth_data, auth); + process_associated_data(key, auth_data_len, auth_data, auth); uint8_t effective_tag[TAG_BYTES]; _generate_tag(key, ciphertext_len, message, nonce, auth, effective_tag); |