From ce047dd5b1beaba66b8ea615191c421e1c8c8c9a Mon Sep 17 00:00:00 2001
From: Kévin Le Gouguec <kevin.legouguec@airbus.com>
Date: Tue, 30 Apr 2019 15:41:59 +0200
Subject: Homogénéisation de la gestion de l'index de bloc dans les tweaks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- "block number" → "block index"

- "192" → "t"

- boucle de copie de l'index

- utilisation de size_t :

    - par  définition, aucune  implémentation ne  pourra traiter  plus
      d'octets que SIZE_MAX (donc pas plus de blocs),

    - pas de  raison de  forcer un  index de 64  bits sur  ces pauvres
      ATmega et MSP430.
---
 src/ref/lilliput-ae-utils.h | 29 ++++++++++++++++++-----------
 src/ref/lilliput-i.c        | 26 ++++++++++----------------
 src/ref/lilliput-ii.c       | 27 ++++++++++++++-------------
 3 files changed, 42 insertions(+), 40 deletions(-)

diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h
index ce3f154..0efb776 100644
--- a/src/ref/lilliput-ae-utils.h
+++ b/src/ref/lilliput-ae-utils.h
@@ -90,24 +90,31 @@ static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BL
     memcpy(padded+pad_len, X, X_len);
 }
 
+static inline void copy_block_index(size_t index, uint8_t tweak[TWEAK_BYTES])
+{
+    /* NB: little-endian architectures can simply use:
+     *     memcpy(tweak, &index, sizeof(index)); */
+    for (size_t i=0; i<sizeof(index); i++)
+    {
+        tweak[i] = index >> 8*i & 0xff;
+    }
+}
+
 static inline void fill_index_tweak(
-    uint8_t  prefix,
-    uint64_t block_index,
-    uint8_t  tweak[TWEAK_BYTES]
+    uint8_t prefix,
+    size_t  block_index,
+    uint8_t tweak[TWEAK_BYTES]
 )
 {
-    /* The t-bit tweak is filled as follows:
+    /* With an s-bit block index, the t-bit tweak is filled as follows:
      *
      * - bits [  1, t-4]: block index
-     *        [  1,  64]: actual 64-bit block index
-     *        [ 65, t-4]: 0-padding
-     * - bits [t-3,   t]: constant 4-bit prefix
+     *        [  1,   s]: actual block index
+     *        [s+1, t-4]: 0-padding
+     * - bits [t-3,   t]: 4-bit prefix
      */
 
-    for (size_t i=0; i<sizeof(block_index); i++)
-    {
-        tweak[i] = block_index >> 8*i & 0xff;
-    }
+    copy_block_index(block_index, tweak);
 
     /* Assume padding bytes have already been set to 0. */
 
diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c
index 97c2117..3ba7ea2 100644
--- a/src/ref/lilliput-i.c
+++ b/src/ref/lilliput-i.c
@@ -35,32 +35,26 @@ static const uint8_t _0n[BLOCK_BYTES] = {
 static void _fill_msg_tweak(
     uint8_t       prefix,
     const uint8_t N[NONCE_BYTES],
-    uint64_t      block_nb,
+    size_t        block_index,
     uint8_t       tweak[TWEAK_BYTES]
 )
 {
-    /* The 192-bit tweak is filled as follows:
+    /* With an s-bit block index, the t-bit tweak is filled as follows:
      *
-     * - bits   1- 68: block number
-     *          1- 64: actual 64-bit block number
-     *         64- 68: 0-padding
-     * - bits  67-188: nonce
-     * - bits 189-192: constant 4-bit prefix
+     * - bits [      1, t-|N|-4]: block index
+     *        [      1,       s]: actual 64-bit block index
+     *        [    s+1, t-|N|-4]: 0-padding
+     * - bits [t-|N|-4,     t-4]: nonce
+     * - bits [    t-3,       t]: 4-bit prefix
      */
 
-    for (size_t i=0; i<sizeof(block_nb); i++)
-    {
-        uint64_t mask = (uint64_t)0xff << 8*i;
-        uint8_t b = (mask & block_nb) >> 8*i;
-
-        tweak[i] = b;
-    }
+    copy_block_index(block_index, tweak);
 
-    tweak[sizeof(block_nb)] = lower_nibble(N[0]) << 4;
+    tweak[sizeof(block_index)] = lower_nibble(N[0]) << 4;
 
     for (size_t i=1; i<NONCE_BYTES; i++)
     {
-        tweak[sizeof(block_nb)+i] = lower_nibble(N[i]) << 4 ^ upper_nibble(N[i-1]);
+        tweak[sizeof(block_index)+i] = lower_nibble(N[i]) << 4 ^ upper_nibble(N[i-1]);
     }
 
     tweak[TWEAK_BYTES-1] = prefix << 4 ^ upper_nibble(N[NONCE_BYTES-1]);
diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c
index a371521..6811d49 100644
--- a/src/ref/lilliput-ii.c
+++ b/src/ref/lilliput-ii.c
@@ -28,37 +28,38 @@ This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2.
 
 static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BYTES])
 {
-    /* The t-bit tweak is filled as follows:
+    /* With an s-bit block index, the t-bit tweak is filled as follows:
      *
      * - bits [  1, t-1]: tag + block index
-     *        [  1,  64]: tag[ 1.. 64] XOR block index
-     *        [ 65, t-1]: tag[65..t-1]
+     *        [  1,   s]: tag[1..s] XOR block index
+     *        [s+1, t-1]: tag[s+1..t-1]
      * - bit t: 1
      *
-     * This function sets bits 65 to t once and for all.
+     * This function sets bits s+1 to t once and for all.
      */
 
-    memcpy(tweak+sizeof(uint64_t), tag+sizeof(uint64_t), TAG_BYTES-sizeof(uint64_t));
+    memcpy(tweak+sizeof(size_t), tag+sizeof(size_t), TAG_BYTES-sizeof(size_t));
     tweak[TWEAK_BYTES-1] |= 0x80;
 }
 
-static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], uint64_t block_index, uint8_t tweak[TWEAK_BYTES])
+static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES])
 {
-    /* The t-bit tweak is filled as follows:
+    /* With an s-bit block index, the t-bit tweak is filled as follows:
      *
      * - bits [  1, t-1]: tag + block index
-     *        [  1,  64]: tag[ 1.. 64] XOR block index
-     *        [ 65, t-1]: tag[65..t-1]
+     *        [  1,   s]: tag[1..s] XOR block index
+     *        [s+1, t-1]: tag[s+1..t-1]
      * - bit t: 1
      *
-     * This function assumes bits 65 to t have already been set, and
-     * only sets bits 1 to 64.
+     * This function assumes bits s+1 to t have already been set, and
+     * only sets bits 1 to s.
      */
 
+    copy_block_index(block_index, tweak);
+
     for (size_t i=0; i<sizeof(block_index); i++)
     {
-        uint8_t index_i = block_index >> i*8 & 0xff;
-        tweak[i] = tag[i] ^ index_i;
+        tweak[i] ^= tag[i];
     }
 }
 
-- 
cgit v1.2.3