From 3a074358065de5af65510d53f131b98c28f0b547 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Mon, 1 Jul 2019 17:00:15 +0200 Subject: Ajout de la multiplication M⁴ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - α₀ devient M - α₁ M² - α₂ M³ - α₃ M⁴ - α₄ M_R - α₅ M_R² - α₆ M_R³ --- src/ref/multiplications.h | 20 ++++++++++++++++++++ src/ref/tweakey.c | 9 ++++----- 2 files changed, 24 insertions(+), 5 deletions(-) (limited to 'src/ref') diff --git a/src/ref/multiplications.h b/src/ref/multiplications.h index 4de1848..c0645b9 100644 --- a/src/ref/multiplications.h +++ b/src/ref/multiplications.h @@ -71,6 +71,26 @@ static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) y[0] = x[5]; } +static void _multiply_M4(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t a_5 = x[5]<<3 ^ x[4]; + uint8_t a_4 = x[4]>>3 ^ x[3]; + uint8_t b_5 = a_5<<3 ^ a_4; + uint8_t b_4 = a_4>>3 ^ x[2]; + + uint8_t c_4 = b_4>>3 ^ x[6]<<2 ^ x[1]; + uint8_t c_5 = b_5<<3 ^ b_4; + + y[7] = b_5; + y[6] = c_5; + y[5] = c_5<<3 ^ c_4; + y[4] = c_4>>3 ^ x[5]<<2 ^ x[0]; + y[3] = a_5<<2 ^ x[7]; + y[2] = b_5<<2 ^ x[6]; + y[1] = x[5]; + y[0] = a_5; +} + static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) { y[0] = x[1]; diff --git a/src/ref/tweakey.c b/src/ref/tweakey.c index 2f357ca..510f35a 100644 --- a/src/ref/tweakey.c +++ b/src/ref/tweakey.c @@ -63,10 +63,11 @@ void tweakey_state_extract( typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); -static const matrix_multiplication ALPHAS[6] = { +static const matrix_multiplication ALPHAS[7] = { _multiply_M, _multiply_M2, _multiply_M3, + _multiply_M4, _multiply_MR, _multiply_MR2, _multiply_MR3 @@ -75,15 +76,13 @@ static const matrix_multiplication ALPHAS[6] = { void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES]) { - /* Skip lane 0, as it is multiplied by the identity matrix. */ - - for (size_t j=1; j Date: Fri, 5 Jul 2019 09:48:32 +0200 Subject: Utilisation de "size_t" pour l'indexation d'un tableau MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cf. db83bae, surtout par souci d'homogénéité. --- CHANGELOG.txt | 6 +++--- src/add_felicsref/cipher.c | 4 ++-- src/ref/cipher.c | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) (limited to 'src/ref') diff --git a/CHANGELOG.txt b/CHANGELOG.txt index cc38a27..eb074ad 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -34,6 +34,9 @@ These modifications are structural and/or stylistic and do not change the algori - Extract tweakey multiplications into their own header file, so that other implementations can make more targeted changes. (constants.h, multiplications.h, tweakey.c) +- Use size_t to iterate on arrays in lilliput_tbc_encrypt() and lilliput_tbc_decrypt(). + (cipher.c) + add_threshold ------------- @@ -45,9 +48,6 @@ See reference implementation. See reference implementation. Further cleanups: -- Use size_t to iterate on arrays in lilliput_tbc_encrypt() and lilliput_tbc_decrypt(). - (cipher.c) - - Add constant macros KEY_LANES_NB and TWEAK_LANES_NB to make tweakey schedule code more legible. (tweakey.c) diff --git a/src/add_felicsref/cipher.c b/src/add_felicsref/cipher.c index 7de0a08..59bc5d8 100644 --- a/src/add_felicsref/cipher.c +++ b/src/add_felicsref/cipher.c @@ -150,7 +150,7 @@ void lilliput_tbc_encrypt( uint8_t RTK[ROUND_TWEAKEY_BYTES]; tweakey_state_init(TK, key, tweak); - for (unsigned i=0; i Date: Wed, 12 Jun 2019 17:34:41 +0200 Subject: Changement de la concaténation des chaînes de bits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit L'implémentation précédente n'était pas cohérente. Étant données deux chaînes X et Y de longueur x et y, et Z=X∥Y de longueur z=x+y, - pad10* et la construction des tweaks fonctionnaient selon la logique "indices faibles = LSB", donc Z[0] = Y[0] Z[z-1] = X[x-1] - le découpage de M, C et A en blocs fonctionnait selon la logique "indices faibles = premiers blocs", donc Z[0] = X[0] Z[z-1] = Y[y-1] En conséquence, la façon dont M, C et A étaient paddés n'avait aucun sens, e.g. pour un message M de taille 35, pad10*(M*) donnait : { M[34], M[33], M[32], 0b10000000, 0, … } Les deux seules façons logiques de padder M* sont { M[32], M[33], M[34], 0b10000000, 0, … } ou { M[2], M[1], M[0], 0b10000000, 0, … } Après revue d'autres implémentations de ΘCB3 et SCT-2, j'ai choisi de suivre la convention MSB. En conséquence, quand la spécification dit Z = X∥Y L'implémentation traduira : Z[] = { X[0], … X[x-1], Y[0], … Y[y-1] } Dans la même logique, les compteurs de blocs seront insérés MSB d'abord et paddés en conséquence, e.g. j=0x01020304 ≡ J[] = { 0, …, 0x01, 0x02, 0x03, 0x04 } --- src/ref/lilliput-ae-utils.h | 62 ++++++++++++++++++++--------------------- src/ref/lilliput-i.c | 67 +++++++++++++++++++++++++-------------------- src/ref/lilliput-ii.c | 40 +++++++++++++-------------- 3 files changed, 87 insertions(+), 82 deletions(-) (limited to 'src/ref') diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index 0efb776..a66b75c 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -28,16 +28,6 @@ This file provides functions used by both authenticated encryption modes. #include "constants.h" -static inline uint8_t upper_nibble(uint8_t i) -{ - return i >> 4; -} - -static inline uint8_t lower_nibble(uint8_t i) -{ - return i & 0x0f; -} - static inline void encrypt(const uint8_t K[KEY_BYTES], const uint8_t T[TWEAK_BYTES], const uint8_t M[BLOCK_BYTES], @@ -68,35 +58,41 @@ static inline void xor_arrays(size_t len, uint8_t out[len], const uint8_t a[len] static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BLOCK_BYTES]) { - /* pad10*(X) = X || 1 || 0^{n-|X|-1} */ - - /* For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 } + /* Assuming 0 < |X| < n: + * + * pad10*(X) = X || 1 || 0^{n-|X|-1} + * + * For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 } * * pad10*(X) = - * X[2] X[1] X[0] 1 0* - * 00000011 00000010 00000001 1 0000000 00000000... + * X[0] X[1] X[2] 1 0* + * 00000001 00000010 00000011 1 0000000 00000000... * - * - padded[0, 11]: zeroes - * - padded[12]: 10000000 - * - padded[13, 15]: X[0, 2] + * - padded[0, 2]: X[0, 2] + * - padded[3]: 10000000 + * - padded[4, 15]: zeroes */ - /* Assume that X_len> 8*i & 0xff; + dest[i] = index >> 8*(s-1-i); } } @@ -108,17 +104,17 @@ static inline void fill_index_tweak( { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-4]: block index - * [ 1, s]: actual block index - * [s+1, t-4]: 0-padding - * - bits [t-3, t]: 4-bit prefix + * [ 1, 4]: 4-bit prefix + * [ 5, t]: block index + * [ 5, t-s]: 0-padding + * [t-s+1, t]: actual block index, from MSB to LSB */ - copy_block_index(block_index, tweak); + tweak[0] = prefix<<4; /* Assume padding bytes have already been set to 0. */ - tweak[TWEAK_BYTES-1] |= prefix << 4; + copy_block_index(block_index, tweak); } static void process_associated_data( diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index 6f869c3..fb06237 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -32,58 +32,67 @@ static const uint8_t _0n[BLOCK_BYTES] = { }; +static uint8_t _upper_nibble(uint8_t i) +{ + return i >> 4; +} + +static uint8_t _lower_nibble(uint8_t i) +{ + return i & 0x0f; +} + static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES]) { /* With an s-bit block index, the t-bit tweak is filled as follows: * - * - bits [ 1, t-|N|-4]: block index - * [ 1, s]: actual block index - * [ s+1, t-|N|-4]: 0-padding - * - bits [t-|N|-3, t-4]: nonce - * - bits [ t-3, t]: 4-bit prefix + * [ 1, 4]: 4-bit prefix + * [ 5, |N|+4]: nonce + * [ |N|+5, t]: block index + * [|N|+5, t-s]: 0-padding + * [t-s+1, t]: actual block index, from MSB to LSB * - * This function sets bits s+1 to t-4 once and for all. + * This function sets bits 5 to t-s once and for all. */ - size_t N_start = TWEAK_BYTES - NONCE_BYTES - 1; - - for (size_t i=sizeof(size_t); i Date: Thu, 27 Jun 2019 16:36:11 +0200 Subject: Réécriture des commentaires schématiques sur les tweaks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/ref/lilliput-ae-utils.h | 13 ++++++++----- src/ref/lilliput-i.c | 28 ++++++++++++++++------------ src/ref/lilliput-ii.c | 30 ++++++++++++++++++------------ 3 files changed, 42 insertions(+), 29 deletions(-) (limited to 'src/ref') diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index a66b75c..19b4623 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -102,12 +102,15 @@ static inline void fill_index_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, t]: block index - * [ 5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 t + * [ prefix || block index ] + * + * The s-bit block index is encoded as follows: + * + * 5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] */ tweak[0] = prefix<<4; diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index fb06237..3358b10 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -44,13 +44,15 @@ static uint8_t _lower_nibble(uint8_t i) static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: + * + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function sets bits 5 to t-s once and for all. */ @@ -77,13 +79,15 @@ static void _fill_msg_tweak( uint8_t tweak[TWEAK_BYTES] ) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 4 5 |N|+4 |N|+5 t + * [ prefix || nonce || block index ] + * + * The s-bit block index is encoded as follows: * - * [ 1, 4]: 4-bit prefix - * [ 5, |N|+4]: nonce - * [ |N|+5, t]: block index - * [|N|+5, t-s]: 0-padding - * [t-s+1, t]: actual block index, from MSB to LSB + * |N|+5 t-s t-s+1 t + * [ zero padding || block index, MSB first ] * * This function assumes bits 5 to t-s have already been set, and * only sets bits 1 to 4 and t-s+1 to t. diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index 9ed17a2..bb43d08 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -28,12 +28,15 @@ This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2. static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag[ 2, t] XOR block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function sets bits 1 to t-s once and for all. */ @@ -44,12 +47,15 @@ static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BY static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES]) { - /* With an s-bit block index, the t-bit tweak is filled as follows: + /* The t-bit tweak is filled as follows: + * + * 1 2 t + * [ 1 || tag[2,t] XOR block index ] + * + * The s-bit block index is XORed to the tag as follows: * - * 1: 1 - * [ 2, t]: tag + block index - * [ 2, t-s]: tag[ 2, t-s] - * [t-s+1, t]: tag[t-s+1, t] XOR block index + * 2 t-s t-s+1 t + * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ] * * This function assumes bits 1 to t-s have already been set, and * only sets bits t-s+1 to t. @@ -67,8 +73,8 @@ static void _fill_tag_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BY { /* The t-bit tweak is filled as follows: * - * [ 1, 8]: 0001||0^4 - * [t-|N|+1, t]: N + * 1 4 5 8 t-|N|+1 t + * [ 0001 || 0^4 || nonce ] */ tweak[0] = 0x10; -- cgit v1.2.3