--- /dev/null
+/* LibTomCrypt, modular cryptographic library -- Tom St Denis
+ *
+ * LibTomCrypt is a library that provides various cryptographic
+ * algorithms in a highly modular and flexible manner.
+ *
+ * The library is free for all purposes without any express
+ * guarantee it works.
+ */
+
+/**
+ @file ocb3_init.c
+ OCB implementation, initialize state, by Tom St Denis
+*/
+#include "tomcrypt.h"
+
+#ifdef LTC_OCB3_MODE
+
+static void _ocb3_int_calc_offset_zero(ocb3_state *ocb, const unsigned char *nonce, unsigned long noncelen, unsigned long taglen)
+{
+ int x, y, bottom;
+ int idx, shift;
+ unsigned char iNonce[MAXBLOCKSIZE];
+ unsigned char iKtop[MAXBLOCKSIZE];
+ unsigned char iStretch[MAXBLOCKSIZE+8];
+
+ /* Nonce = zeros(127-bitlen(N)) || 1 || N */
+ zeromem(iNonce, sizeof(iNonce));
+ for (x = ocb->block_len-1, y=0; y<(int)noncelen; x--, y++) {
+ iNonce[x] = nonce[noncelen-y-1];
+ }
+ iNonce[x] = 0x01;
+ iNonce[0] |= ((taglen*8) % 128) << 1;
+
+ /* bottom = str2num(Nonce[123..128]) */
+ bottom = iNonce[ocb->block_len-1] & 0x3F;
+
+ /* Ktop = ENCIPHER(K, Nonce[1..122] || zeros(6)) */
+ iNonce[ocb->block_len-1] = iNonce[ocb->block_len-1] & 0xC0;
+ if ((cipher_descriptor[ocb->cipher].ecb_encrypt(iNonce, iKtop, &ocb->key)) != CRYPT_OK) {
+ zeromem(ocb->Offset_current, ocb->block_len);
+ return;
+ }
+
+ /* Stretch = Ktop || (Ktop[1..64] xor Ktop[9..72]) */
+ for (x = 0; x < ocb->block_len; x++) {
+ iStretch[x] = iKtop[x];
+ }
+ for (y = 0; y < 8; y++) {
+ iStretch[x+y] = iKtop[y] ^ iKtop[y+1];
+ }
+
+ /* Offset_0 = Stretch[1+bottom..128+bottom] */
+ idx = bottom / 8;
+ shift = (bottom % 8);
+ for (x = 0; x < ocb->block_len; x++) {
+ ocb->Offset_current[x] = iStretch[idx+x] << shift;
+ if (shift > 0) {
+ ocb->Offset_current[x] |= iStretch[idx+x+1] >> (8-shift);
+ }
+ }
+}
+
+static const struct {
+ int len;
+ unsigned char poly_mul[MAXBLOCKSIZE];
+} polys[] = {
+{
+ 8,
+ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B }
+}, {
+ 16,
+ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x87 }
+}
+};
+
+/**
+ Initialize an OCB context
+ @param ocb [out] The destination of the OCB state
+ @param cipher The index of the desired cipher
+ @param key The secret key
+ @param keylen The length of the secret key (octets)
+ @param nonce The session nonce
+ @param noncelen The length of the session nonce (octets, up to 15)
+ @param taglen The length of the tag (octets, up to 16)
+ @return CRYPT_OK if successful
+*/
+int ocb3_init(ocb3_state *ocb, int cipher,
+ const unsigned char *key, unsigned long keylen,
+ const unsigned char *nonce, unsigned long noncelen,
+ unsigned long taglen)
+{
+ int poly, x, y, m, err;
+ unsigned char *previous, *current;
+
+ LTC_ARGCHK(ocb != NULL);
+ LTC_ARGCHK(key != NULL);
+ LTC_ARGCHK(nonce != NULL);
+
+ /* valid cipher? */
+ if ((err = cipher_is_valid(cipher)) != CRYPT_OK) {
+ return err;
+ }
+ ocb->cipher = cipher;
+
+ /* Valid Nonce?
+ * As of RFC7253: "string of no more than 120 bits" */
+ if (noncelen > (120/8)) {
+ return CRYPT_INVALID_ARG;
+ }
+
+ /* The blockcipher must have a 128-bit blocksize */
+ if (cipher_descriptor[cipher].block_length != 16) {
+ return CRYPT_INVALID_ARG;
+ }
+
+ /* The TAGLEN may be any value up to 128 (bits) */
+ if (taglen > 16) {
+ return CRYPT_INVALID_ARG;
+ }
+ ocb->tag_len = taglen;
+
+ /* determine which polys to use */
+ ocb->block_len = cipher_descriptor[cipher].block_length;
+ x = (int)(sizeof(polys)/sizeof(polys[0]));
+ for (poly = 0; poly < x; poly++) {
+ if (polys[poly].len == ocb->block_len) {
+ break;
+ }
+ }
+ if (poly == x) {
+ return CRYPT_INVALID_ARG; /* block_len not found in polys */
+ }
+ if (polys[poly].len != ocb->block_len) {
+ return CRYPT_INVALID_ARG;
+ }
+
+ /* schedule the key */
+ if ((err = cipher_descriptor[cipher].setup(key, keylen, 0, &ocb->key)) != CRYPT_OK) {
+ return err;
+ }
+
+ /* L_* = ENCIPHER(K, zeros(128)) */
+ zeromem(ocb->L_star, ocb->block_len);
+ if ((err = cipher_descriptor[cipher].ecb_encrypt(ocb->L_star, ocb->L_star, &ocb->key)) != CRYPT_OK) {
+ return err;
+ }
+
+ /* compute L_$, L_0, L_1, ... */
+ for (x = -1; x < 32; x++) {
+ if (x == -1) { /* gonna compute: L_$ = double(L_*) */
+ current = ocb->L_dollar;
+ previous = ocb->L_star;
+ }
+ else if (x == 0) { /* gonna compute: L_0 = double(L_$) */
+ current = ocb->L_[0];
+ previous = ocb->L_dollar;
+ }
+ else { /* gonna compute: L_i = double(L_{i-1}) for every integer i > 0 */
+ current = ocb->L_[x];
+ previous = ocb->L_[x-1];
+ }
+ m = previous[0] >> 7;
+ for (y = 0; y < ocb->block_len-1; y++) {
+ current[y] = ((previous[y] << 1) | (previous[y+1] >> 7)) & 255;
+ }
+ current[ocb->block_len-1] = (previous[ocb->block_len-1] << 1) & 255;
+ if (m == 1) {
+ /* current[] = current[] XOR polys[poly].poly_mul[]*/
+ ocb3_int_xor_blocks(current, current, polys[poly].poly_mul, ocb->block_len);
+ }
+ }
+
+ /* initialize ocb->Offset_current = Offset_0 */
+ _ocb3_int_calc_offset_zero(ocb, nonce, noncelen, taglen);
+
+ /* initialize checksum to all zeros */
+ zeromem(ocb->checksum, ocb->block_len);
+
+ /* set block index */
+ ocb->block_index = 1;
+
+ /* initialize AAD related stuff */
+ ocb->ablock_index = 1;
+ ocb->adata_buffer_bytes = 0;
+ zeromem(ocb->aOffset_current, ocb->block_len);
+ zeromem(ocb->aSum_current, ocb->block_len);
+
+ return CRYPT_OK;
+}
+
+#endif
+
+/* ref: $Format:%D$ */
+/* git commit: $Format:%H$ */
+/* commit time: $Format:%ai$ */
projects / zpackage / blobdiff