|
3
|
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis |
|
|
2 * |
|
|
3 * LibTomCrypt is a library that provides various cryptographic |
|
|
4 * algorithms in a highly modular and flexible manner. |
|
|
5 * |
|
|
6 * The library is free for all purposes without any express |
|
|
7 * guarantee it works. |
|
|
8 * |
|
|
9 * Tom St Denis, [email protected], http://libtomcrypt.org |
|
|
10 */ |
|
|
11 |
|
|
12 /* OCB Implementation by Tom St Denis */ |
|
|
13 #include "mycrypt.h" |
|
|
14 |
|
|
15 #ifdef OCB_MODE |
|
|
16 |
|
|
17 /* Since the last block is encrypted in CTR mode the same code can |
|
|
18 * be used to finish a decrypt or encrypt stream. The only difference |
|
|
19 * is we XOR the final ciphertext into the checksum so we have to xor it |
|
|
20 * before we CTR [decrypt] or after [encrypt] |
|
|
21 * |
|
|
22 * the names pt/ptlen/ct really just mean in/inlen/out but this is the way I wrote it... |
|
|
23 */ |
|
|
24 int __ocb_done(ocb_state *ocb, const unsigned char *pt, unsigned long ptlen, |
|
|
25 unsigned char *ct, unsigned char *tag, unsigned long *taglen, int mode) |
|
|
26 |
|
|
27 { |
|
143
|
28 unsigned char *Z, *Y, *X; |
|
3
|
29 int err, x; |
|
|
30 |
|
|
31 _ARGCHK(ocb != NULL); |
|
|
32 _ARGCHK(pt != NULL); |
|
|
33 _ARGCHK(ct != NULL); |
|
|
34 _ARGCHK(tag != NULL); |
|
|
35 _ARGCHK(taglen != NULL); |
|
|
36 if ((err = cipher_is_valid(ocb->cipher)) != CRYPT_OK) { |
|
|
37 return err; |
|
|
38 } |
|
|
39 if (ocb->block_len != cipher_descriptor[ocb->cipher].block_length || |
|
|
40 (int)ptlen > ocb->block_len || (int)ptlen < 0) { |
|
|
41 return CRYPT_INVALID_ARG; |
|
|
42 } |
|
|
43 |
|
143
|
44 /* allocate ram */ |
|
|
45 Z = XMALLOC(MAXBLOCKSIZE); |
|
|
46 Y = XMALLOC(MAXBLOCKSIZE); |
|
|
47 X = XMALLOC(MAXBLOCKSIZE); |
|
|
48 if (X == NULL || Y == NULL || Z == NULL) { |
|
|
49 if (X != NULL) { |
|
|
50 XFREE(X); |
|
|
51 } |
|
|
52 if (Y != NULL) { |
|
|
53 XFREE(Y); |
|
|
54 } |
|
|
55 if (Z != NULL) { |
|
|
56 XFREE(Z); |
|
|
57 } |
|
|
58 return CRYPT_MEM; |
|
|
59 } |
|
|
60 |
|
3
|
61 /* compute X[m] = len(pt[m]) XOR Lr XOR Z[m] */ |
|
|
62 ocb_shift_xor(ocb, X); |
|
143
|
63 XMEMCPY(Z, X, ocb->block_len); |
|
3
|
64 |
|
|
65 X[ocb->block_len-1] ^= (ptlen*8)&255; |
|
|
66 X[ocb->block_len-2] ^= ((ptlen*8)>>8)&255; |
|
|
67 for (x = 0; x < ocb->block_len; x++) { |
|
|
68 X[x] ^= ocb->Lr[x]; |
|
|
69 } |
|
|
70 |
|
|
71 /* Y[m] = E(X[m])) */ |
|
|
72 cipher_descriptor[ocb->cipher].ecb_encrypt(X, Y, &ocb->key); |
|
|
73 |
|
|
74 if (mode == 1) { |
|
|
75 /* decrypt mode, so let's xor it first */ |
|
|
76 /* xor C[m] into checksum */ |
|
|
77 for (x = 0; x < (int)ptlen; x++) { |
|
|
78 ocb->checksum[x] ^= ct[x]; |
|
|
79 } |
|
|
80 } |
|
|
81 |
|
|
82 /* C[m] = P[m] xor Y[m] */ |
|
|
83 for (x = 0; x < (int)ptlen; x++) { |
|
|
84 ct[x] = pt[x] ^ Y[x]; |
|
|
85 } |
|
|
86 |
|
|
87 if (mode == 0) { |
|
|
88 /* encrypt mode */ |
|
|
89 /* xor C[m] into checksum */ |
|
|
90 for (x = 0; x < (int)ptlen; x++) { |
|
|
91 ocb->checksum[x] ^= ct[x]; |
|
|
92 } |
|
|
93 } |
|
|
94 |
|
|
95 /* xor Y[m] and Z[m] into checksum */ |
|
|
96 for (x = 0; x < ocb->block_len; x++) { |
|
|
97 ocb->checksum[x] ^= Y[x] ^ Z[x]; |
|
|
98 } |
|
|
99 |
|
|
100 /* encrypt checksum, er... tag!! */ |
|
|
101 cipher_descriptor[ocb->cipher].ecb_encrypt(ocb->checksum, X, &ocb->key); |
|
|
102 |
|
|
103 /* now store it */ |
|
|
104 for (x = 0; x < ocb->block_len && x < (int)*taglen; x++) { |
|
|
105 tag[x] = X[x]; |
|
|
106 } |
|
|
107 *taglen = x; |
|
|
108 |
|
|
109 #ifdef CLEAN_STACK |
|
143
|
110 zeromem(X, MAXBLOCKSIZE); |
|
|
111 zeromem(Y, MAXBLOCKSIZE); |
|
|
112 zeromem(Z, MAXBLOCKSIZE); |
|
3
|
113 zeromem(ocb, sizeof(*ocb)); |
|
|
114 #endif |
|
143
|
115 |
|
|
116 XFREE(X); |
|
|
117 XFREE(Y); |
|
|
118 XFREE(Z); |
|
|
119 |
|
3
|
120 return CRYPT_OK; |
|
|
121 } |
|
|
122 |
|
|
123 #endif |
|
|
124 |
