/*      $NetBSD: aes_bear.c,v 1.4 2020/07/25 22:28:27 riastradh Exp $   */

/*-
* Copyright (c) 2020 The NetBSD Foundation, Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(1, "$NetBSD: aes_bear.c,v 1.4 2020/07/25 22:28:27 riastradh Exp $");

#include <sys/types.h>
#include <sys/endian.h>

#ifdef _KERNEL
#include <sys/systm.h>
#else
#include <assert.h>
#include <err.h>
#include <string.h>
#define KASSERT                 assert
#define panic(fmt, args...)     err(1, fmt, args)
#endif

#include <crypto/aes/aes.h>
#include <crypto/aes/aes_bear.h>
#include <crypto/aes/aes_impl.h>

static void
aesbear_setkey(uint32_t rk[static 60], const void *key, uint32_t nrounds)
{
       size_t key_len;

       switch (nrounds) {
       case 10:
               key_len = 16;
               break;
       case 12:
               key_len = 24;
               break;
       case 14:
               key_len = 32;
               break;
       default:
               panic("invalid AES nrounds: %u", nrounds);
       }

       br_aes_ct_keysched(rk, key, key_len);
}

static void
aesbear_setenckey(struct aesenc *enc, const uint8_t *key, uint32_t nrounds)
{

       aesbear_setkey(enc->aese_aes.aes_rk, key, nrounds);
}

static void
aesbear_setdeckey(struct aesdec *dec, const uint8_t *key, uint32_t nrounds)
{

       /*
        * BearSSL computes InvMixColumns on the fly -- no need for
        * distinct decryption round keys.
        */
       aesbear_setkey(dec->aesd_aes.aes_rk, key, nrounds);
}

static void
aesbear_enc(const struct aesenc *enc, const uint8_t in[static 16],
   uint8_t out[static 16], uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, enc->aese_aes.aes_rk);

       /* Load input block interleaved with garbage block.  */
       q[2*0] = le32dec(in + 4*0);
       q[2*1] = le32dec(in + 4*1);
       q[2*2] = le32dec(in + 4*2);
       q[2*3] = le32dec(in + 4*3);
       q[1] = q[3] = q[5] = q[7] = 0;

       /* Transform to bitslice, decrypt, transform from bitslice.  */
       br_aes_ct_ortho(q);
       br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
       br_aes_ct_ortho(q);

       /* Store output block.  */
       le32enc(out + 4*0, q[2*0]);
       le32enc(out + 4*1, q[2*1]);
       le32enc(out + 4*2, q[2*2]);
       le32enc(out + 4*3, q[2*3]);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static void
aesbear_dec(const struct aesdec *dec, const uint8_t in[static 16],
   uint8_t out[static 16], uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, dec->aesd_aes.aes_rk);

       /* Load input block interleaved with garbage.  */
       q[2*0] = le32dec(in + 4*0);
       q[2*1] = le32dec(in + 4*1);
       q[2*2] = le32dec(in + 4*2);
       q[2*3] = le32dec(in + 4*3);
       q[1] = q[3] = q[5] = q[7] = 0;

       /* Transform to bitslice, decrypt, transform from bitslice.  */
       br_aes_ct_ortho(q);
       br_aes_ct_bitslice_decrypt(nrounds, sk_exp, q);
       br_aes_ct_ortho(q);

       /* Store output block.  */
       le32enc(out + 4*0, q[2*0]);
       le32enc(out + 4*1, q[2*1]);
       le32enc(out + 4*2, q[2*2]);
       le32enc(out + 4*3, q[2*3]);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static void
aesbear_cbc_enc(const struct aesenc *enc, const uint8_t in[static 16],
   uint8_t out[static 16], size_t nbytes, uint8_t iv[static 16],
   uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];
       uint32_t cv0, cv1, cv2, cv3;

       KASSERT(nbytes % 16 == 0);

       /* Skip if there's nothing to do.  */
       if (nbytes == 0)
               return;

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, enc->aese_aes.aes_rk);

       /* Initialize garbage block.  */
       q[1] = q[3] = q[5] = q[7] = 0;

       /* Load IV.  */
       cv0 = le32dec(iv + 4*0);
       cv1 = le32dec(iv + 4*1);
       cv2 = le32dec(iv + 4*2);
       cv3 = le32dec(iv + 4*3);

       for (; nbytes; nbytes -= 16, in += 16, out += 16) {
               /* Load input block and apply CV.  */
               q[2*0] = cv0 ^ le32dec(in + 4*0);
               q[2*1] = cv1 ^ le32dec(in + 4*1);
               q[2*2] = cv2 ^ le32dec(in + 4*2);
               q[2*3] = cv3 ^ le32dec(in + 4*3);

               /* Transform to bitslice, encrypt, transform from bitslice.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* Remember ciphertext as CV and store output block.  */
               cv0 = q[2*0];
               cv1 = q[2*1];
               cv2 = q[2*2];
               cv3 = q[2*3];
               le32enc(out + 4*0, cv0);
               le32enc(out + 4*1, cv1);
               le32enc(out + 4*2, cv2);
               le32enc(out + 4*3, cv3);
       }

       /* Store updated IV.  */
       le32enc(iv + 4*0, cv0);
       le32enc(iv + 4*1, cv1);
       le32enc(iv + 4*2, cv2);
       le32enc(iv + 4*3, cv3);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static void
aesbear_cbc_dec(const struct aesdec *dec, const uint8_t in[static 16],
   uint8_t out[static 16], size_t nbytes, uint8_t iv[static 16],
   uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];
       uint32_t cv0, cv1, cv2, cv3, iv0, iv1, iv2, iv3;

       KASSERT(nbytes % 16 == 0);

       /* Skip if there's nothing to do.  */
       if (nbytes == 0)
               return;

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, dec->aesd_aes.aes_rk);

       /* Load the IV.  */
       iv0 = le32dec(iv + 4*0);
       iv1 = le32dec(iv + 4*1);
       iv2 = le32dec(iv + 4*2);
       iv3 = le32dec(iv + 4*3);

       /* Load the last cipher block.  */
       cv0 = le32dec(in + nbytes - 16 + 4*0);
       cv1 = le32dec(in + nbytes - 16 + 4*1);
       cv2 = le32dec(in + nbytes - 16 + 4*2);
       cv3 = le32dec(in + nbytes - 16 + 4*3);

       /* Store the updated IV.  */
       le32enc(iv + 4*0, cv0);
       le32enc(iv + 4*1, cv1);
       le32enc(iv + 4*2, cv2);
       le32enc(iv + 4*3, cv3);

       /* Handle the last cipher block separately if odd number.  */
       if (nbytes % 32) {
               KASSERT(nbytes % 32 == 16);

               /* Set up the last cipher block and a garbage block.  */
               q[2*0] = cv0;
               q[2*1] = cv1;
               q[2*2] = cv2;
               q[2*3] = cv3;
               q[1] = q[3] = q[5] = q[7] = 0;

               /* Decrypt.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_decrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* If this was the only cipher block, we're done.  */
               nbytes -= 16;
               if (nbytes == 0)
                       goto out;

               /*
                * Otherwise, load up the penultimate cipher block, and
                * store the output block.
                */
               cv0 = le32dec(in + nbytes - 16 + 4*0);
               cv1 = le32dec(in + nbytes - 16 + 4*1);
               cv2 = le32dec(in + nbytes - 16 + 4*2);
               cv3 = le32dec(in + nbytes - 16 + 4*3);
               le32enc(out + nbytes + 4*0, cv0 ^ q[2*0]);
               le32enc(out + nbytes + 4*1, cv1 ^ q[2*1]);
               le32enc(out + nbytes + 4*2, cv2 ^ q[2*2]);
               le32enc(out + nbytes + 4*3, cv3 ^ q[2*3]);
       }

       for (;;) {
               KASSERT(nbytes >= 32);

               /*
                * 1. Set up upper cipher block from cvN.
                * 2. Load lower cipher block into cvN and set it up.
                * 3. Decrypt.
                */
               q[2*0 + 1] = cv0;
               q[2*1 + 1] = cv1;
               q[2*2 + 1] = cv2;
               q[2*3 + 1] = cv3;
               cv0 = q[2*0] = le32dec(in + nbytes - 32 + 4*0);
               cv1 = q[2*1] = le32dec(in + nbytes - 32 + 4*1);
               cv2 = q[2*2] = le32dec(in + nbytes - 32 + 4*2);
               cv3 = q[2*3] = le32dec(in + nbytes - 32 + 4*3);

               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_decrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* Store the upper output block.  */
               le32enc(out + nbytes - 16 + 4*0, q[2*0 + 1] ^ cv0);
               le32enc(out + nbytes - 16 + 4*1, q[2*1 + 1] ^ cv1);
               le32enc(out + nbytes - 16 + 4*2, q[2*2 + 1] ^ cv2);
               le32enc(out + nbytes - 16 + 4*3, q[2*3 + 1] ^ cv3);

               /* Stop if we've reached the first output block.  */
               nbytes -= 32;
               if (nbytes == 0)
                       goto out;

               /*
                * Load the preceding cipher block, and apply it as the
                * chaining value to this one.
                */
               cv0 = le32dec(in + nbytes - 16 + 4*0);
               cv1 = le32dec(in + nbytes - 16 + 4*1);
               cv2 = le32dec(in + nbytes - 16 + 4*2);
               cv3 = le32dec(in + nbytes - 16 + 4*3);
               le32enc(out + nbytes + 4*0, q[2*0] ^ cv0);
               le32enc(out + nbytes + 4*1, q[2*1] ^ cv1);
               le32enc(out + nbytes + 4*2, q[2*2] ^ cv2);
               le32enc(out + nbytes + 4*3, q[2*3] ^ cv3);
       }

out:    /* Store the first output block.  */
       le32enc(out + 4*0, q[2*0] ^ iv0);
       le32enc(out + 4*1, q[2*1] ^ iv1);
       le32enc(out + 4*2, q[2*2] ^ iv2);
       le32enc(out + 4*3, q[2*3] ^ iv3);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static inline void
aesbear_xts_update(uint32_t *t0, uint32_t *t1, uint32_t *t2, uint32_t *t3)
{
       uint32_t s0, s1, s2, s3;

       s0 = *t0 >> 31;
       s1 = *t1 >> 31;
       s2 = *t2 >> 31;
       s3 = *t3 >> 31;
       *t0 = (*t0 << 1) ^ (-s3 & 0x87);
       *t1 = (*t1 << 1) ^ s0;
       *t2 = (*t2 << 1) ^ s1;
       *t3 = (*t3 << 1) ^ s2;
}

static int
aesbear_xts_update_selftest(void)
{
       static const struct {
               uint32_t in[4], out[4];
       } cases[] = {
               { {1}, {2} },
               { {0x80000000U,0,0,0}, {0,1,0,0} },
               { {0,0x80000000U,0,0}, {0,0,1,0} },
               { {0,0,0x80000000U,0}, {0,0,0,1} },
               { {0,0,0,0x80000000U}, {0x87,0,0,0} },
               { {0,0x80000000U,0,0x80000000U}, {0x87,0,1,0} },
       };
       unsigned i;
       uint32_t t0, t1, t2, t3;

       for (i = 0; i < sizeof(cases)/sizeof(cases[0]); i++) {
               t0 = cases[i].in[0];
               t1 = cases[i].in[1];
               t2 = cases[i].in[2];
               t3 = cases[i].in[3];
               aesbear_xts_update(&t0, &t1, &t2, &t3);
               if (t0 != cases[i].out[0] ||
                   t1 != cases[i].out[1] ||
                   t2 != cases[i].out[2] ||
                   t3 != cases[i].out[3])
                       return -1;
       }

       /* Success!  */
       return 0;
}

static void
aesbear_xts_enc(const struct aesenc *enc, const uint8_t in[static 16],
   uint8_t out[static 16], size_t nbytes, uint8_t tweak[static 16],
   uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];
       uint32_t t0, t1, t2, t3, u0, u1, u2, u3;

       KASSERT(nbytes % 16 == 0);

       /* Skip if there's nothing to do.  */
       if (nbytes == 0)
               return;

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, enc->aese_aes.aes_rk);

       /* Load tweak.  */
       t0 = le32dec(tweak + 4*0);
       t1 = le32dec(tweak + 4*1);
       t2 = le32dec(tweak + 4*2);
       t3 = le32dec(tweak + 4*3);

       /* Handle the first block separately if odd number.  */
       if (nbytes % 32) {
               KASSERT(nbytes % 32 == 16);

               /* Load up the first block and a garbage block.  */
               q[2*0] = le32dec(in + 4*0) ^ t0;
               q[2*1] = le32dec(in + 4*1) ^ t1;
               q[2*2] = le32dec(in + 4*2) ^ t2;
               q[2*3] = le32dec(in + 4*3) ^ t3;
               q[1] = q[3] = q[5] = q[7] = 0;

               /* Encrypt two blocks.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* Store the first cipher block.  */
               le32enc(out + 4*0, q[2*0] ^ t0);
               le32enc(out + 4*1, q[2*1] ^ t1);
               le32enc(out + 4*2, q[2*2] ^ t2);
               le32enc(out + 4*3, q[2*3] ^ t3);

               /* Advance to the next block.  */
               aesbear_xts_update(&t0, &t1, &t2, &t3);
               if ((nbytes -= 16) == 0)
                       goto out;
               in += 16;
               out += 16;
       }

       do {
               KASSERT(nbytes >= 32);

               /* Compute the upper tweak.  */
               u0 = t0; u1 = t1; u2 = t2; u3 = t3;
               aesbear_xts_update(&u0, &u1, &u2, &u3);

               /* Load lower and upper blocks.  */
               q[2*0] = le32dec(in + 4*0) ^ t0;
               q[2*1] = le32dec(in + 4*1) ^ t1;
               q[2*2] = le32dec(in + 4*2) ^ t2;
               q[2*3] = le32dec(in + 4*3) ^ t3;
               q[2*0 + 1] = le32dec(in + 16 + 4*0) ^ u0;
               q[2*1 + 1] = le32dec(in + 16 + 4*1) ^ u1;
               q[2*2 + 1] = le32dec(in + 16 + 4*2) ^ u2;
               q[2*3 + 1] = le32dec(in + 16 + 4*3) ^ u3;

               /* Encrypt two blocks.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* Store lower and upper blocks.  */
               le32enc(out + 4*0, q[2*0] ^ t0);
               le32enc(out + 4*1, q[2*1] ^ t1);
               le32enc(out + 4*2, q[2*2] ^ t2);
               le32enc(out + 4*3, q[2*3] ^ t3);
               le32enc(out + 16 + 4*0, q[2*0 + 1] ^ u0);
               le32enc(out + 16 + 4*1, q[2*1 + 1] ^ u1);
               le32enc(out + 16 + 4*2, q[2*2 + 1] ^ u2);
               le32enc(out + 16 + 4*3, q[2*3 + 1] ^ u3);

               /* Advance to the next pair of blocks.  */
               t0 = u0; t1 = u1; t2 = u2; t3 = u3;
               aesbear_xts_update(&t0, &t1, &t2, &t3);
               in += 32;
               out += 32;
       } while (nbytes -= 32, nbytes);

out:    /* Store the updated tweak.  */
       le32enc(tweak + 4*0, t0);
       le32enc(tweak + 4*1, t1);
       le32enc(tweak + 4*2, t2);
       le32enc(tweak + 4*3, t3);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static void
aesbear_xts_dec(const struct aesdec *dec, const uint8_t in[static 16],
   uint8_t out[static 16], size_t nbytes, uint8_t tweak[static 16],
   uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];
       uint32_t t0, t1, t2, t3, u0, u1, u2, u3;

       KASSERT(nbytes % 16 == 0);

       /* Skip if there's nothing to do.  */
       if (nbytes == 0)
               return;

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, dec->aesd_aes.aes_rk);

       /* Load tweak.  */
       t0 = le32dec(tweak + 4*0);
       t1 = le32dec(tweak + 4*1);
       t2 = le32dec(tweak + 4*2);
       t3 = le32dec(tweak + 4*3);

       /* Handle the first block separately if odd number.  */
       if (nbytes % 32) {
               KASSERT(nbytes % 32 == 16);

               /* Load up the first block and a garbage block.  */
               q[2*0] = le32dec(in + 4*0) ^ t0;
               q[2*1] = le32dec(in + 4*1) ^ t1;
               q[2*2] = le32dec(in + 4*2) ^ t2;
               q[2*3] = le32dec(in + 4*3) ^ t3;
               q[1] = q[3] = q[5] = q[7] = 0;

               /* Decrypt two blocks.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_decrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* Store the first cipher block.  */
               le32enc(out + 4*0, q[2*0] ^ t0);
               le32enc(out + 4*1, q[2*1] ^ t1);
               le32enc(out + 4*2, q[2*2] ^ t2);
               le32enc(out + 4*3, q[2*3] ^ t3);

               /* Advance to the next block.  */
               aesbear_xts_update(&t0, &t1, &t2, &t3);
               if ((nbytes -= 16) == 0)
                       goto out;
               in += 16;
               out += 16;
       }

       do {
               KASSERT(nbytes >= 32);

               /* Compute the upper tweak.  */
               u0 = t0; u1 = t1; u2 = t2; u3 = t3;
               aesbear_xts_update(&u0, &u1, &u2, &u3);

               /* Load lower and upper blocks.  */
               q[2*0] = le32dec(in + 4*0) ^ t0;
               q[2*1] = le32dec(in + 4*1) ^ t1;
               q[2*2] = le32dec(in + 4*2) ^ t2;
               q[2*3] = le32dec(in + 4*3) ^ t3;
               q[2*0 + 1] = le32dec(in + 16 + 4*0) ^ u0;
               q[2*1 + 1] = le32dec(in + 16 + 4*1) ^ u1;
               q[2*2 + 1] = le32dec(in + 16 + 4*2) ^ u2;
               q[2*3 + 1] = le32dec(in + 16 + 4*3) ^ u3;

               /* Encrypt two blocks.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_decrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* Store lower and upper blocks.  */
               le32enc(out + 4*0, q[2*0] ^ t0);
               le32enc(out + 4*1, q[2*1] ^ t1);
               le32enc(out + 4*2, q[2*2] ^ t2);
               le32enc(out + 4*3, q[2*3] ^ t3);
               le32enc(out + 16 + 4*0, q[2*0 + 1] ^ u0);
               le32enc(out + 16 + 4*1, q[2*1 + 1] ^ u1);
               le32enc(out + 16 + 4*2, q[2*2 + 1] ^ u2);
               le32enc(out + 16 + 4*3, q[2*3 + 1] ^ u3);

               /* Advance to the next pair of blocks.  */
               t0 = u0; t1 = u1; t2 = u2; t3 = u3;
               aesbear_xts_update(&t0, &t1, &t2, &t3);
               in += 32;
               out += 32;
       } while (nbytes -= 32, nbytes);

out:    /* Store the updated tweak.  */
       le32enc(tweak + 4*0, t0);
       le32enc(tweak + 4*1, t1);
       le32enc(tweak + 4*2, t2);
       le32enc(tweak + 4*3, t3);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static void
aesbear_cbcmac_update1(const struct aesenc *enc, const uint8_t in[static 16],
   size_t nbytes, uint8_t auth[static 16], uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];

       KASSERT(nbytes);
       KASSERT(nbytes % 16 == 0);

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, enc->aese_aes.aes_rk);

       /* Initialize garbage block.  */
       q[1] = q[3] = q[5] = q[7] = 0;

       /* Load initial authenticator.  */
       q[2*0] = le32dec(auth + 4*0);
       q[2*1] = le32dec(auth + 4*1);
       q[2*2] = le32dec(auth + 4*2);
       q[2*3] = le32dec(auth + 4*3);

       for (; nbytes; nbytes -= 16, in += 16) {
               /* Combine input block.  */
               q[2*0] ^= le32dec(in + 4*0);
               q[2*1] ^= le32dec(in + 4*1);
               q[2*2] ^= le32dec(in + 4*2);
               q[2*3] ^= le32dec(in + 4*3);

               /* Transform to bitslice, encrypt, transform from bitslice.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);
       }

       /* Store updated authenticator.  */
       le32enc(auth + 4*0, q[2*0]);
       le32enc(auth + 4*1, q[2*1]);
       le32enc(auth + 4*2, q[2*2]);
       le32enc(auth + 4*3, q[2*3]);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static void
aesbear_ccm_enc1(const struct aesenc *enc, const uint8_t *in, uint8_t *out,
   size_t nbytes, uint8_t authctr[32], uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];
       uint32_t c0, c1, c2, c3;

       KASSERT(nbytes);
       KASSERT(nbytes % 16 == 0);

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, enc->aese_aes.aes_rk);

       /* Set first block to authenticator.  */
       q[2*0] = le32dec(authctr + 4*0);
       q[2*1] = le32dec(authctr + 4*1);
       q[2*2] = le32dec(authctr + 4*2);
       q[2*3] = le32dec(authctr + 4*3);

       /* Load initial counter block, big-endian so we can increment it.  */
       c0 = le32dec(authctr + 16 + 4*0);
       c1 = le32dec(authctr + 16 + 4*1);
       c2 = le32dec(authctr + 16 + 4*2);
       c3 = be32dec(authctr + 16 + 4*3);

       for (; nbytes; nbytes -= 16, in += 16, out += 16) {
               /* Update authenticator.  */
               q[2*0] ^= le32dec(in + 4*0);
               q[2*1] ^= le32dec(in + 4*1);
               q[2*2] ^= le32dec(in + 4*2);
               q[2*3] ^= le32dec(in + 4*3);

               /* Increment 32-bit counter.  */
               q[2*0 + 1] = c0;
               q[2*1 + 1] = c1;
               q[2*2 + 1] = c2;
               q[2*3 + 1] = bswap32(++c3);

               /* Encrypt authenticator and counter.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);

               /* Encrypt with CTR output.  */
               le32enc(out + 4*0, le32dec(in + 4*0) ^ q[2*0 + 1]);
               le32enc(out + 4*1, le32dec(in + 4*1) ^ q[2*1 + 1]);
               le32enc(out + 4*2, le32dec(in + 4*2) ^ q[2*2 + 1]);
               le32enc(out + 4*3, le32dec(in + 4*3) ^ q[2*3 + 1]);
       }

       /* Update authenticator.  */
       le32enc(authctr + 4*0, q[2*0]);
       le32enc(authctr + 4*1, q[2*1]);
       le32enc(authctr + 4*2, q[2*2]);
       le32enc(authctr + 4*3, q[2*3]);

       /* Update counter.  */
       be32enc(authctr + 16 + 4*3, c3);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static void
aesbear_ccm_dec1(const struct aesenc *enc, const uint8_t *in, uint8_t *out,
   size_t nbytes, uint8_t authctr[32], uint32_t nrounds)
{
       uint32_t sk_exp[120];
       uint32_t q[8];
       uint32_t c0, c1, c2, c3;
       uint32_t b0, b1, b2, b3;

       KASSERT(nbytes);
       KASSERT(nbytes % 16 == 0);

       /* Expand round keys for bitslicing.  */
       br_aes_ct_skey_expand(sk_exp, nrounds, enc->aese_aes.aes_rk);

       /* Load initial counter block, big-endian so we can increment it.  */
       c0 = le32dec(authctr + 16 + 4*0);
       c1 = le32dec(authctr + 16 + 4*1);
       c2 = le32dec(authctr + 16 + 4*2);
       c3 = be32dec(authctr + 16 + 4*3);

       /* Increment 32-bit counter.  */
       q[2*0] = c0;
       q[2*1] = c1;
       q[2*2] = c2;
       q[2*3] = bswap32(++c3);

       /*
        * Set the second block to garbage -- we don't have any
        * plaintext to authenticate yet.
        */
       q[1] = q[3] = q[5] = q[7] = 0;

       /* Encrypt first CTR.  */
       br_aes_ct_ortho(q);
       br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
       br_aes_ct_ortho(q);

       /* Load the initial authenticator.  */
       q[2*0 + 1] = le32dec(authctr + 4*0);
       q[2*1 + 1] = le32dec(authctr + 4*1);
       q[2*2 + 1] = le32dec(authctr + 4*2);
       q[2*3 + 1] = le32dec(authctr + 4*3);

       for (;; in += 16, out += 16) {
               /* Decrypt the block.  */
               b0 = le32dec(in + 4*0) ^ q[2*0];
               b1 = le32dec(in + 4*1) ^ q[2*1];
               b2 = le32dec(in + 4*2) ^ q[2*2];
               b3 = le32dec(in + 4*3) ^ q[2*3];

               /* Update authenticator.  */
               q[2*0 + 1] ^= b0;
               q[2*1 + 1] ^= b1;
               q[2*2 + 1] ^= b2;
               q[2*3 + 1] ^= b3;

               /* Store plaintext.  */
               le32enc(out + 4*0, b0);
               le32enc(out + 4*1, b1);
               le32enc(out + 4*2, b2);
               le32enc(out + 4*3, b3);

               /* If this is the last block, stop.  */
               if ((nbytes -= 16) == 0)
                       break;

               /* Increment 32-bit counter.  */
               q[2*0] = c0;
               q[2*1] = c1;
               q[2*2] = c2;
               q[2*3] = bswap32(++c3);

               /* Authenticate previous plaintext, encrypt next CTR.  */
               br_aes_ct_ortho(q);
               br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
               br_aes_ct_ortho(q);
       }

       /*
        * Authenticate last plaintext.  We're only doing this for the
        * authenticator, not for the counter, so don't bother to
        * initialize q[2*i].  (Even for the sake of sanitizers,
        * they're already initialized to something by now.)
        */
       br_aes_ct_ortho(q);
       br_aes_ct_bitslice_encrypt(nrounds, sk_exp, q);
       br_aes_ct_ortho(q);

       /* Update authenticator.  */
       le32enc(authctr + 4*0, q[2*0 + 1]);
       le32enc(authctr + 4*1, q[2*1 + 1]);
       le32enc(authctr + 4*2, q[2*2 + 1]);
       le32enc(authctr + 4*3, q[2*3 + 1]);

       /* Update counter.  */
       be32enc(authctr + 16 + 4*3, c3);

       /* Paranoia: Zero temporary buffers.  */
       explicit_memset(sk_exp, 0, sizeof sk_exp);
       explicit_memset(q, 0, sizeof q);
}

static int
aesbear_probe(void)
{

       if (aesbear_xts_update_selftest())
               return -1;

       /* XXX test br_aes_ct_bitslice_decrypt */
       /* XXX test br_aes_ct_bitslice_encrypt */
       /* XXX test br_aes_ct_keysched */
       /* XXX test br_aes_ct_ortho */
       /* XXX test br_aes_ct_skey_expand */

       return 0;
}

struct aes_impl aes_bear_impl = {
       .ai_name = "BearSSL aes_ct",
       .ai_probe = aesbear_probe,
       .ai_setenckey = aesbear_setenckey,
       .ai_setdeckey = aesbear_setdeckey,
       .ai_enc = aesbear_enc,
       .ai_dec = aesbear_dec,
       .ai_cbc_enc = aesbear_cbc_enc,
       .ai_cbc_dec = aesbear_cbc_dec,
       .ai_xts_enc = aesbear_xts_enc,
       .ai_xts_dec = aesbear_xts_dec,
       .ai_cbcmac_update1 = aesbear_cbcmac_update1,
       .ai_ccm_enc1 = aesbear_ccm_enc1,
       .ai_ccm_dec1 = aesbear_ccm_dec1,
};

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.