Skip to content

Commit df189b5

Browse files
jedisct1jedisct1
committed
Update 128X4 to the new MAC API
1 parent 57ade7c commit df189b5

File tree

10 files changed

+208
-43
lines changed

10 files changed

+208
-43
lines changed

‎src/aegis128x4/aegis128x4.c

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -177,19 +177,19 @@ aegis128x4_decrypt_unauthenticated(uint8_t *m, const uint8_t *c, size_t clen, co
177177
}
178178

179179
void
180-
aegis128x4_mac_init(aegis128x4_state *st_, const uint8_t *k, const uint8_t *npub)
180+
aegis128x4_mac_init(aegis128x4_mac_state *st_, const uint8_t *k, const uint8_t *npub)
181181
{
182-
implementation->state_init(st_, NULL, 0, npub, k);
182+
implementation->state_mac_init(st_, npub, k);
183183
}
184184

185185
int
186-
aegis128x4_mac_update(aegis128x4_state *st_, const uint8_t *m, size_t mlen)
186+
aegis128x4_mac_update(aegis128x4_mac_state *st_, const uint8_t *m, size_t mlen)
187187
{
188188
return implementation->state_mac_update(st_, m, mlen);
189189
}
190190

191191
int
192-
aegis128x4_mac_final(aegis128x4_state *st_, uint8_t *mac, size_t maclen)
192+
aegis128x4_mac_final(aegis128x4_mac_state *st_, uint8_t *mac, size_t maclen)
193193
{
194194
if (maclen != 16 && maclen != 32) {
195195
errno = EINVAL;
@@ -199,7 +199,7 @@ aegis128x4_mac_final(aegis128x4_state *st_, uint8_t *mac, size_t maclen)
199199
}
200200

201201
int
202-
aegis128x4_mac_verify(aegis128x4_state *st_, const uint8_t *mac, size_t maclen)
202+
aegis128x4_mac_verify(aegis128x4_mac_state *st_, const uint8_t *mac, size_t maclen)
203203
{
204204
uint8_t expected_mac[32];
205205

@@ -217,9 +217,15 @@ aegis128x4_mac_verify(aegis128x4_state *st_, const uint8_t *mac, size_t maclen)
217217
}
218218

219219
void
220-
aegis128x4_mac_state_clone(aegis128x4_state *dst, const aegis128x4_state *src)
220+
aegis128x4_mac_reset(aegis128x4_mac_state *st_)
221221
{
222-
implementation->state_clone(dst, src);
222+
implementation->state_mac_reset(st_);
223+
}
224+
225+
void
226+
aegis128x4_mac_state_clone(aegis128x4_mac_state *dst, const aegis128x4_mac_state *src)
227+
{
228+
implementation->state_mac_clone(dst, src);
223229
}
224230

225231
int

‎src/aegis128x4/aegis128x4_aesni.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,11 @@ struct aegis128x4_implementation aegis128x4_aesni_implementation = {
107107
.state_encrypt_final = state_encrypt_final,
108108
.state_decrypt_detached_update = state_decrypt_detached_update,
109109
.state_decrypt_detached_final = state_decrypt_detached_final,
110+
.state_mac_init = state_mac_init,
110111
.state_mac_update = state_mac_update,
111112
.state_mac_final = state_mac_final,
112-
.state_clone = state_clone,
113+
.state_mac_reset = state_mac_reset,
114+
.state_mac_clone = state_mac_clone,
113115
};
114116

115117
# ifdef __clang__

‎src/aegis128x4/aegis128x4_altivec.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,11 @@ struct aegis128x4_implementation aegis128x4_altivec_implementation = {
101101
.state_encrypt_final = state_encrypt_final,
102102
.state_decrypt_detached_update = state_decrypt_detached_update,
103103
.state_decrypt_detached_final = state_decrypt_detached_final,
104+
.state_mac_init = state_mac_init,
104105
.state_mac_update = state_mac_update,
105106
.state_mac_final = state_mac_final,
106-
.state_clone = state_clone,
107+
.state_mac_reset = state_mac_reset,
108+
.state_mac_clone = state_mac_clone,
107109
};
108110

109111
# ifdef __clang__

‎src/aegis128x4/aegis128x4_armcrypto.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,11 @@ struct aegis128x4_implementation aegis128x4_armcrypto_implementation = {
109109
.state_encrypt_final = state_encrypt_final,
110110
.state_decrypt_detached_update = state_decrypt_detached_update,
111111
.state_decrypt_detached_final = state_decrypt_detached_final,
112+
.state_mac_init = state_mac_init,
112113
.state_mac_update = state_mac_update,
113114
.state_mac_final = state_mac_final,
114-
.state_clone = state_clone,
115+
.state_mac_reset = state_mac_reset,
116+
.state_mac_clone = state_mac_clone,
115117
};
116118

117119
# ifdef __clang__

‎src/aegis128x4/aegis128x4_avx2.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,11 @@ struct aegis128x4_implementation aegis128x4_avx2_implementation = {
9999
.state_encrypt_final = state_encrypt_final,
100100
.state_decrypt_detached_update = state_decrypt_detached_update,
101101
.state_decrypt_detached_final = state_decrypt_detached_final,
102+
.state_mac_init = state_mac_init,
102103
.state_mac_update = state_mac_update,
103104
.state_mac_final = state_mac_final,
104-
.state_clone = state_clone,
105+
.state_mac_reset = state_mac_reset,
106+
.state_mac_clone = state_mac_clone,
105107
};
106108

107109
# ifdef __clang__

‎src/aegis128x4/aegis128x4_avx512.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,11 @@ struct aegis128x4_implementation aegis128x4_avx512_implementation = {
7272
.state_encrypt_final = state_encrypt_final,
7373
.state_decrypt_detached_update = state_decrypt_detached_update,
7474
.state_decrypt_detached_final = state_decrypt_detached_final,
75+
.state_mac_init = state_mac_init,
7576
.state_mac_update = state_mac_update,
7677
.state_mac_final = state_mac_final,
77-
.state_clone = state_clone,
78+
.state_mac_reset = state_mac_reset,
79+
.state_mac_clone = state_mac_clone,
7880
};
7981

8082
# ifdef __clang__

‎src/aegis128x4/aegis128x4_common.h

Lines changed: 128 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,76 @@ aegis128x4_declast(uint8_t *const dst, const uint8_t *const src, size_t len,
192192
aegis128x4_update(state, msg0, msg1);
193193
}
194194

195+
static void
196+
aegis128x4_mac_nr(uint8_t *mac, size_t maclen, uint64_t adlen, aes_block_t *state)
197+
{
198+
uint8_t t[2 * AES_BLOCK_LENGTH];
199+
uint8_t r[RATE];
200+
aes_block_t tmp;
201+
int i;
202+
const int d = AES_BLOCK_LENGTH / 16;
203+
204+
tmp = AES_BLOCK_LOAD_64x2(0, adlen << 3);
205+
tmp = AES_BLOCK_XOR(tmp, state[2]);
206+
207+
for (i = 0; i < 7; i++) {
208+
aegis128x4_update(state, tmp, tmp);
209+
}
210+
211+
memset(r, 0, sizeof r);
212+
if (maclen == 16) {
213+
#if AES_BLOCK_LENGTH > 16
214+
tmp = AES_BLOCK_XOR(state[6], AES_BLOCK_XOR(state[5], state[4]));
215+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[3], state[2]));
216+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0]));
217+
AES_BLOCK_STORE(t, tmp);
218+
for (i = 0; i < d / 2; i++) {
219+
memcpy(r, t + i * 32, 32);
220+
aegis128x4_absorb(r, state);
221+
}
222+
tmp = AES_BLOCK_LOAD_64x2(d, maclen);
223+
tmp = AES_BLOCK_XOR(tmp, state[2]);
224+
for (i = 0; i < 7; i++) {
225+
aegis128x4_update(state, tmp, tmp);
226+
}
227+
#endif
228+
tmp = AES_BLOCK_XOR(state[6], AES_BLOCK_XOR(state[5], state[4]));
229+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[3], state[2]));
230+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0]));
231+
AES_BLOCK_STORE(t, tmp);
232+
memcpy(mac, t, 16);
233+
} else if (maclen == 32) {
234+
#if AES_BLOCK_LENGTH > 16
235+
tmp = AES_BLOCK_XOR(state[3], state[2]);
236+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0]));
237+
AES_BLOCK_STORE(t, tmp);
238+
tmp = AES_BLOCK_XOR(state[7], state[6]);
239+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[5], state[4]));
240+
AES_BLOCK_STORE(t + AES_BLOCK_LENGTH, tmp);
241+
for (i = 1; i < d; i++) {
242+
memcpy(r, t + i * 16, 16);
243+
memcpy(r + 16, t + AES_BLOCK_LENGTH + i * 16, 16);
244+
aegis128x4_absorb(r, state);
245+
}
246+
tmp = AES_BLOCK_LOAD_64x2(d, maclen);
247+
tmp = AES_BLOCK_XOR(tmp, state[2]);
248+
for (i = 0; i < 7; i++) {
249+
aegis128x4_update(state, tmp, tmp);
250+
}
251+
#endif
252+
tmp = AES_BLOCK_XOR(state[3], state[2]);
253+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0]));
254+
AES_BLOCK_STORE(t, tmp);
255+
memcpy(mac, t, 16);
256+
tmp = AES_BLOCK_XOR(state[7], state[6]);
257+
tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[5], state[4]));
258+
AES_BLOCK_STORE(t, tmp);
259+
memcpy(mac + 16, t, 16);
260+
} else {
261+
memset(mac, 0, maclen);
262+
}
263+
}
264+
195265
static int
196266
encrypt_detached(uint8_t *c, uint8_t *mac, size_t maclen, const uint8_t *m, size_t mlen,
197267
const uint8_t *ad, size_t adlen, const uint8_t *npub, const uint8_t *k)
@@ -351,6 +421,14 @@ typedef struct _aegis128x4_state {
351421
size_t pos;
352422
} _aegis128x4_state;
353423

424+
typedef struct _aegis128x4_mac_state {
425+
aegis_blocks blocks0;
426+
aegis_blocks blocks;
427+
uint8_t buf[RATE];
428+
uint64_t adlen;
429+
size_t pos;
430+
} _aegis128x4_mac_state;
431+
354432
static void
355433
state_init(aegis128x4_state *st_, const uint8_t *ad, size_t adlen, const uint8_t *npub,
356434
const uint8_t *k)
@@ -619,13 +697,33 @@ state_decrypt_detached_final(aegis128x4_state *st_, uint8_t *m, size_t mlen_max,
619697
return ret;
620698
}
621699

700+
static void
701+
state_mac_init(aegis128x4_mac_state *st_, const uint8_t *npub, const uint8_t *k)
702+
{
703+
aegis_blocks blocks;
704+
_aegis128x4_mac_state *const st =
705+
(_aegis128x4_mac_state *) ((((uintptr_t) &st_->opaque) + (ALIGNMENT - 1)) &
706+
~(uintptr_t) (ALIGNMENT - 1));
707+
708+
COMPILER_ASSERT((sizeof *st) + ALIGNMENT <= sizeof *st_);
709+
st->pos = 0;
710+
711+
memcpy(blocks, st->blocks, sizeof blocks);
712+
713+
aegis128x4_init(k, npub, blocks);
714+
715+
memcpy(st->blocks0, blocks, sizeof blocks);
716+
memcpy(st->blocks, blocks, sizeof blocks);
717+
st->adlen = 0;
718+
}
719+
622720
static int
623-
state_mac_update(aegis128x4_state *st_, const uint8_t *ad, size_t adlen)
721+
state_mac_update(aegis128x4_mac_state *st_, const uint8_t *ad, size_t adlen)
624722
{
625-
aegis_blocks blocks;
626-
_aegis128x4_state *const st =
627-
(_aegis128x4_state *) ((((uintptr_t) &st_->opaque) + (ALIGNMENT - 1)) &
628-
~(uintptr_t) (ALIGNMENT - 1));
723+
aegis_blocks blocks;
724+
_aegis128x4_mac_state *const st =
725+
(_aegis128x4_mac_state *) ((((uintptr_t) &st_->opaque) + (ALIGNMENT - 1)) &
726+
~(uintptr_t) (ALIGNMENT - 1));
629727
size_t i;
630728
size_t left;
631729

@@ -669,12 +767,12 @@ state_mac_update(aegis128x4_state *st_, const uint8_t *ad, size_t adlen)
669767
}
670768

671769
static int
672-
state_mac_final(aegis128x4_state *st_, uint8_t *mac, size_t maclen)
770+
state_mac_final(aegis128x4_mac_state *st_, uint8_t *mac, size_t maclen)
673771
{
674-
aegis_blocks blocks;
675-
_aegis128x4_state *const st =
676-
(_aegis128x4_state *) ((((uintptr_t) &st_->opaque) + (ALIGNMENT - 1)) &
677-
~(uintptr_t) (ALIGNMENT - 1));
772+
aegis_blocks blocks;
773+
_aegis128x4_mac_state *const st =
774+
(_aegis128x4_mac_state *) ((((uintptr_t) &st_->opaque) + (ALIGNMENT - 1)) &
775+
~(uintptr_t) (ALIGNMENT - 1));
678776
size_t left;
679777

680778
memcpy(blocks, st->blocks, sizeof blocks);
@@ -684,21 +782,32 @@ state_mac_final(aegis128x4_state *st_, uint8_t *mac, size_t maclen)
684782
memset(st->buf + left, 0, RATE - left);
685783
aegis128x4_absorb(st->buf, blocks);
686784
}
687-
aegis128x4_mac(mac, maclen, st->adlen, 0, blocks);
785+
aegis128x4_mac_nr(mac, maclen, st->adlen, blocks);
688786

689787
memcpy(st->blocks, blocks, sizeof blocks);
690788

691789
return 0;
692790
}
693791

694792
static void
695-
state_clone(aegis128x4_state *dst, const aegis128x4_state *src)
793+
state_mac_reset(aegis128x4_mac_state *st_)
696794
{
697-
_aegis128x4_state *const dst_ =
698-
(_aegis128x4_state *) ((((uintptr_t) &dst->opaque) + (ALIGNMENT - 1)) &
699-
~(uintptr_t) (ALIGNMENT - 1));
700-
const _aegis128x4_state *const src_ =
701-
(const _aegis128x4_state *) ((((uintptr_t) &src->opaque) + (ALIGNMENT - 1)) &
702-
~(uintptr_t) (ALIGNMENT - 1));
795+
_aegis128x4_mac_state *const st =
796+
(_aegis128x4_mac_state *) ((((uintptr_t) &st_->opaque) + (ALIGNMENT - 1)) &
797+
~(uintptr_t) (ALIGNMENT - 1));
798+
st->adlen = 0;
799+
st->pos = 0;
800+
memcpy(st->blocks, st->blocks0, sizeof(aegis_blocks));
801+
}
802+
803+
static void
804+
state_mac_clone(aegis128x4_mac_state *dst, const aegis128x4_mac_state *src)
805+
{
806+
_aegis128x4_mac_state *const dst_ =
807+
(_aegis128x4_mac_state *) ((((uintptr_t) &dst->opaque) + (ALIGNMENT - 1)) &
808+
~(uintptr_t) (ALIGNMENT - 1));
809+
const _aegis128x4_mac_state *const src_ =
810+
(const _aegis128x4_mac_state *) ((((uintptr_t) &src->opaque) + (ALIGNMENT - 1)) &
811+
~(uintptr_t) (ALIGNMENT - 1));
703812
*dst_ = *src_;
704-
}
813+
}

‎src/aegis128x4/implementations.h

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,11 @@ typedef struct aegis128x4_implementation {
2929
size_t *written, const uint8_t *c, size_t clen);
3030
int (*state_decrypt_detached_final)(aegis128x4_state *st_, uint8_t *m, size_t mlen_max,
3131
size_t *written, const uint8_t *mac, size_t maclen);
32-
int (*state_mac_update)(aegis128x4_state *st_, const uint8_t *ad, size_t adlen);
33-
int (*state_mac_final)(aegis128x4_state *st_, uint8_t *mac, size_t maclen);
34-
void (*state_clone)(aegis128x4_state *dst, const aegis128x4_state *src);
32+
void (*state_mac_init)(aegis128x4_mac_state *st_, const uint8_t *npub, const uint8_t *k);
33+
int (*state_mac_update)(aegis128x4_mac_state *st_, const uint8_t *ad, size_t adlen);
34+
int (*state_mac_final)(aegis128x4_mac_state *st_, uint8_t *mac, size_t maclen);
35+
void (*state_mac_reset)(aegis128x4_mac_state *st);
36+
void (*state_mac_clone)(aegis128x4_mac_state *dst, const aegis128x4_mac_state *src);
3537
} aegis128x4_implementation;
3638

3739
#endif

‎src/include/aegis128x4.h

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ typedef struct aegis128x4_state {
3131
CRYPTO_ALIGN(64) uint8_t opaque[832];
3232
} aegis128x4_state;
3333

34+
/* An AEGIS state, only for MAC updates */
35+
typedef struct aegis128x4_mac_state {
36+
CRYPTO_ALIGN(32) uint8_t opaque[1664];
37+
} aegis128x4_mac_state;
38+
3439
/* The length of an AEGIS key, in bytes */
3540
size_t aegis128x4_keybytes(void);
3641

@@ -258,13 +263,12 @@ void aegis128x4_decrypt_unauthenticated(uint8_t *m, const uint8_t *c, size_t cle
258263
* k: key input buffer (16 bytes)
259264
*
260265
* - The same key MUST NOT be used both for MAC and encryption.
261-
* - The nonce MUST NOT be reused with the same key.
262266
* - If the key is secret, the MAC is secure against forgery.
263267
* - However, if the key is known, arbitrary inputs matching a tag can be efficiently computed.
264268
*
265269
* The recommended way to use the MAC mode is to generate a random key and keep it secret.
266270
*/
267-
void aegis128x4_mac_init(aegis128x4_state *st_, const uint8_t *k, const uint8_t *npub);
271+
void aegis128x4_mac_init(aegis128x4_mac_state *st_, const uint8_t *k, const uint8_t *npub);
268272

269273
/*
270274
* Update the MAC state with input data.
@@ -277,7 +281,7 @@ void aegis128x4_mac_init(aegis128x4_state *st_, const uint8_t *k, const uint8_t
277281
*
278282
* Once the full input has been absorb, call either `_mac_final` or `_mac_verify`.
279283
*/
280-
int aegis128x4_mac_update(aegis128x4_state *st_, const uint8_t *m, size_t mlen);
284+
int aegis128x4_mac_update(aegis128x4_mac_state *st_, const uint8_t *m, size_t mlen);
281285

282286
/*
283287
* Finalize the MAC and generate the authentication tag.
@@ -286,7 +290,7 @@ int aegis128x4_mac_update(aegis128x4_state *st_, const uint8_t *m, size_t mlen);
286290
* mac: authentication tag output buffer
287291
* maclen: length of the authentication tag to generate (16 or 32. 32 is recommended).
288292
*/
289-
int aegis128x4_mac_final(aegis128x4_state *st_, uint8_t *mac, size_t maclen);
293+
int aegis128x4_mac_final(aegis128x4_mac_state *st_, uint8_t *mac, size_t maclen);
290294

291295
/*
292296
* Verify a MAC in constant time.
@@ -297,7 +301,12 @@ int aegis128x4_mac_final(aegis128x4_state *st_, uint8_t *mac, size_t maclen);
297301
*
298302
* Returns 0 if the tag is authentic, -1 otherwise.
299303
*/
300-
int aegis128x4_mac_verify(aegis128x4_state *st_, const uint8_t *mac, size_t maclen);
304+
int aegis128x4_mac_verify(aegis128x4_mac_state *st_, const uint8_t *mac, size_t maclen);
305+
306+
/*
307+
* Reset an AEGIS_MAC state.
308+
*/
309+
void aegis128x4_mac_reset(aegis128x4_mac_state *st_);
301310

302311
/*
303312
* Clone an AEGIS-MAC state.
@@ -307,7 +316,7 @@ int aegis128x4_mac_verify(aegis128x4_state *st_, const uint8_t *mac, size_t macl
307316
*
308317
* This function MUST be used in order to clone states.
309318
*/
310-
void aegis128x4_mac_state_clone(aegis128x4_state *dst, const aegis128x4_state *src);
319+
void aegis128x4_mac_state_clone(aegis128x4_mac_state *dst, const aegis128x4_mac_state *src);
311320

312321
#ifdef __cplusplus
313322
}

0 commit comments

Comments
 (0)