]>
Commit | Line | Data |
---|---|---|
4f22f405 RS |
1 | /* |
2 | * Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved. | |
85b2c0ce | 3 | * |
81cae8ce | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
4f22f405 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
85b2c0ce AP |
8 | */ |
9 | ||
85b2c0ce | 10 | #include <string.h> |
459b15d4 SL |
11 | #include <openssl/crypto.h> |
12 | #include "internal/modes_int.h" | |
85b2c0ce | 13 | |
0f113f3e MC |
14 | /* |
15 | * NOTE: the IV/counter CTR mode is big-endian. The code itself is | |
16 | * endian-neutral. | |
17 | */ | |
85b2c0ce AP |
18 | |
19 | /* increment counter (128-bit int) by 1 */ | |
0f113f3e MC |
20 | static void ctr128_inc(unsigned char *counter) |
21 | { | |
5e4bbeb4 | 22 | u32 n = 16, c = 1; |
0f113f3e MC |
23 | |
24 | do { | |
25 | --n; | |
5e4bbeb4 AP |
26 | c += counter[n]; |
27 | counter[n] = (u8)c; | |
28 | c >>= 8; | |
0f113f3e | 29 | } while (n); |
85b2c0ce AP |
30 | } |
31 | ||
f62df694 | 32 | #if !defined(OPENSSL_SMALL_FOOTPRINT) |
0f113f3e MC |
33 | static void ctr128_inc_aligned(unsigned char *counter) |
34 | { | |
5e4bbeb4 | 35 | size_t *data, c, d, n; |
0f113f3e MC |
36 | const union { |
37 | long one; | |
38 | char little; | |
39 | } is_endian = { | |
40 | 1 | |
41 | }; | |
42 | ||
5e4bbeb4 | 43 | if (is_endian.little || ((size_t)counter % sizeof(size_t)) != 0) { |
0f113f3e MC |
44 | ctr128_inc(counter); |
45 | return; | |
46 | } | |
47 | ||
48 | data = (size_t *)counter; | |
5e4bbeb4 | 49 | c = 1; |
0f113f3e MC |
50 | n = 16 / sizeof(size_t); |
51 | do { | |
52 | --n; | |
5e4bbeb4 AP |
53 | d = data[n] += c; |
54 | /* did addition carry? */ | |
76f572ed | 55 | c = ((d - c) & ~d) >> (sizeof(size_t) * 8 - 1); |
0f113f3e | 56 | } while (n); |
85b2c0ce AP |
57 | } |
58 | #endif | |
59 | ||
0f113f3e MC |
60 | /* |
61 | * The input encrypted as though 128bit counter mode is being used. The | |
62 | * extra state information to record how much of the 128bit block we have | |
63 | * used is contained in *num, and the encrypted counter is kept in | |
64 | * ecount_buf. Both *num and ecount_buf must be initialised with zeros | |
65 | * before the first call to CRYPTO_ctr128_encrypt(). This algorithm assumes | |
66 | * that the counter is in the x lower bits of the IV (ivec), and that the | |
67 | * application has full control over overflow and the rest of the IV. This | |
0d4fb843 | 68 | * implementation takes NO responsibility for checking that the counter |
0f113f3e | 69 | * doesn't overflow into the rest of the IV when incremented. |
85b2c0ce AP |
70 | */ |
71 | void CRYPTO_ctr128_encrypt(const unsigned char *in, unsigned char *out, | |
0f113f3e MC |
72 | size_t len, const void *key, |
73 | unsigned char ivec[16], | |
74 | unsigned char ecount_buf[16], unsigned int *num, | |
75 | block128_f block) | |
85b2c0ce | 76 | { |
0f113f3e MC |
77 | unsigned int n; |
78 | size_t l = 0; | |
85b2c0ce | 79 | |
0f113f3e | 80 | n = *num; |
85b2c0ce AP |
81 | |
82 | #if !defined(OPENSSL_SMALL_FOOTPRINT) | |
0f113f3e MC |
83 | if (16 % sizeof(size_t) == 0) { /* always true actually */ |
84 | do { | |
85 | while (n && len) { | |
86 | *(out++) = *(in++) ^ ecount_buf[n]; | |
87 | --len; | |
88 | n = (n + 1) % 16; | |
89 | } | |
90 | ||
91 | # if defined(STRICT_ALIGNMENT) | |
5e4bbeb4 AP |
92 | if (((size_t)in | (size_t)out | (size_t)ecount_buf) |
93 | % sizeof(size_t) != 0) | |
0f113f3e MC |
94 | break; |
95 | # endif | |
96 | while (len >= 16) { | |
97 | (*block) (ivec, ecount_buf, key); | |
98 | ctr128_inc_aligned(ivec); | |
5e4bbeb4 | 99 | for (n = 0; n < 16; n += sizeof(size_t)) |
0f113f3e MC |
100 | *(size_t *)(out + n) = |
101 | *(size_t *)(in + n) ^ *(size_t *)(ecount_buf + n); | |
102 | len -= 16; | |
103 | out += 16; | |
104 | in += 16; | |
105 | n = 0; | |
106 | } | |
107 | if (len) { | |
108 | (*block) (ivec, ecount_buf, key); | |
109 | ctr128_inc_aligned(ivec); | |
110 | while (len--) { | |
111 | out[n] = in[n] ^ ecount_buf[n]; | |
112 | ++n; | |
113 | } | |
114 | } | |
115 | *num = n; | |
116 | return; | |
117 | } while (0); | |
118 | } | |
119 | /* the rest would be commonly eliminated by x86* compiler */ | |
85b2c0ce | 120 | #endif |
0f113f3e MC |
121 | while (l < len) { |
122 | if (n == 0) { | |
123 | (*block) (ivec, ecount_buf, key); | |
124 | ctr128_inc(ivec); | |
125 | } | |
126 | out[l] = in[l] ^ ecount_buf[n]; | |
127 | ++l; | |
128 | n = (n + 1) % 16; | |
129 | } | |
130 | ||
131 | *num = n; | |
85b2c0ce | 132 | } |
f472ec8c AP |
133 | |
134 | /* increment upper 96 bits of 128-bit counter by 1 */ | |
0f113f3e MC |
135 | static void ctr96_inc(unsigned char *counter) |
136 | { | |
5e4bbeb4 | 137 | u32 n = 12, c = 1; |
0f113f3e MC |
138 | |
139 | do { | |
140 | --n; | |
5e4bbeb4 AP |
141 | c += counter[n]; |
142 | counter[n] = (u8)c; | |
143 | c >>= 8; | |
0f113f3e | 144 | } while (n); |
f472ec8c AP |
145 | } |
146 | ||
147 | void CRYPTO_ctr128_encrypt_ctr32(const unsigned char *in, unsigned char *out, | |
0f113f3e MC |
148 | size_t len, const void *key, |
149 | unsigned char ivec[16], | |
150 | unsigned char ecount_buf[16], | |
151 | unsigned int *num, ctr128_f func) | |
f472ec8c | 152 | { |
0f113f3e MC |
153 | unsigned int n, ctr32; |
154 | ||
0f113f3e MC |
155 | n = *num; |
156 | ||
157 | while (n && len) { | |
158 | *(out++) = *(in++) ^ ecount_buf[n]; | |
159 | --len; | |
160 | n = (n + 1) % 16; | |
161 | } | |
162 | ||
163 | ctr32 = GETU32(ivec + 12); | |
164 | while (len >= 16) { | |
165 | size_t blocks = len / 16; | |
166 | /* | |
167 | * 1<<28 is just a not-so-small yet not-so-large number... | |
168 | * Below condition is practically never met, but it has to | |
169 | * be checked for code correctness. | |
170 | */ | |
171 | if (sizeof(size_t) > sizeof(unsigned int) && blocks > (1U << 28)) | |
172 | blocks = (1U << 28); | |
173 | /* | |
174 | * As (*func) operates on 32-bit counter, caller | |
175 | * has to handle overflow. 'if' below detects the | |
176 | * overflow, which is then handled by limiting the | |
177 | * amount of blocks to the exact overflow point... | |
178 | */ | |
179 | ctr32 += (u32)blocks; | |
180 | if (ctr32 < blocks) { | |
181 | blocks -= ctr32; | |
182 | ctr32 = 0; | |
183 | } | |
184 | (*func) (in, out, blocks, key, ivec); | |
185 | /* (*ctr) does not update ivec, caller does: */ | |
186 | PUTU32(ivec + 12, ctr32); | |
0d4fb843 | 187 | /* ... overflow was detected, propagate carry. */ |
0f113f3e MC |
188 | if (ctr32 == 0) |
189 | ctr96_inc(ivec); | |
190 | blocks *= 16; | |
191 | len -= blocks; | |
192 | out += blocks; | |
193 | in += blocks; | |
194 | } | |
195 | if (len) { | |
196 | memset(ecount_buf, 0, 16); | |
197 | (*func) (ecount_buf, ecount_buf, 1, key, ivec); | |
198 | ++ctr32; | |
199 | PUTU32(ivec + 12, ctr32); | |
200 | if (ctr32 == 0) | |
201 | ctr96_inc(ivec); | |
202 | while (len--) { | |
203 | out[n] = in[n] ^ ecount_buf[n]; | |
204 | ++n; | |
205 | } | |
206 | } | |
207 | ||
208 | *num = n; | |
f472ec8c | 209 | } |