Share common GCM-AE and GCM-AD functionality

These operations are almost identical, so use common functions to
share the same implementation.

Signed-hostap: Jouni Malinen <j@w1.fi>

diff --git a/src/crypto/aes-gcm.c b/src/crypto/aes-gcm.c
index f6f4074b06084ac95217b560dca0777fdd8c0be8..3d91c71de2dd93393833000603638f46aaaaa3c1 100644 (file)
--- a/src/crypto/aes-gcm.c
+++ b/src/crypto/aes-gcm.c
@@ -172,29 +172,29 @@ static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
 }
 
 
-/**
- * aes_gcm_ae - GCM-AE_K(IV, P, A)
- */
-int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
-              const u8 *plain, size_t plain_len,
-              const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
+static void * aes_gcm_init_hash_subkey(const u8 *key, size_t key_len, u8 *H)
 {
-       u8 H[AES_BLOCK_SIZE];
-       u8 J0[AES_BLOCK_SIZE], J0inc[AES_BLOCK_SIZE];
-       u8 S[16], len_buf[16];
        void *aes;
 
        aes = aes_encrypt_init(key, key_len);
        if (aes == NULL)
-               return -1;
+               return NULL;
 
-       /* 1. Generate hash subkey H = AES_K(0^128) */
-       os_memset(H, 0, sizeof(H));
+       /* Generate hash subkey H = AES_K(0^128) */
+       os_memset(H, 0, AES_BLOCK_SIZE);
        aes_encrypt(aes, H, H);
-       wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
+       wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH",
+                       H, AES_BLOCK_SIZE);
+       return aes;
+}
+
+
+static void aes_gcm_prepare_j0(const u8 *iv, size_t iv_len, const u8 *H, u8 *J0)
+{
+       u8 len_buf[16];
 
        if (iv_len == 12) {
-               /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
+               /* Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
                os_memcpy(J0, iv, iv_len);
                os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
                J0[AES_BLOCK_SIZE - 1] = 0x01;
@@ -209,31 +209,72 @@ int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
                WPA_PUT_BE64(len_buf + 8, iv_len * 8);
                ghash(H, len_buf, sizeof(len_buf), J0);
        }
+}
+
+
+static void aes_gcm_gctr(void *aes, const u8 *J0, const u8 *in, size_t len,
+                        u8 *out)
+{
+       u8 J0inc[AES_BLOCK_SIZE];
+
+       if (len == 0)
+               return;
 
-       /* 3. C = GCTR_K(inc_32(J_0), P) */
        os_memcpy(J0inc, J0, AES_BLOCK_SIZE);
        inc32(J0inc);
-       aes_gctr(aes, J0inc, plain, plain_len, crypt);
+       aes_gctr(aes, J0inc, in, len, out);
+}
+
+
+static void aes_gcm_ghash(const u8 *H, const u8 *aad, size_t aad_len,
+                         const u8 *crypt, size_t crypt_len, u8 *S)
+{
+       u8 len_buf[16];
 
        /*
-        * 4. u = 128 * ceil[len(C)/128] - len(C)
-        *    v = 128 * ceil[len(A)/128] - len(A)
-        * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
+        * u = 128 * ceil[len(C)/128] - len(C)
+        * v = 128 * ceil[len(A)/128] - len(A)
+        * S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
         * (i.e., zero padded to block size A || C and lengths of each in bits)
         */
        ghash_start(S);
        ghash(H, aad, aad_len, S);
-       ghash(H, crypt, plain_len, S);
+       ghash(H, crypt, crypt_len, S);
        WPA_PUT_BE64(len_buf, aad_len * 8);
-       WPA_PUT_BE64(len_buf + 8, plain_len * 8);
+       WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
        ghash(H, len_buf, sizeof(len_buf), S);
 
        wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
+}
+
+
+/**
+ * aes_gcm_ae - GCM-AE_K(IV, P, A)
+ */
+int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
+              const u8 *plain, size_t plain_len,
+              const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
+{
+       u8 H[AES_BLOCK_SIZE];
+       u8 J0[AES_BLOCK_SIZE];
+       u8 S[16];
+       void *aes;
 
-       /* 6. T = MSB_t(GCTR_K(J_0, S)) */
+       aes = aes_gcm_init_hash_subkey(key, key_len, H);
+       if (aes == NULL)
+               return -1;
+
+       aes_gcm_prepare_j0(iv, iv_len, H, J0);
+
+       /* C = GCTR_K(inc_32(J_0), P) */
+       aes_gcm_gctr(aes, J0, plain, plain_len, crypt);
+
+       aes_gcm_ghash(H, aad, aad_len, crypt, plain_len, S);
+
+       /* T = MSB_t(GCTR_K(J_0, S)) */
        aes_gctr(aes, J0, S, sizeof(S), tag);
 
-       /* 7. Return (C, T) */
+       /* Return (C, T) */
 
        aes_encrypt_deinit(aes);
 
@@ -249,57 +290,22 @@ int aes_gcm_ad(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
               const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain)
 {
        u8 H[AES_BLOCK_SIZE];
-       u8 J0[AES_BLOCK_SIZE], J0inc[AES_BLOCK_SIZE];
-       u8 S[16], T[16], len_buf[16];
+       u8 J0[AES_BLOCK_SIZE];
+       u8 S[16], T[16];
        void *aes;
 
-       aes = aes_encrypt_init(key, key_len);
+       aes = aes_gcm_init_hash_subkey(key, key_len, H);
        if (aes == NULL)
                return -1;
 
-       /* 2. Generate hash subkey H = AES_K(0^128) */
-       os_memset(H, 0, sizeof(H));
-       aes_encrypt(aes, H, H);
-       wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
-
-       if (iv_len == 12) {
-               /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
-               os_memcpy(J0, iv, iv_len);
-               os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
-               J0[AES_BLOCK_SIZE - 1] = 0x01;
-       } else {
-               /*
-                * s = 128 * ceil(len(IV)/128) - len(IV)
-                * J_0 = GHASH_H(IV || 0^(s+64) || [len(IV)]_64)
-                */
-               ghash_start(J0);
-               ghash(H, iv, iv_len, J0);
-               WPA_PUT_BE64(len_buf, 0);
-               WPA_PUT_BE64(len_buf + 8, iv_len * 8);
-               ghash(H, len_buf, sizeof(len_buf), J0);
-       }
-
-       /* 4. C = GCTR_K(inc_32(J_0), C) */
-       os_memcpy(J0inc, J0, AES_BLOCK_SIZE);
-       inc32(J0inc);
-       aes_gctr(aes, J0inc, crypt, crypt_len, plain);
+       aes_gcm_prepare_j0(iv, iv_len, H, J0);
 
-       /*
-        * 5. u = 128 * ceil[len(C)/128] - len(C)
-        *    v = 128 * ceil[len(A)/128] - len(A)
-        * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
-        * (i.e., zero padded to block size A || C and lengths of each in bits)
-        */
-       ghash_start(S);
-       ghash(H, aad, aad_len, S);
-       ghash(H, crypt, crypt_len, S);
-       WPA_PUT_BE64(len_buf, aad_len * 8);
-       WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
-       ghash(H, len_buf, sizeof(len_buf), S);
+       /* P = GCTR_K(inc_32(J_0), C) */
+       aes_gcm_gctr(aes, J0, crypt, crypt_len, plain);
 
-       wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
+       aes_gcm_ghash(H, aad, aad_len, crypt, crypt_len, S);
 
-       /* 7. T' = MSB_t(GCTR_K(J_0, S)) */
+       /* T' = MSB_t(GCTR_K(J_0, S)) */
        aes_gctr(aes, J0, S, sizeof(S), T);
 
        aes_encrypt_deinit(aes);