gnutls_aead_cipher_set_key: new function

This adds gnutls_aead_cipher_set_key, which enables to reuse the same
handle but reset the context and key, without releasing the memory.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

diff --git a/NEWS b/NEWS
index 71ed9986f792759f5072faa7c0429a039011de14..5ebd3fd9eaa2323006b281385a77fb9768366834 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,12 @@ See the end for copying conditions.
    will be disallowed for encryption after December 31, 2023:
    https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
 
+** libgnutls: Optimized support for AES-SIV-CMAC algorithms (#1217, #1312).
+   The existing AEAD API that works in a scatter-gather fashion
+   (gnutls_aead_cipher_encryptv2) has been extended to support AES-SIV-CMAC.
+   For further optimization, new function (gnutls_aead_cipher_set_key) has been
+   added to set key on the existing AEAD handle without re-allocation.
+
 ** The configure arguments for Brotli and Zstandard (zstd) support
    have changed to reflect the previous help text: they are now
    --with-brotli/--with-zstd respectively (#1342).
@@ -33,6 +39,7 @@ See the end for copying conditions.
 
 ** API and ABI modifications:
 GNUTLS_NO_TICKETS_TLS12: New flag
+gnutls_aead_cipher_set_key: New function
 
 * Version 3.7.4 (released 2022-03-17)
 

diff --git a/devel/libgnutls.abignore b/devel/libgnutls.abignore
index c19dce38e11a1c763a5d7bb7a17888e269dc61bf..1de34210de9ab9ed2e5397c6daf70499b51a60b3 100644 (file)
--- a/devel/libgnutls.abignore
+++ b/devel/libgnutls.abignore
@@ -70,3 +70,5 @@ name = drbg_aes_reseed
 
 # The following should be removed in the new release, after updating the
 # abi-dump repository:
+[suppress_function]
+name = gnutls_aead_cipher_set_key

diff --git a/devel/symbols.last b/devel/symbols.last
index 18997b910dd81149cc347285ccd0ec393adde413..b3d7e1ea18047fd3a987dd2643685d633eee5ba0 100644 (file)
--- a/devel/symbols.last
+++ b/devel/symbols.last
@@ -15,6 +15,7 @@ GNUTLS_3_7_0@GNUTLS_3_7_0
 GNUTLS_3_7_2@GNUTLS_3_7_2
 GNUTLS_3_7_3@GNUTLS_3_7_3
 GNUTLS_3_7_4@GNUTLS_3_7_4
+GNUTLS_3_7_5@GNUTLS_3_7_5
 _gnutls_global_init_skip@GNUTLS_3_4
 gnutls_aead_cipher_decrypt@GNUTLS_3_4
 gnutls_aead_cipher_decryptv2@GNUTLS_3_6_10
@@ -23,6 +24,7 @@ gnutls_aead_cipher_encrypt@GNUTLS_3_4
 gnutls_aead_cipher_encryptv2@GNUTLS_3_6_10
 gnutls_aead_cipher_encryptv@GNUTLS_3_6_3
 gnutls_aead_cipher_init@GNUTLS_3_4
+gnutls_aead_cipher_set_key@GNUTLS_3_7_5
 gnutls_alert_get@GNUTLS_3_4
 gnutls_alert_get_name@GNUTLS_3_4
 gnutls_alert_get_strname@GNUTLS_3_4

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 59472b1a3f4782491d8a2ea6be383381b8e5481e..d20a021d97fc1a3f66240610bfc8bbd89343ea71 100644 (file)
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -680,6 +680,8 @@ FUNCS += functions/gnutls_aead_cipher_encryptv2
 FUNCS += functions/gnutls_aead_cipher_encryptv2.short
 FUNCS += functions/gnutls_aead_cipher_init
 FUNCS += functions/gnutls_aead_cipher_init.short
+FUNCS += functions/gnutls_aead_cipher_set_key
+FUNCS += functions/gnutls_aead_cipher_set_key.short
 FUNCS += functions/gnutls_alert_get
 FUNCS += functions/gnutls_alert_get.short
 FUNCS += functions/gnutls_alert_get_name

diff --git a/doc/manpages/Makefile.am b/doc/manpages/Makefile.am
index f6ab114fdce1651de3b1e1a17d5d9bc7186f0601..d8c5f2854d689384c4d76e4d3db2bda46da5c8ce 100644 (file)
--- a/doc/manpages/Makefile.am
+++ b/doc/manpages/Makefile.am
@@ -172,6 +172,7 @@ APIMANS += gnutls_aead_cipher_encrypt.3
 APIMANS += gnutls_aead_cipher_encryptv.3
 APIMANS += gnutls_aead_cipher_encryptv2.3
 APIMANS += gnutls_aead_cipher_init.3
+APIMANS += gnutls_aead_cipher_set_key.3
 APIMANS += gnutls_alert_get.3
 APIMANS += gnutls_alert_get_name.3
 APIMANS += gnutls_alert_get_strname.3

diff --git a/lib/crypto-api.c b/lib/crypto-api.c
index 621eeb1166196fc41ad1095cf9ab0da305aa7598..b3e1eec2496bbc88c795ec5e13506119386819cb 100644 (file)
--- a/lib/crypto-api.c
+++ b/lib/crypto-api.c
@@ -989,6 +989,38 @@ int gnutls_aead_cipher_init(gnutls_aead_cipher_hd_t *handle,
        return ret;
 }
 
+/**
+ * gnutls_aead_cipher_set_key:
+ * @handle: is a #gnutls_aead_cipher_hd_t type.
+ * @key: The key to be used for encryption
+ *
+ * This function will set a new key without re-initializing the
+ * context.
+ *
+ * Returns: Zero or a negative error code on error.
+ *
+ * Since: 3.7.5
+ **/
+int gnutls_aead_cipher_set_key(gnutls_aead_cipher_hd_t handle,
+                              const gnutls_datum_t *key)
+{
+       const cipher_entry_st* e;
+       int ret;
+
+       e = cipher_to_entry(handle->ctx_enc.e->id);
+       if (e == NULL || e->type != CIPHER_AEAD) {
+               return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+       }
+
+       ret = handle->ctx_enc.setkey(handle->ctx_enc.handle,
+                                    key->data, key->size);
+       if (ret < 0) {
+               _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
+       }
+
+       return ret;
+}
+
 /**
  * gnutls_aead_cipher_decrypt:
  * @handle: is a #gnutls_aead_cipher_hd_t type.

diff --git a/lib/includes/gnutls/crypto.h b/lib/includes/gnutls/crypto.h
index fe046a42392e9401ef8d1e0d686a1ff77af0bc13..506f3b161e4bfddf7d255a3bbcd813c8cc1752de 100644 (file)
--- a/lib/includes/gnutls/crypto.h
+++ b/lib/includes/gnutls/crypto.h
@@ -69,6 +69,10 @@ typedef struct api_aead_cipher_hd_st *gnutls_aead_cipher_hd_t;
 int gnutls_aead_cipher_init(gnutls_aead_cipher_hd_t * handle,
                            gnutls_cipher_algorithm_t cipher,
                            const gnutls_datum_t * key);
+
+int gnutls_aead_cipher_set_key(gnutls_aead_cipher_hd_t handle,
+                              const gnutls_datum_t *key);
+
 int
 gnutls_aead_cipher_decrypt(gnutls_aead_cipher_hd_t handle,
                           const void *nonce, size_t nonce_len,

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index d16178580d451ef98de688dde17b54ada24f36bc..0241946c8adf353569a8a386b09523bb8e61c339 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -1391,6 +1391,14 @@ GNUTLS_3_7_4
        *;
 } GNUTLS_3_7_3;
 
+GNUTLS_3_7_5
+{
+ global:
+       gnutls_aead_cipher_set_key;
+ local:
+       *;
+} GNUTLS_3_7_4;
+
 GNUTLS_FIPS140_3_4 {
   global:
        gnutls_cipher_self_test;