gcm.c
Go to the documentation of this file.
1 /**
2  * @file gcm.c
3  * @brief Galois/Counter Mode (GCM)
4  *
5  * @section License
6  *
7  * SPDX-License-Identifier: GPL-2.0-or-later
8  *
9  * Copyright (C) 2010-2025 Oryx Embedded SARL. All rights reserved.
10  *
11  * This file is part of CycloneCRYPTO Open.
12  *
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License
15  * as published by the Free Software Foundation; either version 2
16  * of the License, or (at your option) any later version.
17  *
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21  * GNU General Public License for more details.
22  *
23  * You should have received a copy of the GNU General Public License
24  * along with this program; if not, write to the Free Software Foundation,
25  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
26  *
27  * @section Description
28  *
29  * The Galois/Counter Mode (GCM) is an authenticated encryption algorithm
30  * designed to provide both data authenticity (integrity) and confidentiality.
31  * Refer to SP 800-38D for more details
32  *
33  * @author Oryx Embedded SARL (www.oryx-embedded.com)
34  * @version 2.5.0
35  **/
36 
37 //Switch to the appropriate trace level
38 #define TRACE_LEVEL CRYPTO_TRACE_LEVEL
39 
40 //Dependencies
41 #include "core/crypto.h"
42 #include "aead/gcm.h"
43 #include "debug.h"
44 
45 //Check crypto library configuration
46 #if (GCM_SUPPORT == ENABLED)
47 
48 //Reduction table
49 static const uint32_t r[GCM_TABLE_N] =
50 {
51 #if (GCM_TABLE_W == 4)
52  0x00000000, 0x1C200000, 0x38400000, 0x24600000, 0x70800000, 0x6CA00000, 0x48C00000, 0x54E00000,
53  0xE1000000, 0xFD200000, 0xD9400000, 0xC5600000, 0x91800000, 0x8DA00000, 0xA9C00000, 0xB5E00000
54 #else
55  0x00000000, 0x01C20000, 0x03840000, 0x02460000, 0x07080000, 0x06CA0000, 0x048C0000, 0x054E0000,
56  0x0E100000, 0x0FD20000, 0x0D940000, 0x0C560000, 0x09180000, 0x08DA0000, 0x0A9C0000, 0x0B5E0000,
57  0x1C200000, 0x1DE20000, 0x1FA40000, 0x1E660000, 0x1B280000, 0x1AEA0000, 0x18AC0000, 0x196E0000,
58  0x12300000, 0x13F20000, 0x11B40000, 0x10760000, 0x15380000, 0x14FA0000, 0x16BC0000, 0x177E0000,
59  0x38400000, 0x39820000, 0x3BC40000, 0x3A060000, 0x3F480000, 0x3E8A0000, 0x3CCC0000, 0x3D0E0000,
60  0x36500000, 0x37920000, 0x35D40000, 0x34160000, 0x31580000, 0x309A0000, 0x32DC0000, 0x331E0000,
61  0x24600000, 0x25A20000, 0x27E40000, 0x26260000, 0x23680000, 0x22AA0000, 0x20EC0000, 0x212E0000,
62  0x2A700000, 0x2BB20000, 0x29F40000, 0x28360000, 0x2D780000, 0x2CBA0000, 0x2EFC0000, 0x2F3E0000,
63  0x70800000, 0x71420000, 0x73040000, 0x72C60000, 0x77880000, 0x764A0000, 0x740C0000, 0x75CE0000,
64  0x7E900000, 0x7F520000, 0x7D140000, 0x7CD60000, 0x79980000, 0x785A0000, 0x7A1C0000, 0x7BDE0000,
65  0x6CA00000, 0x6D620000, 0x6F240000, 0x6EE60000, 0x6BA80000, 0x6A6A0000, 0x682C0000, 0x69EE0000,
66  0x62B00000, 0x63720000, 0x61340000, 0x60F60000, 0x65B80000, 0x647A0000, 0x663C0000, 0x67FE0000,
67  0x48C00000, 0x49020000, 0x4B440000, 0x4A860000, 0x4FC80000, 0x4E0A0000, 0x4C4C0000, 0x4D8E0000,
68  0x46D00000, 0x47120000, 0x45540000, 0x44960000, 0x41D80000, 0x401A0000, 0x425C0000, 0x439E0000,
69  0x54E00000, 0x55220000, 0x57640000, 0x56A60000, 0x53E80000, 0x522A0000, 0x506C0000, 0x51AE0000,
70  0x5AF00000, 0x5B320000, 0x59740000, 0x58B60000, 0x5DF80000, 0x5C3A0000, 0x5E7C0000, 0x5FBE0000,
71  0xE1000000, 0xE0C20000, 0xE2840000, 0xE3460000, 0xE6080000, 0xE7CA0000, 0xE58C0000, 0xE44E0000,
72  0xEF100000, 0xEED20000, 0xEC940000, 0xED560000, 0xE8180000, 0xE9DA0000, 0xEB9C0000, 0xEA5E0000,
73  0xFD200000, 0xFCE20000, 0xFEA40000, 0xFF660000, 0xFA280000, 0xFBEA0000, 0xF9AC0000, 0xF86E0000,
74  0xF3300000, 0xF2F20000, 0xF0B40000, 0xF1760000, 0xF4380000, 0xF5FA0000, 0xF7BC0000, 0xF67E0000,
75  0xD9400000, 0xD8820000, 0xDAC40000, 0xDB060000, 0xDE480000, 0xDF8A0000, 0xDDCC0000, 0xDC0E0000,
76  0xD7500000, 0xD6920000, 0xD4D40000, 0xD5160000, 0xD0580000, 0xD19A0000, 0xD3DC0000, 0xD21E0000,
77  0xC5600000, 0xC4A20000, 0xC6E40000, 0xC7260000, 0xC2680000, 0xC3AA0000, 0xC1EC0000, 0xC02E0000,
78  0xCB700000, 0xCAB20000, 0xC8F40000, 0xC9360000, 0xCC780000, 0xCDBA0000, 0xCFFC0000, 0xCE3E0000,
79  0x91800000, 0x90420000, 0x92040000, 0x93C60000, 0x96880000, 0x974A0000, 0x950C0000, 0x94CE0000,
80  0x9F900000, 0x9E520000, 0x9C140000, 0x9DD60000, 0x98980000, 0x995A0000, 0x9B1C0000, 0x9ADE0000,
81  0x8DA00000, 0x8C620000, 0x8E240000, 0x8FE60000, 0x8AA80000, 0x8B6A0000, 0x892C0000, 0x88EE0000,
82  0x83B00000, 0x82720000, 0x80340000, 0x81F60000, 0x84B80000, 0x857A0000, 0x873C0000, 0x86FE0000,
83  0xA9C00000, 0xA8020000, 0xAA440000, 0xAB860000, 0xAEC80000, 0xAF0A0000, 0xAD4C0000, 0xAC8E0000,
84  0xA7D00000, 0xA6120000, 0xA4540000, 0xA5960000, 0xA0D80000, 0xA11A0000, 0xA35C0000, 0xA29E0000,
85  0xB5E00000, 0xB4220000, 0xB6640000, 0xB7A60000, 0xB2E80000, 0xB32A0000, 0xB16C0000, 0xB0AE0000,
86  0xBBF00000, 0xBA320000, 0xB8740000, 0xB9B60000, 0xBCF80000, 0xBD3A0000, 0xBF7C0000, 0xBEBE0000
87 #endif
88 };
89 
90 
91 /**
92  * @brief Initialize GCM context
93  * @param[in] context Pointer to the GCM context
94  * @param[in] cipherAlgo Cipher algorithm
95  * @param[in] cipherContext Pointer to the cipher algorithm context
96  * @return Error code
97  **/
98 
99 __weak_func error_t gcmInit(GcmContext *context, const CipherAlgo *cipherAlgo,
100  void *cipherContext)
101 {
102  uint_t i;
103  uint_t j;
104  uint32_t c;
105  uint32_t m[4];
106  uint8_t h[16];
107 
108  //Check parameters
109  if(context == NULL || cipherAlgo == NULL || cipherContext == NULL)
110  return ERROR_INVALID_PARAMETER;
111 
112  //GCM supports only symmetric block ciphers whose block size is 128 bits
113  if(cipherAlgo->type != CIPHER_ALGO_TYPE_BLOCK || cipherAlgo->blockSize != 16)
114  return ERROR_INVALID_PARAMETER;
115 
116  //Save cipher algorithm context
117  context->cipherAlgo = cipherAlgo;
118  context->cipherContext = cipherContext;
119 
120  //Let H = 0
121  osMemset(h, 0, 16);
122  //Generate the hash subkey H
123  context->cipherAlgo->encryptBlock(context->cipherContext, h, h);
124 
125  //Pre-compute M(0) = H * 0
126  j = GCM_REVERSE_BITS(0);
127  context->m[j][0] = 0;
128  context->m[j][1] = 0;
129  context->m[j][2] = 0;
130  context->m[j][3] = 0;
131 
132  //Pre-compute M(1) = H * 1
133  j = GCM_REVERSE_BITS(1);
134  context->m[j][0] = LOAD32BE(h + 12);
135  context->m[j][1] = LOAD32BE(h + 8);
136  context->m[j][2] = LOAD32BE(h + 4);
137  context->m[j][3] = LOAD32BE(h);
138 
139  //Pre-compute all multiples of H (Shoup's method)
140  for(i = 2; i < GCM_TABLE_N; i++)
141  {
142  //Odd value?
143  if((i & 1) != 0)
144  {
145  //Compute M(i) = M(i - 1) + H
146  j = GCM_REVERSE_BITS(i - 1);
147  m[0] = context->m[j][0];
148  m[1] = context->m[j][1];
149  m[2] = context->m[j][2];
150  m[3] = context->m[j][3];
151 
152  //An addition in GF(2^128) is identical to a bitwise exclusive-OR
153  //operation
154  m[0] ^= LOAD32BE(h + 12);
155  m[1] ^= LOAD32BE(h + 8);
156  m[2] ^= LOAD32BE(h + 4);
157  m[3] ^= LOAD32BE(h);
158  }
159  else
160  {
161  //Compute M(i) = M(i / 2) * x
162  j = GCM_REVERSE_BITS(i / 2);
163  m[0] = context->m[j][0];
164  m[1] = context->m[j][1];
165  m[2] = context->m[j][2];
166  m[3] = context->m[j][3];
167 
168  //The multiplication of a polynomial by x in GF(2^128) corresponds
169  //to a shift of indices
170  c = m[0] & 0x01;
171  m[0] = (m[0] >> 1) | (m[1] << 31);
172  m[1] = (m[1] >> 1) | (m[2] << 31);
173  m[2] = (m[2] >> 1) | (m[3] << 31);
174  m[3] >>= 1;
175 
176  //If the highest term of the result is equal to one, then perform
177  //reduction
178  m[3] ^= r[GCM_REVERSE_BITS(1)] & ~(c - 1);
179  }
180 
181  //Save M(i)
182  j = GCM_REVERSE_BITS(i);
183  context->m[j][0] = m[0];
184  context->m[j][1] = m[1];
185  context->m[j][2] = m[2];
186  context->m[j][3] = m[3];
187  }
188 
189  //Successful initialization
190  return NO_ERROR;
191 }
192 
193 
194 /**
195  * @brief Authenticated encryption using GCM
196  * @param[in] context Pointer to the GCM context
197  * @param[in] iv Initialization vector
198  * @param[in] ivLen Length of the initialization vector
199  * @param[in] a Additional authenticated data
200  * @param[in] aLen Length of the additional data
201  * @param[in] p Plaintext to be encrypted
202  * @param[out] c Ciphertext resulting from the encryption
203  * @param[in] length Total number of data bytes to be encrypted
204  * @param[out] t Authentication tag
205  * @param[in] tLen Length of the authentication tag
206  * @return Error code
207  **/
208 
209 __weak_func error_t gcmEncrypt(GcmContext *context, const uint8_t *iv,
210  size_t ivLen, const uint8_t *a, size_t aLen, const uint8_t *p,
211  uint8_t *c, size_t length, uint8_t *t, size_t tLen)
212 {
213  size_t k;
214  size_t n;
215  uint8_t b[16];
216  uint8_t j[16];
217  uint8_t s[16];
218 
219  //Make sure the GCM context is valid
220  if(context == NULL)
221  return ERROR_INVALID_PARAMETER;
222 
223  //The length of the IV shall meet SP 800-38D requirements
224  if(ivLen < 1)
225  return ERROR_INVALID_LENGTH;
226 
227  //Check the length of the authentication tag
228  if(tLen < 4 || tLen > 16)
229  return ERROR_INVALID_LENGTH;
230 
231  //Check whether the length of the IV is 96 bits
232  if(ivLen == 12)
233  {
234  //When the length of the IV is 96 bits, the padding string is appended
235  //to the IV to form the pre-counter block
236  osMemcpy(j, iv, 12);
237  STORE32BE(1, j + 12);
238  }
239  else
240  {
241  //Initialize GHASH calculation
242  osMemset(j, 0, 16);
243 
244  //Length of the IV
245  n = ivLen;
246 
247  //Process the initialization vector
248  while(n > 0)
249  {
250  //The IV is processed in a block-by-block fashion
251  k = MIN(n, 16);
252 
253  //Apply GHASH function
254  gcmXorBlock(j, j, iv, k);
255  gcmMul(context, j);
256 
257  //Next block
258  iv += k;
259  n -= k;
260  }
261 
262  //The string is appended with 64 additional 0 bits, followed by the
263  //64-bit representation of the length of the IV
264  osMemset(b, 0, 8);
265  STORE64BE(ivLen * 8, b + 8);
266 
267  //The GHASH function is applied to the resulting string to form the
268  //pre-counter block
269  gcmXorBlock(j, j, b, 16);
270  gcmMul(context, j);
271  }
272 
273  //Compute MSB(CIPH(J(0)))
274  context->cipherAlgo->encryptBlock(context->cipherContext, j, b);
275  osMemcpy(t, b, tLen);
276 
277  //Initialize GHASH calculation
278  osMemset(s, 0, 16);
279  //Length of the AAD
280  n = aLen;
281 
282  //Process AAD
283  while(n > 0)
284  {
285  //Additional data are processed in a block-by-block fashion
286  k = MIN(n, 16);
287 
288  //Apply GHASH function
289  gcmXorBlock(s, s, a, k);
290  gcmMul(context, s);
291 
292  //Next block
293  a += k;
294  n -= k;
295  }
296 
297  //Length of the plaintext
298  n = length;
299 
300  //Process plaintext
301  while(n > 0)
302  {
303  //The encryption operates in a block-by-block fashion
304  k = MIN(n, 16);
305 
306  //Increment counter
307  gcmIncCounter(j);
308 
309  //Encrypt plaintext
310  context->cipherAlgo->encryptBlock(context->cipherContext, j, b);
311  gcmXorBlock(c, p, b, k);
312 
313  //Apply GHASH function
314  gcmXorBlock(s, s, c, k);
315  gcmMul(context, s);
316 
317  //Next block
318  p += k;
319  c += k;
320  n -= k;
321  }
322 
323  //Append the 64-bit representation of the length of the AAD and the
324  //ciphertext
325  STORE64BE(aLen * 8, b);
326  STORE64BE(length * 8, b + 8);
327 
328  //The GHASH function is applied to the result to produce a single output
329  //block S
330  gcmXorBlock(s, s, b, 16);
331  gcmMul(context, s);
332 
333  //Let T = MSB(GCTR(J(0), S)
334  gcmXorBlock(t, t, s, tLen);
335 
336  //Successful encryption
337  return NO_ERROR;
338 }
339 
340 
341 /**
342  * @brief Authenticated decryption using GCM
343  * @param[in] context Pointer to the GCM context
344  * @param[in] iv Initialization vector
345  * @param[in] ivLen Length of the initialization vector
346  * @param[in] a Additional authenticated data
347  * @param[in] aLen Length of the additional data
348  * @param[in] c Ciphertext to be decrypted
349  * @param[out] p Plaintext resulting from the decryption
350  * @param[in] length Total number of data bytes to be decrypted
351  * @param[in] t Authentication tag
352  * @param[in] tLen Length of the authentication tag
353  * @return Error code
354  **/
355 
356 __weak_func error_t gcmDecrypt(GcmContext *context, const uint8_t *iv,
357  size_t ivLen, const uint8_t *a, size_t aLen, const uint8_t *c,
358  uint8_t *p, size_t length, const uint8_t *t, size_t tLen)
359 {
360  uint8_t mask;
361  size_t k;
362  size_t n;
363  uint8_t b[16];
364  uint8_t j[16];
365  uint8_t r[16];
366  uint8_t s[16];
367 
368  //Make sure the GCM context is valid
369  if(context == NULL)
370  return ERROR_INVALID_PARAMETER;
371 
372  //The length of the IV shall meet SP 800-38D requirements
373  if(ivLen < 1)
374  return ERROR_INVALID_LENGTH;
375 
376  //Check the length of the authentication tag
377  if(tLen < 4 || tLen > 16)
378  return ERROR_INVALID_LENGTH;
379 
380  //Check whether the length of the IV is 96 bits
381  if(ivLen == 12)
382  {
383  //When the length of the IV is 96 bits, the padding string is appended
384  //to the IV to form the pre-counter block
385  osMemcpy(j, iv, 12);
386  STORE32BE(1, j + 12);
387  }
388  else
389  {
390  //Initialize GHASH calculation
391  osMemset(j, 0, 16);
392 
393  //Length of the IV
394  n = ivLen;
395 
396  //Process the initialization vector
397  while(n > 0)
398  {
399  //The IV is processed in a block-by-block fashion
400  k = MIN(n, 16);
401 
402  //Apply GHASH function
403  gcmXorBlock(j, j, iv, k);
404  gcmMul(context, j);
405 
406  //Next block
407  iv += k;
408  n -= k;
409  }
410 
411  //The string is appended with 64 additional 0 bits, followed by the
412  //64-bit representation of the length of the IV
413  osMemset(b, 0, 8);
414  STORE64BE(ivLen * 8, b + 8);
415 
416  //The GHASH function is applied to the resulting string to form the
417  //pre-counter block
418  gcmXorBlock(j, j, b, 16);
419  gcmMul(context, j);
420  }
421 
422  //Compute MSB(CIPH(J(0)))
423  context->cipherAlgo->encryptBlock(context->cipherContext, j, b);
424  osMemcpy(r, b, tLen);
425 
426  //Initialize GHASH calculation
427  osMemset(s, 0, 16);
428  //Length of the AAD
429  n = aLen;
430 
431  //Process AAD
432  while(n > 0)
433  {
434  //Additional data are processed in a block-by-block fashion
435  k = MIN(n, 16);
436 
437  //Apply GHASH function
438  gcmXorBlock(s, s, a, k);
439  gcmMul(context, s);
440 
441  //Next block
442  a += k;
443  n -= k;
444  }
445 
446  //Length of the ciphertext
447  n = length;
448 
449  //Process ciphertext
450  while(n > 0)
451  {
452  //The decryption operates in a block-by-block fashion
453  k = MIN(n, 16);
454 
455  //Apply GHASH function
456  gcmXorBlock(s, s, c, k);
457  gcmMul(context, s);
458 
459  //Increment counter
460  gcmIncCounter(j);
461 
462  //Decrypt ciphertext
463  context->cipherAlgo->encryptBlock(context->cipherContext, j, b);
464  gcmXorBlock(p, c, b, k);
465 
466  //Next block
467  c += k;
468  p += k;
469  n -= k;
470  }
471 
472  //Append the 64-bit representation of the length of the AAD and the
473  //ciphertext
474  STORE64BE(aLen * 8, b);
475  STORE64BE(length * 8, b + 8);
476 
477  //The GHASH function is applied to the result to produce a single output
478  //block S
479  gcmXorBlock(s, s, b, 16);
480  gcmMul(context, s);
481 
482  //Let R = MSB(GCTR(J(0), S))
483  gcmXorBlock(r, r, s, tLen);
484 
485  //The calculated tag is bitwise compared to the received tag. The message
486  //is authenticated if and only if the tags match
487  for(mask = 0, n = 0; n < tLen; n++)
488  {
489  mask |= r[n] ^ t[n];
490  }
491 
492  //Return status code
493  return (mask == 0) ? NO_ERROR : ERROR_FAILURE;
494 }
495 
496 
497 /**
498  * @brief Multiplication operation in GF(2^128)
499  * @param[in] context Pointer to the GCM context
500  * @param[in, out] x 16-byte block to be multiplied by H
501  **/
502 
503 __weak_func void gcmMul(GcmContext *context, uint8_t *x)
504 {
505  int_t i;
506  uint8_t b;
507  uint8_t c;
508  uint32_t z[4];
509 
510  //Let Z = 0
511  z[0] = 0;
512  z[1] = 0;
513  z[2] = 0;
514  z[3] = 0;
515 
516  //Fast table-driven implementation (Shoup's method)
517  for(i = 15; i >= 0; i--)
518  {
519 #if (GCM_TABLE_W == 4)
520  //Get the lower nibble
521  b = x[i] & 0x0F;
522 
523  //Multiply 4 bits at a time
524  c = z[0] & 0x0F;
525  z[0] = (z[0] >> 4) | (z[1] << 28);
526  z[1] = (z[1] >> 4) | (z[2] << 28);
527  z[2] = (z[2] >> 4) | (z[3] << 28);
528  z[3] >>= 4;
529 
530  z[0] ^= context->m[b][0];
531  z[1] ^= context->m[b][1];
532  z[2] ^= context->m[b][2];
533  z[3] ^= context->m[b][3];
534 
535  //Perform reduction
536  z[3] ^= r[c];
537 
538  //Get the upper nibble
539  b = (x[i] >> 4) & 0x0F;
540 
541  //Multiply 4 bits at a time
542  c = z[0] & 0x0F;
543  z[0] = (z[0] >> 4) | (z[1] << 28);
544  z[1] = (z[1] >> 4) | (z[2] << 28);
545  z[2] = (z[2] >> 4) | (z[3] << 28);
546  z[3] >>= 4;
547 
548  z[0] ^= context->m[b][0];
549  z[1] ^= context->m[b][1];
550  z[2] ^= context->m[b][2];
551  z[3] ^= context->m[b][3];
552 
553  //Perform reduction
554  z[3] ^= r[c];
555 #else
556  //Get current byte
557  b = x[i];
558 
559  //Multiply 8 bits at a time
560  c = z[0] & 0xFF;
561  z[0] = (z[0] >> 8) | (z[1] << 24);
562  z[1] = (z[1] >> 8) | (z[2] << 24);
563  z[2] = (z[2] >> 8) | (z[3] << 24);
564  z[3] >>= 8;
565 
566  z[0] ^= context->m[b][0];
567  z[1] ^= context->m[b][1];
568  z[2] ^= context->m[b][2];
569  z[3] ^= context->m[b][3];
570 
571  //Perform reduction
572  z[3] ^= r[c];
573 #endif
574  }
575 
576  //Save the result
577  STORE32BE(z[3], x);
578  STORE32BE(z[2], x + 4);
579  STORE32BE(z[1], x + 8);
580  STORE32BE(z[0], x + 12);
581 }
582 
583 
584 /**
585  * @brief XOR operation
586  * @param[out] x Block resulting from the XOR operation
587  * @param[in] a First block
588  * @param[in] b Second block
589  * @param[in] n Size of the block
590  **/
591 
592 void gcmXorBlock(uint8_t *x, const uint8_t *a, const uint8_t *b, size_t n)
593 {
594  size_t i;
595 
596  //Perform XOR operation
597  for(i = 0; i < n; i++)
598  {
599  x[i] = a[i] ^ b[i];
600  }
601 }
602 
603 
604 /**
605  * @brief Increment counter block
606  * @param[in,out] ctr Pointer to the counter block
607  **/
608 
609 void gcmIncCounter(uint8_t *ctr)
610 {
611  uint16_t temp;
612 
613  //The function increments the right-most 32 bits of the block. The remaining
614  //left-most 96 bits remain unchanged
615  temp = ctr[15] + 1;
616  ctr[15] = temp & 0xFF;
617  temp = (temp >> 8) + ctr[14];
618  ctr[14] = temp & 0xFF;
619  temp = (temp >> 8) + ctr[13];
620  ctr[13] = temp & 0xFF;
621  temp = (temp >> 8) + ctr[12];
622  ctr[12] = temp & 0xFF;
623 }
624 
625 #endif
b
uint8_t b
Definition: nbns_common.h:104
a
uint8_t a
Definition: ndp.h:411
int_t
signed int int_t
Definition: compiler_port.h:56
LOAD32BE
#define LOAD32BE(p)
Definition: cpu_endian.h:210
p
uint8_t p
Definition: ndp.h:300
x
uint8_t x
Definition: lldp_ext_med.h:211
CIPHER_ALGO_TYPE_BLOCK
@ CIPHER_ALGO_TYPE_BLOCK
Definition: crypto.h:988
t
uint8_t t
Definition: lldp_ext_med.h:212
CipherAlgo::blockSize
size_t blockSize
Definition: crypto.h:1108
gcmIncCounter
void gcmIncCounter(uint8_t *ctr)
Increment counter block.
Definition: gcm.c:609
gcmInit
__weak_func error_t gcmInit(GcmContext *context, const CipherAlgo *cipherAlgo, void *cipherContext)
Initialize GCM context.
Definition: gcm.c:99
CipherAlgo::encryptBlock
CipherAlgoEncryptBlock encryptBlock
Definition: crypto.h:1112
r
uint8_t r
Definition: ndp.h:346
GCM_REVERSE_BITS
#define GCM_REVERSE_BITS(n)
Definition: gcm.h:47
h
uint8_t h
Definition: ndp.h:302
ERROR_INVALID_PARAMETER
@ ERROR_INVALID_PARAMETER
Invalid parameter.
Definition: error.h:47
osMemcpy
#define osMemcpy(dest, src, length)
Definition: os_port.h:144
gcmMul
__weak_func void gcmMul(GcmContext *context, uint8_t *x)
Multiplication operation in GF(2^128)
Definition: gcm.c:503
error_t
error_t
Error codes.
Definition: error.h:43
CipherAlgo::type
CipherAlgoType type
Definition: crypto.h:1107
ERROR_FAILURE
@ ERROR_FAILURE
Generic error code.
Definition: error.h:45
ERROR_INVALID_LENGTH
@ ERROR_INVALID_LENGTH
Definition: error.h:111
crypto.h
General definitions for cryptographic algorithms.
mask
uint8_t mask
Definition: web_socket.h:319
iv
uint8_t iv[]
Definition: ike.h:1626
GcmContext::cipherAlgo
const CipherAlgo * cipherAlgo
Cipher algorithm.
Definition: gcm.h:65
length
uint8_t length
Definition: tcp.h:375
MIN
#define MIN(a, b)
Definition: os_port.h:63
GcmContext::m
uint32_t m[GCM_TABLE_N][4]
Precalculated table.
Definition: gcm.h:67
z
uint8_t z
Definition: dns_common.h:191
GcmContext
GCM context.
Definition: gcm.h:64
STORE64BE
#define STORE64BE(a, p)
Definition: cpu_endian.h:322
m
uint8_t m
Definition: ndp.h:304
n
uint8_t n
Definition: dhcpv6_common.h:416
gcm.h
Galois/Counter Mode (GCM)
gcmXorBlock
void gcmXorBlock(uint8_t *x, const uint8_t *a, const uint8_t *b, size_t n)
XOR operation.
Definition: gcm.c:592
CipherAlgo
Common interface for encryption algorithms.
Definition: crypto.h:1104
s
uint8_t s
Definition: igmp_common.h:234
uint_t
unsigned int uint_t
Definition: compiler_port.h:57
osMemset
#define osMemset(p, value, length)
Definition: os_port.h:138
GcmContext::cipherContext
void * cipherContext
Cipher algorithm context.
Definition: gcm.h:66
gcmDecrypt
__weak_func error_t gcmDecrypt(GcmContext *context, const uint8_t *iv, size_t ivLen, const uint8_t *a, size_t aLen, const uint8_t *c, uint8_t *p, size_t length, const uint8_t *t, size_t tLen)
Authenticated decryption using GCM.
Definition: gcm.c:356
STORE32BE
#define STORE32BE(a, p)
Definition: cpu_endian.h:286
gcmEncrypt
__weak_func error_t gcmEncrypt(GcmContext *context, const uint8_t *iv, size_t ivLen, const uint8_t *a, size_t aLen, const uint8_t *p, uint8_t *c, size_t length, uint8_t *t, size_t tLen)
Authenticated encryption using GCM.
Definition: gcm.c:209
NO_ERROR
@ NO_ERROR
Success.
Definition: error.h:44
c
uint8_t c
Definition: ndp.h:514
debug.h
Debugging facilities.
GCM_TABLE_N
#define GCM_TABLE_N
Definition: gcm.h:46