projects / openssl.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
gcm128.c: fix AAD-only case with AAD length not divisible by 16.
[openssl.git] / crypto / modes / gcm128.c
diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c
index 875f6cab7d68d68432ad0ea4fdbd7cccdb953c2a..f8dd497f872534de719734b80de2fe1256d52837 100644 (file)
--- a/crypto/modes/gcm128.c
+++ b/crypto/modes/gcm128.c
@@ -148,6 +148,7 @@ static void gcm_gmult_8bit(u64 Xi[2], const u128 Htable[256])
        const u8 *xi = (const u8 *)Xi+15;
        size_t rem, n = *xi;
        const union { long one; char little; } is_endian = {1};
+       __fips_constseg
        static const size_t rem_8bit[256] = {
                PACK(0x0000), PACK(0x01C2), PACK(0x0384), PACK(0x0246),
                PACK(0x0708), PACK(0x06CA), PACK(0x048C), PACK(0x054E),
@@ -326,6 +327,7 @@ static void gcm_init_4bit(u128 Htable[16], u64 H[2])
 }
 
 #ifndef GHASH_ASM
+__fips_constseg
 static const size_t rem_4bit[16] = {
        PACK(0x0000), PACK(0x1C20), PACK(0x3840), PACK(0x2460),
        PACK(0x7080), PACK(0x6CA0), PACK(0x48C0), PACK(0x54E0),
@@ -461,6 +463,7 @@ static void gcm_ghash_4bit(u64 Xi[2],const u128 Htable[16],
      */ 
     u128 Hshr4[16];    /* Htable shifted right by 4 bits */
     u8   Hshl4[16];    /* Htable shifted left  by 4 bits */
+    __fips_constseg
     static const unsigned short rem_8bit[256] = {
        0x0000, 0x01C2, 0x0384, 0x0246, 0x0708, 0x06CA, 0x048C, 0x054E,
        0x0E10, 0x0FD2, 0x0D94, 0x0C56, 0x0918, 0x08DA, 0x0A9C, 0x0B5E,
@@ -668,14 +671,21 @@ void gcm_ghash_4bit_x86(u64 Xi[2],const u128 Htable[16],const u8 *inp,size_t len
 #  if __ARM_ARCH__>=7
 #   define GHASH_ASM_ARM
 #   define GCM_FUNCREF_4BIT
-extern unsigned int OPENSSL_armcap;
-
 void gcm_gmult_neon(u64 Xi[2],const u128 Htable[16]);
 void gcm_ghash_neon(u64 Xi[2],const u128 Htable[16],const u8 *inp,size_t len);
 #  endif
 # endif
 #endif
 
+#ifdef GCM_FUNCREF_4BIT
+# undef  GCM_MUL
+# define GCM_MUL(ctx,Xi)       (*gcm_gmult_p)(ctx->Xi.u,ctx->Htable)
+# ifdef GHASH
+#  undef  GHASH
+#  define GHASH(ctx,in,len)    (*gcm_ghash_p)(ctx->Xi.u,ctx->Htable,in,len)
+# endif
+#endif
+
 void CRYPTO_gcm128_init(GCM128_CONTEXT *ctx,void *key,block128_f block)
 {
        const union { long one; char little; } is_endian = {1};
@@ -706,7 +716,8 @@ void CRYPTO_gcm128_init(GCM128_CONTEXT *ctx,void *key,block128_f block)
 #elif  TABLE_BITS==4
 # if   defined(GHASH_ASM_X86_OR_64)
 #  if  !defined(GHASH_ASM_X86) || defined(OPENSSL_IA32_SSE2)
-       if (OPENSSL_ia32cap_P[1]&(1<<1)) {
+       if (OPENSSL_ia32cap_P[0]&(1<<24) &&     /* check FXSR bit */
+           OPENSSL_ia32cap_P[1]&(1<<1) ) {     /* check PCLMULQDQ bit */
                gcm_init_clmul(ctx->Htable,ctx->H.u);
                ctx->gmult = gcm_gmult_clmul;
                ctx->ghash = gcm_ghash_clmul;
@@ -715,7 +726,11 @@ void CRYPTO_gcm128_init(GCM128_CONTEXT *ctx,void *key,block128_f block)
 #  endif
        gcm_init_4bit(ctx->Htable,ctx->H.u);
 #  if  defined(GHASH_ASM_X86)                  /* x86 only */
-       if (OPENSSL_ia32cap_P[0]&(1<<23)) {
+#   if defined(OPENSSL_IA32_SSE2)
+       if (OPENSSL_ia32cap_P[0]&(1<<25)) {     /* check SSE bit */
+#   else
+       if (OPENSSL_ia32cap_P[0]&(1<<23)) {     /* check MMX bit */
+#   endif
                ctx->gmult = gcm_gmult_4bit_mmx;
                ctx->ghash = gcm_ghash_4bit_mmx;
        } else {
@@ -727,7 +742,7 @@ void CRYPTO_gcm128_init(GCM128_CONTEXT *ctx,void *key,block128_f block)
        ctx->ghash = gcm_ghash_4bit;
 #  endif
 # elif defined(GHASH_ASM_ARM)
-       if (OPENSSL_armcap & 1) {
+       if (OPENSSL_armcap_P & ARMV7_NEON) {
                ctx->gmult = gcm_gmult_neon;
                ctx->ghash = gcm_ghash_neon;
        } else {
@@ -746,7 +761,7 @@ void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx,const unsigned char *iv,size_t len)
        const union { long one; char little; } is_endian = {1};
        unsigned int ctr;
 #ifdef GCM_FUNCREF_4BIT
-       void (*gcm_gmult_4bit)(u64 Xi[2],const u128 Htable[16]) = ctx->gmult;
+       void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])    = ctx->gmult;
 #endif
 
        ctx->Yi.u[0]  = 0;
@@ -817,10 +832,10 @@ int CRYPTO_gcm128_aad(GCM128_CONTEXT *ctx,const unsigned char *aad,size_t len)
        unsigned int n;
        u64 alen = ctx->len.u[0];
 #ifdef GCM_FUNCREF_4BIT
-       void (*gcm_gmult_4bit)(u64 Xi[2],const u128 Htable[16]) = ctx->gmult;
+       void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])    = ctx->gmult;
 # ifdef GHASH
-       void (*gcm_ghash_4bit)(u64 Xi[2],const u128 Htable[16],
-                               const u8 *inp,size_t len) = ctx->ghash;
+       void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
+                               const u8 *inp,size_t len)       = ctx->ghash;
 # endif
 #endif
 
@@ -875,12 +890,14 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
        const union { long one; char little; } is_endian = {1};
        unsigned int n, ctr;
        size_t i;
-       u64 mlen = ctx->len.u[1];
+       u64        mlen  = ctx->len.u[1];
+       block128_f block = ctx->block;
+       void      *key   = ctx->key;
 #ifdef GCM_FUNCREF_4BIT
-       void (*gcm_gmult_4bit)(u64 Xi[2],const u128 Htable[16]) = ctx->gmult;
+       void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])    = ctx->gmult;
 # ifdef GHASH
-       void (*gcm_ghash_4bit)(u64 Xi[2],const u128 Htable[16],
-                               const u8 *inp,size_t len) = ctx->ghash;
+       void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
+                               const u8 *inp,size_t len)       = ctx->ghash;
 # endif
 #endif
 
@@ -927,7 +944,7 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                    size_t j=GHASH_CHUNK;
 
                    while (j) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -947,7 +964,7 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                    size_t j=i;
 
                    while (len>=16) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -964,7 +981,7 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                }
 #else
                while (len>=16) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -981,7 +998,7 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                }
 #endif
                if (len) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -999,7 +1016,7 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
 #endif
        for (i=0;i<len;++i) {
                if (n==0) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -1023,12 +1040,14 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
        const union { long one; char little; } is_endian = {1};
        unsigned int n, ctr;
        size_t i;
-       u64 mlen = ctx->len.u[1];
+       u64        mlen  = ctx->len.u[1];
+       block128_f block = ctx->block;
+       void      *key   = ctx->key;
 #ifdef GCM_FUNCREF_4BIT
-       void (*gcm_gmult_4bit)(u64 Xi[2],const u128 Htable[16]) = ctx->gmult;
+       void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])    = ctx->gmult;
 # ifdef GHASH
-       void (*gcm_ghash_4bit)(u64 Xi[2],const u128 Htable[16],
-                               const u8 *inp,size_t len) = ctx->ghash;
+       void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
+                               const u8 *inp,size_t len)       = ctx->ghash;
 # endif
 #endif
 
@@ -1075,7 +1094,7 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
 
                    GHASH(ctx,in,GHASH_CHUNK);
                    while (j) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -1093,7 +1112,7 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                if ((i = (len&(size_t)-16))) {
                    GHASH(ctx,in,i);
                    while (len>=16) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -1109,7 +1128,7 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                }
 #else
                while (len>=16) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -1127,7 +1146,7 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                }
 #endif
                if (len) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -1148,7 +1167,7 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
        for (i=0;i<len;++i) {
                u8 c;
                if (n==0) {
-                       (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+                       (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
                                PUTU32(ctx->Yi.c+12,ctr);
@@ -1174,12 +1193,13 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
        const union { long one; char little; } is_endian = {1};
        unsigned int n, ctr;
        size_t i;
-       u64 mlen = ctx->len.u[1];
+       u64   mlen = ctx->len.u[1];
+       void *key  = ctx->key;
 #ifdef GCM_FUNCREF_4BIT
-       void (*gcm_gmult_4bit)(u64 Xi[2],const u128 Htable[16]) = ctx->gmult;
+       void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])    = ctx->gmult;
 # ifdef GHASH
-       void (*gcm_ghash_4bit)(u64 Xi[2],const u128 Htable[16],
-                               const u8 *inp,size_t len) = ctx->ghash;
+       void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
+                               const u8 *inp,size_t len)       = ctx->ghash;
 # endif
 #endif
 
@@ -1214,7 +1234,7 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
        }
 #if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)
        while (len>=GHASH_CHUNK) {
-               (*stream)(in,out,GHASH_CHUNK/16,ctx->key,ctx->Yi.c);
+               (*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);
                ctr += GHASH_CHUNK/16;
                if (is_endian.little)
                        PUTU32(ctx->Yi.c+12,ctr);
@@ -1229,7 +1249,7 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
        if ((i = (len&(size_t)-16))) {
                size_t j=i/16;
 
-               (*stream)(in,out,j,ctx->key,ctx->Yi.c);
+               (*stream)(in,out,j,key,ctx->Yi.c);
                ctr += (unsigned int)j;
                if (is_endian.little)
                        PUTU32(ctx->Yi.c+12,ctr);
@@ -1249,7 +1269,7 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
 #endif
        }
        if (len) {
-               (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+               (*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);
                ++ctr;
                if (is_endian.little)
                        PUTU32(ctx->Yi.c+12,ctr);
@@ -1272,12 +1292,13 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
        const union { long one; char little; } is_endian = {1};
        unsigned int n, ctr;
        size_t i;
-       u64 mlen = ctx->len.u[1];
+       u64   mlen = ctx->len.u[1];
+       void *key  = ctx->key;
 #ifdef GCM_FUNCREF_4BIT
-       void (*gcm_gmult_4bit)(u64 Xi[2],const u128 Htable[16]) = ctx->gmult;
+       void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])    = ctx->gmult;
 # ifdef GHASH
-       void (*gcm_ghash_4bit)(u64 Xi[2],const u128 Htable[16],
-                               const u8 *inp,size_t len) = ctx->ghash;
+       void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
+                               const u8 *inp,size_t len)       = ctx->ghash;
 # endif
 #endif
 
@@ -1315,7 +1336,7 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
 #if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)
        while (len>=GHASH_CHUNK) {
                GHASH(ctx,in,GHASH_CHUNK);
-               (*stream)(in,out,GHASH_CHUNK/16,ctx->key,ctx->Yi.c);
+               (*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);
                ctr += GHASH_CHUNK/16;
                if (is_endian.little)
                        PUTU32(ctx->Yi.c+12,ctr);
@@ -1341,7 +1362,7 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
                j   = i/16;
                in -= i;
 #endif
-               (*stream)(in,out,j,ctx->key,ctx->Yi.c);
+               (*stream)(in,out,j,key,ctx->Yi.c);
                ctr += (unsigned int)j;
                if (is_endian.little)
                        PUTU32(ctx->Yi.c+12,ctr);
@@ -1352,7 +1373,7 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
                len -= i;
        }
        if (len) {
-               (*ctx->block)(ctx->Yi.c,ctx->EKi.c,ctx->key);
+               (*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);
                ++ctr;
                if (is_endian.little)
                        PUTU32(ctx->Yi.c+12,ctr);
@@ -1377,10 +1398,10 @@ int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx,const unsigned char *tag,
        u64 alen = ctx->len.u[0]<<3;
        u64 clen = ctx->len.u[1]<<3;
 #ifdef GCM_FUNCREF_4BIT
-       void (*gcm_gmult_4bit)(u64 Xi[2],const u128 Htable[16]) = ctx->gmult;
+       void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])    = ctx->gmult;
 #endif
 
-       if (ctx->mres)
+       if (ctx->mres || ctx->ares)
                GCM_MUL(ctx,Xi);
 
        if (is_endian.little) {
@@ -1725,11 +1746,16 @@ int main()
                        ctr_t/(double)sizeof(buf),
                        (gcm_t-ctr_t)/(double)sizeof(buf));
 #ifdef GHASH
-       GHASH(&ctx,buf.c,sizeof(buf));
+       {
+       void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
+                               const u8 *inp,size_t len)       = ctx.ghash;
+
+       GHASH((&ctx),buf.c,sizeof(buf));
        start = OPENSSL_rdtsc();
-       for (i=0;i<100;++i) GHASH(&ctx,buf.c,sizeof(buf));
+       for (i=0;i<100;++i) GHASH((&ctx),buf.c,sizeof(buf));
        gcm_t = OPENSSL_rdtsc() - start;
        printf("%.2f\n",gcm_t/(double)sizeof(buf)/(double)i);
+       }
 #endif
        }
 #endif
Unnamed repository; edit this file 'description' to name the repository.