C9S/boringssl
2
0
Fork 0
mirror of https://boringssl.googlesource.com/boringssl synced 2026-07-21 14:43:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

Namespace crypto/fipsmodule/aes's internal symbols.

Browse Source 
Down from 699 to 652 unintended exported symbols.

Bug: 42220000
Change-Id: Ifd325834155dd78262e8645ca05325ff6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/86648
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
This commit is contained in:
Rudolf Polzer
2026-01-07 06:00:26 -08:00
committed by Boringssl LUCI CQ
parent 1c0b1841da
commit e7aa303195
19 changed files with 302 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/cipher/e_aesctrhmac.cc
+19 -13
View File
@@ -26,6 +26,8 @@
#include "../fipsmodule/cipher/internal.h"
using namespace bssl;
#define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
#define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
@@ -119,10 +121,12 @@ static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
SHA256_Update(sha256, bytes, sizeof(bytes));
}
static void hmac_calculate(
uint8_t out[SHA256_DIGEST_LENGTH], const SHA256_CTX *inner_init_state,
const SHA256_CTX *outer_init_state, bssl::Span<const CRYPTO_IVEC> aadvecs,
const uint8_t *nonce, bssl::Span<const CRYPTO_IOVEC> iovecs, bool encrypt) {
static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
const SHA256_CTX *inner_init_state,
const SHA256_CTX *outer_init_state,
Span<const CRYPTO_IVEC> aadvecs,
const uint8_t *nonce,
Span<const CRYPTO_IOVEC> iovecs, bool encrypt) {
size_t ad_len = bssl::iovec::TotalLength(aadvecs);
SHA256_CTX sha256;
OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
@@ -157,7 +161,7 @@ static void hmac_calculate(
static void aead_aes_ctr_hmac_sha256_crypt(
const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs, const uint8_t *nonce) {
Span<const CRYPTO_IOVEC> iovecs, const uint8_t *nonce) {
uint8_t partial_block_buffer[AES_BLOCK_SIZE];
unsigned partial_block_offset = 0;
OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
@@ -173,10 +177,12 @@ static void aead_aes_ctr_hmac_sha256_crypt(
}
}
static int aead_aes_ctr_hmac_sha256_sealv(
const EVP_AEAD_CTX *ctx, bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<uint8_t> out_tag, size_t *out_tag_len,
bssl::Span<const uint8_t> nonce, bssl::Span<const CRYPTO_IVEC> aadvecs) {
static int aead_aes_ctr_hmac_sha256_sealv(const EVP_AEAD_CTX *ctx,
Span<const CRYPTO_IOVEC> iovecs,
Span<uint8_t> out_tag,
size_t *out_tag_len,
Span<const uint8_t> nonce,
Span<const CRYPTO_IVEC> aadvecs) {
const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
(struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state;
const uint64_t in_len_64 = bssl::iovec::TotalLength(iovecs);
@@ -203,16 +209,16 @@ static int aead_aes_ctr_hmac_sha256_sealv(
hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
&aes_ctx->outer_init_state, aadvecs, nonce.data(), iovecs,
/*encrypt=*/true);
CopyToPrefix(bssl::Span(hmac_result).first(ctx->tag_len), out_tag);
CopyToPrefix(Span(hmac_result).first(ctx->tag_len), out_tag);
*out_tag_len = ctx->tag_len;
return 1;
}
static int aead_aes_ctr_hmac_sha256_openv_detached(
const EVP_AEAD_CTX *ctx, bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<const uint8_t> nonce, bssl::Span<const uint8_t> in_tag,
bssl::Span<const CRYPTO_IVEC> aadvecs) {
const EVP_AEAD_CTX *ctx, Span<const CRYPTO_IOVEC> iovecs,
Span<const uint8_t> nonce, Span<const uint8_t> in_tag,
Span<const CRYPTO_IVEC> aadvecs) {
const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
(struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state;
crypto/cipher/e_aeseax.cc
+17 -14
View File
@@ -30,6 +30,9 @@
#include "../fipsmodule/cipher/internal.h"
#include "../internal.h"
using namespace bssl;
// Implementation of AES-EAX defined in
// https://www.iacr.org/archive/fse2004/30170391/30170391.pdf.
@@ -117,8 +120,8 @@ static void pad(const struct aead_aes_eax_ctx *aes_ctx,
template <typename IVEC>
static void omac_with_tag(const struct aead_aes_eax_ctx *aes_ctx,
uint8_t out[AES_BLOCK_SIZE],
bssl::Span<const IVEC> ivecs, uint8_t tag) {
uint8_t out[AES_BLOCK_SIZE], Span<const IVEC> ivecs,
uint8_t tag) {
OPENSSL_memset(out, 0, AES_BLOCK_SIZE);
out[AES_BLOCK_SIZE - 1] = tag;
size_t in_len = bssl::iovec::TotalLength(ivecs);
@@ -159,7 +162,7 @@ static void omac_with_tag(const struct aead_aes_eax_ctx *aes_ctx,
static void omac_with_tag_iovec_out(const struct aead_aes_eax_ctx *aes_ctx,
uint8_t out[AES_BLOCK_SIZE],
bssl::Span<const CRYPTO_IOVEC> iovecs,
Span<const CRYPTO_IOVEC> iovecs,
uint8_t tag) {
OPENSSL_memset(out, 0, AES_BLOCK_SIZE);
out[AES_BLOCK_SIZE - 1] = tag;
@@ -201,7 +204,7 @@ static void omac_with_tag_iovec_out(const struct aead_aes_eax_ctx *aes_ctx,
// Encrypts/decrypts |in_len| bytes from |in| to |out| using AES-CTR with |n| as
// the IV.
static void aes_ctr(const struct aead_aes_eax_ctx *aes_ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs,
Span<const CRYPTO_IOVEC> iovecs,
const uint8_t n[AES_BLOCK_SIZE]) {
uint8_t ivec[AES_BLOCK_SIZE];
OPENSSL_memcpy(ivec, n, AES_BLOCK_SIZE);
@@ -216,10 +219,10 @@ static void aes_ctr(const struct aead_aes_eax_ctx *aes_ctx,
}
static int aead_aes_eax_sealv(const EVP_AEAD_CTX *ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<uint8_t> out_tag, size_t *out_tag_len,
bssl::Span<const uint8_t> nonce,
bssl::Span<const CRYPTO_IVEC> aadvecs) {
Span<const CRYPTO_IOVEC> iovecs,
Span<uint8_t> out_tag, size_t *out_tag_len,
Span<const uint8_t> nonce,
Span<const CRYPTO_IVEC> aadvecs) {
// We use the full 128 bits of the nonce as counter, so no need to check the
// plaintext size.
@@ -241,7 +244,7 @@ static int aead_aes_eax_sealv(const EVP_AEAD_CTX *ctx,
CRYPTO_IVEC noncevec[1];
noncevec[0].in = nonce.data();
noncevec[0].len = nonce.size();
omac_with_tag(aes_ctx, n, bssl::Span<const CRYPTO_IVEC>(noncevec), /*tag=*/0);
omac_with_tag(aes_ctx, n, Span<const CRYPTO_IVEC>(noncevec), /*tag=*/0);
// H <- OMAC(1 || ad)
uint8_t h[AES_BLOCK_SIZE];
omac_with_tag(aes_ctx, h, aadvecs, /*tag=*/1);
@@ -260,10 +263,10 @@ static int aead_aes_eax_sealv(const EVP_AEAD_CTX *ctx,
}
static int aead_aes_eax_openv_detached(const EVP_AEAD_CTX *ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<const uint8_t> nonce,
bssl::Span<const uint8_t> in_tag,
bssl::Span<const CRYPTO_IVEC> aadvecs) {
Span<const CRYPTO_IOVEC> iovecs,
Span<const uint8_t> nonce,
Span<const uint8_t> in_tag,
Span<const CRYPTO_IVEC> aadvecs) {
const uint64_t ad_len_64 = bssl::iovec::TotalLength(aadvecs);
if (ad_len_64 >= (UINT64_C(1) << 61)) {
OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
@@ -290,7 +293,7 @@ static int aead_aes_eax_openv_detached(const EVP_AEAD_CTX *ctx,
CRYPTO_IVEC noncevec[1];
noncevec[0].in = nonce.data();
noncevec[0].len = nonce.size();
omac_with_tag(aes_ctx, n, bssl::Span<const CRYPTO_IVEC>(noncevec),
omac_with_tag(aes_ctx, n, Span<const CRYPTO_IVEC>(noncevec),
/*tag=*/0);
// H <- OMAC(1 || ad)
uint8_t h[AES_BLOCK_SIZE];
crypto/cipher/e_aesgcmsiv.cc
+29 -28
View File
@@ -26,6 +26,8 @@
#include "../internal.h"
using namespace bssl;
#define EVP_AEAD_AES_GCM_SIV_NONCE_LEN 12
#define EVP_AEAD_AES_GCM_SIV_TAG_LEN 16
@@ -228,9 +230,8 @@ void aead_aes_gcm_siv_asm_cleanup(EVP_AEAD_CTX *ctx) {}
// gcm_siv_asm_polyval evaluates POLYVAL at |auth_key| on the given plaintext
// and AD. The result is written to |out_tag|.
void gcm_siv_asm_polyval(uint8_t out_tag[16],
bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<const CRYPTO_IVEC> aadvecs,
void gcm_siv_asm_polyval(uint8_t out_tag[16], Span<const CRYPTO_IOVEC> iovecs,
Span<const CRYPTO_IVEC> aadvecs,
const uint8_t auth_key[16], const uint8_t nonce[12]) {
OPENSSL_memset(out_tag, 0, 16);
const size_t ad_len = bssl::iovec::TotalLength(aadvecs);
@@ -270,11 +271,11 @@ void gcm_siv_asm_polyval(uint8_t out_tag[16],
return true;
};
bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(
aadvecs, f_whole, f_final);
bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(aadvecs, f_whole,
f_final);
bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(
iovecs, f_whole, f_final);
bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(iovecs, f_whole,
f_final);
uint8_t length_block[16];
CRYPTO_store_u64_le(length_block, ad_len * 8);
@@ -341,10 +342,10 @@ void aead_aes_gcm_siv_kdf(int is_128_bit,
}
int aead_aes_gcm_siv_asm_sealv(const EVP_AEAD_CTX *ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<uint8_t> out_tag, size_t *out_tag_len,
bssl::Span<const uint8_t> nonce,
bssl::Span<const CRYPTO_IVEC> aadvecs) {
Span<const CRYPTO_IOVEC> iovecs,
Span<uint8_t> out_tag, size_t *out_tag_len,
Span<const uint8_t> nonce,
Span<const CRYPTO_IVEC> aadvecs) {
const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx = asm_ctx_from_ctx(ctx);
const size_t in_len = bssl::iovec::TotalLength(iovecs);
const uint64_t in_len_64 = in_len;
@@ -464,10 +465,10 @@ int aead_aes_gcm_siv_asm_sealv(const EVP_AEAD_CTX *ctx,
}
int aead_aes_gcm_siv_asm_openv_detached(const EVP_AEAD_CTX *ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<const uint8_t> nonce,
bssl::Span<const uint8_t> in_tag,
bssl::Span<const CRYPTO_IVEC> aadvecs) {
Span<const CRYPTO_IOVEC> iovecs,
Span<const uint8_t> nonce,
Span<const uint8_t> in_tag,
Span<const CRYPTO_IVEC> aadvecs) {
const size_t ad_len = bssl::iovec::TotalLength(aadvecs);
const uint64_t ad_len_64 = ad_len;
if (ad_len_64 >= (UINT64_C(1) << 61)) {
@@ -704,7 +705,7 @@ void aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX *ctx) {}
// only the first four bytes are used and the GCM-SIV tweak to the final byte
// is applied. The |in| and |out| pointers may be equal but otherwise must not
// alias.
void gcm_siv_crypt(bssl::Span<const CRYPTO_IOVEC> iovecs,
void gcm_siv_crypt(Span<const CRYPTO_IOVEC> iovecs,
const uint8_t initial_counter[AES_BLOCK_SIZE],
block128_f enc_block, const AES_KEY *key) {
uint8_t counter[16];
@@ -819,8 +820,8 @@ void crypto_polyval_finish(const struct polyval_ctx *ctx, uint8_t out[16]) {
// gcm_siv_polyval evaluates POLYVAL at |auth_key| on the given plaintext and
// AD. The result is written to |out_tag|.
void gcm_siv_polyval(uint8_t out_tag[16], bssl::Span<const CRYPTO_IOVEC> iovecs,
bool encrypt, bssl::Span<const CRYPTO_IVEC> aadvecs,
void gcm_siv_polyval(uint8_t out_tag[16], Span<const CRYPTO_IOVEC> iovecs,
bool encrypt, Span<const CRYPTO_IVEC> aadvecs,
const uint8_t auth_key[16],
const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
struct polyval_ctx polyval_ctx;
@@ -846,8 +847,8 @@ void gcm_siv_polyval(uint8_t out_tag[16], bssl::Span<const CRYPTO_IOVEC> iovecs,
return true;
};
bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(
aadvecs, f_whole, f_final);
bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(aadvecs, f_whole,
f_final);
if (encrypt) {
bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE, /*WriteOut=*/false>(
@@ -916,10 +917,10 @@ void gcm_siv_keys(const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx,
}
int aead_aes_gcm_siv_sealv(const EVP_AEAD_CTX *ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<uint8_t> out_tag, size_t *out_tag_len,
bssl::Span<const uint8_t> nonce,
bssl::Span<const CRYPTO_IVEC> aadvecs) {
Span<const CRYPTO_IOVEC> iovecs,
Span<uint8_t> out_tag, size_t *out_tag_len,
Span<const uint8_t> nonce,
Span<const CRYPTO_IVEC> aadvecs) {
const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx =
(struct aead_aes_gcm_siv_ctx *)&ctx->state;
size_t in_len = bssl::iovec::TotalLength(iovecs);
@@ -959,10 +960,10 @@ int aead_aes_gcm_siv_sealv(const EVP_AEAD_CTX *ctx,
}
int aead_aes_gcm_siv_openv_detached(const EVP_AEAD_CTX *ctx,
bssl::Span<const CRYPTO_IOVEC> iovecs,
bssl::Span<const uint8_t> nonce,
bssl::Span<const uint8_t> in_tag,
bssl::Span<const CRYPTO_IVEC> aadvecs) {
Span<const CRYPTO_IOVEC> iovecs,
Span<const uint8_t> nonce,
Span<const uint8_t> in_tag,
Span<const CRYPTO_IVEC> aadvecs) {
const uint64_t ad_len_64 = bssl::iovec::TotalLength(aadvecs);
if (ad_len_64 >= (UINT64_C(1) << 61)) {
OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
crypto/fipsmodule/aes/aes.cc.inc
+17 -11
View File
@@ -14,10 +14,12 @@
#include <assert.h>
#include "internal.h"
#include "../bcm_interface.h"
#include "internal.h"
using namespace bssl;
// Be aware that different sets of AES functions use incompatible key
// representations, varying in format of the key schedule, the |AES_KEY.rounds|
// value, or both. Therefore they cannot mix. Also, on AArch64, the plain-C
@@ -85,7 +87,8 @@ bcm_status BCM_aes_set_decrypt_key(const uint8_t *key, unsigned bits,
// On x86 and x86_64, |aes_hw_set_decrypt_key|, we implement
// |aes_hw_encrypt_key_to_decrypt_key| in assembly and rely on C code to combine
// the operations.
int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) {
int bssl::aes_hw_set_decrypt_key(const uint8_t *user_key, int bits,
AES_KEY *key) {
int ret = aes_hw_set_encrypt_key(user_key, bits, key);
if (ret == 0) {
aes_hw_encrypt_key_to_decrypt_key(key);
@@ -93,7 +96,8 @@ int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) {
return ret;
}
int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) {
int bssl::aes_hw_set_encrypt_key(const uint8_t *user_key, int bits,
AES_KEY *key) {
if (aes_hw_set_encrypt_key_alt_preferred()) {
return aes_hw_set_encrypt_key_alt(user_key, bits, key);
} else {
@@ -105,8 +109,9 @@ int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) {
#if defined(VPAES) && defined(OPENSSL_X86)
// On x86, there is no |vpaes_ctr32_encrypt_blocks|, so we implement it
// ourselves. This avoids all callers needing to account for a missing function.
void vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t blocks,
const AES_KEY *key, const uint8_t iv[16]) {
void bssl::vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
size_t blocks, const AES_KEY *key,
const uint8_t iv[16]) {
uint32_t ctr = CRYPTO_load_u32_be(iv + 12);
uint8_t iv_buf[16], enc[16];
OPENSSL_memcpy(iv_buf, iv, 12);
@@ -122,9 +127,10 @@ void vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t blocks,
#endif
#if defined(BSAES)
void vpaes_ctr32_encrypt_blocks_with_bsaes(const uint8_t *in, uint8_t *out,
size_t blocks, const AES_KEY *key,
const uint8_t ivec[16]) {
void bssl::vpaes_ctr32_encrypt_blocks_with_bsaes(const uint8_t *in,
uint8_t *out, size_t blocks,
const AES_KEY *key,
const uint8_t ivec[16]) {
// |bsaes_ctr32_encrypt_blocks| is faster than |vpaes_ctr32_encrypt_blocks|,
// but it takes at least one full 8-block batch to amortize the conversion.
if (blocks < 8) {
@@ -159,9 +165,9 @@ void vpaes_ctr32_encrypt_blocks_with_bsaes(const uint8_t *in, uint8_t *out,
}
#endif // BSAES
ctr128_f aes_ctr_set_key(AES_KEY *aes_key, int *out_is_hwaes,
block128_f *out_block, const uint8_t *key,
size_t key_bytes) {
ctr128_f bssl::aes_ctr_set_key(AES_KEY *aes_key, int *out_is_hwaes,
block128_f *out_block, const uint8_t *key,
size_t key_bytes) {
// This function assumes the key length was previously validated.
assert(key_bytes == 128 / 8 || key_bytes == 192 / 8 || key_bytes == 256 / 8);
if (hwaes_capable()) {
crypto/fipsmodule/aes/aes_nohw.cc.inc
+16 -11
View File
@@ -25,6 +25,8 @@
#endif
using namespace bssl;
// This file contains a constant-time implementation of AES, bitsliced with
// 32-bit, 64-bit, or 128-bit words, operating on two-, four-, and eight-block
// batches, respectively. The 128-bit implementation requires SSE2 intrinsics.
@@ -1121,8 +1123,8 @@ static void aes_nohw_setup_key_256(AES_KEY *key, const uint8_t in[32]) {
// External API.
int aes_nohw_set_encrypt_key(const uint8_t *key, unsigned bits,
AES_KEY *aeskey) {
int bssl::aes_nohw_set_encrypt_key(const uint8_t *key, unsigned bits,
AES_KEY *aeskey) {
switch (bits) {
case 128:
aes_nohw_setup_key_128(aeskey, key);
@@ -1137,12 +1139,13 @@ int aes_nohw_set_encrypt_key(const uint8_t *key, unsigned bits,
return 1;
}
int aes_nohw_set_decrypt_key(const uint8_t *key, unsigned bits,
AES_KEY *aeskey) {
int bssl::aes_nohw_set_decrypt_key(const uint8_t *key, unsigned bits,
AES_KEY *aeskey) {
return aes_nohw_set_encrypt_key(key, bits, aeskey);
}
void aes_nohw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
void bssl::aes_nohw_encrypt(const uint8_t *in, uint8_t *out,
const AES_KEY *key) {
AES_NOHW_SCHEDULE sched;
aes_nohw_expand_round_keys(&sched, key);
AES_NOHW_BATCH batch;
@@ -1151,7 +1154,8 @@ void aes_nohw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
aes_nohw_from_batch(out, /*num_blocks=*/1, &batch);
}
void aes_nohw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
void bssl::aes_nohw_decrypt(const uint8_t *in, uint8_t *out,
const AES_KEY *key) {
AES_NOHW_SCHEDULE sched;
aes_nohw_expand_round_keys(&sched, key);
AES_NOHW_BATCH batch;
@@ -1171,9 +1175,9 @@ static inline void aes_nohw_xor_block(uint8_t out[16], const uint8_t a[16],
}
}
void aes_nohw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
size_t blocks, const AES_KEY *key,
const uint8_t ivec[16]) {
void bssl::aes_nohw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
size_t blocks, const AES_KEY *key,
const uint8_t ivec[16]) {
if (blocks == 0) {
return;
}
@@ -1216,8 +1220,9 @@ void aes_nohw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
}
}
void aes_nohw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t *ivec, const int enc) {
void bssl::aes_nohw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t *ivec,
const int enc) {
assert(len % 16 == 0);
size_t blocks = len / 16;
if (blocks == 0) {
crypto/fipsmodule/aes/aes_test.cc
+3
View File
@@ -31,7 +31,9 @@
#include "../../test/wycheproof_util.h"
#include "internal.h"
BSSL_NAMESPACE_BEGIN
namespace {
void TestRaw(FileTest *t) {
std::vector<uint8_t> key, plaintext, ciphertext;
ASSERT_TRUE(t->GetBytes(&key, "Key"));
@@ -622,3 +624,4 @@ TEST(AESTest, VPAESToBSAESConvert) {
#endif // BSAES && !SHARED_LIBRARY
} // namespace
BSSL_NAMESPACE_END
crypto/fipsmodule/aes/cbc.cc.inc
+8 -6
View File
@@ -19,9 +19,11 @@
#include "../../internal.h"
void CRYPTO_cbc128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
block128_f block) {
using namespace bssl;
void bssl::CRYPTO_cbc128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
block128_f block) {
assert(key != nullptr && ivec != nullptr);
if (len == 0) {
// Avoid |ivec| == |iv| in the |memcpy| below, which is not legal in C.
@@ -60,9 +62,9 @@ void CRYPTO_cbc128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
OPENSSL_memcpy(ivec, iv, 16);
}
void CRYPTO_cbc128_decrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
block128_f block) {
void bssl::CRYPTO_cbc128_decrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
block128_f block) {
assert(key != nullptr && ivec != nullptr);
if (len == 0) {
// Avoid |ivec| == |iv| in the |memcpy| below, which is not legal in C.
crypto/fipsmodule/aes/cfb.cc.inc
+12 -10
View File
@@ -18,11 +18,13 @@
#include "internal.h"
using namespace bssl;
static_assert(16 % sizeof(size_t) == 0, "block cannot be divided into size_t");
void CRYPTO_cfb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16], unsigned *num,
int enc, block128_f block) {
void bssl::CRYPTO_cfb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
unsigned *num, int enc, block128_f block) {
assert(in && out && key && ivec && num);
unsigned n = *num;
@@ -134,9 +136,9 @@ static void cfbr_encrypt_block(const uint8_t *in, uint8_t *out, unsigned nbits,
}
// N.B. This expects the input to be packed, MS bit first
void CRYPTO_cfb128_1_encrypt(const uint8_t *in, uint8_t *out, size_t bits,
const AES_KEY *key, uint8_t ivec[16],
unsigned *num, int enc, block128_f block) {
void bssl::CRYPTO_cfb128_1_encrypt(const uint8_t *in, uint8_t *out, size_t bits,
const AES_KEY *key, uint8_t ivec[16],
unsigned *num, int enc, block128_f block) {
size_t n;
uint8_t c[1], d[1];
@@ -151,10 +153,10 @@ void CRYPTO_cfb128_1_encrypt(const uint8_t *in, uint8_t *out, size_t bits,
}
}
void CRYPTO_cfb128_8_encrypt(const unsigned char *in, unsigned char *out,
size_t length, const AES_KEY *key,
unsigned char ivec[16], unsigned *num, int enc,
block128_f block) {
void bssl::CRYPTO_cfb128_8_encrypt(const unsigned char *in, unsigned char *out,
size_t length, const AES_KEY *key,
unsigned char ivec[16], unsigned *num,
int enc, block128_f block) {
size_t n;
assert(in && out && key && ivec && num);
crypto/fipsmodule/aes/ctr.cc.inc
+6 -4
View File
@@ -19,6 +19,8 @@
#include "../../internal.h"
using namespace bssl;
static_assert(16 % sizeof(crypto_word_t) == 0,
"block cannot be divided into crypto_word_t");
@@ -34,10 +36,10 @@ static void ctr96_inc(uint8_t *counter) {
} while (n);
}
void CRYPTO_ctr128_encrypt_ctr32(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
uint8_t ecount_buf[16], unsigned int *num,
ctr128_f func) {
void bssl::CRYPTO_ctr128_encrypt_ctr32(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
uint8_t ivec[16], uint8_t ecount_buf[16],
unsigned int *num, ctr128_f func) {
unsigned int n, ctr32;
assert(key && ecount_buf && num);
crypto/fipsmodule/aes/gcm.cc.inc
+21 -19
View File
@@ -23,12 +23,14 @@
#include "internal.h"
using namespace bssl;
// kSizeTWithoutLower4Bits is a mask that can be used to zero the lower four
// bits of a |size_t|.
static const size_t kSizeTWithoutLower4Bits = (size_t) -16;
#define GCM_MUL(key, ctx, Xi) gcm_gmult_nohw((ctx)->Xi, (key)->Htable)
#define GCM_MUL(key, ctx, Xi) bssl::gcm_gmult_nohw((ctx)->Xi, (key)->Htable)
#define GHASH(key, ctx, in, len) \
gcm_ghash_nohw((ctx)->Xi, (key)->Htable, in, len)
// GHASH_CHUNK is "stride parameter" missioned to mitigate cache
@@ -49,7 +51,7 @@ static inline void gcm_reduce_1bit(u128 *V) {
}
}
void gcm_init_ssse3(u128 Htable[16], const uint64_t H[2]) {
void bssl::gcm_init_ssse3(u128 Htable[16], const uint64_t H[2]) {
Htable[0].hi = 0;
Htable[0].lo = 0;
u128 V;
@@ -168,8 +170,8 @@ static size_t hw_gcm_decrypt(const uint8_t *in, uint8_t *out, size_t len,
#endif // HW_GCM && AARCH64
void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
u128 out_table[16], const uint8_t gcm_key[16]) {
void bssl::CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
u128 out_table[16], const uint8_t gcm_key[16]) {
// H is passed to |gcm_init_*| as a pair of byte-swapped, 64-bit values.
uint64_t H[2] = {CRYPTO_load_u64_be(gcm_key),
CRYPTO_load_u64_be(gcm_key + 8)};
@@ -240,8 +242,8 @@ void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
*out_hash = gcm_ghash_nohw;
}
void CRYPTO_gcm128_init_aes_key(GCM128_KEY *gcm_key, const uint8_t *key,
size_t key_bytes) {
void bssl::CRYPTO_gcm128_init_aes_key(GCM128_KEY *gcm_key, const uint8_t *key,
size_t key_bytes) {
switch (key_bytes) {
case 16:
boringssl_fips_inc_counter(fips_counter_evp_aes_128_gcm);
@@ -283,8 +285,8 @@ void CRYPTO_gcm128_init_aes_key(GCM128_KEY *gcm_key, const uint8_t *key,
#endif
}
void CRYPTO_gcm128_init_ctx(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *iv, size_t iv_len) {
void bssl::CRYPTO_gcm128_init_ctx(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *iv, size_t iv_len) {
#ifdef GCM_FUNCREF
void (*gcm_gmult_p)(uint8_t Xi[16], const u128 Htable[16]) = key->gmult;
#endif
@@ -331,8 +333,8 @@ void CRYPTO_gcm128_init_ctx(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
CRYPTO_store_u32_be(ctx->Yi + 12, ctr);
}
int CRYPTO_gcm128_aad(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *aad, size_t aad_len) {
int bssl::CRYPTO_gcm128_aad(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *aad, size_t aad_len) {
#ifdef GCM_FUNCREF
void (*gcm_gmult_p)(uint8_t Xi[16], const u128 Htable[16]) = key->gmult;
void (*gcm_ghash_p)(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
@@ -385,8 +387,8 @@ int CRYPTO_gcm128_aad(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
return 1;
}
int CRYPTO_gcm128_encrypt(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *in, uint8_t *out, size_t len) {
int bssl::CRYPTO_gcm128_encrypt(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *in, uint8_t *out, size_t len) {
#ifdef GCM_FUNCREF
void (*gcm_gmult_p)(uint8_t Xi[16], const u128 Htable[16]) = key->gmult;
void (*gcm_ghash_p)(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
@@ -472,8 +474,8 @@ int CRYPTO_gcm128_encrypt(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
return 1;
}
int CRYPTO_gcm128_decrypt(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *in, uint8_t *out, size_t len) {
int bssl::CRYPTO_gcm128_decrypt(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *in, uint8_t *out, size_t len) {
#ifdef GCM_FUNCREF
void (*gcm_gmult_p)(uint8_t Xi[16], const u128 Htable[16]) = key->gmult;
void (*gcm_ghash_p)(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
@@ -563,8 +565,8 @@ int CRYPTO_gcm128_decrypt(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
return 1;
}
int CRYPTO_gcm128_finish(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *tag, size_t len) {
int bssl::CRYPTO_gcm128_finish(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
const uint8_t *tag, size_t len) {
#ifdef GCM_FUNCREF
void (*gcm_gmult_p)(uint8_t Xi[16], const u128 Htable[16]) = key->gmult;
#endif
@@ -587,14 +589,14 @@ int CRYPTO_gcm128_finish(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
}
}
void CRYPTO_gcm128_tag(const GCM128_KEY *key, GCM128_CONTEXT *ctx, uint8_t *tag,
size_t len) {
void bssl::CRYPTO_gcm128_tag(const GCM128_KEY *key, GCM128_CONTEXT *ctx,
uint8_t *tag, size_t len) {
CRYPTO_gcm128_finish(key, ctx, nullptr, 0);
OPENSSL_memcpy(tag, ctx->Xi, len <= sizeof(ctx->Xi) ? len : sizeof(ctx->Xi));
}
#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
int crypto_gcm_clmul_enabled() {
int bssl::crypto_gcm_clmul_enabled() {
#if defined(GHASH_ASM_X86) || defined(GHASH_ASM_X86_64)
return CRYPTO_is_PCLMUL_capable() && CRYPTO_is_SSSE3_capable();
#else
crypto/fipsmodule/aes/gcm_nohw.cc.inc
+6 -4
View File
@@ -22,6 +22,8 @@
#endif
using namespace bssl;
// This file contains a constant-time implementation of GHASH based on the notes
// in https://bearssl.org/constanttime.html#ghash-for-gcm and the reduction
// algorithm described in
@@ -192,7 +194,7 @@ static void gcm_mul64_nohw(uint64_t *out_lo, uint64_t *out_hi, uint64_t a,
#endif // BORINGSSL_HAS_UINT128
void gcm_init_nohw(u128 Htable[16], const uint64_t Xi[2]) {
void bssl::gcm_init_nohw(u128 Htable[16], const uint64_t Xi[2]) {
// We implement GHASH in terms of POLYVAL, as described in RFC 8452. This
// avoids a shift by 1 in the multiplication, needed to account for bit
// reversal losing a bit after multiplication, that is,
@@ -274,7 +276,7 @@ static void gcm_polyval_nohw(uint64_t Xi[2], const u128 *H) {
Xi[1] = r3;
}
void gcm_gmult_nohw(uint8_t Xi[16], const u128 Htable[16]) {
void bssl::gcm_gmult_nohw(uint8_t Xi[16], const u128 Htable[16]) {
uint64_t swapped[2];
swapped[0] = CRYPTO_load_u64_be(Xi + 8);
swapped[1] = CRYPTO_load_u64_be(Xi);
@@ -283,8 +285,8 @@ void gcm_gmult_nohw(uint8_t Xi[16], const u128 Htable[16]) {
CRYPTO_store_u64_be(Xi + 8, swapped[0]);
}
void gcm_ghash_nohw(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
size_t len) {
void bssl::gcm_ghash_nohw(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *inp, size_t len) {
uint64_t swapped[2];
swapped[0] = CRYPTO_load_u64_be(Xi + 8);
swapped[1] = CRYPTO_load_u64_be(Xi);
crypto/fipsmodule/aes/gcm_test.cc
+6
View File
@@ -22,6 +22,9 @@
#include "internal.h"
BSSL_NAMESPACE_BEGIN
namespace {
#if defined(SUPPORTS_ABI_TEST) && !defined(OPENSSL_NO_ASM)
TEST(GCMTest, ABI) {
static const uint64_t kH[2] = {
@@ -171,3 +174,6 @@ TEST(GCMTest, ABI) {
#endif
}
#endif // SUPPORTS_ABI_TEST && !OPENSSL_NO_ASM
} // namespace
BSSL_NAMESPACE_END
crypto/fipsmodule/aes/internal.h
+117 -87
View File
@@ -17,11 +17,11 @@
#include <stdlib.h>
#include "../bcm_interface.h"
#include "../../internal.h"
#include "../bcm_interface.h"
extern "C" {
BSSL_NAMESPACE_BEGIN
// block128_f is the type of an AES block cipher implementation.
//
@@ -88,19 +88,25 @@ inline int vpaes_capable() { return CRYPTO_is_NEON_capable(); }
#if defined(HWAES)
int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits, AES_KEY *key);
int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits, AES_KEY *key);
void aes_hw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
void aes_hw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
void aes_hw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
const AES_KEY *key, uint8_t *ivec, int enc);
void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, const uint8_t ivec[16]);
extern "C" int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits,
AES_KEY *key);
extern "C" int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits,
AES_KEY *key);
extern "C" void aes_hw_encrypt(const uint8_t *in, uint8_t *out,
const AES_KEY *key);
extern "C" void aes_hw_decrypt(const uint8_t *in, uint8_t *out,
const AES_KEY *key);
extern "C" void aes_hw_cbc_encrypt(const uint8_t *in, uint8_t *out,
size_t length, const AES_KEY *key,
uint8_t *ivec, int enc);
extern "C" void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
const uint8_t ivec[16]);
#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
// On x86 and x86_64, |aes_hw_set_decrypt_key| is implemented in terms of
// |aes_hw_set_encrypt_key| and a conversion function.
void aes_hw_encrypt_key_to_decrypt_key(AES_KEY *key);
extern "C" void aes_hw_encrypt_key_to_decrypt_key(AES_KEY *key);
// There are two variants of this function, one which uses aeskeygenassist
// ("base") and one which uses aesenclast + pshufb ("alt"). aesenclast is
@@ -118,9 +124,10 @@ inline int aes_hw_set_encrypt_key_alt_capable() {
inline int aes_hw_set_encrypt_key_alt_preferred() {
return hwaes_capable() && CRYPTO_is_AVX_capable();
}
int aes_hw_set_encrypt_key_base(const uint8_t *user_key, int bits,
AES_KEY *key);
int aes_hw_set_encrypt_key_alt(const uint8_t *user_key, int bits, AES_KEY *key);
extern "C" int aes_hw_set_encrypt_key_base(const uint8_t *user_key, int bits,
AES_KEY *key);
extern "C" int aes_hw_set_encrypt_key_alt(const uint8_t *user_key, int bits,
AES_KEY *key);
#endif // OPENSSL_X86 || OPENSSL_X86_64
#else
@@ -164,23 +171,29 @@ inline void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
#if defined(HWAES_ECB)
void aes_hw_ecb_encrypt(const uint8_t *in, uint8_t *out, size_t length,
const AES_KEY *key, int enc);
extern "C" void aes_hw_ecb_encrypt(const uint8_t *in, uint8_t *out,
size_t length, const AES_KEY *key, int enc);
#endif // HWAES_ECB
#if defined(BSAES)
// Note |bsaes_cbc_encrypt| requires |enc| to be zero.
void bsaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
const AES_KEY *key, uint8_t ivec[16], int enc);
void bsaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, const uint8_t ivec[16]);
// VPAES to BSAES conversions are available on all BSAES platforms.
void vpaes_encrypt_key_to_bsaes(AES_KEY *out_bsaes, const AES_KEY *vpaes);
void vpaes_decrypt_key_to_bsaes(AES_KEY *out_bsaes, const AES_KEY *vpaes);
void vpaes_ctr32_encrypt_blocks_with_bsaes(const uint8_t *in, uint8_t *out,
size_t blocks, const AES_KEY *key,
extern "C" void bsaes_cbc_encrypt(const uint8_t *in, uint8_t *out,
size_t length, const AES_KEY *key,
uint8_t ivec[16], int enc);
extern "C" void bsaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
const uint8_t ivec[16]);
// VPAES to BSAES conversions are available on all BSAES platforms.
extern "C" void vpaes_encrypt_key_to_bsaes(AES_KEY *out_bsaes,
const AES_KEY *vpaes);
extern "C" void vpaes_decrypt_key_to_bsaes(AES_KEY *out_bsaes,
const AES_KEY *vpaes);
extern "C" void vpaes_ctr32_encrypt_blocks_with_bsaes(const uint8_t *in,
uint8_t *out,
size_t blocks,
const AES_KEY *key,
const uint8_t ivec[16]);
#else
inline int bsaes_capable() { return 0; }
@@ -212,18 +225,24 @@ inline void vpaes_decrypt_key_to_bsaes(AES_KEY *out_bsaes,
#if defined(VPAES)
// On platforms where VPAES gets defined (just above), then these functions are
// provided by asm.
int vpaes_set_encrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
int vpaes_set_decrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
extern "C" int vpaes_set_encrypt_key(const uint8_t *userKey, int bits,
AES_KEY *key);
extern "C" int vpaes_set_decrypt_key(const uint8_t *userKey, int bits,
AES_KEY *key);
void vpaes_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
void vpaes_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
extern "C" void vpaes_encrypt(const uint8_t *in, uint8_t *out,
const AES_KEY *key);
extern "C" void vpaes_decrypt(const uint8_t *in, uint8_t *out,
const AES_KEY *key);
#if defined(VPAES_CBC)
void vpaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
const AES_KEY *key, uint8_t *ivec, int enc);
extern "C" void vpaes_cbc_encrypt(const uint8_t *in, uint8_t *out,
size_t length, const AES_KEY *key,
uint8_t *ivec, int enc);
#endif
void vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, const uint8_t ivec[16]);
extern "C" void vpaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
const uint8_t ivec[16]);
#else
inline int vpaes_capable() { return 0; }
@@ -418,53 +437,65 @@ void gcm_ghash_nohw(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
#define GCM_FUNCREF
void gcm_init_clmul(u128 Htable[16], const uint64_t Xi[2]);
void gcm_gmult_clmul(uint8_t Xi[16], const u128 Htable[16]);
void gcm_ghash_clmul(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
size_t len);
extern "C" void gcm_init_clmul(u128 Htable[16], const uint64_t Xi[2]);
extern "C" void gcm_gmult_clmul(uint8_t Xi[16], const u128 Htable[16]);
extern "C" void gcm_ghash_clmul(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *inp, size_t len);
void gcm_init_ssse3(u128 Htable[16], const uint64_t Xi[2]);
void gcm_gmult_ssse3(uint8_t Xi[16], const u128 Htable[16]);
void gcm_ghash_ssse3(uint8_t Xi[16], const u128 Htable[16], const uint8_t *in,
size_t len);
extern "C" void gcm_init_ssse3(u128 Htable[16], const uint64_t Xi[2]);
extern "C" void gcm_gmult_ssse3(uint8_t Xi[16], const u128 Htable[16]);
extern "C" void gcm_ghash_ssse3(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *in, size_t len);
#if defined(OPENSSL_X86_64)
#define GHASH_ASM_X86_64
void gcm_init_avx(u128 Htable[16], const uint64_t Xi[2]);
void gcm_gmult_avx(uint8_t Xi[16], const u128 Htable[16]);
void gcm_ghash_avx(uint8_t Xi[16], const u128 Htable[16], const uint8_t *in,
size_t len);
extern "C" void gcm_init_avx(u128 Htable[16], const uint64_t Xi[2]);
extern "C" void gcm_gmult_avx(uint8_t Xi[16], const u128 Htable[16]);
extern "C" void gcm_ghash_avx(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *in, size_t len);
#define HW_GCM
size_t aesni_gcm_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
const u128 Htable[16], uint8_t Xi[16]);
size_t aesni_gcm_decrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
const u128 Htable[16], uint8_t Xi[16]);
void gcm_init_vpclmulqdq_avx2(u128 Htable[16], const uint64_t H[2]);
void gcm_gmult_vpclmulqdq_avx2(uint8_t Xi[16], const u128 Htable[16]);
void gcm_ghash_vpclmulqdq_avx2(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *in, size_t len);
void aes_gcm_enc_update_vaes_avx2(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, const uint8_t ivec[16],
const u128 Htable[16], uint8_t Xi[16]);
void aes_gcm_dec_update_vaes_avx2(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, const uint8_t ivec[16],
const u128 Htable[16], uint8_t Xi[16]);
void gcm_init_vpclmulqdq_avx512(u128 Htable[16], const uint64_t H[2]);
void gcm_gmult_vpclmulqdq_avx512(uint8_t Xi[16], const u128 Htable[16]);
void gcm_ghash_vpclmulqdq_avx512(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *in, size_t len);
void aes_gcm_enc_update_vaes_avx512(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, const uint8_t ivec[16],
extern "C" size_t aesni_gcm_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
const u128 Htable[16], uint8_t Xi[16]);
void aes_gcm_dec_update_vaes_avx512(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, const uint8_t ivec[16],
extern "C" size_t aesni_gcm_decrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
const u128 Htable[16], uint8_t Xi[16]);
extern "C" void gcm_init_vpclmulqdq_avx2(u128 Htable[16], const uint64_t H[2]);
extern "C" void gcm_gmult_vpclmulqdq_avx2(uint8_t Xi[16],
const u128 Htable[16]);
extern "C" void gcm_ghash_vpclmulqdq_avx2(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *in, size_t len);
extern "C" void aes_gcm_enc_update_vaes_avx2(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
const uint8_t ivec[16],
const u128 Htable[16],
uint8_t Xi[16]);
extern "C" void aes_gcm_dec_update_vaes_avx2(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
const uint8_t ivec[16],
const u128 Htable[16],
uint8_t Xi[16]);
extern "C" void gcm_init_vpclmulqdq_avx512(u128 Htable[16],
const uint64_t H[2]);
extern "C" void gcm_gmult_vpclmulqdq_avx512(uint8_t Xi[16],
const u128 Htable[16]);
extern "C" void gcm_ghash_vpclmulqdq_avx512(uint8_t Xi[16],
const u128 Htable[16],
const uint8_t *in, size_t len);
extern "C" void aes_gcm_enc_update_vaes_avx512(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
const uint8_t ivec[16],
const u128 Htable[16],
uint8_t Xi[16]);
extern "C" void aes_gcm_dec_update_vaes_avx512(const uint8_t *in, uint8_t *out,
size_t len, const AES_KEY *key,
const uint8_t ivec[16],
const u128 Htable[16],
uint8_t Xi[16]);
#endif // OPENSSL_X86_64
#if defined(OPENSSL_X86)
@@ -478,27 +509,27 @@ void aes_gcm_dec_update_vaes_avx512(const uint8_t *in, uint8_t *out, size_t len,
inline int gcm_pmull_capable() { return CRYPTO_is_ARMv8_PMULL_capable(); }
void gcm_init_v8(u128 Htable[16], const uint64_t H[2]);
void gcm_gmult_v8(uint8_t Xi[16], const u128 Htable[16]);
void gcm_ghash_v8(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
size_t len);
extern "C" void gcm_init_v8(u128 Htable[16], const uint64_t H[2]);
extern "C" void gcm_gmult_v8(uint8_t Xi[16], const u128 Htable[16]);
extern "C" void gcm_ghash_v8(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *inp, size_t len);
inline int gcm_neon_capable() { return CRYPTO_is_NEON_capable(); }
void gcm_init_neon(u128 Htable[16], const uint64_t H[2]);
void gcm_gmult_neon(uint8_t Xi[16], const u128 Htable[16]);
void gcm_ghash_neon(uint8_t Xi[16], const u128 Htable[16], const uint8_t *inp,
size_t len);
extern "C" void gcm_init_neon(u128 Htable[16], const uint64_t H[2]);
extern "C" void gcm_gmult_neon(uint8_t Xi[16], const u128 Htable[16]);
extern "C" void gcm_ghash_neon(uint8_t Xi[16], const u128 Htable[16],
const uint8_t *inp, size_t len);
#if defined(OPENSSL_AARCH64)
#define HW_GCM
// These functions are defined in aesv8-gcm-armv8.pl.
void aes_gcm_enc_kernel(const uint8_t *in, uint64_t in_bits, void *out,
void *Xi, uint8_t *ivec, const AES_KEY *key,
const u128 Htable[16]);
void aes_gcm_dec_kernel(const uint8_t *in, uint64_t in_bits, void *out,
void *Xi, uint8_t *ivec, const AES_KEY *key,
const u128 Htable[16]);
extern "C" void aes_gcm_enc_kernel(const uint8_t *in, uint64_t in_bits,
void *out, void *Xi, uint8_t *ivec,
const AES_KEY *key, const u128 Htable[16]);
extern "C" void aes_gcm_dec_kernel(const uint8_t *in, uint64_t in_bits,
void *out, void *Xi, uint8_t *ivec,
const AES_KEY *key, const u128 Htable[16]);
#endif
#endif
@@ -568,7 +599,6 @@ size_t CRYPTO_cts128_encrypt_block(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
block128_f block);
} // extern C
BSSL_NAMESPACE_END
#endif // OPENSSL_HEADER_CRYPTO_FIPSMODULE_AES_INTERNAL_H
crypto/fipsmodule/aes/ofb.cc.inc
+5 -3
View File
@@ -18,11 +18,13 @@
#include "internal.h"
using namespace bssl;
static_assert(16 % sizeof(size_t) == 0, "block cannot be divided into size_t");
void CRYPTO_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16], unsigned *num,
block128_f block) {
void bssl::CRYPTO_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
const AES_KEY *key, uint8_t ivec[16],
unsigned *num, block128_f block) {
assert(key != nullptr && ivec != nullptr && num != nullptr);
assert(len == 0 || (in != nullptr && out != nullptr));
crypto/fipsmodule/rand/internal.h
+2 -2
View File
@@ -34,8 +34,8 @@ BSSL_NAMESPACE_END
// 800-90Ar1.
struct ctr_drbg_state_st {
AES_KEY ks;
block128_f block;
ctr128_f ctr;
bssl::block128_f block;
bssl::ctr128_f ctr;
uint8_t counter[16];
uint64_t reseed_counter;
int df;
crypto/fipsmodule/sha/sha_test.cc
+7 -1
View File
@@ -18,11 +18,14 @@
#include <gtest/gtest.h>
#include "internal.h"
#include "../../test/abi_test.h"
#include "../../test/test_util.h"
#include "internal.h"
BSSL_NAMESPACE_BEGIN
namespace {
TEST(SHATest, FIPS1862PRF) {
// From "Multiple Examples of DSA", section 2.2, fetched from archived copy at
// https://web.archive.org/web/20041031124637/http://csrc.nist.gov/CryptoToolkit/dss/Examples-1024bit.pdf
@@ -150,3 +153,6 @@ TEST(SHATest, SHA512ABI) {
}
#endif // SUPPORTS_ABI_TEST
} // namespace
BSSL_NAMESPACE_END
crypto/impl_dispatch_test.cc
+7 -1
View File
@@ -29,6 +29,9 @@
#include "internal.h"
BSSL_NAMESPACE_BEGIN
namespace {
class ImplDispatchTest : public ::testing::Test {
public:
void SetUp() override {
@@ -118,7 +121,7 @@ TEST_F(ImplDispatchTest, AEAD_AES_GCM) {
const uint8_t kPlaintext[40] = {1, 2, 3, 4, 0};
uint8_t ciphertext[sizeof(kPlaintext) + 16];
size_t ciphertext_len;
bssl::ScopedEVP_AEAD_CTX ctx;
ScopedEVP_AEAD_CTX ctx;
ASSERT_TRUE(EVP_AEAD_CTX_init(ctx.get(), EVP_aead_aes_128_gcm(), kZeros,
sizeof(kZeros),
EVP_AEAD_DEFAULT_TAG_LENGTH, nullptr));
@@ -161,4 +164,7 @@ TEST_F(ImplDispatchTest, AES_single_block) {
#endif // X86 || X86_64
} // namespace
BSSL_NAMESPACE_END
#endif // DISPATCH_TEST && !SHARED_LIBRARY
crypto/poly1305/poly1305.cc
+2
View File
@@ -25,6 +25,8 @@
#include "internal.h"
using namespace bssl;
#if !defined(BORINGSSL_HAS_UINT128) || !defined(OPENSSL_X86_64)
static uint64_t mul32x32_64(uint32_t a, uint32_t b) { return (uint64_t)a * b; }
decrepit/xts/xts.cc
+2
View File
@@ -23,6 +23,8 @@
#include "../../crypto/fipsmodule/aes/internal.h"
using namespace bssl;
typedef struct xts128_context {
AES_KEY *key1, *key2;
block128_f block1, block2;