No OneTemporary
Actions

Size

54 KB

Subscribers

None

View Options

	diff --git a/cipher/bufhelp.h b/cipher/bufhelp.h
	index 0e8f5991..fa5b2e8e 100644
	--- a/cipher/bufhelp.h
	+++ b/cipher/bufhelp.h
	@@ -1,383 +1,385 @@
	/* bufhelp.h - Some buffer manipulation helpers
	* Copyright (C) 2012-2017 Jussi Kivilinna <jussi.kivilinna@iki.fi>
	*
	* This file is part of Libgcrypt.
	*
	* Libgcrypt is free software; you can redistribute it and/or modify
	* it under the terms of the GNU Lesser General Public License as
	* published by the Free Software Foundation; either version 2.1 of
	* the License, or (at your option) any later version.
	*
	* Libgcrypt is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Lesser General Public License for more details.
	*
	* You should have received a copy of the GNU Lesser General Public
	* License along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/
	#ifndef GCRYPT_BUFHELP_H
	#define GCRYPT_BUFHELP_H


	#include "g10lib.h"
	#include "bithelp.h"


	#undef BUFHELP_UNALIGNED_ACCESS
	#if defined(HAVE_GCC_ATTRIBUTE_PACKED) && \
	defined(HAVE_GCC_ATTRIBUTE_ALIGNED) && \
	defined(HAVE_GCC_ATTRIBUTE_MAY_ALIAS)
	/* Compiler is supports attributes needed for automatically issuing unaligned
	memory access instructions.
	*/
	# define BUFHELP_UNALIGNED_ACCESS 1
	#endif


	#ifndef BUFHELP_UNALIGNED_ACCESS

	/* Functions for loading and storing unaligned u32 values of different
	endianness. */
	static inline u32 buf_get_be32(const void *_buf)
	{
	const byte *in = _buf;
	return ((u32)in[0] << 24) \| ((u32)in[1] << 16) \| \
	((u32)in[2] << 8) \| (u32)in[3];
	}

	static inline u32 buf_get_le32(const void *_buf)
	{
	const byte *in = _buf;
	return ((u32)in[3] << 24) \| ((u32)in[2] << 16) \| \
	((u32)in[1] << 8) \| (u32)in[0];
	}

	static inline void buf_put_be32(void *_buf, u32 val)
	{
	byte *out = _buf;
	out[0] = val >> 24;
	out[1] = val >> 16;
	out[2] = val >> 8;
	out[3] = val;
	}

	static inline void buf_put_le32(void *_buf, u32 val)
	{
	byte *out = _buf;
	out[3] = val >> 24;
	out[2] = val >> 16;
	out[1] = val >> 8;
	out[0] = val;
	}


	/* Functions for loading and storing unaligned u64 values of different
	endianness. */
	static inline u64 buf_get_be64(const void *_buf)
	{
	const byte *in = _buf;
	return ((u64)in[0] << 56) \| ((u64)in[1] << 48) \| \
	((u64)in[2] << 40) \| ((u64)in[3] << 32) \| \
	((u64)in[4] << 24) \| ((u64)in[5] << 16) \| \
	((u64)in[6] << 8) \| (u64)in[7];
	}

	static inline u64 buf_get_le64(const void *_buf)
	{
	const byte *in = _buf;
	return ((u64)in[7] << 56) \| ((u64)in[6] << 48) \| \
	((u64)in[5] << 40) \| ((u64)in[4] << 32) \| \
	((u64)in[3] << 24) \| ((u64)in[2] << 16) \| \
	((u64)in[1] << 8) \| (u64)in[0];
	}

	static inline void buf_put_be64(void *_buf, u64 val)
	{
	byte *out = _buf;
	out[0] = val >> 56;
	out[1] = val >> 48;
	out[2] = val >> 40;
	out[3] = val >> 32;
	out[4] = val >> 24;
	out[5] = val >> 16;
	out[6] = val >> 8;
	out[7] = val;
	}

	static inline void buf_put_le64(void *_buf, u64 val)
	{
	byte *out = _buf;
	out[7] = val >> 56;
	out[6] = val >> 48;
	out[5] = val >> 40;
	out[4] = val >> 32;
	out[3] = val >> 24;
	out[2] = val >> 16;
	out[1] = val >> 8;
	out[0] = val;
	}

	#else /BUFHELP_UNALIGNED_ACCESS/

	typedef struct bufhelp_u32_s
	{
	u32 a;
	} __attribute__((packed, aligned(1), may_alias)) bufhelp_u32_t;

	/* Functions for loading and storing unaligned u32 values of different
	endianness. */
	static inline u32 buf_get_be32(const void *_buf)
	{
	return be_bswap32(((const bufhelp_u32_t *)_buf)->a);
	}

	static inline u32 buf_get_le32(const void *_buf)
	{
	return le_bswap32(((const bufhelp_u32_t *)_buf)->a);
	}

	static inline void buf_put_be32(void *_buf, u32 val)
	{
	bufhelp_u32_t *out = _buf;
	out->a = be_bswap32(val);
	}

	static inline void buf_put_le32(void *_buf, u32 val)
	{
	bufhelp_u32_t *out = _buf;
	out->a = le_bswap32(val);
	}


	typedef struct bufhelp_u64_s
	{
	u64 a;
	} __attribute__((packed, aligned(1), may_alias)) bufhelp_u64_t;

	/* Functions for loading and storing unaligned u64 values of different
	endianness. */
	static inline u64 buf_get_be64(const void *_buf)
	{
	return be_bswap64(((const bufhelp_u64_t *)_buf)->a);
	}

	static inline u64 buf_get_le64(const void *_buf)
	{
	return le_bswap64(((const bufhelp_u64_t *)_buf)->a);
	}

	static inline void buf_put_be64(void *_buf, u64 val)
	{
	bufhelp_u64_t *out = _buf;
	out->a = be_bswap64(val);
	}

	static inline void buf_put_le64(void *_buf, u64 val)
	{
	bufhelp_u64_t *out = _buf;
	out->a = le_bswap64(val);
	}

	#endif /BUFHELP_UNALIGNED_ACCESS/


	/* Host-endian get/put macros */
	#ifdef WORDS_BIGENDIAN
	# define buf_get_he32 buf_get_be32
	# define buf_put_he32 buf_put_be32
	# define buf_get_he64 buf_get_be64
	# define buf_put_he64 buf_put_be64
	#else
	# define buf_get_he32 buf_get_le32
	# define buf_put_he32 buf_put_le32
	# define buf_get_he64 buf_get_le64
	# define buf_put_he64 buf_put_le64
	#endif



	/* Optimized function for small buffer copying */
	static inline void
	buf_cpy(void _dst, const void _src, size_t len)
	{
	byte *dst = _dst;
	const byte *src = _src;

	#if __GNUC__ >= 4
	if (!__builtin_constant_p (len))
	{
	+ if (UNLIKELY(len == 0))
	+ return;
	memcpy(_dst, _src, len);
	return;
	}
	#endif

	while (len >= sizeof(u64))
	{
	buf_put_he64(dst, buf_get_he64(src));
	dst += sizeof(u64);
	src += sizeof(u64);
	len -= sizeof(u64);
	}

	if (len >= sizeof(u32))
	{
	buf_put_he32(dst, buf_get_he32(src));
	dst += sizeof(u32);
	src += sizeof(u32);
	len -= sizeof(u32);
	}

	/* Handle tail. */
	for (; len; len--)
	dst++ = src++;
	}


	/* Optimized function for buffer xoring */
	static inline void
	buf_xor(void _dst, const void _src1, const void *_src2, size_t len)
	{
	byte *dst = _dst;
	const byte *src1 = _src1;
	const byte *src2 = _src2;

	while (len >= sizeof(u64))
	{
	buf_put_he64(dst, buf_get_he64(src1) ^ buf_get_he64(src2));
	dst += sizeof(u64);
	src1 += sizeof(u64);
	src2 += sizeof(u64);
	len -= sizeof(u64);
	}

	if (len > sizeof(u32))
	{
	buf_put_he32(dst, buf_get_he32(src1) ^ buf_get_he32(src2));
	dst += sizeof(u32);
	src1 += sizeof(u32);
	src2 += sizeof(u32);
	len -= sizeof(u32);
	}

	/* Handle tail. */
	for (; len; len--)
	dst++ = src1++ ^ *src2++;
	}


	/* Optimized function for buffer xoring with two destination buffers. Used
	mainly by CFB mode encryption. */
	static inline void
	buf_xor_2dst(void _dst1, void _dst2, const void *_src, size_t len)
	{
	byte *dst1 = _dst1;
	byte *dst2 = _dst2;
	const byte *src = _src;

	while (len >= sizeof(u64))
	{
	u64 temp = buf_get_he64(dst2) ^ buf_get_he64(src);
	buf_put_he64(dst2, temp);
	buf_put_he64(dst1, temp);
	dst2 += sizeof(u64);
	dst1 += sizeof(u64);
	src += sizeof(u64);
	len -= sizeof(u64);
	}

	if (len >= sizeof(u32))
	{
	u32 temp = buf_get_he32(dst2) ^ buf_get_he32(src);
	buf_put_he32(dst2, temp);
	buf_put_he32(dst1, temp);
	dst2 += sizeof(u32);
	dst1 += sizeof(u32);
	src += sizeof(u32);
	len -= sizeof(u32);
	}

	/* Handle tail. */
	for (; len; len--)
	dst1++ = (dst2++ ^= *src++);
	}


	/* Optimized function for combined buffer xoring and copying. Used by mainly
	CBC mode decryption. */
	static inline void
	buf_xor_n_copy_2(void _dst_xor, const void _src_xor, void *_srcdst_cpy,
	const void *_src_cpy, size_t len)
	{
	byte *dst_xor = _dst_xor;
	byte *srcdst_cpy = _srcdst_cpy;
	const byte *src_xor = _src_xor;
	const byte *src_cpy = _src_cpy;

	while (len >= sizeof(u64))
	{
	u64 temp = buf_get_he64(src_cpy);
	buf_put_he64(dst_xor, buf_get_he64(srcdst_cpy) ^ buf_get_he64(src_xor));
	buf_put_he64(srcdst_cpy, temp);
	dst_xor += sizeof(u64);
	srcdst_cpy += sizeof(u64);
	src_xor += sizeof(u64);
	src_cpy += sizeof(u64);
	len -= sizeof(u64);
	}

	if (len >= sizeof(u32))
	{
	u32 temp = buf_get_he32(src_cpy);
	buf_put_he32(dst_xor, buf_get_he32(srcdst_cpy) ^ buf_get_he32(src_xor));
	buf_put_he32(srcdst_cpy, temp);
	dst_xor += sizeof(u32);
	srcdst_cpy += sizeof(u32);
	src_xor += sizeof(u32);
	src_cpy += sizeof(u32);
	len -= sizeof(u32);
	}

	/* Handle tail. */
	for (; len; len--)
	{
	byte temp = *src_cpy++;
	dst_xor++ = srcdst_cpy ^ *src_xor++;
	*srcdst_cpy++ = temp;
	}
	}


	/* Optimized function for combined buffer xoring and copying. Used by mainly
	CFB mode decryption. */
	static inline void
	buf_xor_n_copy(void _dst_xor, void _srcdst_cpy, const void *_src, size_t len)
	{
	buf_xor_n_copy_2(_dst_xor, _src, _srcdst_cpy, _src, len);
	}


	/* Constant-time compare of two buffers. Returns 1 if buffers are equal,
	and 0 if buffers differ. */
	static inline int
	buf_eq_const(const void _a, const void _b, size_t len)
	{
	const byte *a = _a;
	const byte *b = _b;
	int ab, ba;
	size_t i;

	/* Constant-time compare. */
	for (i = 0, ab = 0, ba = 0; i < len; i++)
	{
	/* If a[i] != b[i], either ab or ba will be negative. */
	ab \|= a[i] - b[i];
	ba \|= b[i] - a[i];
	}

	/* 'ab \| ba' is negative when buffers are not equal. */
	return (ab \| ba) >= 0;
	}


	#endif /GCRYPT_BUFHELP_H/
	diff --git a/cipher/cipher-ccm.c b/cipher/cipher-ccm.c
	index fd284caa..3bacb6b1 100644
	--- a/cipher/cipher-ccm.c
	+++ b/cipher/cipher-ccm.c
	@@ -1,406 +1,411 @@
	/* cipher-ccm.c - CTR mode with CBC-MAC mode implementation
	* Copyright (C) 2013 Jussi Kivilinna <jussi.kivilinna@iki.fi>
	*
	* This file is part of Libgcrypt.
	*
	* Libgcrypt is free software; you can redistribute it and/or modify
	* it under the terms of the GNU Lesser general Public License as
	* published by the Free Software Foundation; either version 2.1 of
	* the License, or (at your option) any later version.
	*
	* Libgcrypt is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Lesser General Public License for more details.
	*
	* You should have received a copy of the GNU Lesser General Public
	* License along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "g10lib.h"
	#include "cipher.h"
	#include "bufhelp.h"
	#include "./cipher-internal.h"


	#define set_burn(burn, nburn) do { \
	unsigned int __nburn = (nburn); \
	(burn) = (burn) > __nburn ? (burn) : __nburn; } while (0)


	static unsigned int
	do_cbc_mac (gcry_cipher_hd_t c, const unsigned char *inbuf, size_t inlen,
	int do_padding)
	{
	const unsigned int blocksize = 16;
	gcry_cipher_encrypt_t enc_fn = c->spec->encrypt;
	unsigned char tmp[blocksize];
	unsigned int burn = 0;
	unsigned int unused = c->u_mode.ccm.mac_unused;
	size_t nblocks;
	+ size_t n;

	if (inlen == 0 && (unused == 0 \|\| !do_padding))
	return 0;

	do
	{
	if (inlen + unused < blocksize \|\| unused > 0)
	{
	- for (; inlen && unused < blocksize; inlen--)
	- c->u_mode.ccm.macbuf[unused++] = *inbuf++;
	+ n = (inlen > blocksize - unused) ? blocksize - unused : inlen;
	+
	+ buf_cpy (&c->u_mode.ccm.macbuf[unused], inbuf, n);
	+ unused += n;
	+ inlen -= n;
	+ inbuf += n;
	}
	if (!inlen)
	{
	if (!do_padding)
	break;

	while (unused < blocksize)
	c->u_mode.ccm.macbuf[unused++] = 0;
	}

	if (unused > 0)
	{
	/* Process one block from macbuf. */
	cipher_block_xor(c->u_iv.iv, c->u_iv.iv, c->u_mode.ccm.macbuf,
	blocksize);
	set_burn (burn, enc_fn ( &c->context.c, c->u_iv.iv, c->u_iv.iv ));

	unused = 0;
	}

	if (c->bulk.cbc_enc)
	{
	nblocks = inlen / blocksize;
	c->bulk.cbc_enc (&c->context.c, c->u_iv.iv, tmp, inbuf, nblocks, 1);
	inbuf += nblocks * blocksize;
	inlen -= nblocks * blocksize;

	wipememory (tmp, sizeof(tmp));
	}
	else
	{
	while (inlen >= blocksize)
	{
	cipher_block_xor(c->u_iv.iv, c->u_iv.iv, inbuf, blocksize);

	set_burn (burn, enc_fn ( &c->context.c, c->u_iv.iv, c->u_iv.iv ));

	inlen -= blocksize;
	inbuf += blocksize;
	}
	}
	}
	while (inlen > 0);

	c->u_mode.ccm.mac_unused = unused;

	if (burn)
	burn += 4 * sizeof(void *);

	return burn;
	}


	gcry_err_code_t
	_gcry_cipher_ccm_set_nonce (gcry_cipher_hd_t c, const unsigned char *nonce,
	size_t noncelen)
	{
	unsigned int marks_key;
	size_t L = 15 - noncelen;
	size_t L_;

	L_ = L - 1;

	if (!nonce)
	return GPG_ERR_INV_ARG;
	/* Length field must be 2, 3, ..., or 8. */
	if (L < 2 \|\| L > 8)
	return GPG_ERR_INV_LENGTH;

	/* Reset state */
	marks_key = c->marks.key;
	memset (&c->u_mode, 0, sizeof(c->u_mode));
	memset (&c->marks, 0, sizeof(c->marks));
	memset (&c->u_iv, 0, sizeof(c->u_iv));
	memset (&c->u_ctr, 0, sizeof(c->u_ctr));
	memset (c->lastiv, 0, sizeof(c->lastiv));
	c->unused = 0;
	c->marks.key = marks_key;

	/* Setup CTR */
	c->u_ctr.ctr[0] = L_;
	memcpy (&c->u_ctr.ctr[1], nonce, noncelen);
	memset (&c->u_ctr.ctr[1 + noncelen], 0, L);

	/* Setup IV */
	c->u_iv.iv[0] = L_;
	memcpy (&c->u_iv.iv[1], nonce, noncelen);
	/* Add (8 * M_ + 64 * flags) to iv[0] and set iv[noncelen + 1 ... 15] later
	in set_aad. */
	memset (&c->u_iv.iv[1 + noncelen], 0, L);

	c->u_mode.ccm.nonce = 1;

	return GPG_ERR_NO_ERROR;
	}


	gcry_err_code_t
	_gcry_cipher_ccm_set_lengths (gcry_cipher_hd_t c, u64 encryptlen, u64 aadlen,
	u64 taglen)
	{
	unsigned int burn = 0;
	unsigned char b0[16];
	size_t noncelen = 15 - (c->u_iv.iv[0] + 1);
	u64 M = taglen;
	u64 M_;
	int i;

	M_ = (M - 2) / 2;

	/* Authentication field must be 4, 6, 8, 10, 12, 14 or 16. */
	if ((M_ * 2 + 2) != M \|\| M < 4 \|\| M > 16)
	return GPG_ERR_INV_LENGTH;
	if (!c->u_mode.ccm.nonce \|\| c->marks.tag)
	return GPG_ERR_INV_STATE;
	if (c->u_mode.ccm.lengths)
	return GPG_ERR_INV_STATE;

	c->u_mode.ccm.authlen = taglen;
	c->u_mode.ccm.encryptlen = encryptlen;
	c->u_mode.ccm.aadlen = aadlen;

	/* Complete IV setup. */
	c->u_iv.iv[0] += (aadlen > 0) * 64 + M_ * 8;
	for (i = 16 - 1; i >= 1 + noncelen; i--)
	{
	c->u_iv.iv[i] = encryptlen & 0xff;
	encryptlen >>= 8;
	}

	memcpy (b0, c->u_iv.iv, 16);
	memset (c->u_iv.iv, 0, 16);

	set_burn (burn, do_cbc_mac (c, b0, 16, 0));

	if (aadlen == 0)
	{
	/* Do nothing. */
	}
	else if (aadlen > 0 && aadlen <= (unsigned int)0xfeff)
	{
	b0[0] = (aadlen >> 8) & 0xff;
	b0[1] = aadlen & 0xff;
	set_burn (burn, do_cbc_mac (c, b0, 2, 0));
	}
	else if (aadlen > 0xfeff && aadlen <= (unsigned int)0xffffffff)
	{
	b0[0] = 0xff;
	b0[1] = 0xfe;
	buf_put_be32(&b0[2], aadlen);
	set_burn (burn, do_cbc_mac (c, b0, 6, 0));
	}
	else if (aadlen > (unsigned int)0xffffffff)
	{
	b0[0] = 0xff;
	b0[1] = 0xff;
	buf_put_be64(&b0[2], aadlen);
	set_burn (burn, do_cbc_mac (c, b0, 10, 0));
	}

	/* Generate S_0 and increase counter. */
	set_burn (burn, c->spec->encrypt ( &c->context.c, c->u_mode.ccm.s0,
	c->u_ctr.ctr ));
	c->u_ctr.ctr[15]++;

	if (burn)
	_gcry_burn_stack (burn + sizeof(void ) 5);

	c->u_mode.ccm.lengths = 1;

	return GPG_ERR_NO_ERROR;
	}


	gcry_err_code_t
	_gcry_cipher_ccm_authenticate (gcry_cipher_hd_t c, const unsigned char *abuf,
	size_t abuflen)
	{
	unsigned int burn;

	if (abuflen > 0 && !abuf)
	return GPG_ERR_INV_ARG;
	if (!c->u_mode.ccm.nonce \|\| !c->u_mode.ccm.lengths \|\| c->marks.tag)
	return GPG_ERR_INV_STATE;
	if (abuflen > c->u_mode.ccm.aadlen)
	return GPG_ERR_INV_LENGTH;

	c->u_mode.ccm.aadlen -= abuflen;
	burn = do_cbc_mac (c, abuf, abuflen, c->u_mode.ccm.aadlen == 0);

	if (burn)
	_gcry_burn_stack (burn + sizeof(void ) 5);

	return GPG_ERR_NO_ERROR;
	}


	gcry_err_code_t
	_gcry_cipher_ccm_tag (gcry_cipher_hd_t c, unsigned char *outbuf,
	size_t outbuflen, int check)
	{
	unsigned int burn;

	if (!outbuf \|\| outbuflen == 0)
	return GPG_ERR_INV_ARG;
	/* Tag length must be same as initial authlen. */
	if (c->u_mode.ccm.authlen != outbuflen)
	return GPG_ERR_INV_LENGTH;
	if (!c->u_mode.ccm.nonce \|\| !c->u_mode.ccm.lengths \|\| c->u_mode.ccm.aadlen > 0)
	return GPG_ERR_INV_STATE;
	/* Initial encrypt length must match with length of actual data processed. */
	if (c->u_mode.ccm.encryptlen > 0)
	return GPG_ERR_UNFINISHED;

	if (!c->marks.tag)
	{
	burn = do_cbc_mac (c, NULL, 0, 1); /* Perform final padding. */

	/* Add S_0 */
	cipher_block_xor (c->u_iv.iv, c->u_iv.iv, c->u_mode.ccm.s0, 16);

	wipememory (c->u_ctr.ctr, 16);
	wipememory (c->u_mode.ccm.s0, 16);
	wipememory (c->u_mode.ccm.macbuf, 16);

	if (burn)
	_gcry_burn_stack (burn + sizeof(void ) 5);

	c->marks.tag = 1;
	}

	if (!check)
	{
	memcpy (outbuf, c->u_iv.iv, outbuflen);
	return GPG_ERR_NO_ERROR;
	}
	else
	{
	return buf_eq_const(outbuf, c->u_iv.iv, outbuflen) ?
	GPG_ERR_NO_ERROR : GPG_ERR_CHECKSUM;
	}
	}


	gcry_err_code_t
	_gcry_cipher_ccm_get_tag (gcry_cipher_hd_t c, unsigned char *outtag,
	size_t taglen)
	{
	return _gcry_cipher_ccm_tag (c, outtag, taglen, 0);
	}


	gcry_err_code_t
	_gcry_cipher_ccm_check_tag (gcry_cipher_hd_t c, const unsigned char *intag,
	size_t taglen)
	{
	return _gcry_cipher_ccm_tag (c, (unsigned char *)intag, taglen, 1);
	}


	gcry_err_code_t
	_gcry_cipher_ccm_encrypt (gcry_cipher_hd_t c, unsigned char *outbuf,
	size_t outbuflen, const unsigned char *inbuf,
	size_t inbuflen)
	{
	gcry_err_code_t err = 0;
	unsigned int burn = 0;
	unsigned int nburn;

	if (outbuflen < inbuflen)
	return GPG_ERR_BUFFER_TOO_SHORT;
	if (!c->u_mode.ccm.nonce \|\| c->marks.tag \|\| !c->u_mode.ccm.lengths \|\|
	c->u_mode.ccm.aadlen > 0)
	return GPG_ERR_INV_STATE;
	if (inbuflen > c->u_mode.ccm.encryptlen)
	return GPG_ERR_INV_LENGTH;

	while (inbuflen)
	{
	size_t currlen = inbuflen;

	/* Since checksumming is done before encryption, process input in 24KiB
	* chunks to keep data loaded in L1 cache for encryption. */
	if (currlen > 24 * 1024)
	currlen = 24 * 1024;

	c->u_mode.ccm.encryptlen -= currlen;
	nburn = do_cbc_mac (c, inbuf, currlen, 0);
	burn = nburn > burn ? nburn : burn;

	err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen);
	if (err)
	break;

	outbuf += currlen;
	inbuf += currlen;
	outbuflen -= currlen;
	inbuflen -= currlen;
	}

	if (burn)
	_gcry_burn_stack (burn + sizeof(void ) 5);
	return err;
	}


	gcry_err_code_t
	_gcry_cipher_ccm_decrypt (gcry_cipher_hd_t c, unsigned char *outbuf,
	size_t outbuflen, const unsigned char *inbuf,
	size_t inbuflen)
	{
	gcry_err_code_t err = 0;
	unsigned int burn = 0;
	unsigned int nburn;

	if (outbuflen < inbuflen)
	return GPG_ERR_BUFFER_TOO_SHORT;
	if (!c->u_mode.ccm.nonce \|\| c->marks.tag \|\| !c->u_mode.ccm.lengths \|\|
	c->u_mode.ccm.aadlen > 0)
	return GPG_ERR_INV_STATE;
	if (inbuflen > c->u_mode.ccm.encryptlen)
	return GPG_ERR_INV_LENGTH;

	while (inbuflen)
	{
	size_t currlen = inbuflen;

	/* Since checksumming is done after decryption, process input in 24KiB
	* chunks to keep data loaded in L1 cache for checksumming. */
	if (currlen > 24 * 1024)
	currlen = 24 * 1024;

	err = _gcry_cipher_ctr_encrypt (c, outbuf, outbuflen, inbuf, currlen);
	if (err)
	break;

	c->u_mode.ccm.encryptlen -= currlen;
	nburn = do_cbc_mac (c, outbuf, currlen, 0);
	burn = nburn > burn ? nburn : burn;

	outbuf += currlen;
	inbuf += currlen;
	outbuflen -= currlen;
	inbuflen -= currlen;
	}

	if (burn)
	_gcry_burn_stack (burn + sizeof(void ) 5);
	return err;
	}
	diff --git a/cipher/cipher-cmac.c b/cipher/cipher-cmac.c
	index da550c37..4efd1e19 100644
	--- a/cipher/cipher-cmac.c
	+++ b/cipher/cipher-cmac.c
	@@ -1,276 +1,292 @@
	/* cmac.c - CMAC, Cipher-based MAC.
	* Copyright (C) 2013,2018 Jussi Kivilinna <jussi.kivilinna@iki.fi>
	*
	* This file is part of Libgcrypt.
	*
	* Libgcrypt is free software; you can redistribute it and/or modify
	* it under the terms of the GNU Lesser General Public License as
	* published by the Free Software Foundation; either version 2.1 of
	* the License, or (at your option) any later version.
	*
	* Libgcrypt is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Lesser General Public License for more details.
	*
	* You should have received a copy of the GNU Lesser General Public
	* License along with this program; if not, see <http://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "g10lib.h"
	#include "cipher.h"
	#include "cipher-internal.h"
	#include "bufhelp.h"


	#define set_burn(burn, nburn) do { \
	unsigned int __nburn = (nburn); \
	(burn) = (burn) > __nburn ? (burn) : __nburn; } while (0)


	gcry_err_code_t
	_gcry_cmac_write (gcry_cipher_hd_t c, gcry_cmac_context_t *ctx,
	const byte * inbuf, size_t inlen)
	{
	gcry_cipher_encrypt_t enc_fn = c->spec->encrypt;
	size_t blocksize_shift = _gcry_blocksize_shift(c);
	size_t blocksize = 1 << blocksize_shift;
	byte outbuf[MAX_BLOCKSIZE];
	unsigned int burn = 0;
	unsigned int nblocks;
	+ size_t n;

	if (ctx->tag)
	return GPG_ERR_INV_STATE;

	if (!inbuf)
	return GPG_ERR_INV_ARG;

	if (inlen == 0)
	return 0;

	/* Last block is needed for cmac_final. */
	if (ctx->mac_unused + inlen <= blocksize)
	{
	- for (; inlen && ctx->mac_unused < blocksize; inlen--)
	- ctx->macbuf[ctx->mac_unused++] = *inbuf++;
	+ buf_cpy (&ctx->macbuf[ctx->mac_unused], inbuf, inlen);
	+ ctx->mac_unused += inlen;
	+ inbuf += inlen;
	+ inlen -= inlen;
	+
	return 0;
	}

	if (ctx->mac_unused)
	{
	- for (; inlen && ctx->mac_unused < blocksize; inlen--)
	- ctx->macbuf[ctx->mac_unused++] = *inbuf++;
	+ n = inlen;
	+ if (n > blocksize - ctx->mac_unused)
	+ n = blocksize - ctx->mac_unused;
	+
	+ buf_cpy (&ctx->macbuf[ctx->mac_unused], inbuf, n);
	+ ctx->mac_unused += n;
	+ inbuf += n;
	+ inlen -= n;

	cipher_block_xor (ctx->u_iv.iv, ctx->u_iv.iv, ctx->macbuf, blocksize);
	set_burn (burn, enc_fn (&c->context.c, ctx->u_iv.iv, ctx->u_iv.iv));

	ctx->mac_unused = 0;
	}

	if (c->bulk.cbc_enc && inlen > blocksize)
	{
	nblocks = inlen >> blocksize_shift;
	nblocks -= ((nblocks << blocksize_shift) == inlen);

	c->bulk.cbc_enc (&c->context.c, ctx->u_iv.iv, outbuf, inbuf, nblocks, 1);
	inbuf += nblocks << blocksize_shift;
	inlen -= nblocks << blocksize_shift;

	wipememory (outbuf, sizeof (outbuf));
	}
	else
	while (inlen > blocksize)
	{
	cipher_block_xor (ctx->u_iv.iv, ctx->u_iv.iv, inbuf, blocksize);
	set_burn (burn, enc_fn (&c->context.c, ctx->u_iv.iv, ctx->u_iv.iv));
	inlen -= blocksize;
	inbuf += blocksize;
	}

	/* Make sure that last block is passed to cmac_final. */
	if (inlen == 0)
	BUG ();

	- for (; inlen && ctx->mac_unused < blocksize; inlen--)
	- ctx->macbuf[ctx->mac_unused++] = *inbuf++;
	+ n = inlen;
	+ if (n > blocksize - ctx->mac_unused)
	+ n = blocksize - ctx->mac_unused;
	+
	+ buf_cpy (&ctx->macbuf[ctx->mac_unused], inbuf, n);
	+ ctx->mac_unused += n;
	+ inbuf += n;
	+ inlen -= n;

	if (burn)
	_gcry_burn_stack (burn + 4 * sizeof (void *));

	return 0;
	}


	gcry_err_code_t
	_gcry_cmac_generate_subkeys (gcry_cipher_hd_t c, gcry_cmac_context_t *ctx)
	{
	const unsigned int blocksize = c->spec->blocksize;
	byte rb, carry, t, bi;
	unsigned int burn;
	int i, j;
	union
	{
	size_t _aligned;
	byte buf[MAX_BLOCKSIZE];
	} u;

	/* Tell compiler that we require a cipher with a 64bit or 128 bit block
	* length, to allow better optimization of this function. */
	if (blocksize > 16 \|\| blocksize < 8 \|\| blocksize & (8 - 1))
	return GPG_ERR_INV_CIPHER_MODE;

	if (MAX_BLOCKSIZE < blocksize)
	BUG ();

	/* encrypt zero block */
	memset (u.buf, 0, blocksize);
	burn = c->spec->encrypt (&c->context.c, u.buf, u.buf);

	/* Currently supported blocksizes are 16 and 8. */
	rb = blocksize == 16 ? 0x87 : 0x1B /* blocksize == 8 */ ;

	for (j = 0; j < 2; j++)
	{
	/* Generate subkeys K1 and K2 */
	carry = 0;
	for (i = blocksize - 1; i >= 0; i--)
	{
	bi = u.buf[i];
	t = carry \| (bi << 1);
	carry = bi >> 7;
	u.buf[i] = t & 0xff;
	ctx->subkeys[j][i] = u.buf[i];
	}
	u.buf[blocksize - 1] ^= carry ? rb : 0;
	ctx->subkeys[j][blocksize - 1] = u.buf[blocksize - 1];
	}

	wipememory (&u, sizeof (u));
	if (burn)
	_gcry_burn_stack (burn + 4 * sizeof (void *));

	return 0;
	}


	gcry_err_code_t
	_gcry_cmac_final (gcry_cipher_hd_t c, gcry_cmac_context_t *ctx)
	{
	const unsigned int blocksize = c->spec->blocksize;
	unsigned int count = ctx->mac_unused;
	unsigned int burn;
	byte *subkey;

	/* Tell compiler that we require a cipher with a 64bit or 128 bit block
	* length, to allow better optimization of this function. */
	if (blocksize > 16 \|\| blocksize < 8 \|\| blocksize & (8 - 1))
	return GPG_ERR_INV_CIPHER_MODE;

	if (count == blocksize)
	subkey = ctx->subkeys[0]; /* K1 */
	else
	{
	subkey = ctx->subkeys[1]; /* K2 */
	ctx->macbuf[count++] = 0x80;
	while (count < blocksize)
	ctx->macbuf[count++] = 0;
	}

	cipher_block_xor (ctx->macbuf, ctx->macbuf, subkey, blocksize);

	cipher_block_xor (ctx->u_iv.iv, ctx->u_iv.iv, ctx->macbuf, blocksize);
	burn = c->spec->encrypt (&c->context.c, ctx->u_iv.iv, ctx->u_iv.iv);
	if (burn)
	_gcry_burn_stack (burn + 4 * sizeof (void *));

	ctx->mac_unused = 0;

	return 0;
	}


	static gcry_err_code_t
	cmac_tag (gcry_cipher_hd_t c, gcry_cmac_context_t *ctx,
	unsigned char *tag, size_t taglen, int check)
	{
	gcry_err_code_t ret;

	if (!tag \|\| taglen == 0 \|\| taglen > c->spec->blocksize)
	return GPG_ERR_INV_ARG;

	if (!ctx->tag)
	{
	ret = _gcry_cmac_final (c, ctx);
	if (ret != 0)
	return ret;

	ctx->tag = 1;
	}

	if (!check)
	{
	memcpy (tag, ctx->u_iv.iv, taglen);
	return GPG_ERR_NO_ERROR;
	}
	else
	{
	return buf_eq_const (tag, ctx->u_iv.iv, taglen) ?
	GPG_ERR_NO_ERROR : GPG_ERR_CHECKSUM;
	}
	}


	void
	_gcry_cmac_reset (gcry_cmac_context_t *ctx)
	{
	char tmp_buf[sizeof(ctx->subkeys)];

	/* Only keep subkeys when reseting context. */

	buf_cpy (tmp_buf, ctx->subkeys, sizeof(ctx->subkeys));
	memset (ctx, 0, sizeof(*ctx));
	buf_cpy (ctx->subkeys, tmp_buf, sizeof(ctx->subkeys));
	wipememory (tmp_buf, sizeof(tmp_buf));
	}


	gcry_err_code_t
	_gcry_cipher_cmac_authenticate (gcry_cipher_hd_t c,
	const unsigned char *abuf, size_t abuflen)
	{
	if (abuflen > 0 && !abuf)
	return GPG_ERR_INV_ARG;
	/* To support new blocksize, update cmac_generate_subkeys() then add new
	blocksize here. */
	if (c->spec->blocksize != 16 && c->spec->blocksize != 8)
	return GPG_ERR_INV_CIPHER_MODE;

	return _gcry_cmac_write (c, &c->u_mode.cmac, abuf, abuflen);
	}


	gcry_err_code_t
	_gcry_cipher_cmac_get_tag (gcry_cipher_hd_t c,
	unsigned char *outtag, size_t taglen)
	{
	return cmac_tag (c, &c->u_mode.cmac, outtag, taglen, 0);
	}


	gcry_err_code_t
	_gcry_cipher_cmac_check_tag (gcry_cipher_hd_t c,
	const unsigned char *intag, size_t taglen)
	{
	return cmac_tag (c, &c->u_mode.cmac, (unsigned char *) intag, taglen, 1);
	}

	gcry_err_code_t
	_gcry_cipher_cmac_set_subkeys (gcry_cipher_hd_t c)
	{
	return _gcry_cmac_generate_subkeys (c, &c->u_mode.cmac);
	}
	diff --git a/cipher/cipher-ocb.c b/cipher/cipher-ocb.c
	index 308b0495..f1c94db0 100644
	--- a/cipher/cipher-ocb.c
	+++ b/cipher/cipher-ocb.c
	@@ -1,750 +1,767 @@
	/* cipher-ocb.c - OCB cipher mode
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of Libgcrypt.
	*
	* Libgcrypt is free software; you can redistribute it and/or modify
	* it under the terms of the GNU Lesser general Public License as
	* published by the Free Software Foundation; either version 2.1 of
	* the License, or (at your option) any later version.
	*
	* Libgcrypt is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Lesser General Public License for more details.
	*
	* You should have received a copy of the GNU Lesser General Public
	* License along with this program; if not, see <http://www.gnu.org/licenses/>.
	*
	*
	* OCB is covered by several patents but may be used freely by most
	* software. See http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm .
	* In particular license 1 is suitable for Libgcrypt: See
	* http://web.cs.ucdavis.edu/~rogaway/ocb/license1.pdf for the full
	* license document; it basically says:
	*
	* License 1 — License for Open-Source Software Implementations of OCB
	* (Jan 9, 2013)
	*
	* Under this license, you are authorized to make, use, and
	* distribute open-source software implementations of OCB. This
	* license terminates for you if you sue someone over their
	* open-source software implementation of OCB claiming that you have
	* a patent covering their implementation.
	*/


	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "g10lib.h"
	#include "cipher.h"
	#include "bufhelp.h"
	#include "./cipher-internal.h"


	/* Double the OCB_BLOCK_LEN sized block B in-place. */
	static inline void
	double_block (unsigned char *b)
	{
	#if OCB_BLOCK_LEN != 16
	unsigned char b_0 = b[0];
	int i;

	for (i=0; i < OCB_BLOCK_LEN - 1; i++)
	b[i] = (b[i] << 1) \| (b[i+1] >> 7);

	b[OCB_BLOCK_LEN-1] = (b[OCB_BLOCK_LEN-1] << 1) ^ ((b_0 >> 7) * 135);
	#else
	/* This is the generic code for 16 byte blocks. However it is not
	faster than the straight byte by byte implementation. */
	u64 l_0, l, r;

	l = buf_get_be64 (b);
	r = buf_get_be64 (b + 8);

	l_0 = -(l >> 63);
	l = (l + l) ^ (r >> 63);
	r = (r + r) ^ (l_0 & 135);

	buf_put_be64 (b, l);
	buf_put_be64 (b+8, r);
	#endif
	}


	/* Double the OCB_BLOCK_LEN sized block S and store it at D. S and D
	may point to the same memory location but they may not overlap. */
	static void
	double_block_cpy (unsigned char d, const unsigned char s)
	{
	if (d != s)
	cipher_block_cpy (d, s, OCB_BLOCK_LEN);
	double_block (d);
	}


	/* Copy NBYTES from buffer S starting at bit offset BITOFF to buffer D. */
	static void
	bit_copy (unsigned char d, const unsigned char s,
	unsigned int bitoff, unsigned int nbytes)
	{
	unsigned int shift;

	s += bitoff / 8;
	shift = bitoff % 8;
	if (shift)
	{
	for (; nbytes; nbytes--, d++, s++)
	*d = (s[0] << shift) \| (s[1] >> (8 - shift));
	}
	else
	{
	for (; nbytes; nbytes--, d++, s++)
	d = s;
	}
	}


	/* Get L_big value for block N, where N is multiple of 65536. */
	static void
	ocb_get_L_big (gcry_cipher_hd_t c, u64 n, unsigned char *l_buf)
	{
	int ntz = _gcry_ctz64 (n);

	gcry_assert(ntz >= OCB_L_TABLE_SIZE);

	double_block_cpy (l_buf, c->u_mode.ocb.L[OCB_L_TABLE_SIZE - 1]);
	for (ntz -= OCB_L_TABLE_SIZE; ntz; ntz--)
	double_block (l_buf);
	}


	/* Called after key has been set. Sets up L table. */
	void _gcry_cipher_ocb_setkey (gcry_cipher_hd_t c)
	{
	unsigned char ktop[OCB_BLOCK_LEN];
	unsigned int burn = 0;
	unsigned int nburn;
	int i;

	/* L_star = E(zero_128) */
	memset (ktop, 0, OCB_BLOCK_LEN);
	nburn = c->spec->encrypt (&c->context.c, c->u_mode.ocb.L_star, ktop);
	burn = nburn > burn ? nburn : burn;
	/* L_dollar = double(L_star) */
	double_block_cpy (c->u_mode.ocb.L_dollar, c->u_mode.ocb.L_star);
	/* L_0 = double(L_dollar), ... */
	double_block_cpy (c->u_mode.ocb.L[0], c->u_mode.ocb.L_dollar);
	for (i = 1; i < OCB_L_TABLE_SIZE; i++)
	double_block_cpy (c->u_mode.ocb.L[i], c->u_mode.ocb.L[i-1]);
	/* Precalculated offset L0+L1 */
	cipher_block_xor (c->u_mode.ocb.L0L1,
	c->u_mode.ocb.L[0], c->u_mode.ocb.L[1], OCB_BLOCK_LEN);

	/* Cleanup */
	wipememory (ktop, sizeof ktop);
	if (burn > 0)
	_gcry_burn_stack (burn + 4sizeof(void));
	}


	/* Set the nonce for OCB. This requires that the key has been set.
	Using it again resets start a new encryption cycle using the same
	key. */
	gcry_err_code_t
	_gcry_cipher_ocb_set_nonce (gcry_cipher_hd_t c, const unsigned char *nonce,
	size_t noncelen)
	{
	unsigned char ktop[OCB_BLOCK_LEN];
	unsigned char stretch[OCB_BLOCK_LEN + 8];
	unsigned int bottom;
	unsigned int burn = 0;
	unsigned int nburn;

	/* Check args. */
	if (!c->marks.key)
	return GPG_ERR_INV_STATE; /* Key must have been set first. */
	switch (c->u_mode.ocb.taglen)
	{
	case 8:
	case 12:
	case 16:
	break;
	default:
	return GPG_ERR_BUG; /* Invalid tag length. */
	}

	if (c->spec->blocksize != OCB_BLOCK_LEN)
	return GPG_ERR_CIPHER_ALGO;
	if (!nonce)
	return GPG_ERR_INV_ARG;
	/* 120 bit is the allowed maximum. In addition we impose a minimum
	of 64 bit. */
	if (noncelen > (120/8) \|\| noncelen < (64/8) \|\| noncelen >= OCB_BLOCK_LEN)
	return GPG_ERR_INV_LENGTH;

	/* Prepare the nonce. */
	memset (ktop, 0, (OCB_BLOCK_LEN - noncelen));
	buf_cpy (ktop + (OCB_BLOCK_LEN - noncelen), nonce, noncelen);
	ktop[0] = ((c->u_mode.ocb.taglen * 8) % 128) << 1;
	ktop[OCB_BLOCK_LEN - noncelen - 1] \|= 1;
	bottom = ktop[OCB_BLOCK_LEN - 1] & 0x3f;
	ktop[OCB_BLOCK_LEN - 1] &= 0xc0; /* Zero the bottom bits. */
	nburn = c->spec->encrypt (&c->context.c, ktop, ktop);
	burn = nburn > burn ? nburn : burn;
	/* Stretch = Ktop \|\| (Ktop[1..64] xor Ktop[9..72]) */
	cipher_block_cpy (stretch, ktop, OCB_BLOCK_LEN);
	cipher_block_xor (stretch + OCB_BLOCK_LEN, ktop, ktop + 1, 8);
	/* Offset_0 = Stretch[1+bottom..128+bottom]
	(We use the IV field to store the offset) */
	bit_copy (c->u_iv.iv, stretch, bottom, OCB_BLOCK_LEN);
	c->marks.iv = 1;

	/* Checksum_0 = zeros(128)
	(We use the CTR field to store the checksum) */
	memset (c->u_ctr.ctr, 0, OCB_BLOCK_LEN);

	/* Clear AAD buffer. */
	memset (c->u_mode.ocb.aad_offset, 0, OCB_BLOCK_LEN);
	memset (c->u_mode.ocb.aad_sum, 0, OCB_BLOCK_LEN);

	/* Setup other values. */
	memset (c->lastiv, 0, sizeof(c->lastiv));
	c->unused = 0;
	c->marks.tag = 0;
	c->marks.finalize = 0;
	c->u_mode.ocb.data_nblocks = 0;
	c->u_mode.ocb.aad_nblocks = 0;
	c->u_mode.ocb.aad_nleftover = 0;
	c->u_mode.ocb.data_finalized = 0;
	c->u_mode.ocb.aad_finalized = 0;

	/* log_printhex ("L_* ", c->u_mode.ocb.L_star, OCB_BLOCK_LEN); */
	/* log_printhex ("L_$ ", c->u_mode.ocb.L_dollar, OCB_BLOCK_LEN); */
	/* log_printhex ("L_0 ", c->u_mode.ocb.L[0], OCB_BLOCK_LEN); */
	/* log_printhex ("L_1 ", c->u_mode.ocb.L[1], OCB_BLOCK_LEN); */
	/* log_debug ( "bottom : %u (decimal)\n", bottom); */
	/* log_printhex ("Ktop ", ktop, OCB_BLOCK_LEN); */
	/* log_printhex ("Stretch ", stretch, sizeof stretch); */
	/* log_printhex ("Offset_0 ", c->u_iv.iv, OCB_BLOCK_LEN); */

	/* Cleanup */
	wipememory (ktop, sizeof ktop);
	wipememory (stretch, sizeof stretch);
	if (burn > 0)
	_gcry_burn_stack (burn + 4sizeof(void));

	return 0;
	}


	/* Process additional authentication data. This implementation allows
	to add additional authentication data at any time before the final
	gcry_cipher_gettag. */
	gcry_err_code_t
	_gcry_cipher_ocb_authenticate (gcry_cipher_hd_t c, const unsigned char *abuf,
	size_t abuflen)
	{
	const size_t table_maxblks = 1 << OCB_L_TABLE_SIZE;
	const u32 table_size_mask = ((1 << OCB_L_TABLE_SIZE) - 1);
	unsigned char l_tmp[OCB_BLOCK_LEN];
	unsigned int burn = 0;
	unsigned int nburn;
	+ size_t n;

	/* Check that a nonce and thus a key has been set and that we have
	not yet computed the tag. We also return an error if the aad has
	been finalized (i.e. a short block has been processed). */
	if (!c->marks.iv \|\| c->marks.tag \|\| c->u_mode.ocb.aad_finalized)
	return GPG_ERR_INV_STATE;

	/* Check correct usage and arguments. */
	if (c->spec->blocksize != OCB_BLOCK_LEN)
	return GPG_ERR_CIPHER_ALGO;

	/* Process remaining data from the last call first. */
	if (c->u_mode.ocb.aad_nleftover)
	{
	- for (; abuflen && c->u_mode.ocb.aad_nleftover < OCB_BLOCK_LEN;
	- abuf++, abuflen--)
	- c->u_mode.ocb.aad_leftover[c->u_mode.ocb.aad_nleftover++] = *abuf;
	+ n = abuflen;
	+ if (n > OCB_BLOCK_LEN - c->u_mode.ocb.aad_nleftover)
	+ n = OCB_BLOCK_LEN - c->u_mode.ocb.aad_nleftover;
	+
	+ buf_cpy (&c->u_mode.ocb.aad_leftover[c->u_mode.ocb.aad_nleftover],
	+ abuf, n);
	+ c->u_mode.ocb.aad_nleftover += n;
	+ abuf += n;
	+ abuflen -= n;

	if (c->u_mode.ocb.aad_nleftover == OCB_BLOCK_LEN)
	{
	c->u_mode.ocb.aad_nblocks++;

	if ((c->u_mode.ocb.aad_nblocks % table_maxblks) == 0)
	{
	/* Table overflow, L needs to be generated. */
	ocb_get_L_big(c, c->u_mode.ocb.aad_nblocks + 1, l_tmp);
	}
	else
	{
	cipher_block_cpy (l_tmp, ocb_get_l (c, c->u_mode.ocb.aad_nblocks),
	OCB_BLOCK_LEN);
	}

	/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
	cipher_block_xor_1 (c->u_mode.ocb.aad_offset, l_tmp, OCB_BLOCK_LEN);
	/* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i) */
	cipher_block_xor (l_tmp, c->u_mode.ocb.aad_offset,
	c->u_mode.ocb.aad_leftover, OCB_BLOCK_LEN);
	nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
	burn = nburn > burn ? nburn : burn;
	cipher_block_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);

	c->u_mode.ocb.aad_nleftover = 0;
	}
	}

	if (!abuflen)
	{
	if (burn > 0)
	_gcry_burn_stack (burn + 4sizeof(void));

	return 0;
	}

	/* Full blocks handling. */
	while (abuflen >= OCB_BLOCK_LEN)
	{
	size_t nblks = abuflen / OCB_BLOCK_LEN;
	size_t nmaxblks;

	/* Check how many blocks to process till table overflow. */
	nmaxblks = (c->u_mode.ocb.aad_nblocks + 1) % table_maxblks;
	nmaxblks = (table_maxblks - nmaxblks) % table_maxblks;

	if (nmaxblks == 0)
	{
	/* Table overflow, generate L and process one block. */
	c->u_mode.ocb.aad_nblocks++;
	ocb_get_L_big(c, c->u_mode.ocb.aad_nblocks, l_tmp);

	/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
	cipher_block_xor_1 (c->u_mode.ocb.aad_offset, l_tmp, OCB_BLOCK_LEN);
	/* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i) */
	cipher_block_xor (l_tmp, c->u_mode.ocb.aad_offset, abuf,
	OCB_BLOCK_LEN);
	nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
	burn = nburn > burn ? nburn : burn;
	cipher_block_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);

	abuf += OCB_BLOCK_LEN;
	abuflen -= OCB_BLOCK_LEN;
	nblks--;

	/* With overflow handled, retry loop again. Next overflow will
	* happen after 65535 blocks. */
	continue;
	}

	nblks = nblks < nmaxblks ? nblks : nmaxblks;

	/* Use a bulk method if available. */
	if (nblks && c->bulk.ocb_auth)
	{
	size_t nleft;
	size_t ndone;

	nleft = c->bulk.ocb_auth (c, abuf, nblks);
	ndone = nblks - nleft;

	abuf += ndone * OCB_BLOCK_LEN;
	abuflen -= ndone * OCB_BLOCK_LEN;
	nblks = nleft;
	}

	/* Hash all full blocks. */
	while (nblks)
	{
	c->u_mode.ocb.aad_nblocks++;

	gcry_assert(c->u_mode.ocb.aad_nblocks & table_size_mask);

	/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
	cipher_block_xor_1 (c->u_mode.ocb.aad_offset,
	ocb_get_l (c, c->u_mode.ocb.aad_nblocks),
	OCB_BLOCK_LEN);
	/* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i) */
	cipher_block_xor (l_tmp, c->u_mode.ocb.aad_offset, abuf,
	OCB_BLOCK_LEN);
	nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
	burn = nburn > burn ? nburn : burn;
	cipher_block_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);

	abuf += OCB_BLOCK_LEN;
	abuflen -= OCB_BLOCK_LEN;
	nblks--;
	}
	}

	/* Store away the remaining data. */
	- for (; abuflen && c->u_mode.ocb.aad_nleftover < OCB_BLOCK_LEN;
	- abuf++, abuflen--)
	- c->u_mode.ocb.aad_leftover[c->u_mode.ocb.aad_nleftover++] = *abuf;
	+ if (abuflen)
	+ {
	+ n = abuflen;
	+ if (n > OCB_BLOCK_LEN - c->u_mode.ocb.aad_nleftover)
	+ n = OCB_BLOCK_LEN - c->u_mode.ocb.aad_nleftover;
	+
	+ buf_cpy (&c->u_mode.ocb.aad_leftover[c->u_mode.ocb.aad_nleftover],
	+ abuf, n);
	+ c->u_mode.ocb.aad_nleftover += n;
	+ abuf += n;
	+ abuflen -= n;
	+ }
	+
	gcry_assert (!abuflen);

	if (burn > 0)
	_gcry_burn_stack (burn + 4sizeof(void));

	return 0;
	}


	/* Hash final partial AAD block. */
	static void
	ocb_aad_finalize (gcry_cipher_hd_t c)
	{
	unsigned char l_tmp[OCB_BLOCK_LEN];
	unsigned int burn = 0;
	unsigned int nburn;

	/* Check that a nonce and thus a key has been set and that we have
	not yet computed the tag. We also skip this if the aad has been
	finalized. */
	if (!c->marks.iv \|\| c->marks.tag \|\| c->u_mode.ocb.aad_finalized)
	return;
	if (c->spec->blocksize != OCB_BLOCK_LEN)
	return; /* Ooops. */

	/* Hash final partial block if any. */
	if (c->u_mode.ocb.aad_nleftover)
	{
	/* Offset_* = Offset_m xor L_* */
	cipher_block_xor_1 (c->u_mode.ocb.aad_offset,
	c->u_mode.ocb.L_star, OCB_BLOCK_LEN);
	/* CipherInput = (A_* \|\| 1 \|\| zeros(127-bitlen(A_))) xor Offset_ */
	buf_cpy (l_tmp, c->u_mode.ocb.aad_leftover, c->u_mode.ocb.aad_nleftover);
	memset (l_tmp + c->u_mode.ocb.aad_nleftover, 0,
	OCB_BLOCK_LEN - c->u_mode.ocb.aad_nleftover);
	l_tmp[c->u_mode.ocb.aad_nleftover] = 0x80;
	cipher_block_xor_1 (l_tmp, c->u_mode.ocb.aad_offset, OCB_BLOCK_LEN);
	/* Sum = Sum_m xor ENCIPHER(K, CipherInput) */
	nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
	burn = nburn > burn ? nburn : burn;
	cipher_block_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);

	c->u_mode.ocb.aad_nleftover = 0;
	}

	/* Mark AAD as finalized so that gcry_cipher_ocb_authenticate can
	* return an erro when called again. */
	c->u_mode.ocb.aad_finalized = 1;

	if (burn > 0)
	_gcry_burn_stack (burn + 4sizeof(void));
	}



	/* Checksumming for encrypt and decrypt. */
	static void
	ocb_checksum (unsigned char chksum, const unsigned char plainbuf,
	size_t nblks)
	{
	while (nblks > 0)
	{
	/* Checksum_i = Checksum_{i-1} xor P_i */
	cipher_block_xor_1(chksum, plainbuf, OCB_BLOCK_LEN);

	plainbuf += OCB_BLOCK_LEN;
	nblks--;
	}
	}


	/* Common code for encrypt and decrypt. */
	static gcry_err_code_t
	ocb_crypt (gcry_cipher_hd_t c, int encrypt,
	unsigned char *outbuf, size_t outbuflen,
	const unsigned char *inbuf, size_t inbuflen)
	{
	const size_t table_maxblks = 1 << OCB_L_TABLE_SIZE;
	const u32 table_size_mask = ((1 << OCB_L_TABLE_SIZE) - 1);
	unsigned char l_tmp[OCB_BLOCK_LEN];
	unsigned int burn = 0;
	unsigned int nburn;
	gcry_cipher_encrypt_t crypt_fn =
	encrypt ? c->spec->encrypt : c->spec->decrypt;

	/* Check that a nonce and thus a key has been set and that we are
	not yet in end of data state. */
	if (!c->marks.iv \|\| c->u_mode.ocb.data_finalized)
	return GPG_ERR_INV_STATE;

	/* Check correct usage and arguments. */
	if (c->spec->blocksize != OCB_BLOCK_LEN)
	return GPG_ERR_CIPHER_ALGO;
	if (outbuflen < inbuflen)
	return GPG_ERR_BUFFER_TOO_SHORT;
	if (c->marks.finalize)
	; /* Allow arbitarty length. */
	else if ((inbuflen % OCB_BLOCK_LEN))
	return GPG_ERR_INV_LENGTH; /* We support only full blocks for now. */

	/* Full blocks handling. */
	while (inbuflen >= OCB_BLOCK_LEN)
	{
	size_t nblks = inbuflen / OCB_BLOCK_LEN;
	size_t nmaxblks;

	/* Check how many blocks to process till table overflow. */
	nmaxblks = (c->u_mode.ocb.data_nblocks + 1) % table_maxblks;
	nmaxblks = (table_maxblks - nmaxblks) % table_maxblks;

	if (nmaxblks == 0)
	{
	/* Table overflow, generate L and process one block. */
	c->u_mode.ocb.data_nblocks++;
	ocb_get_L_big(c, c->u_mode.ocb.data_nblocks, l_tmp);

	if (encrypt)
	{
	/* Checksum_i = Checksum_{i-1} xor P_i */
	ocb_checksum (c->u_ctr.ctr, inbuf, 1);
	}

	/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
	cipher_block_xor_1 (c->u_iv.iv, l_tmp, OCB_BLOCK_LEN);
	/* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i) */
	cipher_block_xor (outbuf, c->u_iv.iv, inbuf, OCB_BLOCK_LEN);
	nburn = crypt_fn (&c->context.c, outbuf, outbuf);
	burn = nburn > burn ? nburn : burn;
	cipher_block_xor_1 (outbuf, c->u_iv.iv, OCB_BLOCK_LEN);

	if (!encrypt)
	{
	/* Checksum_i = Checksum_{i-1} xor P_i */
	ocb_checksum (c->u_ctr.ctr, outbuf, 1);
	}

	inbuf += OCB_BLOCK_LEN;
	inbuflen -= OCB_BLOCK_LEN;
	outbuf += OCB_BLOCK_LEN;
	outbuflen =- OCB_BLOCK_LEN;
	nblks--;

	/* With overflow handled, retry loop again. Next overflow will
	* happen after 65535 blocks. */
	continue;
	}

	nblks = nblks < nmaxblks ? nblks : nmaxblks;

	/* Since checksum xoring is done before/after encryption/decryption,
	process input in 24KiB chunks to keep data loaded in L1 cache for
	checksumming. */
	if (nblks > 24 * 1024 / OCB_BLOCK_LEN)
	nblks = 24 * 1024 / OCB_BLOCK_LEN;

	/* Use a bulk method if available. */
	if (nblks && c->bulk.ocb_crypt)
	{
	size_t nleft;
	size_t ndone;

	nleft = c->bulk.ocb_crypt (c, outbuf, inbuf, nblks, encrypt);
	ndone = nblks - nleft;

	inbuf += ndone * OCB_BLOCK_LEN;
	outbuf += ndone * OCB_BLOCK_LEN;
	inbuflen -= ndone * OCB_BLOCK_LEN;
	outbuflen -= ndone * OCB_BLOCK_LEN;
	nblks = nleft;
	}

	if (nblks)
	{
	size_t nblks_chksum = nblks;

	if (encrypt)
	{
	/* Checksum_i = Checksum_{i-1} xor P_i */
	ocb_checksum (c->u_ctr.ctr, inbuf, nblks_chksum);
	}

	/* Encrypt all full blocks. */
	while (nblks)
	{
	c->u_mode.ocb.data_nblocks++;

	gcry_assert(c->u_mode.ocb.data_nblocks & table_size_mask);

	/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
	cipher_block_xor_1 (c->u_iv.iv,
	ocb_get_l (c, c->u_mode.ocb.data_nblocks),
	OCB_BLOCK_LEN);
	/* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i) */
	cipher_block_xor (outbuf, c->u_iv.iv, inbuf, OCB_BLOCK_LEN);
	nburn = crypt_fn (&c->context.c, outbuf, outbuf);
	burn = nburn > burn ? nburn : burn;
	cipher_block_xor_1 (outbuf, c->u_iv.iv, OCB_BLOCK_LEN);

	inbuf += OCB_BLOCK_LEN;
	inbuflen -= OCB_BLOCK_LEN;
	outbuf += OCB_BLOCK_LEN;
	outbuflen =- OCB_BLOCK_LEN;
	nblks--;
	}

	if (!encrypt)
	{
	/* Checksum_i = Checksum_{i-1} xor P_i */
	ocb_checksum (c->u_ctr.ctr,
	outbuf - nblks_chksum * OCB_BLOCK_LEN,
	nblks_chksum);
	}
	}
	}

	/* Encrypt final partial block. Note that we expect INBUFLEN to be
	shorter than OCB_BLOCK_LEN (see above). */
	if (inbuflen)
	{
	unsigned char pad[OCB_BLOCK_LEN];

	/* Offset_* = Offset_m xor L_* */
	cipher_block_xor_1 (c->u_iv.iv, c->u_mode.ocb.L_star, OCB_BLOCK_LEN);
	/* Pad = ENCIPHER(K, Offset_) /
	nburn = c->spec->encrypt (&c->context.c, pad, c->u_iv.iv);
	burn = nburn > burn ? nburn : burn;

	if (encrypt)
	{
	/* Checksum_* = Checksum_m xor (P_* \|\| 1 \|\| zeros(127-bitlen(P_))) /
	/* Note that INBUFLEN is less than OCB_BLOCK_LEN. */
	buf_cpy (l_tmp, inbuf, inbuflen);
	memset (l_tmp + inbuflen, 0, OCB_BLOCK_LEN - inbuflen);
	l_tmp[inbuflen] = 0x80;
	cipher_block_xor_1 (c->u_ctr.ctr, l_tmp, OCB_BLOCK_LEN);
	/* C_* = P_* xor Pad[1..bitlen(P_)] /
	buf_xor (outbuf, inbuf, pad, inbuflen);
	}
	else
	{
	/* P_* = C_* xor Pad[1..bitlen(C_)] /
	/* Checksum_* = Checksum_m xor (P_* \|\| 1 \|\| zeros(127-bitlen(P_))) /
	cipher_block_cpy (l_tmp, pad, OCB_BLOCK_LEN);
	buf_cpy (l_tmp, inbuf, inbuflen);
	cipher_block_xor_1 (l_tmp, pad, OCB_BLOCK_LEN);
	l_tmp[inbuflen] = 0x80;
	buf_cpy (outbuf, l_tmp, inbuflen);

	cipher_block_xor_1 (c->u_ctr.ctr, l_tmp, OCB_BLOCK_LEN);
	}
	}

	/* Compute the tag if the finalize flag has been set. */
	if (c->marks.finalize)
	{
	/* Tag = ENCIPHER(K, Checksum xor Offset xor L_$) xor HASH(K,A) */
	cipher_block_xor (c->u_mode.ocb.tag, c->u_ctr.ctr, c->u_iv.iv,
	OCB_BLOCK_LEN);
	cipher_block_xor_1 (c->u_mode.ocb.tag, c->u_mode.ocb.L_dollar,
	OCB_BLOCK_LEN);
	nburn = c->spec->encrypt (&c->context.c,
	c->u_mode.ocb.tag, c->u_mode.ocb.tag);
	burn = nburn > burn ? nburn : burn;

	c->u_mode.ocb.data_finalized = 1;
	/* Note that the the final part of the tag computation is done
	by _gcry_cipher_ocb_get_tag. */
	}

	if (burn > 0)
	_gcry_burn_stack (burn + 4sizeof(void));

	return 0;
	}


	/* Encrypt (INBUF,INBUFLEN) in OCB mode to OUTBUF. OUTBUFLEN gives
	the allocated size of OUTBUF. This function accepts only multiples
	of a full block unless gcry_cipher_final has been called in which
	case the next block may have any length. */
	gcry_err_code_t
	_gcry_cipher_ocb_encrypt (gcry_cipher_hd_t c,
	unsigned char *outbuf, size_t outbuflen,
	const unsigned char *inbuf, size_t inbuflen)

	{
	return ocb_crypt (c, 1, outbuf, outbuflen, inbuf, inbuflen);
	}


	/* Decrypt (INBUF,INBUFLEN) in OCB mode to OUTBUF. OUTBUFLEN gives
	the allocated size of OUTBUF. This function accepts only multiples
	of a full block unless gcry_cipher_final has been called in which
	case the next block may have any length. */
	gcry_err_code_t
	_gcry_cipher_ocb_decrypt (gcry_cipher_hd_t c,
	unsigned char *outbuf, size_t outbuflen,
	const unsigned char *inbuf, size_t inbuflen)
	{
	return ocb_crypt (c, 0, outbuf, outbuflen, inbuf, inbuflen);
	}


	/* Compute the tag. The last data operation has already done some
	part of it. To allow adding AAD even after having done all data,
	we finish the tag computation only here. */
	static void
	compute_tag_if_needed (gcry_cipher_hd_t c)
	{
	if (!c->marks.tag)
	{
	ocb_aad_finalize (c);
	cipher_block_xor_1 (c->u_mode.ocb.tag, c->u_mode.ocb.aad_sum,
	OCB_BLOCK_LEN);
	c->marks.tag = 1;
	}
	}


	/* Copy the already computed tag to OUTTAG. OUTTAGSIZE is the
	allocated size of OUTTAG; the function returns an error if that is
	too short to hold the tag. */
	gcry_err_code_t
	_gcry_cipher_ocb_get_tag (gcry_cipher_hd_t c,
	unsigned char *outtag, size_t outtagsize)
	{
	if (c->u_mode.ocb.taglen > outtagsize)
	return GPG_ERR_BUFFER_TOO_SHORT;
	if (!c->u_mode.ocb.data_finalized)
	return GPG_ERR_INV_STATE; /* Data has not yet been finalized. */

	compute_tag_if_needed (c);

	memcpy (outtag, c->u_mode.ocb.tag, c->u_mode.ocb.taglen);

	return 0;
	}


	/* Check that the tag (INTAG,TAGLEN) matches the computed tag for the
	handle C. */
	gcry_err_code_t
	_gcry_cipher_ocb_check_tag (gcry_cipher_hd_t c, const unsigned char *intag,
	size_t taglen)
	{
	size_t n;

	if (!c->u_mode.ocb.data_finalized)
	return GPG_ERR_INV_STATE; /* Data has not yet been finalized. */

	compute_tag_if_needed (c);

	n = c->u_mode.ocb.taglen;
	if (taglen < n)
	n = taglen;

	if (!buf_eq_const (intag, c->u_mode.ocb.tag, n)
	\|\| c->u_mode.ocb.taglen != taglen)
	return GPG_ERR_CHECKSUM;

	return 0;
	}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Feb 7, 7:37 AM (1 d, 19 h)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: fa/75/c353978db0b7f48621a9d68cb0ca

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions