10#include <botan/internal/ghash.h>
12#include <botan/exceptn.h>
13#include <botan/internal/cpuid.h>
14#include <botan/internal/ct_utils.h>
15#include <botan/internal/loadstor.h>
16#include <botan/internal/stl_util.h>
21#if defined(BOTAN_HAS_GHASH_CLMUL_CPU)
27#if defined(BOTAN_HAS_GHASH_CLMUL_VPERM)
36void GHASH::ghash_multiply(std::span<uint8_t, GCM_BS> x, std::span<const uint8_t> input,
size_t blocks) {
39#if defined(BOTAN_HAS_GHASH_CLMUL_CPU)
42 return ghash_multiply_cpu(x.data(), m_H_pow.data(), input.data(), blocks);
46#if defined(BOTAN_HAS_GHASH_CLMUL_VPERM)
48 return ghash_multiply_vperm(x.data(), m_HM.data(), input.data(), blocks);
56 BufferSlicer in(input);
57 for(
size_t b = 0;
b != blocks; ++
b) {
62 std::array<uint64_t, 2>
Z{};
64 for(
size_t i = 0; i != 64; ++i) {
71 Z[0] = X0MASK.select(Z[0] ^ m_HM[4 * i], Z[0]);
72 Z[1] = X0MASK.select(Z[1] ^ m_HM[4 * i + 1], Z[1]);
74 Z[0] = X1MASK.select(Z[0] ^ m_HM[4 * i + 2], Z[0]);
75 Z[1] = X1MASK.select(Z[1] ^ m_HM[4 * i + 3], Z[1]);
89void GHASH::key_schedule(std::span<const uint8_t> key) {
97 const uint64_t R = 0xE100000000000000;
102 for(
size_t i = 0; i != 2; ++i) {
103 for(
size_t j = 0; j != 64; ++j) {
108 m_HM[4 * j + 2 * i] = H[0];
109 m_HM[4 * j + 2 * i + 1] = H[1];
113 H[1] = (H[1] >> 1) | (H[0] << 63);
114 H[0] = (H[0] >> 1) ^
carry;
118#if defined(BOTAN_HAS_GHASH_CLMUL_CPU)
121 ghash_precompute_cpu(key.data(), m_H_pow.data());
128 auto& n = m_nonce.emplace();
138 ghash_update(m_H_ad, input);
139 ghash_zeropad(m_H_ad);
140 m_ad_len = input.size();
145 ghash_update(m_ghash, ad);
146 m_ad_len += ad.size();
152 ghash_update(m_ghash, input);
153 m_text_len += input.size();
157 BOTAN_ARG_CHECK(!mac.empty() && mac.size() <= GCM_BS,
"GHASH output length");
161 ghash_zeropad(m_ghash);
162 ghash_final_block(m_ghash, m_ad_len, m_text_len);
164 xor_buf(mac, std::span{m_ghash}.first(mac.size()), std::span{*m_nonce}.first(mac.size()));
176 auto sy0 = std::span<uint8_t, GCM_BS>{y0};
177 ghash_update(sy0, nonce);
179 ghash_final_block(sy0, 0, nonce.size());
195 m_text_len = m_ad_len = 0;
198void GHASH::ghash_update(std::span<uint8_t, GCM_BS> x, std::span<const uint8_t> input) {
202 ghash_multiply(x, one_block.value(), 1);
207 if(full_blocks > 0) {
208 ghash_multiply(x, aligned_data, full_blocks);
215void GHASH::ghash_zeropad(std::span<uint8_t, GCM_BS> x) {
218 ghash_multiply(x, m_buffer.
consume(), 1);
222void GHASH::ghash_final_block(std::span<uint8_t, GCM_BS> x, uint64_t ad_len, uint64_t text_len) {
224 const auto final_block =
store_be(8 * ad_len, 8 * text_len);
225 ghash_multiply(x, final_block, 1);
#define BOTAN_ASSERT_NOMSG(expr)
#define BOTAN_STATE_CHECK(expr)
#define BOTAN_ARG_CHECK(expr, msg)
std::tuple< std::span< const uint8_t >, size_t > aligned_data_to_process(BufferSlicer &slicer) const
std::optional< std::span< const T > > handle_unaligned_data(BufferSlicer &slicer)
std::span< const T > consume()
void fill_up_with_zeros()
bool in_alignment() const
static bool has_carryless_multiply()
static constexpr Mask< T > expand(T v)
static constexpr Mask< T > expand_top_bit(T v)
void update_associated_data(std::span< const uint8_t > ad)
Incremental update of associated data used in the GMAC use-case.
std::string provider() const
void nonce_hash(secure_vector< uint8_t > &y0, std::span< const uint8_t > nonce)
Hashing of non-default length nonce values for both GCM and GMAC use-cases.
void final(std::span< uint8_t > out)
void update(std::span< const uint8_t > in)
void start(std::span< const uint8_t > nonce)
bool has_keying_material() const override
void set_associated_data(std::span< const uint8_t > ad)
Monolithic setting of associated data usid in the GCM use-case.
void assert_key_material_set() const
constexpr auto scoped_poison(const Ts &... xs)
void zap(std::vector< T, Alloc > &vec)
void secure_scrub_memory(void *ptr, size_t n)
void carry(int64_t &h0, int64_t &h1)
constexpr void xor_buf(ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in)
std::vector< T, secure_allocator< T > > secure_vector
constexpr void copy_mem(T *out, const T *in, size_t n)
constexpr auto store_be(ParamTs &&... params)
constexpr auto load_be(ParamTs &&... params)