Home | History | Annotate | Download | only in crypto 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "base/basictypes.h"
      6 #include "crypto/crypto_export.h"
      7 
      8 namespace crypto {
      9 
     10 // GaloisHash implements the polynomial authenticator part of GCM as specified
     11 // in http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf
     12 // Specifically it implements the GHASH function, defined in section 2.3 of
     13 // that document.
     14 //
     15 // In SP-800-38D, GHASH is defined differently and takes only a single data
     16 // argument. But it is always called with an argument of a certain form:
     17 //   GHASH_H (A || 0^v || C || 0^u || [len(A)]_64 || [len(C)]_64)
     18 // This mirrors how the gcm-revised-spec.pdf version of GHASH handles its two
     19 // data arguments. The two GHASH functions therefore differ only in whether the
     20 // data is formatted inside or outside of the function.
     21 //
     22 // WARNING: do not use this as a generic authenticator. Polynomial
     23 // authenticators must be used in the correct manner and any use outside of GCM
     24 // requires careful consideration.
     25 //
     26 // WARNING: this code is not constant time. However, in all likelihood, nor is
     27 // the implementation of AES that is used.
     28 class CRYPTO_EXPORT_PRIVATE GaloisHash {
     29  public:
     30   explicit GaloisHash(const uint8 key[16]);
     31 
     32   // Reset prepares to digest a fresh message with the same key. This is more
     33   // efficient than creating a fresh object.
     34   void Reset();
     35 
     36   // UpdateAdditional hashes in `additional' data. This is data that is not
     37   // encrypted, but is covered by the authenticator. All additional data must
     38   // be written before any ciphertext is written.
     39   void UpdateAdditional(const uint8* data, size_t length);
     40 
     41   // UpdateCiphertext hashes in ciphertext to be authenticated.
     42   void UpdateCiphertext(const uint8* data, size_t length);
     43 
     44   // Finish completes the hash computation and writes at most |len| bytes of
     45   // the result to |output|.
     46   void Finish(void* output, size_t len);
     47 
     48  private:
     49   enum State {
     50     kHashingAdditionalData,
     51     kHashingCiphertext,
     52     kComplete,
     53   };
     54 
     55   struct FieldElement {
     56     uint64 low, hi;
     57   };
     58 
     59   // Add returns |x|+|y|.
     60   static FieldElement Add(const FieldElement& x, const FieldElement& y);
     61   // Double returns 2*|x|.
     62   static FieldElement Double(const FieldElement& x);
     63   // MulAfterPrecomputation sets |x| = |x|*h where h is |table[1]| and
     64   // table[i] = i*h for i=0..15.
     65   static void MulAfterPrecomputation(const FieldElement* table,
     66                                      FieldElement* x);
     67   // Mul16 sets |x| = 16*|x|.
     68   static void Mul16(FieldElement* x);
     69 
     70   // UpdateBlocks processes |num_blocks| 16-bytes blocks from |bytes|.
     71   void UpdateBlocks(const uint8* bytes, size_t num_blocks);
     72   // Update processes |length| bytes from |bytes| and calls UpdateBlocks on as
     73   // much data as possible. It uses |buf_| to buffer any remaining data and
     74   // always consumes all of |bytes|.
     75   void Update(const uint8* bytes, size_t length);
     76 
     77   FieldElement y_;
     78   State state_;
     79   size_t additional_bytes_;
     80   size_t ciphertext_bytes_;
     81   uint8 buf_[16];
     82   size_t buf_used_;
     83   FieldElement product_table_[16];
     84 };
     85 
     86 }  // namespace crypto
     87