summaryrefslogtreecommitdiff
path: root/crypto_aead/lilliputaei128v1/ref/lilliput-ae-i.c
diff options
context:
space:
mode:
Diffstat (limited to 'crypto_aead/lilliputaei128v1/ref/lilliput-ae-i.c')
-rw-r--r--crypto_aead/lilliputaei128v1/ref/lilliput-ae-i.c310
1 files changed, 0 insertions, 310 deletions
diff --git a/crypto_aead/lilliputaei128v1/ref/lilliput-ae-i.c b/crypto_aead/lilliputaei128v1/ref/lilliput-ae-i.c
deleted file mode 100644
index 60a916b..0000000
--- a/crypto_aead/lilliputaei128v1/ref/lilliput-ae-i.c
+++ /dev/null
@@ -1,310 +0,0 @@
-#include <stdbool.h>
-#include <stdint.h>
-#include <string.h>
-
-#include "cipher.h"
-#include "lilliput-ae.h"
-
-
-static const uint8_t _0n[BLOCK_BYTES] = {
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-};
-
-
-static uint8_t _upper_nibble(uint8_t i)
-{
- return i >> 4;
-}
-
-static uint8_t _lower_nibble(uint8_t i)
-{
- return i & 0x0f;
-}
-
-static void _encrypt(const uint8_t K[KEY_BYTES],
- const uint8_t T[TWEAK_BYTES],
- const uint8_t M[BLOCK_BYTES],
- uint8_t C[BLOCK_BYTES])
-{
- lilliput_tbc_encrypt(K, T, M, C);
-}
-
-static void _decrypt(const uint8_t K[KEY_BYTES],
- const uint8_t T[TWEAK_BYTES],
- const uint8_t C[BLOCK_BYTES],
- uint8_t M[BLOCK_BYTES])
-{
- lilliput_tbc_decrypt(K, T, C, M);
-}
-
-static void _xor_into(uint8_t dest[BLOCK_BYTES], const uint8_t src[BLOCK_BYTES])
-{
- for (size_t i=0; i<BLOCK_BYTES; i++)
- dest[i] ^= src[i];
-}
-
-static void _xor_arrays(size_t len, uint8_t out[len], const uint8_t a[len], const uint8_t b[len])
-{
- for (size_t i=0; i<len; i++)
- out[i] = a[i] ^ b[i];
-}
-
-static void _pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BLOCK_BYTES])
-{
- /* pad10*(X) = X || 1 || 0^{n-|X|-1} */
-
- /* Assume that len<BLOCK_BYTES. */
-
- size_t pad_len = BLOCK_BYTES-X_len;
-
- memcpy(padded+pad_len, X, X_len);
-
- padded[pad_len-1] = 0x80;
-
- if (pad_len > 1)
- {
- memset(padded, 0, pad_len-1);
- }
-}
-
-static void _fill_ad_tweak(
- uint8_t prefix,
- uint64_t block_nb,
- uint8_t tweak[TWEAK_BYTES]
-)
-{
- /* The 192-bit tweak is filled as follows:
- *
- * - bits 1-188: block number
- * 1- 64: actual 64-bit block number
- * 65-188: 0-padding
- * - bits 189-192: constant 4-bit prefix
- */
-
- for (size_t i=0; i<sizeof(block_nb); i++)
- {
- uint64_t mask = (uint64_t)0xff << 8*i;
- uint8_t b = (mask & block_nb) >> 8*i;
-
- tweak[i] = b;
- }
-
- /* Assume padding bytes have already been memset to 0. */
-
- tweak[TWEAK_BYTES-1] |= prefix << 4;
-}
-
-static void _fill_msg_tweak(
- uint8_t prefix,
- const uint8_t N[NONCE_BYTES],
- uint64_t block_nb,
- uint8_t tweak[TWEAK_BYTES]
-)
-{
- /* The 192-bit tweak is filled as follows:
- *
- * - bits 1- 68: block number
- * 1- 64: actual 64-bit block number
- * 64- 68: 0-padding
- * - bits 67-188: nonce
- * - bits 189-192: constant 4-bit prefix
- */
-
- for (size_t i=0; i<sizeof(block_nb); i++)
- {
- uint64_t mask = (uint64_t)0xff << 8*i;
- uint8_t b = (mask & block_nb) >> 8*i;
-
- tweak[i] = b;
- }
-
- tweak[sizeof(block_nb)] = _lower_nibble(N[0]) << 4;
-
- for (size_t i=1; i<NONCE_BYTES; i++)
- {
- tweak[sizeof(block_nb)+i] = _lower_nibble(N[i]) << 4 ^ _upper_nibble(N[i-1]);
- }
-
- tweak[TWEAK_BYTES-1] = prefix << 4 ^ _upper_nibble(N[NONCE_BYTES-1]);
-}
-
-static void _process_associated_data(
- const uint8_t key[KEY_BYTES],
- size_t A_len,
- const uint8_t A[A_len],
- uint8_t Auth[BLOCK_BYTES]
-)
-{
- uint8_t Ek_Ai[BLOCK_BYTES];
- uint8_t tweak[TWEAK_BYTES];
-
- memset(tweak, 0, TWEAK_BYTES);
- memset(Auth, 0, BLOCK_BYTES);
-
- size_t l_a = A_len / BLOCK_BYTES;
- size_t rest = A_len % BLOCK_BYTES;
-
- for (size_t i=0; i<l_a; i++)
- {
- _fill_ad_tweak(0x2, i, tweak);
- _encrypt(key, tweak, &A[i*BLOCK_BYTES], Ek_Ai);
- _xor_into(Auth, Ek_Ai);
- }
-
- if (rest != 0)
- {
- uint8_t A_rest[BLOCK_BYTES];
- _pad10(rest, &A[l_a*BLOCK_BYTES], A_rest);
- _fill_ad_tweak(0x6, l_a, tweak);
- _encrypt(key, tweak, A_rest, Ek_Ai);
- _xor_into(Auth, Ek_Ai);
- }
-}
-
-static void _encrypt_message(
- const uint8_t key[KEY_BYTES],
- size_t M_len,
- const uint8_t M[M_len],
- const uint8_t N[NONCE_BYTES],
- uint8_t C[M_len+BLOCK_BYTES],
- uint8_t Final[BLOCK_BYTES]
-)
-{
- size_t l = M_len / BLOCK_BYTES;
- size_t rest = M_len % BLOCK_BYTES;
-
- uint8_t tweak[TWEAK_BYTES];
- uint8_t checksum[BLOCK_BYTES];
-
- memset(tweak, 0, TWEAK_BYTES);
- memset(checksum, 0, BLOCK_BYTES);
-
- for (size_t j=0; j<l; j++)
- {
- _xor_into(checksum, &M[j*BLOCK_BYTES]);
- _fill_msg_tweak(0x0, N, j, tweak);
- _encrypt(key, tweak, &M[j*BLOCK_BYTES], &C[j*BLOCK_BYTES]);
- }
-
- if (rest == 0)
- {
- _fill_msg_tweak(0x1, N, l-1, tweak);
- _encrypt(key, tweak, checksum, Final);
- }
- else
- {
- uint8_t M_rest[BLOCK_BYTES];
- uint8_t Pad[BLOCK_BYTES];
-
- _pad10(rest, &M[l*BLOCK_BYTES], M_rest);
- _xor_into(checksum, M_rest);
-
- _fill_msg_tweak(0x4, N, l, tweak);
- _encrypt(key, tweak, _0n, Pad);
- _xor_arrays(rest, &C[l*BLOCK_BYTES], &M[l*BLOCK_BYTES], Pad);
-
- _fill_msg_tweak(0x5, N, l, tweak);
- _encrypt(key, tweak, checksum, Final);
- }
-}
-
-static void _decrypt_message(
- const uint8_t key[KEY_BYTES],
- size_t C_len,
- const uint8_t C[C_len],
- const uint8_t N[NONCE_BYTES],
- uint8_t M[C_len],
- uint8_t Final[BLOCK_BYTES]
-)
-{
- size_t l = C_len / BLOCK_BYTES;
- size_t rest = C_len % BLOCK_BYTES;
-
- uint8_t tweak[TWEAK_BYTES];
- uint8_t checksum[BLOCK_BYTES];
-
- memset(tweak, 0, TWEAK_BYTES);
- memset(checksum, 0, BLOCK_BYTES);
-
- for (size_t j=0; j<l; j++)
- {
- _fill_msg_tweak(0x0, N, j, tweak);
- _decrypt(key, tweak, &C[j*BLOCK_BYTES], &M[j*BLOCK_BYTES]);
- _xor_into(checksum, &M[j*BLOCK_BYTES]);
- }
-
- if (rest == 0)
- {
- _fill_msg_tweak(0x1, N, l-1, tweak);
- _encrypt(key, tweak, checksum, Final);
- }
- else
- {
- uint8_t M_rest[BLOCK_BYTES];
- uint8_t Pad[BLOCK_BYTES];
-
- _fill_msg_tweak(0x4, N, l, tweak);
- _encrypt(key, tweak, _0n, Pad);
- _xor_arrays(rest, &M[l*BLOCK_BYTES], &C[l*BLOCK_BYTES], Pad);
-
- _pad10(rest, &M[l*BLOCK_BYTES], M_rest);
- _xor_into(checksum, M_rest);
-
- _fill_msg_tweak(0x5, N, l, tweak);
- _encrypt(key, tweak, checksum, Final);
- }
-}
-
-static void _generate_tag(
- const uint8_t Final[BLOCK_BYTES],
- const uint8_t Auth[BLOCK_BYTES],
- uint8_t tag[TAG_BYTES]
-)
-{
- _xor_arrays(TAG_BYTES, tag, Final, Auth);
-}
-
-
-void lilliput_ae_encrypt(
- size_t message_len,
- const uint8_t message[message_len],
- size_t auth_data_len,
- const uint8_t auth_data[auth_data_len],
- const uint8_t key[KEY_BYTES],
- const uint8_t nonce[NONCE_BYTES],
- uint8_t ciphertext[message_len],
- uint8_t tag[TAG_BYTES]
-)
-{
- uint8_t auth[BLOCK_BYTES];
- _process_associated_data(key, auth_data_len, auth_data, auth);
-
- uint8_t final[BLOCK_BYTES];
- _encrypt_message(key, message_len, message, nonce, ciphertext, final);
-
- _generate_tag(final, auth, tag);
-}
-
-bool lilliput_ae_decrypt(
- size_t ciphertext_len,
- const uint8_t ciphertext[ciphertext_len],
- size_t auth_data_len,
- const uint8_t auth_data[auth_data_len],
- const uint8_t key[KEY_BYTES],
- const uint8_t nonce[NONCE_BYTES],
- const uint8_t tag[TAG_BYTES],
- uint8_t message[ciphertext_len]
-)
-{
- uint8_t auth[BLOCK_BYTES];
- _process_associated_data(key, auth_data_len, auth_data, auth);
-
- uint8_t final[BLOCK_BYTES];
- _decrypt_message(key, ciphertext_len, ciphertext, nonce, message, final);
-
- uint8_t effective_tag[TAG_BYTES];
- _generate_tag(final, auth, effective_tag);
-
- return memcmp(tag, effective_tag, TAG_BYTES) == 0;
-}
generated by cgit v1.2.3 (git 2.39.1) at 2025-12-06 19:10:21 +0000