1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "base/basictypes.h"
6#include "crypto/crypto_export.h"
7
8namespace crypto {
9
10// GaloisHash implements the polynomial authenticator part of GCM as specified
11// in http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf
12// Specifically it implements the GHASH function, defined in section 2.3 of
13// that document.
14//
15// In SP-800-38D, GHASH is defined differently and takes only a single data
16// argument. But it is always called with an argument of a certain form:
17//   GHASH_H (A || 0^v || C || 0^u || [len(A)]_64 || [len(C)]_64)
18// This mirrors how the gcm-revised-spec.pdf version of GHASH handles its two
19// data arguments. The two GHASH functions therefore differ only in whether the
20// data is formatted inside or outside of the function.
21//
22// WARNING: do not use this as a generic authenticator. Polynomial
23// authenticators must be used in the correct manner and any use outside of GCM
24// requires careful consideration.
25//
26// WARNING: this code is not constant time. However, in all likelihood, nor is
27// the implementation of AES that is used.
28class CRYPTO_EXPORT_PRIVATE GaloisHash {
29 public:
30  explicit GaloisHash(const uint8 key[16]);
31
32  // Reset prepares to digest a fresh message with the same key. This is more
33  // efficient than creating a fresh object.
34  void Reset();
35
36  // UpdateAdditional hashes in `additional' data. This is data that is not
37  // encrypted, but is covered by the authenticator. All additional data must
38  // be written before any ciphertext is written.
39  void UpdateAdditional(const uint8* data, size_t length);
40
41  // UpdateCiphertext hashes in ciphertext to be authenticated.
42  void UpdateCiphertext(const uint8* data, size_t length);
43
44  // Finish completes the hash computation and writes at most |len| bytes of
45  // the result to |output|.
46  void Finish(void* output, size_t len);
47
48 private:
49  enum State {
50    kHashingAdditionalData,
51    kHashingCiphertext,
52    kComplete,
53  };
54
55  struct FieldElement {
56    uint64 low, hi;
57  };
58
59  // Add returns |x|+|y|.
60  static FieldElement Add(const FieldElement& x, const FieldElement& y);
61  // Double returns 2*|x|.
62  static FieldElement Double(const FieldElement& x);
63  // MulAfterPrecomputation sets |x| = |x|*h where h is |table[1]| and
64  // table[i] = i*h for i=0..15.
65  static void MulAfterPrecomputation(const FieldElement* table,
66                                     FieldElement* x);
67  // Mul16 sets |x| = 16*|x|.
68  static void Mul16(FieldElement* x);
69
70  // UpdateBlocks processes |num_blocks| 16-bytes blocks from |bytes|.
71  void UpdateBlocks(const uint8* bytes, size_t num_blocks);
72  // Update processes |length| bytes from |bytes| and calls UpdateBlocks on as
73  // much data as possible. It uses |buf_| to buffer any remaining data and
74  // always consumes all of |bytes|.
75  void Update(const uint8* bytes, size_t length);
76
77  FieldElement y_;
78  State state_;
79  size_t additional_bytes_;
80  size_t ciphertext_bytes_;
81  uint8 buf_[16];
82  size_t buf_used_;
83  FieldElement product_table_[16];
84};
85
86}  // namespace crypto
87