xref: /openssl/crypto/modes/ctr128.c (revision 3c2bdd7d)
1 /*
2  * Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <string.h>
11 #include <openssl/crypto.h>
12 #include "internal/endian.h"
13 #include "crypto/modes.h"
14 
15 #if defined(__GNUC__) && !defined(STRICT_ALIGNMENT)
16 typedef size_t size_t_aX __attribute((__aligned__(1)));
17 #else
18 typedef size_t size_t_aX;
19 #endif
20 
21 /*
22  * NOTE: the IV/counter CTR mode is big-endian.  The code itself is
23  * endian-neutral.
24  */
25 
26 /* increment counter (128-bit int) by 1 */
ctr128_inc(unsigned char * counter)27 static void ctr128_inc(unsigned char *counter)
28 {
29     u32 n = 16, c = 1;
30 
31     do {
32         --n;
33         c += counter[n];
34         counter[n] = (u8)c;
35         c >>= 8;
36     } while (n);
37 }
38 
39 #if !defined(OPENSSL_SMALL_FOOTPRINT)
ctr128_inc_aligned(unsigned char * counter)40 static void ctr128_inc_aligned(unsigned char *counter)
41 {
42     size_t *data, c, d, n;
43     DECLARE_IS_ENDIAN;
44 
45     if (IS_LITTLE_ENDIAN || ((size_t)counter % sizeof(size_t)) != 0) {
46         ctr128_inc(counter);
47         return;
48     }
49 
50     data = (size_t *)counter;
51     c = 1;
52     n = 16 / sizeof(size_t);
53     do {
54         --n;
55         d = data[n] += c;
56         /* did addition carry? */
57         c = ((d - c) & ~d) >> (sizeof(size_t) * 8 - 1);
58     } while (n);
59 }
60 #endif
61 
62 /*
63  * The input encrypted as though 128bit counter mode is being used.  The
64  * extra state information to record how much of the 128bit block we have
65  * used is contained in *num, and the encrypted counter is kept in
66  * ecount_buf.  Both *num and ecount_buf must be initialised with zeros
67  * before the first call to CRYPTO_ctr128_encrypt(). This algorithm assumes
68  * that the counter is in the x lower bits of the IV (ivec), and that the
69  * application has full control over overflow and the rest of the IV.  This
70  * implementation takes NO responsibility for checking that the counter
71  * doesn't overflow into the rest of the IV when incremented.
72  */
CRYPTO_ctr128_encrypt(const unsigned char * in,unsigned char * out,size_t len,const void * key,unsigned char ivec[16],unsigned char ecount_buf[16],unsigned int * num,block128_f block)73 void CRYPTO_ctr128_encrypt(const unsigned char *in, unsigned char *out,
74                            size_t len, const void *key,
75                            unsigned char ivec[16],
76                            unsigned char ecount_buf[16], unsigned int *num,
77                            block128_f block)
78 {
79     unsigned int n;
80     size_t l = 0;
81 
82     n = *num;
83 
84 #if !defined(OPENSSL_SMALL_FOOTPRINT)
85     if (16 % sizeof(size_t) == 0) { /* always true actually */
86         do {
87             while (n && len) {
88                 *(out++) = *(in++) ^ ecount_buf[n];
89                 --len;
90                 n = (n + 1) % 16;
91             }
92 
93 # if defined(STRICT_ALIGNMENT)
94             if (((size_t)in | (size_t)out | (size_t)ecount_buf)
95                 % sizeof(size_t) != 0)
96                 break;
97 # endif
98             while (len >= 16) {
99                 (*block) (ivec, ecount_buf, key);
100                 ctr128_inc_aligned(ivec);
101                 for (n = 0; n < 16; n += sizeof(size_t))
102                     *(size_t_aX *)(out + n) =
103                         *(size_t_aX *)(in + n)
104                         ^ *(size_t_aX *)(ecount_buf + n);
105                 len -= 16;
106                 out += 16;
107                 in += 16;
108                 n = 0;
109             }
110             if (len) {
111                 (*block) (ivec, ecount_buf, key);
112                 ctr128_inc_aligned(ivec);
113                 while (len--) {
114                     out[n] = in[n] ^ ecount_buf[n];
115                     ++n;
116                 }
117             }
118             *num = n;
119             return;
120         } while (0);
121     }
122     /* the rest would be commonly eliminated by x86* compiler */
123 #endif
124     while (l < len) {
125         if (n == 0) {
126             (*block) (ivec, ecount_buf, key);
127             ctr128_inc(ivec);
128         }
129         out[l] = in[l] ^ ecount_buf[n];
130         ++l;
131         n = (n + 1) % 16;
132     }
133 
134     *num = n;
135 }
136 
137 /* increment upper 96 bits of 128-bit counter by 1 */
ctr96_inc(unsigned char * counter)138 static void ctr96_inc(unsigned char *counter)
139 {
140     u32 n = 12, c = 1;
141 
142     do {
143         --n;
144         c += counter[n];
145         counter[n] = (u8)c;
146         c >>= 8;
147     } while (n);
148 }
149 
CRYPTO_ctr128_encrypt_ctr32(const unsigned char * in,unsigned char * out,size_t len,const void * key,unsigned char ivec[16],unsigned char ecount_buf[16],unsigned int * num,ctr128_f func)150 void CRYPTO_ctr128_encrypt_ctr32(const unsigned char *in, unsigned char *out,
151                                  size_t len, const void *key,
152                                  unsigned char ivec[16],
153                                  unsigned char ecount_buf[16],
154                                  unsigned int *num, ctr128_f func)
155 {
156     unsigned int n, ctr32;
157 
158    n = *num;
159 
160     while (n && len) {
161         *(out++) = *(in++) ^ ecount_buf[n];
162         --len;
163         n = (n + 1) % 16;
164     }
165 
166     ctr32 = GETU32(ivec + 12);
167     while (len >= 16) {
168         size_t blocks = len / 16;
169         /*
170          * 1<<28 is just a not-so-small yet not-so-large number...
171          * Below condition is practically never met, but it has to
172          * be checked for code correctness.
173          */
174         if (sizeof(size_t) > sizeof(unsigned int) && blocks > (1U << 28))
175             blocks = (1U << 28);
176         /*
177          * As (*func) operates on 32-bit counter, caller
178          * has to handle overflow. 'if' below detects the
179          * overflow, which is then handled by limiting the
180          * amount of blocks to the exact overflow point...
181          */
182         ctr32 += (u32)blocks;
183         if (ctr32 < blocks) {
184             blocks -= ctr32;
185             ctr32 = 0;
186         }
187         (*func) (in, out, blocks, key, ivec);
188         /* (*ctr) does not update ivec, caller does: */
189         PUTU32(ivec + 12, ctr32);
190         /* ... overflow was detected, propagate carry. */
191         if (ctr32 == 0)
192             ctr96_inc(ivec);
193         blocks *= 16;
194         len -= blocks;
195         out += blocks;
196         in += blocks;
197     }
198     if (len) {
199         memset(ecount_buf, 0, 16);
200         (*func) (ecount_buf, ecount_buf, 1, key, ivec);
201         ++ctr32;
202         PUTU32(ivec + 12, ctr32);
203         if (ctr32 == 0)
204             ctr96_inc(ivec);
205         while (len--) {
206             out[n] = in[n] ^ ecount_buf[n];
207             ++n;
208         }
209     }
210 
211     *num = n;
212 }
213