+ NID_grasshopper_ctr,
+ gost_grasshopper_cipher_init_ctr,
+ gost_grasshopper_cipher_do_ctr,
+ gost_grasshopper_cipher_destroy_ctr,
+ 1,
+ sizeof(gost_grasshopper_cipher_ctx_ctr),
+ /* IV size is set to match full block, to make it responsibility of
+ * user to assign correct values (IV || 0), and to make naive context
+ * copy possible (for software such as openssh) */
+ 16,
+ false}
+ ,
+ [GRASSHOPPER_CIPHER_CTRACPKM] = {
+ NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm,
+ gost_grasshopper_cipher_init_ctracpkm,
+ gost_grasshopper_cipher_do_ctracpkm,
+ gost_grasshopper_cipher_destroy_ctr,
+ 1,
+ sizeof
+ (gost_grasshopper_cipher_ctx_ctr),
+ 16,
+ false}
+ ,
+ };
+
+/* first 256 bit of D from draft-irtf-cfrg-re-keying-12 */
+ static const unsigned char ACPKM_D_2018[] = {
+ 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 64 bit */
+ 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 128 bit */
+ 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+ 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 256 bit */
+ };
+
+ static void acpkm_next(gost_grasshopper_cipher_ctx * c) {
+ unsigned char newkey[GRASSHOPPER_KEY_SIZE];
+ const int J = GRASSHOPPER_KEY_SIZE / GRASSHOPPER_BLOCK_SIZE;
+ int n;
+
+ for (n = 0; n < J; n++) {
+ const unsigned char *D_n =
+ &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE];
+
+ grasshopper_encrypt_block(&c->encrypt_round_keys,
+ (grasshopper_w128_t *) D_n,
+ (grasshopper_w128_t *) & newkey[n *
+ GRASSHOPPER_BLOCK_SIZE],
+ &c->buffer);
+ }
+ gost_grasshopper_cipher_key(c, newkey);
+ }