X-Git-Url: http://wagner.pp.ru/gitweb/?a=blobdiff_plain;f=gost_grasshopper_cipher.c;h=da67eb4c88eaeaa9d7af47780820fdb690e8b73d;hb=41bff5cad003c9239623e556e69a281b2a8e80b1;hp=d641bcb114ee2a60ac44bc3a1eb0ea39f7f291aa;hpb=b0129fa19b2d53c99f9c958ea7fdd2c77e14c1a4;p=openssl-gost%2Fengine.git diff --git a/gost_grasshopper_cipher.c b/gost_grasshopper_cipher.c index d641bcb..da67eb4 100644 --- a/gost_grasshopper_cipher.c +++ b/gost_grasshopper_cipher.c @@ -3,10 +3,6 @@ * This file is distributed under the same license as OpenSSL */ -#if defined(__cplusplus) -extern "C" { -#endif - #include "gost_grasshopper_cipher.h" #include "gost_grasshopper_defines.h" #include "gost_grasshopper_math.h" @@ -15,855 +11,1355 @@ extern "C" { #include #include #include + #include +#include #include "gost_lcl.h" #include "e_gost_err.h" - enum GRASSHOPPER_CIPHER_TYPE { - GRASSHOPPER_CIPHER_ECB = 0, - GRASSHOPPER_CIPHER_CBC, - GRASSHOPPER_CIPHER_OFB, - GRASSHOPPER_CIPHER_CFB, - GRASSHOPPER_CIPHER_CTR, - GRASSHOPPER_CIPHER_CTRACPKM, - }; - - static EVP_CIPHER *gost_grasshopper_ciphers[6] = { - [GRASSHOPPER_CIPHER_ECB] = NULL, - [GRASSHOPPER_CIPHER_CBC] = NULL, - [GRASSHOPPER_CIPHER_OFB] = NULL, - [GRASSHOPPER_CIPHER_CFB] = NULL, - [GRASSHOPPER_CIPHER_CTR] = NULL, - [GRASSHOPPER_CIPHER_CTRACPKM] = NULL, - }; - - static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c); - static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c); - - struct GRASSHOPPER_CIPHER_PARAMS { - int nid; - grasshopper_init_cipher_func init_cipher; - grasshopper_do_cipher_func do_cipher; - grasshopper_destroy_cipher_func destroy_cipher; - int block_size; - int ctx_size; - int iv_size; - bool padding; - }; - - static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[6] = { - [GRASSHOPPER_CIPHER_ECB] = { - NID_grasshopper_ecb, - gost_grasshopper_cipher_init_ecb, - gost_grasshopper_cipher_do_ecb, - NULL, - 16, - sizeof(gost_grasshopper_cipher_ctx), - 0, - true} - , - [GRASSHOPPER_CIPHER_CBC] = { - NID_grasshopper_cbc, - gost_grasshopper_cipher_init_cbc, - gost_grasshopper_cipher_do_cbc, - NULL, - 16, - sizeof(gost_grasshopper_cipher_ctx), - 16, - true} - , - [GRASSHOPPER_CIPHER_OFB] = { - NID_grasshopper_ofb, - gost_grasshopper_cipher_init_ofb, - gost_grasshopper_cipher_do_ofb, - gost_grasshopper_cipher_destroy_ofb, - 1, - sizeof(gost_grasshopper_cipher_ctx_ofb), - 16, - false} - , - [GRASSHOPPER_CIPHER_CFB] = { - NID_grasshopper_cfb, - gost_grasshopper_cipher_init_cfb, - gost_grasshopper_cipher_do_cfb, - NULL, - 1, - sizeof(gost_grasshopper_cipher_ctx), - 16, - false} - , - [GRASSHOPPER_CIPHER_CTR] = { - NID_grasshopper_ctr, - gost_grasshopper_cipher_init_ctr, - gost_grasshopper_cipher_do_ctr, - gost_grasshopper_cipher_destroy_ctr, - 1, - sizeof(gost_grasshopper_cipher_ctx_ctr), - /* IV size is set to match full block, to make it responsibility of - * user to assign correct values (IV || 0), and to make naive context - * copy possible (for software such as openssh) */ - 16, - false} - , - [GRASSHOPPER_CIPHER_CTRACPKM] = { - NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm, - gost_grasshopper_cipher_init_ctracpkm, - gost_grasshopper_cipher_do_ctracpkm, - gost_grasshopper_cipher_destroy_ctr, - 1, - sizeof - (gost_grasshopper_cipher_ctx_ctr), - 16, - false} - , - }; +enum GRASSHOPPER_CIPHER_TYPE { + GRASSHOPPER_CIPHER_ECB = 0, + GRASSHOPPER_CIPHER_CBC, + GRASSHOPPER_CIPHER_OFB, + GRASSHOPPER_CIPHER_CFB, + GRASSHOPPER_CIPHER_CTR, + GRASSHOPPER_CIPHER_CTRACPKM, + GRASSHOPPER_CIPHER_MGM, +}; + +static EVP_CIPHER *gost_grasshopper_ciphers[7] = { + [GRASSHOPPER_CIPHER_ECB] = NULL, + [GRASSHOPPER_CIPHER_CBC] = NULL, + [GRASSHOPPER_CIPHER_OFB] = NULL, + [GRASSHOPPER_CIPHER_CFB] = NULL, + [GRASSHOPPER_CIPHER_CTR] = NULL, + [GRASSHOPPER_CIPHER_CTRACPKM] = NULL, + [GRASSHOPPER_CIPHER_MGM] = NULL, +}; + +static GRASSHOPPER_INLINE void +gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c); +static GRASSHOPPER_INLINE void +gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c); +static GRASSHOPPER_INLINE void +gost_grasshopper_cipher_destroy_mgm(gost_grasshopper_cipher_ctx * c); + +struct GRASSHOPPER_CIPHER_PARAMS { + int nid; + grasshopper_init_cipher_func init_cipher; + grasshopper_do_cipher_func do_cipher; + grasshopper_destroy_cipher_func destroy_cipher; + int block_size; + int ctx_size; + int iv_size; + bool padding; +}; + +static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[7] = { + [GRASSHOPPER_CIPHER_ECB] = { + NID_grasshopper_ecb, + gost_grasshopper_cipher_init_ecb, + gost_grasshopper_cipher_do_ecb, + NULL, + 16, + sizeof(gost_grasshopper_cipher_ctx), + 0, + true} + , + [GRASSHOPPER_CIPHER_CBC] = { + NID_grasshopper_cbc, + gost_grasshopper_cipher_init_cbc, + gost_grasshopper_cipher_do_cbc, + NULL, + 16, + sizeof(gost_grasshopper_cipher_ctx), + 16, + true} + , + [GRASSHOPPER_CIPHER_OFB] = { + NID_grasshopper_ofb, + gost_grasshopper_cipher_init_ofb, + gost_grasshopper_cipher_do_ofb, + gost_grasshopper_cipher_destroy_ofb, + 1, + sizeof(gost_grasshopper_cipher_ctx_ofb), + 16, + false} + , + [GRASSHOPPER_CIPHER_CFB] = { + NID_grasshopper_cfb, + gost_grasshopper_cipher_init_cfb, + gost_grasshopper_cipher_do_cfb, + NULL, + 1, + sizeof(gost_grasshopper_cipher_ctx), + 16, + false} + , + [GRASSHOPPER_CIPHER_CTR] = { + NID_grasshopper_ctr, + gost_grasshopper_cipher_init_ctr, + gost_grasshopper_cipher_do_ctr, + gost_grasshopper_cipher_destroy_ctr, + 1, + sizeof(gost_grasshopper_cipher_ctx_ctr), + /* IV size is set to match full block, to make it responsibility of + * user to assign correct values (IV || 0), and to make naive context + * copy possible (for software such as openssh) */ + 16, + false} + , + [GRASSHOPPER_CIPHER_CTRACPKM] = { + NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm, + gost_grasshopper_cipher_init_ctracpkm, + gost_grasshopper_cipher_do_ctracpkm, + gost_grasshopper_cipher_destroy_ctr, + 1, + sizeof(gost_grasshopper_cipher_ctx_ctr), + 16, + false} + , +#ifdef NID_kuznyechik_mgm + [GRASSHOPPER_CIPHER_MGM] = { + NID_kuznyechik_mgm, + gost_grasshopper_cipher_init_mgm, + gost_grasshopper_cipher_do_mgm, + gost_grasshopper_cipher_destroy_mgm, + 1, + sizeof(gost_grasshopper_cipher_ctx_mgm), + 16, + false} + , +#else + [GRASSHOPPER_CIPHER_MGM] = { + NID_undef, + NULL, + NULL, + NULL, + 0, + 0, + 0, + false} + , +#endif +}; /* first 256 bit of D from draft-irtf-cfrg-re-keying-12 */ - static const unsigned char ACPKM_D_2018[] = { - 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 64 bit */ - 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 128 bit */ - 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, - 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 256 bit */ - }; - - static void acpkm_next(gost_grasshopper_cipher_ctx * c) { - unsigned char newkey[GRASSHOPPER_KEY_SIZE]; - const int J = GRASSHOPPER_KEY_SIZE / GRASSHOPPER_BLOCK_SIZE; - int n; - - for (n = 0; n < J; n++) { - const unsigned char *D_n = - &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE]; - - grasshopper_encrypt_block(&c->encrypt_round_keys, - (grasshopper_w128_t *) D_n, - (grasshopper_w128_t *) & newkey[n * - GRASSHOPPER_BLOCK_SIZE], - &c->buffer); - } - gost_grasshopper_cipher_key(c, newkey); +static const unsigned char ACPKM_D_2018[] = { + 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 64 bit */ + 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 128 bit */ + 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, + 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 256 bit */ +}; + +static void acpkm_next(gost_grasshopper_cipher_ctx * c) +{ + unsigned char newkey[GRASSHOPPER_KEY_SIZE]; + const int J = GRASSHOPPER_KEY_SIZE / GRASSHOPPER_BLOCK_SIZE; + int n; + + for (n = 0; n < J; n++) { + const unsigned char *D_n = &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE]; + + grasshopper_encrypt_block(&c->encrypt_round_keys, + (grasshopper_w128_t *) D_n, + (grasshopper_w128_t *) & newkey[n * + GRASSHOPPER_BLOCK_SIZE], + &c->buffer); } + gost_grasshopper_cipher_key(c, newkey); +} /* Set 256 bit key into context */ - GRASSHOPPER_INLINE void - gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, - const uint8_t *k) { - int i; - for (i = 0; i < 2; i++) { - grasshopper_copy128(&c->key.k.k[i], - (const grasshopper_w128_t *)(k + i * 16)); - } - grasshopper_set_encrypt_key(&c->encrypt_round_keys, &c->key); - grasshopper_set_decrypt_key(&c->decrypt_round_keys, &c->key); +GRASSHOPPER_INLINE void +gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) +{ + int i; + for (i = 0; i < 2; i++) { + grasshopper_copy128(&c->key.k.k[i], + (const grasshopper_w128_t *)(k + i * 16)); } + grasshopper_set_encrypt_key(&c->encrypt_round_keys, &c->key); + grasshopper_set_decrypt_key(&c->decrypt_round_keys, &c->key); +} + +/* Set master 256-bit key to be used in TLSTREE calculation into context */ +GRASSHOPPER_INLINE void +gost_grasshopper_master_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) +{ + int i; + for (i = 0; i < 2; i++) { + grasshopper_copy128(&c->master_key.k.k[i], + (const grasshopper_w128_t *)(k + i * 16)); + } +} + /* Cleans up key from context */ - GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) { - int i; - for (i = 0; i < 2; i++) { - grasshopper_zero128(&c->key.k.k[i]); - } - for (i = 0; i < GRASSHOPPER_ROUND_KEYS_COUNT; i++) { - grasshopper_zero128(&c->encrypt_round_keys.k[i]); - } - for (i = 0; i < GRASSHOPPER_ROUND_KEYS_COUNT; i++) { - grasshopper_zero128(&c->decrypt_round_keys.k[i]); - } - grasshopper_zero128(&c->buffer); +GRASSHOPPER_INLINE void +gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) +{ + int i; + for (i = 0; i < 2; i++) { + grasshopper_zero128(&c->key.k.k[i]); + grasshopper_zero128(&c->master_key.k.k[i]); + } + for (i = 0; i < GRASSHOPPER_ROUND_KEYS_COUNT; i++) { + grasshopper_zero128(&c->encrypt_round_keys.k[i]); } + for (i = 0; i < GRASSHOPPER_ROUND_KEYS_COUNT; i++) { + grasshopper_zero128(&c->decrypt_round_keys.k[i]); + } + grasshopper_zero128(&c->buffer); +} + +static GRASSHOPPER_INLINE void +gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c) +{ + gost_grasshopper_cipher_ctx_ofb *ctx = + (gost_grasshopper_cipher_ctx_ofb *) c; + + grasshopper_zero128(&ctx->buffer1); +} + +static GRASSHOPPER_INLINE void +gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c) +{ + gost_grasshopper_cipher_ctx_ctr *ctx = + (gost_grasshopper_cipher_ctx_ctr *) c; + + grasshopper_zero128(&ctx->partial_buffer); +} + +static GRASSHOPPER_INLINE void +gost_grasshopper_cipher_destroy_mgm(gost_grasshopper_cipher_ctx * c) +{ + gost_grasshopper_cipher_ctx_mgm *ctx = + (gost_grasshopper_cipher_ctx_mgm *) c; + + grasshopper_zero128(&ctx->partial_buffer); +} - static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c) { - gost_grasshopper_cipher_ctx_ofb *ctx = - (gost_grasshopper_cipher_ctx_ofb *) c; +int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, + const unsigned char *key, + const unsigned char *iv, int enc) +{ + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - grasshopper_zero128(&ctx->buffer1); + if (EVP_CIPHER_CTX_get_app_data(ctx) == NULL) { + EVP_CIPHER_CTX_set_app_data(ctx, EVP_CIPHER_CTX_get_cipher_data(ctx)); } - static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c) { - gost_grasshopper_cipher_ctx_ctr *ctx = - (gost_grasshopper_cipher_ctx_ctr *) c; + if (key != NULL) { + gost_grasshopper_cipher_key(c, key); + gost_grasshopper_master_key(c, key); + } - grasshopper_zero128(&ctx->partial_buffer); + if (iv != NULL) { + if (c->type == GRASSHOPPER_CIPHER_MGM) { + gost_grasshopper_cipher_ctx_mgm *m = (gost_grasshopper_cipher_ctx_mgm *)c; + + /* 1st bit should be 0*/ + if (iv[0] > 127) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_INIT, GOST_R_INVALID_IV_LENGTH); + return 0; + } + memcpy(m->mgm_iv, iv, 16); + *(unsigned char *)(m->mgm_iv) += 128; + } + memcpy((unsigned char *)EVP_CIPHER_CTX_original_iv(ctx), iv, + EVP_CIPHER_CTX_iv_length(ctx)); } - int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, - const unsigned char *key, - const unsigned char *iv, int enc) { - gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), + EVP_CIPHER_CTX_original_iv(ctx), EVP_CIPHER_CTX_iv_length(ctx)); - if (EVP_CIPHER_CTX_get_app_data(ctx) == NULL) { - EVP_CIPHER_CTX_set_app_data(ctx, - EVP_CIPHER_CTX_get_cipher_data(ctx)); - } + grasshopper_zero128(&c->buffer); - if (key != NULL) { - gost_grasshopper_cipher_key(c, key); - } + return 1; +} - if (iv != NULL) { - memcpy((unsigned char *)EVP_CIPHER_CTX_original_iv(ctx), iv, - EVP_CIPHER_CTX_iv_length(ctx)); - } +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + c->type = GRASSHOPPER_CIPHER_ECB; + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} - memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), - EVP_CIPHER_CTX_original_iv(ctx), EVP_CIPHER_CTX_iv_length(ctx)); +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + c->type = GRASSHOPPER_CIPHER_CBC; + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} - grasshopper_zero128(&c->buffer); +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ofb *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - return 1; - } + c->c.type = GRASSHOPPER_CIPHER_OFB; - GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - c->type = GRASSHOPPER_CIPHER_ECB; - return gost_grasshopper_cipher_init(ctx, key, iv, enc); - } - - GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - c->type = GRASSHOPPER_CIPHER_CBC; - return gost_grasshopper_cipher_init(ctx, key, iv, enc); - } - - GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx_ofb *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); + grasshopper_zero128(&c->buffer1); - c->c.type = GRASSHOPPER_CIPHER_OFB; + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} - grasshopper_zero128(&c->buffer1); +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + c->type = GRASSHOPPER_CIPHER_CFB; + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} - return gost_grasshopper_cipher_init(ctx, key, iv, enc); - } +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - c->type = GRASSHOPPER_CIPHER_CFB; - return gost_grasshopper_cipher_init(ctx, key, iv, enc); - } + c->c.type = GRASSHOPPER_CIPHER_CTR; + EVP_CIPHER_CTX_set_num(ctx, 0); - GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); + grasshopper_zero128(&c->partial_buffer); - c->c.type = GRASSHOPPER_CIPHER_CTR; - EVP_CIPHER_CTX_set_num(ctx, 0); + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} - grasshopper_zero128(&c->partial_buffer); +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX + *ctx, const unsigned + char *key, const unsigned + char *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - return gost_grasshopper_cipher_init(ctx, key, iv, enc); - } + /* NB: setting type makes EVP do_cipher callback useless */ + c->c.type = GRASSHOPPER_CIPHER_CTRACPKM; + EVP_CIPHER_CTX_set_num(ctx, 0); + c->section_size = 4096; - GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX - *ctx, - const unsigned - char *key, - const unsigned - char *iv, - int enc) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} - /* NB: setting type makes EVP do_cipher callback useless */ - c->c.type = GRASSHOPPER_CIPHER_CTRACPKM; - EVP_CIPHER_CTX_set_num(ctx, 0); - c->section_size = 4096; +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_mgm(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx_mgm *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - return gost_grasshopper_cipher_init(ctx, key, iv, enc); - } + c->c.type = GRASSHOPPER_CIPHER_MGM; + c->taglen = 16; + EVP_CIPHER_CTX_set_num(ctx, 0); - GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, - size_t inl) { - gost_grasshopper_cipher_ctx *c = - (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; + grasshopper_zero128(&c->partial_buffer); - return params->do_cipher(ctx, out, in, inl); - } + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} - int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx *c = - (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); - const unsigned char *current_in = in; - unsigned char *current_out = out; - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; - size_t i; +GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX *ctx, + unsigned char *out, + const unsigned char *in, + size_t inl) +{ + gost_grasshopper_cipher_ctx *c = + (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); + struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; - for (i = 0; i < blocks; - i++, current_in += GRASSHOPPER_BLOCK_SIZE, current_out += - GRASSHOPPER_BLOCK_SIZE) { - if (encrypting) { - grasshopper_encrypt_block(&c->encrypt_round_keys, - (grasshopper_w128_t *) current_in, - (grasshopper_w128_t *) current_out, - &c->buffer); - } else { - grasshopper_decrypt_block(&c->decrypt_round_keys, - (grasshopper_w128_t *) current_in, - (grasshopper_w128_t *) current_out, - &c->buffer); - } - } + return params->do_cipher(ctx, out, in, inl); +} - return 1; +int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx *c = + (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); + bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); + const unsigned char *current_in = in; + unsigned char *current_out = out; + size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; + size_t i; + + for (i = 0; i < blocks; + i++, current_in += GRASSHOPPER_BLOCK_SIZE, current_out += + GRASSHOPPER_BLOCK_SIZE) { + if (encrypting) { + grasshopper_encrypt_block(&c->encrypt_round_keys, + (grasshopper_w128_t *) current_in, + (grasshopper_w128_t *) current_out, + &c->buffer); + } else { + grasshopper_decrypt_block(&c->decrypt_round_keys, + (grasshopper_w128_t *) current_in, + (grasshopper_w128_t *) current_out, + &c->buffer); + } } - int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx *c = - (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); - bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); - const unsigned char *current_in = in; - unsigned char *current_out = out; - grasshopper_w128_t *currentInputBlock; - grasshopper_w128_t *currentOutputBlock; - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; - size_t i; - grasshopper_w128_t *currentBlock; - - currentBlock = (grasshopper_w128_t *) iv; - - for (i = 0; i < blocks; - i++, current_in += GRASSHOPPER_BLOCK_SIZE, current_out += - GRASSHOPPER_BLOCK_SIZE) { - currentInputBlock = (grasshopper_w128_t *) current_in; - currentOutputBlock = (grasshopper_w128_t *) current_out; - if (encrypting) { - grasshopper_append128(currentBlock, currentInputBlock); - grasshopper_encrypt_block(&c->encrypt_round_keys, currentBlock, - currentOutputBlock, &c->buffer); - grasshopper_copy128(currentBlock, currentOutputBlock); - } else { - grasshopper_decrypt_block(&c->decrypt_round_keys, - currentInputBlock, currentOutputBlock, - &c->buffer); - grasshopper_append128(currentOutputBlock, currentBlock); - grasshopper_copy128(currentBlock, currentInputBlock); - } - } + return 1; +} - return 1; +int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx *c = + (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); + unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); + bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); + const unsigned char *current_in = in; + unsigned char *current_out = out; + grasshopper_w128_t *currentInputBlock; + grasshopper_w128_t *currentOutputBlock; + size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; + size_t i; + grasshopper_w128_t *currentBlock; + + currentBlock = (grasshopper_w128_t *) iv; + + for (i = 0; i < blocks; + i++, current_in += GRASSHOPPER_BLOCK_SIZE, current_out += + GRASSHOPPER_BLOCK_SIZE) { + currentInputBlock = (grasshopper_w128_t *) current_in; + currentOutputBlock = (grasshopper_w128_t *) current_out; + if (encrypting) { + grasshopper_append128(currentBlock, currentInputBlock); + grasshopper_encrypt_block(&c->encrypt_round_keys, currentBlock, + currentOutputBlock, &c->buffer); + grasshopper_copy128(currentBlock, currentOutputBlock); + } else { + grasshopper_w128_t tmp; + + grasshopper_copy128(&tmp, currentInputBlock); + grasshopper_decrypt_block(&c->decrypt_round_keys, + currentInputBlock, currentOutputBlock, + &c->buffer); + grasshopper_append128(currentOutputBlock, currentBlock); + grasshopper_copy128(currentBlock, &tmp); + } } - void inc_counter(unsigned char *counter, size_t counter_bytes) { - unsigned char c; - unsigned int n = counter_bytes; + return 1; +} - do { - --n; - c = counter[n]; - ++c; - counter[n] = c; - if (c) - return; - } while (n); - } +void inc_counter(unsigned char *counter, size_t counter_bytes) +{ + unsigned char c; + unsigned int n = counter_bytes; + + do { + --n; + c = counter[n]; + ++c; + counter[n] = c; + if (c) + return; + } while (n); +} /* increment counter (128-bit int) by 1 */ - static void ctr128_inc(unsigned char *counter) { - inc_counter(counter, 16); - } +static void ctr128_inc(unsigned char *counter) +{ + inc_counter(counter, 16); +} - int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx_ctr *c = - (gost_grasshopper_cipher_ctx_ctr *) - EVP_CIPHER_CTX_get_cipher_data(ctx); - unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); - const unsigned char *current_in = in; - unsigned char *current_out = out; - grasshopper_w128_t *currentInputBlock; - grasshopper_w128_t *currentOutputBlock; - unsigned int n = EVP_CIPHER_CTX_num(ctx); - size_t lasted; - size_t i; - - while (n && inl) { - *(current_out++) = *(current_in++) ^ c->partial_buffer.b[n]; - --inl; - n = (n + 1) % GRASSHOPPER_BLOCK_SIZE; - } - EVP_CIPHER_CTX_set_num(ctx, n); - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; - - grasshopper_w128_t *iv_buffer = (grasshopper_w128_t *) iv; - - // full parts - for (i = 0; i < blocks; i++) { - currentInputBlock = (grasshopper_w128_t *) current_in; - currentOutputBlock = (grasshopper_w128_t *) current_out; - grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, - currentOutputBlock, &c->c.buffer); - grasshopper_append128(currentOutputBlock, currentInputBlock); - ctr128_inc(iv_buffer->b); - current_in += GRASSHOPPER_BLOCK_SIZE; - current_out += GRASSHOPPER_BLOCK_SIZE; - } +int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ctr *c = (gost_grasshopper_cipher_ctx_ctr *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); + const unsigned char *current_in = in; + unsigned char *current_out = out; + grasshopper_w128_t *currentInputBlock; + grasshopper_w128_t *currentOutputBlock; + unsigned int n = EVP_CIPHER_CTX_num(ctx); + size_t lasted; + size_t i; + + while (n && inl) { + *(current_out++) = *(current_in++) ^ c->partial_buffer.b[n]; + --inl; + n = (n + 1) % GRASSHOPPER_BLOCK_SIZE; + } + EVP_CIPHER_CTX_set_num(ctx, n); + size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; + + grasshopper_w128_t *iv_buffer = (grasshopper_w128_t *) iv; + grasshopper_w128_t tmp; + + // full parts + for (i = 0; i < blocks; i++) { + currentInputBlock = (grasshopper_w128_t *) current_in; + currentOutputBlock = (grasshopper_w128_t *) current_out; + grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, + &c->partial_buffer, &c->c.buffer); + grasshopper_plus128(&tmp, &c->partial_buffer, currentInputBlock); + grasshopper_copy128(currentOutputBlock, &tmp); + ctr128_inc(iv_buffer->b); + current_in += GRASSHOPPER_BLOCK_SIZE; + current_out += GRASSHOPPER_BLOCK_SIZE; + } - // last part - lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; - if (lasted > 0) { - currentInputBlock = (grasshopper_w128_t *) current_in; - currentOutputBlock = (grasshopper_w128_t *) current_out; - grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, - &c->partial_buffer, &c->c.buffer); - for (i = 0; i < lasted; i++) { - currentOutputBlock->b[i] = - c->partial_buffer.b[i] ^ currentInputBlock->b[i]; - } - EVP_CIPHER_CTX_set_num(ctx, i); - ctr128_inc(iv_buffer->b); + // last part + lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; + if (lasted > 0) { + currentInputBlock = (grasshopper_w128_t *) current_in; + currentOutputBlock = (grasshopper_w128_t *) current_out; + grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, + &c->partial_buffer, &c->c.buffer); + for (i = 0; i < lasted; i++) { + currentOutputBlock->b[i] = + c->partial_buffer.b[i] ^ currentInputBlock->b[i]; } - - return 1; + EVP_CIPHER_CTX_set_num(ctx, i); + ctr128_inc(iv_buffer->b); } + return 1; +} + #define GRASSHOPPER_BLOCK_MASK (GRASSHOPPER_BLOCK_SIZE - 1) - static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr * - ctx, unsigned int *num) { - if (!ctx->section_size || (*num < ctx->section_size)) - return; - acpkm_next(&ctx->c); - *num &= GRASSHOPPER_BLOCK_MASK; - } +static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr * + ctx, unsigned int *num) +{ + if (!ctx->section_size || (*num < ctx->section_size)) + return; + acpkm_next(&ctx->c); + *num &= GRASSHOPPER_BLOCK_MASK; +} /* If meshing is not configured via ctrl (setting section_size) * this function works exactly like plain ctr */ - int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, - size_t inl) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); - unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); - unsigned int num = EVP_CIPHER_CTX_num(ctx); +int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, + unsigned char *out, + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); + unsigned int num = EVP_CIPHER_CTX_num(ctx); + + while ((num & GRASSHOPPER_BLOCK_MASK) && inl) { + *out++ = *in++ ^ c->partial_buffer.b[num & GRASSHOPPER_BLOCK_MASK]; + --inl; + num++; + } + size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; + size_t i; + grasshopper_w128_t tmp; + + // full parts + for (i = 0; i < blocks; i++) { + apply_acpkm_grasshopper(c, &num); + grasshopper_encrypt_block(&c->c.encrypt_round_keys, + (grasshopper_w128_t *) iv, + (grasshopper_w128_t *) & c->partial_buffer, + &c->c.buffer); + grasshopper_plus128(&tmp, &c->partial_buffer, + (grasshopper_w128_t *) in); + grasshopper_copy128((grasshopper_w128_t *) out, &tmp); + ctr128_inc(iv); + in += GRASSHOPPER_BLOCK_SIZE; + out += GRASSHOPPER_BLOCK_SIZE; + num += GRASSHOPPER_BLOCK_SIZE; + } - while ((num & GRASSHOPPER_BLOCK_MASK) && inl) { - *out++ = *in++ ^ c->partial_buffer.b[num & GRASSHOPPER_BLOCK_MASK]; - --inl; - num++; - } - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; - size_t i; - - // full parts - for (i = 0; i < blocks; i++) { - apply_acpkm_grasshopper(c, &num); - grasshopper_encrypt_block(&c->c.encrypt_round_keys, - (grasshopper_w128_t *) iv, - (grasshopper_w128_t *) out, &c->c.buffer); - grasshopper_append128((grasshopper_w128_t *) out, - (grasshopper_w128_t *) in); - ctr128_inc(iv); - in += GRASSHOPPER_BLOCK_SIZE; - out += GRASSHOPPER_BLOCK_SIZE; - num += GRASSHOPPER_BLOCK_SIZE; - } + // last part + size_t lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; + if (lasted > 0) { + apply_acpkm_grasshopper(c, &num); + grasshopper_encrypt_block(&c->c.encrypt_round_keys, + (grasshopper_w128_t *) iv, + &c->partial_buffer, &c->c.buffer); + for (i = 0; i < lasted; i++) + out[i] = c->partial_buffer.b[i] ^ in[i]; + ctr128_inc(iv); + num += lasted; + } + EVP_CIPHER_CTX_set_num(ctx, num); - // last part - size_t lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; - if (lasted > 0) { - apply_acpkm_grasshopper(c, &num); - grasshopper_encrypt_block(&c->c.encrypt_round_keys, - (grasshopper_w128_t *) iv, - &c->partial_buffer, &c->c.buffer); - for (i = 0; i < lasted; i++) - out[i] = c->partial_buffer.b[i] ^ in[i]; - ctr128_inc(iv); - num += lasted; - } - EVP_CIPHER_CTX_set_num(ctx, num); + return 1; +} - return 1; +/* ----------------------------------------------------------------------------------------------- */ +/*! Функция реализует операцию умножения двух элементов конечного поля \f$ \mathbb F_{2^{128}}\f$, + порожденного неприводимым многочленом + \f$ f(x) = x^{128} + x^7 + x^2 + x + 1 \in \mathbb F_2[x]\f$. Для умножения используется + простейшая реализация, основанная на приведении по модулю после каждого шага алгоритма. */ +/* ----------------------------------------------------------------------------------------------- */ +static void gf128_mul_uint64(uint64_t *z, uint64_t *x, uint64_t *y) +{ + int i = 0, n = 0; + uint64_t t, s0, s1; + + BUF_reverse((unsigned char *)x, NULL, 16); + BUF_reverse((unsigned char *)y, NULL, 16); + +#ifdef L_ENDIAN + s0 = x[0]; + s1 = x[1]; +#else + s0 = bswap_64(x[0]); + s1 = bswap_64(x[1]); +#endif + + memset(z, 0, sizeof(uint64_t)*2); + + /* lower half */ +#ifdef L_ENDIAN + t = y[0]; +#else + t = bswap_64(y[0]); +#endif + + for( i = 0; i < 64; i++ ) { + if( t&0x1 ) { z[0] ^= s0; z[1] ^= s1; } + t >>= 1; + n = s1 >> 63; + s1 <<= 1; s1 ^= ( s0 >> 63 ); s0 <<= 1; + if(n) s0 ^= 0x87; + } + + /* upper half */ +#ifdef L_ENDIAN + t = y[1]; +#else + t = bswap_64(y[1]); +#endif + + for( i = 0; i < 63; i++ ) { + if( t&0x1 ) { z[0] ^= s0; z[1] ^= s1; } + t >>= 1; + n = s1 >> 63; + s1 <<= 1; s1 ^= ( s0 >> 63 ); s0 <<= 1; + if( n ) s0 ^= 0x87; + } + + if( t&0x1 ) { + z[0] ^= s0; + z[1] ^= s1; + } +#ifndef L_ENDIAN + z[0] = bswap_64(z[0]); + z[1] = bswap_64(z[1]); +#endif + BUF_reverse((unsigned char *)z, NULL, 16); +} + +static void hexdump(FILE *f, const char *title, const unsigned char *s, int l) +{ + int n = 0; + + fprintf(f, "%s", title); + for (; n < l; ++n) { + if ((n % 16) == 0) + fprintf(f, "\n%04x", n); + fprintf(f, " %02x", s[n]); } + fprintf(f, "\n"); +} + +int gost_grasshopper_cipher_do_mgm(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_mgm *c = (gost_grasshopper_cipher_ctx_mgm *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); + const unsigned char *current_in = in; + unsigned char *current_out = out; + grasshopper_w128_t *currentInputBlock; + grasshopper_w128_t *currentOutputBlock; + unsigned int n = EVP_CIPHER_CTX_num(ctx); + size_t lasted; + size_t i; + + size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; + int rest_len = n % GRASSHOPPER_BLOCK_SIZE; + grasshopper_w128_t h; + + grasshopper_w128_t *iv_buffer = (grasshopper_w128_t *) iv; + grasshopper_w128_t tmp; + +/* ======== Here we deal with associated data =========== */ + if (out == NULL && c->mgm_state == mgm_associated_data) { + if (n == 0) { + grasshopper_encrypt_block(&c->c.encrypt_round_keys, c->mgm_iv, + &c->partial_buffer, &c->c.buffer); + memcpy(c->mgm_iv, &c->partial_buffer, GRASSHOPPER_BLOCK_SIZE); + hexdump(stderr, "Tag", c->tag, 16); + } + + if (rest_len != 0) { + /* Finalize partial_data */ + if (inl + rest_len < GRASSHOPPER_BLOCK_SIZE) { + memcpy(c->mgm_partial_buffer.b+rest_len, current_in, inl); + n += inl; + EVP_CIPHER_CTX_set_num(ctx, n); + return 1; + } else { + memcpy(c->mgm_partial_buffer.b+rest_len, current_in, GRASSHOPPER_BLOCK_SIZE - rest_len); + + grasshopper_encrypt_block(&c->c.encrypt_round_keys, c->mgm_iv, + &h, &c->c.buffer); + inc_counter(c->mgm_iv->b, 8); + + hexdump(stderr, "Hnext", h.b, 16); + hexdump(stderr, "Adata", c->mgm_partial_buffer.b, 16); + /* Galois multiply Hi * Ai */ + gf128_mul_uint64(tmp.q, h.q, c->mgm_partial_buffer.q); + + /* XOR to c->tag */ + grasshopper_plus128(&h, (grasshopper_w128_t *)c->tag, &tmp); + grasshopper_copy128((grasshopper_w128_t *)c->tag, &h); + hexdump(stderr, "Tag", c->tag, 16); + + current_in += GRASSHOPPER_BLOCK_SIZE - rest_len; + inl -= (GRASSHOPPER_BLOCK_SIZE - rest_len); + n += GRASSHOPPER_BLOCK_SIZE - rest_len; + } + } + + while (inl >= GRASSHOPPER_BLOCK_SIZE) { + currentInputBlock = (grasshopper_w128_t *) current_in; + + grasshopper_encrypt_block(&c->c.encrypt_round_keys, c->mgm_iv, + &h, &c->c.buffer); + inc_counter(c->mgm_iv->b, 8); + + hexdump(stderr, "Hnext", h.b, 16); + hexdump(stderr, "Adata", currentInputBlock->b, 16); + /* Galois multiply */ + gf128_mul_uint64(tmp.q, h.q, currentInputBlock->q); + + /* XOR to c->tag */ + grasshopper_plus128(&h, (grasshopper_w128_t *)c->tag, &tmp); + grasshopper_copy128((grasshopper_w128_t *)c->tag, &h); + hexdump(stderr, "Tag", c->tag, 16); + + current_in += GRASSHOPPER_BLOCK_SIZE; + inl -= GRASSHOPPER_BLOCK_SIZE; + n += GRASSHOPPER_BLOCK_SIZE; + } + + if (inl > 0) + { + memcpy(c->mgm_partial_buffer.b, current_in, inl); + n += inl; + } + + EVP_CIPHER_CTX_set_num(ctx, n); + return 1; + } + + if (out == NULL && in != NULL && inl !=0 && c->mgm_state == mgm_main_data) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_DO_MGM, GOST_R_BAD_ORDER); + return 0; + } + + if (out != NULL && c->mgm_state == mgm_associated_data) { + memset(c->mgm_partial_buffer.b+rest_len, 0, GRASSHOPPER_BLOCK_SIZE - rest_len); + + grasshopper_encrypt_block(&c->c.encrypt_round_keys, c->mgm_iv, + &h, &c->c.buffer); + inc_counter(c->mgm_iv->b, 8); + + hexdump(stderr, "Hnext", h.b, 16); + hexdump(stderr, "Padded Adata", c->mgm_partial_buffer.b, 16); + /* Galois multiply Hi * Ai */ + gf128_mul_uint64(tmp.q, h.q, c->mgm_partial_buffer.q); + + /* XOR to c->tag */ + grasshopper_plus128(&h, (grasshopper_w128_t *)c->tag, &tmp); + grasshopper_copy128((grasshopper_w128_t *)c->tag, &h); + hexdump(stderr, "Tag", c->tag, 16); + + /* We finish processing associated data */ + /* Pad rest of mgm_partial_buffer */ + /* Process last block */ + c->ad_length = n; + n = 0; + EVP_CIPHER_CTX_set_num(ctx, 0); + c->mgm_state = mgm_main_data; + + fprintf(stderr, "============= Deal with main data\n"); + } + +/* ======== Here we deal with main data =========== */ + if (n == 0) { + /* actual IV derived from nonce */ + grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, + &c->partial_buffer, &c->c.buffer); + memcpy(iv, c->partial_buffer.b, GRASSHOPPER_BLOCK_SIZE); + //hexdump(stderr, "Y1", iv, 16); + } + + while (rest_len && inl) { + *(current_out++) = *(current_in++) ^ c->partial_buffer.b[rest_len]; + --inl; + n++; + rest_len++; + if (rest_len == GRASSHOPPER_BLOCK_SIZE) + { + rest_len = 0; + } + } + EVP_CIPHER_CTX_set_num(ctx, n); + + // full parts + for (i = 0; i < blocks; i++) { + currentInputBlock = (grasshopper_w128_t *) current_in; + currentOutputBlock = (grasshopper_w128_t *) current_out; + grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, + &c->partial_buffer, &c->c.buffer); + grasshopper_plus128(&tmp, &c->partial_buffer, currentInputBlock); + grasshopper_copy128(currentOutputBlock, &tmp); + //hexdump(stderr, "Ciphertext", currentOutputBlock->b, 16); + + grasshopper_encrypt_block(&c->c.encrypt_round_keys, c->mgm_iv, + &h, &c->c.buffer); + inc_counter(c->mgm_iv->b, 8); + hexdump(stderr, "Hnext", h.b, 16); + hexdump(stderr, "Ciphertext", currentOutputBlock->b, 16); + /* Galois multiply Hi * Ai */ + gf128_mul_uint64(tmp.q, h.q, currentOutputBlock->q); + + /* XOR to c->tag */ + grasshopper_plus128(&h, (grasshopper_w128_t *)c->tag, &tmp); + grasshopper_copy128((grasshopper_w128_t *)c->tag, &h); + hexdump(stderr, "Tag", c->tag, 16); + + ctr128_inc(iv_buffer->b); + current_in += GRASSHOPPER_BLOCK_SIZE; + current_out += GRASSHOPPER_BLOCK_SIZE; + n += GRASSHOPPER_BLOCK_SIZE; + } + + // last part + lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; + if (lasted > 0) { + currentInputBlock = (grasshopper_w128_t *) current_in; + currentOutputBlock = (grasshopper_w128_t *) current_out; + grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, + &c->partial_buffer, &c->c.buffer); + for (i = 0; i < lasted; i++) { + currentOutputBlock->b[i] = + c->partial_buffer.b[i] ^ currentInputBlock->b[i]; + } + grasshopper_copy128(&c->partial_buffer, currentOutputBlock); + EVP_CIPHER_CTX_set_num(ctx, n+i); + ctr128_inc(iv_buffer->b); + } + + /* Final step */ + if (in == NULL && inl == 0) + { + unsigned char len_buf[16]; + uint64_t a_len = 0, p_len = 0; + + if (rest_len != 0) + { + memset(c->partial_buffer.b+rest_len, 0, GRASSHOPPER_BLOCK_SIZE - rest_len); + grasshopper_encrypt_block(&c->c.encrypt_round_keys, c->mgm_iv, + &h, &c->c.buffer); + inc_counter(c->mgm_iv->b, 8); + hexdump(stderr, "Hnext", h.b, 16); + hexdump(stderr, "Padded ciphertext", c->partial_buffer.b, 16); + /* Galois multiply Hi * Ai */ + gf128_mul_uint64(tmp.q, h.q, c->partial_buffer.q); + + /* XOR to c->tag */ + grasshopper_plus128(&h, (grasshopper_w128_t *)c->tag, &tmp); + grasshopper_copy128((grasshopper_w128_t *)c->tag, &h); + hexdump(stderr, "Tag", c->tag, 16); + } + + a_len = c->ad_length << 3; + p_len = (c->mgm_state == mgm_associated_data) ? 0 : n << 3; + +#ifdef L_ENDIAN + a_len = bswap_64(a_len); + p_len = bswap_64(p_len); +#endif + memset(len_buf, 0, 16); + + memcpy(len_buf, &a_len, sizeof(a_len)); + memcpy(len_buf+sizeof(a_len), &p_len, sizeof(p_len)); + grasshopper_encrypt_block(&c->c.encrypt_round_keys, c->mgm_iv, + &h, &c->c.buffer); + + hexdump(stderr, "Hlast", h.b, 16); + hexdump(stderr, "Lenbuf", len_buf, 16); + /* Galois multiply Hi * Ai */ + gf128_mul_uint64(tmp.q, h.q, (uint64_t *)len_buf); + + /* XOR to c->tag */ + grasshopper_plus128(&h, (grasshopper_w128_t *)c->tag, &tmp); + grasshopper_copy128((grasshopper_w128_t *)c->tag, &h); + hexdump(stderr, "Tag", c->tag, 16); + + /* Final tag calculation */ + grasshopper_encrypt_block(&c->c.encrypt_round_keys, (grasshopper_w128_t *)c->tag, + (grasshopper_w128_t *)c->final_tag, &c->c.buffer); + } + + return 1; +} /* * Fixed 128-bit IV implementation make shift regiser redundant. */ - static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx_ofb * ctx, - grasshopper_w128_t * iv, - grasshopper_w128_t * buf) { - memcpy(&ctx->buffer1, iv, 16); - grasshopper_encrypt_block(&ctx->c.encrypt_round_keys, &ctx->buffer1, - buf, &ctx->c.buffer); - memcpy(iv, buf, 16); - } - - int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx_ofb *c = - (gost_grasshopper_cipher_ctx_ofb *) - EVP_CIPHER_CTX_get_cipher_data(ctx); - const unsigned char *in_ptr = in; - unsigned char *out_ptr = out; - unsigned char *buf = EVP_CIPHER_CTX_buf_noconst(ctx); - unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); - int num = EVP_CIPHER_CTX_num(ctx); - size_t i = 0; - size_t j; - - /* process partial block if any */ - if (num > 0) { - for (j = (size_t)num, i = 0; j < GRASSHOPPER_BLOCK_SIZE && i < inl; - j++, i++, in_ptr++, out_ptr++) { - *out_ptr = buf[j] ^ (*in_ptr); - } - if (j == GRASSHOPPER_BLOCK_SIZE) { - EVP_CIPHER_CTX_set_num(ctx, 0); - } else { - EVP_CIPHER_CTX_set_num(ctx, (int)j); - return 1; - } - } - - for (; i + GRASSHOPPER_BLOCK_SIZE < - inl; - i += GRASSHOPPER_BLOCK_SIZE, in_ptr += - GRASSHOPPER_BLOCK_SIZE, out_ptr += GRASSHOPPER_BLOCK_SIZE) { - /* - * block cipher current iv - */ - /* Encrypt */ - gost_grasshopper_cnt_next(c, (grasshopper_w128_t *) iv, - (grasshopper_w128_t *) buf); +static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx_ofb * ctx, + grasshopper_w128_t * iv, + grasshopper_w128_t * buf) +{ + memcpy(&ctx->buffer1, iv, 16); + grasshopper_encrypt_block(&ctx->c.encrypt_round_keys, &ctx->buffer1, + buf, &ctx->c.buffer); + memcpy(iv, buf, 16); +} - /* - * xor next block of input text with it and output it - */ - /* - * output this block - */ - for (j = 0; j < GRASSHOPPER_BLOCK_SIZE; j++) { - out_ptr[j] = buf[j] ^ in_ptr[j]; - } +int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ofb *c = (gost_grasshopper_cipher_ctx_ofb *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + const unsigned char *in_ptr = in; + unsigned char *out_ptr = out; + unsigned char *buf = EVP_CIPHER_CTX_buf_noconst(ctx); + unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); + int num = EVP_CIPHER_CTX_num(ctx); + size_t i = 0; + size_t j; + + /* process partial block if any */ + if (num > 0) { + for (j = (size_t)num, i = 0; j < GRASSHOPPER_BLOCK_SIZE && i < inl; + j++, i++, in_ptr++, out_ptr++) { + *out_ptr = buf[j] ^ (*in_ptr); } - - /* Process rest of buffer */ - if (i < inl) { - gost_grasshopper_cnt_next(c, (grasshopper_w128_t *) iv, - (grasshopper_w128_t *) buf); - for (j = 0; i < inl; j++, i++) { - out_ptr[j] = buf[j] ^ in_ptr[j]; - } - EVP_CIPHER_CTX_set_num(ctx, (int)j); - } else { + if (j == GRASSHOPPER_BLOCK_SIZE) { EVP_CIPHER_CTX_set_num(ctx, 0); + } else { + EVP_CIPHER_CTX_set_num(ctx, (int)j); + return 1; } - - return 1; } - int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx *c = - (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - const unsigned char *in_ptr = in; - unsigned char *out_ptr = out; - unsigned char *buf = EVP_CIPHER_CTX_buf_noconst(ctx); - unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); - bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); - int num = EVP_CIPHER_CTX_num(ctx); - size_t i = 0; - size_t j = 0; - - /* process partial block if any */ - if (num > 0) { - for (j = (size_t)num, i = 0; j < GRASSHOPPER_BLOCK_SIZE && i < inl; - j++, i++, in_ptr++, out_ptr++) { - if (!encrypting) { - buf[j + GRASSHOPPER_BLOCK_SIZE] = *in_ptr; - } - *out_ptr = buf[j] ^ (*in_ptr); - if (encrypting) { - buf[j + GRASSHOPPER_BLOCK_SIZE] = *out_ptr; - } - } - if (j == GRASSHOPPER_BLOCK_SIZE) { - memcpy(iv, buf + GRASSHOPPER_BLOCK_SIZE, - GRASSHOPPER_BLOCK_SIZE); - EVP_CIPHER_CTX_set_num(ctx, 0); - } else { - EVP_CIPHER_CTX_set_num(ctx, (int)j); - return 1; - } + for (; i + GRASSHOPPER_BLOCK_SIZE < + inl; + i += GRASSHOPPER_BLOCK_SIZE, in_ptr += + GRASSHOPPER_BLOCK_SIZE, out_ptr += GRASSHOPPER_BLOCK_SIZE) { + /* + * block cipher current iv + */ + /* Encrypt */ + gost_grasshopper_cnt_next(c, (grasshopper_w128_t *) iv, + (grasshopper_w128_t *) buf); + + /* + * xor next block of input text with it and output it + */ + /* + * output this block + */ + for (j = 0; j < GRASSHOPPER_BLOCK_SIZE; j++) { + out_ptr[j] = buf[j] ^ in_ptr[j]; } + } - for (; i + GRASSHOPPER_BLOCK_SIZE < - inl; - i += GRASSHOPPER_BLOCK_SIZE, in_ptr += - GRASSHOPPER_BLOCK_SIZE, out_ptr += GRASSHOPPER_BLOCK_SIZE) { - /* - * block cipher current iv - */ - grasshopper_encrypt_block(&c->encrypt_round_keys, - (grasshopper_w128_t *) iv, - (grasshopper_w128_t *) buf, &c->buffer); - /* - * xor next block of input text with it and output it - */ - /* - * output this block - */ - if (!encrypting) { - memcpy(iv, in_ptr, GRASSHOPPER_BLOCK_SIZE); - } - for (j = 0; j < GRASSHOPPER_BLOCK_SIZE; j++) { - out_ptr[j] = buf[j] ^ in_ptr[j]; - } - /* Encrypt */ - /* Next iv is next block of cipher text */ - if (encrypting) { - memcpy(iv, out_ptr, GRASSHOPPER_BLOCK_SIZE); - } + /* Process rest of buffer */ + if (i < inl) { + gost_grasshopper_cnt_next(c, (grasshopper_w128_t *) iv, + (grasshopper_w128_t *) buf); + for (j = 0; i < inl; j++, i++) { + out_ptr[j] = buf[j] ^ in_ptr[j]; } + EVP_CIPHER_CTX_set_num(ctx, (int)j); + } else { + EVP_CIPHER_CTX_set_num(ctx, 0); + } - /* Process rest of buffer */ - if (i < inl) { - grasshopper_encrypt_block(&c->encrypt_round_keys, - (grasshopper_w128_t *) iv, - (grasshopper_w128_t *) buf, &c->buffer); + return 1; +} + +int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx *c = + (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); + const unsigned char *in_ptr = in; + unsigned char *out_ptr = out; + unsigned char *buf = EVP_CIPHER_CTX_buf_noconst(ctx); + unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); + bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); + int num = EVP_CIPHER_CTX_num(ctx); + size_t i = 0; + size_t j = 0; + + /* process partial block if any */ + if (num > 0) { + for (j = (size_t)num, i = 0; j < GRASSHOPPER_BLOCK_SIZE && i < inl; + j++, i++, in_ptr++, out_ptr++) { if (!encrypting) { - memcpy(buf + GRASSHOPPER_BLOCK_SIZE, in_ptr, inl - i); - } - for (j = 0; i < inl; j++, i++) { - out_ptr[j] = buf[j] ^ in_ptr[j]; + buf[j + GRASSHOPPER_BLOCK_SIZE] = *in_ptr; } - EVP_CIPHER_CTX_set_num(ctx, (int)j); + *out_ptr = buf[j] ^ (*in_ptr); if (encrypting) { - memcpy(buf + GRASSHOPPER_BLOCK_SIZE, out_ptr, j); + buf[j + GRASSHOPPER_BLOCK_SIZE] = *out_ptr; } - } else { + } + if (j == GRASSHOPPER_BLOCK_SIZE) { + memcpy(iv, buf + GRASSHOPPER_BLOCK_SIZE, GRASSHOPPER_BLOCK_SIZE); EVP_CIPHER_CTX_set_num(ctx, 0); + } else { + EVP_CIPHER_CTX_set_num(ctx, (int)j); + return 1; } + } - return 1; + for (; i + GRASSHOPPER_BLOCK_SIZE < + inl; + i += GRASSHOPPER_BLOCK_SIZE, in_ptr += + GRASSHOPPER_BLOCK_SIZE, out_ptr += GRASSHOPPER_BLOCK_SIZE) { + /* + * block cipher current iv + */ + grasshopper_encrypt_block(&c->encrypt_round_keys, + (grasshopper_w128_t *) iv, + (grasshopper_w128_t *) buf, &c->buffer); + /* + * xor next block of input text with it and output it + */ + /* + * output this block + */ + if (!encrypting) { + memcpy(iv, in_ptr, GRASSHOPPER_BLOCK_SIZE); + } + for (j = 0; j < GRASSHOPPER_BLOCK_SIZE; j++) { + out_ptr[j] = buf[j] ^ in_ptr[j]; + } + /* Encrypt */ + /* Next iv is next block of cipher text */ + if (encrypting) { + memcpy(iv, out_ptr, GRASSHOPPER_BLOCK_SIZE); + } } - int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) { - gost_grasshopper_cipher_ctx *c = - (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); + /* Process rest of buffer */ + if (i < inl) { + grasshopper_encrypt_block(&c->encrypt_round_keys, + (grasshopper_w128_t *) iv, + (grasshopper_w128_t *) buf, &c->buffer); + if (!encrypting) { + memcpy(buf + GRASSHOPPER_BLOCK_SIZE, in_ptr, inl - i); + } + for (j = 0; i < inl; j++, i++) { + out_ptr[j] = buf[j] ^ in_ptr[j]; + } + EVP_CIPHER_CTX_set_num(ctx, (int)j); + if (encrypting) { + memcpy(buf + GRASSHOPPER_BLOCK_SIZE, out_ptr, j); + } + } else { + EVP_CIPHER_CTX_set_num(ctx, 0); + } - if (!c) - return 1; + return 1; +} - struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; +int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) +{ + gost_grasshopper_cipher_ctx *c = + (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - gost_grasshopper_cipher_destroy(c); - if (params->destroy_cipher != NULL) { - params->destroy_cipher(c); - } + if (!c) + return 1; - EVP_CIPHER_CTX_set_app_data(ctx, NULL); + struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; - return 1; + gost_grasshopper_cipher_destroy(c); + if (params->destroy_cipher != NULL) { + params->destroy_cipher(c); } - int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, - ASN1_TYPE *params) { - int len = 0; - unsigned char *buf = NULL; - ASN1_OCTET_STRING *os = NULL; + EVP_CIPHER_CTX_set_app_data(ctx, NULL); + + return 1; +} - os = ASN1_OCTET_STRING_new(); +int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, ASN1_TYPE *params) +{ + int len = 0; + unsigned char *buf = NULL; + ASN1_OCTET_STRING *os = NULL; - if (!os || !ASN1_OCTET_STRING_set(os, buf, len)) { - OPENSSL_free(buf); - GOSTerr(GOST_F_GOST_GRASSHOPPER_SET_ASN1_PARAMETERS, - ERR_R_MALLOC_FAILURE); - return 0; - } + os = ASN1_OCTET_STRING_new(); + + if (!os || !ASN1_OCTET_STRING_set(os, buf, len)) { OPENSSL_free(buf); + GOSTerr(GOST_F_GOST_GRASSHOPPER_SET_ASN1_PARAMETERS, + ERR_R_MALLOC_FAILURE); + return 0; + } + OPENSSL_free(buf); - ASN1_TYPE_set(params, V_ASN1_SEQUENCE, os); - return 1; + ASN1_TYPE_set(params, V_ASN1_SEQUENCE, os); + return 1; +} + +GRASSHOPPER_INLINE int gost_grasshopper_get_asn1_parameters(EVP_CIPHER_CTX + *ctx, ASN1_TYPE + *params) +{ + int ret = -1; + + if (ASN1_TYPE_get(params) != V_ASN1_SEQUENCE) { + return ret; } - GRASSHOPPER_INLINE int gost_grasshopper_get_asn1_parameters(EVP_CIPHER_CTX - *ctx, - ASN1_TYPE - *params) { - int ret = -1; + return 1; +} - if (ASN1_TYPE_get(params) != V_ASN1_SEQUENCE) { - return ret; +int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, + void *ptr) +{ + switch (type) { + case EVP_CTRL_RAND_KEY:{ + if (RAND_bytes + ((unsigned char *)ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_RNG_ERROR); + return -1; + } + break; + } + case EVP_CTRL_KEY_MESH:{ + gost_grasshopper_cipher_ctx_ctr *c = + EVP_CIPHER_CTX_get_cipher_data(ctx); + if (c->c.type != GRASSHOPPER_CIPHER_CTRACPKM || !arg + || (arg % GRASSHOPPER_BLOCK_SIZE)) + return -1; + c->section_size = arg; + break; } +#ifdef EVP_CTRL_TLS1_2_TLSTREE + case EVP_CTRL_TLS1_2_TLSTREE: + { + unsigned char newkey[32]; + int mode = EVP_CIPHER_CTX_mode(ctx); + static const unsigned char zeroseq[8]; + gost_grasshopper_cipher_ctx_ctr *ctr_ctx = NULL; + gost_grasshopper_cipher_ctx *c = NULL; + + unsigned char adjusted_iv[16]; + unsigned char seq[8]; + int j, carry; + if (mode != EVP_CIPH_CTR_MODE) + return -1; - return 1; - } + ctr_ctx = (gost_grasshopper_cipher_ctx_ctr *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + c = &(ctr_ctx->c); - int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr) { - switch (type) { - case EVP_CTRL_RAND_KEY:{ - if (RAND_bytes - ((unsigned char *)ptr, - EVP_CIPHER_CTX_key_length(ctx)) <= 0) { - GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, - GOST_R_RNG_ERROR); - return -1; - } - break; + memcpy(seq, ptr, 8); + if (EVP_CIPHER_CTX_encrypting(ctx)) { + /* + * OpenSSL increments seq after mac calculation. + * As we have Mac-Then-Encrypt, we need decrement it here on encryption + * to derive the key correctly. + * */ + if (memcmp(seq, zeroseq, 8) != 0) + { + for(j=7; j>=0; j--) + { + if (seq[j] != 0) {seq[j]--; break;} + else seq[j] = 0xFF; + } } - case EVP_CTRL_KEY_MESH:{ - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); - if (c->c.type != GRASSHOPPER_CIPHER_CTRACPKM || !arg - || (arg % GRASSHOPPER_BLOCK_SIZE)) - return -1; - c->section_size = arg; - break; + } + if (gost_tlstree(NID_grasshopper_cbc, c->master_key.k.b, newkey, + (const unsigned char *)seq) > 0) { + memset(adjusted_iv, 0, 16); + memcpy(adjusted_iv, EVP_CIPHER_CTX_original_iv(ctx), 8); + for(j=7,carry=0; j>=0; j--) + { + int adj_byte = adjusted_iv[j]+seq[j]+carry; + carry = (adj_byte > 255) ? 1 : 0; + adjusted_iv[j] = adj_byte & 0xFF; } - default: - GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, - GOST_R_UNSUPPORTED_CIPHER_CTL_COMMAND); - return -1; + EVP_CIPHER_CTX_set_num(ctx, 0); + memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), adjusted_iv, 16); + + gost_grasshopper_cipher_key(c, newkey); + return 1; + } } - return 1; + return -1; +#endif + case EVP_CTRL_AEAD_GET_TAG: + case EVP_CTRL_AEAD_SET_TAG: + { + gost_grasshopper_cipher_ctx_mgm *mgm_ctx = NULL; + gost_grasshopper_cipher_ctx *c = NULL; + int taglen = arg; + unsigned char* tag = ptr; + + mgm_ctx = (gost_grasshopper_cipher_ctx_mgm *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + c = (gost_grasshopper_cipher_ctx *)mgm_ctx; + + if (c->type != GRASSHOPPER_CIPHER_MGM) + return -1; + + if (taglen > 16) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_INVALID_TAG_LENGTH); + return -1; + } + + if (type == EVP_CTRL_AEAD_GET_TAG) + memcpy(tag, mgm_ctx->final_tag, taglen); + else + memcpy(mgm_ctx->final_tag, tag, taglen); + + return 1; + } + default: + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, + GOST_R_UNSUPPORTED_CIPHER_CTL_COMMAND); + return -1; } + return 1; +} - GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_create(int - cipher_type, - int - block_size) { - return EVP_CIPHER_meth_new(cipher_type, block_size /* block_size */ , - GRASSHOPPER_KEY_SIZE /* key_size */ ); - } - - const int cipher_gost_grasshopper_setup(EVP_CIPHER *cipher, uint8_t mode, - int iv_size, bool padding) { - return EVP_CIPHER_meth_set_iv_length(cipher, iv_size) - && EVP_CIPHER_meth_set_flags(cipher, - (unsigned long)(mode | - ((!padding) ? - EVP_CIPH_NO_PADDING : - 0) | ((iv_size > - 0) ? - EVP_CIPH_CUSTOM_IV - : 0) | - EVP_CIPH_RAND_KEY | - EVP_CIPH_ALWAYS_CALL_INIT) - ) - && EVP_CIPHER_meth_set_cleanup(cipher, - gost_grasshopper_cipher_cleanup) - && EVP_CIPHER_meth_set_set_asn1_params(cipher, - gost_grasshopper_set_asn1_parameters) - && EVP_CIPHER_meth_set_get_asn1_params(cipher, - gost_grasshopper_get_asn1_parameters) - && EVP_CIPHER_meth_set_ctrl(cipher, gost_grasshopper_cipher_ctl) - && EVP_CIPHER_meth_set_do_cipher(cipher, - gost_grasshopper_cipher_do); - } - - const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper(uint8_t mode, - uint8_t num) { - EVP_CIPHER **cipher; - struct GRASSHOPPER_CIPHER_PARAMS *params; - - cipher = &gost_grasshopper_ciphers[num]; +GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_create(int + cipher_type, int + block_size) +{ + return EVP_CIPHER_meth_new(cipher_type, block_size /* block_size */ , + GRASSHOPPER_KEY_SIZE /* key_size */ ); +} - if (*cipher == NULL) { - params = &gost_cipher_params[num]; - - int nid = params->nid; - grasshopper_init_cipher_func init_cipher = params->init_cipher; - int block_size = params->block_size; - int ctx_size = params->ctx_size; - int iv_size = params->iv_size; - bool padding = params->padding; - - *cipher = cipher_gost_grasshopper_create(nid, block_size); - if (*cipher == NULL) { - return NULL; - } +const int cipher_gost_grasshopper_setup(EVP_CIPHER *cipher, uint8_t mode, + int iv_size, bool padding, int extra_flags) +{ + return EVP_CIPHER_meth_set_iv_length(cipher, iv_size) + && EVP_CIPHER_meth_set_flags(cipher, + (unsigned long)(mode | + ((!padding) ? + EVP_CIPH_NO_PADDING : + 0) | ((iv_size > + 0) ? + EVP_CIPH_CUSTOM_IV + : 0) | + EVP_CIPH_RAND_KEY | + EVP_CIPH_ALWAYS_CALL_INIT | extra_flags) + ) + && EVP_CIPHER_meth_set_cleanup(cipher, gost_grasshopper_cipher_cleanup) + && EVP_CIPHER_meth_set_set_asn1_params(cipher, + gost_grasshopper_set_asn1_parameters) + && EVP_CIPHER_meth_set_get_asn1_params(cipher, + gost_grasshopper_get_asn1_parameters) + && EVP_CIPHER_meth_set_ctrl(cipher, gost_grasshopper_cipher_ctl) + && EVP_CIPHER_meth_set_do_cipher(cipher, gost_grasshopper_cipher_do); +} - if (!cipher_gost_grasshopper_setup(*cipher, mode, iv_size, padding) - || !EVP_CIPHER_meth_set_init(*cipher, init_cipher) - || !EVP_CIPHER_meth_set_impl_ctx_size(*cipher, ctx_size)) { - EVP_CIPHER_meth_free(*cipher); - *cipher = NULL; - } - } +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper(uint8_t mode, + uint8_t num) +{ + EVP_CIPHER **cipher; + struct GRASSHOPPER_CIPHER_PARAMS *params; - return *cipher; - } + cipher = &gost_grasshopper_ciphers[num]; - const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ecb() { - return cipher_gost_grasshopper(EVP_CIPH_ECB_MODE, - GRASSHOPPER_CIPHER_ECB); - } + if (*cipher == NULL) { + params = &gost_cipher_params[num]; - const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cbc() { - return cipher_gost_grasshopper(EVP_CIPH_CBC_MODE, - GRASSHOPPER_CIPHER_CBC); - } + int nid = params->nid; + grasshopper_init_cipher_func init_cipher = params->init_cipher; + int block_size = params->block_size; + int ctx_size = params->ctx_size; + int iv_size = params->iv_size; + bool padding = params->padding; - const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ofb() { - return cipher_gost_grasshopper(EVP_CIPH_OFB_MODE, - GRASSHOPPER_CIPHER_OFB); - } + int extra_flags = (num == GRASSHOPPER_CIPHER_MGM) ? + EVP_CIPH_FLAG_CUSTOM_CIPHER | EVP_CIPH_FLAG_AEAD_CIPHER : 0; - const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cfb() { - return cipher_gost_grasshopper(EVP_CIPH_CFB_MODE, - GRASSHOPPER_CIPHER_CFB); - } + *cipher = cipher_gost_grasshopper_create(nid, block_size); + if (*cipher == NULL) { + return NULL; + } - const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctr() { - return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, - GRASSHOPPER_CIPHER_CTR); + if (!cipher_gost_grasshopper_setup(*cipher, mode, iv_size, padding, extra_flags) + || !EVP_CIPHER_meth_set_init(*cipher, init_cipher) + || !EVP_CIPHER_meth_set_impl_ctx_size(*cipher, ctx_size)) { + EVP_CIPHER_meth_free(*cipher); + *cipher = NULL; + } } - const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() { - return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, - GRASSHOPPER_CIPHER_CTRACPKM); - } + return *cipher; +} - void cipher_gost_grasshopper_destroy(void) { - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_OFB]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_OFB] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers - [GRASSHOPPER_CIPHER_CTRACPKM]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM] = NULL; - } +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ecb() +{ + return cipher_gost_grasshopper(EVP_CIPH_ECB_MODE, GRASSHOPPER_CIPHER_ECB); +} + +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cbc() +{ + return cipher_gost_grasshopper(EVP_CIPH_CBC_MODE, GRASSHOPPER_CIPHER_CBC); +} + +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ofb() +{ + return cipher_gost_grasshopper(EVP_CIPH_OFB_MODE, GRASSHOPPER_CIPHER_OFB); +} -#if defined(__cplusplus) +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cfb() +{ + return cipher_gost_grasshopper(EVP_CIPH_CFB_MODE, GRASSHOPPER_CIPHER_CFB); } + +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctr() +{ + return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTR); +} + +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() +{ + return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, + GRASSHOPPER_CIPHER_CTRACPKM); +} + +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_mgm() +{ +#ifndef NID_kuznyechik_mgm + return NULL; +#else + return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_MGM); #endif +} + +void cipher_gost_grasshopper_destroy(void) +{ + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB] = NULL; + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC] = NULL; + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_OFB]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_OFB] = NULL; + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB] = NULL; + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR] = NULL; + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM] = NULL; + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_MGM]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_MGM] = NULL; +}