_ Git - BearSSL/blob - inc/bearssl_aead.h

   1 /*
   2  * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
   3  *
   4  * Permission is hereby granted, free of charge, to any person obtaining
   5  * a copy of this software and associated documentation files (the
   6  * "Software"), to deal in the Software without restriction, including
   7  * without limitation the rights to use, copy, modify, merge, publish,
   8  * distribute, sublicense, and/or sell copies of the Software, and to
   9  * permit persons to whom the Software is furnished to do so, subject to
  10  * the following conditions:
  11  *
  12  * The above copyright notice and this permission notice shall be
  13  * included in all copies or substantial portions of the Software.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  16  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  17  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  18  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  19  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  20  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  22  * SOFTWARE.
  23  */
  24
  25 #ifndef BR_BEARSSL_AEAD_H__
  26 #define BR_BEARSSL_AEAD_H__
  27
  28 #include <stddef.h>
  29 #include <stdint.h>
  30
  31 #include "bearssl_block.h"
  32 #include "bearssl_hash.h"
  33
  34 #ifdef __cplusplus
  35 extern "C" {
  36 #endif
  37
  38 /** \file bearssl_aead.h
  39  *
  40  * # Authenticated Encryption with Additional Data
  41  *
  42  * This file documents the API for AEAD encryption.
  43  *
  44  *
  45  * ## Procedural API
  46  *
  47  * An AEAD algorithm processes messages and provides confidentiality
  48  * (encryption) and checked integrity (MAC). It uses the following
  49  * parameters:
  50  *
  51  *   - A symmetric key. Exact size depends on the AEAD algorithm.
  52  *
  53  *   - A nonce (IV). Size depends on the AEAD algorithm; for most
  54  *     algorithms, it is crucial for security that any given nonce
  55  *     value is never used twice for the same key and distinct
  56  *     messages.
  57  *
  58  *   - Data to encrypt and protect.
  59  *
  60  *   - Additional authenticated data, which is covered by the MAC but
  61  *     otherwise left untouched (i.e. not encrypted).
  62  *
  63  * The AEAD algorithm encrypts the data, and produces an authentication
  64  * tag. It is assumed that the encrypted data, the tag, the additional
  65  * authenticated data and the nonce are sent to the receiver; the
  66  * additional data and the nonce may be implicit (e.g. using elements of
  67  * the underlying transport protocol, such as record sequence numbers).
  68  * The receiver will recompute the tag value and compare it with the one
  69  * received; if they match, then the data is correct, and can be
  70  * decrypted and used; otherwise, at least one of the elements was
  71  * altered in transit, normally leading to wholesale rejection of the
  72  * complete message.
  73  *
  74  * For each AEAD algorithm, identified by a symbolic name (hereafter
  75  * denoted as "`xxx`"), the following functions are defined:
  76  *
  77  *   - `br_xxx_init()`
  78  *
  79  *     Initialise the AEAD algorithm, on a provided context structure.
  80  *     Exact parameters depend on the algorithm, and may include
  81  *     pointers to extra implementations and context structures. The
  82  *     secret key is provided at this point, either directly or
  83  *     indirectly.
  84  *
  85  *   - `br_xxx_reset()`
  86  *
  87  *     Start a new AEAD computation. The nonce value is provided as
  88  *     parameter to this function.
  89  *
  90  *   - `br_xxx_aad_inject()`
  91  *
  92  *     Inject some additional authenticated data. Additional data may
  93  *     be provided in several chunks of arbitrary length.
  94  *
  95  *   - `br_xxx_flip()`
  96  *
  97  *     This function MUST be called after injecting all additional
  98  *     authenticated data, and before beginning to encrypt the plaintext
  99  *     (or decrypt the ciphertext).
 100  *
 101  *   - `br_xxx_run()`
 102  *
 103  *     Process some plaintext (to encrypt) or ciphertext (to decrypt).
 104  *     Encryption/decryption is done in place. Data may be provided in
 105  *     several chunks of arbitrary length.
 106  *
 107  *   - `br_xxx_get_tag()`
 108  *
 109  *     Compute the authentication tag. All message data (encrypted or
 110  *     decrypted) must have been injected at that point. Also, this
 111  *     call may modify internal context elements, so it may be called
 112  *     only once for a given AEAD computation.
 113  *
 114  *   - `br_xxx_check_tag()`
 115  *
 116  *     An alternative to `br_xxx_get_tag()`, meant to be used by the
 117  *     receiver: the authentication tag is internally recomputed, and
 118  *     compared with the one provided as parameter.
 119  *
 120  * This API makes the following assumptions on the AEAD algorithm:
 121  *
 122  *   - Encryption does not expand the size of the ciphertext; there is
 123  *     no padding. This is true of most modern AEAD modes such as GCM.
 124  *
 125  *   - The additional authenticated data must be processed first,
 126  *     before the encrypted/decrypted data.
 127  *
 128  *   - Nonce, plaintext and additional authenticated data all consist
 129  *     in an integral number of bytes. There is no provision to use
 130  *     elements whose length in bits is not a multiple of 8.
 131  *
 132  * Each AEAD algorithm has its own requirements and limits on the sizes
 133  * of additional data and plaintext. This API does not provide any
 134  * way to report invalid usage; it is up to the caller to ensure that
 135  * the provided key, nonce, and data elements all fit the algorithm's
 136  * requirements.
 137  *
 138  *
 139  * ## Object-Oriented API
 140  *
 141  * Each context structure begins with a field (called `vtable`) that
 142  * points to an instance of a structure that references the relevant
 143  * functions through pointers. Each such structure contains the
 144  * following:
 145  *
 146  *   - `reset`
 147  *
 148  *     Pointer to the reset function, that allows starting a new
 149  *     computation.
 150  *
 151  *   - `aad_inject`
 152  *
 153  *     Pointer to the additional authenticated data injection function.
 154  *
 155  *   - `flip`
 156  *
 157  *     Pointer to the function that transitions from additional data
 158  *     to main message data processing.
 159  *
 160  *   - `get_tag`
 161  *
 162  *     Pointer to the function that computes and returns the tag.
 163  *
 164  *   - `check_tag`
 165  *
 166  *     Pointer to the function that computes and verifies the tag against
 167  *     a received value.
 168  *
 169  * Note that there is no OOP method for context initialisation: the
 170  * various AEAD algorithms have different requirements that would not
 171  * map well to a single initialisation API.
 172  *
 173  * The OOP API is not provided for CCM, due to its specific requirements
 174  * (length of plaintext must be known in advance).
 175  */
 176
 177 /**
 178  * \brief Class type of an AEAD algorithm.
 179  */
 180 typedef struct br_aead_class_ br_aead_class;
 181 struct br_aead_class_ {
 182
 183         /**
 184          * \brief Size (in bytes) of authentication tags created by
 185          * this AEAD algorithm.
 186          */
 187         size_t tag_size;
 188
 189         /**
 190          * \brief Reset an AEAD context.
 191          *
 192          * This function resets an already initialised AEAD context for
 193          * a new computation run. Implementations and keys are
 194          * conserved. This function can be called at any time; it
 195          * cancels any ongoing AEAD computation that uses the provided
 196          * context structure.
 197
 198          * The provided IV is a _nonce_. Each AEAD algorithm has its
 199          * own requirements on IV size and contents; for most of them,
 200          * it is crucial to security that each nonce value is used
 201          * only once for a given secret key.
 202          *
 203          * \param cc    AEAD context structure.
 204          * \param iv    AEAD nonce to use.
 205          * \param len   AEAD nonce length (in bytes).
 206          */
 207         void (*reset)(const br_aead_class **cc, const void *iv, size_t len);
 208
 209         /**
 210          * \brief Inject additional authenticated data.
 211          *
 212          * The provided data is injected into a running AEAD
 213          * computation. Additional data must be injected _before_ the
 214          * call to `flip()`. Additional data can be injected in several
 215          * chunks of arbitrary length.
 216          *
 217          * \param cc     AEAD context structure.
 218          * \param data   pointer to additional authenticated data.
 219          * \param len    length of additional authenticated data (in bytes).
 220          */
 221         void (*aad_inject)(const br_aead_class **cc,
 222                 const void *data, size_t len);
 223
 224         /**
 225          * \brief Finish injection of additional authenticated data.
 226          *
 227          * This function MUST be called before beginning the actual
 228          * encryption or decryption (with `run()`), even if no
 229          * additional authenticated data was injected. No additional
 230          * authenticated data may be injected after this function call.
 231          *
 232          * \param cc   AEAD context structure.
 233          */
 234         void (*flip)(const br_aead_class **cc);
 235
 236         /**
 237          * \brief Encrypt or decrypt some data.
 238          *
 239          * Data encryption or decryption can be done after `flip()` has
 240          * been called on the context. If `encrypt` is non-zero, then
 241          * the provided data shall be plaintext, and it is encrypted in
 242          * place. Otherwise, the data shall be ciphertext, and it is
 243          * decrypted in place.
 244          *
 245          * Data may be provided in several chunks of arbitrary length.
 246          *
 247          * \param cc        AEAD context structure.
 248          * \param encrypt   non-zero for encryption, zero for decryption.
 249          * \param data      data to encrypt or decrypt.
 250          * \param len       data length (in bytes).
 251          */
 252         void (*run)(const br_aead_class **cc, int encrypt,
 253                 void *data, size_t len);
 254
 255         /**
 256          * \brief Compute authentication tag.
 257          *
 258          * Compute the AEAD authentication tag. The tag length depends
 259          * on the AEAD algorithm; it is written in the provided `tag`
 260          * buffer. This call terminates the AEAD run: no data may be
 261          * processed with that AEAD context afterwards, until `reset()`
 262          * is called to initiate a new AEAD run.
 263          *
 264          * The tag value must normally be sent along with the encrypted
 265          * data. When decrypting, the tag value must be recomputed and
 266          * compared with the received tag: if the two tag values differ,
 267          * then either the tag or the encrypted data was altered in
 268          * transit. As an alternative to this function, the
 269          * `check_tag()` function may be used to compute and check the
 270          * tag value.
 271          *
 272          * Tag length depends on the AEAD algorithm.
 273          *
 274          * \param cc    AEAD context structure.
 275          * \param tag   destination buffer for the tag.
 276          */
 277         void (*get_tag)(const br_aead_class **cc, void *tag);
 278
 279         /**
 280          * \brief Compute and check authentication tag.
 281          *
 282          * This function is an alternative to `get_tag()`, and is
 283          * normally used on the receiving end (i.e. when decrypting
 284          * messages). The tag value is recomputed and compared with the
 285          * provided tag value. If they match, 1 is returned; on
 286          * mismatch, 0 is returned. A returned value of 0 means that the
 287          * data or the tag was altered in transit, normally leading to
 288          * wholesale rejection of the complete message.
 289          *
 290          * Tag length depends on the AEAD algorithm.
 291          *
 292          * \param cc    AEAD context structure.
 293          * \param tag   tag value to compare with.
 294          * \return  1 on success (exact match of tag value), 0 otherwise.
 295          */
 296         uint32_t (*check_tag)(const br_aead_class **cc, const void *tag);
 297
 298         /**
 299          * \brief Compute authentication tag (with truncation).
 300          *
 301          * This function is similar to `get_tag()`, except that the tag
 302          * length is provided. Some AEAD algorithms allow several tag
 303          * lengths, usually by truncating the normal tag. Shorter tags
 304          * mechanically increase success probability of forgeries.
 305          * The range of allowed tag lengths depends on the algorithm.
 306          *
 307          * \param cc    AEAD context structure.
 308          * \param tag   destination buffer for the tag.
 309          * \param len   tag length (in bytes).
 310          */
 311         void (*get_tag_trunc)(const br_aead_class **cc, void *tag, size_t len);
 312
 313         /**
 314          * \brief Compute and check authentication tag (with truncation).
 315          *
 316          * This function is similar to `check_tag()` except that it
 317          * works over an explicit tag length. See `get_tag()` for a
 318          * discussion of explicit tag lengths; the range of allowed tag
 319          * lengths depends on the algorithm.
 320          *
 321          * \param cc    AEAD context structure.
 322          * \param tag   tag value to compare with.
 323          * \param len   tag length (in bytes).
 324          * \return  1 on success (exact match of tag value), 0 otherwise.
 325          */
 326         uint32_t (*check_tag_trunc)(const br_aead_class **cc,
 327                 const void *tag, size_t len);
 328 };
 329
 330 /**
 331  * \brief Context structure for GCM.
 332  *
 333  * GCM is an AEAD mode that combines a block cipher in CTR mode with a
 334  * MAC based on GHASH, to provide authenticated encryption:
 335  *
 336  *   - Any block cipher with 16-byte blocks can be used with GCM.
 337  *
 338  *   - The nonce can have any length, from 0 up to 2^64-1 bits; however,
 339  *     96-bit nonces (12 bytes) are recommended (nonces with a length
 340  *     distinct from 12 bytes are internally hashed, which risks reusing
 341  *     nonce value with a small but not always negligible probability).
 342  *
 343  *   - Additional authenticated data may have length up to 2^64-1 bits.
 344  *
 345  *   - Message length may range up to 2^39-256 bits at most.
 346  *
 347  *   - The authentication tag has length 16 bytes.
 348  *
 349  * The GCM initialisation function receives as parameter an
 350  * _initialised_ block cipher implementation context, with the secret
 351  * key already set. A pointer to that context will be kept within the
 352  * GCM context structure. It is up to the caller to allocate and
 353  * initialise that block cipher context.
 354  */
 355 typedef struct {
 356         /** \brief Pointer to vtable for this context. */
 357         const br_aead_class *vtable;
 358
 359 #ifndef BR_DOXYGEN_IGNORE
 360         const br_block_ctr_class **bctx;
 361         br_ghash gh;
 362         unsigned char h[16];
 363         unsigned char j0_1[12];
 364         unsigned char buf[16];
 365         unsigned char y[16];
 366         uint32_t j0_2, jc;
 367         uint64_t count_aad, count_ctr;
 368 #endif
 369 } br_gcm_context;
 370
 371 /**
 372  * \brief Initialize a GCM context.
 373  *
 374  * A block cipher implementation, with its initialised context structure,
 375  * is provided. The block cipher MUST use 16-byte blocks in CTR mode,
 376  * and its secret key MUST have been already set in the provided context.
 377  * A GHASH implementation must also be provided. The parameters are linked
 378  * in the GCM context.
 379  *
 380  * After this function has been called, the `br_gcm_reset()` function must
 381  * be called, to provide the IV for GCM computation.
 382  *
 383  * \param ctx    GCM context structure.
 384  * \param bctx   block cipher context (already initialised with secret key).
 385  * \param gh     GHASH implementation.
 386  */
 387 void br_gcm_init(br_gcm_context *ctx,
 388         const br_block_ctr_class **bctx, br_ghash gh);
 389
 390 /**
 391  * \brief Reset a GCM context.
 392  *
 393  * This function resets an already initialised GCM context for a new
 394  * computation run. Implementations and keys are conserved. This function
 395  * can be called at any time; it cancels any ongoing GCM computation that
 396  * uses the provided context structure.
 397  *
 398  * The provided IV is a _nonce_. It is critical to GCM security that IV
 399  * values are not repeated for the same encryption key. IV can have
 400  * arbitrary length (up to 2^64-1 bits), but the "normal" length is
 401  * 96 bits (12 bytes).
 402  *
 403  * \param ctx   GCM context structure.
 404  * \param iv    GCM nonce to use.
 405  * \param len   GCM nonce length (in bytes).
 406  */
 407 void br_gcm_reset(br_gcm_context *ctx, const void *iv, size_t len);
 408
 409 /**
 410  * \brief Inject additional authenticated data into GCM.
 411  *
 412  * The provided data is injected into a running GCM computation. Additional
 413  * data must be injected _before_ the call to `br_gcm_flip()`.
 414  * Additional data can be injected in several chunks of arbitrary length;
 415  * the maximum total size of additional authenticated data is 2^64-1
 416  * bits.
 417  *
 418  * \param ctx    GCM context structure.
 419  * \param data   pointer to additional authenticated data.
 420  * \param len    length of additional authenticated data (in bytes).
 421  */
 422 void br_gcm_aad_inject(br_gcm_context *ctx, const void *data, size_t len);
 423
 424 /**
 425  * \brief Finish injection of additional authenticated data into GCM.
 426  *
 427  * This function MUST be called before beginning the actual encryption
 428  * or decryption (with `br_gcm_run()`), even if no additional authenticated
 429  * data was injected. No additional authenticated data may be injected
 430  * after this function call.
 431  *
 432  * \param ctx   GCM context structure.
 433  */
 434 void br_gcm_flip(br_gcm_context *ctx);
 435
 436 /**
 437  * \brief Encrypt or decrypt some data with GCM.
 438  *
 439  * Data encryption or decryption can be done after `br_gcm_flip()`
 440  * has been called on the context. If `encrypt` is non-zero, then the
 441  * provided data shall be plaintext, and it is encrypted in place.
 442  * Otherwise, the data shall be ciphertext, and it is decrypted in place.
 443  *
 444  * Data may be provided in several chunks of arbitrary length. The maximum
 445  * total length for data is 2^39-256 bits, i.e. about 65 gigabytes.
 446  *
 447  * \param ctx       GCM context structure.
 448  * \param encrypt   non-zero for encryption, zero for decryption.
 449  * \param data      data to encrypt or decrypt.
 450  * \param len       data length (in bytes).
 451  */
 452 void br_gcm_run(br_gcm_context *ctx, int encrypt, void *data, size_t len);
 453
 454 /**
 455  * \brief Compute GCM authentication tag.
 456  *
 457  * Compute the GCM authentication tag. The tag is a 16-byte value which
 458  * is written in the provided `tag` buffer. This call terminates the
 459  * GCM run: no data may be processed with that GCM context afterwards,
 460  * until `br_gcm_reset()` is called to initiate a new GCM run.
 461  *
 462  * The tag value must normally be sent along with the encrypted data.
 463  * When decrypting, the tag value must be recomputed and compared with
 464  * the received tag: if the two tag values differ, then either the tag
 465  * or the encrypted data was altered in transit. As an alternative to
 466  * this function, the `br_gcm_check_tag()` function can be used to
 467  * compute and check the tag value.
 468  *
 469  * \param ctx   GCM context structure.
 470  * \param tag   destination buffer for the tag (16 bytes).
 471  */
 472 void br_gcm_get_tag(br_gcm_context *ctx, void *tag);
 473
 474 /**
 475  * \brief Compute and check GCM authentication tag.
 476  *
 477  * This function is an alternative to `br_gcm_get_tag()`, normally used
 478  * on the receiving end (i.e. when decrypting value). The tag value is
 479  * recomputed and compared with the provided tag value. If they match, 1
 480  * is returned; on mismatch, 0 is returned. A returned value of 0 means
 481  * that the data or the tag was altered in transit, normally leading to
 482  * wholesale rejection of the complete message.
 483  *
 484  * \param ctx   GCM context structure.
 485  * \param tag   tag value to compare with (16 bytes).
 486  * \return  1 on success (exact match of tag value), 0 otherwise.
 487  */
 488 uint32_t br_gcm_check_tag(br_gcm_context *ctx, const void *tag);
 489
 490 /**
 491  * \brief Compute GCM authentication tag (with truncation).
 492  *
 493  * This function is similar to `br_gcm_get_tag()`, except that it allows
 494  * the tag to be truncated to a smaller length. The intended tag length
 495  * is provided as `len` (in bytes); it MUST be no more than 16, but
 496  * it may be smaller. Note that decreasing tag length mechanically makes
 497  * forgeries easier; NIST SP 800-38D specifies that the tag length shall
 498  * lie between 12 and 16 bytes (inclusive), but may be truncated down to
 499  * 4 or 8 bytes, for specific applications that can tolerate it. It must
 500  * also be noted that successful forgeries leak information on the
 501  * authentication key, making subsequent forgeries easier. Therefore,
 502  * tag truncation, and in particular truncation to sizes lower than 12
 503  * bytes, shall be envisioned only with great care.
 504  *
 505  * The tag is written in the provided `tag` buffer. This call terminates
 506  * the GCM run: no data may be processed with that GCM context
 507  * afterwards, until `br_gcm_reset()` is called to initiate a new GCM
 508  * run.
 509  *
 510  * The tag value must normally be sent along with the encrypted data.
 511  * When decrypting, the tag value must be recomputed and compared with
 512  * the received tag: if the two tag values differ, then either the tag
 513  * or the encrypted data was altered in transit. As an alternative to
 514  * this function, the `br_gcm_check_tag_trunc()` function can be used to
 515  * compute and check the tag value.
 516  *
 517  * \param ctx   GCM context structure.
 518  * \param tag   destination buffer for the tag.
 519  * \param len   tag length (16 bytes or less).
 520  */
 521 void br_gcm_get_tag_trunc(br_gcm_context *ctx, void *tag, size_t len);
 522
 523 /**
 524  * \brief Compute and check GCM authentication tag (with truncation).
 525  *
 526  * This function is an alternative to `br_gcm_get_tag_trunc()`, normally used
 527  * on the receiving end (i.e. when decrypting value). The tag value is
 528  * recomputed and compared with the provided tag value. If they match, 1
 529  * is returned; on mismatch, 0 is returned. A returned value of 0 means
 530  * that the data or the tag was altered in transit, normally leading to
 531  * wholesale rejection of the complete message.
 532  *
 533  * Tag length MUST be 16 bytes or less. The normal GCM tag length is 16
 534  * bytes. See `br_check_tag_trunc()` for some discussion on the potential
 535  * perils of truncating authentication tags.
 536  *
 537  * \param ctx   GCM context structure.
 538  * \param tag   tag value to compare with.
 539  * \param len   tag length (in bytes).
 540  * \return  1 on success (exact match of tag value), 0 otherwise.
 541  */
 542 uint32_t br_gcm_check_tag_trunc(br_gcm_context *ctx,
 543         const void *tag, size_t len);
 544
 545 /**
 546  * \brief Class instance for GCM.
 547  */
 548 extern const br_aead_class br_gcm_vtable;
 549
 550 /**
 551  * \brief Context structure for EAX.
 552  *
 553  * EAX is an AEAD mode that combines a block cipher in CTR mode with
 554  * CBC-MAC using the same block cipher and the same key, to provide
 555  * authenticated encryption:
 556  *
 557  *   - Any block cipher with 16-byte blocks can be used with EAX
 558  *     (technically, other block sizes are defined as well, but this
 559  *     is not implemented by these functions; shorter blocks also
 560  *     imply numerous security issues).
 561  *
 562  *   - The nonce can have any length, as long as nonce values are
 563  *     not reused (thus, if nonces are randomly selected, the nonce
 564  *     size should be such that reuse probability is negligible).
 565  *
 566  *   - Additional authenticated data length is unlimited.
 567  *
 568  *   - Message length is unlimited.
 569  *
 570  *   - The authentication tag has length 16 bytes.
 571  *
 572  * The EAX initialisation function receives as parameter an
 573  * _initialised_ block cipher implementation context, with the secret
 574  * key already set. A pointer to that context will be kept within the
 575  * EAX context structure. It is up to the caller to allocate and
 576  * initialise that block cipher context.
 577  */
 578 typedef struct {
 579         /** \brief Pointer to vtable for this context. */
 580         const br_aead_class *vtable;
 581
 582 #ifndef BR_DOXYGEN_IGNORE
 583         const br_block_ctrcbc_class **bctx;
 584         unsigned char L2[16];
 585         unsigned char L4[16];
 586         unsigned char nonce[16];
 587         unsigned char head[16];
 588         unsigned char ctr[16];
 589         unsigned char cbcmac[16];
 590         unsigned char buf[16];
 591         size_t ptr;
 592 #endif
 593 } br_eax_context;
 594
 595 /**
 596  * \brief Initialize an EAX context.
 597  *
 598  * A block cipher implementation, with its initialised context
 599  * structure, is provided. The block cipher MUST use 16-byte blocks in
 600  * CTR + CBC-MAC mode, and its secret key MUST have been already set in
 601  * the provided context. The parameters are linked in the EAX context.
 602  *
 603  * After this function has been called, the `br_eax_reset()` function must
 604  * be called, to provide the nonce for EAX computation.
 605  *
 606  * \param ctx    EAX context structure.
 607  * \param bctx   block cipher context (already initialised with secret key).
 608  */
 609 void br_eax_init(br_eax_context *ctx, const br_block_ctrcbc_class **bctx);
 610
 611 /**
 612  * \brief Reset an EAX context.
 613  *
 614  * This function resets an already initialised EAX context for a new
 615  * computation run. Implementations and keys are conserved. This function
 616  * can be called at any time; it cancels any ongoing EAX computation that
 617  * uses the provided context structure.
 618  *
 619  * It is critical to EAX security that nonce values are not repeated for
 620  * the same encryption key. Nonces can have arbitrary length. If nonces
 621  * are randomly generated, then a nonce length of at least 128 bits (16
 622  * bytes) is recommended, to make nonce reuse probability sufficiently
 623  * low.
 624  *
 625  * \param ctx     EAX context structure.
 626  * \param nonce   EAX nonce to use.
 627  * \param len     EAX nonce length (in bytes).
 628  */
 629 void br_eax_reset(br_eax_context *ctx, const void *nonce, size_t len);
 630
 631 /**
 632  * \brief Inject additional authenticated data into EAX.
 633  *
 634  * The provided data is injected into a running EAX computation. Additional
 635  * data must be injected _before_ the call to `br_eax_flip()`.
 636  * Additional data can be injected in several chunks of arbitrary length;
 637  * the total amount of additional authenticated data is unlimited.
 638  *
 639  * \param ctx    EAX context structure.
 640  * \param data   pointer to additional authenticated data.
 641  * \param len    length of additional authenticated data (in bytes).
 642  */
 643 void br_eax_aad_inject(br_eax_context *ctx, const void *data, size_t len);
 644
 645 /**
 646  * \brief Finish injection of additional authenticated data into EAX.
 647  *
 648  * This function MUST be called before beginning the actual encryption
 649  * or decryption (with `br_eax_run()`), even if no additional authenticated
 650  * data was injected. No additional authenticated data may be injected
 651  * after this function call.
 652  *
 653  * \param ctx   EAX context structure.
 654  */
 655 void br_eax_flip(br_eax_context *ctx);
 656
 657 /**
 658  * \brief Encrypt or decrypt some data with EAX.
 659  *
 660  * Data encryption or decryption can be done after `br_eax_flip()`
 661  * has been called on the context. If `encrypt` is non-zero, then the
 662  * provided data shall be plaintext, and it is encrypted in place.
 663  * Otherwise, the data shall be ciphertext, and it is decrypted in place.
 664  *
 665  * Data may be provided in several chunks of arbitrary length.
 666  *
 667  * \param ctx       EAX context structure.
 668  * \param encrypt   non-zero for encryption, zero for decryption.
 669  * \param data      data to encrypt or decrypt.
 670  * \param len       data length (in bytes).
 671  */
 672 void br_eax_run(br_eax_context *ctx, int encrypt, void *data, size_t len);
 673
 674 /**
 675  * \brief Compute EAX authentication tag.
 676  *
 677  * Compute the EAX authentication tag. The tag is a 16-byte value which
 678  * is written in the provided `tag` buffer. This call terminates the
 679  * EAX run: no data may be processed with that EAX context afterwards,
 680  * until `br_eax_reset()` is called to initiate a new EAX run.
 681  *
 682  * The tag value must normally be sent along with the encrypted data.
 683  * When decrypting, the tag value must be recomputed and compared with
 684  * the received tag: if the two tag values differ, then either the tag
 685  * or the encrypted data was altered in transit. As an alternative to
 686  * this function, the `br_eax_check_tag()` function can be used to
 687  * compute and check the tag value.
 688  *
 689  * \param ctx   EAX context structure.
 690  * \param tag   destination buffer for the tag (16 bytes).
 691  */
 692 void br_eax_get_tag(br_eax_context *ctx, void *tag);
 693
 694 /**
 695  * \brief Compute and check EAX authentication tag.
 696  *
 697  * This function is an alternative to `br_eax_get_tag()`, normally used
 698  * on the receiving end (i.e. when decrypting value). The tag value is
 699  * recomputed and compared with the provided tag value. If they match, 1
 700  * is returned; on mismatch, 0 is returned. A returned value of 0 means
 701  * that the data or the tag was altered in transit, normally leading to
 702  * wholesale rejection of the complete message.
 703  *
 704  * \param ctx   EAX context structure.
 705  * \param tag   tag value to compare with (16 bytes).
 706  * \return  1 on success (exact match of tag value), 0 otherwise.
 707  */
 708 uint32_t br_eax_check_tag(br_eax_context *ctx, const void *tag);
 709
 710 /**
 711  * \brief Compute EAX authentication tag (with truncation).
 712  *
 713  * This function is similar to `br_eax_get_tag()`, except that it allows
 714  * the tag to be truncated to a smaller length. The intended tag length
 715  * is provided as `len` (in bytes); it MUST be no more than 16, but
 716  * it may be smaller. Note that decreasing tag length mechanically makes
 717  * forgeries easier; NIST SP 800-38D specifies that the tag length shall
 718  * lie between 12 and 16 bytes (inclusive), but may be truncated down to
 719  * 4 or 8 bytes, for specific applications that can tolerate it. It must
 720  * also be noted that successful forgeries leak information on the
 721  * authentication key, making subsequent forgeries easier. Therefore,
 722  * tag truncation, and in particular truncation to sizes lower than 12
 723  * bytes, shall be envisioned only with great care.
 724  *
 725  * The tag is written in the provided `tag` buffer. This call terminates
 726  * the EAX run: no data may be processed with that EAX context
 727  * afterwards, until `br_eax_reset()` is called to initiate a new EAX
 728  * run.
 729  *
 730  * The tag value must normally be sent along with the encrypted data.
 731  * When decrypting, the tag value must be recomputed and compared with
 732  * the received tag: if the two tag values differ, then either the tag
 733  * or the encrypted data was altered in transit. As an alternative to
 734  * this function, the `br_eax_check_tag_trunc()` function can be used to
 735  * compute and check the tag value.
 736  *
 737  * \param ctx   EAX context structure.
 738  * \param tag   destination buffer for the tag.
 739  * \param len   tag length (16 bytes or less).
 740  */
 741 void br_eax_get_tag_trunc(br_eax_context *ctx, void *tag, size_t len);
 742
 743 /**
 744  * \brief Compute and check EAX authentication tag (with truncation).
 745  *
 746  * This function is an alternative to `br_eax_get_tag_trunc()`, normally used
 747  * on the receiving end (i.e. when decrypting value). The tag value is
 748  * recomputed and compared with the provided tag value. If they match, 1
 749  * is returned; on mismatch, 0 is returned. A returned value of 0 means
 750  * that the data or the tag was altered in transit, normally leading to
 751  * wholesale rejection of the complete message.
 752  *
 753  * Tag length MUST be 16 bytes or less. The normal EAX tag length is 16
 754  * bytes. See `br_check_tag_trunc()` for some discussion on the potential
 755  * perils of truncating authentication tags.
 756  *
 757  * \param ctx   EAX context structure.
 758  * \param tag   tag value to compare with.
 759  * \param len   tag length (in bytes).
 760  * \return  1 on success (exact match of tag value), 0 otherwise.
 761  */
 762 uint32_t br_eax_check_tag_trunc(br_eax_context *ctx,
 763         const void *tag, size_t len);
 764
 765 /**
 766  * \brief Class instance for EAX.
 767  */
 768 extern const br_aead_class br_eax_vtable;
 769
 770 /**
 771  * \brief Context structure for CCM.
 772  *
 773  * CCM is an AEAD mode that combines a block cipher in CTR mode with
 774  * CBC-MAC using the same block cipher and the same key, to provide
 775  * authenticated encryption:
 776  *
 777  *   - Any block cipher with 16-byte blocks can be used with CCM
 778  *     (technically, other block sizes are defined as well, but this
 779  *     is not implemented by these functions; shorter blocks also
 780  *     imply numerous security issues).
 781  *
 782  *   - The authentication tag length, and plaintext length, MUST be
 783  *     known when starting processing data. Plaintext and ciphertext
 784  *     can still be provided by chunks, but the total size must match
 785  *     the value provided upon initialisation.
 786  *
 787  *   - The nonce length is constrained betwen 7 and 13 bytes (inclusive).
 788  *     Furthermore, the plaintext length, when encoded, must fit over
 789  *     15-nonceLen bytes; thus, if the nonce has length 13 bytes, then
 790  *     the plaintext length cannot exceed 65535 bytes.
 791  *
 792  *   - Additional authenticated data length is practically unlimited
 793  *     (formal limit is at 2^64 bytes).
 794  *
 795  *   - The authentication tag has length 4 to 16 bytes (even values only).
 796  *
 797  * The CCM initialisation function receives as parameter an
 798  * _initialised_ block cipher implementation context, with the secret
 799  * key already set. A pointer to that context will be kept within the
 800  * CCM context structure. It is up to the caller to allocate and
 801  * initialise that block cipher context.
 802  */
 803 typedef struct {
 804 #ifndef BR_DOXYGEN_IGNORE
 805         const br_block_ctrcbc_class **bctx;
 806         unsigned char ctr[16];
 807         unsigned char cbcmac[16];
 808         unsigned char tagmask[16];
 809         unsigned char buf[16];
 810         size_t ptr;
 811         size_t tag_len;
 812 #endif
 813 } br_ccm_context;
 814
 815 /**
 816  * \brief Initialize a CCM context.
 817  *
 818  * A block cipher implementation, with its initialised context
 819  * structure, is provided. The block cipher MUST use 16-byte blocks in
 820  * CTR + CBC-MAC mode, and its secret key MUST have been already set in
 821  * the provided context. The parameters are linked in the CCM context.
 822  *
 823  * After this function has been called, the `br_ccm_reset()` function must
 824  * be called, to provide the nonce for CCM computation.
 825  *
 826  * \param ctx    CCM context structure.
 827  * \param bctx   block cipher context (already initialised with secret key).
 828  */
 829 void br_ccm_init(br_ccm_context *ctx, const br_block_ctrcbc_class **bctx);
 830
 831 /**
 832  * \brief Reset a CCM context.
 833  *
 834  * This function resets an already initialised CCM context for a new
 835  * computation run. Implementations and keys are conserved. This function
 836  * can be called at any time; it cancels any ongoing CCM computation that
 837  * uses the provided context structure.
 838  *
 839  * The `aad_len` parameter contains the total length, in bytes, of the
 840  * additional authenticated data. It may be zero. That length MUST be
 841  * exact.
 842  *
 843  * The `data_len` parameter contains the total length, in bytes, of the
 844  * data that will be injected (plaintext or ciphertext). That length MUST
 845  * be exact. Moreover, that length MUST be less than 2^(8*(15-nonce_len)).
 846  *
 847  * The nonce length (`nonce_len`), in bytes, must be in the 7..13 range
 848  * (inclusive).
 849  *
 850  * The tag length (`tag_len`), in bytes, must be in the 4..16 range, and
 851  * be an even integer. Short tags mechanically allow for higher forgery
 852  * probabilities; hence, tag sizes smaller than 12 bytes shall be used only
 853  * with care.
 854  *
 855  * It is critical to CCM security that nonce values are not repeated for
 856  * the same encryption key. Random generation of nonces is not generally
 857  * recommended, due to the relatively small maximum nonce value.
 858  *
 859  * Returned value is 1 on success, 0 on error. An error is reported if
 860  * the tag or nonce length is out of range, or if the
 861  * plaintext/ciphertext length cannot be encoded with the specified
 862  * nonce length.
 863  *
 864  * \param ctx         CCM context structure.
 865  * \param nonce       CCM nonce to use.
 866  * \param nonce_len   CCM nonce length (in bytes, 7 to 13).
 867  * \param aad_len     additional authenticated data length (in bytes).
 868  * \param data_len    plaintext/ciphertext length (in bytes).
 869  * \param tag_len     tag length (in bytes).
 870  * \return  1 on success, 0 on error.
 871  */
 872 int br_ccm_reset(br_ccm_context *ctx, const void *nonce, size_t nonce_len,
 873         uint64_t aad_len, uint64_t data_len, size_t tag_len);
 874
 875 /**
 876  * \brief Inject additional authenticated data into CCM.
 877  *
 878  * The provided data is injected into a running CCM computation. Additional
 879  * data must be injected _before_ the call to `br_ccm_flip()`.
 880  * Additional data can be injected in several chunks of arbitrary length,
 881  * but the total amount MUST exactly match the value which was provided
 882  * to `br_ccm_reset()`.
 883  *
 884  * \param ctx    CCM context structure.
 885  * \param data   pointer to additional authenticated data.
 886  * \param len    length of additional authenticated data (in bytes).
 887  */
 888 void br_ccm_aad_inject(br_ccm_context *ctx, const void *data, size_t len);
 889
 890 /**
 891  * \brief Finish injection of additional authenticated data into CCM.
 892  *
 893  * This function MUST be called before beginning the actual encryption
 894  * or decryption (with `br_ccm_run()`), even if no additional authenticated
 895  * data was injected. No additional authenticated data may be injected
 896  * after this function call.
 897  *
 898  * \param ctx   CCM context structure.
 899  */
 900 void br_ccm_flip(br_ccm_context *ctx);
 901
 902 /**
 903  * \brief Encrypt or decrypt some data with CCM.
 904  *
 905  * Data encryption or decryption can be done after `br_ccm_flip()`
 906  * has been called on the context. If `encrypt` is non-zero, then the
 907  * provided data shall be plaintext, and it is encrypted in place.
 908  * Otherwise, the data shall be ciphertext, and it is decrypted in place.
 909  *
 910  * Data may be provided in several chunks of arbitrary length, provided
 911  * that the total length exactly matches the length provided to the
 912  * `br_ccm_reset()` call.
 913  *
 914  * \param ctx       CCM context structure.
 915  * \param encrypt   non-zero for encryption, zero for decryption.
 916  * \param data      data to encrypt or decrypt.
 917  * \param len       data length (in bytes).
 918  */
 919 void br_ccm_run(br_ccm_context *ctx, int encrypt, void *data, size_t len);
 920
 921 /**
 922  * \brief Compute CCM authentication tag.
 923  *
 924  * Compute the CCM authentication tag. This call terminates the CCM
 925  * run: all data must have been injected with `br_ccm_run()` (in zero,
 926  * one or more successive calls). After this function has been called,
 927  * no more data can br processed; a `br_ccm_reset()` call is required
 928  * to start a new message.
 929  *
 930  * The tag length was provided upon context initialisation (last call
 931  * to `br_ccm_reset()`); it is returned by this function.
 932  *
 933  * The tag value must normally be sent along with the encrypted data.
 934  * When decrypting, the tag value must be recomputed and compared with
 935  * the received tag: if the two tag values differ, then either the tag
 936  * or the encrypted data was altered in transit. As an alternative to
 937  * this function, the `br_ccm_check_tag()` function can be used to
 938  * compute and check the tag value.
 939  *
 940  * \param ctx   CCM context structure.
 941  * \param tag   destination buffer for the tag (up to 16 bytes).
 942  * \return  the tag length (in bytes).
 943  */
 944 size_t br_ccm_get_tag(br_ccm_context *ctx, void *tag);
 945
 946 /**
 947  * \brief Compute and check CCM authentication tag.
 948  *
 949  * This function is an alternative to `br_ccm_get_tag()`, normally used
 950  * on the receiving end (i.e. when decrypting value). The tag value is
 951  * recomputed and compared with the provided tag value. If they match, 1
 952  * is returned; on mismatch, 0 is returned. A returned value of 0 means
 953  * that the data or the tag was altered in transit, normally leading to
 954  * wholesale rejection of the complete message.
 955  *
 956  * \param ctx   CCM context structure.
 957  * \param tag   tag value to compare with (up to 16 bytes).
 958  * \return  1 on success (exact match of tag value), 0 otherwise.
 959  */
 960 uint32_t br_ccm_check_tag(br_ccm_context *ctx, const void *tag);
 961
 962 #ifdef __cplusplus
 963 }
 964 #endif
 965
 966 #endif