1 /** 2 * \file gcm.h 3 * 4 * \brief This file contains GCM definitions and functions. 5 * 6 * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined 7 * in <em>D. McGrew, J. Viega, The Galois/Counter Mode of Operation 8 * (GCM), Natl. Inst. Stand. Technol.</em> 9 * 10 * For more information on GCM, see <em>NIST SP 800-38D: Recommendation for 11 * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC</em>. 12 * 13 */ 14 /* 15 * Copyright The Mbed TLS Contributors 16 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 17 */ 18 19 #ifndef MBEDTLS_GCM_H 20 #define MBEDTLS_GCM_H 21 #include "mbedtls/private_access.h" 22 23 #include "mbedtls/build_info.h" 24 25 #include "mbedtls/cipher.h" 26 27 #include <stdint.h> 28 29 #define MBEDTLS_GCM_ENCRYPT 1 30 #define MBEDTLS_GCM_DECRYPT 0 31 32 /** Authenticated decryption failed. */ 33 #define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 34 /** Bad input parameters to function. */ 35 #define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 36 /** An output buffer is too small. */ 37 #define MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL -0x0016 38 39 #ifdef __cplusplus 40 extern "C" { 41 #endif 42 43 #if !defined(MBEDTLS_GCM_ALT) 44 45 /** 46 * \brief The GCM context structure. 47 */ 48 typedef struct mbedtls_gcm_context { 49 mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher_ctx); /*!< The cipher context used. */ 50 uint64_t MBEDTLS_PRIVATE(HL)[16]; /*!< Precalculated HTable low. */ 51 uint64_t MBEDTLS_PRIVATE(HH)[16]; /*!< Precalculated HTable high. */ 52 uint64_t MBEDTLS_PRIVATE(len); /*!< The total length of the encrypted data. */ 53 uint64_t MBEDTLS_PRIVATE(add_len); /*!< The total length of the additional data. */ 54 unsigned char MBEDTLS_PRIVATE(base_ectr)[16]; /*!< The first ECTR for tag. */ 55 unsigned char MBEDTLS_PRIVATE(y)[16]; /*!< The Y working value. */ 56 unsigned char MBEDTLS_PRIVATE(buf)[16]; /*!< The buf working value. */ 57 int MBEDTLS_PRIVATE(mode); /*!< The operation to perform: 58 #MBEDTLS_GCM_ENCRYPT or 59 #MBEDTLS_GCM_DECRYPT. */ 60 } 61 mbedtls_gcm_context; 62 63 #else /* !MBEDTLS_GCM_ALT */ 64 #include "gcm_alt.h" 65 #endif /* !MBEDTLS_GCM_ALT */ 66 67 /** 68 * \brief This function initializes the specified GCM context, 69 * to make references valid, and prepares the context 70 * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). 71 * 72 * The function does not bind the GCM context to a particular 73 * cipher, nor set the key. For this purpose, use 74 * mbedtls_gcm_setkey(). 75 * 76 * \param ctx The GCM context to initialize. This must not be \c NULL. 77 */ 78 void mbedtls_gcm_init(mbedtls_gcm_context *ctx); 79 80 /** 81 * \brief This function associates a GCM context with a 82 * cipher algorithm and a key. 83 * 84 * \param ctx The GCM context. This must be initialized. 85 * \param cipher The 128-bit block cipher to use. 86 * \param key The encryption key. This must be a readable buffer of at 87 * least \p keybits bits. 88 * \param keybits The key size in bits. Valid options are: 89 * <ul><li>128 bits</li> 90 * <li>192 bits</li> 91 * <li>256 bits</li></ul> 92 * 93 * \return \c 0 on success. 94 * \return A cipher-specific error code on failure. 95 */ 96 int mbedtls_gcm_setkey(mbedtls_gcm_context *ctx, 97 mbedtls_cipher_id_t cipher, 98 const unsigned char *key, 99 unsigned int keybits); 100 101 /** 102 * \brief This function performs GCM encryption or decryption of a buffer. 103 * 104 * \note For encryption, the output buffer can be the same as the 105 * input buffer. For decryption, the output buffer cannot be 106 * the same as input buffer. If the buffers overlap, the output 107 * buffer must trail at least 8 Bytes behind the input buffer. 108 * 109 * \warning When this function performs a decryption, it outputs the 110 * authentication tag and does not verify that the data is 111 * authentic. You should use this function to perform encryption 112 * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. 113 * 114 * \param ctx The GCM context to use for encryption or decryption. This 115 * must be initialized. 116 * \param mode The operation to perform: 117 * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. 118 * The ciphertext is written to \p output and the 119 * authentication tag is written to \p tag. 120 * - #MBEDTLS_GCM_DECRYPT to perform decryption. 121 * The plaintext is written to \p output and the 122 * authentication tag is written to \p tag. 123 * Note that this mode is not recommended, because it does 124 * not verify the authenticity of the data. For this reason, 125 * you should use mbedtls_gcm_auth_decrypt() instead of 126 * calling this function in decryption mode. 127 * \param length The length of the input data, which is equal to the length 128 * of the output data. 129 * \param iv The initialization vector. This must be a readable buffer of 130 * at least \p iv_len Bytes. 131 * \param iv_len The length of the IV. 132 * \param add The buffer holding the additional data. This must be of at 133 * least that size in Bytes. 134 * \param add_len The length of the additional data. 135 * \param input The buffer holding the input data. If \p length is greater 136 * than zero, this must be a readable buffer of at least that 137 * size in Bytes. 138 * \param output The buffer for holding the output data. If \p length is greater 139 * than zero, this must be a writable buffer of at least that 140 * size in Bytes. 141 * \param tag_len The length of the tag to generate. 142 * \param tag The buffer for holding the tag. This must be a writable 143 * buffer of at least \p tag_len Bytes. 144 * 145 * \return \c 0 if the encryption or decryption was performed 146 * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, 147 * this does not indicate that the data is authentic. 148 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 149 * not valid or a cipher-specific error code if the encryption 150 * or decryption failed. 151 */ 152 int mbedtls_gcm_crypt_and_tag(mbedtls_gcm_context *ctx, 153 int mode, 154 size_t length, 155 const unsigned char *iv, 156 size_t iv_len, 157 const unsigned char *add, 158 size_t add_len, 159 const unsigned char *input, 160 unsigned char *output, 161 size_t tag_len, 162 unsigned char *tag); 163 164 /** 165 * \brief This function performs a GCM authenticated decryption of a 166 * buffer. 167 * 168 * \note For decryption, the output buffer cannot be the same as 169 * input buffer. If the buffers overlap, the output buffer 170 * must trail at least 8 Bytes behind the input buffer. 171 * 172 * \param ctx The GCM context. This must be initialized. 173 * \param length The length of the ciphertext to decrypt, which is also 174 * the length of the decrypted plaintext. 175 * \param iv The initialization vector. This must be a readable buffer 176 * of at least \p iv_len Bytes. 177 * \param iv_len The length of the IV. 178 * \param add The buffer holding the additional data. This must be of at 179 * least that size in Bytes. 180 * \param add_len The length of the additional data. 181 * \param tag The buffer holding the tag to verify. This must be a 182 * readable buffer of at least \p tag_len Bytes. 183 * \param tag_len The length of the tag to verify. 184 * \param input The buffer holding the ciphertext. If \p length is greater 185 * than zero, this must be a readable buffer of at least that 186 * size. 187 * \param output The buffer for holding the decrypted plaintext. If \p length 188 * is greater than zero, this must be a writable buffer of at 189 * least that size. 190 * 191 * \return \c 0 if successful and authenticated. 192 * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. 193 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 194 * not valid or a cipher-specific error code if the decryption 195 * failed. 196 */ 197 int mbedtls_gcm_auth_decrypt(mbedtls_gcm_context *ctx, 198 size_t length, 199 const unsigned char *iv, 200 size_t iv_len, 201 const unsigned char *add, 202 size_t add_len, 203 const unsigned char *tag, 204 size_t tag_len, 205 const unsigned char *input, 206 unsigned char *output); 207 208 /** 209 * \brief This function starts a GCM encryption or decryption 210 * operation. 211 * 212 * \param ctx The GCM context. This must be initialized. 213 * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or 214 * #MBEDTLS_GCM_DECRYPT. 215 * \param iv The initialization vector. This must be a readable buffer of 216 * at least \p iv_len Bytes. 217 * \param iv_len The length of the IV. 218 * 219 * \return \c 0 on success. 220 */ 221 int mbedtls_gcm_starts(mbedtls_gcm_context *ctx, 222 int mode, 223 const unsigned char *iv, 224 size_t iv_len); 225 226 /** 227 * \brief This function feeds an input buffer as associated data 228 * (authenticated but not encrypted data) in a GCM 229 * encryption or decryption operation. 230 * 231 * Call this function after mbedtls_gcm_starts() to pass 232 * the associated data. If the associated data is empty, 233 * you do not need to call this function. You may not 234 * call this function after calling mbedtls_cipher_update(). 235 * 236 * \param ctx The GCM context. This must have been started with 237 * mbedtls_gcm_starts() and must not have yet received 238 * any input with mbedtls_gcm_update(). 239 * \param add The buffer holding the additional data, or \c NULL 240 * if \p add_len is \c 0. 241 * \param add_len The length of the additional data. If \c 0, 242 * \p add may be \c NULL. 243 * 244 * \return \c 0 on success. 245 */ 246 int mbedtls_gcm_update_ad(mbedtls_gcm_context *ctx, 247 const unsigned char *add, 248 size_t add_len); 249 250 /** 251 * \brief This function feeds an input buffer into an ongoing GCM 252 * encryption or decryption operation. 253 * 254 * You may call this function zero, one or more times 255 * to pass successive parts of the input: the plaintext to 256 * encrypt, or the ciphertext (not including the tag) to 257 * decrypt. After the last part of the input, call 258 * mbedtls_gcm_finish(). 259 * 260 * This function may produce output in one of the following 261 * ways: 262 * - Immediate output: the output length is always equal 263 * to the input length. 264 * - Buffered output: the output consists of a whole number 265 * of 16-byte blocks. If the total input length so far 266 * (not including associated data) is 16 \* *B* + *A* 267 * with *A* < 16 then the total output length is 16 \* *B*. 268 * 269 * In particular: 270 * - It is always correct to call this function with 271 * \p output_size >= \p input_length + 15. 272 * - If \p input_length is a multiple of 16 for all the calls 273 * to this function during an operation, then it is 274 * correct to use \p output_size = \p input_length. 275 * 276 * \note For decryption, the output buffer cannot be the same as 277 * input buffer. If the buffers overlap, the output buffer 278 * must trail at least 8 Bytes behind the input buffer. 279 * 280 * \param ctx The GCM context. This must be initialized. 281 * \param input The buffer holding the input data. If \p input_length 282 * is greater than zero, this must be a readable buffer 283 * of at least \p input_length bytes. 284 * \param input_length The length of the input data in bytes. 285 * \param output The buffer for the output data. If \p output_size 286 * is greater than zero, this must be a writable buffer of 287 * of at least \p output_size bytes. 288 * \param output_size The size of the output buffer in bytes. 289 * See the function description regarding the output size. 290 * \param output_length On success, \p *output_length contains the actual 291 * length of the output written in \p output. 292 * On failure, the content of \p *output_length is 293 * unspecified. 294 * 295 * \return \c 0 on success. 296 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: 297 * total input length too long, 298 * unsupported input/output buffer overlap detected, 299 * or \p output_size too small. 300 */ 301 int mbedtls_gcm_update(mbedtls_gcm_context *ctx, 302 const unsigned char *input, size_t input_length, 303 unsigned char *output, size_t output_size, 304 size_t *output_length); 305 306 /** 307 * \brief This function finishes the GCM operation and generates 308 * the authentication tag. 309 * 310 * It wraps up the GCM stream, and generates the 311 * tag. The tag can have a maximum length of 16 Bytes. 312 * 313 * \param ctx The GCM context. This must be initialized. 314 * \param tag The buffer for holding the tag. This must be a writable 315 * buffer of at least \p tag_len Bytes. 316 * \param tag_len The length of the tag to generate. This must be at least 317 * four. 318 * \param output The buffer for the final output. 319 * If \p output_size is nonzero, this must be a writable 320 * buffer of at least \p output_size bytes. 321 * \param output_size The size of the \p output buffer in bytes. 322 * This must be large enough for the output that 323 * mbedtls_gcm_update() has not produced. In particular: 324 * - If mbedtls_gcm_update() produces immediate output, 325 * or if the total input size is a multiple of \c 16, 326 * then mbedtls_gcm_finish() never produces any output, 327 * so \p output_size can be \c 0. 328 * - \p output_size never needs to be more than \c 15. 329 * \param output_length On success, \p *output_length contains the actual 330 * length of the output written in \p output. 331 * On failure, the content of \p *output_length is 332 * unspecified. 333 * 334 * \return \c 0 on success. 335 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: 336 * invalid value of \p tag_len, 337 * or \p output_size too small. 338 */ 339 int mbedtls_gcm_finish(mbedtls_gcm_context *ctx, 340 unsigned char *output, size_t output_size, 341 size_t *output_length, 342 unsigned char *tag, size_t tag_len); 343 344 /** 345 * \brief This function clears a GCM context and the underlying 346 * cipher sub-context. 347 * 348 * \param ctx The GCM context to clear. If this is \c NULL, the call has 349 * no effect. Otherwise, this must be initialized. 350 */ 351 void mbedtls_gcm_free(mbedtls_gcm_context *ctx); 352 353 #if defined(MBEDTLS_SELF_TEST) 354 355 /** 356 * \brief The GCM checkup routine. 357 * 358 * \return \c 0 on success. 359 * \return \c 1 on failure. 360 */ 361 int mbedtls_gcm_self_test(int verbose); 362 363 #endif /* MBEDTLS_SELF_TEST */ 364 365 #ifdef __cplusplus 366 } 367 #endif 368 369 370 #endif /* gcm.h */ 371
