Botan 2.19.5
Crypto and TLS for C&
xts.cpp
Go to the documentation of this file.
1/*
2* XTS Mode
3* (C) 2009,2013 Jack Lloyd
4* (C) 2016 Daniel Neus, Rohde & Schwarz Cybersecurity
5*
6* Botan is released under the Simplified BSD License (see license.txt)
7*/
8
9#include <botan/xts.h>
10#include <botan/internal/poly_dbl.h>
11
12namespace Botan {
13
15 m_cipher(cipher),
16 m_cipher_block_size(m_cipher->block_size()),
17 m_cipher_parallelism(m_cipher->parallel_bytes())
18 {
19 if(poly_double_supported_size(m_cipher_block_size) == false)
20 {
21 throw Invalid_Argument("Cannot use " + cipher->name() + " with XTS");
22 }
23
24 m_tweak_cipher.reset(m_cipher->clone());
25 }
26
28 {
29 m_cipher->clear();
30 m_tweak_cipher->clear();
31 reset();
32 }
33
35 {
36 m_tweak.clear();
37 }
38
39std::string XTS_Mode::name() const
40 {
41 return cipher().name() + "/XTS";
42 }
43
45 {
46 return cipher_block_size();
47 }
48
53
55 {
56 return cipher_block_size();
57 }
58
59bool XTS_Mode::valid_nonce_length(size_t n) const
60 {
61 return n <= cipher_block_size();
62 }
63
64void XTS_Mode::key_schedule(const uint8_t key[], size_t length)
65 {
66 const size_t key_half = length / 2;
67
68 if(length % 2 == 1 || !m_cipher->valid_keylength(key_half))
69 throw Invalid_Key_Length(name(), length);
70
71 m_cipher->set_key(key, key_half);
72 m_tweak_cipher->set_key(&key[key_half], key_half);
73 }
74
75void XTS_Mode::start_msg(const uint8_t nonce[], size_t nonce_len)
76 {
77 if(!valid_nonce_length(nonce_len))
78 throw Invalid_IV_Length(name(), nonce_len);
79
80 m_tweak.resize(update_granularity());
81 clear_mem(m_tweak.data(), m_tweak.size());
82 copy_mem(m_tweak.data(), nonce, nonce_len);
83 m_tweak_cipher->encrypt(m_tweak.data());
84
85 update_tweak(0);
86 }
87
88void XTS_Mode::update_tweak(size_t which)
89 {
90 const size_t BS = m_tweak_cipher->block_size();
91
92 if(which > 0)
93 poly_double_n_le(m_tweak.data(), &m_tweak[(which-1)*BS], BS);
94
95 const size_t blocks_in_tweak = update_granularity() / BS;
96
97 for(size_t i = 1; i < blocks_in_tweak; ++i)
98 poly_double_n_le(&m_tweak[i*BS], &m_tweak[(i-1)*BS], BS);
99 }
100
101size_t XTS_Encryption::output_length(size_t input_length) const
102 {
103 return input_length;
104 }
105
106size_t XTS_Encryption::process(uint8_t buf[], size_t sz)
107 {
109 const size_t BS = cipher_block_size();
110
111 BOTAN_ASSERT(sz % BS == 0, "Input is full blocks");
112 size_t blocks = sz / BS;
113
114 const size_t blocks_in_tweak = update_granularity() / BS;
115
116 while(blocks)
117 {
118 const size_t to_proc = std::min(blocks, blocks_in_tweak);
119
120 cipher().encrypt_n_xex(buf, tweak(), to_proc);
121
122 buf += to_proc * BS;
123 blocks -= to_proc;
124
125 update_tweak(to_proc);
126 }
127
128 return sz;
129 }
130
132 {
133 BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane");
134 const size_t sz = buffer.size() - offset;
135 uint8_t* buf = buffer.data() + offset;
136
137 BOTAN_ASSERT(sz >= minimum_final_size(), "Have sufficient final input in XTS encrypt");
138
139 const size_t BS = cipher_block_size();
140
141 if(sz % BS == 0)
142 {
143 update(buffer, offset);
144 }
145 else
146 {
147 // steal ciphertext
148 const size_t full_blocks = ((sz / BS) - 1) * BS;
149 const size_t final_bytes = sz - full_blocks;
150 BOTAN_ASSERT(final_bytes > BS && final_bytes < 2*BS, "Left over size in expected range");
151
152 secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);
153 buffer.resize(full_blocks + offset);
154 update(buffer, offset);
155
156 xor_buf(last, tweak(), BS);
157 cipher().encrypt(last);
158 xor_buf(last, tweak(), BS);
159
160 for(size_t i = 0; i != final_bytes - BS; ++i)
161 {
162 last[i] ^= last[i + BS];
163 last[i + BS] ^= last[i];
164 last[i] ^= last[i + BS];
165 }
166
167 xor_buf(last, tweak() + BS, BS);
168 cipher().encrypt(last);
169 xor_buf(last, tweak() + BS, BS);
170
171 buffer += last;
172 }
173 }
174
175size_t XTS_Decryption::output_length(size_t input_length) const
176 {
177 return input_length;
178 }
179
180size_t XTS_Decryption::process(uint8_t buf[], size_t sz)
181 {
183 const size_t BS = cipher_block_size();
184
185 BOTAN_ASSERT(sz % BS == 0, "Input is full blocks");
186 size_t blocks = sz / BS;
187
188 const size_t blocks_in_tweak = update_granularity() / BS;
189
190 while(blocks)
191 {
192 const size_t to_proc = std::min(blocks, blocks_in_tweak);
193
194 cipher().decrypt_n_xex(buf, tweak(), to_proc);
195
196 buf += to_proc * BS;
197 blocks -= to_proc;
198
199 update_tweak(to_proc);
200 }
201
202 return sz;
203 }
204
206 {
207 BOTAN_ASSERT(buffer.size() >= offset, "Offset is sane");
208 const size_t sz = buffer.size() - offset;
209 uint8_t* buf = buffer.data() + offset;
210
211 BOTAN_ASSERT(sz >= minimum_final_size(), "Have sufficient final input in XTS decrypt");
212
213 const size_t BS = cipher_block_size();
214
215 if(sz % BS == 0)
216 {
217 update(buffer, offset);
218 }
219 else
220 {
221 // steal ciphertext
222 const size_t full_blocks = ((sz / BS) - 1) * BS;
223 const size_t final_bytes = sz - full_blocks;
224 BOTAN_ASSERT(final_bytes > BS && final_bytes < 2*BS, "Left over size in expected range");
225
226 secure_vector<uint8_t> last(buf + full_blocks, buf + full_blocks + final_bytes);
227 buffer.resize(full_blocks + offset);
228 update(buffer, offset);
229
230 xor_buf(last, tweak() + BS, BS);
231 cipher().decrypt(last);
232 xor_buf(last, tweak() + BS, BS);
233
234 for(size_t i = 0; i != final_bytes - BS; ++i)
235 {
236 last[i] ^= last[i + BS];
237 last[i + BS] ^= last[i];
238 last[i] ^= last[i + BS];
239 }
240
241 xor_buf(last, tweak(), BS);
242 cipher().decrypt(last);
243 xor_buf(last, tweak(), BS);
244
245 buffer += last;
246 }
247 }
248
249}
#define BOTAN_STATE_CHECK(expr)
Definition assert.h:49
#define BOTAN_ASSERT(expr, assertion_made)
Definition assert.h:55
void encrypt(const uint8_t in[], uint8_t out[]) const
void decrypt(const uint8_t in[], uint8_t out[]) const
virtual void encrypt_n_xex(uint8_t data[], const uint8_t mask[], size_t blocks) const
virtual void decrypt_n_xex(uint8_t data[], const uint8_t mask[], size_t blocks) const
Key_Length_Specification multiple(size_t n) const
Definition sym_algo.h:88
virtual std::string name() const =0
virtual Key_Length_Specification key_spec() const =0
size_t output_length(size_t input_length) const override
Definition xts.cpp:175
void finish(secure_vector< uint8_t > &final_block, size_t offset=0) override
Definition xts.cpp:205
size_t process(uint8_t buf[], size_t size) override
Definition xts.cpp:180
void finish(secure_vector< uint8_t > &final_block, size_t offset=0) override
Definition xts.cpp:131
size_t output_length(size_t input_length) const override
Definition xts.cpp:101
size_t process(uint8_t buf[], size_t size) override
Definition xts.cpp:106
std::string name() const override
Definition xts.cpp:39
const uint8_t * tweak() const
Definition xts.h:44
Key_Length_Specification key_spec() const override
Definition xts.cpp:49
size_t cipher_block_size() const
Definition xts.h:52
XTS_Mode(BlockCipher *cipher)
Definition xts.cpp:14
size_t minimum_final_size() const override
Definition xts.cpp:44
void clear() override
Definition xts.cpp:27
size_t update_granularity() const override
Definition xts.h:27
const BlockCipher & cipher() const
Definition xts.h:48
size_t default_nonce_length() const override
Definition xts.cpp:54
void reset() override
Definition xts.cpp:34
void update_tweak(size_t last_used)
Definition xts.cpp:88
bool tweak_set() const
Definition xts.h:46
bool valid_nonce_length(size_t n) const override
Definition xts.cpp:59
int(* update)(CTX *, const void *, CC_LONG len)
void poly_double_n_le(uint8_t out[], const uint8_t in[], size_t n)
Definition poly_dbl.cpp:94
void copy_mem(T *out, const T *in, size_t n)
Definition mem_ops.h:133
void xor_buf(uint8_t out[], const uint8_t in[], size_t length)
Definition mem_ops.h:262
bool poly_double_supported_size(size_t n)
Definition poly_dbl.h:22
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:65
void clear_mem(T *ptr, size_t n)
Definition mem_ops.h:115