kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Restore H (the key) in the GHASH context.

Browse Source 
This was removed in a00cafc50c because
none of the assembly actually appeared to need it. However, we found the
assembly the uses it: the MOVBE-based, x86-64 code.

Needing H seems silly since Htable is there, but rather than mess with
the assembly, it's easier to put H back in the structure—now with a
better comment.

Change-Id: Ie038cc4482387264d5e0821664fb41f575826d6f
Reviewed-on: https://boringssl-review.googlesource.com/13122
Reviewed-by: Adam Langley <alangley@gmail.com>
This commit is contained in:
Adam Langley 2017-01-12 16:15:20 -08:00
parent 67ccf59161
commit abb32cc00d
3 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
crypto/modes/gcm.c
View File

@ -351,7 +351,8 @@ void gcm_ghash_p8(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
#endif
void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
u128 out_table[16], const uint8_t *gcm_key) {
u128 *out_key, u128 out_table[16],
const uint8_t *gcm_key) {
union {
uint64_t u[2];
uint8_t c[16];
@ -363,6 +364,8 @@ void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
H.u[0] = CRYPTO_bswap8(H.u[0]);
H.u[1] = CRYPTO_bswap8(H.u[1]);
OPENSSL_memcpy(out_key, H.c, 16);
#if defined(GHASH_ASM_X86_64)
if (crypto_gcm_clmul_enabled()) {
if (((OPENSSL_ia32cap_P[1] >> 22) & 0x41) == 0x41) { /* AVX+MOVBE */
@ -425,7 +428,7 @@ void CRYPTO_gcm128_init(GCM128_CONTEXT *ctx, const void *aes_key,
OPENSSL_memset(gcm_key, 0, sizeof(gcm_key));
(*block)(gcm_key, gcm_key, aes_key);
CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, ctx->Htable, gcm_key);
CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, &ctx->H, ctx->Htable, gcm_key);
}
void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx, const void *key,

9
crypto/modes/internal.h
View File

@ -150,6 +150,9 @@ struct gcm128_context {
size_t t[16 / sizeof(size_t)];
} Yi, EKi, EK0, len, Xi;
/* Note that the order of |Xi|, |H| and |Htable| is fixed by the MOVBE-based,
* x86-64, GHASH assembly. */
u128 H;
u128 Htable[16];
gmult_func gmult;
ghash_func ghash;
@ -211,7 +214,8 @@ typedef struct gcm128_context GCM128_CONTEXT;
* |out_table| and sets |*out_mult| and |*out_hash| to (potentially hardware
* accelerated) functions for performing operations in the GHASH field. */
void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
u128 out_table[16], const uint8_t *gcm_key);
u128 *out_key, u128 out_table[16],
const uint8_t *gcm_key);
/* CRYPTO_gcm128_init initialises |ctx| to use |block| (typically AES) with
* the given key. */
@ -348,7 +352,10 @@ typedef union {
} polyval_block;
struct polyval_ctx {
/* Note that the order of |S|, |H| and |Htable| is fixed by the MOVBE-based,
* x86-64, GHASH assembly. */
polyval_block S;
u128 H;
u128 Htable[16];
gmult_func gmult;
ghash_func ghash;

2
crypto/modes/polyval.c
View File

@ -57,7 +57,7 @@ void CRYPTO_POLYVAL_init(struct polyval_ctx *ctx, const uint8_t key[16]) {
OPENSSL_memcpy(H.c, key, 16);
reverse_and_mulX_ghash(&H);
CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, ctx->Htable, H.c);
CRYPTO_ghash_init(&ctx->gmult, &ctx->ghash, &ctx->H, ctx->Htable, H.c);
OPENSSL_memset(&ctx->S, 0, sizeof(ctx->S));
}