diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj b/builds/msvc/vs2010/libsodium/libsodium.vcxproj index 4b491d42..2ac4ca21 100644 --- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj @@ -164,10 +164,10 @@ + - - - + + @@ -316,10 +316,11 @@ - - - - + + + + + diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters index 3c4c2d8b..8041203d 100644 --- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters @@ -315,17 +315,17 @@ crypto_aead\xchacha20poly1305\sodium + + crypto_aead\aegis128l + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft - - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -767,17 +767,20 @@ crypto_stream\salsa20\xmm6 - + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft + + crypto_aead\aegis128l - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l + + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -826,15 +829,6 @@ {9e2a023d-fef1-3231-90ba-9a0ffc9bc9ab} - - {77ed2f29-bed2-35a2-acce-0c09b665d57b} - - - {2abca274-f068-3cf1-bd4e-5bfc5ee81de6} - - - {f606c11a-a160-3619-b842-8e8cce100ba7} - {6897a4cc-0091-3970-b712-c0ac75c16b67} diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj b/builds/msvc/vs2012/libsodium/libsodium.vcxproj index 97e42c28..98a07971 100644 --- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj @@ -164,10 +164,10 @@ + - - - + + @@ -316,10 +316,11 @@ - - - - + + + + + diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters index 3c4c2d8b..8041203d 100644 --- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters @@ -315,17 +315,17 @@ crypto_aead\xchacha20poly1305\sodium + + crypto_aead\aegis128l + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft - - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -767,17 +767,20 @@ crypto_stream\salsa20\xmm6 - + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft + + crypto_aead\aegis128l - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l + + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -826,15 +829,6 @@ {9e2a023d-fef1-3231-90ba-9a0ffc9bc9ab} - - {77ed2f29-bed2-35a2-acce-0c09b665d57b} - - - {2abca274-f068-3cf1-bd4e-5bfc5ee81de6} - - - {f606c11a-a160-3619-b842-8e8cce100ba7} - {6897a4cc-0091-3970-b712-c0ac75c16b67} diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj b/builds/msvc/vs2013/libsodium/libsodium.vcxproj index 8ed0ef2b..a7aa674b 100644 --- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj @@ -164,10 +164,10 @@ + - - - + + @@ -316,10 +316,11 @@ - - - - + + + + + diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters index 3c4c2d8b..8041203d 100644 --- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters @@ -315,17 +315,17 @@ crypto_aead\xchacha20poly1305\sodium + + crypto_aead\aegis128l + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft - - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -767,17 +767,20 @@ crypto_stream\salsa20\xmm6 - + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft + + crypto_aead\aegis128l - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l + + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -826,15 +829,6 @@ {9e2a023d-fef1-3231-90ba-9a0ffc9bc9ab} - - {77ed2f29-bed2-35a2-acce-0c09b665d57b} - - - {2abca274-f068-3cf1-bd4e-5bfc5ee81de6} - - - {f606c11a-a160-3619-b842-8e8cce100ba7} - {6897a4cc-0091-3970-b712-c0ac75c16b67} diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj b/builds/msvc/vs2015/libsodium/libsodium.vcxproj index 5882ae94..9ab29ad1 100644 --- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj @@ -164,10 +164,10 @@ + - - - + + @@ -316,10 +316,11 @@ - - - - + + + + + diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters index 3c4c2d8b..8041203d 100644 --- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters @@ -315,17 +315,17 @@ crypto_aead\xchacha20poly1305\sodium + + crypto_aead\aegis128l + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft - - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -767,17 +767,20 @@ crypto_stream\salsa20\xmm6 - + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft + + crypto_aead\aegis128l - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l + + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -826,15 +829,6 @@ {9e2a023d-fef1-3231-90ba-9a0ffc9bc9ab} - - {77ed2f29-bed2-35a2-acce-0c09b665d57b} - - - {2abca274-f068-3cf1-bd4e-5bfc5ee81de6} - - - {f606c11a-a160-3619-b842-8e8cce100ba7} - {6897a4cc-0091-3970-b712-c0ac75c16b67} diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj b/builds/msvc/vs2017/libsodium/libsodium.vcxproj index ffd72001..6b6a485e 100644 --- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj @@ -164,10 +164,10 @@ + - - - + + @@ -316,10 +316,11 @@ - - - - + + + + + diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters index 3c4c2d8b..8041203d 100644 --- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters @@ -315,17 +315,17 @@ crypto_aead\xchacha20poly1305\sodium + + crypto_aead\aegis128l + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft - - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -767,17 +767,20 @@ crypto_stream\salsa20\xmm6 - + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft + + crypto_aead\aegis128l - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l + + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -826,15 +829,6 @@ {9e2a023d-fef1-3231-90ba-9a0ffc9bc9ab} - - {77ed2f29-bed2-35a2-acce-0c09b665d57b} - - - {2abca274-f068-3cf1-bd4e-5bfc5ee81de6} - - - {f606c11a-a160-3619-b842-8e8cce100ba7} - {6897a4cc-0091-3970-b712-c0ac75c16b67} diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj b/builds/msvc/vs2019/libsodium/libsodium.vcxproj index bdd5e5d5..34c0f93d 100644 --- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj @@ -188,10 +188,10 @@ + - - - + + @@ -340,10 +340,11 @@ - - - - + + + + + diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters index 3c4c2d8b..8041203d 100644 --- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters @@ -315,17 +315,17 @@ crypto_aead\xchacha20poly1305\sodium + + crypto_aead\aegis128l + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft - - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -767,17 +767,20 @@ crypto_stream\salsa20\xmm6 - + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft + + crypto_aead\aegis128l - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l + + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -826,15 +829,6 @@ {9e2a023d-fef1-3231-90ba-9a0ffc9bc9ab} - - {77ed2f29-bed2-35a2-acce-0c09b665d57b} - - - {2abca274-f068-3cf1-bd4e-5bfc5ee81de6} - - - {f606c11a-a160-3619-b842-8e8cce100ba7} - {6897a4cc-0091-3970-b712-c0ac75c16b67} diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj b/builds/msvc/vs2022/libsodium/libsodium.vcxproj index 20e434f9..4c792c7a 100644 --- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj @@ -117,10 +117,10 @@ + - - - + + @@ -269,10 +269,11 @@ - - - - + + + + + diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters index 3c4c2d8b..8041203d 100644 --- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters @@ -315,17 +315,17 @@ crypto_aead\xchacha20poly1305\sodium + + crypto_aead\aegis128l + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft - - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -767,17 +767,20 @@ crypto_stream\salsa20\xmm6 - + crypto_aead\aegis128l - - crypto_aead\aegis128l\aesni + + crypto_aead\aegis128l - - crypto_aead\aegis128l\soft + + crypto_aead\aegis128l - - crypto_aead\aegis128l\armcrypto + + crypto_aead\aegis128l + + + crypto_aead\aegis128l crypto_aead\aegis256 @@ -826,15 +829,6 @@ {9e2a023d-fef1-3231-90ba-9a0ffc9bc9ab} - - {77ed2f29-bed2-35a2-acce-0c09b665d57b} - - - {2abca274-f068-3cf1-bd4e-5bfc5ee81de6} - - - {f606c11a-a160-3619-b842-8e8cce100ba7} - {6897a4cc-0091-3970-b712-c0ac75c16b67} diff --git a/libsodium.vcxproj b/libsodium.vcxproj index 269d5895..0d878a75 100644 --- a/libsodium.vcxproj +++ b/libsodium.vcxproj @@ -412,10 +412,10 @@ + - - - + + @@ -564,10 +564,11 @@ - - - - + + + + + diff --git a/libsodium.vcxproj.filters b/libsodium.vcxproj.filters index fd03d1b9..fb298fac 100644 --- a/libsodium.vcxproj.filters +++ b/libsodium.vcxproj.filters @@ -306,16 +306,16 @@ Source Files + + Source Files + Source Files - + Source Files - - Source Files - - + Source Files @@ -758,16 +758,19 @@ Header Files - + Header Files - + Header Files - + Header Files - + + Header Files + + Header Files diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am index ca930973..95c4618b 100644 --- a/src/libsodium/Makefile.am +++ b/src/libsodium/Makefile.am @@ -3,9 +3,10 @@ lib_LTLIBRARIES = \ libsodium_la_SOURCES = \ crypto_aead/aegis128l/aead_aegis128l.c \ - crypto_aead/aegis128l/aead_aegis128l.h \ - crypto_aead/aegis128l/soft/aead_aegis128l_soft.c \ - crypto_aead/aegis128l/soft/aead_aegis128l_soft.h \ + crypto_aead/aegis128l/aegis128l_common.h \ + crypto_aead/aegis128l/aegis128l_soft.c \ + crypto_aead/aegis128l/aegis128l_soft.h \ + crypto_aead/aegis128l/implementations.h \ crypto_aead/aegis256/aead_aegis256.c \ crypto_aead/aegis256/aead_aegis256.h \ crypto_aead/aegis256/soft/aead_aegis256_soft.c \ @@ -232,8 +233,8 @@ libarmcrypto_la_LDFLAGS = $(libsodium_la_LDFLAGS) libarmcrypto_la_CPPFLAGS = $(libsodium_la_CPPFLAGS) \ @CFLAGS_ARMCRYPTO@ libarmcrypto_la_SOURCES = \ - crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.c \ - crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.h \ + crypto_aead/aegis128l/aegis128l_armcrypto.c \ + crypto_aead/aegis128l/aegis128l_armcrypto.h \ crypto_aead/aegis256/armcrypto/aead_aegis256_armcrypto.c \ crypto_aead/aegis256/armcrypto/aead_aegis256_armcrypto.h \ crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c @@ -242,8 +243,8 @@ libaesni_la_LDFLAGS = $(libsodium_la_LDFLAGS) libaesni_la_CPPFLAGS = $(libsodium_la_CPPFLAGS) \ @CFLAGS_SSE2@ @CFLAGS_SSSE3@ @CFLAGS_AVX@ @CFLAGS_AESNI@ @CFLAGS_PCLMUL@ libaesni_la_SOURCES = \ - crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.c \ - crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.h \ + crypto_aead/aegis128l/aegis128l_aesni.c \ + crypto_aead/aegis128l/aegis128l_aesni.h \ crypto_aead/aegis256/aesni/aead_aegis256_aesni.c \ crypto_aead/aegis256/aesni/aead_aegis256_aesni.h \ crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c diff --git a/src/libsodium/crypto_aead/aegis128l/aead_aegis128l.c b/src/libsodium/crypto_aead/aegis128l/aead_aegis128l.c index 55fac512..01ba2a7e 100644 --- a/src/libsodium/crypto_aead/aegis128l/aead_aegis128l.c +++ b/src/libsodium/crypto_aead/aegis128l/aead_aegis128l.c @@ -9,20 +9,17 @@ #include "randombytes.h" #include "runtime.h" -#include "aead_aegis128l.h" - -#include "soft/aead_aegis128l_soft.h" +#include "aegis128l_soft.h" #if defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN) -#include "armcrypto/aead_aegis128l_armcrypto.h" +#include "aegis128l_armcrypto.h" #endif -#if defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H) -#include "aesni/aead_aegis128l_aesni.h" +#if defined(HAVE_AVXINTRIN_H) && defined(HAVE_WMMINTRIN_H) +#include "aegis128l_aesni.h" #endif -static const crypto_aead_aegis128l_implementation *implementation = - &crypto_aead_aegis128l_soft_implementation; +static const aegis128l_implementation *implementation = &aegis128l_soft_implementation; size_t crypto_aead_aegis128l_keybytes(void) @@ -69,9 +66,6 @@ crypto_aead_aegis128l_encrypt(unsigned char *c, unsigned long long *clen_p, cons unsigned long long clen = 0ULL; int ret; - if (mlen > crypto_aead_aegis128l_MESSAGEBYTES_MAX) { - sodium_misuse(); - } ret = crypto_aead_aegis128l_encrypt_detached(c, c + mlen, NULL, m, mlen, ad, adlen, nsec, npub, k); if (clen_p != NULL) { @@ -112,7 +106,17 @@ crypto_aead_aegis128l_encrypt_detached(unsigned char *c, unsigned char *mac, unsigned long long adlen, const unsigned char *nsec, const unsigned char *npub, const unsigned char *k) { - return implementation->encrypt_detached(c, mac, maclen_p, m, mlen, ad, adlen, nsec, npub, k); + const size_t maclen = crypto_aead_aegis128l_ABYTES; + + if (maclen_p != NULL) { + *maclen_p = maclen; + } + if (mlen > crypto_aead_aegis128l_MESSAGEBYTES_MAX || + adlen > crypto_aead_aegis128l_MESSAGEBYTES_MAX) { + sodium_misuse(); + } + return implementation->encrypt_detached(c, mac, maclen, m, (size_t) mlen, ad, (size_t) adlen, + npub, k); } int @@ -122,24 +126,31 @@ crypto_aead_aegis128l_decrypt_detached(unsigned char *m, unsigned char *nsec, unsigned long long adlen, const unsigned char *npub, const unsigned char *k) { - return implementation->decrypt_detached(m, nsec, c, clen, mac, ad, adlen, npub, k); + const size_t maclen = crypto_aead_aegis128l_ABYTES; + + if (clen > crypto_aead_aegis128l_MESSAGEBYTES_MAX || + adlen > crypto_aead_aegis128l_MESSAGEBYTES_MAX) { + return -1; + } + return implementation->decrypt_detached(m, c, (size_t) clen, mac, maclen, ad, (size_t) adlen, + npub, k); } int _crypto_aead_aegis128l_pick_best_implementation(void) { - implementation = &crypto_aead_aegis128l_soft_implementation; + implementation = &aegis128l_soft_implementation; #if defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN) if (sodium_runtime_has_armcrypto()) { - implementation = &crypto_aead_aegis128l_armcrypto_implementation; + implementation = &aegis128l_armcrypto_implementation; return 0; } #endif -#if defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H) +#if defined(HAVE_AVXINTRIN_H) && defined(HAVE_WMMINTRIN_H) if (sodium_runtime_has_aesni() & sodium_runtime_has_avx()) { - implementation = &crypto_aead_aegis128l_aesni_implementation; + implementation = &aegis128l_aesni_implementation; return 0; } #endif diff --git a/src/libsodium/crypto_aead/aegis128l/aead_aegis128l.h b/src/libsodium/crypto_aead/aegis128l/aead_aegis128l.h deleted file mode 100644 index d112c8f4..00000000 --- a/src/libsodium/crypto_aead/aegis128l/aead_aegis128l.h +++ /dev/null @@ -1,16 +0,0 @@ -#ifndef aead_aegis128l_H -#define aead_aegis128l_H - -typedef struct crypto_aead_aegis128l_implementation { - int (*encrypt_detached)(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p, - const unsigned char *m, unsigned long long mlen, - const unsigned char *ad, unsigned long long adlen, - const unsigned char *nsec, const unsigned char *npub, - const unsigned char *k); - int (*decrypt_detached)(unsigned char *m, unsigned char *nsec, const unsigned char *c, - unsigned long long clen, const unsigned char *mac, - const unsigned char *ad, unsigned long long adlen, - const unsigned char *npub, const unsigned char *k); -} crypto_aead_aegis128l_implementation; - -#endif diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_aesni.c b/src/libsodium/crypto_aead/aegis128l/aegis128l_aesni.c new file mode 100644 index 00000000..93782ce2 --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_aesni.c @@ -0,0 +1,70 @@ +#include +#include +#include +#include +#include + +#include "core.h" +#include "crypto_aead_aegis128l.h" +#include "crypto_verify_16.h" +#include "crypto_verify_32.h" +#include "export.h" +#include "utils.h" + +#include "private/common.h" + +#if defined(HAVE_AVXINTRIN_H) && defined(HAVE_WMMINTRIN_H) + +#include "aegis128l_aesni.h" + +#ifdef __clang__ +#pragma clang attribute push(__attribute__((target("aes,avx"))), apply_to = function) +#elif defined(__GNUC__) +#pragma GCC target("aes,avx") +#endif + +#include "private/sse2_64_32.h" +#include +#include + +#define AES_BLOCK_LENGTH 16 + +typedef __m128i aes_block_t; +#define AES_BLOCK_XOR(A, B) _mm_xor_si128((A), (B)) +#define AES_BLOCK_AND(A, B) _mm_and_si128((A), (B)) +#define AES_BLOCK_LOAD(A) _mm_loadu_si128((const aes_block_t *) (const void *) (A)) +#define AES_BLOCK_LOAD_64x2(A, B) _mm_set_epi64x((long long) (A), (long long) (B)) +#define AES_BLOCK_STORE(A, B) _mm_storeu_si128((aes_block_t *) (void *) (A), (B)) +#define AES_ENC(A, B) _mm_aesenc_si128((A), (B)) + +static inline void +aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2) +{ + aes_block_t tmp; + + tmp = state[7]; + state[7] = AES_ENC(state[6], state[7]); + state[6] = AES_ENC(state[5], state[6]); + state[5] = AES_ENC(state[4], state[5]); + state[4] = AES_ENC(state[3], state[4]); + state[3] = AES_ENC(state[2], state[3]); + state[2] = AES_ENC(state[1], state[2]); + state[1] = AES_ENC(state[0], state[1]); + state[0] = AES_ENC(tmp, state[0]); + + state[0] = AES_BLOCK_XOR(state[0], d1); + state[4] = AES_BLOCK_XOR(state[4], d2); +} + +#include "aegis128l_common.h" + +struct aegis128l_implementation aegis128l_aesni_implementation = { SODIUM_C99(.encrypt_detached =) + encrypt_detached, + SODIUM_C99(.decrypt_detached =) + decrypt_detached }; + +#ifdef __clang__ +#pragma clang attribute pop +#endif + +#endif diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_aesni.h b/src/libsodium/crypto_aead/aegis128l/aegis128l_aesni.h new file mode 100644 index 00000000..65e52dab --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_aesni.h @@ -0,0 +1,8 @@ +#ifndef aegis128l_aesni_H +#define aegis128l_aesni_H + +#include "implementations.h" + +extern struct aegis128l_implementation aegis128l_aesni_implementation; + +#endif \ No newline at end of file diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_armcrypto.c b/src/libsodium/crypto_aead/aegis128l/aegis128l_armcrypto.c new file mode 100644 index 00000000..8f2adf8c --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_armcrypto.c @@ -0,0 +1,69 @@ +#include +#include +#include +#include +#include + +#include "core.h" +#include "crypto_aead_aegis128l.h" +#include "crypto_verify_16.h" +#include "crypto_verify_32.h" +#include "export.h" +#include "utils.h" + +#include "private/common.h" + +#if defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN) + +#include "aegis128l_armcrypto.h" + +#ifdef __clang__ +#pragma clang attribute push(__attribute__((target("neon,crypto,aes"))), apply_to = function) +#elif defined(__GNUC__) +#pragma GCC target("neon,crypto,aes") +#endif + +#ifndef __ARM_FEATURE_AES +#define __ARM_FEATURE_AES 1 +#endif + +#include + +#define AES_BLOCK_LENGTH 16 + +typedef uint8x16_t aes_block_t; +#define AES_BLOCK_XOR(A, B) veorq_u8((A), (B)) +#define AES_BLOCK_AND(A, B) vandq_u8((A), (B)) +#define AES_BLOCK_LOAD(A) vld1q_u8(A) +#define AES_BLOCK_LOAD_64x2(A, B) vreinterpretq_u8_u64(vsetq_lane_u64((A), vmovq_n_u64(B), 1)) +#define AES_BLOCK_STORE(A, B) vst1q_u8((A), (B)) +#define AES_ENC(A, B) veorq_u8(vaesmcq_u8(vaeseq_u8((A), vmovq_n_u8(0))), (B)) + +static inline void +aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2) +{ + aes_block_t tmp; + + tmp = state[7]; + state[7] = AES_ENC(state[6], state[7]); + state[6] = AES_ENC(state[5], state[6]); + state[5] = AES_ENC(state[4], state[5]); + state[4] = AES_BLOCK_XOR(AES_ENC(state[3], state[4]), d2); + state[3] = AES_ENC(state[2], state[3]); + state[2] = AES_ENC(state[1], state[2]); + state[1] = AES_ENC(state[0], state[1]); + state[0] = AES_BLOCK_XOR(AES_ENC(tmp, state[0]), d1); +} + +#include "aegis128l_common.h" + +struct aegis128l_implementation aegis128l_armcrypto_implementation = { + SODIUM_C99(.encrypt_detached =) encrypt_detached, + SODIUM_C99(.decrypt_detached =) decrypt_detached +}; + +#ifdef __clang__ +#pragma clang attribute pop +#endif + +#endif diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_armcrypto.h b/src/libsodium/crypto_aead/aegis128l/aegis128l_armcrypto.h new file mode 100644 index 00000000..41ad43cb --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_armcrypto.h @@ -0,0 +1,8 @@ +#ifndef aegis128l_armcrypto_H +#define aegis128l_armcrypto_H + +#include "implementations.h" + +extern struct aegis128l_implementation aegis128l_armcrypto_implementation; + +#endif \ No newline at end of file diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_common.h b/src/libsodium/crypto_aead/aegis128l/aegis128l_common.h new file mode 100644 index 00000000..7a130b0c --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_common.h @@ -0,0 +1,229 @@ +#define RATE 32 + +static void +aegis128l_init(const uint8_t *key, const uint8_t *nonce, aes_block_t *const state) +{ + static CRYPTO_ALIGN(AES_BLOCK_LENGTH) + const uint8_t c0_[AES_BLOCK_LENGTH] = { 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, + 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }; + static CRYPTO_ALIGN(AES_BLOCK_LENGTH) + const uint8_t c1_[AES_BLOCK_LENGTH] = { 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, + 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }; + + const aes_block_t c0 = AES_BLOCK_LOAD(c0_); + const aes_block_t c1 = AES_BLOCK_LOAD(c1_); + aes_block_t k; + aes_block_t n; + int i; + + k = AES_BLOCK_LOAD(key); + n = AES_BLOCK_LOAD(nonce); + + state[0] = AES_BLOCK_XOR(k, n); + state[1] = c1; + state[2] = c0; + state[3] = c1; + state[4] = AES_BLOCK_XOR(k, n); + state[5] = AES_BLOCK_XOR(k, c0); + state[6] = AES_BLOCK_XOR(k, c1); + state[7] = AES_BLOCK_XOR(k, c0); + for (i = 0; i < 10; i++) { + aegis128l_update(state, n, k); + } +} + +static void +aegis128l_mac(uint8_t *mac, size_t maclen, size_t adlen, size_t mlen, aes_block_t *const state) +{ + aes_block_t tmp; + int i; + + tmp = AES_BLOCK_LOAD_64x2(((uint64_t) mlen) << 3, ((uint64_t) adlen) << 3); + tmp = AES_BLOCK_XOR(tmp, state[2]); + + for (i = 0; i < 7; i++) { + aegis128l_update(state, tmp, tmp); + } + + if (maclen == 16) { + tmp = AES_BLOCK_XOR(state[6], AES_BLOCK_XOR(state[5], state[4])); + tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[3], state[2])); + tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0])); + AES_BLOCK_STORE(mac, tmp); + } else if (maclen == 32) { + tmp = AES_BLOCK_XOR(state[3], state[2]); + tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0])); + AES_BLOCK_STORE(mac, tmp); + tmp = AES_BLOCK_XOR(state[7], state[6]); + tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[5], state[4])); + AES_BLOCK_STORE(mac + 16, tmp); + } else { + memset(mac, 0, maclen); + } +} + +static inline void +aegis128l_absorb(const uint8_t *const src, aes_block_t *const state) +{ + aes_block_t msg0, msg1; + + msg0 = AES_BLOCK_LOAD(src); + msg1 = AES_BLOCK_LOAD(src + AES_BLOCK_LENGTH); + aegis128l_update(state, msg0, msg1); +} + +static void +aegis128l_enc(uint8_t *const dst, const uint8_t *const src, aes_block_t *const state) +{ + aes_block_t msg0, msg1; + aes_block_t tmp0, tmp1; + + msg0 = AES_BLOCK_LOAD(src); + msg1 = AES_BLOCK_LOAD(src + AES_BLOCK_LENGTH); + tmp0 = AES_BLOCK_XOR(msg0, state[6]); + tmp0 = AES_BLOCK_XOR(tmp0, state[1]); + tmp1 = AES_BLOCK_XOR(msg1, state[5]); + tmp1 = AES_BLOCK_XOR(tmp1, state[2]); + tmp0 = AES_BLOCK_XOR(tmp0, AES_BLOCK_AND(state[2], state[3])); + tmp1 = AES_BLOCK_XOR(tmp1, AES_BLOCK_AND(state[6], state[7])); + AES_BLOCK_STORE(dst, tmp0); + AES_BLOCK_STORE(dst + AES_BLOCK_LENGTH, tmp1); + + aegis128l_update(state, msg0, msg1); +} + +static void +aegis128l_dec(uint8_t *const dst, const uint8_t *const src, aes_block_t *const state) +{ + aes_block_t msg0, msg1; + + msg0 = AES_BLOCK_LOAD(src); + msg1 = AES_BLOCK_LOAD(src + AES_BLOCK_LENGTH); + msg0 = AES_BLOCK_XOR(msg0, state[6]); + msg0 = AES_BLOCK_XOR(msg0, state[1]); + msg1 = AES_BLOCK_XOR(msg1, state[5]); + msg1 = AES_BLOCK_XOR(msg1, state[2]); + msg0 = AES_BLOCK_XOR(msg0, AES_BLOCK_AND(state[2], state[3])); + msg1 = AES_BLOCK_XOR(msg1, AES_BLOCK_AND(state[6], state[7])); + AES_BLOCK_STORE(dst, msg0); + AES_BLOCK_STORE(dst + AES_BLOCK_LENGTH, msg1); + + aegis128l_update(state, msg0, msg1); +} + +static void +aegis128l_declast(uint8_t *const dst, const uint8_t *const src, size_t len, + aes_block_t *const state) +{ + uint8_t pad[RATE]; + aes_block_t msg0, msg1; + + memset(pad, 0, sizeof pad); + memcpy(pad, src, len); + + msg0 = AES_BLOCK_LOAD(pad); + msg1 = AES_BLOCK_LOAD(pad + AES_BLOCK_LENGTH); + msg0 = AES_BLOCK_XOR(msg0, state[6]); + msg0 = AES_BLOCK_XOR(msg0, state[1]); + msg1 = AES_BLOCK_XOR(msg1, state[5]); + msg1 = AES_BLOCK_XOR(msg1, state[2]); + msg0 = AES_BLOCK_XOR(msg0, AES_BLOCK_AND(state[2], state[3])); + msg1 = AES_BLOCK_XOR(msg1, AES_BLOCK_AND(state[6], state[7])); + AES_BLOCK_STORE(pad, msg0); + AES_BLOCK_STORE(pad + AES_BLOCK_LENGTH, msg1); + + memset(pad + len, 0, sizeof pad - len); + memcpy(dst, pad, len); + + msg0 = AES_BLOCK_LOAD(pad); + msg1 = AES_BLOCK_LOAD(pad + AES_BLOCK_LENGTH); + + aegis128l_update(state, msg0, msg1); +} + +static int +encrypt_detached(uint8_t *c, uint8_t *mac, size_t maclen, const uint8_t *m, size_t mlen, + const uint8_t *ad, size_t adlen, const uint8_t *npub, const uint8_t *k) +{ + aes_block_t state[8]; + CRYPTO_ALIGN(RATE) uint8_t src[RATE]; + CRYPTO_ALIGN(RATE) uint8_t dst[RATE]; + size_t i; + + aegis128l_init(k, npub, state); + + for (i = 0; i + RATE <= adlen; i += RATE) { + aegis128l_absorb(ad + i, state); + } + if (adlen % RATE) { + memset(src, 0, RATE); + memcpy(src, ad + i, adlen % RATE); + aegis128l_absorb(src, state); + } + for (i = 0; i + RATE <= mlen; i += RATE) { + aegis128l_enc(c + i, m + i, state); + } + if (mlen % RATE) { + memset(src, 0, RATE); + memcpy(src, m + i, mlen % RATE); + aegis128l_enc(dst, src, state); + memcpy(c + i, dst, mlen % RATE); + } + + aegis128l_mac(mac, maclen, adlen, mlen, state); + + return 0; +} + +static int +decrypt_detached(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac, size_t maclen, + const uint8_t *ad, size_t adlen, const uint8_t *npub, const uint8_t *k) +{ + aes_block_t state[8]; + CRYPTO_ALIGN(RATE) uint8_t src[RATE]; + CRYPTO_ALIGN(RATE) uint8_t dst[RATE]; + CRYPTO_ALIGN(16) uint8_t computed_mac[32]; + const size_t mlen = clen; + size_t i; + int ret; + + aegis128l_init(k, npub, state); + + for (i = 0; i + RATE <= adlen; i += RATE) { + aegis128l_absorb(ad + i, state); + } + if (adlen % RATE) { + memset(src, 0, RATE); + memcpy(src, ad + i, adlen % RATE); + aegis128l_absorb(src, state); + } + if (m != NULL) { + for (i = 0; i + RATE <= mlen; i += RATE) { + aegis128l_dec(m + i, c + i, state); + } + } else { + for (i = 0; i + RATE <= mlen; i += RATE) { + aegis128l_dec(dst, c + i, state); + } + } + if (mlen % RATE) { + if (m != NULL) { + aegis128l_declast(m + i, c + i, mlen % RATE, state); + } else { + aegis128l_declast(dst, c + i, mlen % RATE, state); + } + } + + COMPILER_ASSERT(sizeof computed_mac >= 32); + aegis128l_mac(computed_mac, maclen, adlen, mlen, state); + ret = -1; + if (maclen == 16) { + ret = crypto_verify_16(computed_mac, mac); + } else if (maclen == 32) { + ret = crypto_verify_32(computed_mac, mac); + } + if (ret != 0 && m != NULL) { + memset(m, 0, mlen); + } + return ret; +} diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_soft.c b/src/libsodium/crypto_aead/aegis128l/aegis128l_soft.c new file mode 100644 index 00000000..e1d60ecb --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_soft.c @@ -0,0 +1,59 @@ +#include +#include +#include +#include +#include + +#include "core.h" +#include "crypto_aead_aegis128l.h" +#include "crypto_verify_16.h" +#include "crypto_verify_32.h" +#include "export.h" +#include "utils.h" + +#include "private/common.h" + +#include "crypto_aead_aegis128l.h" +#include "private/softaes.h" + +#if 1 + +#include "aegis128l_soft.h" + +#define AES_BLOCK_LENGTH 16 + +typedef SoftAesBlock aes_block_t; +#define AES_BLOCK_XOR(A, B) softaes_block_xor((A), (B)) +#define AES_BLOCK_AND(A, B) softaes_block_and((A), (B)) +#define AES_BLOCK_LOAD(A) softaes_block_load(A) +#define AES_BLOCK_LOAD_64x2(A, B) softaes_block_load64x2((A), (B)) +#define AES_BLOCK_STORE(A, B) softaes_block_store((A), (B)) +#define AES_ENC(A, B) softaes_block_encrypt((A), (B)) + +static inline void +aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2) +{ + aes_block_t tmp; + + tmp = state[7]; + state[7] = AES_ENC(state[6], state[7]); + state[6] = AES_ENC(state[5], state[6]); + state[5] = AES_ENC(state[4], state[5]); + state[4] = AES_ENC(state[3], state[4]); + state[3] = AES_ENC(state[2], state[3]); + state[2] = AES_ENC(state[1], state[2]); + state[1] = AES_ENC(state[0], state[1]); + state[0] = AES_ENC(tmp, state[0]); + + state[0] = AES_BLOCK_XOR(state[0], d1); + state[4] = AES_BLOCK_XOR(state[4], d2); +} + +#include "aegis128l_common.h" + +struct aegis128l_implementation aegis128l_soft_implementation = { SODIUM_C99(.encrypt_detached =) + encrypt_detached, + SODIUM_C99(.decrypt_detached =) + decrypt_detached }; + +#endif diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_soft.h b/src/libsodium/crypto_aead/aegis128l/aegis128l_soft.h new file mode 100644 index 00000000..df8ddece --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_soft.h @@ -0,0 +1,8 @@ +#ifndef aegis128l_soft_H +#define aegis128l_soft_H + +#include "implementations.h" + +extern struct aegis128l_implementation aegis128l_soft_implementation; + +#endif \ No newline at end of file diff --git a/src/libsodium/crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.c b/src/libsodium/crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.c deleted file mode 100644 index ae47fc23..00000000 --- a/src/libsodium/crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.c +++ /dev/null @@ -1,268 +0,0 @@ -#include -#include -#include -#include - -#include "core.h" -#include "crypto_aead_aegis128l.h" -#include "crypto_verify_16.h" -#include "export.h" -#include "randombytes.h" -#include "runtime.h" -#include "utils.h" - -#include "private/common.h" - -#include "aead_aegis128l_aesni.h" - -#if defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H) - -#ifdef __GNUC__ -#pragma GCC target("avx,aes") -#endif - -#include "private/sse2_64_32.h" -#include -#include - -typedef __m128i aes_block_t; -#define AES_BLOCK_XOR(A, B) _mm_xor_si128((A), (B)) -#define AES_BLOCK_AND(A, B) _mm_and_si128((A), (B)) -#define AES_BLOCK_LOAD(A) _mm_loadu_si128((const aes_block_t *) (const void *) (A)) -#define AES_BLOCK_LOAD_64x2(A, B) _mm_set_epi64x((A), (B)) -#define AES_BLOCK_STORE(A, B) _mm_storeu_si128((aes_block_t *) (void *) (A), (B)) -#define AES_ENC(A, B) _mm_aesenc_si128((A), (B)) - -static inline void -aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2) -{ - aes_block_t tmp; - - tmp = state[7]; - state[7] = AES_ENC(state[6], state[7]); - state[6] = AES_ENC(state[5], state[6]); - state[5] = AES_ENC(state[4], state[5]); - state[4] = AES_ENC(state[3], state[4]); - state[3] = AES_ENC(state[2], state[3]); - state[2] = AES_ENC(state[1], state[2]); - state[1] = AES_ENC(state[0], state[1]); - state[0] = AES_ENC(tmp, state[0]); - - state[0] = AES_BLOCK_XOR(state[0], d1); - state[4] = AES_BLOCK_XOR(state[4], d2); -} - -static void -aegis128l_init(const unsigned char *key, const unsigned char *nonce, aes_block_t *const state) -{ - static CRYPTO_ALIGN(16) - const uint8_t c0_[] = { 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, - 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }; - static CRYPTO_ALIGN(16) - const uint8_t c1_[] = { 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, - 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }; - const aes_block_t c0 = AES_BLOCK_LOAD(c0_); - const aes_block_t c1 = AES_BLOCK_LOAD(c1_); - aes_block_t k; - aes_block_t n; - int i; - - k = AES_BLOCK_LOAD(key); - n = AES_BLOCK_LOAD(nonce); - - state[0] = AES_BLOCK_XOR(k, n); - state[1] = c0; - state[2] = c1; - state[3] = c0; - state[4] = AES_BLOCK_XOR(k, n); - state[5] = AES_BLOCK_XOR(k, c1); - state[6] = AES_BLOCK_XOR(k, c0); - state[7] = AES_BLOCK_XOR(k, c1); - for (i = 0; i < 10; i++) { - aegis128l_update(state, n, k); - } -} - -static void -aegis128l_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen, - aes_block_t *const state) -{ - aes_block_t tmp; - int i; - - tmp = AES_BLOCK_LOAD_64x2(mlen << 3, adlen << 3); - tmp = AES_BLOCK_XOR(tmp, state[2]); - - for (i = 0; i < 7; i++) { - aegis128l_update(state, tmp, tmp); - } - - tmp = AES_BLOCK_XOR(state[6], AES_BLOCK_XOR(state[5], state[4])); - tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[3], state[2])); - tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0])); - - AES_BLOCK_STORE(mac, tmp); -} - -static inline void -aegis128l_absorb(const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - aegis128l_update(state, msg0, msg1); -} - -static void -aegis128l_enc(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - aes_block_t tmp0, tmp1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - tmp0 = AES_BLOCK_XOR(msg0, state[6]); - tmp0 = AES_BLOCK_XOR(tmp0, state[1]); - tmp1 = AES_BLOCK_XOR(msg1, state[5]); - tmp1 = AES_BLOCK_XOR(tmp1, state[2]); - tmp0 = AES_BLOCK_XOR(tmp0, AES_BLOCK_AND(state[2], state[3])); - tmp1 = AES_BLOCK_XOR(tmp1, AES_BLOCK_AND(state[6], state[7])); - AES_BLOCK_STORE(dst, tmp0); - AES_BLOCK_STORE(dst + 16, tmp1); - - aegis128l_update(state, msg0, msg1); -} - -static void -aegis128l_dec(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - msg0 = AES_BLOCK_XOR(msg0, state[6]); - msg0 = AES_BLOCK_XOR(msg0, state[1]); - msg1 = AES_BLOCK_XOR(msg1, state[5]); - msg1 = AES_BLOCK_XOR(msg1, state[2]); - msg0 = AES_BLOCK_XOR(msg0, AES_BLOCK_AND(state[2], state[3])); - msg1 = AES_BLOCK_XOR(msg1, AES_BLOCK_AND(state[6], state[7])); - AES_BLOCK_STORE(dst, msg0); - AES_BLOCK_STORE(dst + 16, msg1); - - aegis128l_update(state, msg0, msg1); -} - -static int -aegis128l_encrypt_detached(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p, - const unsigned char *m, unsigned long long mlen, const unsigned char *ad, - unsigned long long adlen, const unsigned char *nsec, - const unsigned char *npub, const unsigned char *k) -{ - aes_block_t state[8]; - CRYPTO_ALIGN(16) unsigned char src[32]; - CRYPTO_ALIGN(16) unsigned char dst[32]; - unsigned long long i; - - (void) nsec; - aegis128l_init(k, npub, state); - - for (i = 0ULL; i + 32ULL <= adlen; i += 32ULL) { - aegis128l_absorb(ad + i, state); - } - if (adlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, ad + i, adlen & 0x1f); - aegis128l_absorb(src, state); - } - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_enc(c + i, m + i, state); - } - if (mlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, m + i, mlen & 0x1f); - aegis128l_enc(dst, src, state); - memcpy(c + i, dst, mlen & 0x1f); - } - - aegis128l_mac(mac, adlen, mlen, state); - sodium_memzero(state, sizeof state); - sodium_memzero(src, sizeof src); - sodium_memzero(dst, sizeof dst); - - if (maclen_p != NULL) { - *maclen_p = 16ULL; - } - return 0; -} - -static int -aegis128l_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c, - unsigned long long clen, const unsigned char *mac, - const unsigned char *ad, unsigned long long adlen, - const unsigned char *npub, const unsigned char *k) -{ - aes_block_t state[8]; - CRYPTO_ALIGN(16) unsigned char src[32]; - CRYPTO_ALIGN(16) unsigned char dst[32]; - CRYPTO_ALIGN(16) unsigned char computed_mac[16]; - unsigned long long i; - unsigned long long mlen; - int ret; - - (void) nsec; - mlen = clen; - aegis128l_init(k, npub, state); - - for (i = 0ULL; i + 32ULL <= adlen; i += 32ULL) { - aegis128l_absorb(ad + i, state); - } - if (adlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, ad + i, adlen & 0x1f); - aegis128l_absorb(src, state); - } - if (m != NULL) { - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_dec(m + i, c + i, state); - } - } else { - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_dec(dst, c + i, state); - } - } - if (mlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, c + i, mlen & 0x1f); - aegis128l_dec(dst, src, state); - if (m != NULL) { - memcpy(m + i, dst, mlen & 0x1f); - } - memset(dst, 0, mlen & 0x1f); - state[0] = - AES_BLOCK_XOR(state[0], AES_BLOCK_LOAD(dst)); - state[4] = AES_BLOCK_XOR(state[4], AES_BLOCK_LOAD(dst + 16)); - } - - aegis128l_mac(computed_mac, adlen, mlen, state); - sodium_memzero(state, sizeof state); - sodium_memzero(src, sizeof src); - sodium_memzero(dst, sizeof dst); - ret = crypto_verify_16(computed_mac, mac); - sodium_memzero(computed_mac, sizeof computed_mac); - if (m == NULL) { - return ret; - } - if (ret != 0) { - memset(m, 0, mlen); - return -1; - } - return 0; -} - -struct crypto_aead_aegis128l_implementation crypto_aead_aegis128l_aesni_implementation = { - SODIUM_C99(.encrypt_detached =) aegis128l_encrypt_detached, - SODIUM_C99(.decrypt_detached =) aegis128l_decrypt_detached -}; - -#endif diff --git a/src/libsodium/crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.h b/src/libsodium/crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.h deleted file mode 100644 index 1b747c7f..00000000 --- a/src/libsodium/crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.h +++ /dev/null @@ -1,6 +0,0 @@ -#include - -#include "../aead_aegis128l.h" -#include "crypto_aead_aegis128l.h" - -extern struct crypto_aead_aegis128l_implementation crypto_aead_aegis128l_aesni_implementation; diff --git a/src/libsodium/crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.c b/src/libsodium/crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.c deleted file mode 100644 index 45b82207..00000000 --- a/src/libsodium/crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.c +++ /dev/null @@ -1,262 +0,0 @@ -#include -#include -#include -#include - -#include "core.h" -#include "crypto_aead_aegis128l.h" -#include "crypto_verify_16.h" -#include "export.h" -#include "randombytes.h" -#include "runtime.h" -#include "utils.h" - -#include "private/common.h" - -#include "aead_aegis128l_armcrypto.h" - -#if defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN) - -#ifndef __ARM_FEATURE_AES -#define __ARM_FEATURE_AES 1 -#endif - -#include - -typedef uint8x16_t aes_block_t; -#define AES_BLOCK_XOR(A, B) veorq_u8((A), (B)) -#define AES_BLOCK_AND(A, B) vandq_u8((A), (B)) -#define AES_BLOCK_LOAD(A) vld1q_u8(A) -#define AES_BLOCK_LOAD_64x2(A, B) vreinterpretq_u8_u64(vsetq_lane_u64((A), vmovq_n_u64(B), 1)) -#define AES_BLOCK_STORE(A, B) vst1q_u8((A), (B)) -#define AES_ENC(A, B) veorq_u8(vaesmcq_u8(vaeseq_u8((A), vmovq_n_u8(0))), (B)) - -static inline void -aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2) -{ - aes_block_t tmp; - - tmp = state[7]; - state[7] = AES_ENC(state[6], state[7]); - state[6] = AES_ENC(state[5], state[6]); - state[5] = AES_ENC(state[4], state[5]); - state[4] = AES_BLOCK_XOR(AES_ENC(state[3], state[4]), d2); - state[3] = AES_ENC(state[2], state[3]); - state[2] = AES_ENC(state[1], state[2]); - state[1] = AES_ENC(state[0], state[1]); - state[0] = AES_BLOCK_XOR(AES_ENC(tmp, state[0]), d1); -} - -static void -aegis128l_init(const unsigned char *key, const unsigned char *nonce, aes_block_t *const state) -{ - static CRYPTO_ALIGN(16) - const unsigned char c0_[] = { 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, - 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }; - static CRYPTO_ALIGN(16) - const unsigned char c1_[] = { 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, - 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }; - const aes_block_t c0 = AES_BLOCK_LOAD(c0_); - const aes_block_t c1 = AES_BLOCK_LOAD(c1_); - aes_block_t k; - aes_block_t n; - int i; - - k = AES_BLOCK_LOAD(key); - n = AES_BLOCK_LOAD(nonce); - - state[0] = AES_BLOCK_XOR(k, n); - state[1] = c0; - state[2] = c1; - state[3] = c0; - state[4] = AES_BLOCK_XOR(k, n); - state[5] = AES_BLOCK_XOR(k, c1); - state[6] = AES_BLOCK_XOR(k, c0); - state[7] = AES_BLOCK_XOR(k, c1); - for (i = 0; i < 10; i++) { - aegis128l_update(state, n, k); - } -} - -static void -aegis128l_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen, - aes_block_t *const state) -{ - aes_block_t tmp; - int i; - - tmp = AES_BLOCK_LOAD_64x2(mlen << 3, adlen << 3); - tmp = AES_BLOCK_XOR(tmp, state[2]); - - for (i = 0; i < 7; i++) { - aegis128l_update(state, tmp, tmp); - } - - tmp = AES_BLOCK_XOR(state[6], AES_BLOCK_XOR(state[5], state[4])); - tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[3], state[2])); - tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_XOR(state[1], state[0])); - - AES_BLOCK_STORE(mac, tmp); -} - -static inline void -aegis128l_absorb(const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - aegis128l_update(state, msg0, msg1); -} - -static void -aegis128l_enc(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - aes_block_t tmp0, tmp1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - tmp0 = AES_BLOCK_XOR(msg0, state[6]); - tmp0 = AES_BLOCK_XOR(tmp0, state[1]); - tmp1 = AES_BLOCK_XOR(msg1, state[5]); - tmp1 = AES_BLOCK_XOR(tmp1, state[2]); - tmp0 = AES_BLOCK_XOR(tmp0, AES_BLOCK_AND(state[2], state[3])); - tmp1 = AES_BLOCK_XOR(tmp1, AES_BLOCK_AND(state[6], state[7])); - AES_BLOCK_STORE(dst, tmp0); - AES_BLOCK_STORE(dst + 16, tmp1); - - aegis128l_update(state, msg0, msg1); -} - -static void -aegis128l_dec(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - msg0 = AES_BLOCK_XOR(msg0, state[6]); - msg0 = AES_BLOCK_XOR(msg0, state[1]); - msg1 = AES_BLOCK_XOR(msg1, state[5]); - msg1 = AES_BLOCK_XOR(msg1, state[2]); - msg0 = AES_BLOCK_XOR(msg0, AES_BLOCK_AND(state[2], state[3])); - msg1 = AES_BLOCK_XOR(msg1, AES_BLOCK_AND(state[6], state[7])); - AES_BLOCK_STORE(dst, msg0); - AES_BLOCK_STORE(dst + 16, msg1); - - aegis128l_update(state, msg0, msg1); -} - -static int -aegis128l_encrypt_detached(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p, - const unsigned char *m, unsigned long long mlen, const unsigned char *ad, - unsigned long long adlen, const unsigned char *nsec, - const unsigned char *npub, const unsigned char *k) -{ - aes_block_t state[8]; - CRYPTO_ALIGN(16) unsigned char src[32]; - CRYPTO_ALIGN(16) unsigned char dst[32]; - unsigned long long i; - - (void) nsec; - aegis128l_init(k, npub, state); - - for (i = 0ULL; i + 32ULL <= adlen; i += 32ULL) { - aegis128l_absorb(ad + i, state); - } - if (adlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, ad + i, adlen & 0x1f); - aegis128l_absorb(src, state); - } - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_enc(c + i, m + i, state); - } - if (mlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, m + i, mlen & 0x1f); - aegis128l_enc(dst, src, state); - memcpy(c + i, dst, mlen & 0x1f); - } - - aegis128l_mac(mac, adlen, mlen, state); - sodium_memzero(state, sizeof state); - sodium_memzero(src, sizeof src); - sodium_memzero(dst, sizeof dst); - - if (maclen_p != NULL) { - *maclen_p = 16ULL; - } - return 0; -} - -static int -aegis128l_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c, - unsigned long long clen, const unsigned char *mac, - const unsigned char *ad, unsigned long long adlen, - const unsigned char *npub, const unsigned char *k) -{ - aes_block_t state[8]; - CRYPTO_ALIGN(16) unsigned char src[32]; - CRYPTO_ALIGN(16) unsigned char dst[32]; - CRYPTO_ALIGN(16) unsigned char computed_mac[16]; - unsigned long long i; - unsigned long long mlen; - int ret; - - (void) nsec; - mlen = clen; - aegis128l_init(k, npub, state); - - for (i = 0ULL; i + 32ULL <= adlen; i += 32ULL) { - aegis128l_absorb(ad + i, state); - } - if (adlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, ad + i, adlen & 0x1f); - aegis128l_absorb(src, state); - } - if (m != NULL) { - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_dec(m + i, c + i, state); - } - } else { - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_dec(dst, c + i, state); - } - } - if (mlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, c + i, mlen & 0x1f); - aegis128l_dec(dst, src, state); - if (m != NULL) { - memcpy(m + i, dst, mlen & 0x1f); - } - memset(dst, 0, mlen & 0x1f); - state[0] = AES_BLOCK_XOR(state[0], AES_BLOCK_LOAD(dst)); - state[4] = AES_BLOCK_XOR(state[4], AES_BLOCK_LOAD(dst + 16)); - } - - aegis128l_mac(computed_mac, adlen, mlen, state); - sodium_memzero(state, sizeof state); - sodium_memzero(src, sizeof src); - sodium_memzero(dst, sizeof dst); - ret = crypto_verify_16(computed_mac, mac); - sodium_memzero(computed_mac, sizeof computed_mac); - if (m == NULL) { - return ret; - } - if (ret != 0) { - memset(m, 0, mlen); - return -1; - } - return 0; -} - -struct crypto_aead_aegis128l_implementation crypto_aead_aegis128l_armcrypto_implementation = { - SODIUM_C99(.encrypt_detached =) aegis128l_encrypt_detached, - SODIUM_C99(.decrypt_detached =) aegis128l_decrypt_detached -}; - -#endif diff --git a/src/libsodium/crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.h b/src/libsodium/crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.h deleted file mode 100644 index 715da68d..00000000 --- a/src/libsodium/crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.h +++ /dev/null @@ -1,6 +0,0 @@ -#include - -#include "../aead_aegis128l.h" -#include "crypto_aead_aegis128l.h" - -extern struct crypto_aead_aegis128l_implementation crypto_aead_aegis128l_armcrypto_implementation; diff --git a/src/libsodium/crypto_aead/aegis128l/implementations.h b/src/libsodium/crypto_aead/aegis128l/implementations.h new file mode 100644 index 00000000..29e7b1cb --- /dev/null +++ b/src/libsodium/crypto_aead/aegis128l/implementations.h @@ -0,0 +1,17 @@ +#ifndef aegis128l_implementations_H +#define aegis128l_implementations_H + +#include +#include + +#include "crypto_aead_aegis128l.h" + +typedef struct aegis128l_implementation { + int (*encrypt_detached)(uint8_t *c, uint8_t *mac, size_t maclen, const uint8_t *m, size_t mlen, + const uint8_t *ad, size_t adlen, const uint8_t *npub, const uint8_t *k); + int (*decrypt_detached)(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac, + size_t maclen, const uint8_t *ad, size_t adlen, const uint8_t *npub, + const uint8_t *k); +} aegis128l_implementation; + +#endif diff --git a/src/libsodium/crypto_aead/aegis128l/soft/aead_aegis128l_soft.c b/src/libsodium/crypto_aead/aegis128l/soft/aead_aegis128l_soft.c deleted file mode 100644 index 81081384..00000000 --- a/src/libsodium/crypto_aead/aegis128l/soft/aead_aegis128l_soft.c +++ /dev/null @@ -1,259 +0,0 @@ -#include -#include -#include -#include - -#include "core.h" -#include "crypto_aead_aegis128l.h" -#include "crypto_verify_16.h" -#include "export.h" -#include "randombytes.h" -#include "runtime.h" -#include "utils.h" - -#include "private/common.h" -#include "private/softaes.h" - -#include "aead_aegis128l_soft.h" - -typedef SoftAesBlock aes_block_t; -#define AES_BLOCK_XOR(A, B) softaes_block_xor((A), (B)) -#define AES_BLOCK_AND(A, B) softaes_block_and((A), (B)) -#define AES_BLOCK_LOAD(A) softaes_block_load(A) -#define AES_BLOCK_LOAD_64x2(A, B) softaes_block_load64x2((A), (B)) -#define AES_BLOCK_STORE(A, B) softaes_block_store((A), (B)) -#define AES_ENC(A, B) softaes_block_encrypt((A), (B)) - -static inline void -aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2) -{ - aes_block_t tmp; - - tmp = state[7]; - state[7] = AES_ENC(state[6], state[7]); - state[6] = AES_ENC(state[5], state[6]); - state[5] = AES_ENC(state[4], state[5]); - state[4] = AES_ENC(state[3], state[4]); - state[3] = AES_ENC(state[2], state[3]); - state[2] = AES_ENC(state[1], state[2]); - state[1] = AES_ENC(state[0], state[1]); - state[0] = AES_ENC(tmp, state[0]); - - state[0] = AES_BLOCK_XOR(state[0], d1); - state[4] = AES_BLOCK_XOR(state[4], d2); -} - -static void -aegis128l_init(const unsigned char *key, const unsigned char *nonce, aes_block_t *const state) -{ - static CRYPTO_ALIGN(16) - const unsigned char c0_[] = { 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, - 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }; - static CRYPTO_ALIGN(16) - const unsigned char c1_[] = { 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, - 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }; - const aes_block_t c0 = AES_BLOCK_LOAD(c0_); - const aes_block_t c1 = AES_BLOCK_LOAD(c1_); - aes_block_t k; - aes_block_t n; - int i; - - k = AES_BLOCK_LOAD(key); - n = AES_BLOCK_LOAD(nonce); - - state[0] = AES_BLOCK_XOR(k, n); - state[1] = c0; - state[2] = c1; - state[3] = c0; - state[4] = AES_BLOCK_XOR(k, n); - state[5] = AES_BLOCK_XOR(k, c1); - state[6] = AES_BLOCK_XOR(k, c0); - state[7] = AES_BLOCK_XOR(k, c1); - for (i = 0; i < 10; i++) { - aegis128l_update(state, n, k); - } -} - -static void -aegis128l_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen, - aes_block_t *const state) -{ - aes_block_t tmp; - int i; - - tmp = AES_BLOCK_LOAD_64x2(mlen << 3, adlen << 3); - tmp = AES_BLOCK_XOR(tmp, state[2]); - - for (i = 0; i < 7; i++) { - aegis128l_update(state, tmp, tmp); - } - - tmp = AES_BLOCK_XOR(state[6], state[5]); - tmp = AES_BLOCK_XOR(tmp, state[4]); - tmp = AES_BLOCK_XOR(tmp, state[3]); - tmp = AES_BLOCK_XOR(tmp, state[2]); - tmp = AES_BLOCK_XOR(tmp, state[1]); - tmp = AES_BLOCK_XOR(tmp, state[0]); - - AES_BLOCK_STORE(mac, tmp); -} - -static inline void -aegis128l_absorb(const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - aegis128l_update(state, msg0, msg1); -} - -static void -aegis128l_enc(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - aes_block_t tmp0, tmp1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - tmp0 = AES_BLOCK_XOR(msg0, state[6]); - tmp0 = AES_BLOCK_XOR(tmp0, state[1]); - tmp1 = AES_BLOCK_XOR(msg1, state[5]); - tmp1 = AES_BLOCK_XOR(tmp1, state[2]); - tmp0 = AES_BLOCK_XOR(tmp0, AES_BLOCK_AND(state[2], state[3])); - tmp1 = AES_BLOCK_XOR(tmp1, AES_BLOCK_AND(state[6], state[7])); - AES_BLOCK_STORE(dst, tmp0); - AES_BLOCK_STORE(dst + 16, tmp1); - - aegis128l_update(state, msg0, msg1); -} - -static void -aegis128l_dec(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state) -{ - aes_block_t msg0, msg1; - - msg0 = AES_BLOCK_LOAD(src); - msg1 = AES_BLOCK_LOAD(src + 16); - msg0 = AES_BLOCK_XOR(msg0, state[6]); - msg0 = AES_BLOCK_XOR(msg0, state[1]); - msg1 = AES_BLOCK_XOR(msg1, state[5]); - msg1 = AES_BLOCK_XOR(msg1, state[2]); - msg0 = AES_BLOCK_XOR(msg0, AES_BLOCK_AND(state[2], state[3])); - msg1 = AES_BLOCK_XOR(msg1, AES_BLOCK_AND(state[6], state[7])); - AES_BLOCK_STORE(dst, msg0); - AES_BLOCK_STORE(dst + 16, msg1); - - aegis128l_update(state, msg0, msg1); -} - -static int -aegis128l_encrypt_detached(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p, - const unsigned char *m, unsigned long long mlen, const unsigned char *ad, - unsigned long long adlen, const unsigned char *nsec, - const unsigned char *npub, const unsigned char *k) -{ - aes_block_t state[8]; - CRYPTO_ALIGN(16) unsigned char src[32]; - CRYPTO_ALIGN(16) unsigned char dst[32]; - unsigned long long i; - - (void) nsec; - aegis128l_init(k, npub, state); - - for (i = 0ULL; i + 32ULL <= adlen; i += 32ULL) { - aegis128l_absorb(ad + i, state); - } - if (adlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, ad + i, adlen & 0x1f); - aegis128l_absorb(src, state); - } - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_enc(c + i, m + i, state); - } - if (mlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, m + i, mlen & 0x1f); - aegis128l_enc(dst, src, state); - memcpy(c + i, dst, mlen & 0x1f); - } - - aegis128l_mac(mac, adlen, mlen, state); - sodium_memzero(state, sizeof state); - sodium_memzero(src, sizeof src); - sodium_memzero(dst, sizeof dst); - - if (maclen_p != NULL) { - *maclen_p = 16ULL; - } - return 0; -} - -static int -aegis128l_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c, - unsigned long long clen, const unsigned char *mac, - const unsigned char *ad, unsigned long long adlen, - const unsigned char *npub, const unsigned char *k) -{ - aes_block_t state[8]; - CRYPTO_ALIGN(16) unsigned char src[32]; - CRYPTO_ALIGN(16) unsigned char dst[32]; - CRYPTO_ALIGN(16) unsigned char computed_mac[16]; - unsigned long long i; - unsigned long long mlen; - int ret; - - (void) nsec; - mlen = clen; - aegis128l_init(k, npub, state); - - for (i = 0ULL; i + 32ULL <= adlen; i += 32ULL) { - aegis128l_absorb(ad + i, state); - } - if (adlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, ad + i, adlen & 0x1f); - aegis128l_absorb(src, state); - } - if (m != NULL) { - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_dec(m + i, c + i, state); - } - } else { - for (i = 0ULL; i + 32ULL <= mlen; i += 32ULL) { - aegis128l_dec(dst, c + i, state); - } - } - if (mlen & 0x1f) { - memset(src, 0, 32); - memcpy(src, c + i, mlen & 0x1f); - aegis128l_dec(dst, src, state); - if (m != NULL) { - memcpy(m + i, dst, mlen & 0x1f); - } - memset(dst, 0, mlen & 0x1f); - state[0] = AES_BLOCK_XOR(state[0], AES_BLOCK_LOAD(dst)); - state[4] = AES_BLOCK_XOR(state[4], AES_BLOCK_LOAD(dst + 16)); - } - - aegis128l_mac(computed_mac, adlen, mlen, state); - sodium_memzero(state, sizeof state); - sodium_memzero(src, sizeof src); - sodium_memzero(dst, sizeof dst); - ret = crypto_verify_16(computed_mac, mac); - sodium_memzero(computed_mac, sizeof computed_mac); - if (m == NULL) { - return ret; - } - if (ret != 0) { - memset(m, 0, mlen); - return -1; - } - return 0; -} - -struct crypto_aead_aegis128l_implementation crypto_aead_aegis128l_soft_implementation = { - SODIUM_C99(.encrypt_detached =) aegis128l_encrypt_detached, - SODIUM_C99(.decrypt_detached =) aegis128l_decrypt_detached -}; diff --git a/src/libsodium/crypto_aead/aegis128l/soft/aead_aegis128l_soft.h b/src/libsodium/crypto_aead/aegis128l/soft/aead_aegis128l_soft.h deleted file mode 100644 index aa070ff8..00000000 --- a/src/libsodium/crypto_aead/aegis128l/soft/aead_aegis128l_soft.h +++ /dev/null @@ -1,7 +0,0 @@ -#include - -#include "../aead_aegis128l.h" -#include "crypto_aead_aegis128l.h" - -extern struct crypto_aead_aegis128l_implementation - crypto_aead_aegis128l_soft_implementation; diff --git a/src/libsodium/crypto_core/softaes/softaes.c b/src/libsodium/crypto_core/softaes/softaes.c index b21134d9..ae469c8a 100644 --- a/src/libsodium/crypto_core/softaes/softaes.c +++ b/src/libsodium/crypto_core/softaes/softaes.c @@ -44,7 +44,11 @@ uint32_t _aes_lut[256] __attribute__ ((visibility ("hidden"))) = { static const uint32_t * const LUT = _aes_lut; #ifndef SOFTAES_STRIDE -#define SOFTAES_STRIDE 16 +# ifdef FAVOR_PERFORMANCE +# define SOFTAES_STRIDE 256 +# else +# define SOFTAES_STRIDE 16 +# endif #endif static SoftAesBlock