xref: /optee_os/core/lib/libtomcrypt/src/encauth/ocb3/ocb3_decrypt_last.c (revision 8411e6ad673d20c4742ed30c785e3f5cdea54dfa)
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis */
2 /* SPDX-License-Identifier: Unlicense */
3 
4 /**
5    @file ocb3_decrypt_last.c
6    OCB implementation, internal helper, by Karel Miko
7 */
8 #include "tomcrypt_private.h"
9 
10 #ifdef LTC_OCB3_MODE
11 
12 /**
13    Finish an OCB (decryption) stream
14    @param ocb    The OCB state
15    @param ct     The remaining ciphertext
16    @param ctlen  The length of the ciphertext (octets)
17    @param pt     [out] The output buffer
18    @return CRYPT_OK if successful
19 */
ocb3_decrypt_last(ocb3_state * ocb,const unsigned char * ct,unsigned long ctlen,unsigned char * pt)20 int ocb3_decrypt_last(ocb3_state *ocb, const unsigned char *ct, unsigned long ctlen, unsigned char *pt)
21 {
22    unsigned char iOffset_star[MAXBLOCKSIZE];
23    unsigned char iPad[MAXBLOCKSIZE];
24    int err, x, full_blocks, full_blocks_len, last_block_len;
25 
26    LTC_ARGCHK(ocb != NULL);
27    if (ct == NULL) LTC_ARGCHK(ctlen == 0);
28    if (ctlen != 0) {
29       LTC_ARGCHK(ct    != NULL);
30       LTC_ARGCHK(pt    != NULL);
31    }
32 
33    if ((err = cipher_is_valid(ocb->cipher)) != CRYPT_OK) {
34       goto LBL_ERR;
35    }
36 
37    full_blocks = ctlen/ocb->block_len;
38    full_blocks_len = full_blocks * ocb->block_len;
39    last_block_len = ctlen - full_blocks_len;
40 
41    /* process full blocks first */
42    if (full_blocks>0) {
43      if ((err = ocb3_decrypt(ocb, ct, full_blocks_len, pt)) != CRYPT_OK) {
44        goto LBL_ERR;
45      }
46    }
47 
48    if (last_block_len>0) {
49      /* Offset_* = Offset_m xor L_* */
50      ocb3_int_xor_blocks(iOffset_star, ocb->Offset_current, ocb->L_star, ocb->block_len);
51 
52      /* Pad = ENCIPHER(K, Offset_*) */
53      if ((err = cipher_descriptor[ocb->cipher]->ecb_encrypt(iOffset_star, iPad, &ocb->key)) != CRYPT_OK) {
54        goto LBL_ERR;
55      }
56 
57      /* P_* = C_* xor Pad[1..bitlen(C_*)] */
58      ocb3_int_xor_blocks(pt+full_blocks_len, (unsigned char *)ct+full_blocks_len, iPad, last_block_len);
59 
60      /* Checksum_* = Checksum_m xor (P_* || 1 || zeros(127-bitlen(P_*))) */
61      ocb3_int_xor_blocks(ocb->checksum, ocb->checksum, pt+full_blocks_len, last_block_len);
62      for(x=last_block_len; x<ocb->block_len; x++) {
63        if (x == last_block_len) {
64          ocb->checksum[x] ^= 0x80;
65        } else {
66          ocb->checksum[x] ^= 0x00;
67        }
68      }
69 
70      /* Tag = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) xor HASH(K,A) */
71      /* at this point we calculate only: Tag_part = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) */
72      for(x=0; x<ocb->block_len; x++) {
73        ocb->tag_part[x] = (ocb->checksum[x] ^ iOffset_star[x]) ^ ocb->L_dollar[x];
74      }
75      if ((err = cipher_descriptor[ocb->cipher]->ecb_encrypt(ocb->tag_part, ocb->tag_part, &ocb->key)) != CRYPT_OK) {
76        goto LBL_ERR;
77      }
78    }
79    else {
80      /* Tag = ENCIPHER(K, Checksum_m xor Offset_m xor L_$) xor HASH(K,A) */
81      /* at this point we calculate only: Tag_part = ENCIPHER(K, Checksum_m xor Offset_m xor L_$) */
82      for(x=0; x<ocb->block_len; x++) {
83        ocb->tag_part[x] = (ocb->checksum[x] ^ ocb->Offset_current[x]) ^ ocb->L_dollar[x];
84      }
85      if ((err = cipher_descriptor[ocb->cipher]->ecb_encrypt(ocb->tag_part, ocb->tag_part, &ocb->key)) != CRYPT_OK) {
86        goto LBL_ERR;
87      }
88    }
89 
90    err = CRYPT_OK;
91 
92 LBL_ERR:
93 #ifdef LTC_CLEAN_STACK
94    zeromem(iOffset_star, MAXBLOCKSIZE);
95    zeromem(iPad, MAXBLOCKSIZE);
96 #endif
97 
98    return err;
99 }
100 
101 #endif
102