commit - 354d02c5e11292ce7e503ac5dad08eef9d7d648b
commit + 8c960797355352f63b53aeef38169d4e6108d507
blob - 422aa7d4991817d3aeb9cd4920160df3bb88f2ec
blob + 5eb616cef75fe981253b1fcf263ed2d99e7bc6c4
--- lib/libcrypto/modes/gcm128.c
+++ lib/libcrypto/modes/gcm128.c
-/* $OpenBSD: gcm128.c,v 1.36 2025/05/16 15:09:26 jsing Exp $ */
+/* $OpenBSD: gcm128.c,v 1.37 2025/05/17 14:43:17 jsing Exp $ */
/* ====================================================================
* Copyright (c) 2010 The OpenSSL Project. All rights reserved.
*
} \
} while(0)
-/*
- * Even though permitted values for TABLE_BITS are 8, 4 and 1, it should
- * never be set to 8. 8 is effectively reserved for testing purposes.
- * TABLE_BITS>1 are lookup-table-driven implementations referred to as
- * "Shoup's" in GCM specification. In other words OpenSSL does not cover
- * whole spectrum of possible table driven implementations. Why? In
- * non-"Shoup's" case memory access pattern is segmented in such manner,
- * that it's trivial to see that cache timing information can reveal
- * fair portion of intermediate hash value. Given that ciphertext is
- * always available to attacker, it's possible for him to attempt to
- * deduce secret parameter H and if successful, tamper with messages
- * [which is nothing but trivial in CTR mode]. In "Shoup's" case it's
- * not as trivial, but there is no reason to believe that it's resistant
- * to cache-timing attack. And the thing about "8-bit" implementation is
- * that it consumes 16 (sixteen) times more memory, 4KB per individual
- * key + 1KB shared. Well, on pros side it should be twice as fast as
- * "4-bit" version. And for gcc-generated x86[_64] code, "8-bit" version
- * was observed to run ~75% faster, closer to 100% for commercial
- * compilers... Yet "4-bit" procedure is preferred, because it's
- * believed to provide better security-performance balance and adequate
- * all-round performance. "All-round" refers to things like:
- *
- * - shorter setup time effectively improves overall timing for
- * handling short messages;
- * - larger table allocation can become unbearable because of VM
- * subsystem penalties (for example on Windows large enough free
- * results in VM working set trimming, meaning that consequent
- * malloc would immediately incur working set expansion);
- * - larger table has larger cache footprint, which can affect
- * performance of other code paths (not necessarily even from same
- * thread in Hyper-Threading world);
- *
- * Value of 1 is not appropriate for performance reasons.
- */
-#if TABLE_BITS==8
-
static void
-gcm_init_8bit(u128 Htable[256], u64 H[2])
-{
- int i, j;
- u128 V;
-
- Htable[0].hi = 0;
- Htable[0].lo = 0;
- V.hi = H[0];
- V.lo = H[1];
-
- for (Htable[128] = V, i = 64; i > 0; i >>= 1) {
- REDUCE1BIT(V);
- Htable[i] = V;
- }
-
- for (i = 2; i < 256; i <<= 1) {
- u128 *Hi = Htable + i, H0 = *Hi;
- for (j = 1; j < i; ++j) {
- Hi[j].hi = H0.hi ^ Htable[j].hi;
- Hi[j].lo = H0.lo ^ Htable[j].lo;
- }
- }
-}
-
-static void
-gcm_gmult_8bit(u64 Xi[2], const u128 Htable[256])
-{
- u128 Z = { 0, 0};
- const u8 *xi = (const u8 *)Xi + 15;
- size_t rem, n = *xi;
- static const size_t rem_8bit[256] = {
- PACK(0x0000), PACK(0x01C2), PACK(0x0384), PACK(0x0246),
- PACK(0x0708), PACK(0x06CA), PACK(0x048C), PACK(0x054E),
- PACK(0x0E10), PACK(0x0FD2), PACK(0x0D94), PACK(0x0C56),
- PACK(0x0918), PACK(0x08DA), PACK(0x0A9C), PACK(0x0B5E),
- PACK(0x1C20), PACK(0x1DE2), PACK(0x1FA4), PACK(0x1E66),
- PACK(0x1B28), PACK(0x1AEA), PACK(0x18AC), PACK(0x196E),
- PACK(0x1230), PACK(0x13F2), PACK(0x11B4), PACK(0x1076),
- PACK(0x1538), PACK(0x14FA), PACK(0x16BC), PACK(0x177E),
- PACK(0x3840), PACK(0x3982), PACK(0x3BC4), PACK(0x3A06),
- PACK(0x3F48), PACK(0x3E8A), PACK(0x3CCC), PACK(0x3D0E),
- PACK(0x3650), PACK(0x3792), PACK(0x35D4), PACK(0x3416),
- PACK(0x3158), PACK(0x309A), PACK(0x32DC), PACK(0x331E),
- PACK(0x2460), PACK(0x25A2), PACK(0x27E4), PACK(0x2626),
- PACK(0x2368), PACK(0x22AA), PACK(0x20EC), PACK(0x212E),
- PACK(0x2A70), PACK(0x2BB2), PACK(0x29F4), PACK(0x2836),
- PACK(0x2D78), PACK(0x2CBA), PACK(0x2EFC), PACK(0x2F3E),
- PACK(0x7080), PACK(0x7142), PACK(0x7304), PACK(0x72C6),
- PACK(0x7788), PACK(0x764A), PACK(0x740C), PACK(0x75CE),
- PACK(0x7E90), PACK(0x7F52), PACK(0x7D14), PACK(0x7CD6),
- PACK(0x7998), PACK(0x785A), PACK(0x7A1C), PACK(0x7BDE),
- PACK(0x6CA0), PACK(0x6D62), PACK(0x6F24), PACK(0x6EE6),
- PACK(0x6BA8), PACK(0x6A6A), PACK(0x682C), PACK(0x69EE),
- PACK(0x62B0), PACK(0x6372), PACK(0x6134), PACK(0x60F6),
- PACK(0x65B8), PACK(0x647A), PACK(0x663C), PACK(0x67FE),
- PACK(0x48C0), PACK(0x4902), PACK(0x4B44), PACK(0x4A86),
- PACK(0x4FC8), PACK(0x4E0A), PACK(0x4C4C), PACK(0x4D8E),
- PACK(0x46D0), PACK(0x4712), PACK(0x4554), PACK(0x4496),
- PACK(0x41D8), PACK(0x401A), PACK(0x425C), PACK(0x439E),
- PACK(0x54E0), PACK(0x5522), PACK(0x5764), PACK(0x56A6),
- PACK(0x53E8), PACK(0x522A), PACK(0x506C), PACK(0x51AE),
- PACK(0x5AF0), PACK(0x5B32), PACK(0x5974), PACK(0x58B6),
- PACK(0x5DF8), PACK(0x5C3A), PACK(0x5E7C), PACK(0x5FBE),
- PACK(0xE100), PACK(0xE0C2), PACK(0xE284), PACK(0xE346),
- PACK(0xE608), PACK(0xE7CA), PACK(0xE58C), PACK(0xE44E),
- PACK(0xEF10), PACK(0xEED2), PACK(0xEC94), PACK(0xED56),
- PACK(0xE818), PACK(0xE9DA), PACK(0xEB9C), PACK(0xEA5E),
- PACK(0xFD20), PACK(0xFCE2), PACK(0xFEA4), PACK(0xFF66),
- PACK(0xFA28), PACK(0xFBEA), PACK(0xF9AC), PACK(0xF86E),
- PACK(0xF330), PACK(0xF2F2), PACK(0xF0B4), PACK(0xF176),
- PACK(0xF438), PACK(0xF5FA), PACK(0xF7BC), PACK(0xF67E),
- PACK(0xD940), PACK(0xD882), PACK(0xDAC4), PACK(0xDB06),
- PACK(0xDE48), PACK(0xDF8A), PACK(0xDDCC), PACK(0xDC0E),
- PACK(0xD750), PACK(0xD692), PACK(0xD4D4), PACK(0xD516),
- PACK(0xD058), PACK(0xD19A), PACK(0xD3DC), PACK(0xD21E),
- PACK(0xC560), PACK(0xC4A2), PACK(0xC6E4), PACK(0xC726),
- PACK(0xC268), PACK(0xC3AA), PACK(0xC1EC), PACK(0xC02E),
- PACK(0xCB70), PACK(0xCAB2), PACK(0xC8F4), PACK(0xC936),
- PACK(0xCC78), PACK(0xCDBA), PACK(0xCFFC), PACK(0xCE3E),
- PACK(0x9180), PACK(0x9042), PACK(0x9204), PACK(0x93C6),
- PACK(0x9688), PACK(0x974A), PACK(0x950C), PACK(0x94CE),
- PACK(0x9F90), PACK(0x9E52), PACK(0x9C14), PACK(0x9DD6),
- PACK(0x9898), PACK(0x995A), PACK(0x9B1C), PACK(0x9ADE),
- PACK(0x8DA0), PACK(0x8C62), PACK(0x8E24), PACK(0x8FE6),
- PACK(0x8AA8), PACK(0x8B6A), PACK(0x892C), PACK(0x88EE),
- PACK(0x83B0), PACK(0x8272), PACK(0x8034), PACK(0x81F6),
- PACK(0x84B8), PACK(0x857A), PACK(0x873C), PACK(0x86FE),
- PACK(0xA9C0), PACK(0xA802), PACK(0xAA44), PACK(0xAB86),
- PACK(0xAEC8), PACK(0xAF0A), PACK(0xAD4C), PACK(0xAC8E),
- PACK(0xA7D0), PACK(0xA612), PACK(0xA454), PACK(0xA596),
- PACK(0xA0D8), PACK(0xA11A), PACK(0xA35C), PACK(0xA29E),
- PACK(0xB5E0), PACK(0xB422), PACK(0xB664), PACK(0xB7A6),
- PACK(0xB2E8), PACK(0xB32A), PACK(0xB16C), PACK(0xB0AE),
- PACK(0xBBF0), PACK(0xBA32), PACK(0xB874), PACK(0xB9B6),
- PACK(0xBCF8), PACK(0xBD3A), PACK(0xBF7C), PACK(0xBEBE) };
-
- while (1) {
- Z.hi ^= Htable[n].hi;
- Z.lo ^= Htable[n].lo;
-
- if ((u8 *)Xi == xi)
- break;
-
- n = *(--xi);
-
- rem = (size_t)Z.lo & 0xff;
- Z.lo = (Z.hi << 56)|(Z.lo >> 8);
- Z.hi = (Z.hi >> 8);
-#if SIZE_MAX == 0xffffffffffffffff
- Z.hi ^= rem_8bit[rem];
-#else
- Z.hi ^= (u64)rem_8bit[rem] << 32;
-#endif
- }
-
- Xi[0] = htobe64(Z.hi);
- Xi[1] = htobe64(Z.lo);
-}
-
-static inline void
-gcm_mul(GCM128_CONTEXT *ctx, u64 u[2])
-{
- gcm_gmult_8bit(u, ctx->Htable);
-}
-
-static inline void
-gcm_ghash(GCM128_CONTEXT *ctx, const uint8_t *in, size_t len)
-{
- size_t i;
-
- while (len >= 16) {
- for (i = 0; i < 16; ++i)
- ctx->Xi.c[i] ^= in[i];
- gcm_mul(ctx, ctx->Xi.u);
- in += 16;
- len -= 16;
- }
-}
-
-#elif TABLE_BITS==4
-
-static void
gcm_init_4bit(u128 Htable[16], u64 H[2])
{
u128 V;
*/
#define GHASH_CHUNK (3*1024)
-#else /* TABLE_BITS */
-
-static void
-gcm_gmult_1bit(u64 Xi[2], const u64 H[2])
-{
- u128 V, Z = { 0, 0 };
- u64 X;
- int i, j;
-
- V.hi = H[0]; /* H is in host byte order, no byte swapping */
- V.lo = H[1];
-
- for (j = 0; j < 2; j++) {
- X = be64toh(Xi[j]);
-
- for (i = 0; i < 64; i++) {
- u64 M = 0 - (X >> 63);
- Z.hi ^= V.hi & M;
- Z.lo ^= V.lo & M;
- X <<= 1;
-
- REDUCE1BIT(V);
- }
- }
-
- Xi[0] = htobe64(Z.hi);
- Xi[1] = htobe64(Z.lo);
-}
-
-static inline void
-gcm_mul(GCM128_CONTEXT *ctx, u64 u[2])
-{
- gcm_gmult_1bit(u, ctx->H.u);
-}
-
-static inline void
-gcm_ghash(GCM128_CONTEXT *ctx, const uint8_t *in, size_t len)
-{
- size_t i;
-
- while (len >= 16) {
- for (i = 0; i < 16; ++i)
- ctx->Xi.c[i] ^= in[i];
- gcm_mul(ctx, ctx->Xi.u);
- in += 16;
- len -= 16;
- }
-}
-#endif
-
#if defined(GHASH_ASM) && \
(defined(__i386) || defined(__i386__) || \
defined(__x86_64) || defined(__x86_64__) || \
#include "x86_arch.h"
#endif
-#if TABLE_BITS==4 && defined(GHASH_ASM)
+#if defined(GHASH_ASM)
# if (defined(__i386) || defined(__i386__) || \
defined(__x86_64) || defined(__x86_64__) || \
defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64))
ctx->H.u[0] = be64toh(ctx->H.u[0]);
ctx->H.u[1] = be64toh(ctx->H.u[1]);
-#if TABLE_BITS==8
- gcm_init_8bit(ctx->Htable, ctx->H.u);
-#elif TABLE_BITS==4
# if defined(GHASH_ASM_X86_OR_64)
# if !defined(GHASH_ASM_X86) || defined(OPENSSL_IA32_SSE2)
/* check FXSR and PCLMULQDQ bits */
# else
gcm_init_4bit(ctx->Htable, ctx->H.u);
# endif
-#endif
}
LCRYPTO_ALIAS(CRYPTO_gcm128_init);
blob - c04db034d03ba62c7f2afc10122bfe77f3de087f
blob + 81994876e37f3d8d5bb2d17a587b29105f1aab10
--- lib/libcrypto/modes/modes_local.h
+++ lib/libcrypto/modes/modes_local.h
-/* $OpenBSD: modes_local.h,v 1.4 2025/04/23 14:15:19 jsing Exp $ */
+/* $OpenBSD: modes_local.h,v 1.5 2025/05/17 14:43:17 jsing Exp $ */
/* ====================================================================
* Copyright (c) 2010 The OpenSSL Project. All rights reserved.
*
u64 hi, lo;
} u128;
-#ifdef TABLE_BITS
-#undef TABLE_BITS
-#endif
-/*
- * Even though permitted values for TABLE_BITS are 8, 4 and 1, it should
- * never be set to 8 [or 1]. For further information see gcm128.c.
- */
-#define TABLE_BITS 4
-
struct gcm128_context {
/* Following 6 names follow names in GCM specification */
union {
} Yi, EKi, EK0, len, Xi, H;
/* Relative position of Xi, H and pre-computed Htable is used
* in some assembler modules, i.e. don't change the order! */
-#if TABLE_BITS==8
- u128 Htable[256];
-#else
u128 Htable[16];
void (*gmult)(u64 Xi[2], const u128 Htable[16]);
void (*ghash)(u64 Xi[2], const u128 Htable[16], const u8 *inp,
size_t len);
-#endif
unsigned int mres, ares;
block128_f block;
void *key;
