1 // SPDX-License-Identifier: BSD-2-Clause
2 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
3  *
4  * LibTomCrypt is a library that provides various cryptographic
5  * algorithms in a highly modular and flexible manner.
6  *
7  * The library is free for all purposes without any express
8  * guarantee it works.
9  */
10 
11 /**
12    @file ocb3_encrypt_last.c
13    OCB implementation, internal helper, by Karel Miko
14 */
15 #include "tomcrypt_private.h"
16 
17 #ifdef LTC_OCB3_MODE
18 
19 /**
20    Finish an OCB (encryption) stream
21    @param ocb    The OCB state
22    @param pt     The remaining plaintext
23    @param ptlen  The length of the plaintext (octets)
24    @param ct     [out] The output buffer
25    @return CRYPT_OK if successful
26 */
ocb3_encrypt_last(ocb3_state * ocb,const unsigned char * pt,unsigned long ptlen,unsigned char * ct)27 int ocb3_encrypt_last(ocb3_state *ocb, const unsigned char *pt, unsigned long ptlen, unsigned char *ct)
28 {
29    unsigned char iOffset_star[MAXBLOCKSIZE];
30    unsigned char iPad[MAXBLOCKSIZE];
31    int err, x, full_blocks, full_blocks_len, last_block_len;
32 
33    LTC_ARGCHK(ocb != NULL);
34    if (pt == NULL) LTC_ARGCHK(ptlen == 0);
35    if (ptlen != 0) {
36       LTC_ARGCHK(pt    != NULL);
37       LTC_ARGCHK(ct    != NULL);
38    }
39 
40    if ((err = cipher_is_valid(ocb->cipher)) != CRYPT_OK) {
41       goto LBL_ERR;
42    }
43 
44    full_blocks = ptlen/ocb->block_len;
45    full_blocks_len = full_blocks * ocb->block_len;
46    last_block_len = ptlen - full_blocks_len;
47 
48    /* process full blocks first */
49    if (full_blocks>0) {
50      if ((err = ocb3_encrypt(ocb, pt, full_blocks_len, ct)) != CRYPT_OK) {
51        goto LBL_ERR;
52      }
53    }
54 
55    /* at this point: m = ocb->block_index (last block index), Offset_m = ocb->Offset_current */
56 
57    if (last_block_len>0) {
58      /* Offset_* = Offset_m xor L_* */
59      ocb3_int_xor_blocks(iOffset_star, ocb->Offset_current, ocb->L_star, ocb->block_len);
60 
61      /* Pad = ENCIPHER(K, Offset_*) */
62      if ((err = cipher_descriptor[ocb->cipher]->ecb_encrypt(iOffset_star, iPad, &ocb->key)) != CRYPT_OK) {
63        goto LBL_ERR;
64      }
65 
66      /* C_* = P_* xor Pad[1..bitlen(P_*)] */
67      ocb3_int_xor_blocks(ct+full_blocks_len, pt+full_blocks_len, iPad, last_block_len);
68 
69      /* Checksum_* = Checksum_m xor (P_* || 1 || zeros(127-bitlen(P_*))) */
70      ocb3_int_xor_blocks(ocb->checksum, ocb->checksum, pt+full_blocks_len, last_block_len);
71      for(x=last_block_len; x<ocb->block_len; x++) {
72        if (x == last_block_len) {
73          ocb->checksum[x] ^= 0x80;
74        } else {
75          ocb->checksum[x] ^= 0x00;
76        }
77      }
78 
79      /* Tag = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) xor HASH(K,A) */
80      /* at this point we calculate only: Tag_part = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) */
81      for(x=0; x<ocb->block_len; x++) {
82        ocb->tag_part[x] = (ocb->checksum[x] ^ iOffset_star[x]) ^ ocb->L_dollar[x];
83      }
84      if ((err = cipher_descriptor[ocb->cipher]->ecb_encrypt(ocb->tag_part, ocb->tag_part, &ocb->key)) != CRYPT_OK) {
85        goto LBL_ERR;
86      }
87    } else {
88      /* Tag = ENCIPHER(K, Checksum_m xor Offset_m xor L_$) xor HASH(K,A) */
89      /* at this point we calculate only: Tag_part = ENCIPHER(K, Checksum_m xor Offset_m xor L_$) */
90      for(x=0; x<ocb->block_len; x++) {
91        ocb->tag_part[x] = (ocb->checksum[x] ^ ocb->Offset_current[x]) ^ ocb->L_dollar[x];
92      }
93      if ((err = cipher_descriptor[ocb->cipher]->ecb_encrypt(ocb->tag_part, ocb->tag_part, &ocb->key)) != CRYPT_OK) {
94        goto LBL_ERR;
95      }
96    }
97 
98    err = CRYPT_OK;
99 
100 LBL_ERR:
101 #ifdef LTC_CLEAN_STACK
102    zeromem(iOffset_star, MAXBLOCKSIZE);
103    zeromem(iPad, MAXBLOCKSIZE);
104 #endif
105 
106    return err;
107 }
108 
109 #endif
110 
111 /* ref:         $Format:%D$ */
112 /* git commit:  $Format:%H$ */
113 /* commit time: $Format:%ai$ */
114