static int noise_aesgcm_encrypt
(NoiseCipherState *state, const uint8_t *ad, size_t ad_len,
uint8_t *data, size_t len)
{
NoiseAESGCMState *st = (NoiseAESGCMState *)state;
noise_aesgcm_setup_iv(st);
if (ad_len) {
ghash_update(&(st->ghash), ad, ad_len);
ghash_pad(&(st->ghash));
}
noise_aesgcm_encrypt_or_decrypt(st, data, len);
ghash_update(&(st->ghash), data, len);
noise_aesgcm_finalize_hash(st, data + len, ad_len, len);
return NOISE_ERROR_NONE;
}
void GHASH::add_final_block(secure_vector<uint8_t>& hash,
size_t ad_len, size_t text_len)
{
secure_vector<uint8_t> final_block(GCM_BS);
store_be<uint64_t>(final_block.data(), 8*ad_len, 8*text_len);
ghash_update(hash, final_block.data(), final_block.size());
}
void GHASH::set_associated_data(const uint8_t input[], size_t length)
{
zeroise(m_H_ad);
ghash_update(m_H_ad, input, length);
m_ad_len = length;
}
void GHASH::add_final_block(secure_vector<byte>& hash,
size_t ad_len, size_t text_len)
{
secure_vector<byte> final_block(16);
store_be<u64bit>(final_block.data(), 8*ad_len, 8*text_len);
ghash_update(hash, final_block.data(), final_block.size());
}
void GHASH::update(const uint8_t input[], size_t length)
{
BOTAN_ASSERT(m_ghash.size() == GCM_BS, "Key was set");
m_text_len += length;
ghash_update(m_ghash, input, length);
}
/**
* \brief Finalizes the GHASH state.
*
* \param st The cipher state for AESGCM.
* \param hash The buffer where to place the final hash value.
* \param ad_len The length of the associated data.
* \param data_len The length of the plaintext data.
*/
static void noise_aesgcm_finalize_hash
(NoiseAESGCMState *st, uint8_t *hash, size_t ad_len, size_t data_len)
{
uint8_t *value;
uint8_t index;
uint8_t block[16];
/* Pad the GHASH data to a 16-byte boundary */
ghash_pad(&(st->ghash));
/* Add the sizes (in bits, not bytes) in a final block */
PUT_UINT64(block, ((uint64_t)ad_len) * 8);
PUT_UINT64(block + 8, ((uint64_t)data_len) * 8);
ghash_update(&(st->ghash), block, 16);
/* Read the result directly out of ghash.Y and XOR with the hash nonce */
value = (uint8_t *)(st->ghash.Y);
for (index = 0; index < 16; ++index)
hash[index] = st->hash[index] ^ value[index];
}