XTS.cpp

/*
 * Copyright (C) 2016 Southern Storm Software, Pty Ltd.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included
 * in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 */
 
#include "XTS.h"
#include "Crypto.h"
#include "GF128.h"
#include <string.h>
 
XTSCommon::XTSCommon()
    : sectSize(512)
{
}
 
XTSCommon::~XTSCommon()
{
    clean(twk);
}
 
size_t XTSCommon::keySize() const
{
    return blockCipher1->keySize() * 2;
}
 
size_t XTSCommon::tweakSize() const
{
    return 16;
}
 
bool XTSCommon::setSectorSize(size_t size)
{
    if (size < 16)
        return false;
    sectSize = size;
    return true;
}
 
bool XTSCommon::setKey(const uint8_t *key, size_t len)
{
    if (!blockCipher1->setKey(key, len / 2))
        return false;
    return blockCipher2->setKey(key + len / 2, len - (len / 2));
}
 
bool XTSCommon::setTweak(const uint8_t *tweak, size_t len)
{
    if (len > 16)
        return false;
    memcpy(twk, tweak, len);
    memset(((uint8_t *)twk) + len, 0, 16 - len);
    blockCipher2->encryptBlock((uint8_t *)twk, (uint8_t *)twk);
    return true;
}
 
#define xorTweak(output, input, tweak) \
    do { \
        for (uint8_t i = 0; i < 16; ++i) \
            (output)[i] = (input)[i] ^ ((const uint8_t *)(tweak))[i]; \
    } while (0)
 
void XTSCommon::encryptSector(uint8_t *output, const uint8_t *input)
{
    size_t sectLast = sectSize & ~15;
    size_t posn = 0;
    uint32_t t[4];
    memcpy(t, twk, sizeof(t));
    while (posn < sectLast) {
        // Process all complete 16-byte blocks.
        xorTweak(output, input, t);
        blockCipher1->encryptBlock(output, output);
        xorTweak(output, output, t);
        GF128::dblXTS(t);
        input += 16;
        output += 16;
        posn += 16;
    }
    if (posn < sectSize) {
        // Perform ciphertext stealing on the final partial block.
        uint8_t leftOver = sectSize - posn;
        output -= 16;
        while (leftOver > 0) {
            // Swap the left-over bytes in the last two blocks.
            --leftOver;
            uint8_t temp = input[leftOver];
            output[leftOver + 16] = output[leftOver];
            output[leftOver] = temp;
        }
        xorTweak(output, output, t);
        blockCipher1->encryptBlock(output, output);
        xorTweak(output, output, t);
    }
}
 
void XTSCommon::decryptSector(uint8_t *output, const uint8_t *input)
{
    size_t sectLast = sectSize & ~15;
    size_t posn = 0;
    uint32_t t[4];
    memcpy(t, twk, sizeof(t));
    if (sectLast != sectSize)
        sectLast -= 16;
    while (posn < sectLast) {
        // Process all complete 16-byte blocks.
        xorTweak(output, input, t);
        blockCipher1->decryptBlock(output, output);
        xorTweak(output, output, t);
        GF128::dblXTS(t);
        input += 16;
        output += 16;
        posn += 16;
    }
    if (posn < sectSize) {
        // Perform ciphertext stealing on the final two blocks.
        uint8_t leftOver = sectSize - 16 - posn;
        uint32_t u[4];
 
        // Decrypt the second-last block of ciphertext to recover
        // the last partial block of plaintext.  We need to use
        // dblXTS(t) as the tweak for this block.  Save the current
        // tweak in "u" for use later.
        memcpy(u, t, sizeof(t));
        GF128::dblXTS(t);
        xorTweak(output, input, t);
        blockCipher1->decryptBlock(output, output);
        xorTweak(output, output, t);
 
        // Swap the left-over bytes in the last two blocks.
        while (leftOver > 0) {
            --leftOver;
            uint8_t temp = input[leftOver + 16];
            output[leftOver + 16] = output[leftOver];
            output[leftOver] = temp;
        }
 
        // Decrypt the second-last block using the second-last tweak.
        xorTweak(output, output, u);
        blockCipher1->decryptBlock(output, output);
        xorTweak(output, output, u);
    }
}
 
void XTSCommon::clear()
{
    clean(twk);
    blockCipher1->clear();
    blockCipher2->clear();
}
 
XTSSingleKeyCommon::~XTSSingleKeyCommon()
{
}
 
size_t XTSSingleKeyCommon::keySize() const
{
    return blockCipher1->keySize();
}
 
bool XTSSingleKeyCommon::setKey(const uint8_t *key, size_t len)
{
    return blockCipher1->setKey(key, len);
}