Adding AES-EAX version using the AES-NI instruction set.

PiperOrigin-RevId: 203378951
GitOrigin-RevId: 62fd8b1b82187a7758e7bbf66de363288305e3d2

cc/subtle/aes_eax_aesni.h

+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+///////////////////////////////////////////////////////////////////////////////
+
+#ifndef TINK_SUBTLE_AES_EAX_AESNI_H_
+#define TINK_SUBTLE_AES_EAX_AESNI_H_
+
+#ifdef __SSE4_1__
+#ifdef __AES__
+
+#include <xmmintrin.h>
+
+#include <memory>
+#include <string>
+
+#include "absl/strings/string_view.h"
+#include "tink/aead.h"
+#include "tink/util/status.h"
+#include "tink/util/statusor.h"
+
+namespace crypto {
+namespace tink {
+namespace subtle {
+
+// This class implements AES-EAX on CPUs that support the AESNI instruction set
+// (as well as SSE 4.1).
+// Currently the implementation supports 128 and 256 bit keys and 96 or 128 bit
+// nonces. AES-EAX allows arbitrary nonce sizes. Allowing only 96 or 128 bits
+// is a tink specific restriction.
+class AesEaxAesni : public Aead {
+ public:
+  static crypto::tink::util::StatusOr<std::unique_ptr<Aead>> New(
+      absl::string_view key_value, size_t nonce_size_in_bytes);
+
+  crypto::tink::util::StatusOr<std::string> Encrypt(
+      absl::string_view plaintext,
+      absl::string_view additional_data) const override;
+
+  crypto::tink::util::StatusOr<std::string> Decrypt(
+      absl::string_view ciphertext,
+      absl::string_view additional_data) const override;
+
+  ~AesEaxAesni() {}
+
+ protected:
+  // The tag size is fixed for this implementation.
+  // Using the full 128-bits of the tag allows an efficient verification.
+  static const size_t TAG_SIZE = 16;
+  static const size_t BLOCK_SIZE = 16;
+
+  virtual bool RawEncrypt(
+    absl::string_view nonce,
+    absl::string_view in,
+    absl::string_view additional_data,
+    uint8_t *ciphertext,
+    size_t ciphertext_size) const;
+
+  virtual bool RawDecrypt(
+    absl::string_view nonce,
+    absl::string_view in,
+    absl::string_view additional_data,
+    uint8_t *plaintext,
+    size_t plaintext_size) const;
+
+ private:
+  AesEaxAesni() {}
+
+  // AesEaxAesni instances are immutable objects.
+  // Therefore, the only place where SetKey should be called is in the
+  // construction, i.e. in New().
+  bool SetKey(absl::string_view key_value, size_t nonce_size_in_bytes);
+
+  // Encrypt a single block.
+  __m128i EncryptBlock(const __m128i block) const;
+
+  // Encrypt 2 blocks with plain AES.
+  void Encrypt2Blocks(
+      const __m128i in0,
+      const __m128i in1,
+      __m128i *out0,
+      __m128i *out1) const;
+
+  // Encrypt 3 blocks and decrypts 1 block.
+  // This is used to decrypt a ciphertext and verify the MAC concurrently.
+  void Encrypt3Decrypt1(
+      const __m128i in0,
+      const __m128i in1,
+      const __m128i in2,
+      const __m128i in_dec,
+      __m128i* out0,
+      __m128i* out1,
+      __m128i* out2,
+      __m128i* out_dec) const;
+
+  // Pads a partial block of size 1 .. 16.
+  __m128i Pad(const uint8_t* data, int len) const;
+
+  // Computes an OMAC.
+  __m128i OMAC(absl::string_view blob, int tag) const;
+
+  static const int kMaxRounds = 14;  // maximal number of rounds
+  static const int kMaxRoundKeys = kMaxRounds + 1;  // max number of round keys
+  __m128i round_key_[kMaxRoundKeys];
+  __m128i round_dec_key_[kMaxRoundKeys];
+  __m128i B_;  // Used for padding
+  __m128i P_;  // Used for padding
+  int rounds_;
+  size_t nonce_size_;
+};
+
+}  // namespace subtle
+}  // namespace tink
+}  // namespace crypto
+
+#endif  // __AES__
+#endif  // __SSE4_1__
+#endif  // TINK_SUBTLE_AES_EAX_AESNI_H_
+

cc/subtle/aes_eax_aesni_test.cc

+// Copyright 2017 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include "tink/subtle/aes_eax_aesni.h"
+
+#include <string>
+#include <vector>
+
+#include "tink/subtle/wycheproof_util.h"
+#include "tink/util/status.h"
+#include "tink/util/statusor.h"
+#include "tink/util/test_util.h"
+#include "gtest/gtest.h"
+
+namespace crypto {
+namespace tink {
+namespace subtle {
+namespace {
+
+TEST(AesEaxAesniTest, testBasic) {
+  std::string key(test::HexDecodeOrDie("000102030405060708090a0b0c0d0e0f"));
+  size_t nonce_size = 12;
+  auto res = AesEaxAesni::New(key, nonce_size);
+  EXPECT_TRUE(res.ok()) << res.status();
+  auto cipher = std::move(res.ValueOrDie());
+  std::string message = "Some data to encrypt.";
+  std::string aad = "Some data to authenticate.";
+  auto ct = cipher->Encrypt(message, aad);
+  EXPECT_TRUE(ct.ok()) << ct.status();
+  EXPECT_EQ(ct.ValueOrDie().size(), message.size() + nonce_size + 16);
+  auto pt = cipher->Decrypt(ct.ValueOrDie(), aad);
+  EXPECT_TRUE(pt.ok()) << pt.status();
+  EXPECT_EQ(pt.ValueOrDie(), message);
+}
+
+TEST(AesEaxAesniTest, testMessageSize) {
+  std::string key(test::HexDecodeOrDie("000102030405060708090a0b0c0d0e0f"));
+  size_t nonce_size = 12;
+  auto res = AesEaxAesni::New(key, nonce_size);
+  EXPECT_TRUE(res.ok()) << res.status();
+  auto cipher = std::move(res.ValueOrDie());
+  for (size_t size = 0; size < 260; size++) {
+    std::string message(size, 'x');
+    std::string aad = "";
+    auto ct = cipher->Encrypt(message, aad);
+    EXPECT_TRUE(ct.ok()) << ct.status();
+    EXPECT_EQ(ct.ValueOrDie().size(), message.size() + nonce_size + 16);
+    auto pt = cipher->Decrypt(ct.ValueOrDie(), aad);
+    EXPECT_TRUE(pt.ok()) << pt.status();
+    EXPECT_EQ(pt.ValueOrDie(), message);
+  }
+}
+
+TEST(AesEaxAesniTest, testAadSize) {
+  std::string key(test::HexDecodeOrDie("000102030405060708090a0b0c0d0e0f"));
+  size_t nonce_size = 12;
+  auto res = AesEaxAesni::New(key, nonce_size);
+  EXPECT_TRUE(res.ok()) << res.status();
+  auto cipher = std::move(res.ValueOrDie());
+  for (size_t size = 0; size < 260; size++) {
+    std::string message("Some message");
+    std::string aad(size, 'x');
+    auto ct = cipher->Encrypt(message, aad);
+    EXPECT_TRUE(ct.ok()) << ct.status();
+    EXPECT_EQ(ct.ValueOrDie().size(), message.size() + nonce_size + 16);
+    auto pt = cipher->Decrypt(ct.ValueOrDie(), aad);
+    EXPECT_TRUE(pt.ok()) << pt.status();
+    EXPECT_EQ(pt.ValueOrDie(), message);
+  }
+}
+
+TEST(AesEaxAesniTest, testLongNonce) {
+  std::string key(test::HexDecodeOrDie("000102030405060708090a0b0c0d0e0f"));
+  size_t nonce_size = 16;
+  auto res = AesEaxAesni::New(key, nonce_size);
+  EXPECT_TRUE(res.ok()) << res.status();
+  auto cipher = std::move(res.ValueOrDie());
+  std::string message = "Some data to encrypt.";
+  std::string aad = "Some data to authenticate.";
+  auto ct = cipher->Encrypt(message, aad);
+  EXPECT_TRUE(ct.ok()) << ct.status();
+  EXPECT_EQ(ct.ValueOrDie().size(), message.size() + nonce_size + 16);
+  auto pt = cipher->Decrypt(ct.ValueOrDie(), aad);
+  EXPECT_TRUE(pt.ok()) << pt.status();
+  EXPECT_EQ(pt.ValueOrDie(), message);
+}
+
+TEST(AesEaxAesniTest, testModification) {
+  size_t nonce_size = 12;
+  std::string key(test::HexDecodeOrDie("000102030405060708090a0b0c0d0e0f"));
+  auto cipher = std::move(AesEaxAesni::New(key, nonce_size).ValueOrDie());
+  std::string message = "Some data to encrypt.";
+  std::string aad = "Some data to authenticate.";
+  std::string ct = cipher->Encrypt(message, aad).ValueOrDie();
+  EXPECT_TRUE(cipher->Decrypt(ct, aad).ok());
+  // Modify the ciphertext
+  for (size_t i = 0; i < ct.size() * 8; i++) {
+    std::string modified_ct = ct;
+    modified_ct[i / 8] ^= 1 << (i % 8);
+    EXPECT_FALSE(cipher->Decrypt(modified_ct, aad).ok()) << i;
+  }
+  // Modify the additional data
+  for (size_t i = 0; i < aad.size() * 8; i++) {
+    std::string modified_aad = aad;
+    modified_aad[i / 8] ^= 1 << (i % 8);
+    auto decrypted = cipher->Decrypt(ct, modified_aad);
+    EXPECT_FALSE(decrypted.ok()) << i << " pt:" << decrypted.ValueOrDie();
+  }
+  // Truncate the ciphertext
+  for (size_t i = 0; i < ct.size(); i++) {
+    std::string truncated_ct(ct, 0, i);
+    EXPECT_FALSE(cipher->Decrypt(truncated_ct, aad).ok()) << i;
+  }
+}
+
+TEST(AesEaxAesniTest, testInvalidKeySizes) {
+  size_t nonce_size = 12;
+  for (int keysize = 0; keysize < 65; keysize++) {
+    if (keysize == 16 || keysize == 24 || keysize == 32) {
+      continue;
+    }
+    std::string key(keysize, 'x');
+    auto cipher = AesEaxAesni::New(key, nonce_size);
+    EXPECT_FALSE(cipher.ok());
+  }
+  absl::string_view null_string_view;
+  auto nokeycipher = AesEaxAesni::New(null_string_view, nonce_size);
+  EXPECT_FALSE(nokeycipher.ok());
+}
+
+TEST(AesEaxAesniTest, testEmpty) {
+  size_t nonce_size = 12;
+  std::string key(test::HexDecodeOrDie("bedcfb5a011ebc84600fcb296c15af0d"));
+  std::string nonce(test::HexDecodeOrDie("438a547a94ea88dce46c6c85"));
+  // Expected tag is an empty std::string with an empty tag is encrypted with
+  // the nonce above;
+  std::string tag(test::HexDecodeOrDie("9607977cd7556b1dfedf0c73a35a5197"));
+  std::string ciphertext = nonce + tag;
+  auto res = AesEaxAesni::New(key, nonce_size);
+  EXPECT_TRUE(res.ok()) << res.status();
+  auto cipher = std::move(res.ValueOrDie());
+
+  // Test decryption of the arguments above.
+  std::string empty_string("");
+  absl::string_view empty_string_view("");
+  absl::string_view null_string_view;
+
+  auto pt = cipher->Decrypt(ciphertext, empty_string);
+  EXPECT_TRUE(pt.ok());
+  EXPECT_EQ(0, pt.ValueOrDie().size());
+
+  pt = cipher->Decrypt(ciphertext, empty_string_view);
+  EXPECT_TRUE(pt.ok());
+  EXPECT_EQ(0, pt.ValueOrDie().size());
+
+  pt = cipher->Decrypt(ciphertext, null_string_view);
+  EXPECT_TRUE(pt.ok());
+  EXPECT_EQ(0, pt.ValueOrDie().size());
+
+  // Test encryption.
+  auto ct = cipher->Encrypt(empty_string, empty_string);
+  EXPECT_TRUE(ct.ok());
+  pt = cipher->Decrypt(ct.ValueOrDie(), empty_string);
+  EXPECT_TRUE(pt.ok());
+  EXPECT_EQ(0, pt.ValueOrDie().size());
+
+  ct = cipher->Encrypt(empty_string_view, empty_string_view);
+  EXPECT_TRUE(ct.ok());
+  pt = cipher->Decrypt(ct.ValueOrDie(), empty_string);
+  EXPECT_TRUE(pt.ok());
+  EXPECT_EQ(0, pt.ValueOrDie().size());
+
+  ct = cipher->Encrypt(empty_string_view, empty_string_view);
+  EXPECT_TRUE(ct.ok());
+  pt = cipher->Decrypt(ct.ValueOrDie(), empty_string);
+  EXPECT_TRUE(pt.ok());
+  EXPECT_EQ(0, pt.ValueOrDie().size());
+
+  ct = cipher->Encrypt(null_string_view, null_string_view);
+  EXPECT_TRUE(ct.ok());
+  pt = cipher->Decrypt(ct.ValueOrDie(), empty_string);
+  EXPECT_TRUE(pt.ok());
+  EXPECT_EQ(0, pt.ValueOrDie().size());
+}
+
+// Test with test vectors from project Wycheproof.
+// AesEaxAesni does not allow to pass in IVs. Therefore this test
+// can only test decryption.
+// Currently AesEaxAesni is restricted to encryption with 12 byte
+// IVs and 16 byte tags. Therefore it is necessary to skip tests with
+// other parameter sizes.
+bool WycheproofTest(const rapidjson::Document &root) {
+  int errors = 0;
+  for (const rapidjson::Value& test_group : root["testGroups"].GetArray()) {
+    const size_t iv_size = test_group["ivSize"].GetInt();
+    const size_t key_size = test_group["keySize"].GetInt();
+    const size_t tag_size = test_group["tagSize"].GetInt();
+    if (key_size != 128 && key_size != 256) {
+      // Not supported
+      continue;
+    }
+    if (iv_size != 128 && iv_size != 96) {
+      // Not supported
+      continue;
+    }
+    if (tag_size != 128) {
+      // Not supported
+      continue;
+    }
+    for (const rapidjson::Value& test : test_group["tests"].GetArray()) {
+      std::string comment = test["comment"].GetString();
+      std::string key = WycheproofUtil::GetBytes(test["key"]);
+      std::string iv = WycheproofUtil::GetBytes(test["iv"]);
+      std::string msg = WycheproofUtil::GetBytes(test["msg"]);
+      std::string ct = WycheproofUtil::GetBytes(test["ct"]);
+      std::string aad = WycheproofUtil::GetBytes(test["aad"]);
+      std::string tag = WycheproofUtil::GetBytes(test["tag"]);
+      int id = test["tcId"].GetInt();
+      std::string expected = test["result"].GetString();
+      auto cipher =
+         std::move(AesEaxAesni::New(key, iv_size / 8).ValueOrDie());
+      auto result = cipher->Decrypt(iv + ct + tag, aad);
+      bool success = result.ok();
+      if (success) {
+        std::string decrypted = result.ValueOrDie();
+        if (expected == "invalid") {
+          ADD_FAILURE() << "decrypted invalid ciphertext:" << id;
+          errors++;
+        } else if (msg != decrypted) {
+          ADD_FAILURE() << "Incorrect decryption:" << id;
+          errors++;
+        }
+      } else {
+        if (expected == "valid" || expected == "acceptable") {
+          ADD_FAILURE()
+              << "Could not decrypt test with tcId:" << id
+              << " iv_size:" << iv_size
+              << " tag_size:" << tag_size
+              << " key_size:" << key_size;
+          errors++;
+        }
+      }
+    }
+  }
+  return errors == 0;
+}
+
+TEST(AesEaxAesniTest, TestVectors) {
+  std::unique_ptr<rapidjson::Document> root =
+      WycheproofUtil::ReadTestVectors("aes_eax_test.json");
+  ASSERT_TRUE(WycheproofTest(*root));
+}
+
+}  // namespace
+}  // namespace subtle
+}  // namespace tink
+}  // namespace crypto
+
+int main(int ac, char* av[]) {
+  testing::InitGoogleTest(&ac, av);
+  return RUN_ALL_TESTS();
+}