main/vaseboot
main
/
vaseboot
1
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity
vaseboot/VasEBoot-core/lib/libgcrypt/cipher/cipher-gcm-siv.c

665 lines
18 KiB
C
Raw Permalink Blame History

/* cipher-gcm-siv.c - GCM-SIV implementation (RFC 8452)
* Copyright (C) 2021 Jussi Kivilinna <jussi.kivilinna@iki.fi>
*
* This file is part of Libgcrypt.
*
* Libgcrypt is free software; you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as
* published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* Libgcrypt is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
#include <config.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include "g10lib.h"
#include "cipher.h"
#include "bufhelp.h"
#include "./cipher-internal.h"
#define GCM_SIV_NONCE_LENGTH (96 / 8)
static inline void
mulx_ghash (byte *a)
{
u64 t[2], mask;
t[0] = buf_get_be64(a + 0);
t[1] = buf_get_be64(a + 8);
mask = -(t[1] & 1) & 0xe1;
mask <<= 56;
buf_put_be64(a + 8, (t[1] >> 1) ^ (t[0] << 63));
buf_put_be64(a + 0, (t[0] >> 1) ^ mask);
}
static inline void
gcm_siv_bytecounter_add (u32 ctr[2], size_t add)
{
if (sizeof(add) > sizeof(u32))
{
u32 high_add = ((add >> 31) >> 1) & 0xffffffff;
ctr[1] += high_add;
}
ctr[0] += add;
if (ctr[0] >= add)
return;
++ctr[1];
}
static inline int
gcm_siv_check_len (u32 ctr[2])
{
/* len(plaintext/aadlen) <= 2^39-256 bits == 2^36-32 bytes == 2^32-2 blocks */
if (ctr[1] > 0xfU)
return 0;
if (ctr[1] < 0xfU)
return 1;
if (ctr[0] <= 0xffffffe0U)
return 1;
return 0;
}
static void
polyval_set_key (gcry_cipher_hd_t c, const byte *auth_key)
{
cipher_block_bswap (c->u_mode.gcm.u_ghash_key.key, auth_key,
GCRY_SIV_BLOCK_LEN);
mulx_ghash (c->u_mode.gcm.u_ghash_key.key);
_gcry_cipher_gcm_setupM (c);
}
static void
do_polyval_buf(gcry_cipher_hd_t c, byte *hash, const byte *buf,
size_t buflen, int do_padding)
{
unsigned int blocksize = GCRY_SIV_BLOCK_LEN;
unsigned int unused = c->u_mode.gcm.mac_unused;
ghash_fn_t ghash_fn = c->u_mode.gcm.ghash_fn;
ghash_fn_t polyval_fn = c->u_mode.gcm.polyval_fn;
byte tmp_blocks[16][GCRY_SIV_BLOCK_LEN];
size_t nblocks, n;
unsigned int burn = 0, nburn;
unsigned int num_blks_used = 0;
if (buflen == 0 && (unused == 0 || !do_padding))
return;
do
{
if (buflen > 0 && (buflen + unused < blocksize || unused > 0))
{
n = blocksize - unused;
n = n < buflen ? n : buflen;
buf_cpy (&c->u_mode.gcm.macbuf[unused], buf, n);
unused += n;
buf += n;
buflen -= n;
}
if (!buflen)
{
if (!do_padding && unused < blocksize)
{
break;
}
n = blocksize - unused;
if (n > 0)
{
memset (&c->u_mode.gcm.macbuf[unused], 0, n);
unused = blocksize;
}
}
if (unused > 0)
{
gcry_assert (unused == blocksize);
/* Process one block from macbuf. */
if (polyval_fn)
{
nburn = polyval_fn (c, hash, c->u_mode.gcm.macbuf, 1);
}
else
{
cipher_block_bswap (c->u_mode.gcm.macbuf, c->u_mode.gcm.macbuf,
blocksize);
nburn = ghash_fn (c, hash, c->u_mode.gcm.macbuf, 1);
}
burn = nburn > burn ? nburn : burn;
unused = 0;
}
nblocks = buflen / blocksize;
while (nblocks)
{
if (polyval_fn)
{
n = nblocks;
nburn = polyval_fn (c, hash, buf, n);
}
else
{
for (n = 0; n < (nblocks > 16 ? 16 : nblocks); n++)
cipher_block_bswap (tmp_blocks[n], buf + n * blocksize,
blocksize);
num_blks_used = n > num_blks_used ? n : num_blks_used;
nburn = ghash_fn (c, hash, tmp_blocks[0], n);
}
burn = nburn > burn ? nburn : burn;
buf += n * blocksize;
buflen -= n * blocksize;
nblocks -= n;
}
}
while (buflen > 0);
c->u_mode.gcm.mac_unused = unused;
if (num_blks_used)
wipememory (tmp_blocks, num_blks_used * blocksize);
if (burn)
_gcry_burn_stack (burn);
}
static void
do_ctr_le32 (gcry_cipher_hd_t c, byte *outbuf, const byte *inbuf,
size_t inbuflen)
{
gcry_cipher_encrypt_t enc_fn = c->spec->encrypt;
unsigned char tmp[GCRY_SIV_BLOCK_LEN];
unsigned int burn = 0, nburn;
size_t nblocks;
if (inbuflen == 0)
return;
/* Use a bulk method if available. */
nblocks = inbuflen / GCRY_SIV_BLOCK_LEN;
if (nblocks && c->bulk.ctr32le_enc)
{
c->bulk.ctr32le_enc (c->context.c, c->u_ctr.ctr, outbuf, inbuf, nblocks);
inbuf += nblocks * GCRY_SIV_BLOCK_LEN;
outbuf += nblocks * GCRY_SIV_BLOCK_LEN;
inbuflen -= nblocks * GCRY_SIV_BLOCK_LEN;
}
do
{
nburn = enc_fn (c->context.c, tmp, c->u_ctr.ctr);
burn = nburn > burn ? nburn : burn;
buf_put_le32(c->u_ctr.ctr, buf_get_le32(c->u_ctr.ctr) + 1);
if (inbuflen < GCRY_SIV_BLOCK_LEN)
break;
cipher_block_xor(outbuf, inbuf, tmp, GCRY_SIV_BLOCK_LEN);
inbuflen -= GCRY_SIV_BLOCK_LEN;
outbuf += GCRY_SIV_BLOCK_LEN;
inbuf += GCRY_SIV_BLOCK_LEN;
}
while (inbuflen);
if (inbuflen)
{
buf_xor(outbuf, inbuf, tmp, inbuflen);
outbuf += inbuflen;
inbuf += inbuflen;
inbuflen -= inbuflen;
}
wipememory (tmp, sizeof(tmp));
if (burn > 0)
_gcry_burn_stack (burn + 4 * sizeof(void *));
}
static int
gcm_siv_selftest (gcry_cipher_hd_t c)
{
static const byte in1[GCRY_SIV_BLOCK_LEN] =
"\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
static const byte out1[GCRY_SIV_BLOCK_LEN] =
"\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
static const byte in2[GCRY_SIV_BLOCK_LEN] =
"\x9c\x98\xc0\x4d\xf9\x38\x7d\xed\x82\x81\x75\xa9\x2b\xa6\x52\xd8";
static const byte out2[GCRY_SIV_BLOCK_LEN] =
"\x4e\x4c\x60\x26\xfc\x9c\x3e\xf6\xc1\x40\xba\xd4\x95\xd3\x29\x6c";
static const byte polyval_key[GCRY_SIV_BLOCK_LEN] =
"\x25\x62\x93\x47\x58\x92\x42\x76\x1d\x31\xf8\x26\xba\x4b\x75\x7b";
static const byte ghash_key[GCRY_SIV_BLOCK_LEN] =
"\xdc\xba\xa5\xdd\x13\x7c\x18\x8e\xbb\x21\x49\x2c\x23\xc9\xb1\x12";
static const byte polyval_data[GCRY_SIV_BLOCK_LEN * 2] =
"\x4f\x4f\x95\x66\x8c\x83\xdf\xb6\x40\x17\x62\xbb\x2d\x01\xa2\x62"
"\xd1\xa2\x4d\xdd\x27\x21\xd0\x06\xbb\xe4\x5f\x20\xd3\xc9\xf3\x62";
static const byte polyval_tag[GCRY_SIV_BLOCK_LEN] =
"\xf7\xa3\xb4\x7b\x84\x61\x19\xfa\xe5\xb7\x86\x6c\xf5\xe5\xb7\x7e";
byte tmp[GCRY_SIV_BLOCK_LEN];
/* Test mulx_ghash */
memcpy (tmp, in1, GCRY_SIV_BLOCK_LEN);
mulx_ghash (tmp);
if (memcmp (tmp, out1, GCRY_SIV_BLOCK_LEN) != 0)
return -1;
memcpy (tmp, in2, GCRY_SIV_BLOCK_LEN);
mulx_ghash (tmp);
if (memcmp (tmp, out2, GCRY_SIV_BLOCK_LEN) != 0)
return -1;
/* Test GHASH key generation */
memcpy (tmp, polyval_key, GCRY_SIV_BLOCK_LEN);
cipher_block_bswap (tmp, tmp, GCRY_SIV_BLOCK_LEN);
mulx_ghash (tmp);
if (memcmp (tmp, ghash_key, GCRY_SIV_BLOCK_LEN) != 0)
return -1;
/* Test POLYVAL */
memset (&c->u_mode.gcm, 0, sizeof(c->u_mode.gcm));
polyval_set_key (c, polyval_key);
memset (&tmp, 0, sizeof(tmp));
do_polyval_buf (c, tmp, polyval_data, GCRY_SIV_BLOCK_LEN * 2, 1);
cipher_block_bswap (tmp, tmp, GCRY_SIV_BLOCK_LEN);
if (memcmp (tmp, polyval_tag, GCRY_SIV_BLOCK_LEN) != 0)
return -1;
return 0;
}
gcry_err_code_t
_gcry_cipher_gcm_siv_setkey (gcry_cipher_hd_t c, unsigned int keylen)
{
static int done;
if (keylen != 16 && keylen != 32)
return GPG_ERR_INV_KEYLEN;
if (!done)
{
if (gcm_siv_selftest (c))
return GPG_ERR_SELFTEST_FAILED;
done = 1;
}
c->marks.iv = 0;
c->marks.tag = 0;
memset (&c->u_mode.gcm, 0, sizeof(c->u_mode.gcm));
c->u_mode.gcm.siv_keylen = keylen;
return 0;
}
gcry_err_code_t
_gcry_cipher_gcm_siv_set_nonce (gcry_cipher_hd_t c, const byte *iv,
size_t ivlen)
{
byte auth_key[GCRY_SIV_BLOCK_LEN];
byte tmp_in[GCRY_SIV_BLOCK_LEN];
byte tmp[GCRY_SIV_BLOCK_LEN];
byte enc_key[32];
gcry_err_code_t err;
if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)
return GPG_ERR_CIPHER_ALGO;
if (ivlen != GCM_SIV_NONCE_LENGTH)
return GPG_ERR_INV_ARG;
if (c->u_mode.gcm.siv_keylen == 0)
return GPG_ERR_INV_STATE;
if (c->marks.iv)
{
/* If nonce is already set, use cipher_reset or setkey first to reset
* cipher state. */
return GPG_ERR_INV_STATE;
}
memset (c->u_mode.gcm.aadlen, 0, sizeof(c->u_mode.gcm.aadlen));
memset (c->u_mode.gcm.datalen, 0, sizeof(c->u_mode.gcm.datalen));
memset (c->u_mode.gcm.u_tag.tag, 0, sizeof(c->u_mode.gcm.u_tag.tag));
c->u_mode.gcm.datalen_over_limits = 0;
c->u_mode.gcm.ghash_data_finalized = 0;
c->u_mode.gcm.ghash_aad_finalized = 0;
memset (c->u_iv.iv, 0, GCRY_SIV_BLOCK_LEN);
memcpy (c->u_iv.iv, iv, ivlen);
memcpy (tmp_in + 4, iv, ivlen);
/* Derive message authentication key */
buf_put_le32(tmp_in, 0);
c->spec->encrypt (&c->context.c, tmp, tmp_in);
memcpy (auth_key + 0, tmp, 8);
buf_put_le32(tmp_in, 1);
c->spec->encrypt (&c->context.c, tmp, tmp_in);
memcpy (auth_key + 8, tmp, 8);
polyval_set_key (c, auth_key);
wipememory (auth_key, sizeof(auth_key));
/* Derive message encryption key */
buf_put_le32(tmp_in, 2);
c->spec->encrypt (&c->context.c, tmp, tmp_in);
memcpy (enc_key + 0, tmp, 8);
buf_put_le32(tmp_in, 3);
c->spec->encrypt (&c->context.c, tmp, tmp_in);
memcpy (enc_key + 8, tmp, 8);
if (c->u_mode.gcm.siv_keylen >= 24)
{
buf_put_le32(tmp_in, 4);
c->spec->encrypt (&c->context.c, tmp, tmp_in);
memcpy (enc_key + 16, tmp, 8);
}
if (c->u_mode.gcm.siv_keylen >= 32)
{
buf_put_le32(tmp_in, 5);
c->spec->encrypt (&c->context.c, tmp, tmp_in);
memcpy (enc_key + 24, tmp, 8);
}
wipememory (tmp, sizeof(tmp));
wipememory (tmp_in, sizeof(tmp_in));
err = c->spec->setkey (&c->context.c, enc_key, c->u_mode.gcm.siv_keylen,
&c->bulk);
wipememory (enc_key, sizeof(enc_key));
if (err)
return err;
c->marks.iv = 1;
return 0;
}
gcry_err_code_t
_gcry_cipher_gcm_siv_authenticate (gcry_cipher_hd_t c,
const byte *aadbuf, size_t aadbuflen)
{
if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)
return GPG_ERR_CIPHER_ALGO;
if (c->u_mode.gcm.datalen_over_limits)
return GPG_ERR_INV_LENGTH;
if (c->marks.tag
|| !c->marks.iv
|| c->u_mode.gcm.ghash_aad_finalized
|| c->u_mode.gcm.ghash_data_finalized
|| !c->u_mode.gcm.ghash_fn)
return GPG_ERR_INV_STATE;
gcm_siv_bytecounter_add (c->u_mode.gcm.aadlen, aadbuflen);
if (!gcm_siv_check_len (c->u_mode.gcm.aadlen))
{
c->u_mode.gcm.datalen_over_limits = 1;
return GPG_ERR_INV_LENGTH;
}
do_polyval_buf (c, c->u_mode.gcm.u_tag.tag, aadbuf, aadbuflen, 0);
return 0;
}
gcry_err_code_t
_gcry_cipher_gcm_siv_encrypt (gcry_cipher_hd_t c,
byte *outbuf, size_t outbuflen,
const byte *inbuf, size_t inbuflen)
{
u32 bitlengths[2][2];
if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)
return GPG_ERR_CIPHER_ALGO;
if (outbuflen < inbuflen)
return GPG_ERR_BUFFER_TOO_SHORT;
if (c->u_mode.gcm.datalen_over_limits)
return GPG_ERR_INV_LENGTH;
if (c->marks.tag
|| !c->marks.iv
|| c->u_mode.gcm.ghash_data_finalized
|| !c->u_mode.gcm.ghash_fn)
return GPG_ERR_INV_STATE;
if (!c->u_mode.gcm.ghash_aad_finalized)
{
/* Start of encryption marks end of AAD stream. */
do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, NULL, 0, 1);
c->u_mode.gcm.ghash_aad_finalized = 1;
}
gcm_siv_bytecounter_add (c->u_mode.gcm.datalen, inbuflen);
if (!gcm_siv_check_len (c->u_mode.gcm.datalen))
{
c->u_mode.gcm.datalen_over_limits = 1;
return GPG_ERR_INV_LENGTH;
}
/* Plaintext and padding to POLYVAL. */
do_polyval_buf (c, c->u_mode.gcm.u_tag.tag, inbuf, inbuflen, 1);
c->u_mode.gcm.ghash_data_finalized = 1;
/* aad length */
bitlengths[0][0] = le_bswap32(c->u_mode.gcm.aadlen[0] << 3);
bitlengths[0][1] = le_bswap32((c->u_mode.gcm.aadlen[0] >> 29) |
(c->u_mode.gcm.aadlen[1] << 3));
/* data length */
bitlengths[1][0] = le_bswap32(c->u_mode.gcm.datalen[0] << 3);
bitlengths[1][1] = le_bswap32((c->u_mode.gcm.datalen[0] >> 29) |
(c->u_mode.gcm.datalen[1] << 3));
/* Length block to POLYVAL. */
do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, (byte *)bitlengths,
GCRY_SIV_BLOCK_LEN, 1);
wipememory (bitlengths, sizeof(bitlengths));
/* Prepare tag and counter. */
cipher_block_bswap (c->u_mode.gcm.u_tag.tag, c->u_mode.gcm.u_tag.tag,
GCRY_SIV_BLOCK_LEN);
cipher_block_xor (c->u_mode.gcm.tagiv, c->u_iv.iv, c->u_mode.gcm.u_tag.tag,
GCRY_SIV_BLOCK_LEN);
c->u_mode.gcm.tagiv[GCRY_SIV_BLOCK_LEN - 1] &= 0x7f;
c->spec->encrypt (&c->context.c, c->u_mode.gcm.tagiv, c->u_mode.gcm.tagiv);
c->marks.tag = 1;
memcpy (c->u_ctr.ctr, c->u_mode.gcm.tagiv, GCRY_SIV_BLOCK_LEN);
c->u_ctr.ctr[GCRY_SIV_BLOCK_LEN - 1] |= 0x80;
/* Encrypt data */
do_ctr_le32 (c, outbuf, inbuf, inbuflen);
return 0;
}
gcry_err_code_t
_gcry_cipher_gcm_siv_set_decryption_tag (gcry_cipher_hd_t c,
const byte *tag, size_t taglen)
{
if (taglen != GCRY_SIV_BLOCK_LEN)
return GPG_ERR_INV_ARG;
if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)
return GPG_ERR_CIPHER_ALGO;
if (c->marks.tag)
return GPG_ERR_INV_STATE;
memcpy (c->u_mode.gcm.tagiv, tag, GCRY_SIV_BLOCK_LEN);
c->marks.tag = 1;
return 0;
}
gcry_err_code_t
_gcry_cipher_gcm_siv_decrypt (gcry_cipher_hd_t c,
byte *outbuf, size_t outbuflen,
const byte *inbuf, size_t inbuflen)
{
byte expected_tag[GCRY_SIV_BLOCK_LEN];
u32 bitlengths[2][2];
gcry_err_code_t rc = 0;
if (c->spec->blocksize != GCRY_SIV_BLOCK_LEN)
return GPG_ERR_CIPHER_ALGO;
if (outbuflen < inbuflen)
return GPG_ERR_BUFFER_TOO_SHORT;
if (c->u_mode.gcm.datalen_over_limits)
return GPG_ERR_INV_LENGTH;
if (!c->marks.tag
|| !c->marks.iv
|| c->u_mode.gcm.ghash_data_finalized
|| !c->u_mode.gcm.ghash_fn)
return GPG_ERR_INV_STATE;
if (!c->u_mode.gcm.ghash_aad_finalized)
{
/* Start of encryption marks end of AAD stream. */
do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, NULL, 0, 1);
c->u_mode.gcm.ghash_aad_finalized = 1;
}
gcm_siv_bytecounter_add (c->u_mode.gcm.datalen, inbuflen);
if (!gcm_siv_check_len (c->u_mode.gcm.datalen))
{
c->u_mode.gcm.datalen_over_limits = 1;
return GPG_ERR_INV_LENGTH;
}
/* Prepare counter. */
memcpy (c->u_ctr.ctr, c->u_mode.gcm.tagiv, GCRY_SIV_BLOCK_LEN);
c->u_ctr.ctr[GCRY_SIV_BLOCK_LEN - 1] |= 0x80;
/* Decrypt data. */
do_ctr_le32 (c, outbuf, inbuf, inbuflen);
/* Plaintext and padding to POLYVAL. */
do_polyval_buf (c, c->u_mode.gcm.u_tag.tag, outbuf, inbuflen, 1);
c->u_mode.gcm.ghash_data_finalized = 1;
/* aad length */
bitlengths[0][0] = le_bswap32(c->u_mode.gcm.aadlen[0] << 3);
bitlengths[0][1] = le_bswap32((c->u_mode.gcm.aadlen[0] >> 29) |
(c->u_mode.gcm.aadlen[1] << 3));
/* data length */
bitlengths[1][0] = le_bswap32(c->u_mode.gcm.datalen[0] << 3);
bitlengths[1][1] = le_bswap32((c->u_mode.gcm.datalen[0] >> 29) |
(c->u_mode.gcm.datalen[1] << 3));
/* Length block to POLYVAL. */
do_polyval_buf(c, c->u_mode.gcm.u_tag.tag, (byte *)bitlengths,
GCRY_SIV_BLOCK_LEN, 1);
wipememory (bitlengths, sizeof(bitlengths));
/* Prepare tag. */
cipher_block_bswap (c->u_mode.gcm.u_tag.tag, c->u_mode.gcm.u_tag.tag,
GCRY_SIV_BLOCK_LEN);
cipher_block_xor (expected_tag, c->u_iv.iv, c->u_mode.gcm.u_tag.tag,
GCRY_SIV_BLOCK_LEN);
expected_tag[GCRY_SIV_BLOCK_LEN - 1] &= 0x7f;
c->spec->encrypt (&c->context.c, expected_tag, expected_tag);
if (!buf_eq_const(c->u_mode.gcm.tagiv, expected_tag, GCRY_SIV_BLOCK_LEN))
{
wipememory (outbuf, inbuflen);
rc = GPG_ERR_CHECKSUM;
}
wipememory (expected_tag, sizeof(expected_tag));
return rc;
}
static gcry_err_code_t
_gcry_cipher_gcm_siv_tag (gcry_cipher_hd_t c,
byte * outbuf, size_t outbuflen, int check)
{
gcry_err_code_t err;
if (!c->marks.tag)
{
if (!c->u_mode.gcm.ghash_fn)
return GPG_ERR_INV_STATE;
if (!c->marks.tag)
{
/* Finalize GCM-SIV with zero-length plaintext. */
err = _gcry_cipher_gcm_siv_encrypt (c, NULL, 0, NULL, 0);
if (err != 0)
return err;
}
}
if (c->u_mode.gcm.datalen_over_limits)
return GPG_ERR_INV_LENGTH;
if (!c->u_mode.gcm.ghash_data_finalized)
return GPG_ERR_INV_STATE;
if (!c->marks.tag)
return GPG_ERR_INV_STATE;
if (!check)
{
if (outbuflen > GCRY_SIV_BLOCK_LEN)
outbuflen = GCRY_SIV_BLOCK_LEN;
/* NB: We already checked that OUTBUF is large enough to hold
* the result or has valid truncated length. */
memcpy (outbuf, c->u_mode.gcm.tagiv, outbuflen);
}
else
{
/* OUTBUFLEN gives the length of the user supplied tag in OUTBUF
* and thus we need to compare its length first. */
if (outbuflen != GCRY_SIV_BLOCK_LEN
|| !buf_eq_const (outbuf, c->u_mode.gcm.tagiv, outbuflen))
return GPG_ERR_CHECKSUM;
}
return 0;
}
gcry_err_code_t
_gcry_cipher_gcm_siv_get_tag (gcry_cipher_hd_t c, unsigned char *outtag,
size_t taglen)
{
return _gcry_cipher_gcm_siv_tag (c, outtag, taglen, 0);
}
gcry_err_code_t
_gcry_cipher_gcm_siv_check_tag (gcry_cipher_hd_t c,
const unsigned char *intag,
size_t taglen)
{
return _gcry_cipher_gcm_siv_tag (c, (unsigned char *)intag, taglen, 1);
}
Reference in New Issue View Git Blame Copy Permalink