authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2024-11-22 10:00:49+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2024-11-22 10:00:49+01:00
log636308a17d8f8118ab34e9d4b217baa5878416c4
treed686f3b2cb237c0f6d4a75cf3b22760ae113ac16
parentf845fa04a0dce3104efe129c73a6ad792b1712b6
signaturebadge-check Signed by PGP key B5690EEEBB952194

std.crypto.aes: introduce AES block vectors (#22023)

* std.crypto.aes: introduce AES block vectors Modern Intel CPUs with the VAES extension can handle more than a single AES block per instruction. So can some ARM and RISC-V CPUs. Software implementations with bitslicing can also greatly benefit from this. Implement low-level operations on AES block vectors, and the parallel AEGIS variants on top of them. AMD Zen4: aegis-128x4: 73225 MiB/s aegis-128x2: 51571 MiB/s aegis-128l: 25806 MiB/s aegis-256x4: 46742 MiB/s aegis-256x2: 30227 MiB/s aegis-256: 8436 MiB/s aes128-gcm: 5926 MiB/s aes256-gcm: 5085 MiB/s AES-GCM, and anything based on AES-CTR are also going to benefit from this later. * Make AEGIS-MAC twice a fast

7 files changed, 949 insertions(+), 324 deletions(-)

lib/std/crypto.zig+33-8
...@@ -7,10 +7,23 @@ pub const timing_safe = @import("crypto/timing_safe.zig");...@@ -7,10 +7,23 @@ pub const timing_safe = @import("crypto/timing_safe.zig");
7/// Authenticated Encryption with Associated Data7/// Authenticated Encryption with Associated Data
8pub const aead = struct {8pub const aead = struct {
9 pub const aegis = struct {9 pub const aegis = struct {
10 pub const Aegis128L = @import("crypto/aegis.zig").Aegis128L;10 const variants = @import("crypto/aegis.zig");
11 pub const Aegis128L_256 = @import("crypto/aegis.zig").Aegis128L_256;11
12 pub const Aegis256 = @import("crypto/aegis.zig").Aegis256;12 pub const Aegis128X4 = variants.Aegis128X4;
13 pub const Aegis256_256 = @import("crypto/aegis.zig").Aegis256_256;13 pub const Aegis128X2 = variants.Aegis128X2;
14 pub const Aegis128L = variants.Aegis128L;
15
16 pub const Aegis256X4 = variants.Aegis256X4;
17 pub const Aegis256X2 = variants.Aegis256X2;
18 pub const Aegis256 = variants.Aegis256;
19
20 pub const Aegis128X4_256 = variants.Aegis128X4_256;
21 pub const Aegis128X2_256 = variants.Aegis128X2_256;
22 pub const Aegis128L_256 = variants.Aegis128L_256;
23
24 pub const Aegis256X4_256 = variants.Aegis256X4_256;
25 pub const Aegis256X2_256 = variants.Aegis256X2_256;
26 pub const Aegis256_256 = variants.Aegis256_256;
14 };27 };
1528
16 pub const aes_gcm = struct {29 pub const aes_gcm = struct {
...@@ -44,10 +57,22 @@ pub const auth = struct {...@@ -44,10 +57,22 @@ pub const auth = struct {
44 pub const hmac = @import("crypto/hmac.zig");57 pub const hmac = @import("crypto/hmac.zig");
45 pub const siphash = @import("crypto/siphash.zig");58 pub const siphash = @import("crypto/siphash.zig");
46 pub const aegis = struct {59 pub const aegis = struct {
47 pub const Aegis128LMac = @import("crypto/aegis.zig").Aegis128LMac;60 const variants = @import("crypto/aegis.zig");
48 pub const Aegis128LMac_128 = @import("crypto/aegis.zig").Aegis128LMac_128;61 pub const Aegis128X4Mac = variants.Aegis128X4Mac;
49 pub const Aegis256Mac = @import("crypto/aegis.zig").Aegis256Mac;62 pub const Aegis128X2Mac = variants.Aegis128X2Mac;
50 pub const Aegis256Mac_128 = @import("crypto/aegis.zig").Aegis256Mac_128;63 pub const Aegis128LMac = variants.Aegis128LMac;
64
65 pub const Aegis256X4Mac = variants.Aegis256X4Mac;
66 pub const Aegis256X2Mac = variants.Aegis256X2Mac;
67 pub const Aegis256Mac = variants.Aegis256Mac;
68
69 pub const Aegis128X4Mac_128 = variants.Aegis128X4Mac_128;
70 pub const Aegis128X2Mac_128 = variants.Aegis128X2Mac_128;
71 pub const Aegis128LMac_128 = variants.Aegis128LMac_128;
72
73 pub const Aegis256X4Mac_128 = variants.Aegis256X4Mac_128;
74 pub const Aegis256X2Mac_128 = variants.Aegis256X2Mac_128;
75 pub const Aegis256Mac_128 = variants.Aegis256Mac_128;
51 };76 };
52 pub const cmac = @import("crypto/cmac.zig");77 pub const cmac = @import("crypto/cmac.zig");
53};78};
lib/std/crypto/aegis.zig+482-265
...@@ -1,16 +1,21 @@...@@ -1,16 +1,21 @@
1//! AEGIS is a very fast authenticated encryption system built on top of the core AES function.1//! AEGIS is a very fast authenticated encryption system built on top of the core AES function.
2//!2//!
3//! The AEGIS-128L variant has a 128 bit key, a 128 bit nonce, and processes 256 bit message blocks.3//! The AEGIS-128* variants have a 128 bit key and a 128 bit nonce.
4//! The AEGIS-256 variant has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks.4//! The AEGIS-256* variants have a 256 bit key and a 256 bit nonce.
5//! All of them can compute 128 and 256 bit authentication tags.
5//!6//!
6//! The AEGIS cipher family offers performance that significantly exceeds that of AES-GCM with7//! The AEGIS cipher family offers performance that significantly exceeds that of AES-GCM with
7//! hardware support for parallelizable AES block encryption.8//! hardware support for parallelizable AES block encryption.
8//!9//!
9//! Unlike with AES-GCM, nonces can be safely chosen at random with no practical limit when using AEGIS-256.10//! On high-end Intel CPUs with AVX-512 support, AEGIS-128X4 and AEGIS-256X4 are the fastest options.
10//! AEGIS-128L also allows for more messages to be safely encrypted when using random nonces.11//! On other modern server, desktop and mobile CPUs, AEGIS-128X2 and AEGIS-256X2 are usually the fastest options.
12//! AEGIS-128L and AEGIS-256 perform well on a broad range of platforms, including WebAssembly.
11//!13//!
12//! AEGIS is believed to be key-committing, making it a safer choice than most other AEADs14//! Unlike with AES-GCM, nonces can be safely chosen at random with no practical limit when using AEGIS-256*.
13//! when the key has low entropy, or can be controlled by an attacker.15//! AEGIS-128* also allows for more messages to be safely encrypted when using random nonces.
16//!
17//! Unless the associated data can be fully controled by an adversary, AEGIS is believed to be key-committing,
18//! making it a safer choice than most other AEADs when the key has low entropy, or can be controlled by an attacker.
14//!19//!
15//! Finally, leaking the state does not leak the key.20//! Finally, leaking the state does not leak the key.
16//!21//!
...@@ -20,122 +25,202 @@ const std = @import("std");...@@ -20,122 +25,202 @@ const std = @import("std");
20const crypto = std.crypto;25const crypto = std.crypto;
21const mem = std.mem;26const mem = std.mem;
22const assert = std.debug.assert;27const assert = std.debug.assert;
23const AesBlock = crypto.core.aes.Block;
24const AuthenticationError = crypto.errors.AuthenticationError;28const AuthenticationError = crypto.errors.AuthenticationError;
2529
26/// AEGIS-128L with a 128-bit authentication tag.30/// AEGIS-128X4 with a 128 bit tag
27pub const Aegis128L = Aegis128LGeneric(128);31pub const Aegis128X4 = Aegis128XGeneric(4, 128);
2832/// AEGIS-128X2 with a 128 bit tag
29/// AEGIS-128L with a 256-bit authentication tag.33pub const Aegis128X2 = Aegis128XGeneric(2, 128);
30pub const Aegis128L_256 = Aegis128LGeneric(256);34/// AEGIS-128L with a 128 bit tag
3135pub const Aegis128L = Aegis128XGeneric(1, 128);
32/// AEGIS-256 with a 128-bit authentication tag.36
33pub const Aegis256 = Aegis256Generic(128);37/// AEGIS-256X4 with a 128 bit tag
3438pub const Aegis256X4 = Aegis256XGeneric(4, 128);
35/// AEGIS-256 with a 256-bit authentication tag.39/// AEGIS-256X2 with a 128 bit tag
36pub const Aegis256_256 = Aegis256Generic(256);40pub const Aegis256X2 = Aegis256XGeneric(2, 128);
3741/// AEGIS-256 with a 128 bit tag
38const State128L = struct {42pub const Aegis256 = Aegis256XGeneric(1, 128);
39 blocks: [8]AesBlock,43
4044/// AEGIS-128X4 with a 256 bit tag
41 fn init(key: [16]u8, nonce: [16]u8) State128L {45pub const Aegis128X4_256 = Aegis128XGeneric(4, 256);
42 const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });46/// AEGIS-128X2 with a 256 bit tag
43 const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });47pub const Aegis128X2_256 = Aegis128XGeneric(2, 256);
44 const key_block = AesBlock.fromBytes(&key);48/// AEGIS-128L with a 256 bit tag
45 const nonce_block = AesBlock.fromBytes(&nonce);49pub const Aegis128L_256 = Aegis128XGeneric(1, 256);
46 const blocks = [8]AesBlock{50
47 key_block.xorBlocks(nonce_block),51/// AEGIS-256X4 with a 256 bit tag
48 c1,52pub const Aegis256X4_256 = Aegis256XGeneric(4, 256);
49 c2,53/// AEGIS-256X2 with a 256 bit tag
50 c1,54pub const Aegis256X2_256 = Aegis256XGeneric(2, 256);
51 key_block.xorBlocks(nonce_block),55/// AEGIS-256 with a 256 bit tag
52 key_block.xorBlocks(c2),56pub const Aegis256_256 = Aegis256XGeneric(1, 256);
53 key_block.xorBlocks(c1),57
54 key_block.xorBlocks(c2),58fn State128X(comptime degree: u7) type {
55 };59 return struct {
56 var state = State128L{ .blocks = blocks };60 const AesBlockVec = crypto.core.aes.BlockVec(degree);
57 var i: usize = 0;61 const State = @This();
58 while (i < 10) : (i += 1) {62
59 state.update(nonce_block, key_block);63 blocks: [8]AesBlockVec,
64
65 const aes_block_length = AesBlockVec.block_length;
66 const rate = aes_block_length * 2;
67 const alignment = AesBlockVec.native_word_size;
68
69 fn init(key: [16]u8, nonce: [16]u8) State {
70 const c1 = AesBlockVec.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd } ** degree);
71 const c2 = AesBlockVec.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 } ** degree);
72 const key_block = AesBlockVec.fromBytes(&(key ** degree));
73 const nonce_block = AesBlockVec.fromBytes(&(nonce ** degree));
74 const blocks = [8]AesBlockVec{
75 key_block.xorBlocks(nonce_block),
76 c1,
77 c2,
78 c1,
79 key_block.xorBlocks(nonce_block),
80 key_block.xorBlocks(c2),
81 key_block.xorBlocks(c1),
82 key_block.xorBlocks(c2),
83 };
84 var state = State{ .blocks = blocks };
85 if (degree > 1) {
86 const context_block = ctx: {
87 var contexts_bytes = [_]u8{0} ** aes_block_length;
88 for (0..degree) |i| {
89 contexts_bytes[i * 16] = @intCast(i);
90 contexts_bytes[i * 16 + 1] = @intCast(degree - 1);
91 }
92 break :ctx AesBlockVec.fromBytes(&contexts_bytes);
93 };
94 for (0..10) |_| {
95 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
96 state.blocks[7] = state.blocks[7].xorBlocks(context_block);
97 state.update(nonce_block, key_block);
98 }
99 } else {
100 for (0..10) |_| {
101 state.update(nonce_block, key_block);
102 }
103 }
104 return state;
60 }105 }
61 return state;
62 }
63106
64 inline fn update(state: *State128L, d1: AesBlock, d2: AesBlock) void {107 inline fn update(state: *State, d1: AesBlockVec, d2: AesBlockVec) void {
65 const blocks = &state.blocks;108 const blocks = &state.blocks;
66 const tmp = blocks[7];109 const tmp = blocks[7];
67 comptime var i: usize = 7;110 comptime var i: usize = 7;
68 inline while (i > 0) : (i -= 1) {111 inline while (i > 0) : (i -= 1) {
69 blocks[i] = blocks[i - 1].encrypt(blocks[i]);112 blocks[i] = blocks[i - 1].encrypt(blocks[i]);
113 }
114 blocks[0] = tmp.encrypt(blocks[0]);
115 blocks[0] = blocks[0].xorBlocks(d1);
116 blocks[4] = blocks[4].xorBlocks(d2);
70 }117 }
71 blocks[0] = tmp.encrypt(blocks[0]);
72 blocks[0] = blocks[0].xorBlocks(d1);
73 blocks[4] = blocks[4].xorBlocks(d2);
74 }
75118
76 fn absorb(state: *State128L, src: *const [32]u8) void {119 fn absorb(state: *State, src: *const [rate]u8) void {
77 const msg0 = AesBlock.fromBytes(src[0..16]);120 const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]);
78 const msg1 = AesBlock.fromBytes(src[16..32]);121 const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]);
79 state.update(msg0, msg1);122 state.update(msg0, msg1);
80 }123 }
81124
82 fn enc(state: *State128L, dst: *[32]u8, src: *const [32]u8) void {125 fn enc(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
83 const blocks = &state.blocks;126 const blocks = &state.blocks;
84 const msg0 = AesBlock.fromBytes(src[0..16]);127 const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]);
85 const msg1 = AesBlock.fromBytes(src[16..32]);128 const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]);
86 var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]);129 var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]);
87 var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]);130 var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]);
88 tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3]));131 tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3]));
89 tmp1 = tmp1.xorBlocks(blocks[6].andBlocks(blocks[7]));132 tmp1 = tmp1.xorBlocks(blocks[6].andBlocks(blocks[7]));
90 dst[0..16].* = tmp0.toBytes();133 dst[0..aes_block_length].* = tmp0.toBytes();
91 dst[16..32].* = tmp1.toBytes();134 dst[aes_block_length..rate].* = tmp1.toBytes();
92 state.update(msg0, msg1);135 state.update(msg0, msg1);
93 }136 }
94137
95 fn dec(state: *State128L, dst: *[32]u8, src: *const [32]u8) void {138 fn dec(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
96 const blocks = &state.blocks;139 const blocks = &state.blocks;
97 var msg0 = AesBlock.fromBytes(src[0..16]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);140 var msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);
98 var msg1 = AesBlock.fromBytes(src[16..32]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);141 var msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);
99 msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3]));142 msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3]));
100 msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7]));143 msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7]));
101 dst[0..16].* = msg0.toBytes();144 dst[0..aes_block_length].* = msg0.toBytes();
102 dst[16..32].* = msg1.toBytes();145 dst[aes_block_length..rate].* = msg1.toBytes();
103 state.update(msg0, msg1);146 state.update(msg0, msg1);
104 }147 }
105148
106 fn mac(state: *State128L, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {149 fn decLast(state: *State, dst: []u8, src: []const u8) void {
107 const blocks = &state.blocks;150 const blocks = &state.blocks;
108 var sizes: [16]u8 = undefined;151 const z0 = blocks[6].xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3]));
109 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);152 const z1 = blocks[2].xorBlocks(blocks[5]).xorBlocks(blocks[6].andBlocks(blocks[7]));
110 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);153 var pad = [_]u8{0} ** rate;
111 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[2]);154 pad[0..aes_block_length].* = z0.toBytes();
112 var i: usize = 0;155 pad[aes_block_length..].* = z1.toBytes();
113 while (i < 7) : (i += 1) {156 for (pad[0..src.len], src) |*p, x| p.* ^= x;
114 state.update(tmp, tmp);157 @memcpy(dst, pad[0..src.len]);
158 @memset(pad[src.len..], 0);
159 const msg0 = AesBlockVec.fromBytes(pad[0..aes_block_length]);
160 const msg1 = AesBlockVec.fromBytes(pad[aes_block_length..rate]);
161 state.update(msg0, msg1);
115 }162 }
116 return switch (tag_bits) {
117 128 => blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3])
118 .xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes(),
119 256 => tag: {
120 const t1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]);
121 const t2 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]);
122 break :tag t1.toBytes() ++ t2.toBytes();
123 },
124 else => unreachable,
125 };
126 }
127};
128163
129fn Aegis128LGeneric(comptime tag_bits: u9) type {164 fn mac(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
165 const blocks = &state.blocks;
166 var sizes: [aes_block_length]u8 = undefined;
167 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
168 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
169 for (1..degree) |i| {
170 @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
171 }
172 const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[2]);
173 for (0..7) |_| {
174 state.update(tmp, tmp);
175 }
176 switch (tag_bits) {
177 128 => {
178 var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();
179 var tag = tag_multi[0..16].*;
180 @memcpy(tag[0..], tag_multi[0..16]);
181 for (1..degree) |d| {
182 for (0..16) |i| {
183 tag[i] ^= tag_multi[d * 16 + i];
184 }
185 }
186 return tag;
187 },
188 256 => {
189 const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();
190 const tag_multi_2 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();
191 var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*;
192 for (1..degree) |d| {
193 for (0..16) |i| {
194 tag[i] ^= tag_multi_1[d * 16 + i];
195 tag[i + 16] ^= tag_multi_2[d * 16 + i];
196 }
197 }
198 return tag;
199 },
200 else => unreachable,
201 }
202 }
203 };
204}
205
206/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.
207///
208/// The 128 bits variants of AEGIS have a 128 bit key and a 128 bit nonce.
209///
210/// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
211fn Aegis128XGeneric(comptime degree: u7, comptime tag_bits: u9) type {
212 comptime assert(degree > 0); // degree must be greater than 0
130 comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits213 comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits
131214
132 return struct {215 return struct {
216 const State = State128X(degree);
217
133 pub const tag_length = tag_bits / 8;218 pub const tag_length = tag_bits / 8;
134 pub const nonce_length = 16;219 pub const nonce_length = 16;
135 pub const key_length = 16;220 pub const key_length = 16;
136 pub const block_length = 32;221 pub const block_length = State.rate;
137222
138 const State = State128L;223 const alignment = State.alignment;
139224
140 /// c: ciphertext: output buffer should be of size m.len225 /// c: ciphertext: output buffer should be of size m.len
141 /// tag: authentication tag: output MAC226 /// tag: authentication tag: output MAC
...@@ -145,27 +230,27 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {...@@ -145,27 +230,27 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {
145 /// k: private key230 /// k: private key
146 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {231 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
147 assert(c.len == m.len);232 assert(c.len == m.len);
148 var state = State128L.init(key, npub);233 var state = State.init(key, npub);
149 var src: [32]u8 align(16) = undefined;234 var src: [block_length]u8 align(alignment) = undefined;
150 var dst: [32]u8 align(16) = undefined;235 var dst: [block_length]u8 align(alignment) = undefined;
151 var i: usize = 0;236 var i: usize = 0;
152 while (i + 32 <= ad.len) : (i += 32) {237 while (i + block_length <= ad.len) : (i += block_length) {
153 state.absorb(ad[i..][0..32]);238 state.absorb(ad[i..][0..block_length]);
154 }239 }
155 if (ad.len % 32 != 0) {240 if (ad.len % block_length != 0) {
156 @memset(src[0..], 0);241 @memset(src[0..], 0);
157 @memcpy(src[0 .. ad.len % 32], ad[i..][0 .. ad.len % 32]);242 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
158 state.absorb(&src);243 state.absorb(&src);
159 }244 }
160 i = 0;245 i = 0;
161 while (i + 32 <= m.len) : (i += 32) {246 while (i + block_length <= m.len) : (i += block_length) {
162 state.enc(c[i..][0..32], m[i..][0..32]);247 state.enc(c[i..][0..block_length], m[i..][0..block_length]);
163 }248 }
164 if (m.len % 32 != 0) {249 if (m.len % block_length != 0) {
165 @memset(src[0..], 0);250 @memset(src[0..], 0);
166 @memcpy(src[0 .. m.len % 32], m[i..][0 .. m.len % 32]);251 @memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]);
167 state.enc(&dst, &src);252 state.enc(&dst, &src);
168 @memcpy(c[i..][0 .. m.len % 32], dst[0 .. m.len % 32]);253 @memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]);
169 }254 }
170 tag.* = state.mac(tag_bits, ad.len, m.len);255 tag.* = state.mac(tag_bits, ad.len, m.len);
171 }256 }
...@@ -181,31 +266,23 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {...@@ -181,31 +266,23 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {
181 /// Contents of `m` are undefined if an error is returned.266 /// Contents of `m` are undefined if an error is returned.
182 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {267 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {
183 assert(c.len == m.len);268 assert(c.len == m.len);
184 var state = State128L.init(key, npub);269 var state = State.init(key, npub);
185 var src: [32]u8 align(16) = undefined;270 var src: [block_length]u8 align(alignment) = undefined;
186 var dst: [32]u8 align(16) = undefined;
187 var i: usize = 0;271 var i: usize = 0;
188 while (i + 32 <= ad.len) : (i += 32) {272 while (i + block_length <= ad.len) : (i += block_length) {
189 state.absorb(ad[i..][0..32]);273 state.absorb(ad[i..][0..block_length]);
190 }274 }
191 if (ad.len % 32 != 0) {275 if (ad.len % block_length != 0) {
192 @memset(src[0..], 0);276 @memset(src[0..], 0);
193 @memcpy(src[0 .. ad.len % 32], ad[i..][0 .. ad.len % 32]);277 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
194 state.absorb(&src);278 state.absorb(&src);
195 }279 }
196 i = 0;280 i = 0;
197 while (i + 32 <= m.len) : (i += 32) {281 while (i + block_length <= m.len) : (i += block_length) {
198 state.dec(m[i..][0..32], c[i..][0..32]);282 state.dec(m[i..][0..block_length], c[i..][0..block_length]);
199 }283 }
200 if (m.len % 32 != 0) {284 if (m.len % block_length != 0) {
201 @memset(src[0..], 0);285 state.decLast(m[i..], c[i..]);
202 @memcpy(src[0 .. m.len % 32], c[i..][0 .. m.len % 32]);
203 state.dec(&dst, &src);
204 @memcpy(m[i..][0 .. m.len % 32], dst[0 .. m.len % 32]);
205 @memset(dst[0 .. m.len % 32], 0);
206 const blocks = &state.blocks;
207 blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(dst[0..16]));
208 blocks[4] = blocks[4].xorBlocks(AesBlock.fromBytes(dst[16..32]));
209 }286 }
210 var computed_tag = state.mac(tag_bits, ad.len, m.len);287 var computed_tag = state.mac(tag_bits, ad.len, m.len);
211 const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);288 const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);
...@@ -218,107 +295,172 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {...@@ -218,107 +295,172 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {
218 };295 };
219}296}
220297
221const State256 = struct {298fn State256X(comptime degree: u7) type {
222 blocks: [6]AesBlock,299 return struct {
223300 const AesBlockVec = crypto.core.aes.BlockVec(degree);
224 fn init(key: [32]u8, nonce: [32]u8) State256 {301 const State = @This();
225 const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });302
226 const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });303 blocks: [6]AesBlockVec,
227 const key_block1 = AesBlock.fromBytes(key[0..16]);304
228 const key_block2 = AesBlock.fromBytes(key[16..32]);305 const aes_block_length = AesBlockVec.block_length;
229 const nonce_block1 = AesBlock.fromBytes(nonce[0..16]);306 const rate = aes_block_length;
230 const nonce_block2 = AesBlock.fromBytes(nonce[16..32]);307 const alignment = AesBlockVec.native_word_size;
231 const kxn1 = key_block1.xorBlocks(nonce_block1);308
232 const kxn2 = key_block2.xorBlocks(nonce_block2);309 fn init(key: [32]u8, nonce: [32]u8) State {
233 const blocks = [6]AesBlock{310 const c1 = AesBlockVec.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd } ** degree);
234 kxn1,311 const c2 = AesBlockVec.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 } ** degree);
235 kxn2,312 const key_block1 = AesBlockVec.fromBytes(key[0..16] ** degree);
236 c1,313 const key_block2 = AesBlockVec.fromBytes(key[16..32] ** degree);
237 c2,314 const nonce_block1 = AesBlockVec.fromBytes(nonce[0..16] ** degree);
238 key_block1.xorBlocks(c2),315 const nonce_block2 = AesBlockVec.fromBytes(nonce[16..32] ** degree);
239 key_block2.xorBlocks(c1),316 const kxn1 = key_block1.xorBlocks(nonce_block1);
240 };317 const kxn2 = key_block2.xorBlocks(nonce_block2);
241 var state = State256{ .blocks = blocks };318 const blocks = [6]AesBlockVec{
242 var i: usize = 0;319 kxn1,
243 while (i < 4) : (i += 1) {320 kxn2,
244 state.update(key_block1);321 c1,
245 state.update(key_block2);322 c2,
246 state.update(kxn1);323 key_block1.xorBlocks(c2),
247 state.update(kxn2);324 key_block2.xorBlocks(c1),
325 };
326 var state = State{ .blocks = blocks };
327 if (degree > 1) {
328 const context_block = ctx: {
329 var contexts_bytes = [_]u8{0} ** aes_block_length;
330 for (0..degree) |i| {
331 contexts_bytes[i * 16] = @intCast(i);
332 contexts_bytes[i * 16 + 1] = @intCast(degree - 1);
333 }
334 break :ctx AesBlockVec.fromBytes(&contexts_bytes);
335 };
336 for (0..4) |_| {
337 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
338 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
339 state.update(key_block1);
340 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
341 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
342 state.update(key_block2);
343 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
344 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
345 state.update(kxn1);
346 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
347 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
348 state.update(kxn2);
349 }
350 } else {
351 for (0..4) |_| {
352 state.update(key_block1);
353 state.update(key_block2);
354 state.update(kxn1);
355 state.update(kxn2);
356 }
357 }
358 return state;
248 }359 }
249 return state;
250 }
251360
252 inline fn update(state: *State256, d: AesBlock) void {361 inline fn update(state: *State, d: AesBlockVec) void {
253 const blocks = &state.blocks;362 const blocks = &state.blocks;
254 const tmp = blocks[5].encrypt(blocks[0]);363 const tmp = blocks[5].encrypt(blocks[0]);
255 comptime var i: usize = 5;364 comptime var i: usize = 5;
256 inline while (i > 0) : (i -= 1) {365 inline while (i > 0) : (i -= 1) {
257 blocks[i] = blocks[i - 1].encrypt(blocks[i]);366 blocks[i] = blocks[i - 1].encrypt(blocks[i]);
367 }
368 blocks[0] = tmp.xorBlocks(d);
258 }369 }
259 blocks[0] = tmp.xorBlocks(d);
260 }
261370
262 fn absorb(state: *State256, src: *const [16]u8) void {371 fn absorb(state: *State, src: *const [rate]u8) void {
263 const msg = AesBlock.fromBytes(src);372 const msg = AesBlockVec.fromBytes(src);
264 state.update(msg);373 state.update(msg);
265 }374 }
266375
267 fn enc(state: *State256, dst: *[16]u8, src: *const [16]u8) void {376 fn enc(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
268 const blocks = &state.blocks;377 const blocks = &state.blocks;
269 const msg = AesBlock.fromBytes(src);378 const msg = AesBlockVec.fromBytes(src);
270 var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);379 var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
271 tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3]));380 tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3]));
272 dst.* = tmp.toBytes();381 dst.* = tmp.toBytes();
273 state.update(msg);382 state.update(msg);
274 }383 }
275384
276 fn dec(state: *State256, dst: *[16]u8, src: *const [16]u8) void {385 fn dec(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
277 const blocks = &state.blocks;386 const blocks = &state.blocks;
278 var msg = AesBlock.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);387 var msg = AesBlockVec.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
279 msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3]));388 msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3]));
280 dst.* = msg.toBytes();389 dst.* = msg.toBytes();
281 state.update(msg);390 state.update(msg);
282 }391 }
283392
284 fn mac(state: *State256, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {393 fn decLast(state: *State, dst: []u8, src: []const u8) void {
285 const blocks = &state.blocks;394 const blocks = &state.blocks;
286 var sizes: [16]u8 = undefined;395 const z = blocks[5].xorBlocks(blocks[4]).xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3]));
287 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);396 var pad = z.toBytes();
288 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);397 for (pad[0..src.len], src) |*p, x| p.* ^= x;
289 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[3]);398 @memcpy(dst, pad[0..src.len]);
290 var i: usize = 0;399 @memset(pad[src.len..], 0);
291 while (i < 7) : (i += 1) {400 const msg = AesBlockVec.fromBytes(pad[0..]);
292 state.update(tmp);401 state.update(msg);
293 }402 }
294 return switch (tag_bits) {403
295 128 => blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3])404 fn mac(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
296 .xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes(),405 const blocks = &state.blocks;
297 256 => tag: {406 var sizes: [aes_block_length]u8 = undefined;
298 const t1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]);407 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
299 const t2 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]);408 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
300 break :tag t1.toBytes() ++ t2.toBytes();409 for (1..degree) |i| {
301 },410 @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
302 else => unreachable,411 }
303 };412 const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[3]);
304 }413 for (0..7) |_| {
305};414 state.update(tmp);
415 }
416 switch (tag_bits) {
417 128 => {
418 var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
419 var tag = tag_multi[0..16].*;
420 @memcpy(tag[0..], tag_multi[0..16]);
421 for (1..degree) |d| {
422 for (0..16) |i| {
423 tag[i] ^= tag_multi[d * 16 + i];
424 }
425 }
426 return tag;
427 },
428 256 => {
429 const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).toBytes();
430 const tag_multi_2 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
431 var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*;
432 for (1..degree) |d| {
433 for (0..16) |i| {
434 tag[i] ^= tag_multi_1[d * 16 + i];
435 tag[i + 16] ^= tag_multi_2[d * 16 + i];
436 }
437 }
438 return tag;
439 },
440 else => unreachable,
441 }
442 }
443 };
444}
306445
307/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.446/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.
308///447///
309/// The 256 bit variant of AEGIS has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks.448/// The 256 bits variants of AEGIS have a 256 bit key and a 256 bit nonce.
310///449///
311/// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/450/// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
312fn Aegis256Generic(comptime tag_bits: u9) type {451fn Aegis256XGeneric(comptime degree: u7, comptime tag_bits: u9) type {
452 comptime assert(degree > 0); // degree must be greater than 0
313 comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits453 comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits
314454
315 return struct {455 return struct {
456 const State = State256X(degree);
457
316 pub const tag_length = tag_bits / 8;458 pub const tag_length = tag_bits / 8;
317 pub const nonce_length = 32;459 pub const nonce_length = 32;
318 pub const key_length = 32;460 pub const key_length = 32;
319 pub const block_length = 16;461 pub const block_length = State.rate;
320462
321 const State = State256;463 const alignment = State.alignment;
322464
323 /// c: ciphertext: output buffer should be of size m.len465 /// c: ciphertext: output buffer should be of size m.len
324 /// tag: authentication tag: output MAC466 /// tag: authentication tag: output MAC
...@@ -328,27 +470,27 @@ fn Aegis256Generic(comptime tag_bits: u9) type {...@@ -328,27 +470,27 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
328 /// k: private key470 /// k: private key
329 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {471 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
330 assert(c.len == m.len);472 assert(c.len == m.len);
331 var state = State256.init(key, npub);473 var state = State.init(key, npub);
332 var src: [16]u8 align(16) = undefined;474 var src: [block_length]u8 align(alignment) = undefined;
333 var dst: [16]u8 align(16) = undefined;475 var dst: [block_length]u8 align(alignment) = undefined;
334 var i: usize = 0;476 var i: usize = 0;
335 while (i + 16 <= ad.len) : (i += 16) {477 while (i + block_length <= ad.len) : (i += block_length) {
336 state.enc(&dst, ad[i..][0..16]);478 state.enc(&dst, ad[i..][0..block_length]);
337 }479 }
338 if (ad.len % 16 != 0) {480 if (ad.len % block_length != 0) {
339 @memset(src[0..], 0);481 @memset(src[0..], 0);
340 @memcpy(src[0 .. ad.len % 16], ad[i..][0 .. ad.len % 16]);482 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
341 state.enc(&dst, &src);483 state.enc(&dst, &src);
342 }484 }
343 i = 0;485 i = 0;
344 while (i + 16 <= m.len) : (i += 16) {486 while (i + block_length <= m.len) : (i += block_length) {
345 state.enc(c[i..][0..16], m[i..][0..16]);487 state.enc(c[i..][0..block_length], m[i..][0..block_length]);
346 }488 }
347 if (m.len % 16 != 0) {489 if (m.len % block_length != 0) {
348 @memset(src[0..], 0);490 @memset(src[0..], 0);
349 @memcpy(src[0 .. m.len % 16], m[i..][0 .. m.len % 16]);491 @memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]);
350 state.enc(&dst, &src);492 state.enc(&dst, &src);
351 @memcpy(c[i..][0 .. m.len % 16], dst[0 .. m.len % 16]);493 @memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]);
352 }494 }
353 tag.* = state.mac(tag_bits, ad.len, m.len);495 tag.* = state.mac(tag_bits, ad.len, m.len);
354 }496 }
...@@ -364,30 +506,23 @@ fn Aegis256Generic(comptime tag_bits: u9) type {...@@ -364,30 +506,23 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
364 /// Contents of `m` are undefined if an error is returned.506 /// Contents of `m` are undefined if an error is returned.
365 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {507 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {
366 assert(c.len == m.len);508 assert(c.len == m.len);
367 var state = State256.init(key, npub);509 var state = State.init(key, npub);
368 var src: [16]u8 align(16) = undefined;510 var src: [block_length]u8 align(alignment) = undefined;
369 var dst: [16]u8 align(16) = undefined;
370 var i: usize = 0;511 var i: usize = 0;
371 while (i + 16 <= ad.len) : (i += 16) {512 while (i + block_length <= ad.len) : (i += block_length) {
372 state.enc(&dst, ad[i..][0..16]);513 state.absorb(ad[i..][0..block_length]);
373 }514 }
374 if (ad.len % 16 != 0) {515 if (ad.len % block_length != 0) {
375 @memset(src[0..], 0);516 @memset(src[0..], 0);
376 @memcpy(src[0 .. ad.len % 16], ad[i..][0 .. ad.len % 16]);517 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
377 state.enc(&dst, &src);518 state.absorb(&src);
378 }519 }
379 i = 0;520 i = 0;
380 while (i + 16 <= m.len) : (i += 16) {521 while (i + block_length <= m.len) : (i += block_length) {
381 state.dec(m[i..][0..16], c[i..][0..16]);522 state.dec(m[i..][0..block_length], c[i..][0..block_length]);
382 }523 }
383 if (m.len % 16 != 0) {524 if (m.len % block_length != 0) {
384 @memset(src[0..], 0);525 state.decLast(m[i..], c[i..]);
385 @memcpy(src[0 .. m.len % 16], c[i..][0 .. m.len % 16]);
386 state.dec(&dst, &src);
387 @memcpy(m[i..][0 .. m.len % 16], dst[0 .. m.len % 16]);
388 @memset(dst[0 .. m.len % 16], 0);
389 const blocks = &state.blocks;
390 blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(&dst));
391 }526 }
392 var computed_tag = state.mac(tag_bits, ad.len, m.len);527 var computed_tag = state.mac(tag_bits, ad.len, m.len);
393 const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);528 const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);
...@@ -400,6 +535,24 @@ fn Aegis256Generic(comptime tag_bits: u9) type {...@@ -400,6 +535,24 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
400 };535 };
401}536}
402537
538/// The `Aegis128X4Mac` message authentication function outputs 256 bit tags.
539/// In addition to being extremely fast, its large state, non-linearity
540/// and non-invertibility provides the following properties:
541/// - 128 bit security, stronger than GHash/Polyval/Poly1305.
542/// - Recovering the secret key from the state would require ~2^128 attempts,
543/// which is infeasible for any practical adversary.
544/// - It has a large security margin against internal collisions.
545pub const Aegis128X4Mac = AegisMac(Aegis128X4_256);
546
547/// The `Aegis128X2Mac` message authentication function outputs 256 bit tags.
548/// In addition to being extremely fast, its large state, non-linearity
549/// and non-invertibility provides the following properties:
550/// - 128 bit security, stronger than GHash/Polyval/Poly1305.
551/// - Recovering the secret key from the state would require ~2^128 attempts,
552/// which is infeasible for any practical adversary.
553/// - It has a large security margin against internal collisions.
554pub const Aegis128X2Mac = AegisMac(Aegis128X2_256);
555
403/// The `Aegis128LMac` message authentication function outputs 256 bit tags.556/// The `Aegis128LMac` message authentication function outputs 256 bit tags.
404/// In addition to being extremely fast, its large state, non-linearity557/// In addition to being extremely fast, its large state, non-linearity
405/// and non-invertibility provides the following properties:558/// and non-invertibility provides the following properties:
...@@ -409,34 +562,60 @@ fn Aegis256Generic(comptime tag_bits: u9) type {...@@ -409,34 +562,60 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
409/// - It has a large security margin against internal collisions.562/// - It has a large security margin against internal collisions.
410pub const Aegis128LMac = AegisMac(Aegis128L_256);563pub const Aegis128LMac = AegisMac(Aegis128L_256);
411564
565/// The `Aegis256X4Mac` message authentication function has a 256-bit key size,
566/// and outputs 256 bit tags. Unless theoretical multi-target attacks are a
567/// concern, the AEGIS-128L variant should be preferred.
568/// AEGIS' large state, non-linearity and non-invertibility provides the
569/// following properties:
570/// - 256 bit security against forgery.
571/// - Recovering the secret key from the state would require ~2^256 attempts,
572/// which is infeasible for any practical adversary.
573/// - It has a large security margin against internal collisions.
574pub const Aegis256X4Mac = AegisMac(Aegis256X4_256);
575
576/// The `Aegis256X2Mac` message authentication function has a 256-bit key size,
577/// and outputs 256 bit tags. Unless theoretical multi-target attacks are a
578/// concern, the AEGIS-128L variant should be preferred.
579/// AEGIS' large state, non-linearity and non-invertibility provides the
580/// following properties:
581/// - 256 bit security against forgery.
582/// - Recovering the secret key from the state would require ~2^256 attempts,
583/// which is infeasible for any practical adversary.
584/// - It has a large security margin against internal collisions.
585pub const Aegis256X2Mac = AegisMac(Aegis256X2_256);
586
412/// The `Aegis256Mac` message authentication function has a 256-bit key size,587/// The `Aegis256Mac` message authentication function has a 256-bit key size,
413/// and outputs 256 bit tags. Unless theoretical multi-target attacks are a588/// and outputs 256 bit tags. Unless theoretical multi-target attacks are a
414/// concern, the AEGIS-128L variant should be preferred.589/// concern, the AEGIS-128L variant should be preferred.
415/// AEGIS' large state, non-linearity and non-invertibility provides the590/// AEGIS' large state, non-linearity and non-invertibility provides the
416/// following properties:591/// following properties:
417/// - More than 128 bit security against forgery.592/// - 256 bit security against forgery.
418/// - Recovering the secret key from the state would require ~2^256 attempts,593/// - Recovering the secret key from the state would require ~2^256 attempts,
419/// which is infeasible for any practical adversary.594/// which is infeasible for any practical adversary.
420/// - It has a large security margin against internal collisions.595/// - It has a large security margin against internal collisions.
421pub const Aegis256Mac = AegisMac(Aegis256_256);596pub const Aegis256Mac = AegisMac(Aegis256_256);
422597
423/// Aegis128L MAC with a 128-bit output.598/// AEGIS-128X4 MAC with 128-bit tags
424/// A MAC with a 128-bit output is not safe unless the number of messages599pub const Aegis128X4Mac_128 = AegisMac(Aegis128X4);
425/// authenticated with the same key remains small.600
426/// After 2^48 messages, the probability of a collision is already ~ 2^-33.601/// AEGIS-128X2 MAC with 128-bit tags
427/// If unsure, use the Aegis128LMac type, that has a 256 bit output.602pub const Aegis128X2Mac_128 = AegisMac(Aegis128X2);
603
604/// AEGIS-128L MAC with 128-bit tags
428pub const Aegis128LMac_128 = AegisMac(Aegis128L);605pub const Aegis128LMac_128 = AegisMac(Aegis128L);
429606
430/// Aegis256 MAC with a 128-bit output.607/// AEGIS-256X4 MAC with 128-bit tags
431/// A MAC with a 128-bit output is not safe unless the number of messages608pub const Aegis256X4Mac_128 = AegisMac(Aegis256X4);
432/// authenticated with the same key remains small.609
433/// After 2^48 messages, the probability of a collision is already ~ 2^-33.610/// AEGIS-256X2 MAC with 128-bit tags
434/// If unsure, use the Aegis256Mac type, that has a 256 bit output.611pub const Aegis256X2Mac_128 = AegisMac(Aegis256X2);
612
613/// AEGIS-256 MAC with 128-bit tags
435pub const Aegis256Mac_128 = AegisMac(Aegis256);614pub const Aegis256Mac_128 = AegisMac(Aegis256);
436615
437fn AegisMac(comptime T: type) type {616fn AegisMac(comptime T: type) type {
438 return struct {617 return struct {
439 const Self = @This();618 const Mac = @This();
440619
441 pub const mac_length = T.tag_length;620 pub const mac_length = T.tag_length;
442 pub const key_length = T.key_length;621 pub const key_length = T.key_length;
...@@ -448,15 +627,15 @@ fn AegisMac(comptime T: type) type {...@@ -448,15 +627,15 @@ fn AegisMac(comptime T: type) type {
448 msg_len: usize = 0,627 msg_len: usize = 0,
449628
450 /// Initialize a state for the MAC function629 /// Initialize a state for the MAC function
451 pub fn init(key: *const [key_length]u8) Self {630 pub fn init(key: *const [key_length]u8) Mac {
452 const nonce = [_]u8{0} ** T.nonce_length;631 const nonce = [_]u8{0} ** T.nonce_length;
453 return Self{632 return Mac{
454 .state = T.State.init(key.*, nonce),633 .state = T.State.init(key.*, nonce),
455 };634 };
456 }635 }
457636
458 /// Add data to the state637 /// Add data to the state
459 pub fn update(self: *Self, b: []const u8) void {638 pub fn update(self: *Mac, b: []const u8) void {
460 self.msg_len += b.len;639 self.msg_len += b.len;
461640
462 const len_partial = @min(b.len, block_length - self.off);641 const len_partial = @min(b.len, block_length - self.off);
...@@ -469,6 +648,10 @@ fn AegisMac(comptime T: type) type {...@@ -469,6 +648,10 @@ fn AegisMac(comptime T: type) type {
469648
470 var i = len_partial;649 var i = len_partial;
471 self.off = 0;650 self.off = 0;
651 while (i + block_length * 2 <= b.len) : (i += block_length * 2) {
652 self.state.absorb(b[i..][0..block_length]);
653 self.state.absorb(b[i..][block_length .. block_length * 2]);
654 }
472 while (i + block_length <= b.len) : (i += block_length) {655 while (i + block_length <= b.len) : (i += block_length) {
473 self.state.absorb(b[i..][0..block_length]);656 self.state.absorb(b[i..][0..block_length]);
474 }657 }
...@@ -479,7 +662,7 @@ fn AegisMac(comptime T: type) type {...@@ -479,7 +662,7 @@ fn AegisMac(comptime T: type) type {
479 }662 }
480663
481 /// Return an authentication tag for the current state664 /// Return an authentication tag for the current state
482 pub fn final(self: *Self, out: *[mac_length]u8) void {665 pub fn final(self: *Mac, out: *[mac_length]u8) void {
483 if (self.off > 0) {666 if (self.off > 0) {
484 var pad = [_]u8{0} ** block_length;667 var pad = [_]u8{0} ** block_length;
485 @memcpy(pad[0..self.off], self.buf[0..self.off]);668 @memcpy(pad[0..self.off], self.buf[0..self.off]);
...@@ -490,20 +673,20 @@ fn AegisMac(comptime T: type) type {...@@ -490,20 +673,20 @@ fn AegisMac(comptime T: type) type {
490673
491 /// Return an authentication tag for a message and a key674 /// Return an authentication tag for a message and a key
492 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void {675 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void {
493 var ctx = Self.init(key);676 var ctx = Mac.init(key);
494 ctx.update(msg);677 ctx.update(msg);
495 ctx.final(out);678 ctx.final(out);
496 }679 }
497680
498 pub const Error = error{};681 pub const Error = error{};
499 pub const Writer = std.io.Writer(*Self, Error, write);682 pub const Writer = std.io.Writer(*Mac, Error, write);
500683
501 fn write(self: *Self, bytes: []const u8) Error!usize {684 fn write(self: *Mac, bytes: []const u8) Error!usize {
502 self.update(bytes);685 self.update(bytes);
503 return bytes.len;686 return bytes.len;
504 }687 }
505688
506 pub fn writer(self: *Self) Writer {689 pub fn writer(self: *Mac) Writer {
507 return .{ .context = self };690 return .{ .context = self };
508 }691 }
509 };692 };
...@@ -568,6 +751,23 @@ test "Aegis128L test vector 3" {...@@ -568,6 +751,23 @@ test "Aegis128L test vector 3" {
568 try htest.assertEqual("83cc600dc4e3e7e62d4055826174f149", &tag);751 try htest.assertEqual("83cc600dc4e3e7e62d4055826174f149", &tag);
569}752}
570753
754test "Aegis128X2 test vector 1" {
755 const key: [Aegis128X2.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
756 const nonce: [Aegis128X2.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
757 var empty = [_]u8{};
758 var tag: [Aegis128X2.tag_length]u8 = undefined;
759 var tag256: [Aegis128X2_256.tag_length]u8 = undefined;
760
761 Aegis128X2.encrypt(&empty, &tag, &empty, &empty, nonce, key);
762 Aegis128X2_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key);
763 try htest.assertEqual("63117dc57756e402819a82e13eca8379", &tag);
764 try htest.assertEqual("b92c71fdbd358b8a4de70b27631ace90cffd9b9cfba82028412bac41b4f53759", &tag256);
765 tag[0] +%= 1;
766 try testing.expectError(error.AuthenticationFailed, Aegis128X2.decrypt(&empty, &empty, tag, &empty, nonce, key));
767 tag256[0] +%= 1;
768 try testing.expectError(error.AuthenticationFailed, Aegis128X2_256.decrypt(&empty, &empty, tag256, &empty, nonce, key));
769}
770
571test "Aegis256 test vector 1" {771test "Aegis256 test vector 1" {
572 const key: [Aegis256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30;772 const key: [Aegis256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30;
573 const nonce: [Aegis256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29;773 const nonce: [Aegis256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29;
...@@ -624,6 +824,23 @@ test "Aegis256 test vector 3" {...@@ -624,6 +824,23 @@ test "Aegis256 test vector 3" {
624 try htest.assertEqual("f7a0878f68bd083e8065354071fc27c3", &tag);824 try htest.assertEqual("f7a0878f68bd083e8065354071fc27c3", &tag);
625}825}
626826
827test "Aegis256X4 test vector 1" {
828 const key: [Aegis256X4.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
829 const nonce: [Aegis256X4.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f };
830 var empty = [_]u8{};
831 var tag: [Aegis256X4.tag_length]u8 = undefined;
832 var tag256: [Aegis256X4_256.tag_length]u8 = undefined;
833
834 Aegis256X4.encrypt(&empty, &tag, &empty, &empty, nonce, key);
835 Aegis256X4_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key);
836 try htest.assertEqual("3b7fee6cee7bf17888ad11ed2397beb4", &tag);
837 try htest.assertEqual("6093a1a8aab20ec635dc1ca71745b01b5bec4fc444c9ffbebd710d4a34d20eaf", &tag256);
838 tag[0] +%= 1;
839 try testing.expectError(error.AuthenticationFailed, Aegis256X4.decrypt(&empty, &empty, tag, &empty, nonce, key));
840 tag256[0] +%= 1;
841 try testing.expectError(error.AuthenticationFailed, Aegis256X4_256.decrypt(&empty, &empty, tag256, &empty, nonce, key));
842}
843
627test "Aegis MAC" {844test "Aegis MAC" {
628 const key = [_]u8{0x00} ** Aegis128LMac.key_length;845 const key = [_]u8{0x00} ** Aegis128LMac.key_length;
629 var msg: [64]u8 = undefined;846 var msg: [64]u8 = undefined;
lib/std/crypto/aes.zig+1
...@@ -22,6 +22,7 @@ pub const has_hardware_support =...@@ -22,6 +22,7 @@ pub const has_hardware_support =
22 (builtin.cpu.arch == .aarch64 and has_armaes);22 (builtin.cpu.arch == .aarch64 and has_armaes);
2323
24pub const Block = impl.Block;24pub const Block = impl.Block;
25pub const BlockVec = impl.BlockVec;
25pub const AesEncryptCtx = impl.AesEncryptCtx;26pub const AesEncryptCtx = impl.AesEncryptCtx;
26pub const AesDecryptCtx = impl.AesDecryptCtx;27pub const AesDecryptCtx = impl.AesDecryptCtx;
27pub const Aes128 = impl.Aes128;28pub const Aes128 = impl.Aes128;
lib/std/crypto/aes/aesni.zig+158-12
...@@ -2,18 +2,23 @@ const std = @import("../../std.zig");...@@ -2,18 +2,23 @@ const std = @import("../../std.zig");
2const builtin = @import("builtin");2const builtin = @import("builtin");
3const mem = std.mem;3const mem = std.mem;
4const debug = std.debug;4const debug = std.debug;
5const BlockVec = @Vector(2, u64);5
6const has_vaes = builtin.cpu.arch == .x86_64 and std.Target.x86.featureSetHas(builtin.cpu.features, .vaes);
7const has_avx512f = builtin.cpu.arch == .x86_64 and std.Target.x86.featureSetHas(builtin.cpu.features, .avx512f);
68
7/// A single AES block.9/// A single AES block.
8pub const Block = struct {10pub const Block = struct {
11 const Repr = @Vector(2, u64);
12
13 /// The length of an AES block in bytes.
9 pub const block_length: usize = 16;14 pub const block_length: usize = 16;
1015
11 /// Internal representation of a block.16 /// Internal representation of a block.
12 repr: BlockVec,17 repr: Repr,
1318
14 /// Convert a byte sequence into an internal representation.19 /// Convert a byte sequence into an internal representation.
15 pub inline fn fromBytes(bytes: *const [16]u8) Block {20 pub inline fn fromBytes(bytes: *const [16]u8) Block {
16 const repr = mem.bytesToValue(BlockVec, bytes);21 const repr = mem.bytesToValue(Repr, bytes);
17 return Block{ .repr = repr };22 return Block{ .repr = repr };
18 }23 }
1924
...@@ -33,7 +38,7 @@ pub const Block = struct {...@@ -33,7 +38,7 @@ pub const Block = struct {
33 return Block{38 return Block{
34 .repr = asm (39 .repr = asm (
35 \\ vaesenc %[rk], %[in], %[out]40 \\ vaesenc %[rk], %[in], %[out]
36 : [out] "=x" (-> BlockVec),41 : [out] "=x" (-> Repr),
37 : [in] "x" (block.repr),42 : [in] "x" (block.repr),
38 [rk] "x" (round_key.repr),43 [rk] "x" (round_key.repr),
39 ),44 ),
...@@ -45,7 +50,7 @@ pub const Block = struct {...@@ -45,7 +50,7 @@ pub const Block = struct {
45 return Block{50 return Block{
46 .repr = asm (51 .repr = asm (
47 \\ vaesenclast %[rk], %[in], %[out]52 \\ vaesenclast %[rk], %[in], %[out]
48 : [out] "=x" (-> BlockVec),53 : [out] "=x" (-> Repr),
49 : [in] "x" (block.repr),54 : [in] "x" (block.repr),
50 [rk] "x" (round_key.repr),55 [rk] "x" (round_key.repr),
51 ),56 ),
...@@ -57,7 +62,7 @@ pub const Block = struct {...@@ -57,7 +62,7 @@ pub const Block = struct {
57 return Block{62 return Block{
58 .repr = asm (63 .repr = asm (
59 \\ vaesdec %[rk], %[in], %[out]64 \\ vaesdec %[rk], %[in], %[out]
60 : [out] "=x" (-> BlockVec),65 : [out] "=x" (-> Repr),
61 : [in] "x" (block.repr),66 : [in] "x" (block.repr),
62 [rk] "x" (inv_round_key.repr),67 [rk] "x" (inv_round_key.repr),
63 ),68 ),
...@@ -69,7 +74,7 @@ pub const Block = struct {...@@ -69,7 +74,7 @@ pub const Block = struct {
69 return Block{74 return Block{
70 .repr = asm (75 .repr = asm (
71 \\ vaesdeclast %[rk], %[in], %[out]76 \\ vaesdeclast %[rk], %[in], %[out]
72 : [out] "=x" (-> BlockVec),77 : [out] "=x" (-> Repr),
73 : [in] "x" (block.repr),78 : [in] "x" (block.repr),
74 [rk] "x" (inv_round_key.repr),79 [rk] "x" (inv_round_key.repr),
75 ),80 ),
...@@ -168,17 +173,158 @@ pub const Block = struct {...@@ -168,17 +173,158 @@ pub const Block = struct {
168 };173 };
169};174};
170175
176/// A fixed-size vector of AES blocks.
177/// All operations are performed in parallel, using SIMD instructions when available.
178pub fn BlockVec(comptime blocks_count: comptime_int) type {
179 return struct {
180 const Self = @This();
181
182 /// The number of AES blocks the target architecture can process with a single instruction.
183 pub const native_vector_size = w: {
184 if (has_avx512f and blocks_count % 4 == 0) break :w 4;
185 if (has_vaes and blocks_count % 2 == 0) break :w 2;
186 break :w 1;
187 };
188
189 /// The size of the AES block vector that the target architecture can process with a single instruction, in bytes.
190 pub const native_word_size = native_vector_size * 16;
191
192 const native_words = blocks_count / native_vector_size;
193
194 const Repr = @Vector(native_vector_size * 2, u64);
195
196 /// Internal representation of a block vector.
197 repr: [native_words]Repr,
198
199 /// Length of the block vector in bytes.
200 pub const block_length: usize = blocks_count * 16;
201
202 /// Convert a byte sequence into an internal representation.
203 pub inline fn fromBytes(bytes: *const [blocks_count * 16]u8) Self {
204 var out: Self = undefined;
205 inline for (0..native_words) |i| {
206 out.repr[i] = mem.bytesToValue(Repr, bytes[i * native_word_size ..][0..native_word_size]);
207 }
208 return out;
209 }
210
211 /// Convert the internal representation of a block vector into a byte sequence.
212 pub inline fn toBytes(block_vec: Self) [blocks_count * 16]u8 {
213 var out: [blocks_count * 16]u8 = undefined;
214 inline for (0..native_words) |i| {
215 out[i * native_word_size ..][0..native_word_size].* = mem.toBytes(block_vec.repr[i]);
216 }
217 return out;
218 }
219
220 /// XOR the block vector with a byte sequence.
221 pub inline fn xorBytes(block_vec: Self, bytes: *const [blocks_count * 16]u8) [blocks_count * 16]u8 {
222 var x: Self = undefined;
223 inline for (0..native_words) |i| {
224 x.repr[i] = block_vec.repr[i] ^ mem.bytesToValue(Repr, bytes[i * native_word_size ..][0..native_word_size]);
225 }
226 return x.toBytes();
227 }
228
229 /// Apply the forward AES operation to the block vector with a vector of round keys.
230 pub inline fn encrypt(block_vec: Self, round_key_vec: Self) Self {
231 var out: Self = undefined;
232 inline for (0..native_words) |i| {
233 out.repr[i] = asm (
234 \\ vaesenc %[rk], %[in], %[out]
235 : [out] "=x" (-> Repr),
236 : [in] "x" (block_vec.repr[i]),
237 [rk] "x" (round_key_vec.repr[i]),
238 );
239 }
240 return out;
241 }
242
243 /// Apply the forward AES operation to the block vector with a vector of last round keys.
244 pub inline fn encryptLast(block_vec: Self, round_key_vec: Self) Self {
245 var out: Self = undefined;
246 inline for (0..native_words) |i| {
247 out.repr[i] = asm (
248 \\ vaesenclast %[rk], %[in], %[out]
249 : [out] "=x" (-> Repr),
250 : [in] "x" (block_vec.repr[i]),
251 [rk] "x" (round_key_vec.repr[i]),
252 );
253 }
254 return out;
255 }
256
257 /// Apply the inverse AES operation to the block vector with a vector of round keys.
258 pub inline fn decrypt(block_vec: Self, inv_round_key_vec: Self) Self {
259 var out: Self = undefined;
260 inline for (0..native_words) |i| {
261 out.repr[i] = asm (
262 \\ vaesdec %[rk], %[in], %[out]
263 : [out] "=x" (-> Repr),
264 : [in] "x" (block_vec.repr[i]),
265 [rk] "x" (inv_round_key_vec.repr[i]),
266 );
267 }
268 return out;
269 }
270
271 /// Apply the inverse AES operation to the block vector with a vector of last round keys.
272 pub inline fn decryptLast(block_vec: Self, inv_round_key_vec: Self) Self {
273 var out: Self = undefined;
274 inline for (0..native_words) |i| {
275 out.repr[i] = asm (
276 \\ vaesdeclast %[rk], %[in], %[out]
277 : [out] "=x" (-> Repr),
278 : [in] "x" (block_vec.repr[i]),
279 [rk] "x" (inv_round_key_vec.repr[i]),
280 );
281 }
282 return out;
283 }
284
285 /// Apply the bitwise XOR operation to the content of two block vectors.
286 pub inline fn xorBlocks(block_vec1: Self, block_vec2: Self) Self {
287 var out: Self = undefined;
288 inline for (0..native_words) |i| {
289 out.repr[i] = block_vec1.repr[i] ^ block_vec2.repr[i];
290 }
291 return out;
292 }
293
294 /// Apply the bitwise AND operation to the content of two block vectors.
295 pub inline fn andBlocks(block_vec1: Self, block_vec2: Self) Self {
296 var out: Self = undefined;
297 inline for (0..native_words) |i| {
298 out.repr[i] = block_vec1.repr[i] & block_vec2.repr[i];
299 }
300 return out;
301 }
302
303 /// Apply the bitwise OR operation to the content of two block vectors.
304 pub inline fn orBlocks(block_vec1: Self, block_vec2: Block) Self {
305 var out: Self = undefined;
306 inline for (0..native_words) |i| {
307 out.repr[i] = block_vec1.repr[i] | block_vec2.repr[i];
308 }
309 return out;
310 }
311 };
312}
313
171fn KeySchedule(comptime Aes: type) type {314fn KeySchedule(comptime Aes: type) type {
172 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);315 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
173 const rounds = Aes.rounds;316 const rounds = Aes.rounds;
174317
175 return struct {318 return struct {
176 const Self = @This();319 const Self = @This();
320
321 const Repr = Aes.block.Repr;
322
177 round_keys: [rounds + 1]Block,323 round_keys: [rounds + 1]Block,
178324
179 fn drc(comptime second: bool, comptime rc: u8, t: BlockVec, tx: BlockVec) BlockVec {325 fn drc(comptime second: bool, comptime rc: u8, t: Repr, tx: Repr) Repr {
180 var s: BlockVec = undefined;326 var s: Repr = undefined;
181 var ts: BlockVec = undefined;327 var ts: Repr = undefined;
182 return asm (328 return asm (
183 \\ vaeskeygenassist %[rc], %[t], %[s]329 \\ vaeskeygenassist %[rc], %[t], %[s]
184 \\ vpslldq $4, %[tx], %[ts]330 \\ vpslldq $4, %[tx], %[ts]
...@@ -187,7 +333,7 @@ fn KeySchedule(comptime Aes: type) type {...@@ -187,7 +333,7 @@ fn KeySchedule(comptime Aes: type) type {
187 \\ vpxor %[ts], %[r], %[r]333 \\ vpxor %[ts], %[r], %[r]
188 \\ vpshufd %[mask], %[s], %[ts]334 \\ vpshufd %[mask], %[s], %[ts]
189 \\ vpxor %[ts], %[r], %[r]335 \\ vpxor %[ts], %[r], %[r]
190 : [r] "=&x" (-> BlockVec),336 : [r] "=&x" (-> Repr),
191 [s] "=&x" (s),337 [s] "=&x" (s),
192 [ts] "=&x" (ts),338 [ts] "=&x" (ts),
193 : [rc] "n" (rc),339 : [rc] "n" (rc),
...@@ -234,7 +380,7 @@ fn KeySchedule(comptime Aes: type) type {...@@ -234,7 +380,7 @@ fn KeySchedule(comptime Aes: type) type {
234 inv_round_keys[i] = Block{380 inv_round_keys[i] = Block{
235 .repr = asm (381 .repr = asm (
236 \\ vaesimc %[rk], %[inv_rk]382 \\ vaesimc %[rk], %[inv_rk]
237 : [inv_rk] "=x" (-> BlockVec),383 : [inv_rk] "=x" (-> Repr),
238 : [rk] "x" (round_keys[rounds - i].repr),384 : [rk] "x" (round_keys[rounds - i].repr),
239 ),385 ),
240 };386 };
lib/std/crypto/aes/armcrypto.zig+135-20
...@@ -1,18 +1,19 @@...@@ -1,18 +1,19 @@
1const std = @import("../../std.zig");1const std = @import("../../std.zig");
2const mem = std.mem;2const mem = std.mem;
3const debug = std.debug;3const debug = std.debug;
4const BlockVec = @Vector(2, u64);
54
6/// A single AES block.5/// A single AES block.
7pub const Block = struct {6pub const Block = struct {
7 const Repr = @Vector(2, u64);
8
8 pub const block_length: usize = 16;9 pub const block_length: usize = 16;
910
10 /// Internal representation of a block.11 /// Internal representation of a block.
11 repr: BlockVec,12 repr: Repr,
1213
13 /// Convert a byte sequence into an internal representation.14 /// Convert a byte sequence into an internal representation.
14 pub inline fn fromBytes(bytes: *const [16]u8) Block {15 pub inline fn fromBytes(bytes: *const [16]u8) Block {
15 const repr = mem.bytesToValue(BlockVec, bytes);16 const repr = mem.bytesToValue(Repr, bytes);
16 return Block{ .repr = repr };17 return Block{ .repr = repr };
17 }18 }
1819
...@@ -36,7 +37,7 @@ pub const Block = struct {...@@ -36,7 +37,7 @@ pub const Block = struct {
36 \\ mov %[out].16b, %[in].16b37 \\ mov %[out].16b, %[in].16b
37 \\ aese %[out].16b, %[zero].16b38 \\ aese %[out].16b, %[zero].16b
38 \\ aesmc %[out].16b, %[out].16b39 \\ aesmc %[out].16b, %[out].16b
39 : [out] "=&x" (-> BlockVec),40 : [out] "=&x" (-> Repr),
40 : [in] "x" (block.repr),41 : [in] "x" (block.repr),
41 [zero] "x" (zero),42 [zero] "x" (zero),
42 )) ^ round_key.repr,43 )) ^ round_key.repr,
...@@ -49,7 +50,7 @@ pub const Block = struct {...@@ -49,7 +50,7 @@ pub const Block = struct {
49 .repr = (asm (50 .repr = (asm (
50 \\ mov %[out].16b, %[in].16b51 \\ mov %[out].16b, %[in].16b
51 \\ aese %[out].16b, %[zero].16b52 \\ aese %[out].16b, %[zero].16b
52 : [out] "=&x" (-> BlockVec),53 : [out] "=&x" (-> Repr),
53 : [in] "x" (block.repr),54 : [in] "x" (block.repr),
54 [zero] "x" (zero),55 [zero] "x" (zero),
55 )) ^ round_key.repr,56 )) ^ round_key.repr,
...@@ -63,7 +64,7 @@ pub const Block = struct {...@@ -63,7 +64,7 @@ pub const Block = struct {
63 \\ mov %[out].16b, %[in].16b64 \\ mov %[out].16b, %[in].16b
64 \\ aesd %[out].16b, %[zero].16b65 \\ aesd %[out].16b, %[zero].16b
65 \\ aesimc %[out].16b, %[out].16b66 \\ aesimc %[out].16b, %[out].16b
66 : [out] "=&x" (-> BlockVec),67 : [out] "=&x" (-> Repr),
67 : [in] "x" (block.repr),68 : [in] "x" (block.repr),
68 [zero] "x" (zero),69 [zero] "x" (zero),
69 )) ^ inv_round_key.repr,70 )) ^ inv_round_key.repr,
...@@ -76,7 +77,7 @@ pub const Block = struct {...@@ -76,7 +77,7 @@ pub const Block = struct {
76 .repr = (asm (77 .repr = (asm (
77 \\ mov %[out].16b, %[in].16b78 \\ mov %[out].16b, %[in].16b
78 \\ aesd %[out].16b, %[zero].16b79 \\ aesd %[out].16b, %[zero].16b
79 : [out] "=&x" (-> BlockVec),80 : [out] "=&x" (-> Repr),
80 : [in] "x" (block.repr),81 : [in] "x" (block.repr),
81 [zero] "x" (zero),82 [zero] "x" (zero),
82 )) ^ inv_round_key.repr,83 )) ^ inv_round_key.repr,
...@@ -165,6 +166,118 @@ pub const Block = struct {...@@ -165,6 +166,118 @@ pub const Block = struct {
165 };166 };
166};167};
167168
169/// A fixed-size vector of AES blocks.
170/// All operations are performed in parallel, using SIMD instructions when available.
171pub fn BlockVec(comptime blocks_count: comptime_int) type {
172 return struct {
173 const Self = @This();
174
175 /// The number of AES blocks the target architecture can process with a single instruction.
176 pub const native_vector_size = 1;
177
178 /// The size of the AES block vector that the target architecture can process with a single instruction, in bytes.
179 pub const native_word_size = native_vector_size * 16;
180
181 const native_words = blocks_count;
182
183 /// Internal representation of a block vector.
184 repr: [native_words]Block,
185
186 /// Length of the block vector in bytes.
187 pub const block_length: usize = blocks_count * 16;
188
189 /// Convert a byte sequence into an internal representation.
190 pub inline fn fromBytes(bytes: *const [blocks_count * 16]u8) Self {
191 var out: Self = undefined;
192 inline for (0..native_words) |i| {
193 out.repr[i] = Block.fromBytes(bytes[i * native_word_size ..][0..native_word_size]);
194 }
195 return out;
196 }
197
198 /// Convert the internal representation of a block vector into a byte sequence.
199 pub inline fn toBytes(block_vec: Self) [blocks_count * 16]u8 {
200 var out: [blocks_count * 16]u8 = undefined;
201 inline for (0..native_words) |i| {
202 out[i * native_word_size ..][0..native_word_size].* = block_vec.repr[i].toBytes();
203 }
204 return out;
205 }
206
207 /// XOR the block vector with a byte sequence.
208 pub inline fn xorBytes(block_vec: Self, bytes: *const [blocks_count * 16]u8) [32]u8 {
209 var out: Self = undefined;
210 inline for (0..native_words) |i| {
211 out.repr[i] = block_vec.repr[i].xorBytes(bytes[i * native_word_size ..][0..native_word_size]);
212 }
213 return out;
214 }
215
216 /// Apply the forward AES operation to the block vector with a vector of round keys.
217 pub inline fn encrypt(block_vec: Self, round_key_vec: Self) Self {
218 var out: Self = undefined;
219 inline for (0..native_words) |i| {
220 out.repr[i] = block_vec.repr[i].encrypt(round_key_vec.repr[i]);
221 }
222 return out;
223 }
224
225 /// Apply the forward AES operation to the block vector with a vector of last round keys.
226 pub inline fn encryptLast(block_vec: Self, round_key_vec: Self) Self {
227 var out: Self = undefined;
228 inline for (0..native_words) |i| {
229 out.repr[i] = block_vec.repr[i].encryptLast(round_key_vec.repr[i]);
230 }
231 return out;
232 }
233
234 /// Apply the inverse AES operation to the block vector with a vector of round keys.
235 pub inline fn decrypt(block_vec: Self, inv_round_key_vec: Self) Self {
236 var out: Self = undefined;
237 inline for (0..native_words) |i| {
238 out.repr[i] = block_vec.repr[i].decrypt(inv_round_key_vec.repr[i]);
239 }
240 return out;
241 }
242
243 /// Apply the inverse AES operation to the block vector with a vector of last round keys.
244 pub inline fn decryptLast(block_vec: Self, inv_round_key_vec: Self) Self {
245 var out: Self = undefined;
246 inline for (0..native_words) |i| {
247 out.repr[i] = block_vec.repr[i].decryptLast(inv_round_key_vec.repr[i]);
248 }
249 return out;
250 }
251
252 /// Apply the bitwise XOR operation to the content of two block vectors.
253 pub inline fn xorBlocks(block_vec1: Self, block_vec2: Self) Self {
254 var out: Self = undefined;
255 inline for (0..native_words) |i| {
256 out.repr[i] = block_vec1.repr[i].xorBlocks(block_vec2.repr[i]);
257 }
258 return out;
259 }
260
261 /// Apply the bitwise AND operation to the content of two block vectors.
262 pub inline fn andBlocks(block_vec1: Self, block_vec2: Self) Self {
263 var out: Self = undefined;
264 inline for (0..native_words) |i| {
265 out.repr[i] = block_vec1.repr[i].andBlocks(block_vec2.repr[i]);
266 }
267 return out;
268 }
269
270 /// Apply the bitwise OR operation to the content of two block vectors.
271 pub inline fn orBlocks(block_vec1: Self, block_vec2: Block) Self {
272 var out: Self = undefined;
273 inline for (0..native_words) |i| {
274 out.repr[i] = block_vec1.repr[i].orBlocks(block_vec2.repr[i]);
275 }
276 return out;
277 }
278 };
279}
280
168fn KeySchedule(comptime Aes: type) type {281fn KeySchedule(comptime Aes: type) type {
169 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);282 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
170 const rounds = Aes.rounds;283 const rounds = Aes.rounds;
...@@ -172,17 +285,19 @@ fn KeySchedule(comptime Aes: type) type {...@@ -172,17 +285,19 @@ fn KeySchedule(comptime Aes: type) type {
172 return struct {285 return struct {
173 const Self = @This();286 const Self = @This();
174287
288 const Repr = Aes.block.Repr;
289
175 const zero = @Vector(2, u64){ 0, 0 };290 const zero = @Vector(2, u64){ 0, 0 };
176 const mask1 = @Vector(16, u8){ 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12 };291 const mask1 = @Vector(16, u8){ 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12 };
177 const mask2 = @Vector(16, u8){ 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15 };292 const mask2 = @Vector(16, u8){ 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15 };
178293
179 round_keys: [rounds + 1]Block,294 round_keys: [rounds + 1]Block,
180295
181 fn drc128(comptime rc: u8, t: BlockVec) BlockVec {296 fn drc128(comptime rc: u8, t: Repr) Repr {
182 var v1: BlockVec = undefined;297 var v1: Repr = undefined;
183 var v2: BlockVec = undefined;298 var v2: Repr = undefined;
184 var v3: BlockVec = undefined;299 var v3: Repr = undefined;
185 var v4: BlockVec = undefined;300 var v4: Repr = undefined;
186301
187 return asm (302 return asm (
188 \\ movi %[v2].4s, %[rc]303 \\ movi %[v2].4s, %[rc]
...@@ -196,7 +311,7 @@ fn KeySchedule(comptime Aes: type) type {...@@ -196,7 +311,7 @@ fn KeySchedule(comptime Aes: type) type {
196 \\ eor %[v1].16b, %[v1].16b, %[r].16b311 \\ eor %[v1].16b, %[v1].16b, %[r].16b
197 \\ eor %[r].16b, %[v1].16b, %[v3].16b312 \\ eor %[r].16b, %[v1].16b, %[v3].16b
198 \\ eor %[r].16b, %[r].16b, %[v4].16b313 \\ eor %[r].16b, %[r].16b, %[v4].16b
199 : [r] "=&x" (-> BlockVec),314 : [r] "=&x" (-> Repr),
200 [v1] "=&x" (v1),315 [v1] "=&x" (v1),
201 [v2] "=&x" (v2),316 [v2] "=&x" (v2),
202 [v3] "=&x" (v3),317 [v3] "=&x" (v3),
...@@ -208,11 +323,11 @@ fn KeySchedule(comptime Aes: type) type {...@@ -208,11 +323,11 @@ fn KeySchedule(comptime Aes: type) type {
208 );323 );
209 }324 }
210325
211 fn drc256(comptime second: bool, comptime rc: u8, t: BlockVec, tx: BlockVec) BlockVec {326 fn drc256(comptime second: bool, comptime rc: u8, t: Repr, tx: Repr) Repr {
212 var v1: BlockVec = undefined;327 var v1: Repr = undefined;
213 var v2: BlockVec = undefined;328 var v2: Repr = undefined;
214 var v3: BlockVec = undefined;329 var v3: Repr = undefined;
215 var v4: BlockVec = undefined;330 var v4: Repr = undefined;
216331
217 return asm (332 return asm (
218 \\ movi %[v2].4s, %[rc]333 \\ movi %[v2].4s, %[rc]
...@@ -226,7 +341,7 @@ fn KeySchedule(comptime Aes: type) type {...@@ -226,7 +341,7 @@ fn KeySchedule(comptime Aes: type) type {
226 \\ eor %[v1].16b, %[v1].16b, %[v2].16b341 \\ eor %[v1].16b, %[v1].16b, %[v2].16b
227 \\ eor %[v1].16b, %[v1].16b, %[v3].16b342 \\ eor %[v1].16b, %[v1].16b, %[v3].16b
228 \\ eor %[r].16b, %[v1].16b, %[v4].16b343 \\ eor %[r].16b, %[v1].16b, %[v4].16b
229 : [r] "=&x" (-> BlockVec),344 : [r] "=&x" (-> Repr),
230 [v1] "=&x" (v1),345 [v1] "=&x" (v1),
231 [v2] "=&x" (v2),346 [v2] "=&x" (v2),
232 [v3] "=&x" (v3),347 [v3] "=&x" (v3),
...@@ -276,7 +391,7 @@ fn KeySchedule(comptime Aes: type) type {...@@ -276,7 +391,7 @@ fn KeySchedule(comptime Aes: type) type {
276 inv_round_keys[i] = Block{391 inv_round_keys[i] = Block{
277 .repr = asm (392 .repr = asm (
278 \\ aesimc %[inv_rk].16b, %[rk].16b393 \\ aesimc %[inv_rk].16b, %[rk].16b
279 : [inv_rk] "=x" (-> BlockVec),394 : [inv_rk] "=x" (-> Repr),
280 : [rk] "x" (round_keys[rounds - i].repr),395 : [rk] "x" (round_keys[rounds - i].repr),
281 ),396 ),
282 };397 };
lib/std/crypto/aes/soft.zig+132-19
...@@ -2,16 +2,16 @@ const std = @import("../../std.zig");...@@ -2,16 +2,16 @@ const std = @import("../../std.zig");
2const math = std.math;2const math = std.math;
3const mem = std.mem;3const mem = std.mem;
44
5const BlockVec = [4]u32;
6
7const side_channels_mitigations = std.options.side_channels_mitigations;5const side_channels_mitigations = std.options.side_channels_mitigations;
86
9/// A single AES block.7/// A single AES block.
10pub const Block = struct {8pub const Block = struct {
9 const Repr = [4]u32;
10
11 pub const block_length: usize = 16;11 pub const block_length: usize = 16;
1212
13 /// Internal representation of a block.13 /// Internal representation of a block.
14 repr: BlockVec align(16),14 repr: Repr align(16),
1515
16 /// Convert a byte sequence into an internal representation.16 /// Convert a byte sequence into an internal representation.
17 pub inline fn fromBytes(bytes: *const [16]u8) Block {17 pub inline fn fromBytes(bytes: *const [16]u8) Block {
...@@ -19,7 +19,7 @@ pub const Block = struct {...@@ -19,7 +19,7 @@ pub const Block = struct {
19 const s1 = mem.readInt(u32, bytes[4..8], .little);19 const s1 = mem.readInt(u32, bytes[4..8], .little);
20 const s2 = mem.readInt(u32, bytes[8..12], .little);20 const s2 = mem.readInt(u32, bytes[8..12], .little);
21 const s3 = mem.readInt(u32, bytes[12..16], .little);21 const s3 = mem.readInt(u32, bytes[12..16], .little);
22 return Block{ .repr = BlockVec{ s0, s1, s2, s3 } };22 return Block{ .repr = Repr{ s0, s1, s2, s3 } };
23 }23 }
2424
25 /// Convert the internal representation of a block into a byte sequence.25 /// Convert the internal representation of a block into a byte sequence.
...@@ -65,7 +65,7 @@ pub const Block = struct {...@@ -65,7 +65,7 @@ pub const Block = struct {
65 t2 ^= round_key.repr[2];65 t2 ^= round_key.repr[2];
66 t3 ^= round_key.repr[3];66 t3 ^= round_key.repr[3];
6767
68 return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };68 return Block{ .repr = Repr{ t0, t1, t2, t3 } };
69 }69 }
7070
71 /// Encrypt a block with a round key *WITHOUT ANY PROTECTION AGAINST SIDE CHANNELS*71 /// Encrypt a block with a round key *WITHOUT ANY PROTECTION AGAINST SIDE CHANNELS*
...@@ -110,7 +110,7 @@ pub const Block = struct {...@@ -110,7 +110,7 @@ pub const Block = struct {
110 t2 ^= round_key.repr[2];110 t2 ^= round_key.repr[2];
111 t3 ^= round_key.repr[3];111 t3 ^= round_key.repr[3];
112112
113 return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };113 return Block{ .repr = Repr{ t0, t1, t2, t3 } };
114 }114 }
115115
116 /// Encrypt a block with the last round key.116 /// Encrypt a block with the last round key.
...@@ -136,7 +136,7 @@ pub const Block = struct {...@@ -136,7 +136,7 @@ pub const Block = struct {
136 t2 ^= round_key.repr[2];136 t2 ^= round_key.repr[2];
137 t3 ^= round_key.repr[3];137 t3 ^= round_key.repr[3];
138138
139 return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };139 return Block{ .repr = Repr{ t0, t1, t2, t3 } };
140 }140 }
141141
142 /// Decrypt a block with a round key.142 /// Decrypt a block with a round key.
...@@ -161,7 +161,7 @@ pub const Block = struct {...@@ -161,7 +161,7 @@ pub const Block = struct {
161 t2 ^= round_key.repr[2];161 t2 ^= round_key.repr[2];
162 t3 ^= round_key.repr[3];162 t3 ^= round_key.repr[3];
163163
164 return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };164 return Block{ .repr = Repr{ t0, t1, t2, t3 } };
165 }165 }
166166
167 /// Decrypt a block with a round key *WITHOUT ANY PROTECTION AGAINST SIDE CHANNELS*167 /// Decrypt a block with a round key *WITHOUT ANY PROTECTION AGAINST SIDE CHANNELS*
...@@ -206,7 +206,7 @@ pub const Block = struct {...@@ -206,7 +206,7 @@ pub const Block = struct {
206 t2 ^= round_key.repr[2];206 t2 ^= round_key.repr[2];
207 t3 ^= round_key.repr[3];207 t3 ^= round_key.repr[3];
208208
209 return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };209 return Block{ .repr = Repr{ t0, t1, t2, t3 } };
210 }210 }
211211
212 /// Decrypt a block with the last round key.212 /// Decrypt a block with the last round key.
...@@ -232,12 +232,12 @@ pub const Block = struct {...@@ -232,12 +232,12 @@ pub const Block = struct {
232 t2 ^= round_key.repr[2];232 t2 ^= round_key.repr[2];
233 t3 ^= round_key.repr[3];233 t3 ^= round_key.repr[3];
234234
235 return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };235 return Block{ .repr = Repr{ t0, t1, t2, t3 } };
236 }236 }
237237
238 /// Apply the bitwise XOR operation to the content of two blocks.238 /// Apply the bitwise XOR operation to the content of two blocks.
239 pub inline fn xorBlocks(block1: Block, block2: Block) Block {239 pub inline fn xorBlocks(block1: Block, block2: Block) Block {
240 var x: BlockVec = undefined;240 var x: Repr = undefined;
241 comptime var i = 0;241 comptime var i = 0;
242 inline while (i < 4) : (i += 1) {242 inline while (i < 4) : (i += 1) {
243 x[i] = block1.repr[i] ^ block2.repr[i];243 x[i] = block1.repr[i] ^ block2.repr[i];
...@@ -247,7 +247,7 @@ pub const Block = struct {...@@ -247,7 +247,7 @@ pub const Block = struct {
247247
248 /// Apply the bitwise AND operation to the content of two blocks.248 /// Apply the bitwise AND operation to the content of two blocks.
249 pub inline fn andBlocks(block1: Block, block2: Block) Block {249 pub inline fn andBlocks(block1: Block, block2: Block) Block {
250 var x: BlockVec = undefined;250 var x: Repr = undefined;
251 comptime var i = 0;251 comptime var i = 0;
252 inline while (i < 4) : (i += 1) {252 inline while (i < 4) : (i += 1) {
253 x[i] = block1.repr[i] & block2.repr[i];253 x[i] = block1.repr[i] & block2.repr[i];
...@@ -257,7 +257,7 @@ pub const Block = struct {...@@ -257,7 +257,7 @@ pub const Block = struct {
257257
258 /// Apply the bitwise OR operation to the content of two blocks.258 /// Apply the bitwise OR operation to the content of two blocks.
259 pub inline fn orBlocks(block1: Block, block2: Block) Block {259 pub inline fn orBlocks(block1: Block, block2: Block) Block {
260 var x: BlockVec = undefined;260 var x: Repr = undefined;
261 comptime var i = 0;261 comptime var i = 0;
262 inline while (i < 4) : (i += 1) {262 inline while (i < 4) : (i += 1) {
263 x[i] = block1.repr[i] | block2.repr[i];263 x[i] = block1.repr[i] | block2.repr[i];
...@@ -332,6 +332,118 @@ pub const Block = struct {...@@ -332,6 +332,118 @@ pub const Block = struct {
332 };332 };
333};333};
334334
335/// A fixed-size vector of AES blocks.
336/// All operations are performed in parallel, using SIMD instructions when available.
337pub fn BlockVec(comptime blocks_count: comptime_int) type {
338 return struct {
339 const Self = @This();
340
341 /// The number of AES blocks the target architecture can process with a single instruction.
342 pub const native_vector_size = 1;
343
344 /// The size of the AES block vector that the target architecture can process with a single instruction, in bytes.
345 pub const native_word_size = native_vector_size * 16;
346
347 const native_words = blocks_count;
348
349 /// Internal representation of a block vector.
350 repr: [native_words]Block,
351
352 /// Length of the block vector in bytes.
353 pub const block_length: usize = blocks_count * 16;
354
355 /// Convert a byte sequence into an internal representation.
356 pub inline fn fromBytes(bytes: *const [blocks_count * 16]u8) Self {
357 var out: Self = undefined;
358 for (0..native_words) |i| {
359 out.repr[i] = Block.fromBytes(bytes[i * native_word_size ..][0..native_word_size]);
360 }
361 return out;
362 }
363
364 /// Convert the internal representation of a block vector into a byte sequence.
365 pub inline fn toBytes(block_vec: Self) [blocks_count * 16]u8 {
366 var out: [blocks_count * 16]u8 = undefined;
367 for (0..native_words) |i| {
368 out[i * native_word_size ..][0..native_word_size].* = block_vec.repr[i].toBytes();
369 }
370 return out;
371 }
372
373 /// XOR the block vector with a byte sequence.
374 pub inline fn xorBytes(block_vec: Self, bytes: *const [blocks_count * 16]u8) [32]u8 {
375 var out: Self = undefined;
376 for (0..native_words) |i| {
377 out.repr[i] = block_vec.repr[i].xorBytes(bytes[i * native_word_size ..][0..native_word_size]);
378 }
379 return out;
380 }
381
382 /// Apply the forward AES operation to the block vector with a vector of round keys.
383 pub inline fn encrypt(block_vec: Self, round_key_vec: Self) Self {
384 var out: Self = undefined;
385 for (0..native_words) |i| {
386 out.repr[i] = block_vec.repr[i].encrypt(round_key_vec.repr[i]);
387 }
388 return out;
389 }
390
391 /// Apply the forward AES operation to the block vector with a vector of last round keys.
392 pub inline fn encryptLast(block_vec: Self, round_key_vec: Self) Self {
393 var out: Self = undefined;
394 for (0..native_words) |i| {
395 out.repr[i] = block_vec.repr[i].encryptLast(round_key_vec.repr[i]);
396 }
397 return out;
398 }
399
400 /// Apply the inverse AES operation to the block vector with a vector of round keys.
401 pub inline fn decrypt(block_vec: Self, inv_round_key_vec: Self) Self {
402 var out: Self = undefined;
403 for (0..native_words) |i| {
404 out.repr[i] = block_vec.repr[i].decrypt(inv_round_key_vec.repr[i]);
405 }
406 return out;
407 }
408
409 /// Apply the inverse AES operation to the block vector with a vector of last round keys.
410 pub inline fn decryptLast(block_vec: Self, inv_round_key_vec: Self) Self {
411 var out: Self = undefined;
412 for (0..native_words) |i| {
413 out.repr[i] = block_vec.repr[i].decryptLast(inv_round_key_vec.repr[i]);
414 }
415 return out;
416 }
417
418 /// Apply the bitwise XOR operation to the content of two block vectors.
419 pub inline fn xorBlocks(block_vec1: Self, block_vec2: Self) Self {
420 var out: Self = undefined;
421 for (0..native_words) |i| {
422 out.repr[i] = block_vec1.repr[i].xorBlocks(block_vec2.repr[i]);
423 }
424 return out;
425 }
426
427 /// Apply the bitwise AND operation to the content of two block vectors.
428 pub inline fn andBlocks(block_vec1: Self, block_vec2: Self) Self {
429 var out: Self = undefined;
430 for (0..native_words) |i| {
431 out.repr[i] = block_vec1.repr[i].andBlocks(block_vec2.repr[i]);
432 }
433 return out;
434 }
435
436 /// Apply the bitwise OR operation to the content of two block vectors.
437 pub inline fn orBlocks(block_vec1: Self, block_vec2: Block) Self {
438 var out: Self = undefined;
439 for (0..native_words) |i| {
440 out.repr[i] = block_vec1.repr[i].orBlocks(block_vec2.repr[i]);
441 }
442 return out;
443 }
444 };
445}
446
335fn KeySchedule(comptime Aes: type) type {447fn KeySchedule(comptime Aes: type) type {
336 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);448 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
337 const key_length = Aes.key_bits / 8;449 const key_length = Aes.key_bits / 8;
...@@ -671,7 +783,7 @@ fn mul(a: u8, b: u8) u8 {...@@ -671,7 +783,7 @@ fn mul(a: u8, b: u8) u8 {
671783
672const cache_line_bytes = std.atomic.cache_line;784const cache_line_bytes = std.atomic.cache_line;
673785
674inline fn sbox_lookup(sbox: *align(64) const [256]u8, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u8 {786fn sbox_lookup(sbox: *align(64) const [256]u8, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u8 {
675 if (side_channels_mitigations == .none) {787 if (side_channels_mitigations == .none) {
676 return [4]u8{788 return [4]u8{
677 sbox[idx0],789 sbox[idx0],
...@@ -709,7 +821,7 @@ inline fn sbox_lookup(sbox: *align(64) const [256]u8, idx0: u8, idx1: u8, idx2:...@@ -709,7 +821,7 @@ inline fn sbox_lookup(sbox: *align(64) const [256]u8, idx0: u8, idx1: u8, idx2:
709 }821 }
710}822}
711823
712inline fn table_lookup(table: *align(64) const [4][256]u32, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u32 {824fn table_lookup(table: *align(64) const [4][256]u32, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u32 {
713 if (side_channels_mitigations == .none) {825 if (side_channels_mitigations == .none) {
714 return [4]u32{826 return [4]u32{
715 table[0][idx0],827 table[0][idx0],
...@@ -718,17 +830,18 @@ inline fn table_lookup(table: *align(64) const [4][256]u32, idx0: u8, idx1: u8,...@@ -718,17 +830,18 @@ inline fn table_lookup(table: *align(64) const [4][256]u32, idx0: u8, idx1: u8,
718 table[3][idx3],830 table[3][idx3],
719 };831 };
720 } else {832 } else {
833 const table_len: usize = 256;
721 const stride = switch (side_channels_mitigations) {834 const stride = switch (side_channels_mitigations) {
722 .none => unreachable,835 .none => unreachable,
723 .basic => table[0].len / 4,836 .basic => table_len / 4,
724 .medium => @max(1, @min(table[0].len, 2 * cache_line_bytes / 4)),837 .medium => @max(1, @min(table_len, 2 * cache_line_bytes / 4)),
725 .full => @max(1, @min(table[0].len, cache_line_bytes / 4)),838 .full => @max(1, @min(table_len, cache_line_bytes / 4)),
726 };839 };
727 const of0 = idx0 % stride;840 const of0 = idx0 % stride;
728 const of1 = idx1 % stride;841 const of1 = idx1 % stride;
729 const of2 = idx2 % stride;842 const of2 = idx2 % stride;
730 const of3 = idx3 % stride;843 const of3 = idx3 % stride;
731 var t: [4][table[0].len / stride]u32 align(64) = undefined;844 var t: [4][table_len / stride]u32 align(64) = undefined;
732 var i: usize = 0;845 var i: usize = 0;
733 while (i < t[0].len) : (i += 1) {846 while (i < t[0].len) : (i += 1) {
734 const tx = table[0][i * stride ..];847 const tx = table[0][i * stride ..];
lib/std/crypto/benchmark.zig+8
...@@ -72,6 +72,10 @@ const macs = [_]Crypto{...@@ -72,6 +72,10 @@ const macs = [_]Crypto{
72 Crypto{ .ty = crypto.auth.siphash.SipHash64(1, 3), .name = "siphash-1-3" },72 Crypto{ .ty = crypto.auth.siphash.SipHash64(1, 3), .name = "siphash-1-3" },
73 Crypto{ .ty = crypto.auth.siphash.SipHash128(2, 4), .name = "siphash128-2-4" },73 Crypto{ .ty = crypto.auth.siphash.SipHash128(2, 4), .name = "siphash128-2-4" },
74 Crypto{ .ty = crypto.auth.siphash.SipHash128(1, 3), .name = "siphash128-1-3" },74 Crypto{ .ty = crypto.auth.siphash.SipHash128(1, 3), .name = "siphash128-1-3" },
75 Crypto{ .ty = crypto.auth.aegis.Aegis128X4Mac, .name = "aegis-128x4 mac" },
76 Crypto{ .ty = crypto.auth.aegis.Aegis256X4Mac, .name = "aegis-256x4 mac" },
77 Crypto{ .ty = crypto.auth.aegis.Aegis128X2Mac, .name = "aegis-128x2 mac" },
78 Crypto{ .ty = crypto.auth.aegis.Aegis256X2Mac, .name = "aegis-256x2 mac" },
75 Crypto{ .ty = crypto.auth.aegis.Aegis128LMac, .name = "aegis-128l mac" },79 Crypto{ .ty = crypto.auth.aegis.Aegis128LMac, .name = "aegis-128l mac" },
76 Crypto{ .ty = crypto.auth.aegis.Aegis256Mac, .name = "aegis-256 mac" },80 Crypto{ .ty = crypto.auth.aegis.Aegis256Mac, .name = "aegis-256 mac" },
77 Crypto{ .ty = crypto.auth.cmac.CmacAes128, .name = "aes-cmac" },81 Crypto{ .ty = crypto.auth.cmac.CmacAes128, .name = "aes-cmac" },
...@@ -283,7 +287,11 @@ const aeads = [_]Crypto{...@@ -283,7 +287,11 @@ const aeads = [_]Crypto{
283 Crypto{ .ty = crypto.aead.chacha_poly.XChaCha20Poly1305, .name = "xchacha20Poly1305" },287 Crypto{ .ty = crypto.aead.chacha_poly.XChaCha20Poly1305, .name = "xchacha20Poly1305" },
284 Crypto{ .ty = crypto.aead.chacha_poly.XChaCha8Poly1305, .name = "xchacha8Poly1305" },288 Crypto{ .ty = crypto.aead.chacha_poly.XChaCha8Poly1305, .name = "xchacha8Poly1305" },
285 Crypto{ .ty = crypto.aead.salsa_poly.XSalsa20Poly1305, .name = "xsalsa20Poly1305" },289 Crypto{ .ty = crypto.aead.salsa_poly.XSalsa20Poly1305, .name = "xsalsa20Poly1305" },
290 Crypto{ .ty = crypto.aead.aegis.Aegis128X4, .name = "aegis-128x4" },
291 Crypto{ .ty = crypto.aead.aegis.Aegis128X2, .name = "aegis-128x2" },
286 Crypto{ .ty = crypto.aead.aegis.Aegis128L, .name = "aegis-128l" },292 Crypto{ .ty = crypto.aead.aegis.Aegis128L, .name = "aegis-128l" },
293 Crypto{ .ty = crypto.aead.aegis.Aegis256X4, .name = "aegis-256x4" },
294 Crypto{ .ty = crypto.aead.aegis.Aegis256X2, .name = "aegis-256x2" },
287 Crypto{ .ty = crypto.aead.aegis.Aegis256, .name = "aegis-256" },295 Crypto{ .ty = crypto.aead.aegis.Aegis256, .name = "aegis-256" },
288 Crypto{ .ty = crypto.aead.aes_gcm.Aes128Gcm, .name = "aes128-gcm" },296 Crypto{ .ty = crypto.aead.aes_gcm.Aes128Gcm, .name = "aes128-gcm" },
289 Crypto{ .ty = crypto.aead.aes_gcm.Aes256Gcm, .name = "aes256-gcm" },297 Crypto{ .ty = crypto.aead.aes_gcm.Aes256Gcm, .name = "aes256-gcm" },