decrypt.c 2.79 KB
Newer Older
lwc-tester committed
1
#include "api.h"
Martin Schläffer committed
2
#include "ascon.h"
Enrico Pozzobon committed
3
#include "crypto_aead.h"
lwc-tester committed
4
#include "permutations.h"
Martin Schläffer committed
5
#include "printstate.h"
Martin Schläffer committed
6
#include "word.h"
lwc-tester committed
7

Enrico Pozzobon committed
8 9 10 11 12
int crypto_aead_decrypt(unsigned char* m, unsigned long long* mlen,
                        unsigned char* nsec, const unsigned char* c,
                        unsigned long long clen, const unsigned char* ad,
                        unsigned long long adlen, const unsigned char* npub,
                        const unsigned char* k) {
Martin Schläffer committed
13
  (void)nsec;
lwc-tester committed
14

Enrico Pozzobon committed
15
  if (clen < CRYPTO_ABYTES) return -1;
lwc-tester committed
16

Martin Schläffer committed
17
  /* set plaintext size */
lwc-tester committed
18 19
  *mlen = clen - CRYPTO_ABYTES;

Martin Schläffer committed
20
  /* load key and nonce */
Enrico Pozzobon committed
21 22 23 24
  const uint64_t K0 = LOADBYTES(k, 8);
  const uint64_t K1 = LOADBYTES(k + 8, 8);
  const uint64_t N0 = LOADBYTES(npub, 8);
  const uint64_t N1 = LOADBYTES(npub + 8, 8);
Martin Schläffer committed
25

Enrico Pozzobon committed
26 27
  /* initialize */
  state_t s;
Martin Schläffer committed
28
  s.x0 = ASCON_128A_IV;
lwc-tester committed
29 30 31 32 33 34 35
  s.x1 = K0;
  s.x2 = K1;
  s.x3 = N0;
  s.x4 = N1;
  P12(&s);
  s.x3 ^= K0;
  s.x4 ^= K1;
Martin Schläffer committed
36
  printstate("initialization", &s);
lwc-tester committed
37 38

  if (adlen) {
Enrico Pozzobon committed
39
    /* full associated data blocks */
Martin Schläffer committed
40
    while (adlen >= ASCON_128A_RATE) {
Martin Schläffer committed
41 42
      s.x0 ^= LOADBYTES(ad, 8);
      s.x1 ^= LOADBYTES(ad + 8, 8);
lwc-tester committed
43
      P8(&s);
Martin Schläffer committed
44 45
      ad += ASCON_128A_RATE;
      adlen -= ASCON_128A_RATE;
lwc-tester committed
46
    }
Martin Schläffer committed
47
    /* final associated data block */
lwc-tester committed
48
    if (adlen >= 8) {
Martin Schläffer committed
49 50
      s.x0 ^= LOADBYTES(ad, 8);
      s.x1 ^= LOADBYTES(ad + 8, adlen - 8);
Martin Schläffer committed
51
      s.x1 ^= PAD(adlen - 8);
lwc-tester committed
52
    } else {
Martin Schläffer committed
53
      s.x0 ^= LOADBYTES(ad, adlen);
Martin Schläffer committed
54
      s.x0 ^= PAD(adlen);
lwc-tester committed
55 56 57
    }
    P8(&s);
  }
Enrico Pozzobon committed
58
  /* domain separation */
lwc-tester committed
59
  s.x4 ^= 1;
Martin Schläffer committed
60
  printstate("process associated data", &s);
lwc-tester committed
61

Enrico Pozzobon committed
62
  /* full ciphertext blocks */
lwc-tester committed
63
  clen -= CRYPTO_ABYTES;
Martin Schläffer committed
64
  while (clen >= ASCON_128A_RATE) {
Martin Schläffer committed
65 66 67 68
    uint64_t c0 = LOADBYTES(c, 8);
    uint64_t c1 = LOADBYTES(c + 8, 8);
    STOREBYTES(m, s.x0 ^ c0, 8);
    STOREBYTES(m + 8, s.x1 ^ c1, 8);
lwc-tester committed
69 70 71
    s.x0 = c0;
    s.x1 = c1;
    P8(&s);
Martin Schläffer committed
72 73 74
    m += ASCON_128A_RATE;
    c += ASCON_128A_RATE;
    clen -= ASCON_128A_RATE;
lwc-tester committed
75
  }
Martin Schläffer committed
76
  /* final ciphertext block */
lwc-tester committed
77
  if (clen >= 8) {
Martin Schläffer committed
78 79 80 81
    uint64_t c0 = LOADBYTES(c, 8);
    uint64_t c1 = LOADBYTES(c + 8, clen - 8);
    STOREBYTES(m, s.x0 ^ c0, 8);
    STOREBYTES(m + 8, s.x1 ^ c1, clen - 8);
lwc-tester committed
82
    s.x0 = c0;
Martin Schläffer committed
83
    s.x1 = CLEARBYTES(s.x1, clen - 8);
lwc-tester committed
84
    s.x1 |= c1;
Martin Schläffer committed
85
    s.x1 ^= PAD(clen - 8);
lwc-tester committed
86
  } else {
Martin Schläffer committed
87 88 89
    uint64_t c0 = LOADBYTES(c, clen);
    STOREBYTES(m, s.x0 ^ c0, clen);
    s.x0 = CLEARBYTES(s.x0, clen);
lwc-tester committed
90
    s.x0 |= c0;
Martin Schläffer committed
91
    s.x0 ^= PAD(clen);
lwc-tester committed
92 93
  }
  c += clen;
Martin Schläffer committed
94
  printstate("process ciphertext", &s);
lwc-tester committed
95

Enrico Pozzobon committed
96
  /* finalize */
lwc-tester committed
97 98 99 100 101
  s.x2 ^= K0;
  s.x3 ^= K1;
  P12(&s);
  s.x3 ^= K0;
  s.x4 ^= K1;
Martin Schläffer committed
102
  printstate("finalization", &s);
lwc-tester committed
103

Enrico Pozzobon committed
104 105 106 107 108
  /* set tag */
  uint8_t t[16];
  STOREBYTES(t, s.x3, 8);
  STOREBYTES(t + 8, s.x4, 8);

Martin Schläffer committed
109
  /* verify tag (should be constant time, check compiler output) */
Enrico Pozzobon committed
110 111 112
  int result = 0;
  for (int i = 0; i < CRYPTO_ABYTES; ++i) result |= c[i] ^ t[i];
  result = (((result - 1) >> 8) & 1) - 1;
lwc-tester committed
113

Enrico Pozzobon committed
114
  return result;
lwc-tester committed
115
}