hyena.c

/*
 * Copyright (C) 2020 Southern Storm Software, Pty Ltd.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included
 * in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 */

#include "hyena.h"
#include "internal-gift128.h"
#include "internal-util.h"
#include <string.h>

aead_cipher_t const hyena_v1_cipher = {
    "HYENA-v1",
    HYENA_KEY_SIZE,
    HYENA_NONCE_SIZE,
    HYENA_TAG_SIZE,
    AEAD_FLAG_LITTLE_ENDIAN,
    hyena_v1_aead_encrypt,
    hyena_v1_aead_decrypt
};

aead_cipher_t const hyena_v2_cipher = {
    "HYENA-v2",
    HYENA_KEY_SIZE,
    HYENA_NONCE_SIZE,
    HYENA_TAG_SIZE,
    AEAD_FLAG_LITTLE_ENDIAN,
    hyena_v2_aead_encrypt,
    hyena_v2_aead_decrypt
};

/**
 * \brief Doubles a delta value in the F(2^64) field.
 *
 * \param D The delta value to be doubled.
 *
 * D = D << 1 if the top-most bit is 0, or D = (D << 1) ^ 0x1B otherwise.
 */
static void hyena_double_delta(unsigned char D[8])
{
    unsigned index;
    unsigned char mask = (unsigned char)(((signed char)(D[0])) >> 7);
    for (index = 0; index < 7; ++index)
        D[index] = (D[index] << 1) | (D[index + 1] >> 7);
    D[7] = (D[7] << 1) ^ (mask & 0x1B);
}

/**
 * \brief Triples a delta value in the F(2^64) field.
 *
 * \param D The delta value to be tripled.
 *
 * D' = D ^ (D << 1) if the top-most bit is 0, or D' = D ^ (D << 1) ^ 0x1B
 * otherwise.
 */
static void hyena_triple_delta(unsigned char D[8])
{
    unsigned index;
    unsigned char mask = (unsigned char)(((signed char)(D[0])) >> 7);
    for (index = 0; index < 7; ++index)
        D[index] ^= (D[index] << 1) | (D[index + 1] >> 7);
    D[7] ^= (D[7] << 1) ^ (mask & 0x1B);
}

/**
 * \brief Process the associated data for HYENA-v1.
 *
 * \param ks Key schedule for the GIFT-128 cipher.
 * \param Y Internal hash state of HYENA.
 * \param D Internal hash state of HYENA.
 * \param ad Points to the associated data.
 * \param adlen Length of the associated data in bytes.
 */
static void hyena_v1_process_ad
    (const gift128n_key_schedule_t *ks, unsigned char Y[16],
     unsigned char D[8], const unsigned char *ad,
     unsigned long long adlen)
{
    unsigned char feedback[16];
    hyena_double_delta(D);
    while (adlen > 16) {
        memcpy(feedback, ad, 16);
        lw_xor_block(feedback + 8, Y + 8, 8);
        lw_xor_block(feedback + 8, D, 8);
        lw_xor_block(Y, feedback, 16);
        gift128n_encrypt(ks, Y, Y);
        hyena_double_delta(D);
        ad += 16;
        adlen -= 16;
    }
    if (adlen == 16) {
        hyena_double_delta(D);
        memcpy(feedback, ad, 16);
        lw_xor_block(feedback + 8, Y + 8, 8);
        lw_xor_block(feedback + 8, D, 8);
        lw_xor_block(Y, feedback, 16);
    } else {
        unsigned temp = (unsigned)adlen;
        hyena_double_delta(D);
        hyena_double_delta(D);
        memcpy(feedback, ad, temp);
        feedback[temp] = 0x01;
        memset(feedback + temp + 1, 0, 15 - temp);
        if (temp > 8)
            lw_xor_block(feedback + 8, Y + 8, temp - 8);
        lw_xor_block(feedback + 8, D, 8);
        lw_xor_block(Y, feedback, 16);
    }
}

int hyena_v1_aead_encrypt
    (unsigned char *c, unsigned long long *clen,
     const unsigned char *m, unsigned long long mlen,
     const unsigned char *ad, unsigned long long adlen,
     const unsigned char *nsec,
     const unsigned char *npub,
     const unsigned char *k)
{
    gift128n_key_schedule_t ks;
    unsigned char Y[16];
    unsigned char D[8];
    unsigned char feedback[16];
    unsigned index;
    (void)nsec;

    /* Set the length of the returned ciphertext */
    *clen = mlen + HYENA_TAG_SIZE;

    /* Set up the key schedule and use it to encrypt the nonce */
    gift128n_init(&ks, k);
    Y[0] = 0;
    if (adlen == 0)
        Y[0] |= 0x01;
    if (adlen == 0 && mlen == 0)
        Y[0] |= 0x02;
    Y[1] = 0;
    Y[2] = 0;
    Y[3] = 0;
    memcpy(Y + 4, npub, HYENA_NONCE_SIZE);
    gift128n_encrypt(&ks, Y, Y);
    memcpy(D, Y + 8, 8);

    /* Process the associated data */
    hyena_v1_process_ad(&ks, Y, D, ad, adlen);

    /* Encrypt the plaintext to produce the ciphertext */
    if (mlen > 0) {
        while (mlen > 16) {
            gift128n_encrypt(&ks, Y, Y);
            hyena_double_delta(D);
            memcpy(feedback, m, 16);
            lw_xor_block(feedback + 8, Y + 8, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block_2_src(c, m, Y, 16);
            lw_xor_block(Y, feedback, 16);
            c += 16;
            m += 16;
            mlen -= 16;
        }
        gift128n_encrypt(&ks, Y, Y);
        if (mlen == 16) {
            hyena_double_delta(D);
            hyena_double_delta(D);
            memcpy(feedback, m, 16);
            lw_xor_block(feedback + 8, Y + 8, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block_2_src(c, m, Y, 16);
            lw_xor_block(Y, feedback, 16);
            c += 16;
        } else {
            unsigned temp = (unsigned)mlen;
            hyena_double_delta(D);
            hyena_double_delta(D);
            hyena_double_delta(D);
            memcpy(feedback, m, temp);
            feedback[temp] = 0x01;
            memset(feedback + temp + 1, 0, 15 - temp);
            if (temp > 8)
                lw_xor_block(feedback + 8, Y + 8, temp - 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block_2_src(c, m, Y, temp);
            lw_xor_block(Y, feedback, 16);
            c += temp;
        }
    }

    /* Swap the two halves of Y and generate the authentication tag */
    for (index = 0; index < 8; ++index) {
        unsigned char temp1 = Y[index];
        unsigned char temp2 = Y[index + 8];
        Y[index] = temp2;
        Y[index + 8] = temp1;
    }
    gift128n_encrypt(&ks, c, Y);
    return 0;
}

int hyena_v1_aead_decrypt
    (unsigned char *m, unsigned long long *mlen,
     unsigned char *nsec,
     const unsigned char *c, unsigned long long clen,
     const unsigned char *ad, unsigned long long adlen,
     const unsigned char *npub,
     const unsigned char *k)
{
    gift128n_key_schedule_t ks;
    unsigned char Y[16];
    unsigned char D[8];
    unsigned char feedback[16];
    unsigned char *mtemp;
    unsigned index;
    (void)nsec;

    /* Validate the ciphertext length and set the return "mlen" value */
    if (clen < HYENA_TAG_SIZE)
        return -1;
    *mlen = clen - HYENA_TAG_SIZE;

    /* Set up the key schedule and use it to encrypt the nonce */
    gift128n_init(&ks, k);
    Y[0] = 0;
    if (adlen == 0)
        Y[0] |= 0x01;
    if (adlen == 0 && clen == HYENA_TAG_SIZE)
        Y[0] |= 0x02;
    Y[1] = 0;
    Y[2] = 0;
    Y[3] = 0;
    memcpy(Y + 4, npub, HYENA_NONCE_SIZE);
    gift128n_encrypt(&ks, Y, Y);
    memcpy(D, Y + 8, 8);

    /* Process the associated data */
    hyena_v1_process_ad(&ks, Y, D, ad, adlen);

    /* Decrypt the ciphertext to produce the plaintext */
    clen -= HYENA_TAG_SIZE;
    mtemp = m;
    if (clen > 0) {
        while (clen > 16) {
            gift128n_encrypt(&ks, Y, Y);
            hyena_double_delta(D);
            memcpy(feedback + 8, c + 8, 8);
            lw_xor_block_2_src(m, c, Y, 16);
            memcpy(feedback, m, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block(Y, feedback, 16);
            c += 16;
            m += 16;
            clen -= 16;
        }
        gift128n_encrypt(&ks, Y, Y);
        if (clen == 16) {
            hyena_double_delta(D);
            hyena_double_delta(D);
            memcpy(feedback + 8, c + 8, 8);
            lw_xor_block_2_src(m, c, Y, 16);
            memcpy(feedback, m, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block(Y, feedback, 16);
            c += 16;
        } else {
            unsigned temp = (unsigned)clen;
            hyena_double_delta(D);
            hyena_double_delta(D);
            hyena_double_delta(D);
            if (temp > 8) {
                memcpy(feedback + 8, c + 8, temp - 8);
                lw_xor_block_2_src(m, c, Y, temp);
                memcpy(feedback, m, 8);
            } else {
                lw_xor_block_2_src(m, c, Y, temp);
                memcpy(feedback, m, temp);
            }
            feedback[temp] = 0x01;
            memset(feedback + temp + 1, 0, 15 - temp);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block(Y, feedback, 16);
            c += temp;
        }
    }

    /* Swap the two halves of Y and check the authentication tag */
    for (index = 0; index < 8; ++index) {
        unsigned char temp1 = Y[index];
        unsigned char temp2 = Y[index + 8];
        Y[index] = temp2;
        Y[index + 8] = temp1;
    }
    gift128n_encrypt(&ks, Y, Y);
    return aead_check_tag(mtemp, *mlen, Y, c, HYENA_TAG_SIZE);
}

/**
 * \brief Process the associated data for HYENA-v2.
 *
 * \param ks Key schedule for the GIFT-128 cipher.
 * \param Y Internal hash state of HYENA.
 * \param D Internal hash state of HYENA.
 * \param ad Points to the associated data.
 * \param adlen Length of the associated data in bytes.
 */
static void hyena_v2_process_ad
    (const gift128n_key_schedule_t *ks, unsigned char Y[16],
     unsigned char D[8], const unsigned char *ad,
     unsigned long long adlen)
{
    unsigned char feedback[16];
    while (adlen > 16) {
        hyena_double_delta(D);
        memcpy(feedback, ad, 16);
        lw_xor_block(feedback + 8, Y + 8, 8);
        lw_xor_block(feedback + 8, D, 8);
        lw_xor_block(Y, feedback, 16);
        gift128n_encrypt(ks, Y, Y);
        ad += 16;
        adlen -= 16;
    }
    if (adlen == 16) {
        hyena_triple_delta(D);
        memcpy(feedback, ad, 16);
        lw_xor_block(feedback + 8, Y + 8, 8);
        lw_xor_block(feedback + 8, D, 8);
        lw_xor_block(Y, feedback, 16);
    } else {
        unsigned temp = (unsigned)adlen;
        hyena_triple_delta(D);
        hyena_triple_delta(D);
        memcpy(feedback, ad, temp);
        feedback[temp] = 0x01;
        memset(feedback + temp + 1, 0, 15 - temp);
        if (temp > 8)
            lw_xor_block(feedback + 8, Y + 8, temp - 8);
        lw_xor_block(feedback + 8, D, 8);
        lw_xor_block(Y, feedback, 16);
    }
}

int hyena_v2_aead_encrypt
    (unsigned char *c, unsigned long long *clen,
     const unsigned char *m, unsigned long long mlen,
     const unsigned char *ad, unsigned long long adlen,
     const unsigned char *nsec,
     const unsigned char *npub,
     const unsigned char *k)
{
    gift128n_key_schedule_t ks;
    unsigned char Y[16];
    unsigned char D[8];
    unsigned char feedback[16];
    unsigned index;
    (void)nsec;

    /* Set the length of the returned ciphertext */
    *clen = mlen + HYENA_TAG_SIZE;

    /* Set up the key schedule and use it to encrypt the nonce */
    gift128n_init(&ks, k);
    Y[0] = 0;
    if (adlen == 0)
        Y[0] |= 0x01;
    if (adlen == 0 && mlen == 0)
        Y[0] |= 0x02;
    Y[1] = 0;
    Y[2] = 0;
    Y[3] = 0;
    memcpy(Y + 4, npub, HYENA_NONCE_SIZE);
    gift128n_encrypt(&ks, Y, Y);
    memcpy(D, Y + 8, 8);

    /* Process the associated data */
    hyena_v2_process_ad(&ks, Y, D, ad, adlen);

    /* Encrypt the plaintext to produce the ciphertext */
    if (mlen > 0) {
        while (mlen > 16) {
            gift128n_encrypt(&ks, Y, Y);
            hyena_double_delta(D);
            memcpy(feedback, m, 16);
            lw_xor_block(feedback + 8, Y + 8, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block_2_src(c, m, Y, 16);
            lw_xor_block(Y, feedback, 16);
            c += 16;
            m += 16;
            mlen -= 16;
        }
        gift128n_encrypt(&ks, Y, Y);
        if (mlen == 16) {
            hyena_triple_delta(D);
            memcpy(feedback, m, 16);
            lw_xor_block(feedback + 8, Y + 8, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block_2_src(c, m, Y, 16);
            lw_xor_block(Y, feedback, 16);
            c += 16;
        } else {
            unsigned temp = (unsigned)mlen;
            hyena_triple_delta(D);
            hyena_triple_delta(D);
            memcpy(feedback, m, temp);
            feedback[temp] = 0x01;
            memset(feedback + temp + 1, 0, 15 - temp);
            if (temp > 8)
                lw_xor_block(feedback + 8, Y + 8, temp - 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block_2_src(c, m, Y, temp);
            lw_xor_block(Y, feedback, 16);
            c += temp;
        }
    }

    /* Swap the two halves of Y and generate the authentication tag */
    for (index = 0; index < 8; ++index) {
        unsigned char temp1 = Y[index];
        unsigned char temp2 = Y[index + 8];
        Y[index] = temp2;
        Y[index + 8] = temp1;
    }
    gift128n_encrypt(&ks, c, Y);
    return 0;
}

int hyena_v2_aead_decrypt
    (unsigned char *m, unsigned long long *mlen,
     unsigned char *nsec,
     const unsigned char *c, unsigned long long clen,
     const unsigned char *ad, unsigned long long adlen,
     const unsigned char *npub,
     const unsigned char *k)
{
    gift128n_key_schedule_t ks;
    unsigned char Y[16];
    unsigned char D[8];
    unsigned char feedback[16];
    unsigned char *mtemp;
    unsigned index;
    (void)nsec;

    /* Validate the ciphertext length and set the return "mlen" value */
    if (clen < HYENA_TAG_SIZE)
        return -1;
    *mlen = clen - HYENA_TAG_SIZE;

    /* Set up the key schedule and use it to encrypt the nonce */
    gift128n_init(&ks, k);
    Y[0] = 0;
    if (adlen == 0)
        Y[0] |= 0x01;
    if (adlen == 0 && clen == HYENA_TAG_SIZE)
        Y[0] |= 0x02;
    Y[1] = 0;
    Y[2] = 0;
    Y[3] = 0;
    memcpy(Y + 4, npub, HYENA_NONCE_SIZE);
    gift128n_encrypt(&ks, Y, Y);
    memcpy(D, Y + 8, 8);

    /* Process the associated data */
    hyena_v2_process_ad(&ks, Y, D, ad, adlen);

    /* Decrypt the ciphertext to produce the plaintext */
    clen -= HYENA_TAG_SIZE;
    mtemp = m;
    if (clen > 0) {
        while (clen > 16) {
            gift128n_encrypt(&ks, Y, Y);
            hyena_double_delta(D);
            memcpy(feedback + 8, c + 8, 8);
            lw_xor_block_2_src(m, c, Y, 16);
            memcpy(feedback, m, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block(Y, feedback, 16);
            c += 16;
            m += 16;
            clen -= 16;
        }
        gift128n_encrypt(&ks, Y, Y);
        if (clen == 16) {
            hyena_triple_delta(D);
            memcpy(feedback + 8, c + 8, 8);
            lw_xor_block_2_src(m, c, Y, 16);
            memcpy(feedback, m, 8);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block(Y, feedback, 16);
            c += 16;
        } else {
            unsigned temp = (unsigned)clen;
            hyena_triple_delta(D);
            hyena_triple_delta(D);
            if (temp > 8) {
                memcpy(feedback + 8, c + 8, temp - 8);
                lw_xor_block_2_src(m, c, Y, temp);
                memcpy(feedback, m, 8);
            } else {
                lw_xor_block_2_src(m, c, Y, temp);
                memcpy(feedback, m, temp);
            }
            feedback[temp] = 0x01;
            memset(feedback + temp + 1, 0, 15 - temp);
            lw_xor_block(feedback + 8, D, 8);
            lw_xor_block(Y, feedback, 16);
            c += temp;
        }
    }

    /* Swap the two halves of Y and check the authentication tag */
    for (index = 0; index < 8; ++index) {
        unsigned char temp1 = Y[index];
        unsigned char temp2 = Y[index + 8];
        Y[index] = temp2;
        Y[index + 8] = temp1;
    }
    gift128n_encrypt(&ks, Y, Y);
    return aead_check_tag(mtemp, *mlen, Y, c, HYENA_TAG_SIZE);
}