Commit d560a00f by Rhys Weatherley Committed by Sebastian Renner

Updated implementations from Rhys

parent ba578844
/*
* Copyright (C) 2021 Southern Storm Software, Pty Ltd.
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
* to deal in the Software without restriction, including without limitation
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
* and/or sell copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included
* in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*/
#ifndef LWCRYPTO_ASCON_AEAD_H
#define LWCRYPTO_ASCON_AEAD_H
#include <stddef.h>
/**
* \file ascon-aead.h
* \brief ASCON-128 encryption algorithm and related family members.
*
* The ASCON family consists of several related algorithms:
*
* \li ASCON-128 with a 128-bit key, a 128-bit nonce, a 128-bit authentication
* tag, and a block rate of 64 bits.
* \li ASCON-128a with a 128-bit key, a 128-bit nonce, a 128-bit authentication
* tag, and a block rate of 128 bits. This is faster than ASCON-128 but may
* not be as secure.
* \li ASCON-80pq with a 160-bit key, a 128-bit nonce, a 128-bit authentication
* tag, and a block rate of 64 bits. This is similar to ASCON-128 but has a
* 160-bit key instead which may be more resistant against quantum computers.
* \li ASCON-HASH and ASCON-HASHA with a 256-bit hash output.
* \li ASCON-XOF and ASCON-XOFA with extensible hash output (XOF mode).
*
* References: https://ascon.iaik.tugraz.at/
*/
#ifdef __cplusplus
extern "C" {
#endif
/**
* \brief Size of the key for ASCON-128 and ASCON-128a.
*/
#define ASCON128_KEY_SIZE 16
/**
* \brief Size of the nonce for ASCON-128 and ASCON-128a.
*/
#define ASCON128_NONCE_SIZE 16
/**
* \brief Size of the authentication tag for ASCON-128 and ASCON-128a.
*/
#define ASCON128_TAG_SIZE 16
/**
* \brief Size of the key for ASCON-80pq.
*/
#define ASCON80PQ_KEY_SIZE 20
/**
* \brief Size of the nonce for ASCON-80pq.
*/
#define ASCON80PQ_NONCE_SIZE 16
/**
* \brief Size of the authentication tag for ASCON-80pq.
*/
#define ASCON80PQ_TAG_SIZE 16
/**
* \brief Encrypts and authenticates a packet with ASCON-128.
*
* \param c Buffer to receive the output.
* \param clen On exit, set to the length of the output which includes
* the ciphertext and the 16 byte authentication tag.
* \param m Buffer that contains the plaintext message to encrypt.
* \param mlen Length of the plaintext message in bytes.
* \param ad Buffer that contains associated data to authenticate
* along with the packet but which does not need to be encrypted.
* \param adlen Length of the associated data in bytes.
* \param npub Points to the public nonce for the packet which must
* be 16 bytes in length.
* \param k Points to the 16 bytes of the key to use to encrypt the packet.
*
* \return 0 on success, or a negative value if there was an error in
* the parameters.
*
* \sa ascon128_aead_decrypt()
*/
int ascon128_aead_encrypt
(unsigned char *c, size_t *clen,
const unsigned char *m, size_t mlen,
const unsigned char *ad, size_t adlen,
const unsigned char *npub,
const unsigned char *k);
/**
* \brief Decrypts and authenticates a packet with ASCON-128.
*
* \param m Buffer to receive the plaintext message on output.
* \param mlen Receives the length of the plaintext message on output.
* \param c Buffer that contains the ciphertext and authentication
* tag to decrypt.
* \param clen Length of the input data in bytes, which includes the
* ciphertext and the 16 byte authentication tag.
* \param ad Buffer that contains associated data to authenticate
* along with the packet but which does not need to be encrypted.
* \param adlen Length of the associated data in bytes.
* \param npub Points to the public nonce for the packet which must
* be 16 bytes in length.
* \param k Points to the 16 bytes of the key to use to decrypt the packet.
*
* \return 0 on success, -1 if the authentication tag was incorrect,
* or some other negative number if there was an error in the parameters.
*
* \sa ascon128_aead_encrypt()
*/
int ascon128_aead_decrypt
(unsigned char *m, size_t *mlen,
const unsigned char *c, size_t clen,
const unsigned char *ad, size_t adlen,
const unsigned char *npub,
const unsigned char *k);
/**
* \brief Encrypts and authenticates a packet with ASCON-128a.
*
* \param c Buffer to receive the output.
* \param clen On exit, set to the length of the output which includes
* the ciphertext and the 16 byte authentication tag.
* \param m Buffer that contains the plaintext message to encrypt.
* \param mlen Length of the plaintext message in bytes.
* \param ad Buffer that contains associated data to authenticate
* along with the packet but which does not need to be encrypted.
* \param adlen Length of the associated data in bytes.
* \param npub Points to the public nonce for the packet which must
* be 16 bytes in length.
* \param k Points to the 16 bytes of the key to use to encrypt the packet.
*
* \return 0 on success, or a negative value if there was an error in
* the parameters.
*
* \sa ascon128a_aead_decrypt()
*/
int ascon128a_aead_encrypt
(unsigned char *c, size_t *clen,
const unsigned char *m, size_t mlen,
const unsigned char *ad, size_t adlen,
const unsigned char *npub,
const unsigned char *k);
/**
* \brief Decrypts and authenticates a packet with ASCON-128a.
*
* \param m Buffer to receive the plaintext message on output.
* \param mlen Receives the length of the plaintext message on output.
* \param c Buffer that contains the ciphertext and authentication
* tag to decrypt.
* \param clen Length of the input data in bytes, which includes the
* ciphertext and the 16 byte authentication tag.
* \param ad Buffer that contains associated data to authenticate
* along with the packet but which does not need to be encrypted.
* \param adlen Length of the associated data in bytes.
* \param npub Points to the public nonce for the packet which must
* be 16 bytes in length.
* \param k Points to the 16 bytes of the key to use to decrypt the packet.
*
* \return 0 on success, -1 if the authentication tag was incorrect,
* or some other negative number if there was an error in the parameters.
*
* \sa ascon128a_aead_encrypt()
*/
int ascon128a_aead_decrypt
(unsigned char *m, size_t *mlen,
const unsigned char *c, size_t clen,
const unsigned char *ad, size_t adlen,
const unsigned char *npub,
const unsigned char *k);
/**
* \brief Encrypts and authenticates a packet with ASCON-80pq.
*
* \param c Buffer to receive the output.
* \param clen On exit, set to the length of the output which includes
* the ciphertext and the 16 byte authentication tag.
* \param m Buffer that contains the plaintext message to encrypt.
* \param mlen Length of the plaintext message in bytes.
* \param ad Buffer that contains associated data to authenticate
* along with the packet but which does not need to be encrypted.
* \param adlen Length of the associated data in bytes.
* \param npub Points to the public nonce for the packet which must
* be 16 bytes in length.
* \param k Points to the 20 bytes of the key to use to encrypt the packet.
*
* \return 0 on success, or a negative value if there was an error in
* the parameters.
*
* \sa ascon80pq_aead_decrypt()
*/
int ascon80pq_aead_encrypt
(unsigned char *c, size_t *clen,
const unsigned char *m, size_t mlen,
const unsigned char *ad, size_t adlen,
const unsigned char *npub,
const unsigned char *k);
/**
* \brief Decrypts and authenticates a packet with ASCON-80pq.
*
* \param m Buffer to receive the plaintext message on output.
* \param mlen Receives the length of the plaintext message on output.
* \param c Buffer that contains the ciphertext and authentication
* tag to decrypt.
* \param clen Length of the input data in bytes, which includes the
* ciphertext and the 16 byte authentication tag.
* \param ad Buffer that contains associated data to authenticate
* along with the packet but which does not need to be encrypted.
* \param adlen Length of the associated data in bytes.
* \param npub Points to the public nonce for the packet which must
* be 16 bytes in length.
* \param k Points to the 20 bytes of the key to use to decrypt the packet.
*
* \return 0 on success, -1 if the authentication tag was incorrect,
* or some other negative number if there was an error in the parameters.
*
* \sa ascon80pq_aead_encrypt()
*/
int ascon80pq_aead_decrypt
(unsigned char *m, size_t *mlen,
const unsigned char *c, size_t clen,
const unsigned char *ad, size_t adlen,
const unsigned char *npub,
const unsigned char *k);
#ifdef __cplusplus
}
#endif
#endif
int crypto_aead_encrypt(
unsigned char *c, unsigned long long *clen,
const unsigned char *m, unsigned long long mlen,
const unsigned char *ad, unsigned long long adlen,
const unsigned char *nsec,
const unsigned char *npub,
const unsigned char *k
);
int crypto_aead_decrypt(
unsigned char *m, unsigned long long *mlen,
unsigned char *nsec,
const unsigned char *c, unsigned long long clen,
const unsigned char *ad, unsigned long long adlen,
const unsigned char *npub,
const unsigned char *k
);
#include "ascon128.h"
#include "ascon-aead.h"
int crypto_aead_encrypt
(unsigned char *c, unsigned long long *clen,
......@@ -9,8 +9,12 @@ int crypto_aead_encrypt
const unsigned char *npub,
const unsigned char *k)
{
return ascon128a_aead_encrypt
(c, clen, m, mlen, ad, adlen, nsec, npub, k);
size_t len = 0;
int result = ascon128a_aead_encrypt
(c, &len, m, mlen, ad, adlen, npub, k);
(void)nsec;
*clen = len;
return result;
}
int crypto_aead_decrypt
......@@ -21,6 +25,10 @@ int crypto_aead_decrypt
const unsigned char *npub,
const unsigned char *k)
{
return ascon128a_aead_decrypt
(m, mlen, nsec, c, clen, ad, adlen, npub, k);
size_t len = 0;
int result = ascon128a_aead_decrypt
(m, &len, c, clen, ad, adlen, npub, k);
(void)nsec;
*mlen = len;
return result;
}
#if defined(__AVR__)
/*
* Copyright (C) 2021 Southern Storm Software, Pty Ltd.
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
* to deal in the Software without restriction, including without limitation
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
* and/or sell copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included
* in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*/
#include <avr/io.h>
/* Automatically generated - do not edit */
......@@ -49,287 +71,223 @@ ascon_permute:
ldd r23,Z+7
ldd r12,Z+15
ldd r13,Z+31
eor r23,r4
eor r4,r13
eor r18,r12
mov r14,r23
mov r15,r12
mov r24,r18
mov r25,r13
mov r16,r4
com r14
mov r14,r12
mov r15,r23
mov r24,r13
eor r14,r18
eor r15,r4
eor r24,r4
com r4
or r4,r13
eor r4,r14
eor r13,r12
or r13,r14
eor r13,r15
eor r18,r15
or r18,r12
eor r18,r24
com r15
com r24
com r25
com r16
and r14,r12
and r15,r18
and r24,r13
and r25,r4
and r16,r23
eor r23,r15
and r12,r15
eor r12,r24
eor r18,r25
eor r13,r16
eor r4,r14
eor r12,r23
eor r23,r4
eor r13,r18
com r18
std Z+7,r23
std Z+15,r12
std Z+31,r13
std Z+39,r4
or r23,r24
eor r23,r14
std Z+31,r23
std Z+39,r12
std Z+15,r13
std Z+23,r4
ldd r23,Z+6
ldd r12,Z+14
ldd r13,Z+30
eor r23,r5
eor r5,r13
eor r19,r12
mov r14,r23
mov r15,r12
mov r24,r19
mov r25,r13
mov r16,r5
com r14
mov r14,r12
mov r15,r23
mov r24,r13
eor r14,r19
eor r15,r5
eor r24,r5
com r5
or r5,r13
eor r5,r14
eor r13,r12
or r13,r14
eor r13,r15
eor r19,r15
or r19,r12
eor r19,r24
com r15
com r24
com r25
com r16
and r14,r12
and r15,r19
and r24,r13
and r25,r5
and r16,r23
eor r23,r15
and r12,r15
eor r12,r24
eor r19,r25
eor r13,r16
eor r5,r14
eor r12,r23
eor r23,r5
eor r13,r19
com r19
std Z+6,r23
std Z+14,r12
std Z+30,r13
std Z+38,r5
or r23,r24
eor r23,r14
std Z+30,r23
std Z+38,r12
std Z+14,r13
std Z+22,r5
ldd r23,Z+5
ldd r12,Z+13
ldd r13,Z+29
eor r23,r6
eor r6,r13
eor r20,r12
mov r14,r23
mov r15,r12
mov r24,r20
mov r25,r13
mov r16,r6
com r14
mov r14,r12
mov r15,r23
mov r24,r13
eor r14,r20
eor r15,r6
eor r24,r6
com r6
or r6,r13
eor r6,r14
eor r13,r12
or r13,r14
eor r13,r15
eor r20,r15
or r20,r12
eor r20,r24
com r15
com r24
com r25
com r16
and r14,r12
and r15,r20
and r24,r13
and r25,r6
and r16,r23
eor r23,r15
and r12,r15
eor r12,r24
eor r20,r25
eor r13,r16
eor r6,r14
eor r12,r23
eor r23,r6
eor r13,r20
com r20
std Z+5,r23
std Z+13,r12
std Z+29,r13
std Z+37,r6
or r23,r24
eor r23,r14
std Z+29,r23
std Z+37,r12
std Z+13,r13
std Z+21,r6
ldd r23,Z+4
ldd r12,Z+12
ldd r13,Z+28
eor r23,r7
eor r7,r13
eor r21,r12
mov r14,r23
mov r15,r12
mov r24,r21
mov r25,r13
mov r16,r7
com r14
mov r14,r12
mov r15,r23
mov r24,r13
eor r14,r21