Updated implementations from Rhys

ascon/Implementations/crypto_aead/ascon128av12/rhys/ascon-aead.h

+/*
+ * Copyright (C) 2021 Southern Storm Software, Pty Ltd.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef LWCRYPTO_ASCON_AEAD_H
+#define LWCRYPTO_ASCON_AEAD_H
+
+#include <stddef.h>
+
+/**
+ * \file ascon-aead.h
+ * \brief ASCON-128 encryption algorithm and related family members.
+ *
+ * The ASCON family consists of several related algorithms:
+ *
+ * \li ASCON-128 with a 128-bit key, a 128-bit nonce, a 128-bit authentication
+ * tag, and a block rate of 64 bits.
+ * \li ASCON-128a with a 128-bit key, a 128-bit nonce, a 128-bit authentication
+ * tag, and a block rate of 128 bits.  This is faster than ASCON-128 but may
+ * not be as secure.
+ * \li ASCON-80pq with a 160-bit key, a 128-bit nonce, a 128-bit authentication
+ * tag, and a block rate of 64 bits.  This is similar to ASCON-128 but has a
+ * 160-bit key instead which may be more resistant against quantum computers.
+ * \li ASCON-HASH and ASCON-HASHA with a 256-bit hash output.
+ * \li ASCON-XOF and ASCON-XOFA with extensible hash output (XOF mode).
+ *
+ * References: https://ascon.iaik.tugraz.at/
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \brief Size of the key for ASCON-128 and ASCON-128a.
+ */
+#define ASCON128_KEY_SIZE 16
+
+/**
+ * \brief Size of the nonce for ASCON-128 and ASCON-128a.
+ */
+#define ASCON128_NONCE_SIZE 16
+
+/**
+ * \brief Size of the authentication tag for ASCON-128 and ASCON-128a.
+ */
+#define ASCON128_TAG_SIZE 16
+
+/**
+ * \brief Size of the key for ASCON-80pq.
+ */
+#define ASCON80PQ_KEY_SIZE 20
+
+/**
+ * \brief Size of the nonce for ASCON-80pq.
+ */
+#define ASCON80PQ_NONCE_SIZE 16
+
+/**
+ * \brief Size of the authentication tag for ASCON-80pq.
+ */
+#define ASCON80PQ_TAG_SIZE 16
+
+/**
+ * \brief Encrypts and authenticates a packet with ASCON-128.
+ *
+ * \param c Buffer to receive the output.
+ * \param clen On exit, set to the length of the output which includes
+ * the ciphertext and the 16 byte authentication tag.
+ * \param m Buffer that contains the plaintext message to encrypt.
+ * \param mlen Length of the plaintext message in bytes.
+ * \param ad Buffer that contains associated data to authenticate
+ * along with the packet but which does not need to be encrypted.
+ * \param adlen Length of the associated data in bytes.
+ * \param npub Points to the public nonce for the packet which must
+ * be 16 bytes in length.
+ * \param k Points to the 16 bytes of the key to use to encrypt the packet.
+ *
+ * \return 0 on success, or a negative value if there was an error in
+ * the parameters.
+ *
+ * \sa ascon128_aead_decrypt()
+ */
+int ascon128_aead_encrypt
+    (unsigned char *c, size_t *clen,
+     const unsigned char *m, size_t mlen,
+     const unsigned char *ad, size_t adlen,
+     const unsigned char *npub,
+     const unsigned char *k);
+
+/**
+ * \brief Decrypts and authenticates a packet with ASCON-128.
+ *
+ * \param m Buffer to receive the plaintext message on output.
+ * \param mlen Receives the length of the plaintext message on output.
+ * \param c Buffer that contains the ciphertext and authentication
+ * tag to decrypt.
+ * \param clen Length of the input data in bytes, which includes the
+ * ciphertext and the 16 byte authentication tag.
+ * \param ad Buffer that contains associated data to authenticate
+ * along with the packet but which does not need to be encrypted.
+ * \param adlen Length of the associated data in bytes.
+ * \param npub Points to the public nonce for the packet which must
+ * be 16 bytes in length.
+ * \param k Points to the 16 bytes of the key to use to decrypt the packet.
+ *
+ * \return 0 on success, -1 if the authentication tag was incorrect,
+ * or some other negative number if there was an error in the parameters.
+ *
+ * \sa ascon128_aead_encrypt()
+ */
+int ascon128_aead_decrypt
+    (unsigned char *m, size_t *mlen,
+     const unsigned char *c, size_t clen,
+     const unsigned char *ad, size_t adlen,
+     const unsigned char *npub,
+     const unsigned char *k);
+
+/**
+ * \brief Encrypts and authenticates a packet with ASCON-128a.
+ *
+ * \param c Buffer to receive the output.
+ * \param clen On exit, set to the length of the output which includes
+ * the ciphertext and the 16 byte authentication tag.
+ * \param m Buffer that contains the plaintext message to encrypt.
+ * \param mlen Length of the plaintext message in bytes.
+ * \param ad Buffer that contains associated data to authenticate
+ * along with the packet but which does not need to be encrypted.
+ * \param adlen Length of the associated data in bytes.
+ * \param npub Points to the public nonce for the packet which must
+ * be 16 bytes in length.
+ * \param k Points to the 16 bytes of the key to use to encrypt the packet.
+ *
+ * \return 0 on success, or a negative value if there was an error in
+ * the parameters.
+ *
+ * \sa ascon128a_aead_decrypt()
+ */
+int ascon128a_aead_encrypt
+    (unsigned char *c, size_t *clen,
+     const unsigned char *m, size_t mlen,
+     const unsigned char *ad, size_t adlen,
+     const unsigned char *npub,
+     const unsigned char *k);
+
+/**
+ * \brief Decrypts and authenticates a packet with ASCON-128a.
+ *
+ * \param m Buffer to receive the plaintext message on output.
+ * \param mlen Receives the length of the plaintext message on output.
+ * \param c Buffer that contains the ciphertext and authentication
+ * tag to decrypt.
+ * \param clen Length of the input data in bytes, which includes the
+ * ciphertext and the 16 byte authentication tag.
+ * \param ad Buffer that contains associated data to authenticate
+ * along with the packet but which does not need to be encrypted.
+ * \param adlen Length of the associated data in bytes.
+ * \param npub Points to the public nonce for the packet which must
+ * be 16 bytes in length.
+ * \param k Points to the 16 bytes of the key to use to decrypt the packet.
+ *
+ * \return 0 on success, -1 if the authentication tag was incorrect,
+ * or some other negative number if there was an error in the parameters.
+ *
+ * \sa ascon128a_aead_encrypt()
+ */
+int ascon128a_aead_decrypt
+    (unsigned char *m, size_t *mlen,
+     const unsigned char *c, size_t clen,
+     const unsigned char *ad, size_t adlen,
+     const unsigned char *npub,
+     const unsigned char *k);
+
+/**
+ * \brief Encrypts and authenticates a packet with ASCON-80pq.
+ *
+ * \param c Buffer to receive the output.
+ * \param clen On exit, set to the length of the output which includes
+ * the ciphertext and the 16 byte authentication tag.
+ * \param m Buffer that contains the plaintext message to encrypt.
+ * \param mlen Length of the plaintext message in bytes.
+ * \param ad Buffer that contains associated data to authenticate
+ * along with the packet but which does not need to be encrypted.
+ * \param adlen Length of the associated data in bytes.
+ * \param npub Points to the public nonce for the packet which must
+ * be 16 bytes in length.
+ * \param k Points to the 20 bytes of the key to use to encrypt the packet.
+ *
+ * \return 0 on success, or a negative value if there was an error in
+ * the parameters.
+ *
+ * \sa ascon80pq_aead_decrypt()
+ */
+int ascon80pq_aead_encrypt
+    (unsigned char *c, size_t *clen,
+     const unsigned char *m, size_t mlen,
+     const unsigned char *ad, size_t adlen,
+     const unsigned char *npub,
+     const unsigned char *k);
+
+/**
+ * \brief Decrypts and authenticates a packet with ASCON-80pq.
+ *
+ * \param m Buffer to receive the plaintext message on output.
+ * \param mlen Receives the length of the plaintext message on output.
+ * \param c Buffer that contains the ciphertext and authentication
+ * tag to decrypt.
+ * \param clen Length of the input data in bytes, which includes the
+ * ciphertext and the 16 byte authentication tag.
+ * \param ad Buffer that contains associated data to authenticate
+ * along with the packet but which does not need to be encrypted.
+ * \param adlen Length of the associated data in bytes.
+ * \param npub Points to the public nonce for the packet which must
+ * be 16 bytes in length.
+ * \param k Points to the 20 bytes of the key to use to decrypt the packet.
+ *
+ * \return 0 on success, -1 if the authentication tag was incorrect,
+ * or some other negative number if there was an error in the parameters.
+ *
+ * \sa ascon80pq_aead_encrypt()
+ */
+int ascon80pq_aead_decrypt
+    (unsigned char *m, size_t *mlen,
+     const unsigned char *c, size_t clen,
+     const unsigned char *ad, size_t adlen,
+     const unsigned char *npub,
+     const unsigned char *k);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

ascon/Implementations/crypto_aead/ascon128av12/rhys/crypto_aead.h

+
+int crypto_aead_encrypt(
+	unsigned char *c, unsigned long long *clen,
+	const unsigned char *m, unsigned long long mlen,
+	const unsigned char *ad, unsigned long long adlen,
+	const unsigned char *nsec,
+	const unsigned char *npub,
+	const unsigned char *k
+);
+
+int crypto_aead_decrypt(
+	unsigned char *m, unsigned long long *mlen,
+	unsigned char *nsec,
+	const unsigned char *c, unsigned long long clen,
+	const unsigned char *ad, unsigned long long adlen,
+	const unsigned char *npub,
+	const unsigned char *k
+);

ascon/Implementations/crypto_aead/ascon128av12/rhys/encrypt.c

 
-#include "ascon128.h"
+#include "ascon-aead.h"
 
 int crypto_aead_encrypt
     (unsigned char *c, unsigned long long *clen,
@@ -9,8 +9,12 @@ int crypto_aead_encrypt
      const unsigned char *npub,
      const unsigned char *k)
 {
-    return ascon128a_aead_encrypt
-        (c, clen, m, mlen, ad, adlen, nsec, npub, k);
+    size_t len = 0;
+    int result = ascon128a_aead_encrypt
+        (c, &len, m, mlen, ad, adlen, npub, k);
+    (void)nsec;
+    *clen = len;
+    return result;
 }
 
 int crypto_aead_decrypt
@@ -21,6 +25,10 @@ int crypto_aead_decrypt
      const unsigned char *npub,
      const unsigned char *k)
 {
-    return ascon128a_aead_decrypt
-        (m, mlen, nsec, c, clen, ad, adlen, npub, k);
+    size_t len = 0;
+    int result = ascon128a_aead_decrypt
+        (m, &len, c, clen, ad, adlen, npub, k);
+    (void)nsec;
+    *mlen = len;
+    return result;
 }

ascon/Implementations/crypto_aead/ascon128av12/rhys/internal-ascon-avr.S

 #if defined(__AVR__)
+/*
+ * Copyright (C) 2021 Southern Storm Software, Pty Ltd.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
 #include <avr/io.h>
 /* Automatically generated - do not edit */
 
@@ -49,287 +71,223 @@ ascon_permute:
 	ldd r23,Z+7
 	ldd r12,Z+15
 	ldd r13,Z+31
-	eor r23,r4
-	eor r4,r13
-	eor r18,r12
-	mov r14,r23
-	mov r15,r12
-	mov r24,r18
-	mov r25,r13
-	mov r16,r4
-	com r14
+	mov r14,r12
+	mov r15,r23
+	mov r24,r13
+	eor r14,r18
+	eor r15,r4
+	eor r24,r4
+	com r4
+	or r4,r13
+	eor r4,r14
+	eor r13,r12
+	or r13,r14
+	eor r13,r15
+	eor r18,r15
+	or r18,r12
+	eor r18,r24
 	com r15
-	com r24
-	com r25
-	com r16
-	and r14,r12
-	and r15,r18
-	and r24,r13
-	and r25,r4
-	and r16,r23
-	eor r23,r15
+	and r12,r15
 	eor r12,r24
-	eor r18,r25
-	eor r13,r16
-	eor r4,r14
-	eor r12,r23
-	eor r23,r4
-	eor r13,r18
-	com r18
-	std Z+7,r23
-	std Z+15,r12
-	std Z+31,r13
-	std Z+39,r4
+	or r23,r24
+	eor r23,r14
+	std Z+31,r23
+	std Z+39,r12
+	std Z+15,r13
+	std Z+23,r4
 	ldd r23,Z+6
 	ldd r12,Z+14
 	ldd r13,Z+30
-	eor r23,r5
-	eor r5,r13
-	eor r19,r12
-	mov r14,r23
-	mov r15,r12
-	mov r24,r19
-	mov r25,r13
-	mov r16,r5
-	com r14
+	mov r14,r12
+	mov r15,r23
+	mov r24,r13
+	eor r14,r19
+	eor r15,r5
+	eor r24,r5
+	com r5
+	or r5,r13
+	eor r5,r14
+	eor r13,r12
+	or r13,r14
+	eor r13,r15
+	eor r19,r15
+	or r19,r12
+	eor r19,r24
 	com r15
-	com r24
-	com r25
-	com r16
-	and r14,r12
-	and r15,r19
-	and r24,r13
-	and r25,r5
-	and r16,r23
-	eor r23,r15
+	and r12,r15
 	eor r12,r24
-	eor r19,r25
-	eor r13,r16
-	eor r5,r14
-	eor r12,r23
-	eor r23,r5
-	eor r13,r19
-	com r19
-	std Z+6,r23
-	std Z+14,r12
-	std Z+30,r13
-	std Z+38,r5
+	or r23,r24
+	eor r23,r14
+	std Z+30,r23
+	std Z+38,r12
+	std Z+14,r13
+	std Z+22,r5
 	ldd r23,Z+5
 	ldd r12,Z+13
 	ldd r13,Z+29
-	eor r23,r6
-	eor r6,r13
-	eor r20,r12
-	mov r14,r23
-	mov r15,r12
-	mov r24,r20
-	mov r25,r13
-	mov r16,r6
-	com r14
+	mov r14,r12
+	mov r15,r23
+	mov r24,r13
+	eor r14,r20
+	eor r15,r6
+	eor r24,r6
+	com r6
+	or r6,r13
+	eor r6,r14
+	eor r13,r12
+	or r13,r14
+	eor r13,r15
+	eor r20,r15
+	or r20,r12
+	eor r20,r24
 	com r15
-	com r24
-	com r25
-	com r16
-	and r14,r12
-	and r15,r20
-	and r24,r13
-	and r25,r6
-	and r16,r23
-	eor r23,r15
+	and r12,r15
 	eor r12,r24
-	eor r20,r25
-	eor r13,r16
-	eor r6,r14
-	eor r12,r23
-	eor r23,r6
-	eor r13,r20
-	com r20
-	std Z+5,r23
-	std Z+13,r12
-	std Z+29,r13
-	std Z+37,r6
+	or r23,r24
+	eor r23,r14
+	std Z+29,r23
+	std Z+37,r12
+	std Z+13,r13
+	std Z+21,r6
 	ldd r23,Z+4
 	ldd r12,Z+12
 	ldd r13,Z+28
-	eor r23,r7
-	eor r7,r13
-	eor r21,r12
-	mov r14,r23
-	mov r15,r12
-	mov r24,r21
-	mov r25,r13
-	mov r16,r7
-	com r14
+	mov r14,r12
+	mov r15,r23
+	mov r24,r13
+	eor r14,r21