openssl/crypto/modes
Todd Short 0113ec8460 Implement AES-GCM-SIV (RFC8452)
Fixes #16721

This uses AES-ECB to create a counter mode AES-CTR32 (32bit counter, I could
not get AES-CTR to work as-is), and GHASH to implement POLYVAL. Optimally,
there would be separate polyval assembly implementation(s), but the only one
I could find (and it was SSE2 x86_64 code) was not Apache 2.0 licensed.

This implementation lives only in the default provider; there is no legacy
implementation.

The code offered in #16721 is not used; that implementation sits on top of
OpenSSL, this one is embedded inside OpenSSL.

Full test vectors from RFC8452 are included, except the 0 length plaintext;
that is not supported; and I'm not sure it's worthwhile to do so.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18693)
2022-07-29 08:32:16 -04:00
..
asm Add clmul-based gmult for riscv64 with Zbb, Zbc 2022-05-19 16:32:49 +10:00
build.info Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
cbc128.c Update copyright year 2021-04-08 13:04:41 +01:00
ccm128.c
cfb128.c Update copyright year 2021-04-08 13:04:41 +01:00
ctr128.c Update copyright year 2021-04-08 13:04:41 +01:00
cts128.c
gcm128.c Implement AES-GCM-SIV (RFC8452) 2022-07-29 08:32:16 -04:00
ocb128.c
ofb128.c Update copyright year 2021-04-08 13:04:41 +01:00
siv128.c Rename all getters to use get/get0 in name 2021-06-01 12:40:00 +02:00
wrap128.c
xts128.c