AES-256-GCM in software - the backend for a target with no accelerated AEAD. More...

#include "board_drivers/board_profiles/pc_platform.h"
#include "crypto/aead/aesgcm.h"
#include "crypto/cipher/aes_block.h"
#include "crypto/crypto_opt.h"
#include "crypto/crypto_scratch.h"
#include "crypto/mac/ghash.h"
#include "server/mmgr/secure.h"
#include <string.h>

Classes
struct	GcmWork

Functions
pc_aesgcm_key *	pc_aesgcm_key_init (void *storage, const uint8_t key[PC_AESGCM_KEY_LEN])
	Bind `storage` as a context keyed with `key`.

void	pc_aesgcm_key_wipe (pc_aesgcm_key *k)
	Wipe the expanded schedule. Call on rekey and on close; the storage stays the caller's.

pc_cspan	pc_aesgcm_seal (pc_aesgcm_key k, const uint8_t nonce[PC_AESGCM_IV_LEN], const uint8_t aad, size_t aad_len, const uint8_t pt, size_t pt_len, uint8_t ct_out, uint8_t tag_out[PC_AESGCM_TAG_LEN])
	Seal one record under `k` and `nonce`.

bool	pc_aesgcm_open (pc_aesgcm_key k, const uint8_t nonce[PC_AESGCM_IV_LEN], const uint8_t aad, size_t aad_len, const uint8_t ct, size_t ct_len, const uint8_t tag[PC_AESGCM_TAG_LEN], uint8_t out)
	Open one record: verify `tag` over `aad` \|\| `ct` in constant time, then (only on success) decrypt `ct` into `out` (may alias `ct`).

Detailed Description

AES-256-GCM in software - the backend for a target with no accelerated AEAD.

Software AES-256 plus a 4-bit-table GHASH. Selected explicitly by a vendor profile that sets PC_HAS_HW_AESGCM 0; never a fallback. Software crypto is a legitimate choice and on some parts the only one, but arriving here by default is not - there is no weak symbol anywhere in the chain, so linking no backend is an undefined reference and linking two is a duplicate definition.

Expect roughly an order of magnitude less throughput than a vendor AEAD (measured on an ESP32-S3: 616k cycles/KiB for the software GHASH path against 81k for the vendor's). A part that HAS an accelerated GCM should never be pointed here.

Definition in file portable_aesgcm.cpp.

Function Documentation

◆ pc_aesgcm_key_init()

pc_aesgcm_key * pc_aesgcm_key_init	(	void *	storage,
		const uint8_t	key[PC_AESGCM_KEY_LEN]
	)

Bind storage as a context keyed with key.

Parameters

storage exactly PC_WORK_AESGCM bytes of the caller's secure storage, 8-aligned. Declare it as that macro and it cannot be wrong - the backend static_asserts its context fits, so the size is settled at compile time and there is nothing to check here. Must outlive every seal/open against it, and must be wiped on rekey and on close.

Returns: the context, or nullptr if the vendor rejected the key.

Definition at line 177 of file portable_aesgcm.cpp.

Referenced by ssh_dh_derive_keys_sid().

◆ pc_aesgcm_key_wipe()

void pc_aesgcm_key_wipe ( pc_aesgcm_key * k )

Wipe the expanded schedule. Call on rekey and on close; the storage stays the caller's.

Definition at line 185 of file portable_aesgcm.cpp.

Referenced by ssh_dh_derive_keys_sid().

◆ pc_aesgcm_seal()

pc_cspan pc_aesgcm_seal	(	pc_aesgcm_key *	k,
		const uint8_t	nonce[PC_AESGCM_IV_LEN],
		const uint8_t *	aad,
		size_t	aad_len,
		const uint8_t *	pt,
		size_t	pt_len,
		uint8_t *	ct_out,
		uint8_t	tag_out[PC_AESGCM_TAG_LEN]
	)

Seal one record under k and nonce.

ct_out receives pt_len ciphertext bytes (may alias pt) and tag_out the 16-byte tag. No state is kept or advanced - the caller owns the nonce.

Definition at line 192 of file portable_aesgcm.cpp.

References GcmWork::ctr, GcmWork::j0, and pc_cspan_from().

Referenced by ssh_pkt_send().

◆ pc_aesgcm_open()

bool pc_aesgcm_open	(	pc_aesgcm_key *	k,
		const uint8_t	nonce[PC_AESGCM_IV_LEN],
		const uint8_t *	aad,
		size_t	aad_len,
		const uint8_t *	ct,
		size_t	ct_len,
		const uint8_t	tag[PC_AESGCM_TAG_LEN],
		uint8_t *	out
	)

Open one record: verify tag over aad || ct in constant time, then (only on success) decrypt ct into out (may alias ct).

Returns: true iff the tag is valid.

Definition at line 205 of file portable_aesgcm.cpp.

References GcmWork::ctr, GcmWork::ej0, GcmWork::j0, and PC_AESGCM_TAG_LEN.