Implement AES-GCM-SIV

This implements AES-GCM-SIV, described in RFC8452, on top of the
existing AES-GCM primitives.  In particular, its hash algorithm
POLYVAL is implemented using the GHASH with additional byte order
conversion according to RFC8452 Appendix A.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

1 files changed, 52 insertions, 0 deletions

diff --git a/siv-ghash-set-key.c b/siv-ghash-set-key.c
new file mode 100644
index 00000000..b13d7495
--- /dev/null
+++ b/siv-ghash-set-key.c
@@ -0,0 +1,52 @@
+/* siv-ghash-set-key.c
+
+   POLYVAL implementation for AES-GCM-SIV, based on GHASH
+
+   Copyright (C) 2011 Katholieke Universiteit Leuven
+   Copyright (C) 2011, 2013, 2018, 2022 Niels Möller
+   Copyright (C) 2018, 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "ghash-internal.h"
+#include "block-internal.h"
+
+void
+_siv_ghash_set_key (struct gcm_key *ctx, const union nettle_block16 *key)
+{
+  union nettle_block16 h;
+
+  block16_bswap (&h, key);
+  block16_mulx_ghash (&h, &h);
+
+  _ghash_set_key (ctx, &h);
+}