Add support for GCM mode (AES only).

The main change done by this commit is adding support
for MODE_GCM (NIST SP 800 38D). Test vectors are included.

The mode uses a C extension (Crypto.Util.galois._ghash)
to compute the GHASH step. The C implementation is the most
basic one and it is still significantly (5x times) slower than CTR.
Optimizations can be introduced using tables (CPU/memory trade-off)
or even AES NI instructions on newer x86 CPUs.

This patch also simplifies Crypto.Cipher.blockalgo.py by:
 * removing duplicated code previously shared by digest() and verify().
 * removing duplicated code previously shared by Crypto.Hash.CMAC
   and Crypto.Cipher.block_algo (management of internal buffers
   for MACs that can only operate on block aligned data, like
   CMAC, CBCMAC, and now also GHASH).

[dlitz@dlitz.net: Included changes from the following commits from the author's pull request:]
- [9c13f9c] Rename 'IV' parameter to 'nonce' for AEAD modes.
- [ca460a7] Made blockalgo.py more PEP-8 compliant;
            The second parameter of the _GHASH constructor
            is now the length of the block (block_size)
            and not the full module.
[dlitz@dlitz.net: Replaced MacMismatchError with ValueError]
[dlitz@dlitz.net: Replaced ApiUsageError with TypeError]
[dlitz@dlitz.net: Replaced renamed variable `ht` with original `h`]
[dlitz@dlitz.net: Whitespace fixed with "git rebase --whitespace=fix"]

2 files changed, 199 insertions, 2 deletions

diff --git a/lib/Crypto/SelfTest/Cipher/common.py b/lib/Crypto/SelfTest/Cipher/common.py
index ed612b4..727086d 100644
--- a/lib/Crypto/SelfTest/Cipher/common.py
+++ b/lib/Crypto/SelfTest/Cipher/common.py
@@ -688,7 +688,7 @@ def make_block_tests(module, module_name, test_data, additional_params=dict()):
             extra_tests_added = 1
 
         # Extract associated data and MAC for AEAD modes
-        if p_mode in ('CCM', 'EAX', 'SIV'):
+        if p_mode in ('CCM', 'EAX', 'SIV', 'GCM'):
             assoc_data, params['plaintext'] = params['plaintext'].split('|')
             assoc_data2, params['ciphertext'], params['mac'] = params['ciphertext'].split('|')
             params['assoc_data'] = assoc_data.split("-")
@@ -717,7 +717,7 @@ def make_block_tests(module, module_name, test_data, additional_params=dict()):
             CCMMACLengthTest(module),
             CCMSplitEncryptionTest(module),
         ]
-    for aead_mode in ("MODE_CCM","MODE_EAX", "MODE_SIV"):
+    for aead_mode in ("MODE_CCM","MODE_EAX", "MODE_SIV", "MODE_GCM"):
         if hasattr(module, aead_mode):
             key_sizes = []
             try:
diff --git a/lib/Crypto/SelfTest/Cipher/test_AES.py b/lib/Crypto/SelfTest/Cipher/test_AES.py
index 89243c0..f54f473 100644
--- a/lib/Crypto/SelfTest/Cipher/test_AES.py
+++ b/lib/Crypto/SelfTest/Cipher/test_AES.py
@@ -1795,6 +1795,203 @@ test_data = [
       'RFC5297 A.2',
       dict(mode='SIV', nonce='09f911029d74e35bd84156c5635688c0')
     ),
+
+    # Test vectors for GCM taken from
+    # http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf
+    # This is a list of tuples with 5 items:
+    #
+    #  1. Header + '|' + plaintext
+    #  2. Header + '|' + ciphertext + '|' + MAC
+    #  3. AES-128 key
+    #  4. Description
+    #  5. Dictionary of parameters to be passed to AES.new().
+    #     It must include the nonce.
+    #
+    ( '|',
+      '||58e2fccefa7e3061367f1d57a4e7455a',
+      '00000000000000000000000000000000',
+      'GCM Test Case 1',
+      dict(mode='GCM', nonce='000000000000000000000000')
+    ),
+
+    ( '|00000000000000000000000000000000',
+      '|0388dace60b6a392f328c2b971b2fe78|ab6e47d42cec13bdf53a67b21257bddf',
+      '00000000000000000000000000000000',
+      'GCM Test Case 2',
+      dict(mode='GCM', nonce='000000000000000000000000')
+    ),
+
+    ( '|d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+       '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b391aafd255',
+      '|42831ec2217774244b7221b784d0d49ce3aa212f2c02a4e035c17e2329aca12e'  +
+       '21d514b25466931c7d8f6a5aac84aa051ba30b396a0aac973d58e091473f5985|' +
+       '4d5c2af327cd64a62cf35abd2ba6fab4',
+      'feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 3',
+      dict(mode='GCM', nonce='cafebabefacedbaddecaf888')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      '42831ec2217774244b7221b784d0d49ce3aa212f2c02a4e035c17e2329aca12e'  +
+      '21d514b25466931c7d8f6a5aac84aa051ba30b396a0aac973d58e091|' +
+      '5bc94fbc3221a5db94fae95ae7121a47',
+      'feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 4',
+      dict(mode='GCM', nonce='cafebabefacedbaddecaf888')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      '61353b4c2806934a777ff51fa22a4755699b2a714fcdc6f83766e5f97b6c7423' +
+      '73806900e49f24b22b097544d4896b424989b5e1ebac0f07c23f4598|' +
+      '3612d2e79e3b0785561be14aaca2fccb',
+      'feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 5',
+      dict(mode='GCM', nonce='cafebabefacedbad')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      '8ce24998625615b603a033aca13fb894be9112a5c3a211a8ba262a3cca7e2ca7' +
+      '01e4a9a4fba43c90ccdcb281d48c7c6fd62875d2aca417034c34aee5|' +
+      '619cc5aefffe0bfa462af43c1699d050',
+      'feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 6',
+      dict(mode='GCM', nonce='9313225df88406e555909c5aff5269aa'+
+          '6a7a9538534f7da1e4c303d2a318a728c3c0c95156809539fcf0e2429a6b5254'+
+          '16aedbf5a0de6a57a637b39b' )
+    ),
+
+    ( '|',
+      '||cd33b28ac773f74ba00ed1f312572435',
+      '000000000000000000000000000000000000000000000000',
+      'GCM Test Case 7',
+      dict(mode='GCM', nonce='000000000000000000000000')
+    ),
+
+    ( '|00000000000000000000000000000000',
+      '|98e7247c07f0fe411c267e4384b0f600|2ff58d80033927ab8ef4d4587514f0fb',
+      '000000000000000000000000000000000000000000000000',
+      'GCM Test Case 8',
+      dict(mode='GCM', nonce='000000000000000000000000')
+    ),
+
+    ( '|d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+       '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b391aafd255',
+      '|3980ca0b3c00e841eb06fac4872a2757859e1ceaa6efd984628593b40ca1e19c'  +
+       '7d773d00c144c525ac619d18c84a3f4718e2448b2fe324d9ccda2710acade256|' +
+       '9924a7c8587336bfb118024db8674a14',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c',
+      'GCM Test Case 9',
+      dict(mode='GCM', nonce='cafebabefacedbaddecaf888')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      '3980ca0b3c00e841eb06fac4872a2757859e1ceaa6efd984628593b40ca1e19c'  +
+      '7d773d00c144c525ac619d18c84a3f4718e2448b2fe324d9ccda2710|' +
+      '2519498e80f1478f37ba55bd6d27618c',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c',
+      'GCM Test Case 10',
+      dict(mode='GCM', nonce='cafebabefacedbaddecaf888')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      '0f10f599ae14a154ed24b36e25324db8c566632ef2bbb34f8347280fc4507057' +
+      'fddc29df9a471f75c66541d4d4dad1c9e93a19a58e8b473fa0f062f7|' +
+      '65dcc57fcf623a24094fcca40d3533f8',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c',
+      'GCM Test Case 11',
+      dict(mode='GCM', nonce='cafebabefacedbad')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd27e88681ce3243c4830165a8fdcf9ff1de9a1d8e6b447ef6ef7b79828666e45' +
+      '81e79012af34ddd9e2f037589b292db3e67c036745fa22e7e9b7373b|' +
+      'dcf566ff291c25bbb8568fc3d376a6d9',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c',
+      'GCM Test Case 12',
+      dict(mode='GCM', nonce='9313225df88406e555909c5aff5269aa'+
+          '6a7a9538534f7da1e4c303d2a318a728c3c0c95156809539fcf0e2429a6b5254'+
+          '16aedbf5a0de6a57a637b39b' )
+    ),
+
+    ( '|',
+      '||530f8afbc74536b9a963b4f1c4cb738b',
+      '0000000000000000000000000000000000000000000000000000000000000000',
+      'GCM Test Case 13',
+      dict(mode='GCM', nonce='000000000000000000000000')
+    ),
+
+    ( '|00000000000000000000000000000000',
+      '|cea7403d4d606b6e074ec5d3baf39d18|d0d1c8a799996bf0265b98b5d48ab919',
+      '0000000000000000000000000000000000000000000000000000000000000000',
+      'GCM Test Case 14',
+      dict(mode='GCM', nonce='000000000000000000000000')
+    ),
+
+    ( '|d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+       '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b391aafd255',
+      '|522dc1f099567d07f47f37a32a84427d643a8cdcbfe5c0c97598a2bd2555d1aa'  +
+       '8cb08e48590dbb3da7b08b1056828838c5f61e6393ba7a0abcc9f662898015ad|' +
+       'b094dac5d93471bdec1a502270e3cc6c',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 15',
+      dict(mode='GCM', nonce='cafebabefacedbaddecaf888')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      '522dc1f099567d07f47f37a32a84427d643a8cdcbfe5c0c97598a2bd2555d1aa'  +
+      '8cb08e48590dbb3da7b08b1056828838c5f61e6393ba7a0abcc9f662|' +
+      '76fc6ece0f4e1768cddf8853bb2d551b',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 16',
+      dict(mode='GCM', nonce='cafebabefacedbaddecaf888')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'c3762df1ca787d32ae47c13bf19844cbaf1ae14d0b976afac52ff7d79bba9de0' +
+      'feb582d33934a4f0954cc2363bc73f7862ac430e64abe499f47c9b1f|' +
+      '3a337dbf46a792c45e454913fe2ea8f2',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 17',
+      dict(mode='GCM', nonce='cafebabefacedbad')
+    ),
+
+    ( 'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      'd9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a72' +
+      '1c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39',
+      'feedfacedeadbeeffeedfacedeadbeefabaddad2|' +
+      '5a8def2f0c9e53f1f75d7853659e2a20eeb2b22aafde6419a058ab4f6f746bf4' +
+      '0fc0c3b780f244452da3ebf1c5d82cdea2418997200ef82e44ae7e3f|' +
+      'a44a8266ee1c8eb0c8b5d4cf5ae9f19a',
+      'feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308',
+      'GCM Test Case 18',
+      dict(mode='GCM', nonce='9313225df88406e555909c5aff5269aa'+
+          '6a7a9538534f7da1e4c303d2a318a728c3c0c95156809539fcf0e2429a6b5254'+
+          '16aedbf5a0de6a57a637b39b' )
+    ),
 ]
 
 def get_tests(config={}):