lkml.org 
[lkml]   [2015]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v2 6/7] crypto: omap-aes: Add support for GCM mode
    On Wednesday 08 July 2015 01:18 PM, Herbert Xu wrote:
    > On Wed, Jul 08, 2015 at 12:29:47PM +0530, Lokesh Vutla wrote:
    >>
    >>>> + if (req->assoclen + req->cryptlen == 0) {
    >>>> + scatterwalk_map_and_copy(ctx->auth_tag, req->dst, 0, authlen,
    >>>> + 1);
    >>>> + return 0;
    >>>> + }
    >>>
    >>> How can this be right? Did you enable the selftest?
    >> Why not? Self tests are passed for this case.
    >>
    >> As per the equation given in GCM spec[1], we can see that
    >> if assoclen and cryptlen is 0, then output of GCM is just E(K, Y0)
    >> where Y0 = IV||(0^31)1
    >> I have E(K, Y0) calculated in previous step. And copying it
    >> to destination if assoclen and cryptlen is 0.
    >>
    >> Correct me if I am wrong.
    >
    > It should be E(K, Y0) ^ GHASH(0). So unless GHASH(0) == 0, your
    > code doesn't work.
    Yes, thats right. I have considered that.
    So, we need GHASH(H, {}, {}).
    As per the spec,
    GHASH(H, A, C) = X(m + n + 1).
    m = n = 0 in our case.

    X0 = 0
    X1 = (X(m + n) ^ (len(A) || len(C)) . H
    X1 = 0 . H (GF(128) Multiplication)
    X1 = 0

    The same thing is given in the Test case 1 of the spec. GHASH(H, {}, {}) = 0

    Thanks and regards,
    Lokesh

    >
    > Cheers,
    >



    \
     
     \ /
      Last update: 2015-07-08 10:41    [W:3.377 / U:0.260 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site