1 files changed, 13 insertions, 79 deletions

diff --git a/src/lib/libcrypto/modes/gcm128.c b/src/lib/libcrypto/modes/gcm128.c
index 6c89bd44b7..21ba9eef57 100644
--- a/src/lib/libcrypto/modes/gcm128.c
+++ b/src/lib/libcrypto/modes/gcm128.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gcm128.c,v 1.27 2024/09/06 09:57:32 tb Exp $ */
+/* $OpenBSD: gcm128.c,v 1.35 2025/04/25 12:08:53 jsing Exp $ */
 /* ====================================================================
  * Copyright (c) 2010 The OpenSSL Project.  All rights reserved.
  *
@@ -48,8 +48,6 @@
  * ====================================================================
  */
 
-#define OPENSSL_FIPSAPI
-
 #include <string.h>
 
 #include <openssl/crypto.h>
@@ -57,18 +55,6 @@
 #include "crypto_internal.h"
 #include "modes_local.h"
 
-#ifndef MODES_DEBUG
-# ifndef NDEBUG
-#  define NDEBUG
-# endif
-#endif
-
-#if defined(BSWAP4) && defined(__STRICT_ALIGNMENT)
-/* redefine, because alignment is ensured */
-#undef  GETU32
-#define GETU32(p)       BSWAP4(*(const u32 *)(p))
-#endif
-
 #define PACK(s)         ((size_t)(s)<<(sizeof(size_t)*8-16))
 #define REDUCE1BIT(V)                                                   \
         do {                                                            \
@@ -246,16 +232,13 @@ static void
 gcm_init_4bit(u128 Htable[16], u64 H[2])
 {
         u128 V;
-#if defined(OPENSSL_SMALL_FOOTPRINT)
         int  i;
-#endif
 
         Htable[0].hi = 0;
         Htable[0].lo = 0;
         V.hi = H[0];
         V.lo = H[1];
 
-#if defined(OPENSSL_SMALL_FOOTPRINT)
         for (Htable[8] = V, i = 4; i > 0; i >>= 1) {
                 REDUCE1BIT(V);
                 Htable[i] = V;
@@ -269,34 +252,7 @@ gcm_init_4bit(u128 Htable[16], u64 H[2])
                         Hi[j].lo = V.lo ^ Htable[j].lo;
                 }
         }
-#else
-        Htable[8] = V;
-        REDUCE1BIT(V);
-        Htable[4] = V;
-        REDUCE1BIT(V);
-        Htable[2] = V;
-        REDUCE1BIT(V);
-        Htable[1] = V;
-        Htable[3].hi = V.hi ^ Htable[2].hi, Htable[3].lo = V.lo ^ Htable[2].lo;
-        V = Htable[4];
-        Htable[5].hi = V.hi ^ Htable[1].hi, Htable[5].lo = V.lo ^ Htable[1].lo;
-        Htable[6].hi = V.hi ^ Htable[2].hi, Htable[6].lo = V.lo ^ Htable[2].lo;
-        Htable[7].hi = V.hi ^ Htable[3].hi, Htable[7].lo = V.lo ^ Htable[3].lo;
-        V = Htable[8];
-        Htable[9].hi = V.hi ^ Htable[1].hi, Htable[9].lo = V.lo ^ Htable[1].lo;
-        Htable[10].hi = V.hi ^ Htable[2].hi,
-            Htable[10].lo = V.lo ^ Htable[2].lo;
-        Htable[11].hi = V.hi ^ Htable[3].hi,
-            Htable[11].lo = V.lo ^ Htable[3].lo;
-        Htable[12].hi = V.hi ^ Htable[4].hi,
-            Htable[12].lo = V.lo ^ Htable[4].lo;
-        Htable[13].hi = V.hi ^ Htable[5].hi,
-            Htable[13].lo = V.lo ^ Htable[5].lo;
-        Htable[14].hi = V.hi ^ Htable[6].hi,
-            Htable[14].lo = V.lo ^ Htable[6].lo;
-        Htable[15].hi = V.hi ^ Htable[7].hi,
-            Htable[15].lo = V.lo ^ Htable[7].lo;
-#endif
+
 #if defined(GHASH_ASM) && (defined(__arm__) || defined(__arm))
         /*
          * ARM assembler expects specific dword order in Htable.
@@ -376,7 +332,6 @@ gcm_gmult_4bit(u64 Xi[2], const u128 Htable[16])
         Xi[1] = htobe64(Z.lo);
 }
 
-#if !defined(OPENSSL_SMALL_FOOTPRINT)
 /*
  * Streamed gcm_mult_4bit, see CRYPTO_gcm128_[en|de]crypt for
  * details... Compiler-generated code doesn't seem to give any
@@ -532,7 +487,6 @@ gcm_ghash_4bit(u64 Xi[2], const u128 Htable[16],
                 Xi[1] = htobe64(Z.lo);
         } while (inp += 16, len -= 16);
 }
-#endif
 #else
 void gcm_gmult_4bit(u64 Xi[2], const u128 Htable[16]);
 void gcm_ghash_4bit(u64 Xi[2], const u128 Htable[16], const u8 *inp,
@@ -540,48 +494,32 @@ void gcm_ghash_4bit(u64 Xi[2], const u128 Htable[16], const u8 *inp,
 #endif
 
 #define GCM_MUL(ctx,Xi)   gcm_gmult_4bit(ctx->Xi.u,ctx->Htable)
-#if defined(GHASH_ASM) || !defined(OPENSSL_SMALL_FOOTPRINT)
 #define GHASH(ctx,in,len) gcm_ghash_4bit((ctx)->Xi.u,(ctx)->Htable,in,len)
 /* GHASH_CHUNK is "stride parameter" missioned to mitigate cache
  * trashing effect. In other words idea is to hash data while it's
  * still in L1 cache after encryption pass... */
 #define GHASH_CHUNK       (3*1024)
-#endif
 
 #else   /* TABLE_BITS */
 
 static void
 gcm_gmult_1bit(u64 Xi[2], const u64 H[2])
 {
-        u128 V, Z = { 0,0 };
-        long X;
+        u128 V, Z = { 0, 0 };
+        u64 X;
         int i, j;
-        const long *xi = (const long *)Xi;
 
         V.hi = H[0];    /* H is in host byte order, no byte swapping */
         V.lo = H[1];
 
-        for (j = 0; j < 16/sizeof(long); ++j) {
-#if BYTE_ORDER == LITTLE_ENDIAN
-#if SIZE_MAX == 0xffffffffffffffff
-#ifdef BSWAP8
-                X = (long)(BSWAP8(xi[j]));
-#else
-                const u8 *p = (const u8 *)(xi + j);
-                X = (long)((u64)GETU32(p) << 32|GETU32(p + 4));
-#endif
-#else
-                const u8 *p = (const u8 *)(xi + j);
-                X = (long)GETU32(p);
-#endif
-#else /* BIG_ENDIAN */
-                X = xi[j];
-#endif
+        for (j = 0; j < 2; j++) {
+                X = be64toh(Xi[j]);
 
-                for (i = 0; i < 8*sizeof(long); ++i, X <<= 1) {
-                        u64 M = (u64)(X >> (8*sizeof(long) - 1));
+                for (i = 0; i < 64; i++) {
+                        u64 M = 0 - (X >> 63);
                         Z.hi ^= V.hi & M;
                         Z.lo ^= V.lo & M;
+                        X <<= 1;
 
                         REDUCE1BIT(V);
                 }
@@ -850,7 +788,6 @@ CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
         ctr = be32toh(ctx->Yi.d[3]);
 
         n = ctx->mres;
-#if !defined(OPENSSL_SMALL_FOOTPRINT)
         if (16 % sizeof(size_t) == 0)
                 do {    /* always true actually */
                         if (n) {
@@ -946,7 +883,6 @@ CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                         ctx->mres = n;
                         return 0;
                 } while (0);
-#endif
         for (i = 0; i < len; ++i) {
                 if (n == 0) {
                         (*block)(ctx->Yi.c, ctx->EKi.c, key);
@@ -996,7 +932,6 @@ CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
         ctr = be32toh(ctx->Yi.d[3]);
 
         n = ctx->mres;
-#if !defined(OPENSSL_SMALL_FOOTPRINT)
         if (16 % sizeof(size_t) == 0)
                 do {    /* always true actually */
                         if (n) {
@@ -1068,8 +1003,8 @@ CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                                 ctx->Yi.d[3] = htobe32(ctr);
 
                                 for (i = 0; i < 16/sizeof(size_t); ++i) {
-                                        size_t c = in[i];
-                                        out[i] = c ^ ctx->EKi.t[i];
+                                        size_t c = in_t[i];
+                                        out_t[i] = c ^ ctx->EKi.t[i];
                                         ctx->Xi.t[i] ^= c;
                                 }
                                 GCM_MUL(ctx, Xi);
@@ -1094,7 +1029,6 @@ CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                         ctx->mres = n;
                         return 0;
                 } while (0);
-#endif
         for (i = 0; i < len; ++i) {
                 u8 c;
                 if (n == 0) {
@@ -1159,7 +1093,7 @@ CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
                         return 0;
                 }
         }
-#if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)
+#if defined(GHASH) && defined(GHASH_CHUNK)
         while (len >= GHASH_CHUNK) {
                 (*stream)(in, out, GHASH_CHUNK/16, key, ctx->Yi.c);
                 ctr += GHASH_CHUNK/16;
@@ -1251,7 +1185,7 @@ CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
                         return 0;
                 }
         }
-#if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)
+#if defined(GHASH) && defined(GHASH_CHUNK)
         while (len >= GHASH_CHUNK) {
                 GHASH(ctx, in, GHASH_CHUNK);
                 (*stream)(in, out, GHASH_CHUNK/16, key, ctx->Yi.c);