mirror of
https://gogs.blitter.com/RLabs/xs
synced 2024-08-14 10:26:42 +00:00
334 lines
6.7 KiB
Go
334 lines
6.7 KiB
Go
|
/*
|
|||
|
|
Copyright Hyperledger-TWGC All Rights Reserved.
|
|||
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|||
|
|
you may not use this file except in compliance with the License.
|
|||
|
|
You may obtain a copy of the License at
|
|||
|
|
|
|||
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|||
|
|
|
|||
|
|
Unless required by applicable law or agreed to in writing, software
|
|||
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|||
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|||
|
|
See the License for the specific language governing permissions and
|
|||
|
|
limitations under the License.
|
|||
|
|
|
|||
|
|
writed by Zhiwei Yan, 2020 Oct
|
|||
|
|
*/
|
|||
|
|
package sm4
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"errors"
|
|||
|
|
"strconv"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
//Paper: The Galois/Counter Mode of Operation (GCM) David A. Mcgrew，John Viega .2004.
|
|||
|
|
func Sm4GCM(key []byte, IV ,in, A []byte, mode bool) ([]byte, []byte, error) {
|
|||
|
|
if len(key) != BlockSize {
|
|||
|
|
return nil,nil, errors.New("SM4: invalid key size " + strconv.Itoa(len(key)))
|
|||
|
|
}
|
|||
|
|
if mode {
|
|||
|
|
C,T:=GCMEncrypt(key,IV,in,A)
|
|||
|
|
return C,T,nil
|
|||
|
|
}else{
|
|||
|
|
P,_T:=GCMDecrypt(key,IV,in,A)
|
|||
|
|
return P,_T,nil
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func GetH(key []byte) (H []byte){
|
|||
|
|
c,err := NewCipher(key)
|
|||
|
|
if err != nil {
|
|||
|
|
panic(err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
zores:=make([]byte, BlockSize)
|
|||
|
|
H =make([]byte, BlockSize)
|
|||
|
|
c.Encrypt(H,zores)
|
|||
|
|
return H
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//ut = a + b
|
|||
|
|
func addition(a ,b []byte) (out []byte){
|
|||
|
|
Len:=len(a)
|
|||
|
|
if Len != len(b) {
|
|||
|
|
return nil
|
|||
|
|
}
|
|||
|
|
out = make([]byte, Len)
|
|||
|
|
for i := 0; i < Len; i++ {
|
|||
|
|
out[i] = a[i] ^ b[i]
|
|||
|
|
}
|
|||
|
|
return out
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func Rightshift(V []byte){
|
|||
|
|
n:=len(V)
|
|||
|
|
for i:=n-1;i>=0;i-- {
|
|||
|
|
V[i]=V[i]>>1
|
|||
|
|
if i!=0{
|
|||
|
|
V[i]=((V[i-1]&0x01)<<7)|V[i]
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func findYi( Y []byte,index int) int{
|
|||
|
|
var temp byte
|
|||
|
|
i := uint(index)
|
|||
|
|
temp=Y[i/8]
|
|||
|
|
temp=temp>>(7-i%8)
|
|||
|
|
if temp & 0x01 == 1{
|
|||
|
|
return 1
|
|||
|
|
}else{
|
|||
|
|
return 0
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
func multiplication(X,Y []byte) (Z []byte){
|
|||
|
|
|
|||
|
|
R:=make([]byte,BlockSize)
|
|||
|
|
R[0]=0xe1
|
|||
|
|
Z=make([]byte,BlockSize)
|
|||
|
|
V:=make([]byte,BlockSize)
|
|||
|
|
copy(V,X)
|
|||
|
|
for i:=0;i<=127;i++{
|
|||
|
|
if findYi(Y,i)==1{
|
|||
|
|
Z=addition(Z,V)
|
|||
|
|
}
|
|||
|
|
if V[BlockSize-1]&0x01==0{
|
|||
|
|
Rightshift(V)
|
|||
|
|
}else{
|
|||
|
|
Rightshift(V)
|
|||
|
|
V=addition(V,R)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
return Z
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func GHASH(H []byte,A []byte,C []byte) (X[]byte){
|
|||
|
|
|
|||
|
|
calculm_v:=func(m ,v int) (int,int) {
|
|||
|
|
if(m==0 && v!=0){
|
|||
|
|
m=1
|
|||
|
|
v=v*8
|
|||
|
|
}else if(m!=0 && v==0) {
|
|||
|
|
v=BlockSize*8
|
|||
|
|
}else if(m!=0 && v!=0){
|
|||
|
|
m=m+1
|
|||
|
|
v=v*8
|
|||
|
|
}else { //m==0 && v==0
|
|||
|
|
m=1
|
|||
|
|
v=0
|
|||
|
|
}
|
|||
|
|
return m,v
|
|||
|
|
}
|
|||
|
|
m:=len(A)/BlockSize
|
|||
|
|
v:=len(A)%BlockSize
|
|||
|
|
m,v=calculm_v(m,v)
|
|||
|
|
|
|||
|
|
n:=len(C)/BlockSize
|
|||
|
|
u:=(len(C)%BlockSize)
|
|||
|
|
n,u=calculm_v(n,u)
|
|||
|
|
|
|||
|
|
//i=0
|
|||
|
|
X=make([]byte,BlockSize*(m+n+2)) //X0 = 0
|
|||
|
|
for i:=0;i<BlockSize;i++{
|
|||
|
|
X[i]=0x00
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//i=1...m-1
|
|||
|
|
for i:=1;i<=m-1;i++{
|
|||
|
|
copy(X[i*BlockSize:i*BlockSize+BlockSize],multiplication(addition(X[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize],A[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize]),H)) //A 1-->m-1 对于数组来说是 0-->m-2
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//i=m
|
|||
|
|
zeros:=make([]byte,(128-v)/8)
|
|||
|
|
Am:=make([]byte,v/8)
|
|||
|
|
copy(Am[:],A[(m-1)*BlockSize:])
|
|||
|
|
Am=append(Am,zeros...)
|
|||
|
|
copy(X[m*BlockSize:m*BlockSize+BlockSize],multiplication( addition(X[(m-1)*BlockSize:(m-1)*BlockSize+BlockSize],Am),H))
|
|||
|
|
|
|||
|
|
//i=m+1...m+n-1
|
|||
|
|
for i:=m+1;i<=(m+n-1);i++{
|
|||
|
|
copy(X[i*BlockSize:i*BlockSize+BlockSize],multiplication( addition(X[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize],C[(i-m-1)*BlockSize:(i-m-1)*BlockSize+BlockSize]),H))
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//i=m+n
|
|||
|
|
zeros =make([]byte,(128-u)/8)
|
|||
|
|
Cn:=make([]byte,u/8)
|
|||
|
|
copy(Cn[:],C[(n-1)*BlockSize:])
|
|||
|
|
Cn=append(Cn,zeros...)
|
|||
|
|
copy(X[(m+n)*BlockSize:(m+n)*BlockSize+BlockSize],multiplication( addition(X[(m+n-1)*BlockSize:(m+n-1)*BlockSize+BlockSize],Cn),H))
|
|||
|
|
|
|||
|
|
//i=m+n+1
|
|||
|
|
var lenAB []byte
|
|||
|
|
calculateLenToBytes :=func(len int) []byte{
|
|||
|
|
data:=make([]byte,8)
|
|||
|
|
data[0]=byte((len>>56)&0xff)
|
|||
|
|
data[1]=byte((len>>48)&0xff)
|
|||
|
|
data[2]=byte((len>>40)&0xff)
|
|||
|
|
data[3]=byte((len>>32)&0xff)
|
|||
|
|
data[4]=byte((len>>24)&0xff)
|
|||
|
|
data[5]=byte((len>>16)&0xff)
|
|||
|
|
data[6]=byte((len>>8)&0xff)
|
|||
|
|
data[7]=byte((len>>0)&0xff)
|
|||
|
|
return data
|
|||
|
|
}
|
|||
|
|
lenAB=append(lenAB,calculateLenToBytes(len(A))...)
|
|||
|
|
lenAB=append(lenAB,calculateLenToBytes(len(C))...)
|
|||
|
|
copy(X[(m+n+1)*BlockSize:(m+n+1)*BlockSize+BlockSize],multiplication(addition(X[(m+n)*BlockSize:(m+n)*BlockSize+BlockSize],lenAB),H))
|
|||
|
|
return X[(m+n+1)*BlockSize:(m+n+1)*BlockSize+BlockSize]
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
|
|||
|
|
func GetY0(H,IV []byte) []byte{
|
|||
|
|
if len(IV)*8 == 96 {
|
|||
|
|
zero31one1:=[]byte{0x00,0x00,0x00,0x01}
|
|||
|
|
IV=append(IV,zero31one1...)
|
|||
|
|
return IV
|
|||
|
|
}else{
|
|||
|
|
return GHASH(H,[]byte{},IV)
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func incr(n int ,Y_i []byte) (Y_ii []byte) {
|
|||
|
|
|
|||
|
|
Y_ii=make([]byte,BlockSize*n)
|
|||
|
|
copy(Y_ii,Y_i)
|
|||
|
|
|
|||
|
|
addYone:=func(yi,yii []byte){
|
|||
|
|
copy(yii[:],yi[:])
|
|||
|
|
|
|||
|
|
Len:=len(yi)
|
|||
|
|
var rc byte=0x00
|
|||
|
|
for i:=Len-1;i>=0;i--{
|
|||
|
|
if(i==Len-1){
|
|||
|
|
if(yii[i]<0xff){
|
|||
|
|
yii[i]=yii[i]+0x01
|
|||
|
|
rc=0x00
|
|||
|
|
}else{
|
|||
|
|
yii[i]=0x00
|
|||
|
|
rc=0x01
|
|||
|
|
}
|
|||
|
|
}else{
|
|||
|
|
if yii[i]+rc<0xff {
|
|||
|
|
yii[i]=yii[i]+rc
|
|||
|
|
rc=0x00
|
|||
|
|
}else{
|
|||
|
|
yii[i]=0x00
|
|||
|
|
rc=0x01
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
for i:=1;i<n;i++{ //2^32
|
|||
|
|
addYone(Y_ii[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize],Y_ii[i*BlockSize:i*BlockSize+BlockSize])
|
|||
|
|
}
|
|||
|
|
return Y_ii
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func MSB(len int, S []byte) (out []byte){
|
|||
|
|
return S[:len/8]
|
|||
|
|
}
|
|||
|
|
func GCMEncrypt(K,IV,P,A []byte) (C,T []byte){
|
|||
|
|
calculm_v:=func(m ,v int) (int,int) {
|
|||
|
|
if(m==0 && v!=0){
|
|||
|
|
m=1
|
|||
|
|
v=v*8
|
|||
|
|
}else if(m!=0 && v==0) {
|
|||
|
|
v=BlockSize*8
|
|||
|
|
}else if(m!=0 && v!=0){
|
|||
|
|
m=m+1
|
|||
|
|
v=v*8
|
|||
|
|
}else { //m==0 && v==0
|
|||
|
|
m=1
|
|||
|
|
v=0
|
|||
|
|
}
|
|||
|
|
return m,v
|
|||
|
|
}
|
|||
|
|
n:=len(P)/BlockSize
|
|||
|
|
u:=len(P)%BlockSize
|
|||
|
|
n,u=calculm_v(n,u)
|
|||
|
|
|
|||
|
|
H:=GetH(K)
|
|||
|
|
|
|||
|
|
Y0:=GetY0(H,IV)
|
|||
|
|
|
|||
|
|
Y:=make([]byte,BlockSize*(n+1))
|
|||
|
|
Y=incr(n+1,Y0)
|
|||
|
|
c,err := NewCipher(K)
|
|||
|
|
if err != nil {
|
|||
|
|
panic(err)
|
|||
|
|
}
|
|||
|
|
Enc:=make([]byte,BlockSize)
|
|||
|
|
C =make([]byte,len(P))
|
|||
|
|
|
|||
|
|
//i=1...n-1
|
|||
|
|
for i:=1;i<=n-1;i++{
|
|||
|
|
c.Encrypt(Enc,Y[i*BlockSize:i*BlockSize+BlockSize])
|
|||
|
|
|
|||
|
|
copy(C[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize],addition(P[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize],Enc))
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//i=n
|
|||
|
|
c.Encrypt(Enc,Y[n*BlockSize:n*BlockSize+BlockSize])
|
|||
|
|
out:=MSB(u,Enc)
|
|||
|
|
copy(C[(n-1)*BlockSize:],addition(P[(n-1)*BlockSize:],out))
|
|||
|
|
|
|||
|
|
c.Encrypt(Enc,Y0)
|
|||
|
|
|
|||
|
|
t:=128
|
|||
|
|
T =MSB(t,addition(Enc,GHASH(H,A,C)))
|
|||
|
|
return C,T
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func GCMDecrypt(K,IV,C,A []byte)(P,_T []byte){
|
|||
|
|
calculm_v:=func(m ,v int) (int,int) {
|
|||
|
|
if(m==0 && v!=0){
|
|||
|
|
m=1
|
|||
|
|
v=v*8
|
|||
|
|
}else if(m!=0 && v==0) {
|
|||
|
|
v=BlockSize*8
|
|||
|
|
}else if(m!=0 && v!=0){
|
|||
|
|
m=m+1
|
|||
|
|
v=v*8
|
|||
|
|
}else { //m==0 && v==0
|
|||
|
|
m=1
|
|||
|
|
v=0
|
|||
|
|
}
|
|||
|
|
return m,v
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
H:=GetH(K)
|
|||
|
|
|
|||
|
|
Y0:=GetY0(H,IV)
|
|||
|
|
|
|||
|
|
Enc:=make([]byte,BlockSize)
|
|||
|
|
c,err := NewCipher(K)
|
|||
|
|
if err != nil{
|
|||
|
|
panic(err)
|
|||
|
|
}
|
|||
|
|
c.Encrypt(Enc,Y0)
|
|||
|
|
t:=128
|
|||
|
|
_T=MSB(t,addition(Enc,GHASH(H,A,C)))
|
|||
|
|
|
|||
|
|
n:=len(C)/BlockSize
|
|||
|
|
u:=len(C)%BlockSize
|
|||
|
|
n,u=calculm_v(n,u)
|
|||
|
|
Y:=make([]byte,BlockSize*(n+1))
|
|||
|
|
Y=incr(n+1,Y0)
|
|||
|
|
|
|||
|
|
P = make([]byte, BlockSize*n)
|
|||
|
|
for i:=1;i<=n;i++{
|
|||
|
|
c.Encrypt(Enc,Y[i*BlockSize:i*BlockSize+BlockSize])
|
|||
|
|
copy(P[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize],addition(C[(i-1)*BlockSize:(i-1)*BlockSize+BlockSize],Enc))
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
c.Encrypt(Enc,Y[n*BlockSize:n*BlockSize+BlockSize])
|
|||
|
|
out:=MSB(u,Enc)
|
|||
|
|
copy(P[(n-1)*BlockSize:],addition(C[(n-1)*BlockSize:],out))
|
|||
|
|
|
|||
|
|
return P,_T
|
|||
|
|
}
|