added libtomcrypt-1.14

src/encauth/ccm/ccm_memory.c

@@ -117,6 +117,11 @@ int ccm_memory(int cipher,
       L = 15 - noncelen;
    }
 
+   /* decrease noncelen to match L */
+   if ((noncelen + L) > 15) {
+      noncelen = 15 - L;
+   }
+
    /* allocate mem for the symmetric key */
    if (uskey == NULL) {
       skey = XMALLOC(sizeof(*skey));
@@ -308,8 +313,10 @@ int ccm_memory(int cipher,
       }
    }
 
-   /* setup CTR for the TAG */
-   ctr[14] = ctr[15] = 0x00;
+   /* setup CTR for the TAG (zero the count) */
+   for (y = 15; y > 15 - L; y--) {
+      ctr[y] = 0x00;
+   }
    if ((err = cipher_descriptor[cipher].ecb_encrypt(ctr, CTRPAD, skey)) != CRYPT_OK) {
       goto error;
    }

src/encauth/gcm/gcm_memory.c

@@ -43,6 +43,7 @@ int gcm_memory(      int           cipher,
                      unsigned char *tag,    unsigned long *taglen,
                                int direction)
 {
+    void      *orig;
     gcm_state *gcm;
     int        err;
 
@@ -63,11 +64,26 @@ int gcm_memory(      int           cipher,
     }
 
 
-    gcm = XMALLOC(sizeof(*gcm));
+
+#ifndef GCM_TABLES_SSE2
+    orig = gcm = XMALLOC(sizeof(*gcm));
+#else
+    orig = gcm = XMALLOC(sizeof(*gcm) + 16);
+#endif
     if (gcm == NULL) {
         return CRYPT_MEM;
     }
 
+   /* Force GCM to be on a multiple of 16 so we can use 128-bit aligned operations
+    * note that we only modify gcm and keep orig intact.  This code is not portable
+    * but again it's only for SSE2 anyways, so who cares?
+    */
+#ifdef GCM_TABLES_SSE2
+   if ((unsigned long)gcm & 15) {
+      gcm = (gcm_state *)((unsigned long)gcm + (16 - ((unsigned long)gcm & 15)));
+   }
+#endif
+
     if ((err = gcm_init(gcm, cipher, key, keylen)) != CRYPT_OK) {
        goto LTC_ERR;
     }
@@ -82,7 +98,7 @@ int gcm_memory(      int           cipher,
     }
     err = gcm_done(gcm, tag, taglen);
 LTC_ERR:
-    XFREE(gcm);
+    XFREE(orig);
     return err;
 }
 #endif

src/encauth/gcm/gcm_mult_h.c

@@ -26,6 +26,13 @@ void gcm_mult_h(gcm_state *gcm, unsigned char *I)
    unsigned char T[16];
 #ifdef GCM_TABLES
    int x, y;
+#ifdef GCM_TABLES_SSE2
+   asm("movdqa (%0),%%xmm0"::"r"(&gcm->PC[0][I[0]][0]));
+   for (x = 1; x < 16; x++) {
+      asm("pxor (%0),%%xmm0"::"r"(&gcm->PC[x][I[x]][0]));
+   }
+   asm("movdqa %%xmm0,(%0)"::"r"(&T));
+#else
    XMEMCPY(T, &gcm->PC[0][I[0]][0], 16);
    for (x = 1; x < 16; x++) {
 #ifdef LTC_FAST
@@ -36,8 +43,9 @@ void gcm_mult_h(gcm_state *gcm, unsigned char *I)
        for (y = 0; y < 16; y++) {
            T[y] ^= gcm->PC[x][I[x]][y];
        }
-#endif
+#endif /* LTC_FAST */
    }
+#endif /* GCM_TABLES_SSE2 */
 #else     
    gcm_gf_mult(gcm->H, I, T); 
 #endif

src/encauth/gcm/gcm_process.c

@@ -59,7 +59,7 @@ int gcm_process(gcm_state *gcm,
 
       /* increment counter */
       for (y = 15; y >= 12; y--) {
-          if (++gcm->Y[y]) { break; }
+          if (++gcm->Y[y] & 255) { break; }
       }
       /* encrypt the counter */
       if ((err = cipher_descriptor[gcm->cipher].ecb_encrypt(gcm->Y, gcm->buf, &gcm->K)) != CRYPT_OK) {
@@ -89,7 +89,7 @@ int gcm_process(gcm_state *gcm,
              gcm_mult_h(gcm, gcm->X);
              /* increment counter */
              for (y = 15; y >= 12; y--) {
-                 if (++gcm->Y[y]) { break; }
+                 if (++gcm->Y[y] & 255) { break; }
              }
              if ((err = cipher_descriptor[gcm->cipher].ecb_encrypt(gcm->Y, gcm->buf, &gcm->K)) != CRYPT_OK) {
                 return err;
@@ -107,7 +107,7 @@ int gcm_process(gcm_state *gcm,
              gcm_mult_h(gcm, gcm->X);
              /* increment counter */
              for (y = 15; y >= 12; y--) {
-                 if (++gcm->Y[y]) { break; }
+                 if (++gcm->Y[y] & 255) { break; }
              }
              if ((err = cipher_descriptor[gcm->cipher].ecb_encrypt(gcm->Y, gcm->buf, &gcm->K)) != CRYPT_OK) {
                 return err;
@@ -125,7 +125,7 @@ int gcm_process(gcm_state *gcm,
           
           /* increment counter */
           for (y = 15; y >= 12; y--) {
-              if (++gcm->Y[y]) { break; }
+              if (++gcm->Y[y] & 255) { break; }
           }
           if ((err = cipher_descriptor[gcm->cipher].ecb_encrypt(gcm->Y, gcm->buf, &gcm->K)) != CRYPT_OK) {
              return err;