Add kuznyechik_ctracpkm

5 files changed, 161 insertions, 5 deletions

diff --git a/gost_eng.c b/gost_eng.c
index caedf9a..6ed13c7 100644
--- a/gost_eng.c
+++ b/gost_eng.c
@@ -49,6 +49,7 @@ static int gost_cipher_nids[] = {
         NID_grasshopper_ctr,
         NID_magma_cbc,
         NID_magma_ctr,
+        NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm,
         0
 };
 
@@ -253,6 +254,7 @@ static int bind_gost(ENGINE* e, const char* id) {
         || !EVP_add_cipher(cipher_gost_grasshopper_cfb())
         || !EVP_add_cipher(cipher_gost_grasshopper_ofb())
         || !EVP_add_cipher(cipher_gost_grasshopper_ctr())
+        || !EVP_add_cipher(cipher_gost_grasshopper_ctracpkm())
         || !EVP_add_cipher(cipher_magma_cbc())
         || !EVP_add_cipher(cipher_magma_ctr())
         || !EVP_add_digest(digest_gost())
@@ -332,6 +334,8 @@ static int gost_ciphers(ENGINE* e, const EVP_CIPHER** cipher,
         *cipher = cipher_gost_grasshopper_ofb();
     } else if (nid == NID_grasshopper_ctr) {
         *cipher = cipher_gost_grasshopper_ctr();
+    } else if (nid == NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm) {
+        *cipher = cipher_gost_grasshopper_ctracpkm();
     } else if (nid == NID_magma_cbc) {
         *cipher = cipher_magma_cbc();
     } else if (nid == NID_magma_ctr) {
diff --git a/gost_grasshopper_cipher.c b/gost_grasshopper_cipher.c
index baf25fe..a3f34d6 100644
--- a/gost_grasshopper_cipher.c
+++ b/gost_grasshopper_cipher.c
@@ -25,15 +25,17 @@ enum GRASSHOPPER_CIPHER_TYPE {
     GRASSHOPPER_CIPHER_CBC,
     GRASSHOPPER_CIPHER_OFB,
     GRASSHOPPER_CIPHER_CFB,
-    GRASSHOPPER_CIPHER_CTR
+    GRASSHOPPER_CIPHER_CTR,
+    GRASSHOPPER_CIPHER_CTRACPKM,
 };
 
-static EVP_CIPHER* gost_grasshopper_ciphers[5] = {
+static EVP_CIPHER* gost_grasshopper_ciphers[6] = {
         [GRASSHOPPER_CIPHER_ECB] = NULL,
         [GRASSHOPPER_CIPHER_CBC] = NULL,
         [GRASSHOPPER_CIPHER_OFB] = NULL,
         [GRASSHOPPER_CIPHER_CFB] = NULL,
-        [GRASSHOPPER_CIPHER_CTR] = NULL
+        [GRASSHOPPER_CIPHER_CTR] = NULL,
+        [GRASSHOPPER_CIPHER_CTRACPKM] = NULL,
 };
 
 static GRASSHOPPER_INLINE void gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx* c);
@@ -50,7 +52,7 @@ struct GRASSHOPPER_CIPHER_PARAMS {
     bool padding;
 };
 
-static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[5] = {
+static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[6] = {
         [GRASSHOPPER_CIPHER_ECB] = {
                 NID_grasshopper_ecb,
                 gost_grasshopper_cipher_init_ecb,
@@ -104,8 +106,44 @@ static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[5] = {
                 16,
                 false
         },
+        [GRASSHOPPER_CIPHER_CTRACPKM] = {
+                NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm,
+                gost_grasshopper_cipher_init_ctracpkm,
+                gost_grasshopper_cipher_do_ctracpkm,
+                gost_grasshopper_cipher_destroy_ctr,
+                1,
+                sizeof(gost_grasshopper_cipher_ctx_ctr),
+                16,
+                false
+        },
+};
+
+/* first 256 bit of D from draft-irtf-cfrg-re-keying-12 */
+static const unsigned char ACPKM_D_2018[] = {
+    0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /*  64 bit */
+    0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 128 bit */
+    0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+    0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 256 bit */
 };
 
+static void acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr *ctx)
+{
+    gost_grasshopper_cipher_ctx *c = &ctx->c;
+    unsigned char newkey[GRASSHOPPER_KEY_SIZE];
+    const int J = GRASSHOPPER_KEY_SIZE / GRASSHOPPER_BLOCK_SIZE;
+    int n;
+
+    for (n = 0; n < J; n++) {
+        const unsigned char *D_n = &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE];
+
+        grasshopper_encrypt_block(&c->encrypt_round_keys,
+            (grasshopper_w128_t *)D_n,
+            (grasshopper_w128_t *)&newkey[n * GRASSHOPPER_BLOCK_SIZE],
+            &c->buffer);
+    }
+    gost_grasshopper_cipher_key(c, newkey);
+}
+
 /* Set 256 bit  key into context */
 GRASSHOPPER_INLINE void gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx* c, const uint8_t* k) {
 		int i;
@@ -218,6 +256,20 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX* ctx, con
     return gost_grasshopper_cipher_init(ctx, key, iv, enc);
 }
 
+GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+                                                               const unsigned char *iv,
+                                                               int enc) {
+    gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx);
+
+    /* NB: setting type makes EVP do_cipher callback useless */
+    c->c.type = GRASSHOPPER_CIPHER_CTRACPKM;
+    EVP_CIPHER_CTX_set_num(ctx, 0);
+    c->section_size  = 0; /* by default meshing is turned off */
+    c->skip_sections = 0; /* will be set to 1 on EVP_CTRL_KEY_MESH */
+
+    return gost_grasshopper_cipher_init(ctx, key, iv, enc);
+}
+
 GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX* ctx, unsigned char* out,
                                                          const unsigned char* in, size_t inl) {
     gost_grasshopper_cipher_ctx* c = (gost_grasshopper_cipher_ctx*) EVP_CIPHER_CTX_get_cipher_data(ctx);
@@ -351,6 +403,64 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX* ctx, unsigned char* out,
     return 1;
 }
 
+static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr *ctx, unsigned int num)
+{
+    if (!ctx->section_size ||
+        (num & (ctx->section_size - 1)))
+        return;
+    if (ctx->skip_sections) {
+        /* In no master key mode first section is using original key */
+        --ctx->skip_sections;
+        return;
+    }
+    acpkm_grasshopper(ctx);
+}
+
+#define GRASSHOPPER_BLOCK_MASK (GRASSHOPPER_BLOCK_SIZE - 1)
+/* If meshing is not configured via ctrl (setting section_size)
+ * this function works exactly like plain ctr */
+int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, unsigned char *out,
+    const unsigned char *in, size_t inl) {
+    gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx);
+    unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx);
+    unsigned int num = EVP_CIPHER_CTX_num(ctx);
+
+    while ((num & GRASSHOPPER_BLOCK_MASK) && inl) {
+        *out++ = *in++ ^ c->partial_buffer.b[num & GRASSHOPPER_BLOCK_MASK];
+        --inl;
+        num++;
+    }
+    size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE;
+    size_t i;
+
+    // full parts
+    for (i = 0; i < blocks; i++) {
+        apply_acpkm_grasshopper(c, num);
+        grasshopper_encrypt_block(&c->c.encrypt_round_keys,
+            (grasshopper_w128_t *)iv, (grasshopper_w128_t *)out, &c->c.buffer);
+        grasshopper_append128((grasshopper_w128_t *)out, (grasshopper_w128_t *)in);
+        ctr128_inc(iv);
+        in  += GRASSHOPPER_BLOCK_SIZE;
+        out += GRASSHOPPER_BLOCK_SIZE;
+        num += GRASSHOPPER_BLOCK_SIZE;
+    }
+
+    // last part
+    size_t lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE;
+    if (lasted > 0) {
+        apply_acpkm_grasshopper(c, num);
+        grasshopper_encrypt_block(&c->c.encrypt_round_keys,
+            (grasshopper_w128_t *)iv, &c->partial_buffer, &c->c.buffer);
+        for (i = 0; i < lasted; i++)
+            out[i] = c->partial_buffer.b[i] ^ in[i];
+        ctr128_inc(iv);
+        num += lasted;
+    }
+    EVP_CIPHER_CTX_set_num(ctx, num);
+
+    return 1;
+}
+
 /*
  * Fixed 128-bit IV implementation make shift regiser redundant.
  */
@@ -549,6 +659,13 @@ int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX* ctx, int type, int arg, void* pt
             }
             break;
         }
+        case EVP_CTRL_KEY_MESH:
+            if (arg <= 1 || ((arg - 1) & arg))
+                return -1;
+            gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx);
+            c->section_size = arg;
+            c->skip_sections = 1;
+            break;
         default:
             GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_UNSUPPORTED_CIPHER_CTL_COMMAND);
             return -1;
@@ -630,6 +747,10 @@ const GRASSHOPPER_INLINE EVP_CIPHER* cipher_gost_grasshopper_ctr() {
     return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTR);
 }
 
+const GRASSHOPPER_INLINE EVP_CIPHER* cipher_gost_grasshopper_ctracpkm() {
+    return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTRACPKM);
+}
+
 void cipher_gost_grasshopper_destroy(void)
 {
     EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB]);
@@ -642,6 +763,8 @@ void cipher_gost_grasshopper_destroy(void)
     gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB] = NULL;
     EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR]);
     gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR] = NULL;
+    EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM]);
+    gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM] = NULL;
 }
 
 #if defined(__cplusplus)
diff --git a/gost_grasshopper_cipher.h b/gost_grasshopper_cipher.h
index c8957a0..0ab17c1 100644
--- a/gost_grasshopper_cipher.h
+++ b/gost_grasshopper_cipher.h
@@ -32,6 +32,9 @@ typedef struct {
 typedef struct {
     gost_grasshopper_cipher_ctx c;
     grasshopper_w128_t partial_buffer;
+    unsigned int skip_sections; /* 1 or 0, used to skip meshing for a first section */
+    unsigned int section_size;  /* After how much bytes mesh the key,
+				   if 0 never mesh and work like plain ctr. */
 } gost_grasshopper_cipher_ctx_ctr;
 
 typedef int (* grasshopper_init_cipher_func)(EVP_CIPHER_CTX* ctx, const unsigned char* key, const unsigned char* iv,
@@ -56,6 +59,8 @@ int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX* ctx, const unsigned char* k
 
 int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX* ctx, const unsigned char* key, const unsigned char* iv, int enc);
 
+int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX* ctx, const unsigned char* key, const unsigned char* iv, int enc);
+
 int gost_grasshopper_cipher_init(EVP_CIPHER_CTX* ctx, const unsigned char* key,
                                  const unsigned char* iv, int enc);
 
@@ -76,6 +81,8 @@ int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX* ctx, unsigned char* out,
 
 int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX* ctx, unsigned char* out,
                                    const unsigned char* in, size_t inl);
+int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX* ctx, unsigned char* out,
+                                   const unsigned char* in, size_t inl);
 
 int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX* ctx);
 
@@ -96,6 +103,7 @@ extern const EVP_CIPHER* cipher_gost_grasshopper_cbc();
 extern const EVP_CIPHER* cipher_gost_grasshopper_ofb();
 extern const EVP_CIPHER* cipher_gost_grasshopper_cfb();
 extern const EVP_CIPHER* cipher_gost_grasshopper_ctr();
+extern const EVP_CIPHER* cipher_gost_grasshopper_ctracpkm();
 
 void cipher_gost_grasshopper_destroy(void);
 
diff --git a/test/00-engine.t b/test/00-engine.t
index adc78b5..16f2c35 100644
--- a/test/00-engine.t
+++ b/test/00-engine.t
@@ -40,7 +40,7 @@ if ( -f $engine . ".info") {
 
 $engine_info= <<EOINF;
 (gost) Reference implementation of GOST engine
- [gost89, gost89-cnt, gost89-cnt-12, gost89-cbc, grasshopper-ecb, grasshopper-cbc, grasshopper-cfb, grasshopper-ofb, grasshopper-ctr, magma-cbc, magma-ctr, md_gost94, gost-mac, md_gost12_256, md_gost12_512, gost-mac-12, magma-mac, grasshopper-mac, gost2001, gost-mac, gost2012_256, gost2012_512, gost-mac-12, magma-mac, grasshopper-mac]
+ [gost89, gost89-cnt, gost89-cnt-12, gost89-cbc, grasshopper-ecb, grasshopper-cbc, grasshopper-cfb, grasshopper-ofb, grasshopper-ctr, magma-cbc, magma-ctr, id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm, md_gost94, gost-mac, md_gost12_256, md_gost12_512, gost-mac-12, magma-mac, grasshopper-mac, gost2001, gost-mac, gost2012_256, gost2012_512, gost-mac-12, magma-mac, grasshopper-mac]
 EOINF
 }
 
diff --git a/test_grasshopper.c b/test_grasshopper.c
index fb6b967..1b0f913 100644
--- a/test_grasshopper.c
+++ b/test_grasshopper.c
@@ -46,6 +46,16 @@ static const unsigned char P[] = {
     0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,
     0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xee,0xff,0x0a,0x00,0x11,
 };
+/* Extended plaintext from tc26 acpkm Kuznyechik test vector */
+static const unsigned char P_acpkm[] = {
+    0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x00,0xFF,0xEE,0xDD,0xCC,0xBB,0xAA,0x99,0x88,
+    0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,
+    0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,
+    0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,
+    0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,0x22,
+    0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,0x22,0x33,
+    0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xEE,0xFF,0x0A,0x00,0x11,0x22,0x33,0x44,
+};
 static const unsigned char E_ecb[] = {
     /* ECB test vectors from GOST R 34.13-2015  A.1.1 */
     /* first 16 bytes is vector (b) from GOST R 34.12-2015 A.1 */
@@ -61,6 +71,15 @@ static const unsigned char E_ctr[] = {
     0xa5,0xea,0xe8,0x8b,0xe6,0x35,0x6e,0xd3,0xd5,0xe8,0x77,0xf1,0x35,0x64,0xa3,0xa5,
     0xcb,0x91,0xfa,0xb1,0xf2,0x0c,0xba,0xb6,0xd1,0xc6,0xd1,0x58,0x20,0xbd,0xba,0x73,
 };
+static const unsigned char E_acpkm[] = {
+    0xF1,0x95,0xD8,0xBE,0xC1,0x0E,0xD1,0xDB,0xD5,0x7B,0x5F,0xA2,0x40,0xBD,0xA1,0xB8,
+    0x85,0xEE,0xE7,0x33,0xF6,0xA1,0x3E,0x5D,0xF3,0x3C,0xE4,0xB3,0x3C,0x45,0xDE,0xE4,
+    0x4B,0xCE,0xEB,0x8F,0x64,0x6F,0x4C,0x55,0x00,0x17,0x06,0x27,0x5E,0x85,0xE8,0x00,
+    0x58,0x7C,0x4D,0xF5,0x68,0xD0,0x94,0x39,0x3E,0x48,0x34,0xAF,0xD0,0x80,0x50,0x46,
+    0xCF,0x30,0xF5,0x76,0x86,0xAE,0xEC,0xE1,0x1C,0xFC,0x6C,0x31,0x6B,0x8A,0x89,0x6E,
+    0xDF,0xFD,0x07,0xEC,0x81,0x36,0x36,0x46,0x0C,0x4F,0x3B,0x74,0x34,0x23,0x16,0x3E,
+    0x64,0x09,0xA9,0xC2,0x82,0xFA,0xC8,0xD4,0x69,0xD2,0x21,0xE7,0xFB,0xD6,0xDE,0x5D,
+};
 /*
  * Other modes (ofb, cbc, cfb) is impossible to test to match GOST R
  * 34.13-2015 test vectors exactly, due to these vectors having exceeding
@@ -111,6 +130,8 @@ struct testcase {
 static struct testcase testcases[] = {
     { "ecb", cipher_gost_grasshopper_ecb, 0, P,  E_ecb,  sizeof(P),  NULL,       0, 0 },
     { "ctr", cipher_gost_grasshopper_ctr, 1, P,  E_ctr,  sizeof(P),  iv_ctr,     sizeof(iv_ctr), 0 },
+    { "ctr-no-acpkm", cipher_gost_grasshopper_ctracpkm, 1, P,       E_ctr,   sizeof(P),       iv_ctr, sizeof(iv_ctr), 0 },
+    { "ctracpkm",     cipher_gost_grasshopper_ctracpkm, 1, P_acpkm, E_acpkm, sizeof(P_acpkm), iv_ctr, sizeof(iv_ctr), 1 },
     { "ofb", cipher_gost_grasshopper_ofb, 1, P,  E_ofb,  sizeof(P),  iv_128bit,  sizeof(iv_128bit), 0 },
     { "cbc", cipher_gost_grasshopper_cbc, 0, P,  E_cbc,  sizeof(P),  iv_128bit,  sizeof(iv_128bit), 0 },
     { "cfb", cipher_gost_grasshopper_cfb, 0, P,  E_cfb,  sizeof(P),  iv_128bit,  sizeof(iv_128bit), 0 },