Function AES_CCM_decrypt

freebsd/crypto/aesni/aesni_ccm.c:378–439

* The exposed decryption routine. This is practically a * copy of the encryption routine, except that the order * in which the tag is created is changed. * XXX combine the two functions at some point! */

 * XXX combine the two functions at some point!
 */
int
AES_CCM_decrypt(const unsigned char *in, unsigned char *out,
		const unsigned char *addt, const unsigned char *nonce,
		const unsigned char *tag, uint32_t nbytes, uint32_t abytes, int nlen,
		const unsigned char *key, int nr)
{
	static const int tag_length = 16;	/* 128 bits */
	int L;
	__m128i s0, rolling_mac, staging_block;
	uint8_t *byte_ptr;

	if (nbytes == 0 && abytes == 0)
		return (1);	// No message means no decryption!
	if (nlen < 0 || nlen > 15)
		panic("%s: bad nonce length %d", __FUNCTION__, nlen);

	/*
	 * We need to know how many bytes to use to describe
	 * the length of the data.  Normally, nlen should be
	 * 12, which leaves us 3 bytes to do that -- 16mbytes of
	 * data to encrypt.  But it can be longer or shorter.
	 */
	L = sizeof(__m128i) - 1 - nlen;

	/*
	 * Now, this shouldn't happen, but let's make sure that
	 * the data length isn't too big.
	 */
	if (nbytes > ((1 << (8 * L)) - 1))
		panic("%s: nbytes is %u, but length field is %d bytes",
		      __FUNCTION__, nbytes, L);
	/*
	 * Clear out the blocks
	 */
	s0 = _mm_setzero_si128();

	rolling_mac = cbc_mac_start(addt, abytes, nonce, nlen,
	    key, nr, nbytes, tag_length);
	/* s0 has flags, nonce, and then 0 */
	byte_ptr = (uint8_t*)&s0;
	byte_ptr[0] = L-1;	/* but the flags byte only has L' */
	bcopy(nonce, &byte_ptr[1], nlen);

	/*
	 * Now to cycle through the rest of the data.
	 */
	decrypt_loop(in, NULL, nbytes, s0, nlen, &rolling_mac, key, nr);

	/*
	 * Compare the tag.
	 */
	staging_block = _mm_xor_si128(AESNI_ENC(s0, key, nr), rolling_mac);
	if (timingsafe_bcmp(&staging_block, tag, tag_length) != 0) {
		return (0);
	}

	/*
	 * Push out the decryption results this time.