Function decrypt_loop

freebsd/crypto/aesni/aesni_ccm.c:309–370

* Implement AES CCM+CBC-MAC decryption and authentication. * Returns 0 on failure, 1 on success. * * The primary difference here is that each encrypted block * needs to be hashed&encrypted after it is decrypted (since * the CBC-MAC is based on the plain text). This means that * we do the decryption twice -- first to verify the tag, * and second to decrypt and copy it out. * * To avoid an

 * checksum.
 */
static void
decrypt_loop(const unsigned char *in, unsigned char *out, size_t nbytes,
    __m128i s0, size_t nonce_length, __m128i *macp,
    const unsigned char *key, int nr)
{
	size_t total = 0;
	__m128i s_x = s0, mac_block;
	int counter = 1;
	const size_t L = sizeof(__m128i) - 1 - nonce_length;
	__m128i pad_block, staging_block;

	/*
	 * The starting mac (post AAD, if any).
	 */
	if (macp != NULL)
		mac_block = *macp;
	
	while (total < nbytes) {
		size_t copy_amt = MIN(nbytes - total, sizeof(staging_block));

		if (copy_amt < sizeof(staging_block)) {
			staging_block = _mm_setzero_si128();
		}
		bcopy(in+total, &staging_block, copy_amt);

		/*
		 * staging_block has the current block of input data,
		 * zero-padded if necessary.  This is used in computing
		 * both the decrypted data, and the authentication tag.
		 */
		append_int(counter++, &s_x, L+1);
		/*
		 * The tag is computed based on the decrypted data.
		 */
		pad_block = AESNI_ENC(s_x, key, nr);
		if (copy_amt < sizeof(staging_block)) {
			/*
			 * Need to pad out pad_block with 0.
			 * (staging_block was set to 0's above.)
			 */
			uint8_t *end_of_buffer = (uint8_t*)&pad_block;
			bzero(end_of_buffer + copy_amt,
			    sizeof(pad_block) - copy_amt);
		}
		staging_block = _mm_xor_si128(staging_block, pad_block);

		if (out)
			bcopy(&staging_block, out+total, copy_amt);

		if (macp)
			mac_block = xor_and_encrypt(mac_block, staging_block,
			    key, nr);
		total += copy_amt;
	}

	if (macp)
		*macp = mac_block;