tweak belt-dwp bundled ghash, use polyval as inner

belt-dwp/Cargo.toml

@@ -17,6 +17,7 @@ belt-block = "0.2"
 belt-ctr = "0.2"
 ctutils = "0.4"
 universal-hash = "0.6"
+ghash = "0.6"
 
 # optional dependencies
 zeroize = { version = "1.8", default-features = false, optional = true }
@@ -32,7 +33,7 @@ bytes = ["aead/bytes"]
 getrandom = ["aead/getrandom"]
 rand_core = ["aead/rand_core"]
 reduced-round = []
-zeroize = ["dep:zeroize", "belt-ctr/zeroize"]
+zeroize = ["dep:zeroize", "belt-ctr/zeroize", "ghash/zeroize"]
 
 [lints]
 workspace = true

belt-dwp/src/ghash.rs

@@ -1,10 +1,8 @@
 use aead::array::Array;
-use aead::consts::{U1, U16};
+use aead::consts::U16;
 use aead::{KeyInit, KeySizeUser};
 use belt_block::cipher::{BlockSizeUser, ParBlocksSizeUser};
-use universal_hash::{Reset, UhfBackend, UhfClosure, UniversalHash};
-
-use crate::gf::gf128_soft64::Element;
+use universal_hash::{ParBlocks, UhfBackend, UhfClosure, UniversalHash};
 
 /// GHASH keys (16-bytes)
 pub type Key = Array<u8, U16>;
@@ -15,10 +13,21 @@ pub type Block = Array<u8, U16>;
 /// GHASH tags (16-bytes)
 pub type Tag = Array<u8, U16>;
 
+/// Convert a block between STB 34.101.31's and NIST SP 800-38D's representations.
+///
+/// Both standards use the same field, but STB numbers the bits of every byte in the opposite
+/// order, so the conversion is a bit reversal within each byte.
+#[inline(always)]
+fn convert(block: &Block) -> Block {
+    let x = u128::from_le_bytes((*block).into());
+    x.reverse_bits().swap_bytes().to_le_bytes().into()
+}
+
 #[derive(Clone)]
 pub struct GHash {
-    s: Element,
-    h: Element,
+    ghash: ghash::GHash,
+    /// Initial `T` value in GHASH's representation, folded into the first processed block.
+    init: u128,
 }
 
 impl KeySizeUser for GHash {
@@ -37,37 +46,105 @@ impl KeyInit for GHash {
 
 impl GHash {
     pub(crate) fn new_with_init_block(h: &Key, s: u128) -> Self {
+        let init = convert(&s.to_le_bytes().into());
+
         Self {
-            s: Element::from(s),
-            h: Element::from(h),
+            ghash: ghash::GHash::new(&convert(h)),
+            init: u128::from_le_bytes(init.into()),
         }
     }
 }
 
-impl ParBlocksSizeUser for GHash {
-    type ParBlocksSize = U1;
+/// Backend which converts blocks into GHASH's representation on the way in, folding the initial
+/// `t` value into the first block it processes.
+struct BeltBackend<'a, B: UhfBackend<BlockSize = U16>> {
+    backend: &'a mut B,
+    init: &'a mut u128,
+}
+
+impl<B: UhfBackend<BlockSize = U16>> BeltBackend<'_, B> {
+    /// Convert a block, folding in the initial `t` value.
+    #[inline(always)]
+    fn convert(&mut self, block: &Block) -> Block {
+        let x = u128::from_le_bytes(convert(block).into()) ^ core::mem::take(self.init);
+        x.to_le_bytes().into()
+    }
+}
+
+impl<B: UhfBackend<BlockSize = U16>> BlockSizeUser for BeltBackend<'_, B> {
+    type BlockSize = U16;
+}
+
+impl<B: UhfBackend<BlockSize = U16>> ParBlocksSizeUser for BeltBackend<'_, B> {
+    type ParBlocksSize = B::ParBlocksSize;
 }
 
-impl UhfBackend for GHash {
+impl<B: UhfBackend<BlockSize = U16>> UhfBackend for BeltBackend<'_, B> {
     fn proc_block(&mut self, x: &Block) {
-        self.s = (self.s + Element::from(x)) * self.h;
+        let x = self.convert(x);
+        self.backend.proc_block(&x);
+    }
+
+    fn proc_par_blocks(&mut self, blocks: &ParBlocks<Self>) {
+        let blocks = ParBlocks::<Self>::from_fn(|i| self.convert(&blocks[i]));
+        self.backend.proc_par_blocks(&blocks);
     }
 }
 
 impl UniversalHash for GHash {
     fn update_with_backend(&mut self, f: impl UhfClosure<BlockSize = Self::BlockSize>) {
-        f.call(self);
+        struct BeltClosure<'a, C: UhfClosure> {
+            f: C,
+            init: &'a mut u128,
+        }
+
+        impl<C: UhfClosure> BlockSizeUser for BeltClosure<'_, C> {
+            type BlockSize = C::BlockSize;
+        }
+
+        impl<C: UhfClosure<BlockSize = U16>> UhfClosure for BeltClosure<'_, C> {
+            fn call<B: UhfBackend<BlockSize = U16>>(self, backend: &mut B) {
+                self.f.call(&mut BeltBackend {
+                    backend,
+                    init: self.init,
+                });
+            }
+        }
+
+        self.ghash.update_with_backend(BeltClosure {
+            f,
+            init: &mut self.init,
+        });
     }
 
     /// Get GHASH output
     #[inline]
     fn finalize(self) -> Tag {
-        self.s.into()
+        convert(&self.ghash.finalize())
     }
 }
 
-impl Reset for GHash {
-    fn reset(&mut self) {
-        self.s = Element::default();
+/// Tests from Appendix A, table 18 of [STB 34.101.31-2020](https://apmi.bsu.by/assets/files/std/belt-spec372.pdf)
+#[test]
+fn test_a18() {
+    use hex_literal::hex;
+
+    let test_vectors = [
+        (
+            hex!("34904055 11BE3297 1343724C 5AB793E9"),
+            hex!("22481783 8761A9D6 E3EC9689 110FB0F3"),
+            hex!("0001D107 FC67DE40 04DC2C80 3DFD95C3"),
+        ),
+        (
+            hex!("703FCCF0 95EE8DF1 C1ABF8EE 8DF1C1AB"),
+            hex!("2055704E 2EDB48FE 87E74075 A5E77EB1"),
+            hex!("4A5C9593 8B3FE8F6 74D59BC1 EB356079"),
+        ),
+    ];
+
+    for (u, v, w) in test_vectors {
+        let mut hash = GHash::new(&Block::from(v));
+        hash.update(&[Block::from(u)]);
+        assert_eq!(hash.finalize(), Block::from(w));
     }
 }

belt-dwp/src/lib.rs

@@ -92,7 +92,6 @@ use universal_hash::typenum::{IsLessOrEqual, NonZero};
 /// Nonce type for [`Dwp`]
 pub type Nonce = aead::Nonce<BeltDwp>;
 
-mod gf;
 mod ghash;
 
 use ghash::GHash;
@@ -182,7 +181,7 @@ where
         ghash.update_padded(&sizes_block);
 
         // 6. 𝑡 ← belt-block(𝑡 * 𝑟, 𝐾).
-        let mut tag = ghash.finalize_reset();
+        let mut tag = ghash.finalize();
         self.cipher.encrypt_block(&mut tag);
 
         tag[..TagSize::USIZE].try_into().map_err(|_| Error)
@@ -222,7 +221,7 @@ where
         ghash.update_padded(&sizes_block);
 
         // 6. 𝑡 ← belt-block(𝑡 * 𝑟, 𝐾).
-        let mut tag_exact = ghash.finalize_reset();
+        let mut tag_exact = ghash.finalize();
         self.cipher.encrypt_block(&mut tag_exact);
 
         use ctutils::CtEq;