commit bd7528a5920740722b9ab2cb830b45adf21aabfe
author Valerio Setti <valerio.setti@nordicsemi.no> Thu Dec 14 09:36:03 2023 +0100
committer Valerio Setti <valerio.setti@nordicsemi.no> Thu Dec 14 18:08:14 2023 +0100
tree 922bae263fb0cca7d9c3ef33bcd433fe8a38f8c9
parent 4a5d57d2255d2b0d862cb006b6743fdb894f62b2

ccm/gcm: use BLOCK_CIPHER whenever possible

Prefer BLOCK_CIPHER instead of CIPHER_C whenever it's enabled.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

library/gcm.c

diff --git a/library/gcm.c b/library/gcm.c
index 8181ec8..ac6b945 100644
--- a/library/gcm.c
+++ b/library/gcm.c
@@ -25,7 +25,7 @@
 #include "mbedtls/error.h"
 #include "mbedtls/constant_time.h"
 
-#if !defined(MBEDTLS_CIPHER_C)
+#if defined(MBEDTLS_BLOCK_CIPHER_C)
 #include "block_cipher_internal.h"
 #endif
 
@@ -66,11 +66,11 @@
 
     memset(h, 0, 16);
 
-#if defined(MBEDTLS_CIPHER_C)
+#if defined(MBEDTLS_BLOCK_CIPHER_C)
+    ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, h, h);
+#else
     size_t olen = 0;
     ret = mbedtls_cipher_update(&ctx->cipher_ctx, h, 16, h, &olen);
-#else
-    ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, h, h);
 #endif
     if (ret != 0) {
         return ret;
@@ -139,7 +139,17 @@
         return MBEDTLS_ERR_GCM_BAD_INPUT;
     }
 
-#if defined(MBEDTLS_CIPHER_C)
+#if defined(MBEDTLS_BLOCK_CIPHER_C)
+    mbedtls_block_cipher_free(&ctx->block_cipher_ctx);
+
+    if ((ret = mbedtls_block_cipher_setup(&ctx->block_cipher_ctx, cipher)) != 0) {
+        return ret;
+    }
+
+    if ((ret = mbedtls_block_cipher_setkey(&ctx->block_cipher_ctx, key, keybits)) != 0) {
+        return ret;
+    }
+#else
     const mbedtls_cipher_info_t *cipher_info;
 
     cipher_info = mbedtls_cipher_info_from_values(cipher, keybits,
@@ -162,16 +172,6 @@
                                      MBEDTLS_ENCRYPT)) != 0) {
         return ret;
     }
-#else
-    mbedtls_block_cipher_free(&ctx->block_cipher_ctx);
-
-    if ((ret = mbedtls_block_cipher_setup(&ctx->block_cipher_ctx, cipher)) != 0) {
-        return ret;
-    }
-
-    if ((ret = mbedtls_block_cipher_setkey(&ctx->block_cipher_ctx, key, keybits)) != 0) {
-        return ret;
-    }
 #endif
 
     if ((ret = gcm_gen_table(ctx)) != 0) {
@@ -277,7 +277,7 @@
     const unsigned char *p;
     size_t use_len;
     uint64_t iv_bits;
-#if defined(MBEDTLS_CIPHER_C)
+#if !defined(MBEDTLS_BLOCK_CIPHER_C)
     size_t olen = 0;
 #endif
 
@@ -320,10 +320,10 @@
     }
 
 
-#if defined(MBEDTLS_CIPHER_C)
-    ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->y, 16, ctx->base_ectr, &olen);
-#else
+#if defined(MBEDTLS_BLOCK_CIPHER_C)
     ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->y, ctx->base_ectr);
+#else
+    ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->y, 16, ctx->base_ectr, &olen);
 #endif
     if (ret != 0) {
         return ret;
@@ -419,11 +419,11 @@
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
-#if defined(MBEDTLS_CIPHER_C)
+#if defined(MBEDTLS_BLOCK_CIPHER_C)
+    ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->y, ectr);
+#else
     size_t olen = 0;
     ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->y, 16, ectr, &olen);
-#else
-    ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->y, ectr);
 #endif
     if (ret != 0) {
         mbedtls_platform_zeroize(ectr, 16);
@@ -649,10 +649,10 @@
     if (ctx == NULL) {
         return;
     }
-#if defined(MBEDTLS_CIPHER_C)
-    mbedtls_cipher_free(&ctx->cipher_ctx);
-#else
+#if defined(MBEDTLS_BLOCK_CIPHER_C)
     mbedtls_block_cipher_free(&ctx->block_cipher_ctx);
+#else
+    mbedtls_cipher_free(&ctx->cipher_ctx);
 #endif
     mbedtls_platform_zeroize(ctx, sizeof(mbedtls_gcm_context));
 }