29673219783

Committed 18 Jul 2026 10:42PM UTC coverage: 89.416% (+0.009%) from 89.407%

Build # 29673219783

Build Type

push

github

Committed by

randombit

Commit Message

Fix EC_Scalar_Data_BN::square_self

It computed the square then failed to update the stored value

Coverage Stats

114352 of 127887 relevant lines covered (89.42%)

10766049.99 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

96.36

/src/lib/mac/gmac/gmac.cpp

/*
 * GMAC
 * (C) 2016 Matthias Gierlings, René Korthaus
 * (C) 2017 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */

#include <botan/internal/gmac.h>

#include <botan/block_cipher.h>
#include <botan/exceptn.h>
#include <botan/mem_ops.h>
#include <botan/internal/fmt.h>
#include <botan/internal/ghash.h>

namespace Botan {

GMAC::GMAC(std::unique_ptr<BlockCipher> cipher) :
      m_cipher(std::move(cipher)), m_ghash(std::make_unique<GHASH>()), m_H(GCM_BS), m_initialized(false) {
   if(m_cipher->block_size() != GCM_BS) {
      throw Invalid_Argument(fmt("Invalid block cipher {} for GMAC", m_cipher->name()));
   }
}

void GMAC::clear() {
   m_cipher->clear();
   m_ghash->clear();
   zeroise(m_H);
   m_initialized = false;
}

GMAC::~GMAC() = default;

Key_Length_Specification GMAC::key_spec() const {
   return m_cipher->key_spec();
}

std::string GMAC::name() const {
   return fmt("GMAC({})", m_cipher->name());
}

std::string GMAC::provider() const {
   return m_ghash->provider();
}

size_t GMAC::output_length() const {
   return GCM_BS;
}

void GMAC::add_data(std::span<const uint8_t> input) {
   if(!m_initialized) {
      throw Invalid_State("GMAC was not used with a fresh nonce");
   }
   m_ghash->update_associated_data(input);
}

bool GMAC::has_keying_material() const {
   return m_cipher->has_keying_material();
}

void GMAC::key_schedule(std::span<const uint8_t> key) {
   clear();
   m_cipher->set_key(key);

   m_cipher->encrypt(m_H);
   m_ghash->set_key(m_H);
}

void GMAC::start_msg(std::span<const uint8_t> nonce) {
   if(nonce.empty()) {
      throw Invalid_IV_Length(name(), nonce.size());
   }

   std::array<uint8_t, GCM_BS> y0 = {0};

   // Clear any AD accumulated by a prior start() that was never finalized
   m_ghash->reset_state();
   m_ghash->reset_associated_data();

   if(nonce.size() == 12) {
      copy_mem(y0.data(), nonce.data(), nonce.size());
      y0[GCM_BS - 1] = 1;
   } else {
      m_ghash->nonce_hash(y0, nonce);
   }

   m_cipher->encrypt(y0.data());
   m_ghash->start(y0);
   m_initialized = true;
}

void GMAC::final_result(std::span<uint8_t> mac) {
   // This ensures the GMAC computation has been initialized with a fresh
   // nonce. The aim of this check is to prevent developers from re-using
   // nonces (and potential nonce-reuse attacks).
   if(!m_initialized) {
      throw Invalid_State("GMAC was not used with a fresh nonce");
   }

   m_ghash->final(mac.first(output_length()));
   m_ghash->reset_associated_data();
}

std::unique_ptr<MessageAuthenticationCode> GMAC::new_object() const {
   return std::make_unique<GMAC>(m_cipher->new_object());
}
}  // namespace Botan

1	/*
2	* GMAC
3	* (C) 2016 Matthias Gierlings, René Korthaus
4	* (C) 2017 Jack Lloyd
5	*
6	* Botan is released under the Simplified BSD License (see license.txt)
7	*/
8
9	#include <botan/internal/gmac.h>
10
11	#include <botan/block_cipher.h>
12	#include <botan/exceptn.h>
13	#include <botan/mem_ops.h>
14	#include <botan/internal/fmt.h>
15	#include <botan/internal/ghash.h>
16
17	namespace Botan {
18
19	GMAC::GMAC(std::unique_ptr<BlockCipher> cipher) :	1,717✔
20	m_cipher(std::move(cipher)), m_ghash(std::make_unique<GHASH>()), m_H(GCM_BS), m_initialized(false) {	1,717✔
21	if(m_cipher->block_size() != GCM_BS) {	1,717✔
22	throw Invalid_Argument(fmt("Invalid block cipher {} for GMAC", m_cipher->name()));	×
23	}
24	}	1,717✔
25
26	void GMAC::clear() {	6,833✔
27	m_cipher->clear();	6,833✔
28	m_ghash->clear();	6,833✔
29	zeroise(m_H);	6,833✔
30	m_initialized = false;	6,833✔
31	}	6,833✔
32
33	GMAC::~GMAC() = default;	5,151✔
34
35	Key_Length_Specification GMAC::key_spec() const {	5,692✔
36	return m_cipher->key_spec();	5,692✔
37	}
38
39	std::string GMAC::name() const {	1,717✔
40	return fmt("GMAC({})", m_cipher->name());	1,717✔
41	}
42
43	std::string GMAC::provider() const {	572✔
44	return m_ghash->provider();	572✔
45	}
46
47	size_t GMAC::output_length() const {	6,834✔
48	return GCM_BS;	6,834✔
49	}
50
51	void GMAC::add_data(std::span<const uint8_t> input) {	11,344✔
52	if(!m_initialized) {	11,344✔
53	throw Invalid_State("GMAC was not used with a fresh nonce");	1,144✔
54	}
55	m_ghash->update_associated_data(input);	10,200✔
56	}	10,200✔
57
58	bool GMAC::has_keying_material() const {	1,716✔
59	return m_cipher->has_keying_material();	1,716✔
60	}
61
62	void GMAC::key_schedule(std::span<const uint8_t> key) {	5,689✔
63	clear();	5,689✔
64	m_cipher->set_key(key);	5,689✔
65
66	m_cipher->encrypt(m_H);	5,689✔
67	m_ghash->set_key(m_H);	5,689✔
68	}	5,689✔
69
70	void GMAC::start_msg(std::span<const uint8_t> nonce) {	7,977✔
71	if(nonce.empty()) {	7,977✔
72	throw Invalid_IV_Length(name(), nonce.size());	×
73	}
74
75	std::array<uint8_t, GCM_BS> y0 = {0};	7,977✔
76
77	// Clear any AD accumulated by a prior start() that was never finalized
78	m_ghash->reset_state();	7,977✔
79	m_ghash->reset_associated_data();	7,977✔
80
81	if(nonce.size() == 12) {	7,977✔
82	copy_mem(y0.data(), nonce.data(), nonce.size());	7,921✔
83	y0[GCM_BS - 1] = 1;	7,921✔
84	} else {
85	m_ghash->nonce_hash(y0, nonce);	56✔
86	}
87
88	m_cipher->encrypt(y0.data());	7,977✔
89	m_ghash->start(y0);	7,977✔
90	m_initialized = true;	7,977✔
91	}	7,977✔
92
93	void GMAC::final_result(std::span<uint8_t> mac) {	6,261✔
94	// This ensures the GMAC computation has been initialized with a fresh
95	// nonce. The aim of this check is to prevent developers from re-using
96	// nonces (and potential nonce-reuse attacks).
97	if(!m_initialized) {	6,261✔
98	throw Invalid_State("GMAC was not used with a fresh nonce");	572✔
99	}
100
101	m_ghash->final(mac.first(output_length()));	5,689✔
102	m_ghash->reset_associated_data();	5,689✔
103	}	5,689✔
104
105	std::unique_ptr<MessageAuthenticationCode> GMAC::new_object() const {	572✔
106	return std::make_unique<GMAC>(m_cipher->new_object());	572✔
107	}
108	} // namespace Botan

randombit / botan / 29673219783

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous