Top Description Inners Fields Constructors Methods
org.bouncycastle.crypto.modes

public Class GCMSIVBlockCipher

extends Object
implements AEADBlockCipher
Class Inheritance
All Implemented Interfaces
org.bouncycastle.crypto.modes.AEADBlockCipher, org.bouncycastle.crypto.modes.AEADCipher
Imports
java.io.ByteArrayOutputStream, org.bouncycastle.crypto.BlockCipher, .CipherParameters, .DataLengthException, .InvalidCipherTextException, .OutputLengthException, org.bouncycastle.crypto.engines.AESEngine, org.bouncycastle.crypto.modes.gcm.GCMMultiplier, .Tables4kGCMMultiplier, org.bouncycastle.crypto.params.AEADParameters, .KeyParameter, .ParametersWithIV, org.bouncycastle.util.Arrays, .Bytes, .Integers, .Longs, .Pack

GCM-SIV Mode.

It should be noted that the specified limit of 236 bytes is not supported. This is because all bytes are cached in a ByteArrayOutputStream object (which has a limit of a little less than 231 bytes), and are output on the doFinal() call (which can only process a maximum of 231 bytes).

The practical limit of 231 - 24 bytes is policed, and attempts to breach the limit will be rejected

In order to properly support the higher limit, an extended form of ByteArrayOutputStream would be needed which would use multiple arrays to store the data. In addition, a new doOutput method would be required (similar to that in XOF digests), which would allow the data to be output over multiple calls. Alternatively an extended form of ByteArrayInputStream could be used to deliver the data.

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
private class

Field Summary

Modifier and TypeField and Description
private static final byte
ADD

The addition constant.

private static final int
AEAD_COMPLETE

The aeadComplete flag.

private static final int
BUFLEN

The buffer length.

private boolean
forEncryption

Are we encrypting?

private static final int
HALFBUFLEN

The halfBuffer length.

private static final int
INIT

The initialisation flag.

private byte[]
private static final byte
MASK

The top bit mask.

private static final int
MAX_DATALEN

The maximum data length (AEAD/PlainText).

private static final int
NONCELEN

The nonce length.

private final GCMSIVBlockCipher.GCMSIVHasher
theAEADHasher

The aeadHasher.

private final BlockCipher
theCipher

The cipher.

private final GCMSIVBlockCipher.GCMSIVHasher
theDataHasher

The dataHasher.

private GCMSIVBlockCipher.GCMSIVCache
theEncData

The encryptedDataStream (decryption only).

private int
theFlags

The flags.

private final byte[]
theGHash

The gHash buffer.

private byte[]
theInitialAEAD

The initialAEAD.

private final GCMMultiplier
theMultiplier

The multiplier.

private byte[]
theNonce

The nonce.

private GCMSIVBlockCipher.GCMSIVCache
thePlain

The plainDataStream.

private final byte[]
theReverse

The reverse buffer.

Constructor Summary

AccessConstructor and Description
public
GCMSIVBlockCipher()

Constructor.

public
GCMSIVBlockCipher(final BlockCipher
the underlying cipher
pCipher
)

Constructor.

public
GCMSIVBlockCipher(final BlockCipher
the underlying cipher
pCipher
,
final GCMMultiplier
the multiplier
pMultiplier
)

Constructor.

Method Summary

Modifier and TypeMethod and Description
private static int

Returns:

the length
bufLength
(final byte[]
the buffere
pBuffer
)

Obtain buffer length (allowing for null).

private byte[]

Returns:

the calculated tag
calculateTag
()

calculate tag.

private void
checkAEADStatus(final int
the aeadLength
pLen
)

check AEAD status.

private static void
checkBuffer(final byte[]
the buffer
pBuffer
,
final int
the offset
pOffset
,
final int
the length
pLen
,
final boolean
is this an output buffer?
pOutput
)

Check buffer.

private void
checkStatus(final int
the dataLength
pLen
)

check status.

private byte[]

Returns:

the calculated value
completePolyVal
()

complete polyVAL.

private void
decryptPlain()

decrypt data stream.

private void
deriveKeys(final KeyParameter
the keyGeneration key
pKey
)

Derive Keys.

public int
doFinal(final byte[]
space for any resulting output data.
pOutput
,
final int
offset into out to start copying the data at.
pOffset
)

Implements org.bouncycastle.crypto.modes.AEADCipher.doFinal.

Finish the operation either appending or verifying the MAC at the end of the data.
private int

Returns:

the length of data encrypted
encryptPlain
(final byte[]
the counter
pCounter
,
final byte[]
the target buffer
pTarget
,
final int
the target offset
pOffset
)

encrypt data stream.

private static void
fillReverse(final byte[]
the input buffer
pInput
,
final int
the offset
pOffset
,
final int
the length of data (<= BUFLEN)
pLength
,
final byte[]
the output buffer
pOutput
)

Byte reverse a buffer.

public String
getAlgorithmName()

Implements org.bouncycastle.crypto.modes.AEADCipher.getAlgorithmName.

Return the name of the algorithm.
public byte[]
getMac()

Implements org.bouncycastle.crypto.modes.AEADCipher.getMac.

Return the value of the MAC associated with the last stream processed.
public int
getOutputSize(final int
the length of the input.
pLen
)

Implements org.bouncycastle.crypto.modes.AEADCipher.getOutputSize.

return the size of the output buffer required for a processBytes plus a doFinal with an input of len bytes.
public BlockCipher
public int
getUpdateOutputSize(final int
the length of the input.
pLen
)

Implements org.bouncycastle.crypto.modes.AEADCipher.getUpdateOutputSize.

return the size of the output buffer required for a processBytes an input of len bytes.
private void
gHASH(final byte[]
the next value
pNext
)

perform the next GHASH step.

private void
gHashLengths()

process lengths.

private static void
incrementCounter(final byte[]
the counter to increment
pCounter
)

increment the counter.

public void
init(final boolean
true if we are setting up for encryption, false otherwise.
pEncrypt
,
final CipherParameters
the necessary parameters for the underlying cipher to be initialised.
cipherParameters
)

Implements org.bouncycastle.crypto.modes.AEADCipher.init.

initialise the underlying cipher.
private static void
mulX(final byte[]
the value to adjust
pValue
)

multiply by X.

public void
processAADByte(final byte
the byte to be processed.
pByte
)

Implements org.bouncycastle.crypto.modes.AEADCipher.processAADByte.

Add a single byte to the associated data check.
public void
processAADBytes(final byte[]
the input byte array.
pData
,
final int
the offset into the in array where the data to be processed starts.
pOffset
,
final int
the number of bytes to be processed.
pLen
)

Implements org.bouncycastle.crypto.modes.AEADCipher.processAADBytes.

Add a sequence of bytes to the associated data check.
public int
processByte(final byte
the byte to be processed.
pByte
,
final byte[]
the output buffer the processed byte goes into.
pOutput
,
final int
the offset into the output byte array the processed data starts at.
pOutOffset
)

Implements org.bouncycastle.crypto.modes.AEADCipher.processByte.

encrypt/decrypt a single byte.
public int
processBytes(final byte[]
the input byte array.
pData
,
final int
the offset into the in array where the data to be processed starts.
pOffset
,
final int
the number of bytes to be processed.
pLen
,
final byte[]
the output buffer the processed bytes go into.
pOutput
,
final int
the offset into the output byte array the processed data starts at.
pOutOffset
)

Implements org.bouncycastle.crypto.modes.AEADCipher.processBytes.

process a block of bytes from in putting the result into out.
public void
private void
resetStreams()

Reset Streams.

private static void
xorBlock(final byte[]
the left operand and result
pLeft
,
final byte[]
the right operand
pRight
)

xor a full block buffer.

private static void
xorBlock(final byte[]
the left operand and result
pLeft
,
final byte[]
the right operand
pRight
,
final int
the offset in the right operand
pOffset
,
final int
the length of data in the right operand
pLength
)

xor a partial block buffer.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ADDback to summary
private static final byte ADD

The addition constant.

AEAD_COMPLETEback to summary
private static final int AEAD_COMPLETE

The aeadComplete flag.

BUFLENback to summary
private static final int BUFLEN

The buffer length.

forEncryptionback to summary
private boolean forEncryption

Are we encrypting?

HALFBUFLENback to summary
private static final int HALFBUFLEN

The halfBuffer length.

INITback to summary
private static final int INIT

The initialisation flag.

macBlockback to summary
private byte[] macBlock
MASKback to summary
private static final byte MASK

The top bit mask.

MAX_DATALENback to summary
private static final int MAX_DATALEN

The maximum data length (AEAD/PlainText). Due to implementation constraints this is restricted to the maximum array length (https://programming.guide/java/array-maximum-length.html) minus the BUFLEN to allow for the MAC

NONCELENback to summary
private static final int NONCELEN

The nonce length.

theAEADHasherback to summary
private final GCMSIVBlockCipher.GCMSIVHasher theAEADHasher

The aeadHasher.

theCipherback to summary
private final BlockCipher theCipher

The cipher.

theDataHasherback to summary
private final GCMSIVBlockCipher.GCMSIVHasher theDataHasher

The dataHasher.

theEncDataback to summary
private GCMSIVBlockCipher.GCMSIVCache theEncData

The encryptedDataStream (decryption only).

theFlagsback to summary
private int theFlags

The flags.

theGHashback to summary
private final byte[] theGHash

The gHash buffer.

theInitialAEADback to summary
private byte[] theInitialAEAD

The initialAEAD.

theMultiplierback to summary
private final GCMMultiplier theMultiplier

The multiplier.

theNonceback to summary
private byte[] theNonce

The nonce.

thePlainback to summary
private GCMSIVBlockCipher.GCMSIVCache thePlain

The plainDataStream.

theReverseback to summary
private final byte[] theReverse

The reverse buffer.

Constructor Detail

GCMSIVBlockCipherback to summary
public GCMSIVBlockCipher()

Constructor.

GCMSIVBlockCipherback to summary
public GCMSIVBlockCipher(final BlockCipher pCipher)

Constructor.

Parameters
pCipher:BlockCipher

the underlying cipher

GCMSIVBlockCipherback to summary
public GCMSIVBlockCipher(final BlockCipher pCipher, final GCMMultiplier pMultiplier)

Constructor.

Parameters
pCipher:BlockCipher

the underlying cipher

pMultiplier:GCMMultiplier

the multiplier

Method Detail

bufLengthback to summary
private static int bufLength(final byte[] pBuffer)

Obtain buffer length (allowing for null).

Parameters
pBuffer:byte[]

the buffere

Returns:int

the length

calculateTagback to summary
private byte[] calculateTag()

calculate tag.

Returns:byte[]

the calculated tag

checkAEADStatusback to summary
private void checkAEADStatus(final int pLen)

check AEAD status.

Parameters
pLen:int

the aeadLength

checkBufferback to summary
private static void checkBuffer(final byte[] pBuffer, final int pOffset, final int pLen, final boolean pOutput)

Check buffer.

Parameters
pBuffer:byte[]

the buffer

pOffset:int

the offset

pLen:int

the length

pOutput:boolean

is this an output buffer?

checkStatusback to summary
private void checkStatus(final int pLen)

check status.

Parameters
pLen:int

the dataLength

completePolyValback to summary
private byte[] completePolyVal()

complete polyVAL.

Returns:byte[]

the calculated value

decryptPlainback to summary
private void decryptPlain() throws InvalidCipherTextException

decrypt data stream.

Exceptions
InvalidCipherTextException:
on data too short or mac check failed
deriveKeysback to summary
private void deriveKeys(final KeyParameter pKey)

Derive Keys.

Parameters
pKey:KeyParameter

the keyGeneration key

doFinalback to summary
public int doFinal(final byte[] pOutput, final int pOffset) throws IllegalStateException, InvalidCipherTextException

Implements org.bouncycastle.crypto.modes.AEADCipher.doFinal.

Doc from org.bouncycastle.crypto.modes.AEADCipher.doFinal.

Finish the operation either appending or verifying the MAC at the end of the data.

Parameters
pOutput:byte[]

space for any resulting output data.

pOffset:int

offset into out to start copying the data at.

Returns:int

number of bytes written into out.

Exceptions
IllegalStateException:
if the cipher is in an inappropriate state.
InvalidCipherTextException:
if the MAC fails to match.
encryptPlainback to summary
private int encryptPlain(final byte[] pCounter, final byte[] pTarget, final int pOffset)

encrypt data stream.

Parameters
pCounter:byte[]

the counter

pTarget:byte[]

the target buffer

pOffset:int

the target offset

Returns:int

the length of data encrypted

fillReverseback to summary
private static void fillReverse(final byte[] pInput, final int pOffset, final int pLength, final byte[] pOutput)

Byte reverse a buffer.

Parameters
pInput:byte[]

the input buffer

pOffset:int

the offset

pLength:int

the length of data (<= BUFLEN)

pOutput:byte[]

the output buffer

getAlgorithmNameback to summary
public String getAlgorithmName()

Implements org.bouncycastle.crypto.modes.AEADCipher.getAlgorithmName.

Doc from org.bouncycastle.crypto.modes.AEADCipher.getAlgorithmName.

Return the name of the algorithm.

Returns:String

the algorithm name.

getMacback to summary
public byte[] getMac()

Implements org.bouncycastle.crypto.modes.AEADCipher.getMac.

Doc from org.bouncycastle.crypto.modes.AEADCipher.getMac.

Return the value of the MAC associated with the last stream processed.

Returns:byte[]

MAC for plaintext data.

getOutputSizeback to summary
public int getOutputSize(final int pLen)

Implements org.bouncycastle.crypto.modes.AEADCipher.getOutputSize.

Doc from org.bouncycastle.crypto.modes.AEADCipher.getOutputSize.

return the size of the output buffer required for a processBytes plus a doFinal with an input of len bytes.

The returned size may be dependent on the initialisation of this cipher and may not be accurate once subsequent input data is processed - this method should be invoked immediately prior to a call to final processing of input data and a call to doFinal(byte[], int).

Parameters
pLen:int

the length of the input.

Returns:int

the space required to accommodate a call to processBytes and doFinal with len bytes of input.

getUnderlyingCipherback to summary
public BlockCipher getUnderlyingCipher()

Implements org.bouncycastle.crypto.modes.AEADBlockCipher.getUnderlyingCipher.

Doc from org.bouncycastle.crypto.modes.AEADBlockCipher.getUnderlyingCipher.

return the BlockCipher this object wraps.

Returns:BlockCipher

the BlockCipher this object wraps.

getUpdateOutputSizeback to summary
public int getUpdateOutputSize(final int pLen)

Implements org.bouncycastle.crypto.modes.AEADCipher.getUpdateOutputSize.

Doc from org.bouncycastle.crypto.modes.AEADCipher.getUpdateOutputSize.

return the size of the output buffer required for a processBytes an input of len bytes.

The returned size may be dependent on the initialisation of this cipher and may not be accurate once subsequent input data is processed - this method should be invoked immediately prior to input data being processed.

Parameters
pLen:int

the length of the input.

Returns:int

the space required to accommodate a call to processBytes with len bytes of input.

gHASHback to summary
private void gHASH(final byte[] pNext)

perform the next GHASH step.

Parameters
pNext:byte[]

the next value

gHashLengthsback to summary
private void gHashLengths()

process lengths.

incrementCounterback to summary
private static void incrementCounter(final byte[] pCounter)

increment the counter.

Parameters
pCounter:byte[]

the counter to increment

initback to summary
public void init(final boolean pEncrypt, final CipherParameters cipherParameters) throws IllegalArgumentException

Implements org.bouncycastle.crypto.modes.AEADCipher.init.

Doc from org.bouncycastle.crypto.modes.AEADCipher.init.

initialise the underlying cipher. Parameter can either be an AEADParameters or a ParametersWithIV object.

Parameters
pEncrypt:boolean

true if we are setting up for encryption, false otherwise.

cipherParameters:CipherParameters

the necessary parameters for the underlying cipher to be initialised.

Exceptions
IllegalArgumentException:
if the params argument is inappropriate.
mulXback to summary
private static void mulX(final byte[] pValue)

multiply by X.

Parameters
pValue:byte[]

the value to adjust

processAADByteback to summary
public void processAADByte(final byte pByte)

Implements org.bouncycastle.crypto.modes.AEADCipher.processAADByte.

Doc from org.bouncycastle.crypto.modes.AEADCipher.processAADByte.

Add a single byte to the associated data check.
If the implementation supports it, this will be an online operation and will not retain the associated data.

Parameters
pByte:byte

the byte to be processed.

processAADBytesback to summary
public void processAADBytes(final byte[] pData, final int pOffset, final int pLen)

Implements org.bouncycastle.crypto.modes.AEADCipher.processAADBytes.

Doc from org.bouncycastle.crypto.modes.AEADCipher.processAADBytes.

Add a sequence of bytes to the associated data check.
If the implementation supports it, this will be an online operation and will not retain the associated data.

Parameters
pData:byte[]

the input byte array.

pOffset:int

the offset into the in array where the data to be processed starts.

pLen:int

the number of bytes to be processed.

processByteback to summary
public int processByte(final byte pByte, final byte[] pOutput, final int pOutOffset) throws DataLengthException

Implements org.bouncycastle.crypto.modes.AEADCipher.processByte.

Doc from org.bouncycastle.crypto.modes.AEADCipher.processByte.

encrypt/decrypt a single byte.

Parameters
pByte:byte

the byte to be processed.

pOutput:byte[]

the output buffer the processed byte goes into.

pOutOffset:int

the offset into the output byte array the processed data starts at.

Returns:int

the number of bytes written to out.

Exceptions
DataLengthException:
if the output buffer is too small.
processBytesback to summary
public int processBytes(final byte[] pData, final int pOffset, final int pLen, final byte[] pOutput, final int pOutOffset) throws DataLengthException

Implements org.bouncycastle.crypto.modes.AEADCipher.processBytes.

Doc from org.bouncycastle.crypto.modes.AEADCipher.processBytes.

process a block of bytes from in putting the result into out.

Parameters
pData:byte[]

the input byte array.

pOffset:int

the offset into the in array where the data to be processed starts.

pLen:int

the number of bytes to be processed.

pOutput:byte[]

the output buffer the processed bytes go into.

pOutOffset:int

the offset into the output byte array the processed data starts at.

Returns:int

the number of bytes written to out.

Exceptions
DataLengthException:
if the output buffer is too small.
resetback to summary
public void reset()

Implements org.bouncycastle.crypto.modes.AEADCipher.reset.

Doc from org.bouncycastle.crypto.modes.AEADCipher.reset.

Reset the cipher. After resetting the cipher is in the same state as it was after the last init (if there was one).

resetStreamsback to summary
private void resetStreams()

Reset Streams.

xorBlockback to summary
private static void xorBlock(final byte[] pLeft, final byte[] pRight)

xor a full block buffer.

Parameters
pLeft:byte[]

the left operand and result

pRight:byte[]

the right operand

xorBlockback to summary
private static void xorBlock(final byte[] pLeft, final byte[] pRight, final int pOffset, final int pLength)

xor a partial block buffer.

Parameters
pLeft:byte[]

the left operand and result

pRight:byte[]

the right operand

pOffset:int

the offset in the right operand

pLength:int

the length of data in the right operand

org.bouncycastle.crypto.modes back to summary

private Class GCMSIVBlockCipher.GCMSIVCache

extends ByteArrayOutputStream
Class Inheritance

GCMSIVCache.

Field Summary

Inherited from java.io.ByteArrayOutputStream:
bufcount

Constructor Summary

AccessConstructor and Description
pack-priv
GCMSIVCache()

Constructor.

Method Summary

Modifier and TypeMethod and Description
pack-priv void
clearBuffer()

Clear the buffer.

pack-priv byte[]

Returns:

the buffer
getBuffer
()

Obtain the buffer.

Inherited from java.io.ByteArrayOutputStream:
closeresetsizetoByteArraytoStringtoStringtoStringtoStringwritewritewriteByteswriteTo

Constructor Detail

GCMSIVCacheback to summary
pack-priv GCMSIVCache()

Constructor.

Method Detail

clearBufferback to summary
pack-priv void clearBuffer()

Clear the buffer.

getBufferback to summary
pack-priv byte[] getBuffer()

Obtain the buffer.

Returns:byte[]

the buffer

org.bouncycastle.crypto.modes back to summary

private Class GCMSIVBlockCipher.GCMSIVHasher

extends Object
Class Inheritance

Hash Control.

Field Summary

Modifier and TypeField and Description
private int
numActive

Count of active bytes in cache.

private long
numHashed

Count of hashed bytes.

private final byte[]
theBuffer

Cache.

private final byte[]
theByte

Single byte cache.

Constructor Summary

AccessConstructor and Description
private

Method Summary

Modifier and TypeMethod and Description
pack-priv void
completeHash()

complete hash.

pack-priv long

Returns:

the count
getBytesProcessed
()

Obtain the count of bytes hashed.

pack-priv void
reset()

Reset the hasher.

pack-priv void
updateHash(final byte
the byte
pByte
)

update hash.

pack-priv void
updateHash(final byte[]
the buffer
pBuffer
,
final int
the offset within the buffer
pOffset
,
final int
the length of data
pLen
)

update hash.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

numActiveback to summary
private int numActive

Count of active bytes in cache.

numHashedback to summary
private long numHashed

Count of hashed bytes.

theBufferback to summary
private final byte[] theBuffer

Cache.

theByteback to summary
private final byte[] theByte

Single byte cache.

Constructor Detail

GCMSIVHasherback to summary
private GCMSIVHasher()

Method Detail

completeHashback to summary
pack-priv void completeHash()

complete hash.

getBytesProcessedback to summary
pack-priv long getBytesProcessed()

Obtain the count of bytes hashed.

Returns:long

the count

resetback to summary
pack-priv void reset()

Reset the hasher.

updateHashback to summary
pack-priv void updateHash(final byte pByte)

update hash.

Parameters
pByte:byte

the byte

updateHashback to summary
pack-priv void updateHash(final byte[] pBuffer, final int pOffset, final int pLen)

update hash.

Parameters
pBuffer:byte[]

the buffer

pOffset:int

the offset within the buffer

pLen:int

the length of data