impl test for ghash, polyval

circuits/aes-gcm/gfmulx.circom

@@ -0,0 +1,115 @@
+pragma circom 2.1.9;
+
+// include "circomlib/circuits/gates.circom";
+include "helper_functions.circom";
+
+// compute x * `in` over ghash polynomial
+// ghash irreducible polynomial x^128 = x^7 + x^2 + x + 1
+//
+// spec: 
+// https://tools.ietf.org/html/rfc8452#appendix-A
+template ghash_GFMULX() {
+    signal input in[128];
+    signal output out[128];
+    var msb = in[127];
+
+    // v = in right-shifted by 1
+    signal v[128];
+    v[0] <== 0;
+    for (var i = 1; i < 128; i++) { v[i] <== in[i-1]; }
+
+    // if MSB set, assign irreducible poly bits, otherwise zero
+    // irreducible_poly has 1s at positions 1, 2, 7, 127
+    signal irreducible_poly[128];
+    for (var i = 0; i < 128; i++) {
+        if (i==0 || i == 1 || i==6 || i==127) { 
+            irreducible_poly[i] <== msb;
+        } else {
+            irreducible_poly[i] <== 0;
+        }
+    }
+
+    component xor = BitwiseXor(128);
+    xor.a <== v;
+    xor.b <== irreducible_poly;
+    out <== xor.out;
+}
+
+// compute x * `in` over polyval polynomial
+// polyval irreducible polynomial x^128 = x^127 + x^126 + x^121 + 1
+//
+// spec: 
+// https://tools.ietf.org/html/rfc8452#appendix-A
+//
+// rust-crypto reference implementation: 
+// https://github.com/RustCrypto/universal-hashes/blob/master/polyval/src/mulx.rs#L11
+template polyval_GFMULX() {
+    signal input in[128];
+    signal output out[128];
+    // v = in << 1;  observe that LE makes this less straightforward
+    signal v[128];
+    // if MSB set, assign irreducible poly bits, otherwise zero
+    signal irreducible_poly[128];
+    var msb = in[128 - 8];
+
+    component left_shift = LeftShiftLE(1);
+    for (var i = 0; i < 128; i++) {
+        left_shift.in[i] <== in[i];
+    }
+    for (var i = 0; i < 128; i++) {
+        v[i] <== left_shift.out[i];
+    }
+
+    // irreducible_poly has 1s at positions 1, 121, 126, 127
+    // 0000 0001... <== encodes 1
+    // ...1100 0010 <== encodes 121, 126, 127
+    // ...0100 0010 <== encodes 121, 126
+    for (var i = 0; i < 128; i++) {
+        // if (i==7 || i == 120 || i==121 || i==126) { // passes rust-crypto
+        if (i==7 || i==121 || i==126) { // passes ietf spec?
+            irreducible_poly[i] <== msb;
+        } else {
+            irreducible_poly[i] <== 0;
+        }
+    }
+
+    component xor = BitwiseXor(128);
+    xor.a <== v;
+    xor.b <== irreducible_poly;
+    out <== xor.out;
+}
+
+
+// Left shift a 128-bit little-endian array by `shift` bits
+//
+// example for 16 bit-array shifted by 1 bit:
+// in  = [h g f e d c b a, p o n m l k j i]
+// mid1= [a b c d e f g h, i j k l m n o p] // swap order of bits in each byte
+// mid2= [0 a b c d e f g, h i j k l m n o] // shift bits right by 1
+// out = [g f e d c b a 0, o n m l k j i h] // swap order of bits in each byte
+// TODO(TK 2024-08-15): optimize
+template LeftShiftLE(shift) {
+    signal input in[128];
+    signal output out[128];
+    signal mid_1[128];
+    signal mid_2[128]; 
+
+    for (var i = 0; i < 16; i++) {
+        for (var j = 0; j < 8; j++) {
+            mid_1[j + 8*i] <== in[7-j + 8*i];
+        }
+    }
+
+    for (var i = 0; i < shift; i++) {
+        mid_2[i] <== 0;
+    }
+    for (var i = shift; i < 128; i++) {
+        mid_2[i] <== mid_1[i - shift];
+    }
+
+    for (var i = 0; i < 16; i++) {
+        for (var j = 0; j < 8; j++) {
+            out[j + 8*i] <== mid_2[7-j + 8*i];
+        }
+    }
+}

circuits/aes-gcm/hashes.circom

@@ -0,0 +1,147 @@
+pragma circom 2.1.9;
+
+include "gfmul_int.circom";
+include "helper_functions.circom";
+
+// GHASH computes the authentication tag for AES-GCM.
+// Inputs:
+// - `H` the hash key
+// - `AAD` authenticated additional data
+// - `msg` the message to authenticate
+// 
+// Outputs:
+// - `result` the authentication tag
+//
+// Computes:
+// let M = pad(AAD) || pad(msg) || len_64(AAD) || let_64(msg)
+// X_0 = 0^128
+// X_{i+1} = (X_i xor M_{i+1}) * H
+// output: X_{n+1} where n is the number of blocks.
+template GHASH(n_msg_bits) {
+    signal input msg[n_msg_bits]; 
+    signal input H[128]; 
+    // signal input AAD[128]; // included in msg
+    signal output out[128];
+
+    for (var i = 0; i < 128; i++) {
+        out[i] <== 1;
+    }
+
+}
+
+// {
+//     signal input msg[n_msg_bits]; 
+//     signal input H[128]; 
+//     signal input AAD[2][64];
+//     signal output result[2][64];
+
+//     var n_msg_bytes = n_msg_bits/8; 
+//     var current_res[2][64] = AAD, in_t[2][64]; // result intermediate state
+//     var i, j, k;
+//     var n_msg_blocks = n_msg_bytes/16; 
+
+//     component xor_1[n_msg_blocks][2][64];
+//     component gfmul_int_1[n_msg_blocks];
+
+//     if(n_msg_blocks != 0)
+//     {
+//         // for each bit in the message
+//         for(i=0; i<n_msg_blocks; i++)
+//         {
+//             // 
+//             for(j=0; j<64; j++)
+//             {
+//                 in_t[0][j] = msg[2*i*64+j];
+//                 in_t[1][j] = msg[(2*i+1)*64+j];
+//             }
+
+//             for(j=0; j<2; j++)
+//             {
+//                 for(k=0; k<64; k++)
+//                 {
+//                     xor_1[i][j][k] = XOR();
+//                     xor_1[i][j][k].a <== current_res[j][k];
+//                     xor_1[i][j][k].b <== in_t[j][k];
+
+//                     current_res[j][k] = xor_1[i][j][k].out;
+//                 }
+//             }
+
+//             gfmul_int_1[i] = GFMULInt();
+//             for(j=0; j<2; j++)
+//             {
+//                 for(k=0; k<64; k++)
+//                 {
+//                     gfmul_int_1[i].a[j][k] <== current_res[j][k];
+//                     gfmul_int_1[i].b[j][k] <== H[j*64+k];
+//                 }
+//             }
+
+//             current_res = gfmul_int_1[i].res;
+//         }
+//     }
+
+//     for(i=0; i<2; i++)
+//     {
+//         for(j=0; j<64; j++) result[i][j] <== current_res[i][j];
+//     }
+// }
+
+
+// template POLYVAL(n_bits)
+// {
+//     var msg_len = n_bits/8;
+//     signal input in[n_bits];
+//     signal input H[128];
+//     signal input T[2][64];
+//     signal output result[2][64];
+
+//     var current_res[2][64] = T, in_t[2][64];
+
+//     var i, j, k;
+//     var blocks = msg_len/16;
+
+//     component xor_1[blocks][2][64];
+//     component gfmul_int_1[blocks];
+
+//     if(blocks != 0)
+//     {
+//         for(i=0; i<blocks; i++)
+//         {
+//             for(j=0; j<64; j++)
+//             {
+//                 in_t[0][j] = in[2*i*64+j];
+//                 in_t[1][j] = in[(2*i+1)*64+j];
+//             }
+
+//             for(j=0; j<2; j++)
+//             {
+//                 for(k=0; k<64; k++)
+//                 {
+//                     xor_1[i][j][k] = XOR();
+//                     xor_1[i][j][k].a <== current_res[j][k];
+//                     xor_1[i][j][k].b <== in_t[j][k];
+
+//                     current_res[j][k] = xor_1[i][j][k].out;
+//                 }
+//             }
+
+//             gfmul_int_1[i] = GFMULInt();
+//             for(j=0; j<2; j++)
+//             {
+//                 for(k=0; k<64; k++)
+//                 {
+//                     gfmul_int_1[i].a[j][k] <== current_res[j][k];
+//                     gfmul_int_1[i].b[j][k] <== H[j*64+k];
+//                 }
+//             }
+
+//             current_res = gfmul_int_1[i].res;
+//         }
+//     }
+
+//     for(i=0; i<2; i++)
+//     {
+//         for(j=0; j<64; j++) result[i][j] <== current_res[i][j];
+//     }
+// }

circuits/aes-gcm/helper_functions.circom

@@ -257,3 +257,15 @@ template ReverseBitsArray(n) {
         out[i] <== in[n-i-1];
     }
 }
+
+// reverse the byte order in a 16 byte array
+template ReverseByteArray() {
+    signal input in[128];
+    signal output out[128];
+
+    for (var i = 0; i < 16; i++) {
+        for (var j = 0; j < 8; j++) {
+            out[j + 8*i] <== in[(15-i)*8 +j];
+        }
+    }
+}