tweak belt-dwp bundled ghash, use polyval as inner

belt-dwp/Cargo.toml

@@ -16,6 +16,7 @@ aead = { version = "0.6", default-features = false }
 belt-block = "0.2"
 belt-ctr = "0.2"
 universal-hash = "0.6"
+polyval = { version = "0.7", default-features = false, features = ["hazmat"] }
 subtle = { version = "2", default-features = false }
 zeroize = { version = "1.8", default-features = false, optional = true }
 
@@ -30,7 +31,7 @@ bytes = ["aead/bytes"]
 getrandom = ["aead/getrandom"]
 rand_core = ["aead/rand_core"]
 reduced-round = []
-zeroize = ["dep:zeroize", "belt-ctr/zeroize"]
+zeroize = ["dep:zeroize", "belt-ctr/zeroize", "polyval/zeroize"]
 
 [lints]
 workspace = true

belt-dwp/src/ghash.rs

@@ -1,10 +1,9 @@
 use aead::array::Array;
-use aead::consts::{U1, U16};
+use aead::consts::{U4, U16};
 use aead::{KeyInit, KeySizeUser};
 use belt_block::cipher::{BlockSizeUser, ParBlocksSizeUser};
-use universal_hash::{Reset, UhfBackend, UhfClosure, UniversalHash};
-
-use crate::gf::gf128_soft64::Element;
+use polyval::{Polyval, hazmat::FieldElement};
+use universal_hash::{ParBlocks, UhfBackend, UhfClosure, UniversalHash};
 
 /// GHASH keys (16-bytes)
 pub type Key = Array<u8, U16>;
@@ -15,10 +14,17 @@ pub type Block = Array<u8, U16>;
 /// GHASH tags (16-bytes)
 pub type Tag = Array<u8, U16>;
 
+/// Convert a block between the STB and POLYVAL
+#[inline(always)]
+fn convert(block: &Block) -> u128 {
+    u128::from_le_bytes((*block).into()).reverse_bits()
+}
+
 #[derive(Clone)]
 pub struct GHash {
-    s: Element,
-    h: Element,
+    polyval: Polyval,
+    /// Initial `t` value in POLYVAL's representation, folded into the first processed block.
+    init: u128,
 }
 
 impl KeySizeUser for GHash {
@@ -37,20 +43,32 @@ impl KeyInit for GHash {
 
 impl GHash {
     pub(crate) fn new_with_init_block(h: &Key, s: u128) -> Self {
+        let h = FieldElement::from(convert(h)).mulx();
+
         Self {
-            s: Element::from(s),
-            h: Element::from(h),
+            polyval: Polyval::new(&h.into()),
+            init: s,
         }
     }
 }
 
 impl ParBlocksSizeUser for GHash {
-    type ParBlocksSize = U1;
+    type ParBlocksSize = U4;
 }
 
 impl UhfBackend for GHash {
     fn proc_block(&mut self, x: &Block) {
-        self.s = (self.s + Element::from(x)) * self.h;
+        let x = convert(x) ^ core::mem::take(&mut self.init);
+        self.polyval.proc_block(&x.to_le_bytes().into());
+    }
+
+    fn proc_par_blocks(&mut self, blocks: &ParBlocks<Self>) {
+        let init = core::mem::take(&mut self.init);
+        let blocks = ParBlocks::<Self>::from_fn(|i| {
+            let x = convert(&blocks[i]) ^ if i == 0 { init } else { 0 };
+            x.to_le_bytes().into()
+        });
+        self.polyval.proc_par_blocks(&blocks);
     }
 }
 
@@ -62,12 +80,31 @@ impl UniversalHash for GHash {
     /// Get GHASH output
     #[inline]
     fn finalize(self) -> Tag {
-        self.s.into()
+        convert(&self.polyval.finalize()).to_le_bytes().into()
     }
 }
 
-impl Reset for GHash {
-    fn reset(&mut self) {
-        self.s = Element::default();
+/// Tests from Appendix A, table 18 of [STB 34.101.31-2020](https://apmi.bsu.by/assets/files/std/belt-spec372.pdf)
+#[test]
+fn test_a18() {
+    use hex_literal::hex;
+
+    let test_vectors = [
+        (
+            hex!("34904055 11BE3297 1343724C 5AB793E9"),
+            hex!("22481783 8761A9D6 E3EC9689 110FB0F3"),
+            hex!("0001D107 FC67DE40 04DC2C80 3DFD95C3"),
+        ),
+        (
+            hex!("703FCCF0 95EE8DF1 C1ABF8EE 8DF1C1AB"),
+            hex!("2055704E 2EDB48FE 87E74075 A5E77EB1"),
+            hex!("4A5C9593 8B3FE8F6 74D59BC1 EB356079"),
+        ),
+    ];
+
+    for (u, v, w) in test_vectors {
+        let mut hash = GHash::new(&Block::from(v));
+        hash.update(&[Block::from(u)]);
+        assert_eq!(hash.finalize(), Block::from(w));
     }
 }

belt-dwp/src/lib.rs

@@ -92,13 +92,12 @@ use universal_hash::typenum::{IsLessOrEqual, NonZero};
 /// Nonce type for [`Dwp`]
 pub type Nonce = aead::Nonce<BeltDwp>;
 
-mod gf;
 mod ghash;
 
 use ghash::GHash;
 
-/// Constant `T` from the STB 34.101.31-2020
-const T: u128 = 0xE45D_4A58_8E00_6D36_3BF5_080A_C8BA_94B1;
+/// Constant `T` from the STB 34.101.31-2020, in POLYVAL's representation
+const T: u128 = 0xE45D_4A58_8E00_6D36_3BF5_080A_C8BA_94B1_u128.reverse_bits();
 
 /// `belt-dwp` authenticated encryption with associated data (AEAD) cipher,
 /// defined in STB 34.101.31-2020.
@@ -182,7 +181,7 @@ where
         ghash.update_padded(&sizes_block);
 
         // 6. 𝑡 ← belt-block(𝑡 * 𝑟, 𝐾).
-        let mut tag = ghash.finalize_reset();
+        let mut tag = ghash.finalize();
         self.cipher.encrypt_block(&mut tag);
 
         tag[..TagSize::USIZE].try_into().map_err(|_| Error)
@@ -222,7 +221,7 @@ where
         ghash.update_padded(&sizes_block);
 
         // 6. 𝑡 ← belt-block(𝑡 * 𝑟, 𝐾).
-        let mut tag_exact = ghash.finalize_reset();
+        let mut tag_exact = ghash.finalize();
         self.cipher.encrypt_block(&mut tag_exact);
 
         use subtle::ConstantTimeEq;