Add EVP_AEAD API for XAES-256-GCM with Key Commitment

[ttunglee]

1. Add XAES-256-GCM, which is extended AES-256-GCM with a derived key mode proposed by Filippo Valsorda in 2023, followed by a specification released in 2024. The key commitment extension follows https://eprint.iacr.org/2025/758.pdf#page=6.
2. This implementation supports EVP_CIPHER API and uses an optimized CMAC dedicated to the specific use case of XAES-256-GCM from XAES-256-GCM #2652 to derive subkeys and key commitments.
3. Support varying nonce sizes: 20 ≤ b ≤ 24 based on the extension: https://eprint.iacr.org/2025/758.pdf#page=24

Description of Changes

1. Implementation for API EVP_AEAD of XAES-256-GCM with Key Commitment is appended to e_aes.c
2. The tests are put in xaes_256_gcm_kc_tests.txt. Negative tests are also added: https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/aead_test.cc#L1669, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/aead_test.cc#L1852, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/aead_test.cc#L1860.
3. Adding negative tests failing invalid key commitment: https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/aead_test.cc#L1825, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/cipher_test.cc#L1757.
4. Enable extra_in data to support AWS-LC-RS: https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2049, https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2326.

Testing

Reuse the test vectors in #2809 with our own added key commitment values, similar to #2826.

./crypto_test --gtest_filter='All/PerAEADTest.*'
./crypto_test --gtest_filter='CipherTest.*'

Modifications compared with #2652

1. Optimize CMAC-based Key Commitment: https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2073
2. Add full test cases based on Implementation of XAES-256-GCM with EVP_CIPHER Implementation of XAES-256-GCM with EVP_AEAD #2809.
3. Adapt to varying tag sizes: https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2203, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2218, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2273
4. Support < 24-byte nonce sizes: https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2084, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2085, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2247, https://github.com/ttungle96/aws-lc/blob/xaes-256-gcm/crypto/fipsmodule/cipher/e_aes.c#L2315.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.41379% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.33%. Comparing base (cdccd62) to head (0486571).

Files with missing lines	Patch %	Lines
crypto/fipsmodule/cipher/e_aes.c	95.38%	3 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##           xaes-256-gcm    #2862   +/-   ##
=============================================
  Coverage         78.32%   78.33%           
=============================================
  Files               683      683           
  Lines            117745   117822   +77     
  Branches          16516    16527   +11     
=============================================
+ Hits              92226    92293   +67     
- Misses            24633    24642    +9     
- Partials            886      887    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nebeid]

Do we need to test with a truncated key commitment for both EVP and AEAD?

[ttunglee]

I have added tests for truncated key commitment of EVP_CIPHER:
https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/cipher_test.cc#L1704
https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/cipher_test.cc#L1748
https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/cipher_test.cc#L1788
https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/cipher_test.cc#L1796

[nebeid]

Did we decide in the design that we want to support this case or we error out as this would not be a key commitment cipher so someone calling it doesn't think key commitment exists in the tag?

[ttunglee]

Not yet. I just realized this issue when putting EVP_aead_xaes_256_gcm_kc into aead_test: https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/aead_test.cc#L100

With flag kCanTruncateTags enabled, it will execute this test, which needs to process truncated MAC+KC properly:
https://github.com/ttunglee/aws-lc/blob/xaes-256-gcm/crypto/cipher_extra/aead_test.cc#L703

To process the case you mentioned, it is needed to remove the kCanTruncateTags for EVP_aead_xaes_256_gcm_kc, otherwise the test will fail.

[nebeid]

Here and in open_gather, we can replace key_commit with kc or the other way around in init function.

[ttunglee]

Thank you! I'll change to make it consistent.

[nebeid]

Before integrating into main, we need to consider:

• Do we want to keep the current design which allows the case of truncated tags to 16 bytes or less? This will not contain key commitment despite that the caller may be thinking that the API will still produce some key commitment.
  • it's tricky to know whether the caller wants to truncate the GCM tag or the key commitment tag in this case.
  • if we don't allow it, as Tung mentioned in #2862 (comment), we will need to test it with a new flag other than kCanTruncateTags, which starts at tag length of 0, or just create a separate test for it.
• We should test the correctness of the key commitment using the CMAC API to calculate it separately since we don't have a source for test vectors.