crypt.tex

\documentclass[synpaper]{book}
\usepackage{geometry}
\usepackage{hyperref}
\usepackage{makeidx}
\usepackage{amssymb}
\usepackage{color}
\usepackage{alltt}
\usepackage{graphicx}
\usepackage{layout}
\usepackage{fancyhdr}
\usepackage{float}
\def\union{\cup}
\def\intersect{\cap}
\def\getsrandom{\stackrel{\rm R}{\gets}}
\def\cross{\times}
\def\cat{\hspace{0.5em} \| \hspace{0.5em}}
\def\catn{$\|$}
\def\divides{\hspace{0.3em} | \hspace{0.3em}}
\def\nequiv{\not\equiv}
\def\approx{\raisebox{0.2ex}{\mbox{\small $\sim$}}}
\def\lcm{{\rm lcm}}
\def\gcd{{\rm gcd}}
\def\log{{\rm log}}
\def\ord{{\rm ord}}
\def\abs{{\mathit abs}}
\def\rep{{\mathit rep}}
\def\mod{{\mathit\ mod\ }}
\renewcommand{\pmod}[1]{\ ({\rm mod\ }{#1})}
\newcommand{\floor}[1]{\left\lfloor{#1}\right\rfloor}
\newcommand{\ceil}[1]{\left\lceil{#1}\right\rceil}
\def\Or{{\rm\ or\ }}
\def\And{{\rm\ and\ }}
\def\iff{\hspace{1em}\Longleftrightarrow\hspace{1em}}
\def\implies{\Rightarrow}
\def\Proof{\vspace{1ex}\noindent {\bf Proof:}\hspace{1em}}
\let\oldphi\phi
\def\phi{\varphi}
\def\Pr{{\rm Pr}}
\newcommand{\str}[1]{{\mathbf{#1}}}
\def\F{{\mathbb F}}
\def\N{{\mathbb N}}
\def\Z{{\mathbb Z}}
\def\R{{\mathbb R}}
\def\C{{\mathbb C}}
\def\Q{{\mathbb Q}}
\definecolor{DGray}{gray}{0.5}
\newcommand{\emailaddr}[1]{\mbox{$<${#1}$>$}}
\def\twiddle{\raisebox{0.3ex}{\mbox{\tiny $\sim$}}}
\def\gap{\vspace{0.5ex}}
\makeindex
\newcommand{\mysection}[1]    % Re-define the chaptering command to use
	{                   % THESE headers.
	\section{#1}
   \markboth{\textsf{www.libtom.net}}{\thesection ~ {#1}}
	}

\newcommand{\mystarsection}[1]    % Re-define the chaptering command to use
	{                   % THESE headers.
	\section*{#1}
   \markboth{\textsf{www.libtom.net}}{{#1}}
	}
\pagestyle{empty}
\begin{document}
\frontmatter
\pagestyle{empty}

~

\vspace{2in}

~

\begin{center}
\begin{Huge}LibTomCrypt\end{Huge}

~

\begin{large}Developer Manual\end{large}

~

\vspace{15mm}


\begin{tabular}{c}
LibTom Projects
\end{tabular}
\end{center}
\vfil
\newpage
This document is part of the LibTomCrypt package and is hereby released into the public domain.

~

Open Source.  Open Academia.  Open Minds.

~

\begin{flushright}
LibTom Projects
~

\& originally
~

Tom St Denis
~

Ottawa, Ontario
~

Canada
~
\vfil
\end{flushright}
\newpage

\tableofcontents
\listoffigures
\pagestyle{myheadings}
\mainmatter
\chapter{Introduction}
\mysection{What is the LibTomCrypt?}
LibTomCrypt is a portable ISO C cryptographic library meant to be a tool set for cryptographers who are
designing cryptosystems.  It supports symmetric ciphers, one-way hashes, pseudo-random number generators,
public key cryptography (via PKCS \#1 RSA, DH or ECDH), and a plethora of support routines.

The library was designed such that new ciphers/hashes/PRNGs can be added at run-time and the existing API
(and helper API functions) are able to use the new designs automatically.  There exists self-check functions for each
block cipher and hash function to ensure that they compile and execute to the published design specifications.  The library
also performs extensive parameter error checking to prevent any number of run-time exploits or errors.

\mysection{Why did I write it?}
You may be wondering, \textit{Tom, why did you write a crypto library.  I already have one.}  Well the reason falls into
two categories:
\begin{enumerate}
    \item I am too lazy to figure out someone else's API.  I'd rather invent my own simpler API and use that.
    \item It was (still is) good coding practice.
\end{enumerate}

The idea is that I am not striving to replace OpenSSL or Crypto++ or Cryptlib or etc.  I'm trying to write my
{\bf own} crypto library and hopefully along the way others will appreciate the work.

With this library all core functions (ciphers, hashes, prngs, and bignum) have the same prototype definition.  They all load
and store data in a format independent of the platform.  This means if you encrypt with Blowfish on a PPC it should decrypt
on an x86 with zero problems.  The consistent API also means that if you learn how to use Blowfish with the library you
know how to use Safer+, RC6, or Serpent as well.  With all of the core functions there are central descriptor tables
that can be used to make a program automatically pick between ciphers, hashes and PRNGs at run-time.  That means your
application can support all ciphers/hashes/prngs/bignum without changing the source code.

Not only did I strive to make a consistent and simple API to work with but I also attempted to make the library
configurable in terms of its build options.  Out of the box the library will build with any modern version of GCC
without having to use configure scripts.  This means that the library will work with platforms where development
tools may be limited (e.g. no autoconf).

On top of making the build simple and the API approachable I've also attempted for a reasonably high level of
robustness and efficiency.  LibTomCrypt traps and returns a series of errors ranging from invalid
arguments to buffer overflows/overruns.  It is mostly thread safe and has been clocked on various platforms
with \textit{cycles per byte} timings that are comparable (and often favourable) to other libraries such as OpenSSL and
Crypto++.

\subsection{Modular}
The LibTomCrypt package has also been written to be very modular.  The block ciphers, one--way hashes,
pseudo--random number generators (PRNG), and bignum math routines are all used within the API through \textit{descriptor} tables which
are essentially structures with pointers to functions.  While you can still call particular functions
directly (\textit{e.g. sha256\_process()}) this descriptor interface allows the developer to customize their
usage of the library.

For example, consider a hardware platform with a specialized RNG device.  Obviously one would like to tap
that for the PRNG needs within the library (\textit{e.g. making a RSA key}).  All the developer has to do
is write a descriptor and the few support routines required for the device.  After that the rest of the
API can make use of it without change.  Similarly imagine a few years down the road when AES2
(\textit{or whatever they call it}) has been invented.  It can be added to the library and used within applications
with zero modifications to the end applications provided they are written properly.

This flexibility within the library means it can be used with any combination of primitive algorithms and
unlike libraries like OpenSSL is not tied to direct routines.  For instance, in OpenSSL there are CBC block
mode routines for every single cipher.  That means every time you add or remove a cipher from the library
you have to update the associated support code as well.  In LibTomCrypt the associated code (\textit{chaining modes in this case})
are not directly tied to the ciphers.  That is a new cipher can be added to the library by simply providing
the key setup, ECB decrypt and encrypt and test vector routines.  After that all five chaining mode routines
can make use of the cipher right away.

\mysection{License}

The project is hereby released as public domain.

\mysection{Patent Disclosure}

The author (Tom St Denis) is not a patent lawyer so this section is not to be treated as legal advice.  To the best
of the author's knowledge the only patent related issues within the library are the RC5 and RC6 symmetric block ciphers.
They can be removed from a build by simply commenting out the two appropriate lines in \textit{tomcrypt\_custom.h}.  The rest
of the ciphers and hashes are patent free or under patents that have since expired.

The RC2 and RC4 symmetric ciphers are not under patents but are under trademark regulations.  This means you can use
the ciphers you just can't advertise that you are doing so.

\mysection{Thanks}
I would like to give thanks to the following people (in no particular order) for helping me develop this project from
early on:
\begin{enumerate}
   \item Richard van de Laarschot
   \item Richard Heathfield
   \item Ajay K. Agrawal
   \item Brian Gladman
   \item Svante Seleborg
   \item Clay Culver
   \item Jason Klapste
   \item Dobes Vandermeer
   \item Daniel Richards
   \item Wayne Scott
   \item Andrew Tyler
   \item Sky Schulz
   \item Christopher Imes
\end{enumerate}

There have been quite a few other people as well.  Please check the change log to see who else has contributed from
time to time.

\chapter{The Application Programming Interface (API)}
\mysection{Introduction}
\index{CRYPT\_ERROR} \index{CRYPT\_OK}

In general the API is very simple to memorize and use.  Most of the functions return either {\bf void} or {\bf int}.  Functions
that return {\bf int} will return {\bf CRYPT\_OK} if the function was successful, or one of the many error codes
if it failed.  Certain functions that return int will return $-1$ to indicate an error.  These functions will be explicitly
commented upon.  When a function does return a CRYPT error code it can be translated into a string with

\index{error\_to\_string()}
\begin{verbatim}
const char *error_to_string(int err);
\end{verbatim}

An example of handling an error is:
\begin{small}
\begin{verbatim}
void somefunc(void)
{
   int err;

   /* call a cryptographic function */
   if ((err = some_crypto_function(...)) != CRYPT_OK) {
      printf("A crypto error occurred, %s\n", error_to_string(err));
      /* perform error handling */
   }
   /* continue on if no error occurred */
}
\end{verbatim}
\end{small}

There is no initialization routine for the library and for the most part the code is thread safe.  The only thread
related issue is if you use the same symmetric cipher, hash or public key state data in multiple threads.  Normally
that is not an issue.

To include the prototypes for \textit{LibTomCrypt.a} into your own program simply include \textit{tomcrypt.h} like so:
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void) {
    return 0;
}
\end{verbatim}
\end{small}

The header file \textit{tomcrypt.h} also includes \textit{stdio.h}, \textit{string.h}, \textit{stdlib.h}, \textit{time.h} and \textit{ctype.h}.

\mysection{Macros}

There are a few helper macros to make the coding process a bit easier.  The first set are related to loading and storing
32/64-bit words in little/big endian format.  The macros are:

\index{STORE32L} \index{STORE64L} \index{LOAD32L} \index{LOAD64L} \index{STORE32H} \index{STORE64H} \index{LOAD32H} \index{LOAD64H} \index{BSWAP}
\newpage
\begin{figure}[hpbt]
\begin{small}
\begin{center}
\begin{tabular}{|c|c|c|}
     \hline STORE32L(x, y) & {\bf ulong32} x, {\bf unsigned char} *y & $x \to y[0 \ldots 3]$ \\
     \hline STORE64L(x, y) & {\bf ulong64} x, {\bf unsigned char} *y & $x \to y[0 \ldots 7]$ \\
     \hline LOAD32L(x, y) & {\bf ulong32} x, {\bf unsigned char} *y & $y[0 \ldots 3] \to x$ \\
     \hline LOAD64L(x, y) & {\bf ulong64} x, {\bf unsigned char} *y & $y[0 \ldots 7] \to x$ \\
     \hline STORE32H(x, y) & {\bf ulong32} x, {\bf unsigned char} *y & $x \to y[3 \ldots 0]$ \\
     \hline STORE64H(x, y) & {\bf ulong64} x, {\bf unsigned char} *y & $x \to y[7 \ldots 0]$ \\
     \hline LOAD32H(x, y) & {\bf ulong32} x, {\bf unsigned char} *y & $y[3 \ldots 0] \to x$ \\
     \hline LOAD64H(x, y) & {\bf ulong64} x, {\bf unsigned char} *y & $y[7 \ldots 0] \to x$ \\
     \hline BSWAP(x) & {\bf ulong32} x & Swap bytes \\
     \hline
\end{tabular}
\caption{Load And Store Macros}
\end{center}
\end{small}
\end{figure}

There are 32 and 64-bit cyclic rotations as well:
\index{ROL} \index{ROR} \index{ROL64} \index{ROR64} \index{ROLc} \index{RORc} \index{ROL64c} \index{ROR64c}
\begin{figure}[hpbt]
\begin{small}
\begin{center}
\begin{tabular}{|c|c|c|}
     \hline ROL(x, y) & {\bf ulong32} x, {\bf ulong32} y & $x << y, 0 \le y \le 31$ \\
     \hline ROLc(x, y) & {\bf ulong32} x, {\bf const ulong32} y & $x << y, 0 \le y \le 31$ \\
     \hline ROR(x, y) & {\bf ulong32} x, {\bf ulong32} y & $x >> y, 0 \le y \le 31$ \\
     \hline RORc(x, y) & {\bf ulong32} x, {\bf const ulong32} y & $x >> y, 0 \le y \le 31$ \\
     \hline && \\
     \hline ROL64(x, y) & {\bf ulong64} x, {\bf ulong64} y & $x << y, 0 \le y \le 63$ \\
     \hline ROL64c(x, y) & {\bf ulong64} x, {\bf const ulong64} y & $x << y, 0 \le y \le 63$ \\
     \hline ROR64(x, y) & {\bf ulong64} x, {\bf ulong64} y & $x >> y, 0 \le y \le 63$ \\
     \hline ROR64c(x, y) & {\bf ulong64} x, {\bf const ulong64} y & $x >> y, 0 \le y \le 63$ \\
     \hline
\end{tabular}
\caption{Rotate Macros}
\end{center}
\end{small}
\end{figure}

\mysection{Functions with Variable Length Output}
Certain functions such as (for example) \textit{rsa\_export()} give an output that is variable length.  To prevent buffer overflows you
must pass it the length of the buffer where the output will be stored.  For example:
\index{rsa\_export()} \index{error\_to\_string()} \index{variable length output}
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void) {
    rsa_key key;
    unsigned char buffer[1024];
    unsigned long x;
    int err;

    /* ... Make up the RSA key somehow ... */

    /* lets export the key, set x to the size of the
     * output buffer */
    x = sizeof(buffer);
    if ((err = rsa_export(buffer, &x, PK_PUBLIC, &key)) != CRYPT_OK) {
       printf("Export error: %s\n", error_to_string(err));
       return -1;
    }

    /* if rsa_export() was successful then x will have
     * the size of the output */
    printf("RSA exported key takes %d bytes\n", x);

    /* ... do something with the buffer */

    return 0;
}
\end{verbatim}
\end{small}
In the above example if the size of the RSA public key was more than 1024 bytes this function would return an error code
indicating a buffer overflow would have occurred.  If the function succeeds, it stores the length of the output back into
\textit{x} so that the calling application will know how many bytes were used.

As of v1.13, most functions will update your length on failure to indicate the size required by the function.  Not all functions
support this so please check the source before you rely on it doing that.

\mysection{Functions that need a PRNG}
\index{Pseudo Random Number Generator} \index{PRNG}
Certain functions such as \textit{rsa\_make\_key()} require a Pseudo Random Number Generator (PRNG).  These functions do not setup
the PRNG themselves so it is the responsibility of the calling function to initialize the PRNG before calling them.

Certain PRNG algorithms do not require a \textit{prng\_state} argument (sprng for example).  The \textit{prng\_state} argument
may be passed as \textbf{NULL} in such situations.

\index{register\_prng()} \index{rsa\_make\_key()}
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void) {
    rsa_key key;
    int     err;

    /* register the system RNG */
    register_prng(&sprng_desc)

    /* make a 1024-bit RSA key with the system RNG */
    if ((err = rsa_make_key(NULL, find_prng("sprng"), 1024/8, 65537, &key))
        != CRYPT_OK) {
       printf("make_key error: %s\n", error_to_string(err));
       return -1;
    }

    /* use the key ... */

    return 0;
}
\end{verbatim}
\end{small}

\mysection{Functions that use Arrays of Octets}
Most functions require inputs that are arrays of the data type \textit{unsigned char}.  Whether it is a symmetric key, IV
for a chaining mode or public key packet it is assumed that regardless of the actual size of \textit{unsigned char} only the
lower eight bits contain data.  For example, if you want to pass a 256 bit key to a symmetric ciphers setup routine, you
must pass in (a pointer to) an array of 32 \textit{unsigned char} variables.  Certain routines (such as SAFER+) take
special care to work properly on platforms where an \textit{unsigned char} is not eight bits.

For the purposes of this library, the term \textit{byte} will refer to an octet or eight bit word.  Typically an array of
type \textit{byte} will be synonymous with an array of type \textit{unsigned char.}

\chapter{Symmetric Block Ciphers}
\mysection{Core Functions}
LibTomCrypt provides several block ciphers with an ECB block mode interface.  It is important to first note that you
should never use the ECB modes directly to encrypt data.  Instead you should use the ECB functions to make a chaining mode,
or use one of the provided chaining modes.  All of the ciphers are written as ECB interfaces since it allows the rest of
the API to grow in a modular fashion.

\subsection{Key Scheduling}
All ciphers store their scheduled keys in a single data type called \textit{symmetric\_key}.  This allows all ciphers to
have the same prototype and store their keys as naturally as possible.  This also removes the need for dynamic memory
allocation, and allows you to allocate a fixed sized buffer for storing scheduled keys.  All ciphers must provide six visible
functions which are (given that XXX is the name of the cipher) the following:
\index{Cipher Setup}
\begin{verbatim}
int XXX_setup(const unsigned char *key,
                              int  keylen,
                              int  rounds,
                    symmetric_key *skey);
\end{verbatim}

The XXX\_setup() routine will setup the cipher to be used with a given number of rounds and a given key length (in bytes).
The number of rounds can be set to zero to use the default, which is generally a good idea.

If the function returns successfully the variable \textit{skey} will have a scheduled key stored in it.  It's important to note
that you should only used this scheduled key with the intended cipher.  For example, if you call \textit{blowfish\_setup()} do not
pass the scheduled key onto \textit{rc5\_ecb\_encrypt()}.  All built--in setup functions do not allocate memory off the heap so
when you are done with a key you can simply discard it (e.g. they can be on the stack).  However, to maintain proper coding
practices you should always call the respective XXX\_done() function.  This allows for quicker porting to applications with
externally supplied plugins.

\subsection{ECB Encryption and Decryption}
To encrypt or decrypt a block in ECB mode there are these two functions per cipher:
\index{Cipher Encrypt} \index{Cipher Decrypt}
\begin{verbatim}
int XXX_ecb_encrypt(const unsigned char *pt,
                          unsigned char *ct,
                          symmetric_key *skey);

int XXX_ecb_decrypt(const unsigned char *ct,
                          unsigned char *pt,
                          symmetric_key *skey);
\end{verbatim}
These two functions will encrypt or decrypt (respectively) a single block of text\footnote{The size of which depends on
which cipher you are using.}, storing the result in the \textit{ct} buffer (\textit{pt} resp.).  It is possible that the input and output buffer are
the same buffer.  For the encrypt function \textit{pt}\footnote{pt stands for plaintext.} is the input and
\textit{ct}\footnote{ct stands for ciphertext.} is the output.  For the decryption function it's the opposite.  They both
return \textbf{CRYPT\_OK} on success.  To test a particular cipher against test vectors\footnote{As published in their design papers.}
call the following self-test function.

\subsection{Self--Testing}
\index{Cipher Testing}
\begin{verbatim}
int XXX_test(void);
\end{verbatim}
This function will return {\bf CRYPT\_OK} if the cipher matches the test vectors from the design publication it is
based upon.

\subsection{Key Sizing}
For each cipher there is a function which will help find a desired key size.  It is specified as follows:
\index{Key Sizing}
\begin{verbatim}
int XXX_keysize(int *keysize);
\end{verbatim}
Essentially, it will round the input keysize in \textit{keysize} down to the next appropriate key size.  This function
will return {\bf CRYPT\_OK} if the key size specified is acceptable.  For example:
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int keysize, err;

   /* now given a 20 byte key what keysize does Twofish want to use? */
   keysize = 20;
   if ((err = twofish_keysize(&keysize)) != CRYPT_OK) {
      printf("Error getting key size: %s\n", error_to_string(err));
      return -1;
   }
   printf("Twofish suggested a key size of %d\n", keysize);
   return 0;
}
\end{verbatim}
\end{small}
This should indicate a keysize of sixteen bytes is suggested by storing 16 in \textit{keysize.}

\subsection{Cipher Termination}
When you are finished with a cipher you can de--initialize it with the done function.
\begin{verbatim}
void XXX_done(symmetric_key *skey);
\end{verbatim}
For the software based ciphers within LibTomCrypt, these functions will not do anything.  However, user supplied
cipher descriptors may require to be called for resource management purposes.  To be compliant, all functions which call a cipher
setup function must also call the respective cipher done function when finished.

\subsection{Simple Encryption Demonstration}
An example snippet that encodes a block with Blowfish in ECB mode.

\index{blowfish\_setup()} \index{blowfish\_ecb\_encrypt()} \index{blowfish\_ecb\_decrypt()} \index{blowfish\_done()}
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   unsigned char pt[8], ct[8], key[8];
   symmetric_key skey;
   int err;

   /* ... key is loaded appropriately in key ... */
   /* ... load a block of plaintext in pt ... */

   /* schedule the key */
   if ((err = blowfish_setup(key, /* the key we will use */
                               8, /* key is 8 bytes (64-bits) long */
                               0, /* 0 == use default # of rounds */
                           &skey) /* where to put the scheduled key */
       ) != CRYPT_OK) {
      printf("Setup error: %s\n", error_to_string(err));
      return -1;
   }

   /* encrypt the block */
   blowfish_ecb_encrypt(pt,       /* encrypt this 8-byte array */
                        ct,       /* store encrypted data here */
                        &skey);   /* our previously scheduled key */

   /* now ct holds the encrypted version of pt */

   /* decrypt the block */
   blowfish_ecb_decrypt(ct,       /* decrypt this 8-byte array */
                        pt,       /* store decrypted data here */
                        &skey);   /* our previously scheduled key */

   /* now we have decrypted ct to the original plaintext in pt */

   /* Terminate the cipher context */
   blowfish_done(&skey);

   return 0;
}
\end{verbatim}
\end{small}

\mysection{Key Sizes and Number of Rounds}
\index{Symmetric Keys}
As a general rule of thumb, do not use symmetric keys under 80 bits if you can help it.  Only a few of the ciphers support smaller
keys (mainly for test vectors anyways).  Ideally, your application should be making at least 256 bit keys.  This is not
because you are to be paranoid.  It is because if your PRNG has a bias of any sort the more bits the better.  For
example, if you have $\mbox{Pr}\left[X = 1\right] = {1 \over 2} \pm \gamma$ where $\vert \gamma \vert > 0$ then the
total amount of entropy in N bits is $N \cdot -log_2\left ({1 \over 2} + \vert \gamma \vert \right)$.  So if $\gamma$
were $0.25$ (a severe bias) a 256-bit string would have about 106 bits of entropy whereas a 128-bit string would have
only 53 bits of entropy.

The number of rounds of most ciphers is not an option you can change.  Only RC5 allows you to change the number of
rounds.  By passing zero as the number of rounds all ciphers will use their default number of rounds.  Generally the
ciphers are configured such that the default number of rounds provide adequate security for the given block and key
size.

\mysection{The Cipher Descriptors}
\index{Cipher Descriptor}
To facilitate automatic routines an array of cipher descriptors is provided in the array \textit{cipher\_descriptor}.  An element
of this array has the following (partial) format (See Section \ref{sec:cipherdesc}):

\begin{small}
\begin{verbatim}
struct ltc_cipher_descriptor {
   /** name of cipher */
   char *name;

   /** internal ID */
   unsigned char ID;

   /** min keysize (octets) */
   int  min_key_length,

   /** max keysize (octets) */
        max_key_length,

   /** block size (octets) */
        block_length,

   /** default number of rounds */
        default_rounds;
...<snip>...
};
\end{verbatim}
\end{small}

Where \textit{name} is the lower case ASCII version of the name.  The fields \textit{min\_key\_length} and \textit{max\_key\_length}
are the minimum and maximum key sizes in bytes.  The \textit{block\_length} member is the block size of the cipher
in bytes.  As a good rule of thumb it is assumed that the cipher supports
the min and max key lengths but not always everything in between.  The \textit{default\_rounds} field is the default number
of rounds that will be used.

For a plugin to be compliant it must provide at least each function listed before the accelerators begin.  Accelerators are optional,
and if missing will be emulated in software.

The remaining fields are all pointers to the core functions for each cipher.  The end of the cipher\_descriptor array is
marked when \textit{name} equals {\bf NULL}.

As of this release the current cipher\_descriptors elements are the following:
\vfil
\index{Cipher descriptor table}
\index{blowfish\_desc} \index{xtea\_desc} \index{rc2\_desc} \index{rc5\_desc} \index{rc6\_desc} \index{saferp\_desc} \index{aes\_desc} \index{twofish\_desc}
\index{des\_desc} \index{des3\_desc} \index{noekeon\_desc} \index{skipjack\_desc} \index{anubis\_desc} \index{khazad\_desc} \index{kseed\_desc} \index{kasumi\_desc} \index{camellia\_desc} \index{aes\_enc\_desc}
\index{idea\_desc} \index{serpent\_desc} \index{tea\_desc}
\begin{figure}[hpbt]
\begin{small}
\begin{center}
\begin{tabular}{|c|c|c|c|c|c|c|}
     \hline \textbf{Name} & \textbf{Descriptor Name} & \textbf{Block Size} & \textbf{Key Range} & \textbf{Rounds} & \textbf{Id} \\
     \hline Blowfish & blowfish\_desc & 8 & 8 $\ldots$ 56 & 16 & 0 \\
     \hline X-Tea & xtea\_desc & 8 & 16 & 32 & 1 \\
     \hline RC2 & rc2\_desc & 8 & 5 $\ldots$ 128 & 16 & 12 \\
     \hline RC5-32/12/b & rc5\_desc & 8 & 8 $\ldots$ 128 & 12 $\ldots$ 24 & 2 \\
     \hline RC6-32/20/b & rc6\_desc & 16 & 8 $\ldots$ 128 & 20 & 3 \\
     \hline SAFER+ & saferp\_desc &16 & 16, 24, 32 & 8, 12, 16 & 4 \\
     \hline AES & aes\_desc & 16 & 16, 24, 32 & 10, 12, 14 & 6 \\
                & aes\_enc\_desc & 16 & 16, 24, 32 & 10, 12, 14 & 6 \\
                & aesni\_desc & 16 & 16, 24, 32 & 10, 12, 14 & 6 \\
     \hline Twofish & twofish\_desc & 16 & 16, 24, 32 & 16 & 7 \\
     \hline DES & des\_desc & 8 & 8 & 16 & 13 \\
     \hline 3DES (EDE mode) & des3\_desc & 8 & 16, 24 & 16 & 14 \\
     \hline CAST5 (CAST-128) & cast5\_desc & 8 & 5 $\ldots$ 16 & 12, 16 & 15 \\
     \hline Noekeon & noekeon\_desc & 16 & 16 & 16 & 16 \\
     \hline Skipjack & skipjack\_desc & 8 & 10 & 32 & 17 \\
     \hline Anubis & anubis\_desc & 16 & 16 $\ldots$ 40 & 12 $\ldots$ 18 & 19 \\
     \hline Khazad & khazad\_desc & 8 & 16 & 8 & 18 \\
     \hline SEED   & kseed\_desc & 16 & 16 & 16 & 20 \\
     \hline KASUMI & kasumi\_desc & 8 & 16 & 8 & 21 \\
     \hline Camellia & camellia\_desc & 16 & 16, 24, 32 & 18, 24 & 23 \\
     \hline IDEA & idea\_desc & 8 & 16 & 8 & 24 \\
     \hline Serpent & serpent\_desc & 16 & 16, 24, 32 & 32 & 25 \\
     \hline TEA & tea\_desc & 8 & 16 & 32 & 26 \\
     \hline
\end{tabular}
\end{center}
\end{small}
\caption{Built--In Software Ciphers}
\end{figure}

\subsection{Notes}
\begin{small}
\begin{enumerate}
\item
For AES, (also known as Rijndael) there are four descriptors which complicate issues a little.  The descriptors
rijndael\_desc and rijndael\_enc\_desc provide the cipher named \textit{rijndael}.  The descriptors aes\_desc and
aes\_enc\_desc provide the cipher name \textit{aes}.  Functionally both \textit{rijndael} and \textit{aes} are the same cipher.  The
only difference is when you call find\_cipher() you have to pass the correct name.  The cipher descriptors with \textit{enc}
in the middle (e.g. rijndael\_enc\_desc) are related to an implementation of Rijndael with only the encryption routine
and tables.  The decryption and self--test function pointers of both \textit{encrypt only} descriptors are set to \textbf{NULL} and
should not be called.

The \textit{encrypt only} descriptors are useful for applications that only use the encryption function of the cipher.  Algorithms such
as EAX, PMAC and OMAC only require the encryption function.  So far this \textit{encrypt only} functionality has only been implemented for
Rijndael as it makes the most sense for this cipher.

\item
Note that for \textit{DES} and \textit{3DES} they use 8 and 24 byte keys but only 7 and 21 [respectively] bytes of the keys are in
fact used for the purposes of encryption.  My suggestion is just to use random 8/24 byte keys instead of trying to make a 8/24
byte string from the real 7/21 byte key.

For \textit{3DES} exists a two-key mode, that can be initialized by calling the setup function with a \textit{keylen} of 16. This results in the re-usage of key \textit{K1} as key \textit{K3}. This mode has been specified as \textit{Keying Option 2} in FIPS 46-3.

\item
Note that \textit{Twofish} has additional configuration options (Figure \ref{fig:twofishopts}) that take place at build time.  These options are found in
the file \textit{tomcrypt\_cfg.h}.  The first option is \textit{TWOFISH\_SMALL} which when defined will force the Twofish code
to not pre-compute the Twofish \textit{$g(X)$} function as a set of four $8 \times 32$ s-boxes.  This means that a scheduled
key will require less ram but the resulting cipher will be slower.  The second option is \textit{TWOFISH\_TABLES} which when
defined will force the Twofish code to use pre-computed tables for the two s-boxes $q_0, q_1$ as well as the multiplication
by the polynomials 5B and EF used in the MDS multiplication.  As a result the code is faster and slightly larger.  The
speed increase is useful when \textit{TWOFISH\_SMALL} is defined since the s-boxes and MDS multiply form the heart of the
Twofish round function.

\begin{figure}[hpbt]
\index{Twofish build options} \index{TWOFISH\_SMALL} \index{TWOFISH\_TABLES}
\begin{small}
\begin{center}
\begin{tabular}{|l|l|l|}
\hline \textbf{TWOFISH\_SMALL} & \textbf{TWOFISH\_TABLES} & \textbf{Speed and Memory (per key)} \\
\hline undefined & undefined & Very fast, 4.2KB of ram. \\
\hline undefined & defined & Faster key setup, larger code. \\
\hline defined & undefined & Very slow, 0.2KB of ram. \\
\hline defined & defined & Faster, 0.2KB of ram, larger code. \\
\hline
\end{tabular}
\end{center}
\end{small}
\caption{Twofish Build Options}
\label{fig:twofishopts}
\end{figure}

\item
As of v1.18.0 of the library RC2 got an extended setup function (which didn't fit in the regular API):

\index{rc2\_setup\_ex()}
\begin{verbatim}
int rc2_setup_ex(const unsigned char *key,
                                 int keylen,
                                 int bits,
                                 int num_rounds,
                       symmetric_key *skey);
\end{verbatim}

This setup function also allows to configure the effective key length in bits of the RC2 cipher as in its original specification.

\end{enumerate}
\end{small}


To work with the cipher\_descriptor array there is a function:
\index{find\_cipher()}
\begin{verbatim}
int find_cipher(char *name)
\end{verbatim}
Which will search for a given name in the array.  It returns $-1$ if the cipher is not found, otherwise it returns
the location in the array where the cipher was found.  For example, to indirectly setup Blowfish you can also use:
\begin{small}
\index{register\_cipher()} \index{find\_cipher()} \index{error\_to\_string()}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   unsigned char key[8];
   symmetric_key skey;
   int err;

   /* you must register a cipher before you use it */
   if (register_cipher(&blowfish_desc)) == -1) {
      printf("Unable to register Blowfish cipher.");
      return -1;
   }

   /* generic call to function (assuming the key
    * in key[] was already setup) */
   if ((err =
        cipher_descriptor[find_cipher("blowfish")].
          setup(key, 8, 0, &skey)) != CRYPT_OK) {
      printf("Error setting up Blowfish: %s\n", error_to_string(err));
      return -1;
   }

   /* ... use cipher ... */
}
\end{verbatim}
\end{small}

A good safety would be to check the return value of \textit{find\_cipher()} before accessing the desired function.  In order
to use a cipher with the descriptor table you must register it first using:
\index{register\_cipher()}
\begin{verbatim}
int register_cipher(const struct ltc_cipher_descriptor *cipher);
\end{verbatim}
Which accepts a pointer to a descriptor and returns the index into the global descriptor table.  If an error occurs such
as there is no more room (it can have 32 ciphers at most) it will return {\bf{-1}}.  If you try to add the same cipher more
than once it will just return the index of the first copy.  To remove a cipher call:
\index{unregister\_cipher()}
\begin{verbatim}
int unregister_cipher(const struct ltc_cipher_descriptor *cipher);
\end{verbatim}
Which returns {\bf CRYPT\_OK} if it removes the cipher, otherwise it returns {\bf CRYPT\_ERROR}.
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int err;

   /* register the cipher */
   if (register_cipher(&rijndael_desc) == -1) {
      printf("Error registering Rijndael\n");
      return -1;
   }

   /* use Rijndael */

   /* remove it */
   if ((err = unregister_cipher(&rijndael_desc)) != CRYPT_OK) {
      printf("Error removing Rijndael: %s\n", error_to_string(err));
      return -1;
   }

   return 0;
}
\end{verbatim}
\end{small}
This snippet is a small program that registers Rijndael.

\mysection{Symmetric Modes of Operations}
\subsection{Background}
A typical symmetric block cipher can be used in chaining modes to effectively encrypt messages larger than the block
size of the cipher.  Given a key $k$, a plaintext $P$ and a cipher $E$ we shall denote the encryption of the block
$P$ under the key $k$ as $E_k(P)$.  In some modes there exists an initialization vector denoted as $C_{-1}$.

\subsubsection{ECB Mode}
\index{ECB mode}
ECB or Electronic Codebook Mode is the simplest method to use.  It is given as:
\begin{equation}
C_i = E_k(P_i)
\end{equation}
This mode is very weak since it allows people to swap blocks and perform replay attacks if the same key is used more
than once.

\subsubsection{CBC Mode}
\index{CBC mode}
CBC or Cipher Block Chaining mode is a simple mode designed to prevent trivial forms of replay and swap attacks on ciphers.
It is given as:
\begin{equation}
C_i = E_k(P_i \oplus C_{i - 1})
\end{equation}
It is important that the initialization vector be unique and preferably random for each message encrypted under the same key.

\subsubsection{CTR Mode}
\index{CTR mode}
CTR or Counter Mode is a mode which only uses the encryption function of the cipher.  Given a initialization vector which is
treated as a large binary counter the CTR mode is given as:
\begin{eqnarray}
C_{-1} = C_{-1} + 1\mbox{ }(\mbox{mod }2^W) \nonumber \\
C_i = P_i \oplus E_k(C_{-1})
\end{eqnarray}
Where $W$ is the size of a block in bits (e.g. 64 for Blowfish).  As long as the initialization vector is random for each message
encrypted under the same key replay and swap attacks are infeasible.  CTR mode may look simple but it is as secure
as the block cipher is under a chosen plaintext attack (provided the initialization vector is unique).

\subsubsection{CFB Mode}
\index{CFB mode}
CFB or Ciphertext Feedback Mode is a mode akin to CBC.  It is given as:
\begin{eqnarray}
C_i = P_i \oplus C_{-1} \nonumber \\
C_{-1} = E_k(C_i)
\end{eqnarray}
Note that in this library the output feedback width is equal to the size of the block cipher.  That is this mode is used
to encrypt whole blocks at a time.  However, the library will buffer data allowing the user to encrypt or decrypt partial
blocks without a delay.  When this mode is first setup it will initially encrypt the initialization vector as required.

\subsubsection{OFB Mode}
\index{OFB mode}
OFB or Output Feedback Mode is a mode akin to CBC as well.  It is given as:
\begin{eqnarray}
C_{-1} = E_k(C_{-1}) \nonumber \\
C_i = P_i \oplus C_{-1}
\end{eqnarray}
Like the CFB mode the output width in CFB mode is the same as the width of the block cipher.  OFB mode will also
buffer the output which will allow you to encrypt or decrypt partial blocks without delay.

\subsection{Choice of Mode}
My personal preference is for the CTR mode since it has several key benefits:
\begin{enumerate}
   \item No short cycles which is possible in the OFB and CFB modes.
   \item Provably as secure as the block cipher being used under a chosen plaintext attack.
   \item Technically does not require the decryption routine of the cipher.
   \item Allows random access to the plaintext.
   \item Allows the encryption of block sizes that are not equal to the size of the block cipher.
\end{enumerate}
The CTR, CFB and OFB routines provided allow you to encrypt block sizes that differ from the ciphers block size.  They
accomplish this by buffering the data required to complete a block.  This allows you to encrypt or decrypt any size
block of memory with either of the three modes.

The ECB and CBC modes process blocks of the same size as the cipher at a time.  Therefore, they are less flexible than the
other modes.

\subsection{Ciphertext Stealing}
\index{Ciphertext stealing}
Ciphertext stealing is a method of dealing with messages in CBC mode which are not a multiple of the block length.  This is accomplished
by encrypting the last ciphertext block in ECB mode, and XOR'ing the output against the last partial block of plaintext.  LibTomCrypt does not
support this mode directly but it is fairly easy to emulate with a call to the cipher's ecb\_encrypt() callback function.

The more sane way to deal with partial blocks is to pad them with zeroes, and then use CBC normally.

\subsection{Initialization}
\index{CBC Mode} \index{CTR Mode}
\index{OFB Mode} \index{CFB Mode}
The library provides simple support routines for handling CBC, CTR, CFB, OFB and ECB encoded messages.  Assuming the mode
you want is XXX there is a structure called \textit{symmetric\_XXX} that will contain the information required to
use that mode.  They have identical setup routines (except CTR and ECB mode):
\index{ecb\_start()} \index{cfb\_start()} \index{cbc\_start()} \index{ofb\_start()} \index{ctr\_start()}
\begin{verbatim}
int XXX_start(                int  cipher,
              const unsigned char *IV,
              const unsigned char *key,
                              int  keylen,
                              int  num_rounds,
                    symmetric_XXX *XXX);

int ctr_start(                int  cipher,
              const unsigned char *IV,
              const unsigned char *key,
                              int  keylen,
                              int  num_rounds,
                              int  ctr_mode,
                    symmetric_CTR *ctr);

int ecb_start(                int  cipher,
              const unsigned char *key,
                              int  keylen,
                              int  num_rounds,
                    symmetric_ECB *ecb);
\end{verbatim}

In each case, \textit{cipher} is the index into the cipher\_descriptor array of the cipher you want to use.  The \textit{IV} value is
the initialization vector to be used with the cipher.  You must fill the IV yourself and it is assumed they are the same
length as the block size\footnote{In other words the size of a block of plaintext for the cipher, e.g. 8 for DES, 16 for AES, etc.}
of the cipher you choose.  It is important that the IV  be random for each unique message you want to encrypt.  The
parameters \textit{key}, \textit{keylen} and \textit{num\_rounds} are the same as in the XXX\_setup() function call.  The final parameter
is a pointer to the structure you want to hold the information for the mode of operation.

The routines return {\bf CRYPT\_OK} if the cipher initialized correctly, otherwise, they return an error code.

\subsubsection{CTR Mode}
In the case of CTR mode there is an additional parameter \textit{ctr\_mode} which specifies the mode that the counter is to be used in.
If \textbf{CTR\_COUNTER\_ LITTLE\_ENDIAN} was specified then the counter will be treated as a little endian value.  Otherwise, if
\textbf{CTR\_COUNTER\_BIG\_ENDIAN} was specified the counter will be treated as a big endian value.  As of v1.15 the RFC 3686 style of
increment then encrypt is also supported.  By OR'ing \textbf{LTC\_CTR\_RFC3686} with the CTR \textit{mode} value, ctr\_start() will increment
the counter before encrypting it for the first time.

As of V1.17, the library supports variable length counters for CTR mode.  The (optional) counter length is specified by OR'ing the octet
length of the counter against the \textit{ctr\_mode} parameter.  The default, zero, indicates that a full block length counter will be used.  This also
ensures backwards compatibility with software that uses older versions of the library.

\begin{small}
\begin{verbatim}
symmetric_CTR ctr;
int           err;
unsigned char IV[16], key[16];

/* use a 32-bit little endian counter */
if ((err = ctr_start(find_cipher("aes"),
                     IV, key, 16, 0,
                     CTR_COUNTER_LITTLE_ENDIAN | 4,
                     &ctr)) != CRYPT_OK) {
   handle_error(err);
}
\end{verbatim}
\end{small}

Changing the counter size has little (really no) effect on the performance of the CTR chaining mode.  It is provided for compatibility
with other software (and hardware) which have smaller fixed sized counters.

\subsection{Encryption and Decryption}
To actually encrypt or decrypt the following routines are provided:
\index{ecb\_encrypt()} \index{ecb\_decrypt()} \index{cfb\_encrypt()} \index{cfb\_decrypt()}
\index{cbc\_encrypt()} \index{cbc\_decrypt()} \index{ofb\_encrypt()} \index{ofb\_decrypt()} \index{ctr\_encrypt()} \index{ctr\_decrypt()}
\begin{verbatim}
int XXX_encrypt(const unsigned char *pt,
                      unsigned char *ct,
                      unsigned long  len,
                      symmetric_YYY *YYY);

int XXX_decrypt(const unsigned char *ct,
                      unsigned char *pt,
                      unsigned long  len,
                      symmetric_YYY *YYY);
\end{verbatim}
Where \textit{XXX} is one of $\lbrace ecb, cbc, ctr, cfb, ofb \rbrace$.

In all cases, \textit{len} is the size of the buffer (as number of octets) to encrypt or decrypt.  The CTR, OFB and CFB modes are order sensitive but not
chunk sensitive.  That is you can encrypt \textit{ABCDEF} in three calls like \textit{AB}, \textit{CD}, \textit{EF} or two like \textit{ABCDE} and \textit{F}
and end up with the same ciphertext.  However, encrypting \textit{ABC} and \textit{DABC} will result in different ciphertexts.  All
five of the modes will return {\bf CRYPT\_OK} on success from the encrypt or decrypt functions.

In the ECB and CBC cases, \textit{len} must be a multiple of the ciphers block size.  In the CBC case, you must manually pad the end of your message (either with
zeroes or with whatever your protocol requires).

To decrypt in either mode, perform the setup like before (recall you have to fetch the IV value you used), and use the decrypt routine on all of the blocks.

\subsection{IV Manipulation}
To change or read the IV of a previously initialized chaining mode use the following two functions.
\index{cbc\_setiv()} \index{cbc\_getiv()} \index{ofb\_setiv()} \index{ofb\_getiv()} \index{cfb\_setiv()} \index{cfb\_getiv()}
\index{ctr\_setiv()} \index{ctr\_getiv()}
\begin{verbatim}
int XXX_getiv(unsigned char *IV,
              unsigned long *len,
              symmetric_XXX *XXX);

int XXX_setiv(const unsigned char *IV,
                    unsigned long  len,
                    symmetric_XXX *XXX);
\end{verbatim}

The XXX\_getiv() functions will read the IV out of the chaining mode and store it into \textit{IV} along with the length of the IV
stored in \textit{len}.  The XXX\_setiv will initialize the chaining mode state as if the original IV were the new IV specified.  The length
of the IV passed in must be the size of the ciphers block size.

The XXX\_setiv() functions are handy if you wish to change the IV without re--keying the cipher.

What the \textit{setiv} function will do depends on the mode being changed.  In CBC mode, the new IV replaces the existing IV as if it
were the last ciphertext block.  In CFB mode, the IV is encrypted as if it were the prior encrypted pad.  In CTR mode, the IV is encrypted without
first incrementing it (regardless of the LTC\_RFC\_3686 flag presence).  In F8 mode, the IV is encrypted and becomes the new pad.  It does not change
the salted IV, and is only meant to allow seeking within a session.  In LRW, it changes the tweak, forcing a computation of the tweak pad, allowing for
seeking within the session.  In OFB mode, the IV is encrypted and becomes the new pad.

\subsection{Stream Termination}
To terminate an open stream call the done function.

\index{ecb\_done()} \index{cbc\_done()}\index{cfb\_done()}\index{ofb\_done()} \index{ctr\_done()}
\begin{verbatim}
int XXX_done(symmetric_XXX *XXX);
\end{verbatim}

This will terminate the stream (by terminating the cipher) and return \textbf{CRYPT\_OK} if successful.

\newpage
\subsection{Examples}
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   unsigned char key[16], IV[16], buffer[512];
   symmetric_CTR ctr;
   int x, err;

   /* register twofish first */
   if (register_cipher(&twofish_desc) == -1) {
      printf("Error registering cipher.\n");
      return -1;
   }

   /* somehow fill out key and IV */

   /* start up CTR mode */
   if ((err = ctr_start(
        find_cipher("twofish"), /* index of desired cipher */
                            IV, /* the initialization vector */
                           key, /* the secret key */
                            16, /* length of secret key (16 bytes) */
                             0, /* 0 == default # of rounds */
     CTR_COUNTER_LITTLE_ENDIAN, /* Little endian counter */
                         &ctr)  /* where to store the CTR state */
      ) != CRYPT_OK) {
      printf("ctr_start error: %s\n", error_to_string(err));
      return -1;
   }

   /* somehow fill buffer than encrypt it */
   if ((err = ctr_encrypt(        buffer, /* plaintext */
                                  buffer, /* ciphertext */
                          sizeof(buffer), /* length of plaintext pt */
                                   &ctr)  /* CTR state */
      ) != CRYPT_OK) {
      printf("ctr_encrypt error: %s\n", error_to_string(err));
      return -1;
   }

   /* make use of ciphertext... */

   /* now we want to decrypt so let's use ctr_setiv */
   if ((err = ctr_setiv(  IV, /* the initial IV we gave to ctr_start */
                          16, /* the IV is 16 bytes long */
                        &ctr) /* the ctr state we wish to modify */
       ) != CRYPT_OK) {
      printf("ctr_setiv error: %s\n", error_to_string(err));
      return -1;
   }

   if ((err = ctr_decrypt(        buffer, /* ciphertext */
                                  buffer, /* plaintext */
                          sizeof(buffer), /* length of plaintext */
                                   &ctr)  /* CTR state */
      ) != CRYPT_OK) {
      printf("ctr_decrypt error: %s\n", error_to_string(err));
      return -1;
   }

   /* terminate the stream */
   if ((err = ctr_done(&ctr)) != CRYPT_OK) {
      printf("ctr_done error: %s\n", error_to_string(err));
      return -1;
   }

   /* clear up and return */
   zeromem(key, sizeof(key));
   zeromem(&ctr, sizeof(ctr));

   return 0;
}
\end{verbatim}
\end{small}

\subsection{LRW Mode}
LRW mode is a cipher mode which is meant for indexed encryption like used to handle storage media.  It is meant to have efficient seeking and overcome the
security problems of ECB mode while not increasing the storage requirements.  It is used much like any other chaining mode except with two key differences.

The key is specified as two strings the first key $K_1$ is the (normally AES) key and can be any length (typically 16, 24 or 32 octets long).  The second key
$K_2$ is the \textit{tweak} key and is always 16 octets long.  The tweak value is \textbf{NOT} a nonce or IV value it must be random and secret.

To initialize LRW mode use:

\index{lrw\_start()}
\begin{verbatim}
int lrw_start(                int  cipher,
              const unsigned char *IV,
              const unsigned char *key,
                              int  keylen,
              const unsigned char *tweak,
                              int  num_rounds,
                    symmetric_LRW *lrw);
\end{verbatim}

This will initialize the LRW context with the given (16 octet) \textit{IV}, cipher $K_1$ \textit{key} of length \textit{keylen} octets and the (16 octet) $K_2$ \textit{tweak}.
While LRW was specified to be used only with AES, LibTomCrypt will allow any 128--bit block cipher to be specified as indexed by \textit{cipher}.  The
number of rounds for the block cipher \textit{num\_rounds} can be 0 to use the default number of rounds for the given cipher.

To process data use the following functions:

\index{lrw\_encrypt()} \index{lrw\_decrypt()}
\begin{verbatim}
int lrw_encrypt(const unsigned char *pt,
                      unsigned char *ct,
                      unsigned long  len,
                      symmetric_LRW *lrw);

int lrw_decrypt(const unsigned char *ct,
                      unsigned char *pt,
                      unsigned long  len,
                      symmetric_LRW *lrw);
\end{verbatim}

These will encrypt (or decrypt) the plaintext to the ciphertext buffer (or vice versa).  The length is specified by \textit{len} in octets but must be a multiple
of 16.  The LRW code uses a fast tweak update such that consecutive blocks are encrypted faster than if random seeking where used.

To manipulate the IV use the following functions:

\index{lrw\_getiv()} \index{lrw\_setiv()}
\begin{verbatim}
int lrw_getiv(unsigned char *IV,
              unsigned long *len,
              symmetric_LRW *lrw);

int lrw_setiv(const unsigned char *IV,
                    unsigned long  len,
                    symmetric_LRW *lrw);
\end{verbatim}
These will get or set the 16--octet IV.  Note that setting the IV is the same as \textit{seeking} and unlike other modes is not a free operation.  It requires
updating the entire tweak which is slower than sequential use.  Avoid seeking excessively in performance constrained code.

To terminate the LRW state use the following:

\index{lrw\_done()}
\begin{verbatim}
int lrw_done(symmetric_LRW *lrw);
\end{verbatim}

\subsection{XTS Mode}
As of v1.17, LibTomCrypt supports XTS mode with code donated by Elliptic Semiconductor Inc.\footnote{www.ellipticsemi.com}.
XTS is a chaining mode for 128--bit block ciphers, recommended by IEEE (P1619)
for disk encryption.  It is meant to be an encryption mode with random access to the message data without compromising privacy.  It requires two private keys (of equal
length) to perform the encryption process.  Each encryption invocation includes a sector number or unique identifier specified as a 128--bit string.

To initialize XTS mode use the following function call:

\index{xts\_start()}
\begin{verbatim}
int xts_start(                int  cipher,
              const unsigned char *key1,
              const unsigned char *key2,
                    unsigned long  keylen,
                              int  num_rounds,
                    symmetric_xts *xts)
\end{verbatim}
This will start the XTS mode with the two keys pointed to by \textit{key1} and \textit{key2} of length \textit{keylen} octets each.

To encrypt or decrypt a sector use the following calls:

\index{xts\_encrypt()} \index{xts\_decrypt()}
\begin{verbatim}
int xts_encrypt(
   const unsigned char *pt, unsigned long ptlen,
         unsigned char *ct,
   const unsigned char *tweak,
         symmetric_xts *xts);

int xts_decrypt(
   const unsigned char *ct, unsigned long ptlen,
         unsigned char *pt,
   const unsigned char *tweak,
         symmetric_xts *xts);
\end{verbatim}
The first will encrypt the plaintext pointed to by \textit{pt} of length \textit{ptlen} octets, and store the ciphertext in the array pointed to by
\textit{ct}.  It uses the 128--bit tweak pointed to by \textit{tweak} to encrypt the block.  The decrypt function performs the opposite operation.  Both
functions support ciphertext stealing (blocks that are not multiples of 16 bytes).

The P1619 specification states the tweak for sector number shall be represented as a 128--bit little endian string.

To terminate the XTS state call the following function:

\index{xts\_done()}
\begin{verbatim}
void xts_done(symmetric_xts *xts);
\end{verbatim}


\subsection{F8 Mode}
\index{F8 Mode}
The F8 Chaining mode (see RFC 3711 for instance) is yet another chaining mode for block ciphers.  It behaves much like CTR mode in that it XORs a keystream
against the plaintext to encrypt.  F8 mode comes with the additional twist that the counter value is secret, encrypted by a \textit{salt key}.  We
initialize F8 mode with the following function call:

\index{f8\_start()}
\begin{verbatim}
int f8_start(                int  cipher,
             const unsigned char *IV,
             const unsigned char *key,
                             int  keylen,
             const unsigned char *salt_key,
                             int  skeylen,
                             int  num_rounds,
                    symmetric_F8 *f8);
\end{verbatim}
This will start the F8 mode state using \textit{key} as the secret key, \textit{IV} as the counter.  It uses the \textit{salt\_key} as IV encryption key
(\textit{m} in the RFC 3711).  The salt\_key can be shorter than the secret key but it should not be longer.

To encrypt or decrypt data we use the following two functions:

\index{f8\_encrypt()} \index{f8\_decrypt()}
\begin{verbatim}
int f8_encrypt(const unsigned char *pt,
                     unsigned char *ct,
                     unsigned long  len,
                      symmetric_F8 *f8);

int f8_decrypt(const unsigned char *ct,
                     unsigned char *pt,
                     unsigned long  len,
                      symmetric_F8 *f8);
\end{verbatim}
These will encrypt or decrypt a variable length array of bytes using the F8 mode state specified.  The length is specified in bytes and does not have to be a multiple
of the ciphers block size.

To change or retrieve the current counter IV value use the following functions:
\index{f8\_getiv()} \index{f8\_setiv()}
\begin{verbatim}
int f8_getiv(unsigned char *IV,
             unsigned long *len,
              symmetric_F8 *f8);

int f8_setiv(const unsigned char *IV,
                   unsigned long  len,
                    symmetric_F8 *f8);
\end{verbatim}
These work with the current IV value only and not the encrypted IV value specified during the call to f8\_start().  The purpose of these two functions is to be
able to seek within a current session only.  If you want to change the session IV you will have to call f8\_done() and then start a new state with
f8\_start().

To terminate an F8 state call the following function:

\index{f8\_done()}
\begin{verbatim}
int f8_done(symmetric_F8 *f8);
\end{verbatim}

\chapter{Stream Ciphers}

Stream ciphers are symmetric key ciphers which operate on a stream of bytes (in theory on a stream of bits
however LibTomCrypt's implementation works with bytes).

The API for all stream ciphers operates in mode: \textit{setup} -- \textit{crypt} -- \textit{crypt} -- ... -- \textit{done}.
Please note that both encryption and decryption are implemented via \textit{crypt}.

Another useful feature of the stream ciphers API is generation of a random stream of bytes which works like:
\textit{setup} -- \textit{keystream} -- \textit{keystream} -- ... -- \textit{done}. The random stream generation is
implemented like encryption of a stream of \textit{0x00} bytes.

Note: You shouldn't use the keystream interface as a PRNG, as it doesn't allow to re-seed the internal state.

\mysection{ChaCha}

\textit{ChaCha} is currently the most modern stream cipher included in LibTomCrypt, so use this one unless you
have a reason for using some of the older algorithms.

For more information about ChaCha see \url{https://en.wikipedia.org/wiki/ChaCha_(cipher)}.

Supported key size: 16 or 32 bytes (128 or 256 bits).

You can initialize ChaCha with 96bit \textit{nonce} + 32bit \textit{counter}:
\begin{verbatim}
chacha_state st;
err = chacha_setup(&st, key, key_len, rounds);
err = chacha_ivctr32(&st, nonce, 12, initial_32bit_ctr);
\end{verbatim}

Or with 64bit \textit{nonce} + 64bit \textit{counter}:
\begin{verbatim}
chacha_state st;
err = chacha_setup(&st, key, key_len, rounds);
err = chacha_ivctr64(&st, nonce, 8, initial_64bit_ctr);
\end{verbatim}

The \textit{chacha\_setup} takes the number of rounds as a parameter -- choose 20 if you are not sure.
As always never ever use the same key + nonce pair more than once.

For the actual encryption or decryption you have to call:
\begin{verbatim}
err = chacha_crypt(&st, in_buffer, in_len, out_buffer);
\end{verbatim}

If you just want a random stream of bytes initialize the cipher with a truly random \textit{key} (32 bytes),
a truly random \textit{nonce} (8 bytes) and zero initial counter. After that you can get a stream of pseudo--random
bytes via:
\begin{verbatim}
err = chacha_keystream(&st, out_buffer, out_len);
\end{verbatim}

At the end you have to terminate the state:
\begin{verbatim}
err = chacha_done(&st);
\end{verbatim}

To encrypt plaintext (or decrypt ciphertext) using ChaCha for data already in
memory with a single function call, the following function may be used.
\begin{verbatim}
err = chacha_memory(key, keylen, iv, ivlen, datain, datalen, rounds, dataout);
\end{verbatim}

\mysection{Salsa20 and XSalsa20}

\textit{Salsa20} was Daniel Bernstein's submission to the EU eSTREAM
competition where a reduced-round version, \textit{Salsa20/12}, was named
one of the winners.  A third version, \textit{Salsa20/8}, was also evaluated.
\vspace{1mm}

While 20 rounds is the conservative default number of rounds, eSTREAM deemed
12 rounds to be a decent balance between strength and better performance.
The 8-round version, while still secure as of this writing, is faster but
does not enjoy the same margin of safety.  Regardless of the number of rounds,
\textit{Salsa20} accepts either a 128- or a 256-bit key, a 64-bit IV, and a
64-bit counter.
\vspace{1mm}

\textit{XSalsa20} is yet another variant of \textit{Salsa20} designed to accept
only a 256-bit key and a longer 192-bit nonce, initialization being the only
difference between \textit{XSalsa20} and \textit{Salsa20}.  Even the
\textit{salsa20\_state} is the same.  Thereafter, salsa20\_crypt(),
salsa20\_keystream(), and salsa20\_done() are used unaltered.
salsa20\_ivctr64() is NOT used with xsalsa20\_setup().
\vspace{1mm}

To initialize \textit{Salsa20} for 8, 12, or 20 rounds with a 128- or a
256-bit key (16 or 32 bytes), a 64-bit IV (8 bytes), and counter (typically
zero), use:

\begin{verbatim}
salsa20_state st;
ulong64 counter = 0;
err = salsa20_setup(&st, key, key_len, rounds);
err = salsa20_ivctr64(&st, nonce, 8, counter);
\end{verbatim}

To initialize \textit{XSalsa20} for the recommended 20 rounds with a 256-bit
key (32 bytes) and a 192-bit nonce (24 bytes), use:

\begin{verbatim}
salsa20_state st;
err = xsalsa20_setup(&st, key, key_len, nonce, nonce_len, rounds);
\end{verbatim}

Both \textit{Salsa20} and \textit{XSalsa20} use the following functions.  To
encrypt or decrypt call:
\begin{verbatim}
err = salsa20_crypt(&st, in_buffer, in_len, out_buffer);
\end{verbatim}

For a random keystream initialize the cipher with a truly random \textit{key}
and random \textit{nonce} after which you can get a stream of
pseudo--random bytes via:
\begin{verbatim}
err = salsa20_keystream(&st, out_buffer, out_len);
\end{verbatim}

Finally, when finished you should wipe the state.
\begin{verbatim}
err = salsa20_done(&st);
\end{verbatim}

To encrypt plaintext (or decrypt ciphertext) using Salsa20 for data already in
memory with a single function call, the following function may be used.
\begin{verbatim}
err = salsa20_memory(key, keylen, iv, ivlen, datain, datalen, rounds, dataout);
\end{verbatim}

To encrypt plaintext (or decrypt ciphertext) using XSalsa20 for data already in
memory with a single function call, the following function may be used.
\begin{verbatim}
err = xsalsa20_memory(key, keylen, nonce, nonce_len, datain, datalen, rounds, dataout);
\end{verbatim}

For both \textit{Salsa20} and \textit{XSalsa20} rounds must be an even number
and if set to 0 the default number of rounds, 20, will be used.
\vspace{1mm}

If you define \textit{LTC\_XSALSA20} to include \textit{XSalsa20} in a minimal
\textit{libtomcrypt} library build, you must also define \textit{LTC\_SALSA20}.
\vspace{1mm}

As always, never ever use the same key + nonce/IV pair more than once.
\vspace{1mm}

For more information about Salsa20 see
\url{https://en.wikipedia.org/wiki/Salsa20}.
\vspace{1mm}

For more information about XSalsa20 see
\url{https://cr.yp.to/snuffle/xsalsa-20081128.pdf}.
\vspace{1mm}

\mysection{Sosemanuk}

\textit{Sosemanuk}, along with Salsa20, HC-128, and Rabbit, was named one of the winners in
the EU eSTREAM competition.  Sosemanuk is a stream cipher that borrows heavily from SNOW,
another stream cipher, and the block cipher Serpent.  (Sosemanuk means "snow snake" in the
Cree Indian language.)

Sosemanuk will accept a key between 1 and 256 bits, but Sosemanuk's security level of 128
bits is achieved only if the key is between 128 and 256 bits.  Keys longer than 128 bits
are not guaranteed to provided higher security.  The initialization vector is 128 bits.
(All length arguments are expressed in bytes.)

See \url{http://www.ecrypt.eu.org/stream/p3ciphers/sosemanuk/sosemanuk_p3.pdf} for more
information.

Initialize by creating a Sosemanuk state and provide a 128- to 256-bit key to \textit{sosemanuk\_setup()}.
\begin{verbatim}
sosemanuk_state st;
err = sosemanuk_setup(&st, key, keylen);
\end{verbatim}

Finish initializing with an iv of up to 128 bits.
\begin{verbatim}
err = sosemanuk_setiv(&st, iv, ivlen);
\end{verbatim}

For the actual encryption or decryption, call:
\begin{verbatim}
err = sosemanuk_crypt(&st, in, inlen, out);
\end{verbatim}

If you just want a random stream of bytes initialize the cipher with a truly random
\textit{key} (256 bits) and a truly random \textit{iv} (128 bits). After that you can
get a stream of pseudo--random bytes via:
\begin{verbatim}
err = sosemanuk_keystream(&st, out, outlen);
\end{verbatim}

When finished you should wipe the key by running \textit{sosemanuk\_done()}.
\begin{verbatim}
err = sosemanuk_done(&st);
\end{verbatim}

To do multiple encryptions and decryptions with the same key, you will want to set the iv but
you do not need to re-run \textit{sosemanuk\_setup()} again, unless of course, you called
\textit{sosemanuk\_done()}.

To encrypt plaintext (or decrypt ciphertext) using Sosemanuk for data already in
memory with a single function call, the following function may be used.
\begin{verbatim}
err = sosemanuk_memory(key, keylen, iv, ivlen, datain, datalen, dataout);
\end{verbatim}

\mysection{Rabbit}

\textit{Rabbit}, along with Salsa20, Sosemanuk, and HC-128, was named one of the winners
in the EU eSTREAM competition.  Rabbit is a simple and fast cipher suitable for resource
constrained platforms.

This implementation of Rabbit will accept a key of up to 16 bytes (128 bits), and an
initialization vector of up to 8 bytes (64 bits).  If the provided key or IV is shorter,
they will be null padded to that length.  There is no rounds option.

The calls to \textit{rabbit\_crypt()} or \textit{rabbit\_keystream()} may be for any
number bytes although their generation will be more efficient if the requests are for
multiples of 16 bytes.

You begin initializing Rabbit by creating a state and calling \textit{rabbit\_setup()}
with a 128-bit key.
\begin{verbatim}
rabbit_state st;
err = rabbit_setup(&st, key, keylen);
\end{verbatim}

Set the IV using \textit{rabbit\_setiv()} with a 64-bit IV.
\begin{verbatim}
err = rabbit_setiv(&st, iv, iv_len);
\end{verbatim}

For the actual encryption or decryption, call:
\begin{verbatim}
err = rabbit_crypt(&st, in_buffer, inlen, out_buffer);
\end{verbatim}

If you just want a random stream of bytes initialize the cipher with a truly random \textit{key}
(16 bytes), a truly random \textit{iv} (8 bytes). After that you can
get a stream of pseudo--random bytes via:
\begin{verbatim}
err = rabbit_keystream(&st, out_buffer, length);
\end{verbatim}

When finished you should wipe the key and the state:
\begin{verbatim}
err = rabbit_done(&st);
\end{verbatim}

Technically, it is possible to initialize Rabbit with only a call to \textit{rabbit\_setup()},
skipping the call to \textit{rabbit\_setiv()}.  This is not recommended for interoperability reasons,
but there may be special cases like closed systems or custom protocols where doing so might be
appropriate.  Please note that skipping \textit{rabbit\_setiv()} will give results different than
calling \textit{rabbit\_setiv()} passing a zero-valued IV.  You should call \textit{rabbit\_setiv()} unless
you have a special reason for not doing so.

To do multiple encryptions and decryptions with the same key, you can reset the algorithm
using \textit{rabbit\_setiv()} if you saved the state and did not wipe it with \textit{rabbit\_done()}.
You will want to use a different IV but you do not need to call \textit{rabbit\_setup()} a 2nd time,
unless of course, you skipped calling \textit{rabbit\_setiv()}.

To encrypt plaintext (or decrypt ciphertext) using Rabbit for data already in
memory with a single function call, the following function may be used.
\begin{verbatim}
err = rabbit_memory(key, keylen, iv, ivlen, datain, datalen, dataout);
\end{verbatim}

For more information, see: \newline
\hspace{4em}- \url{http://www.ecrypt.eu.org/stream/p3ciphers/rabbit/rabbit_p3.pdf} \newline
\hspace{4em}- \url{https://tools.ietf.org/html/rfc4503}

\mysection{RC4}

For more information about RC4 see \url{https://en.wikipedia.org/wiki/RC4}.

Supported key size: 5--256 bytes

You need to initialize RC4 only with a \textit{key}.
\begin{verbatim}
rc4_state st;
err = rc4_stream_setup(&st, key, key_len);
\end{verbatim}

For the actual encryption or decryption you have to call:
\begin{verbatim}
err = rc4_stream_crypt(&st, in_buffer, in_len, out_buffer);
\end{verbatim}


If you just want a random stream of bytes initialize the cipher with truly random \textit{key}.
After that you can get a stream of pseudo--random bytes via:
\begin{verbatim}
err = rc4_stream_keystream(&st, out_buffer, out_len);
\end{verbatim}

At the end you have to terminate the state:
\begin{verbatim}
err = rc4_stream_done(&st);
\end{verbatim}

To encrypt plaintext (or decrypt ciphertext) using RC6 for data already in
memory with a single function call, the following function may be used.
\begin{verbatim}
err = rc4_stream_memory(key, keylen, datain, datalen, dataout);
\end{verbatim}

\mysection{Sober128}

Supported key size: must be multiple of 4 bytes

You need to initialize Sober128 with a \textit{key} and a \textit{nonce} (must be multiple of 4 bytes).
\begin{verbatim}
sober128_state st;
err = sober128_stream_setup(&st, key, 16);
err = sober128_stream_setiv(&st, nonce, 12);
\end{verbatim}

For the actual encryption or decryption you to call:
\begin{verbatim}
err = sober128_stream_crypt(&st, in_buffer, in_len, out_buffer);
\end{verbatim}

If you just want a random stream of bytes initialize the cipher with a truly random \textit{key}
and a truly random \textit{nonce}. After that you can get a stream of pseudo--random bytes via:
\begin{verbatim}
err = sober128_stream_keystream(&st, out_buffer, out_len);
\end{verbatim}

At the end you have to terminate the state:
\begin{verbatim}
err = sober128_stream_done(&st);
\end{verbatim}

To encrypt plaintext (or decrypt ciphertext) using Sober128 for data already in
memory with a single function call, the following function may be used.
\begin{verbatim}
err = sober128_stream_memory(key, keylen, iv, ivlen, datain, datalen, dataout);
\end{verbatim}

\chapter{Authenticated Encryption}

Authenticated Encryption - sometimes also called Authenticated Encryption with Associated Data (AEAD) - is a variant of encryption
that provides not only confidentiality (as other symmetric or stream ciphers) but also integrity.

The inputs of Authenticated Encryption are: \textit{key}, \textit{nonce} (sometimes called initialization vector), \textit{plaintext},
optional \textit{header} (sometimes called additional authenticated data - AAD). The outputs are: \textit{ciphertext} and \textit{tag}.

\mysection{EAX Mode}
LibTomCrypt provides support for a mode called EAX\footnote{See
M. Bellare, P. Rogaway, D. Wagner, A Conventional Authenticated-Encryption Mode.} in a manner similar to the way it was intended to be used
by the designers.  First, a short description of what EAX mode is before we explain how to use it.  EAX is a mode that requires a cipher,
CTR and OMAC support and provides encryption and
authentication\footnote{Note that since EAX only requires OMAC and CTR you may use \textit{encrypt only} cipher descriptors with this mode.}.
It is initialized with a random \textit{nonce} that can be shared publicly, a \textit{header} which can be fixed and public, and a random secret symmetric key.

The \textit{header} data is meant to be meta--data associated with a stream that isn't private (e.g., protocol messages).  It can
be added at anytime during an EAX stream, and is part of the authentication tag.  That is, changes in the meta-data can be detected by changes in the output tag.

The mode can then process plaintext producing ciphertext as well as compute a partial checksum.  The actual checksum
called a \textit{tag} is only emitted when the message is finished.  In the interim, the user can process any arbitrary
sized message block to send to the recipient as ciphertext.  This makes the EAX mode especially suited for streaming modes
of operation.

The mode is initialized with the following function.
\index{eax\_init()}
\begin{verbatim}
int eax_init(          eax_state *eax,
                             int  cipher,
             const unsigned char *key,
                   unsigned long  keylen,
             const unsigned char *nonce,
                   unsigned long  noncelen,
             const unsigned char *header,
                   unsigned long  headerlen);
\end{verbatim}

Where \textit{eax} is the EAX state.  The \textit{cipher} parameter is the index of the desired cipher in the descriptor table.
The \textit{key} parameter is the shared secret symmetric key of length \textit{keylen} octets.  The \textit{nonce} parameter is the
random public string of length \textit{noncelen} octets.  The \textit{header} parameter is the random (or fixed or \textbf{NULL}) header for the
message of length \textit{headerlen} octets.

When this function completes, the \textit{eax} state will be initialized such that you can now either have data decrypted or
encrypted in EAX mode.  Note: if \textit{headerlen} is zero you may pass \textit{header} as \textbf{NULL} to indicate there is no initial header data.

To encrypt or decrypt data in a streaming mode use the following.
\index{eax\_encrypt()} \index{eax\_decrypt()}
\begin{verbatim}
int eax_encrypt(          eax_state *eax,
                const unsigned char *pt,
                      unsigned char *ct,
                      unsigned long  length);

int eax_decrypt(          eax_state *eax,
                const unsigned char *ct,
                      unsigned char *pt,
                      unsigned long  length);
\end{verbatim}
The function \textit{eax\_encrypt} will encrypt the bytes in \textit{pt} of \textit{length} octets, and store the ciphertext in
\textit{ct}.  Note: \textit{ct} and \textit{pt} may be the same region in memory.   This function will also send the ciphertext
through the OMAC function.  The function \textit{eax\_decrypt} decrypts \textit{ct}, and stores it in \textit{pt}.  This also allows
\textit{pt} and \textit{ct} to be the same region in memory.

You cannot both encrypt or decrypt with the same \textit{eax} context.  For bi--directional communication you will need to initialize
two EAX contexts (preferably with different headers and nonces).

Note: both of these functions allow you to send the data in any granularity but the order is important.  While
the eax\_init() function allows you to add initial header data to the stream you can also add header data during the
EAX stream with the following.

\index{eax\_addheader()}
\begin{verbatim}
int eax_addheader(          eax_state *eax,
                  const unsigned char *header,
                        unsigned long  length);
\end{verbatim}
This will add the \textit{length} octet from \textit{header} to the given \textit{eax} header.  Once the message is finished, the
\textit{tag} (checksum) may be computed with the following function:

\index{eax\_done()}
\begin{verbatim}
int eax_done(    eax_state *eax,
             unsigned char *tag,
             unsigned long *taglen);
\end{verbatim}
This will terminate the EAX state \textit{eax}, and store up to \textit{taglen} bytes of the message tag in \textit{tag}.  The function
then stores how many bytes of the tag were written out back in to \textit{taglen}.

The EAX mode code can be tested to ensure it matches the test vectors by calling the following function:
\index{eax\_test()}
\begin{verbatim}
int eax_test(void);
\end{verbatim}
This requires that the AES (or Rijndael) block cipher be registered with the cipher\_descriptor table first.

\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int           err;
   eax_state     eax;
   unsigned char pt[64], ct[64], nonce[16], key[16], tag[16];
   unsigned long taglen;

   if (register_cipher(&rijndael_desc) == -1) {
      printf("Error registering Rijndael");
      return EXIT_FAILURE;
   }

   /* ... make up random nonce and key ... */

   /* initialize context */
   if ((err = eax_init(            &eax,  /* context */
                find_cipher("rijndael"),  /* cipher id */
                                  nonce,  /* the nonce */
                                     16,  /* nonce is 16 bytes */
                              "TestApp",  /* example header */
                                      7)  /* header length */
       ) != CRYPT_OK) {
      printf("Error eax_init: %s", error_to_string(err));
      return EXIT_FAILURE;
   }

   /* now encrypt data, say in a loop or whatever */
   if ((err = eax_encrypt(     &eax, /* eax context */
                                 pt, /* plaintext  (source) */
                                 ct, /* ciphertext (destination) */
                          sizeof(pt) /* size of plaintext */
      ) != CRYPT_OK) {
      printf("Error eax_encrypt: %s", error_to_string(err));
      return EXIT_FAILURE;
   }

   /* finish message and get authentication tag */
   taglen = sizeof(tag);
   if ((err = eax_done(   &eax,      /* eax context */
                           tag,      /* where to put tag */
                       &taglen       /* length of tag space */
      ) != CRYPT_OK) {
      printf("Error eax_done: %s", error_to_string(err));
      return EXIT_FAILURE;
   }

   /* now we have the authentication tag in "tag" and
    * it's taglen bytes long */
}
\end{verbatim}

You can also perform an entire EAX state on a block of memory in a single function call with the
following functions.


\index{eax\_encrypt\_authenticate\_memory} \index{eax\_decrypt\_verify\_memory}
\begin{verbatim}
int eax_encrypt_authenticate_memory(
                    int  cipher,
    const unsigned char *key,    unsigned long keylen,
    const unsigned char *nonce,  unsigned long noncelen,
    const unsigned char *header, unsigned long headerlen,
    const unsigned char *pt,     unsigned long ptlen,
          unsigned char *ct,
          unsigned char *tag,    unsigned long *taglen);

int eax_decrypt_verify_memory(
                    int  cipher,
    const unsigned char *key,    unsigned long keylen,
    const unsigned char *nonce,  unsigned long noncelen,
    const unsigned char *header, unsigned long headerlen,
    const unsigned char *ct,     unsigned long ctlen,
          unsigned char *pt,
          unsigned char *tag,    unsigned long taglen,
          int           *res);
\end{verbatim}

Both essentially just call eax\_init() followed by eax\_encrypt() (or eax\_decrypt() respectively) and eax\_done().  The parameters
have the same meaning as with those respective functions.

The only difference is eax\_decrypt\_verify\_memory() does not emit a tag.  Instead you pass it a tag as input and it compares it against
the tag it computed while decrypting the message.  If the tags match then it stores a $1$ in \textit{res}, otherwise it stores a $0$.

\mysection{OCB Modes}
\subsection{Preface}

LibTomCrypt provides support for a mode called OCB in version 1 ''OCB''\footnote{See
P. Rogaway, M. Bellare, J. Black, T. Krovetz, \textit{OCB: A Block Cipher Mode of Operation for Efficient Authenticated Encryption}.}
and version 3 ''OCB3''\footnote{See RFC7253, T. Krovetz, P. Rogaway, \textit{The OCB Authenticated-Encryption Algorithm}.}.
OCB is an encryption protocol that simultaneously provides authentication.  It is slightly faster to use than EAX mode
but is less flexible.

Please be aware that all versions of OCB are patented and there are several licensing models provided by P. Rogaway, the patent holder
-- see \url{http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm}.

\subsection{OCB}
\subsubsection{Initialization and processing}

Let's review how to initialize an OCB context.

\index{ocb\_init()}
\begin{verbatim}
int ocb_init(          ocb_state *ocb,
                             int  cipher,
             const unsigned char *key,
                   unsigned long  keylen,
             const unsigned char *nonce);
\end{verbatim}

This will initialize the \textit{ocb} context using cipher descriptor \textit{cipher}.  It will use a \textit{key} of length \textit{keylen}
and the random \textit{nonce}.  Note that \textit{nonce} must be a random (public) string the same length as the block ciphers
block size (e.g. 16 bytes for AES).

This mode has no \textit{Associated Data} like EAX mode does which means you cannot authenticate metadata along with the stream.
To encrypt or decrypt data use the following.

\index{ocb\_encrypt()} \index{ocb\_decrypt()}
\begin{verbatim}
int ocb_encrypt(          ocb_state *ocb,
                const unsigned char *pt,
                      unsigned char *ct);

int ocb_decrypt(          ocb_state *ocb,
                const unsigned char *ct,
                      unsigned char *pt);
\end{verbatim}

This will encrypt (or decrypt for the latter) a fixed length of data from \textit{pt} to \textit{ct} (vice versa for the latter).
They assume that \textit{pt} and \textit{ct} are the same size as the block cipher's block size.  Note that you cannot call
both functions given a single \textit{ocb} state.  For bi-directional communication you will have to initialize two \textit{ocb}
states (with different nonces).  Also \textit{pt} and \textit{ct} may point to the same location in memory.

\subsubsection{State Termination}

When you are finished encrypting the message you call the following function to compute the tag.

\index{ocb\_done\_encrypt()}
\begin{verbatim}
int ocb_done_encrypt(          ocb_state *ocb,
                     const unsigned char *pt,
                           unsigned long  ptlen,
                           unsigned char *ct,
                           unsigned char *tag,
                           unsigned long *taglen);
\end{verbatim}

This will terminate an encrypt stream \textit{ocb}.  If you have trailing bytes of plaintext that will not complete a block
you can pass them here.  This will also encrypt the \textit{ptlen} bytes in \textit{pt} and store them in \textit{ct}.  It will also
store up to \textit{taglen} bytes of the tag into \textit{tag}.

Note that \textit{ptlen} must be less than or equal to the block size of block cipher chosen.  Also note that if you have
an input message equal to the length of the block size then you pass the data here (not to ocb\_encrypt()) only.

To terminate a decrypt stream and compared the tag you call the following.

\index{ocb\_done\_decrypt()}
\begin{verbatim}
int ocb_done_decrypt(          ocb_state *ocb,
                     const unsigned char *ct,
                           unsigned long  ctlen,
                           unsigned char *pt,
                     const unsigned char *tag,
                           unsigned long  taglen,
                                     int *res);
\end{verbatim}
Similarly to the previous function you can pass trailing message bytes into this function.  This will compute the
tag of the message (internally) and then compare it against the \textit{taglen} bytes of \textit{tag} provided.  By default
\textit{res} is set to zero.  If all \textit{taglen} bytes of \textit{tag} can be verified then \textit{res} is set to one (authenticated
message).

\subsubsection{Packet Functions}
To make life simpler the following two functions are provided for memory bound OCB.

%\index{ocb\_encrypt\_authenticate\_memory()}
\begin{verbatim}
int ocb_encrypt_authenticate_memory(
                    int  cipher,
    const unsigned char *key,    unsigned long keylen,
    const unsigned char *nonce,
    const unsigned char *pt,     unsigned long ptlen,
          unsigned char *ct,
          unsigned char *tag,    unsigned long *taglen);
\end{verbatim}

This will OCB encrypt the message \textit{pt} of length \textit{ptlen}, and store the ciphertext in \textit{ct}.  The length \textit{ptlen}
can be any arbitrary length.

\index{ocb\_decrypt\_verify\_memory()}
\begin{verbatim}
int ocb_decrypt_verify_memory(
                    int  cipher,
    const unsigned char *key,    unsigned long keylen,
    const unsigned char *nonce,
    const unsigned char *ct,     unsigned long ctlen,
          unsigned char *pt,
    const unsigned char *tag,    unsigned long taglen,
          int           *res);
\end{verbatim}

Similarly, this will OCB decrypt, and compare the internally computed tag against the tag provided. \textit{res} is set
appropriately to \textit{1} if the tag matches or to \textit{0} if it doesn't match.

\subsection{OCB3}
\subsubsection{Initialization and processing}

\index{ocb3\_init()}
\begin{verbatim}
int ocb3_init(ocb3_state *ocb, int cipher,
             const unsigned char *key, unsigned long keylen,
             const unsigned char *nonce, unsigned long noncelen,
             unsigned long taglen);
\end{verbatim}

This will initialize the \textit{ocb} context using cipher descriptor \textit{cipher}.  It will use a \textit{key} of length \textit{keylen}
and the random \textit{nonce} of length \textit{noncelen}.  The \textit{nonce} must be a random (public) string of an arbitrary length
between 1 and 15 octets.  The desired length of the TAG that should be created when terminating the state has to be passed in \textit{taglen}
and has to be between 0 and 16 octets.

Note that you can only use ciphers with a block length of 16.

\subsubsection{Additional Authenticated Data}

OCB3 has, in contrary to OCB, the possibility to add "Additional Authenticated Data" (AAD) when performing cryptographic operations.

\index{ocb3\_add\_aad()}
\begin{verbatim}
int ocb3_add_aad(ocb3_state *ocb, const unsigned char *aad, unsigned long aadlen);
\end{verbatim}

This will add the AAD at \textit{aad} of the arbitrary length \textit{aadlen} to be authenticated within the context \textit{ocb}.

\index{ocb3\_encrypt()} \index{ocb3\_decrypt()}
\begin{verbatim}
int ocb3_encrypt(         ocb3_state *ocb,
                 const unsigned char *pt,
                       unsigned long ptlen,
                       unsigned char *ct);

int ocb3_decrypt(         ocb3_state *ocb,
                 const unsigned char *ct,
                       unsigned long ctlen,
                       unsigned char *pt);
\end{verbatim}

This will encrypt (or decrypt for the latter) a fixed length of data from \textit{pt} to \textit{ct} (vice versa for the latter).
They assume that \textit{pt} and \textit{ct} are the same size as the block cipher's block size.  Note that you cannot call
both functions given a single \textit{ocb} state.  For bi-directional communication you will have to initialize two \textit{ocb}
states (with different nonces).  Also \textit{pt} and \textit{ct} may point to the same location in memory.

\subsubsection{State Termination}

\index{ocb3\_encrypt\_last()} \index{ocb3\_decrypt\_last()}
\begin{verbatim}
int ocb3_encrypt_last(         ocb3_state *ocb,
                      const unsigned char *pt,
                            unsigned long ptlen,
                            unsigned char *ct);

int ocb3_decrypt_last(         ocb3_state *ocb,
                      const unsigned char *ct,
                            unsigned long ctlen,
                            unsigned char *pt);
\end{verbatim}

This has to be called for the last encrypt (or decrypt) operation. Note that if you have to invoke only a single operation you can
directly use these functions instead of \textit{ocb3\_encrypt()} or \textit{ocb3\_decrypt()}.

When you are finished encrypting the message you call the following function to compute the tag.

\index{ocb3\_done()}
\begin{verbatim}
int ocb3_done(ocb3_state *ocb, unsigned char *tag, unsigned long *taglen);
\end{verbatim}

This stores the tag of the \textit{ocb} state in \textit{tag}.
The \textit{taglen} parameter defines on input the length of the tag to output and will be set to the actual length written, which
is at most 16 octets.

\subsubsection{Packet Functions}
To make life simpler the following two functions are provided for memory bound OCB3.

\index{ocb3\_encrypt\_authenticate\_memory()}
\begin{verbatim}
int ocb3_encrypt_authenticate_memory(int cipher,
    const unsigned char *key,    unsigned long keylen,
    const unsigned char *nonce,  unsigned long noncelen,
    const unsigned char *adata,  unsigned long adatalen,
    const unsigned char *pt,     unsigned long ptlen,
          unsigned char *ct,
          unsigned char *tag,    unsigned long *taglen);
\end{verbatim}

This will OCB3 encrypt the message \textit{pt} of length \textit{ptlen}, and store the ciphertext in \textit{ct}.  The length \textit{ptlen}
can be any arbitrary length.  The additional authenticated data \textit{adata} of length \textit{adatalen} is optional and can be left out
by passing \textit{NULL} as \textit{adata}. The length of the authentication TAG will be stored in \textit{tag}, which is also optional.
The length of the TAG passed in \textit{taglen} has to be between 0 and 16.

\index{ocb3\_decrypt\_verify\_memory()}
\begin{verbatim}
int ocb3_decrypt_verify_memory(int cipher,
    const unsigned char *key,    unsigned long keylen,
    const unsigned char *nonce,  unsigned long noncelen,
    const unsigned char *adata,  unsigned long adatalen,
    const unsigned char *ct,     unsigned long ctlen,
          unsigned char *pt,
    const unsigned char *tag,    unsigned long taglen,
          int           *stat);
\end{verbatim}

Similarly, this will OCB3 decrypt, and compare the internally computed tag against the tag provided. \textit{res} is set
appropriately to \textit{1} if the tag matches or to \textit{0} if it doesn't match.

\mysection{CCM Mode}
CCM is a NIST proposal for encrypt + authenticate that is centered around using AES (or any 16--byte cipher) as a primitive.

\subsection{Initialization}
To initialize the CCM context with a secret key call the following function.

\index{ccm\_init()}
\begin{verbatim}
int ccm_init(      ccm_state *ccm,
                   int cipher,
             const unsigned char *key,
                   int keylen,
                   int ptlen,
                   int taglen,
                   int aadlen);
\end{verbatim}
This initializes the CCM state \textit{ccm} for the given cipher indexed by \textit{cipher}, with a secret key \textit{key} of length \textit{keylen} octets. The cipher
chosen must have a 16--byte block size (e.g., AES).
Unlike EAX and OCB mode, CCM is only meant for \textit{packet} mode where the length of the input is known in advance. This is why the length of the stream
to authenticate is given as \textit{ptlen}.
With CCM, a header is meta--data you want to send with the message but not have encrypted. The header len is given in the init
as \textit{aadlen}.

\subsection{Nonce Vector}
After the state has been initialized (or reset) the next step is to add the session (or packet) initialization vector.  It should be unique per packet encrypted.

\index{ccm\_add\_nonce()}
\begin{verbatim}
int ccm_add_nonce(      ccm_state *ccm,
                  const unsigned char *nonce,
                        unsigned long noncelen);
\end{verbatim}

This adds the nonce (a.k.a. salt) \textit{nonce} of length \textit{noncelen} octets to the CCM state \textit{ccm}. Note that this function must be called
once and only once.

\subsection{Additional Authentication Data}
The header is meta--data you want to send with the message but not have encrypted, it must be stored in \textit{adata} of length \textit{adatalen} octets.

\index{ccm\_add\_aad()}
\begin{verbatim}
int ccm_add_aad(      ccm_state *ccm,
                const unsigned char *adata,
                      unsigned long adatalen);
\end{verbatim}
This adds the additional authentication data \textit{adata} of length \textit{adatalen} to the CCM state \textit{ccm}.

\subsection{Plaintext Processing}
After the AAD has been processed, the plaintext (or ciphertext depending on the direction) can be processed.

\index{ccm\_process()}
\begin{verbatim}
int ccm_process(ccm_state *ccm,
                unsigned char *pt,
                unsigned long  ptlen,
                unsigned char *ct,
                int  direction);
\end{verbatim}
This processes message data where \textit{pt} is the plaintext and \textit{ct} is the ciphertext.  The length of both are equal and stored in \textit{ptlen}.  Depending on
the mode \textit{pt} is the input and \textit{ct} is the output (or vice versa).  When \textit{direction} equals \textbf{CCM\_ENCRYPT} the plaintext is read,
encrypted and stored in the ciphertext buffer.  When \textit{direction} equals \textbf{CCM\_DECRYPT} the opposite occurs.

\subsection{State Termination}
To terminate a CCM state and retrieve the message authentication tag call the following function.

\index{ccm\_done()}
\begin{verbatim}
int ccm_done(    ccm_state *ccm,
             unsigned char *tag,
             unsigned long *taglen);
\end{verbatim}
This terminates the CCM state \textit{ccm} and stores the tag in \textit{tag} of length \textit{taglen} octets.

\subsection{State Reset}
The call to ccm\_init() will perform considerable pre--computation and if you're going to be dealing with a lot of packets
it is very costly to have to call it repeatedly.  To aid in this endeavour, the reset function is provided.

\index{ccm\_reset()}
\begin{verbatim}
int ccm_reset(ccm_state *ccm);
\end{verbatim}

This will reset the CCM state \textit{ccm} to the state that ccm\_init() left it.  The user would then call ccm\_add\_nonce(), ccm\_add\_aad(), etc.

\subsection{One--Shot Packet}
To process a single packet under any given key the following helper function can be used.

\index{ccm\_memory()}
\begin{verbatim}
int ccm_memory(
                    int  cipher,
    const unsigned char *key,    unsigned long keylen,
    symmetric_key       *uskey,
    const unsigned char *nonce,  unsigned long noncelen,
    const unsigned char *header, unsigned long headerlen,
          unsigned char *pt,     unsigned long ptlen,
          unsigned char *ct,
          unsigned char *tag,    unsigned long *taglen,
                    int  direction);
\end{verbatim}

This will initialize the CCM state with the given key, nonce and AAD value then proceed to encrypt or decrypt the message text and store the final
message tag.  The definition of the variables is the same as it is for all the manual functions.

If you are processing many packets under the same key you shouldn't use this function as it invokes the pre--computation with each call.

\subsection{Example Usage}
The following is an example usage of how to use CCM over multiple packets with a shared secret key.

\begin{small}
\begin{verbatim}
#include <tomcrypt.h>

int send_packet(const unsigned char *pt,     unsigned long ptlen,
                const unsigned char *nonce,  unsigned long noncelen,
                const unsigned char *aad,    unsigned long aadlen,
                      ccm_state     *ccm)
{
   int           err;
   unsigned long taglen;
   unsigned char tag[16];

   /* reset the state */
   if ((err = ccm_reset(ccm)) != CRYPT_OK) {
      return err;
   }

   /* Add the nonce */
   if ((err = ccm_add_nonce(ccm, nonce, noncelen)) != CRYPT_OK) {
      return err;
   }

   /* Add the AAD (note: aad can be NULL if aadlen == 0) */
   if ((err = ccm_add_aad(ccm, aad, aadlen)) != CRYPT_OK) {
      return err;
   }

   /* process the plaintext */
   if ((err =
        ccm_process(ccm, pt, ptlen, pt, CCM_ENCRYPT)) != CRYPT_OK) {
      return err;
   }

   /* Finish up and get the MAC tag */
   taglen = sizeof(tag);
   if ((err = ccm_done(ccm, tag, &taglen)) != CRYPT_OK) {
      return err;
   }

   /* ... send a header describing the lengths ... */

   /* depending on the protocol and how nonce is
    * generated you may have to send it too... */
   send(socket, nonce, noncelen, 0);

   /* send the aad */
   send(socket, aad, aadlen, 0);

   /* send the ciphertext */
   send(socket, pt, ptlen, 0);

   /* send the tag */
   send(socket, tag, taglen, 0);

   return CRYPT_OK;
}

int main(void)
{
   ccm_state     ccm;
   unsigned char key[16], NONCE[12], pt[PACKET_SIZE];
   int           err, x;
   unsigned long ptlen;

   /* somehow fill key/NONCE with random values */

   /* register AES */
   register_cipher(&aes_desc);

   /* init the CCM state */
   if ((err =
        ccm_init(&ccm, find_cipher("aes"), key, 16, PACKET_SIZE, 16, size(NONCE))) != CRYPT_OK) {
      whine_and_pout(err);
   }

   /* handle us some packets */
   for (;;) {
       ptlen = make_packet_we_want_to_send(pt);

       /* use NONCE as counter (12 byte counter) */
       for (x = 11; x >= 0; x--) {
           if (++NONCE[x]) {
              break;
           }
       }

       if ((err = send_packet(pt, ptlen, NONCE, 12, NULL, 0, &ccm))
           != CRYPT_OK) {
           whine_and_pout(err);
       }
   }
   return EXIT_SUCCESS;
}
\end{verbatim}
\end{small}

\mysection{GCM Mode}
Galois counter mode is an IEEE proposal for authenticated encryption (also it is a planned NIST standard).  Like EAX and OCB mode, it can be used in a streaming capacity
however, unlike EAX it cannot accept \textit{additional authentication data} (meta--data) after plaintext has been processed.  This mode also only works with
block ciphers with a 16--byte block.

A GCM stream is meant to be processed in three modes, one after another.  First, the initialization vector (per session) data is processed.  This should be
unique to every session.  Next, the the optional additional authentication data is processed, and finally the plaintext (or ciphertext depending on the direction).

\subsection{Initialization}
To initialize the GCM context with a secret key call the following function.

\index{gcm\_init()}
\begin{verbatim}
int gcm_init(          gcm_state *gcm,
                             int  cipher,
             const unsigned char *key,
                             int  keylen);
\end{verbatim}
This initializes the GCM state \textit{gcm} for the given cipher indexed by \textit{cipher}, with a secret key \textit{key} of length \textit{keylen} octets.  The cipher
chosen must have a 16--byte block size (e.g., AES).

\subsection{Initialization Vector}
After the state has been initialized (or reset) the next step is to add the session (or packet) initialization vector.  It should be unique per packet encrypted.

\index{gcm\_add\_iv()}
\begin{verbatim}
int gcm_add_iv(          gcm_state *gcm,
               const unsigned char *IV,
                     unsigned long  IVlen);
\end{verbatim}
This adds the initialization vector octets from \textit{IV} of length \textit{IVlen} to the GCM state \textit{gcm}.  You can call this function as many times as required
to process the entire IV.

Note: the GCM protocols provides a \textit{shortcut} for 12--byte IVs where no pre-processing is to be done.  If you want to minimize per packet latency it is ideal
to only use 12--byte IVs.  You can just increment it like a counter for each packet.

\subsection{Additional Authentication Data}
After the entire IV has been processed, the additional authentication data can be processed.  Unlike the IV, a packet/session does not require additional
authentication data (AAD) for security.  The AAD is meant to be used as side--channel data you want to be authenticated with the packet.  Note:  once
you begin adding AAD to the GCM state you cannot return to adding IV data until the state has been reset.

\index{gcm\_add\_aad()}
\begin{verbatim}
int gcm_add_aad(          gcm_state *gcm,
                const unsigned char *adata,
                      unsigned long  adatalen);
\end{verbatim}
This adds the additional authentication data \textit{adata} of length \textit{adatalen} to the GCM state \textit{gcm}.

\subsection{Plaintext Processing}
After the AAD has been processed, the plaintext (or ciphertext depending on the direction) can be processed.

\index{gcm\_process()}
\begin{verbatim}
int gcm_process(    gcm_state *gcm,
                unsigned char *pt,
                unsigned long  ptlen,
                unsigned char *ct,
                          int  direction);
\end{verbatim}
This processes message data where \textit{pt} is the plaintext and \textit{ct} is the ciphertext.  The length of both are equal and stored in \textit{ptlen}.  Depending on
the mode \textit{pt} is the input and \textit{ct} is the output (or vice versa).  When \textit{direction} equals \textbf{GCM\_ENCRYPT} the plaintext is read,
encrypted and stored in the ciphertext buffer.  When \textit{direction} equals \textbf{GCM\_DECRYPT} the opposite occurs.

\subsection{State Termination}
To terminate a GCM state and retrieve the message authentication tag call the following function.

\index{gcm\_done()}
\begin{verbatim}
int gcm_done(    gcm_state *gcm,
             unsigned char *tag,
             unsigned long *taglen);
\end{verbatim}
This terminates the GCM state \textit{gcm} and stores the tag in \textit{tag} of length \textit{taglen} octets.

\subsection{State Reset}
The call to gcm\_init() will perform considerable pre--computation (when \textbf{GCM\_TABLES} is defined) and if you're going to be dealing with a lot of packets
it is very costly to have to call it repeatedly.  To aid in this endeavour, the reset function has been provided.

\index{gcm\_reset()}
\begin{verbatim}
int gcm_reset(gcm_state *gcm);
\end{verbatim}

This will reset the GCM state \textit{gcm} to the state that gcm\_init() left it.  The user would then call gcm\_add\_iv(), gcm\_add\_aad(), etc.

\subsection{One--Shot Packet}
To process a single packet under any given key the following helper function can be used.

\index{gcm\_memory()}
\begin{verbatim}
int gcm_memory(
                    int  cipher,
    const unsigned char *key,
          unsigned long keylen,
    const unsigned char *IV,    unsigned long IVlen,
    const unsigned char *adata, unsigned long adatalen,
          unsigned char *pt,    unsigned long ptlen,
          unsigned char *ct,
          unsigned char *tag,   unsigned long *taglen,
                    int  direction);
\end{verbatim}

This will initialize the GCM state with the given key, IV and AAD value then proceed to encrypt or decrypt the message text and store the final
message tag.  The definition of the variables is the same as it is for all the manual functions.

IMPORTANT NOTICE: for \textit{direction == GCM\_DECRYPT} the caller has to fill \textit{tag} and \textit{taglen} with expected
tag value. The \textit{gcm\_memory} in decrypt mode validates the \textit{tag} value and returns \textit{CRYPT\_ERROR} on mismatch.

If you are processing many packets under the same key you shouldn't use this function as it invokes the pre--computation with each call.

\subsection{Example Usage}
The following is an example usage of how to use GCM over multiple packets with a shared secret key.

\begin{small}
\begin{verbatim}
#include <tomcrypt.h>

int send_packet(const unsigned char *pt,  unsigned long ptlen,
                const unsigned char *iv,  unsigned long ivlen,
                const unsigned char *aad, unsigned long aadlen,
                      gcm_state     *gcm)
{
   int           err;
   unsigned long taglen;
   unsigned char tag[16];

   /* reset the state */
   if ((err = gcm_reset(gcm)) != CRYPT_OK) {
      return err;
   }

   /* Add the IV */
   if ((err = gcm_add_iv(gcm, iv, ivlen)) != CRYPT_OK) {
      return err;
   }

   /* Add the AAD (note: aad can be NULL if aadlen == 0) */
   if ((err = gcm_add_aad(gcm, aad, aadlen)) != CRYPT_OK) {
      return err;
   }

   /* process the plaintext */
   if ((err =
        gcm_process(gcm, pt, ptlen, pt, GCM_ENCRYPT)) != CRYPT_OK) {
      return err;
   }

   /* Finish up and get the MAC tag */
   taglen = sizeof(tag);
   if ((err = gcm_done(gcm, tag, &taglen)) != CRYPT_OK) {
      return err;
   }

   /* ... send a header describing the lengths ... */

   /* depending on the protocol and how IV is
    * generated you may have to send it too... */
   send(socket, iv, ivlen, 0);

   /* send the aad */
   send(socket, aad, aadlen, 0);

   /* send the ciphertext */
   send(socket, pt, ptlen, 0);

   /* send the tag */
   send(socket, tag, taglen, 0);

   return CRYPT_OK;
}

int main(void)
{
   gcm_state     gcm;
   unsigned char key[16], IV[12], pt[PACKET_SIZE];
   int           err, x;
   unsigned long ptlen;

   /* somehow fill key/IV with random values */

   /* register AES */
   register_cipher(&aes_desc);

   /* init the GCM state */
   if ((err =
        gcm_init(&gcm, find_cipher("aes"), key, 16)) != CRYPT_OK) {
      whine_and_pout(err);
   }

   /* handle us some packets */
   for (;;) {
       ptlen = make_packet_we_want_to_send(pt);

       /* use IV as counter (12 byte counter) */
       for (x = 11; x >= 0; x--) {
           if (++IV[x]) {
              break;
           }
       }

       if ((err = send_packet(pt, ptlen, iv, 12, NULL, 0, &gcm))
           != CRYPT_OK) {
           whine_and_pout(err);
       }
   }
   return EXIT_SUCCESS;
}
\end{verbatim}
\end{small}

\mysection{ChaCha20--Poly1305}

This authenticated encryption is based on ChaCha20 stream cipher and Poly1305 authenticator.
It is defined by \url{https://tools.ietf.org/html/rfc7539}.

\subsection{Initialization}
To initialize the ChaCha20--Poly1305 context with a secret key call the following function.

\index{chacha20poly1305\_init()}
\begin{verbatim}
int chacha20poly1305_init(chacha20poly1305_state *st,
                             const unsigned char *key,
                                   unsigned long  keylen);
\end{verbatim}
This initializes the ChaCha20--Poly1305 state \textit{st} with a secret key \textit{key} of length \textit{keylen}
octets (valid lengths: 32 or 16).

\subsection{Initialization Vector}
After the state has been initialized the next step is to add the initialization vector.

\index{chacha20poly1305\_setiv()}
\begin{verbatim}
int chacha20poly1305_setiv(chacha20poly1305_state *st,
                              const unsigned char *iv,
                                    unsigned long  ivlen);
\end{verbatim}
This adds the initialization vector from \textit{iv} of length \textit{ivlen} octects (valid lengths: 8 or 12) to
the ChaCha20--Poly1305 state \textit{st}.

\index{chacha20poly1305\_setiv\_rfc7905()}
\begin{verbatim}
int chacha20poly1305_setiv_rfc7905(chacha20poly1305_state *st,
                                      const unsigned char *iv,
                                            unsigned long  ivlen,
                                                  ulong64  sequence_number);
\end{verbatim}
This also adds the initialization vector from \textit{iv} of length \textit{ivlen} octects (valid lengths: 8 or 12) to
the state \textit{st} but it also incorporates 64bit \textit{sequence\_number} into IV as described in RFC7905.

You can call only one of \textit{chacha20poly1305\_setiv} or \textit{chacha20poly1305\_setiv\_rfc7905}.

\subsection{Additional Authentication Data}
After the IV has been set, the additional authentication data can be processed.

\index{chacha20poly1305\_add\_aad()}
\begin{verbatim}
int chacha20poly1305_add_aad(chacha20poly1305_state *st,
                                const unsigned char *adata,
                                      unsigned long  adatalen);

\end{verbatim}
This adds the additional authentication data \textit{adata} of length \textit{adatalen} to the ChaCha20--Poly1305 state \textit{st}.

\subsection{Encryption / Decryption}
After the AAD has been processed, the plaintext (or ciphertext depending on the direction) can be processed.

\index{chacha20poly1305\_encrypt()}
\begin{verbatim}
int chacha20poly1305_encrypt(chacha20poly1305_state *st,
                                const unsigned char *in,
                                      unsigned long  inlen,
                                      unsigned char *out);
\end{verbatim}
This encrypts the data where \textit{in} is the plaintext and \textit{out} is the ciphertext. The length of both are equal and stored in \textit{inlen}.

\index{chacha20poly1305\_decrypt()}
\begin{verbatim}
int chacha20poly1305_decrypt(chacha20poly1305_state *st,
                                const unsigned char *in,
                                      unsigned long  inlen,
                                      unsigned char *out);
\end{verbatim}
This decrypts the data where \textit{in} is the ciphertext and \textit{out} is the plaintext. The length of both are equal and stored in \textit{inlen}.

\subsection{State Termination}
To terminate a ChaCha20--Poly1305 state and retrieve the message authentication tag call the following function.

\index{chacha20poly1305\_done()}
\begin{verbatim}
int chacha20poly1305_done(chacha20poly1305_state *st,
                                   unsigned char *tag,
                                   unsigned long *taglen);
\end{verbatim}
This terminates the ChaCha20--Poly1305 state \textit{st} and stores the tag in \textit{tag} of length \textit{taglen} octets (always 16).

\subsection{One--Shot Packet}
To process a single packet under any given key the following helper function can be used.

\index{chacha20poly1305\_memory()}
\begin{verbatim}
int chacha20poly1305_memory(const unsigned char *key,
                                  unsigned long  keylen,
                            const unsigned char *iv,
                                  unsigned long  ivlen,
                            const unsigned char *aad,
                                  unsigned long  aadlen,
                            const unsigned char *in,
                                  unsigned long  inlen,
                                  unsigned char *out,
                                  unsigned char *tag,
                                  unsigned long *taglen,
                                            int  direction);
\end{verbatim}
This will initialize the ChaCha20--Poly1305 state with the given key, IV and AAD value then proceed to
encrypt (\textit{direction} equals \textbf{CHACHA20POLY1305\_ENCRYPT}) or decrypt (\textit{direction} equals
\textbf{CHACHA20POLY1305\_DECRYPT}) the message text and store the final message tag. The definition of the
variables is the same as it is for all the manual functions.

IMPORTANT NOTICE: for \textit{direction == CHACHA20POLY1305\_DECRYPT} the caller has to fill \textit{tag} and \textit{taglen} with expected
tag value. The \textit{chacha20poly1305\_memory} in decrypt mode validates the \textit{tag} value and returns \textit{CRYPT\_ERROR} on mismatch.

\chapter{One-Way Cryptographic Hash Functions}
\mysection{Core Functions}
Like the ciphers, there are hash core functions and a universal data type to hold the hash state called \textit{hash\_state}.  To initialize hash
XXX (where XXX is the name) call:
\index{Hash Functions}
\begin{verbatim}
void XXX_init(hash_state *md);
\end{verbatim}

This simply sets up the hash to the default state governed by the specifications of the hash.  To add data to the message being hashed call:
\begin{verbatim}
int XXX_process(         hash_state *md,
                const unsigned char *in,
                      unsigned long  inlen);
\end{verbatim}
Essentially all hash messages are virtually infinitely\footnote{Most hashes are limited to $2^{64}$ bits or 2,305,843,009,213,693,952 bytes.} long message which
are buffered.  In the case where this limit is reached the \textit{XXX\_process()} function returns \textit{CRYPT\_HASH\_OVERFLOW}.
\index{CRYPT\_HASH\_OVERFLOW}
The data can be passed in any sized chunks as long as the order of the bytes are the same, the message digest (hash output) will be the same.  For example, this means that:
\begin{verbatim}
md5_process(&md, "hello ", 6);
md5_process(&md, "world", 5);
\end{verbatim}
Will produce the same message digest as the single call:
\index{Message Digest}
\begin{verbatim}
md5_process(&md, "hello world", 11);
\end{verbatim}

To finally get the message digest (the hash) call:
\begin{verbatim}
int XXX_done(   hash_state *md,
             unsigned char *out);
\end{verbatim}

This function will finish up the hash and store the result in the \textit{out} array.  You must ensure that \textit{out} is long
enough for the hash in question.  Often hashes are used to get keys for symmetric ciphers so the \textit{XXX\_done()} functions
will wipe the \textit{md} variable before returning automatically.

To test a hash function call:
\begin{verbatim}
int XXX_test(void);
\end{verbatim}

This will return {\bf CRYPT\_OK} if the hash matches the test vectors, otherwise it returns an error code.  An
example snippet that hashes a message with md5 is given below.
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
    hash_state md;
    unsigned char *in = "hello world", out[16];

    /* setup the hash */
    md5_init(&md);

    /* add the message */
    md5_process(&md, in, strlen(in));

    /* get the hash in out[0..15] */
    md5_done(&md, out);

    return 0;
}
\end{verbatim}
\end{small}

\mysection{Hash Descriptors}
Like the set of ciphers, the set of hashes have descriptors as well.  They are stored in an array called \textit{hash\_descriptor} and
are defined by:
\begin{verbatim}
struct ltc_hash_descriptor {
    char *name;

    unsigned long hashsize;    /* digest output size in bytes  */
    unsigned long blocksize;   /* the block size the hash uses */

    void (*init)   (hash_state *hash);

    int  (*process)(         hash_state *hash,
                    const unsigned char *in,
                          unsigned long  inlen);

    int  (*done)   (hash_state *hash, unsigned char *out);

    int  (*test)   (void);
};
\end{verbatim}

\index{find\_hash()}
The \textit{name} member is the name of the hash function (all lowercase).  The \textit{hashsize} member is the size of the digest output
in bytes, while \textit{blocksize} is the size of blocks the hash expects to the compression function.  Technically, this detail is not important
for high level developers but is useful to know for performance reasons.

The \textit{init} member initializes the hash, \textit{process} passes data through the hash, \textit{done} terminates the hash and retrieves the
digest.  The \textit{test} member tests the hash against the specified test vectors.

There is a function to search the array as well called \textit{int find\_hash(char *name)}.  It returns -1 if the hash is not found, otherwise, the
position in the descriptor table of the hash.

In addition, there is also find\_hash\_oid() which finds a hash by the ASN.1 OBJECT IDENTIFIER string.
\index{find\_hash\_oid()}
\begin{verbatim}
int find_hash_oid(const unsigned long *ID, unsigned long IDlen);
\end{verbatim}

You can use the table to indirectly call a hash function that is chosen at run-time.  For example:
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   unsigned char buffer[100], hash[MAXBLOCKSIZE];
   int idx, x;
   hash_state md;

   /* register hashes .... */
   if (register_hash(&md5_desc) == -1) {
      printf("Error registering MD5.\n");
      return -1;
   }

   /* register other hashes ... */

   /* prompt for name and strip newline */
   printf("Enter hash name: \n");
   fgets(buffer, sizeof(buffer), stdin);
   buffer[strlen(buffer) - 1] = 0;

   /* get hash index */
   idx = find_hash(buffer);
   if (idx == -1) {
      printf("Invalid hash name!\n");
      return -1;
   }

   /* hash input until blank line */
   hash_descriptor[idx].init(&md);
   while (fgets(buffer, sizeof(buffer), stdin) != NULL)
         hash_descriptor[idx].process(&md, buffer, strlen(buffer));
   hash_descriptor[idx].done(&md, hash);

   /* dump to screen */
   for (x = 0; x < hash_descriptor[idx].hashsize; x++)
       printf("%02x ", hash[x]);
   printf("\n");
   return 0;
}
\end{verbatim}
\end{small}

Note the usage of \textbf{MAXBLOCKSIZE}.  In LibTomCrypt, no symmetric block, key or hash digest is larger than \textbf{MAXBLOCKSIZE} in
length.  This provides a simple size you can set your automatic arrays to that will not get overrun.

There are three helper functions to make working with hashes easier.  The first is a function to hash a buffer, and produce the digest in a single
function call.

\index{hash\_memory()}
\begin{verbatim}
int hash_memory(                int  hash,
                const unsigned char *in,
                      unsigned long  inlen,
                      unsigned char *out,
                      unsigned long *outlen);
\end{verbatim}

This will hash the data pointed to by \textit{in} of length \textit{inlen}.  The hash used is indexed by the \textit{hash} parameter.  The message
digest is stored in \textit{out}, and the \textit{outlen} parameter is updated to hold the message digest size.

The next helper function allows for the hashing of a file based on a file name.
\index{hash\_file()}
\begin{verbatim}
int hash_file(          int  hash,
                 const char *fname,
              unsigned char *out,
              unsigned long *outlen);
\end{verbatim}

This will hash the file named by \textit{fname} using the hash indexed by \textit{hash}.  The file named in this function call must be readable by the
user owning the process performing the request.  This function can be omitted by the \textbf{LTC\_NO\_FILE} define, which forces it to return \textbf{CRYPT\_NOP}
when it is called.  The message digest is stored in \textit{out}, and the \textit{outlen} parameter is updated to hold the message digest size.

\index{hash\_filehandle()}
\begin{verbatim}
int hash_filehandle(          int  hash,
                             FILE *in,
                    unsigned char *out,
                    unsigned long *outlen);
\end{verbatim}

This will hash the file identified by the handle \textit{in} using the hash indexed by \textit{hash}.  This will begin hashing from the current file pointer position, and
will not rewind the file pointer when finished.  This function can be omitted by the \textbf{LTC\_NO\_FILE} define, which forces it to return \textbf{CRYPT\_NOP}
when it is called.  The message digest is stored in \textit{out}, and the \textit{outlen} parameter is updated to hold the message digest size.

To perform the above hash with md5 the following code could be used:
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int idx, err;
   unsigned long len;
   unsigned char out[MAXBLOCKSIZE];

   /* register the hash */
   if (register_hash(&md5_desc) == -1) {
      printf("Error registering MD5.\n");
      return -1;
   }

   /* get the index of the hash  */
   idx = find_hash("md5");

   /* call the hash */
   len = sizeof(out);
   if ((err =
       hash_memory(idx, "hello world", 11, out, &len)) != CRYPT_OK) {
      printf("Error hashing data: %s\n", error_to_string(err));
      return -1;
   }
   return 0;
}
\end{verbatim}
\end{small}

\subsection{Hash Registration}
Similar to the cipher descriptor table you must register your hash algorithms before you can use them.  These functions
work exactly like those of the cipher registration code.  The functions are:
\index{register\_hash()} \index{unregister\_hash()}
\begin{verbatim}
int register_hash(const struct ltc_hash_descriptor *hash);

int unregister_hash(const struct ltc_hash_descriptor *hash);
\end{verbatim}

The following hashes are provided as of this release within the LibTomCrypt library:
\index{Hash descriptor table}

\begin{figure}[H]
\begin{center}
\begin{tabular}{|c|c|c|}
      \hline \textbf{Name} & \textbf{Descriptor Name} & \textbf{Size of Message Digest (bytes)} \\
      \hline WHIRLPOOL & whirlpool\_desc & 64 \\
      \hline Keccak512 & keccak\_512\_desc & 64 \\
      \hline SHA3-512 & sha3\_512\_desc & 64 \\
      \hline SHA-512 & sha512\_desc & 64 \\
      \hline BLAKE2B-512 & blake2b\_512\_desc & 64 \\
      \hline Keccak384 & keccak\_384\_desc & 48 \\
      \hline SHA3-384 & sha3\_384\_desc & 48 \\
      \hline SHA-384 & sha384\_desc & 48 \\
      \hline RIPEMD-320 & rmd160\_desc & 40 \\
      \hline SHA-512/256 & sha512\_256\_desc & 32 \\
      \hline Keccak256 & keccak\_256\_desc & 32 \\
      \hline SHA3-256 & sha3\_256\_desc & 32 \\
      \hline SHA-256 & sha256\_desc & 32 \\
      \hline RIPEMD-256 & rmd160\_desc & 32 \\
      \hline BLAKE2S-256 & blake2s\_256\_desc & 32 \\
      \hline BLAKE2B-256 & blake2b\_256\_desc & 32 \\
      \hline SHA-512/224 & sha512\_224\_desc & 28 \\
      \hline Keccak224 & keccak\_224\_desc & 28 \\
      \hline SHA3-224 & sha3\_224\_desc & 28 \\
      \hline SHA-224 & sha224\_desc & 28 \\
      \hline BLAKE2S-224 & blake2s\_224\_desc & 28 \\
      \hline BLAKE2B-384 & blake2b\_384\_desc & 48 \\
      \hline TIGER-192 & tiger\_desc & 24 \\
      \hline SHA-1 & sha1\_desc & 20 \\
      \hline RIPEMD-160 & rmd160\_desc & 20 \\
      \hline BLAKE2S-160 & blake2s\_160\_desc & 20 \\
      \hline BLAKE2B-160 & blake2b\_160\_desc & 20 \\
      \hline RIPEMD-128 & rmd128\_desc & 16 \\
      \hline MD5 & md5\_desc & 16 \\
      \hline MD4 & md4\_desc & 16 \\
      \hline MD2 & md2\_desc & 16 \\
      \hline BLAKE2S-128 & blake2s\_128\_desc & 16 \\
      \hline
\end{tabular}
\end{center}
\caption{Built--In Software Hashes}
\end{figure}
\vfil

\mysection{Cipher Hash Construction}
\index{Cipher Hash Construction}
An addition to the suite of hash functions is the \textit{Cipher Hash Construction} or \textit{CHC} mode.  In this mode
applicable block ciphers (such as AES) can be turned into hash functions that other LTC functions can use.  In
particular this allows a cryptosystem to be designed using very few moving parts.

In order to use the CHC system the developer will have to take a few extra steps.  First the \textit{chc\_desc} hash
descriptor must be registered with register\_hash().  At this point the CHC hash cannot be used to hash
data.  While it is in the hash system you still have to tell the CHC code which cipher to use.  This is accomplished
via the chc\_register() function.

\index{chc\_register()}
\begin{verbatim}
int chc_register(int cipher);
\end{verbatim}

A cipher has to be registered with CHC (and also in the cipher descriptor tables with
register\_cipher()).  The chc\_register() function will bind a cipher to the CHC system.  Only one cipher can
be bound to the CHC hash at a time.  There are additional requirements for the system to work.

\begin{enumerate}
   \item The cipher must have a block size greater than 64--bits.
   \item The cipher must allow an input key the size of the block size.
\end{enumerate}

Example of using CHC with the AES block cipher.

\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int err;

   /* register cipher and hash */
   if (register_cipher(&aes_enc_desc) == -1) {
      printf("Could not register cipher\n");
      return EXIT_FAILURE;
   }
   if (register_hash(&chc_desc) == -1) {
      printf("Could not register hash\n");
      return EXIT_FAILURE;
   }

   /* start chc with AES */
   if ((err = chc_register(find_cipher("aes"))) != CRYPT_OK) {
      printf("Error binding AES to CHC: %s\n",
             error_to_string(err));
   }

   /* now you can use chc_hash in any LTC function
    * [aside from pkcs...] */
}
\end{verbatim}

\mysection{SHA3 SHAKE}
The SHA3 class of algorithms provides a special XOF (Extendable Output Functions) mode, called SHAKE.
SHAKE operates in 2 security configurations, 128bit or 256bit, and allows to generate message digests of an arbitrary length.

For further information see \url{https://en.wikipedia.org/wiki/SHA-3}

Example of using SHAKE256 with an arbitrary length output.

\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int err;
   hash_state state;
   const void* msg = "The quick brown fox jumps over the lazy dog";
   unsigned char output[345];

   if ((err = sha3_shake_init(&state, 256)) != CRYPT_OK) {
      printf("Could not init SHAKE256 (%s)\n", error_to_string(err));
      return EXIT_FAILURE;
   }
   if ((err = sha3_shake_process(&state, msg, strlen(msg))) != CRYPT_OK) {
      printf("Could not process SHAKE256 (%s)\n", error_to_string(err));
      return EXIT_FAILURE;
   }
   if ((err = sha3_shake_done(&state, output, sizeof(output))) != CRYPT_OK) {
      printf("Could not finish SHAKE256 (%s)\n", error_to_string(err));
      return EXIT_FAILURE;
   }
   return EXIT_SUCCESS;
}
\end{verbatim}

\mysection{Notice}
It is highly recommended that you \textbf{not} use the MD2, MD4, MD5, or SHA-1 hashes for the purposes of digital signatures or authentication codes.
These hashes are provided for completeness and they still can be used for the purposes of password hashing or one-way accumulators
(e.g. Yarrow).

The other hashes such as the SHA-2 (that includes SHA-512, SHA-512/384, SHA-384, SHA-512/256, SHA-256 and SHA-224) and TIGER-192 are still considered secure
for all purposes you would normally use a hash for.

\chapter{Checksum Functions}

\mysection{Preface}

The API for all checksum functions operate in mode: \textit{init} -- \textit{update} -- \textit{update} -- ... -- \textit{finish}.

The \textit{finish} functions allow to output a partial result if necessary.

\mysection{CRC-32 -- Cyclic redundancy check}

A Cyclic Redundancy Check is an error-detecting code, where LibTomCrypt implements CRC-32 with the polynomial \textit{0x04C11DB7}.

For further information see \url{https://en.wikipedia.org/wiki/Cyclic_redundancy_check}

\begin{verbatim}
void crc32_init(crc32_state *ctx);
void crc32_update(crc32_state *ctx, const unsigned char *input, unsigned long length);
void crc32_finish(crc32_state *ctx, void *hash, unsigned long size);
\end{verbatim}

\mysection{Adler-32}

Adler-32 is a checksum algorithm.

For further information see \url{https://en.wikipedia.org/wiki/Adler-32}.

\begin{verbatim}
void adler32_init(adler32_state *ctx);
void adler32_update(adler32_state *ctx, const unsigned char *input, unsigned long length);
void adler32_finish(adler32_state *ctx, void *hash, unsigned long size);
\end{verbatim}

\chapter{Message Authentication Codes}
\mysection{HMAC Protocol}
Thanks to Dobes Vandermeer, the library now includes support for hash based message authentication codes, or HMAC for short.  An HMAC
of a message is a keyed authentication code that only the owner of a private symmetric key will be able to verify.  The purpose is
to allow an owner of a private symmetric key to produce an HMAC on a message then later verify if it is correct.  Any impostor or
eavesdropper will not be able to verify the authenticity of a message.

The HMAC support works much like the normal hash functions except that the initialization routine requires you to pass a key
and its length.  The key is much like a key you would pass to a cipher.  That is, it is simply an array of octets stored in
unsigned characters.  The initialization routine is:
\index{hmac\_init()}
\begin{verbatim}
int hmac_init(         hmac_state *hmac,
                              int  hash,
              const unsigned char *key,
                    unsigned long  keylen);
\end{verbatim}
The \textit{hmac} parameter is the state for the HMAC code.  The \textit{hash} parameter is the index into the descriptor table of the hash you want
to use to authenticate the message.  The \textit{key} parameter is the pointer to the array of chars that make up the key.  The \textit{keylen} parameter is the
length (in octets) of the key you want to use to authenticate the message.  To send octets of a message through the HMAC system you must use the following function:
\index{hmac\_process()}
\begin{verbatim}
int hmac_process(         hmac_state *hmac,
                 const unsigned char *in,
                       unsigned long  inlen);
\end{verbatim}
\textit{hmac} is the HMAC state you are working with. \textit{in} is the array of octets to send into the HMAC process.  \textit{inlen} is the
number of octets to process.  Like the hash process routines, you can send the data in arbitrarily sized chunks. When you
are finished with the HMAC process you must call the following function to get the HMAC code:
\index{hmac\_done()}
\begin{verbatim}
int hmac_done(   hmac_state *hmac,
              unsigned char *out,
              unsigned long *outlen);
\end{verbatim}
The \textit{hmac} parameter is the HMAC state you are working with.  The \textit{out} parameter is the array of octets where the HMAC code should be stored.
You must set \textit{outlen} to the size of the destination buffer before calling this function.  It is updated with the length of the HMAC code
produced (depending on which hash was picked).  If \textit{outlen} is less than the size of the message digest (and ultimately
the HMAC code) then the HMAC code is truncated as per FIPS-198 specifications (e.g. take the first \textit{outlen} bytes).

There are two utility functions provided to make using HMACs easier to do.  They accept the key and information about the
message (file pointer, address in memory), and produce the HMAC result in one shot.  These are useful if you want to avoid
calling the three step process yourself.

\index{hmac\_memory()}
\begin{verbatim}
int hmac_memory(
                   int  hash,
   const unsigned char *key, unsigned long  keylen,
   const unsigned char *in,  unsigned long  inlen,
         unsigned char *out, unsigned long *outlen);
\end{verbatim}
This will produce an HMAC code for the array of octets in \textit{in} of length \textit{inlen}.  The index into the hash descriptor
table must be provided in \textit{hash}.  It uses the key from \textit{key} with a key length of \textit{keylen}.
The result is stored in the array of octets \textit{out} and the length in \textit{outlen}.  The value of \textit{outlen} must be set
to the size of the destination buffer before calling this function.  Similarly for files there is the  following function:
\index{hmac\_file()}
\begin{verbatim}
int hmac_file(
                   int  hash,
            const char *fname,
   const unsigned char *key, unsigned long  keylen,
         unsigned char *out, unsigned long *outlen);
\end{verbatim}
\textit{hash} is the index into the hash descriptor table of the hash you want to use.  \textit{fname} is the filename to process.
\textit{key} is the array of octets to use as the key of length \textit{keylen}.  \textit{out} is the array of octets where the
result should be stored.

To test if the HMAC code is working there is the following function:
\index{hmac\_test()}
\begin{verbatim}
int hmac_test(void);
\end{verbatim}
Which returns {\bf CRYPT\_OK} if the code passes otherwise it returns an error code.  Some example code for using the
HMAC system is given below.

\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int idx, err;
   hmac_state hmac;
   unsigned char key[16], dst[MAXBLOCKSIZE];
   unsigned long dstlen;

   /* register SHA-1 */
   if (register_hash(&sha1_desc) == -1) {
      printf("Error registering SHA1\n");
      return -1;
   }

   /* get index of SHA1 in hash descriptor table */
   idx = find_hash("sha1");

   /* we would make up our symmetric key in "key[]" here */

   /* start the HMAC */
   if ((err = hmac_init(&hmac, idx, key, 16)) != CRYPT_OK) {
      printf("Error setting up hmac: %s\n", error_to_string(err));
      return -1;
   }

   /* process a few octets */
   if((err = hmac_process(&hmac, "hello", 5) != CRYPT_OK) {
      printf("Error processing hmac: %s\n", error_to_string(err));
      return -1;
   }

   /* get result (presumably to use it somehow...) */
   dstlen = sizeof(dst);
   if ((err = hmac_done(&hmac, dst, &dstlen)) != CRYPT_OK) {
      printf("Error finishing hmac: %s\n", error_to_string(err));
      return -1;
   }
   printf("The hmac is %lu bytes long\n", dstlen);

   /* return */
   return 0;
}
\end{verbatim}
\end{small}

\mysection{OMAC Support}
\index{OMAC} \index{CMAC}
OMAC\footnote{\url{http://crypt.cis.ibaraki.ac.jp/omac/omac.html}}, which stands for \textit{One-Key CBC MAC} is an
algorithm which produces a Message Authentication Code (MAC) using only a block cipher such as AES.  Note:  OMAC has been standardized as
CMAC within NIST, for the purposes of this library OMAC and CMAC are synonymous.  From an API standpoint, the OMAC routines work much like the
HMAC routines.  Instead, in this case a cipher is used instead of a hash.

To start an OMAC state you call
\index{omac\_init()}
\begin{verbatim}
int omac_init(         omac_state *omac,
                              int  cipher,
              const unsigned char *key,
                    unsigned long  keylen);
\end{verbatim}
The \textit{omac} parameter is the state for the OMAC algorithm.  The \textit{cipher} parameter is the index into the cipher\_descriptor table
of the cipher\footnote{The cipher must have a 64 or 128 bit block size.  Such as CAST5, Blowfish, DES, AES, Twofish, etc.} you
wish to use.  The \textit{key} and \textit{keylen} parameters are the keys used to authenticate the data.

To send data through the algorithm call
\index{omac\_process()}
\begin{verbatim}
int omac_process(         omac_state *state,
                 const unsigned char *in,
                       unsigned long  inlen);
\end{verbatim}
This will send \textit{inlen} bytes from \textit{in} through the active OMAC state \textit{state}.  Returns \textbf{CRYPT\_OK} if the
function succeeds.  The function is not sensitive to the granularity of the data.  For example,

\begin{verbatim}
omac_process(&mystate, "hello",  5);
omac_process(&mystate, " world", 6);
\end{verbatim}

Would produce the same result as,

\begin{verbatim}
omac_process(&mystate, "hello world",  11);
\end{verbatim}

When you are done processing the message you can call the following to compute the message tag.

\index{omac\_done()}
\begin{verbatim}
int omac_done(   omac_state *state,
              unsigned char *out,
              unsigned long *outlen);
\end{verbatim}
Which will terminate the OMAC and output the \textit{tag} (MAC) to \textit{out}.  Note that unlike the HMAC and other code
\textit{outlen} can be smaller than the default MAC size (for instance AES would make a 16-byte tag).  Part of the OMAC
specification states that the output may be truncated.  So if you pass in $outlen = 5$ and use AES as your cipher than
the output MAC code will only be five bytes long.  If \textit{outlen} is larger than the default size it is set to the default
size to show how many bytes were actually used.

Similar to the HMAC code the file and memory functions are also provided.  To OMAC a buffer of memory in one shot use the
following function.

\index{omac\_memory()}
\begin{verbatim}
int omac_memory(
                    int  cipher,
    const unsigned char *key, unsigned long keylen,
    const unsigned char *in,  unsigned long inlen,
          unsigned char *out, unsigned long *outlen);
\end{verbatim}
This will compute the OMAC of \textit{inlen} bytes of \textit{in} using the key \textit{key} of length \textit{keylen} bytes and the cipher
specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with the same
rules as omac\_done.

To OMAC a file use
\index{omac\_file()}
\begin{verbatim}
int omac_file(
                    int  cipher,
    const unsigned char *key,      unsigned long keylen,
             const char *filename,
          unsigned char *out,      unsigned long *outlen);
\end{verbatim}

Which will OMAC the entire contents of the file specified by \textit{filename} using the key \textit{key} of length \textit{keylen} bytes
and the cipher specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with
the same rules as omac\_done.

To test if the OMAC code is working there is the following function:
\index{omac\_test()}
\begin{verbatim}
int omac_test(void);
\end{verbatim}
Which returns {\bf CRYPT\_OK} if the code passes otherwise it returns an error code.  Some example code for using the
OMAC system is given below.

\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int idx, err;
   omac_state omac;
   unsigned char key[16], dst[MAXBLOCKSIZE];
   unsigned long dstlen;

   /* register Rijndael */
   if (register_cipher(&rijndael_desc) == -1) {
      printf("Error registering Rijndael\n");
      return -1;
   }

   /* get index of Rijndael in cipher descriptor table */
   idx = find_cipher("rijndael");

   /* we would make up our symmetric key in "key[]" here */

   /* start the OMAC */
   if ((err = omac_init(&omac, idx, key, 16)) != CRYPT_OK) {
      printf("Error setting up omac: %s\n", error_to_string(err));
      return -1;
   }

   /* process a few octets */
   if((err = omac_process(&omac, "hello", 5) != CRYPT_OK) {
      printf("Error processing omac: %s\n", error_to_string(err));
      return -1;
   }

   /* get result (presumably to use it somehow...) */
   dstlen = sizeof(dst);
   if ((err = omac_done(&omac, dst, &dstlen)) != CRYPT_OK) {
      printf("Error finishing omac: %s\n", error_to_string(err));
      return -1;
   }
   printf("The omac is %lu bytes long\n", dstlen);

   /* return */
   return 0;
}
\end{verbatim}
\end{small}

\mysection{PMAC Support}
The PMAC\footnote{J.Black, P.Rogaway, \textit{A Block--Cipher Mode of Operation for Parallelizable Message Authentication}}
protocol is another MAC algorithm that relies solely on a symmetric-key block cipher.  It uses essentially the same
API as the provided OMAC code.

A PMAC state is initialized with the following.

\index{pmac\_init()}
\begin{verbatim}
int pmac_init(         pmac_state *pmac,
                              int  cipher,
              const unsigned char *key,
                    unsigned long  keylen);
\end{verbatim}
Which initializes the \textit{pmac} state with the given \textit{cipher} and \textit{key} of length \textit{keylen} bytes.  The chosen cipher
must have a 64 or 128 bit block size (e.x. AES).

To MAC data simply send it through the process function.

\index{pmac\_process()}
\begin{verbatim}
int pmac_process(         pmac_state *state,
                 const unsigned char *in,
                       unsigned long  inlen);
\end{verbatim}
This will process \textit{inlen} bytes of \textit{in} in the given \textit{state}.  The function is not sensitive to the granularity of the
data.  For example,

\begin{verbatim}
pmac_process(&mystate, "hello",  5);
pmac_process(&mystate, " world", 6);
\end{verbatim}

Would produce the same result as,

\begin{verbatim}
pmac_process(&mystate, "hello world",  11);
\end{verbatim}

When a complete message has been processed the following function can be called to compute the message tag.

\index{pmac\_done()}
\begin{verbatim}
int pmac_done(   pmac_state *state,
              unsigned char *out,
              unsigned long *outlen);
\end{verbatim}
This will store up to \textit{outlen} bytes of the tag for the given \textit{state} into \textit{out}.  Note that if \textit{outlen} is larger
than the size of the tag it is set to the amount of bytes stored in \textit{out}.

Similar to the OMAC code the file and memory functions are also provided.  To PMAC a buffer of memory in one shot use the
following function.

\index{pmac\_memory()}
\begin{verbatim}
int pmac_memory(
                    int  cipher,
    const unsigned char *key, unsigned long  keylen,
    const unsigned char *in,  unsigned long  inlen,
          unsigned char *out, unsigned long *outlen);
\end{verbatim}
This will compute the PMAC of \textit{msglen} bytes of \textit{msg} using the key \textit{key} of length \textit{keylen} bytes, and the cipher
specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with the same
rules as pmac\_done().

To PMAC a file use
\index{pmac\_file()}
\begin{verbatim}
int pmac_file(
                    int  cipher,
    const unsigned char *key,      unsigned long keylen,
             const char *filename,
          unsigned char *out,      unsigned long *outlen);
\end{verbatim}

Which will PMAC the entire contents of the file specified by \textit{filename} using the key \textit{key} of length \textit{keylen} bytes,
and the cipher specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with
the same rules as pmac\_done().

To test if the PMAC code is working there is the following function:
\index{pmac\_test()}
\begin{verbatim}
int pmac_test(void);
\end{verbatim}
Which returns {\bf CRYPT\_OK} if the code passes otherwise it returns an error code.

\mysection{Pelican MAC}
Pelican MAC is a new (experimental) MAC by the AES team that uses four rounds of AES as a \textit{mixing function}.  It achieves a very high
rate of processing and is potentially very secure.  It requires AES to be enabled to function.  You do not have to register\_cipher() AES first though
as it calls AES directly.

\index{pelican\_init()}
\begin{verbatim}
int pelican_init(      pelican_state *pelmac,
                 const unsigned char *key,
                       unsigned long  keylen);
\end{verbatim}
This will initialize the Pelican state with the given AES key.  Once this has been done you can begin processing data.

\index{pelican\_process()}
\begin{verbatim}
int pelican_process(      pelican_state *pelmac,
                    const unsigned char *in,
                          unsigned long  inlen);
\end{verbatim}
This will process \textit{inlen} bytes of \textit{in} through the Pelican MAC.  It's best that you pass in multiples of 16 bytes as it makes the
routine more efficient but you may pass in any length of text.  You can call this function as many times as required to process
an entire message.

\index{pelican\_done()}
\begin{verbatim}
int pelican_done(pelican_state *pelmac, unsigned char *out);
\end{verbatim}
This terminates a Pelican MAC and writes the 16--octet tag to \textit{out}.

\subsection{Example}

\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   pelican_state pelstate;
   unsigned char key[32], tag[16];
   int           err;

   /* somehow initialize a key */

   /* initialize pelican mac */
   if ((err = pelican_init(&pelstate, /* the state */
                           key,       /* user key */
                           32         /* key length in octets */
                          )) != CRYPT_OK) {
      printf("Error initializing Pelican: %s",
              error_to_string(err));
      return EXIT_FAILURE;
   }

   /* MAC some data */
   if ((err = pelican_process(&pelstate,       /* the state */
                              "hello world",   /* data to mac */
                              11               /* length of data */
                              )) != CRYPT_OK) {
      printf("Error processing Pelican: %s",
             error_to_string(err));
      return EXIT_FAILURE;
   }

   /* Terminate the MAC */
   if ((err = pelican_done(&pelstate,/* the state */
                           tag       /* where to store the tag */
                           )) != CRYPT_OK) {
      printf("Error terminating Pelican: %s",
             error_to_string(err));
      return EXIT_FAILURE;
   }

   /* tag[0..15] has the MAC output now */

   return EXIT_SUCCESS;
}
\end{verbatim}

\mysection{XCBC-MAC}
As of LibTomCrypt v1.15, XCBC-MAC (RFC 3566) has been provided to support TLS encryption suites.  Like OMAC, it computes a message authentication code
by using a cipher in CBC mode.  It also uses a single key which it expands into the requisite three keys for the MAC function.  A XCBC--MAC state is
initialized with the following function:

\index{xcbc\_init()}
\begin{verbatim}
int xcbc_init(         xcbc_state *xcbc,
                              int  cipher,
              const unsigned char *key,
                    unsigned long  keylen);
\end{verbatim}

This will initialize the XCBC--MAC state \textit{xcbc}, with the key specified in \textit{key} of length \textit{keylen} octets.  The cipher indicated
by the \textit{cipher} index can be either a 64 or 128--bit block cipher.  This will return \textbf{CRYPT\_OK} on success.

\index{LTC\_XCBC\_PURE}
It is possible to use XCBC in a three key mode by OR'ing the value \textbf{LTC\_XCBC\_PURE} against the \textit{keylen} parameter.  In this mode, the key is
interpretted as three keys.  If the cipher has a block size of $n$ octets, the first key is then $keylen - 2n$ octets and is the encryption key.  The next
$2n$ octets are the $K_1$ and $K_2$ padding keys (used on the last block).  For example, to use AES--192 \textit{keylen} should be $24 + 2 \cdot 16 = 56$ octets.
The three keys are interpretted as if they were concatenated in the \textit{key} buffer.


To process data through XCBC--MAC use the following function:

\index{xcbc\_process()}
\begin{verbatim}
int xcbc_process(         xcbc_state *state,
                 const unsigned char *in,
                       unsigned long  inlen);
\end{verbatim}

This will add the message octets pointed to by \textit{in} of length \textit{inlen} to the XCBC--MAC state pointed to by \textit{state}.  Like the other MAC functions,
the granularity of the input is not important but the order is.  This will return \textbf{CRYPT\_OK} on success.

To compute the MAC tag value use the following function:

\index{xcbc\_done()}
\begin{verbatim}
int xcbc_done(   xcbc_state *state,
              unsigned char *out,
              unsigned long *outlen);
\end{verbatim}

This will retrieve the XCBC--MAC tag from the state pointed to by \textit{state}, and store it in the array pointed to by \textit{out}.  The \textit{outlen} parameter
specifies the maximum size of the destination buffer, and is updated to hold the final size of the tag when the function returns.  This will return \textbf{CRYPT\_OK} on success.

Helper functions are provided to make parsing memory buffers and files easier.  The following functions are provided:

\index{xcbc\_memory()}
\begin{verbatim}
int xcbc_memory(
                    int  cipher,
    const unsigned char *key, unsigned long  keylen,
    const unsigned char *in,  unsigned long  inlen,
          unsigned char *out, unsigned long *outlen);
\end{verbatim}
This will compute the XCBC--MAC of \textit{msglen} bytes of \textit{msg}, using the key \textit{key} of length \textit{keylen} bytes, and the cipher
specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with the same rules as xcbc\_done().

To xcbc a file use
\index{xcbc\_file()}
\begin{verbatim}
int xcbc_file(
                    int  cipher,
    const unsigned char *key,      unsigned long keylen,
             const char *filename,
          unsigned char *out,      unsigned long *outlen);
\end{verbatim}

Which will XCBC--MAC the entire contents of the file specified by \textit{filename} using the key \textit{key} of length \textit{keylen} bytes, and the cipher
specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with the same rules as xcbc\_done().


To test XCBC--MAC for RFC 3566 compliance use the following function:

\index{xcbc\_test()}
\begin{verbatim}
int xcbc_test(void);
\end{verbatim}

This will return \textbf{CRYPT\_OK} on success.  This requires the AES or Rijndael descriptor be previously registered, otherwise, it will return
\textbf{CRYPT\_NOP}.

\mysection{F9--MAC}
The F9--MAC is yet another CBC--MAC variant proposed for the 3GPP standard.  Originally specified to be used with the KASUMI block cipher, it can also be used
with other ciphers.  For LibTomCrypt, the F9--MAC code can use any cipher.

\subsection{Usage Notice}
F9--MAC differs slightly from the other MAC functions in that it requires the caller to perform the final message padding.  The padding quite simply is a direction
bit followed by a 1 bit and enough zeros to make the message a multiple of the cipher block size.  If the message is byte aligned, the padding takes on the form of
a single 0x40 or 0xC0 byte followed by enough 0x00 bytes to make the message proper multiple.

If the user simply wants a MAC function (hint: use OMAC) padding with a single 0x40 byte should be sufficient for security purposes and still be reasonably compatible
with F9--MAC.

\subsection{F9--MAC Functions}
A F9--MAC state is initialized with the following function:
\index{f9\_init()}
\begin{verbatim}
int f9_init(           f9_state *f9,
                            int  cipher,
            const unsigned char *key,
                  unsigned long  keylen);
\end{verbatim}

This will initialize the F9--MAC state \textit{f9}, with the key specified in \textit{key} of length \textit{keylen} octets.  The cipher indicated
by the \textit{cipher} index can be either a 64 or 128--bit block cipher.  This will return \textbf{CRYPT\_OK} on success.

To process data through F9--MAC use the following function:
\index{f9\_process()}
\begin{verbatim}
int f9_process(           f9_state *state,
               const unsigned char *in,
                     unsigned long  inlen);
\end{verbatim}

This will add the message octets pointed to by \textit{in} of length \textit{inlen} to the F9--MAC state pointed to by \textit{state}.  Like the other MAC functions,
the granularity of the input is not important but the order is.  This will return \textbf{CRYPT\_OK} on success.

To compute the MAC tag value use the following function:

\index{f9\_done()}
\begin{verbatim}
int f9_done(     f9_state *state,
            unsigned char *out,
            unsigned long *outlen);
\end{verbatim}

This will retrieve the F9--MAC tag from the state pointed to by \textit{state}, and store it in the array pointed to by \textit{out}.  The \textit{outlen} parameter
specifies the maximum size of the destination buffer, and is updated to hold the final size of the tag when the function returns.  This will return
\textbf{CRYPT\_OK} on success.

Helper functions are provided to make parsing memory buffers and files easier.  The following functions are provided:

\index{f9\_memory()}
\begin{verbatim}
int f9_memory(
                    int  cipher,
    const unsigned char *key, unsigned long  keylen,
    const unsigned char *in,  unsigned long  inlen,
          unsigned char *out, unsigned long *outlen);
\end{verbatim}
This will compute the F9--MAC of \textit{msglen} bytes of \textit{msg}, using the key \textit{key} of length \textit{keylen} bytes, and the cipher
specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with the same rules as f9\_done().

To F9--MAC a file use
\index{f9\_file()}
\begin{verbatim}
int f9_file(
                    int  cipher,
    const unsigned char *key,      unsigned long keylen,
             const char *filename,
          unsigned char *out,      unsigned long *outlen);
\end{verbatim}

Which will F9--MAC the entire contents of the file specified by \textit{filename} using the key \textit{key} of length \textit{keylen} bytes, and the cipher
specified by the \textit{cipher}'th entry in the cipher\_descriptor table.  It will store the MAC in \textit{out} with the same rules as f9\_done().


To test f9--MAC for RFC 3566 compliance use the following function:

\index{f9\_test()}
\begin{verbatim}
int f9_test(void);
\end{verbatim}

This will return \textbf{CRYPT\_OK} on success.  This requires the AES or Rijndael descriptor be previously registered, otherwise, it will return
\textbf{CRYPT\_NOP}.

\mysection{Poly1305--MAC}

The Poly1305--MAC is a cryptographic message authentication code created by Daniel J. Bernstein.
More info at \url{https://en.wikipedia.org/wiki/Poly1305}.

A Poly1305--MAC state is initialized with the following function:
\index{poly1305\_init()}
\begin{verbatim}
int poly1305_init(     poly1305_state *st,
                  const unsigned char *key,
                        unsigned long  keylen);
\end{verbatim}
This will initialize the Poly1305--MAC state \textit{st}, with the key specified in \textit{key} of length \textit{keylen} octets (always 32).

To process data through Poly1305--MAC use the following function:
\index{poly1305\_process()}
\begin{verbatim}
int poly1305_process(     poly1305_state *st,
                     const unsigned char *in,
                           unsigned long  inlen);
\end{verbatim}

This will add the message octets pointed to by \textit{in} of length \textit{inlen} to the Poly1305--MAC state pointed to by \textit{st}.

To compute the MAC tag value use the following function:
\index{poly1305\_done()}
\begin{verbatim}
int poly1305_done(poly1305_state *st,
                   unsigned char *mac,
                   unsigned long *maclen);
\end{verbatim}

This will retrieve the Poly1305--MAC tag from the state pointed to by \textit{st}, and store it in the array pointed to by \textit{mac}.
The \textit{maclen} parameter specifies the maximum size of the destination buffer, and is updated to hold the final size of the tag when
the function returns.

Helper functions are provided to make parsing memory buffers and files easier. The following functions are provided:
\index{poly1305\_memory()}
\begin{verbatim}
int poly1305_memory(const unsigned char *key,
                          unsigned long  keylen,
                    const unsigned char *in,
                          unsigned long  inlen,
                          unsigned char *mac,
                          unsigned long *maclen);
\end{verbatim}
This will compute the Poly1305--MAC of \textit{inlen} bytes of \textit{in}, using the key \textit{key} of length \textit{keylen} bytes.
It will store the MAC in \textit{mac} with the same rules as poly1305\_done().

To Poly1305--MAC a file use
\index{poly1305\_file()}
\begin{verbatim}
int poly1305_file(         const char *fname,
                  const unsigned char *key,
                        unsigned long  keylen,
                        unsigned char *mac,
                        unsigned long *maclen);
\end{verbatim}

Which will Poly1305--MAC the entire contents of the file specified by \textit{fname} using the key \textit{key} of
length \textit{keylen} bytes. It will store the MAC in \textit{mac} with the same rules as poly1305\_done().

\mysection{BLAKE2s + BLAKE2b MAC}

The BLAKE2s and BLAKE2b are cryptographic message authentication code designed by Jean--Philippe Aumasson,
Samuel Neves, Zooko Wilcox-O'Hearn, and Christian Winnerlein. More info at \url{https://tools.ietf.org/html/rfc7693}.

A BLAKE2s/b--MAC state is initialized with the following function:
\index{blake2smac\_init()}
\begin{verbatim}
int blake2smac_init(blake2smac_state *st,
                       unsigned long  outlen,
                 const unsigned char *key,
                       unsigned long  keylen);
\end{verbatim}
\index{blake2bmac\_init()}
\begin{verbatim}
int blake2bmac_init(blake2smac_state *st,
                       unsigned long  outlen,
                 const unsigned char *key,
                       unsigned long  keylen);
\end{verbatim}
This will initialize the BLAKE2s/b--MAC state \textit{st}, with the key specified in \textit{key} of length \textit{keylen} octets (up to 64).
The \textit{outlen} specifies the size of the final tag (up to 64 octets).

To process data through BLAKE2s/b--MAC use the following function:
\index{blake2smac\_process()}
\begin{verbatim}
int blake2smac_process(   blake2smac_state *st,
                       const unsigned char *in,
                             unsigned long  inlen);
\end{verbatim}
\index{blake2bmac\_process()}
\begin{verbatim}
int blake2bmac_process(   blake2bmac_state *st,
                       const unsigned char *in,
                             unsigned long  inlen);
\end{verbatim}

This will add the message octets pointed to by \textit{in} of length \textit{inlen} to the BLAKE2s/b--MAC state pointed to by \textit{st}.

To compute the MAC tag value use the following function:
\index{blake2smac\_done()}
\begin{verbatim}
int blake2smac_done(blake2smac_state *st,
                       unsigned char *mac,
                       unsigned long *maclen);
\end{verbatim}
\index{blake2bmac\_done()}
\begin{verbatim}
int blake2bmac_done(blake2bmac_state *st,
                       unsigned char *mac,
                       unsigned long *maclen);
\end{verbatim}

This will retrieve the BLAKE2s/b--MAC tag from the state pointed to by \textit{st}, and store it in the array pointed to by \textit{mac}.
The \textit{maclen} parameter specifies the maximum size of the destination buffer, and is updated to hold the final size of the tag when
the function returns.

Helper functions are provided to make parsing memory buffers and files easier. The following functions are provided:
\index{blake2smac\_memory()}
\begin{verbatim}
int blake2smac_memory(const unsigned char *key,
                            unsigned long  keylen,
                      const unsigned char *in,
                            unsigned long  inlen,
                            unsigned char *mac,
                            unsigned long *maclen);
\end{verbatim}
\index{blake2bmac\_memory()}
\begin{verbatim}
int blake2bmac_memory(const unsigned char *key,
                            unsigned long  keylen,
                      const unsigned char *in,
                            unsigned long  inlen,
                            unsigned char *mac,
                            unsigned long *maclen);
\end{verbatim}
This will compute the BLAKE2s/b--MAC of \textit{inlen} bytes of \textit{in}, using the key \textit{key} of length \textit{keylen} bytes.
It will store the MAC in \textit{mac} with the same rules as blake2smac\_done().

To BLAKE2s/b--MAC a file use
\index{blake2smac\_file()}
\begin{verbatim}
int blake2smac_file(         const char *fname,
                    const unsigned char *key,
                          unsigned long  keylen,
                          unsigned char *mac,
                          unsigned long *maclen);
\end{verbatim}
\index{blake2bmac\_file()}
\begin{verbatim}
int blake2bmac_file(         const char *fname,
                    const unsigned char *key,
                          unsigned long  keylen,
                          unsigned char *mac,
                          unsigned long *maclen);
\end{verbatim}

Which will BLAKE2s/b--MAC the entire contents of the file specified by \textit{fname} using the key \textit{key} of
length \textit{keylen} bytes. It will store the MAC in \textit{mac} with the same rules as blake2smac\_done().

\chapter{Pseudo-Random Number Generators}
\mysection{Core Functions}
The library provides an array of core functions for Pseudo-Random Number Generators (PRNGs) as well.  A cryptographic PRNG is
used to expand a shorter bit string into a longer bit string.  PRNGs are used wherever random data is required such as Public Key (PK)
key generation.  There is a universal structure called \textit{prng\_state}.  To initialize a PRNG call:
\index{PRNG start}
\begin{verbatim}
int XXX_start(prng_state *prng);
\end{verbatim}

This will setup the PRNG for future use and not seed it.  In order for the PRNG to be cryptographically useful you must give it
entropy.  Ideally you'd have some OS level source to tap like in UNIX.  To add entropy to the PRNG call:
\index{PRNG add\_entropy}
\begin{verbatim}
int XXX_add_entropy(const unsigned char *in,
                          unsigned long  inlen,
                             prng_state *prng);
\end{verbatim}
Which returns {\bf CRYPT\_OK} if the entropy was accepted.  Once you think you have enough entropy you call another
function to put the entropy into action.
\index{PRNG ready}
\begin{verbatim}
int XXX_ready(prng_state *prng);
\end{verbatim}

Which returns {\bf CRYPT\_OK} if it is ready.  Finally to actually read bytes call:
\index{PRNG read}
\begin{verbatim}
unsigned long XXX_read(unsigned char *out,
                       unsigned long  outlen,
                          prng_state *prng);
\end{verbatim}

Which returns the number of bytes read from the PRNG.  When you are finished with a PRNG state you call
the following.

\index{PRNG done}
\begin{verbatim}
void XXX_done(prng_state *prng);
\end{verbatim}

This will terminate a PRNG state and free any memory (if any) allocated.  To export a PRNG state
so that you can later resume the PRNG call the following.

\index{PRNG export}
\begin{verbatim}
int XXX_export(unsigned char *out,
               unsigned long *outlen,
                  prng_state *prng);
\end{verbatim}

This will write a \textit{PRNG state} to the buffer \textit{out} of length \textit{outlen} bytes.  The idea of
the export is meant to be used as a \textit{seed file}.  That is, when the program starts up there will not likely
be that much entropy available.   To import a state to seed a PRNG call the following function.

\index{PRNG import}
\begin{verbatim}
int XXX_import(const unsigned char *in,
                     unsigned long  inlen,
                        prng_state *prng);
\end{verbatim}

This will call the start and add\_entropy functions of the given PRNG.  It will use the state in
\textit{in} of length \textit{inlen} as the initial seed.  You must pass the same seed length as was exported
by the corresponding export function.

Note that importing a state will not \textit{resume} the PRNG from where it left off.  That is, if you export
a state, emit (say) 8 bytes and then import the previously exported state the next 8 bytes will not
specifically equal the 8 bytes you generated previously.

When a program is first executed the normal course of operation is:

\begin{enumerate}
   \item Gather entropy from your sources for a given period of time or number of events.
   \item Start, use your entropy via add\_entropy and ready the PRNG yourself.
\end{enumerate}

When your program is finished you simply call the export function and save the state to a medium (disk,
flash memory, etc).  The next time your application starts up you can detect the state, feed it to the
import function and go on your way.  It is ideal that (as soon as possible) after start up you export a
fresh state.  This helps in the case that the program aborts or the machine is powered down without
being given a chance to exit properly.

Note that even if you have a state to import it is important to add new entropy to the state.  However,
there is less pressure to do so.

To test a PRNG for operational conformity call the following functions.

\index{PRNG test}
\begin{verbatim}
int XXX_test(void);
\end{verbatim}

This will return \textbf{CRYPT\_OK} if PRNG is operating properly.

\subsection{Remarks}

It is possible to be adding entropy and reading from a PRNG at the same time.  For example, if you first seed the PRNG
and call ready() you can now read from it.  You can also keep adding new entropy to it.  The new entropy will not be used
in the PRNG until ready() is called again.  This allows the PRNG to be used and re-seeded at the same time.  No real error
checking is guaranteed to see if the entropy is sufficient, or if the PRNG is even in a ready state before reading.

\subsection{Example}
Below is a simple snippet to read 10 bytes from Yarrow.  It is important to note that this snippet is {\bf NOT} secure since
the entropy added is not random.

\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   prng_state prng;
   unsigned char buf[10];
   int err;

   /* start it */
   if ((err = yarrow_start(&prng)) != CRYPT_OK) {
      printf("Start error: %s\n", error_to_string(err));
   }
   /* add entropy */
   if ((err = yarrow_add_entropy("hello world", 11, &prng))
       != CRYPT_OK) {
      printf("Add_entropy error: %s\n", error_to_string(err));
   }
   /* ready and read */
   if ((err = yarrow_ready(&prng)) != CRYPT_OK) {
      printf("Ready error: %s\n", error_to_string(err));
   }
   printf("Read %lu bytes from yarrow\n",
          yarrow_read(buf, sizeof(buf), &prng));
   return 0;
}
\end{verbatim}

\mysection{PRNG Descriptors}
\index{PRNG Descriptor}
PRNGs have descriptors that allow plugin driven functions to be created using PRNGs. The plugin descriptors are stored in the structure \textit{prng\_descriptor}.  The
format of an element is:
\begin{verbatim}
struct ltc_prng_descriptor {
    char *name;
    int  export_size;    /* size in bytes of exported state */

    int (*start)      (prng_state *);

    int (*add_entropy)(const unsigned char *, unsigned long,
                       prng_state *);

    int (*ready)      (prng_state *);

    unsigned long (*read)(unsigned char *, unsigned long len,
                          prng_state *);

    void (*done)(prng_state *);

    int (*pexport)(unsigned char *, unsigned long *, prng_state *);

    int (*pimport)(const unsigned char *, unsigned long, prng_state *);

    int (*test)(void);
};
\end{verbatim}

To find a PRNG in the descriptor table the following function can be used:
\index{find\_prng()}
\begin{verbatim}
int find_prng(const char *name);
\end{verbatim}
This will search the PRNG descriptor table for the PRNG named \textit{name}.  It will return -1 if the PRNG is not found, otherwise, it returns
the index into the descriptor table.

Just like the ciphers and hashes, you must register your prng before you can use it.  The two functions provided work exactly as those for the cipher registry functions.
They are the following:
\index{register\_prng()} \index{unregister\_prng()}
\begin{verbatim}
int register_prng(const struct ltc_prng_descriptor *prng);
int unregister_prng(const struct ltc_prng_descriptor *prng);
\end{verbatim}

The register function will register the PRNG, and return the index into the table where it was placed (or -1 for error).  It will avoid registering the same
descriptor twice, and will return the index of the current placement in the table if the caller attempts to register it more than once.  The unregister function
will return \textbf{CRYPT\_OK} if the PRNG was found and removed.  Otherwise, it returns \textbf{CRYPT\_ERROR}.

\subsection{PRNGs Provided}
\begin{figure}[H]
\begin{center}
\begin{small}
\begin{tabular}{|c|c|l|}
\hline \textbf{Name} & \textbf{Descriptor} & \textbf{Usage} \\
\hline ChaCha20 & chacha20\_prng\_desc & Stream Cipher PRNG (recommended, fast) \\
\hline Fortuna & fortuna\_desc & Fast long-term PRNG (recommended, secure) \\
\hline RC4 & rc4\_desc & Stream Cipher PRNG \\
\hline SOBER-128 & sober128\_desc & Stream Cipher PRNG \\
\hline sprng & sprng\_desc & Secure PRNG using the System RNG \\
\hline Yarrow & yarrow\_desc & Fast short-term PRNG \\
\hline
\end{tabular}
\end{small}
\end{center}
\caption{List of Provided PRNGs}
\end{figure}

\subsubsection{Yarrow}
Yarrow is fast PRNG meant to collect an unspecified amount of entropy from sources
(keyboard, mouse, interrupts, etc), and produce an unbounded string of random bytes.

\textit{Note:} This PRNG is still secure for most tasks but is no longer recommended.  Users
should use Fortuna or ChaCha20 instead.

\subsubsection{Fortuna}

Fortuna is a fast attack tolerant and more thoroughly designed PRNG suitable for long term
usage.  It is faster than the default implementation of Yarrow\footnote{Yarrow has been implemented
to work with most cipher and hash combos based on which you have chosen to build into the library.} while
providing more security.

Fortuna is slightly less flexible than Yarrow in the sense that it only works with the AES block cipher
and SHA--256 hash function.  Technically, Fortuna will work with any block cipher that accepts a 256--bit
key, and any hash that produces at least a 256--bit output.  However, to make the implementation simpler
it has been fixed to those choices.

Fortuna is more secure than Yarrow in the sense that attackers who learn parts of the entropy being
added to the PRNG learn far less about the state than that of Yarrow.  Without getting into too many
details Fortuna has the ability to recover from state determination attacks where the attacker starts
to learn information from the PRNGs output about the internal state.  Yarrow on the other hand, cannot
recover from that problem until new entropy is added to the pool and put to use through the ready() function.

For detailed information on how the algorithm works and what you have to do to maintain the secure state
get a copy of the book\footnote{Niels Ferguson and Bruce Schneier, Practical Cryptography. ISBN 0-471-22357-3.} or
read the paper online\footnote{\url{https://www.schneier.com/academic/paperfiles/fortuna.pdf} [Accessed on 7th Dec. 2017]}.

Fortuna provides additional API functions to be able to implement some of the important steps proposed in the original algorithm specification.

\index{fortuna\_add\_random\_event()}
\begin{verbatim}
int fortuna_add_random_event(      unsigned long  source, unsigned long pool,
                             const unsigned char *in,     unsigned long inlen,
                                      prng_state *prng);
\end{verbatim}

\textit{fortuna\_add\_random\_event()} can be used as a powerful alternative to the more general \textit{add\_entropy()}.

\index{fortuna\_update\_seed()}
\begin{verbatim}
int fortuna_update_seed(const unsigned char *in, unsigned long inlen,
                                 prng_state *prng);
\end{verbatim}

\textit{fortuna\_update\_seed()} can be used to implement the \textit{UpdateSeedFile} function from the original specification.


\subsubsection{RC4}

RC4 is an old stream cipher that can also double duty as a PRNG in a pinch.  You key RC4 by
calling add\_entropy(), and setup the key by calling ready().

You really should not use RC4 for cryptographical purposes, it's broken.

\subsubsection{SOBER-128}

SOBER--128 is a stream cipher designed by the QUALCOMM Australia team.  Like RC4, you key it by
calling add\_entropy().  There is no need to call ready() for this PRNG as it does not do anything.

Note: this cipher has several oddities about how it operates.  The first call to add\_entropy() sets the cipher's key.
Every other time call to the add\_entropy() function sets the cipher's IV variable.  The IV mechanism allows you to
encrypt several messages with the same key, and not re--use the same key material.

Unlike Yarrow and Fortuna, all of the entropy (and hence security) of this algorithm rests in the data
you pass it on the \textbf{first} call to add\_entropy().  All buffers sent to add\_entropy() must have a length
that is a multiple of four bytes.

Like RC4, the output of SOBER--128 is XOR'ed against the buffer you provide it.  In this manner, you can use
sober128\_read() as an encrypt (and decrypt) function.

Since SOBER--128 has a fixed keying scheme, and is very fast (faster than RC4) the ideal usage of SOBER-128 is to
key it from the output of Fortuna (or Yarrow), and use it to encrypt messages.  It is also ideal for
simulations which need a high quality (and fast) stream of bytes.

\subsubsection{ChaCha20}

ChaCha20 is a fast stream cipher built on a pseudorandom function designed by Daniel J. Bernstein.
It can also double duty as a PRNG.

It is recommended to use 40 bytes of truly random bytes for initialization.

The implementation supports adding entropy via the add\_entropy() function while already being operational.

\subsubsection{Example Usage}
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   prng_state prng;
   unsigned char buf[32];
   int err;

   if ((err = rc4_start(&prng)) != CRYPT_OK) {
      printf("RC4 init error: %s\n", error_to_string(err));
      exit(-1);
   }

   /* use "key" as the key */
   if ((err = rc4_add_entropy("key", 3, &prng)) != CRYPT_OK) {
      printf("RC4 add entropy error: %s\n", error_to_string(err));
      exit(-1);
   }

   /* setup RC4 for use */
   if ((err = rc4_ready(&prng)) != CRYPT_OK) {
      printf("RC4 ready error: %s\n", error_to_string(err));
      exit(-1);
   }

   /* encrypt buffer */
   strcpy(buf,"hello world");
   if (rc4_read(buf, 11, &prng) != 11) {
      printf("RC4 read error\n");
      exit(-1);
   }
   return 0;
}
\end{verbatim}
\end{small}
To decrypt you have to do the exact same steps.

\mysection{The Secure RNG}
\index{Secure RNG}
An RNG is related to a PRNG in many ways, except that it does not expand a smaller seed to get the data.  They generate their random bits
by performing some computation on fresh input bits.  Possibly the hardest thing to get correctly in a cryptosystem is the
PRNG.  Computers are deterministic that try hard not to stray from pre--determined paths.  This makes gathering entropy needed to seed a PRNG
a hard task.

There is one small function that may help on certain platforms:
\index{rng\_get\_bytes()}
\begin{verbatim}
unsigned long rng_get_bytes(
    unsigned char *buf,
    unsigned long  len,
    void         (*callback)(void));
\end{verbatim}

Which will try one of three methods of getting random data.  The first is to open the popular \textit{/dev/random} device which
on most *NIX platforms provides cryptographic random bits\footnote{This device is available in Windows through the Cygwin compiler suite.  It emulates \textit{/dev/random} via the Microsoft CSP.}.
The second method is to try the Microsoft Cryptographic Service Provider, and read the RNG.  The third method is an ANSI C
clock drift method that is also somewhat popular but gives bits of lower entropy.  The \textit{callback} parameter is a pointer to a function that returns void.  It is
used when the slower ANSI C RNG must be used so the calling application can still work.  This is useful since the ANSI C RNG has a throughput of roughly three
bytes a second.  The callback pointer may be set to {\bf NULL} to avoid using it if you do not want to.  The function returns the number of bytes actually read from
any RNG source.  There is a function to help setup a PRNG as well:
\index{rng\_make\_prng()}
\begin{verbatim}
int rng_make_prng(       int  bits,
                         int  wprng,
                  prng_state *prng,
                       void (*callback)(void));
\end{verbatim}
This will try to initialize the prng with a state of at least \textit{bits} of entropy.  The \textit{callback} parameter works much like
the callback in \textit{rng\_get\_bytes()}.  It is highly recommended that you use this function to setup your PRNGs unless you have a
platform where the RNG does not work well.  Example usage of this function is given below:

\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   ecc_key mykey;
   prng_state prng;
   int err;

   /* register yarrow */
   if (register_prng(&yarrow_desc) == -1) {
      printf("Error registering Yarrow\n");
      return -1;
   }

   /* setup the PRNG */
   if ((err = rng_make_prng(128, find_prng("yarrow"), &prng, NULL))
       != CRYPT_OK) {
      printf("Error setting up PRNG, %s\n", error_to_string(err));
      return -1;
   }

   /* make a 192-bit ECC key */
   if ((err = ecc_make_key(&prng, find_prng("yarrow"), 24, &mykey))
       != CRYPT_OK) {
      printf("Error making key: %s\n", error_to_string(err));
      return -1;
   }
   return 0;
}
\end{verbatim}
\end{small}

\subsection{The Secure PRNG Interface}
\index{sprng\_desc}
It is possible to access the secure RNG through the PRNG interface, and in turn use it within dependent functions such
as the PK API.  This simplifies the cryptosystem on platforms where the secure RNG is fast.  The secure PRNG never
requires to be started, that is you need not call the start, add\_entropy, or ready functions.  For example, consider
the previous example using this PRNG.

\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   ecc_key mykey;
   int err;

   /* register SPRNG */
   if (register_prng(&sprng_desc) == -1) {
      printf("Error registering SPRNG\n");
      return -1;
   }

   /* make a 192-bit ECC key */
   if ((err = ecc_make_key(NULL, find_prng("sprng"), 24, &mykey))
       != CRYPT_OK) {
      printf("Error making key: %s\n", error_to_string(err));
      return -1;
   }
   return 0;
}
\end{verbatim}
\end{small}

\chapter{RSA Public Key Cryptography}

\mysection{Introduction}
RSA wrote the PKCS \#1 specifications which detail RSA Public Key Cryptography.  In the specifications are
padding algorithms for encryption and signatures.  The standard includes the \textit{v1.5} and \textit{v2.1} algorithms.
To simplify matters a little the v2.1 encryption and signature padding algorithms are called OAEP and PSS respectively.

\mysection{PKCS \#1 Padding}
PKCS \#1 v1.5 padding is so simple that both signature and encryption padding are performed by the same function.  Note: the
signature padding does \textbf{not} include the ASN.1 padding required.  That is performed by the rsa\_sign\_hash\_ex() function
documented later on in this chapter.

\subsection{PKCS \#1 v1.5 Encoding}
The following function performs PKCS \#1 v1.5 padding:
\index{pkcs\_1\_v1\_5\_encode()}
\begin{verbatim}
int pkcs_1_v1_5_encode(
    const unsigned char *msg,
          unsigned long  msglen,
                    int  block_type,
          unsigned long  modulus_bitlen,
             prng_state *prng,
                    int  prng_idx,
          unsigned char *out,
          unsigned long *outlen);
\end{verbatim}

This will encode the message pointed to by \textit{msg} of length \textit{msglen} octets.  The \textit{block\_type} parameter must be set to
\textbf{LTC\_PKCS\_1\_EME} to perform encryption padding.  It must be set to \textbf{LTC\_PKCS\_1\_EMSA} to perform signature padding.  The \textit{modulus\_bitlen}
parameter indicates the length of the modulus in bits.  The padded data is stored in \textit{out} with a length of \textit{outlen} octets.  The output will not be
longer than the modulus which helps allocate the correct output buffer size.

Only encryption padding requires a PRNG.  When performing signature padding the \textit{prng\_idx} parameter may be left to zero as it is not checked for validity.

\subsection{PKCS \#1 v1.5 Decoding}
The following function performs PKCS \#1 v1.5 de--padding:
\index{pkcs\_1\_v1\_5\_decode()}
\begin{verbatim}
int pkcs_1_v1_5_decode(
    const unsigned char *msg,
          unsigned long  msglen,
                    int  block_type,
          unsigned long  modulus_bitlen,
          unsigned char *out,
          unsigned long *outlen,
                    int *is_valid);
\end{verbatim}
\index{LTC\_PKCS\_1\_EME} \index{LTC\_PKCS\_1\_EMSA}
This will remove the PKCS padding data pointed to by \textit{msg} of length \textit{msglen}.  The decoded data is stored in \textit{out} of length
\textit{outlen}.  If the padding is valid, a 1 is stored in \textit{is\_valid}, otherwise, a 0 is stored.  The \textit{block\_type} parameter must be set to either
\textbf{LTC\_PKCS\_1\_EME} or \textbf{LTC\_PKCS\_1\_EMSA} depending on whether encryption or signature padding is being removed.

\mysection{PKCS \#1 v2.1 Encryption}
PKCS \#1 RSA Encryption amounts to OAEP padding of the input message followed by the modular exponentiation.  As far as this portion of
the library is concerned we are only dealing with th OAEP padding of the message.

\subsection{OAEP Encoding}

The following function performs PKCS \#1 v2.1 encryption padding:

\index{pkcs\_1\_oaep\_encode()}
\begin{alltt}
int pkcs_1_oaep_encode(
    const unsigned char *msg,
          unsigned long  msglen,
    const unsigned char *lparam,
          unsigned long  lparamlen,
          unsigned long  modulus_bitlen,
             prng_state *prng,
                    int  prng_idx,
                    int  hash_idx,
          unsigned char *out,
          unsigned long *outlen);
\end{alltt}

This accepts \textit{msg} as input of length \textit{msglen} which will be OAEP padded.  The \textit{lparam} variable is an additional system specific
tag that can be applied to the encoding.  This is useful to identify which system encoded the message.  If no variance is desired then
\textit{lparam} can be set to \textbf{NULL}.

OAEP encoding requires the length of the modulus in bits in order to calculate the size of the output.  This is passed as the parameter
\textit{modulus\_bitlen}.  \textit{hash\_idx} is the index into the hash descriptor table of the hash desired.  PKCS \#1 allows any hash to be
used but both the encoder and decoder must use the same hash in order for this to succeed.  The size of hash output affects the maximum
 sized input message.  \textit{prng\_idx} and \textit{prng} are the random number generator arguments required to randomize the padding process.
The padded message is stored in \textit{out} along with the length in \textit{outlen}.

If $h$ is the length of the hash and $m$ the length of the modulus (both in octets) then the maximum payload for \textit{msg} is
$m - 2h - 2$.  For example, with a $1024$--bit RSA key and SHA--1 as the hash the maximum payload is $86$ bytes.

Note that when the message is padded it still has not been RSA encrypted.  You must pass the output of this function to
rsa\_exptmod() to encrypt it.

\subsection{OAEP Decoding}

\index{pkcs\_1\_oaep\_decode()}
\begin{alltt}
int pkcs_1_oaep_decode(
    const unsigned char *msg,
          unsigned long  msglen,
    const unsigned char *lparam,
          unsigned long  lparamlen,
          unsigned long  modulus_bitlen,
                    int  hash_idx,
          unsigned char *out,
          unsigned long *outlen,
                    int *res);
\end{alltt}

This function decodes an OAEP encoded message and outputs the original message that was passed to the OAEP encoder.  \textit{msg} is the
output of pkcs\_1\_oaep\_encode() of length \textit{msglen}.  \textit{lparam} is the same system variable passed to the OAEP encoder.  If it does not
match what was used during encoding this function will not decode the packet.  \textit{modulus\_bitlen} is the size of the RSA modulus in bits
and must match what was used during encoding.  Similarly the \textit{hash\_idx} index into the hash descriptor table must match what was used
during encoding.

If the function succeeds it decodes the OAEP encoded message into \textit{out} of length \textit{outlen} and stores a
$1$ in \textit{res}.  If the packet is invalid it stores $0$ in \textit{res} and if the function fails for another reason
it returns an error code.

\mysection{PKCS \#1 Digital Signatures}

\subsection{PSS Encoding}
PSS encoding is the second half of the PKCS \#1 standard which is padding to be applied to messages that are signed.

\index{pkcs\_1\_pss\_encode()}
\begin{alltt}
int pkcs_1_pss_encode(
    const unsigned char *msghash,
          unsigned long  msghashlen,
          unsigned long  saltlen,
             prng_state *prng,
                    int  prng_idx,
                    int  hash_idx,
          unsigned long  modulus_bitlen,
          unsigned char *out,
          unsigned long *outlen);
\end{alltt}

This function assumes the message to be PSS encoded has previously been hashed.  The input hash \textit{msghash} is of length
\textit{msghashlen}.  PSS allows a variable length random salt (it can be zero length) to be introduced in the signature process.
\textit{hash\_idx} is the index into the hash descriptor table of the hash to use.  \textit{prng\_idx} and \textit{prng} are the random
number generator information required for the salt.

Similar to OAEP encoding \textit{modulus\_bitlen} is the size of the RSA modulus (in bits).  It limits the size of the salt.  If $m$ is the length
of the modulus $h$ the length of the hash output (in octets) then there can be $m - h - 2$ bytes of salt.

This function does not actually sign the data it merely pads the hash of a message so that it can be processed by rsa\_exptmod().

\subsection{PSS Decoding}

To decode a PSS encoded signature block you have to use the following.

\index{pkcs\_1\_pss\_decode()}
\begin{alltt}
int pkcs_1_pss_decode(
    const unsigned char *msghash,
          unsigned long  msghashlen,
    const unsigned char *sig,
          unsigned long  siglen,
          unsigned long  saltlen,
                    int  hash_idx,
          unsigned long  modulus_bitlen,
                    int *res);
\end{alltt}
This will decode the PSS encoded message in \textit{sig} of length \textit{siglen} and compare it to values in \textit{msghash} of length
\textit{msghashlen}.  If the block is a valid PSS block and the decoded hash equals the hash supplied \textit{res} is set to non--zero.  Otherwise,
it is set to zero.  The rest of the parameters are as in the PSS encode call.

It's important to use the same \textit{saltlen} and hash for both encoding and decoding as otherwise the procedure will not work.

\mysection{RSA Key Operations}
\subsection{Background}

RSA is a public key algorithm that is based on the inability to find the \textit{e-th} root modulo a composite of unknown
factorization.  Normally the difficulty of breaking RSA is associated with the integer factoring problem but they are
not strictly equivalent.

The system begins with with two primes $p$ and $q$ and their product $N = pq$.  The order or \textit{Euler totient} of the
multiplicative sub-group formed modulo $N$ is given as $\phi(N) = (p - 1)(q - 1)$ which can be reduced to
$\mbox{lcm}(p - 1, q - 1)$.  The public key consists of the composite $N$ and some integer $e$ such that
$\mbox{gcd}(e, \phi(N)) = 1$.  The private key consists of the composite $N$ and the inverse of $e$ modulo $\phi(N)$
often simply denoted as $de \equiv 1\mbox{ }(\mbox{mod }\phi(N))$.

A person who wants to encrypt with your public key simply forms an integer (the plaintext) $M$ such that
$1 < M < N-2$ and computes the ciphertext $C = M^e\mbox{ }(\mbox{mod }N)$.  Since finding the inverse exponent $d$
given only $N$ and $e$ appears to be intractable only the owner of the private key can decrypt the ciphertext and compute
$C^d \equiv \left (M^e \right)^d \equiv M^1 \equiv M\mbox{ }(\mbox{mod }N)$.  Similarly the owner of the private key
can sign a message by \textit{decrypting} it.  Others can verify it by \textit{encrypting} it.

Currently RSA is a difficult system to cryptanalyze provided that both primes are large and not close to each other.
Ideally $e$ should be larger than $100$ to prevent direct analysis.  For example, if $e$ is three and you do not pad
the plaintext to be encrypted than it is possible that $M^3 < N$ in which case finding the cube-root would be trivial.
The most often suggested value for $e$ is $65537$ since it is large enough to make such attacks impossible and also well
designed for fast exponentiation (requires 16 squarings and one multiplication).

It is important to pad the input to RSA since it has particular mathematical structure.  For instance
$M_1^dM_2^d = (M_1M_2)^d$ which can be used to forge a signature.  Suppose $M_3 = M_1M_2$ is a message you want
to have a forged signature for.  Simply get the signatures for $M_1$ and $M_2$ on their own and multiply the result
together.  Similar tricks can be used to deduce plaintexts from ciphertexts.  It is important not only to sign
the hash of documents only but also to pad the inputs with data to remove such structure.

\subsection{RSA Key Generation}

For RSA routines a single \textit{rsa\_key} structure is used.  To make a new RSA key call:
\index{rsa\_make\_key()}
\begin{verbatim}
int rsa_make_key(prng_state *prng,
                        int  wprng,
                        int  size,
                       long  e,
                    rsa_key *key);
\end{verbatim}

Where \textit{wprng} is the index into the PRNG descriptor array.  The \textit{size} parameter is the size in bytes of the RSA modulus desired.
The \textit{e} parameter is the encryption exponent desired, typical values are 3, 17, 257 and 65537.  Stick with 65537 since it is big enough to prevent
trivial math attacks, and not super slow.  The \textit{key} parameter is where the constructed key is placed.  All keys must be at
least 128 bytes, and no more than 512 bytes in size (\textit{that is from 1024 to 4096 bits}).

\index{rsa\_free()}
Note: the \textit{rsa\_make\_key()} function allocates memory at run--time when you make the key.  Make sure to call
\textit{rsa\_free()} (see below) when you are finished with the key.  If \textit{rsa\_make\_key()} fails it will automatically
free the memory allocated.

\index{PK\_PRIVATE} \index{PK\_PUBLIC}
There are two types of RSA keys.  The types are {\bf PK\_PRIVATE} and {\bf PK\_PUBLIC}.  The first type is a private
RSA key which includes the CRT parameters\footnote{As of v0.99 the PK\_PRIVATE\_OPTIMIZED type has been deprecated, and has been replaced by the
PK\_PRIVATE type.} in the form of a RSAPrivateKey (PKCS \#1 compliant).  The second type, is a public RSA key which only includes the modulus and public exponent.
It takes the form of a RSAPublicKey (PKCS \#1 compliant).

\subsection{RSA Exponentiation}
To do raw work with the RSA function, that is without padding, use the following function:
\index{rsa\_exptmod()}
\begin{verbatim}
int rsa_exptmod(const unsigned char *in,
                      unsigned long  inlen,
                      unsigned char *out,
                      unsigned long *outlen,
                                int  which,
                            rsa_key *key);
\end{verbatim}
This will load the bignum from \textit{in} as a big endian integer in the format PKCS \#1 specifies, raises it to either \textit{e} or \textit{d} and stores the result
in \textit{out} and the size of the result in \textit{outlen}. \textit{which} is set to {\bf PK\_PUBLIC} to use \textit{e}
(i.e. for encryption/verifying) and set to {\bf PK\_PRIVATE} to use \textit{d} as the exponent (i.e. for decrypting/signing).

Note: the output of this function is zero--padded as per PKCS \#1 specification.  This allows this routine to work with PKCS \#1 padding functions properly.

\subsection{RSA Key Size}
To fetch the key size of an RSA key, use the following function:
\index{rsa\_get\_size()}
\begin{verbatim}
int rsa_get_size(rsa_key *key);
\end{verbatim}
This can be used to determine the modulus size of an RSA key.

\mysection{RSA Key Encryption}
Normally RSA is used to encrypt short symmetric keys which are then used in block ciphers to encrypt a message.
To facilitate encrypting short keys the following functions have been provided.

\index{rsa\_encrypt\_key()}
\begin{verbatim}
int rsa_encrypt_key(
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long *outlen,
    const unsigned char *lparam,
          unsigned long  lparamlen,
             prng_state *prng,
                    int  prng_idx,
                    int  hash_idx,
                rsa_key *key);
\end{verbatim}
This function will OAEP pad \textit{in} of length \textit{inlen} bytes, RSA encrypt it, and store the ciphertext
in \textit{out} of length \textit{outlen} octets.  The \textit{lparam} and \textit{lparamlen} are the same parameters you would pass
to \index{pkcs\_1\_oaep\_encode()} pkcs\_1\_oaep\_encode().

\subsection{Extended Encryption}
As of v1.15, the library supports both v1.5 and v2.1 PKCS \#1 style paddings in these higher level functions.  The following is the extended
encryption function:

\index{rsa\_encrypt\_key\_ex()}
\begin{verbatim}
int rsa_encrypt_key_ex(
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long *outlen,
    const unsigned char *lparam,
          unsigned long  lparamlen,
             prng_state *prng,
                    int  prng_idx,
                    int  hash_idx,
                    int  padding,
                rsa_key *key);
\end{verbatim}

\index{LTC\_PKCS\_1\_OAEP} \index{LTC\_PKCS\_1\_V1\_5}
The parameters are all the same as for rsa\_encrypt\_key() except for the addition of the \textit{padding} parameter.  It must be set to
\textbf{LTC\_PKCS\_1\_V1\_5} to perform v1.5 encryption, or set to \textbf{LTC\_PKCS\_1\_OAEP} to perform v2.1 encryption.

When performing v1.5 encryption, the hash and lparam parameters are totally ignored and can be set to \textbf{NULL} or zero (respectively).

\mysection{RSA Key Decryption}
\index{rsa\_decrypt\_key()}
\begin{verbatim}
int rsa_decrypt_key(
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long *outlen,
    const unsigned char *lparam,
          unsigned long  lparamlen,
                    int  hash_idx,
                    int *stat,
                rsa_key *key);
\end{verbatim}
This function will RSA decrypt \textit{in} of length \textit{inlen} then OAEP de-pad the resulting data and store it in
\textit{out} of length \textit{outlen}.  The \textit{lparam} and \textit{lparamlen} are the same parameters you would pass
to pkcs\_1\_oaep\_decode().

If the RSA decrypted data is not a valid OAEP packet then \textit{stat} is set to $0$.  Otherwise, it is set to $1$.

\subsection{Extended Decryption}
As of v1.15, the library supports both v1.5 and v2.1 PKCS \#1 style paddings in these higher level functions.  The following is the extended
decryption function:

\index{rsa\_decrypt\_key\_ex()}
\begin{verbatim}
int rsa_decrypt_key_ex(
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long *outlen,
    const unsigned char *lparam,
          unsigned long  lparamlen,
                    int  hash_idx,
                    int  padding,
                    int *stat,
                rsa_key *key);
\end{verbatim}

Similar to the extended encryption, the new parameter \textit{padding} indicates which version of the PKCS \#1 standard to use.
It must be set to \textbf{LTC\_PKCS\_1\_V1\_5} to perform v1.5 decryption, or set to \textbf{LTC\_PKCS\_1\_OAEP} to perform v2.1 decryption.

When performing v1.5 decryption, the hash and lparam parameters are totally ignored and can be set to \textbf{NULL} or zero (respectively).


\mysection{RSA Signature Generation}
Similar to RSA key encryption RSA is also used to \textit{digitally sign} message digests (hashes).  To facilitate this
process the following functions have been provided.

\index{rsa\_sign\_hash()}
\begin{verbatim}
int rsa_sign_hash(const unsigned char *in,
                        unsigned long  inlen,
                        unsigned char *out,
                        unsigned long *outlen,
                           prng_state *prng,
                                  int  prng_idx,
                                  int  hash_idx,
                        unsigned long  saltlen,
                              rsa_key *key);
\end{verbatim}

This will PSS encode the message digest pointed to by \textit{in} of length \textit{inlen} octets.  Next, the PSS encoded hash will be RSA
\textit{signed} and the output stored in the buffer pointed to by \textit{out} of length \textit{outlen} octets.

The \textit{hash\_idx} parameter indicates which hash will be used to create the PSS encoding.  It should be the same as the hash used to
hash the message being signed.  The \textit{saltlen} parameter indicates the length of the desired salt, and should typically be small.  A good
default value is between 8 and 16 octets.  Strictly, it must be small than $modulus\_len - hLen - 2$ where \textit{modulus\_len} is the size of
the RSA modulus (in octets), and \textit{hLen} is the length of the message digest produced by the chosen hash.

\subsection{Extended Signatures}

As of v1.15, the library supports both v1.5 and v2.1 signatures.  The extended signature generation function has the following prototype:

\index{rsa\_sign\_hash\_ex()}
\begin{verbatim}
int rsa_sign_hash_ex(
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long *outlen,
                    int  padding,
          prng_state    *prng,
                    int  prng_idx,
                    int  hash_idx,
          unsigned long  saltlen,
                rsa_key *key);
\end{verbatim}

This will PKCS encode the message digest pointed to by \textit{in} of length \textit{inlen} octets.  Next, the PKCS encoded hash will be RSA
\textit{signed} and the output stored in the buffer pointed to by \textit{out} of length \textit{outlen} octets.  The \textit{padding} parameter
must be set to \textbf{LTC\_PKCS\_1\_V1\_5} to produce a v1.5 signature, otherwise, it must be set to \textbf{LTC\_PKCS\_1\_PSS} to produce a
v2.1 signature.

\index{LTC\_PKCS\_1\_V1\_5\_NA1}
As of v1.18.0, the library also supports v1.5 signature generation without ASN.1 encoding the signature which can be indicated by passing
\textbf{LTC\_PKCS\_1\_V1\_5\_NA1} as \textit{padding} parameter. This option has been introduced to provide compatibilty to SSL3.0 implementations
which implemented this.

When generating a standard v1.5 signature the \textit{prng}, and \textit{prng\_idx} parameters are ignored.
When generating a v1.5 signature without ASN.1 decoding additionally the textit{hash\_idx} parameter is ignored.

\mysection{RSA Signature Verification}
\index{rsa\_verify\_hash()}
\begin{verbatim}
int rsa_verify_hash(const unsigned char *sig,
                          unsigned long  siglen,
                    const unsigned char *msghash,
                          unsigned long  msghashlen,
                                    int  hash_idx,
                          unsigned long  saltlen,
                                    int *stat,
                                rsa_key *key);
\end{verbatim}

This will RSA \textit{verify} the signature pointed to by \textit{sig} of length \textit{siglen} octets.  Next, the RSA decoded data is PSS decoded
and the extracted hash is compared against the message digest pointed to by \textit{msghash} of length \textit{msghashlen} octets.

If the RSA decoded data is not a valid PSS message, or if the PSS decoded hash does not match the \textit{msghash}
value, \textit{res} is set to $0$.  Otherwise, if the function succeeds, and signature is valid \textit{res} is set to $1$.

\subsection{RSA Signature Salt Length}

The v2.1 signature algorithm requires a salt length to be able to properly
encode resp. decode. To fetch the maximum possible salt length this function
is provided:

\index{rsa\_sign\_saltlen\_get\_max()}
\begin{verbatim}
int rsa_sign_saltlen_get_max(int hash_idx, rsa_key *key);
\end{verbatim}

As stated in the PKCS\#1 RFC3447 "Typical salt lengths in octets are hLen
(the length of the output of the hash function Hash) and 0".
This function is provided to be able to use other lengths as well and to make
sure at runtime that the RSA key can handle the desired salt length.

\subsection{Extended Verification}

As of v1.15, the library supports both v1.5 and v2.1 signature verification.  The extended signature verification function has the following prototype:

\index{rsa\_verify\_hash\_ex()}
\begin{verbatim}
int rsa_verify_hash_ex(
    const unsigned char *sig,
          unsigned long  siglen,
    const unsigned char *hash,
          unsigned long  hashlen,
                    int  padding,
                    int  hash_idx,
          unsigned long  saltlen,
                    int *stat,
                rsa_key *key);
\end{verbatim}

This will RSA \textit{verify} the signature pointed to by \textit{sig} of length \textit{siglen} octets.  Next, the RSA decoded data is PKCS decoded
and the extracted hash is compared against the message digest pointed to by \textit{msghash} of length \textit{msghashlen} octets.

If the RSA decoded data is not a valid PSS message, or if the PKCS decoded hash does not match the \textit{msghash}
value, \textit{res} is set to $0$.  Otherwise, if the function succeeds, and signature is valid \textit{res} is set to $1$.

The \textit{padding} parameter must be set to \textbf{LTC\_PKCS\_1\_V1\_5} to perform a v1.5 verification.  Otherwise, it must be set to
\textbf{LTC\_PKCS\_1\_PSS} to perform a v2.1 verification.

As of v1.18.0, the library also supports v1.5 signature verification without ASN.1 decoding the signature which can be indicated by passing
\textbf{LTC\_PKCS\_1\_V1\_5\_NA1} as \textit{padding} parameter.

When performing a standard v1.5 verification the \textit{saltlen} parameter is ignored.
When performing a v1.5 verification without ASN.1 decoding additionally the \textit{hash\_idx} parameter is ignored.


\mysection{RSA Encryption Example}
\begin{small}
\begin{verbatim}
#include <tomcrypt.h>
int main(void)
{
   int           err, hash_idx, prng_idx, res;
   unsigned long l1, l2;
   unsigned char pt[16], pt2[16], out[1024];
   rsa_key       key;

   /* register prng/hash */
   if (register_prng(&sprng_desc) == -1) {
      printf("Error registering sprng");
      return EXIT_FAILURE;
   }

   /* register a math library (in this case TomsFastMath) */
   ltc_mp = tfm_desc;

   if (register_hash(&sha1_desc) == -1) {
      printf("Error registering sha1");
      return EXIT_FAILURE;
   }
   hash_idx = find_hash("sha1");
   prng_idx = find_prng("sprng");

   /* make an RSA-1024 key */
   if ((err = rsa_make_key(NULL,     /* PRNG state */
                           prng_idx, /* PRNG idx */
                           1024/8,   /* 1024-bit key */
                           65537,    /* we like e=65537 */
                           &key)     /* where to store the key */
       ) != CRYPT_OK) {
       printf("rsa_make_key %s", error_to_string(err));
       return EXIT_FAILURE;
   }

   /* fill in pt[] with a key we want to send ... */
   l1 = sizeof(out);
   if ((err = rsa_encrypt_key(pt, /* data we wish to encrypt */
                              16, /* data is 16 bytes long */
                             out, /* where to store ciphertext */
                             &l1, /* length of ciphertext */
                       "TestApp", /* our lparam for this program */
                               7, /* lparam is 7 bytes long */
                            NULL, /* PRNG state */
                        prng_idx, /* prng idx */
                        hash_idx, /* hash idx */
                            &key) /* our RSA key */
       ) != CRYPT_OK) {
       printf("rsa_encrypt_key %s", error_to_string(err));
       return EXIT_FAILURE;
   }

   /* now let's decrypt the encrypted key */
   l2 = sizeof(pt2);
   if ((err = rsa_decrypt_key(out, /* encrypted data */
                               l1, /* length of ciphertext */
                              pt2, /* where to put plaintext */
                              &l2, /* plaintext length */
                        "TestApp", /* lparam for this program */
                                7, /* lparam is 7 bytes long */
                         hash_idx, /* hash idx */
                             &res, /* validity of data */
                             &key) /* our RSA key */
        ) != CRYPT_OK) {
       printf("rsa_decrypt_key %s", error_to_string(err));
       return EXIT_FAILURE;
   }
   /* if all went well pt == pt2, l2 == 16, res == 1 */
}
\end{verbatim}
\end{small}

\mysection{RSA Key Format}

The RSA key format adopted for exporting and importing keys is the PKCS \#1 format defined by the ASN.1 constructs known as
RSAPublicKey and RSAPrivateKey.  Additionally, the OpenSSL key format is supported as well.

\subsection{RSA Key Export}
To export a RSA key use the following function.

\index{rsa\_export()}
\begin{verbatim}
int rsa_export(unsigned char *out,
               unsigned long *outlen,
                         int  type,
                     rsa_key *key);
\end{verbatim}

This will export the RSA key depending on the value of \textit{type}.

The RSAPublicKey (PKCS \#1 type) format will be used for the public key,
indicated by \textbf{PK\_PUBLIC}.
The RSAPrivateKey (PKCS \#1 type) format will be used for the private key,
indicated by \textbf{PK\_PRIVATE}.

As of v1.18.0 this function can also export OpenSSL-compatible formatted public RSA keys.
By OR'ing \textbf{PK\_STD} and \textbf{PK\_PUBLIC} the public key will be exported
in the SubjectPublicKeyInfo (X.509 type) format.

\subsection{RSA Key Import}
To import a RSA key use one of the following function.

\subsubsection{Import from standard formats}

This will import the key stored in \textit{in} of length inlen and import it to \textit{key}.

These formats are normally distributed in the PEM format, consisting of a label defining the content and base64 encoded DER-serialized data.

All the import functions expect binary DER data.

\index{rsa\_import()}
\begin{verbatim}
int rsa_import(const unsigned char *in,
                     unsigned long  inlen,
                           rsa_key *key);
\end{verbatim}

This function can import both RSAPublicKey and RSAPrivateKey formats.

As of v1.06 this function can also import OpenSSL DER formatted public RSA keys.  They are essentially encapsulated RSAPublicKeys.  LibTomCrypt will
import the key, strip off the additional data and fill in the \textit{rsa\_key} structure.

\index{rsa\_import\_pkcs8()}
\begin{verbatim}
int rsa_import_pkcs8(const unsigned char *in,
                           unsigned long inlen,
                              const void *passwd,
                           unsigned long passwdlen,
                                rsa_key *key);
\end{verbatim}

This function can import RSA private keys serialized in PKCS\#8 format.

Where \textit{key} is the RSA key structure (uninitialized), \textit{inlen} bytes of \textit{in} buffer is the DER encoded key,
and \textit{pwdlen} bytes of \textit{pwd} is optional password/secret (use \textit{pwd = NULL} for keys without password protection).

For password-protected files all supported encryption algorithms are listed in \ref{fig:pkcs8}.

\index{rsa\_import\_x509()}
\begin{verbatim}
int rsa_import_x509(const unsigned char *in,
                          unsigned long inlen,
                                rsa_key *key);
\end{verbatim}

This function can import the RSA public key from a X.509 certificate.

\subsubsection{Import from plain big numbers}

\index{rsa\_set\_key()}
\begin{verbatim}
int rsa_set_key(const unsigned char *N,
                      unsigned long Nlen,
                const unsigned char *e,
                      unsigned long elen,
                const unsigned char *d,
                      unsigned long dlen,
                rsa_key *key);
\end{verbatim}

This function can import the plain RSA key parameters \textit{N}, \textit{e} and \textit{d}.
The parameter \textit{d} is optional and only required when importing a private key.

\index{rsa\_set\_factors()}
\begin{verbatim}
int rsa_set_factors(const unsigned char *p,
                          unsigned long plen,
                    const unsigned char *q,
                          unsigned long qlen,
                    rsa_key *key);
\end{verbatim}

This function can import the plain RSA key factors \textit{p} and \textit{q}.

\index{rsa\_set\_crt\_params()}
\begin{verbatim}
int rsa_set_crt_params(const unsigned char *dP,
                             unsigned long dPlen,
                       const unsigned char *dQ,
                             unsigned long dQlen,
                       const unsigned char *qP,
                             unsigned long qPlen,
                       rsa_key *key);
\end{verbatim}

This function can import the plain RSA CRT (chinese remainder theorem) parameters \textit{dP}, \textit{dQ} and \textit{qP}.

After importing \textit{p}, \textit{q}, \textit{dP}, \textit{dQ} and \textit{qP}
the library can perfrom the optimized CRT calculations on private key operations.

\chapter{Diffie-Hellman Key Exchange}

\mysection{Background}

Diffie-Hellman was the original public key system proposed.  The system is based upon the group structure
of finite fields.  For Diffie-Hellman a prime $p$ is chosen and a ``base'' $b$ such that $b^x\mbox{ }(\mbox{mod }p)$
generates a large sub-group of prime order (for unique values of $x$).

A secret key is an exponent $x$ and a public key is the value of $y \equiv g^x\mbox{ }(\mbox{mod }p)$.  The term
``discrete logarithm'' denotes the action of finding $x$ given only $y$, $g$ and $p$.  The key exchange part of
Diffie-Hellman arises from the fact that two users A and B with keys $(A_x, A_y)$ and $(B_x, B_y)$ can exchange
a shared key $K \equiv B_y^{A_x} \equiv A_y^{B_x} \equiv g^{A_xB_x}\mbox{ }(\mbox{mod }p)$.

From this public encryption and signatures can be developed.  The trivial way to encrypt (for example) using a public key
$y$ is to perform the key exchange offline.  The sender invents a key $k$ and its public copy
$k' \equiv g^k\mbox{ }(\mbox{mod }p)$ and uses $K \equiv k'^{A_x}\mbox{ }(\mbox{mod }p)$ as a key to encrypt
the message with.  Typically $K$ would be sent to a one-way hash and the message digested used as a key in a
symmetric cipher.

It is important that the order of the sub-group that $g$ generates not only be large but also prime.  There are
discrete logarithm algorithms that take $\sqrt r$ time given the order $r$.  The discrete logarithm can be computed
modulo each prime factor of $r$ and the results combined using the Chinese Remainder Theorem.  In the cases where
$r$ is ``B-Smooth'' (e.g. all small factors or powers of small prime factors) the solution is trivial to find.

To thwart such attacks the primes and bases in the library have been designed and fixed.  Given a prime $p$ the order of
 the sub-group generated is a large prime namely ${p - 1} \over 2$.  Such primes are known as ``strong primes'' and the
smaller prime (e.g. the order of the base) are known as Sophie-Germaine primes.

\mysection{Core Functions}

This library also provides core Diffie-Hellman functions so you can negotiate keys over insecure mediums.  The routines
provided are relatively easy to use and only take two function calls to negotiate a shared key.  There is a structure
called ``dh\_key'' which stores the Diffie-Hellman key in a format these routines can use.  The first set of routines
are to make a Diffie-Hellman private key pair:
\index{dh\_make\_key()}
\begin{verbatim}
int dh_set_pg_groupsize(int groupsize, dh_key *key);
int dh_generate_key(prng_state *prng, int wprng, dh_key *key);
\end{verbatim}
The ``groupsize'' is the size of the modulus you want in bytes.  Currently support sizes are 96 to 1024 bytes which correspond
to key sizes of 768 to 8192 bits. The smaller the key the faster it is to use however it will be less secure.  When
specifying a size not explicitly supported by the library it will round {\em up} to the next key size.  If the size is
above 512 it will return an error.  So if you pass ``groupsize == 32'' it will use a 768 bit key but if you pass
``groupsize == 20000'' it will return an error.  The primes and generators used are built-into the library and were designed
to meet very specific goals.  The primes are strong primes which means that if $p$ is the prime then
$p-1$ is equal to $2r$ where $r$ is a large prime.  The bases are chosen to generate a group of order $r$ to prevent
leaking a bit of the key.  This means the bases generate a very large prime order group which is good to make cryptanalysis
hard.

The next two routines are for exporting/importing Diffie-Hellman keys in/from DER encoded ASN.1.  This is useful for transport
over communication mediums.

\index{dh\_export()} \index{dh\_import()}
\begin{verbatim}
int dh_export(unsigned char *out, unsigned long *outlen,
              int type, dh_key *key);

int dh_import(const unsigned char *in, unsigned long inlen, dh_key *key);
\end{verbatim}

The ASN.1 sequence used to represent a DH key is as following:

\begin{verbatim}
DiffieHellmanKey ::= SEQUENCE {
      version Version,
      flags   Flags,
      p       INTEGER, -- prime
      g       INTEGER, -- base/group
      n       INTEGER  -- either x when private key or y when public key }

Version  ::=  INTEGER  {  v1(0)  }

Flags    ::=  BIT STRING {
      privateKey      (0) -- this BIT is '1' if it's a private key
                          --          or '0' if it's a public key
}
\end{verbatim}

These two functions work just like the ``rsa\_export()'' and ``rsa\_import()'' functions except these work with
Diffie-Hellman keys. Its important to note you do not have to free the ram for a ``dh\_key'' if an import fails.

You can free a ``dh\_key'' using:
\begin{verbatim}
void dh_free(dh_key *key);
\end{verbatim}
After you have exported a copy of your public key (using {\bf PK\_PUBLIC} as ``type'') you can now create a shared secret
with the other user using:
\index{dh\_shared\_secret()}
\begin{verbatim}
int dh_shared_secret(dh_key *private_key,
                     dh_key *public_key,
                     unsigned char *out, unsigned long *outlen);
\end{verbatim}

Where ``private\_key'' is the key you made and ``public\_key'' is the copy of the public key the other user sent you.  The result goes
into ``out'' and the length into ``outlen''.  If all went correctly the data in ``out'' should be identical for both parties.  It is important to
note that the two keys have to be the same size in order for this to work.  There is a function to get the size of a
key:
\index{dh\_get\_groupsize()}
\begin{verbatim}
int dh_get_groupsize(dh_key *key);
\end{verbatim}
This returns the size in bytes of the modulus chosen for that key.

\mysection{Other Diffie-Hellman Functions}

To be able to import Diffie-Hellman keys LibTomCrypt provides several API functions.
\\

To import the prime and group from binary format:
\index{dh\_set\_pg()}
\begin{verbatim}
int dh_set_pg(const unsigned char *p, unsigned long plen,
              const unsigned char *g, unsigned long glen,
              dh_key *key);
\end{verbatim}
This sets the prime \textit{p} of length \textit{plen} and the generator/base \textit{g} of length \textit{glen} in the DH key \textit{key}.
\\

To import the prime and group from an ASN.1 encoded DHparam Sequence:
\index{dh\_set\_pg\_dhparam()}
\begin{verbatim}
int dh_set_pg_dhparam(const unsigned char *dhparam, unsigned long dhparamlen, dh_key *key);
\end{verbatim}
This sets the parameters in \textit{dhparam} of \textit{dhparamlen} in the DH key \textit{key}.
\\

To import a private or public key from binary data:
\index{dh\_set\_key()}
\begin{verbatim}
int dh_set_key(const unsigned char *in, unsigned long inlen, int type, dh_key *key);
\end{verbatim}
This will import, depending on \textit{type} which can be either \textit{PK\_PRIVATE} or \textit{PK\_PUBLIC},
the according part of the DH key \textit{key} from \textit{in} of length \textit{inlen}.
After import the key will be verified and in case of an error it will be free'd.

\mysection{Remarks on Usage}
Its important that you hash the shared key before trying to use it as a key for a symmetric cipher or something.  An
example program that communicates over sockets, using MD5 and 1024-bit DH keys is\footnote{This function is a small example.  It is suggested that proper packaging be used.  For example, if the public key sent is truncated these routines will not detect that.}:
\newpage
\begin{small}
\begin{verbatim}
int establish_secure_socket(int sock, int mode, unsigned char *key,
                            prng_state *prng, int wprng)
{
   unsigned char buf[4096], buf2[4096];
   unsigned long x, len;
   int res, err, inlen;
   dh_key mykey, theirkey;

   /* make up our private key */
   if ((err = dh_set_pg_groupsize(128, &mykey)) != CRYPT_OK)  {
      return err;
   }
   if ((err = dh_generate_key(prng, wprng, &mykey)) != CRYPT_OK)  {
      return err;
   }

   /* export our key as public */
   x = sizeof(buf);
   if ((err = dh_export(buf, &x, PK_PUBLIC, &mykey)) != CRYPT_OK) {
      res = err;
      goto done2;
   }

   if (mode == 0) {
      /* mode 0 so we send first */
      if (send(sock, buf, x, 0) != x) {
         res = CRYPT_ERROR;
         goto done2;
      }

      /* get their key */
      if ((inlen = recv(sock, buf2, sizeof(buf2), 0)) <= 0) {
         res = CRYPT_ERROR;
         goto done2;
      }
   } else {
      /* mode >0 so we send second */
      if ((inlen = recv(sock, buf2, sizeof(buf2), 0)) <= 0) {
         res = CRYPT_ERROR;
         goto done2;
      }

      if (send(sock, buf, x, 0) != x) {
         res = CRYPT_ERROR;
         goto done2;
      }
   }

   if ((err = dh_import(buf2, inlen, &theirkey)) != CRYPT_OK) {
      res = err;
      goto done2;
   }

   /* make shared secret */
   x = sizeof(buf);
   if ((err = dh_shared_secret(&mykey, &theirkey, buf, &x)) != CRYPT_OK) {
      res = err;
      goto done;
   }

   /* hash it */
   len = 16;        /* default is MD5 so "key" must be at least 16 bytes long */
   if ((err = hash_memory(find_hash("md5"), buf, x, key, &len)) != CRYPT_OK) {
      res = err;
      goto done;
   }

   /* clean up and return */
   res = CRYPT_OK;
done:
   dh_free(&theirkey);
done2:
   dh_free(&mykey);
   zeromem(buf,  sizeof(buf));
   zeromem(buf2, sizeof(buf2));
   return res;
}
\end{verbatim}
\end{small}
\subsection{Remarks on The Snippet}
When the above code snippet is done (assuming all went well) there will be a shared 128-bit key in the ``key'' array
passed to ``establish\_secure\_socket()''.

\chapter{Elliptic Curve Cryptography - $GF(p)$}

\mysection{Introduction}

The library provides public-key cryptography based on elliptic curves over finite fields \textit{GF(p)}.
They are all curves over the integers modulo a prime. The curves have the basic equation:

\begin{equation}
y^2 = x^3 + a \cdot x + b\mbox{ }(\mbox{mod }p)
\end{equation}
\label{ecc-gf-p-equation}

The built--in curves range in order from $\approx 2^{112}$ points to $\approx 2^{521}$.

The advantage of ECC is the fact that it requires smaller keys than RSA or DSA to provide equivalent level of security.
The cryptographic foundation of ECC is the \textit{"elliptic curve discrete logarithm problem"} (ECDLP).

The library provides a set of core ECC functions as well as functions that are designed to be the Elliptic Curve
analogy for deriving a shared secret between a pair of keys (also known as \textit{ECDH}) and functions implementing the
analogy for digital signatures (also known as \textit{ECDSA}).

\mysection{Supported Curves}

The following table \ref{fig:builtincurves} shows all built--in curves supported by the library. On top of that one can also use a custom curve
defined by own parameters (the only limitation is that the curve must be based on equation \ref{ecc-gf-p-equation}).

\begin{table}[H]
\begin{center}
\begin{tabular}{|l|l|l|l|}
      \hline \textbf{Curve Name} & \textbf{Alternative Names}  & \textbf{OID}          \\
      \hline secp112r1           &                             & 1.3.132.0.6           \\
      \hline secp112r2           &                             & 1.3.132.0.7           \\
      \hline secp128r1           &                             & 1.3.132.0.28          \\
      \hline secp128r2           &                             & 1.3.132.0.29          \\
      \hline secp160r1           &                             & 1.3.132.0.8           \\
      \hline secp160r2           &                             & 1.3.132.0.30          \\
      \hline secp160k1           &                             & 1.3.132.0.9           \\
      \hline secp192r1           & nistp192, prime192v1, P-192 & 1.2.840.10045.3.1.1   \\
      \hline prime192v2          &                             & 1.2.840.10045.3.1.2   \\
      \hline prime192v3          &                             & 1.2.840.10045.3.1.3   \\
      \hline secp192k1           &                             & 1.3.132.0.31          \\
      \hline secp224r1           & nistp224, P-224             & 1.3.132.0.33          \\
      \hline secp224k1           &                             & 1.3.132.0.32          \\
      \hline secp256r1           & nistp256, prime256v1, P-256 & 1.2.840.10045.3.1.7   \\
      \hline secp256k1           &                             & 1.3.132.0.10          \\
      \hline secp384r1           & nistp384, P-384             & 1.3.132.0.34          \\
      \hline secp521r1           & nistp521, P-521             & 1.3.132.0.35          \\
      \hline prime239v1          &                             & 1.2.840.10045.3.1.4   \\
      \hline prime239v2          &                             & 1.2.840.10045.3.1.5   \\
      \hline prime239v3          &                             & 1.2.840.10045.3.1.6   \\
      \hline brainpoolP160r1     &                             & 1.3.36.3.3.2.8.1.1.1  \\
      \hline brainpoolP192r1     &                             & 1.3.36.3.3.2.8.1.1.3  \\
      \hline brainpoolP224r1     &                             & 1.3.36.3.3.2.8.1.1.5  \\
      \hline brainpoolP256r1     &                             & 1.3.36.3.3.2.8.1.1.7  \\
      \hline brainpoolP320r1     &                             & 1.3.36.3.3.2.8.1.1.9  \\
      \hline brainpoolP384r1     &                             & 1.3.36.3.3.2.8.1.1.11 \\
      \hline brainpoolP512r1     &                             & 1.3.36.3.3.2.8.1.1.13 \\
      \hline brainpoolP160t1     &                             & 1.3.36.3.3.2.8.1.1.2  \\
      \hline brainpoolP192t1     &                             & 1.3.36.3.3.2.8.1.1.4  \\
      \hline brainpoolP224t1     &                             & 1.3.36.3.3.2.8.1.1.6  \\
      \hline brainpoolP256t1     &                             & 1.3.36.3.3.2.8.1.1.8  \\
      \hline brainpoolP320t1     &                             & 1.3.36.3.3.2.8.1.1.10 \\
      \hline brainpoolP384t1     &                             & 1.3.36.3.3.2.8.1.1.12 \\
      \hline brainpoolP512t1     &                             & 1.3.36.3.3.2.8.1.1.14 \\
      \hline
\end{tabular}
\caption{Built--In Elliptic Curves over GF(p)}
\end{center}
\label{fig:builtincurves}
\end{table}

\mysection{Key Generation}

There is a key structure called \textit{ecc\_key} which is used by all ECC functions.

To generate a new private \textit{ecc\_key} there are basically two ways provided.
The first is via using one of the built--in curves and the second way is via using a user--supplied curve.

\subsection{Using Built--in Curves}

First a function is provided to look up curve name or OID of built--in curves:
\index{ecc\_find\_curve()}
\begin{verbatim}
int ecc_find_curve(const char  *name_or_oid,
          const ltc_ecc_curve **cu);
\end{verbatim}

The \textit{name\_or\_oid} argument will search by name, alternative name or OID as mentioned in Table \ref{fig:builtincurves}.

\index{ecc\_set\_curve()}
\begin{verbatim}
int ecc_set_curve(const ltc_ecc_curve *cu,
                              ecc_key *key);
\end{verbatim}

The function \textit{ecc\_set\_curve} initializes the \textit{key} structure with the curve parameters passed via \textit{cu}.

\index{ecc\_generate\_key()}
\begin{verbatim}
int ecc_generate_key(prng_state *prng,
                            int  wprng,
                        ecc_key *key);
\end{verbatim}

The function \textit{ecc\_generate\_key} does the actual key generation. The function will free any internally
allocated resources if there is an error.

Example of creating an ECC key:
\begin{small}
\begin{verbatim}
   prng_state prng;
   int wprng;
   ecc_key key;
   const ltc_ecc_curve* cu;

   if (register_all_prngs() != CRYPT_OK) return -1;
   wprng = find_prng("yarrow");
   if (rng_make_prng(128, wprng, &prng, NULL) != CRYPT_OK) return -1;
   if (ecc_find_curve("nistp256", &cu) != CRYPT_OK) return -1;
   if (ecc_set_curve(cu, &key) != CRYPT_OK) return -1;
   if (ecc_generate_key(&prng, wprng, &key) != CRYPT_OK) return -1;
\end{verbatim}
\end{small}

\subsection{Extended Key Generation}

The library uses the following structure to describe an elliptic curve.
This structure can also be used for defining a custom curve based on user--supplied parameters.

\index{ltc\_ecc\_curve}
\begin{verbatim}
/** Structure defines a NIST GF(p) curve */
typedef struct {
   /** The prime that defines the field the curve is in (encoded in hex) */
   const char *prime;

   /** The fields A param (hex) */
   const char *A;

   /** The fields B param (hex) */
   const char *B;

   /** The order of the curve (hex) */
   const char *order;

   /** The x co-ordinate of the base point on the curve (hex) */
   const char *Gx;

   /** The y co-ordinate of the base point on the curve (hex) */
   const char *Gy;

   /** The co-factor */
   unsigned long cofactor;

   /** The OID */
   const char *OID;
} ltc_ecc_curve;
\end{verbatim}

The curve must be of the form $y^2 = x^3 - a \cdot x + b$, and all of the \textit{const char*} parameters have to be encoded in hexadecimal format.

Advanced example of creating an ECC key:
\begin{small}
\begin{verbatim}
   prng_state prng;
   int wprng;
   ecc_key key;
   const ltc_ecc_curve custom_curve = {
      "FFFFFFFFFFFFFFFFFFFFFFFFFDE7",   /* prime    */
      "0000000000000000000000000000",   /* A        */
      "0000000000000000000000000003",   /* B        */
      "0100000000000001ECEA551AD837E9", /* order    */
      "0000000000000000000000000001",   /* Gx       */
      "0000000000000000000000000002",   /* Gy       */
      1,                                /* cofactor */
      "2.23.43.1.4.8"                   /* OID      */
   };

   if (register_all_prngs() != CRYPT_OK) return -1;
   wprng = find_prng("yarrow");
   if (rng_make_prng(128, wprng, &prng, NULL) != CRYPT_OK) return -1;
   if (ecc_set_curve(&custom_curve, &key) != CRYPT_OK) return -1;
   if (ecc_generate_key(&prng, wprng, &key) != CRYPT_OK) return -1;
\end{verbatim}
\end{small}

\subsection{Legacy Key Generation}
To generate a new key in a way compatible with libtomcrypt 1.18 and earlier the following function is provided:

\index{ecc\_make\_key()}
\begin{verbatim}
int ecc_make_key(prng_state *prng,
                        int  wprng,
                        int  keysize,
                    ecc_key *key);
\end{verbatim}

Where \textit{keysize} maps to the specific curve as follows:

\begin{table}[H]
\begin{center}
\begin{tabular}{|c|l|}
      \hline \textbf{keysize} & \textbf{curve name}                    \\
      \hline 14               & secp112r1                              \\
      \hline 16               & secp128r1                              \\
      \hline 20               & secp160r1                              \\
      \hline 24               & secp192r1, nistp192, prime192v1, P-192 \\
      \hline 28               & secp224r1, nistp224, P-224             \\
      \hline 32               & secp256r1, nistp256, prime256v1, P-256 \\
      \hline 48               & secp384r1, nistp384, P-384             \\
      \hline 66               & secp521r1, nistp521, P-521             \\
      \hline
\end{tabular}
\caption{Mapping of ecc\_make\_key() keysizes to curves}
\end{center}
\label{fig:legacy-curve-names}
\end{table}

For backwards compatibility the function \textit{ecc\_make\_key\_ex} is provided, which is just a wrapper
around \textit{ecc\_set\_curve} and \textit{ecc\_generate\_key}.

\index{ecc\_make\_key\_ex()}
\begin{verbatim}
int  ecc_make_key_ex(prng_state *prng,
                            int  wprng,
                        ecc_key *key,
            const ltc_ecc_curve *cu);
\end{verbatim}

This function generates a random ECC key over the curve specified by the parameters in \textit{cu}.

It is also possible to use a combination of \textit{ecc\_set\_curve\_by\_size} (similar to \textit{ecc\_set\_curve}) and \textit{ecc\_generate\_key}.

\index{ecc\_set\_curve\_by\_size}
\begin{verbatim}
int ecc_set_curve_by_size(    int  keysize,
                          ecc_key *key);
\end{verbatim}

The \textit{keysize} maps to the specific curve according to table \ref{fig:legacy-curve-names}.

\subsection{Key Free}
To free the memory allocated by one of \textit{ecc\_generate\_key()}, \textit{ecc\_make\_key()}, \textit{ecc\_make\_key\_ex()}, \textit{ecc\_import()},
\textit{ecc\_import\_openssl()}, \textit{ecc\_import\_x509()}, \textit{ecc\_import\_pkcs8()}, \textit{ecc\_ansi\_x963\_import()},
\textit{ecc\_ansi\_x963\_import\_ex()}, or \textit{ecc\_set\_key()} the following function is provided:

\index{ecc\_free()}
\begin{verbatim}
void ecc_free(ecc_key *key);
\end{verbatim}

\subsection{Key Helper Functions}
To get the curve OID as a NUL--terminated string the following function is provided:

\index{ecc\_get\_oid\_str()}
\begin{verbatim}
int  ecc_get_oid_str(         char *out,
                     unsigned long *outlen,
                     const ecc_key *key);
\end{verbatim}

Where \textit{key} is the key for which we want to extract its OID,
\textit{out} is where the ASCII output is placed, and the \textit{outlen}
parameter is updated to hold the output OID size (including NUL byte).

\mysection{Key Export and Import}

\subsection{Export Raw Key}
To export the raw value of the key (private or public) the following function is provided:

\index{ecc\_get\_key()}
\begin{verbatim}
int ecc_get_key(unsigned char *out,
                unsigned long *outlen,
                          int  type,
                const ecc_key *key);
\end{verbatim}

Where \textit{key} is the key to export, \textit{out} is where the output is placed,
the \textit{outlen} parameter is updated to hold the output, and the \textit{type} indicates
what kind of export should be done (see table \ref{fig:ecc-get-key-type}).

\begin{table}[H]
\begin{center}
\begin{tabular}{|l|l|l|}
      \hline \textbf{type}                               & \textbf{description}               & \textbf{NIST-256 example} \\
      \hline \textit{PK\_PRIVATE}                        & export the private key             & output: 32 bytes \\
      \hline \textit{PK\_PUBLIC}                         & export the public key (long form)  & output: 65 bytes \\
      \hline \textit{PK\_PUBLIC \textbar PK\_COMPRESSED} & export the public key (short form) & output: 33 bytes \\
      \hline
\end{tabular}
\caption{Possible types of ecc\_get\_key()}
\label{fig:ecc-get-key-type}
\end{center}
\end{table}

Please note that the output data does not contain the information about the elliptic curve of the exported key
(one can just assume the size of the curve which is unambiguous). The information about the curve has to be kept
separately to be able to re-use the key after importing.

\subsection{Import Raw Key}
To import the raw value of the key (private or public) the following function is provided:

\index{ecc\_set\_key()}
\begin{verbatim}
int ecc_set_key(const unsigned char *in,
                      unsigned long  inlen,
                                int  type,
                            ecc_key *key);
\end{verbatim}

Where \textit{key} is the key structure with properly initialized curve parameters (see below),
\textit{inlen} bytes of \textit{in} buffer is imported, and the \textit{type} indicates
the key type -- either \textit{PK\_PUBLIC} or \textit{PK\_PRIVATE}.

For the actual import you need to know the curve of the imported key and load the key like this:

\begin{small}
\begin{verbatim}
   ecc_key key;
   const ltc_ecc_curve* cu;

   if (ecc_find_curve("nistp256", &cu) != CRYPT_OK) return -1;
   if (ecc_set_curve(cu, &key) != CRYPT_OK) return -1;
   if (ecc_set_key(keybuf, keylen, PK_PRIVATE, &key) != CRYPT_OK) return -1;
\end{verbatim}
\end{small}

\subsection{Key Export -- OpenSSL compatible}
To export the key (private or public) in DER format compatible with OpenSSL the following function is provided:

\index{ecc\_export\_openssl()}
\begin{verbatim}
int ecc_export_openssl(unsigned char *out,
                       unsigned long *outlen,
                                 int  type,
                       const ecc_key *key);
\end{verbatim}


Where \textit{key} is the key to export, \textit{out} is where the output is placed,
the \textit{outlen} parameter is updated to hold the output, and the \textit{type} indicates
what kind of export should be done (see table \ref{fig:ecc-export-openssl-type}).

\begin{table}[H]
\begin{center}
\begin{tabular}{|l|l|l|}
      \hline \textbf{type}                                                     & \textbf{note} \\
      \hline \textit{PK\_PRIVATE}                                              & the output contains all curve constants \\
      \hline \textit{PK\_PRIVATE \textbar PK\_CURVEOID}                        & the output contains only curve OID \\
      \hline \textit{PK\_PUBLIC}                                               & all curve constants \\
      \hline \textit{PK\_PUBLIC \textbar PK\_COMPRESSED}                       & all curve constants + using point compression \\
      \hline \textit{PK\_PUBLIC \textbar PK\_CURVEOID}                         & only curve OID \\
      \hline \textit{PK\_PUBLIC \textbar PK\_COMPRESSED \textbar PK\_CURVEOID} & only curve OID + using point compression \\
      \hline
\end{tabular}
\caption{Possible types of ecc\_export\_openssl()}
\label{fig:ecc-export-openssl-type}
\end{center}
\end{table}

\subsection{Key Import -- OpenSSL compatible}
To import the key (private or public) in DER format compatible with OpenSSL the following function is provided:

\index{ecc\_import\_openssl()}
\begin{verbatim}
int ecc_import_openssl(const unsigned char *in,
                             unsigned long  inlen,
                                   ecc_key *key);
\end{verbatim}

Where \textit{key} is the ECC key structure (uninitialized), \textit{inlen} bytes of \textit{in} buffer is the DER encoded key.

\subsection{Public Key Import -- X.509 certificates}
To import the public key from a X.509 certificate (DER encoded) the following function is provided:

\index{ecc\_import\_x509()}
\begin{verbatim}
int ecc_import_x509(const unsigned char *in,
                          unsigned long  inlen,
                                ecc_key *key);
\end{verbatim}

Where \textit{key} is the ECC key structure (uninitialized), \textit{inlen} bytes of \textit{in} buffer is the DER encoded certificate.

\subsection{Private Key Import -- PKCS\#8}
To import the private key (optionally password protected/encrypted) in PKCS\#8 (DER encoded) format the following function is provided:

\index{ecc\_import\_pkcs8()}
\begin{verbatim}
int ecc_import_pkcs8(const unsigned char *in,
                                unsigned  long inlen,
                              const void *pwd,
                           unsigned long  pwdlen,
                                 ecc_key *key);
\end{verbatim}

Where \textit{key} is the ECC key structure (uninitialized), \textit{inlen} bytes of \textit{in} buffer is the DER encoded key,
and \textit{pwdlen} bytes of \textit{pwd} is optional password/secret (use \textit{pwd = NULL} for keys without password protection).

For password-protected files all supported encryption algorithms are listed in \ref{fig:pkcs8}.

\subsection{Key Export -- LTC proprietary (deprecated)}

LTC proprietary format for ECC public and private keys is defined as follows:

\begin{small}
\begin{verbatim}
ECCPublicKey ::= SEQUENCE {
    flags       BIT STRING(0), -- public/private flag (always zero),
    keySize     INTEGER,       -- Curve size (in bits) divided by eight
                               -- and rounded down, e.g. 521 => 65
    pubkey.x    INTEGER,       -- The X co-ordinate of the public key point
    pubkey.y    INTEGER,       -- The Y co-ordinate of the public key point
}

ECCPrivateKey ::= SEQUENCE {
    flags       BIT STRING(1), -- public/private flag (always one),
    keySize     INTEGER,       -- Curve size (in bits) divided by eight
                               -- and rounded down, e.g. 521 => 65
    pubkey.x    INTEGER,       -- The X co-ordinate of the public key point
    pubkey.y    INTEGER,       -- The Y co-ordinate of the public key point
    secret.k    INTEGER,       -- The secret key scalar
}
\end{verbatim}
\end{small}

The first flags bit denotes whether the key is public (zero) or private (one).

To export an ECC key using the LibTomCrypt format the following function is provided:
\index{ecc\_export()}
\begin{verbatim}
int ecc_export(unsigned char *out,
               unsigned long *outlen,
                         int  type,
                     ecc_key *key);
\end{verbatim}
This will export the key with the given \textit{type} (\textbf{PK\_PUBLIC} or \textbf{PK\_PRIVATE}), and store it to \textit{out}.

\subsection{Key Import -- LTC proprietary (deprecated)}

The following function imports a LibTomCrypt format ECC key:
\index{ecc\_import()}
\begin{verbatim}
int ecc_import(const unsigned char *in,
                     unsigned long  inlen,
                           ecc_key *key);
\end{verbatim}
This will import the ECC key from \textit{in}, and store it in the ecc\_key structure pointed to by \textit{key}.  If the operation fails it will free
any allocated memory automatically.

The following function imports a LibTomCrypt format ECC key using a specified set of curve parameters:
\index{ecc\_import\_ex()}
\begin{verbatim}
int  ecc_import_ex(const unsigned char *in,
                         unsigned long  inlen,
                               ecc_key *key,
                   const ltc_ecc_curve *dp);
\end{verbatim}
This will import the key from the array pointed to by \textit{in} of length \textit{inlen} octets.  The key is stored in
the ECC structure pointed to by \textit{key}.  The curve is specified by the parameters pointed to by \textit{dp}.  The function will free
all internally allocated memory upon error.

\subsection{ANSI X9.63 Export (deprecated)}
The following function exports an ECC public key in the ANSI X9.63 format:

\index{ecc\_ansi\_x963\_export()}
\begin{verbatim}
int ecc_ansi_x963_export(      ecc_key *key,
                         unsigned char *out,
                         unsigned long *outlen);
\end{verbatim}
The ECC key pointed to by \textit{key} is exported in public fashion to the array pointed to by \textit{out}.  The ANSI X9.63 format used is from
section 4.3.6 of the standard.  It does not allow for the export of private keys.

\subsection{ANSI X9.63 Import (deprecated)}

The following function imports an ANSI X9.63 section 4.3.6 format public ECC key:

\index{ecc\_ansi\_x963\_import()}
\begin{verbatim}
int ecc_ansi_x963_import(const unsigned char *in,
                               unsigned long  inlen,
                                     ecc_key *key);
\end{verbatim}
This will import the key stored in the array pointed to by \textit{in} of length \textit{inlen} octets.  The imported key is stored in the ECC key pointed to by
\textit{key}.  The function will free any allocated memory upon error.

The following function allows the importing of an ANSI x9.63 section 4.3.6 format public ECC key using user specified domain parameters:

\index{ecc\_ansi\_x963\_import\_ex()}
\begin{verbatim}
int ecc_ansi_x963_import_ex(const unsigned char *in,
                                  unsigned long  inlen,
                                        ecc_key *key,
                                  ltc_ecc_curve *dp);
\end{verbatim}
This will import the key stored in the array pointed to by \textit{in} of length \textit{inlen} octets using the domain parameters pointed to by \textit{dp}.
The imported key is stored in the ECC key pointed to by \textit{key}.  The function will free any allocated memory upon error.


\mysection{Signatures (ECDSA)}
There are also functions to sign and verify messages. They use the ANSI X9.62 ECDSA algorithm to generate and verify signatures in the
ANSI X9.62 format.

\subsection{Signature Generation}
To sign a message digest (hash) use the following function:

\index{ecc\_sign\_hash()}
\begin{verbatim}
int ecc_sign_hash(const unsigned char *in,
                        unsigned long  inlen,
                        unsigned char *out,
                        unsigned long *outlen,
                           prng_state *prng,
                                  int  wprng,
                              ecc_key *key);
\end{verbatim}

This function will ECDSA sign the message digest stored in the array pointed to by \textit{in} of length \textit{inlen} octets.  The signature
will be stored in the array pointed to by \textit{out} of length \textit{outlen} octets.  The function requires a properly seeded PRNG, and
the ECC \textit{key} provided must be a private key.

\index{ecc\_sign\_hash\_rfc7518()}
\begin{verbatim}
int ecc_sign_hash_rfc7518(const unsigned char *in,
                                unsigned long  inlen,
                                unsigned char *out,
                                unsigned long *outlen,
                                   prng_state *prng,
                                          int  wprng,
                                      ecc_key *key);
\end{verbatim}

This function creates the same ECDSA signature as \textit{ecc\_sign\_hash} only the output format is different.
The format follows \url{https://tools.ietf.org/html/rfc7518#section-3.4}, sometimes it is also called plain signature.

\index{ecc\_sign\_hash\_ex()}
\begin{verbatim}
int ecc_sign_hash_ex(const unsigned char *in,
                           unsigned long  inlen,
                           unsigned char *out,
                           unsigned long *outlen,
                              prng_state *prng,
                                     int  wprng,
                      ecc_signature_type  sigformat,
                                     int *recid,
                                 ecc_key *key);
\end{verbatim}

This function is an extended version of the ECDSA signature in \textit{ecc\_sign\_hash}, but with a choice of output formats
and an optional output of the recovery ID for use with \textit{ecc\_recover\_key}.

\subsection{Signature Verification}
\index{ecc\_verify\_hash()}
\begin{verbatim}
int ecc_verify_hash(const unsigned char *sig,
                          unsigned long  siglen,
                    const unsigned char *hash,
                          unsigned long  hashlen,
                                    int *stat,
                                ecc_key *key);
\end{verbatim}

This function will verify the ECDSA signature in the array pointed to by \textit{sig} of length \textit{siglen} octets, against the message digest
pointed to by the array \textit{hash} of length \textit{hashlen}. It will store a non--zero value in \textit{stat} if the signature is valid.  Note:
the function will not return an error if the signature is invalid. It will return an error, if the actual signature payload is an invalid format.
The ECC \textit{key} must be the public (or private) ECC key corresponding to the key that performed the signature.
The function \textit{ecc\_verify\_hash} implements signature format according to X9.62 ECDSA, and the output is compliant for GF(p) curves.

\index{ecc\_verify\_hash\_rfc7518()}
\begin{verbatim}
int ecc_verify_hash_rfc7518(const unsigned char *sig,
                                  unsigned long  siglen,
                            const unsigned char *hash,
                                  unsigned long  hashlen,
                                            int *stat,
                                        ecc_key *key);
\end{verbatim}

This function validate the ECDSA signature as \textit{ecc\_verify\_hash} only the signature input format
follows \url{https://tools.ietf.org/html/rfc7518#section-3.4}.

\index{ecc\_verify\_hash\_ex()}
\begin{verbatim}
int ecc_verify_hash_ex(const unsigned char *sig,
                             unsigned long  siglen,
                       const unsigned char *hash,
                             unsigned long  hashlen,
                        ecc_signature_type  sigformat,
                                       int *stat,
                                   ecc_key *key);
\end{verbatim}

This function validates an ECDSA signature as \textit{ecc\_verify\_hash} but with a choice of signature formats.

{\bf BEWARE:} With ECC if you try to sign a hash that is bigger than your ECC key you can run into problems. The math
will still work, and in effect the signature will still work.  With ECC keys the strength of the signature is limited
by the size of the hash, or the size of the key, whichever is smaller.  For example, if you sign with SHA256 and a
P--192 key, you have in effect 96--bits of security. The library will not warn you if you make this mistake, so it
is important to check yourself before using the signatures.

\subsection{Public Key Recovery}
\index{ecc\_recover\_key()}
\begin{verbatim}
int ecc_recover_key(const unsigned char *sig,
                          unsigned long  siglen,
                    const unsigned char *hash,
                          unsigned long  hashlen,
                                    int  recid,
                     ecc_signature_type  sigformat,
                                ecc_key *key);
\end{verbatim}

This function will recover (a) public key from the ECDSA signature in the array pointed to by \textit{sig} of length \textit{siglen} octets, the message digest
pointed to by the array \textit{hash} of length \textit{hashlen}, and the recovery id \textit{recid}. It will store the recovered
key into \textit{key} and return CRYPT\_OK if recovery succeeds, or an error if recovery fails.
This is for compatibility with the (v,r,s) signatures used in Ethereum, where public keys are not explicitly shared,
only the parity of the public key. For curves like secp256k1, recid will take values of 0 or 1, corresponding to the
parity of the public key's y coordinate. For curves like secp112r2, with a cofactor of 4, values 0..7 are possible,
with the low bit corresponding to the parity and the higher bits specifying the public key's x coordinate's multiple
of the curve's order.
If the signature format contains the recovery id (currently only \textit{LTC\_ECCSIG\_ETH27}), \textit{recid} can be -1
which signals that the recovery id from the signature blob should be used. This means an application does not need to
extract the recovery id from such a signature in order to use this function.
The function \textit{ecc\_recover\_key} implements multiple signature formats, and the output is compliant for GF(p) curves.

\subsection{Signature Formats}
The following signature formats are suported:

\begin{figure}[hpbt]
\index{Signature Formats}
\begin{small}
\begin{center}
\begin{tabular}{|l|l|}
\hline \textbf{sigformat} & \textbf{description} \\
\hline LTC\_ECCSIG\_ANSIX962 & ASN.1 encoded, ANSI X9.62 \\
\hline LTC\_ECCSIG\_RFC7518 & raw R, S values as defined in RFC7518 \\
\hline LTC\_ECCSIG\_ETH27 & raw R, S, V values (V has 27 added) \\
\hline LTC\_ECCSIG\_RFC5656 & SSH+ECDSA format as defined in RFC5656 \\
\hline
\end{tabular}
\end{center}
\end{small}
\caption{Signature Formats}
\label{fig:sigformat}
\end{figure}

The \textit{LTC\_ECCSIG\_ETH27} format is based on the Ethereum Yellow Paper, see \url{https://github.com/ethereum/yellowpaper}
(Appendix F). However, convention allows the use of v=0,1 as equivalent to v=27,28 and both are accepted by
\textit{ecc\_recover\_key}.

\mysection{Shared Secret (ECDH)}
To construct a Diffie-Hellman shared secret with a private and public ECC key, use the following function:
\index{ecc\_shared\_secret()}
\begin{verbatim}
int ecc_shared_secret(      ecc_key *private_key,
                            ecc_key *public_key,
                      unsigned char *out,
                      unsigned long *outlen);
\end{verbatim}
The \textit{private\_key} is typically the local private key, and \textit{public\_key} is the key the remote party has shared.
Note: this function stores only the $x$ co-ordinate of the shared elliptic point as described in ANSI X9.63 ECDH.

\mysection{Encrypt and Decrypt (ECDH--based)}
ECDH Encryption is performed by producing a random key, hashing it, and XOR'ing the digest against the plaintext.  It is not strictly ANSI X9.63 compliant
but it is very similar.  It has been extended by using an ASN.1 sequence and hash object identifiers to allow portable usage.  The following function
encrypts a short string (no longer than the message digest) using this technique:

\subsection{Encryption}
\index{ecc\_encrypt\_key()}
\begin{verbatim}
int ecc_encrypt_key(const unsigned char *in,
                          unsigned long  inlen,
                          unsigned char *out,
                          unsigned long *outlen,
                             prng_state *prng,
                                    int  wprng,
                                    int  hash,
                                ecc_key *key);
\end{verbatim}

As the name implies this function can be used to encrypt a (symmetric) key, and is not intended for encrypting long messages directly.  It will encrypt the
plaintext in the array pointed to by \textit{in} of length \textit{inlen} octets.  It uses the public ECC key pointed to by \textit{key}, and
hash algorithm indexed by \textit{hash} to construct a shared secret which may be XOR'ed against the plaintext.  The ciphertext is stored in
the output buffer pointed to by \textit{out} of length \textit{outlen} octets.

The data is encrypted through the public ECC \textit{key} such that only the holder of the private key can decrypt the payload.
% This sounds to me like multi-party encryption, but that's not true, isn't it?
To have multiple recipients multiple calls to this function for each public ECC key are required.

\subsection{Decryption}
\index{ecc\_decrypt\_key()}
\begin{verbatim}
int ecc_decrypt_key(const unsigned char *in,
                          unsigned long  inlen,
                          unsigned char *out,
                          unsigned long *outlen,
                                ecc_key *key);
\end{verbatim}

This function will decrypt an encrypted payload.  The \textit{key} provided must be the private key corresponding to the public key
used during encryption.  If the wrong key is provided the function will not specifically return an error code.  It is important
to use some form of challenge response in that case (e.g. compute a MAC of a known string).

\subsection{Encryption Format}
The packet format for the encrypted keys is the following ASN.1 SEQUENCE:

\begin{verbatim}
ECCEncrypt ::= SEQUENCE {
   hashID        OBJECT IDENTIFIER, -- OID of hash used
   pubkey        OCTET STRING     , -- Encapsulated ECCPublicKey
   skey          OCTET STRING       -- xor of plaintext and
                                    --"hash of shared secret"
}
\end{verbatim}

\chapter{Elliptic Curve Cryptography - $Montgomery/Twisted Edwards$}
\mysection{Introduction}

The library provides functionality for \textit{Curve25519}-based \textit{X25519} Diffie-Hellman shared secrets
and \textit{EdDSA} a.k.a \textit{Ed25519} signature schemes.

The implementation is based on the \textit{tweetnacl}\footnote{\url{https://tweetnacl.cr.yp.to/}} reference implementation
as provided by Daniel J. Bernstein et.al. and only slightly modified to better fit in the library.

Both algorithms share the key structure called \textit{curve25519\_key} which is used by all Curve25519 functions.

As Curve25519 and Ed25519 are based on the same elliptic curve, but use different mathematics, the keys are not
compatible to each other.

It is possible to convert a Curve-Key to an Ed-Key and vice-versa, but this is not provided (yet).


\mysection{Curve25519-based Diffie-Hellman Key Exchange - X25519}

The library provides the Diffie-Hellman Key Exchange algorithm \textit{X25519} for curve25519 as specified in RFC 7748.

\subsection{X25519 Key Operations}

The \textit{X25519} algorithm API provides the following set of functions to create, import and export keys.

\index{x25519\_make\_key}
\begin{verbatim}
int x25519_make_key(prng_state *prng, int wprng, curve25519_key *key);
\end{verbatim}

To generate a fresh X25529 key, one can use \textit{x25519\_make\_key} which will create a private\&public key-pair.
\index{x25519\_import}
\begin{verbatim}
int x25519_import(const unsigned char *in, unsigned long inlen, curve25519_key *key);
\end{verbatim}

The \textit{x25519\_import} function can be used to import a public key in DER-encoded \textit{SubjectPublicKeyInfo} format.

\index{x25519\_import\_raw}
\begin{verbatim}
int x25519_import_raw(const unsigned char *in, unsigned long inlen, int which, curve25519_key *key);
\end{verbatim}

To import a public or private key in raw format, one can use the function \textit{x25519\_import\_raw}.

\index{x25519\_import\_x509}
\begin{verbatim}
int x25519_import_x509(const unsigned char *in, unsigned long inlen, curve25519_key *key);
\end{verbatim}

To import a public key from a DER-encoded \textit{X.509} certificate, one can use the function \textit{x25519\_import\_x509}.

\index{x25519\_import\_pkcs8}
\begin{verbatim}
int x25519_import_pkcs8(const unsigned char *in, unsigned long inlen,
                                 const void *pwd, unsigned long pwdlen,
                             curve25519_key *key);
\end{verbatim}

To import a private key in the \textit{OneAsymmetricKey} a.k.a \textit{PKCS \#8} format, either plain or PBES encrypted,
one can use the function \textit{x25519\_import\_pkcs8}.

\index{x25519\_export}
\begin{verbatim}
int x25519_export(       unsigned char *out, unsigned long *outlen,
                                   int  which,
                  const curve25519_key *key);
\end{verbatim}

To export a key, the function \textit{x25519\_export} is provided.

It has support for the following output formats:

\begin{figure}[H]
\begin{center}
\begin{tabular}{|c|c|}
\hline \textbf{which} & \textbf{output format} \\
\hline PK\_PRIVATE & Raw \\
\hline PK\_PRIVATE \& PK\_STD & PKCS \#8 \\
\hline PK\_PUBLIC & Raw \\
\hline PK\_PUBLIC \& PK\_STD & SubjectPublicKeyInfo \\
\hline
\end{tabular}
\end{center}
\caption{Possible x25519\_export() output formats}
\end{figure}

\subsection{X25519 Cryptographic Operations}

To construct a Diffie-Hellman shared secret with a private and a public X25519 key, use the following function:

\index{x25519\_shared\_secret}
\begin{verbatim}
int x25519_shared_secret(const curve25519_key *private_key,
                         const curve25519_key *public_key,
                                unsigned char *out, unsigned long *outlen);
\end{verbatim}

This will construct the shared secret between the private- and the public-key and store the result in \textit{out} of length \textit{outlen}.

\mysection{Curve25519-based EdDSA Signature Scheme - Ed25519}

The library provides the EdDSA algorithm for the edwards25519 curve in the PureEdDSA variant as specified in RFC 8032.

\subsection{EdDSA Key Operations}

The \textit{Ed25519} algorithm API provides the following set of functions to create, import and export keys.

\index{ed25519\_make\_key}
\begin{verbatim}
int ed25519_make_key(prng_state *prng, int wprng, curve25519_key *key);
\end{verbatim}

To generate a fresh Ed25529 key, one can use \textit{ed25519\_make\_key} which will create a private\&public key-pair.

\index{ed25519\_import}
\begin{verbatim}
int ed25519_import(const unsigned char *in, unsigned long inlen, curve25519_key *key);
\end{verbatim}

The \textit{ed25519\_import} function can be used to import a public key in DER-encoded \textit{SubjectPublicKeyInfo} format.

\index{ed25519\_import\_raw}
\begin{verbatim}
int ed25519_import_raw(const unsigned char *in, unsigned long inlen, int which, curve25519_key *key);
\end{verbatim}

To import a public or private key in raw format, one can use the function \textit{ed25519\_import\_raw}.

\index{ed25519\_import\_x509}
\begin{verbatim}
int ed25519_import_x509(const unsigned char *in, unsigned long inlen, curve25519_key *key);
\end{verbatim}

To import a public key from a DER-encoded \textit{X.509} certificate, one can use the function \textit{ed25519\_import\_x509}.

\index{ed25519\_import\_pkcs8}
\begin{verbatim}
int ed25519_import_pkcs8(const unsigned char *in, unsigned long inlen,
                                  const void *pwd, unsigned long pwdlen,
                              curve25519_key *key);
\end{verbatim}

To import a private key in the \textit{OneAsymmetricKey} a.k.a \textit{PKCS \#8} format, either plain or PBES encrypted,
one can use the function \textit{ed25519\_import\_pkcs8}.

\index{ed25519\_export}
\begin{verbatim}
int ed25519_export(       unsigned char *out, unsigned long *outlen,
                                    int  which,
                   const curve25519_key *key);
\end{verbatim}

To export a key, the function \textit{ed25519\_export} is provided.

It has support for the following output formats:

\begin{figure}[H]
\begin{center}
\begin{tabular}{|c|c|}
\hline \textbf{which} & \textbf{output format} \\
\hline PK\_PRIVATE & Raw \\
\hline PK\_PRIVATE \& PK\_STD & PKCS \#8 \\
\hline PK\_PUBLIC & Raw \\
\hline PK\_PUBLIC \& PK\_STD & SubjectPublicKeyInfo \\
\hline
\end{tabular}
\end{center}
\caption{Possible ed25519\_export() output formats}
\end{figure}

\subsection{EdDSA Cryptographic Operations}

To sign and/or verify a message use the following functions:

\index{ed25519\_sign}
\begin{verbatim}
int ed25519_sign(const unsigned char  *msg, unsigned long msglen,
                       unsigned char  *sig, unsigned long *siglen,
                 const curve25519_key *private_key);
\end{verbatim}

This function will EdDSA sign the message stored in the array pointed to by \textit{msg} of length \textit{msglen} octets.  The signature
will be stored in the array pointed to by \textit{sig} of length \textit{siglen} octets.

\index{ed25519\_verify}
\begin{verbatim}
int ed25519_verify(const  unsigned char *msg, unsigned long msglen,
                   const  unsigned char *sig, unsigned long siglen,
                   int *stat, const curve25519_key *public_key);
\end{verbatim}

This function will verify the EdDSA signature in the array pointed to by \textit{sig} of length \textit{siglen} octets, against the message
pointed to by the array \textit{msg} of length \textit{msglen}. It will store a non--zero value in \textit{stat} if the signature is valid.  Note:
the function will not return an error if the signature is invalid. It will return an error, if the actual signature payload is an invalid format.


\chapter{Digital Signature Algorithm}
\mysection{Introduction}
The Digital Signature Algorithm (or DSA) is a variant of the ElGamal Signature scheme which has been modified to
reduce the bandwidth of the signatures.  For example, to have \textit{80-bits of security} with ElGamal, you need a group with an order of at least 1024--bits.
With DSA, you need a group of order at least 160--bits.  By comparison, the ElGamal signature would require at least 256 bytes of storage, whereas the DSA signature
would require only at least 40 bytes.

\mysection{Key Format}
Since no useful public standard for DSA key storage was presented to me during the course of this development I made my own ASN.1 SEQUENCE which I document
now so that others can interoperate with this library.

\begin{verbatim}
DSAPublicKey ::= SEQUENCE {
    publicFlags    BIT STRING(0), -- must be 0
    g              INTEGER      , -- base generator
                                  -- check that g^q mod p == 1
                                  -- and that 1 < g < p - 1
    p              INTEGER      , -- prime modulus
    q              INTEGER      , -- order of sub-group
                                  -- (must be prime)
    y              INTEGER      , -- public key, specifically,
                                  -- g^x mod p,
                                  -- check that y^q mod p == 1
                                  -- and that 1 < y < p - 1
}

DSAPrivateKey ::= SEQUENCE {
    publicFlags    BIT STRING(1), -- must be 1
    g              INTEGER      , -- base generator
                                  -- check that g^q mod p == 1
                                  -- and that 1 < g < p - 1
    p              INTEGER      , -- prime modulus
    q              INTEGER      , -- order of sub-group
                                  -- (must be prime)
    y              INTEGER      , -- public key, specifically,
                                  -- g^x mod p,
                                  -- check that y^q mod p == 1
                                  -- and that 1 < y < p - 1
    x              INTEGER        -- private key
}
\end{verbatim}

The leading BIT STRING has a single bit in it which is zero for public keys and one for private keys.  This makes the structure uniquely decodable,
and easy to work with.

\mysection{Key Generation}
To make a DSA key you must call the following function
\begin{verbatim}
int dsa_make_key(prng_state *prng,
                        int  wprng,
                        int  group_size,
                        int  modulus_size,
                    dsa_key *key);
\end{verbatim}
The variable \textit{prng} is an active PRNG state and \textit{wprng} the index to the descriptor.  \textit{group\_size} and
\textit{modulus\_size} control the difficulty of forging a signature.  Both parameters are in bytes.  The larger the
\textit{group\_size} the more difficult a forgery becomes upto a limit.  The value of $group\_size$ is limited by
$15 < group\_size < 1024$ and $modulus\_size - group\_size < 512$.  Suggested values for the pairs are as follows.

\begin{figure}[H]
\begin{center}
\begin{tabular}{|c|c|c|}
\hline \textbf{Bits of Security} & \textbf{group\_size} & \textbf{modulus\_size} \\
\hline 80  & 20 & 128 \\
\hline 120 & 30 & 256 \\
\hline 140 & 35 & 384 \\
\hline 160 & 40 & 512 \\
\hline
\end{tabular}
\end{center}
\caption{DSA Key Sizes}
\end{figure}

When you are finished with a DSA key you can call the following function to free the memory used.
\index{dsa\_free()}
\begin{verbatim}
void dsa_free(dsa_key *key);
\end{verbatim}

\mysection{Key Verification}
Each DSA key is composed of the following variables.

\begin{enumerate}
  \item $q$ a small prime of magnitude $256^{group\_size}$.
  \item $p = qr + 1$ a large prime of magnitude $256^{modulus\_size}$ where $r$ is a random even integer.
  \item $g = h^r \mbox{ (mod }p\mbox{)}$ a generator of order $q$ modulo $p$.  $h$ can be any non-trivial random
        value.  For this library they start at $h = 2$ and step until $g$ is not $1$.
  \item $x$ a random secret (the secret key) in the range $1 < x < q$
  \item $y = g^x \mbox{ (mod }p\mbox{)}$ the public key.
\end{enumerate}

A DSA key is considered valid if it passes all of the following tests.

\begin{enumerate}
   \item $q$ must be prime.
   \item $p$ must be prime.
   \item $g$ cannot be one of $\lbrace -1, 0, 1 \rbrace$ (modulo $p$).
   \item $g$ must be less than $p$.
   \item $(p-1) \equiv 0 \mbox{ (mod }q\mbox{)}$.
   \item $g^q \equiv 1 \mbox{ (mod }p\mbox{)}$.
   \item $1 < y < p - 1$
   \item $y^q \equiv 1 \mbox{ (mod }p\mbox{)}$.
\end{enumerate}

Tests one and two ensure that the values will at least form a field which is required for the signatures to
function.  Tests three and four ensure that the generator $g$ is not set to a trivial value which would make signature
forgery easier.  Test five ensures that $q$ divides the order of multiplicative sub-group of $\Z/p\Z$. Test six
ensures that the generator actually generates a prime order group.  Tests seven and eight ensure that the public key
is within range and belongs to a group of prime order.  Note that test eight does not prove that $g$ generated $y$ only
that $y$ belongs to a multiplicative sub-group of order $q$.

The following function will perform these tests.

\index{dsa\_verify\_key()}
\begin{verbatim}
int dsa_verify_key(dsa_key *key, int *stat);
\end{verbatim}

This will test \textit{key} and store the result in \textit{stat}.  If the result is $stat = 0$ the DSA key failed one of the tests
and should not be used at all.  If the result is $stat = 1$ the DSA key is valid (as far as valid mathematics are concerned).

\mysection{Signatures}
\subsection{Signature Generation}
To generate a DSA signature call the following function:

\index{dsa\_sign\_hash()}
\begin{verbatim}
int dsa_sign_hash(const unsigned char *in,
                        unsigned long  inlen,
                        unsigned char *out,
                        unsigned long *outlen,
                           prng_state *prng,
                                  int  wprng,
                              dsa_key *key);
\end{verbatim}

Which will sign the data in \textit{in} of length \textit{inlen} bytes.  The signature is stored in \textit{out} and the size
of the signature in \textit{outlen}.  If the signature is longer than the size you initially specify in \textit{outlen} nothing
is stored and the function returns an error code.  The DSA \textit{key} must be of the \textbf{PK\_PRIVATE} persuasion.

\subsection{Signature Verification}
To verify a hash created with that function use the following function:

\index{dsa\_verify\_hash()}
\begin{verbatim}
int dsa_verify_hash(const unsigned char *sig,
                          unsigned long  siglen,
                    const unsigned char *hash,
                          unsigned long  inlen,
                                    int *stat,
                                dsa_key *key);
\end{verbatim}
Which will verify the data in \textit{hash} of length \textit{inlen} against the signature stored in \textit{sig} of length \textit{siglen}.
It will set \textit{stat} to $1$ if the signature is valid, otherwise it sets \textit{stat} to $0$.

\mysection{DSA Encrypt and Decrypt}
As of version 1.07, the DSA keys can be used to encrypt and decrypt small payloads.  It works similar to the ECC encryption where
a shared key is computed, and the hash of the shared key XOR'ed against the plaintext forms the ciphertext.  The format used is functional port of
the ECC encryption format to the DSA algorithm.

\subsection{DSA Encryption}
This function will encrypt a small payload with a recipients public DSA key.

\index{dsa\_encrypt\_key()}
\begin{verbatim}
int dsa_encrypt_key(const unsigned char *in,
                          unsigned long  inlen,
                          unsigned char *out,
                          unsigned long *outlen,
                             prng_state *prng,
                                    int  wprng,
                                    int  hash,
                                dsa_key *key);
\end{verbatim}

This will encrypt the payload in \textit{in} of length \textit{inlen} and store the ciphertext in the output buffer \textit{out}.  The
length of the ciphertext \textit{outlen} must be originally set to the length of the output buffer.  The DSA \textit{key} can be
a public key.

\subsection{DSA Decryption}

\index{dsa\_decrypt\_key()}
\begin{verbatim}
int dsa_decrypt_key(const unsigned char *in,
                          unsigned long  inlen,
                          unsigned char *out,
                          unsigned long *outlen,
                                dsa_key *key);
\end{verbatim}
This will decrypt the ciphertext \textit{in} of length \textit{inlen}, and store the original payload in \textit{out} of length \textit{outlen}.
The DSA \textit{key} must be a private key.

\mysection{DSA Key Import and Export}

\subsection{DSA Key Export}
To export a DSA key so that it can be transported use the following function:
\index{dsa\_export()}
\begin{verbatim}
int dsa_export(unsigned char *out,
               unsigned long *outlen,
                         int  type,
                     dsa_key *key);
\end{verbatim}
This will export the DSA \textit{key} to the buffer \textit{out} and set the length in \textit{outlen} (which must have been previously
initialized to the maximum buffer size).  The \textit{type} variable may be either \textbf{PK\_PRIVATE} or \textbf{PK\_PUBLIC}
depending on whether you want to export a private or public copy of the DSA key.

\subsection{DSA Key Import}
To import an exported DSA key use the following function
:
\index{dsa\_import()}
\begin{verbatim}
int dsa_import(const unsigned char *in,
                     unsigned long  inlen,
                           dsa_key *key);
\end{verbatim}

This will import the DSA key from the buffer \textit{in} of length \textit{inlen} to the \textit{key}.  If the process fails the function
will automatically free all of the heap allocated in the process (you don't have to call dsa\_free()).

\mysection{Other DSA Functions}

The following functions allow to create a DSA key in 2 steps:

\begin{enumerate}
    \item Load or generate \textit{p}, \textit{q}, \textit{g} part of the key via \textit{dsa\_set\_pqg()}, \textit{dsa\_set\_pqg\_dsaparam()} or \textit{dsa\_generate\_pqg()}.
    \item Load or generate the actual DSA key -- private (\textit{x} and \textit{y} values) or public (\textit{y} value).
\end{enumerate}

\index{dsa\_set\_pqg()}
\begin{verbatim}
int dsa_set_pqg(const unsigned char *p,  unsigned long plen,
                const unsigned char *q,  unsigned long qlen,
                const unsigned char *g,  unsigned long glen,
                dsa_key *key);
\end{verbatim}

This will initialise the \textit{p}, \textit{q} and \textit{g} part of \textit{key} structure by directly loading binary
representation of \textit{p} (with length of \textit{plen}), \textit{q} (with length of \textit{qlen}) and \textit{g} (with length of \textit{glen}).
A simple DSA key validity check (without primality testing) is performed at the end of this function.

\index{dsa\_set\_pqg\_dsaparam()}
\begin{verbatim}
int dsa_set_pqg_dsaparam(const unsigned char *dsaparam,
                               unsigned long  dsaparamlen,
                                     dsa_key *key);
\end{verbatim}

This will initialise the \textit{p}, \textit{q} and \textit{g} part of \textit{key} structure by directly loading binary representation
of DSA parameters stored as a binary data in a buffer \textit{dsaparam} (with length of \textit{dsaparamlen}). A simple DSA key validity
check (without primality testing) is performed at the end of this function. The \textit{dsaparam} can be generated via:
\begin{verbatim}
 openssl dsaparam 2048 -outform DER -out dsaparam.der
\end{verbatim}

\index{dsa\_generate\_pqg()}
\begin{verbatim}
int dsa_generate_pqg(prng_state *prng,
                            int  wprng,
                            int  group_size,
                            int  modulus_size,
                        dsa_key *key);
\end{verbatim}

This will initialise the \textit{p}, \textit{q} and \textit{g} part of \textit{key} structure with newly generated random values.
As for the parameters they are the same as by \textit{dsa\_make\_key}.

\index{dsa\_set\_key()}
\begin{verbatim}
int dsa_set_key(const unsigned char *in,
                      unsigned long  inlen,
                                int  type,
                            dsa_key *key);
\end{verbatim}

This function can be used for setting the actual DSA key. If \textit{type} is \textit{PK\_PRIVATE} then the buffer \textit{in}
(with length of \textit{inlen}) contains a binary representation of \textit{x} part of the key (the public part \textit{y} is computed).
If \textit{type} is \textit{PK\_PUBLIC} then the buffer \textit{in} contains a binary representation of \textit{y} part of the key.

\index{dsa\_generate\_key()}
\begin{verbatim}
int dsa_generate_key(prng_state *prng,
                            int  wprng,
                        dsa_key *key);
\end{verbatim}

This function generates a private DSA key containing both \textit{x} and \textit{y} parts.

\chapter{Standards Support}
\mysection{ASN.1 Formats}
LibTomCrypt supports a variety of ASN.1 data types encoded with the Distinguished Encoding Rules (DER) suitable for various cryptographic protocols.  The data types
are all provided with three basic functions with \textit{similar} prototypes.  One function has been dedicated to calculate the length in octets of a given
format, and two functions have been dedicated to encoding and decoding the format.

On top of the basic data types are the SEQUENCE and SET data types which are collections of other ASN.1 types.  They are provided
in the same manner as the other data types except they use list of objects known as the \textbf{ltc\_asn1\_list} structure.  It is defined as the following:

\index{ltc\_asn1\_list structure}
\begin{verbatim}
typedef struct {
   ltc_asn1_type          type;
   void                  *data;
   unsigned long          size;
   int                    used;
   int                    optional;
   ltc_asn1_class         klass;
   ltc_asn1_pc            pc;
   ulong64                tag;
   struct ltc_asn1_list_ *prev,  *next,
                         *child, *parent;
} ltc_asn1_list;
\end{verbatim}

\index{LTC\_SET\_ASN1 macro}
The \textit{type} field is one of the following ASN.1 field definitions.  The \textit{data} pointer is a void pointer to the data to be encoded (or the destination) and the
\textit{size} field is specific to what you are encoding (e.g. number of bits in the BIT STRING data type).  The \textit{used} field is primarily for the CHOICE decoder
and reflects if the particular member of a list was the decoded data type.  To help build the lists in an orderly fashion the macro
\textit{LTC\_SET\_ASN1(list, index, Type, Data, Size)} has been provided.

It will assign to the \textit{index}th position in the \textit{list} the triplet (Type, Data, Size).  An example usage would be:

\begin{small}
\begin{verbatim}
...
ltc_asn1_list   sequence[3];
unsigned long   three=3;

LTC_SET_ASN1(sequence, 0, LTC_ASN1_IA5_STRING,    "hello", 5);
LTC_SET_ASN1(sequence, 1, LTC_ASN1_SHORT_INTEGER, &three,  1);
LTC_SET_ASN1(sequence, 2, LTC_ASN1_NULL,           NULL,   0);
\end{verbatim}
\end{small}

The macro is relatively safe with respect to modifying variables, for instance the following code is equivalent.

\begin{small}
\begin{verbatim}
...
ltc_asn1_list   sequence[3];
unsigned long   three=3;
int             x=0;
LTC_SET_ASN1(sequence, x++, LTC_ASN1_IA5_STRING,    "hello", 5);
LTC_SET_ASN1(sequence, x++, LTC_ASN1_SHORT_INTEGER, &three,  1);
LTC_SET_ASN1(sequence, x++, LTC_ASN1_NULL,           NULL,   0);
\end{verbatim}
\end{small}

\begin{figure}[h]
\begin{center}
\begin{small}
\begin{tabular}{|l|l|}
\hline \textbf{Definition}           & \textbf{ASN.1 Type} \\
\hline LTC\_ASN1\_EOL                & End of a ASN.1 list structure. \\
\hline LTC\_ASN1\_BOOLEAN            & BOOLEAN type \\
\hline LTC\_ASN1\_INTEGER            & INTEGER (uses mp\_int) \\
\hline LTC\_ASN1\_SHORT\_INTEGER     & INTEGER (32--bit using unsigned long) \\
\hline LTC\_ASN1\_BIT\_STRING        & BIT STRING (one bit per char) \\
\hline LTC\_ASN1\_OCTET\_STRING      & OCTET STRING (one octet per char) \\
\hline LTC\_ASN1\_NULL               & NULL \\
\hline LTC\_ASN1\_OBJECT\_IDENTIFIER & OBJECT IDENTIFIER  \\
\hline LTC\_ASN1\_IA5\_STRING        & IA5 STRING (one octet per char) \\
\hline LTC\_ASN1\_PRINTABLE\_STRING  & PRINTABLE STRING (one octet per char) \\
\hline LTC\_ASN1\_UTF8\_STRING       & UTF8 STRING (one wchar\_t per char) \\
\hline LTC\_ASN1\_UTCTIME            & UTCTIME (see ltc\_utctime structure) \\
\hline LTC\_ASN1\_CHOICE             & CHOICE \\
\hline LTC\_ASN1\_SEQUENCE           & SEQUENCE (and SEQUENCE OF) \\
\hline LTC\_ASN1\_SET                & SET \\
\hline LTC\_ASN1\_SETOF              & SET OF \\
\hline LTC\_ASN1\_RAW\_BIT\_STRING   & BIT STRING (one octet per char) \\
\hline LTC\_ASN1\_TELETEX\_STRING    & TELETEX STRING (one octet per char) \\
\hline LTC\_ASN1\_GENERALIZEDTIME    & GeneralizedTime (see ltc\_generalizedtime structure) \\
\hline LTC\_ASN1\_CUSTOM\_TYPE       & A custom type (see LTC\_SET\_ASN1\_CUSTOM\_XXX macros) \\
\hline
\end{tabular}
\caption{List of ASN.1 Supported Types}
\index{ltc\_asn1\_type}
\end{small}
\end{center}
\end{figure}

\index{LTC\_ASN1\_CUSTOM\_TYPE}
\index{LTC\_SET\_ASN1\_CUSTOM\_CONSTRUCTED macro}
\index{LTC\_SET\_ASN1\_CUSTOM\_PRIMITIVE macro}

To be able to encode and decode all other valid ASN.1 Identifiers, such as Context-Specific types the macros
\textit{LTC\_SET\_ASN1\_CUSTOM\_CONSTRUCTED(list, index, Class, Tag, Data)} resp.
\textit{LTC\_SET\_ASN1\_CUSTOM\_PRIMITIVE(list, index, Class, Tag, Type, Data, Size)} have been provided.

They will assign to the \textit{index}th position in the \textit{list} the Identifier-triplet (Class, CONSTRUCTED resp. PRIMITIVE, Tag).
An example usage would be:

\begin{small}
\begin{verbatim}
...
ltc_asn1_list   sequence[4], custom[1];
unsigned long   three=3;
unsigned char   buf[128];

LTC_SET_ASN1(sequence, 0, LTC_ASN1_IA5_STRING,    "hello", 5);
LTC_SET_ASN1(sequence, 1, LTC_ASN1_SHORT_INTEGER, &three,  1);
LTC_SET_ASN1(sequence, 2, LTC_ASN1_NULL,           NULL,   0);
LTC_SET_ASN1_CUSTOM_PRIMITIVE(sequence, 3, LTC_ASN1_CL_CONTEXT_SPECIFIC, 23, \
                                        LTC_ASN1_OCTET_STRING, buf, sizeof(buf));

LTC_SET_ASN1_CUSTOM_CONSTRUCTED(custom, 0, LTC_ASN1_CL_CONTEXT_SPECIFIC, 0, sequence);
\end{verbatim}
\end{small}

This would allow (un)pack'ing the given \textit{sequence} from/in the context-specific tag \textit{[0]}.

\subsection{SEQUENCE Type}
The SEQUENCE data type is a collection of other ASN.1 data types encapsulated with a small header which is a useful way of sending multiple data types in one packet.

\subsubsection{SEQUENCE Encoding}
To encode a sequence a \textbf{ltc\_asn1\_list} array must be initialized with the members of the sequence and their respective pointers.  The encoding is performed
with the following function.

\index{der\_encode\_sequence()}\index{LTC\_ASN1\_EOL}
\begin{verbatim}
int der_encode_sequence(ltc_asn1_list *list,
                        unsigned long  inlen,
                        unsigned char *out,
                        unsigned long *outlen);
\end{verbatim}
This encodes a sequence of items pointed to by \textit{list} where the list has \textit{inlen} items in it.  The SEQUENCE will be encoded to \textit{out} and of length \textit{outlen}.  The
function will terminate when it reads all the items out of the list (upto \textit{inlen}) or it encounters an item in the list with a type of \textbf{LTC\_ASN1\_EOL}.

The \textit{data} pointer in the list would be the same pointer you would pass to the respective ASN.1 encoder (e.g. der\_encode\_bit\_string()) and it is simply passed on
verbatim to the dependent encoder.  The list can contain other SEQUENCE or SET types which enables you to have nested SEQUENCE and SET definitions.  In these cases
the \textit{data} pointer is simply a pointer to another \textbf{ltc\_asn1\_list}.

\subsubsection{SEQUENCE Decoding}

\index{der\_decode\_sequence()}
\index{der\_decode\_sequence\_strict()}

Decoding a SEQUENCE is similar to encoding.  You set up an array of \textbf{ltc\_asn1\_list} where in this case the \textit{size} member is the maximum size
(in certain cases).  For types such as IA5 STRING, BIT STRING, OCTET STRING (etc) the \textit{size} field is updated after successful decoding to reflect how many
units of the respective type has been loaded.

\begin{verbatim}
int der_decode_sequence(const unsigned char *in,
                              unsigned long  inlen,
                              ltc_asn1_list *list,
                              unsigned long  outlen);

int der_decode_sequence_strict(const unsigned char *in,
                                     unsigned long  inlen,
                                     ltc_asn1_list *list,
                                     unsigned long  outlen);
\end{verbatim}

This will decode upto \textit{outlen} items from the input buffer \textit{in} of length \textit{inlen} octets.  The function will stop (gracefully) when it runs out of items to decode.
It will fail (for among other reasons) when it runs out of input bytes to read, a data type is invalid or a heap failure occurred.
The regular variant will return \textbf{CRYPT\_INPUT\_TOO\_LONG} in cases where there was more data to be decoded given through \textit{inlen} than the ASN.1 length-tag specified.
The strict variant \textit{der\_decode\_sequence\_strict()} returns an error in this case.

For the following types the \textit{size} field will be updated to reflect the number of units read of the given type.
\begin{enumerate}
   \item (RAW) BIT STRING
   \item OCTET STRING
   \item OBJECT IDENTIFIER
   \item IA5 STRING
   \item PRINTABLE STRING
   \item TELETEX STRING
   \item UTF8 STRING
\end{enumerate}

\subsubsection{SEQUENCE Length}

The length of a SEQUENCE can be determined with the following function.

\index{der\_length\_sequence()}
\begin{verbatim}
int der_length_sequence(ltc_asn1_list *list,
                        unsigned long  inlen,
                        unsigned long *outlen);
\end{verbatim}

This will get the encoding size for the given \textit{list} of length \textit{inlen} and store it in \textit{outlen}.

\subsubsection{SEQUENCE Multiple Argument Lists}\index{LTC\_ASN1\_EOL}

For small or simple sequences an encoding or decoding can be performed with one of the following two functions.

\index{der\_encode\_sequence\_multi()}
\index{der\_decode\_sequence\_multi()}

\begin{verbatim}
int der_encode_sequence_multi(unsigned char *out,
                              unsigned long *outlen, ...);

int der_decode_sequence_multi(const unsigned char *in,
                                    unsigned long  inlen, ...);
\end{verbatim}

These either encode or decode (respectively) a SEQUENCE data type where the items in the sequence are specified after the length parameter.

The list of items are specified as a triple of the form \textit{(type, size, data)}  where \textit{type} is an \textbf{int}, \textit{size} is a \textbf{unsigned long}
and \textit{data} is \textbf{void} pointer.  The list of items must be terminated with an item with the type \textbf{LTC\_ASN1\_EOL}.

It is ideal that you cast the \textit{size} values to unsigned long to ensure that the proper data type is passed to the function.  Constants such as \textit{1} without
a cast or prototype are of type \textbf{int} by default.  Appending \textit{UL} or pre-pending \textit{(unsigned long)} is enough to cast it to the correct type.

\begin{small}
\begin{verbatim}
unsigned char buf[MAXBUFSIZE];
unsigned long buflen;
int           err;

   buflen = sizeof(buf);
   if ((err =
        der_encode_sequence_multi(buf, &buflen,
        LTC_ASN1_IA5_STRING, 5UL, "Hello",
        LTC_ASN1_IA5_STRING, 7UL, " World!",
        LTC_ASN1_EOL,        0UL, NULL)) != CRYPT_OK) {
      // error handling
   }
\end{verbatim}
\end{small}

This example encodes a SEQUENCE with two IA5 STRING types containing ``Hello'' and `` World!'' respectively.  Note the usage of the \textbf{UL} modifier
on the size parameters.  This forces the compiler to pass the numbers as the required \textbf{unsigned long} type that the function expects.

\subsection{SET and SET OF}

\index{SET} \index{SET OF}
SET and SET OF are related to the SEQUENCE type in that they can be pretty much be decoded with the same code.  However, they are different, and they should
be carefully noted.  The SET type is an unordered array of ASN.1 types sorted by the TAG (type identifier), whereas the SET OF type is an ordered array of
a \textbf{single} ASN.1 object sorted in ascending order by the DER their respective encodings.

\subsubsection{SET Encoding}

SETs use the same array structure of ltc\_asn1\_list that the SEQUENCE functions use.  They are encoded with the following function:

\index{der\_encode\_set()}
\begin{verbatim}
int der_encode_set(ltc_asn1_list *list,
                   unsigned long  inlen,
                   unsigned char *out,
                   unsigned long *outlen);
\end{verbatim}

This will encode the list of ASN.1 objects in \textit{list} of length \textit{inlen} objects, and store the output in \textit{out} of length \textit{outlen} bytes.
The function will make a copy of the list provided, and sort it by the TAG.  Objects with identical TAGs are additionally sorted on their original placement in the
array (to make the process deterministic).

This function will \textbf{NOT} recognize \textit{DEFAULT} objects, and it is the responsibility of the caller to remove them as required.

\subsubsection{SET Decoding}

The SET type can be decoded with the following function.

\index{der\_decode\_set()}
\begin{verbatim}
int der_decode_set(const unsigned char *in,
                         unsigned long  inlen,
                         ltc_asn1_list *list,
                         unsigned long  outlen);
\end{verbatim}

This will decode the SET specified by \textit{list} of length \textit{outlen} objects from the input buffer \textit{in} of length \textit{inlen} octets.

It handles the fact that SETs are not strictly ordered and will make multiple passes (as required) through the list to decode all the objects.

\subsubsection{SET Length}
The length of a SET can be determined by calling der\_length\_sequence() since they have the same encoding length.

\subsubsection{SET OF Encoding}
A \textit{SET OF} object is an array of identical objects (e.g. OCTET STRING) sorted in ascending order by the DER encoding of the object.  They are
used to store objects deterministically based solely on their encoding.  It uses the same array structure of ltc\_asn1\_list that the SEQUENCE functions
use.  They are encoded with the following function.

\index{der\_encode\_setof()}
\begin{verbatim}
int der_encode_setof(ltc_asn1_list *list,
                     unsigned long  inlen,
                     unsigned char *out,
                     unsigned long *outlen);
\end{verbatim}

This will encode a \textit{SET OF} containing the \textit{list} of \textit{inlen} ASN.1 objects and store the encoding in the output buffer \textit{out} of length \textit{outlen}.

The routine will first encode the SET OF in an unordered fashion (in a temporary buffer) then sort using the XQSORT macro and copy back to the output buffer.  This
means you need at least enough memory to keep an additional copy of the output on the heap.

\subsubsection{SET OF Decoding}
Since the decoding of a \textit{SET OF} object is unambiguous it can be decoded with der\_decode\_sequence().

\subsubsection{SET OF Length}
Like the SET type the der\_length\_sequence() function can be used to determine the length of a \textit{SET OF} object.

\subsection{ASN.1 INTEGER}

To encode or decode INTEGER data types use the following functions.

\index{der\_encode\_integer()}\index{der\_decode\_integer()}\index{der\_length\_integer()}
\begin{verbatim}
int der_encode_integer(         void *num,
                       unsigned char *out,
                       unsigned long *outlen);

int der_decode_integer(const unsigned char *in,
                             unsigned long  inlen,
                                      void *num);

int der_length_integer(         void *num,
                       unsigned long *len);
\end{verbatim}

These will encode or decode a signed INTEGER data type using the bignum data type to store the large INTEGER.  To encode smaller values without allocating
a bignum to store the value, the \textit{short} INTEGER functions were made available.

\index{der\_encode\_short\_integer()}\index{der\_decode\_short\_integer()}\index{der\_length\_short\_integer()}
\begin{verbatim}
int der_encode_short_integer(unsigned long  num,
                             unsigned char *out,
                             unsigned long *outlen);

int der_decode_short_integer(const unsigned char *in,
                                   unsigned long  inlen,
                                   unsigned long *num);

int der_length_short_integer(unsigned long  num,
                             unsigned long *outlen);
\end{verbatim}

These will encode or decode an unsigned \textbf{unsigned long} type (only reads upto 32--bits).  For values in the range $0 \dots 2^{32} - 1$ the integer
and short integer functions can encode and decode each others outputs.

\subsection{ASN.1 BIT STRING}

\index{der\_encode\_bit\_string()}\index{der\_decode\_bit\_string()}\index{der\_length\_bit\_string()}
\begin{verbatim}
int der_encode_bit_string(const unsigned char *in,
                                unsigned long  inlen,
                                unsigned char *out,
                                unsigned long *outlen);

int der_decode_bit_string(const unsigned char *in,
                                unsigned long  inlen,
                                unsigned char *out,
                                unsigned long *outlen);

int der_length_bit_string(unsigned long  nbits,
                          unsigned long *outlen);
\end{verbatim}

These will encode or decode a BIT STRING data type.  The bits are passed in (or read out) using one \textbf{char} per bit.  A non--zero value will be interpreted
as a one bit, and a zero value a zero bit.

\subsection{ASN.1 RAW BIT STRING}

\index{der\_encode\_raw\_bit\_string()}\index{der\_decode\_raw\_bit\_string()}
\begin{verbatim}
int der_encode_raw_bit_string(const unsigned char *in,
                                    unsigned long  inlen,
                                    unsigned char *out,
                                    unsigned long *outlen);

int der_decode_raw_bit_string(const unsigned char *in,
                                    unsigned long  inlen,
                                    unsigned char *out,
                                    unsigned long *outlen);
\end{verbatim}

These will encode or decode a BIT STRING data type.
The bits are passed in (or read out) using one \textbf{unsigned char} per 8 bit.

This function differs from the normal BIT STRING, as it can be used to directly
process raw binary data and store it to resp. read it from an ASN.1 BIT STRING
data type.

The length function is the same as for the normal BIT STRING \textit{der\_length\_bit\_string()}.

\subsection{ASN.1 OCTET STRING}

\index{der\_encode\_octet\_string()}\index{der\_decode\_octet\_string()}\index{der\_length\_octet\_string()}
\begin{verbatim}
int der_encode_octet_string(const unsigned char *in,
                                  unsigned long  inlen,
                                  unsigned char *out,
                                  unsigned long *outlen);

int der_decode_octet_string(const unsigned char *in,
                                  unsigned long  inlen,
                                  unsigned char *out,
                                  unsigned long *outlen);

int der_length_octet_string(unsigned long  noctets,
                            unsigned long *outlen);
\end{verbatim}

These will encode or decode an OCTET STRING data type.  The octets are stored using one \textbf{unsigned char} each.

\subsection{ASN.1 OBJECT IDENTIFIER}

\index{der\_encode\_object\_identifier()}\index{der\_decode\_object\_identifier()}\index{der\_length\_object\_identifier()}
\begin{verbatim}
int der_encode_object_identifier(unsigned long *words,
                                 unsigned long  nwords,
                                 unsigned char *out,
                                 unsigned long *outlen);

int der_decode_object_identifier(const unsigned char *in,
                                       unsigned long  inlen,
                                       unsigned long *words,
                                       unsigned long *outlen);

int der_length_object_identifier(unsigned long *words,
                                 unsigned long  nwords,
                                 unsigned long *outlen);
\end{verbatim}

These will encode or decode an OBJECT IDENTIFIER object.  The words of the OID are stored in individual \textbf{unsigned long} elements, and must be in the range
$0 \ldots 2^{32} - 1$.

\subsection{ASN.1 IA5 STRING}

\index{der\_encode\_ia5\_string()}\index{der\_decode\_ia5\_string()}\index{der\_length\_ia5\_string()}
\begin{verbatim}
int der_encode_ia5_string(const unsigned char *in,
                                unsigned long  inlen,
                                unsigned char *out,
                                unsigned long *outlen);

int der_decode_ia5_string(const unsigned char *in,
                                unsigned long  inlen,
                                unsigned char *out,
                                unsigned long *outlen);

int der_length_ia5_string(const unsigned char *octets,
                                unsigned long  noctets,
                                unsigned long *outlen);
\end{verbatim}

These will encode or decode an IA5 STRING.  The characters are read or stored in individual \textbf{char} elements.  These functions performs internal character
to numerical conversions based on the conventions of the compiler being used.  For instance, on an x86\_32 machine 'A' == 65 but the same may not be true on
say a SPARC machine.  Internally, these functions have a table of literal characters and their numerical ASCII values.  This provides a stable conversion provided
that the build platform honours the run--time platforms character conventions.

\subsection{ASN.1 TELETEX STRING}

\index{der\_decode\_teletex\_string()}\index{der\_length\_teletex\_string()}
\begin{verbatim}
int der_decode_teletex_string(const unsigned char *in,
                                    unsigned long  inlen,
                                    unsigned char *out,
                                    unsigned long *outlen);

int der_length_teletex_string(const unsigned char *octets,
                                    unsigned long  noctets,
                                    unsigned long *outlen);
\end{verbatim}

These will decode a TELETEX STRING.
The characters are read in individual \textbf{char} elements.
The internal structure is similar to that of the IA5 STRING implementation, to
be able to provide a stable conversion independent of the build-- and run--time
platform.

\subsection{ASN.1 PRINTABLE STRING}

\index{der\_encode\_printable\_string()}\index{der\_decode\_printable\_string()}\index{der\_length\_printable\_string()}
\begin{verbatim}
int der_encode_printable_string(const unsigned char *in,
                                      unsigned long  inlen,
                                      unsigned char *out,
                                      unsigned long *outlen);

int der_decode_printable_string(const unsigned char *in,
                                      unsigned long  inlen,
                                      unsigned char *out,
                                      unsigned long *outlen);

int der_length_printable_string(const unsigned char *octets,
                                      unsigned long  noctets,
                                      unsigned long *outlen);
\end{verbatim}

These will encode or decode an PRINTABLE STRING.  The characters are read or stored in individual \textbf{char} elements.  These functions performs internal character
to numerical conversions based on the conventions of the compiler being used.  For instance, on an x86\_32 machine 'A' == 65 but the same may not be true on
say a SPARC machine.  Internally, these functions have a table of literal characters and their numerical ASCII values.  This provides a stable conversion provided
that the build platform honours the run-time platforms character conventions.

\subsection{ASN.1 UTF8 STRING}

\index{der\_encode\_utf8\_string()}\index{der\_decode\_utf8\_string()}\index{der\_length\_utf8\_string()}
\begin{verbatim}
int der_encode_utf8_string(const wchar_t *in,
                           unsigned long  inlen,
                           unsigned char *out,
                           unsigned long *outlen);

int der_decode_utf8_string(const unsigned char *in,
                                 unsigned long  inlen,
                                       wchar_t *out,
                                 unsigned long *outlen);

int der_length_utf8_string(const wchar_t *octets,
                           unsigned long  noctets,
                           unsigned long *outlen);
\end{verbatim}

These will encode or decode an UTF8 STRING.  The characters are read or stored in individual \textbf{wchar\_t} elements.  These function performs no internal
mapping and treat the characters as literals.

These functions use the \textbf{wchar\_t} type which is not universally available.  In those cases, the library will typedef it to \textbf{unsigned long}.  If you
intend to use the ISO C functions for working with wide--char arrays, you should make sure that wchar\_t has been defined previously.

\subsection{ASN.1 UTCTIME}

The UTCTIME type is to store a date and time in ASN.1 format.  It uses the following structure to organize the time.

\index{ltc\_utctime structure}
\begin{verbatim}
typedef struct {
   unsigned YY, /* year    00--99 */
            MM, /* month   01--12 */
            DD, /* day     01--31 */
            hh, /* hour    00--23 */
            mm, /* minute  00--59 */
            ss, /* second  00--59 */
            off_dir, /* timezone offset direction 0 == +, 1 == - */
            off_hh, /* timezone offset hours */
            off_mm; /* timezone offset minutes */
} ltc_utctime;
\end{verbatim}

The time can be offset plus or minus a set amount of hours (off\_hh) and minutes (off\_mm).  When \textit{off\_dir} is zero, the time will be added otherwise it
will be subtracted.  For instance, the array $\lbrace 5, 6, 20, 22, 4, 00, 0, 5, 0 \rbrace$ represents the current time of
\textit{2005, June 20th, 22:04:00} with a time offset of +05h00.

\index{der\_encode\_utctime()}\index{der\_decode\_utctime()}\index{der\_length\_utctime()}
\begin{verbatim}
int der_encode_utctime(  ltc_utctime *utctime,
                       unsigned char *out,
                       unsigned long *outlen);

int der_decode_utctime(const unsigned char *in,
                             unsigned long *inlen,
                               ltc_utctime *out);

int der_length_utctime(  ltc_utctime *utctime,
                       unsigned long *outlen);
\end{verbatim}

The encoder will store time in one of the two ASN.1 formats, either \textit{YYMMDDhhmmssZ} or \textit{YYMMDDhhmmss$\pm$hhmm}, and perform minimal error checking on the
input.  The decoder will read all valid ASN.1 formats and perform range checking on the values (not complete but rational) useful for catching packet errors.

It is suggested that decoded data be further scrutinized (e.g. days of month in particular).

\subsection{ASN.1 GeneralizedTime}

The GeneralizedTime type is to store a date and time in ASN.1 format.  It uses the following structure to organize the time.

\index{ltc\_utctime structure}
\begin{verbatim}
typedef struct {
   unsigned YYYY, /* year              0--9999 */
            MM, /* month               1--12 */
            DD, /* day                 1--31 */
            hh, /* hour                0--23 */
            mm, /* minute              0--59 */
            ss, /* second              0--59 */
            fs, /* fractional seconds  1--UINT_MAX */
            off_dir, /* timezone offset direction 0 == +, 1 == - */
            off_hh, /* timezone offset hours */
            off_mm; /* timezone offset minutes */
} ltc_generalizedtime;
\end{verbatim}

The time can be offset plus or minus a set amount of hours (off\_hh) and minutes (off\_mm).  When \textit{off\_dir} is zero, the time will be added otherwise it
will be subtracted.  For instance, the array $\lbrace 2005, 6, 20, 22, 4, 0, 122, 0, 5, 0 \rbrace$ represents the current time of
\textit{2005, June 20th, 22:04:00.122} with a time offset of +05h00.

\index{der\_encode\_utctime()}\index{der\_decode\_utctime()}\index{der\_length\_utctime()}
\begin{verbatim}
int der_encode_generalizedtime(ltc_generalizedtime *gtime,
                               unsigned char       *out,
                               unsigned long       *outlen);

int der_decode_generalizedtime(const unsigned char *in,
                               unsigned long       *inlen,
                               ltc_generalizedtime *out);

int der_length_generalizedtime(ltc_generalizedtime *gtime,
                               unsigned long       *outlen);
\end{verbatim}

The encoder will store time in one of the following ASN.1 formats, either \textit{YYYYMMDDhhmmssZ} or
\textit{YYYYMMDDhhmmss$\pm$hhmm} or\textit{YYYYMMDDhhmmss.fsZ} or \textit{YYYYMMDDhhmmss.fs$\pm$hhmm},
and perform minimal error checking on the input.
The decoder will read all valid ASN.1 formats and perform range checking on the values (not complete but
rational) useful for catching packet errors.

The fractional seconds are always added in case they are not $0$.
The implementation of fractional seconds is currently unreliable and you can't detect decoded
resp. encode leading $0$'s (e.g. \textit{20170424232717.005Z} would be decoded as
\textit{22. April 2017, 23:27:17.5}).

It is suggested that decoded data be further scrutinized (e.g. days of month in particular).

\subsection{ASN.1 CHOICE}

The CHOICE ASN.1 type represents a union of ASN.1 types all of which are stored in a \textit{ltc\_asn1\_list}.  There is no encoder for the CHOICE type, only a
decoder.  The decoder will scan through the provided list attempting to use the appropriate decoder on the input packet.  The list can contain any ASN.1 data
type\footnote{Except it cannot have LTC\_ASN1\_INTEGER and LTC\_ASN1\_SHORT\_INTEGER simultaneously.} except for other CHOICE types.

There is no encoder for the CHOICE type as the actual DER encoding is the encoding of the chosen type.

\index{der\_decode\_choice()}
\begin{verbatim}
int der_decode_choice(const unsigned char *in,
                            unsigned long *inlen,
                            ltc_asn1_list *list,
                            unsigned long  outlen);
\end{verbatim}

This will decode the input in the \textit{in} field of length \textit{inlen}.  It uses the provided ASN.1 list specified in the \textit{list} field which has
\textit{outlen} elements.  The \textit{inlen} field will be updated with the length of the decoded data type, as well as the respective entry in the \textit{list} field
will have the \textit{used} flag set to non--zero to reflect it was the data type decoded.

\subsection{ASN.1 Custom Types}

To be able to represent all other valid types besides the primitive types having their own decoder, the \textit{custom\_type} de- and encoders are provided.

\index{der\_encode\_custom\_type()} \index{der\_decode\_custom\_type()} \index{der\_length\_custom\_type()} \index{LTC\_ASN1\_CUSTOM\_TYPE}
\begin{verbatim}
int der_encode_custom_type(const ltc_asn1_list *root,
                                 unsigned char *out, unsigned long *outlen);

int der_decode_custom_type(const unsigned char *in, unsigned long inlen,
                                 ltc_asn1_list *root);

int der_length_custom_type(const ltc_asn1_list *root,
                                 unsigned long *outlen,
                                 unsigned long *payloadlen);
\end{verbatim}

The usage of this de- and encoder is a bit different than the others since the type to be encoded has to be passed to the function.
Therefore the \textit{root} parameter identifies the type that should be encoded which has been set by the \textit{LTC\_SET\_ASN1}
and \textit{LTC\_SET\_ASN1\_IDENTIFIER}, resp. \textit{LTC\_SET\_ASN1\_CUSTOM} macros.
The value to de-/encode has to be linked through the \textit{data} argument of the \textit{LTC\_SET\_ASN1} macro, as done for sequences.
The value that should be de-/encoded can either be a primitive or a constructed type.

\subsection{ASN.1 Flexi Decoder}

The ASN.1 \textit{flexi} decoder allows the developer to decode arbitrary ASN.1 DER packets without first knowing the structure of the data.
Where der\_decode\_sequence() requires the developer to specify the data types to decode in advance the flexi decoder is entirely free form.

The flexi decoder uses the same \textit{ltc\_asn1\_list} but instead of being stored in an array it uses the linked list pointers \textit{prev}, \textit{next}, \textit{parent}
and \textit{child}.  The list works as a \textit{doubly-linked list} structure where decoded items at the same level are siblings (using \textit{next} and \textit{prev}) and items
encoded in a SEQUENCE are stored as a \textit{child} element.

When a SEQUENCE or SET has been encountered a SEQUENCE (or SET resp.) item will be added as a sibling (e.g. list.type == LTC\_ASN1\_SEQUENCE) and the \textit{child}
pointer points to a new list of items contained within the object.

\index{der\_decode\_sequence\_flexi()}
\begin{verbatim}
int  der_decode_sequence_flexi(const unsigned char *in,
                                     unsigned long *inlen,
                                     ltc_asn1_list **out);
\end{verbatim}

This will decode items in the \textit{in} buffer of max input length \textit{inlen} and store the newly created pointer to the list in \textit{out}.  This function allocates
all required memory for the decoding.  It stores the number of octets read back into \textit{inlen}.

The function will terminate when either it hits an invalid ASN.1 tag, or it reads \textit{inlen} octets.  An early termination is a soft error, and returns
normally.  The decoded list \textit{out} will point to the very first element of the list (i.e. both parent and prev pointers will be \textbf{NULL}).

An invalid decoding will terminate the process, and free the allocated memory automatically.

The flexi decoder calls itself when decoding a constructed type. This leads to
a 'child process' that will terminate when it decodes an unkown/invalid
identifier and leaves an allocated but uninitialized child element.
However the parent processing will continue with a "soft-error".
This can be detected by checking for \textit{child} elements with
type \textbf{LTC\_ASN1\_EOL} after decoding.

The v1.18.0 of the library had support for decoding two new types, \textbf{LTC\_ASN1\_CONSTRUCTED} and \textbf{LTC\_ASN1\_CONTEXT\_SPECIFIC},
which has been replaced in FIXME-version-next by a more complete approach.

As of FIXME-version-next all ASN.1 Identifiers which don't have a decoder implemented (and thereby their own type) will be marked as
\textbf{LTC\_ASN1\_CUSTOM\_TYPE}.


\textbf{Note:} the list decoded by this function is \textbf{NOT} in the correct form for der\_encode\_sequence() to use directly.  You will first
have to convert the list by first storing all of the siblings in an array then storing all the children as sub-lists of a sequence using the \textit{.data}
pointer.  Currently no function in LibTomCrypt provides this ability.

\subsubsection{Sample Decoding}
Suppose we decode the following structure:
\begin{small}
\begin{verbatim}
User ::= SEQUENCE {
   Name        IA5 STRING
   LoginToken  SEQUENCE {
      passwdHash   OCTET STRING
      pubkey       ECCPublicKey
   }
   LastOn      UTCTIME
}
\end{verbatim}
\end{small}
\begin{flushleft}and we decoded it with the following code:\end{flushleft}

\begin{small}
\begin{verbatim}
unsigned char inbuf[MAXSIZE];
unsigned long inbuflen;
ltc_asn1_list *list;
int           err;

/* somehow fill inbuf/inbuflen */
if ((err = der_decode_sequence_flexi(inbuf, inbuflen, &list)) != CRYPT_OK) {
   printf("Error decoding: %s\n", error_to_string(err));
   exit(EXIT_FAILURE);
}
\end{verbatim}
\end{small}

At this point \textit{list} would point to the SEQUENCE identified by \textit{User}.  It would have no sibblings (prev or next), and only a child node.  Walking to the child
node with the following code will bring us to the \textit{Name} portion of the SEQUENCE:
\begin{small}
\begin{verbatim}
list = list->child;
\end{verbatim}
\end{small}
Now \textit{list} points to the \textit{Name} member (with the tag IA5 STRING).  The \textit{data}, \textit{size}, and \textit{type} members of \textit{list} should reflect
that of an IA5 STRING.  The sibbling will now be the \textit{LoginToken} SEQUENCE.  The sibbling has a child node which points to the \textit{passwdHash} OCTET STRING.
We can walk to this node with the following code:
\begin{small}
\begin{verbatim}
/* list already pointing to 'Name' */
list = list->next->child;
\end{verbatim}
\end{small}
At this point, \textit{list} will point to the \textit{passwdHash} member of the innermost SEQUENCE.  This node has a sibbling, the \textit{pubkey} member of the SEQUENCE.
The \textit{LastOn} member of the SEQUENCE is a sibbling of the LoginToken node, if we wanted to walk there we would have to go up and over via:
\begin{small}
\begin{verbatim}
list = list->parent->next;
\end{verbatim}
\end{small}
At this point, we are pointing to the last node of the list.  Lists are terminated in all directions by a \textbf{NULL} pointer.  All nodes are doubly linked so that you
can walk up and down the nodes without keeping pointers lying around.


\subsubsection{Shrink'ing a Flexi List}
While decoding the flexi decoder will recursively decode an ASN.1 \textit{constructed} type it will store the decoded list
as well as the plain data that was decoded.
To free up this additional data a shrink function is provided.

\index{der\_sequence\_shrink()}
\begin{verbatim}
void der_sequence_shrink(ltc_asn1_list *in);
\end{verbatim}

This will free all the plain constructed data, but keep the decoded list intact.

\subsubsection{Free'ing a Flexi List}
To free the list use the following function.

\index{der\_sequence\_free()}
\begin{verbatim}
void der_sequence_free(ltc_asn1_list *in);
\end{verbatim}

This will free all of the memory allocated by der\_decode\_sequence\_flexi().

\mysection{Password Based Cryptography}
\subsection{PKCS \#5}
\index{PKCS \#5}
In order to securely handle user passwords for the purposes of creating session keys and chaining IVs the PKCS \#5 was drafted.   PKCS \#5
is made up of two algorithms, Algorithm One and Algorithm Two.  Algorithm One is the older fairly limited algorithm which has been implemented
for completeness.  Algorithm Two is a bit more modern and more flexible to work with.

The OpenSSL project implemented an extension to Algorithm One that allows for arbitrary keylengths; we have a compatible implementation described below.

\subsubsection{Algorithm One}
Algorithm One accepts as input a password, an 8--byte salt, and an iteration counter.  The iteration counter is meant to act as delay for
people trying to brute force guess the password.  The higher the iteration counter the longer the delay.  This algorithm also requires a hash
algorithm and produces an output no longer than the output of the hash.

\index{pkcs\_5\_alg1()}
\begin{alltt}
int pkcs_5_alg1(const unsigned char *password,
                      unsigned long  password_len,
                const unsigned char *salt,
                                int  iteration_count,
                                int  hash_idx,
                      unsigned char *out,
                      unsigned long *outlen)
\end{alltt}
Where \textit{password} is the user's password.  Since the algorithm allows binary passwords you must also specify the length in \textit{password\_len}.
The \textit{salt} is a fixed size 8--byte array which should be random for each user and session.  The \textit{iteration\_count} is the delay desired
on the password.  The \textit{hash\_idx} is the index of the hash you wish to use in the descriptor table.

The output of length up to \textit{outlen} is stored in \textit{out}.  If \textit{outlen} is initially larger than the size of the hash functions output
it is set to the number of bytes stored.  If it is smaller than not all of the hash output is stored in \textit{out}.

\index{pkcs\_5\_alg1\_openssl()}
\begin{alltt}
int pkcs_5_alg1_openssl(const unsigned char *password,
                      unsigned long  password_len,
                const unsigned char *salt,
                                int  iteration_count,
                                int  hash_idx,
                      unsigned char *out,
                      unsigned long *outlen)
\end{alltt}
As above, but we generate as many bytes as requested in outlen per the OpenSSL extension to Algorithm One.  If you are trying to be compatible with OpenSSL's EVP\_BytesToKey() or the "openssl enc" command line (or variants such as perl's Crypt::CBC), then use this function with MD5 as your hash (ick!) and iteration\_count=1 (double-ick!!).
\subsubsection{Algorithm Two}

Algorithm Two is the recommended algorithm for this task.  It allows variable length salts, and can produce outputs larger than the
hash functions output.  As such, it can easily be used to derive session keys for ciphers and MACs as well initialization vectors as required
from a single password and invocation of this algorithm.

\index{pkcs\_5\_alg2()}
\begin{alltt}
int pkcs_5_alg2(const unsigned char *password,
                      unsigned long  password_len,
                const unsigned char *salt,
                      unsigned long  salt_len,
                                int  iteration_count,
                                int  hash_idx,
                      unsigned char *out,
                      unsigned long *outlen)
\end{alltt}
Where \textit{password} is the users password.  Since the algorithm allows binary passwords you must also specify the length in \textit{password\_len}.
The \textit{salt} is an array of size \textit{salt\_len}.  It should be random for each user and session.  The \textit{iteration\_count} is the delay desired
on the password.  The \textit{hash\_idx} is the index of the hash you wish to use in the descriptor table.   The output of length up to
\textit{outlen} is stored in \textit{out}.

\begin{verbatim}
/* demo to show how to make session state material
 * from a password */
#include <tomcrypt.h>
int main(void)
{
    unsigned char password[100], salt[100],
                  cipher_key[16], cipher_iv[16],
                  mac_key[16], outbuf[48];
    int           err, hash_idx;
    unsigned long outlen, password_len, salt_len;

    /* register hash and get it's idx .... */

    /* get users password and make up a salt ... */

    /* create the material (100 iterations in algorithm) */
    outlen = sizeof(outbuf);
    if ((err = pkcs_5_alg2(password, password_len, salt,
                           salt_len, 100, hash_idx, outbuf,
                           &outlen))
       != CRYPT_OK) {
       /* error handle */
    }

    /* now extract it */
    memcpy(cipher_key, outbuf, 16);
    memcpy(cipher_iv,  outbuf+16, 16);
    memcpy(mac_key,    outbuf+32, 16);

    /* use material (recall to store the salt in the output) */
}
\end{verbatim}


\subsection{bcrypt}
\index{bcrypt}

bcrypt is a password hashing function, similar to PKCS \#5, but it is based on the blowfish symmetric cipher.
It is widely used in e.g. OpenBSD as default password hash algorithm, or in encrypted OpenSSH key files.

This implementation provides the PBKDF version as used in OpenSSH key files.

The OpenBSD implementation is fixed to SHA512 as hashing algorithm, but this generalized implementation works with any hashing algorithm.

To hash a password with the bcrypt PBKDF algorithm, the following API function is provided.

\index{bcrypt()}
\begin{alltt}
int bcrypt_pbkdf_openbsd(const          void *secret, unsigned long secret_len,
                         const unsigned char *salt,   unsigned long salt_len,
                               unsigned int  rounds,            int hash_idx,
                               unsigned char *out,    unsigned long *outlen);
\end{alltt}

The \textit{secret} parameter is the secret of length \textit{secret\_len} (most of the time a utf-8 encoded user password).
The \textit{salt} parameter is a pointer to the array of octets of length \textit{salt\_len} containing the salt.
The \textit{rounds} parameter defines the number of iterations of the expensive key setup that shall be executed.
The \textit{hash\_idx} parameter defines the hash algorithm that shall be used. 
The \textit{out} parameter shall be a pointer to a buffer of at least 32 octets,
where \textit{outlen} contains the available buffer size on input and the written size after the invocation.


\mysection{PKCS \#8}
\index{PKCS \#8}

The library has built-in support for PKCS \#8 decoding as specified in RFC 5208.

Encoding of private keys into PKCS \#8 is not supported.

The library supports the following encryption algorithms:

\begin{table}[H]
\begin{center}
\begin{tabular}{|l|l|}
      \hline \textbf{Scheme} & \textbf{Algorithm}              \\
      \hline PBES1           & pbeWithMD2AndDES-CBC            \\
      \hline PBES1           & pbeWithMD2AndRC2-CBC            \\
      \hline PBES1           & pbeWithMD5AndDES-CBC            \\
      \hline PBES1           & pbeWithMD5AndRC2-CBC            \\
      \hline PBES1           & pbeWithSHA1AndDES-CBC           \\
      \hline PBES1           & pbeWithSHA1AndRC2-CBC           \\
      \hline PBES1           & pbeWithSHAAnd3-KeyTripleDES-CBC \\
      \hline PBES2 + PBKDF2  & desCBC                          \\
      \hline PBES2 + PBKDF2  & rc2CBC                          \\
      \hline PBES2 + PBKDF2  & des-EDE3-CBC                    \\
      \hline PBES2 + PBKDF2  & aes128-CBC                      \\
      \hline PBES2 + PBKDF2  & aes192-CBC                      \\
      \hline PBES2 + PBKDF2  & aes256-CBC                      \\
      \hline
\end{tabular}
\caption{Supported PKCS\#8 encryption algorithms}
\end{center}
\label{fig:pkcs8}
\end{table}

The PKCS \#8 import has no direct API endpoints, but it is available through Public Key Algorithm-specific
\textit{pkaX\_import\_pkcs8()} functions.


\mysection{Key Derviation Functions}
\subsection{HKDF}
\index{HKDF}
A key derivation function (KDF) is a basic and essential component of cryptographic systems.  Its goal is to take some source of initial
keying material and derive from it one or more cryptographically strong secret keys.

HKDF follows the "extract-then-expand" paradigm, where the KDF logically consists of two modules.  The first stage takes the input
keying material and "extracts" from it a fixed-length pseudorandom key K.  The second stage "expands" the key K into several additional
pseudorandom keys (the output of the KDF).

In many applications, the input keying material is not necessarily distributed uniformly, and the attacker may have some partial
knowledge about it (for example, a Diffie-Hellman value computed by a key exchange protocol) or even partial control of it (as in some
entropy-gathering applications).  Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input
keying material into a short, but cryptographically strong, pseudorandom key.  In some applications, the input may already be a
good pseudorandom key; in these cases, the "extract" stage is not necessary, and the "expand" part can be used alone.

The second stage "expands" the pseudorandom key to the desired length; the number and lengths of the output keys depend on the
specific cryptographic algorithms for which the keys are needed.

\subsection{HKDF Extract}
To perform the extraction phase, use the following function:

\index{hkdf\_extract()}
\begin{alltt}
int hkdf_extract(   int  hash_idx,
    const unsigned char *salt,
          unsigned long  saltlen,
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long *outlen);
\end{alltt}
The \textit{hash\_idx} parameter is the index into the descriptor table of the hash you want to use.
The \textit{salt} parameter is a pointer to the array of octets of length \textit{saltlen} containing the salt or a NULL pointer if a salt is not being used (in that case set saltlen to 0).
\textit{in} is a pointer to an array of octets of length \textit{inlen} containing the source entropy.  The extracted output is stored in the location pointed to by \textit{out}.
You must set \textit{outlen} to the size of the destination buffer before calling this function. It is updated to the length of the extracted output. If \textit{outlen} is too small the extracted output will be truncated.

While the salt is optional, using one improves HKDF's security. If used, the salt should be randomly chosen, but does not need to be secret and may be re-used. Please see RFC5869 section 3.1 for more details.

\subsection{HKDF Expand}
To perform the expansion phase, use the following function:

\index{hkdf\_expand()}
\begin{alltt}
int hkdf_expand(    int  hash_idx,
    const unsigned char *info,
          unsigned long  infolen,
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long  outlen);
\end{alltt}

The \textit{hash\_idx} parameter is the index into the descriptor table of the hash you want to use.
The \textit{info} parameter, an array of octets of length \textit{infolen}, is an optional parameter (set \textit{info} to NULL and \textit{infolen} to 0 if not using it) which
may be used to bind the derived keys to some application and context specific information. This prevents the same keying material from being generated in different contexts. Please see RFC5869 section 3.2 for more information.
The extracted keying material is passed as octet array \textit{in} of length \textit{inlen}.  Expanded output of length \textit{outlen} is generated and stored in octet arrat \textit{out}.

\subsection{HKDF Extract-and-Expand}
To perform both phases together, use the following function:

\index{hkdf()}
\begin{alltt}
int hkdf(           int  hash_idx,
    const unsigned char *salt,
          unsigned long  saltlen,
    const unsigned char *info,
          unsigned long  infolen,
    const unsigned char *in,
          unsigned long  inlen,
          unsigned char *out,
          unsigned long  outlen);
\end{alltt}

Parameters are as in \textit{hkdf\_extract()} and \textit{hkdf\_expand()}.


\mysection{SSH}

The library provides functions to encode and decode SSH data as specified in RFC4251 Ch. 5.

\subsection{Data types}

The following enum is used to indicate a specific SSH data type
(besides EOL which is an internal one that indicates the end of a sequence).

\begin{figure}[h]
\begin{center}
\begin{small}
\begin{tabular}{|l|l|l|}
\hline \textbf{Definition}    & \textbf{arg data Type} & \textbf{SSH Type} \\
\hline LTC\_SSHDATA\_EOL      & -                      & End of SSH data sequence. \\
\hline LTC\_SSHDATA\_BYTE     & \texttt{unsigned char} & \texttt{byte} type \\
\hline LTC\_SSHDATA\_BOOLEAN  & \texttt{unsigned char} & \texttt{boolean} type \\
\hline LTC\_SSHDATA\_UINT32   & \texttt{ulong32}       & \texttt{uint32} \\
\hline LTC\_SSHDATA\_UINT64   & \texttt{ulong64}       & \texttt{uint64} \\
\hline LTC\_SSHDATA\_STRING   & \texttt{char*}         & \texttt{string} (one octet per char) \\
\hline LTC\_SSHDATA\_MPINT    & \texttt{mp\_int}       & \texttt{mpint} \\
\hline LTC\_SSHDATA\_NAMELIST & \texttt{char*}         & \texttt{name-list} (which works exactly like a \texttt{string}) \\
\hline
\end{tabular}
\caption{List of SSH Supported Types}
\index{ssh\_data\_type}
\end{small}
\end{center}
\end{figure}

\subsection{De- and Encoding with Multiple Argument Lists}

\index{ssh\_encode\_sequence\_multi()}
\index{ssh\_decode\_sequence\_multi()}


The API works similar to the ASN.1 SEQUENCE multi en- and decoders.

They either encode or decode a sequence of the supported SSH types where the items are specified after the length parameter.


\begin{verbatim}
int ssh_encode_sequence_multi(unsigned char *out, unsigned long *outlen, ...);
\end{verbatim}

Where \texttt{out} points to the destination buffer and  \texttt{outlen} points 
on function invocation to the length of the destination buffer 
and after returning it will be filled with the number of octets written to the buffer.

The encoding function \texttt{ssh\_encode\_sequence\_multi()} expects its items to be a pair of \texttt{(type, data)},
except for the \texttt{string} resp. \texttt{name-list} type, which expects the triple \texttt{(type, data, size)}
with \texttt{size} being of type \texttt{unsigned long}.


\begin{verbatim}
int ssh_decode_sequence_multi(const unsigned char *in, unsigned long *inlen, ...);
\end{verbatim}

Where \texttt{in} points to the buffer with the sequence to decode and \texttt{inlen} points 
on function invocation to the length of the sequence
and after returning it will be filled with the decoded number of octets.

The decoding function \texttt{ssh\_decode\_sequence\_multi()} expects its items to be a pair of \texttt{(type, data*)},
except for the \texttt{string} resp. \texttt{name-list} type, which expects the triple \texttt{(type, data, size*)}
with \texttt{size*} being of type \texttt{unsigned long*}.

\chapter{Miscellaneous}
\mysection{Base64 Encoding and Decoding}
The library provides functions to encode and decode a RFC 4648 Base64 coding scheme.

\subsection{Standard 'base64' encoding}
The characters used in the mappings are:
\begin{verbatim}
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
\end{verbatim}
Those characters are supported in the 7-bit ASCII map, which means they can be used for transport over
common e-mail, usenet and HTTP mediums.  The format of an encoded stream is just a literal sequence of ASCII characters
where a group of four represent 24-bits of input.  The first four chars of the encoders output is the length of the
original input.  After the first four characters is the rest of the message.

Often, it is desirable to line wrap the output to fit nicely in an e-mail or usenet posting.  The decoder allows you to
put any character (that is not in the above sequence) in between any character of the encoders output.  You may not however,
break up the first four characters.

To encode a binary string in base64 call:
\index{base64\_encode()}
\begin{verbatim}
int base64_encode(const unsigned char *in,
                        unsigned long  len,
                                 char *out,
                        unsigned long *outlen);
\end{verbatim}
Where \textit{in} is the binary string and \textit{out} is where the ASCII output is placed.  You must set the value of \textit{outlen} prior
to calling this function and it sets the length of the base64 output in \textit{outlen} when it is done.  To decode a base64
string call:
\index{base64\_decode()}
\begin{verbatim}
int base64_decode(   const char *in,
                  unsigned long  len,
                  unsigned char *out,
                  unsigned long *outlen);
\end{verbatim}

The function \textit{base64\_decode} works in a dangerously relaxed way which allows decoding some inputs that do not strictly follow the standard.

If you want to be strict during decoding you can use:
\index{base64\_strict\_decode()}
\begin{verbatim}
int base64_strict_decode(   const char *in,
                         unsigned long  len,
                         unsigned char *out,
                         unsigned long *outlen);
\end{verbatim}

There is also so called sane mode that ignores white-spaces (\textit{CR}, \textit{LF}, \textit{TAB}, \textit{space}),
does not care about trailing \textit{=} and also ignores the last input byte in case it is \textit{NUL}.
\index{base64\_sane\_decode()}
\begin{verbatim}
int base64_sane_decode(   const char *in,
                       unsigned long  len,
                       unsigned char *out,
                       unsigned long *outlen);
\end{verbatim}

\subsection{URL--safe 'base64url' encoding}
The characters used in the mappings are:
\begin{verbatim}
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_
\end{verbatim}
Those characters are sometimes also called URL and filename safe alphabet.
The interface is analogous to \textit{base64\_xxxx} functions in previous chapter.

\index{base64url\_encode()}
\index{base64url\_strict\_encode()}
\index{base64url\_decode()}
\index{base64url\_strict\_decode()}
\index{base64url\_sane\_decode()}
\begin{verbatim}
int base64url_encode(const unsigned char *in,  unsigned long len,
                                    char *out, unsigned long *outlen);

int base64url_strict_encode(const unsigned char *in,  unsigned long inlen,
                                           char *out, unsigned long *outlen);

int base64url_decode(   const char *in,  unsigned long len,
                     unsigned char *out, unsigned long *outlen);

int base64url_strict_decode(   const char *in,  unsigned long len,
                            unsigned char *out, unsigned long *outlen);

int base64url_sane_decode(   const char *in,  unsigned long len,
                          unsigned char *out, unsigned long *outlen);
\end{verbatim}

\mysection{Base32 Encoding and Decoding}

The library provides functions to encode and decode a Base32 coding scheme. The supported mappings are:

\begin{figure}[H]
\begin{center}
\begin{tabular}{|l|l|l|}
     \hline \textbf{id} & \textbf{Mapping} & \textbf{Name} \\
     \hline BASE32\_RFC4648 & ABCDEFGHIJKLMNOPQRSTUVWXYZ234567 & RFC-4648 \\
     \hline BASE32\_BASE32HEX & 0123456789ABCDEFGHIJKLMNOPQRSTUV & Base32hex \\
     \hline BASE32\_ZBASE32 & YBNDRFG8EJKMCPQXOT1UWISZA345H769 & ZBase32 \\
     \hline BASE32\_CROCKFORD & 0123456789ABCDEFGHJKMNPQRSTVWXYZ & Crockford \\
     \hline
\end{tabular}
\end{center}
\caption{Base32 coding schemes}
\end{figure}

To encode a binary string in base32 call:

\index{base32\_encode()}
\begin{verbatim}
int base32_encode(const unsigned char *in,
                        unsigned long  len,
                                 char *out,
                        unsigned long *outlen,
                        base32_alphabet id);
\end{verbatim}

Where \textit{in} is the binary string, \textit{out} is where the ASCII output is placed and \textit{id} is
\textit{BASE32\_RFC4648}, \textit{BASE32\_BASE32HEX}, \textit{BASE32\_ZBASE32} or \textit{BASE32\_CROCKFORD} according the table above.

To decode a base32 string call:

\index{base32\_decode()}
\begin{verbatim}
int base32_decode(const          char *in,
                        unsigned long  len,
                        unsigned char *out,
                        unsigned long *outlen,
                        base32_alphabet id);
\end{verbatim}


\mysection{Base16 Encoding and Decoding}

The library provides functions to encode and decode a Base16 a.k.a Hex string.

To encode a binary string in base16 call:

\index{base16\_encode()}
\begin{verbatim}
int base16_encode(const unsigned char *in,  unsigned long  inlen,
                                 char *out, unsigned long *outlen,
                        unsigned int   options);
\end{verbatim}

Where \textit{in} is the binary string,
\textit{out} is where the ASCII output is placed
and \textit{options} is either $0$ to use lower-letter \textit{a..f} or else to use caps \textit{A..F}.

To decode a base16 string call:

\index{base16\_decode()}
\begin{verbatim}
int base16_decode(const          char *in,  unsigned long  inlen,
                        unsigned char *out, unsigned long *outlen);
\end{verbatim}

\mysection{Padding data}

The library provides functions to pad and depad according to several standards, please refer to Figure \ref{fig:paddingmodes} for details about the supported standards.


\subsection{Padding mode argument}

All functions have a \textit{mode} argument which must be set to the bit-wise OR of the desired blocksize and one of the modes as shown in the following table:

\begin{figure}[H]
\begin{minipage}{\textwidth}
\begin{center}
\begin{tabular}{|l|l|}
     \hline \textbf{mode} & \textbf{Standard} \\
     \hline LTC\_PAD\_PKCS7  & RFC-5652 / PKCS \#7 \\
     \hline LTC\_PAD\_ISO\_10126 & ISO/IEC 10126 \footnote{\textit{ISO/IEC 10126} support is only available when the library is built with \textit{rng\_get\_bytes()} support} \\
     \hline LTC\_PAD\_ANSI\_X923 & ANSI X.923 \\
     \hline LTC\_PAD\_ONE\_AND\_ZERO & ISO/IEC 7816-4 \\
     \hline LTC\_PAD\_ZERO & ISO/IEC 10118-1 \\
     \hline LTC\_PAD\_ZERO\_ALWAYS & ISO/IEC 10118-1 \footnote{\textit{LTC\_PAD\_ZERO\_ALWAYS} adds an entire block of padding if the plaintext length is divisible by the blocksize} \\
     \hline
\end{tabular}
\end{center}
\end{minipage}
\caption{Padding modes}
\label{fig:paddingmodes}
\end{figure}

\textit{ISO/IEC 10126} has been withdrawn as an ISO/IEC standard in 2007 and is only provided for historical reasons (it was used e.g. in early versions of TLS/SSL).
Therefore it should not be used for new designs.


\subsection{Padding}

To pad data call:

\index{padding\_pad()}
\begin{verbatim}
int padding_pad(unsigned char *data,
                unsigned long  length,
                unsigned long *padded_length,
                unsigned long  mode);
\end{verbatim}

Where \textit{data} is a pointer to a buffer containing the data to pad,
\textit{length} is the original length of the data to pad and
\textit{padded\_length} is a pointer that should contain the length of buffer available and will contain the padded data-length.
It is possible to call this function with \textit{padded\_length} set to $0$ which will then return with the error-code \textit{CRYPT\_BUFFER\_OVERFLOW}
and \textit{padded\_length} set to the required size of the buffer.


\subsection{Depadding}

To depad data call:

\index{padding\_depad()}
\begin{verbatim}
int padding_depad(unsigned char *data,
                  unsigned long *length,
                  unsigned long  mode);
\end{verbatim}

Where \textit{data} is a pointer to the data to depad,
\textit{length} is a pointer that should contain the length of the padded data and will be updated to contain the length of the data after depadding.


\mysection{Primality Testing}
\index{Primality Testing}
The library includes primality testing and random prime functions as well.  The primality tester will perform the test in
two phases.  First it will perform trial division by the first few primes.  Second it will perform \textit{LTC\_MILLER\_RABIN\_REPS} (pre-defined to $35$) rounds of the
Rabin-Miller primality testing algorithm.  If the candidate passes both phases it is declared prime otherwise it is declared
composite.  No prime number will fail the two phases but composites can.  Each round of the Rabin-Miller algorithm reduces
the probability of a pseudo-prime by $1 \over 4$ therefore after sixteen rounds the probability is no more than
$\left ( { 1 \over 4 } \right )^{8} = 2^{-16}$.  In practice the probability of error is in fact much lower than that.

When making random primes the trial division step is in fact an optimized implementation of \textit{Implementation of Fast RSA Key Generation on Smart Cards}\footnote{Chenghuai Lu, Andre L. M. dos Santos and Francisco R. Pimentel}.
In essence a table of machine-word sized residues are kept of a candidate modulo a set of primes.  When the candidate
is rejected and ultimately incremented to test the next number the residues are updated without using multi-word precision
math operations.  As a result the routine can scan ahead to the next number required for testing with very little work
involved.

In the event that a composite did make it through it would most likely cause the the algorithm trying to use it to fail.  For
instance, in RSA two primes $p$ and $q$ are required.  The order of the multiplicative sub-group (modulo $pq$) is given
as $\phi(pq)$ or $(p - 1)(q - 1)$.  The decryption exponent $d$ is found as $de \equiv 1\mbox{ }(\mbox{mod } \phi(pq))$.  If either $p$ or $q$ is composite the value of $d$ will be incorrect and the user
will not be able to sign or decrypt messages at all.  Suppose $p$ was prime and $q$ was composite this is just a variation of
the multi-prime RSA.  Suppose $q = rs$ for two primes $r$ and $s$ then $\phi(pq) = (p - 1)(r - 1)(s - 1)$ which clearly is
not equal to $(p - 1)(rs - 1)$.

These are not technically part of the LibTomMath library but this is the best place to document them.
To test if a \textit{mp\_int} is prime call:
\begin{verbatim}
int is_prime(mp_int *N, int *result);
\end{verbatim}
This puts a one in \textit{result} if the number is probably prime, otherwise it places a zero in it.  It is assumed that if
it returns an error that the value in \textit{result} is undefined.  To make
a random prime call:
\begin{verbatim}
int rand_prime(       mp_int *N,
               unsigned long len,
                  prng_state *prng,
                         int  wprng);
\end{verbatim}
Where \textit{len} is the size of the prime in bytes ($2 \le len \le 256$).  You can set \textit{len} to the negative size you want
to get a prime of the form $p \equiv 3\mbox{ }(\mbox{mod } 4)$.  So if you want a 1024-bit prime of this sort pass
\textit{len = -128} to the function.  Upon success it will return {\bf CRYPT\_OK} and \textit{N} will contain an integer which
is very likely prime.

\mysection{Random MPI Generation}
\index{Random MPI Generation}

Several Public Key Cryptography algorithms require random MPI's for operations like signature generation.
The library provides two API functions to generate random MPI's which allow the utilisation of a user-defined PRNG to aquire the random data.

\index{rand\_bn\_bits()}
\begin{verbatim}
int rand_bn_bits(       void *N,
                         int bits,
                  prng_state *prng,
                         int wprng);
\end{verbatim}

This sets \textit{N} to a \textit{bits}-long random MPI.

\index{rand\_bn\_upto()}
\begin{verbatim}
int rand_bn_upto(       void *N,
                        void *limit,
                  prng_state *prng,
                         int wprng);
\end{verbatim}

This ensures that \textit{N} is set to a random MPI in the range $1 \le N < limit$.


\mysection{Helper functions}

\subsection{Zero'ing data}

Optimizing compilers are sometimes allowed to remove an invocation of \textit{memset(out, 0, outlen)},
which could result in sensitive data not being zero'ed out. LibTomCrypt, therefore, implements a variant
of this routine, \textit{zeromem(out, outlen)}, which won't be optimized away.

\index{zeromem()}
\begin{verbatim}
void zeromem(volatile void *out, size_t outlen);
\end{verbatim}

This zero's the buffer \textit{out} of size \textit{outlen}.

\subsection{Constant-time memory compare}

Some symmetric-key cryptographic operation-modes are vulnerable to timing attacks in case non-contant-time memory comparison functions
are used to compare results. Therefore LibTomCrypt implements a constant-time memory compare function.

\index{mem\_neq()}
\begin{verbatim}
int mem_neq(const void *a, const void *b, size_t len);
\end{verbatim}

This will compare the buffer \textit{a} against the buffer \textit{b} for \textit{len} bytes.
The return value is either \textit{0} when the content of \textit{a} and \textit{b} is equal or \textit{1} when it differs.

\subsection{Radix to binary conversion}

All public-key cryptographic algorithms provide a way to import and/or export their key parameters in binary format.
In order to be able to import keys stored in different formats, e.g. hexadecimal strings, the \textit{radix\_to\_bin()} function is provided.

\index{radix\_to\_bin()}
\begin{verbatim}
int radix_to_bin(const void *in, int radix, void *out, unsigned long *len);
\end{verbatim}

This will convert the MPI \textit{in} of radix \textit{radix} to the buffer pointed to by \textit{out}.
The field \textit{len} is a pointer to the length of the buffer on input and the length stored on output.

In case you don't know the length of the buffer you can use \textit{radix\_to\_bin()} to determine the length for you.

\begin{verbatim}
#include <tomcrypt.h>

int main(void)
{
   const char *mpi = "AABBCCDD";
   unsigned long l = 0;
   void* buf;
   int ret;
   ltc_mp = ltm_desc;

   if (radix_to_bin(mpi, 16, NULL, &l) != CRYPT_BUFFER_OVERFLOW)
      return EXIT_FAILURE;
   buf = malloc(l);

   ret = EXIT_SUCCESS;
   if (radix_to_bin(mpi, 16, buf, &l) != CRYPT_OK)
      ret = EXIT_FAILURE;

   free(buf);
   return ret;
}
\end{verbatim}


\mysection{Dynamic Language Support}
\index{Dynamic Language Support}
Various LibTomCrypt functions require that their callers define a struct
(or a union) and provide a pointer to it, or allocate sufficient memory and
provide its pointer.  Programs written in C or C++ can obtain the necessary
information by simply including the appropriate header files, but dynamic
languages like Python don't understand C header files, and without assistance,
have no way to know how much memory to allocate.  A similar story can be told
for certain LTC constant values.

LTC's Dynamic Language Support provides functions that return the size of
a named struct or union, the value of a named constant, a list of all sizes
supported, and a list of all named constants supported.  Two additional
functions can initialize LTM and TFM.

To get the size of a named struct or union:
\begin{verbatim}
int crypt_get_size(  const char *namein,
                   unsigned int *sizeout);
\end{verbatim}
$namein$ is spelled exactly as found in the C header files.  This function will
return -1 if $namein$ is not found.

To get the value of a named constant:
\begin{verbatim}
int crypt_get_constant(const char *namein,
                              int *valueout);
\end{verbatim}
$namein$ is spelled exactly as found in the C header files.  Again, -1 is
returned if $namein$ is not found.

To get the names of all the supported structs, unions and constants:
\begin{verbatim}
int crypt_list_all_sizes(        char *names_list,
                         unsigned int *names_list_size);

int crypt_list_all_constants(        char *names_list,
                             unsigned int *names_list_size);
\end{verbatim}
You may want to call these functions twice, first to get the amount
of memory to be allocated for the $names\_list$, and a final time to
actually populate $names\_list$.  If $names\_list$ is NULL,
$names\_list\_size$ will be the minimum size needed to receive the
complete $names\_list$.  If $names\_list$ is NOT NULL, $names\_list$ must
be a pointer to sufficient memory into which the $names\_list$ will be
written.  Also, the value in $names\_list\_size$ sets the upper bound of
the number of characters to be written.  A -1 return value signifies
insufficient space.

The format of the $names\_list$ string is a series of $name,value$ pairs
where each name and value is separated by a comma, the pairs are separated
by newlines, and the list is null terminated.

\index{crypt\_mp\_init()}
\begin{verbatim}
int crypt_mp_init(const char* mpi);
\end{verbatim}

To ease the setup of a specific math descriptor, in cases where the library was compiled with support for multiple MPI libraries,
the function \textit{crypt\_mp\_init()} is provided.
It takes a string to the desired MPI library to use as an argument.
The three default MPI libraries are identified as follows, \textit{LibTomMath} as \texttt{"ltm"}, \textit{TomsFastmath} as \texttt{"tfm"}
and the \textit{GNU Multi Precision Arithmetic Library} as \texttt{"gmp"}.
The identification happens case-insensitive and only on the first character.

Here is a Python program demonstrating how to call various LTC dynamic
language support functions.

A more detailed example is given in the library source in \texttt{demos/demo\_dynamic.py}.

\begin{verbatim}
from ctypes import *

# load the OSX shared/dynamic library
LIB = CDLL('libtomcrypt.dylib')

# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# print info about this library

little = c_int()        # assume False is big
word32 = c_int()        # assume False is 64-bit

LIB.crypt_get_constant('ENDIAN_LITTLE', byref(little))
LIB.crypt_get_constant('ENDIAN_32BITWORD', byref(word32))

print('this lib was compiled for a %s endian %d-bit processor'
      % ('little' if little else 'big', 32 if word32 else 64))

# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# print the size of the struct named "sha256_state"

struct_size = c_int()

# don't forget to add the '_struct' or '_union' suffix
LIB.crypt_get_size('sha256_state_struct', byref(struct_size))

print('allocate %d bytes for sha256_state' % struct_size.value)

# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# print a list of all supported named constants

list_size = c_int()

# call with NULL to calc the min size needed for the list
LIB.crypt_list_all_constants(None, byref(list_size))

# allocate required space
names_list = c_buffer(list_size.value)

# call again providing a pointer to where to write the list
LIB.crypt_list_all_constants(names_list, byref(list_size))

print(names_list.value)

# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# print a list of all supported named structs and unions

list_size = c_int()

# call with NULL to calc the min size needed for the list
LIB.crypt_list_all_sizes(None, byref(list_size))

# allocate required space
names_list = c_buffer(list_size.value)

# call again providing a pointer to where to write the list
LIB.crypt_list_all_sizes(names_list, byref(list_size))

print(names_list.value)
\end{verbatim}


\chapter{Programming Guidelines}

\mysection{Secure Pseudo Random Number Generators}
Probably the single most vulnerable point of any cryptosystem is the PRNG.  Without one, generating and protecting secrets
would be impossible.  The requirement that one be setup correctly is vitally important, and to address this point the library
does provide two RNG sources that will address the largest amount of end users as possible.  The \textit{sprng} PRNG provides an easy to
access source of entropy for any application on a UNIX (and the like) or Windows computer.

However, when the end user is not on one of these platforms, the application developer must address the issue of finding
entropy.  This manual is not designed to be a text on cryptography.  I would just like to highlight that when you design
a cryptosystem make sure the first problem you solve is getting a fresh source of entropy.

\mysection{Preventing Trivial Errors}
Two simple ways to prevent trivial errors is to prevent overflows, and to check the return values.  All of the functions
which output variable length strings will require you to pass the length of the destination.  If the size of your output
buffer is smaller than the output it will report an error.  Therefore, make sure the size you pass is correct!

Also, virtually all of the functions return an error code or {\bf CRYPT\_OK}.  You should detect all errors, as simple
typos can cause algorithms to fail to work as desired.

\mysection{Registering Your Algorithms}
To avoid linking and other run--time errors it is important to register the ciphers, hashes and PRNGs you intend to use
before you try to use them.  This includes any function which would use an algorithm indirectly through a descriptor table.

A neat bonus to the registry system is that you can add external algorithms that are not part of the library without
having to hack the library.  For example, suppose you have a hardware specific PRNG on your system.  You could easily
write the few functions required plus a descriptor.  After registering your PRNG, all of the library functions that
need a PRNG can instantly take advantage of it.  The same applies for ciphers, hashes, and bignum math routines.

\mysection{Key Sizes}

\subsection{Symmetric Ciphers}
For symmetric ciphers, use as large as of a key as possible.  For the most part \textit{bits are cheap} so using a 256--bit key
is not a hard thing to do.  As a good rule of thumb do not use a key smaller than 128 bits.

\subsection{Asymmetric Ciphers}
The following chart gives the work factor for solving a DH/RSA public key using the NFS.  The work factor for a key of order
$n$ is estimated to be
\begin{equation}
e^{1.923 \cdot ln(n)^{1 \over 3} \cdot ln(ln(n))^{2 \over 3}}
\end{equation}

Note that $n$ is not the bit-length but the magnitude.  For example, for a 1024-bit key $n = 2^{1024}$.  The work required
is:
\begin{figure}[H]
\begin{center}
\begin{tabular}{|c|c|}
    \hline RSA/DH Key Size (bits) & Work Factor ($log_2$) \\
    \hline 512 & 63.92 \\
    \hline 768 & 76.50 \\
    \hline 1024 & 86.76 \\
    \hline 1536 & 103.37 \\
    \hline 2048 & 116.88 \\
    \hline 2560 & 128.47 \\
    \hline 3072 & 138.73 \\
    \hline 4096 & 156.49 \\
    \hline
\end{tabular}
\end{center}
\caption{RSA/DH Key Strength}
\end{figure}

The work factor for ECC keys is much higher since the best attack is still fully exponential.  Given a key of magnitude
$n$ it requires $\sqrt n$ work.  The following table summarizes the work required:
\begin{figure}[H]
\begin{center}
\begin{tabular}{|c|c|}
    \hline ECC Key Size (bits) & Work Factor ($log_2$) \\
    \hline 112 & 56 \\
    \hline 128 & 64 \\
    \hline 160 & 80 \\
    \hline 192 & 96  \\
    \hline 224 & 112 \\
    \hline 256 & 128 \\
    \hline 384 & 192 \\
    \hline 521 & 260.5 \\
    \hline
\end{tabular}
\end{center}
\caption{ECC Key Strength}
\end{figure}

Using the above tables the following suggestions for key sizes seems appropriate:
\begin{center}
\begin{tabular}{|c|c|c|}
    \hline Security Goal & RSA/DH Key Size (bits) & ECC Key Size (bits) \\
    \hline Near term   & 1024 & 160 \\
    \hline Short term  & 1536 & 192 \\
    \hline Long Term   & 2560 & 384 \\
    \hline
\end{tabular}
\end{center}

\mysection{Thread Safety}
The library is not fully thread safe but several simple precautions can be taken to avoid any problems.  The registry functions
such as register\_cipher() are not thread safe no matter what you do.  It is best to call them from your programs initialization
code before threads are initiated.

The rest of the code uses state variables you must pass it such as hash\_state, hmac\_state, etc.  This means that if each
thread has its own state variables then they will not affect each other, and are fully thread safe.  This is fairly simple with symmetric ciphers
and hashes.

\index{LTC\_PTHREAD}
The only sticky issue is a shared PRNG which can be alleviated with the careful use of mutex devices.  Defining LTC\_PTHREAD for instance, enables
pthreads based mutex locking in various routines such as the Yarrow and Fortuna PRNGs, the fixed point ECC multiplier, and other routines.

\chapter{Configuring and Building the Library}
\mysection{Introduction}
The library is fairly flexible about how it can be built, used, and generally distributed.  Additions are being made with
each new release that will make the library even more flexible.  Each of the classes of functions can be disabled during
the build process to make a smaller library.  This is particularly useful for shared libraries.

As of v1.06 of the library, the build process has been moved to two steps for the typical LibTomCrypt application.  This is because
LibTomCrypt no longer provides a math API on its own and relies on third party libraries (such as LibTomMath, GnuMP, or TomsFastMath).

The build process now consists of installing a math library first, and then building and installing LibTomCrypt with a math library
configured.  Note that LibTomCrypt can be built with no internal math descriptors.  This means that one must be provided at either
build, or run time for the application.  LibTomCrypt comes with three math descriptors that provide a standard interface to math
libraries.

\mysection{Makefile variables}

All GNU driven makefiles (including the makefile for ICC) use a set of common variables to control the build and install process.  Most of the
settings can be overwritten from the command line which makes custom installation a breeze.

\subsection{MAKE, CC, AR and CROSS\_COMPILE}
\index{MAKE} \index{CC} \index{AR} \index{CROSS\_COMPILE}
The MAKE, CC and AR flags can all be overwritten.  They default to \textit{make}, \textit{\$CC} and \textit{\$AR} respectively.
Changing MAKE allows you to change what program will be invoked to handle sub--directories. For example, this

\begin{verbatim}
gmake install MAKE=gmake
\end{verbatim}

\begin{flushleft} will build and install the libraries with the \textit{gmake} tool.  Similarly, \end{flushleft}

\begin{verbatim}
make CC=arm-gcc AR=arm-ar
\end{verbatim}

\begin{flushleft} will build the library using \textit{arm--gcc} as the compiler and \textit{arm--ar} as the archiver. \end{flushleft}

\begin{verbatim}
make CROSS_COMPILE=arm-none-eabi-
\end{verbatim}

\begin{flushleft} will build the library using the \textit{arm--none--eabi--} prefix'ed toolchain. \end{flushleft}

\subsection{IGNORE\_SPEED and LTC\_DEBUG}
\index{IGNORE\_SPEED} \index{LTC\_DEBUG}
When \textbf{IGNORE\_SPEED} has been defined the default optimization flags for CFLAGS will be disabled which allows the developer to specify new
CFLAGS on the command line.  E.g. to add debugging

\begin{verbatim}
make IGNORE_SPEED=1 CFLAGS="-g3"
\end{verbatim}

This will turn off optimizations and add \textit{-g3} to the CFLAGS which enables debugging.

Alternatively one can define \textbf{LTC\_DEBUG} instead, which additionally defines \textit{LTC\_NO\_ASM} and enables debug output on test failures.

Defining \textit{LTC\_DEBUG=2} has the effect to enable verbose output in some of the tests.

\begin{verbatim}
make LTC_DEBUG=2
\end{verbatim}

\begin{flushleft} will build the library without compiler-optimisation or architecture specific code and will enable debugging
and verbose debug output. \end{flushleft}

\subsection{LIBNAME}
\index{LIBNAME}
\textbf{LIBNAME} is the name of the output library (archive) to create.  It defaults to \textit{libtomcrypt.a} for static builds and \textit{libtomcrypt.la} for
shared.
On installation of the shared library the appropriately versioned \textit{libtomcrypt.so}, \textit{libtomcrypt.so.0} etc. will be created by \textit{libtool}.

\subsection{Installation Directories}
\index{DESTDIR} \index{PREFIX} \index{LIBPATH} \index{INCPATH} \index{DATAPATH} \index{BINPATH}
\textbf{DESTDIR} is the location where the output will be stored.  It default to an empty string.
\textbf{PREFIX} is the prefix for the installation directories.  It defaults to \textit{/usr/local}.
\textbf{LIBPATH} is the location of the library directory which defaults to \textit{\$PREFIX/lib}.
\textbf{INCPATH} is the location of the header file directory which defaults to \textit{\$PREFIX/include}.
\textbf{DATAPATH} is the location of the data (documentation) directory which defaults to \textit{\$PREFIX/share/doc/libtomcrypt/pdf}.
\textbf{BINPATH} is the location of the binary file directory which defaults to \textit{\$PREFIX/bin}.

They allow to configure the installation locations of the libary.

\begin{verbatim}
make PREFIX=/home/tom/project DATAPATH=/home/tom/project/docs install
\end{verbatim}

This will build the library and install it to the directories under \textit{/home/tom/project/}.  e.g.

\begin{small}
\begin{verbatim}
/home/tom/project/:
total 1
drwxr-xr-x  2 tom users  80 Jul 30 16:02 docs
drwxr-xr-x  2 tom users 528 Jul 30 16:02 include
drwxr-xr-x  2 tom users  80 Jul 30 16:02 lib

/home/tom/project/docs:
total 452
-rwxr-xr-x  1 tom users 459009 Jul 30 16:02 crypt.pdf

/home/tom/project/include:
total 132
-rwxr-xr-x  1 tom users  2482 Jul 30 16:02 tomcrypt.h
-rwxr-xr-x  1 tom users   702 Jul 30 16:02 tomcrypt_argchk.h
-rwxr-xr-x  1 tom users  2945 Jul 30 16:02 tomcrypt_cfg.h
-rwxr-xr-x  1 tom users 22763 Jul 30 16:02 tomcrypt_cipher.h
-rwxr-xr-x  1 tom users  5174 Jul 30 16:02 tomcrypt_custom.h
-rwxr-xr-x  1 tom users 11314 Jul 30 16:02 tomcrypt_hash.h
-rwxr-xr-x  1 tom users 11571 Jul 30 16:02 tomcrypt_mac.h
-rwxr-xr-x  1 tom users 13614 Jul 30 16:02 tomcrypt_macros.h
-rwxr-xr-x  1 tom users 14714 Jul 30 16:02 tomcrypt_math.h
-rwxr-xr-x  1 tom users   632 Jul 30 16:02 tomcrypt_misc.h
-rwxr-xr-x  1 tom users 10934 Jul 30 16:02 tomcrypt_pk.h
-rwxr-xr-x  1 tom users  2634 Jul 30 16:02 tomcrypt_pkcs.h
-rwxr-xr-x  1 tom users  7067 Jul 30 16:02 tomcrypt_prng.h
-rwxr-xr-x  1 tom users  1467 Jul 30 16:02 tomcrypt_test.h

/home/tom/project/lib:
total 1073
-rwxr-xr-x  1 tom users 1096284 Jul 30 16:02 libtomcrypt.a
\end{verbatim}
\end{small}

For further information see: \url{https://www.gnu.org/prep/standards/html_node/DESTDIR.html}
and \url{https://www.freebsd.org/doc/en/books/porters-handbook/porting-prefix.html}.

\mysection{Extra libraries}
\index{EXTRALIBS}
\textbf{EXTRALIBS} specifies any extra libraries required to link the test programs and shared libraries.  They are specified in the notation
that GCC expects for global archives.

\begin{verbatim}
make install test timing CFLAGS="-DTFM_DESC -DUSE_TFM" EXTRALIBS=-ltfm
\end{verbatim}

This will install the library using the TomsFastMath library and link the \textit{libtfm.a} library out of the default library search path.  The two
defines are explained below.  You can specify multiple archives (say if you want to support two math libraries, or add on additional code) to
the \textbf{EXTRALIBS} variable by separating them by a space.

Note that \textbf{EXTRALIBS} is not required if you are only making and installing the static library but none of the test programs.

\mysection{Building a Static Library}

Building a static library is fairly trivial as it only requires one invocation of the GNU make command.

\begin{verbatim}
make install CFLAGS="-DTFM_DESC"
\end{verbatim}

That will build LibTomCrypt (including the TomsFastMath descriptor), and install it in the default locations indicated previously.  You can enable
the built--in LibTomMath descriptor as well (or in place of the TomsFastMath descriptor).  Similarly, you can build the library with no built--in
math descriptors.

\begin{verbatim}
make install
\end{verbatim}

In this case, no math descriptors are present in the library and they will have to be made available at build or run time before you can use any of the
public key functions.

Note that even if you include the built--in descriptors you must link against the source library as well.

\begin{verbatim}
gcc -DTFM_DESC myprogram.c -ltomcrypt -ltfm -o myprogram
\end{verbatim}

This will compile \textit{myprogram} and link it against the LibTomCrypt library as well as TomsFastMath (which must have been previously installed).  Note that
we define \textbf{TFM\_DESC} for compilation.  This is so that the TFM descriptor symbol will be defined for the client application to make use of without
giving warnings.

\mysection{Building a Shared Library}

LibTomCrypt can also be built as a shared library through the \textit{makefile.shared} make script.  It is similar to use as the static script except
that you \textbf{must} specify the \textbf{EXTRALIBS} variable at install time.

\begin{verbatim}
make -f makefile.shared install CFLAGS="-DTFM_DESC" EXTRALIBS=-ltfm
\end{verbatim}

This will build and install the library and link the shared object against the TomsFastMath library (which must be installed as a shared object as well).  The
shared build process requires libtool to be installed.

\mysection{Header Configuration}
The file \textit{tomcrypt\_cfg.h} is what lets you control various high level macros which control the behaviour of the library.  Build options are also
stored in \textit{tomcrypt\_custom.h} which allow the enabling and disabling of various algorithms.

\subsubsection{ARGTYPE}
This lets you control how the LTC\_ARGCHK macro will behave.  The macro is used to check pointers inside the functions against
NULL.  There are four settings for ARGTYPE.  When set to 0, it will have the default behaviour of printing a message to
stderr and raising a SIGABRT signal.  This is provided so all platforms that use LibTomCrypt can have an error that functions
similarly.  When set to 1, it will simply pass on to the assert() macro.  When set to 2, the macro will display the error to
stderr then return execution to the caller.  This could lead to a segmentation fault (e.g. when a pointer is \textbf{NULL}) but is useful
if you handle signals on your own.  When set to 3, it will resolve to a empty macro and no error checking will be performed.  Finally, when set
to 4, it will return CRYPT\_INVALID\_ARG to the caller.

\subsubsection{Endianness}
There are five macros related to endianness issues.  For little endian platforms define, \textbf{ENDIAN\_LITTLE}.  For big endian
platforms define \textbf{ENDIAN\_BIG}.  Similarly when the default word size of an \textit{unsigned long} is 32-bits define \textbf{ENDIAN\_32BITWORD}
or define \textbf{ENDIAN\_64BITWORD} when its 64-bits.  If you do not define any of them the library will automatically use \textbf{ENDIAN\_NEUTRAL}
which will work on all platforms.

Currently LibTomCrypt will detect x86-32, x86-64, MIPS R5900, SPARC and SPARC64 running GCC as well as x86-32 running MSVC.

\mysection{Customisation}
There are also options you can specify from the \textit{tomcrypt\_custom.h} header file.

\subsection{X memory routines}
\index{XMALLOC}\index{XREALLOC}\index{XCALLOC}\index{XFREE}\index{XMEMSET}\index{XMEMCPY}\index{XMEMMOVE}\index{XMEMCMP}\index{XSTRCMP}\index{XSTRNCPY}
At the top of tomcrypt\_custom.h are a series of macros denoted as XMALLOC, XCALLOC, XREALLOC, XFREE, and so on.  They resolve to
the name of the respective functions from the standard C library by default.  This lets you substitute in your own memory routines.
If you substitute in your own functions they must behave like the standard C library functions in terms of what they expect as input and
output.

These macros are handy for working with platforms which do not have a standard C library.
For instance, the OLPC\footnote{See \url{http://dev.laptop.org/git?p=bios-crypto;a=summary}}
bios code uses these macros to redirect to very compact heap and string operations.

\subsection{X clock routines}
The rng\_get\_bytes() function can call a function that requires the clock() function.  These macros let you override
the default clock() used with a replacement.  By default the standard C library clock() function is used.

\subsection{LTC\_NO\_FILE}
During the build if LTC\_NO\_FILE is defined then any function in the library that uses file I/O will not call the file I/O
functions and instead simply return CRYPT\_NOP.  This should help resolve any linker errors stemming from a lack of
file I/O on embedded platforms.

\subsection{LTC\_CLEAN\_STACK}
When this functions is defined the functions that store key material on the stack will clean up afterwards.
Assumes that you have no memory paging with the stack.

\subsection{LTC\_TEST}
When this has been defined the various self--test functions (for ciphers, hashes, prngs, etc) are included in the build.  This is the default configuration.
If LTC\_NO\_TEST has been defined, the testing routines will be compacted and only return CRYPT\_NOP.

\subsection{LTC\_NO\_FAST}
When this has been defined the library will not use faster word oriented operations.  By default, they are only enabled for platforms
which can be auto-detected.  This macro ensures that they are never enabled.

\subsection{LTC\_FAST}
This mode (auto-detected with x86\_32, x86\_64 platforms with GCC or CLANG) configures various routines such as ctr\_encrypt() or
cbc\_encrypt() that it can safely XOR multiple octets in one step by using a larger data type.  This has the benefit of
cutting down the overhead of the respective functions.

This mode does have one downside.  It can cause unaligned reads from memory if you are not careful with the functions.  This is why
it has been enabled by default only for the x86 class of processors where unaligned accesses are allowed.  Technically LTC\_FAST
is not \textit{portable} since unaligned accesses are not covered by the ISO C specifications.

In practice however, you can use it on pretty much any platform (even MIPS) with care.

By design the \textit{fast} mode functions won't get unaligned on their own.  For instance, if you call ctr\_encrypt() right after calling
ctr\_start() and all the inputs you gave are aligned than ctr\_encrypt() will perform aligned memory operations only.  However, if you
call ctr\_encrypt() with an odd amount of plaintext then call it again the CTR pad (the IV) will be partially used.  This will
cause the ctr routine to first use up the remaining pad bytes.  Then if there are enough plaintext bytes left it will use
whole word XOR operations.  These operations will be unaligned.

The simplest precaution is to make sure you process all data in power of two blocks and handle \textit{remainder} at the end.  e.g. If you are
CTR'ing a long stream process it in blocks of (say) four kilobytes and handle any remaining incomplete blocks at the end of the stream.

\index{LTC\_FAST\_TYPE}
If you do plan on using the \textit{LTC\_FAST} mode, a \textit{LTC\_FAST\_TYPE} type which resolves to an optimal sized
data type you can perform integer operations with is required.  For the auto-detected platforms this type will be defined automatically.  Ideally it should be four or eight bytes since it must properly divide the size
of your block cipher (e.g. 16 bytes for AES).  This means sadly if you're on a platform with 57--bit words (or something) you can't
use this mode.  So sad.

\subsection{LTC\_NO\_ASM}
When this has been defined the library will not use any inline assembler.  Only a few platforms support assembler inlines but various versions of ICC and GCC
cannot handle all of the assembler functions.

\subsection{Symmetric Ciphers, One-way Hashes, PRNGS and Public Key Functions}
There are a plethora of macros for the ciphers, hashes, PRNGs and public key functions which are fairly
self-explanatory.  When they are defined the functionality is included otherwise it is not.  There are some
dependency issues which are noted in the file.  For instance, Yarrow requires CTR chaining mode, a block
cipher and a hash function.

Also see technical note number five for more details.

\subsection{LTC\_EASY}
When defined the library is configured to build fewer algorithms and modes.  Mostly it sticks to NIST and ANSI approved algorithms.  See
the header file \textit{tomcrypt\_custom.h} for more details.  It is meant to provide literally an easy method of trimming the library
build to the most minimum of useful functionality.

\subsection{TWOFISH\_SMALL and TWOFISH\_TABLES}
Twofish is a 128-bit symmetric block cipher that is provided within the library.  The cipher itself is flexible enough
to allow some trade-offs in the implementation.  When TWOFISH\_SMALL is defined the scheduled symmetric key for Twofish
requires only 200 bytes of memory.  This is achieved by not pre-computing the substitution boxes.  Having this
defined will also greatly slow down the cipher.  When this macro is not defined Twofish will pre-compute the
tables at a cost of 4KB of memory.  The cipher will be much faster as a result.

When TWOFISH\_TABLES is defined the cipher will use pre-computed (and fixed in code) tables required to work.  This is
useful when TWOFISH\_SMALL is defined as the table values are computed on the fly.  When this is defined the code size
will increase by approximately 500 bytes.  If this is defined but TWOFISH\_SMALL is not the cipher will still work but
it will not speed up the encryption or decryption functions.

\subsection{GCM\_TABLES}
When defined GCM will use a 64KB table (per GCM state) which will greatly speed up the per--packet latency.
It also increases the initialization time and is not suitable when you are going to use a key a few times only.

\subsection{GCM\_TABLES\_SSE2}
\index{SSE2}
When defined GCM will use the SSE2 instructions to perform the $GF(2^x)$ multiply using 16 128--bit XOR operations.  It shaves a few cycles per byte
of GCM output on both the AMD64 and Intel Pentium 4 platforms.  Requires GCC and an SSE2 equipped platform.

\subsection{LTC\_SMALL\_CODE}
When this is defined some of the code such as the Rijndael and SAFER+ ciphers are replaced with smaller code variants.
These variants are slower but can save quite a bit of code space.

\subsection{LTC\_PTHREAD}
When this is activated all of the descriptor table functions will use pthread locking to ensure thread safe updates to the tables.  Note that
it doesn't prevent a thread that is passively using a table from being messed up by another thread that updates the table.

Generally the rule of thumb is to setup the tables once at startup and then leave them be.  This added build flag simply makes updating
the tables safer.

\subsection{LTC\_ECC\_TIMING\_RESISTANT}
When this has been defined the ECC point multiplier (built--in to the library) will use a timing resistant point multiplication
algorithm which prevents leaking key bits of the private key (scalar).  It is a slower algorithm but useful for situations
where timing side channels pose a significant threat.

This is enabled by default and can be disabled by defining \textbf{LTC\_NO\_ECC\_TIMING\_RESISTANT}.

\subsection{LTC\_RSA\_BLINDING}
When this has been defined the RSA modular exponentiation will use a blinding algorithm to improve timing resistance.

This is enabled by default and can be disabled by defining \textbf{LTC\_NO\_RSA\_BLINDING}.

\subsection{LTC\_RSA\_CRT\_HARDENING}
When this has been defined the RSA modular exponentiation will do some sanity checks regarding the CRT parameters and the operations' results.

This is enabled by default and can be disabled by defining \textbf{LTC\_NO\_RSA\_CRT\_HARDENING}.

\subsection{Math Descriptors}
The library comes with three math descriptors that allow you to interface the public key cryptography API to freely available math
libraries.  When \textbf{GMP\_DESC}, \textbf{LTM\_DESC}, or \textbf{TFM\_DESC} are defined
descriptors for the respective library are built and included in the library as \textit{gmp\_desc}, \textit{ltm\_desc}, or \textit{tfm\_desc} respectively.

In the test demos that use the libraries the additional flags \textbf{USE\_GMP}, \textbf{USE\_LTM}, and \textbf{USE\_TFM} can be defined
to tell the program which library to use.  Only one of the USE flags can be defined at once.

\index{GMP\_DESC} \index{USE\_GMP} \index{LTM\_DESC} \index{TFM\_DESC} \index{USE\_LTM} \index{USE\_TFM}
\begin{small}
\begin{verbatim}
make -f makefile.shared install timing CFLAGS="-DGMP_DESC -DLTM_DESC -DTFM_DESC -DUSE_TFM" \
EXTRALIBS="-lgmp -ltommath -ltfm"
\end{verbatim}
\end{small}

That will build and install the library with all descriptors (and link against all), but only use TomsFastMath in the timing demo.

\chapter{Optimizations}
\mysection{Introduction}
The entire API was designed with plug and play in mind at the low level.  That is you can swap out any cipher, hash, PRNG or bignum library and the dependent API will not
require updating.  This has the nice benefit that one can add ciphers (etc.) not have to re--write portions of the API.  For the most part, LibTomCrypt has also been written
to be highly portable and easy to build out of the box on pretty much any platform.  As such there are no assembler inlines throughout the code, I make no assumptions
about the platform, etc...

That works well for most cases but there are times where performance is of the essence.  This API allows optimized routines to be dropped in--place of the existing
portable routines.  For instance, hand optimized assembler versions of AES could be provided.  Any existing function that uses the cipher could automatically use
the optimized code without re--writing.  This also paves the way for hardware drivers that can access hardware accelerated cryptographic devices.

At the heart of this flexibility is the \textit{descriptor} system.  A descriptor is essentially just a C \textit{struct} which describes the algorithm and provides pointers
to functions that do the required work.  For a given class of operation (e.g. cipher, hash, prng, bignum) the functions of a descriptor have identical prototypes which makes
development simple.  In most dependent routines all an end developer has to do is register\_XXX() the descriptor and they are set.

\mysection{Ciphers}
The ciphers in LibTomCrypt are accessed through the ltc\_cipher\_descriptor structure.

\label{sec:cipherdesc}
\begin{small}
\begin{verbatim}
struct ltc_cipher_descriptor {
   /** name of cipher */
   char *name;

   /** internal ID */
   unsigned char ID;

   /** min keysize (octets) */
   int  min_key_length,

   /** max keysize (octets) */
        max_key_length,

   /** block size (octets) */
        block_length,

   /** default number of rounds */
        default_rounds;

   /** Setup the cipher
      @param key         The input symmetric key
      @param keylen      The length of the input key (octets)
      @param num_rounds  The requested number of rounds (0==default)
      @param skey        [out] The destination of the scheduled key
      @return CRYPT_OK if successful
   */
   int  (*setup)(const unsigned char *key,
                                 int  keylen,
                                 int  num_rounds,
                       symmetric_key *skey);

   /** Encrypt a block
      @param pt      The plaintext
      @param ct      [out] The ciphertext
      @param skey    The scheduled key
      @return CRYPT_OK if successful
   */
   int (*ecb_encrypt)(const unsigned char *pt,
                            unsigned char *ct,
                            symmetric_key *skey);

   /** Decrypt a block
      @param ct      The ciphertext
      @param pt      [out] The plaintext
      @param skey    The scheduled key
      @return CRYPT_OK if successful
   */
   int (*ecb_decrypt)(const unsigned char *ct,
                            unsigned char *pt,
                            symmetric_key *skey);

   /** Test the block cipher
       @return CRYPT_OK if successful,
               CRYPT_NOP if self-testing has been disabled
   */
   int (*test)(void);

   /** Terminate the context
      @param skey    The scheduled key
   */
   void (*done)(symmetric_key *skey);

   /** Determine a key size
       @param keysize    [in/out] The size of the key desired
                                  The suggested size
       @return CRYPT_OK if successful
   */
   int  (*keysize)(int *keysize);

/** Accelerators **/
   /** Accelerated ECB encryption
       @param pt      Plaintext
       @param ct      Ciphertext
       @param blocks  The number of complete blocks to process
       @param skey    The scheduled key context
       @return CRYPT_OK if successful
   */
   int (*accel_ecb_encrypt)(const unsigned char *pt,
                                  unsigned char *ct,
                                  unsigned long  blocks,
                                  symmetric_key *skey);

   /** Accelerated ECB decryption
       @param pt      Plaintext
       @param ct      Ciphertext
       @param blocks  The number of complete blocks to process
       @param skey    The scheduled key context
       @return CRYPT_OK if successful
   */
   int (*accel_ecb_decrypt)(const unsigned char *ct,
                                  unsigned char *pt,
                                  unsigned long  blocks,
                                  symmetric_key *skey);

   /** Accelerated CBC encryption
       @param pt      Plaintext
       @param ct      Ciphertext
       @param blocks  The number of complete blocks to process
       @param IV      The initial value (input/output)
       @param skey    The scheduled key context
       @return CRYPT_OK if successful
   */
   int (*accel_cbc_encrypt)(const unsigned char *pt,
                                  unsigned char *ct,
                                  unsigned long  blocks,
                                  unsigned char *IV,
                                  symmetric_key *skey);

   /** Accelerated CBC decryption
       @param pt      Plaintext
       @param ct      Ciphertext
       @param blocks  The number of complete blocks to process
       @param IV      The initial value (input/output)
       @param skey    The scheduled key context
       @return CRYPT_OK if successful
   */
   int (*accel_cbc_decrypt)(const unsigned char *ct,
                                  unsigned char *pt,
                                  unsigned long  blocks,
                                  unsigned char *IV,
                                  symmetric_key *skey);

   /** Accelerated CTR encryption
       @param pt      Plaintext
       @param ct      Ciphertext
       @param blocks  The number of complete blocks to process
       @param IV      The initial value (input/output)
       @param mode    little or big endian counter (mode=0 or mode=1)
       @param skey    The scheduled key context
       @return CRYPT_OK if successful
   */
   int (*accel_ctr_encrypt)(const unsigned char *pt,
                                  unsigned char *ct,
                                  unsigned long  blocks,
                                  unsigned char *IV,
                                            int  mode,
                                  symmetric_key *skey);

   /** Accelerated LRW
       @param pt      Plaintext
       @param ct      Ciphertext
       @param blocks  The number of complete blocks to process
       @param IV      The initial value (input/output)
       @param tweak   The LRW tweak
       @param skey    The scheduled key context
       @return CRYPT_OK if successful
   */
   int (*accel_lrw_encrypt)(const unsigned char *pt,
                                  unsigned char *ct,
                                  unsigned long  blocks,
                                  unsigned char *IV,
                            const unsigned char *tweak,
                                  symmetric_key *skey);

   /** Accelerated LRW
       @param ct      Ciphertext
       @param pt      Plaintext
       @param blocks  The number of complete blocks to process
       @param IV      The initial value (input/output)
       @param tweak   The LRW tweak
       @param skey    The scheduled key context
       @return CRYPT_OK if successful
   */
   int (*accel_lrw_decrypt)(const unsigned char *ct,
                                  unsigned char *pt,
                                  unsigned long  blocks,
                                  unsigned char *IV,
                            const unsigned char *tweak,
                                  symmetric_key *skey);

   /** Accelerated CCM packet (one-shot)
       @param key        The secret key to use
       @param keylen     The length of the secret key (octets)
       @param uskey      A previously scheduled key [can be NULL]
       @param nonce      The session nonce [use once]
       @param noncelen   The length of the nonce
       @param header     The header for the session
       @param headerlen  The length of the header (octets)
       @param pt         [out] The plaintext
       @param ptlen      The length of the plaintext (octets)
       @param ct         [out] The ciphertext
       @param tag        [out] The destination tag
       @param taglen     [in/out] The max size and resulting size
                                  of the authentication tag
       @param direction  Encrypt or Decrypt direction (0 or 1)
       @return CRYPT_OK if successful
   */
   int (*accel_ccm_memory)(
       const unsigned char *key,    unsigned long keylen,
       symmetric_key       *uskey,
       const unsigned char *nonce,  unsigned long noncelen,
       const unsigned char *header, unsigned long headerlen,
             unsigned char *pt,     unsigned long ptlen,
             unsigned char *ct,
             unsigned char *tag,    unsigned long *taglen,
                       int  direction);

   /** Accelerated GCM packet (one shot)
       @param key        The secret key
       @param keylen     The length of the secret key
       @param IV         The initialization vector
       @param IVlen      The length of the initialization vector
       @param adata      The additional authentication data (header)
       @param adatalen   The length of the adata
       @param pt         The plaintext
       @param ptlen      The length of the plaintext/ciphertext
       @param ct         The ciphertext
       @param tag        [out] The MAC tag
       @param taglen     [in/out] The MAC tag length
       @param direction  Encrypt or Decrypt mode (GCM_ENCRYPT or GCM_DECRYPT)
       @return CRYPT_OK on success
   */
   int (*accel_gcm_memory)(
       const unsigned char *key,    unsigned long keylen,
       const unsigned char *IV,     unsigned long IVlen,
       const unsigned char *adata,  unsigned long adatalen,
             unsigned char *pt,     unsigned long ptlen,
             unsigned char *ct,
             unsigned char *tag,    unsigned long *taglen,
                       int direction);

   /** Accelerated one shot OMAC
       @param key            The secret key
       @param keylen         The key length (octets)
       @param in             The message
       @param inlen          Length of message (octets)
       @param out            [out] Destination for tag
       @param outlen         [in/out] Initial and final size of out
       @return CRYPT_OK on success
   */
   int (*omac_memory)(
       const unsigned char *key, unsigned long keylen,
       const unsigned char *in,  unsigned long inlen,
             unsigned char *out, unsigned long *outlen);

   /** Accelerated one shot XCBC
       @param key            The secret key
       @param keylen         The key length (octets)
       @param in             The message
       @param inlen          Length of message (octets)
       @param out            [out] Destination for tag
       @param outlen         [in/out] Initial and final size of out
       @return CRYPT_OK on success
   */
   int (*xcbc_memory)(
       const unsigned char *key, unsigned long keylen,
       const unsigned char *in,  unsigned long inlen,
             unsigned char *out, unsigned long *outlen);

   /** Accelerated one shot F9
       @param key            The secret key
       @param keylen         The key length (octets)
       @param in             The message
       @param inlen          Length of message (octets)
       @param out            [out] Destination for tag
       @param outlen         [in/out] Initial and final size of out
       @return CRYPT_OK on success
       @remark Requires manual padding
   */
   int (*f9_memory)(
       const unsigned char *key, unsigned long keylen,
       const unsigned char *in,  unsigned long inlen,
             unsigned char *out, unsigned long *outlen);
};
\end{verbatim}
\end{small}

\subsection{Name}
\index{find\_cipher()}
The \textit{name} parameter specifies the name of the cipher.  This is what a developer would pass to find\_cipher() to find the cipher in the descriptor
tables.

\subsection{Internal ID}
This is a single byte Internal ID you can use to distinguish ciphers from each other.

\subsection{Key Lengths}
The minimum key length is \textit{min\_key\_length} and is measured in octets.  Similarly the maximum key length is \textit{max\_key\_length}.  They can be equal
and both must valid key sizes for the cipher.  Values in between are not assumed to be valid though they may be.

\subsection{Block Length}
The size of the ciphers plaintext or ciphertext is \textit{block\_length} and is measured in octets.

\subsection{Rounds}
Some ciphers allow different number of rounds to be used.  Usually you just use the default.  The default round count is \textit{default\_rounds}.

\subsection{Setup}
To initialize a cipher (for ECB mode) the function setup() was provided.  It accepts an array of key octets \textit{key} of length \textit{keylen} octets.  The user
can specify the number of rounds they want through \textit{num\_rounds} where $num\_rounds = 0$ means use the default.  The destination of a scheduled key is stored
in \textit{skey}.

Inside the \textit{symmetric\_key} union there is a \textit{void *data} which you can use to allocate data if you need a data structure that does not fit with the existing
ones provided.  Just make sure in your \textit{done()} function that you free the allocated memory.

\subsection{Single block ECB}
To process a single block in ECB mode the ecb\_encrypt() and ecb\_decrypt() functions were provided.  The plaintext and ciphertext buffers are allowed to overlap so you
must make sure you do not overwrite the output before you are finished with the input.

\subsection{Testing}
The test() function is used to self--test the \textit{device}.  It takes no arguments and returns \textbf{CRYPT\_OK} if all is working properly.  You may return
\textbf{CRYPT\_NOP} to indicate that no testing was performed.

\subsection{Key Sizing}
Occasionally, a function will want to find a suitable key size to use since the input is oddly sized.  The keysize() function is for this case.  It accepts a
pointer to an integer which represents the desired size.  The function then has to match it to the exact or a lower key size that is valid for the cipher.  For
example, if the input is $25$ and $24$ is valid then it stores $24$ back in the pointed to integer.  It must not round up and must return an error if the keysize
 cannot be mapped to a valid key size for the cipher.

\subsection{Acceleration}
The next set of functions cover the accelerated functionality of the cipher descriptor.  Any combination of these functions may be set to \textbf{NULL} to indicate
it is not supported.  In those cases the software defaults are used (using the single ECB block routines).

\subsubsection{Accelerated ECB}
These two functions are meant for cases where a user wants to encrypt (in ECB mode no less) an array of blocks.  These functions are accessed
through the accel\_ecb\_encrypt and accel\_ecb\_decrypt pointers.  The \textit{blocks} count is the number of complete blocks to process.

\subsubsection{Accelerated CBC}
These two functions are meant for accelerated CBC encryption.  These functions are accessed through the accel\_cbc\_encrypt and accel\_cbc\_decrypt pointers.
The \textit{blocks} value is the number of complete blocks to process.  The \textit{IV} is the CBC initialization vector.  It is an input upon calling this function and must be
updated by the function before returning.

\subsubsection{Accelerated CTR}
This function is meant for accelerated CTR encryption.  It is accessible through the accel\_ctr\_encrypt pointer.
The \textit{blocks} value is the number of complete blocks to process.  The \textit{IV} is the CTR counter vector.  It is an input upon calling this function and must be
updated by the function before returning.  The \textit{mode} value indicates whether the counter is big (mode = CTR\_COUNTER\_BIG\_ENDIAN) or
little (mode = CTR\_COUNTER\_LITTLE\_ENDIAN) endian.

This function (and the way it's called) differs from the other two since ctr\_encrypt() allows any size input plaintext.  The accelerator will only be
called if the following conditions are met.

\begin{enumerate}
   \item The accelerator is present
   \item The CTR pad is empty
   \item The remaining length of the input to process is greater than or equal to the block size.
\end{enumerate}

The \textit{CTR pad} is empty when a multiple (including zero) blocks of text have been processed.  That is, if you pass in seven bytes to AES--CTR mode you would have to
pass in a minimum of nine extra bytes before the accelerator could be called.  The CTR accelerator must increment the counter (and store it back into the
buffer provided) before encrypting it to create the pad.

The accelerator will only be used to encrypt whole blocks.  Partial blocks are always handled in software.

\subsubsection{Accelerated LRW}
These functions are meant for accelerated LRW.  They process blocks of input in lengths of multiples of 16 octets.  They must accept the \textit{IV} and \textit{tweak}
state variables and updated them prior to returning.  Note that you may want to disable \textbf{LRW\_TABLES} in \textit{tomcrypt\_custom.h} if you intend
to use accelerators for LRW.

While both encrypt and decrypt accelerators are not required it is suggested as it makes lrw\_setiv() more efficient.

Note that calling lrw\_done() will only invoke the cipher\_descriptor[].done() function on the \textit{symmetric\_key} parameter of the LRW state.  That means
if your device requires any (LRW specific) resources you should free them in your ciphers() done function.  The simplest way to think of it is to write
the plugin solely to do LRW with the cipher.  That way cipher\_descriptor[].setup() means to init LRW resources and cipher\_descriptor[].done() means to
free them.

\subsubsection{Accelerated CCM}
This function is meant for accelerated CCM encryption or decryption.  It processes the entire packet in one call.  You can optimize the work flow somewhat
by allowing the caller to call the setup() function first to schedule the key if your accelerator cannot do the key schedule on the fly (for instance).  This
function MUST support both key passing methods.

\begin{center}
\begin{small}
\begin{tabular}{|r|r|l|}
\hline \textbf{key} & \textbf{uskey} & \textbf{Source of key} \\
\hline NULL         & NULL           & Error, not supported \\
\hline non-NULL     & NULL           & Use key, do a key schedule \\
\hline NULL         & non-NULL       & Use uskey, key schedule not required \\
\hline non-NULL     & non-NULL       & Use uskey, key schedule not required \\
\hline
\end{tabular}
\end{small}
\end{center}

\index{ccm\_memory()} This function is called when the user calls ccm\_memory().

\subsubsection{Accelerated GCM}
\index{gcm\_memory()}
This function is meant for accelerated GCM encryption or decryption.  It processes the entire packet in one call.  Note that the setup() function will not
be called prior to this.  This function must handle scheduling the key provided on its own.  It is called when the user calls gcm\_memory().

\subsubsection{Accelerated OMAC}
\index{omac\_memory()}
This function is meant to perform an optimized OMAC1 (CMAC) message authentication code computation when the user calls omac\_memory().

\subsubsection{Accelerated XCBC-MAC}
\index{xcbc\_memory()}
This function is meant to perform an optimized XCBC-MAC message authentication code computation when the user calls xcbc\_memory().

\subsubsection{Accelerated F9}
\index{f9\_memory()}
This function is meant to perform an optimized F9 message authentication code computation when the user calls f9\_memory().  Like f9\_memory(), it requires
the caller to perform any 3GPP related padding before calling in order to ensure proper compliance with F9.


\mysection{One--Way Hashes}
The hash functions are accessed through the ltc\_hash\_descriptor structure.

\begin{small}
\begin{verbatim}
struct ltc_hash_descriptor {
    /** name of hash */
    char *name;

    /** internal ID */
    unsigned char ID;

    /** Size of digest in octets */
    unsigned long hashsize;

    /** Input block size in octets */
    unsigned long blocksize;

    /** ASN.1 OID */
    unsigned long OID[16];

    /** Length of DER encoding */
    unsigned long OIDlen;

    /** Init a hash state
      @param hash   The hash to initialize
      @return CRYPT_OK if successful
    */
    int (*init)(hash_state *hash);

    /** Process a block of data
      @param hash   The hash state
      @param in     The data to hash
      @param inlen  The length of the data (octets)
      @return CRYPT_OK if successful
    */
    int (*process)(         hash_state *hash,
                   const unsigned char *in,
                         unsigned long  inlen);

    /** Produce the digest and store it
      @param hash   The hash state
      @param out    [out] The destination of the digest
      @return CRYPT_OK if successful
    */
    int (*done)(   hash_state *hash,
                unsigned char *out);

    /** Self-test
      @return CRYPT_OK if successful,
              CRYPT_NOP if self-tests have been disabled
    */
    int (*test)(void);

    /* accelerated hmac callback: if you need to-do
       multiple packets just use the generic hmac_memory
       and provide a hash callback
    */
    int  (*hmac_block)(const unsigned char *key,
                             unsigned long  keylen,
                       const unsigned char *in,
                             unsigned long  inlen,
                             unsigned char *out,
                             unsigned long *outlen);
};
\end{verbatim}
\end{small}

\subsection{Name}
This is the name the hash is known by and what find\_hash() will look for.

\subsection{Internal ID}
This is the internal ID byte used to distinguish the hash from other hashes.

\subsection{Digest Size}
The \textit{hashsize} variable indicates the length of the output in octets.

\subsection{Block Size}
The \textit{blocksize} variable indicates the length of input (in octets) that the hash processes in a given
invocation.

\subsection{OID Identifier}
This is the universal ASN.1 Object Identifier for the hash.

\subsection{Initialization}
The init function initializes the hash and prepares it to process message bytes.

\subsection{Process}
This processes message bytes.  The algorithm must accept any length of input that the hash would allow.  The input is not
guaranteed to be a multiple of the block size in length.

\subsection{Done}
The done function terminates the hash and returns the message digest.

\subsection{Acceleration}
A compatible accelerator must allow processing data in any granularity which may require internal padding on the driver side.

\subsection{HMAC Acceleration}
The hmac\_block() callback is meant for single--shot optimized HMAC implementations.  It is called directly by hmac\_memory() if present.  If you need
to be able to process multiple blocks per MAC then you will have to simply provide a process() callback and use hmac\_memory() as provided in LibTomCrypt.

\mysection{Pseudo--Random Number Generators}
The pseudo--random number generators are accessible through the ltc\_prng\_descriptor structure.

\begin{small}
\begin{verbatim}
struct ltc_prng_descriptor {
    /** Name of the PRNG */
    char *name;

    /** size in bytes of exported state */
    int  export_size;

    /** Start a PRNG state
        @param prng   [out] The state to initialize
        @return CRYPT_OK if successful
    */
    int (*start)(prng_state *prng);

    /** Add entropy to the PRNG
        @param in         The entropy
        @param inlen      Length of the entropy (octets)
        @param prng       The PRNG state
        @return CRYPT_OK if successful
    */
    int (*add_entropy)(const unsigned char *in,
                             unsigned long  inlen,
                                prng_state *prng);

    /** Ready a PRNG state to read from
        @param prng       The PRNG state to ready
        @return CRYPT_OK if successful
    */
    int (*ready)(prng_state *prng);

    /** Read from the PRNG
        @param out     [out] Where to store the data
        @param outlen  Length of data desired (octets)
        @param prng    The PRNG state to read from
        @return Number of octets read
    */
    unsigned long (*read)(unsigned char *out,
                          unsigned long  outlen,
                             prng_state *prng);

    /** Terminate a PRNG state
        @param prng   The PRNG state to terminate
        @return CRYPT_OK if successful
    */
    int (*done)(prng_state *prng);

    /** Export a PRNG state
        @param out     [out] The destination for the state
        @param outlen  [in/out] The max size and resulting size
        @param prng    The PRNG to export
        @return CRYPT_OK if successful
    */
    int (*pexport)(unsigned char *out,
                   unsigned long *outlen,
                      prng_state *prng);

    /** Import a PRNG state
        @param in      The data to import
        @param inlen   The length of the data to import (octets)
        @param prng    The PRNG to initialize/import
        @return CRYPT_OK if successful
    */
    int (*pimport)(const unsigned char *in,
                         unsigned long  inlen,
                            prng_state *prng);

    /** Self-test the PRNG
        @return CRYPT_OK if successful,
                CRYPT_NOP if self-testing has been disabled
    */
    int (*test)(void);
};
\end{verbatim}
\end{small}

\subsection{Name}
The name by which find\_prng() will find the PRNG.

\subsection{Export Size}
When an PRNG state is to be exported for future use you specify the space required in this variable.

\subsection{Start}
Initialize the PRNG and make it ready to accept entropy.

\subsection{Entropy Addition}
Add entropy to the PRNG state.  The exact behaviour of this function depends on the particulars of the PRNG.

\subsection{Ready}
This function makes the PRNG ready to read from by processing the entropy added.  The behaviour of this function depends
on the specific PRNG used.

\subsection{Read}
Read from the PRNG and return the number of bytes read.  This function does not have to fill the buffer but it is best
if it does as many protocols do not retry reads and will fail on the first try.

\subsection{Done}
Terminate a PRNG state.  The behaviour of this function depends on the particular PRNG used.

\subsection{Exporting and Importing}
An exported PRNG state is data that the PRNG can later import to resume activity.  They're not meant to resume \textit{the same session}
but should at least maintain the same level of state entropy.

\mysection{BigNum Math Descriptors}
The library also makes use of the math descriptors to access math functions.  While bignum math libraries usually differ in implementation
it hasn't proven hard to write \textit{glue} to use math libraries so far.  The basic descriptor looks like.

\begin{small}
\begin{verbatim}
/** math descriptor */
typedef struct {
   /** Name of the math provider */
   char *name;

   /** Bits per digit, amount of bits must fit in an unsigned long */
   int  bits_per_digit;

/* ---- init/deinit functions ---- */

   /** initialize a bignum
     @param   a     The number to initialize
     @return  CRYPT_OK on success
   */
   int (*init)(void **a);

   /** init copy
     @param  dst    The number to initialize and write to
     @param  src    The number to copy from
     @return CRYPT_OK on success
   */
   int (*init_copy)(void **dst, void *src);

   /** deinit
      @param   a    The number to free
      @return CRYPT_OK on success
   */
   void (*deinit)(void *a);

/* ---- data movement ---- */

   /** negate
      @param   src   The number to negate
      @param   dst   The destination
      @return CRYPT_OK on success
   */
   int (*neg)(void *src, void *dst);

   /** copy
      @param   src   The number to copy from
      @param   dst   The number to write to
      @return CRYPT_OK on success
   */
   int (*copy)(void *src, void *dst);

/* ---- trivial low level functions ---- */

   /** set small constant
      @param a    Number to write to
      @param n    Source upto bits_per_digit (actually meant for very small constants)
      @return CRYPT_OK on success
   */
   int (*set_int)(void *a, unsigned long n);

   /** get small constant
      @param a  Small number to read,
                only fetches up to bits_per_digit from the number
      @return   The lower bits_per_digit of the integer (unsigned)
   */
   unsigned long (*get_int)(void *a);

   /** get digit n
     @param a  The number to read from
     @param n  The number of the digit to fetch
     @return  The bits_per_digit  sized n'th digit of a
   */
   ltc_mp_digit (*get_digit)(void *a, int n);

   /** Get the number of digits that represent the number
     @param a   The number to count
     @return The number of digits used to represent the number
   */
   int (*get_digit_count)(void *a);

   /** compare two integers
     @param a   The left side integer
     @param b   The right side integer
     @return LTC_MP_LT if a < b,
             LTC_MP_GT if a > b and
             LTC_MP_EQ otherwise.  (signed comparison)
   */
   int (*compare)(void *a, void *b);

   /** compare against int
     @param a   The left side integer
     @param b   The right side integer (upto bits_per_digit)
     @return LTC_MP_LT if a < b,
             LTC_MP_GT if a > b and
             LTC_MP_EQ otherwise.  (signed comparison)
   */
   int (*compare_d)(void *a, unsigned long n);

   /** Count the number of bits used to represent the integer
     @param a   The integer to count
     @return The number of bits required to represent the integer
   */
   int (*count_bits)(void * a);

   /** Count the number of LSB bits which are zero
     @param a   The integer to count
     @return The number of contiguous zero LSB bits
   */
   int (*count_lsb_bits)(void *a);

   /** Compute a power of two
     @param a  The integer to store the power in
     @param n  The power of two you want to store (a = 2^n)
     @return CRYPT_OK on success
   */
   int (*twoexpt)(void *a , int n);

/* ---- radix conversions ---- */

   /** read ascii string
     @param a     The integer to store into
     @param str   The string to read
     @param radix The radix the integer has been represented in (2-64)
     @return CRYPT_OK on success
   */
   int (*read_radix)(void *a, const char *str, int radix);

   /** write number to string
     @param a     The integer to store
     @param str   The destination for the string
     @param radix The radix the integer is to be represented in (2-64)
     @return CRYPT_OK on success
   */
   int (*write_radix)(void *a, char *str, int radix);

   /** get size as unsigned char string
     @param a  The integer to get the size (when stored in array of octets)
     @return   The length of the integer in octets
   */
   unsigned long (*unsigned_size)(void *a);

   /** store an integer as an array of octets
     @param src   The integer to store
     @param dst   The buffer to store the integer in
     @return CRYPT_OK on success
   */
   int (*unsigned_write)(void *src, unsigned char *dst);

   /** read an array of octets and store as integer
     @param dst   The integer to load
     @param src   The array of octets
     @param len   The number of octets
     @return CRYPT_OK on success
   */
   int (*unsigned_read)(         void *dst,
                        unsigned char *src,
                        unsigned long  len);

/* ---- basic math ---- */

   /** add two integers
     @param a   The first source integer
     @param b   The second source integer
     @param c   The destination of "a + b"
     @return CRYPT_OK on success
   */
   int (*add)(void *a, void *b, void *c);

   /** add two integers
     @param a   The first source integer
     @param b   The second source integer
                (single digit of upto bits_per_digit in length)
     @param c   The destination of "a + b"
     @return CRYPT_OK on success
   */
   int (*addi)(void *a, unsigned long b, void *c);

   /** subtract two integers
     @param a   The first source integer
     @param b   The second source integer
     @param c   The destination of "a - b"
     @return CRYPT_OK on success
   */
   int (*sub)(void *a, void *b, void *c);

   /** subtract two integers
     @param a   The first source integer
     @param b   The second source integer
                (single digit of upto bits_per_digit in length)
     @param c   The destination of "a - b"
     @return CRYPT_OK on success
   */
   int (*subi)(void *a, unsigned long b, void *c);

   /** multiply two integers
     @param a   The first source integer
     @param b   The second source integer
                (single digit of upto bits_per_digit in length)
     @param c   The destination of "a * b"
     @return CRYPT_OK on success
   */
   int (*mul)(void *a, void *b, void *c);

   /** multiply two integers
     @param a   The first source integer
     @param b   The second source integer
                (single digit of upto bits_per_digit in length)
     @param c   The destination of "a * b"
     @return CRYPT_OK on success
   */
   int (*muli)(void *a, unsigned long b, void *c);

   /** Square an integer
     @param a    The integer to square
     @param b    The destination
     @return CRYPT_OK on success
   */
   int (*sqr)(void *a, void *b);

   /** Divide an integer
     @param a    The dividend
     @param b    The divisor
     @param c    The quotient (can be NULL to signify don't care)
     @param d    The remainder (can be NULL to signify don't care)
     @return CRYPT_OK on success
   */
   int (*mpdiv)(void *a, void *b, void *c, void *d);

   /** divide by two
      @param  a   The integer to divide (shift right)
      @param  b   The destination
      @return CRYPT_OK on success
   */
   int (*div_2)(void *a, void *b);

   /** Get remainder (small value)
      @param  a    The integer to reduce
      @param  b    The modulus (upto bits_per_digit in length)
      @param  c    The destination for the residue
      @return CRYPT_OK on success
   */
   int (*modi)(void *a, unsigned long b, unsigned long *c);

   /** gcd
      @param  a     The first integer
      @param  b     The second integer
      @param  c     The destination for (a, b)
      @return CRYPT_OK on success
   */
   int (*gcd)(void *a, void *b, void *c);

   /** lcm
      @param  a     The first integer
      @param  b     The second integer
      @param  c     The destination for [a, b]
      @return CRYPT_OK on success
   */
   int (*lcm)(void *a, void *b, void *c);

   /** Modular multiplication
      @param  a     The first source
      @param  b     The second source
      @param  c     The modulus
      @param  d     The destination (a*b mod c)
      @return CRYPT_OK on success
   */
   int (*mulmod)(void *a, void *b, void *c, void *d);

   /** Modular squaring
      @param  a     The first source
      @param  b     The modulus
      @param  c     The destination (a*a mod b)
      @return CRYPT_OK on success
   */
   int (*sqrmod)(void *a, void *b, void *c);

   /** Modular inversion
      @param  a     The value to invert
      @param  b     The modulus
      @param  c     The destination (1/a mod b)
      @return CRYPT_OK on success
   */
   int (*invmod)(void *, void *, void *);

/* ---- reduction ---- */

   /** setup Montgomery
       @param a  The modulus
       @param b  The destination for the reduction digit
       @return CRYPT_OK on success
   */
   int (*montgomery_setup)(void *a, void **b);

   /** get normalization value
       @param a   The destination for the normalization value
       @param b   The modulus
       @return  CRYPT_OK on success
   */
   int (*montgomery_normalization)(void *a, void *b);

   /** reduce a number
       @param a   The number [and dest] to reduce
       @param b   The modulus
       @param c   The value "b" from montgomery_setup()
       @return CRYPT_OK on success
   */
   int (*montgomery_reduce)(void *a, void *b, void *c);

   /** clean up  (frees memory)
       @param a   The value "b" from montgomery_setup()
       @return CRYPT_OK on success
   */
   void (*montgomery_deinit)(void *a);

/* ---- exponentiation ---- */

   /** Modular exponentiation
       @param a    The base integer
       @param b    The power (can be negative) integer
       @param c    The modulus integer
       @param d    The destination
       @return CRYPT_OK on success
   */
   int (*exptmod)(void *a, void *b, void *c, void *d);

   /** Primality testing
       @param a     The integer to test
       @param b     The number of Miller-Rabin tests that shall be executed
       @param c     The destination of the result (FP_YES if prime)
       @return CRYPT_OK on success
   */
   int (*isprime)(void *a, int b, int *c);

/* ----  (optional) ecc point math ---- */

   /** ECC GF(p) point multiplication (from the NIST curves)
       @param k   The integer to multiply the point by
       @param G   The point to multiply
       @param R   The destination for kG
       @param modulus  The modulus for the field
       @param map Boolean indicated whether to map back to affine or not
                  (can be ignored if you work in affine only)
       @return CRYPT_OK on success
   */
   int (*ecc_ptmul)(     void *k,
                    ecc_point *G,
                    ecc_point *R,
                         void *modulus,
                          int  map);

   /** ECC GF(p) point addition
       @param P    The first point
       @param Q    The second point
       @param R    The destination of P + Q
       @param modulus  The modulus
       @param mp   The "b" value from montgomery_setup()
       @return CRYPT_OK on success
   */
   int (*ecc_ptadd)(ecc_point *P,
                    ecc_point *Q,
                    ecc_point *R,
                         void *modulus,
                         void *mp);

   /** ECC GF(p) point double
       @param P    The first point
       @param R    The destination of 2P
       @param modulus  The modulus
       @param mp   The "b" value from montgomery_setup()
       @return CRYPT_OK on success
   */
   int (*ecc_ptdbl)(ecc_point *P,
                    ecc_point *R,
                         void *modulus,
                         void *mp);

   /** ECC mapping from projective to affine,
       currently uses (x,y,z) => (x/z^2, y/z^3, 1)
       @param P     The point to map
       @param modulus The modulus
       @param mp    The "b" value from montgomery_setup()
       @return CRYPT_OK on success
       @remark The mapping can be different but keep in mind a
               ecc_point only has three integers (x,y,z) so if
               you use a different mapping you have to make it fit.
   */
   int (*ecc_map)(ecc_point *P, void *modulus, void *mp);

   /** Computes kA*A + kB*B = C using Shamir's Trick
       @param A        First point to multiply
       @param kA       What to multiple A by
       @param B        Second point to multiply
       @param kB       What to multiple B by
       @param C        [out] Destination point (can overlap with A or B)
       @param modulus  Modulus for curve
       @return CRYPT_OK on success
   */
   int (*ecc_mul2add)(ecc_point *A, void *kA,
                      ecc_point *B, void *kB,
                      ecc_point *C,
                           void *modulus);

/* ---- (optional) rsa optimized math (for internal CRT) ---- */

   /** RSA Key Generation
       @param prng     An active PRNG state
       @param wprng    The index of the PRNG desired
       @param size     The size of the key in octets
       @param e        The "e" value (public key).
                       e==65537 is a good choice
       @param key      [out] Destination of a newly created private key pair
       @return CRYPT_OK if successful, upon error all allocated ram is freed
    */
    int (*rsa_keygen)(prng_state *prng,
                             int  wprng,
                             int  size,
                            long  e,
                         rsa_key *key);

   /** RSA exponentiation
      @param in       The octet array representing the base
      @param inlen    The length of the input
      @param out      The destination (to be stored in an octet array format)
      @param outlen   The length of the output buffer and the resulting size
                      (zero padded to the size of the modulus)
      @param which    PK_PUBLIC for public RSA and PK_PRIVATE for private RSA
      @param key      The RSA key to use
      @return CRYPT_OK on success
   */
   int (*rsa_me)(const unsigned char *in,   unsigned long inlen,
                       unsigned char *out,  unsigned long *outlen, int which,
                       rsa_key *key);

/* ---- basic math continued ---- */

   /** Modular addition
      @param  a     The first source
      @param  b     The second source
      @param  c     The modulus
      @param  d     The destination (a + b mod c)
      @return CRYPT_OK on success
   */
   int (*addmod)(void *a, void *b, void *c, void *d);

   /** Modular substraction
      @param  a     The first source
      @param  b     The second source
      @param  c     The modulus
      @param  d     The destination (a - b mod c)
      @return CRYPT_OK on success
   */
   int (*submod)(void *a, void *b, void *c, void *d);

/* ---- misc stuff ---- */

   /** Make a pseudo-random mpi
      @param  a     The mpi to make random
      @param  size  The desired length
      @return CRYPT_OK on success
   */
   int (*rand)(void *a, int size);
} ltc_math_descriptor;
\end{verbatim}
\end{small}

Most of the functions are fairly straightforward and do not need documentation.  We'll cover the basic conventions of the API and then explain the accelerated functions.

\subsection{Conventions}

All \textit{bignums} are accessed through an opaque \textit{void *} data type.  You must internally cast the pointer if you need to access members of your bignum structure.  During
the init calls a \textit{void **} will be passed where you allocate your structure and set the pointer then initialize the number to zero.  During the deinit calls you must
free the bignum as well as the structure you allocated to place it in.

All functions except the Montgomery reductions work from left to right with the arguments.  For example, mul(a, b, c) computes $c \leftarrow ab$.

All functions (except where noted otherwise) return \textbf{CRYPT\_OK} to signify a successful operation.  All error codes must be valid LibTomCrypt error codes.

The digit routines (including functions with the \textit{i} suffix) use a \textit{ltc\_mp\_digit} to represent the digit.  If your internal digit is larger than this you must
then partition your digits.  Note that if your digit is smaller than an \textit{ltc\_mp\_digit} that is also acceptable as the \textit{bits\_per\_digit} parameter will specify this.

\subsubsection{ltc\_mp\_digit}
\index{ltc\_mp\_digit}

Depending on the archtitecture \textit{ltc\_mp\_digit} is either a $32$- or $64$-bit long \textit{unsigned} data type.

\subsection{ECC Functions}
The ECC system in LibTomCrypt is based off the NIST recommended curves over $GF(p)$ and is used to implement ECDSA and ECDH.   The ECC functions work with
the \textbf{ecc\_point} structure and assumes the points are stored in Jacobian projective format.

\begin{verbatim}
/** A point on a ECC curve, stored in Jacobian format such
    that (x,y,z) => (x/z^2, y/z^3, 1) when interpreted as affine */
typedef struct {
    /** The x co-ordinate */
    void *x;
    /** The y co-ordinate */
    void *y;
    /** The z co-ordinate */
    void *z;
} ecc_point;
\end{verbatim}

All ECC functions must use this mapping system.  The only exception is when you remap all ECC callbacks which will allow you to have more control
over how the ECC math will be implemented.  Out of the box you only have three parameters per point to use $(x, y, z)$ however, these are just void pointers.
They could point to anything you want.  The only further exception is the export functions which expects the values to be in affine format.

\subsubsection{Point Multiply}
This will multiply the point $G$ by the scalar $k$ and store the result in the point $R$.  The value should be mapped to affine only if $map$ is set to one.

\subsubsection{Point Addition}
This will add the point $P$ to the point $Q$ and store it in the point $R$.  The $mp$ parameter is the \textit{b} value from the montgomery\_setup() call.  The input points
may be in either affine (with $z = 1$) or projective format and the output point is always projective.

\subsubsection{Point Mapping}
This will map the point $P$ back from projective to affine.  The output point $P$ must be of the form $(x, y, 1)$.

\subsubsection{Shamir's Trick}
\index{Shamir's Trick}
\index{ltc\_ecc\_mul2add()}
To accelerate ECDSA verification the library provides a built--in function called ltc\_ecc\_mul2add().  This performs two point multiplications and an addition in
roughly the time of one point multiplication.  It is called from ecc\_verify\_hash() if an accelerator is not present.  The acclerator function must allow the points to
overlap (e.g., $A \leftarrow k_1A + k_2B$) and must return the final point in affine format.


\subsection{RSA Functions}
The RSA Modular Exponentiation (ME) function is used by the RSA API to perform exponentiations for private and public key operations.  In particular for
private key operations it uses the CRT approach to lower the time required.  It is passed an RSA key with the following format.

\begin{verbatim}
/** RSA PKCS style key */
typedef struct Rsa_key {
    /** Type of key, PK_PRIVATE or PK_PUBLIC */
    int type;
    /** The public exponent */
    void *e;
    /** The private exponent */
    void *d;
    /** The modulus */
    void *N;
    /** The p factor of N */
    void *p;
    /** The q factor of N */
    void *q;
    /** The 1/q mod p CRT param */
    void *qP;
    /** The d mod (p - 1) CRT param */
    void *dP;
    /** The d mod (q - 1) CRT param */
    void *dQ;
} rsa_key;
\end{verbatim}

The call reads the \textit{in} buffer as an unsigned char array in big endian format.  Then it performs the exponentiation and stores the output in big endian format
to the \textit{out} buffer.  The output must be zero padded (leading bytes) so that the length of the output matches the length of the modulus (in bytes).  For example,
for RSA--1024 the output is always 128 bytes regardless of how small the numerical value of the exponentiation is.

Since the function is given the entire RSA key (for private keys only) CRT is possible as prescribed in the PKCS \#1 v2.1 specification.


\mysection{Deprecated API functions}

\subsection{After v1.18.0}

\index{init\_LTM()} \index{init\_TFM()} \index{init\_GMP()}
\begin{verbatim}
void init_LTM(void);
void init_TFM(void);
void init_GMP(void);
\end{verbatim}

These three MPI init functions have been introduced in version 1.18.0 and have been deprecated in the same version in favor of \textit{crypt\_mp\_init()}.

\newpage
\markboth{Index}{Index}
\input{crypt.ind}

\end{document}

% ref:         $Format:%D$
% git commit:  $Format:%H$
% commit time: $Format:%ai$