grpc-flamingo 1.11.0 → 1.15.0

data/third_party/boringssl/crypto/fipsmodule/ecdsa/ecdsa.c

@@ -66,10 +66,52 @@
 #include "../../internal.h"
 
 
+// EC_LOOSE_SCALAR is like |EC_SCALAR| but is bounded by 2^|BN_num_bits(order)|
+// rather than |order|.
+typedef union {
+  // bytes is the representation of the scalar in little-endian order.
+  uint8_t bytes[EC_MAX_SCALAR_BYTES];
+  BN_ULONG words[EC_MAX_SCALAR_WORDS];
+} EC_LOOSE_SCALAR;
+
+static void scalar_add_loose(const EC_GROUP *group, EC_LOOSE_SCALAR *r,
+                             const EC_LOOSE_SCALAR *a, const EC_SCALAR *b) {
+  // Add and subtract one copy of |order| if necessary. We have:
+  //   |a| + |b| < 2^BN_num_bits(order) + order
+  // so this leaves |r| < 2^BN_num_bits(order).
+  const BIGNUM *order = &group->order;
+  BN_ULONG carry = bn_add_words(r->words, a->words, b->words, order->width);
+  EC_LOOSE_SCALAR tmp;
+  BN_ULONG v =
+      bn_sub_words(tmp.words, r->words, order->d, order->width) - carry;
+  bn_select_words(r->words, 0u - v, r->words /* tmp < 0 */,
+                  tmp.words /* tmp >= 0 */, order->width);
+}
+
+static int scalar_mod_mul_montgomery(const EC_GROUP *group, EC_SCALAR *r,
+                                     const EC_SCALAR *a, const EC_SCALAR *b) {
+  const BIGNUM *order = &group->order;
+  return bn_mod_mul_montgomery_small(r->words, order->width, a->words,
+                                     order->width, b->words, order->width,
+                                     group->order_mont);
+}
+
+static int scalar_mod_mul_montgomery_loose(const EC_GROUP *group, EC_SCALAR *r,
+                                           const EC_LOOSE_SCALAR *a,
+                                           const EC_SCALAR *b) {
+  // Although |a| is loose, |bn_mod_mul_montgomery_small| only requires the
+  // product not exceed R * |order|. |b| is fully reduced and |a| <
+  // 2^BN_num_bits(order) <= R, so this holds.
+  const BIGNUM *order = &group->order;
+  return bn_mod_mul_montgomery_small(r->words, order->width, a->words,
+                                     order->width, b->words, order->width,
+                                     group->order_mont);
+}
+
 // digest_to_scalar interprets |digest_len| bytes from |digest| as a scalar for
 // ECDSA. Note this value is not fully reduced modulo the order, only the
 // correct number of bits.
-static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
+static void digest_to_scalar(const EC_GROUP *group, EC_LOOSE_SCALAR *out,
                              const uint8_t *digest, size_t digest_len) {
   const BIGNUM *order = &group->order;
   size_t num_bits = BN_num_bits(order);
@@ -85,11 +127,11 @@ static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
   // If still too long truncate remaining bits with a shift
   if (8 * digest_len > num_bits) {
     size_t shift = 8 - (num_bits & 0x7);
-    for (int i = 0; i < order->top - 1; i++) {
+    for (int i = 0; i < order->width - 1; i++) {
       out->words[i] =
           (out->words[i] >> shift) | (out->words[i + 1] << (BN_BITS2 - shift));
     }
-    out->words[order->top - 1] >>= shift;
+    out->words[order->width - 1] >>= shift;
   }
 }
 
@@ -195,15 +237,12 @@ int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
     goto err;
   }
 
-  EC_SCALAR r, s, m, u1, u2, s_inv_mont;
+  EC_SCALAR r, s, u1, u2, s_inv_mont;
+  EC_LOOSE_SCALAR m;
   const BIGNUM *order = EC_GROUP_get0_order(group);
   if (BN_is_zero(sig->r) ||
-      BN_is_negative(sig->r) ||
-      BN_ucmp(sig->r, order) >= 0 ||
       !ec_bignum_to_scalar(group, &r, sig->r) ||
       BN_is_zero(sig->s) ||
-      BN_is_negative(sig->s) ||
-      BN_ucmp(sig->s, order) >= 0 ||
       !ec_bignum_to_scalar(group, &s, sig->s)) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
     goto err;
@@ -212,26 +251,21 @@ int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
   // the products below.
   int no_inverse;
   if (!BN_mod_inverse_odd(X, &no_inverse, sig->s, order, ctx) ||
-      !ec_bignum_to_scalar(group, &s_inv_mont, X) ||
-      !bn_to_montgomery_small(s_inv_mont.words, order->top, s_inv_mont.words,
-                              order->top, group->order_mont)) {
+      // TODO(davidben): Add a words version of |BN_mod_inverse_odd| and write
+      // into |s_inv_mont| directly.
+      !ec_bignum_to_scalar_unchecked(group, &s_inv_mont, X) ||
+      !bn_to_montgomery_small(s_inv_mont.words, order->width, s_inv_mont.words,
+                              order->width, group->order_mont)) {
     goto err;
   }
-  // u1 = m * s_inv_mont mod order
-  // u2 = r * s_inv_mont mod order
+  // u1 = m * s^-1 mod order
+  // u2 = r * s^-1 mod order
   //
   // |s_inv_mont| is in Montgomery form while |m| and |r| are not, so |u1| and
-  // |u2| will be taken out of Montgomery form, as desired. Note that, although
-  // |m| is not fully reduced, |bn_mod_mul_montgomery_small| only requires the
-  // product not exceed R * |order|. |s_inv_mont| is fully reduced and |m| <
-  // 2^BN_num_bits(order) <= R, so this holds.
+  // |u2| will be taken out of Montgomery form, as desired.
   digest_to_scalar(group, &m, digest, digest_len);
-  if (!bn_mod_mul_montgomery_small(u1.words, order->top, m.words, order->top,
-                                   s_inv_mont.words, order->top,
-                                   group->order_mont) ||
-      !bn_mod_mul_montgomery_small(u2.words, order->top, r.words, order->top,
-                                   s_inv_mont.words, order->top,
-                                   group->order_mont)) {
+  if (!scalar_mod_mul_montgomery_loose(group, &u1, &m, &s_inv_mont) ||
+      !scalar_mod_mul_montgomery(group, &u2, &r, &s_inv_mont)) {
     goto err;
   }
 
@@ -240,7 +274,7 @@ int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_MALLOC_FAILURE);
     goto err;
   }
-  if (!ec_point_mul_scalar(group, point, &u1, pub_key, &u2, ctx)) {
+  if (!ec_point_mul_scalar_public(group, point, &u1, pub_key, &u2, ctx)) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_EC_LIB);
     goto err;
   }
@@ -308,7 +342,7 @@ static int ecdsa_sign_setup(const EC_KEY *eckey, BN_CTX *ctx,
       SHA512_CTX sha;
       uint8_t additional_data[SHA512_DIGEST_LENGTH];
       SHA512_Init(&sha);
-      SHA512_Update(&sha, priv_key->words, order->top * sizeof(BN_ULONG));
+      SHA512_Update(&sha, priv_key->words, order->width * sizeof(BN_ULONG));
       SHA512_Update(&sha, digest, digest_len);
       SHA512_Final(additional_data, &sha);
       if (!ec_random_nonzero_scalar(group, &k, additional_data)) {
@@ -318,10 +352,10 @@ static int ecdsa_sign_setup(const EC_KEY *eckey, BN_CTX *ctx,
 
     // Compute k^-1. We leave it in the Montgomery domain as an optimization for
     // later operations.
-    if (!bn_to_montgomery_small(out_kinv_mont->words, order->top, k.words,
-                                order->top, group->order_mont) ||
-        !bn_mod_inverse_prime_mont_small(out_kinv_mont->words, order->top,
-                                         out_kinv_mont->words, order->top,
+    if (!bn_to_montgomery_small(out_kinv_mont->words, order->width, k.words,
+                                order->width, group->order_mont) ||
+        !bn_mod_inverse_prime_mont_small(out_kinv_mont->words, order->width,
+                                         out_kinv_mont->words, order->width,
                                          group->order_mont)) {
       goto err;
     }
@@ -358,64 +392,47 @@ ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
   }
 
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
-  const BIGNUM *priv_key_bn = EC_KEY_get0_private_key(eckey);
-  if (group == NULL || priv_key_bn == NULL) {
+  if (group == NULL || eckey->priv_key == NULL) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
     return NULL;
   }
   const BIGNUM *order = EC_GROUP_get0_order(group);
+  const EC_SCALAR *priv_key = &eckey->priv_key->scalar;
 
   int ok = 0;
   ECDSA_SIG *ret = ECDSA_SIG_new();
   BN_CTX *ctx = BN_CTX_new();
-  EC_SCALAR kinv_mont, priv_key, r_mont, s, tmp, m;
+  EC_SCALAR kinv_mont, r_mont, s;
+  EC_LOOSE_SCALAR m, tmp;
   if (ret == NULL || ctx == NULL) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_MALLOC_FAILURE);
     return NULL;
   }
 
   digest_to_scalar(group, &m, digest, digest_len);
-  if (!ec_bignum_to_scalar(group, &priv_key, priv_key_bn)) {
-    goto err;
-  }
   for (;;) {
     if (!ecdsa_sign_setup(eckey, ctx, &kinv_mont, &ret->r, digest, digest_len,
-                          &priv_key)) {
+                          priv_key)) {
       goto err;
     }
 
     // Compute priv_key * r (mod order). Note if only one parameter is in the
-    // Montgomery domain, |bn_mod_mul_montgomery_small| will compute the answer
-    // in the normal domain.
+    // Montgomery domain, |scalar_mod_mul_montgomery| will compute the answer in
+    // the normal domain.
     if (!ec_bignum_to_scalar(group, &r_mont, ret->r) ||
-        !bn_to_montgomery_small(r_mont.words, order->top, r_mont.words,
-                                order->top, group->order_mont) ||
-        !bn_mod_mul_montgomery_small(s.words, order->top, priv_key.words,
-                                     order->top, r_mont.words, order->top,
-                                     group->order_mont)) {
+        !bn_to_montgomery_small(r_mont.words, order->width, r_mont.words,
+                                order->width, group->order_mont) ||
+        !scalar_mod_mul_montgomery(group, &s, priv_key, &r_mont)) {
       goto err;
     }
 
-    // Compute s += m in constant time. Reduce one copy of |order| if necessary.
-    // Note this does not leave |s| fully reduced. We have
-    // |m| < 2^BN_num_bits(order), so subtracting |order| leaves
-    // 0 <= |s| < 2^BN_num_bits(order).
-    BN_ULONG carry = bn_add_words(s.words, s.words, m.words, order->top);
-    BN_ULONG v = bn_sub_words(tmp.words, s.words, order->d, order->top) - carry;
-    v = 0u - v;
-    for (int i = 0; i < order->top; i++) {
-      s.words[i] = constant_time_select_w(v, s.words[i], tmp.words[i]);
-    }
+    // Compute tmp = m + priv_key * r.
+    scalar_add_loose(group, &tmp, &m, &s);
 
     // Finally, multiply s by k^-1. That was retained in Montgomery form, so the
-    // same technique as the previous multiplication works. Although the
-    // previous step did not fully reduce |s|, |bn_mod_mul_montgomery_small|
-    // only requires the product not exceed R * |order|. |kinv_mont| is fully
-    // reduced and |s| < 2^BN_num_bits(order) <= R, so this holds.
-    if (!bn_mod_mul_montgomery_small(s.words, order->top, s.words, order->top,
-                                     kinv_mont.words, order->top,
-                                     group->order_mont) ||
-        !bn_set_words(ret->s, s.words, order->top)) {
+    // same technique as the previous multiplication works.
+    if (!scalar_mod_mul_montgomery_loose(group, &s, &tmp, &kinv_mont) ||
+        !bn_set_words(ret->s, s.words, order->width)) {
       goto err;
     }
     if (!BN_is_zero(ret->s)) {
@@ -433,7 +450,6 @@ err:
   }
   BN_CTX_free(ctx);
   OPENSSL_cleanse(&kinv_mont, sizeof(kinv_mont));
-  OPENSSL_cleanse(&priv_key, sizeof(priv_key));
   OPENSSL_cleanse(&r_mont, sizeof(r_mont));
   OPENSSL_cleanse(&s, sizeof(s));
   OPENSSL_cleanse(&tmp, sizeof(tmp));

data/third_party/boringssl/crypto/fipsmodule/modes/ccm.c

@@ -0,0 +1,256 @@
+/* ====================================================================
+ * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/cpu.h>
+#include <openssl/mem.h>
+
+#include "../../internal.h"
+#include "internal.h"
+
+
+struct ccm128_state {
+  union {
+    uint64_t u[2];
+    uint8_t c[16];
+  } nonce, cmac;
+};
+
+int CRYPTO_ccm128_init(CCM128_CONTEXT *ctx, const void *key, block128_f block,
+                       ctr128_f ctr, unsigned M, unsigned L) {
+  if (M < 4 || M > 16 || (M & 1) != 0 || L < 2 || L > 8) {
+    return 0;
+  }
+  ctx->block = block;
+  ctx->ctr = ctr;
+  ctx->M = M;
+  ctx->L = L;
+  return 1;
+}
+
+size_t CRYPTO_ccm128_max_input(const CCM128_CONTEXT *ctx) {
+  return ctx->L >= sizeof(size_t) ? (size_t)-1
+                                  : (((size_t)1) << (ctx->L * 8)) - 1;
+}
+
+static int ccm128_init_state(const CCM128_CONTEXT *ctx,
+                             struct ccm128_state *state, const void *key,
+                             const uint8_t *nonce, size_t nonce_len,
+                             const uint8_t *aad, size_t aad_len,
+                             size_t plaintext_len) {
+  const block128_f block = ctx->block;
+  const unsigned M = ctx->M;
+  const unsigned L = ctx->L;
+
+  // |L| determines the expected |nonce_len| and the limit for |plaintext_len|.
+  if (plaintext_len > CRYPTO_ccm128_max_input(ctx) ||
+      nonce_len != 15 - L) {
+    return 0;
+  }
+
+  // Assemble the first block for computing the MAC.
+  OPENSSL_memset(state, 0, sizeof(*state));
+  state->nonce.c[0] = (uint8_t)((L - 1) | ((M - 2) / 2) << 3);
+  if (aad_len != 0) {
+    state->nonce.c[0] |= 0x40;  // Set AAD Flag
+  }
+  OPENSSL_memcpy(&state->nonce.c[1], nonce, nonce_len);
+  for (unsigned i = 0; i < L; i++) {
+    state->nonce.c[15 - i] = (uint8_t)(plaintext_len >> (8 * i));
+  }
+
+  (*block)(state->nonce.c, state->cmac.c, key);
+  size_t blocks = 1;
+
+  if (aad_len != 0) {
+    unsigned i;
+    // Cast to u64 to avoid the compiler complaining about invalid shifts.
+    uint64_t aad_len_u64 = aad_len;
+    if (aad_len_u64 < 0x10000 - 0x100) {
+      state->cmac.c[0] ^= (uint8_t)(aad_len_u64 >> 8);
+      state->cmac.c[1] ^= (uint8_t)aad_len_u64;
+      i = 2;
+    } else if (aad_len_u64 <= 0xffffffff) {
+      state->cmac.c[0] ^= 0xff;
+      state->cmac.c[1] ^= 0xfe;
+      state->cmac.c[2] ^= (uint8_t)(aad_len_u64 >> 24);
+      state->cmac.c[3] ^= (uint8_t)(aad_len_u64 >> 16);
+      state->cmac.c[4] ^= (uint8_t)(aad_len_u64 >> 8);
+      state->cmac.c[5] ^= (uint8_t)aad_len_u64;
+      i = 6;
+    } else {
+      state->cmac.c[0] ^= 0xff;
+      state->cmac.c[1] ^= 0xff;
+      state->cmac.c[2] ^= (uint8_t)(aad_len_u64 >> 56);
+      state->cmac.c[3] ^= (uint8_t)(aad_len_u64 >> 48);
+      state->cmac.c[4] ^= (uint8_t)(aad_len_u64 >> 40);
+      state->cmac.c[5] ^= (uint8_t)(aad_len_u64 >> 32);
+      state->cmac.c[6] ^= (uint8_t)(aad_len_u64 >> 24);
+      state->cmac.c[7] ^= (uint8_t)(aad_len_u64 >> 16);
+      state->cmac.c[8] ^= (uint8_t)(aad_len_u64 >> 8);
+      state->cmac.c[9] ^= (uint8_t)aad_len_u64;
+      i = 10;
+    }
+
+    do {
+      for (; i < 16 && aad_len != 0; i++) {
+        state->cmac.c[i] ^= *aad;
+        aad++;
+        aad_len--;
+      }
+      (*block)(state->cmac.c, state->cmac.c, key);
+      blocks++;
+      i = 0;
+    } while (aad_len != 0);
+  }
+
+  // Per RFC 3610, section 2.6, the total number of block cipher operations done
+  // must not exceed 2^61. There are two block cipher operations remaining per
+  // message block, plus one block at the end to encrypt the MAC.
+  size_t remaining_blocks = 2 * ((plaintext_len + 15) / 16) + 1;
+  if (plaintext_len + 15 < plaintext_len ||
+      remaining_blocks + blocks < blocks ||
+      (uint64_t) remaining_blocks + blocks > UINT64_C(1) << 61) {
+    return 0;
+  }
+
+  // Assemble the first block for encrypting and decrypting. The bottom |L|
+  // bytes are replaced with a counter and all bit the encoding of |L| is
+  // cleared in the first byte.
+  state->nonce.c[0] &= 7;
+  return 1;
+}
+
+static int ccm128_encrypt(const CCM128_CONTEXT *ctx, struct ccm128_state *state,
+                          const void *key, uint8_t *out, const uint8_t *in,
+                          size_t len) {
+  // The counter for encryption begins at one.
+  for (unsigned i = 0; i < ctx->L; i++) {
+    state->nonce.c[15 - i] = 0;
+  }
+  state->nonce.c[15] = 1;
+
+  uint8_t partial_buf[16];
+  unsigned num = 0;
+  if (ctx->ctr != NULL) {
+    CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, state->nonce.c, partial_buf,
+                                &num, ctx->ctr);
+  } else {
+    CRYPTO_ctr128_encrypt(in, out, len, key, state->nonce.c, partial_buf, &num,
+                          ctx->block);
+  }
+  return 1;
+}
+
+static int ccm128_compute_mac(const CCM128_CONTEXT *ctx,
+                              struct ccm128_state *state, const void *key,
+                              uint8_t *out_tag, size_t tag_len,
+                              const uint8_t *in, size_t len) {
+  block128_f block = ctx->block;
+  if (tag_len != ctx->M) {
+    return 0;
+  }
+
+  // Incorporate |in| into the MAC.
+  union {
+    uint64_t u[2];
+    uint8_t c[16];
+  } tmp;
+  while (len >= 16) {
+    OPENSSL_memcpy(tmp.c, in, 16);
+    state->cmac.u[0] ^= tmp.u[0];
+    state->cmac.u[1] ^= tmp.u[1];
+    (*block)(state->cmac.c, state->cmac.c, key);
+    in += 16;
+    len -= 16;
+  }
+  if (len > 0) {
+    for (size_t i = 0; i < len; i++) {
+      state->cmac.c[i] ^= in[i];
+    }
+    (*block)(state->cmac.c, state->cmac.c, key);
+  }
+
+  // Encrypt the MAC with counter zero.
+  for (unsigned i = 0; i < ctx->L; i++) {
+    state->nonce.c[15 - i] = 0;
+  }
+  (*block)(state->nonce.c, tmp.c, key);
+  state->cmac.u[0] ^= tmp.u[0];
+  state->cmac.u[1] ^= tmp.u[1];
+
+  OPENSSL_memcpy(out_tag, state->cmac.c, tag_len);
+  return 1;
+}
+
+int CRYPTO_ccm128_encrypt(const CCM128_CONTEXT *ctx, const void *key,
+                          uint8_t *out, uint8_t *out_tag, size_t tag_len,
+                          const uint8_t *nonce, size_t nonce_len,
+                          const uint8_t *in, size_t len, const uint8_t *aad,
+                          size_t aad_len) {
+  struct ccm128_state state;
+  return ccm128_init_state(ctx, &state, key, nonce, nonce_len, aad, aad_len,
+                           len) &&
+         ccm128_compute_mac(ctx, &state, key, out_tag, tag_len, in, len) &&
+         ccm128_encrypt(ctx, &state, key, out, in, len);
+}
+
+int CRYPTO_ccm128_decrypt(const CCM128_CONTEXT *ctx, const void *key,
+                          uint8_t *out, uint8_t *out_tag, size_t tag_len,
+                          const uint8_t *nonce, size_t nonce_len,
+                          const uint8_t *in, size_t len, const uint8_t *aad,
+                          size_t aad_len) {
+  struct ccm128_state state;
+  return ccm128_init_state(ctx, &state, key, nonce, nonce_len, aad, aad_len,
+                           len) &&
+         ccm128_encrypt(ctx, &state, key, out, in, len) &&
+         ccm128_compute_mac(ctx, &state, key, out_tag, tag_len, out, len);
+}