ica_3des_ctr

Purpose

Encrypt or decrypt data with a triple-length DES key using Counter (CTR) mode, as described in NIST Special Publication 800-38A Chapter 6.5. With the counter mode, each message block of size cipher block size (8 bytes for 3DES) is combined with a counter value of the same size during encryption and decryption.

Starting with an initial counter value to be combined with the first message block, subsequent counter values to be combined with subsequent message blocks are derived from preceding counter values by an increment function. The increment function used in ica_3des_ctr is an arithmetic increment without carry on the M least significant bits in the counter, where M is a parameter to ica_3des_ctr.

Required hardware support

KMCTR-TDEA-192

Parameters

const unsigned char *in_data

Pointer to a readable buffer that contains the message to be encrypted or decrypted. The size of the message in bytes is data_length. The size of this buffer must be at least as large as data_length.

unsigned char *out_data

Pointer to a writable buffer to contain the resulting encrypted or decrypted message. The size of this buffer in bytes must be at least as large as data_length.

unsigned long data_length

Length in bytes of the message to be encrypted or decrypted, which resides at the beginning of in_data.

const unsigned char *key

Pointer to a valid 3DES key of 24 bytes in length.

unsigned char *ctr

Pointer to a readable and writable buffer of the same size as the cipher block in bytes. ctr contains an initialization value for a counter function that is replaced by a new value. The new value can be used as an initialization value for a counter function in a chained ica_3des_ctr call with the same key, if the data_length used in the preceding call is a multiple of the cipher block size.

unsigned int ctr_width

A number M between 8 and the cipher block size in bits. The value is used by the counter increment function, which increments a counter value by incrementing without carry the least significant M bits of the counter value. The value must be a multiple of 8 and smaller than 64. When in FIPS mode, an additional counter overflow check is performed, so that the given data length divided by 64 is not greater than 2^M.

unsigned int direction

0

Use the decrypt function.

1

Use the encrypt function.

Return codes

0

Success

For return codes indicating exceptions, see Return codes.