nx_aes256_gcm.nx
buildroot/runtime/nx_aes256_gcm.nx
about
nx_aes256_gcm.nx -- canonical AES-256-GCM (AEAD) per NIST SP 800-38D + RFC 5288, the TLS_AES_256_GCM_SHA384
cipher-suite AEAD. COMPOSED (Cardinals 9/15/22): reuses nx_aes.nx's canonical S-box + round functions
(_aes_sub_bytes/_aes_shift_rows/_aes_mix_columns/_aes_add_round_key/_aes_sbox/_aes_rcon) and nx_ghash.nx's
GF(2^128)/GHASH VERBATIM -- AES-256 differs from AES-128 ONLY in the key schedule (32-byte key -> 240-byte
schedule, 15 round keys, extra SubWord at word%8==4) and 14 rounds. GHASH is key-size-independent so it is
unchanged. This is the "full cipher coverage" so we can complete a handshake whichever TLS-1.3 suite a
Cloudflare-class CDN picks (0x1301 AES-128-GCM / 0x1302 AES-256-GCM / 0x1303 ChaCha20) after JA3-mimicry.
96-bit IV form only (all TLS 1.3 uses). Correctness-first software path (no AES-NI-256); GHASH via the simple
Horner API. NIST SP 800-38D test vectors gated in nx_aes256_gcm_gate. license_tier: INDEPENDENT_REDERIVE
dependencies 3 imports · 2 importers
imports: nx_syscalls.nxnx_aes.nxnx_ghash.nx
imported by: nx_aes256_gcm_gate.nxnx_tls13_record.nx
structs
| none |
consts
| none |
functions
| 15 | func aes256_expand_key(key: *u8, out: *u8) -> i64 |
| 52 | func aes256_encrypt_block(in_block: *u8, sched: *u8, out_block: *u8) -> i64 |
| 70 | func gcm256_inc32(ctr: *u8) -> i64 |
| 83 | func gcm256_tag_eq(a: *u8, b: *u8) -> i64 called by 1: nx_aes256_gcm_open |
| 91 | func nx_aes256_gcm_seal(key32: *u8, iv12: *u8, aad: *u8, aad_len: i64, pt: *u8, pt_len: i64, ct_out: *u8, tag16_out: *u8) -> i64 |
| 118 | func nx_aes256_gcm_open(key32: *u8, iv12: *u8, aad: *u8, aad_len: i64, ct: *u8, ct_len: i64, tag16: *u8, pt_out: *u8) -> i64 |