[gentoo-commits] gentoo-x86 commit in dev-libs/libgcrypt/files: libgcrypt-1.5.0_beta1-ctr.patch

[Arfrever Frehtes Taifersar Arahesis (arfrever)]

arfrever    11/05/01 16:04:19

  Added:                libgcrypt-1.5.0_beta1-ctr.patch
  Log:
  Backport changes in CTR mode (bug #356325).
  
  (Portage version: 2.2.0_alpha30_p25/cvs/Linux x86_64)

Revision  Changes    Path
1.1                  dev-libs/libgcrypt/files/libgcrypt-1.5.0_beta1-ctr.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libgcrypt/files/libgcrypt-1.5.0_beta1-ctr.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libgcrypt/files/libgcrypt-1.5.0_beta1-ctr.patch?rev=1.1&content-type=text/plain

Index: libgcrypt-1.5.0_beta1-ctr.patch
===================================================================
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=2674140cdfdc59ce5ad0238177da1542f5df6e00
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=3c18377a55085faf4df745034056bac53565effa

--- cipher/cipher.c
+++ cipher/cipher.c
@@ -190,6 +190,9 @@
     void (*cbc_dec)(void *context, unsigned char *iv,
                     void *outbuf_arg, const void *inbuf_arg,
                     unsigned int nblocks);
+    void (*ctr_enc)(void *context, unsigned char *iv,
+                    void *outbuf_arg, const void *inbuf_arg,
+                    unsigned int nblocks);
   } bulk;
 
 
@@ -209,12 +212,16 @@
     unsigned char iv[MAX_BLOCKSIZE];
   } u_iv;
 
+  /* The counter for CTR mode.  This field is also used by AESWRAP and
+     thus we can't use the U_IV union.  */
+  union {
+    cipher_context_alignment_t iv_align;
+    unsigned char ctr[MAX_BLOCKSIZE];
+  } u_ctr;
+
   unsigned char lastiv[MAX_BLOCKSIZE];
   int unused;  /* Number of unused bytes in the IV. */
 
-  unsigned char ctr[MAX_BLOCKSIZE];     /* For Counter (CTR) mode. */
-
-
   /* What follows are two contexts of the cipher in use.  The first
      one needs to be aligned well enough for the cipher operation
      whereas the second one is a copy created by cipher_setkey and
@@ -814,6 +821,7 @@
               h->bulk.cfb_dec = _gcry_aes_cfb_dec;
               h->bulk.cbc_enc = _gcry_aes_cbc_enc;
               h->bulk.cbc_dec = _gcry_aes_cbc_dec;
+              h->bulk.ctr_enc = _gcry_aes_ctr_enc;
               break;
 #endif /*USE_AES*/
 
@@ -936,7 +944,7 @@
   memset (&c->marks, 0, sizeof c->marks);
   memset (c->u_iv.iv, 0, c->cipher->blocksize);
   memset (c->lastiv, 0, c->cipher->blocksize);
-  memset (c->ctr, 0, c->cipher->blocksize);
+  memset (c->u_ctr.ctr, 0, c->cipher->blocksize);
 }
 
 
@@ -1441,35 +1449,50 @@
                 const unsigned char *inbuf, unsigned int inbuflen)
 {
   unsigned int n;
-  unsigned char tmp[MAX_BLOCKSIZE];
   int i;
   unsigned int blocksize = c->cipher->blocksize;
+  unsigned int nblocks;
 
   if (outbuflen < inbuflen)
     return GPG_ERR_BUFFER_TOO_SHORT;
 
-  if ((inbuflen % blocksize))
-    return GPG_ERR_INV_LENGTH;
+  /* Use a bulk method if available.  */
+  nblocks = inbuflen / blocksize;
+  if (nblocks && c->bulk.ctr_enc)
+    {
+      c->bulk.ctr_enc (&c->context.c, c->u_ctr.ctr, outbuf, inbuf, nblocks);
+      inbuf  += nblocks * blocksize;
+      outbuf += nblocks * blocksize;
+      inbuflen -= nblocks * blocksize;
+    }
 
-  for (n=0; n < inbuflen; n++)
+  /* If we don't have a bulk method use the standard method.  We also
+     use this method for the a remaining partial block.  */
+  if (inbuflen)
     {
-      if ((n % blocksize) == 0)
-	{
-	  c->cipher->encrypt (&c->context.c, tmp, c->ctr);
+      unsigned char tmp[MAX_BLOCKSIZE];
 
-	  for (i = blocksize; i > 0; i--)
-	    {
-	      c->ctr[i-1]++;
-	      if (c->ctr[i-1] != 0)
-		break;
-	    }
-	}
+      for (n=0; n < inbuflen; n++)
+        {
+          if ((n % blocksize) == 0)
+            {
+              c->cipher->encrypt (&c->context.c, tmp, c->u_ctr.ctr);
+
+              for (i = blocksize; i > 0; i--)
+                {
+                  c->u_ctr.ctr[i-1]++;
+                  if (c->u_ctr.ctr[i-1] != 0)
+                    break;
+                }
+            }
+
+          /* XOR input with encrypted counter and store in output.  */
+          outbuf[n] = inbuf[n] ^ tmp[n % blocksize];
+        }
 
-      /* XOR input with encrypted counter and store in output.  */
-      outbuf[n] = inbuf[n] ^ tmp[n % blocksize];
+      wipememory (tmp, sizeof tmp);
     }
 
-  wipememory (tmp, sizeof tmp);
   return 0;
 }
 
@@ -1517,7 +1540,7 @@
 
   r = outbuf;
   a = outbuf;  /* We store A directly in OUTBUF.  */
-  b = c->ctr;  /* B is also used to concatenate stuff.  */
+  b = c->u_ctr.ctr;  /* B is also used to concatenate stuff.  */
 
   /* If an IV has been set we use that IV as the Alternative Initial
      Value; if it has not been set we use the standard value.  */
@@ -1593,7 +1616,7 @@
 
   r = outbuf;
   a = c->lastiv;  /* We use c->LASTIV as buffer for A.  */
-  b = c->ctr;     /* B is also used to concatenate stuff.  */
+  b = c->u_ctr.ctr;     /* B is also used to concatenate stuff.  */
 
   /* Copy the inbuf to the outbuf and save A. */
   memcpy (a, inbuf, 8);
@@ -1861,9 +1884,9 @@
 _gcry_cipher_setctr (gcry_cipher_hd_t hd, const void *ctr, size_t ctrlen)
 {
   if (ctr && ctrlen == hd->cipher->blocksize)
-    memcpy (hd->ctr, ctr, hd->cipher->blocksize);
+    memcpy (hd->u_ctr.ctr, ctr, hd->cipher->blocksize);
   else if (!ctr || !ctrlen)
-    memset (hd->ctr, 0, hd->cipher->blocksize);
+    memset (hd->u_ctr.ctr, 0, hd->cipher->blocksize);
   else
     return gpg_error (GPG_ERR_INV_ARG);
   return 0;
@@ -1923,9 +1946,9 @@
 
     case GCRYCTL_SET_CTR: /* Deprecated; use gcry_cipher_setctr.  */
       if (buffer && buflen == h->cipher->blocksize)
-	memcpy (h->ctr, buffer, h->cipher->blocksize);
+	memcpy (h->u_ctr.ctr, buffer, h->cipher->blocksize);
       else if (buffer == NULL || buflen == 0)
-	memset (h->ctr, 0, h->cipher->blocksize);
+	memset (h->u_ctr.ctr, 0, h->cipher->blocksize);
       else
 	rc = GPG_ERR_INV_ARG;
       break;
--- cipher/rijndael.c
+++ cipher/rijndael.c
@@ -90,9 +90,7 @@
 #endif
 
 
-static const char *selftest(void);
-
-
+
 /* Our context object.  */
 typedef struct
 {
@@ -144,6 +142,11 @@
   do { asm volatile ("pxor %%xmm0, %%xmm0\n\t"                          \
                      "pxor %%xmm1, %%xmm1\n" :: );                      \
   } while (0)
+# define aesni_cleanup_2_4()                                            \
+  do { asm volatile ("pxor %%xmm2, %%xmm2\n\t"                          \
+                     "pxor %%xmm3, %%xmm3\n"                            \
+                     "pxor %%xmm4, %%xmm4\n":: );                       \
+  } while (0)
 #else
 # define aesni_prepare() do { } while (0)
 # define aesni_cleanup() do { } while (0)
@@ -154,6 +157,23 @@
 #include "rijndael-tables.h"
 
 
+
+/* Function prototypes.  */
+#ifdef USE_AESNI
+/* We don't want to inline these functions to help gcc allocate enough
+   registers.  */
+static void do_aesni_ctr (const RIJNDAEL_context *ctx, unsigned char *ctr,
+                          unsigned char *b, const unsigned char *a)
+  __attribute__ ((__noinline__));
+static void do_aesni_ctr_4 (const RIJNDAEL_context *ctx, unsigned char *ctr,
+                            unsigned char *b, const unsigned char *a)
+  __attribute__ ((__noinline__));
+#endif /*USE_AESNI*/
+
+static const char *selftest(void);
+
+
+
 /* Perform the key setup.  */
 static gcry_err_code_t
 do_setkey (RIJNDAEL_context *ctx, const byte *key, const unsigned keylen)
@@ -272,7 +292,7 @@
   else if (ctx->use_aesni && ctx->rounds == 10)
     {
       /* Note: This code works for AES-128 but it is not much better
-         than than using the standard key schedule.  We disable it for
+         than using the standard key schedule.  We disable it for
          now and don't put any effort into implementing this for
          AES-192 and AES-256.  */
       asm volatile ("movl   %[key], %%esi\n\t"
@@ -860,6 +880,239 @@
 #undef aesenclast_xmm1_xmm0
 }
 
+/* Perform a CTR encryption round using the counter CTR and the input
+   block A.  Write the result to the output block B and update CTR.
+   CTR needs to be a 16 byte aligned little-endian value.  */
+static void
+do_aesni_ctr (const RIJNDAEL_context *ctx,
+              unsigned char *ctr, unsigned char *b, const unsigned char *a)
+{
+#define aesenc_xmm1_xmm0      ".byte 0x66, 0x0f, 0x38, 0xdc, 0xc1\n\t"
+#define aesenclast_xmm1_xmm0  ".byte 0x66, 0x0f, 0x38, 0xdd, 0xc1\n\t"
+  static unsigned char be_mask[16] __attribute__ ((aligned (16))) =
+    { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 };
+
+  asm volatile ("movdqa %[ctr], %%xmm0\n\t"     /* xmm0, xmm2 := CTR   */
+                "movaps %%xmm0, %%xmm2\n\t"
+                "mov    $1, %%esi\n\t"          /* xmm2++ (big-endian) */
+                "movd   %%esi, %%xmm1\n\t"
+                "pshufb %[mask], %%xmm2\n\t"
+                "paddq  %%xmm1, %%xmm2\n\t"
+                "pshufb %[mask], %%xmm2\n\t"
+                "movdqa %%xmm2, %[ctr]\n"       /* Update CTR.         */
+
+                "movl   %[key], %%esi\n\t"      /* esi  := keyschenc */
+                "movdqa (%%esi), %%xmm1\n\t"    /* xmm1 := key[0]    */
+                "pxor   %%xmm1, %%xmm0\n\t"     /* xmm0 ^= key[0]    */
+                "movdqa 0x10(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x20(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x30(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x40(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x50(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x60(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x70(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x80(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0x90(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0xa0(%%esi), %%xmm1\n\t"
+                "cmp $10, %[rounds]\n\t"
+                "jz .Lenclast%=\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0xb0(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0xc0(%%esi), %%xmm1\n\t"
+                "cmp $12, %[rounds]\n\t"
+                "jz .Lenclast%=\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0xd0(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                "movdqa 0xe0(%%esi), %%xmm1\n"
+
+                ".Lenclast%=:\n\t"
+                aesenclast_xmm1_xmm0
+                "movdqu %[src], %%xmm1\n\t"      /* xmm1 := input   */
+                "pxor %%xmm1, %%xmm0\n\t"        /* EncCTR ^= input  */
+                "movdqu %%xmm0, %[dst]"          /* Store EncCTR.    */
+
+                : [ctr] "+m" (*ctr), [dst] "=m" (*b)
+                : [src] "m" (*a),
+                  [key] "g" (ctx->keyschenc),
+                  [rounds] "g" (ctx->rounds),
+                  [mask] "m" (*be_mask)
+                : "%esi", "cc", "memory");
+#undef aesenc_xmm1_xmm0
+#undef aesenclast_xmm1_xmm0
+}
+
+
+/* Four blocks at a time variant of do_aesni_ctr.  */
+static void
+do_aesni_ctr_4 (const RIJNDAEL_context *ctx,
+                unsigned char *ctr, unsigned char *b, const unsigned char *a)
+{
+#define aesenc_xmm1_xmm0      ".byte 0x66, 0x0f, 0x38, 0xdc, 0xc1\n\t"
+#define aesenc_xmm1_xmm2      ".byte 0x66, 0x0f, 0x38, 0xdc, 0xd1\n\t"
+#define aesenc_xmm1_xmm3      ".byte 0x66, 0x0f, 0x38, 0xdc, 0xd9\n\t"
+#define aesenc_xmm1_xmm4      ".byte 0x66, 0x0f, 0x38, 0xdc, 0xe1\n\t"
+#define aesenclast_xmm1_xmm0  ".byte 0x66, 0x0f, 0x38, 0xdd, 0xc1\n\t"
+#define aesenclast_xmm1_xmm2  ".byte 0x66, 0x0f, 0x38, 0xdd, 0xd1\n\t"
+#define aesenclast_xmm1_xmm3  ".byte 0x66, 0x0f, 0x38, 0xdd, 0xd9\n\t"
+#define aesenclast_xmm1_xmm4  ".byte 0x66, 0x0f, 0x38, 0xdd, 0xe1\n\t"
+
+  static unsigned char be_mask[16] __attribute__ ((aligned (16))) =
+    { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 };
+
+  /* Register usage:
+      esi   keyschedule
+      xmm0  CTR-0
+      xmm1  temp / round key
+      xmm2  CTR-1
+      xmm3  CTR-2
+      xmm4  CTR-3
+      xmm5  temp
+   */
+
+  asm volatile ("movdqa %[ctr], %%xmm0\n\t"     /* xmm0, xmm2 := CTR   */
+                "movaps %%xmm0, %%xmm2\n\t"
+                "mov    $1, %%esi\n\t"          /* xmm1 := 1 */
+                "movd   %%esi, %%xmm1\n\t"
+                "pshufb %[mask], %%xmm2\n\t"    /* xmm2 := le(xmm2) */
+                "paddq  %%xmm1, %%xmm2\n\t"     /* xmm2++           */
+                "movaps %%xmm2, %%xmm3\n\t"     /* xmm3 := xmm2     */
+                "paddq  %%xmm1, %%xmm3\n\t"     /* xmm3++           */
+                "movaps %%xmm3, %%xmm4\n\t"     /* xmm4 := xmm3     */
+                "paddq  %%xmm1, %%xmm4\n\t"     /* xmm4++           */
+                "movaps %%xmm4, %%xmm5\n\t"     /* xmm5 := xmm4     */
+                "paddq  %%xmm1, %%xmm5\n\t"     /* xmm5++           */
+                "pshufb %[mask], %%xmm2\n\t"    /* xmm2 := be(xmm2) */
+                "pshufb %[mask], %%xmm3\n\t"    /* xmm3 := be(xmm3) */
+                "pshufb %[mask], %%xmm4\n\t"    /* xmm4 := be(xmm4) */
+                "pshufb %[mask], %%xmm5\n\t"    /* xmm5 := be(xmm5) */
+                "movdqa %%xmm5, %[ctr]\n"       /* Update CTR.      */
+
+                "movl   %[key], %%esi\n\t"      /* esi  := keyschenc */
+                "movdqa (%%esi), %%xmm1\n\t"    /* xmm1 := key[0]    */
+                "pxor   %%xmm1, %%xmm0\n\t"     /* xmm0 ^= key[0]    */
+                "pxor   %%xmm1, %%xmm2\n\t"     /* xmm2 ^= key[0]    */
+                "pxor   %%xmm1, %%xmm3\n\t"     /* xmm3 ^= key[0]    */
+                "pxor   %%xmm1, %%xmm4\n\t"     /* xmm4 ^= key[0]    */
+                "movdqa 0x10(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x20(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x30(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x40(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x50(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x60(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x70(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x80(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0x90(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0xa0(%%esi), %%xmm1\n\t"
+                "cmp $10, %[rounds]\n\t"
+                "jz .Lenclast%=\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0xb0(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0xc0(%%esi), %%xmm1\n\t"
+                "cmp $12, %[rounds]\n\t"
+                "jz .Lenclast%=\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0xd0(%%esi), %%xmm1\n\t"
+                aesenc_xmm1_xmm0
+                aesenc_xmm1_xmm2
+                aesenc_xmm1_xmm3
+                aesenc_xmm1_xmm4
+                "movdqa 0xe0(%%esi), %%xmm1\n"
+
+                ".Lenclast%=:\n\t"
+                aesenclast_xmm1_xmm0
+                aesenclast_xmm1_xmm2
+                aesenclast_xmm1_xmm3
+                aesenclast_xmm1_xmm4
+
+                "movdqu %[src], %%xmm1\n\t"      /* Get block 1.      */
+                "pxor %%xmm1, %%xmm0\n\t"        /* EncCTR-1 ^= input */
+                "movdqu %%xmm0, %[dst]\n\t"      /* Store block 1     */
+
+                "movdqu (16)%[src], %%xmm1\n\t"  /* Get block 2.      */
+                "pxor %%xmm1, %%xmm2\n\t"        /* EncCTR-2 ^= input */
+                "movdqu %%xmm2, (16)%[dst]\n\t"  /* Store block 2.    */
+
+                "movdqu (32)%[src], %%xmm1\n\t"  /* Get block 3.      */
+                "pxor %%xmm1, %%xmm3\n\t"        /* EncCTR-3 ^= input */
+                "movdqu %%xmm3, (32)%[dst]\n\t"  /* Store block 3.    */
+
+                "movdqu (48)%[src], %%xmm1\n\t"  /* Get block 4.      */
+                "pxor %%xmm1, %%xmm4\n\t"        /* EncCTR-4 ^= input */
+                "movdqu %%xmm4, (48)%[dst]"      /* Store block 4.   */
+
+                : [ctr] "+m" (*ctr), [dst] "=m" (*b)
+                : [src] "m" (*a),
+                  [key] "g" (ctx->keyschenc),
+                  [rounds] "g" (ctx->rounds),
+                  [mask] "m" (*be_mask)
+                : "%esi", "cc", "memory");
+#undef aesenc_xmm1_xmm0
+#undef aesenc_xmm1_xmm2
+#undef aesenc_xmm1_xmm3
+#undef aesenc_xmm1_xmm4
+#undef aesenclast_xmm1_xmm0
+#undef aesenclast_xmm1_xmm2
+#undef aesenclast_xmm1_xmm3
+#undef aesenclast_xmm1_xmm4
+}
+
 
 static void
 do_aesni (RIJNDAEL_context *ctx, int decrypt_flag,
@@ -1014,6 +1267,69 @@
 
   _gcry_burn_stack (48 + 2*sizeof(int));
 }
+
+
+/* Bulk encryption of complete blocks in CTR mode.  Caller needs to
+   make sure that CTR is aligned on a 16 byte boundary if AESNI; the
+   minimum alignment is for an u32.  This function is only intended
+   for the bulk encryption feature of cipher.c.  CTR is expected to be
+   of size BLOCKSIZE. */
+void
+_gcry_aes_ctr_enc (void *context, unsigned char *ctr,
+                   void *outbuf_arg, const void *inbuf_arg,
+                   unsigned int nblocks)
+{
+  RIJNDAEL_context *ctx = context;
+  unsigned char *outbuf = outbuf_arg;
+  const unsigned char *inbuf = inbuf_arg;
+  unsigned char *p;
+  int i;
+
+  if (0)
+    ;
+#ifdef USE_AESNI
+  else if (ctx->use_aesni)
+    {
+      aesni_prepare ();
+      for ( ;nblocks > 3 ; nblocks -= 4 )
+        {
+          do_aesni_ctr_4 (ctx, ctr, outbuf, inbuf);
+          outbuf += 4*BLOCKSIZE;
+          inbuf  += 4*BLOCKSIZE;
+        }
+      for ( ;nblocks; nblocks-- )
+        {
+          do_aesni_ctr (ctx, ctr, outbuf, inbuf);
+          outbuf += BLOCKSIZE;
+          inbuf  += BLOCKSIZE;
+        }
+      aesni_cleanup ();
+      aesni_cleanup_2_4 ();
+    }
+#endif /*USE_AESNI*/
+  else
+    {
+      union { unsigned char x1[16]; u32 x32[4]; } tmp;
+
+      for ( ;nblocks; nblocks-- )
+        {
+          /* Encrypt the counter. */
+          do_encrypt_aligned (ctx, tmp.x1, ctr);
+          /* XOR the input with the encrypted counter and store in output.  */
+          for (p=tmp.x1, i=0; i < BLOCKSIZE; i++)
+            *outbuf++ = (*p++ ^= *inbuf++);
+          /* Increment the counter.  */
+          for (i = BLOCKSIZE; i > 0; i--)
+            {
+              ctr[i-1]++;
+              if (ctr[i-1])
+                break;
+            }
+        }
+    }
+
+  _gcry_burn_stack (48 + 2*sizeof(int));
+}
 
 
 
--- src/cipher.h
+++ src/cipher.h
@@ -53,6 +53,9 @@
 void _gcry_aes_cbc_dec (void *context, unsigned char *iv,
                         void *outbuf_arg, const void *inbuf_arg,
                         unsigned int nblocks);
+void _gcry_aes_ctr_enc (void *context, unsigned char *ctr,
+                        void *outbuf_arg, const void *inbuf_arg,
+                        unsigned int nblocks);
 
 
 /*-- dsa.c --*/
--- tests/basic.c
+++ tests/basic.c
@@ -69,6 +69,22 @@
 }
 
 static void
+mismatch (const void *expected, size_t expectedlen,
+          const void *computed, size_t computedlen)
+{
+  const unsigned char *p;
+
+  fprintf (stderr, "expected:");
+  for (p = expected; expectedlen; p++, expectedlen--)
+    fprintf (stderr, " %02x", *p);
+  fprintf (stderr, "\ncomputed:");
+  for (p = computed; computedlen; p++, computedlen--)
+    fprintf (stderr, " %02x", *p);
+  fprintf (stderr, "\n");
+}
+
+
+static void
 die (const char *format, ...)
 {
   va_list arg_ptr;
@@ -349,8 +365,7 @@
       unsigned char plaintext[MAX_DATA_LEN];
       int inlen;
       char out[MAX_DATA_LEN];
-    }
-    data[MAX_DATA_LEN];
+    } data[5];
   } tv[] =
     {
       /* http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf */
@@ -369,6 +384,8 @@
 	  { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
 	    16,
 	    "\x1e\x03\x1d\xda\x2f\xbe\x03\xd1\x79\x21\x70\xa0\xf3\x00\x9c\xee" },
+
+          { "", 0, "" }
 	}
       },
       {	GCRY_CIPHER_AES192,
@@ -387,6 +404,7 @@
 	  { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
 	    16,
 	    "\x4f\x78\xa7\xf6\xd2\x98\x09\x58\x5a\x97\xda\xec\x58\xc6\xb0\x50" },
+          { "", 0, "" }
 	}
       },
       {	GCRY_CIPHER_AES256,
@@ -404,7 +422,80 @@
 	    "\x2b\x09\x30\xda\xa2\x3d\xe9\x4c\xe8\x70\x17\xba\x2d\x84\x98\x8d" },
 	  { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
 	    16,
-	    "\xdf\xc9\xc5\x8d\xb6\x7a\xad\xa6\x13\xc2\xdd\x08\x45\x79\x41\xa6" }
+	    "\xdf\xc9\xc5\x8d\xb6\x7a\xad\xa6\x13\xc2\xdd\x08\x45\x79\x41\xa6" },
+          { "", 0, "" }
+	}
+      },
+      /* Some truncation tests.  With a truncated second block and
+         also with a single truncated block.  */
+      {	GCRY_CIPHER_AES,
+	"\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
+	"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+	{{"\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a",
+          16,
+          "\x87\x4d\x61\x91\xb6\x20\xe3\x26\x1b\xef\x68\x64\x99\x0d\xb6\xce" },
+         {"\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e",
+          15,
+          "\x98\x06\xf6\x6b\x79\x70\xfd\xff\x86\x17\x18\x7b\xb9\xff\xfd" },
+         {"", 0, "" }
+	}
+      },
+      {	GCRY_CIPHER_AES,
+	"\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
+	"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+	{{"\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a",
+          16,
+          "\x87\x4d\x61\x91\xb6\x20\xe3\x26\x1b\xef\x68\x64\x99\x0d\xb6\xce" },
+         {"\xae",
+          1,
+          "\x98" },
+         {"", 0, "" }
+	}
+      },
+      {	GCRY_CIPHER_AES,
+	"\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
+	"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+	{{"\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17",
+          15,
+          "\x87\x4d\x61\x91\xb6\x20\xe3\x26\x1b\xef\x68\x64\x99\x0d\xb6" },
+         {"", 0, "" }
+	}
+      },
+      {	GCRY_CIPHER_AES,
+	"\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
+	"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+	{{"\x6b",
+          1,
+          "\x87" },
+         {"", 0, "" }
+	}
+      },
+#if USE_CAST5
+      /* A selfmade test vector using an 64 bit block cipher.  */
+      {	GCRY_CIPHER_CAST5,
+	"\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
+	"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8",
+        {{"\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a",
+          16,
+          "\xe8\xa7\xac\x68\xca\xca\xa0\x20\x10\xcb\x1b\xcc\x79\x2c\xc4\x48" },
+         {"\xae\x2d\x8a\x57\x1e\x03\xac\x9c",
+          8,
+          "\x16\xe8\x72\x77\xb0\x98\x29\x68" },
+         {"\x9e\xb7\x6f\xac\x45\xaf\x8e\x51",
+          8,
+          "\x9a\xb3\xa8\x03\x3b\xb4\x14\xba" },
+         {"\xae\x2d\x8a\x57\x1e\x03\xac\x9c\xa1\x00",
+          10,
+          "\x31\x5e\xd3\xfb\x1b\x8d\xd1\xf9\xb0\x83" },
+         { "", 0, "" }
+	}
+      },
+#endif /*USE_CAST5*/
+      {	0,
+	"",
+	"",
+	{
+         {"", 0, "" }
 	}
       }
     };
@@ -417,6 +508,9 @@
     fprintf (stderr, "  Starting CTR cipher checks.\n");
   for (i = 0; i < sizeof (tv) / sizeof (tv[0]); i++)
     {
+      if (!tv[i].algo)
+        continue;
+
       err = gcry_cipher_open (&hde, tv[i].algo, GCRY_CIPHER_MODE_CTR, 0);
       if (!err)
 	err = gcry_cipher_open (&hdd, tv[i].algo, GCRY_CIPHER_MODE_CTR, 0);
@@ -485,7 +579,11 @@
 	    }
 
 	  if (memcmp (tv[i].data[j].out, out, tv[i].data[j].inlen))
-	    fail ("aes-ctr, encrypt mismatch entry %d:%d\n", i, j);
+            {
+              fail ("aes-ctr, encrypt mismatch entry %d:%d\n", i, j);
+              mismatch (tv[i].data[j].out, tv[i].data[j].inlen,
+                        out, tv[i].data[j].inlen);
+            }
 
 	  err = gcry_cipher_decrypt (hdd, out, tv[i].data[j].inlen, NULL, 0);
 	  if (err)
@@ -498,7 +596,11 @@
 	    }
 
 	  if (memcmp (tv[i].data[j].plaintext, out, tv[i].data[j].inlen))
-	    fail ("aes-ctr, decrypt mismatch entry %d:%d\n", i, j);
+            {
+              fail ("aes-ctr, decrypt mismatch entry %d:%d\n", i, j);
+              mismatch (tv[i].data[j].plaintext, tv[i].data[j].inlen,
+                        out, tv[i].data[j].inlen);
+            }
 
         }
 
@@ -509,18 +611,6 @@
       if (err)
         fail ("aes-ctr, encryption failed for valid input");
 
-      err = gcry_cipher_encrypt (hde, out, MAX_DATA_LEN,
-                                 "1234567890123456", 15);
-      if (gpg_err_code (err) != GPG_ERR_INV_LENGTH)
-        fail ("aes-ctr, too short input returned wrong error: %s\n",
-              gpg_strerror (err));
-
-      err = gcry_cipher_encrypt (hde, out, MAX_DATA_LEN,
-                                 "12345678901234567", 17);
-      if (gpg_err_code (err) != GPG_ERR_INV_LENGTH)
-        fail ("aes-ctr, too long input returned wrong error: %s\n",
-              gpg_strerror (err));
-
       err = gcry_cipher_encrypt (hde, out, 15,
                                  "1234567890123456", 16);
       if (gpg_err_code (err) != GPG_ERR_BUFFER_TOO_SHORT)
@@ -545,18 +635,6 @@
       if (err)
         fail ("aes-ctr, decryption failed for valid input");
 
-      err = gcry_cipher_decrypt (hde, out, MAX_DATA_LEN,
-                                 "1234567890123456", 15);
-      if (gpg_err_code (err) != GPG_ERR_INV_LENGTH)
-        fail ("aes-ctr, too short input returned wrong error: %s\n",
-              gpg_strerror (err));
-
-      err = gcry_cipher_decrypt (hde, out, MAX_DATA_LEN,
-                                 "12345678901234567", 17);
-      if (gpg_err_code (err) != GPG_ERR_INV_LENGTH)
-        fail ("aes-ctr, too long input returned wrong error: %s\n",
-              gpg_strerror (err));
-
       err = gcry_cipher_decrypt (hde, out, 15,
                                  "1234567890123456", 16);
       if (gpg_err_code (err) != GPG_ERR_BUFFER_TOO_SHORT)