Simplify polynomial doubling code

GCC and Clang generate effectively identical code for a template
with parameters, vs completely unrolled code as was used previously.

Add a little-endian variant so XTS can use it. This extends XTS support
to cover 256 and 512-bit ciphers. I was not able to find another
implementation that supports both XTS and ciphers with large blocks,
so the XTS test vectors are self-generated.

1 files changed, 3 insertions, 5 deletions

diff --git a/src/lib/mac/cmac/cmac.cpp b/src/lib/mac/cmac/cmac.cpp
index 4d76e4a20..665bfe3c0 100644
--- a/src/lib/mac/cmac/cmac.cpp
+++ b/src/lib/mac/cmac/cmac.cpp
@@ -15,8 +15,8 @@ namespace Botan {
 */
 secure_vector<uint8_t> CMAC::poly_double(const secure_vector<uint8_t>& in)
    {
-   secure_vector<uint8_t> out = in;
-   poly_double_n(out.data(), out.size());
+   secure_vector<uint8_t> out(in.size());
+   poly_double_n(out.data(), in.data(), out.size());
    return out;
    }
 
@@ -81,9 +81,7 @@ void CMAC::key_schedule(const uint8_t key[], size_t length)
    m_cipher->set_key(key, length);
    m_cipher->encrypt(m_B);
    poly_double_n(m_B.data(), m_B.size());
-
-   m_P = m_B;
-   poly_double_n(m_P.data(), m_P.size());
+   poly_double_n(m_P.data(), m_B.data(), m_P.size());
    }
 
 /*