feat: v0.1.0

.gitignore

@@ -0,0 +1,3 @@
+.idea/
+Cargo.lock
+target

Cargo.lock

@@ -1,70 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common",
- "inout",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "inout"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "sm4"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d7abf5135ffd68fb4b438e1fb246923b80d25eda386d8b798bb4ad3ed00f75f"
-dependencies = [
- "cipher",
-]
-
-[[package]]
-name = "sm4-gcm"
-version = "0.1.0"
-dependencies = [
- "sm4",
-]
-
-[[package]]
-name = "typenum"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sm4-gcm"
-version = "0.0.0"
+version = "0.1.0"
 edition = "2021"
 authors = ["Hatter Jiang"]
 repository = "https://git.hatter.ink/hatter/sm4-gcm"
@@ -11,4 +11,10 @@ categories = ["cryptography"]
 
 
 [dependencies]
-sm4 = "0.5.1"
+ghash = { version = "0.5.0", features = ["zeroize"] }
+sm4 = { version = "0.5.1", features = ["zeroize"] }
+zeroize = "1.6.0"
+
+[dev-dependencies]
+hex = "0.4.3"
+benchmark-simple = "0.1.8"

README.md

@@ -1,4 +1,39 @@
 # sm4-gcm
 
-PENGING...
+Encrypt & Decrypt test code:
+```rust
+fn main() {
+    let key = Sm4Key([0u8; 16]);
+    let nonce = [0u8; 12];
+    let plaintext = b"Hello World!";
 
+    let ciphertext = sm4_gcm::sm4_gcm_encrypt(&key, &nonce, plaintext);
+    println!("Encrypted: {}", hex::encode(&ciphertext));
+    let decrypted = sm4_gcm::sm4_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    println!("Decrypted: {}", String::from_utf8_lossy(&decrypted));
+}
+```
+
+
+Generate test vector BC test code:
+```java
+public static void encryptGcmNoPadding(String key, String data, String nonce, String associatedData) throws Exception {
+    Cipher cipher = Cipher.getInstance("SM4/GCM/NoPadding", BouncyCastleProvider.PROVIDER_NAME);
+    Key sm4Key = new SecretKeySpec(Bytes.fromHex(key).bytes(), "SM4");
+    byte[] iv = Bytes.fromHex(nonce).bytes();
+    GCMParameterSpec s = new GCMParameterSpec(128, iv);
+    cipher.init(Cipher.ENCRYPT_MODE, sm4Key, s);
+    if (associatedData != null && associatedData.length() > 0) {
+        cipher.updateAAD(Bytes.fromHex(associatedData).bytes());
+    }
+    byte[] aa = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));
+    System.out.println(Bytes.from(aa).asHex());
+}
+```
+
+
+Benchmark @MacBook Pro (Retina, 15-inch, Late 2013/2 GHz Quad-Core Intel Core i7)
+```text
+$ cargo run --release --example bench
+SM4/GCM encrypt : 65.69 M/s
+```

examples/bench.rs

@@ -0,0 +1,30 @@
+use benchmark_simple::{Bench, Options};
+
+use sm4_gcm::{Sm4GcmStreamEncryptor, Sm4Key};
+
+fn main() {
+    let bench = Bench::new();
+    let mut m = vec![0xd0u8; 16384];
+
+    let options = &Options {
+        iterations: 1_000,
+        warmup_iterations: 1_00,
+        min_samples: 5,
+        max_samples: 10,
+        max_rsd: 1.0,
+        ..Default::default()
+    };
+
+    let res = bench.run(options, || test_sm4_encrypt(&mut m));
+    println!("SM4/GCM encrypt : {}", res.throughput(m.len() as _));
+}
+
+
+fn test_sm4_encrypt(m: &mut [u8]) {
+    let key = Sm4Key([0u8; 16]);
+    let nonce = [0u8; 12];
+    let mut encryptor = Sm4GcmStreamEncryptor::new(&key, &nonce);
+
+    encryptor.update(m);
+    encryptor.finalize();
+}

examples/encrypt.rs

@@ -0,0 +1,12 @@
+use sm4_gcm::Sm4Key;
+
+fn main() {
+    let key = Sm4Key([0u8; 16]);
+    let nonce = [0u8; 12];
+    let plaintext = b"Hello World!";
+
+    let ciphertext = sm4_gcm::sm4_gcm_encrypt(&key, &nonce, plaintext);
+    println!("Encrypted: {}", hex::encode(&ciphertext));
+    let decrypted = sm4_gcm::sm4_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    println!("Decrypted: {}", String::from_utf8_lossy(&decrypted));
+}

src/decryptor.rs

@@ -0,0 +1,157 @@
+use ghash::GHash;
+use ghash::universal_hash::UniversalHash;
+use sm4::cipher::{Block, BlockEncrypt, KeyInit};
+use sm4::cipher::generic_array::GenericArray;
+use sm4::Sm4;
+use zeroize::Zeroize;
+
+use crate::util::{BLOCK_SIZE, inc_32, msb_s, normalize_nonce, Sm4Block, Sm4Key, u8to128};
+
+pub fn sm4_gcm_decrypt(key: &Sm4Key, nonce: &[u8], ciphertext: &[u8]) -> Result<Vec<u8>, String> {
+    sm4_gcm_aad_decrypt(key, nonce, &[], ciphertext)
+}
+
+pub fn sm4_gcm_aad_decrypt(key: &Sm4Key, nonce: &[u8], aad: &[u8], ciphertext: &[u8]) -> Result<Vec<u8>, String> {
+    let mut decryptor = Sm4GcmStreamDecryptor::new(key, nonce);
+    if aad.len() > 0 {
+        decryptor.init_adata(aad);
+    }
+    let mut msg1 = decryptor.update(ciphertext);
+    let msg2 = decryptor.finalize()?;
+    msg1.extend_from_slice(&msg2);
+    Ok(msg1)
+}
+
+pub struct Sm4GcmStreamDecryptor {
+    cipher: Sm4,
+    message_buffer: Vec<u8>,
+    ghash: GHash,
+    init_nonce: u128,
+    encryption_nonce: u128,
+    adata_len: usize,
+    message_len: usize,
+}
+
+impl Sm4GcmStreamDecryptor {
+    pub fn new(key: &Sm4Key, nonce: &[u8]) -> Self {
+        let mut key = GenericArray::from(key.0);
+        let cipher = Sm4::new(&key);
+
+        let mut ghash_key = ghash::Key::default();
+        cipher.encrypt_block(&mut ghash_key);
+        let ghash = GHash::new(&ghash_key);
+        ghash_key.zeroize();
+        key.zeroize();
+
+        let mut s = Self {
+            cipher,
+            message_buffer: vec![],
+            ghash,
+            init_nonce: 0,
+            encryption_nonce: 0,
+            adata_len: 0,
+            message_len: 0,
+        };
+        let (_, normalized_nonce) = s.normalize_nonce(nonce);
+        s.init_nonce = normalized_nonce;
+        s.encryption_nonce = normalized_nonce;
+        s
+    }
+
+    pub fn init_adata(&mut self, adata: &[u8]) {
+        if adata.len() > 0 {
+            self.adata_len += adata.len();
+            self.ghash.update_padded(adata);
+        }
+    }
+
+    pub fn update(&mut self, bytes: &[u8]) -> Vec<u8> {
+        self.message_buffer.extend_from_slice(bytes);
+        let message_buffer_slice = self.message_buffer.as_slice();
+        let message_buffer_len = message_buffer_slice.len();
+        if message_buffer_len < 32 {
+            return Vec::with_capacity(0);
+        }
+        let blocks_count = (message_buffer_len / 16) - 1;
+
+        let mut blocks = Vec::with_capacity(blocks_count);
+        for _ in 0..blocks_count {
+            self.encryption_nonce = inc_32(self.encryption_nonce);
+            let ctr = self.encryption_nonce.to_be_bytes();
+            blocks.push(Block::<Sm4Block>::clone_from_slice(&ctr));
+        }
+        self.cipher.encrypt_blocks(&mut blocks);
+
+        let encrypted_message = &message_buffer_slice[0..blocks_count * BLOCK_SIZE];
+        self.ghash.update_padded(encrypted_message);
+        let mut plaintext_message = encrypted_message.to_vec();
+        for i in 0..blocks_count {
+            let chunk = &mut plaintext_message[i * BLOCK_SIZE..(i + 1) * BLOCK_SIZE];
+            let block = blocks[i].as_slice();
+            for k in 0..BLOCK_SIZE {
+                chunk[k] ^= block[k];
+            }
+        }
+        self.message_buffer = message_buffer_slice[blocks_count * BLOCK_SIZE..].to_vec();
+        self.message_len += plaintext_message.len();
+
+        plaintext_message
+    }
+
+    pub fn finalize(&mut self) -> Result<Vec<u8>, String> {
+        let mut plaintext_message = Vec::with_capacity(16);
+        let message_buffer_len = self.message_buffer.len();
+        if message_buffer_len > 16 {
+            // last block and this block len is less than 128 bits
+            self.encryption_nonce = inc_32(self.encryption_nonce);
+            let mut ctr = self.encryption_nonce.to_be_bytes();
+            let block = Block::<Sm4Block>::from_mut_slice(&mut ctr);
+            self.cipher.encrypt_block(block);
+
+            let chunk = &self.message_buffer[0..message_buffer_len - 16];
+            let msb = msb_s(chunk.len() * 8, block.as_slice());
+            let y = u8to128(chunk) ^ u8to128(&msb);
+            plaintext_message.extend_from_slice(&y.to_be_bytes()[16 - chunk.len()..16]);
+            self.ghash.update_padded(&self.message_buffer[0..message_buffer_len - 16]);
+            self.message_len += plaintext_message.len();
+        }
+        let adata_bit_len = self.adata_len * 8;
+        let message_bit_len = self.message_len * 8;
+        let mut adata_and_message_len = Vec::with_capacity(BLOCK_SIZE);
+        adata_and_message_len.extend_from_slice(&(adata_bit_len as u64).to_be_bytes());
+        adata_and_message_len.extend_from_slice(&(message_bit_len as u64).to_be_bytes());
+        self.ghash.update_padded(&adata_and_message_len);
+
+        let tag = self.calculate_tag();
+        let message_tag = &self.message_buffer[message_buffer_len - 16..];
+
+        if message_tag != tag.as_slice() {
+            Err(format!("Tag mismatch, expected: {:2x}, actual: {:2x}",
+                        u8to128(&tag), u8to128(message_tag)))
+        } else {
+            Ok(plaintext_message)
+        }
+    }
+
+    fn calculate_tag(&mut self) -> Vec<u8> {
+        let mut bs = self.init_nonce.to_be_bytes().clone();
+        let block = Block::<Sm4Block>::from_mut_slice(&mut bs);
+        self.cipher.encrypt_block(block);
+        let ghash = self.ghash.clone().finalize();
+        let tag_trunk = ghash.as_slice();
+        let y = u8to128(&tag_trunk) ^ u8to128(&block.as_slice());
+        y.to_be_bytes().to_vec()
+    }
+
+    fn ghash_key(&mut self) -> u128 {
+        let mut block = [0u8; BLOCK_SIZE];
+        let block = Block::<Sm4Block>::from_mut_slice(&mut block);
+        self.cipher.encrypt_block(block);
+        u8to128(&block.as_slice())
+    }
+
+    fn normalize_nonce(&mut self, nonce_bytes: &[u8]) -> (u128, u128) {
+        let ghash_key = self.ghash_key();
+        normalize_nonce(ghash_key, nonce_bytes)
+    }
+}

src/encryptor.rs

@@ -0,0 +1,149 @@
+use ghash::GHash;
+use ghash::universal_hash::UniversalHash;
+use sm4::cipher::{Block, BlockEncrypt, KeyInit};
+use sm4::cipher::generic_array::GenericArray;
+use sm4::Sm4;
+use zeroize::Zeroize;
+
+use crate::util::{BLOCK_SIZE, inc_32, msb_s, normalize_nonce, Sm4Block, Sm4Key, u8to128};
+
+pub fn sm4_gcm_encrypt(key: &Sm4Key, nonce: &[u8], message: &[u8]) -> Vec<u8> {
+    sm4_gcm_aad_encrypt(key, nonce, &[], message)
+}
+
+pub fn sm4_gcm_aad_encrypt(key: &Sm4Key, nonce: &[u8], aad: &[u8], message: &[u8]) -> Vec<u8> {
+    let mut encryptor = Sm4GcmStreamEncryptor::new(key, nonce);
+    if aad.len() > 0 {
+        encryptor.init_adata(aad);
+    }
+    let mut enc1 = encryptor.update(message);
+    let (enc2, tag) = encryptor.finalize();
+    enc1.extend_from_slice(&enc2);
+    enc1.extend_from_slice(&tag);
+    enc1
+}
+
+pub struct Sm4GcmStreamEncryptor {
+    cipher: Sm4,
+    message_buffer: Vec<u8>,
+    ghash: GHash,
+    init_nonce: u128,
+    encryption_nonce: u128,
+    adata_len: usize,
+    message_len: usize,
+}
+
+impl Sm4GcmStreamEncryptor {
+    pub fn new(key: &Sm4Key, nonce: &[u8]) -> Self {
+        let mut key = GenericArray::from(key.0);
+        let cipher = Sm4::new(&key);
+
+        let mut ghash_key = ghash::Key::default();
+        cipher.encrypt_block(&mut ghash_key);
+        let ghash = GHash::new(&ghash_key);
+        ghash_key.zeroize();
+        key.zeroize();
+
+        let mut s = Self {
+            cipher,
+            message_buffer: vec![],
+            ghash,
+            init_nonce: 0,
+            encryption_nonce: 0,
+            adata_len: 0,
+            message_len: 0,
+        };
+        let (_, normalized_nonce) = s.normalize_nonce(nonce);
+        s.init_nonce = normalized_nonce;
+        s.encryption_nonce = normalized_nonce;
+        s
+    }
+
+    pub fn init_adata(&mut self, adata: &[u8]) {
+        if adata.len() > 0 {
+            self.adata_len += adata.len();
+            self.ghash.update_padded(adata);
+        }
+    }
+
+    pub fn update(&mut self, message: &[u8]) -> Vec<u8> {
+        self.message_buffer.extend_from_slice(message);
+        let message_buffer_slice = self.message_buffer.as_slice();
+        if message_buffer_slice.len() < BLOCK_SIZE {
+            return Vec::with_capacity(0);
+        }
+        let blocks_count = message_buffer_slice.len() / BLOCK_SIZE;
+        let mut blocks = Vec::with_capacity(blocks_count);
+        for _ in 0..blocks_count {
+            self.encryption_nonce = inc_32(self.encryption_nonce);
+            let ctr = self.encryption_nonce.to_be_bytes();
+            blocks.push(Block::<Sm4Block>::clone_from_slice(&ctr));
+        }
+        self.cipher.encrypt_blocks(&mut blocks);
+
+        let mut encrypted_message = message_buffer_slice[0..blocks_count * BLOCK_SIZE].to_vec();
+        for i in 0..blocks_count {
+            let chunk = &mut encrypted_message[i * BLOCK_SIZE..(i + 1) * BLOCK_SIZE];
+            let block = blocks[i].as_slice();
+            for k in 0..BLOCK_SIZE {
+                chunk[k] ^= block[k];
+            }
+        }
+        self.ghash.update_padded(&encrypted_message);
+        self.message_buffer = message_buffer_slice[blocks_count * BLOCK_SIZE..].to_vec();
+        self.message_len += encrypted_message.len();
+
+        encrypted_message
+    }
+
+    pub fn finalize(&mut self) -> (Vec<u8>, Vec<u8>) {
+        let mut final_encrypted_message = Vec::with_capacity(BLOCK_SIZE);
+        if !self.message_buffer.is_empty() {
+            // last block and this block len may less than 128 bits (16 bytes)
+            self.encryption_nonce = inc_32(self.encryption_nonce);
+            let mut ctr = self.encryption_nonce.to_be_bytes();
+            let block = Block::<Sm4Block>::from_mut_slice(&mut ctr);
+            self.cipher.encrypt_block(block);
+
+            let chunk = self.message_buffer.as_slice();
+            let msb = msb_s(chunk.len() * 8, block.as_slice());
+            let y = u8to128(chunk) ^ u8to128(&msb);
+            final_encrypted_message.extend_from_slice(&y.to_be_bytes()[16 - chunk.len()..16]);
+            self.ghash.update_padded(&final_encrypted_message);
+            self.message_len += final_encrypted_message.len();
+        }
+        let adata_bit_len = self.adata_len * 8;
+        let message_bit_len = self.message_len * 8;
+        let mut adata_and_message_len = Vec::with_capacity(BLOCK_SIZE);
+        adata_and_message_len.extend_from_slice(&(adata_bit_len as u64).to_be_bytes());
+        adata_and_message_len.extend_from_slice(&(message_bit_len as u64).to_be_bytes());
+        self.ghash.update_padded(&adata_and_message_len);
+
+
+        let tag = self.compute_tag();
+
+        (final_encrypted_message, tag)
+    }
+
+    fn compute_tag(&mut self) -> Vec<u8> {
+        let mut bs = self.init_nonce.to_be_bytes().clone();
+        let block = Block::<Sm4Block>::from_mut_slice(&mut bs);
+        self.cipher.encrypt_block(block);
+        let ghash = self.ghash.clone().finalize();
+        let tag_trunk = ghash.as_slice();
+        let y = u8to128(&tag_trunk) ^ u8to128(&block.as_slice());
+        y.to_be_bytes().to_vec()
+    }
+
+    fn ghash_key(&mut self) -> u128 {
+        let mut block = [0u8; BLOCK_SIZE];
+        let block = Block::<Sm4Block>::from_mut_slice(&mut block);
+        self.cipher.encrypt_block(block);
+        u8to128(&block.as_slice())
+    }
+
+    fn normalize_nonce(&mut self, nonce_bytes: &[u8]) -> (u128, u128) {
+        let ghash_key = self.ghash_key();
+        normalize_nonce(ghash_key, nonce_bytes)
+    }
+}

src/lib.rs

@@ -0,0 +1,39 @@
+pub use decryptor::Sm4GcmStreamDecryptor;
+pub use encryptor::Sm4GcmStreamEncryptor;
+
+pub use crate::decryptor::sm4_gcm_aad_decrypt;
+pub use crate::decryptor::sm4_gcm_decrypt;
+pub use crate::encryptor::sm4_gcm_aad_encrypt;
+pub use crate::encryptor::sm4_gcm_encrypt;
+pub use crate::util::Sm4Key;
+
+mod util;
+mod encryptor;
+mod decryptor;
+
+// Test vectors are all from BC
+#[test]
+fn test_sm4_gcm() {
+    let data = vec![
+        ([0u8; 16], [0u8; 12], &[][..], &b"A"[..], "3c0a0922976fa15e835bc96750e730d967"),
+        ([0u8; 16], [0u8; 12], &[][..], &b"hello world"[..], "1587c6137e306fed6a6a5f49539b6dd6fe2b7872c3279636db07c2"),
+        ([0u8; 16], [0xffu8; 12], &[][..], &b"Hello World!"[..], "cba3523bdf74096f3de1f9160a5adb7bf385dea4d50c910e663ec75a"),
+        ([0xffu8; 16], [0xffu8; 12], &[][..], &b"Hello World!"[..], "99eb1206b5b2a9f9c7d7ec4a81de507f5d79938a10ccd91da68d2fb1"),
+        ([0xffu8; 16], [0xffu8; 12], &[0xaau8, 0xbbu8, 0xccu8][..], &b"Hello World!"[..], "99eb1206b5b2a9f9c7d7ec4a7be091388b3049363189e64a47d20c19"),
+        ([0xffu8; 16], [0xffu8; 12], &[0u8, 1u8, 2u8, 3u8][..], &b"Hello World!"[..], "99eb1206b5b2a9f9c7d7ec4ac157a74de0381b3aa170385a113d4f31"),
+        ([0u8; 16], [0u8; 12], &[][..],
+         &b"Hello World!Hello World!Hello World!Hello World!Hello World!Hello World!"[..],
+         "3587c6137e304fed6a6a5fc0f78e01e5ea4b604843929848601d4b1600e35c1\
+         987a30fd521f6b8f66e950cfb735ca19ab45bd8d050a06b2d560a5927a5611f76\
+         82cd8c6db56ab52dae82a6db190c54ff8299ac7d339f92db"),
+    ];
+
+    for (key, nonce, aad, message, expected) in data {
+        let encrypted = sm4_gcm_aad_encrypt(&Sm4Key(key), &nonce, aad, message);
+        let encrypted_hex = hex::encode(&encrypted);
+        assert_eq!(expected, &encrypted_hex);
+
+        let decrypted = sm4_gcm_aad_decrypt(&Sm4Key(key), &nonce, aad, &encrypted).unwrap();
+        assert_eq!(message, decrypted.as_slice());
+    }
+}

src/main.rs

@@ -1,3 +0,0 @@
-fn main() {
-    println!("Hello, world!");
-}

src/util.rs

@@ -0,0 +1,101 @@
+use std::error::Error;
+
+use sm4::cipher::BlockSizeUser;
+use sm4::cipher::consts::U16;
+use zeroize::Zeroize;
+
+pub(crate) struct Sm4Block {}
+
+impl BlockSizeUser for Sm4Block {
+    type BlockSize = U16;
+}
+
+pub(crate) const BLOCK_SIZE: usize = 16;
+
+pub struct Sm4Key(pub [u8; 16]);
+
+impl Sm4Key {
+    pub fn from_slice(key: &[u8]) -> Result<Self, Box<dyn Error>> {
+        Ok(Self(key.try_into()?))
+    }
+}
+
+impl Drop for Sm4Key {
+    fn drop(&mut self) {
+        self.0.zeroize();
+    }
+}
+
+
+// R = 11100001 || 0(120)
+const R: u128 = 0b11100001 << 120;
+
+pub(crate) fn gmul_128(x: u128, y: u128) -> u128 {
+    let mut z = 0u128;
+    let mut v = y;
+    for i in (0..128).rev() {
+        let xi = (x >> i) & 1;
+        if xi != 0 {
+            z ^= v;
+        }
+        v = match v & 1 == 0 {
+            true => { v >> 1 }
+            false => { (v >> 1) ^ R }
+        };
+    }
+    z
+}
+
+pub(crate) fn ghash(key: u128, messages: &[u128]) -> u128 {
+    let mut y = 0u128;
+    for message in messages {
+        let yi = gmul_128(y ^ message, key);
+        y = yi;
+    }
+    y
+}
+
+pub(crate) fn normalize_nonce(ghash_key: u128, nonce_bytes: &[u8]) -> (u128, u128) {
+    let nonce = u8to128(nonce_bytes);
+    let normalized_nonce = match nonce_bytes.len() == 12 {
+        true => {
+            nonce << 32 | 0x00000001
+        }
+        false => {
+            let mut iv_padding = vec![];
+            // s = 128[len(iv) / 128] - len(iv)
+            let s = 128 * (((nonce_bytes.len() * 8) + 128 - 1) / 128) - (nonce_bytes.len() * 8);
+            iv_padding.push(nonce << s);
+            iv_padding.push((nonce_bytes.len() * 8) as u128);
+            ghash(ghash_key, &iv_padding)
+        }
+    };
+    (ghash_key, normalized_nonce)
+}
+
+pub(crate) fn msb_s(s: usize, bytes: &[u8]) -> Vec<u8> {
+    let mut result = vec![];
+    let n = s / 8;
+    let remain = s % 8;
+    result.extend_from_slice(&bytes[0..n]);
+    if remain > 0 {
+        result.push(bytes[n] >> (8 - remain));
+    }
+    result
+}
+
+#[inline]
+pub(crate) fn u8to128(bytes: &[u8]) -> u128 {
+    bytes.iter().rev().enumerate().fold(0, |acc, (i, &byte)| {
+        acc | (byte as u128) << (i * 8)
+    })
+}
+
+// incs(X)=MSBlen(X)-s(X) || [int(LSBs(X))+1 mod 2^s]s
+#[inline]
+pub(crate) fn inc_32(bits: u128) -> u128 {
+    let msb = bits >> 32;
+    let mut lsb = (bits & 0xffffffff) as u32;
+    lsb = lsb.wrapping_add(1);
+    msb << 32 | lsb as u128
+}