1 /*
2 * AES SIV (RFC 5297)
3 * Copyright (c) 2013 Cozybit, Inc.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "rtw_crypto_wrap.h"
10
11 #include "aes.h"
12 #include "aes_wrap.h"
13 #include "aes_siv.h"
14
15
16 static const u8 zero[AES_BLOCK_SIZE];
17
18
dbl(u8 * pad)19 static void dbl(u8 *pad)
20 {
21 int i, carry;
22
23 carry = pad[0] & 0x80;
24 for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
25 pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
26 pad[AES_BLOCK_SIZE - 1] <<= 1;
27 if (carry)
28 pad[AES_BLOCK_SIZE - 1] ^= 0x87;
29 }
30
31
xor(u8 * a,const u8 * b)32 static void xor(u8 *a, const u8 *b)
33 {
34 int i;
35
36 for (i = 0; i < AES_BLOCK_SIZE; i++)
37 *a++ ^= *b++;
38 }
39
40
xorend(u8 * a,int alen,const u8 * b,int blen)41 static void xorend(u8 *a, int alen, const u8 *b, int blen)
42 {
43 int i;
44
45 if (alen < blen)
46 return;
47
48 for (i = 0; i < blen; i++)
49 a[alen - blen + i] ^= b[i];
50 }
51
52
pad_block(u8 * pad,const u8 * addr,size_t len)53 static void pad_block(u8 *pad, const u8 *addr, size_t len)
54 {
55 os_memset(pad, 0, AES_BLOCK_SIZE);
56 os_memcpy(pad, addr, len);
57
58 if (len < AES_BLOCK_SIZE)
59 pad[len] = 0x80;
60 }
61
62
aes_s2v(const u8 * key,size_t key_len,size_t num_elem,const u8 * addr[],size_t * len,u8 * mac)63 static int aes_s2v(const u8 *key, size_t key_len,
64 size_t num_elem, const u8 *addr[], size_t *len, u8 *mac)
65 {
66 u8 tmp[AES_BLOCK_SIZE], tmp2[AES_BLOCK_SIZE];
67 u8 *buf = NULL;
68 int ret;
69 size_t i;
70 const u8 *data[1];
71 size_t data_len[1];
72
73 if (!num_elem) {
74 os_memcpy(tmp, zero, sizeof(zero));
75 tmp[AES_BLOCK_SIZE - 1] = 1;
76 data[0] = tmp;
77 data_len[0] = sizeof(tmp);
78 return omac1_aes_vector(key, key_len, 1, data, data_len, mac);
79 }
80
81 data[0] = zero;
82 data_len[0] = sizeof(zero);
83 ret = omac1_aes_vector(key, key_len, 1, data, data_len, tmp);
84 if (ret)
85 return ret;
86
87 for (i = 0; i < num_elem - 1; i++) {
88 ret = omac1_aes_vector(key, key_len, 1, &addr[i], &len[i],
89 tmp2);
90 if (ret)
91 return ret;
92
93 dbl(tmp);
94 xor(tmp, tmp2);
95 }
96 if (len[i] >= AES_BLOCK_SIZE) {
97 buf = os_memdup(addr[i], len[i]);
98 if (!buf)
99 return -ENOMEM;
100
101 xorend(buf, len[i], tmp, AES_BLOCK_SIZE);
102 data[0] = buf;
103 ret = omac1_aes_vector(key, key_len, 1, data, &len[i], mac);
104 bin_clear_free(buf, len[i]);
105 return ret;
106 }
107
108 dbl(tmp);
109 pad_block(tmp2, addr[i], len[i]);
110 xor(tmp, tmp2);
111
112 data[0] = tmp;
113 data_len[0] = sizeof(tmp);
114 return omac1_aes_vector(key, key_len, 1, data, data_len, mac);
115 }
116
117
aes_siv_encrypt(const u8 * key,size_t key_len,const u8 * pw,size_t pwlen,size_t num_elem,const u8 * addr[],const size_t * len,u8 * out)118 int aes_siv_encrypt(const u8 *key, size_t key_len,
119 const u8 *pw, size_t pwlen,
120 size_t num_elem, const u8 *addr[], const size_t *len,
121 u8 *out)
122 {
123 const u8 *_addr[6];
124 size_t _len[6];
125 const u8 *k1, *k2;
126 u8 v[AES_BLOCK_SIZE];
127 size_t i;
128 u8 *iv, *crypt_pw;
129
130 if (num_elem > ARRAY_SIZE(_addr) - 1 ||
131 (key_len != 32 && key_len != 48 && key_len != 64))
132 return -1;
133
134 key_len /= 2;
135 k1 = key;
136 k2 = key + key_len;
137
138 for (i = 0; i < num_elem; i++) {
139 _addr[i] = addr[i];
140 _len[i] = len[i];
141 }
142 _addr[num_elem] = pw;
143 _len[num_elem] = pwlen;
144
145 if (aes_s2v(k1, key_len, num_elem + 1, _addr, _len, v))
146 return -1;
147
148 iv = out;
149 crypt_pw = out + AES_BLOCK_SIZE;
150
151 os_memcpy(iv, v, AES_BLOCK_SIZE);
152 os_memcpy(crypt_pw, pw, pwlen);
153
154 /* zero out 63rd and 31st bits of ctr (from right) */
155 v[8] &= 0x7f;
156 v[12] &= 0x7f;
157 return aes_ctr_encrypt(k2, key_len, v, crypt_pw, pwlen);
158 }
159
160
aes_siv_decrypt(const u8 * key,size_t key_len,const u8 * iv_crypt,size_t iv_c_len,size_t num_elem,const u8 * addr[],const size_t * len,u8 * out)161 int aes_siv_decrypt(const u8 *key, size_t key_len,
162 const u8 *iv_crypt, size_t iv_c_len,
163 size_t num_elem, const u8 *addr[], const size_t *len,
164 u8 *out)
165 {
166 const u8 *_addr[6];
167 size_t _len[6];
168 const u8 *k1, *k2;
169 size_t crypt_len;
170 size_t i;
171 int ret;
172 u8 iv[AES_BLOCK_SIZE];
173 u8 check[AES_BLOCK_SIZE];
174
175 if (iv_c_len < AES_BLOCK_SIZE || num_elem > ARRAY_SIZE(_addr) - 1 ||
176 (key_len != 32 && key_len != 48 && key_len != 64))
177 return -1;
178 crypt_len = iv_c_len - AES_BLOCK_SIZE;
179 key_len /= 2;
180 k1 = key;
181 k2 = key + key_len;
182
183 for (i = 0; i < num_elem; i++) {
184 _addr[i] = addr[i];
185 _len[i] = len[i];
186 }
187 _addr[num_elem] = out;
188 _len[num_elem] = crypt_len;
189
190 os_memcpy(iv, iv_crypt, AES_BLOCK_SIZE);
191 os_memcpy(out, iv_crypt + AES_BLOCK_SIZE, crypt_len);
192
193 iv[8] &= 0x7f;
194 iv[12] &= 0x7f;
195
196 ret = aes_ctr_encrypt(k2, key_len, iv, out, crypt_len);
197 if (ret)
198 return ret;
199
200 ret = aes_s2v(k1, key_len, num_elem + 1, _addr, _len, check);
201 if (ret)
202 return ret;
203 if (os_memcmp(check, iv_crypt, AES_BLOCK_SIZE) == 0)
204 return 0;
205
206 return -1;
207 }
208