Differential D15446 Diff 43210 sys/opencrypto/ccm-cbc.c

Changeset View

Standalone View

sys/opencrypto/ccm-cbc.c

Property	Old Value	New Value
svn:eol-style	null	native \ No newline at end of property
svn:keywords	null	FreeBSD=%H \ No newline at end of property
svn:mime-type	null	text/plain \ No newline at end of property

				#include <sys/types.h>
				#include <sys/systm.h>
				#include <sys/param.h>
				#include <sys/endian.h>
				#include <opencrypto/ccm-cbc.h>
				#include <opencrypto/xform_auth.h>

				/*
				* Software implementation of the CBC-MAC part of
				* AES-CCM, as described at https://tools.ietf.org/html/rfc3610
				* The encryption part is essentially the same as
				* AES-ICM/GCM (the initial value of the counter is different),
				* but the authentication code is very different.
				*/

				#ifdef CRYPTO_DEBUG
				static void
				PrintBlock(const char label, void b)
				{
				uint8_t *ptr = b;
				printf("%s: %s: ", __FILE__, label);
				for (size_t i = 0; i < 16; i++)
				printf("%02x ", ptr[i]);
				jmgUnsubmitted Not Done Inline Actions Please fix this so that the function does NOT unencrypted data to dst, and then does a later decryption pass. This is a great way to accidentally leak plaintext. The function does not appear to do this, so possibly a comment that was not updated. jmg: Please fix this so that the function does NOT unencrypted data to dst, and then does a later…
				printf("\n");
				}
				#endif

				/*
				* Given two CCM_CBC_BLOCK_LEN blocks, xor
				* them, and encrypt into dst.
				*/
				static void
				xor_and_encrypt(struct aes_cbc_mac_ctx *ctx,
				const uint8_t src, uint8_t dst)
				{
				const uint64_t *b1;
				uint64_t *b2;
				uint64_t temp_block[CCM_CBC_BLOCK_LEN/sizeof(uint64_t)];
				b1 = (const uint64_t*)src;
				b2 = (uint64_t*)dst;

				for (size_t count = 0;
				count < CCM_CBC_BLOCK_LEN/sizeof(uint64_t);
				count++) {
				temp_block[count] = b1[count] ^ b2[count];
				}
				rijndaelEncrypt(ctx->keysched, ctx->rounds, (void*)temp_block, dst);
				}

				void
				AES_CBC_MAC_Init(struct aes_cbc_mac_ctx *ctx)
				{
				bzero(ctx, sizeof *ctx);
				ctx->tagLength = AES_CBC_MAC_HASH_LEN;
				}

				void
				AES_CBC_MAC_Setkey(struct aes_cbc_mac_ctx ctx, const uint8_t key, uint16_t klen)
				{
				jmgUnsubmitted Not Done Inline Actions I have not verified that this is correct. Why is this done significantly differently than the way gmac does it? Per above, as I don't know what algorithm was implemented, I have not reviewed the implementation. jmg: I have not verified that this is correct. Why is this done significantly differently than the…
				ctx->rounds = rijndaelKeySetupEnc(ctx->keysched, key, klen * 8);
				return;
				}

				/*
				* This is called to set the nonce, aka IV.
				* Before this call, the authDataLength and cryptDataLength fields
				* MUST have been set. Sadly, there's no way to return an error.
				*
				* The CBC-MAC algorithm requires that the first block contain the
				* nonce, as well as information about the sizes and lengths involved.
				*/
				void
				AES_CBC_MAC_Reinit(struct aes_cbc_mac_ctx ctx, const uint8_t nonce, uint16_t nonceLen)
				{
				uint8_t b0[CCM_CBC_BLOCK_LEN];
				uint8_t *bp = b0, flags = 0;
				uint8_t L = 0;
				uint64_t tmp = ctx->cryptDataLength;

				if (ctx->authDataLength == 0 &&
				ctx->cryptDataLength == 0) {
				return;
				}

				ctx->nonce = nonce;
				ctx->nonceLength = nonceLen;

				ctx->authDataCount = 0;
				ctx->blockIndex = 0;
				explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));

				/*
				* Need to determine the L field value.
				* This is the number of bytes needed to
				* specify the length of the message; the
				* length is whatever is left in the 16 bytes
				* after specifying flags and the nonce.
				*/
				L = (15 - nonceLen) & 0xff;

				flags = (ctx->authDataLength > 0) * 64 +
				((ctx->tagLength-2) / 2) * 8 +
				L - 1;
				/*
				* Now we need to set up the first block,
				* which has flags, nonce, and the message length.
				*/
				b0[0] = flags;
				bcopy(nonce, b0+1, nonceLen);
				bp = b0 + 1 + nonceLen;

				/* Need to copy L' [aka L-1] bytes of cryptDataLength */
				for (uint8_t *dst = b0 + sizeof(b0) - 1;
				dst >= bp;
				dst--) {
				*dst = (tmp & 0xff);
				tmp >>= 8;
				}
				/* Now need to encrypt b0 */
				rijndaelEncrypt(ctx->keysched, ctx->rounds, b0, ctx->block);

				/* If there is auth data, we need to set up the staging block */
				if (ctx->authDataLength) {
				if (ctx->authDataLength < ((1<<16) - (1<<8))) {
				uint16_t sizeVal = htobe16(ctx->authDataLength);
				bcopy(&sizeVal, ctx->staging_block, sizeof(sizeVal));
				ctx->blockIndex = sizeof(sizeVal);
				} else if (ctx->authDataLength < (1UL<<32)) {
				uint32_t sizeVal = htobe32(ctx->authDataLength);
				ctx->staging_block[0] = 0xff;
				ctx->staging_block[1] = 0xfe;
				bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
				ctx->blockIndex = 2 + sizeof(sizeVal);
				} else {
				uint64_t sizeVal = htobe64(ctx->authDataLength);
				ctx->staging_block[0] = 0xff;
				ctx->staging_block[1] = 0xff;
				bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
				ctx->blockIndex = 2 + sizeof(sizeVal);
				}
				}
				return;
				}

				int
				AES_CBC_MAC_Update(struct aes_cbc_mac_ctx ctx, const uint8_t data, uint16_t length)
				{

				/*
				* This will be called in one of two phases:
				* (1) Applying authentication data, or
				* (2) Applying the payload data.
				* Because CBC-MAC puts the authentication data
				* size before the data, subsequent calls won't
				* be block-size-aligned. Which complicates things
				* a fair bit.
				*
				* The payload data doesn't have that problem.
				*/

				if (ctx->authDataCount < ctx->authDataLength) {
				/*
				* We need to process data as authentication data.
				* Since we may be out of sync, we may also need
				* to pad out the staging block.
				*/
				const uint8_t *ptr = data;
				while (length) {
				size_t copy_amt = MIN(length,
				sizeof(ctx->staging_block) - ctx->blockIndex);
				bcopy(ptr, ctx->staging_block + ctx->blockIndex, copy_amt);
				ptr += copy_amt;
				length -= copy_amt;
				ctx->authDataCount += copy_amt;
				ctx->blockIndex += copy_amt;
				ctx->blockIndex %= sizeof(ctx->staging_block);
				if (ctx->authDataCount >= ctx->authDataLength)
				length = 0;
				if (ctx->blockIndex == 0 \|\|
				ctx->authDataCount >= ctx->authDataLength) {
				/*
				* We're done with this block, so we
				* xor staging_block with block, and then
				* encrypt it.
				*/
				xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
				explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
				ctx->blockIndex = 0;
				}
				}
				return (0);
				}
				/*
				* If we're here, then we're encoding payload data.
				* This is easier, as we just xor&encrypt.
				*/
				while (length) {
				const uint8_t *ptr;

				if (length < sizeof(ctx->block)) {
				explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
				bcopy(data, ctx->staging_block, length);
				ptr = ctx->staging_block;
				length = 0;
				} else {
				ptr = data;
				length -= sizeof(ctx->block);
				}
				xor_and_encrypt(ctx, ptr, ctx->block);
				}
				return (0);
				}

				void
				AES_CBC_MAC_Final(uint8_t buf, struct aes_cbc_mac_ctx ctx)
				{
				uint8_t s0[CCM_CBC_BLOCK_LEN];

				explicit_bzero(s0, sizeof(s0));
				s0[0] = ((15 - ctx->nonceLength) & 0xff) - 1;
				bcopy(ctx->nonce, s0+1, ctx->nonceLength);
				rijndaelEncrypt(ctx->keysched, ctx->rounds, s0, s0);
				for (size_t indx = 0; indx < ctx->tagLength; indx++)
				buf[indx] = ctx->block[indx] ^ s0[indx];
				explicit_bzero(s0, sizeof(s0));
				return;
				}