Differential D32120 Diff 96389 sys/opencrypto/cbc_mac.c

Changeset View

Standalone View

sys/opencrypto/cbc_mac.c

Show First 20 Lines • Show All 69 Lines • ▼ Show 20 Lines	AES_CBC_MAC_Setkey(void vctx, const uint8_t key, u_int klen)
struct aes_cbc_mac_ctx *ctx;		struct aes_cbc_mac_ctx *ctx;

ctx = vctx;		ctx = vctx;
ctx->rounds = rijndaelKeySetupEnc(ctx->keysched, key, klen * 8);		ctx->rounds = rijndaelKeySetupEnc(ctx->keysched, key, klen * 8);
}		}

/*		/*
* This is called to set the nonce, aka IV.		* This is called to set the nonce, aka IV.
* Before this call, the authDataLength and cryptDataLength fields
* MUST have been set. Sadly, there's no way to return an error.
*		*
* The CBC-MAC algorithm requires that the first block contain the		* Note that the caller is responsible for constructing b0 as well
* nonce, as well as information about the sizes and lengths involved.		* as the length and padding around the AAD and passing that data
		* to _Update.
*/		*/
void		void
AES_CBC_MAC_Reinit(void vctx, const uint8_t nonce, u_int nonceLen)		AES_CBC_MAC_Reinit(void vctx, const uint8_t nonce, u_int nonceLen)
{		{
struct aes_cbc_mac_ctx *ctx = vctx;		struct aes_cbc_mac_ctx *ctx = vctx;
uint8_t b0[CCM_CBC_BLOCK_LEN];
uint8_t *bp = b0, flags = 0;
uint8_t L = 0;
uint64_t dataLength = ctx->cryptDataLength;

KASSERT(nonceLen >= 7 && nonceLen <= 13,
("nonceLen must be between 7 and 13 bytes"));

ctx->nonce = nonce;		ctx->nonce = nonce;
ctx->nonceLength = nonceLen;		ctx->nonceLength = nonceLen;

ctx->authDataCount = 0;
ctx->blockIndex = 0;		ctx->blockIndex = 0;
explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));

/*		/* XOR b0 with all 0's on first call to _Update. */
* Need to determine the L field value. This is the number of		memset(ctx->block, 0, CCM_CBC_BLOCK_LEN);
* bytes needed to specify the length of the message; the length
* is whatever is left in the 16 bytes after specifying flags and
* the nonce.
*/
L = 15 - nonceLen;

flags = ((ctx->authDataLength > 0) << 6) +
(((AES_CBC_MAC_HASH_LEN - 2) / 2) << 3) +
L - 1;
/*
* Now we need to set up the first block, which has flags, nonce,
* and the message length.
*/
b0[0] = flags;
bcopy(nonce, b0 + 1, nonceLen);
bp = b0 + 1 + nonceLen;

/* Need to copy L' [aka L-1] bytes of cryptDataLength */
for (uint8_t *dst = b0 + sizeof(b0) - 1; dst >= bp; dst--) {
*dst = dataLength;
dataLength >>= 8;
}		}
/* Now need to encrypt b0 */
rijndaelEncrypt(ctx->keysched, ctx->rounds, b0, ctx->block);
/* If there is auth data, we need to set up the staging block */
if (ctx->authDataLength) {
size_t addLength;
if (ctx->authDataLength < ((1<<16) - (1<<8))) {
uint16_t sizeVal = htobe16(ctx->authDataLength);
bcopy(&sizeVal, ctx->staging_block, sizeof(sizeVal));
addLength = sizeof(sizeVal);
} else if (ctx->authDataLength < (1ULL<<32)) {
uint32_t sizeVal = htobe32(ctx->authDataLength);
ctx->staging_block[0] = 0xff;
ctx->staging_block[1] = 0xfe;
bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
addLength = 2 + sizeof(sizeVal);
} else {
uint64_t sizeVal = htobe64(ctx->authDataLength);
ctx->staging_block[0] = 0xff;
ctx->staging_block[1] = 0xff;
bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
addLength = 2 + sizeof(sizeVal);
}
ctx->blockIndex = addLength;
/*
* The length descriptor goes into the AAD buffer, so we
* need to account for it.
*/
ctx->authDataLength += addLength;
ctx->authDataCount = addLength;
}
}

int		int
AES_CBC_MAC_Update(void vctx, const void vdata, u_int length)		AES_CBC_MAC_Update(void vctx, const void vdata, u_int length)
{		{
struct aes_cbc_mac_ctx *ctx;		struct aes_cbc_mac_ctx *ctx;
const uint8_t *data;		const uint8_t *data;
size_t copy_amt;		size_t copy_amt;

ctx = vctx;		ctx = vctx;
data = vdata;		data = vdata;

/*		/*
* This will be called in one of two phases:		* _Update can be called with non-aligned update lengths. Use
* (1) Applying authentication data, or		* the staging block when necessary.
* (2) Applying the payload data.
*
* Because CBC-MAC puts the authentication data size before the
* data, subsequent calls won't be block-size-aligned. Which
* complicates things a fair bit.
*
* The payload data doesn't have that problem.
*/		*/
		while (length != 0) {
		uint8_t *ptr;

if (ctx->authDataCount < ctx->authDataLength) {
/*		/*
* We need to process data as authentication data.		* If there is no partial block and the length is at
* Since we may be out of sync, we may also need		* least a full block, encrypt the full block without
* to pad out the staging block.		* copying to the staging block.
*/		*/
const uint8_t *ptr = data;		if (ctx->blockIndex == 0 && length >= CCM_CBC_BLOCK_LEN) {
while (length > 0) {		xor_and_encrypt(ctx, data, ctx->block);
		length -= CCM_CBC_BLOCK_LEN;
copy_amt = MIN(length,		data += CCM_CBC_BLOCK_LEN;
sizeof(ctx->staging_block) - ctx->blockIndex);		continue;

bcopy(ptr, ctx->staging_block + ctx->blockIndex,
copy_amt);
ptr += copy_amt;
length -= copy_amt;
ctx->authDataCount += copy_amt;
ctx->blockIndex += copy_amt;
ctx->blockIndex %= sizeof(ctx->staging_block);

if (ctx->blockIndex == 0 \|\|
ctx->authDataCount == ctx->authDataLength) {
/*
* We're done with this block, so we
* xor staging_block with block, and then
* encrypt it.
*/
xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
bzero(ctx->staging_block, sizeof(ctx->staging_block));
ctx->blockIndex = 0;
if (ctx->authDataCount >= ctx->authDataLength)
break;
}		}
}
/*
* We'd like to be able to check length == 0 and return
* here, but the way OCF calls us, length is always
* blksize (16, in this case). So we have to count on
* the fact that OCF calls us separately for the AAD and
* for the real data.
*/
return (0);
}
/*
* If we're here, then we're encoding payload data.
* This is marginally easier, except that _Update can
* be called with non-aligned update lengths. As a result,
* we still need to use the staging block.
*/
KASSERT((length + ctx->cryptDataCount) <= ctx->cryptDataLength,
("More encryption data than allowed"));

while (length) {
uint8_t *ptr;

copy_amt = MIN(sizeof(ctx->staging_block) - ctx->blockIndex,		copy_amt = MIN(sizeof(ctx->staging_block) - ctx->blockIndex,
length);		length);
ptr = ctx->staging_block + ctx->blockIndex;		ptr = ctx->staging_block + ctx->blockIndex;
bcopy(data, ptr, copy_amt);		bcopy(data, ptr, copy_amt);
data += copy_amt;		data += copy_amt;
ctx->blockIndex += copy_amt;		ctx->blockIndex += copy_amt;
ctx->cryptDataCount += copy_amt;
length -= copy_amt;		length -= copy_amt;
if (ctx->blockIndex == sizeof(ctx->staging_block)) {		if (ctx->blockIndex == sizeof(ctx->staging_block)) {
/* We've got a full block */		/* We've got a full block */
xor_and_encrypt(ctx, ctx->staging_block, ctx->block);		xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
ctx->blockIndex = 0;		ctx->blockIndex = 0;
bzero(ctx->staging_block, sizeof(ctx->staging_block));
}		}
}		}
return (0);		return (0);
}		}

void		void
AES_CBC_MAC_Final(uint8_t buf, void vctx)		AES_CBC_MAC_Final(uint8_t buf, void vctx)
{		{
struct aes_cbc_mac_ctx *ctx;		struct aes_cbc_mac_ctx *ctx;
uint8_t s0[CCM_CBC_BLOCK_LEN];		uint8_t s0[CCM_CBC_BLOCK_LEN];

ctx = vctx;		ctx = vctx;

/*		/*
* We first need to check to see if we've got any data		* We first need to check to see if we've got any data
* left over to encrypt.		* left over to encrypt.
*/		*/
if (ctx->blockIndex != 0) {		if (ctx->blockIndex != 0) {
		memset(ctx->staging_block + ctx->blockIndex, 0,
		CCM_CBC_BLOCK_LEN - ctx->blockIndex);
xor_and_encrypt(ctx, ctx->staging_block, ctx->block);		xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
ctx->cryptDataCount += ctx->blockIndex;
ctx->blockIndex = 0;
explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
}		}
		explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));

bzero(s0, sizeof(s0));		bzero(s0, sizeof(s0));
s0[0] = (15 - ctx->nonceLength) - 1;		s0[0] = (15 - ctx->nonceLength) - 1;
bcopy(ctx->nonce, s0 + 1, ctx->nonceLength);		bcopy(ctx->nonce, s0 + 1, ctx->nonceLength);
rijndaelEncrypt(ctx->keysched, ctx->rounds, s0, s0);		rijndaelEncrypt(ctx->keysched, ctx->rounds, s0, s0);
for (size_t indx = 0; indx < AES_CBC_MAC_HASH_LEN; indx++)		for (size_t indx = 0; indx < AES_CBC_MAC_HASH_LEN; indx++)
buf[indx] = ctx->block[indx] ^ s0[indx];		buf[indx] = ctx->block[indx] ^ s0[indx];
explicit_bzero(s0, sizeof(s0));		explicit_bzero(s0, sizeof(s0));
}		}