Adjust the ${ISODIR}/.didbootstrap logic a little, add needed licenses.
[dragonfly.git] / contrib / wpa_supplicant-0.5.8 / aes_wrap.c
blobc52e45af27c5607b7744b9a8f61a2ab0247373a9
1 /*
2 * AES-based functions
4 * - AES Key Wrap Algorithm (128-bit KEK) (RFC3394)
5 * - One-Key CBC MAC (OMAC1) hash with AES-128
6 * - AES-128 CTR mode encryption
7 * - AES-128 EAX mode encryption/decryption
8 * - AES-128 CBC
10 * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License version 2 as
14 * published by the Free Software Foundation.
16 * Alternatively, this software may be distributed under the terms of BSD
17 * license.
19 * See README and COPYING for more details.
22 #include "includes.h"
24 #include "common.h"
25 #include "aes_wrap.h"
26 #include "crypto.h"
28 #ifdef INTERNAL_AES
29 #include "aes.c"
30 #endif /* INTERNAL_AES */
33 #ifndef CONFIG_NO_AES_WRAP
35 /**
36 * aes_wrap - Wrap keys with AES Key Wrap Algorithm (128-bit KEK) (RFC3394)
37 * @kek: Key encryption key (KEK)
38 * @n: Length of the wrapped key in 64-bit units; e.g., 2 = 128-bit = 16 bytes
39 * @plain: Plaintext key to be wrapped, n * 64 bit
40 * @cipher: Wrapped key, (n + 1) * 64 bit
41 * Returns: 0 on success, -1 on failure
43 int aes_wrap(const u8 *kek, int n, const u8 *plain, u8 *cipher)
45 u8 *a, *r, b[16];
46 int i, j;
47 void *ctx;
49 a = cipher;
50 r = cipher + 8;
52 /* 1) Initialize variables. */
53 os_memset(a, 0xa6, 8);
54 os_memcpy(r, plain, 8 * n);
56 ctx = aes_encrypt_init(kek, 16);
57 if (ctx == NULL)
58 return -1;
60 /* 2) Calculate intermediate values.
61 * For j = 0 to 5
62 * For i=1 to n
63 * B = AES(K, A | R[i])
64 * A = MSB(64, B) ^ t where t = (n*j)+i
65 * R[i] = LSB(64, B)
67 for (j = 0; j <= 5; j++) {
68 r = cipher + 8;
69 for (i = 1; i <= n; i++) {
70 os_memcpy(b, a, 8);
71 os_memcpy(b + 8, r, 8);
72 aes_encrypt(ctx, b, b);
73 os_memcpy(a, b, 8);
74 a[7] ^= n * j + i;
75 os_memcpy(r, b + 8, 8);
76 r += 8;
79 aes_encrypt_deinit(ctx);
81 /* 3) Output the results.
83 * These are already in @cipher due to the location of temporary
84 * variables.
87 return 0;
90 #endif /* CONFIG_NO_AES_WRAP */
93 /**
94 * aes_unwrap - Unwrap key with AES Key Wrap Algorithm (128-bit KEK) (RFC3394)
95 * @kek: Key encryption key (KEK)
96 * @n: Length of the wrapped key in 64-bit units; e.g., 2 = 128-bit = 16 bytes
97 * @cipher: Wrapped key to be unwrapped, (n + 1) * 64 bit
98 * @plain: Plaintext key, n * 64 bit
99 * Returns: 0 on success, -1 on failure (e.g., integrity verification failed)
101 int aes_unwrap(const u8 *kek, int n, const u8 *cipher, u8 *plain)
103 u8 a[8], *r, b[16];
104 int i, j;
105 void *ctx;
107 /* 1) Initialize variables. */
108 os_memcpy(a, cipher, 8);
109 r = plain;
110 os_memcpy(r, cipher + 8, 8 * n);
112 ctx = aes_decrypt_init(kek, 16);
113 if (ctx == NULL)
114 return -1;
116 /* 2) Compute intermediate values.
117 * For j = 5 to 0
118 * For i = n to 1
119 * B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i
120 * A = MSB(64, B)
121 * R[i] = LSB(64, B)
123 for (j = 5; j >= 0; j--) {
124 r = plain + (n - 1) * 8;
125 for (i = n; i >= 1; i--) {
126 os_memcpy(b, a, 8);
127 b[7] ^= n * j + i;
129 os_memcpy(b + 8, r, 8);
130 aes_decrypt(ctx, b, b);
131 os_memcpy(a, b, 8);
132 os_memcpy(r, b + 8, 8);
133 r -= 8;
136 aes_decrypt_deinit(ctx);
138 /* 3) Output results.
140 * These are already in @plain due to the location of temporary
141 * variables. Just verify that the IV matches with the expected value.
143 for (i = 0; i < 8; i++) {
144 if (a[i] != 0xa6)
145 return -1;
148 return 0;
152 #define BLOCK_SIZE 16
154 #ifndef CONFIG_NO_AES_OMAC1
156 static void gf_mulx(u8 *pad)
158 int i, carry;
160 carry = pad[0] & 0x80;
161 for (i = 0; i < BLOCK_SIZE - 1; i++)
162 pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
163 pad[BLOCK_SIZE - 1] <<= 1;
164 if (carry)
165 pad[BLOCK_SIZE - 1] ^= 0x87;
170 * omac1_aes_128 - One-Key CBC MAC (OMAC1) hash with AES-128 (aka AES-CMAC)
171 * @key: 128-bit key for the hash operation
172 * @data: Data buffer for which a MAC is determined
173 * @data: Length of data buffer in bytes
174 * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
175 * Returns: 0 on success, -1 on failure
177 int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
179 void *ctx;
180 u8 cbc[BLOCK_SIZE], pad[BLOCK_SIZE];
181 const u8 *pos = data;
182 size_t i, left = data_len;
184 ctx = aes_encrypt_init(key, 16);
185 if (ctx == NULL)
186 return -1;
187 os_memset(cbc, 0, BLOCK_SIZE);
189 while (left >= BLOCK_SIZE) {
190 for (i = 0; i < BLOCK_SIZE; i++)
191 cbc[i] ^= *pos++;
192 if (left > BLOCK_SIZE)
193 aes_encrypt(ctx, cbc, cbc);
194 left -= BLOCK_SIZE;
197 os_memset(pad, 0, BLOCK_SIZE);
198 aes_encrypt(ctx, pad, pad);
199 gf_mulx(pad);
201 if (left || data_len == 0) {
202 for (i = 0; i < left; i++)
203 cbc[i] ^= *pos++;
204 cbc[left] ^= 0x80;
205 gf_mulx(pad);
208 for (i = 0; i < BLOCK_SIZE; i++)
209 pad[i] ^= cbc[i];
210 aes_encrypt(ctx, pad, mac);
211 aes_encrypt_deinit(ctx);
212 return 0;
215 #endif /* CONFIG_NO_AES_OMAC1 */
219 * aes_128_encrypt_block - Perform one AES 128-bit block operation
220 * @key: Key for AES
221 * @in: Input data (16 bytes)
222 * @out: Output of the AES block operation (16 bytes)
223 * Returns: 0 on success, -1 on failure
225 int aes_128_encrypt_block(const u8 *key, const u8 *in, u8 *out)
227 void *ctx;
228 ctx = aes_encrypt_init(key, 16);
229 if (ctx == NULL)
230 return -1;
231 aes_encrypt(ctx, in, out);
232 aes_encrypt_deinit(ctx);
233 return 0;
237 #ifndef CONFIG_NO_AES_CTR
240 * aes_128_ctr_encrypt - AES-128 CTR mode encryption
241 * @key: Key for encryption (16 bytes)
242 * @nonce: Nonce for counter mode (16 bytes)
243 * @data: Data to encrypt in-place
244 * @data_len: Length of data in bytes
245 * Returns: 0 on success, -1 on failure
247 int aes_128_ctr_encrypt(const u8 *key, const u8 *nonce,
248 u8 *data, size_t data_len)
250 void *ctx;
251 size_t j, len, left = data_len;
252 int i;
253 u8 *pos = data;
254 u8 counter[BLOCK_SIZE], buf[BLOCK_SIZE];
256 ctx = aes_encrypt_init(key, 16);
257 if (ctx == NULL)
258 return -1;
259 os_memcpy(counter, nonce, BLOCK_SIZE);
261 while (left > 0) {
262 aes_encrypt(ctx, counter, buf);
264 len = (left < BLOCK_SIZE) ? left : BLOCK_SIZE;
265 for (j = 0; j < len; j++)
266 pos[j] ^= buf[j];
267 pos += len;
268 left -= len;
270 for (i = BLOCK_SIZE - 1; i >= 0; i--) {
271 counter[i]++;
272 if (counter[i])
273 break;
276 aes_encrypt_deinit(ctx);
277 return 0;
280 #endif /* CONFIG_NO_AES_CTR */
283 #ifndef CONFIG_NO_AES_EAX
286 * aes_128_eax_encrypt - AES-128 EAX mode encryption
287 * @key: Key for encryption (16 bytes)
288 * @nonce: Nonce for counter mode
289 * @nonce_len: Nonce length in bytes
290 * @hdr: Header data to be authenticity protected
291 * @hdr_len: Length of the header data bytes
292 * @data: Data to encrypt in-place
293 * @data_len: Length of data in bytes
294 * @tag: 16-byte tag value
295 * Returns: 0 on success, -1 on failure
297 int aes_128_eax_encrypt(const u8 *key, const u8 *nonce, size_t nonce_len,
298 const u8 *hdr, size_t hdr_len,
299 u8 *data, size_t data_len, u8 *tag)
301 u8 *buf;
302 size_t buf_len;
303 u8 nonce_mac[BLOCK_SIZE], hdr_mac[BLOCK_SIZE], data_mac[BLOCK_SIZE];
304 int i;
306 if (nonce_len > data_len)
307 buf_len = nonce_len;
308 else
309 buf_len = data_len;
310 if (hdr_len > buf_len)
311 buf_len = hdr_len;
312 buf_len += 16;
314 buf = os_malloc(buf_len);
315 if (buf == NULL)
316 return -1;
318 os_memset(buf, 0, 15);
320 buf[15] = 0;
321 os_memcpy(buf + 16, nonce, nonce_len);
322 omac1_aes_128(key, buf, 16 + nonce_len, nonce_mac);
324 buf[15] = 1;
325 os_memcpy(buf + 16, hdr, hdr_len);
326 omac1_aes_128(key, buf, 16 + hdr_len, hdr_mac);
328 aes_128_ctr_encrypt(key, nonce_mac, data, data_len);
329 buf[15] = 2;
330 os_memcpy(buf + 16, data, data_len);
331 omac1_aes_128(key, buf, 16 + data_len, data_mac);
333 os_free(buf);
335 for (i = 0; i < BLOCK_SIZE; i++)
336 tag[i] = nonce_mac[i] ^ data_mac[i] ^ hdr_mac[i];
338 return 0;
343 * aes_128_eax_decrypt - AES-128 EAX mode decryption
344 * @key: Key for decryption (16 bytes)
345 * @nonce: Nonce for counter mode
346 * @nonce_len: Nonce length in bytes
347 * @hdr: Header data to be authenticity protected
348 * @hdr_len: Length of the header data bytes
349 * @data: Data to encrypt in-place
350 * @data_len: Length of data in bytes
351 * @tag: 16-byte tag value
352 * Returns: 0 on success, -1 on failure, -2 if tag does not match
354 int aes_128_eax_decrypt(const u8 *key, const u8 *nonce, size_t nonce_len,
355 const u8 *hdr, size_t hdr_len,
356 u8 *data, size_t data_len, const u8 *tag)
358 u8 *buf;
359 size_t buf_len;
360 u8 nonce_mac[BLOCK_SIZE], hdr_mac[BLOCK_SIZE], data_mac[BLOCK_SIZE];
361 int i;
363 if (nonce_len > data_len)
364 buf_len = nonce_len;
365 else
366 buf_len = data_len;
367 if (hdr_len > buf_len)
368 buf_len = hdr_len;
369 buf_len += 16;
371 buf = os_malloc(buf_len);
372 if (buf == NULL)
373 return -1;
375 os_memset(buf, 0, 15);
377 buf[15] = 0;
378 os_memcpy(buf + 16, nonce, nonce_len);
379 omac1_aes_128(key, buf, 16 + nonce_len, nonce_mac);
381 buf[15] = 1;
382 os_memcpy(buf + 16, hdr, hdr_len);
383 omac1_aes_128(key, buf, 16 + hdr_len, hdr_mac);
385 buf[15] = 2;
386 os_memcpy(buf + 16, data, data_len);
387 omac1_aes_128(key, buf, 16 + data_len, data_mac);
389 os_free(buf);
391 for (i = 0; i < BLOCK_SIZE; i++) {
392 if (tag[i] != (nonce_mac[i] ^ data_mac[i] ^ hdr_mac[i]))
393 return -2;
396 aes_128_ctr_encrypt(key, nonce_mac, data, data_len);
398 return 0;
401 #endif /* CONFIG_NO_AES_EAX */
404 #ifndef CONFIG_NO_AES_CBC
407 * aes_128_cbc_encrypt - AES-128 CBC encryption
408 * @key: Encryption key
409 * @iv: Encryption IV for CBC mode (16 bytes)
410 * @data: Data to encrypt in-place
411 * @data_len: Length of data in bytes (must be divisible by 16)
412 * Returns: 0 on success, -1 on failure
414 int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
416 void *ctx;
417 u8 cbc[BLOCK_SIZE];
418 u8 *pos = data;
419 int i, j, blocks;
421 ctx = aes_encrypt_init(key, 16);
422 if (ctx == NULL)
423 return -1;
424 os_memcpy(cbc, iv, BLOCK_SIZE);
426 blocks = data_len / BLOCK_SIZE;
427 for (i = 0; i < blocks; i++) {
428 for (j = 0; j < BLOCK_SIZE; j++)
429 cbc[j] ^= pos[j];
430 aes_encrypt(ctx, cbc, cbc);
431 os_memcpy(pos, cbc, BLOCK_SIZE);
432 pos += BLOCK_SIZE;
434 aes_encrypt_deinit(ctx);
435 return 0;
440 * aes_128_cbc_decrypt - AES-128 CBC decryption
441 * @key: Decryption key
442 * @iv: Decryption IV for CBC mode (16 bytes)
443 * @data: Data to decrypt in-place
444 * @data_len: Length of data in bytes (must be divisible by 16)
445 * Returns: 0 on success, -1 on failure
447 int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
449 void *ctx;
450 u8 cbc[BLOCK_SIZE], tmp[BLOCK_SIZE];
451 u8 *pos = data;
452 int i, j, blocks;
454 ctx = aes_decrypt_init(key, 16);
455 if (ctx == NULL)
456 return -1;
457 os_memcpy(cbc, iv, BLOCK_SIZE);
459 blocks = data_len / BLOCK_SIZE;
460 for (i = 0; i < blocks; i++) {
461 os_memcpy(tmp, pos, BLOCK_SIZE);
462 aes_decrypt(ctx, pos, pos);
463 for (j = 0; j < BLOCK_SIZE; j++)
464 pos[j] ^= cbc[j];
465 os_memcpy(cbc, tmp, BLOCK_SIZE);
466 pos += BLOCK_SIZE;
468 aes_decrypt_deinit(ctx);
469 return 0;
472 #endif /* CONFIG_NO_AES_CBC */