1/* $NetBSD: aesxcbcmac.c,v 1.2 2016/09/26 14:50:54 christos Exp $ */
2
3/*
4 * Copyright (C) 1995, 1996, 1997, 1998 and 2003 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33__KERNEL_RCSID(0, "$NetBSD: aesxcbcmac.c,v 1.2 2016/09/26 14:50:54 christos Exp $");
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <crypto/rijndael/rijndael.h>
38
39#include <opencrypto/aesxcbcmac.h>
40
41int
42aes_xcbc_mac_init(void *vctx, const uint8_t *key, u_int16_t keylen)
43{
44 static const uint8_t k1seed[AES_BLOCKSIZE] =
45 { 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 };
46 static const uint8_t k2seed[AES_BLOCKSIZE] =
47 { 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2 };
48 static const uint8_t k3seed[AES_BLOCKSIZE] =
49 { 3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3 };
50 u_int32_t r_ks[(RIJNDAEL_MAXNR+1)*4];
51 aesxcbc_ctx *ctx;
52 uint8_t k1[AES_BLOCKSIZE];
53
54 ctx = vctx;
55 memset(ctx, 0, sizeof(*ctx));
56
57 if ((ctx->r_nr = rijndaelKeySetupEnc(r_ks, key, keylen * 8)) == 0)
58 return -1;
59 rijndaelEncrypt(r_ks, ctx->r_nr, k1seed, k1);
60 rijndaelEncrypt(r_ks, ctx->r_nr, k2seed, ctx->k2);
61 rijndaelEncrypt(r_ks, ctx->r_nr, k3seed, ctx->k3);
62 if (rijndaelKeySetupEnc(ctx->r_k1s, k1, AES_BLOCKSIZE * 8) == 0)
63 return -1;
64 if (rijndaelKeySetupEnc(ctx->r_k2s, ctx->k2, AES_BLOCKSIZE * 8) == 0)
65 return -1;
66 if (rijndaelKeySetupEnc(ctx->r_k3s, ctx->k3, AES_BLOCKSIZE * 8) == 0)
67 return -1;
68
69 return 0;
70}
71
72int
73aes_xcbc_mac_loop(void *vctx, const uint8_t *addr, u_int16_t len)
74{
75 uint8_t buf[AES_BLOCKSIZE];
76 aesxcbc_ctx *ctx;
77 const uint8_t *ep;
78 int i;
79
80 ctx = vctx;
81 ep = addr + len;
82
83 if (ctx->buflen == sizeof(ctx->buf)) {
84 for (i = 0; i < sizeof(ctx->e); i++)
85 ctx->buf[i] ^= ctx->e[i];
86 rijndaelEncrypt(ctx->r_k1s, ctx->r_nr, ctx->buf, ctx->e);
87 ctx->buflen = 0;
88 }
89 if (ctx->buflen + len < sizeof(ctx->buf)) {
90 memcpy(ctx->buf + ctx->buflen, addr, len);
91 ctx->buflen += len;
92 return 0;
93 }
94 if (ctx->buflen && ctx->buflen + len > sizeof(ctx->buf)) {
95 memcpy(ctx->buf + ctx->buflen, addr,
96 sizeof(ctx->buf) - ctx->buflen);
97 for (i = 0; i < sizeof(ctx->e); i++)
98 ctx->buf[i] ^= ctx->e[i];
99 rijndaelEncrypt(ctx->r_k1s, ctx->r_nr, ctx->buf, ctx->e);
100 addr += sizeof(ctx->buf) - ctx->buflen;
101 ctx->buflen = 0;
102 }
103 /* due to the special processing for M[n], "=" case is not included */
104 while (ep - addr > AES_BLOCKSIZE) {
105 memcpy(buf, addr, AES_BLOCKSIZE);
106 for (i = 0; i < sizeof(buf); i++)
107 buf[i] ^= ctx->e[i];
108 rijndaelEncrypt(ctx->r_k1s, ctx->r_nr, buf, ctx->e);
109 addr += AES_BLOCKSIZE;
110 }
111 if (addr < ep) {
112 memcpy(ctx->buf + ctx->buflen, addr, ep - addr);
113 ctx->buflen += ep - addr;
114 }
115 return 0;
116}
117
118void
119aes_xcbc_mac_result(uint8_t *addr, void *vctx)
120{
121 uint8_t digest[AES_BLOCKSIZE];
122 aesxcbc_ctx *ctx;
123 int i;
124
125 ctx = vctx;
126
127 if (ctx->buflen == sizeof(ctx->buf)) {
128 for (i = 0; i < sizeof(ctx->buf); i++) {
129 ctx->buf[i] ^= ctx->e[i];
130 ctx->buf[i] ^= ctx->k2[i];
131 }
132 rijndaelEncrypt(ctx->r_k1s, ctx->r_nr, ctx->buf, digest);
133 } else {
134 for (i = ctx->buflen; i < sizeof(ctx->buf); i++)
135 ctx->buf[i] = (i == ctx->buflen) ? 0x80 : 0x00;
136 for (i = 0; i < sizeof(ctx->buf); i++) {
137 ctx->buf[i] ^= ctx->e[i];
138 ctx->buf[i] ^= ctx->k3[i];
139 }
140 rijndaelEncrypt(ctx->r_k1s, ctx->r_nr, ctx->buf, digest);
141 }
142
143 memcpy(addr, digest, sizeof(digest));
144}
145