git.zerfleddert.de Git - proxmark3-svn/blob - common/polarssl/aes_cmac128.c

   1 /*
   2  *  AES-CMAC from NIST Special Publication 800-38B \97 Recommendation for block cipher modes of operation: The CMAC mode for authentication.
   3  *
   4  *  Copyright (C) 2006-2014, Brainspark B.V.
   5  *  Copyright (C) 2014, Anargyros Plemenos
   6  *  Tests added Merkok, 2018
   7  *
   8  *  This file is part of PolarSSL (http://www.polarssl.org)
   9  *  Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
  10  *
  11  *  All rights reserved.
  12  *
  13  *  This program is free software; you can redistribute it and/or modify
  14  *  it under the terms of the GNU General Public License as published by
  15  *  the Free Software Foundation; either version 2 of the License, or
  16  *  (at your option) any later version.
  17  *
  18  *  This program is distributed in the hope that it will be useful,
  19  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  *  GNU General Public License for more details.
  22  *
  23  *  You should have received a copy of the GNU General Public License along
  24  *  with this program; if not, write to the Free Software Foundation, Inc.,
  25  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  26  *
  27  *  Reference : https://polarssl.org/discussions/generic/authentication-token
  28  *  NIST Special Publication 800-38B \97 Recommendation for block cipher modes of operation: The CMAC mode for authentication.
  29  *  Tests here:
  30  *  https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/AES_CMAC.pdf
  31 */
  32
  33 #include "polarssl/aes_cmac128.h"
  34 #include <stdio.h>
  35
  36 #define MIN(a,b)           ((a)<(b)?(a):(b))
  37 #define _MSB(x)            (((x)[0] & 0x80)?1:0)
  38
  39 #if !defined(POLARSSL_CONFIG_FILE)
  40 #include "polarssl_config.h"
  41 #else
  42 #include POLARSSL_CONFIG_FILE
  43 #endif
  44
  45 #if defined(POLARSSL_AES_C)
  46 #include "aes.h"
  47 #endif
  48
  49 #if defined(POLARSSL_PLATFORM_C)
  50 #include "polarssl/platform.h"
  51 #else
  52 #define polarssl_printf printf
  53 #endif
  54
  55
  56 /**
  57  * zero a structure
  58  */
  59 #define ZERO_STRUCT(x)      memset((char *)&(x), 0, sizeof(x))
  60
  61 /**
  62  * zero a structure given a pointer to the structure
  63  */
  64 #define ZERO_STRUCTP(x)     do{ if((x) != NULL) memset((char *)(x), 0, sizeof(*(x)));} while(0)
  65
  66
  67 /* For CMAC Calculation */
  68 static unsigned char const_Rb[16] = {
  69         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  70         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x87
  71 };
  72 static unsigned char const_Zero[16] = {
  73         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  74         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  75 };
  76
  77 static inline void aes_cmac_128_left_shift_1(const uint8_t in[16], uint8_t out[16])
  78 {
  79         uint8_t overflow = 0;
  80         int8_t i;
  81
  82         for (i = 15; i >= 0; i--) {
  83                 out[i] = in[i] << 1;
  84                 out[i] |= overflow;
  85                 overflow = _MSB(&in[i]);
  86          }
  87 }
  88
  89 static inline void aes_cmac_128_xor(const uint8_t in1[16], const uint8_t in2[16],
  90                                                                                 uint8_t out[16])
  91 {
  92         uint8_t i;
  93
  94         for (i = 0; i < 16; i++) {
  95                 out[i] = in1[i] ^ in2[i];
  96         }
  97 }
  98
  99 /*
 100  * AES-CMAC-128 context setup
 101  */
 102 void aes_cmac128_starts(aes_cmac128_context *ctx, const uint8_t K[16])
 103 {
 104         uint8_t L[16];
 105
 106         /* Zero struct of aes_context */
 107         ZERO_STRUCTP(ctx);
 108         /* Initialize aes_context */
 109         aes_setkey_enc(&ctx->aes_key, K, 128);
 110
 111         /* step 1 - generate subkeys k1 and k2 */
 112         aes_crypt_ecb(&ctx->aes_key, AES_ENCRYPT, const_Zero, L);
 113
 114         if (_MSB(L) == 0) {
 115                 aes_cmac_128_left_shift_1(L, ctx->K1);
 116         } else {
 117                 uint8_t tmp_block[16];
 118
 119                 aes_cmac_128_left_shift_1(L, tmp_block);
 120                 aes_cmac_128_xor(tmp_block, const_Rb, ctx->K1);
 121                 ZERO_STRUCT(tmp_block);
 122         }
 123
 124         if (_MSB(ctx->K1) == 0) {
 125                 aes_cmac_128_left_shift_1(ctx->K1, ctx->K2);
 126         } else {
 127                 uint8_t tmp_block[16];
 128
 129                 aes_cmac_128_left_shift_1(ctx->K1, tmp_block);
 130                 aes_cmac_128_xor(tmp_block, const_Rb, ctx->K2);
 131                 ZERO_STRUCT(tmp_block);
 132    }
 133
 134         ZERO_STRUCT(L);
 135 }
 136
 137 /*
 138  * AES-CMAC-128 process message
 139  */
 140 void aes_cmac128_update(aes_cmac128_context *ctx, const uint8_t *_msg, size_t _msg_len)
 141 {
 142         uint8_t tmp_block[16];
 143         uint8_t Y[16];
 144         const uint8_t *msg = _msg;
 145         size_t msg_len = _msg_len;
 146
 147         /*
 148          * copy the remembered last block
 149          */
 150         ZERO_STRUCT(tmp_block);
 151         if (ctx->last_len) {
 152                 memcpy(tmp_block, ctx->last, ctx->last_len);
 153         }
 154
 155         /*
 156          * check if we expand the block
 157          */
 158         if (ctx->last_len < 16) {
 159                 size_t len = MIN(16 - ctx->last_len, msg_len);
 160
 161                 memcpy(&tmp_block[ctx->last_len], msg, len);
 162                 memcpy(ctx->last, tmp_block, 16);
 163                 msg += len;
 164                 msg_len -= len;
 165                 ctx->last_len += len;
 166         }
 167
 168         if (msg_len == 0) {
 169                 /* if it is still the last block, we are done */
 170                 ZERO_STRUCT(tmp_block);
 171                 return;
 172         }
 173
 174         /*
 175          * It is not the last block anymore
 176          */
 177         ZERO_STRUCT(ctx->last);
 178         ctx->last_len = 0;
 179
 180         /*
 181          * now checksum everything but the last block
 182          */
 183         aes_cmac_128_xor(ctx->X, tmp_block, Y);
 184         aes_crypt_ecb(&ctx->aes_key, AES_ENCRYPT, Y, ctx->X);
 185
 186         while (msg_len > 16) {
 187                 memcpy(tmp_block, msg, 16);
 188                 msg += 16;
 189                 msg_len -= 16;
 190
 191                 aes_cmac_128_xor(ctx->X, tmp_block, Y);
 192                 aes_crypt_ecb(&ctx->aes_key, AES_ENCRYPT, Y, ctx->X);
 193         }
 194
 195         /*
 196          * copy the last block, it will be processed in
 197          * aes_cmac128_final().
 198          */
 199          memcpy(ctx->last, msg, msg_len);
 200          ctx->last_len = msg_len;
 201
 202         ZERO_STRUCT(tmp_block);
 203         ZERO_STRUCT(Y);
 204 }
 205
 206 /*
 207  * AES-CMAC-128 compute T
 208  */
 209 void aes_cmac128_final(aes_cmac128_context *ctx, uint8_t T[16])
 210 {
 211         uint8_t tmp_block[16];
 212         uint8_t Y[16];
 213
 214         if (ctx->last_len < 16) {
 215                 ctx->last[ctx->last_len] = 0x80;
 216                 aes_cmac_128_xor(ctx->last, ctx->K2, tmp_block);
 217         } else {
 218                 aes_cmac_128_xor(ctx->last, ctx->K1, tmp_block);
 219         }
 220
 221         aes_cmac_128_xor(tmp_block, ctx->X, Y);
 222         aes_crypt_ecb(&ctx->aes_key, AES_ENCRYPT, Y, T);
 223
 224         ZERO_STRUCT(tmp_block);
 225         ZERO_STRUCT(Y);
 226         ZERO_STRUCTP(ctx);
 227 }
 228
 229 /*
 230  * Checkup routine
 231  *
 232  * https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values
 233  * https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/AES_CMAC.pdf
 234  */
 235 int aes_cmac_self_test( int verbose )
 236 {
 237         unsigned char key[16] = {0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C};
 238         unsigned char mac[16] = {0};
 239         aes_cmac128_context ctx;
 240         int ret;
 241
 242         // check Example1:
 243         if( verbose != 0 )
 244                 polarssl_printf( "  AES-CMAC-128 zero length data: " );
 245         unsigned char ex1data[16] = {0};
 246         aes_cmac128_starts(&ctx, key);
 247         aes_cmac128_update(&ctx, ex1data, 0);
 248         aes_cmac128_final(&ctx, mac);
 249         unsigned char ex1res[16] = {0xBB, 0x1D, 0x69, 0x29, 0xE9, 0x59, 0x37, 0x28, 0x7F, 0xA3, 0x7D, 0x12, 0x9B, 0x75, 0x67, 0x46};
 250         if(!memcmp(mac, ex1res, 16)) {
 251                 if( verbose != 0 )
 252                         polarssl_printf( "passed\n" );
 253         } else {
 254                 polarssl_printf( "failed\n" );
 255                 ret = 1;
 256                 goto exit;
 257         }
 258
 259         // check Example2:
 260         if( verbose != 0 )
 261                 polarssl_printf( "  AES-CMAC-128 one block data  : " );
 262         unsigned char ex2data[16] = {0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A};
 263         aes_cmac128_starts(&ctx, key);
 264         aes_cmac128_update(&ctx, ex2data, sizeof(ex2data));
 265         aes_cmac128_final(&ctx, mac);
 266         unsigned char ex2res[16] = {0x07, 0x0A, 0x16, 0xB4, 0x6B, 0x4D, 0x41, 0x44, 0xF7, 0x9B, 0xDD, 0x9D, 0xD0, 0x4A, 0x28, 0x7C};
 267         if(!memcmp(mac, ex2res, 16)) {
 268                 if( verbose != 0 )
 269                         polarssl_printf( "passed\n" );
 270         } else {
 271                 polarssl_printf( "failed\n" );
 272                 ret = 1;
 273                 goto exit;
 274         }
 275
 276         // check Example3:
 277         if( verbose != 0 )
 278                 polarssl_printf( "  AES-CMAC-128 20 bytes of data: " );
 279         unsigned char ex3data[20] = {0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
 280                                                                  0xAE, 0x2D, 0x8A, 0x57};
 281         aes_cmac128_starts(&ctx, key);
 282         aes_cmac128_update(&ctx, ex3data, sizeof(ex3data));
 283         aes_cmac128_final(&ctx, mac);
 284         unsigned char ex3res[16] = {0x7D, 0x85, 0x44, 0x9E, 0xA6, 0xEA, 0x19, 0xC8, 0x23, 0xA7, 0xBF, 0x78, 0x83, 0x7D, 0xFA, 0xDE};
 285         if(!memcmp(mac, ex3res, 16)) {
 286                 if( verbose != 0 )
 287                         polarssl_printf( "passed\n" );
 288         } else {
 289                 polarssl_printf( "failed\n" );
 290                 ret = 1;
 291                 goto exit;
 292         }
 293
 294         // check Example4:
 295         if( verbose != 0 )
 296                 polarssl_printf( "  AES-CMAC-128 4 blocks of data: " );
 297         unsigned char ex4data[64] = {0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
 298                                                                  0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
 299                                                                  0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
 300                                                                  0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17, 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10};
 301         aes_cmac128_starts(&ctx, key);
 302         aes_cmac128_update(&ctx, ex4data, sizeof(ex4data));
 303         aes_cmac128_final(&ctx, mac);
 304         unsigned char ex4res[16] = {0x51, 0xF0, 0xBE, 0xBF, 0x7E, 0x3B, 0x9D, 0x92, 0xFC, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3C, 0xFE};
 305         if(!memcmp(mac, ex4res, 16)) {
 306                 if( verbose != 0 )
 307                         polarssl_printf( "passed\n" );
 308         } else {
 309                 polarssl_printf( "failed\n" );
 310                 ret = 1;
 311                 goto exit;
 312         }
 313
 314         if( verbose != 0 )
 315                 polarssl_printf( "\n" );
 316
 317         ret = 0;
 318
 319 exit:
 320         return( ret );
 321 }
 322