]> git.zerfleddert.de Git - proxmark3-svn/blame - common/mbedtls/cmac.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
gcc10 compiler fixes:
[proxmark3-svn] / common / mbedtls / cmac.c
CommitLineData
700d8687
OM		 1/**
2 * \file cmac.c
3 *
4 * \brief NIST SP800-38B compliant CMAC implementation for AES and 3DES
5 *
6 * Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
7 * SPDX-License-Identifier: GPL-2.0
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write to the Free Software Foundation, Inc.,
21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22 *
23 * This file is part of mbed TLS (https://tls.mbed.org)
24 */
25
26/*
27 * References:
28 *
29 * - NIST SP 800-38B Recommendation for Block Cipher Modes of Operation: The
30 * CMAC Mode for Authentication
31 * http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf
32 *
33 * - RFC 4493 - The AES-CMAC Algorithm
34 * https://tools.ietf.org/html/rfc4493
35 *
36 * - RFC 4615 - The Advanced Encryption Standard-Cipher-based Message
37 * Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128)
38 * Algorithm for the Internet Key Exchange Protocol (IKE)
39 * https://tools.ietf.org/html/rfc4615
40 *
41 * Additional test vectors: ISO/IEC 9797-1
42 *
43 */
44
45#if !defined(MBEDTLS_CONFIG_FILE)
46#include "mbedtls/config.h"
47#else
48#include MBEDTLS_CONFIG_FILE
49#endif
50
51#if defined(MBEDTLS_CMAC_C)
52
53#include "mbedtls/cmac.h"
54#include "mbedtls/platform_util.h"
55
56#include <string.h>
57
58
59#if defined(MBEDTLS_PLATFORM_C)
60#include "mbedtls/platform.h"
61#else
62#include <stdlib.h>
63#define mbedtls_calloc calloc
64#define mbedtls_free free
65#if defined(MBEDTLS_SELF_TEST)
66#include <stdio.h>
67#define mbedtls_printf printf
68#endif /* MBEDTLS_SELF_TEST */
69#endif /* MBEDTLS_PLATFORM_C */
70
71#if !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST)
72
73/*
74 * Multiplication by u in the Galois field of GF(2^n)
75 *
76 * As explained in NIST SP 800-38B, this can be computed:
77 *
78 * If MSB(p) = 0, then p = (p << 1)
79 * If MSB(p) = 1, then p = (p << 1) ^ R_n
80 * with R_64 = 0x1B and R_128 = 0x87
81 *
82 * Input and output MUST NOT point to the same buffer
83 * Block size must be 8 bytes or 16 bytes - the block sizes for DES and AES.
84 */
85static int cmac_multiply_by_u( unsigned char *output,
86 const unsigned char *input,
87 size_t blocksize )
88{
89 const unsigned char R_128 = 0x87;
90 const unsigned char R_64 = 0x1B;
91 unsigned char R_n, mask;
92 unsigned char overflow = 0x00;
93 int i;
94
95 if( blocksize == MBEDTLS_AES_BLOCK_SIZE )
96 {
97 R_n = R_128;
98 }
99 else if( blocksize == MBEDTLS_DES3_BLOCK_SIZE )
100 {
101 R_n = R_64;
102 }
103 else
104 {
105 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
106 }
107
108 for( i = (int)blocksize - 1; i >= 0; i-- )
109 {
110 output[i] = input[i] << 1 | overflow;
111 overflow = input[i] >> 7;
112 }
113
114 /* mask = ( input[0] >> 7 ) ? 0xff : 0x00
115 * using bit operations to avoid branches */
116
117 /* MSVC has a warning about unary minus on unsigned, but this is
118 * well-defined and precisely what we want to do here */
119#if defined(_MSC_VER)
120#pragma warning( push )
121#pragma warning( disable : 4146 )
122#endif
123 mask = - ( input[0] >> 7 );
124#if defined(_MSC_VER)
125#pragma warning( pop )
126#endif
127
128 output[ blocksize - 1 ] ^= R_n & mask;
129
130 return( 0 );
131}
132
133/*
134 * Generate subkeys
135 *
136 * - as specified by RFC 4493, section 2.3 Subkey Generation Algorithm
137 */
138static int cmac_generate_subkeys( mbedtls_cipher_context_t *ctx,
139 unsigned char* K1, unsigned char* K2 )
140{
141 int ret;
142 unsigned char L[MBEDTLS_CIPHER_BLKSIZE_MAX];
143 size_t olen, block_size;
144
145 mbedtls_platform_zeroize( L, sizeof( L ) );
146
147 block_size = ctx->cipher_info->block_size;
148
149 /* Calculate Ek(0) */
150 if( ( ret = mbedtls_cipher_update( ctx, L, block_size, L, &olen ) ) != 0 )
151 goto exit;
152
153 /*
154 * Generate K1 and K2
155 */
156 if( ( ret = cmac_multiply_by_u( K1, L , block_size ) ) != 0 )
157 goto exit;
158
159 if( ( ret = cmac_multiply_by_u( K2, K1 , block_size ) ) != 0 )
160 goto exit;
161
162exit:
163 mbedtls_platform_zeroize( L, sizeof( L ) );
164
165 return( ret );
166}
167#endif /* !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST) */
168
169#if !defined(MBEDTLS_CMAC_ALT)
170static void cmac_xor_block( unsigned char *output, const unsigned char *input1,
171 const unsigned char *input2,
172 const size_t block_size )
173{
174 size_t idx;
175
176 for( idx = 0; idx < block_size; idx++ )
177 output[ idx ] = input1[ idx ] ^ input2[ idx ];
178}
179
180/*
181 * Create padded last block from (partial) last block.
182 *
183 * We can't use the padding option from the cipher layer, as it only works for
184 * CBC and we use ECB mode, and anyway we need to XOR K1 or K2 in addition.
185 */
186static void cmac_pad( unsigned char padded_block[MBEDTLS_CIPHER_BLKSIZE_MAX],
187 size_t padded_block_len,
188 const unsigned char *last_block,
189 size_t last_block_len )
190{
191 size_t j;
192
193 for( j = 0; j < padded_block_len; j++ )
194 {
195 if( j < last_block_len )
196 padded_block[j] = last_block[j];
197 else if( j == last_block_len )
198 padded_block[j] = 0x80;
199 else
200 padded_block[j] = 0x00;
201 }
202}
203
204int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx,
205 const unsigned char *key, size_t keybits )
206{
207 mbedtls_cipher_type_t type;
208 mbedtls_cmac_context_t *cmac_ctx;
209 int retval;
210
211 if( ctx == NULL || ctx->cipher_info == NULL || key == NULL )
212 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
213
214 if( ( retval = mbedtls_cipher_setkey( ctx, key, (int)keybits,
215 MBEDTLS_ENCRYPT ) ) != 0 )
216 return( retval );
217
218 type = ctx->cipher_info->type;
219
220 switch( type )
221 {
222 case MBEDTLS_CIPHER_AES_128_ECB:
223 case MBEDTLS_CIPHER_AES_192_ECB:
224 case MBEDTLS_CIPHER_AES_256_ECB:
225 case MBEDTLS_CIPHER_DES_EDE3_ECB:
226 break;
227 default:
228 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
229 }
230
231 /* Allocated and initialise in the cipher context memory for the CMAC
232 * context */
233 cmac_ctx = mbedtls_calloc( 1, sizeof( mbedtls_cmac_context_t ) );
234 if( cmac_ctx == NULL )
235 return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
236
237 ctx->cmac_ctx = cmac_ctx;
238
239 mbedtls_platform_zeroize( cmac_ctx->state, sizeof( cmac_ctx->state ) );
240
241 return 0;
242}
243
244int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx,
245 const unsigned char *input, size_t ilen )
246{
247 mbedtls_cmac_context_t* cmac_ctx;
248 unsigned char *state;
249 int ret = 0;
250 size_t n, j, olen, block_size;
251
252 if( ctx == NULL || ctx->cipher_info == NULL || input == NULL ||
253 ctx->cmac_ctx == NULL )
254 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
255
256 cmac_ctx = ctx->cmac_ctx;
257 block_size = ctx->cipher_info->block_size;
258 state = ctx->cmac_ctx->state;
259
260 /* Is there data still to process from the last call, that's greater in
261 * size than a block? */
262 if( cmac_ctx->unprocessed_len > 0 &&
263 ilen > block_size - cmac_ctx->unprocessed_len )
264 {
265 memcpy( &cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
266 input,
267 block_size - cmac_ctx->unprocessed_len );
268
269 cmac_xor_block( state, cmac_ctx->unprocessed_block, state, block_size );
270
271 if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
272 &olen ) ) != 0 )
273 {
274 goto exit;
275 }
276
277 input += block_size - cmac_ctx->unprocessed_len;
278 ilen -= block_size - cmac_ctx->unprocessed_len;
279 cmac_ctx->unprocessed_len = 0;
280 }
281
282 /* n is the number of blocks including any final partial block */
283 n = ( ilen + block_size - 1 ) / block_size;
284
285 /* Iterate across the input data in block sized chunks, excluding any
286 * final partial or complete block */
287 for( j = 1; j < n; j++ )
288 {
289 cmac_xor_block( state, input, state, block_size );
290
291 if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
292 &olen ) ) != 0 )
293 goto exit;
294
295 ilen -= block_size;
296 input += block_size;
297 }
298
299 /* If there is data left over that wasn't aligned to a block */
300 if( ilen > 0 )
301 {
302 memcpy( &cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
303 input,
304 ilen );
305 cmac_ctx->unprocessed_len += ilen;
306 }
307
308exit:
309 return( ret );
310}
311
312int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx,
313 unsigned char *output )
314{
315 mbedtls_cmac_context_t* cmac_ctx;
316 unsigned char *state, *last_block;
317 unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
318 unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
319 unsigned char M_last[MBEDTLS_CIPHER_BLKSIZE_MAX];
320 int ret;
321 size_t olen, block_size;
322
323 if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL ||
324 output == NULL )
325 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
326
327 cmac_ctx = ctx->cmac_ctx;
328 block_size = ctx->cipher_info->block_size;
329 state = cmac_ctx->state;
330
331 mbedtls_platform_zeroize( K1, sizeof( K1 ) );
332 mbedtls_platform_zeroize( K2, sizeof( K2 ) );
333 cmac_generate_subkeys( ctx, K1, K2 );
334
335 last_block = cmac_ctx->unprocessed_block;
336
337 /* Calculate last block */
338 if( cmac_ctx->unprocessed_len < block_size )
339 {
340 cmac_pad( M_last, block_size, last_block, cmac_ctx->unprocessed_len );
341 cmac_xor_block( M_last, M_last, K2, block_size );
342 }
343 else
344 {
345 /* Last block is complete block */
346 cmac_xor_block( M_last, last_block, K1, block_size );
347 }
348
349
350 cmac_xor_block( state, M_last, state, block_size );
351 if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
352 &olen ) ) != 0 )
353 {
354 goto exit;
355 }
356
357 memcpy( output, state, block_size );
358
359exit:
360 /* Wipe the generated keys on the stack, and any other transients to avoid
361 * side channel leakage */
362 mbedtls_platform_zeroize( K1, sizeof( K1 ) );
363 mbedtls_platform_zeroize( K2, sizeof( K2 ) );
364
365 cmac_ctx->unprocessed_len = 0;
366 mbedtls_platform_zeroize( cmac_ctx->unprocessed_block,
367 sizeof( cmac_ctx->unprocessed_block ) );
368
369 mbedtls_platform_zeroize( state, MBEDTLS_CIPHER_BLKSIZE_MAX );
370 return( ret );
371}
372
373int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx )
374{
375 mbedtls_cmac_context_t* cmac_ctx;
376
377 if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL )
378 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
379
380 cmac_ctx = ctx->cmac_ctx;
381
382 /* Reset the internal state */
383 cmac_ctx->unprocessed_len = 0;
384 mbedtls_platform_zeroize( cmac_ctx->unprocessed_block,
385 sizeof( cmac_ctx->unprocessed_block ) );
386 mbedtls_platform_zeroize( cmac_ctx->state,
387 sizeof( cmac_ctx->state ) );
388
389 return( 0 );
390}
391
392int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info,
393 const unsigned char *key, size_t keylen,
394 const unsigned char *input, size_t ilen,
395 unsigned char *output )
396{
397 mbedtls_cipher_context_t ctx;
398 int ret;
399
400 if( cipher_info == NULL || key == NULL || input == NULL || output == NULL )
401 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
402
403 mbedtls_cipher_init( &ctx );
404
405 if( ( ret = mbedtls_cipher_setup( &ctx, cipher_info ) ) != 0 )
406 goto exit;
407
408 ret = mbedtls_cipher_cmac_starts( &ctx, key, keylen );
409 if( ret != 0 )
410 goto exit;
411
412 ret = mbedtls_cipher_cmac_update( &ctx, input, ilen );
413 if( ret != 0 )
414 goto exit;
415
416 ret = mbedtls_cipher_cmac_finish( &ctx, output );
417
418exit:
419 mbedtls_cipher_free( &ctx );
420
421 return( ret );
422}
423
424#if defined(MBEDTLS_AES_C)
425/*
426 * Implementation of AES-CMAC-PRF-128 defined in RFC 4615
427 */
428int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_length,
429 const unsigned char *input, size_t in_len,
430 unsigned char *output )
431{
432 int ret;
433 const mbedtls_cipher_info_t *cipher_info;
434 unsigned char zero_key[MBEDTLS_AES_BLOCK_SIZE];
435 unsigned char int_key[MBEDTLS_AES_BLOCK_SIZE];
436
437 if( key == NULL || input == NULL || output == NULL )
438 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
439
440 cipher_info = mbedtls_cipher_info_from_type( MBEDTLS_CIPHER_AES_128_ECB );
441 if( cipher_info == NULL )
442 {
443 /* Failing at this point must be due to a build issue */
444 ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
445 goto exit;
446 }
447
448 if( key_length == MBEDTLS_AES_BLOCK_SIZE )
449 {
450 /* Use key as is */
451 memcpy( int_key, key, MBEDTLS_AES_BLOCK_SIZE );
452 }
453 else
454 {
455 memset( zero_key, 0, MBEDTLS_AES_BLOCK_SIZE );
456
457 ret = mbedtls_cipher_cmac( cipher_info, zero_key, 128, key,
458 key_length, int_key );
459 if( ret != 0 )
460 goto exit;
461 }
462
463 ret = mbedtls_cipher_cmac( cipher_info, int_key, 128, input, in_len,
464 output );
465
466exit:
467 mbedtls_platform_zeroize( int_key, sizeof( int_key ) );
468
469 return( ret );
470}
471#endif /* MBEDTLS_AES_C */
472
473#endif /* !MBEDTLS_CMAC_ALT */
474
475#if defined(MBEDTLS_SELF_TEST)
476/*
477 * CMAC test data for SP800-38B
478 * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/AES_CMAC.pdf
479 * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/TDES_CMAC.pdf
480 *
481 * AES-CMAC-PRF-128 test data from RFC 4615
482 * https://tools.ietf.org/html/rfc4615#page-4
483 */
484
485#define NB_CMAC_TESTS_PER_KEY 4
486#define NB_PRF_TESTS 3
487
488#if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C)
489/* All CMAC test inputs are truncated from the same 64 byte buffer. */
490static const unsigned char test_message[] = {
491 /* PT */
492 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
493 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
494 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
495 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
496 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
497 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
498 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
499 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
500};
501#endif /* MBEDTLS_AES_C || MBEDTLS_DES_C */
502
503#if defined(MBEDTLS_AES_C)
504/* Truncation point of message for AES CMAC tests */
505static const unsigned int aes_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
506 /* Mlen */
507 0,
508 16,
509 20,
510 64
511};
512
513/* CMAC-AES128 Test Data */
514static const unsigned char aes_128_key[16] = {
515 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
516 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
517};
518static const unsigned char aes_128_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
519 {
520 /* K1 */
521 0xfb, 0xee, 0xd6, 0x18, 0x35, 0x71, 0x33, 0x66,
522 0x7c, 0x85, 0xe0, 0x8f, 0x72, 0x36, 0xa8, 0xde
523 },
524 {
525 /* K2 */
526 0xf7, 0xdd, 0xac, 0x30, 0x6a, 0xe2, 0x66, 0xcc,
527 0xf9, 0x0b, 0xc1, 0x1e, 0xe4, 0x6d, 0x51, 0x3b
528 }
529};
530static const unsigned char aes_128_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
531 {
532 /* Example #1 */
533 0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
534 0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46
535 },
536 {
537 /* Example #2 */
538 0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
539 0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c
540 },
541 {
542 /* Example #3 */
543 0x7d, 0x85, 0x44, 0x9e, 0xa6, 0xea, 0x19, 0xc8,
544 0x23, 0xa7, 0xbf, 0x78, 0x83, 0x7d, 0xfa, 0xde
545 },
546 {
547 /* Example #4 */
548 0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
549 0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe
550 }
551};
552
553/* CMAC-AES192 Test Data */
554static const unsigned char aes_192_key[24] = {
555 0x8e, 0x73, 0xb0, 0xf7, 0xda, 0x0e, 0x64, 0x52,
556 0xc8, 0x10, 0xf3, 0x2b, 0x80, 0x90, 0x79, 0xe5,
557 0x62, 0xf8, 0xea, 0xd2, 0x52, 0x2c, 0x6b, 0x7b
558};
559static const unsigned char aes_192_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
560 {
561 /* K1 */
562 0x44, 0x8a, 0x5b, 0x1c, 0x93, 0x51, 0x4b, 0x27,
563 0x3e, 0xe6, 0x43, 0x9d, 0xd4, 0xda, 0xa2, 0x96
564 },
565 {
566 /* K2 */
567 0x89, 0x14, 0xb6, 0x39, 0x26, 0xa2, 0x96, 0x4e,
568 0x7d, 0xcc, 0x87, 0x3b, 0xa9, 0xb5, 0x45, 0x2c
569 }
570};
571static const unsigned char aes_192_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
572 {
573 /* Example #1 */
574 0xd1, 0x7d, 0xdf, 0x46, 0xad, 0xaa, 0xcd, 0xe5,
575 0x31, 0xca, 0xc4, 0x83, 0xde, 0x7a, 0x93, 0x67
576 },
577 {
578 /* Example #2 */
579 0x9e, 0x99, 0xa7, 0xbf, 0x31, 0xe7, 0x10, 0x90,
580 0x06, 0x62, 0xf6, 0x5e, 0x61, 0x7c, 0x51, 0x84
581 },
582 {
583 /* Example #3 */
584 0x3d, 0x75, 0xc1, 0x94, 0xed, 0x96, 0x07, 0x04,
585 0x44, 0xa9, 0xfa, 0x7e, 0xc7, 0x40, 0xec, 0xf8
586 },
587 {
588 /* Example #4 */
589 0xa1, 0xd5, 0xdf, 0x0e, 0xed, 0x79, 0x0f, 0x79,
590 0x4d, 0x77, 0x58, 0x96, 0x59, 0xf3, 0x9a, 0x11
591 }
592};
593
594/* CMAC-AES256 Test Data */
595static const unsigned char aes_256_key[32] = {
596 0x60, 0x3d, 0xeb, 0x10, 0x15, 0xca, 0x71, 0xbe,
597 0x2b, 0x73, 0xae, 0xf0, 0x85, 0x7d, 0x77, 0x81,
598 0x1f, 0x35, 0x2c, 0x07, 0x3b, 0x61, 0x08, 0xd7,
599 0x2d, 0x98, 0x10, 0xa3, 0x09, 0x14, 0xdf, 0xf4
600};
601static const unsigned char aes_256_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
602 {
603 /* K1 */
604 0xca, 0xd1, 0xed, 0x03, 0x29, 0x9e, 0xed, 0xac,
605 0x2e, 0x9a, 0x99, 0x80, 0x86, 0x21, 0x50, 0x2f
606 },
607 {
608 /* K2 */
609 0x95, 0xa3, 0xda, 0x06, 0x53, 0x3d, 0xdb, 0x58,
610 0x5d, 0x35, 0x33, 0x01, 0x0c, 0x42, 0xa0, 0xd9
611 }
612};
613static const unsigned char aes_256_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
614 {
615 /* Example #1 */
616 0x02, 0x89, 0x62, 0xf6, 0x1b, 0x7b, 0xf8, 0x9e,
617 0xfc, 0x6b, 0x55, 0x1f, 0x46, 0x67, 0xd9, 0x83
618 },
619 {
620 /* Example #2 */
621 0x28, 0xa7, 0x02, 0x3f, 0x45, 0x2e, 0x8f, 0x82,
622 0xbd, 0x4b, 0xf2, 0x8d, 0x8c, 0x37, 0xc3, 0x5c
623 },
624 {
625 /* Example #3 */
626 0x15, 0x67, 0x27, 0xdc, 0x08, 0x78, 0x94, 0x4a,
627 0x02, 0x3c, 0x1f, 0xe0, 0x3b, 0xad, 0x6d, 0x93
628 },
629 {
630 /* Example #4 */
631 0xe1, 0x99, 0x21, 0x90, 0x54, 0x9f, 0x6e, 0xd5,
632 0x69, 0x6a, 0x2c, 0x05, 0x6c, 0x31, 0x54, 0x10
633 }
634};
635#endif /* MBEDTLS_AES_C */
636
637#if defined(MBEDTLS_DES_C)
638/* Truncation point of message for 3DES CMAC tests */
639static const unsigned int des3_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
640 0,
641 16,
642 20,
643 32
644};
645
646/* CMAC-TDES (Generation) - 2 Key Test Data */
647static const unsigned char des3_2key_key[24] = {
648 /* Key1 */
649 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
650 /* Key2 */
651 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xEF, 0x01,
652 /* Key3 */
653 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef
654};
655static const unsigned char des3_2key_subkeys[2][8] = {
656 {
657 /* K1 */
658 0x0d, 0xd2, 0xcb, 0x7a, 0x3d, 0x88, 0x88, 0xd9
659 },
660 {
661 /* K2 */
662 0x1b, 0xa5, 0x96, 0xf4, 0x7b, 0x11, 0x11, 0xb2
663 }
664};
665static const unsigned char des3_2key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE] = {
666 {
667 /* Sample #1 */
668 0x79, 0xce, 0x52, 0xa7, 0xf7, 0x86, 0xa9, 0x60
669 },
670 {
671 /* Sample #2 */
672 0xcc, 0x18, 0xa0, 0xb7, 0x9a, 0xf2, 0x41, 0x3b
673 },
674 {
675 /* Sample #3 */
676 0xc0, 0x6d, 0x37, 0x7e, 0xcd, 0x10, 0x19, 0x69
677 },
678 {
679 /* Sample #4 */
680 0x9c, 0xd3, 0x35, 0x80, 0xf9, 0xb6, 0x4d, 0xfb
681 }
682};
683
684/* CMAC-TDES (Generation) - 3 Key Test Data */
685static const unsigned char des3_3key_key[24] = {
686 /* Key1 */
687 0x01, 0x23, 0x45, 0x67, 0x89, 0xaa, 0xcd, 0xef,
688 /* Key2 */
689 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01,
690 /* Key3 */
691 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23
692};
693static const unsigned char des3_3key_subkeys[2][8] = {
694 {
695 /* K1 */
696 0x9d, 0x74, 0xe7, 0x39, 0x33, 0x17, 0x96, 0xc0
697 },
698 {
699 /* K2 */
700 0x3a, 0xe9, 0xce, 0x72, 0x66, 0x2f, 0x2d, 0x9b
701 }
702};
703static const unsigned char des3_3key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE] = {
704 {
705 /* Sample #1 */
706 0x7d, 0xb0, 0xd3, 0x7d, 0xf9, 0x36, 0xc5, 0x50
707 },
708 {
709 /* Sample #2 */
710 0x30, 0x23, 0x9c, 0xf1, 0xf5, 0x2e, 0x66, 0x09
711 },
712 {
713 /* Sample #3 */
714 0x6c, 0x9f, 0x3e, 0xe4, 0x92, 0x3f, 0x6b, 0xe2
715 },
716 {
717 /* Sample #4 */
718 0x99, 0x42, 0x9b, 0xd0, 0xbF, 0x79, 0x04, 0xe5
719 }
720};
721
722#endif /* MBEDTLS_DES_C */
723
724#if defined(MBEDTLS_AES_C)
725/* AES AES-CMAC-PRF-128 Test Data */
726static const unsigned char PRFK[] = {
727 /* Key */
728 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
729 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
730 0xed, 0xcb
731};
732
733/* Sizes in bytes */
734static const size_t PRFKlen[NB_PRF_TESTS] = {
735 18,
736 16,
737 10
738};
739
740/* Message */
741static const unsigned char PRFM[] = {
742 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
743 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
744 0x10, 0x11, 0x12, 0x13
745};
746
747static const unsigned char PRFT[NB_PRF_TESTS][16] = {
748 {
749 0x84, 0xa3, 0x48, 0xa4, 0xa4, 0x5d, 0x23, 0x5b,
750 0xab, 0xff, 0xfc, 0x0d, 0x2b, 0x4d, 0xa0, 0x9a
751 },
752 {
753 0x98, 0x0a, 0xe8, 0x7b, 0x5f, 0x4c, 0x9c, 0x52,
754 0x14, 0xf5, 0xb6, 0xa8, 0x45, 0x5e, 0x4c, 0x2d
755 },
756 {
757 0x29, 0x0d, 0x9e, 0x11, 0x2e, 0xdb, 0x09, 0xee,
758 0x14, 0x1f, 0xcf, 0x64, 0xc0, 0xb7, 0x2f, 0x3d
759 }
760};
761#endif /* MBEDTLS_AES_C */
762
763static int cmac_test_subkeys( int verbose,
764 const char* testname,
765 const unsigned char* key,
766 int keybits,
767 const unsigned char* subkeys,
768 mbedtls_cipher_type_t cipher_type,
769 int block_size,
770 int num_tests )
771{
772 int i, ret = 0;
773 mbedtls_cipher_context_t ctx;
774 const mbedtls_cipher_info_t *cipher_info;
775 unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
776 unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
777
778 cipher_info = mbedtls_cipher_info_from_type( cipher_type );
779 if( cipher_info == NULL )
780 {
781 /* Failing at this point must be due to a build issue */
782 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
783 }
784
785 for( i = 0; i < num_tests; i++ )
786 {
787 if( verbose != 0 )
788 mbedtls_printf( " %s CMAC subkey #%u: ", testname, i + 1 );
789
790 mbedtls_cipher_init( &ctx );
791
792 if( ( ret = mbedtls_cipher_setup( &ctx, cipher_info ) ) != 0 )
793 {
794 if( verbose != 0 )
795 mbedtls_printf( "test execution failed\n" );
796
797 goto cleanup;
798 }
799
800 if( ( ret = mbedtls_cipher_setkey( &ctx, key, keybits,
801 MBEDTLS_ENCRYPT ) ) != 0 )
802 {
803 if( verbose != 0 )
804 mbedtls_printf( "test execution failed\n" );
805
806 goto cleanup;
807 }
808
809 ret = cmac_generate_subkeys( &ctx, K1, K2 );
810 if( ret != 0 )
811 {
812 if( verbose != 0 )
813 mbedtls_printf( "failed\n" );
814
815 goto cleanup;
816 }
817
818 if( ( ret = memcmp( K1, subkeys, block_size ) ) != 0 ||
819 ( ret = memcmp( K2, &subkeys[block_size], block_size ) ) != 0 )
820 {
821 if( verbose != 0 )
822 mbedtls_printf( "failed\n" );
823
824 goto cleanup;
825 }
826
827 if( verbose != 0 )
828 mbedtls_printf( "passed\n" );
829
830 mbedtls_cipher_free( &ctx );
831 }
832
833 ret = 0;
834 goto exit;
835
836cleanup:
837 mbedtls_cipher_free( &ctx );
838
839exit:
840 return( ret );
841}
842
843static int cmac_test_wth_cipher( int verbose,
844 const char* testname,
845 const unsigned char* key,
846 int keybits,
847 const unsigned char* messages,
848 const unsigned int message_lengths[4],
849 const unsigned char* expected_result,
850 mbedtls_cipher_type_t cipher_type,
851 int block_size,
852 int num_tests )
853{
854 const mbedtls_cipher_info_t *cipher_info;
855 int i, ret = 0;
856 unsigned char output[MBEDTLS_CIPHER_BLKSIZE_MAX];
857
858 cipher_info = mbedtls_cipher_info_from_type( cipher_type );
859 if( cipher_info == NULL )
860 {
861 /* Failing at this point must be due to a build issue */
862 ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
863 goto exit;
864 }
865
866 for( i = 0; i < num_tests; i++ )
867 {
868 if( verbose != 0 )
869 mbedtls_printf( " %s CMAC #%u: ", testname, i + 1 );
870
871 if( ( ret = mbedtls_cipher_cmac( cipher_info, key, keybits, messages,
872 message_lengths[i], output ) ) != 0 )
873 {
874 if( verbose != 0 )
875 mbedtls_printf( "failed\n" );
876 goto exit;
877 }
878
879 if( ( ret = memcmp( output, &expected_result[i * block_size], block_size ) ) != 0 )
880 {
881 if( verbose != 0 )
882 mbedtls_printf( "failed\n" );
883 goto exit;
884 }
885
886 if( verbose != 0 )
887 mbedtls_printf( "passed\n" );
888 }
889 ret = 0;
890
891exit:
892 return( ret );
893}
894
895#if defined(MBEDTLS_AES_C)
896static int test_aes128_cmac_prf( int verbose )
897{
898 int i;
899 int ret;
900 unsigned char output[MBEDTLS_AES_BLOCK_SIZE];
901
902 for( i = 0; i < NB_PRF_TESTS; i++ )
903 {
904 mbedtls_printf( " AES CMAC 128 PRF #%u: ", i );
905 ret = mbedtls_aes_cmac_prf_128( PRFK, PRFKlen[i], PRFM, 20, output );
906 if( ret != 0 ||
907 memcmp( output, PRFT[i], MBEDTLS_AES_BLOCK_SIZE ) != 0 )
908 {
909
910 if( verbose != 0 )
911 mbedtls_printf( "failed\n" );
912
913 return( ret );
914 }
915 else if( verbose != 0 )
916 {
917 mbedtls_printf( "passed\n" );
918 }
919 }
920 return( ret );
921}
922#endif /* MBEDTLS_AES_C */
923
924int mbedtls_cmac_self_test( int verbose )
925{
926 int ret;
927
928#if defined(MBEDTLS_AES_C)
929 /* AES-128 */
930 if( ( ret = cmac_test_subkeys( verbose,
931 "AES 128",
932 aes_128_key,
933 128,
934 (const unsigned char*)aes_128_subkeys,
935 MBEDTLS_CIPHER_AES_128_ECB,
936 MBEDTLS_AES_BLOCK_SIZE,
937 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
938 {
939 return( ret );
940 }
941
942 if( ( ret = cmac_test_wth_cipher( verbose,
943 "AES 128",
944 aes_128_key,
945 128,
946 test_message,
947 aes_message_lengths,
948 (const unsigned char*)aes_128_expected_result,
949 MBEDTLS_CIPHER_AES_128_ECB,
950 MBEDTLS_AES_BLOCK_SIZE,
951 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
952 {
953 return( ret );
954 }
955
956 /* AES-192 */
957 if( ( ret = cmac_test_subkeys( verbose,
958 "AES 192",
959 aes_192_key,
960 192,
961 (const unsigned char*)aes_192_subkeys,
962 MBEDTLS_CIPHER_AES_192_ECB,
963 MBEDTLS_AES_BLOCK_SIZE,
964 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
965 {
966 return( ret );
967 }
968
969 if( ( ret = cmac_test_wth_cipher( verbose,
970 "AES 192",
971 aes_192_key,
972 192,
973 test_message,
974 aes_message_lengths,
975 (const unsigned char*)aes_192_expected_result,
976 MBEDTLS_CIPHER_AES_192_ECB,
977 MBEDTLS_AES_BLOCK_SIZE,
978 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
979 {
980 return( ret );
981 }
982
983 /* AES-256 */
984 if( ( ret = cmac_test_subkeys( verbose,
985 "AES 256",
986 aes_256_key,
987 256,
988 (const unsigned char*)aes_256_subkeys,
989 MBEDTLS_CIPHER_AES_256_ECB,
990 MBEDTLS_AES_BLOCK_SIZE,
991 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
992 {
993 return( ret );
994 }
995
996 if( ( ret = cmac_test_wth_cipher ( verbose,
997 "AES 256",
998 aes_256_key,
999 256,
1000 test_message,
1001 aes_message_lengths,
1002 (const unsigned char*)aes_256_expected_result,
1003 MBEDTLS_CIPHER_AES_256_ECB,
1004 MBEDTLS_AES_BLOCK_SIZE,
1005 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
1006 {
1007 return( ret );
1008 }
1009#endif /* MBEDTLS_AES_C */
1010
1011#if defined(MBEDTLS_DES_C)
1012 /* 3DES 2 key */
1013 if( ( ret = cmac_test_subkeys( verbose,
1014 "3DES 2 key",
1015 des3_2key_key,
1016 192,
1017 (const unsigned char*)des3_2key_subkeys,
1018 MBEDTLS_CIPHER_DES_EDE3_ECB,
1019 MBEDTLS_DES3_BLOCK_SIZE,
1020 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
1021 {
1022 return( ret );
1023 }
1024
1025 if( ( ret = cmac_test_wth_cipher( verbose,
1026 "3DES 2 key",
1027 des3_2key_key,
1028 192,
1029 test_message,
1030 des3_message_lengths,
1031 (const unsigned char*)des3_2key_expected_result,
1032 MBEDTLS_CIPHER_DES_EDE3_ECB,
1033 MBEDTLS_DES3_BLOCK_SIZE,
1034 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
1035 {
1036 return( ret );
1037 }
1038
1039 /* 3DES 3 key */
1040 if( ( ret = cmac_test_subkeys( verbose,
1041 "3DES 3 key",
1042 des3_3key_key,
1043 192,
1044 (const unsigned char*)des3_3key_subkeys,
1045 MBEDTLS_CIPHER_DES_EDE3_ECB,
1046 MBEDTLS_DES3_BLOCK_SIZE,
1047 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
1048 {
1049 return( ret );
1050 }
1051
1052 if( ( ret = cmac_test_wth_cipher( verbose,
1053 "3DES 3 key",
1054 des3_3key_key,
1055 192,
1056 test_message,
1057 des3_message_lengths,
1058 (const unsigned char*)des3_3key_expected_result,
1059 MBEDTLS_CIPHER_DES_EDE3_ECB,
1060 MBEDTLS_DES3_BLOCK_SIZE,
1061 NB_CMAC_TESTS_PER_KEY ) ) != 0 )
1062 {
1063 return( ret );
1064 }
1065#endif /* MBEDTLS_DES_C */
1066
1067#if defined(MBEDTLS_AES_C)
1068 if( ( ret = test_aes128_cmac_prf( verbose ) ) != 0 )
1069 return( ret );
1070#endif /* MBEDTLS_AES_C */
1071
1072 if( verbose != 0 )
1073 mbedtls_printf( "\n" );
1074
1075 return( 0 );
1076}
1077
1078#endif /* MBEDTLS_SELF_TEST */
1079
1080#endif /* MBEDTLS_CMAC_C */
Proxmark3 GIT tracking
Impressum, Datenschutz