1252190Srpaulo/* 2252190Srpaulo * Galois/Counter Mode (GCM) and GMAC with AES 3252190Srpaulo * 4252190Srpaulo * Copyright (c) 2012, Jouni Malinen <j@w1.fi> 5252190Srpaulo * 6252190Srpaulo * This software may be distributed under the terms of the BSD license. 7252190Srpaulo * See README for more details. 8252190Srpaulo */ 9252190Srpaulo 10252190Srpaulo#include "includes.h" 11252190Srpaulo 12252190Srpaulo#include "common.h" 13252190Srpaulo#include "aes.h" 14252190Srpaulo#include "aes_wrap.h" 15252190Srpaulo 16252190Srpaulostatic void inc32(u8 *block) 17252190Srpaulo{ 18252190Srpaulo u32 val; 19252190Srpaulo val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4); 20252190Srpaulo val++; 21252190Srpaulo WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val); 22252190Srpaulo} 23252190Srpaulo 24252190Srpaulo 25252190Srpaulostatic void xor_block(u8 *dst, const u8 *src) 26252190Srpaulo{ 27252190Srpaulo u32 *d = (u32 *) dst; 28252190Srpaulo u32 *s = (u32 *) src; 29252190Srpaulo *d++ ^= *s++; 30252190Srpaulo *d++ ^= *s++; 31252190Srpaulo *d++ ^= *s++; 32252190Srpaulo *d++ ^= *s++; 33252190Srpaulo} 34252190Srpaulo 35252190Srpaulo 36252190Srpaulostatic void shift_right_block(u8 *v) 37252190Srpaulo{ 38252190Srpaulo u32 val; 39252190Srpaulo 40252190Srpaulo val = WPA_GET_BE32(v + 12); 41252190Srpaulo val >>= 1; 42252190Srpaulo if (v[11] & 0x01) 43252190Srpaulo val |= 0x80000000; 44252190Srpaulo WPA_PUT_BE32(v + 12, val); 45252190Srpaulo 46252190Srpaulo val = WPA_GET_BE32(v + 8); 47252190Srpaulo val >>= 1; 48252190Srpaulo if (v[7] & 0x01) 49252190Srpaulo val |= 0x80000000; 50252190Srpaulo WPA_PUT_BE32(v + 8, val); 51252190Srpaulo 52252190Srpaulo val = WPA_GET_BE32(v + 4); 53252190Srpaulo val >>= 1; 54252190Srpaulo if (v[3] & 0x01) 55252190Srpaulo val |= 0x80000000; 56252190Srpaulo WPA_PUT_BE32(v + 4, val); 57252190Srpaulo 58252190Srpaulo val = WPA_GET_BE32(v); 59252190Srpaulo val >>= 1; 60252190Srpaulo WPA_PUT_BE32(v, val); 61252190Srpaulo} 62252190Srpaulo 63252190Srpaulo 64252190Srpaulo/* Multiplication in GF(2^128) */ 65252190Srpaulostatic void gf_mult(const u8 *x, const u8 *y, u8 *z) 66252190Srpaulo{ 67252190Srpaulo u8 v[16]; 68252190Srpaulo int i, j; 69252190Srpaulo 70252190Srpaulo os_memset(z, 0, 16); /* Z_0 = 0^128 */ 71252190Srpaulo os_memcpy(v, y, 16); /* V_0 = Y */ 72252190Srpaulo 73252190Srpaulo for (i = 0; i < 16; i++) { 74252190Srpaulo for (j = 0; j < 8; j++) { 75252190Srpaulo if (x[i] & BIT(7 - j)) { 76252190Srpaulo /* Z_(i + 1) = Z_i XOR V_i */ 77252190Srpaulo xor_block(z, v); 78252190Srpaulo } else { 79252190Srpaulo /* Z_(i + 1) = Z_i */ 80252190Srpaulo } 81252190Srpaulo 82252190Srpaulo if (v[15] & 0x01) { 83252190Srpaulo /* V_(i + 1) = (V_i >> 1) XOR R */ 84252190Srpaulo shift_right_block(v); 85252190Srpaulo /* R = 11100001 || 0^120 */ 86252190Srpaulo v[0] ^= 0xe1; 87252190Srpaulo } else { 88252190Srpaulo /* V_(i + 1) = V_i >> 1 */ 89252190Srpaulo shift_right_block(v); 90252190Srpaulo } 91252190Srpaulo } 92252190Srpaulo } 93252190Srpaulo} 94252190Srpaulo 95252190Srpaulo 96252190Srpaulostatic void ghash_start(u8 *y) 97252190Srpaulo{ 98252190Srpaulo /* Y_0 = 0^128 */ 99252190Srpaulo os_memset(y, 0, 16); 100252190Srpaulo} 101252190Srpaulo 102252190Srpaulo 103252190Srpaulostatic void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y) 104252190Srpaulo{ 105252190Srpaulo size_t m, i; 106252190Srpaulo const u8 *xpos = x; 107252190Srpaulo u8 tmp[16]; 108252190Srpaulo 109252190Srpaulo m = xlen / 16; 110252190Srpaulo 111252190Srpaulo for (i = 0; i < m; i++) { 112252190Srpaulo /* Y_i = (Y^(i-1) XOR X_i) dot H */ 113252190Srpaulo xor_block(y, xpos); 114252190Srpaulo xpos += 16; 115252190Srpaulo 116252190Srpaulo /* dot operation: 117252190Srpaulo * multiplication operation for binary Galois (finite) field of 118252190Srpaulo * 2^128 elements */ 119252190Srpaulo gf_mult(y, h, tmp); 120252190Srpaulo os_memcpy(y, tmp, 16); 121252190Srpaulo } 122252190Srpaulo 123252190Srpaulo if (x + xlen > xpos) { 124252190Srpaulo /* Add zero padded last block */ 125252190Srpaulo size_t last = x + xlen - xpos; 126252190Srpaulo os_memcpy(tmp, xpos, last); 127252190Srpaulo os_memset(tmp + last, 0, sizeof(tmp) - last); 128252190Srpaulo 129252190Srpaulo /* Y_i = (Y^(i-1) XOR X_i) dot H */ 130252190Srpaulo xor_block(y, tmp); 131252190Srpaulo 132252190Srpaulo /* dot operation: 133252190Srpaulo * multiplication operation for binary Galois (finite) field of 134252190Srpaulo * 2^128 elements */ 135252190Srpaulo gf_mult(y, h, tmp); 136252190Srpaulo os_memcpy(y, tmp, 16); 137252190Srpaulo } 138252190Srpaulo 139252190Srpaulo /* Return Y_m */ 140252190Srpaulo} 141252190Srpaulo 142252190Srpaulo 143252190Srpaulostatic void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y) 144252190Srpaulo{ 145252190Srpaulo size_t i, n, last; 146252190Srpaulo u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE]; 147252190Srpaulo const u8 *xpos = x; 148252190Srpaulo u8 *ypos = y; 149252190Srpaulo 150252190Srpaulo if (xlen == 0) 151252190Srpaulo return; 152252190Srpaulo 153252190Srpaulo n = xlen / 16; 154252190Srpaulo 155252190Srpaulo os_memcpy(cb, icb, AES_BLOCK_SIZE); 156252190Srpaulo /* Full blocks */ 157252190Srpaulo for (i = 0; i < n; i++) { 158252190Srpaulo aes_encrypt(aes, cb, ypos); 159252190Srpaulo xor_block(ypos, xpos); 160252190Srpaulo xpos += AES_BLOCK_SIZE; 161252190Srpaulo ypos += AES_BLOCK_SIZE; 162252190Srpaulo inc32(cb); 163252190Srpaulo } 164252190Srpaulo 165252190Srpaulo last = x + xlen - xpos; 166252190Srpaulo if (last) { 167252190Srpaulo /* Last, partial block */ 168252190Srpaulo aes_encrypt(aes, cb, tmp); 169252190Srpaulo for (i = 0; i < last; i++) 170252190Srpaulo *ypos++ = *xpos++ ^ tmp[i]; 171252190Srpaulo } 172252190Srpaulo} 173252190Srpaulo 174252190Srpaulo 175252190Srpaulostatic void * aes_gcm_init_hash_subkey(const u8 *key, size_t key_len, u8 *H) 176252190Srpaulo{ 177252190Srpaulo void *aes; 178252190Srpaulo 179252190Srpaulo aes = aes_encrypt_init(key, key_len); 180252190Srpaulo if (aes == NULL) 181252190Srpaulo return NULL; 182252190Srpaulo 183252190Srpaulo /* Generate hash subkey H = AES_K(0^128) */ 184252190Srpaulo os_memset(H, 0, AES_BLOCK_SIZE); 185252190Srpaulo aes_encrypt(aes, H, H); 186252190Srpaulo wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", 187252190Srpaulo H, AES_BLOCK_SIZE); 188252190Srpaulo return aes; 189252190Srpaulo} 190252190Srpaulo 191252190Srpaulo 192252190Srpaulostatic void aes_gcm_prepare_j0(const u8 *iv, size_t iv_len, const u8 *H, u8 *J0) 193252190Srpaulo{ 194252190Srpaulo u8 len_buf[16]; 195252190Srpaulo 196252190Srpaulo if (iv_len == 12) { 197252190Srpaulo /* Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ 198252190Srpaulo os_memcpy(J0, iv, iv_len); 199252190Srpaulo os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); 200252190Srpaulo J0[AES_BLOCK_SIZE - 1] = 0x01; 201252190Srpaulo } else { 202252190Srpaulo /* 203252190Srpaulo * s = 128 * ceil(len(IV)/128) - len(IV) 204252190Srpaulo * J_0 = GHASH_H(IV || 0^(s+64) || [len(IV)]_64) 205252190Srpaulo */ 206252190Srpaulo ghash_start(J0); 207252190Srpaulo ghash(H, iv, iv_len, J0); 208252190Srpaulo WPA_PUT_BE64(len_buf, 0); 209252190Srpaulo WPA_PUT_BE64(len_buf + 8, iv_len * 8); 210252190Srpaulo ghash(H, len_buf, sizeof(len_buf), J0); 211252190Srpaulo } 212252190Srpaulo} 213252190Srpaulo 214252190Srpaulo 215252190Srpaulostatic void aes_gcm_gctr(void *aes, const u8 *J0, const u8 *in, size_t len, 216252190Srpaulo u8 *out) 217252190Srpaulo{ 218252190Srpaulo u8 J0inc[AES_BLOCK_SIZE]; 219252190Srpaulo 220252190Srpaulo if (len == 0) 221252190Srpaulo return; 222252190Srpaulo 223252190Srpaulo os_memcpy(J0inc, J0, AES_BLOCK_SIZE); 224252190Srpaulo inc32(J0inc); 225252190Srpaulo aes_gctr(aes, J0inc, in, len, out); 226252190Srpaulo} 227252190Srpaulo 228252190Srpaulo 229252190Srpaulostatic void aes_gcm_ghash(const u8 *H, const u8 *aad, size_t aad_len, 230252190Srpaulo const u8 *crypt, size_t crypt_len, u8 *S) 231252190Srpaulo{ 232252190Srpaulo u8 len_buf[16]; 233252190Srpaulo 234252190Srpaulo /* 235252190Srpaulo * u = 128 * ceil[len(C)/128] - len(C) 236252190Srpaulo * v = 128 * ceil[len(A)/128] - len(A) 237252190Srpaulo * S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) 238252190Srpaulo * (i.e., zero padded to block size A || C and lengths of each in bits) 239252190Srpaulo */ 240252190Srpaulo ghash_start(S); 241252190Srpaulo ghash(H, aad, aad_len, S); 242252190Srpaulo ghash(H, crypt, crypt_len, S); 243252190Srpaulo WPA_PUT_BE64(len_buf, aad_len * 8); 244252190Srpaulo WPA_PUT_BE64(len_buf + 8, crypt_len * 8); 245252190Srpaulo ghash(H, len_buf, sizeof(len_buf), S); 246252190Srpaulo 247252190Srpaulo wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); 248252190Srpaulo} 249252190Srpaulo 250252190Srpaulo 251252190Srpaulo/** 252252190Srpaulo * aes_gcm_ae - GCM-AE_K(IV, P, A) 253252190Srpaulo */ 254252190Srpauloint aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len, 255252190Srpaulo const u8 *plain, size_t plain_len, 256252190Srpaulo const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag) 257252190Srpaulo{ 258252190Srpaulo u8 H[AES_BLOCK_SIZE]; 259252190Srpaulo u8 J0[AES_BLOCK_SIZE]; 260252190Srpaulo u8 S[16]; 261252190Srpaulo void *aes; 262252190Srpaulo 263252190Srpaulo aes = aes_gcm_init_hash_subkey(key, key_len, H); 264252190Srpaulo if (aes == NULL) 265252190Srpaulo return -1; 266252190Srpaulo 267252190Srpaulo aes_gcm_prepare_j0(iv, iv_len, H, J0); 268252190Srpaulo 269252190Srpaulo /* C = GCTR_K(inc_32(J_0), P) */ 270252190Srpaulo aes_gcm_gctr(aes, J0, plain, plain_len, crypt); 271252190Srpaulo 272252190Srpaulo aes_gcm_ghash(H, aad, aad_len, crypt, plain_len, S); 273252190Srpaulo 274252190Srpaulo /* T = MSB_t(GCTR_K(J_0, S)) */ 275252190Srpaulo aes_gctr(aes, J0, S, sizeof(S), tag); 276252190Srpaulo 277252190Srpaulo /* Return (C, T) */ 278252190Srpaulo 279252190Srpaulo aes_encrypt_deinit(aes); 280252190Srpaulo 281252190Srpaulo return 0; 282252190Srpaulo} 283252190Srpaulo 284252190Srpaulo 285252190Srpaulo/** 286252190Srpaulo * aes_gcm_ad - GCM-AD_K(IV, C, A, T) 287252190Srpaulo */ 288252190Srpauloint aes_gcm_ad(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len, 289252190Srpaulo const u8 *crypt, size_t crypt_len, 290252190Srpaulo const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain) 291252190Srpaulo{ 292252190Srpaulo u8 H[AES_BLOCK_SIZE]; 293252190Srpaulo u8 J0[AES_BLOCK_SIZE]; 294252190Srpaulo u8 S[16], T[16]; 295252190Srpaulo void *aes; 296252190Srpaulo 297252190Srpaulo aes = aes_gcm_init_hash_subkey(key, key_len, H); 298252190Srpaulo if (aes == NULL) 299252190Srpaulo return -1; 300252190Srpaulo 301252190Srpaulo aes_gcm_prepare_j0(iv, iv_len, H, J0); 302252190Srpaulo 303252190Srpaulo /* P = GCTR_K(inc_32(J_0), C) */ 304252190Srpaulo aes_gcm_gctr(aes, J0, crypt, crypt_len, plain); 305252190Srpaulo 306252190Srpaulo aes_gcm_ghash(H, aad, aad_len, crypt, crypt_len, S); 307252190Srpaulo 308252190Srpaulo /* T' = MSB_t(GCTR_K(J_0, S)) */ 309252190Srpaulo aes_gctr(aes, J0, S, sizeof(S), T); 310252190Srpaulo 311252190Srpaulo aes_encrypt_deinit(aes); 312252190Srpaulo 313252190Srpaulo if (os_memcmp(tag, T, 16) != 0) { 314252190Srpaulo wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch"); 315252190Srpaulo return -1; 316252190Srpaulo } 317252190Srpaulo 318252190Srpaulo return 0; 319252190Srpaulo} 320252190Srpaulo 321252190Srpaulo 322252190Srpauloint aes_gmac(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len, 323252190Srpaulo const u8 *aad, size_t aad_len, u8 *tag) 324252190Srpaulo{ 325252190Srpaulo return aes_gcm_ae(key, key_len, iv, iv_len, NULL, 0, aad, aad_len, NULL, 326252190Srpaulo tag); 327252190Srpaulo} 328