1/*
2 * Copyright (c) 2018 Thomas Pornin <pornin@bolet.org>
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22 * SOFTWARE.
23 */
24
25#include "inner.h"
26
27/* see bearssl_rand.h */
28void
29br_aesctr_drbg_init(br_aesctr_drbg_context *ctx,
30	const br_block_ctr_class *aesctr,
31	const void *seed, size_t len)
32{
33	unsigned char tmp[16];
34
35	ctx->vtable = &br_aesctr_drbg_vtable;
36	memset(tmp, 0, sizeof tmp);
37	aesctr->init(&ctx->sk.vtable, tmp, 16);
38	ctx->cc = 0;
39	br_aesctr_drbg_update(ctx, seed, len);
40}
41
42/* see bearssl_rand.h */
43void
44br_aesctr_drbg_generate(br_aesctr_drbg_context *ctx, void *out, size_t len)
45{
46	unsigned char *buf;
47	unsigned char iv[12];
48
49	buf = out;
50	memset(iv, 0, sizeof iv);
51	while (len > 0) {
52		size_t clen;
53
54		/*
55		 * We generate data by blocks of at most 65280 bytes. This
56		 * allows for unambiguously testing the counter overflow
57		 * condition; also, it should work on 16-bit architectures
58		 * (where 'size_t' is 16 bits only).
59		 */
60		clen = len;
61		if (clen > 65280) {
62			clen = 65280;
63		}
64
65		/*
66		 * We make sure that the counter won't exceed the configured
67		 * limit.
68		 */
69		if ((uint32_t)(ctx->cc + ((clen + 15) >> 4)) > 32768) {
70			clen = (32768 - ctx->cc) << 4;
71			if (clen > len) {
72				clen = len;
73			}
74		}
75
76		/*
77		 * Run CTR.
78		 */
79		memset(buf, 0, clen);
80		ctx->cc = ctx->sk.vtable->run(&ctx->sk.vtable,
81			iv, ctx->cc, buf, clen);
82		buf += clen;
83		len -= clen;
84
85		/*
86		 * Every 32768 blocks, we force a state update.
87		 */
88		if (ctx->cc >= 32768) {
89			br_aesctr_drbg_update(ctx, NULL, 0);
90		}
91	}
92}
93
94/* see bearssl_rand.h */
95void
96br_aesctr_drbg_update(br_aesctr_drbg_context *ctx, const void *seed, size_t len)
97{
98	/*
99	 * We use a Hirose construction on AES-256 to make a hash function.
100	 * Function definition:
101	 *  - running state consists in two 16-byte blocks G and H
102	 *  - initial values of G and H are conventional
103	 *  - there is a fixed block-sized constant C
104	 *  - for next data block m:
105	 *      set AES key to H||m
106	 *      G' = E(G) xor G
107	 *      H' = E(G xor C) xor G xor C
108	 *      G <- G', H <- H'
109	 *  - once all blocks have been processed, output is H||G
110	 *
111	 * Constants:
112	 *   G_init = B6 B6 ... B6
113	 *   H_init = A5 A5 ... A5
114	 *   C      = 01 00 ... 00
115	 *
116	 * With this hash function h(), we compute the new state as
117	 * follows:
118	 *  - produce a state-dependent value s as encryption of an
119	 *    all-one block with AES and the current key
120	 *  - compute the new key as the first 128 bits of h(s||seed)
121	 *
122	 * Original Hirose article:
123	 *    https://www.iacr.org/archive/fse2006/40470213/40470213.pdf
124	 */
125
126	unsigned char s[16], iv[12];
127	unsigned char G[16], H[16];
128	int first;
129
130	/*
131	 * Use an all-one IV to get a fresh output block that depends on the
132	 * current seed.
133	 */
134	memset(iv, 0xFF, sizeof iv);
135	memset(s, 0, 16);
136	ctx->sk.vtable->run(&ctx->sk.vtable, iv, 0xFFFFFFFF, s, 16);
137
138	/*
139	 * Set G[] and H[] to conventional start values.
140	 */
141	memset(G, 0xB6, sizeof G);
142	memset(H, 0x5A, sizeof H);
143
144	/*
145	 * Process the concatenation of the current state and the seed
146	 * with the custom hash function.
147	 */
148	first = 1;
149	for (;;) {
150		unsigned char tmp[32];
151		unsigned char newG[16];
152
153		/*
154		 * Assemble new key H||m into tmp[].
155		 */
156		memcpy(tmp, H, 16);
157		if (first) {
158			memcpy(tmp + 16, s, 16);
159			first = 0;
160		} else {
161			size_t clen;
162
163			if (len == 0) {
164				break;
165			}
166			clen = len < 16 ? len : 16;
167			memcpy(tmp + 16, seed, clen);
168			memset(tmp + 16 + clen, 0, 16 - clen);
169			seed = (const unsigned char *)seed + clen;
170			len -= clen;
171		}
172		ctx->sk.vtable->init(&ctx->sk.vtable, tmp, 32);
173
174		/*
175		 * Compute new G and H values.
176		 */
177		memcpy(iv, G, 12);
178		memcpy(newG, G, 16);
179		ctx->sk.vtable->run(&ctx->sk.vtable, iv,
180			br_dec32be(G + 12), newG, 16);
181		iv[0] ^= 0x01;
182		memcpy(H, G, 16);
183		H[0] ^= 0x01;
184		ctx->sk.vtable->run(&ctx->sk.vtable, iv,
185			br_dec32be(G + 12), H, 16);
186		memcpy(G, newG, 16);
187	}
188
189	/*
190	 * Output hash value is H||G. We truncate it to its first 128 bits,
191	 * i.e. H; that's our new AES key.
192	 */
193	ctx->sk.vtable->init(&ctx->sk.vtable, H, 16);
194	ctx->cc = 0;
195}
196
197/* see bearssl_rand.h */
198const br_prng_class br_aesctr_drbg_vtable = {
199	sizeof(br_aesctr_drbg_context),
200	(void (*)(const br_prng_class **, const void *, const void *, size_t))
201		&br_aesctr_drbg_init,
202	(void (*)(const br_prng_class **, void *, size_t))
203		&br_aesctr_drbg_generate,
204	(void (*)(const br_prng_class **, const void *, size_t))
205		&br_aesctr_drbg_update
206};
207