19bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt/* 29bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * Galois/Counter Mode (GCM) and GMAC with AES 39bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * 49bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * Copyright (c) 2012, Jouni Malinen <j@w1.fi> 59bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * 69bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * This software may be distributed under the terms of the BSD license. 79bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * See README for more details. 89bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt */ 99bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 109bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt#include "includes.h" 119bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 129bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt#include "common.h" 139bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt#include "aes.h" 149bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt#include "aes_wrap.h" 159bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 169bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void inc32(u8 *block) 179bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 189bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u32 val; 199bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4); 209bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val++; 219bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val); 229bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 239bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 249bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 259bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void xor_block(u8 *dst, const u8 *src) 269bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 279bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u32 *d = (u32 *) dst; 289bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u32 *s = (u32 *) src; 299bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt *d++ ^= *s++; 309bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt *d++ ^= *s++; 319bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt *d++ ^= *s++; 329bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt *d++ ^= *s++; 339bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 349bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 359bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 369bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void shift_right_block(u8 *v) 379bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 389bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u32 val; 399bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 409bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val = WPA_GET_BE32(v + 12); 419bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val >>= 1; 429bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (v[11] & 0x01) 439bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val |= 0x80000000; 449bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE32(v + 12, val); 459bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 469bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val = WPA_GET_BE32(v + 8); 479bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val >>= 1; 489bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (v[7] & 0x01) 499bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val |= 0x80000000; 509bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE32(v + 8, val); 519bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 529bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val = WPA_GET_BE32(v + 4); 539bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val >>= 1; 549bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (v[3] & 0x01) 559bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val |= 0x80000000; 569bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE32(v + 4, val); 579bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 589bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val = WPA_GET_BE32(v); 599bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt val >>= 1; 609bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE32(v, val); 619bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 629bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 639bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 649bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt/* Multiplication in GF(2^128) */ 659bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void gf_mult(const u8 *x, const u8 *y, u8 *z) 669bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 679bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 v[16]; 689bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt int i, j; 699bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 709bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memset(z, 0, 16); /* Z_0 = 0^128 */ 719bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memcpy(v, y, 16); /* V_0 = Y */ 729bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 739bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt for (i = 0; i < 16; i++) { 749bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt for (j = 0; j < 8; j++) { 759bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (x[i] & BIT(7 - j)) { 769bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Z_(i + 1) = Z_i XOR V_i */ 779bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt xor_block(z, v); 789bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } else { 799bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Z_(i + 1) = Z_i */ 809bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 819bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 829bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (v[15] & 0x01) { 839bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* V_(i + 1) = (V_i >> 1) XOR R */ 849bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt shift_right_block(v); 859bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* R = 11100001 || 0^120 */ 869bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt v[0] ^= 0xe1; 879bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } else { 889bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* V_(i + 1) = V_i >> 1 */ 899bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt shift_right_block(v); 909bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 919bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 929bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 939bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 949bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 959bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 969bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void ghash_start(u8 *y) 979bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 989bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Y_0 = 0^128 */ 999bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memset(y, 0, 16); 1009bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 1019bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1029bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1039bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y) 1049bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 1059bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt size_t m, i; 1069bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *xpos = x; 1079bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 tmp[16]; 1089bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1099bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt m = xlen / 16; 1109bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1119bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt for (i = 0; i < m; i++) { 1129bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Y_i = (Y^(i-1) XOR X_i) dot H */ 1139bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt xor_block(y, xpos); 1149bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt xpos += 16; 1159bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1169bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* dot operation: 1179bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * multiplication operation for binary Galois (finite) field of 1189bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * 2^128 elements */ 1199bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt gf_mult(y, h, tmp); 1209bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memcpy(y, tmp, 16); 1219bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 1229bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1239bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (x + xlen > xpos) { 1249bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Add zero padded last block */ 1259bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt size_t last = x + xlen - xpos; 1269bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memcpy(tmp, xpos, last); 1279bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memset(tmp + last, 0, sizeof(tmp) - last); 1289bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1299bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Y_i = (Y^(i-1) XOR X_i) dot H */ 1309bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt xor_block(y, tmp); 1319bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1329bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* dot operation: 1339bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * multiplication operation for binary Galois (finite) field of 1349bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * 2^128 elements */ 1359bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt gf_mult(y, h, tmp); 1369bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memcpy(y, tmp, 16); 1379bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 1389bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1399bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Return Y_m */ 1409bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 1419bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1429bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1439bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y) 1449bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 1459bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt size_t i, n, last; 1469bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE]; 1479bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *xpos = x; 1489bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 *ypos = y; 1499bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1509bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (xlen == 0) 1519bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return; 1529bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1539bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt n = xlen / 16; 1549bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1559bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memcpy(cb, icb, AES_BLOCK_SIZE); 1569bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Full blocks */ 1579bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt for (i = 0; i < n; i++) { 1589bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_encrypt(aes, cb, ypos); 1599bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt xor_block(ypos, xpos); 1609bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt xpos += AES_BLOCK_SIZE; 1619bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ypos += AES_BLOCK_SIZE; 1629bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt inc32(cb); 1639bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 1649bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1659bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt last = x + xlen - xpos; 1669bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (last) { 1679bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Last, partial block */ 1689bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_encrypt(aes, cb, tmp); 1699bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt for (i = 0; i < last; i++) 1709bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt *ypos++ = *xpos++ ^ tmp[i]; 1719bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 1729bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 1739bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1749bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1759bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void * aes_gcm_init_hash_subkey(const u8 *key, size_t key_len, u8 *H) 1769bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 1779bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt void *aes; 1789bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1799bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes = aes_encrypt_init(key, key_len); 1809bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (aes == NULL) 1819bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return NULL; 1829bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1839bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Generate hash subkey H = AES_K(0^128) */ 1849bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memset(H, 0, AES_BLOCK_SIZE); 1859bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_encrypt(aes, H, H); 1869bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", 1879bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt H, AES_BLOCK_SIZE); 1889bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return aes; 1899bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 1909bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1919bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1929bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void aes_gcm_prepare_j0(const u8 *iv, size_t iv_len, const u8 *H, u8 *J0) 1939bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 1949bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 len_buf[16]; 1959bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 1969bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (iv_len == 12) { 1979bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ 1989bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memcpy(J0, iv, iv_len); 1999bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); 2009bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt J0[AES_BLOCK_SIZE - 1] = 0x01; 2019bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } else { 2029bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* 2039bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * s = 128 * ceil(len(IV)/128) - len(IV) 2049bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * J_0 = GHASH_H(IV || 0^(s+64) || [len(IV)]_64) 2059bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt */ 2069bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ghash_start(J0); 2079bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ghash(H, iv, iv_len, J0); 2089bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE64(len_buf, 0); 2099bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE64(len_buf + 8, iv_len * 8); 2109bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ghash(H, len_buf, sizeof(len_buf), J0); 2119bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 2129bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 2139bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2149bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2159bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void aes_gcm_gctr(void *aes, const u8 *J0, const u8 *in, size_t len, 2169bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 *out) 2179bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 2189bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 J0inc[AES_BLOCK_SIZE]; 2199bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2209bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (len == 0) 2219bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return; 2229bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2239bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt os_memcpy(J0inc, J0, AES_BLOCK_SIZE); 2249bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt inc32(J0inc); 2259bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gctr(aes, J0inc, in, len, out); 2269bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 2279bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2289bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2299bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtstatic void aes_gcm_ghash(const u8 *H, const u8 *aad, size_t aad_len, 2309bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *crypt, size_t crypt_len, u8 *S) 2319bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 2329bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 len_buf[16]; 2339bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2349bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* 2359bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * u = 128 * ceil[len(C)/128] - len(C) 2369bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * v = 128 * ceil[len(A)/128] - len(A) 2379bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) 2389bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * (i.e., zero padded to block size A || C and lengths of each in bits) 2399bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt */ 2409bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ghash_start(S); 2419bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ghash(H, aad, aad_len, S); 2429bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ghash(H, crypt, crypt_len, S); 2439bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE64(len_buf, aad_len * 8); 2449bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt WPA_PUT_BE64(len_buf + 8, crypt_len * 8); 2459bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt ghash(H, len_buf, sizeof(len_buf), S); 2469bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2479bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); 2489bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 2499bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2509bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2519bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt/** 2529bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * aes_gcm_ae - GCM-AE_K(IV, P, A) 2539bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt */ 2549bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtint aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len, 2559bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *plain, size_t plain_len, 2569bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag) 2579bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 2589bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 H[AES_BLOCK_SIZE]; 2599bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 J0[AES_BLOCK_SIZE]; 2609bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 S[16]; 2619bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt void *aes; 2629bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2639bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes = aes_gcm_init_hash_subkey(key, key_len, H); 2649bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (aes == NULL) 2659bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return -1; 2669bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2679bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gcm_prepare_j0(iv, iv_len, H, J0); 2689bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2699bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* C = GCTR_K(inc_32(J_0), P) */ 2709bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gcm_gctr(aes, J0, plain, plain_len, crypt); 2719bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2729bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gcm_ghash(H, aad, aad_len, crypt, plain_len, S); 2739bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2749bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* T = MSB_t(GCTR_K(J_0, S)) */ 2759bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gctr(aes, J0, S, sizeof(S), tag); 2769bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2779bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* Return (C, T) */ 2789bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2799bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_encrypt_deinit(aes); 2809bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2819bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return 0; 2829bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 2839bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2849bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2859bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt/** 2869bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt * aes_gcm_ad - GCM-AD_K(IV, C, A, T) 2879bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt */ 2889bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtint aes_gcm_ad(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len, 2899bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *crypt, size_t crypt_len, 2909bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain) 2919bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 2929bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 H[AES_BLOCK_SIZE]; 2939bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 J0[AES_BLOCK_SIZE]; 2949bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt u8 S[16], T[16]; 2959bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt void *aes; 2969bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 2979bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes = aes_gcm_init_hash_subkey(key, key_len, H); 2989bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (aes == NULL) 2999bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return -1; 3009bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3019bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gcm_prepare_j0(iv, iv_len, H, J0); 3029bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3039bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* P = GCTR_K(inc_32(J_0), C) */ 3049bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gcm_gctr(aes, J0, crypt, crypt_len, plain); 3059bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3069bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gcm_ghash(H, aad, aad_len, crypt, crypt_len, S); 3079bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3089bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt /* T' = MSB_t(GCTR_K(J_0, S)) */ 3099bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_gctr(aes, J0, S, sizeof(S), T); 3109bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3119bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt aes_encrypt_deinit(aes); 3129bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3139bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt if (os_memcmp(tag, T, 16) != 0) { 3149bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch"); 3159bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return -1; 3169bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt } 3179bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3189bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return 0; 3199bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 3209bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3219bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt 3229bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidtint aes_gmac(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len, 3239bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt const u8 *aad, size_t aad_len, u8 *tag) 3249bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt{ 3259bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt return aes_gcm_ae(key, key_len, iv, iv_len, NULL, 0, aad, aad_len, NULL, 3269bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt tag); 3279bce59c7fef20e34a05f04d1e33a4076083dca0cDmitry Shmidt} 328