1/*
2 * Galois/Counter Mode (GCM) and GMAC with AES
3 *
4 * Copyright (c) 2012, Jouni Malinen <j@w1.fi>
5 *
6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
8 */
9
10#include "includes.h"
11
12#include "common.h"
13#include "aes.h"
14#include "aes_wrap.h"
15
16static void inc32(u8 *block)
17{
18	u32 val;
19	val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4);
20	val++;
21	WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val);
22}
23
24
25static void xor_block(u8 *dst, const u8 *src)
26{
27	u32 *d = (u32 *) dst;
28	u32 *s = (u32 *) src;
29	*d++ ^= *s++;
30	*d++ ^= *s++;
31	*d++ ^= *s++;
32	*d++ ^= *s++;
33}
34
35
36static void shift_right_block(u8 *v)
37{
38	u32 val;
39
40	val = WPA_GET_BE32(v + 12);
41	val >>= 1;
42	if (v[11] & 0x01)
43		val |= 0x80000000;
44	WPA_PUT_BE32(v + 12, val);
45
46	val = WPA_GET_BE32(v + 8);
47	val >>= 1;
48	if (v[7] & 0x01)
49		val |= 0x80000000;
50	WPA_PUT_BE32(v + 8, val);
51
52	val = WPA_GET_BE32(v + 4);
53	val >>= 1;
54	if (v[3] & 0x01)
55		val |= 0x80000000;
56	WPA_PUT_BE32(v + 4, val);
57
58	val = WPA_GET_BE32(v);
59	val >>= 1;
60	WPA_PUT_BE32(v, val);
61}
62
63
64/* Multiplication in GF(2^128) */
65static void gf_mult(const u8 *x, const u8 *y, u8 *z)
66{
67	u8 v[16];
68	int i, j;
69
70	os_memset(z, 0, 16); /* Z_0 = 0^128 */
71	os_memcpy(v, y, 16); /* V_0 = Y */
72
73	for (i = 0; i < 16; i++) {
74		for (j = 0; j < 8; j++) {
75			if (x[i] & BIT(7 - j)) {
76				/* Z_(i + 1) = Z_i XOR V_i */
77				xor_block(z, v);
78			} else {
79				/* Z_(i + 1) = Z_i */
80			}
81
82			if (v[15] & 0x01) {
83				/* V_(i + 1) = (V_i >> 1) XOR R */
84				shift_right_block(v);
85				/* R = 11100001 || 0^120 */
86				v[0] ^= 0xe1;
87			} else {
88				/* V_(i + 1) = V_i >> 1 */
89				shift_right_block(v);
90			}
91		}
92	}
93}
94
95
96static void ghash_start(u8 *y)
97{
98	/* Y_0 = 0^128 */
99	os_memset(y, 0, 16);
100}
101
102
103static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y)
104{
105	size_t m, i;
106	const u8 *xpos = x;
107	u8 tmp[16];
108
109	m = xlen / 16;
110
111	for (i = 0; i < m; i++) {
112		/* Y_i = (Y^(i-1) XOR X_i) dot H */
113		xor_block(y, xpos);
114		xpos += 16;
115
116		/* dot operation:
117		 * multiplication operation for binary Galois (finite) field of
118		 * 2^128 elements */
119		gf_mult(y, h, tmp);
120		os_memcpy(y, tmp, 16);
121	}
122
123	if (x + xlen > xpos) {
124		/* Add zero padded last block */
125		size_t last = x + xlen - xpos;
126		os_memcpy(tmp, xpos, last);
127		os_memset(tmp + last, 0, sizeof(tmp) - last);
128
129		/* Y_i = (Y^(i-1) XOR X_i) dot H */
130		xor_block(y, tmp);
131
132		/* dot operation:
133		 * multiplication operation for binary Galois (finite) field of
134		 * 2^128 elements */
135		gf_mult(y, h, tmp);
136		os_memcpy(y, tmp, 16);
137	}
138
139	/* Return Y_m */
140}
141
142
143static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
144{
145	size_t i, n, last;
146	u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE];
147	const u8 *xpos = x;
148	u8 *ypos = y;
149
150	if (xlen == 0)
151		return;
152
153	n = xlen / 16;
154
155	os_memcpy(cb, icb, AES_BLOCK_SIZE);
156	/* Full blocks */
157	for (i = 0; i < n; i++) {
158		aes_encrypt(aes, cb, ypos);
159		xor_block(ypos, xpos);
160		xpos += AES_BLOCK_SIZE;
161		ypos += AES_BLOCK_SIZE;
162		inc32(cb);
163	}
164
165	last = x + xlen - xpos;
166	if (last) {
167		/* Last, partial block */
168		aes_encrypt(aes, cb, tmp);
169		for (i = 0; i < last; i++)
170			*ypos++ = *xpos++ ^ tmp[i];
171	}
172}
173
174
175static void * aes_gcm_init_hash_subkey(const u8 *key, size_t key_len, u8 *H)
176{
177	void *aes;
178
179	aes = aes_encrypt_init(key, key_len);
180	if (aes == NULL)
181		return NULL;
182
183	/* Generate hash subkey H = AES_K(0^128) */
184	os_memset(H, 0, AES_BLOCK_SIZE);
185	aes_encrypt(aes, H, H);
186	wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH",
187			H, AES_BLOCK_SIZE);
188	return aes;
189}
190
191
192static void aes_gcm_prepare_j0(const u8 *iv, size_t iv_len, const u8 *H, u8 *J0)
193{
194	u8 len_buf[16];
195
196	if (iv_len == 12) {
197		/* Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
198		os_memcpy(J0, iv, iv_len);
199		os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
200		J0[AES_BLOCK_SIZE - 1] = 0x01;
201	} else {
202		/*
203		 * s = 128 * ceil(len(IV)/128) - len(IV)
204		 * J_0 = GHASH_H(IV || 0^(s+64) || [len(IV)]_64)
205		 */
206		ghash_start(J0);
207		ghash(H, iv, iv_len, J0);
208		WPA_PUT_BE64(len_buf, 0);
209		WPA_PUT_BE64(len_buf + 8, iv_len * 8);
210		ghash(H, len_buf, sizeof(len_buf), J0);
211	}
212}
213
214
215static void aes_gcm_gctr(void *aes, const u8 *J0, const u8 *in, size_t len,
216			 u8 *out)
217{
218	u8 J0inc[AES_BLOCK_SIZE];
219
220	if (len == 0)
221		return;
222
223	os_memcpy(J0inc, J0, AES_BLOCK_SIZE);
224	inc32(J0inc);
225	aes_gctr(aes, J0inc, in, len, out);
226}
227
228
229static void aes_gcm_ghash(const u8 *H, const u8 *aad, size_t aad_len,
230			  const u8 *crypt, size_t crypt_len, u8 *S)
231{
232	u8 len_buf[16];
233
234	/*
235	 * u = 128 * ceil[len(C)/128] - len(C)
236	 * v = 128 * ceil[len(A)/128] - len(A)
237	 * S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
238	 * (i.e., zero padded to block size A || C and lengths of each in bits)
239	 */
240	ghash_start(S);
241	ghash(H, aad, aad_len, S);
242	ghash(H, crypt, crypt_len, S);
243	WPA_PUT_BE64(len_buf, aad_len * 8);
244	WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
245	ghash(H, len_buf, sizeof(len_buf), S);
246
247	wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
248}
249
250
251/**
252 * aes_gcm_ae - GCM-AE_K(IV, P, A)
253 */
254int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
255	       const u8 *plain, size_t plain_len,
256	       const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
257{
258	u8 H[AES_BLOCK_SIZE];
259	u8 J0[AES_BLOCK_SIZE];
260	u8 S[16];
261	void *aes;
262
263	aes = aes_gcm_init_hash_subkey(key, key_len, H);
264	if (aes == NULL)
265		return -1;
266
267	aes_gcm_prepare_j0(iv, iv_len, H, J0);
268
269	/* C = GCTR_K(inc_32(J_0), P) */
270	aes_gcm_gctr(aes, J0, plain, plain_len, crypt);
271
272	aes_gcm_ghash(H, aad, aad_len, crypt, plain_len, S);
273
274	/* T = MSB_t(GCTR_K(J_0, S)) */
275	aes_gctr(aes, J0, S, sizeof(S), tag);
276
277	/* Return (C, T) */
278
279	aes_encrypt_deinit(aes);
280
281	return 0;
282}
283
284
285/**
286 * aes_gcm_ad - GCM-AD_K(IV, C, A, T)
287 */
288int aes_gcm_ad(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
289	       const u8 *crypt, size_t crypt_len,
290	       const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain)
291{
292	u8 H[AES_BLOCK_SIZE];
293	u8 J0[AES_BLOCK_SIZE];
294	u8 S[16], T[16];
295	void *aes;
296
297	aes = aes_gcm_init_hash_subkey(key, key_len, H);
298	if (aes == NULL)
299		return -1;
300
301	aes_gcm_prepare_j0(iv, iv_len, H, J0);
302
303	/* P = GCTR_K(inc_32(J_0), C) */
304	aes_gcm_gctr(aes, J0, crypt, crypt_len, plain);
305
306	aes_gcm_ghash(H, aad, aad_len, crypt, crypt_len, S);
307
308	/* T' = MSB_t(GCTR_K(J_0, S)) */
309	aes_gctr(aes, J0, S, sizeof(S), T);
310
311	aes_encrypt_deinit(aes);
312
313	if (os_memcmp_const(tag, T, 16) != 0) {
314		wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
315		return -1;
316	}
317
318	return 0;
319}
320
321
322int aes_gmac(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
323	     const u8 *aad, size_t aad_len, u8 *tag)
324{
325	return aes_gcm_ae(key, key_len, iv, iv_len, NULL, 0, aad, aad_len, NULL,
326			  tag);
327}
328