crypto.c revision d59db761b8559f07a7161ca3387d6c6949667ede
1d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
2d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Ultra Wide Band
3d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * AES-128 CCM Encryption
4d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
5d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Copyright (C) 2007 Intel Corporation
6d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
7d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
8d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * This program is free software; you can redistribute it and/or
9d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * modify it under the terms of the GNU General Public License version
10d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 2 as published by the Free Software Foundation.
11d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
12d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * This program is distributed in the hope that it will be useful,
13d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * but WITHOUT ANY WARRANTY; without even the implied warranty of
14d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * GNU General Public License for more details.
16d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
17d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * You should have received a copy of the GNU General Public License
18d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * along with this program; if not, write to the Free Software
19d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
20d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 02110-1301, USA.
21d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
22d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
23d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * We don't do any encryption here; we use the Linux Kernel's AES-128
24d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * crypto modules to construct keys and payload blocks in a way
25d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * defined by WUSB1.0[6]. Check the erratas, as typos are are patched
26d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * there.
27d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
28d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Thanks a zillion to John Keys for his help and clarifications over
29d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the designed-by-a-committee text.
30d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
31d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * So the idea is that there is this basic Pseudo-Random-Function
32d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * defined in WUSB1.0[6.5] which is the core of everything. It works
33d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * by tweaking some blocks, AES crypting them and then xoring
34d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * something else with them (this seems to be called CBC(AES) -- can
35d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * you tell I know jack about crypto?). So we just funnel it into the
36d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Linux Crypto API.
37d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
38d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * We leave a crypto test module so we can verify that vectors match,
39d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * every now and then.
40d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
41d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Block size: 16 bytes -- AES seems to do things in 'block sizes'. I
42d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *             am learning a lot...
43d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
44d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *             Conveniently, some data structures that need to be
45d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *             funneled through AES are...16 bytes in size!
46d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
47d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
48d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/crypto.h>
49d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/module.h>
50d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/err.h>
51d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/uwb.h>
52d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/usb/wusb.h>
53d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/scatterlist.h>
54d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#define D_LOCAL 0
55d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/uwb/debug.h>
56d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
57d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
58d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
59d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Block of data, as understood by AES-CCM
60d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
61d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * The code assumes this structure is nothing but a 16 byte array
62d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (packed in a struct to avoid common mess ups that I usually do with
63d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * arrays and enforcing type checking).
64d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
65d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_block {
66d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 data[16];
67d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed));
68d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
69d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
70d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Counter-mode Blocks (WUSB1.0[6.4])
71d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
72d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * According to CCM (or so it seems), for the purpose of calculating
73d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the MIC, the message is broken in N counter-mode blocks, B0, B1,
74d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * ... BN.
75d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
76d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * B0 contains flags, the CCM nonce and l(m).
77d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
78d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * B1 contains l(a), the MAC header, the encryption offset and padding.
79d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
80d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * If EO is nonzero, additional blocks are built from payload bytes
81d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * until EO is exahusted (FIXME: padding to 16 bytes, I guess). The
82d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * padding is not xmitted.
83d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
84d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
85d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* WUSB1.0[T6.4] */
86d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_b0 {
87d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 flags;	/* 0x59, per CCM spec */
88d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct aes_ccm_nonce ccm_nonce;
89d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	__be16 lm;
90d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed));
91d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
92d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* WUSB1.0[T6.5] */
93d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_b1 {
94d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	__be16 la;
95d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 mac_header[10];
96d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	__le16 eo;
97d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 security_reserved;	/* This is always zero */
98d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 padding;		/* 0 */
99d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed));
100d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
101d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
102d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Encryption Blocks (WUSB1.0[6.4.4])
103d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
104d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * CCM uses Ax blocks to generate a keystream with which the MIC and
105d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the message's payload are encoded. A0 always encrypts/decrypts the
106d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * MIC. Ax (x>0) are used for the sucesive payload blocks.
107d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
108d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * The x is the counter, and is increased for each block.
109d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
110d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_a {
111d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 flags;	/* 0x01, per CCM spec */
112d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct aes_ccm_nonce ccm_nonce;
113d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	__be16 counter;	/* Value of x */
114d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed));
115d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
116d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic void bytewise_xor(void *_bo, const void *_bi1, const void *_bi2,
117d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			 size_t size)
118d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{
119d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 *bo = _bo;
120d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	const u8 *bi1 = _bi1, *bi2 = _bi2;
121d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	size_t itr;
122d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	for (itr = 0; itr < size; itr++)
123d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		bo[itr] = bi1[itr] ^ bi2[itr];
124d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}
125d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
126d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
127d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * CC-MAC function WUSB1.0[6.5]
128d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
129d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Take a data string and produce the encrypted CBC Counter-mode MIC
130d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
131d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Note the names for most function arguments are made to (more or
132d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * less) match those used in the pseudo-function definition given in
133d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * WUSB1.0[6.5].
134d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
135d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @tfm_cbc: CBC(AES) blkcipher handle (initialized)
136d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
137d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @tfm_aes: AES cipher handle (initialized)
138d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
139d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @mic: buffer for placing the computed MIC (Message Integrity
140d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       Code). This is exactly 8 bytes, and we expect the buffer to
141d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       be at least eight bytes in length.
142d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
143d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @key: 128 bit symmetric key
144d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
145d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @n: CCM nonce
146d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
147d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @a: ASCII string, 14 bytes long (I guess zero padded if needed;
148d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *     we use exactly 14 bytes).
149d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
150d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @b: data stream to be processed; cannot be a global or const local
151d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *     (will confuse the scatterlists)
152d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
153d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @blen: size of b...
154d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
155d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Still not very clear how this is done, but looks like this: we
156d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * create block B0 (as WUSB1.0[6.5] says), then we AES-crypt it with
157d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @key. We bytewise xor B0 with B1 (1) and AES-crypt that. Then we
158d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * take the payload and divide it in blocks (16 bytes), xor them with
159d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the previous crypto result (16 bytes) and crypt it, repeat the next
160d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * block with the output of the previous one, rinse wash (I guess this
161d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * is what AES CBC mode means...but I truly have no idea). So we use
162d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the CBC(AES) blkcipher, that does precisely that. The IV (Initial
163d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Vector) is 16 bytes and is set to zero, so
164d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
165d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * See rfc3610. Linux crypto has a CBC implementation, but the
166d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * documentation is scarce, to say the least, and the example code is
167d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * so intricated that is difficult to understand how things work. Most
168d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * of this is guess work -- bite me.
169d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
170d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (1) Created as 6.5 says, again, using as l(a) 'Blen + 14', and
171d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *     using the 14 bytes of @a to fill up
172d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *     b1.{mac_header,e0,security_reserved,padding}.
173d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
174d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: The definiton of l(a) in WUSB1.0[6.5] vs the definition of
175d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       l(m) is orthogonal, they bear no relationship, so it is not
176d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       in conflict with the parameter's relation that
177d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       WUSB1.0[6.4.2]) defines.
178d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
179d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: WUSB1.0[A.1]: Host Nonce is missing a nibble? (1e); fixed in
180d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       first errata released on 2005/07.
181d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
182d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: we need to clean IV to zero at each invocation to make sure
183d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       we start with a fresh empty Initial Vector, so that the CBC
184d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       works ok.
185d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
186d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: blen is not aligned to a block size, we'll pad zeros, that's
187d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *       what sg[4] is for. Maybe there is a smarter way to do this.
188d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
189d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic int wusb_ccm_mac(struct crypto_blkcipher *tfm_cbc,
190d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			struct crypto_cipher *tfm_aes, void *mic,
191d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			const struct aes_ccm_nonce *n,
192d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			const struct aes_ccm_label *a, const void *b,
193d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			size_t blen)
194d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{
195d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	int result = 0;
196d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct blkcipher_desc desc;
197d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct aes_ccm_b0 b0;
198d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct aes_ccm_b1 b1;
199d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct aes_ccm_a ax;
200d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct scatterlist sg[4], sg_dst;
201d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	void *iv, *dst_buf;
202d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	size_t ivsize, dst_size;
203d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	const u8 bzero[16] = { 0 };
204d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	size_t zero_padding;
205d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
206d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_fnstart(3, NULL, "(tfm_cbc %p, tfm_aes %p, mic %p, "
207d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		  "n %p, a %p, b %p, blen %zu)\n",
208d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		  tfm_cbc, tfm_aes, mic, n, a, b, blen);
209d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/*
210d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * These checks should be compile time optimized out
211d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * ensure @a fills b1's mac_header and following fields
212d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 */
213d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	WARN_ON(sizeof(*a) != sizeof(b1) - sizeof(b1.la));
214d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	WARN_ON(sizeof(b0) != sizeof(struct aes_ccm_block));
215d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	WARN_ON(sizeof(b1) != sizeof(struct aes_ccm_block));
216d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	WARN_ON(sizeof(ax) != sizeof(struct aes_ccm_block));
217d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
218d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = -ENOMEM;
219d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	zero_padding = sizeof(struct aes_ccm_block)
220d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		- blen % sizeof(struct aes_ccm_block);
221d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	zero_padding = blen % sizeof(struct aes_ccm_block);
222d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (zero_padding)
223d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		zero_padding = sizeof(struct aes_ccm_block) - zero_padding;
224d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	dst_size = blen + sizeof(b0) + sizeof(b1) + zero_padding;
225d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	dst_buf = kzalloc(dst_size, GFP_KERNEL);
226d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (dst_buf == NULL) {
227d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: can't alloc destination buffer\n");
228d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		goto error_dst_buf;
229d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
230d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
231d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	iv = crypto_blkcipher_crt(tfm_cbc)->iv;
232d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	ivsize = crypto_blkcipher_ivsize(tfm_cbc);
233d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	memset(iv, 0, ivsize);
234d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
235d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/* Setup B0 */
236d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	b0.flags = 0x59;	/* Format B0 */
237d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	b0.ccm_nonce = *n;
238d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	b0.lm = cpu_to_be16(0);	/* WUSB1.0[6.5] sez l(m) is 0 */
239d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
240d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/* Setup B1
241d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 *
242d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * The WUSB spec is anything but clear! WUSB1.0[6.5]
243d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * says that to initialize B1 from A with 'l(a) = blen +
244d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * 14'--after clarification, it means to use A's contents
245d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * for MAC Header, EO, sec reserved and padding.
246d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 */
247d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	b1.la = cpu_to_be16(blen + 14);
248d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	memcpy(&b1.mac_header, a, sizeof(*a));
249d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
250d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "I: B0 (%zu bytes)\n", sizeof(b0));
251d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_dump(4, NULL, &b0, sizeof(b0));
252d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "I: B1 (%zu bytes)\n", sizeof(b1));
253d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_dump(4, NULL, &b1, sizeof(b1));
254d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "I: B (%zu bytes)\n", blen);
255d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_dump(4, NULL, b, blen);
256d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "I: B 0-padding (%zu bytes)\n", zero_padding);
257d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "D: IV before crypto (%zu)\n", ivsize);
258d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_dump(4, NULL, iv, ivsize);
259d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
260d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	sg_init_table(sg, ARRAY_SIZE(sg));
261d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	sg_set_buf(&sg[0], &b0, sizeof(b0));
262d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	sg_set_buf(&sg[1], &b1, sizeof(b1));
263d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	sg_set_buf(&sg[2], b, blen);
264d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/* 0 if well behaved :) */
265d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	sg_set_buf(&sg[3], bzero, zero_padding);
266d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	sg_init_one(&sg_dst, dst_buf, dst_size);
267d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
268d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	desc.tfm = tfm_cbc;
269d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	desc.flags = 0;
270d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = crypto_blkcipher_encrypt(&desc, &sg_dst, sg, dst_size);
271d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (result < 0) {
272d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: can't compute CBC-MAC tag (MIC): %d\n",
273d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       result);
274d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		goto error_cbc_crypt;
275d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
276d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "D: MIC tag\n");
277d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_dump(4, NULL, iv, ivsize);
278d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
279d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/* Now we crypt the MIC Tag (*iv) with Ax -- values per WUSB1.0[6.5]
280d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * The procedure is to AES crypt the A0 block and XOR the MIC
281d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * Tag agains it; we only do the first 8 bytes and place it
282d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * directly in the destination buffer.
283d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 *
284d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * POS Crypto API: size is assumed to be AES's block size.
285d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * Thanks for documenting it -- tip taken from airo.c
286d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 */
287d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	ax.flags = 0x01;		/* as per WUSB 1.0 spec */
288d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	ax.ccm_nonce = *n;
289d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	ax.counter = 0;
290d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	crypto_cipher_encrypt_one(tfm_aes, (void *)&ax, (void *)&ax);
291d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	bytewise_xor(mic, &ax, iv, 8);
292d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "D: CTR[MIC]\n");
293d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_dump(4, NULL, &ax, 8);
294d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_printf(4, NULL, "D: CCM-MIC tag\n");
295d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_dump(4, NULL, mic, 8);
296d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = 8;
297d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_cbc_crypt:
298d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	kfree(dst_buf);
299d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_dst_buf:
300d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_fnend(3, NULL, "(tfm_cbc %p, tfm_aes %p, mic %p, "
301d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		"n %p, a %p, b %p, blen %zu)\n",
302d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		tfm_cbc, tfm_aes, mic, n, a, b, blen);
303d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	return result;
304d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}
305d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
306d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
307d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * WUSB Pseudo Random Function (WUSB1.0[6.5])
308d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
309d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @b: buffer to the source data; cannot be a global or const local
310d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *     (will confuse the scatterlists)
311d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
312d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezssize_t wusb_prf(void *out, size_t out_size,
313d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		 const u8 key[16], const struct aes_ccm_nonce *_n,
314d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		 const struct aes_ccm_label *a,
315d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		 const void *b, size_t blen, size_t len)
316d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{
317d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	ssize_t result, bytes = 0, bitr;
318d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct aes_ccm_nonce n = *_n;
319d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct crypto_blkcipher *tfm_cbc;
320d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct crypto_cipher *tfm_aes;
321d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u64 sfn = 0;
322d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	__le64 sfn_le;
323d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
324d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_fnstart(3, NULL, "(out %p, out_size %zu, key %p, _n %p, "
325d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		  "a %p, b %p, blen %zu, len %zu)\n", out, out_size,
326d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		  key, _n, a, b, blen, len);
327d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
328d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	tfm_cbc = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
329d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (IS_ERR(tfm_cbc)) {
330d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		result = PTR_ERR(tfm_cbc);
331d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: can't load CBC(AES): %d\n", (int)result);
332d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		goto error_alloc_cbc;
333d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
334d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = crypto_blkcipher_setkey(tfm_cbc, key, 16);
335d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (result < 0) {
336d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: can't set CBC key: %d\n", (int)result);
337d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		goto error_setkey_cbc;
338d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
339d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
340d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
341d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (IS_ERR(tfm_aes)) {
342d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		result = PTR_ERR(tfm_aes);
343d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: can't load AES: %d\n", (int)result);
344d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		goto error_alloc_aes;
345d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
346d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = crypto_cipher_setkey(tfm_aes, key, 16);
347d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (result < 0) {
348d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: can't set AES key: %d\n", (int)result);
349d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		goto error_setkey_aes;
350d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
351d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
352d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	for (bitr = 0; bitr < (len + 63) / 64; bitr++) {
353d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		sfn_le = cpu_to_le64(sfn++);
354d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		memcpy(&n.sfn, &sfn_le, sizeof(n.sfn));	/* n.sfn++... */
355d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		result = wusb_ccm_mac(tfm_cbc, tfm_aes, out + bytes,
356d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez				      &n, a, b, blen);
357d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		if (result < 0)
358d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			goto error_ccm_mac;
359d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		bytes += result;
360d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
361d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = bytes;
362d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_ccm_mac:
363d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_setkey_aes:
364d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	crypto_free_cipher(tfm_aes);
365d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_alloc_aes:
366d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_setkey_cbc:
367d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	crypto_free_blkcipher(tfm_cbc);
368d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_alloc_cbc:
369d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	d_fnend(3, NULL, "(out %p, out_size %zu, key %p, _n %p, "
370d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		"a %p, b %p, blen %zu, len %zu) = %d\n", out, out_size,
371d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		key, _n, a, b, blen, len, (int)bytes);
372d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	return result;
373d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}
374d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
375d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* WUSB1.0[A.2] test vectors */
376d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const u8 stv_hsmic_key[16] = {
377d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	0x4b, 0x79, 0xa3, 0xcf, 0xe5, 0x53, 0x23, 0x9d,
378d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	0xd7, 0xc1, 0x6d, 0x1c, 0x2d, 0xab, 0x6d, 0x3f
379d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez};
380d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
381d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const struct aes_ccm_nonce stv_hsmic_n = {
382d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.sfn = { 0 },
383d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.tkid = { 0x76, 0x98, 0x01,  },
384d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.dest_addr = { .data = { 0xbe, 0x00 } },
385d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.src_addr = { .data = { 0x76, 0x98 } },
386d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez};
387d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
388d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
389d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Out-of-band MIC Generation verification code
390d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
391d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
392d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic int wusb_oob_mic_verify(void)
393d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{
394d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	int result;
395d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	u8 mic[8];
396d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/* WUSB1.0[A.2] test vectors
397d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 *
398d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * Need to keep it in the local stack as GCC 4.1.3something
399d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * messes up and generates noise.
400d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 */
401d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct usb_handshake stv_hsmic_hs = {
402d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.bMessageNumber = 2,
403d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.bStatus 	= 00,
404d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.tTKID 		= { 0x76, 0x98, 0x01 },
405d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.bReserved 	= 00,
406d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.CDID 		= { 0x30, 0x31, 0x32, 0x33, 0x34, 0x35,
407d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez				    0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
408d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez				    0x3c, 0x3d, 0x3e, 0x3f },
409d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.nonce	 	= { 0x20, 0x21, 0x22, 0x23, 0x24, 0x25,
410d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez				    0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
411d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez				    0x2c, 0x2d, 0x2e, 0x2f },
412d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.MIC	 	= { 0x75, 0x6a, 0x97, 0x51, 0x0c, 0x8c,
413d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez				    0x14, 0x7b } ,
414d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	};
415d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	size_t hs_size;
416d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
417d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = wusb_oob_mic(mic, stv_hsmic_key, &stv_hsmic_n, &stv_hsmic_hs);
418d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (result < 0)
419d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: WUSB OOB MIC test: failed: %d\n", result);
420d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	else if (memcmp(stv_hsmic_hs.MIC, mic, sizeof(mic))) {
421d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: OOB MIC test: "
422d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       "mismatch between MIC result and WUSB1.0[A2]\n");
423d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		hs_size = sizeof(stv_hsmic_hs) - sizeof(stv_hsmic_hs.MIC);
424d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: Handshake2 in: (%zu bytes)\n", hs_size);
425d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, &stv_hsmic_hs, hs_size);
426d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: CCM Nonce in: (%zu bytes)\n",
427d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       sizeof(stv_hsmic_n));
428d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, &stv_hsmic_n, sizeof(stv_hsmic_n));
429d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: MIC out:\n");
430d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, mic, sizeof(mic));
431d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: MIC out (from WUSB1.0[A.2]):\n");
432d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, stv_hsmic_hs.MIC, sizeof(stv_hsmic_hs.MIC));
433d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		result = -EINVAL;
434d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	} else
435d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		result = 0;
436d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	return result;
437d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}
438d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
439d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
440d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Test vectors for Key derivation
441d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
442d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * These come from WUSB1.0[6.5.1], the vectors in WUSB1.0[A.1]
443d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (errata corrected in 2005/07).
444d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
445d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const u8 stv_key_a1[16] __attribute__ ((__aligned__(4))) = {
446d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87,
447d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	0x78, 0x69, 0x5a, 0x4b, 0x3c, 0x2d, 0x1e, 0x0f
448d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez};
449d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
450d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const struct aes_ccm_nonce stv_keydvt_n_a1 = {
451d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.sfn = { 0 },
452d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.tkid = { 0x76, 0x98, 0x01,  },
453d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.dest_addr = { .data = { 0xbe, 0x00 } },
454d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.src_addr = { .data = { 0x76, 0x98 } },
455d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez};
456d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
457d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const struct wusb_keydvt_out stv_keydvt_out_a1 = {
458d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.kck = {
459d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		0x4b, 0x79, 0xa3, 0xcf, 0xe5, 0x53, 0x23, 0x9d,
460d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		0xd7, 0xc1, 0x6d, 0x1c, 0x2d, 0xab, 0x6d, 0x3f
461d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	},
462d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	.ptk = {
463d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		0xc8, 0x70, 0x62, 0x82, 0xb6, 0x7c, 0xe9, 0x06,
464d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		0x7b, 0xc5, 0x25, 0x69, 0xf2, 0x36, 0x61, 0x2d
465d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	}
466d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez};
467d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
468d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
469d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Performa a test to make sure we match the vectors defined in
470d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * WUSB1.0[A.1](Errata2006/12)
471d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
472d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic int wusb_key_derive_verify(void)
473d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{
474d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	int result = 0;
475d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct wusb_keydvt_out keydvt_out;
476d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/* These come from WUSB1.0[A.1] + 2006/12 errata
477d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 * NOTE: can't make this const or global -- somehow it seems
478d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 *       the scatterlists for crypto get confused and we get
479d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	 *       bad data. There is no doc on this... */
480d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	struct wusb_keydvt_in stv_keydvt_in_a1 = {
481d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.hnonce = {
482d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
483d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
484d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		},
485d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		.dnonce = {
486d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
487d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez			0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f
488d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		}
489d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	};
490d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
491d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = wusb_key_derive(&keydvt_out, stv_key_a1, &stv_keydvt_n_a1,
492d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez				 &stv_keydvt_in_a1);
493d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (result < 0)
494d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: WUSB key derivation test: "
495d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       "derivation failed: %d\n", result);
496d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (memcmp(&stv_keydvt_out_a1, &keydvt_out, sizeof(keydvt_out))) {
497d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: WUSB key derivation test: "
498d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       "mismatch between key derivation result "
499d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       "and WUSB1.0[A1] Errata 2006/12\n");
500d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: keydvt in: key (%zu bytes)\n",
501d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       sizeof(stv_key_a1));
502d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, stv_key_a1, sizeof(stv_key_a1));
503d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: keydvt in: nonce (%zu bytes)\n",
504d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       sizeof(stv_keydvt_n_a1));
505d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, &stv_keydvt_n_a1, sizeof(stv_keydvt_n_a1));
506d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: keydvt in: hnonce & dnonce (%zu bytes)\n",
507d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		       sizeof(stv_keydvt_in_a1));
508d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, &stv_keydvt_in_a1, sizeof(stv_keydvt_in_a1));
509d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: keydvt out: KCK\n");
510d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, &keydvt_out.kck, sizeof(keydvt_out.kck));
511d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		printk(KERN_ERR "E: keydvt out: PTK\n");
512d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		dump_bytes(NULL, &keydvt_out.ptk, sizeof(keydvt_out.ptk));
513d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		result = -EINVAL;
514d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	} else
515d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		result = 0;
516d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	return result;
517d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}
518d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
519d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/*
520d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Initialize crypto system
521d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez *
522d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * FIXME: we do nothing now, other than verifying. Later on we'll
523d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * cache the encryption stuff, so that's why we have a separate init.
524d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */
525d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezint wusb_crypto_init(void)
526d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{
527d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	int result;
528d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
529d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	result = wusb_key_derive_verify();
530d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	if (result < 0)
531d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez		return result;
532d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	return wusb_oob_mic_verify();
533d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}
534d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez
535d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezvoid wusb_crypto_exit(void)
536d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{
537d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez	/* FIXME: free cached crypto transforms */
538d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}
539