crypto.c revision d59db761b8559f07a7161ca3387d6c6949667ede
1d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 2d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Ultra Wide Band 3d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * AES-128 CCM Encryption 4d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 5d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Copyright (C) 2007 Intel Corporation 6d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> 7d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 8d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * This program is free software; you can redistribute it and/or 9d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * modify it under the terms of the GNU General Public License version 10d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 2 as published by the Free Software Foundation. 11d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 12d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * This program is distributed in the hope that it will be useful, 13d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * but WITHOUT ANY WARRANTY; without even the implied warranty of 14d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * GNU General Public License for more details. 16d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 17d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * You should have received a copy of the GNU General Public License 18d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * along with this program; if not, write to the Free Software 19d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 20d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 02110-1301, USA. 21d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 22d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 23d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * We don't do any encryption here; we use the Linux Kernel's AES-128 24d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * crypto modules to construct keys and payload blocks in a way 25d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * defined by WUSB1.0[6]. Check the erratas, as typos are are patched 26d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * there. 27d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 28d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Thanks a zillion to John Keys for his help and clarifications over 29d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the designed-by-a-committee text. 30d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 31d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * So the idea is that there is this basic Pseudo-Random-Function 32d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * defined in WUSB1.0[6.5] which is the core of everything. It works 33d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * by tweaking some blocks, AES crypting them and then xoring 34d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * something else with them (this seems to be called CBC(AES) -- can 35d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * you tell I know jack about crypto?). So we just funnel it into the 36d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Linux Crypto API. 37d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 38d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * We leave a crypto test module so we can verify that vectors match, 39d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * every now and then. 40d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 41d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Block size: 16 bytes -- AES seems to do things in 'block sizes'. I 42d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * am learning a lot... 43d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 44d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Conveniently, some data structures that need to be 45d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * funneled through AES are...16 bytes in size! 46d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 47d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 48d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/crypto.h> 49d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/module.h> 50d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/err.h> 51d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/uwb.h> 52d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/usb/wusb.h> 53d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/scatterlist.h> 54d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#define D_LOCAL 0 55d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez#include <linux/uwb/debug.h> 56d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 57d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 58d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 59d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Block of data, as understood by AES-CCM 60d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 61d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * The code assumes this structure is nothing but a 16 byte array 62d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (packed in a struct to avoid common mess ups that I usually do with 63d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * arrays and enforcing type checking). 64d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 65d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_block { 66d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 data[16]; 67d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed)); 68d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 69d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 70d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Counter-mode Blocks (WUSB1.0[6.4]) 71d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 72d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * According to CCM (or so it seems), for the purpose of calculating 73d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the MIC, the message is broken in N counter-mode blocks, B0, B1, 74d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * ... BN. 75d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 76d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * B0 contains flags, the CCM nonce and l(m). 77d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 78d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * B1 contains l(a), the MAC header, the encryption offset and padding. 79d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 80d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * If EO is nonzero, additional blocks are built from payload bytes 81d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * until EO is exahusted (FIXME: padding to 16 bytes, I guess). The 82d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * padding is not xmitted. 83d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 84d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 85d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* WUSB1.0[T6.4] */ 86d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_b0 { 87d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 flags; /* 0x59, per CCM spec */ 88d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct aes_ccm_nonce ccm_nonce; 89d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez __be16 lm; 90d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed)); 91d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 92d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* WUSB1.0[T6.5] */ 93d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_b1 { 94d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez __be16 la; 95d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 mac_header[10]; 96d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez __le16 eo; 97d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 security_reserved; /* This is always zero */ 98d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 padding; /* 0 */ 99d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed)); 100d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 101d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 102d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Encryption Blocks (WUSB1.0[6.4.4]) 103d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 104d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * CCM uses Ax blocks to generate a keystream with which the MIC and 105d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the message's payload are encoded. A0 always encrypts/decrypts the 106d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * MIC. Ax (x>0) are used for the sucesive payload blocks. 107d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 108d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * The x is the counter, and is increased for each block. 109d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 110d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstruct aes_ccm_a { 111d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 flags; /* 0x01, per CCM spec */ 112d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct aes_ccm_nonce ccm_nonce; 113d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez __be16 counter; /* Value of x */ 114d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} __attribute__((packed)); 115d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 116d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic void bytewise_xor(void *_bo, const void *_bi1, const void *_bi2, 117d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez size_t size) 118d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{ 119d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 *bo = _bo; 120d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez const u8 *bi1 = _bi1, *bi2 = _bi2; 121d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez size_t itr; 122d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez for (itr = 0; itr < size; itr++) 123d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez bo[itr] = bi1[itr] ^ bi2[itr]; 124d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} 125d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 126d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 127d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * CC-MAC function WUSB1.0[6.5] 128d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 129d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Take a data string and produce the encrypted CBC Counter-mode MIC 130d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 131d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Note the names for most function arguments are made to (more or 132d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * less) match those used in the pseudo-function definition given in 133d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * WUSB1.0[6.5]. 134d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 135d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @tfm_cbc: CBC(AES) blkcipher handle (initialized) 136d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 137d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @tfm_aes: AES cipher handle (initialized) 138d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 139d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @mic: buffer for placing the computed MIC (Message Integrity 140d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Code). This is exactly 8 bytes, and we expect the buffer to 141d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * be at least eight bytes in length. 142d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 143d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @key: 128 bit symmetric key 144d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 145d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @n: CCM nonce 146d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 147d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @a: ASCII string, 14 bytes long (I guess zero padded if needed; 148d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * we use exactly 14 bytes). 149d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 150d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @b: data stream to be processed; cannot be a global or const local 151d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (will confuse the scatterlists) 152d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 153d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @blen: size of b... 154d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 155d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Still not very clear how this is done, but looks like this: we 156d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * create block B0 (as WUSB1.0[6.5] says), then we AES-crypt it with 157d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @key. We bytewise xor B0 with B1 (1) and AES-crypt that. Then we 158d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * take the payload and divide it in blocks (16 bytes), xor them with 159d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the previous crypto result (16 bytes) and crypt it, repeat the next 160d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * block with the output of the previous one, rinse wash (I guess this 161d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * is what AES CBC mode means...but I truly have no idea). So we use 162d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the CBC(AES) blkcipher, that does precisely that. The IV (Initial 163d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Vector) is 16 bytes and is set to zero, so 164d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 165d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * See rfc3610. Linux crypto has a CBC implementation, but the 166d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * documentation is scarce, to say the least, and the example code is 167d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * so intricated that is difficult to understand how things work. Most 168d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * of this is guess work -- bite me. 169d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 170d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (1) Created as 6.5 says, again, using as l(a) 'Blen + 14', and 171d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * using the 14 bytes of @a to fill up 172d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * b1.{mac_header,e0,security_reserved,padding}. 173d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 174d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: The definiton of l(a) in WUSB1.0[6.5] vs the definition of 175d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * l(m) is orthogonal, they bear no relationship, so it is not 176d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * in conflict with the parameter's relation that 177d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * WUSB1.0[6.4.2]) defines. 178d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 179d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: WUSB1.0[A.1]: Host Nonce is missing a nibble? (1e); fixed in 180d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * first errata released on 2005/07. 181d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 182d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: we need to clean IV to zero at each invocation to make sure 183d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * we start with a fresh empty Initial Vector, so that the CBC 184d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * works ok. 185d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 186d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: blen is not aligned to a block size, we'll pad zeros, that's 187d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * what sg[4] is for. Maybe there is a smarter way to do this. 188d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 189d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic int wusb_ccm_mac(struct crypto_blkcipher *tfm_cbc, 190d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct crypto_cipher *tfm_aes, void *mic, 191d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez const struct aes_ccm_nonce *n, 192d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez const struct aes_ccm_label *a, const void *b, 193d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez size_t blen) 194d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{ 195d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez int result = 0; 196d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct blkcipher_desc desc; 197d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct aes_ccm_b0 b0; 198d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct aes_ccm_b1 b1; 199d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct aes_ccm_a ax; 200d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct scatterlist sg[4], sg_dst; 201d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez void *iv, *dst_buf; 202d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez size_t ivsize, dst_size; 203d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez const u8 bzero[16] = { 0 }; 204d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez size_t zero_padding; 205d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 206d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_fnstart(3, NULL, "(tfm_cbc %p, tfm_aes %p, mic %p, " 207d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "n %p, a %p, b %p, blen %zu)\n", 208d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez tfm_cbc, tfm_aes, mic, n, a, b, blen); 209d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* 210d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * These checks should be compile time optimized out 211d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * ensure @a fills b1's mac_header and following fields 212d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 213d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez WARN_ON(sizeof(*a) != sizeof(b1) - sizeof(b1.la)); 214d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez WARN_ON(sizeof(b0) != sizeof(struct aes_ccm_block)); 215d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez WARN_ON(sizeof(b1) != sizeof(struct aes_ccm_block)); 216d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez WARN_ON(sizeof(ax) != sizeof(struct aes_ccm_block)); 217d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 218d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = -ENOMEM; 219d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez zero_padding = sizeof(struct aes_ccm_block) 220d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez - blen % sizeof(struct aes_ccm_block); 221d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez zero_padding = blen % sizeof(struct aes_ccm_block); 222d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (zero_padding) 223d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez zero_padding = sizeof(struct aes_ccm_block) - zero_padding; 224d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dst_size = blen + sizeof(b0) + sizeof(b1) + zero_padding; 225d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dst_buf = kzalloc(dst_size, GFP_KERNEL); 226d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (dst_buf == NULL) { 227d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: can't alloc destination buffer\n"); 228d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez goto error_dst_buf; 229d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 230d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 231d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez iv = crypto_blkcipher_crt(tfm_cbc)->iv; 232d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez ivsize = crypto_blkcipher_ivsize(tfm_cbc); 233d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez memset(iv, 0, ivsize); 234d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 235d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* Setup B0 */ 236d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez b0.flags = 0x59; /* Format B0 */ 237d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez b0.ccm_nonce = *n; 238d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez b0.lm = cpu_to_be16(0); /* WUSB1.0[6.5] sez l(m) is 0 */ 239d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 240d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* Setup B1 241d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 242d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * The WUSB spec is anything but clear! WUSB1.0[6.5] 243d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * says that to initialize B1 from A with 'l(a) = blen + 244d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 14'--after clarification, it means to use A's contents 245d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * for MAC Header, EO, sec reserved and padding. 246d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 247d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez b1.la = cpu_to_be16(blen + 14); 248d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez memcpy(&b1.mac_header, a, sizeof(*a)); 249d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 250d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "I: B0 (%zu bytes)\n", sizeof(b0)); 251d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_dump(4, NULL, &b0, sizeof(b0)); 252d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "I: B1 (%zu bytes)\n", sizeof(b1)); 253d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_dump(4, NULL, &b1, sizeof(b1)); 254d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "I: B (%zu bytes)\n", blen); 255d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_dump(4, NULL, b, blen); 256d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "I: B 0-padding (%zu bytes)\n", zero_padding); 257d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "D: IV before crypto (%zu)\n", ivsize); 258d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_dump(4, NULL, iv, ivsize); 259d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 260d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sg_init_table(sg, ARRAY_SIZE(sg)); 261d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sg_set_buf(&sg[0], &b0, sizeof(b0)); 262d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sg_set_buf(&sg[1], &b1, sizeof(b1)); 263d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sg_set_buf(&sg[2], b, blen); 264d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* 0 if well behaved :) */ 265d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sg_set_buf(&sg[3], bzero, zero_padding); 266d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sg_init_one(&sg_dst, dst_buf, dst_size); 267d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 268d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez desc.tfm = tfm_cbc; 269d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez desc.flags = 0; 270d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = crypto_blkcipher_encrypt(&desc, &sg_dst, sg, dst_size); 271d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (result < 0) { 272d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: can't compute CBC-MAC tag (MIC): %d\n", 273d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result); 274d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez goto error_cbc_crypt; 275d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 276d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "D: MIC tag\n"); 277d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_dump(4, NULL, iv, ivsize); 278d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 279d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* Now we crypt the MIC Tag (*iv) with Ax -- values per WUSB1.0[6.5] 280d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * The procedure is to AES crypt the A0 block and XOR the MIC 281d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Tag agains it; we only do the first 8 bytes and place it 282d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * directly in the destination buffer. 283d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 284d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * POS Crypto API: size is assumed to be AES's block size. 285d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Thanks for documenting it -- tip taken from airo.c 286d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 287d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez ax.flags = 0x01; /* as per WUSB 1.0 spec */ 288d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez ax.ccm_nonce = *n; 289d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez ax.counter = 0; 290d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez crypto_cipher_encrypt_one(tfm_aes, (void *)&ax, (void *)&ax); 291d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez bytewise_xor(mic, &ax, iv, 8); 292d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "D: CTR[MIC]\n"); 293d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_dump(4, NULL, &ax, 8); 294d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_printf(4, NULL, "D: CCM-MIC tag\n"); 295d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_dump(4, NULL, mic, 8); 296d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = 8; 297d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_cbc_crypt: 298d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez kfree(dst_buf); 299d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_dst_buf: 300d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_fnend(3, NULL, "(tfm_cbc %p, tfm_aes %p, mic %p, " 301d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "n %p, a %p, b %p, blen %zu)\n", 302d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez tfm_cbc, tfm_aes, mic, n, a, b, blen); 303d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez return result; 304d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} 305d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 306d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 307d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * WUSB Pseudo Random Function (WUSB1.0[6.5]) 308d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 309d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * @b: buffer to the source data; cannot be a global or const local 310d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (will confuse the scatterlists) 311d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 312d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezssize_t wusb_prf(void *out, size_t out_size, 313d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez const u8 key[16], const struct aes_ccm_nonce *_n, 314d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez const struct aes_ccm_label *a, 315d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez const void *b, size_t blen, size_t len) 316d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{ 317d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez ssize_t result, bytes = 0, bitr; 318d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct aes_ccm_nonce n = *_n; 319d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct crypto_blkcipher *tfm_cbc; 320d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct crypto_cipher *tfm_aes; 321d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u64 sfn = 0; 322d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez __le64 sfn_le; 323d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 324d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_fnstart(3, NULL, "(out %p, out_size %zu, key %p, _n %p, " 325d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "a %p, b %p, blen %zu, len %zu)\n", out, out_size, 326d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez key, _n, a, b, blen, len); 327d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 328d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez tfm_cbc = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC); 329d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (IS_ERR(tfm_cbc)) { 330d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = PTR_ERR(tfm_cbc); 331d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: can't load CBC(AES): %d\n", (int)result); 332d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez goto error_alloc_cbc; 333d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 334d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = crypto_blkcipher_setkey(tfm_cbc, key, 16); 335d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (result < 0) { 336d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: can't set CBC key: %d\n", (int)result); 337d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez goto error_setkey_cbc; 338d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 339d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 340d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC); 341d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (IS_ERR(tfm_aes)) { 342d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = PTR_ERR(tfm_aes); 343d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: can't load AES: %d\n", (int)result); 344d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez goto error_alloc_aes; 345d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 346d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = crypto_cipher_setkey(tfm_aes, key, 16); 347d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (result < 0) { 348d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: can't set AES key: %d\n", (int)result); 349d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez goto error_setkey_aes; 350d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 351d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 352d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez for (bitr = 0; bitr < (len + 63) / 64; bitr++) { 353d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sfn_le = cpu_to_le64(sfn++); 354d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez memcpy(&n.sfn, &sfn_le, sizeof(n.sfn)); /* n.sfn++... */ 355d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = wusb_ccm_mac(tfm_cbc, tfm_aes, out + bytes, 356d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez &n, a, b, blen); 357d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (result < 0) 358d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez goto error_ccm_mac; 359d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez bytes += result; 360d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 361d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = bytes; 362d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_ccm_mac: 363d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_setkey_aes: 364d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez crypto_free_cipher(tfm_aes); 365d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_alloc_aes: 366d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_setkey_cbc: 367d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez crypto_free_blkcipher(tfm_cbc); 368d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezerror_alloc_cbc: 369d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez d_fnend(3, NULL, "(out %p, out_size %zu, key %p, _n %p, " 370d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "a %p, b %p, blen %zu, len %zu) = %d\n", out, out_size, 371d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez key, _n, a, b, blen, len, (int)bytes); 372d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez return result; 373d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} 374d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 375d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* WUSB1.0[A.2] test vectors */ 376d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const u8 stv_hsmic_key[16] = { 377d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x4b, 0x79, 0xa3, 0xcf, 0xe5, 0x53, 0x23, 0x9d, 378d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0xd7, 0xc1, 0x6d, 0x1c, 0x2d, 0xab, 0x6d, 0x3f 379d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}; 380d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 381d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const struct aes_ccm_nonce stv_hsmic_n = { 382d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .sfn = { 0 }, 383d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .tkid = { 0x76, 0x98, 0x01, }, 384d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .dest_addr = { .data = { 0xbe, 0x00 } }, 385d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .src_addr = { .data = { 0x76, 0x98 } }, 386d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}; 387d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 388d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 389d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Out-of-band MIC Generation verification code 390d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 391d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 392d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic int wusb_oob_mic_verify(void) 393d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{ 394d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez int result; 395d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez u8 mic[8]; 396d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* WUSB1.0[A.2] test vectors 397d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 398d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Need to keep it in the local stack as GCC 4.1.3something 399d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * messes up and generates noise. 400d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 401d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct usb_handshake stv_hsmic_hs = { 402d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .bMessageNumber = 2, 403d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .bStatus = 00, 404d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .tTKID = { 0x76, 0x98, 0x01 }, 405d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .bReserved = 00, 406d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .CDID = { 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 407d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 408d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x3c, 0x3d, 0x3e, 0x3f }, 409d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .nonce = { 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 410d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 411d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x2c, 0x2d, 0x2e, 0x2f }, 412d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .MIC = { 0x75, 0x6a, 0x97, 0x51, 0x0c, 0x8c, 413d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x14, 0x7b } , 414d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez }; 415d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez size_t hs_size; 416d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 417d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = wusb_oob_mic(mic, stv_hsmic_key, &stv_hsmic_n, &stv_hsmic_hs); 418d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (result < 0) 419d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: WUSB OOB MIC test: failed: %d\n", result); 420d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez else if (memcmp(stv_hsmic_hs.MIC, mic, sizeof(mic))) { 421d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: OOB MIC test: " 422d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "mismatch between MIC result and WUSB1.0[A2]\n"); 423d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez hs_size = sizeof(stv_hsmic_hs) - sizeof(stv_hsmic_hs.MIC); 424d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: Handshake2 in: (%zu bytes)\n", hs_size); 425d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, &stv_hsmic_hs, hs_size); 426d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: CCM Nonce in: (%zu bytes)\n", 427d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sizeof(stv_hsmic_n)); 428d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, &stv_hsmic_n, sizeof(stv_hsmic_n)); 429d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: MIC out:\n"); 430d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, mic, sizeof(mic)); 431d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: MIC out (from WUSB1.0[A.2]):\n"); 432d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, stv_hsmic_hs.MIC, sizeof(stv_hsmic_hs.MIC)); 433d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = -EINVAL; 434d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } else 435d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = 0; 436d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez return result; 437d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} 438d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 439d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 440d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Test vectors for Key derivation 441d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 442d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * These come from WUSB1.0[6.5.1], the vectors in WUSB1.0[A.1] 443d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * (errata corrected in 2005/07). 444d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 445d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const u8 stv_key_a1[16] __attribute__ ((__aligned__(4))) = { 446d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87, 447d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x78, 0x69, 0x5a, 0x4b, 0x3c, 0x2d, 0x1e, 0x0f 448d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}; 449d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 450d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const struct aes_ccm_nonce stv_keydvt_n_a1 = { 451d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .sfn = { 0 }, 452d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .tkid = { 0x76, 0x98, 0x01, }, 453d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .dest_addr = { .data = { 0xbe, 0x00 } }, 454d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .src_addr = { .data = { 0x76, 0x98 } }, 455d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}; 456d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 457d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic const struct wusb_keydvt_out stv_keydvt_out_a1 = { 458d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .kck = { 459d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x4b, 0x79, 0xa3, 0xcf, 0xe5, 0x53, 0x23, 0x9d, 460d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0xd7, 0xc1, 0x6d, 0x1c, 0x2d, 0xab, 0x6d, 0x3f 461d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez }, 462d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .ptk = { 463d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0xc8, 0x70, 0x62, 0x82, 0xb6, 0x7c, 0xe9, 0x06, 464d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x7b, 0xc5, 0x25, 0x69, 0xf2, 0x36, 0x61, 0x2d 465d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 466d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez}; 467d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 468d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 469d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Performa a test to make sure we match the vectors defined in 470d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * WUSB1.0[A.1](Errata2006/12) 471d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 472d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezstatic int wusb_key_derive_verify(void) 473d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{ 474d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez int result = 0; 475d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct wusb_keydvt_out keydvt_out; 476d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* These come from WUSB1.0[A.1] + 2006/12 errata 477d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * NOTE: can't make this const or global -- somehow it seems 478d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * the scatterlists for crypto get confused and we get 479d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * bad data. There is no doc on this... */ 480d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez struct wusb_keydvt_in stv_keydvt_in_a1 = { 481d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .hnonce = { 482d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 483d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 484d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez }, 485d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez .dnonce = { 486d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 487d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f 488d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } 489d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez }; 490d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 491d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = wusb_key_derive(&keydvt_out, stv_key_a1, &stv_keydvt_n_a1, 492d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez &stv_keydvt_in_a1); 493d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (result < 0) 494d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: WUSB key derivation test: " 495d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "derivation failed: %d\n", result); 496d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (memcmp(&stv_keydvt_out_a1, &keydvt_out, sizeof(keydvt_out))) { 497d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: WUSB key derivation test: " 498d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "mismatch between key derivation result " 499d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez "and WUSB1.0[A1] Errata 2006/12\n"); 500d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: keydvt in: key (%zu bytes)\n", 501d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sizeof(stv_key_a1)); 502d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, stv_key_a1, sizeof(stv_key_a1)); 503d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: keydvt in: nonce (%zu bytes)\n", 504d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sizeof(stv_keydvt_n_a1)); 505d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, &stv_keydvt_n_a1, sizeof(stv_keydvt_n_a1)); 506d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: keydvt in: hnonce & dnonce (%zu bytes)\n", 507d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez sizeof(stv_keydvt_in_a1)); 508d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, &stv_keydvt_in_a1, sizeof(stv_keydvt_in_a1)); 509d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: keydvt out: KCK\n"); 510d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, &keydvt_out.kck, sizeof(keydvt_out.kck)); 511d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez printk(KERN_ERR "E: keydvt out: PTK\n"); 512d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez dump_bytes(NULL, &keydvt_out.ptk, sizeof(keydvt_out.ptk)); 513d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = -EINVAL; 514d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez } else 515d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = 0; 516d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez return result; 517d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} 518d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 519d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez/* 520d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * Initialize crypto system 521d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * 522d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * FIXME: we do nothing now, other than verifying. Later on we'll 523d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez * cache the encryption stuff, so that's why we have a separate init. 524d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez */ 525d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezint wusb_crypto_init(void) 526d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{ 527d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez int result; 528d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 529d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez result = wusb_key_derive_verify(); 530d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez if (result < 0) 531d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez return result; 532d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez return wusb_oob_mic_verify(); 533d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} 534d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez 535d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalezvoid wusb_crypto_exit(void) 536d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez{ 537d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez /* FIXME: free cached crypto transforms */ 538d59db761b8559f07a7161ca3387d6c6949667edeInaky Perez-Gonzalez} 539