crypto.c revision bce83697c5fe84a7a5d38c96fbbe43b4bc028c3e
1/* 2 * Ultra Wide Band 3 * AES-128 CCM Encryption 4 * 5 * Copyright (C) 2007 Intel Corporation 6 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License version 10 * 2 as published by the Free Software Foundation. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 20 * 02110-1301, USA. 21 * 22 * 23 * We don't do any encryption here; we use the Linux Kernel's AES-128 24 * crypto modules to construct keys and payload blocks in a way 25 * defined by WUSB1.0[6]. Check the erratas, as typos are are patched 26 * there. 27 * 28 * Thanks a zillion to John Keys for his help and clarifications over 29 * the designed-by-a-committee text. 30 * 31 * So the idea is that there is this basic Pseudo-Random-Function 32 * defined in WUSB1.0[6.5] which is the core of everything. It works 33 * by tweaking some blocks, AES crypting them and then xoring 34 * something else with them (this seems to be called CBC(AES) -- can 35 * you tell I know jack about crypto?). So we just funnel it into the 36 * Linux Crypto API. 37 * 38 * We leave a crypto test module so we can verify that vectors match, 39 * every now and then. 40 * 41 * Block size: 16 bytes -- AES seems to do things in 'block sizes'. I 42 * am learning a lot... 43 * 44 * Conveniently, some data structures that need to be 45 * funneled through AES are...16 bytes in size! 46 */ 47 48#include <linux/crypto.h> 49#include <linux/module.h> 50#include <linux/err.h> 51#include <linux/uwb.h> 52#include <linux/usb/wusb.h> 53#include <linux/scatterlist.h> 54#include <linux/uwb/debug.h> 55 56static int debug_crypto_verify = 0; 57 58module_param(debug_crypto_verify, int, 0); 59MODULE_PARM_DESC(debug_crypto_verify, "verify the key generation algorithms"); 60 61/* 62 * Block of data, as understood by AES-CCM 63 * 64 * The code assumes this structure is nothing but a 16 byte array 65 * (packed in a struct to avoid common mess ups that I usually do with 66 * arrays and enforcing type checking). 67 */ 68struct aes_ccm_block { 69 u8 data[16]; 70} __attribute__((packed)); 71 72/* 73 * Counter-mode Blocks (WUSB1.0[6.4]) 74 * 75 * According to CCM (or so it seems), for the purpose of calculating 76 * the MIC, the message is broken in N counter-mode blocks, B0, B1, 77 * ... BN. 78 * 79 * B0 contains flags, the CCM nonce and l(m). 80 * 81 * B1 contains l(a), the MAC header, the encryption offset and padding. 82 * 83 * If EO is nonzero, additional blocks are built from payload bytes 84 * until EO is exahusted (FIXME: padding to 16 bytes, I guess). The 85 * padding is not xmitted. 86 */ 87 88/* WUSB1.0[T6.4] */ 89struct aes_ccm_b0 { 90 u8 flags; /* 0x59, per CCM spec */ 91 struct aes_ccm_nonce ccm_nonce; 92 __be16 lm; 93} __attribute__((packed)); 94 95/* WUSB1.0[T6.5] */ 96struct aes_ccm_b1 { 97 __be16 la; 98 u8 mac_header[10]; 99 __le16 eo; 100 u8 security_reserved; /* This is always zero */ 101 u8 padding; /* 0 */ 102} __attribute__((packed)); 103 104/* 105 * Encryption Blocks (WUSB1.0[6.4.4]) 106 * 107 * CCM uses Ax blocks to generate a keystream with which the MIC and 108 * the message's payload are encoded. A0 always encrypts/decrypts the 109 * MIC. Ax (x>0) are used for the sucesive payload blocks. 110 * 111 * The x is the counter, and is increased for each block. 112 */ 113struct aes_ccm_a { 114 u8 flags; /* 0x01, per CCM spec */ 115 struct aes_ccm_nonce ccm_nonce; 116 __be16 counter; /* Value of x */ 117} __attribute__((packed)); 118 119static void bytewise_xor(void *_bo, const void *_bi1, const void *_bi2, 120 size_t size) 121{ 122 u8 *bo = _bo; 123 const u8 *bi1 = _bi1, *bi2 = _bi2; 124 size_t itr; 125 for (itr = 0; itr < size; itr++) 126 bo[itr] = bi1[itr] ^ bi2[itr]; 127} 128 129/* 130 * CC-MAC function WUSB1.0[6.5] 131 * 132 * Take a data string and produce the encrypted CBC Counter-mode MIC 133 * 134 * Note the names for most function arguments are made to (more or 135 * less) match those used in the pseudo-function definition given in 136 * WUSB1.0[6.5]. 137 * 138 * @tfm_cbc: CBC(AES) blkcipher handle (initialized) 139 * 140 * @tfm_aes: AES cipher handle (initialized) 141 * 142 * @mic: buffer for placing the computed MIC (Message Integrity 143 * Code). This is exactly 8 bytes, and we expect the buffer to 144 * be at least eight bytes in length. 145 * 146 * @key: 128 bit symmetric key 147 * 148 * @n: CCM nonce 149 * 150 * @a: ASCII string, 14 bytes long (I guess zero padded if needed; 151 * we use exactly 14 bytes). 152 * 153 * @b: data stream to be processed; cannot be a global or const local 154 * (will confuse the scatterlists) 155 * 156 * @blen: size of b... 157 * 158 * Still not very clear how this is done, but looks like this: we 159 * create block B0 (as WUSB1.0[6.5] says), then we AES-crypt it with 160 * @key. We bytewise xor B0 with B1 (1) and AES-crypt that. Then we 161 * take the payload and divide it in blocks (16 bytes), xor them with 162 * the previous crypto result (16 bytes) and crypt it, repeat the next 163 * block with the output of the previous one, rinse wash (I guess this 164 * is what AES CBC mode means...but I truly have no idea). So we use 165 * the CBC(AES) blkcipher, that does precisely that. The IV (Initial 166 * Vector) is 16 bytes and is set to zero, so 167 * 168 * See rfc3610. Linux crypto has a CBC implementation, but the 169 * documentation is scarce, to say the least, and the example code is 170 * so intricated that is difficult to understand how things work. Most 171 * of this is guess work -- bite me. 172 * 173 * (1) Created as 6.5 says, again, using as l(a) 'Blen + 14', and 174 * using the 14 bytes of @a to fill up 175 * b1.{mac_header,e0,security_reserved,padding}. 176 * 177 * NOTE: The definiton of l(a) in WUSB1.0[6.5] vs the definition of 178 * l(m) is orthogonal, they bear no relationship, so it is not 179 * in conflict with the parameter's relation that 180 * WUSB1.0[6.4.2]) defines. 181 * 182 * NOTE: WUSB1.0[A.1]: Host Nonce is missing a nibble? (1e); fixed in 183 * first errata released on 2005/07. 184 * 185 * NOTE: we need to clean IV to zero at each invocation to make sure 186 * we start with a fresh empty Initial Vector, so that the CBC 187 * works ok. 188 * 189 * NOTE: blen is not aligned to a block size, we'll pad zeros, that's 190 * what sg[4] is for. Maybe there is a smarter way to do this. 191 */ 192static int wusb_ccm_mac(struct crypto_blkcipher *tfm_cbc, 193 struct crypto_cipher *tfm_aes, void *mic, 194 const struct aes_ccm_nonce *n, 195 const struct aes_ccm_label *a, const void *b, 196 size_t blen) 197{ 198 int result = 0; 199 struct blkcipher_desc desc; 200 struct aes_ccm_b0 b0; 201 struct aes_ccm_b1 b1; 202 struct aes_ccm_a ax; 203 struct scatterlist sg[4], sg_dst; 204 void *iv, *dst_buf; 205 size_t ivsize, dst_size; 206 const u8 bzero[16] = { 0 }; 207 size_t zero_padding; 208 209 /* 210 * These checks should be compile time optimized out 211 * ensure @a fills b1's mac_header and following fields 212 */ 213 WARN_ON(sizeof(*a) != sizeof(b1) - sizeof(b1.la)); 214 WARN_ON(sizeof(b0) != sizeof(struct aes_ccm_block)); 215 WARN_ON(sizeof(b1) != sizeof(struct aes_ccm_block)); 216 WARN_ON(sizeof(ax) != sizeof(struct aes_ccm_block)); 217 218 result = -ENOMEM; 219 zero_padding = sizeof(struct aes_ccm_block) 220 - blen % sizeof(struct aes_ccm_block); 221 zero_padding = blen % sizeof(struct aes_ccm_block); 222 if (zero_padding) 223 zero_padding = sizeof(struct aes_ccm_block) - zero_padding; 224 dst_size = blen + sizeof(b0) + sizeof(b1) + zero_padding; 225 dst_buf = kzalloc(dst_size, GFP_KERNEL); 226 if (dst_buf == NULL) { 227 printk(KERN_ERR "E: can't alloc destination buffer\n"); 228 goto error_dst_buf; 229 } 230 231 iv = crypto_blkcipher_crt(tfm_cbc)->iv; 232 ivsize = crypto_blkcipher_ivsize(tfm_cbc); 233 memset(iv, 0, ivsize); 234 235 /* Setup B0 */ 236 b0.flags = 0x59; /* Format B0 */ 237 b0.ccm_nonce = *n; 238 b0.lm = cpu_to_be16(0); /* WUSB1.0[6.5] sez l(m) is 0 */ 239 240 /* Setup B1 241 * 242 * The WUSB spec is anything but clear! WUSB1.0[6.5] 243 * says that to initialize B1 from A with 'l(a) = blen + 244 * 14'--after clarification, it means to use A's contents 245 * for MAC Header, EO, sec reserved and padding. 246 */ 247 b1.la = cpu_to_be16(blen + 14); 248 memcpy(&b1.mac_header, a, sizeof(*a)); 249 250 sg_init_table(sg, ARRAY_SIZE(sg)); 251 sg_set_buf(&sg[0], &b0, sizeof(b0)); 252 sg_set_buf(&sg[1], &b1, sizeof(b1)); 253 sg_set_buf(&sg[2], b, blen); 254 /* 0 if well behaved :) */ 255 sg_set_buf(&sg[3], bzero, zero_padding); 256 sg_init_one(&sg_dst, dst_buf, dst_size); 257 258 desc.tfm = tfm_cbc; 259 desc.flags = 0; 260 result = crypto_blkcipher_encrypt(&desc, &sg_dst, sg, dst_size); 261 if (result < 0) { 262 printk(KERN_ERR "E: can't compute CBC-MAC tag (MIC): %d\n", 263 result); 264 goto error_cbc_crypt; 265 } 266 267 /* Now we crypt the MIC Tag (*iv) with Ax -- values per WUSB1.0[6.5] 268 * The procedure is to AES crypt the A0 block and XOR the MIC 269 * Tag agains it; we only do the first 8 bytes and place it 270 * directly in the destination buffer. 271 * 272 * POS Crypto API: size is assumed to be AES's block size. 273 * Thanks for documenting it -- tip taken from airo.c 274 */ 275 ax.flags = 0x01; /* as per WUSB 1.0 spec */ 276 ax.ccm_nonce = *n; 277 ax.counter = 0; 278 crypto_cipher_encrypt_one(tfm_aes, (void *)&ax, (void *)&ax); 279 bytewise_xor(mic, &ax, iv, 8); 280 result = 8; 281error_cbc_crypt: 282 kfree(dst_buf); 283error_dst_buf: 284 return result; 285} 286 287/* 288 * WUSB Pseudo Random Function (WUSB1.0[6.5]) 289 * 290 * @b: buffer to the source data; cannot be a global or const local 291 * (will confuse the scatterlists) 292 */ 293ssize_t wusb_prf(void *out, size_t out_size, 294 const u8 key[16], const struct aes_ccm_nonce *_n, 295 const struct aes_ccm_label *a, 296 const void *b, size_t blen, size_t len) 297{ 298 ssize_t result, bytes = 0, bitr; 299 struct aes_ccm_nonce n = *_n; 300 struct crypto_blkcipher *tfm_cbc; 301 struct crypto_cipher *tfm_aes; 302 u64 sfn = 0; 303 __le64 sfn_le; 304 305 tfm_cbc = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC); 306 if (IS_ERR(tfm_cbc)) { 307 result = PTR_ERR(tfm_cbc); 308 printk(KERN_ERR "E: can't load CBC(AES): %d\n", (int)result); 309 goto error_alloc_cbc; 310 } 311 result = crypto_blkcipher_setkey(tfm_cbc, key, 16); 312 if (result < 0) { 313 printk(KERN_ERR "E: can't set CBC key: %d\n", (int)result); 314 goto error_setkey_cbc; 315 } 316 317 tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC); 318 if (IS_ERR(tfm_aes)) { 319 result = PTR_ERR(tfm_aes); 320 printk(KERN_ERR "E: can't load AES: %d\n", (int)result); 321 goto error_alloc_aes; 322 } 323 result = crypto_cipher_setkey(tfm_aes, key, 16); 324 if (result < 0) { 325 printk(KERN_ERR "E: can't set AES key: %d\n", (int)result); 326 goto error_setkey_aes; 327 } 328 329 for (bitr = 0; bitr < (len + 63) / 64; bitr++) { 330 sfn_le = cpu_to_le64(sfn++); 331 memcpy(&n.sfn, &sfn_le, sizeof(n.sfn)); /* n.sfn++... */ 332 result = wusb_ccm_mac(tfm_cbc, tfm_aes, out + bytes, 333 &n, a, b, blen); 334 if (result < 0) 335 goto error_ccm_mac; 336 bytes += result; 337 } 338 result = bytes; 339error_ccm_mac: 340error_setkey_aes: 341 crypto_free_cipher(tfm_aes); 342error_alloc_aes: 343error_setkey_cbc: 344 crypto_free_blkcipher(tfm_cbc); 345error_alloc_cbc: 346 return result; 347} 348 349/* WUSB1.0[A.2] test vectors */ 350static const u8 stv_hsmic_key[16] = { 351 0x4b, 0x79, 0xa3, 0xcf, 0xe5, 0x53, 0x23, 0x9d, 352 0xd7, 0xc1, 0x6d, 0x1c, 0x2d, 0xab, 0x6d, 0x3f 353}; 354 355static const struct aes_ccm_nonce stv_hsmic_n = { 356 .sfn = { 0 }, 357 .tkid = { 0x76, 0x98, 0x01, }, 358 .dest_addr = { .data = { 0xbe, 0x00 } }, 359 .src_addr = { .data = { 0x76, 0x98 } }, 360}; 361 362/* 363 * Out-of-band MIC Generation verification code 364 * 365 */ 366static int wusb_oob_mic_verify(void) 367{ 368 int result; 369 u8 mic[8]; 370 /* WUSB1.0[A.2] test vectors 371 * 372 * Need to keep it in the local stack as GCC 4.1.3something 373 * messes up and generates noise. 374 */ 375 struct usb_handshake stv_hsmic_hs = { 376 .bMessageNumber = 2, 377 .bStatus = 00, 378 .tTKID = { 0x76, 0x98, 0x01 }, 379 .bReserved = 00, 380 .CDID = { 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 381 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 382 0x3c, 0x3d, 0x3e, 0x3f }, 383 .nonce = { 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 384 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 385 0x2c, 0x2d, 0x2e, 0x2f }, 386 .MIC = { 0x75, 0x6a, 0x97, 0x51, 0x0c, 0x8c, 387 0x14, 0x7b } , 388 }; 389 size_t hs_size; 390 391 result = wusb_oob_mic(mic, stv_hsmic_key, &stv_hsmic_n, &stv_hsmic_hs); 392 if (result < 0) 393 printk(KERN_ERR "E: WUSB OOB MIC test: failed: %d\n", result); 394 else if (memcmp(stv_hsmic_hs.MIC, mic, sizeof(mic))) { 395 printk(KERN_ERR "E: OOB MIC test: " 396 "mismatch between MIC result and WUSB1.0[A2]\n"); 397 hs_size = sizeof(stv_hsmic_hs) - sizeof(stv_hsmic_hs.MIC); 398 printk(KERN_ERR "E: Handshake2 in: (%zu bytes)\n", hs_size); 399 dump_bytes(NULL, &stv_hsmic_hs, hs_size); 400 printk(KERN_ERR "E: CCM Nonce in: (%zu bytes)\n", 401 sizeof(stv_hsmic_n)); 402 dump_bytes(NULL, &stv_hsmic_n, sizeof(stv_hsmic_n)); 403 printk(KERN_ERR "E: MIC out:\n"); 404 dump_bytes(NULL, mic, sizeof(mic)); 405 printk(KERN_ERR "E: MIC out (from WUSB1.0[A.2]):\n"); 406 dump_bytes(NULL, stv_hsmic_hs.MIC, sizeof(stv_hsmic_hs.MIC)); 407 result = -EINVAL; 408 } else 409 result = 0; 410 return result; 411} 412 413/* 414 * Test vectors for Key derivation 415 * 416 * These come from WUSB1.0[6.5.1], the vectors in WUSB1.0[A.1] 417 * (errata corrected in 2005/07). 418 */ 419static const u8 stv_key_a1[16] __attribute__ ((__aligned__(4))) = { 420 0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87, 421 0x78, 0x69, 0x5a, 0x4b, 0x3c, 0x2d, 0x1e, 0x0f 422}; 423 424static const struct aes_ccm_nonce stv_keydvt_n_a1 = { 425 .sfn = { 0 }, 426 .tkid = { 0x76, 0x98, 0x01, }, 427 .dest_addr = { .data = { 0xbe, 0x00 } }, 428 .src_addr = { .data = { 0x76, 0x98 } }, 429}; 430 431static const struct wusb_keydvt_out stv_keydvt_out_a1 = { 432 .kck = { 433 0x4b, 0x79, 0xa3, 0xcf, 0xe5, 0x53, 0x23, 0x9d, 434 0xd7, 0xc1, 0x6d, 0x1c, 0x2d, 0xab, 0x6d, 0x3f 435 }, 436 .ptk = { 437 0xc8, 0x70, 0x62, 0x82, 0xb6, 0x7c, 0xe9, 0x06, 438 0x7b, 0xc5, 0x25, 0x69, 0xf2, 0x36, 0x61, 0x2d 439 } 440}; 441 442/* 443 * Performa a test to make sure we match the vectors defined in 444 * WUSB1.0[A.1](Errata2006/12) 445 */ 446static int wusb_key_derive_verify(void) 447{ 448 int result = 0; 449 struct wusb_keydvt_out keydvt_out; 450 /* These come from WUSB1.0[A.1] + 2006/12 errata 451 * NOTE: can't make this const or global -- somehow it seems 452 * the scatterlists for crypto get confused and we get 453 * bad data. There is no doc on this... */ 454 struct wusb_keydvt_in stv_keydvt_in_a1 = { 455 .hnonce = { 456 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 457 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f 458 }, 459 .dnonce = { 460 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 461 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f 462 } 463 }; 464 465 result = wusb_key_derive(&keydvt_out, stv_key_a1, &stv_keydvt_n_a1, 466 &stv_keydvt_in_a1); 467 if (result < 0) 468 printk(KERN_ERR "E: WUSB key derivation test: " 469 "derivation failed: %d\n", result); 470 if (memcmp(&stv_keydvt_out_a1, &keydvt_out, sizeof(keydvt_out))) { 471 printk(KERN_ERR "E: WUSB key derivation test: " 472 "mismatch between key derivation result " 473 "and WUSB1.0[A1] Errata 2006/12\n"); 474 printk(KERN_ERR "E: keydvt in: key (%zu bytes)\n", 475 sizeof(stv_key_a1)); 476 dump_bytes(NULL, stv_key_a1, sizeof(stv_key_a1)); 477 printk(KERN_ERR "E: keydvt in: nonce (%zu bytes)\n", 478 sizeof(stv_keydvt_n_a1)); 479 dump_bytes(NULL, &stv_keydvt_n_a1, sizeof(stv_keydvt_n_a1)); 480 printk(KERN_ERR "E: keydvt in: hnonce & dnonce (%zu bytes)\n", 481 sizeof(stv_keydvt_in_a1)); 482 dump_bytes(NULL, &stv_keydvt_in_a1, sizeof(stv_keydvt_in_a1)); 483 printk(KERN_ERR "E: keydvt out: KCK\n"); 484 dump_bytes(NULL, &keydvt_out.kck, sizeof(keydvt_out.kck)); 485 printk(KERN_ERR "E: keydvt out: PTK\n"); 486 dump_bytes(NULL, &keydvt_out.ptk, sizeof(keydvt_out.ptk)); 487 result = -EINVAL; 488 } else 489 result = 0; 490 return result; 491} 492 493/* 494 * Initialize crypto system 495 * 496 * FIXME: we do nothing now, other than verifying. Later on we'll 497 * cache the encryption stuff, so that's why we have a separate init. 498 */ 499int wusb_crypto_init(void) 500{ 501 int result; 502 503 if (debug_crypto_verify) { 504 result = wusb_key_derive_verify(); 505 if (result < 0) 506 return result; 507 return wusb_oob_mic_verify(); 508 } 509 return 0; 510} 511 512void wusb_crypto_exit(void) 513{ 514 /* FIXME: free cached crypto transforms */ 515} 516