aes.h

00001 /**
00002  * \file aes.h
00003  *
00004  * \brief   This file contains AES definitions and functions.
00005  *
00006  *          The Advanced Encryption Standard (AES) specifies a FIPS-approved
00007  *          cryptographic algorithm that can be used to protect electronic
00008  *          data.
00009  *
00010  *          The AES algorithm is a symmetric block cipher that can
00011  *          encrypt and decrypt information. For more information, see
00012  *          <em>FIPS Publication 197: Advanced Encryption Standard</em> and
00013  *          <em>ISO/IEC 18033-2:2006: Information technology -- Security
00014  *          techniques -- Encryption algorithms -- Part 2: Asymmetric
00015  *          ciphers</em>.
00016  */
00017 
00018 /*  Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved.
00019  *  SPDX-License-Identifier: Apache-2.0
00020  *
00021  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
00022  *  not use this file except in compliance with the License.
00023  *  You may obtain a copy of the License at
00024  *
00025  *  http://www.apache.org/licenses/LICENSE-2.0
00026  *
00027  *  Unless required by applicable law or agreed to in writing, software
00028  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
00029  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
00030  *  See the License for the specific language governing permissions and
00031  *  limitations under the License.
00032  *
00033  *  This file is part of Mbed TLS (https://tls.mbed.org)
00034  */
00035 
00036 #ifndef MBEDTLS_AES_H
00037 #define MBEDTLS_AES_H
00038 
00039 #if !defined(MBEDTLS_CONFIG_FILE)
00040 #include "config.h"
00041 #else
00042 #include MBEDTLS_CONFIG_FILE
00043 #endif
00044 
00045 #include <stddef.h>
00046 #include <stdint.h>
00047 
00048 /* padlock.c and aesni.c rely on these values! */
00049 #define MBEDTLS_AES_ENCRYPT     1 /**< AES encryption. */
00050 #define MBEDTLS_AES_DECRYPT     0 /**< AES decryption. */
00051 
00052 /* Error codes in range 0x0020-0x0022 */
00053 #define MBEDTLS_ERR_AES_INVALID_KEY_LENGTH                -0x0020  /**< Invalid key length. */
00054 #define MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH              -0x0022  /**< Invalid data input length. */
00055 
00056 /* Error codes in range 0x0021-0x0025 */
00057 #define MBEDTLS_ERR_AES_BAD_INPUT_DATA                    -0x0021  /**< Invalid input data. */
00058 #define MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE               -0x0023  /**< Feature not available. For example, an unsupported AES key size. */
00059 #define MBEDTLS_ERR_AES_HW_ACCEL_FAILED                   -0x0025  /**< AES hardware accelerator failed. */
00060 
00061 #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
00062     !defined(inline) && !defined(__cplusplus)
00063 #define inline __inline
00064 #endif
00065 
00066 #ifdef __cplusplus
00067 extern "C" {
00068 #endif
00069 
00070 #if !defined(MBEDTLS_AES_ALT)
00071 // Regular implementation
00072 //
00073 
00074 /**
00075  * \brief The AES context-type definition.
00076  */
00077 typedef struct
00078 {
00079     int nr ;                     /*!< The number of rounds. */
00080     uint32_t *rk ;               /*!< AES round keys. */
00081     uint32_t buf[68];           /*!< Unaligned data buffer. This buffer can
00082                                      hold 32 extra Bytes, which can be used for
00083                                      one of the following purposes:
00084                                      <ul><li>Alignment if VIA padlock is
00085                                              used.</li>
00086                                      <li>Simplifying key expansion in the 256-bit
00087                                          case by generating an extra round key.
00088                                          </li></ul> */
00089 }
00090 mbedtls_aes_context;
00091 
00092 #else  /* MBEDTLS_AES_ALT */
00093 #include "aes_alt.h"
00094 #endif /* MBEDTLS_AES_ALT */
00095 
00096 /**
00097  * \brief          This function initializes the specified AES context.
00098  *
00099  *                 It must be the first API called before using
00100  *                 the context.
00101  *
00102  * \param ctx      The AES context to initialize.
00103  */
00104 void mbedtls_aes_init( mbedtls_aes_context *ctx );
00105 
00106 /**
00107  * \brief          This function releases and clears the specified AES context.
00108  *
00109  * \param ctx      The AES context to clear.
00110  */
00111 void mbedtls_aes_free( mbedtls_aes_context *ctx );
00112 
00113 /**
00114  * \brief          This function sets the encryption key.
00115  *
00116  * \param ctx      The AES context to which the key should be bound.
00117  * \param key      The encryption key.
00118  * \param keybits  The size of data passed in bits. Valid options are:
00119  *                 <ul><li>128 bits</li>
00120  *                 <li>192 bits</li>
00121  *                 <li>256 bits</li></ul>
00122  *
00123  * \return         \c 0 on success.
00124  * \return         #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
00125  */
00126 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
00127                     unsigned int keybits );
00128 
00129 /**
00130  * \brief          This function sets the decryption key.
00131  *
00132  * \param ctx      The AES context to which the key should be bound.
00133  * \param key      The decryption key.
00134  * \param keybits  The size of data passed. Valid options are:
00135  *                 <ul><li>128 bits</li>
00136  *                 <li>192 bits</li>
00137  *                 <li>256 bits</li></ul>
00138  *
00139  * \return         \c 0 on success.
00140  * \return         #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure.
00141  */
00142 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
00143                     unsigned int keybits );
00144 
00145 /**
00146  * \brief          This function performs an AES single-block encryption or
00147  *                 decryption operation.
00148  *
00149  *                 It performs the operation defined in the \p mode parameter
00150  *                 (encrypt or decrypt), on the input data buffer defined in
00151  *                 the \p input parameter.
00152  *
00153  *                 mbedtls_aes_init(), and either mbedtls_aes_setkey_enc() or
00154  *                 mbedtls_aes_setkey_dec() must be called before the first
00155  *                 call to this API with the same context.
00156  *
00157  * \param ctx      The AES context to use for encryption or decryption.
00158  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
00159  *                 #MBEDTLS_AES_DECRYPT.
00160  * \param input    The 16-Byte buffer holding the input data.
00161  * \param output   The 16-Byte buffer holding the output data.
00162 
00163  * \return         \c 0 on success.
00164  */
00165 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
00166                     int mode,
00167                     const unsigned char input[16],
00168                     unsigned char output[16] );
00169 
00170 #if defined(MBEDTLS_CIPHER_MODE_CBC)
00171 /**
00172  * \brief  This function performs an AES-CBC encryption or decryption operation
00173  *         on full blocks.
00174  *
00175  *         It performs the operation defined in the \p mode
00176  *         parameter (encrypt/decrypt), on the input data buffer defined in
00177  *         the \p input parameter.
00178  *
00179  *         It can be called as many times as needed, until all the input
00180  *         data is processed. mbedtls_aes_init(), and either
00181  *         mbedtls_aes_setkey_enc() or mbedtls_aes_setkey_dec() must be called
00182  *         before the first call to this API with the same context.
00183  *
00184  * \note   This function operates on aligned blocks, that is, the input size
00185  *         must be a multiple of the AES block size of 16 Bytes.
00186  *
00187  * \note   Upon exit, the content of the IV is updated so that you can
00188  *         call the same function again on the next
00189  *         block(s) of data and get the same result as if it was
00190  *         encrypted in one call. This allows a "streaming" usage.
00191  *         If you need to retain the contents of the IV, you should
00192  *         either save it manually or use the cipher module instead.
00193  *
00194  *
00195  * \param ctx      The AES context to use for encryption or decryption.
00196  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
00197  *                 #MBEDTLS_AES_DECRYPT.
00198  * \param length   The length of the input data in Bytes. This must be a
00199  *                 multiple of the block size (16 Bytes).
00200  * \param iv       Initialization vector (updated after use).
00201  * \param input    The buffer holding the input data.
00202  * \param output   The buffer holding the output data.
00203  *
00204  * \return         \c 0 on success.
00205  * \return         #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH
00206  *                 on failure.
00207  */
00208 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
00209                     int mode,
00210                     size_t length,
00211                     unsigned char iv[16],
00212                     const unsigned char *input,
00213                     unsigned char *output );
00214 #endif /* MBEDTLS_CIPHER_MODE_CBC */
00215 
00216 #if defined(MBEDTLS_CIPHER_MODE_CFB)
00217 /**
00218  * \brief This function performs an AES-CFB128 encryption or decryption
00219  *        operation.
00220  *
00221  *        It performs the operation defined in the \p mode
00222  *        parameter (encrypt or decrypt), on the input data buffer
00223  *        defined in the \p input parameter.
00224  *
00225  *        For CFB, you must set up the context with mbedtls_aes_setkey_enc(),
00226  *        regardless of whether you are performing an encryption or decryption
00227  *        operation, that is, regardless of the \p mode parameter. This is
00228  *        because CFB mode uses the same key schedule for encryption and
00229  *        decryption.
00230  *
00231  * \note  Upon exit, the content of the IV is updated so that you can
00232  *        call the same function again on the next
00233  *        block(s) of data and get the same result as if it was
00234  *        encrypted in one call. This allows a "streaming" usage.
00235  *        If you need to retain the contents of the
00236  *        IV, you must either save it manually or use the cipher
00237  *        module instead.
00238  *
00239  *
00240  * \param ctx      The AES context to use for encryption or decryption.
00241  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
00242  *                 #MBEDTLS_AES_DECRYPT.
00243  * \param length   The length of the input data.
00244  * \param iv_off   The offset in IV (updated after use).
00245  * \param iv       The initialization vector (updated after use).
00246  * \param input    The buffer holding the input data.
00247  * \param output   The buffer holding the output data.
00248  *
00249  * \return         \c 0 on success.
00250  */
00251 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
00252                        int mode,
00253                        size_t length,
00254                        size_t *iv_off,
00255                        unsigned char iv[16],
00256                        const unsigned char *input,
00257                        unsigned char *output );
00258 
00259 /**
00260  * \brief This function performs an AES-CFB8 encryption or decryption
00261  *        operation.
00262  *
00263  *        It performs the operation defined in the \p mode
00264  *        parameter (encrypt/decrypt), on the input data buffer defined
00265  *        in the \p input parameter.
00266  *
00267  *        Due to the nature of CFB, you must use the same key schedule for
00268  *        both encryption and decryption operations. Therefore, you must
00269  *        use the context initialized with mbedtls_aes_setkey_enc() for
00270  *        both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT.
00271  *
00272  * \note  Upon exit, the content of the IV is updated so that you can
00273  *        call the same function again on the next
00274  *        block(s) of data and get the same result as if it was
00275  *        encrypted in one call. This allows a "streaming" usage.
00276  *        If you need to retain the contents of the
00277  *        IV, you should either save it manually or use the cipher
00278  *        module instead.
00279  *
00280  *
00281  * \param ctx      The AES context to use for encryption or decryption.
00282  * \param mode     The AES operation: #MBEDTLS_AES_ENCRYPT or
00283  *                 #MBEDTLS_AES_DECRYPT
00284  * \param length   The length of the input data.
00285  * \param iv       The initialization vector (updated after use).
00286  * \param input    The buffer holding the input data.
00287  * \param output   The buffer holding the output data.
00288  *
00289  * \return         \c 0 on success.
00290  */
00291 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
00292                     int mode,
00293                     size_t length,
00294                     unsigned char iv[16],
00295                     const unsigned char *input,
00296                     unsigned char *output );
00297 #endif /*MBEDTLS_CIPHER_MODE_CFB */
00298 
00299 #if defined(MBEDTLS_CIPHER_MODE_CTR)
00300 /**
00301  * \brief      This function performs an AES-CTR encryption or decryption
00302  *             operation.
00303  *
00304  *             This function performs the operation defined in the \p mode
00305  *             parameter (encrypt/decrypt), on the input data buffer
00306  *             defined in the \p input parameter.
00307  *
00308  *             Due to the nature of CTR, you must use the same key schedule
00309  *             for both encryption and decryption operations. Therefore, you
00310  *             must use the context initialized with mbedtls_aes_setkey_enc()
00311  *             for both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT.
00312  *
00313  * \warning    You must never reuse a nonce value with the same key. Doing so
00314  *             would void the encryption for the two messages encrypted with
00315  *             the same nonce and key.
00316  *
00317  *             There are two common strategies for managing nonces with CTR:
00318  *
00319  *             1. You can handle everything as a single message processed over
00320  *             successive calls to this function. In that case, you want to
00321  *             set \p nonce_counter and \p nc_off to 0 for the first call, and
00322  *             then preserve the values of \p nonce_counter, \p nc_off and \p
00323  *             stream_block across calls to this function as they will be
00324  *             updated by this function.
00325  *
00326  *             With this strategy, you must not encrypt more than 2**128
00327  *             blocks of data with the same key.
00328  *
00329  *             2. You can encrypt separate messages by dividing the \p
00330  *             nonce_counter buffer in two areas: the first one used for a
00331  *             per-message nonce, handled by yourself, and the second one
00332  *             updated by this function internally.
00333  *
00334  *             For example, you might reserve the first 12 bytes for the
00335  *             per-message nonce, and the last 4 bytes for internal use. In that
00336  *             case, before calling this function on a new message you need to
00337  *             set the first 12 bytes of \p nonce_counter to your chosen nonce
00338  *             value, the last 4 to 0, and \p nc_off to 0 (which will cause \p
00339  *             stream_block to be ignored). That way, you can encrypt at most
00340  *             2**96 messages of up to 2**32 blocks each with the same key.
00341  *
00342  *             The per-message nonce (or information sufficient to reconstruct
00343  *             it) needs to be communicated with the ciphertext and must be unique.
00344  *             The recommended way to ensure uniqueness is to use a message
00345  *             counter. An alternative is to generate random nonces, but this
00346  *             limits the number of messages that can be securely encrypted:
00347  *             for example, with 96-bit random nonces, you should not encrypt
00348  *             more than 2**32 messages with the same key.
00349  *
00350  *             Note that for both stategies, sizes are measured in blocks and
00351  *             that an AES block is 16 bytes.
00352  *
00353  * \warning    Upon return, \p stream_block contains sensitive data. Its
00354  *             content must not be written to insecure storage and should be
00355  *             securely discarded as soon as it's no longer needed.
00356  *
00357  * \param ctx              The AES context to use for encryption or decryption.
00358  * \param length           The length of the input data.
00359  * \param nc_off           The offset in the current \p stream_block, for
00360  *                         resuming within the current cipher stream. The
00361  *                         offset pointer should be 0 at the start of a stream.
00362  * \param nonce_counter    The 128-bit nonce and counter.
00363  * \param stream_block     The saved stream block for resuming. This is
00364  *                         overwritten by the function.
00365  * \param input            The buffer holding the input data.
00366  * \param output           The buffer holding the output data.
00367  *
00368  * \return                 \c 0 on success.
00369  */
00370 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
00371                        size_t length,
00372                        size_t *nc_off,
00373                        unsigned char nonce_counter[16],
00374                        unsigned char stream_block[16],
00375                        const unsigned char *input,
00376                        unsigned char *output );
00377 #endif /* MBEDTLS_CIPHER_MODE_CTR */
00378 
00379 /**
00380  * \brief           Internal AES block encryption function. This is only
00381  *                  exposed to allow overriding it using
00382  *                  \c MBEDTLS_AES_ENCRYPT_ALT.
00383  *
00384  * \param ctx       The AES context to use for encryption.
00385  * \param input     The plaintext block.
00386  * \param output    The output (ciphertext) block.
00387  *
00388  * \return          \c 0 on success.
00389  */
00390 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
00391                                   const unsigned char input[16],
00392                                   unsigned char output[16] );
00393 
00394 /**
00395  * \brief           Internal AES block decryption function. This is only
00396  *                  exposed to allow overriding it using see
00397  *                  \c MBEDTLS_AES_DECRYPT_ALT.
00398  *
00399  * \param ctx       The AES context to use for decryption.
00400  * \param input     The ciphertext block.
00401  * \param output    The output (plaintext) block.
00402  *
00403  * \return          \c 0 on success.
00404  */
00405 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
00406                                   const unsigned char input[16],
00407                                   unsigned char output[16] );
00408 
00409 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
00410 #if defined(MBEDTLS_DEPRECATED_WARNING)
00411 #define MBEDTLS_DEPRECATED      __attribute__((deprecated))
00412 #else
00413 #define MBEDTLS_DEPRECATED
00414 #endif
00415 /**
00416  * \brief           Deprecated internal AES block encryption function
00417  *                  without return value.
00418  *
00419  * \deprecated      Superseded by mbedtls_aes_encrypt_ext() in 2.5.0.
00420  *
00421  * \param ctx       The AES context to use for encryption.
00422  * \param input     Plaintext block.
00423  * \param output    Output (ciphertext) block.
00424  */
00425 MBEDTLS_DEPRECATED void mbedtls_aes_encrypt( mbedtls_aes_context *ctx,
00426                                              const unsigned char input[16],
00427                                              unsigned char output[16] );
00428 
00429 /**
00430  * \brief           Deprecated internal AES block decryption function
00431  *                  without return value.
00432  *
00433  * \deprecated      Superseded by mbedtls_aes_decrypt_ext() in 2.5.0.
00434  *
00435  * \param ctx       The AES context to use for decryption.
00436  * \param input     Ciphertext block.
00437  * \param output    Output (plaintext) block.
00438  */
00439 MBEDTLS_DEPRECATED void mbedtls_aes_decrypt( mbedtls_aes_context *ctx,
00440                                              const unsigned char input[16],
00441                                              unsigned char output[16] );
00442 
00443 #undef MBEDTLS_DEPRECATED
00444 #endif /* !MBEDTLS_DEPRECATED_REMOVED */
00445 
00446 /**
00447  * \brief          Checkup routine.
00448  *
00449  * \return         \c 0 on success.
00450  * \return         \c 1 on failure.
00451  */
00452 int mbedtls_aes_self_test( int verbose );
00453 
00454 #ifdef __cplusplus
00455 }
00456 #endif
00457 
00458 #endif /* aes.h */