Kev Mann / mbed-dev-OS5_10_4

features/mbedtls/src/nist_kw.c@0:38ceb79fef03, 2018-11-28 (annotated)

Committer:
kevman
Date:
Wed Nov 28 15:10:15 2018 +0000
Revision:
0:38ceb79fef03
RTC modified

Who changed what in which revision?

UserRevisionLine numberNew contents of line
kevman 0:38ceb79fef03 1 /*
kevman 0:38ceb79fef03 2 * Implementation of NIST SP 800-38F key wrapping, supporting KW and KWP modes
kevman 0:38ceb79fef03 3 * only
kevman 0:38ceb79fef03 4 *
kevman 0:38ceb79fef03 5 * Copyright (C) 2018, Arm Limited (or its affiliates), All Rights Reserved
kevman 0:38ceb79fef03 6 * SPDX-License-Identifier: Apache-2.0
kevman 0:38ceb79fef03 7 *
kevman 0:38ceb79fef03 8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
kevman 0:38ceb79fef03 9 * not use this file except in compliance with the License.
kevman 0:38ceb79fef03 10 * You may obtain a copy of the License at
kevman 0:38ceb79fef03 11 *
kevman 0:38ceb79fef03 12 * http://www.apache.org/licenses/LICENSE-2.0
kevman 0:38ceb79fef03 13 *
kevman 0:38ceb79fef03 14 * Unless required by applicable law or agreed to in writing, software
kevman 0:38ceb79fef03 15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
kevman 0:38ceb79fef03 16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
kevman 0:38ceb79fef03 17 * See the License for the specific language governing permissions and
kevman 0:38ceb79fef03 18 * limitations under the License.
kevman 0:38ceb79fef03 19 *
kevman 0:38ceb79fef03 20 * This file is part of Mbed TLS (https://tls.mbed.org)
kevman 0:38ceb79fef03 21 */
kevman 0:38ceb79fef03 22 /*
kevman 0:38ceb79fef03 23 * Definition of Key Wrapping:
kevman 0:38ceb79fef03 24 * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
kevman 0:38ceb79fef03 25 * RFC 3394 "Advanced Encryption Standard (AES) Key Wrap Algorithm"
kevman 0:38ceb79fef03 26 * RFC 5649 "Advanced Encryption Standard (AES) Key Wrap with Padding Algorithm"
kevman 0:38ceb79fef03 27 *
kevman 0:38ceb79fef03 28 * Note: RFC 3394 defines different methodology for intermediate operations for
kevman 0:38ceb79fef03 29 * the wrapping and unwrapping operation than the definition in NIST SP 800-38F.
kevman 0:38ceb79fef03 30 */
kevman 0:38ceb79fef03 31
kevman 0:38ceb79fef03 32 #if !defined(MBEDTLS_CONFIG_FILE)
kevman 0:38ceb79fef03 33 #include "mbedtls/config.h"
kevman 0:38ceb79fef03 34 #else
kevman 0:38ceb79fef03 35 #include MBEDTLS_CONFIG_FILE
kevman 0:38ceb79fef03 36 #endif
kevman 0:38ceb79fef03 37
kevman 0:38ceb79fef03 38 #if defined(MBEDTLS_NIST_KW_C)
kevman 0:38ceb79fef03 39
kevman 0:38ceb79fef03 40 #include "mbedtls/nist_kw.h"
kevman 0:38ceb79fef03 41 #include "mbedtls/platform_util.h"
kevman 0:38ceb79fef03 42
kevman 0:38ceb79fef03 43 #include <stdint.h>
kevman 0:38ceb79fef03 44 #include <string.h>
kevman 0:38ceb79fef03 45
kevman 0:38ceb79fef03 46 #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
kevman 0:38ceb79fef03 47 #if defined(MBEDTLS_PLATFORM_C)
kevman 0:38ceb79fef03 48 #include "mbedtls/platform.h"
kevman 0:38ceb79fef03 49 #else
kevman 0:38ceb79fef03 50 #include <stdio.h>
kevman 0:38ceb79fef03 51 #define mbedtls_printf printf
kevman 0:38ceb79fef03 52 #endif /* MBEDTLS_PLATFORM_C */
kevman 0:38ceb79fef03 53 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
kevman 0:38ceb79fef03 54
kevman 0:38ceb79fef03 55 #if !defined(MBEDTLS_NIST_KW_ALT)
kevman 0:38ceb79fef03 56
kevman 0:38ceb79fef03 57 #define KW_SEMIBLOCK_LENGTH 8
kevman 0:38ceb79fef03 58 #define MIN_SEMIBLOCKS_COUNT 3
kevman 0:38ceb79fef03 59
kevman 0:38ceb79fef03 60 /* constant-time buffer comparison */
kevman 0:38ceb79fef03 61 static inline unsigned char mbedtls_nist_kw_safer_memcmp( const void *a, const void *b, size_t n )
kevman 0:38ceb79fef03 62 {
kevman 0:38ceb79fef03 63 size_t i;
kevman 0:38ceb79fef03 64 volatile const unsigned char *A = (volatile const unsigned char *) a;
kevman 0:38ceb79fef03 65 volatile const unsigned char *B = (volatile const unsigned char *) b;
kevman 0:38ceb79fef03 66 volatile unsigned char diff = 0;
kevman 0:38ceb79fef03 67
kevman 0:38ceb79fef03 68 for( i = 0; i < n; i++ )
kevman 0:38ceb79fef03 69 {
kevman 0:38ceb79fef03 70 /* Read volatile data in order before computing diff.
kevman 0:38ceb79fef03 71 * This avoids IAR compiler warning:
kevman 0:38ceb79fef03 72 * 'the order of volatile accesses is undefined ..' */
kevman 0:38ceb79fef03 73 unsigned char x = A[i], y = B[i];
kevman 0:38ceb79fef03 74 diff |= x ^ y;
kevman 0:38ceb79fef03 75 }
kevman 0:38ceb79fef03 76
kevman 0:38ceb79fef03 77 return( diff );
kevman 0:38ceb79fef03 78 }
kevman 0:38ceb79fef03 79
kevman 0:38ceb79fef03 80 /*! The 64-bit default integrity check value (ICV) for KW mode. */
kevman 0:38ceb79fef03 81 static const unsigned char NIST_KW_ICV1[] = {0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6};
kevman 0:38ceb79fef03 82 /*! The 32-bit default integrity check value (ICV) for KWP mode. */
kevman 0:38ceb79fef03 83 static const unsigned char NIST_KW_ICV2[] = {0xA6, 0x59, 0x59, 0xA6};
kevman 0:38ceb79fef03 84
kevman 0:38ceb79fef03 85 #ifndef GET_UINT32_BE
kevman 0:38ceb79fef03 86 #define GET_UINT32_BE(n,b,i) \
kevman 0:38ceb79fef03 87 do { \
kevman 0:38ceb79fef03 88 (n) = ( (uint32_t) (b)[(i) ] << 24 ) \
kevman 0:38ceb79fef03 89 | ( (uint32_t) (b)[(i) + 1] << 16 ) \
kevman 0:38ceb79fef03 90 | ( (uint32_t) (b)[(i) + 2] << 8 ) \
kevman 0:38ceb79fef03 91 | ( (uint32_t) (b)[(i) + 3] ); \
kevman 0:38ceb79fef03 92 } while( 0 )
kevman 0:38ceb79fef03 93 #endif
kevman 0:38ceb79fef03 94
kevman 0:38ceb79fef03 95 #ifndef PUT_UINT32_BE
kevman 0:38ceb79fef03 96 #define PUT_UINT32_BE(n,b,i) \
kevman 0:38ceb79fef03 97 do { \
kevman 0:38ceb79fef03 98 (b)[(i) ] = (unsigned char) ( (n) >> 24 ); \
kevman 0:38ceb79fef03 99 (b)[(i) + 1] = (unsigned char) ( (n) >> 16 ); \
kevman 0:38ceb79fef03 100 (b)[(i) + 2] = (unsigned char) ( (n) >> 8 ); \
kevman 0:38ceb79fef03 101 (b)[(i) + 3] = (unsigned char) ( (n) ); \
kevman 0:38ceb79fef03 102 } while( 0 )
kevman 0:38ceb79fef03 103 #endif
kevman 0:38ceb79fef03 104
kevman 0:38ceb79fef03 105 /*
kevman 0:38ceb79fef03 106 * Initialize context
kevman 0:38ceb79fef03 107 */
kevman 0:38ceb79fef03 108 void mbedtls_nist_kw_init( mbedtls_nist_kw_context *ctx )
kevman 0:38ceb79fef03 109 {
kevman 0:38ceb79fef03 110 memset( ctx, 0, sizeof( mbedtls_nist_kw_context ) );
kevman 0:38ceb79fef03 111 }
kevman 0:38ceb79fef03 112
kevman 0:38ceb79fef03 113 int mbedtls_nist_kw_setkey( mbedtls_nist_kw_context *ctx,
kevman 0:38ceb79fef03 114 mbedtls_cipher_id_t cipher,
kevman 0:38ceb79fef03 115 const unsigned char *key,
kevman 0:38ceb79fef03 116 unsigned int keybits,
kevman 0:38ceb79fef03 117 const int is_wrap )
kevman 0:38ceb79fef03 118 {
kevman 0:38ceb79fef03 119 int ret;
kevman 0:38ceb79fef03 120 const mbedtls_cipher_info_t *cipher_info;
kevman 0:38ceb79fef03 121
kevman 0:38ceb79fef03 122 cipher_info = mbedtls_cipher_info_from_values( cipher,
kevman 0:38ceb79fef03 123 keybits,
kevman 0:38ceb79fef03 124 MBEDTLS_MODE_ECB );
kevman 0:38ceb79fef03 125 if( cipher_info == NULL )
kevman 0:38ceb79fef03 126 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 127
kevman 0:38ceb79fef03 128 if( cipher_info->block_size != 16 )
kevman 0:38ceb79fef03 129 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 130
kevman 0:38ceb79fef03 131 /*
kevman 0:38ceb79fef03 132 * SP 800-38F currently defines AES cipher as the only block cipher allowed:
kevman 0:38ceb79fef03 133 * "For KW and KWP, the underlying block cipher shall be approved, and the
kevman 0:38ceb79fef03 134 * block size shall be 128 bits. Currently, the AES block cipher, with key
kevman 0:38ceb79fef03 135 * lengths of 128, 192, or 256 bits, is the only block cipher that fits
kevman 0:38ceb79fef03 136 * this profile."
kevman 0:38ceb79fef03 137 * Currently we don't support other 128 bit block ciphers for key wrapping,
kevman 0:38ceb79fef03 138 * such as Camellia and Aria.
kevman 0:38ceb79fef03 139 */
kevman 0:38ceb79fef03 140 if( cipher != MBEDTLS_CIPHER_ID_AES )
kevman 0:38ceb79fef03 141 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kevman 0:38ceb79fef03 142
kevman 0:38ceb79fef03 143 mbedtls_cipher_free( &ctx->cipher_ctx );
kevman 0:38ceb79fef03 144
kevman 0:38ceb79fef03 145 if( ( ret = mbedtls_cipher_setup( &ctx->cipher_ctx, cipher_info ) ) != 0 )
kevman 0:38ceb79fef03 146 return( ret );
kevman 0:38ceb79fef03 147
kevman 0:38ceb79fef03 148 if( ( ret = mbedtls_cipher_setkey( &ctx->cipher_ctx, key, keybits,
kevman 0:38ceb79fef03 149 is_wrap ? MBEDTLS_ENCRYPT :
kevman 0:38ceb79fef03 150 MBEDTLS_DECRYPT )
kevman 0:38ceb79fef03 151 ) != 0 )
kevman 0:38ceb79fef03 152 {
kevman 0:38ceb79fef03 153 return( ret );
kevman 0:38ceb79fef03 154 }
kevman 0:38ceb79fef03 155
kevman 0:38ceb79fef03 156 return( 0 );
kevman 0:38ceb79fef03 157 }
kevman 0:38ceb79fef03 158
kevman 0:38ceb79fef03 159 /*
kevman 0:38ceb79fef03 160 * Free context
kevman 0:38ceb79fef03 161 */
kevman 0:38ceb79fef03 162 void mbedtls_nist_kw_free( mbedtls_nist_kw_context *ctx )
kevman 0:38ceb79fef03 163 {
kevman 0:38ceb79fef03 164 mbedtls_cipher_free( &ctx->cipher_ctx );
kevman 0:38ceb79fef03 165 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_nist_kw_context ) );
kevman 0:38ceb79fef03 166 }
kevman 0:38ceb79fef03 167
kevman 0:38ceb79fef03 168 /*
kevman 0:38ceb79fef03 169 * Helper function for Xoring the uint64_t "t" with the encrypted A.
kevman 0:38ceb79fef03 170 * Defined in NIST SP 800-38F section 6.1
kevman 0:38ceb79fef03 171 */
kevman 0:38ceb79fef03 172 static void calc_a_xor_t( unsigned char A[KW_SEMIBLOCK_LENGTH], uint64_t t )
kevman 0:38ceb79fef03 173 {
kevman 0:38ceb79fef03 174 size_t i = 0;
kevman 0:38ceb79fef03 175 for( i = 0; i < sizeof( t ); i++ )
kevman 0:38ceb79fef03 176 {
kevman 0:38ceb79fef03 177 A[i] ^= ( t >> ( ( sizeof( t ) - 1 - i ) * 8 ) ) & 0xff;
kevman 0:38ceb79fef03 178 }
kevman 0:38ceb79fef03 179 }
kevman 0:38ceb79fef03 180
kevman 0:38ceb79fef03 181 /*
kevman 0:38ceb79fef03 182 * KW-AE as defined in SP 800-38F section 6.2
kevman 0:38ceb79fef03 183 * KWP-AE as defined in SP 800-38F section 6.3
kevman 0:38ceb79fef03 184 */
kevman 0:38ceb79fef03 185 int mbedtls_nist_kw_wrap( mbedtls_nist_kw_context *ctx,
kevman 0:38ceb79fef03 186 mbedtls_nist_kw_mode_t mode,
kevman 0:38ceb79fef03 187 const unsigned char *input, size_t in_len,
kevman 0:38ceb79fef03 188 unsigned char *output, size_t *out_len, size_t out_size )
kevman 0:38ceb79fef03 189 {
kevman 0:38ceb79fef03 190 int ret = 0;
kevman 0:38ceb79fef03 191 size_t semiblocks = 0;
kevman 0:38ceb79fef03 192 size_t s;
kevman 0:38ceb79fef03 193 size_t olen, padlen = 0;
kevman 0:38ceb79fef03 194 uint64_t t = 0;
kevman 0:38ceb79fef03 195 unsigned char outbuff[KW_SEMIBLOCK_LENGTH * 2];
kevman 0:38ceb79fef03 196 unsigned char inbuff[KW_SEMIBLOCK_LENGTH * 2];
kevman 0:38ceb79fef03 197 unsigned char *R2 = output + KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 198 unsigned char *A = output;
kevman 0:38ceb79fef03 199
kevman 0:38ceb79fef03 200 *out_len = 0;
kevman 0:38ceb79fef03 201 /*
kevman 0:38ceb79fef03 202 * Generate the String to work on
kevman 0:38ceb79fef03 203 */
kevman 0:38ceb79fef03 204 if( mode == MBEDTLS_KW_MODE_KW )
kevman 0:38ceb79fef03 205 {
kevman 0:38ceb79fef03 206 if( out_size < in_len + KW_SEMIBLOCK_LENGTH )
kevman 0:38ceb79fef03 207 {
kevman 0:38ceb79fef03 208 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 209 }
kevman 0:38ceb79fef03 210
kevman 0:38ceb79fef03 211 /*
kevman 0:38ceb79fef03 212 * According to SP 800-38F Table 1, the plaintext length for KW
kevman 0:38ceb79fef03 213 * must be between 2 to 2^54-1 semiblocks inclusive.
kevman 0:38ceb79fef03 214 */
kevman 0:38ceb79fef03 215 if( in_len < 16 ||
kevman 0:38ceb79fef03 216 #if SIZE_MAX > 0x1FFFFFFFFFFFFF8
kevman 0:38ceb79fef03 217 in_len > 0x1FFFFFFFFFFFFF8 ||
kevman 0:38ceb79fef03 218 #endif
kevman 0:38ceb79fef03 219 in_len % KW_SEMIBLOCK_LENGTH != 0 )
kevman 0:38ceb79fef03 220 {
kevman 0:38ceb79fef03 221 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 222 }
kevman 0:38ceb79fef03 223
kevman 0:38ceb79fef03 224 memcpy( output, NIST_KW_ICV1, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 225 memmove( output + KW_SEMIBLOCK_LENGTH, input, in_len );
kevman 0:38ceb79fef03 226 }
kevman 0:38ceb79fef03 227 else
kevman 0:38ceb79fef03 228 {
kevman 0:38ceb79fef03 229 if( in_len % 8 != 0 )
kevman 0:38ceb79fef03 230 {
kevman 0:38ceb79fef03 231 padlen = ( 8 - ( in_len % 8 ) );
kevman 0:38ceb79fef03 232 }
kevman 0:38ceb79fef03 233
kevman 0:38ceb79fef03 234 if( out_size < in_len + KW_SEMIBLOCK_LENGTH + padlen )
kevman 0:38ceb79fef03 235 {
kevman 0:38ceb79fef03 236 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 237 }
kevman 0:38ceb79fef03 238
kevman 0:38ceb79fef03 239 /*
kevman 0:38ceb79fef03 240 * According to SP 800-38F Table 1, the plaintext length for KWP
kevman 0:38ceb79fef03 241 * must be between 1 and 2^32-1 octets inclusive.
kevman 0:38ceb79fef03 242 */
kevman 0:38ceb79fef03 243 if( in_len < 1
kevman 0:38ceb79fef03 244 #if SIZE_MAX > 0xFFFFFFFF
kevman 0:38ceb79fef03 245 || in_len > 0xFFFFFFFF
kevman 0:38ceb79fef03 246 #endif
kevman 0:38ceb79fef03 247 )
kevman 0:38ceb79fef03 248 {
kevman 0:38ceb79fef03 249 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 250 }
kevman 0:38ceb79fef03 251
kevman 0:38ceb79fef03 252 memcpy( output, NIST_KW_ICV2, KW_SEMIBLOCK_LENGTH / 2 );
kevman 0:38ceb79fef03 253 PUT_UINT32_BE( ( in_len & 0xffffffff ), output,
kevman 0:38ceb79fef03 254 KW_SEMIBLOCK_LENGTH / 2 );
kevman 0:38ceb79fef03 255
kevman 0:38ceb79fef03 256 memcpy( output + KW_SEMIBLOCK_LENGTH, input, in_len );
kevman 0:38ceb79fef03 257 memset( output + KW_SEMIBLOCK_LENGTH + in_len, 0, padlen );
kevman 0:38ceb79fef03 258 }
kevman 0:38ceb79fef03 259 semiblocks = ( ( in_len + padlen ) / KW_SEMIBLOCK_LENGTH ) + 1;
kevman 0:38ceb79fef03 260
kevman 0:38ceb79fef03 261 s = 6 * ( semiblocks - 1 );
kevman 0:38ceb79fef03 262
kevman 0:38ceb79fef03 263 if( mode == MBEDTLS_KW_MODE_KWP
kevman 0:38ceb79fef03 264 && in_len <= KW_SEMIBLOCK_LENGTH )
kevman 0:38ceb79fef03 265 {
kevman 0:38ceb79fef03 266 memcpy( inbuff, output, 16 );
kevman 0:38ceb79fef03 267 ret = mbedtls_cipher_update( &ctx->cipher_ctx,
kevman 0:38ceb79fef03 268 inbuff, 16, output, &olen );
kevman 0:38ceb79fef03 269 if( ret != 0 )
kevman 0:38ceb79fef03 270 goto cleanup;
kevman 0:38ceb79fef03 271 }
kevman 0:38ceb79fef03 272 else
kevman 0:38ceb79fef03 273 {
kevman 0:38ceb79fef03 274 /*
kevman 0:38ceb79fef03 275 * Do the wrapping function W, as defined in RFC 3394 section 2.2.1
kevman 0:38ceb79fef03 276 */
kevman 0:38ceb79fef03 277 if( semiblocks < MIN_SEMIBLOCKS_COUNT )
kevman 0:38ceb79fef03 278 {
kevman 0:38ceb79fef03 279 ret = MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
kevman 0:38ceb79fef03 280 goto cleanup;
kevman 0:38ceb79fef03 281 }
kevman 0:38ceb79fef03 282
kevman 0:38ceb79fef03 283 /* Calculate intermediate values */
kevman 0:38ceb79fef03 284 for( t = 1; t <= s; t++ )
kevman 0:38ceb79fef03 285 {
kevman 0:38ceb79fef03 286 memcpy( inbuff, A, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 287 memcpy( inbuff + KW_SEMIBLOCK_LENGTH, R2, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 288
kevman 0:38ceb79fef03 289 ret = mbedtls_cipher_update( &ctx->cipher_ctx,
kevman 0:38ceb79fef03 290 inbuff, 16, outbuff, &olen );
kevman 0:38ceb79fef03 291 if( ret != 0 )
kevman 0:38ceb79fef03 292 goto cleanup;
kevman 0:38ceb79fef03 293
kevman 0:38ceb79fef03 294 memcpy( A, outbuff, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 295 calc_a_xor_t( A, t );
kevman 0:38ceb79fef03 296
kevman 0:38ceb79fef03 297 memcpy( R2, outbuff + KW_SEMIBLOCK_LENGTH, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 298 R2 += KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 299 if( R2 >= output + ( semiblocks * KW_SEMIBLOCK_LENGTH ) )
kevman 0:38ceb79fef03 300 R2 = output + KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 301 }
kevman 0:38ceb79fef03 302 }
kevman 0:38ceb79fef03 303
kevman 0:38ceb79fef03 304 *out_len = semiblocks * KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 305
kevman 0:38ceb79fef03 306 cleanup:
kevman 0:38ceb79fef03 307
kevman 0:38ceb79fef03 308 if( ret != 0)
kevman 0:38ceb79fef03 309 {
kevman 0:38ceb79fef03 310 memset( output, 0, semiblocks * KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 311 }
kevman 0:38ceb79fef03 312 mbedtls_platform_zeroize( inbuff, KW_SEMIBLOCK_LENGTH * 2 );
kevman 0:38ceb79fef03 313 mbedtls_platform_zeroize( outbuff, KW_SEMIBLOCK_LENGTH * 2 );
kevman 0:38ceb79fef03 314 mbedtls_cipher_finish( &ctx->cipher_ctx, NULL, &olen );
kevman 0:38ceb79fef03 315 return( ret );
kevman 0:38ceb79fef03 316 }
kevman 0:38ceb79fef03 317
kevman 0:38ceb79fef03 318 /*
kevman 0:38ceb79fef03 319 * W-1 function as defined in RFC 3394 section 2.2.2
kevman 0:38ceb79fef03 320 * This function assumes the following:
kevman 0:38ceb79fef03 321 * 1. Output buffer is at least of size ( semiblocks - 1 ) * KW_SEMIBLOCK_LENGTH.
kevman 0:38ceb79fef03 322 * 2. The input buffer is of size semiblocks * KW_SEMIBLOCK_LENGTH.
kevman 0:38ceb79fef03 323 * 3. Minimal number of semiblocks is 3.
kevman 0:38ceb79fef03 324 * 4. A is a buffer to hold the first semiblock of the input buffer.
kevman 0:38ceb79fef03 325 */
kevman 0:38ceb79fef03 326 static int unwrap( mbedtls_nist_kw_context *ctx,
kevman 0:38ceb79fef03 327 const unsigned char *input, size_t semiblocks,
kevman 0:38ceb79fef03 328 unsigned char A[KW_SEMIBLOCK_LENGTH],
kevman 0:38ceb79fef03 329 unsigned char *output, size_t* out_len )
kevman 0:38ceb79fef03 330 {
kevman 0:38ceb79fef03 331 int ret = 0;
kevman 0:38ceb79fef03 332 const size_t s = 6 * ( semiblocks - 1 );
kevman 0:38ceb79fef03 333 size_t olen;
kevman 0:38ceb79fef03 334 uint64_t t = 0;
kevman 0:38ceb79fef03 335 unsigned char outbuff[KW_SEMIBLOCK_LENGTH * 2];
kevman 0:38ceb79fef03 336 unsigned char inbuff[KW_SEMIBLOCK_LENGTH * 2];
kevman 0:38ceb79fef03 337 unsigned char *R = output + ( semiblocks - 2 ) * KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 338 *out_len = 0;
kevman 0:38ceb79fef03 339
kevman 0:38ceb79fef03 340 if( semiblocks < MIN_SEMIBLOCKS_COUNT )
kevman 0:38ceb79fef03 341 {
kevman 0:38ceb79fef03 342 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 343 }
kevman 0:38ceb79fef03 344
kevman 0:38ceb79fef03 345 memcpy( A, input, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 346 memmove( output, input + KW_SEMIBLOCK_LENGTH, ( semiblocks - 1 ) * KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 347
kevman 0:38ceb79fef03 348 /* Calculate intermediate values */
kevman 0:38ceb79fef03 349 for( t = s; t >= 1; t-- )
kevman 0:38ceb79fef03 350 {
kevman 0:38ceb79fef03 351 calc_a_xor_t( A, t );
kevman 0:38ceb79fef03 352
kevman 0:38ceb79fef03 353 memcpy( inbuff, A, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 354 memcpy( inbuff + KW_SEMIBLOCK_LENGTH, R, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 355
kevman 0:38ceb79fef03 356 ret = mbedtls_cipher_update( &ctx->cipher_ctx,
kevman 0:38ceb79fef03 357 inbuff, 16, outbuff, &olen );
kevman 0:38ceb79fef03 358 if( ret != 0 )
kevman 0:38ceb79fef03 359 goto cleanup;
kevman 0:38ceb79fef03 360
kevman 0:38ceb79fef03 361 memcpy( A, outbuff, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 362
kevman 0:38ceb79fef03 363 /* Set R as LSB64 of outbuff */
kevman 0:38ceb79fef03 364 memcpy( R, outbuff + KW_SEMIBLOCK_LENGTH, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 365
kevman 0:38ceb79fef03 366 if( R == output )
kevman 0:38ceb79fef03 367 R = output + ( semiblocks - 2 ) * KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 368 else
kevman 0:38ceb79fef03 369 R -= KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 370 }
kevman 0:38ceb79fef03 371
kevman 0:38ceb79fef03 372 *out_len = ( semiblocks - 1 ) * KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 373
kevman 0:38ceb79fef03 374 cleanup:
kevman 0:38ceb79fef03 375 if( ret != 0)
kevman 0:38ceb79fef03 376 memset( output, 0, ( semiblocks - 1 ) * KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 377 mbedtls_platform_zeroize( inbuff, sizeof( inbuff ) );
kevman 0:38ceb79fef03 378 mbedtls_platform_zeroize( outbuff, sizeof( outbuff ) );
kevman 0:38ceb79fef03 379
kevman 0:38ceb79fef03 380 return( ret );
kevman 0:38ceb79fef03 381 }
kevman 0:38ceb79fef03 382
kevman 0:38ceb79fef03 383 /*
kevman 0:38ceb79fef03 384 * KW-AD as defined in SP 800-38F section 6.2
kevman 0:38ceb79fef03 385 * KWP-AD as defined in SP 800-38F section 6.3
kevman 0:38ceb79fef03 386 */
kevman 0:38ceb79fef03 387 int mbedtls_nist_kw_unwrap( mbedtls_nist_kw_context *ctx,
kevman 0:38ceb79fef03 388 mbedtls_nist_kw_mode_t mode,
kevman 0:38ceb79fef03 389 const unsigned char *input, size_t in_len,
kevman 0:38ceb79fef03 390 unsigned char *output, size_t *out_len, size_t out_size )
kevman 0:38ceb79fef03 391 {
kevman 0:38ceb79fef03 392 int ret = 0;
kevman 0:38ceb79fef03 393 size_t i, olen;
kevman 0:38ceb79fef03 394 unsigned char A[KW_SEMIBLOCK_LENGTH];
kevman 0:38ceb79fef03 395 unsigned char diff, bad_padding = 0;
kevman 0:38ceb79fef03 396
kevman 0:38ceb79fef03 397 *out_len = 0;
kevman 0:38ceb79fef03 398 if( out_size < in_len - KW_SEMIBLOCK_LENGTH )
kevman 0:38ceb79fef03 399 {
kevman 0:38ceb79fef03 400 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 401 }
kevman 0:38ceb79fef03 402
kevman 0:38ceb79fef03 403 if( mode == MBEDTLS_KW_MODE_KW )
kevman 0:38ceb79fef03 404 {
kevman 0:38ceb79fef03 405 /*
kevman 0:38ceb79fef03 406 * According to SP 800-38F Table 1, the ciphertext length for KW
kevman 0:38ceb79fef03 407 * must be between 3 to 2^54 semiblocks inclusive.
kevman 0:38ceb79fef03 408 */
kevman 0:38ceb79fef03 409 if( in_len < 24 ||
kevman 0:38ceb79fef03 410 #if SIZE_MAX > 0x200000000000000
kevman 0:38ceb79fef03 411 in_len > 0x200000000000000 ||
kevman 0:38ceb79fef03 412 #endif
kevman 0:38ceb79fef03 413 in_len % KW_SEMIBLOCK_LENGTH != 0 )
kevman 0:38ceb79fef03 414 {
kevman 0:38ceb79fef03 415 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 416 }
kevman 0:38ceb79fef03 417
kevman 0:38ceb79fef03 418 ret = unwrap( ctx, input, in_len / KW_SEMIBLOCK_LENGTH,
kevman 0:38ceb79fef03 419 A, output, out_len );
kevman 0:38ceb79fef03 420 if( ret != 0 )
kevman 0:38ceb79fef03 421 goto cleanup;
kevman 0:38ceb79fef03 422
kevman 0:38ceb79fef03 423 /* Check ICV in "constant-time" */
kevman 0:38ceb79fef03 424 diff = mbedtls_nist_kw_safer_memcmp( NIST_KW_ICV1, A, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 425
kevman 0:38ceb79fef03 426 if( diff != 0 )
kevman 0:38ceb79fef03 427 {
kevman 0:38ceb79fef03 428 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
kevman 0:38ceb79fef03 429 goto cleanup;
kevman 0:38ceb79fef03 430 }
kevman 0:38ceb79fef03 431
kevman 0:38ceb79fef03 432 }
kevman 0:38ceb79fef03 433 else if( mode == MBEDTLS_KW_MODE_KWP )
kevman 0:38ceb79fef03 434 {
kevman 0:38ceb79fef03 435 size_t padlen = 0;
kevman 0:38ceb79fef03 436 uint32_t Plen;
kevman 0:38ceb79fef03 437 /*
kevman 0:38ceb79fef03 438 * According to SP 800-38F Table 1, the ciphertext length for KWP
kevman 0:38ceb79fef03 439 * must be between 2 to 2^29 semiblocks inclusive.
kevman 0:38ceb79fef03 440 */
kevman 0:38ceb79fef03 441 if( in_len < KW_SEMIBLOCK_LENGTH * 2 ||
kevman 0:38ceb79fef03 442 #if SIZE_MAX > 0x100000000
kevman 0:38ceb79fef03 443 in_len > 0x100000000 ||
kevman 0:38ceb79fef03 444 #endif
kevman 0:38ceb79fef03 445 in_len % KW_SEMIBLOCK_LENGTH != 0 )
kevman 0:38ceb79fef03 446 {
kevman 0:38ceb79fef03 447 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 448 }
kevman 0:38ceb79fef03 449
kevman 0:38ceb79fef03 450 if( in_len == KW_SEMIBLOCK_LENGTH * 2 )
kevman 0:38ceb79fef03 451 {
kevman 0:38ceb79fef03 452 unsigned char outbuff[KW_SEMIBLOCK_LENGTH * 2];
kevman 0:38ceb79fef03 453 ret = mbedtls_cipher_update( &ctx->cipher_ctx,
kevman 0:38ceb79fef03 454 input, 16, outbuff, &olen );
kevman 0:38ceb79fef03 455 if( ret != 0 )
kevman 0:38ceb79fef03 456 goto cleanup;
kevman 0:38ceb79fef03 457
kevman 0:38ceb79fef03 458 memcpy( A, outbuff, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 459 memcpy( output, outbuff + KW_SEMIBLOCK_LENGTH, KW_SEMIBLOCK_LENGTH );
kevman 0:38ceb79fef03 460 mbedtls_platform_zeroize( outbuff, sizeof( outbuff ) );
kevman 0:38ceb79fef03 461 *out_len = KW_SEMIBLOCK_LENGTH;
kevman 0:38ceb79fef03 462 }
kevman 0:38ceb79fef03 463 else
kevman 0:38ceb79fef03 464 {
kevman 0:38ceb79fef03 465 /* in_len >= KW_SEMIBLOCK_LENGTH * 3 */
kevman 0:38ceb79fef03 466 ret = unwrap( ctx, input, in_len / KW_SEMIBLOCK_LENGTH,
kevman 0:38ceb79fef03 467 A, output, out_len );
kevman 0:38ceb79fef03 468 if( ret != 0 )
kevman 0:38ceb79fef03 469 goto cleanup;
kevman 0:38ceb79fef03 470 }
kevman 0:38ceb79fef03 471
kevman 0:38ceb79fef03 472 /* Check ICV in "constant-time" */
kevman 0:38ceb79fef03 473 diff = mbedtls_nist_kw_safer_memcmp( NIST_KW_ICV2, A, KW_SEMIBLOCK_LENGTH / 2 );
kevman 0:38ceb79fef03 474
kevman 0:38ceb79fef03 475 if( diff != 0 )
kevman 0:38ceb79fef03 476 {
kevman 0:38ceb79fef03 477 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
kevman 0:38ceb79fef03 478 }
kevman 0:38ceb79fef03 479
kevman 0:38ceb79fef03 480 GET_UINT32_BE( Plen, A, KW_SEMIBLOCK_LENGTH / 2 );
kevman 0:38ceb79fef03 481
kevman 0:38ceb79fef03 482 /*
kevman 0:38ceb79fef03 483 * Plen is the length of the plaintext, when the input is valid.
kevman 0:38ceb79fef03 484 * If Plen is larger than the plaintext and padding, padlen will be
kevman 0:38ceb79fef03 485 * larger than 8, because of the type wrap around.
kevman 0:38ceb79fef03 486 */
kevman 0:38ceb79fef03 487 padlen = in_len - KW_SEMIBLOCK_LENGTH - Plen;
kevman 0:38ceb79fef03 488 if ( padlen > 7 )
kevman 0:38ceb79fef03 489 {
kevman 0:38ceb79fef03 490 padlen &= 7;
kevman 0:38ceb79fef03 491 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
kevman 0:38ceb79fef03 492 }
kevman 0:38ceb79fef03 493
kevman 0:38ceb79fef03 494 /* Check padding in "constant-time" */
kevman 0:38ceb79fef03 495 for( diff = 0, i = 0; i < KW_SEMIBLOCK_LENGTH; i++ )
kevman 0:38ceb79fef03 496 {
kevman 0:38ceb79fef03 497 if( i >= KW_SEMIBLOCK_LENGTH - padlen )
kevman 0:38ceb79fef03 498 diff |= output[*out_len - KW_SEMIBLOCK_LENGTH + i];
kevman 0:38ceb79fef03 499 else
kevman 0:38ceb79fef03 500 bad_padding |= output[*out_len - KW_SEMIBLOCK_LENGTH + i];
kevman 0:38ceb79fef03 501 }
kevman 0:38ceb79fef03 502
kevman 0:38ceb79fef03 503 if( diff != 0 )
kevman 0:38ceb79fef03 504 {
kevman 0:38ceb79fef03 505 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
kevman 0:38ceb79fef03 506 }
kevman 0:38ceb79fef03 507
kevman 0:38ceb79fef03 508 if( ret != 0 )
kevman 0:38ceb79fef03 509 {
kevman 0:38ceb79fef03 510 goto cleanup;
kevman 0:38ceb79fef03 511 }
kevman 0:38ceb79fef03 512 memset( output + Plen, 0, padlen );
kevman 0:38ceb79fef03 513 *out_len = Plen;
kevman 0:38ceb79fef03 514 }
kevman 0:38ceb79fef03 515 else
kevman 0:38ceb79fef03 516 {
kevman 0:38ceb79fef03 517 ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
kevman 0:38ceb79fef03 518 goto cleanup;
kevman 0:38ceb79fef03 519 }
kevman 0:38ceb79fef03 520
kevman 0:38ceb79fef03 521 cleanup:
kevman 0:38ceb79fef03 522 if( ret != 0 )
kevman 0:38ceb79fef03 523 {
kevman 0:38ceb79fef03 524 memset( output, 0, *out_len );
kevman 0:38ceb79fef03 525 *out_len = 0;
kevman 0:38ceb79fef03 526 }
kevman 0:38ceb79fef03 527
kevman 0:38ceb79fef03 528 mbedtls_platform_zeroize( &bad_padding, sizeof( bad_padding) );
kevman 0:38ceb79fef03 529 mbedtls_platform_zeroize( &diff, sizeof( diff ) );
kevman 0:38ceb79fef03 530 mbedtls_platform_zeroize( A, sizeof( A ) );
kevman 0:38ceb79fef03 531 mbedtls_cipher_finish( &ctx->cipher_ctx, NULL, &olen );
kevman 0:38ceb79fef03 532 return( ret );
kevman 0:38ceb79fef03 533 }
kevman 0:38ceb79fef03 534
kevman 0:38ceb79fef03 535 #endif /* !MBEDTLS_NIST_KW_ALT */
kevman 0:38ceb79fef03 536
kevman 0:38ceb79fef03 537 #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
kevman 0:38ceb79fef03 538
kevman 0:38ceb79fef03 539 #define KW_TESTS 3
kevman 0:38ceb79fef03 540
kevman 0:38ceb79fef03 541 /*
kevman 0:38ceb79fef03 542 * Test vectors taken from NIST
kevman 0:38ceb79fef03 543 * https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/CAVP-TESTING-BLOCK-CIPHER-MODES#KW
kevman 0:38ceb79fef03 544 */
kevman 0:38ceb79fef03 545 static const unsigned int key_len[KW_TESTS] = { 16, 24, 32 };
kevman 0:38ceb79fef03 546
kevman 0:38ceb79fef03 547 static const unsigned char kw_key[KW_TESTS][32] = {
kevman 0:38ceb79fef03 548 { 0x75, 0x75, 0xda, 0x3a, 0x93, 0x60, 0x7c, 0xc2,
kevman 0:38ceb79fef03 549 0xbf, 0xd8, 0xce, 0xc7, 0xaa, 0xdf, 0xd9, 0xa6 },
kevman 0:38ceb79fef03 550 { 0x2d, 0x85, 0x26, 0x08, 0x1d, 0x02, 0xfb, 0x5b,
kevman 0:38ceb79fef03 551 0x85, 0xf6, 0x9a, 0xc2, 0x86, 0xec, 0xd5, 0x7d,
kevman 0:38ceb79fef03 552 0x40, 0xdf, 0x5d, 0xf3, 0x49, 0x47, 0x44, 0xd3 },
kevman 0:38ceb79fef03 553 { 0x11, 0x2a, 0xd4, 0x1b, 0x48, 0x56, 0xc7, 0x25,
kevman 0:38ceb79fef03 554 0x4a, 0x98, 0x48, 0xd3, 0x0f, 0xdd, 0x78, 0x33,
kevman 0:38ceb79fef03 555 0x5b, 0x03, 0x9a, 0x48, 0xa8, 0x96, 0x2c, 0x4d,
kevman 0:38ceb79fef03 556 0x1c, 0xb7, 0x8e, 0xab, 0xd5, 0xda, 0xd7, 0x88 }
kevman 0:38ceb79fef03 557 };
kevman 0:38ceb79fef03 558
kevman 0:38ceb79fef03 559 static const unsigned char kw_msg[KW_TESTS][40] = {
kevman 0:38ceb79fef03 560 { 0x42, 0x13, 0x6d, 0x3c, 0x38, 0x4a, 0x3e, 0xea,
kevman 0:38ceb79fef03 561 0xc9, 0x5a, 0x06, 0x6f, 0xd2, 0x8f, 0xed, 0x3f },
kevman 0:38ceb79fef03 562 { 0x95, 0xc1, 0x1b, 0xf5, 0x35, 0x3a, 0xfe, 0xdb,
kevman 0:38ceb79fef03 563 0x98, 0xfd, 0xd6, 0xc8, 0xca, 0x6f, 0xdb, 0x6d,
kevman 0:38ceb79fef03 564 0xa5, 0x4b, 0x74, 0xb4, 0x99, 0x0f, 0xdc, 0x45,
kevman 0:38ceb79fef03 565 0xc0, 0x9d, 0x15, 0x8f, 0x51, 0xce, 0x62, 0x9d,
kevman 0:38ceb79fef03 566 0xe2, 0xaf, 0x26, 0xe3, 0x25, 0x0e, 0x6b, 0x4c },
kevman 0:38ceb79fef03 567 { 0x1b, 0x20, 0xbf, 0x19, 0x90, 0xb0, 0x65, 0xd7,
kevman 0:38ceb79fef03 568 0x98, 0xe1, 0xb3, 0x22, 0x64, 0xad, 0x50, 0xa8,
kevman 0:38ceb79fef03 569 0x74, 0x74, 0x92, 0xba, 0x09, 0xa0, 0x4d, 0xd1 }
kevman 0:38ceb79fef03 570 };
kevman 0:38ceb79fef03 571
kevman 0:38ceb79fef03 572 static const size_t kw_msg_len[KW_TESTS] = { 16, 40, 24 };
kevman 0:38ceb79fef03 573 static const size_t kw_out_len[KW_TESTS] = { 24, 48, 32 };
kevman 0:38ceb79fef03 574 static const unsigned char kw_res[KW_TESTS][48] = {
kevman 0:38ceb79fef03 575 { 0x03, 0x1f, 0x6b, 0xd7, 0xe6, 0x1e, 0x64, 0x3d,
kevman 0:38ceb79fef03 576 0xf6, 0x85, 0x94, 0x81, 0x6f, 0x64, 0xca, 0xa3,
kevman 0:38ceb79fef03 577 0xf5, 0x6f, 0xab, 0xea, 0x25, 0x48, 0xf5, 0xfb },
kevman 0:38ceb79fef03 578 { 0x44, 0x3c, 0x6f, 0x15, 0x09, 0x83, 0x71, 0x91,
kevman 0:38ceb79fef03 579 0x3e, 0x5c, 0x81, 0x4c, 0xa1, 0xa0, 0x42, 0xec,
kevman 0:38ceb79fef03 580 0x68, 0x2f, 0x7b, 0x13, 0x6d, 0x24, 0x3a, 0x4d,
kevman 0:38ceb79fef03 581 0x6c, 0x42, 0x6f, 0xc6, 0x97, 0x15, 0x63, 0xe8,
kevman 0:38ceb79fef03 582 0xa1, 0x4a, 0x55, 0x8e, 0x09, 0x64, 0x16, 0x19,
kevman 0:38ceb79fef03 583 0xbf, 0x03, 0xfc, 0xaf, 0x90, 0xb1, 0xfc, 0x2d },
kevman 0:38ceb79fef03 584 { 0xba, 0x8a, 0x25, 0x9a, 0x47, 0x1b, 0x78, 0x7d,
kevman 0:38ceb79fef03 585 0xd5, 0xd5, 0x40, 0xec, 0x25, 0xd4, 0x3d, 0x87,
kevman 0:38ceb79fef03 586 0x20, 0x0f, 0xda, 0xdc, 0x6d, 0x1f, 0x05, 0xd9,
kevman 0:38ceb79fef03 587 0x16, 0x58, 0x4f, 0xa9, 0xf6, 0xcb, 0xf5, 0x12 }
kevman 0:38ceb79fef03 588 };
kevman 0:38ceb79fef03 589
kevman 0:38ceb79fef03 590 static const unsigned char kwp_key[KW_TESTS][32] = {
kevman 0:38ceb79fef03 591 { 0x78, 0x65, 0xe2, 0x0f, 0x3c, 0x21, 0x65, 0x9a,
kevman 0:38ceb79fef03 592 0xb4, 0x69, 0x0b, 0x62, 0x9c, 0xdf, 0x3c, 0xc4 },
kevman 0:38ceb79fef03 593 { 0xf5, 0xf8, 0x96, 0xa3, 0xbd, 0x2f, 0x4a, 0x98,
kevman 0:38ceb79fef03 594 0x23, 0xef, 0x16, 0x2b, 0x00, 0xb8, 0x05, 0xd7,
kevman 0:38ceb79fef03 595 0xde, 0x1e, 0xa4, 0x66, 0x26, 0x96, 0xa2, 0x58 },
kevman 0:38ceb79fef03 596 { 0x95, 0xda, 0x27, 0x00, 0xca, 0x6f, 0xd9, 0xa5,
kevman 0:38ceb79fef03 597 0x25, 0x54, 0xee, 0x2a, 0x8d, 0xf1, 0x38, 0x6f,
kevman 0:38ceb79fef03 598 0x5b, 0x94, 0xa1, 0xa6, 0x0e, 0xd8, 0xa4, 0xae,
kevman 0:38ceb79fef03 599 0xf6, 0x0a, 0x8d, 0x61, 0xab, 0x5f, 0x22, 0x5a }
kevman 0:38ceb79fef03 600 };
kevman 0:38ceb79fef03 601
kevman 0:38ceb79fef03 602 static const unsigned char kwp_msg[KW_TESTS][31] = {
kevman 0:38ceb79fef03 603 { 0xbd, 0x68, 0x43, 0xd4, 0x20, 0x37, 0x8d, 0xc8,
kevman 0:38ceb79fef03 604 0x96 },
kevman 0:38ceb79fef03 605 { 0x6c, 0xcd, 0xd5, 0x85, 0x18, 0x40, 0x97, 0xeb,
kevman 0:38ceb79fef03 606 0xd5, 0xc3, 0xaf, 0x3e, 0x47, 0xd0, 0x2c, 0x19,
kevman 0:38ceb79fef03 607 0x14, 0x7b, 0x4d, 0x99, 0x5f, 0x96, 0x43, 0x66,
kevman 0:38ceb79fef03 608 0x91, 0x56, 0x75, 0x8c, 0x13, 0x16, 0x8f },
kevman 0:38ceb79fef03 609 { 0xd1 }
kevman 0:38ceb79fef03 610 };
kevman 0:38ceb79fef03 611 static const size_t kwp_msg_len[KW_TESTS] = { 9, 31, 1 };
kevman 0:38ceb79fef03 612
kevman 0:38ceb79fef03 613 static const unsigned char kwp_res[KW_TESTS][48] = {
kevman 0:38ceb79fef03 614 { 0x41, 0xec, 0xa9, 0x56, 0xd4, 0xaa, 0x04, 0x7e,
kevman 0:38ceb79fef03 615 0xb5, 0xcf, 0x4e, 0xfe, 0x65, 0x96, 0x61, 0xe7,
kevman 0:38ceb79fef03 616 0x4d, 0xb6, 0xf8, 0xc5, 0x64, 0xe2, 0x35, 0x00 },
kevman 0:38ceb79fef03 617 { 0x4e, 0x9b, 0xc2, 0xbc, 0xbc, 0x6c, 0x1e, 0x13,
kevman 0:38ceb79fef03 618 0xd3, 0x35, 0xbc, 0xc0, 0xf7, 0x73, 0x6a, 0x88,
kevman 0:38ceb79fef03 619 0xfa, 0x87, 0x53, 0x66, 0x15, 0xbb, 0x8e, 0x63,
kevman 0:38ceb79fef03 620 0x8b, 0xcc, 0x81, 0x66, 0x84, 0x68, 0x17, 0x90,
kevman 0:38ceb79fef03 621 0x67, 0xcf, 0xa9, 0x8a, 0x9d, 0x0e, 0x33, 0x26 },
kevman 0:38ceb79fef03 622 { 0x06, 0xba, 0x7a, 0xe6, 0xf3, 0x24, 0x8c, 0xfd,
kevman 0:38ceb79fef03 623 0xcf, 0x26, 0x75, 0x07, 0xfa, 0x00, 0x1b, 0xc4 }
kevman 0:38ceb79fef03 624 };
kevman 0:38ceb79fef03 625 static const size_t kwp_out_len[KW_TESTS] = { 24, 40, 16 };
kevman 0:38ceb79fef03 626
kevman 0:38ceb79fef03 627 int mbedtls_nist_kw_self_test( int verbose )
kevman 0:38ceb79fef03 628 {
kevman 0:38ceb79fef03 629 mbedtls_nist_kw_context ctx;
kevman 0:38ceb79fef03 630 unsigned char out[48];
kevman 0:38ceb79fef03 631 size_t olen;
kevman 0:38ceb79fef03 632 int i;
kevman 0:38ceb79fef03 633 int ret = 0;
kevman 0:38ceb79fef03 634 mbedtls_nist_kw_init( &ctx );
kevman 0:38ceb79fef03 635
kevman 0:38ceb79fef03 636 for( i = 0; i < KW_TESTS; i++ )
kevman 0:38ceb79fef03 637 {
kevman 0:38ceb79fef03 638 if( verbose != 0 )
kevman 0:38ceb79fef03 639 mbedtls_printf( " KW-AES-%u ", (unsigned int) key_len[i] * 8 );
kevman 0:38ceb79fef03 640
kevman 0:38ceb79fef03 641 ret = mbedtls_nist_kw_setkey( &ctx, MBEDTLS_CIPHER_ID_AES,
kevman 0:38ceb79fef03 642 kw_key[i], key_len[i] * 8, 1 );
kevman 0:38ceb79fef03 643 if( ret != 0 )
kevman 0:38ceb79fef03 644 {
kevman 0:38ceb79fef03 645 if( verbose != 0 )
kevman 0:38ceb79fef03 646 mbedtls_printf( " KW: setup failed " );
kevman 0:38ceb79fef03 647
kevman 0:38ceb79fef03 648 goto end;
kevman 0:38ceb79fef03 649 }
kevman 0:38ceb79fef03 650
kevman 0:38ceb79fef03 651 ret = mbedtls_nist_kw_wrap( &ctx, MBEDTLS_KW_MODE_KW, kw_msg[i],
kevman 0:38ceb79fef03 652 kw_msg_len[i], out, &olen, sizeof( out ) );
kevman 0:38ceb79fef03 653 if( ret != 0 || kw_out_len[i] != olen ||
kevman 0:38ceb79fef03 654 memcmp( out, kw_res[i], kw_out_len[i] ) != 0 )
kevman 0:38ceb79fef03 655 {
kevman 0:38ceb79fef03 656 if( verbose != 0 )
kevman 0:38ceb79fef03 657 mbedtls_printf( "failed. ");
kevman 0:38ceb79fef03 658
kevman 0:38ceb79fef03 659 ret = 1;
kevman 0:38ceb79fef03 660 goto end;
kevman 0:38ceb79fef03 661 }
kevman 0:38ceb79fef03 662
kevman 0:38ceb79fef03 663 if( ( ret = mbedtls_nist_kw_setkey( &ctx, MBEDTLS_CIPHER_ID_AES,
kevman 0:38ceb79fef03 664 kw_key[i], key_len[i] * 8, 0 ) )
kevman 0:38ceb79fef03 665 != 0 )
kevman 0:38ceb79fef03 666 {
kevman 0:38ceb79fef03 667 if( verbose != 0 )
kevman 0:38ceb79fef03 668 mbedtls_printf( " KW: setup failed ");
kevman 0:38ceb79fef03 669
kevman 0:38ceb79fef03 670 goto end;
kevman 0:38ceb79fef03 671 }
kevman 0:38ceb79fef03 672
kevman 0:38ceb79fef03 673 ret = mbedtls_nist_kw_unwrap( &ctx, MBEDTLS_KW_MODE_KW,
kevman 0:38ceb79fef03 674 out, olen, out, &olen, sizeof( out ) );
kevman 0:38ceb79fef03 675
kevman 0:38ceb79fef03 676 if( ret != 0 || olen != kw_msg_len[i] ||
kevman 0:38ceb79fef03 677 memcmp( out, kw_msg[i], kw_msg_len[i] ) != 0 )
kevman 0:38ceb79fef03 678 {
kevman 0:38ceb79fef03 679 if( verbose != 0 )
kevman 0:38ceb79fef03 680 mbedtls_printf( "failed\n" );
kevman 0:38ceb79fef03 681
kevman 0:38ceb79fef03 682 ret = 1;
kevman 0:38ceb79fef03 683 goto end;
kevman 0:38ceb79fef03 684 }
kevman 0:38ceb79fef03 685
kevman 0:38ceb79fef03 686 if( verbose != 0 )
kevman 0:38ceb79fef03 687 mbedtls_printf( " passed\n" );
kevman 0:38ceb79fef03 688 }
kevman 0:38ceb79fef03 689
kevman 0:38ceb79fef03 690 for( i = 0; i < KW_TESTS; i++ )
kevman 0:38ceb79fef03 691 {
kevman 0:38ceb79fef03 692 olen = sizeof( out );
kevman 0:38ceb79fef03 693 if( verbose != 0 )
kevman 0:38ceb79fef03 694 mbedtls_printf( " KWP-AES-%u ", (unsigned int) key_len[i] * 8 );
kevman 0:38ceb79fef03 695
kevman 0:38ceb79fef03 696 ret = mbedtls_nist_kw_setkey( &ctx, MBEDTLS_CIPHER_ID_AES, kwp_key[i],
kevman 0:38ceb79fef03 697 key_len[i] * 8, 1 );
kevman 0:38ceb79fef03 698 if( ret != 0 )
kevman 0:38ceb79fef03 699 {
kevman 0:38ceb79fef03 700 if( verbose != 0 )
kevman 0:38ceb79fef03 701 mbedtls_printf( " KWP: setup failed " );
kevman 0:38ceb79fef03 702
kevman 0:38ceb79fef03 703 goto end;
kevman 0:38ceb79fef03 704 }
kevman 0:38ceb79fef03 705 ret = mbedtls_nist_kw_wrap( &ctx, MBEDTLS_KW_MODE_KWP, kwp_msg[i],
kevman 0:38ceb79fef03 706 kwp_msg_len[i], out, &olen, sizeof( out ) );
kevman 0:38ceb79fef03 707
kevman 0:38ceb79fef03 708 if( ret != 0 || kwp_out_len[i] != olen ||
kevman 0:38ceb79fef03 709 memcmp( out, kwp_res[i], kwp_out_len[i] ) != 0 )
kevman 0:38ceb79fef03 710 {
kevman 0:38ceb79fef03 711 if( verbose != 0 )
kevman 0:38ceb79fef03 712 mbedtls_printf( "failed. ");
kevman 0:38ceb79fef03 713
kevman 0:38ceb79fef03 714 ret = 1;
kevman 0:38ceb79fef03 715 goto end;
kevman 0:38ceb79fef03 716 }
kevman 0:38ceb79fef03 717
kevman 0:38ceb79fef03 718 if( ( ret = mbedtls_nist_kw_setkey( &ctx, MBEDTLS_CIPHER_ID_AES,
kevman 0:38ceb79fef03 719 kwp_key[i], key_len[i] * 8, 0 ) )
kevman 0:38ceb79fef03 720 != 0 )
kevman 0:38ceb79fef03 721 {
kevman 0:38ceb79fef03 722 if( verbose != 0 )
kevman 0:38ceb79fef03 723 mbedtls_printf( " KWP: setup failed ");
kevman 0:38ceb79fef03 724
kevman 0:38ceb79fef03 725 goto end;
kevman 0:38ceb79fef03 726 }
kevman 0:38ceb79fef03 727
kevman 0:38ceb79fef03 728 ret = mbedtls_nist_kw_unwrap( &ctx, MBEDTLS_KW_MODE_KWP, out,
kevman 0:38ceb79fef03 729 olen, out, &olen, sizeof( out ) );
kevman 0:38ceb79fef03 730
kevman 0:38ceb79fef03 731 if( ret != 0 || olen != kwp_msg_len[i] ||
kevman 0:38ceb79fef03 732 memcmp( out, kwp_msg[i], kwp_msg_len[i] ) != 0 )
kevman 0:38ceb79fef03 733 {
kevman 0:38ceb79fef03 734 if( verbose != 0 )
kevman 0:38ceb79fef03 735 mbedtls_printf( "failed. ");
kevman 0:38ceb79fef03 736
kevman 0:38ceb79fef03 737 ret = 1;
kevman 0:38ceb79fef03 738 goto end;
kevman 0:38ceb79fef03 739 }
kevman 0:38ceb79fef03 740
kevman 0:38ceb79fef03 741 if( verbose != 0 )
kevman 0:38ceb79fef03 742 mbedtls_printf( " passed\n" );
kevman 0:38ceb79fef03 743 }
kevman 0:38ceb79fef03 744 end:
kevman 0:38ceb79fef03 745 mbedtls_nist_kw_free( &ctx );
kevman 0:38ceb79fef03 746
kevman 0:38ceb79fef03 747 if( verbose != 0 )
kevman 0:38ceb79fef03 748 mbedtls_printf( "\n" );
kevman 0:38ceb79fef03 749
kevman 0:38ceb79fef03 750 return( ret );
kevman 0:38ceb79fef03 751 }
kevman 0:38ceb79fef03 752
kevman 0:38ceb79fef03 753 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
kevman 0:38ceb79fef03 754
kevman 0:38ceb79fef03 755 #endif /* MBEDTLS_NIST_KW_C */