Xuyi Wang / wolfSSL

Important changes to repositories hosted on mbed.com

Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.

To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.

It is also possible to export all your personal repositories from the account settings page.

Dependents:   OS

wolfcrypt/src/cmac.c@15:117db924cf7c, 2018-08-18 (annotated)

Committer:
wolfSSL
Date:
Sat Aug 18 22:20:43 2018 +0000
Revision:
15:117db924cf7c
wolfSSL 3.15.3

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 15:117db924cf7c 1 /* cmac.c
wolfSSL 15:117db924cf7c 2 *
wolfSSL 15:117db924cf7c 3 * Copyright (C) 2006-2017 wolfSSL Inc.
wolfSSL 15:117db924cf7c 4 *
wolfSSL 15:117db924cf7c 5 * This file is part of wolfSSL.
wolfSSL 15:117db924cf7c 6 *
wolfSSL 15:117db924cf7c 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 15:117db924cf7c 8 * it under the terms of the GNU General Public License as published by
wolfSSL 15:117db924cf7c 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 15:117db924cf7c 10 * (at your option) any later version.
wolfSSL 15:117db924cf7c 11 *
wolfSSL 15:117db924cf7c 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 15:117db924cf7c 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 15:117db924cf7c 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 15:117db924cf7c 15 * GNU General Public License for more details.
wolfSSL 15:117db924cf7c 16 *
wolfSSL 15:117db924cf7c 17 * You should have received a copy of the GNU General Public License
wolfSSL 15:117db924cf7c 18 * along with this program; if not, write to the Free Software
wolfSSL 15:117db924cf7c 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 15:117db924cf7c 20 */
wolfSSL 15:117db924cf7c 21
wolfSSL 15:117db924cf7c 22
wolfSSL 15:117db924cf7c 23 #ifdef HAVE_CONFIG_H
wolfSSL 15:117db924cf7c 24 #include <config.h>
wolfSSL 15:117db924cf7c 25 #endif
wolfSSL 15:117db924cf7c 26
wolfSSL 15:117db924cf7c 27 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 15:117db924cf7c 28
wolfSSL 15:117db924cf7c 29 #if defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)
wolfSSL 15:117db924cf7c 30
wolfSSL 15:117db924cf7c 31 #if defined(HAVE_FIPS) && \
wolfSSL 15:117db924cf7c 32 defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)
wolfSSL 15:117db924cf7c 33
wolfSSL 15:117db924cf7c 34 /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
wolfSSL 15:117db924cf7c 35 #define FIPS_NO_WRAPPERS
wolfSSL 15:117db924cf7c 36
wolfSSL 15:117db924cf7c 37 #ifdef USE_WINDOWS_API
wolfSSL 15:117db924cf7c 38 #pragma code_seg(".fipsA$n")
wolfSSL 15:117db924cf7c 39 #pragma const_seg(".fipsB$n")
wolfSSL 15:117db924cf7c 40 #endif
wolfSSL 15:117db924cf7c 41 #endif
wolfSSL 15:117db924cf7c 42
wolfSSL 15:117db924cf7c 43 #ifdef NO_INLINE
wolfSSL 15:117db924cf7c 44 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 15:117db924cf7c 45 #else
wolfSSL 15:117db924cf7c 46 #define WOLFSSL_MISC_INCLUDED
wolfSSL 15:117db924cf7c 47 #include <wolfcrypt/src/misc.c>
wolfSSL 15:117db924cf7c 48 #endif
wolfSSL 15:117db924cf7c 49
wolfSSL 15:117db924cf7c 50 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 15:117db924cf7c 51 #include <wolfssl/wolfcrypt/aes.h>
wolfSSL 15:117db924cf7c 52 #include <wolfssl/wolfcrypt/cmac.h>
wolfSSL 15:117db924cf7c 53
wolfSSL 15:117db924cf7c 54
wolfSSL 15:117db924cf7c 55 static void ShiftAndXorRb(byte* out, byte* in)
wolfSSL 15:117db924cf7c 56 {
wolfSSL 15:117db924cf7c 57 int i, j, xorRb;
wolfSSL 15:117db924cf7c 58 int mask = 0, last = 0;
wolfSSL 15:117db924cf7c 59 byte Rb = 0x87;
wolfSSL 15:117db924cf7c 60
wolfSSL 15:117db924cf7c 61 xorRb = (in[0] & 0x80) != 0;
wolfSSL 15:117db924cf7c 62
wolfSSL 15:117db924cf7c 63 for (i = 1, j = AES_BLOCK_SIZE - 1; i <= AES_BLOCK_SIZE; i++, j--) {
wolfSSL 15:117db924cf7c 64 last = (in[j] & 0x80) ? 1 : 0;
wolfSSL 15:117db924cf7c 65 out[j] = (byte)((in[j] << 1) | mask);
wolfSSL 15:117db924cf7c 66 mask = last;
wolfSSL 15:117db924cf7c 67 if (xorRb) {
wolfSSL 15:117db924cf7c 68 out[j] ^= Rb;
wolfSSL 15:117db924cf7c 69 Rb = 0;
wolfSSL 15:117db924cf7c 70 }
wolfSSL 15:117db924cf7c 71 }
wolfSSL 15:117db924cf7c 72 }
wolfSSL 15:117db924cf7c 73
wolfSSL 15:117db924cf7c 74
wolfSSL 15:117db924cf7c 75 int wc_InitCmac(Cmac* cmac, const byte* key, word32 keySz,
wolfSSL 15:117db924cf7c 76 int type, void* unused)
wolfSSL 15:117db924cf7c 77 {
wolfSSL 15:117db924cf7c 78 int ret;
wolfSSL 15:117db924cf7c 79
wolfSSL 15:117db924cf7c 80 (void)unused;
wolfSSL 15:117db924cf7c 81
wolfSSL 15:117db924cf7c 82 if (cmac == NULL || key == NULL || keySz == 0 || type != WC_CMAC_AES)
wolfSSL 15:117db924cf7c 83 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 84
wolfSSL 15:117db924cf7c 85 XMEMSET(cmac, 0, sizeof(Cmac));
wolfSSL 15:117db924cf7c 86 ret = wc_AesSetKey(&cmac->aes, key, keySz, NULL, AES_ENCRYPTION);
wolfSSL 15:117db924cf7c 87 if (ret == 0) {
wolfSSL 15:117db924cf7c 88 byte l[AES_BLOCK_SIZE];
wolfSSL 15:117db924cf7c 89
wolfSSL 15:117db924cf7c 90 XMEMSET(l, 0, AES_BLOCK_SIZE);
wolfSSL 15:117db924cf7c 91 wc_AesEncryptDirect(&cmac->aes, l, l);
wolfSSL 15:117db924cf7c 92 ShiftAndXorRb(cmac->k1, l);
wolfSSL 15:117db924cf7c 93 ShiftAndXorRb(cmac->k2, cmac->k1);
wolfSSL 15:117db924cf7c 94 ForceZero(l, AES_BLOCK_SIZE);
wolfSSL 15:117db924cf7c 95 }
wolfSSL 15:117db924cf7c 96 return ret;
wolfSSL 15:117db924cf7c 97 }
wolfSSL 15:117db924cf7c 98
wolfSSL 15:117db924cf7c 99
wolfSSL 15:117db924cf7c 100 int wc_CmacUpdate(Cmac* cmac, const byte* in, word32 inSz)
wolfSSL 15:117db924cf7c 101 {
wolfSSL 15:117db924cf7c 102 if ((cmac == NULL) || (in == NULL && inSz != 0))
wolfSSL 15:117db924cf7c 103 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 104
wolfSSL 15:117db924cf7c 105 while (inSz != 0) {
wolfSSL 15:117db924cf7c 106 word32 add = min(inSz, AES_BLOCK_SIZE - cmac->bufferSz);
wolfSSL 15:117db924cf7c 107 XMEMCPY(&cmac->buffer[cmac->bufferSz], in, add);
wolfSSL 15:117db924cf7c 108
wolfSSL 15:117db924cf7c 109 cmac->bufferSz += add;
wolfSSL 15:117db924cf7c 110 in += add;
wolfSSL 15:117db924cf7c 111 inSz -= add;
wolfSSL 15:117db924cf7c 112
wolfSSL 15:117db924cf7c 113 if (cmac->bufferSz == AES_BLOCK_SIZE && inSz != 0) {
wolfSSL 15:117db924cf7c 114 if (cmac->totalSz != 0)
wolfSSL 15:117db924cf7c 115 xorbuf(cmac->buffer, cmac->digest, AES_BLOCK_SIZE);
wolfSSL 15:117db924cf7c 116 wc_AesEncryptDirect(&cmac->aes,
wolfSSL 15:117db924cf7c 117 cmac->digest,
wolfSSL 15:117db924cf7c 118 cmac->buffer);
wolfSSL 15:117db924cf7c 119 cmac->totalSz += AES_BLOCK_SIZE;
wolfSSL 15:117db924cf7c 120 cmac->bufferSz = 0;
wolfSSL 15:117db924cf7c 121 }
wolfSSL 15:117db924cf7c 122 }
wolfSSL 15:117db924cf7c 123
wolfSSL 15:117db924cf7c 124 return 0;
wolfSSL 15:117db924cf7c 125 }
wolfSSL 15:117db924cf7c 126
wolfSSL 15:117db924cf7c 127
wolfSSL 15:117db924cf7c 128 int wc_CmacFinal(Cmac* cmac, byte* out, word32* outSz)
wolfSSL 15:117db924cf7c 129 {
wolfSSL 15:117db924cf7c 130 const byte* subKey;
wolfSSL 15:117db924cf7c 131
wolfSSL 15:117db924cf7c 132 if (cmac == NULL || out == NULL || outSz == NULL)
wolfSSL 15:117db924cf7c 133 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 134
wolfSSL 15:117db924cf7c 135 if (*outSz < WC_CMAC_TAG_MIN_SZ || *outSz > WC_CMAC_TAG_MAX_SZ)
wolfSSL 15:117db924cf7c 136 return BUFFER_E;
wolfSSL 15:117db924cf7c 137
wolfSSL 15:117db924cf7c 138 if (cmac->bufferSz == AES_BLOCK_SIZE) {
wolfSSL 15:117db924cf7c 139 subKey = cmac->k1;
wolfSSL 15:117db924cf7c 140 }
wolfSSL 15:117db924cf7c 141 else {
wolfSSL 15:117db924cf7c 142 word32 remainder = AES_BLOCK_SIZE - cmac->bufferSz;
wolfSSL 15:117db924cf7c 143
wolfSSL 15:117db924cf7c 144 if (remainder == 0)
wolfSSL 15:117db924cf7c 145 remainder = AES_BLOCK_SIZE;
wolfSSL 15:117db924cf7c 146
wolfSSL 15:117db924cf7c 147 if (remainder > 1)
wolfSSL 15:117db924cf7c 148 XMEMSET(cmac->buffer + AES_BLOCK_SIZE - remainder, 0, remainder);
wolfSSL 15:117db924cf7c 149 cmac->buffer[AES_BLOCK_SIZE - remainder] = 0x80;
wolfSSL 15:117db924cf7c 150 subKey = cmac->k2;
wolfSSL 15:117db924cf7c 151 }
wolfSSL 15:117db924cf7c 152 xorbuf(cmac->buffer, cmac->digest, AES_BLOCK_SIZE);
wolfSSL 15:117db924cf7c 153 xorbuf(cmac->buffer, subKey, AES_BLOCK_SIZE);
wolfSSL 15:117db924cf7c 154 wc_AesEncryptDirect(&cmac->aes, cmac->digest, cmac->buffer);
wolfSSL 15:117db924cf7c 155
wolfSSL 15:117db924cf7c 156 XMEMCPY(out, cmac->digest, *outSz);
wolfSSL 15:117db924cf7c 157
wolfSSL 15:117db924cf7c 158 ForceZero(cmac, sizeof(Cmac));
wolfSSL 15:117db924cf7c 159
wolfSSL 15:117db924cf7c 160 return 0;
wolfSSL 15:117db924cf7c 161 }
wolfSSL 15:117db924cf7c 162
wolfSSL 15:117db924cf7c 163
wolfSSL 15:117db924cf7c 164 int wc_AesCmacGenerate(byte* out, word32* outSz,
wolfSSL 15:117db924cf7c 165 const byte* in, word32 inSz,
wolfSSL 15:117db924cf7c 166 const byte* key, word32 keySz)
wolfSSL 15:117db924cf7c 167 {
wolfSSL 15:117db924cf7c 168 Cmac cmac;
wolfSSL 15:117db924cf7c 169 int ret;
wolfSSL 15:117db924cf7c 170
wolfSSL 15:117db924cf7c 171 if (out == NULL || (in == NULL && inSz > 0) || key == NULL || keySz == 0)
wolfSSL 15:117db924cf7c 172 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 173
wolfSSL 15:117db924cf7c 174 ret = wc_InitCmac(&cmac, key, keySz, WC_CMAC_AES, NULL);
wolfSSL 15:117db924cf7c 175 if (ret != 0)
wolfSSL 15:117db924cf7c 176 return ret;
wolfSSL 15:117db924cf7c 177
wolfSSL 15:117db924cf7c 178 ret = wc_CmacUpdate(&cmac, in, inSz);
wolfSSL 15:117db924cf7c 179 if (ret != 0)
wolfSSL 15:117db924cf7c 180 return ret;
wolfSSL 15:117db924cf7c 181
wolfSSL 15:117db924cf7c 182 ret = wc_CmacFinal(&cmac, out, outSz);
wolfSSL 15:117db924cf7c 183 if (ret != 0)
wolfSSL 15:117db924cf7c 184 return ret;
wolfSSL 15:117db924cf7c 185
wolfSSL 15:117db924cf7c 186 return 0;
wolfSSL 15:117db924cf7c 187 }
wolfSSL 15:117db924cf7c 188
wolfSSL 15:117db924cf7c 189
wolfSSL 15:117db924cf7c 190 int wc_AesCmacVerify(const byte* check, word32 checkSz,
wolfSSL 15:117db924cf7c 191 const byte* in, word32 inSz,
wolfSSL 15:117db924cf7c 192 const byte* key, word32 keySz)
wolfSSL 15:117db924cf7c 193 {
wolfSSL 15:117db924cf7c 194 byte a[AES_BLOCK_SIZE];
wolfSSL 15:117db924cf7c 195 word32 aSz = sizeof(a);
wolfSSL 15:117db924cf7c 196 int result;
wolfSSL 15:117db924cf7c 197 int compareRet;
wolfSSL 15:117db924cf7c 198
wolfSSL 15:117db924cf7c 199 if (check == NULL || checkSz == 0 || (in == NULL && inSz != 0) ||
wolfSSL 15:117db924cf7c 200 key == NULL || keySz == 0)
wolfSSL 15:117db924cf7c 201
wolfSSL 15:117db924cf7c 202 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 203
wolfSSL 15:117db924cf7c 204 XMEMSET(a, 0, aSz);
wolfSSL 15:117db924cf7c 205 result = wc_AesCmacGenerate(a, &aSz, in, inSz, key, keySz);
wolfSSL 15:117db924cf7c 206 compareRet = ConstantCompare(check, a, min(checkSz, aSz));
wolfSSL 15:117db924cf7c 207
wolfSSL 15:117db924cf7c 208 if (result == 0)
wolfSSL 15:117db924cf7c 209 result = compareRet ? 1 : 0;
wolfSSL 15:117db924cf7c 210
wolfSSL 15:117db924cf7c 211 return result;
wolfSSL 15:117db924cf7c 212 }
wolfSSL 15:117db924cf7c 213
wolfSSL 15:117db924cf7c 214
wolfSSL 15:117db924cf7c 215 #endif /* WOLFSSL_CMAC && NO_AES && WOLFSSL_AES_DIRECT */
wolfSSL 15:117db924cf7c 216