jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Share common GCM-AE and GCM-AD functionality

Browse source 
These operations are almost identical, so use common functions to
share the same implementation.

Signed-hostap: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2012-09-09 13:54:33 +03:00
parent 77b2c81275
commit f90a4542b4
1 changed files with 72 additions and 66 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

138
src/crypto/aes-gcm.c
View file

@ -172,29 +172,29 @@ static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
} }
/** static void * aes_gcm_init_hash_subkey(const u8 *key, size_t key_len, u8 *H)
* aes_gcm_ae - GCM-AE_K(IV, P, A)
*/
int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
const u8 *plain, size_t plain_len,
const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
{ {
u8 H[AES_BLOCK_SIZE];
u8 J0[AES_BLOCK_SIZE], J0inc[AES_BLOCK_SIZE];
u8 S[16], len_buf[16];
void *aes; void *aes;
aes = aes_encrypt_init(key, key_len); aes = aes_encrypt_init(key, key_len);
if (aes == NULL) if (aes == NULL)
return -1; return NULL;
/* 1. Generate hash subkey H = AES_K(0^128) */ /* Generate hash subkey H = AES_K(0^128) */
os_memset(H, 0, sizeof(H)); os_memset(H, 0, AES_BLOCK_SIZE);
aes_encrypt(aes, H, H); aes_encrypt(aes, H, H);
wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH",
H, AES_BLOCK_SIZE);
return aes;
}
static void aes_gcm_prepare_j0(const u8 *iv, size_t iv_len, const u8 *H, u8 *J0)
{
u8 len_buf[16];
if (iv_len == 12) { if (iv_len == 12) {
/* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ /* Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
os_memcpy(J0, iv, iv_len); os_memcpy(J0, iv, iv_len);
os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
J0[AES_BLOCK_SIZE - 1] = 0x01; J0[AES_BLOCK_SIZE - 1] = 0x01;
@ -209,31 +209,72 @@ int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
WPA_PUT_BE64(len_buf + 8, iv_len * 8); WPA_PUT_BE64(len_buf + 8, iv_len * 8);
ghash(H, len_buf, sizeof(len_buf), J0); ghash(H, len_buf, sizeof(len_buf), J0);
} }
}
static void aes_gcm_gctr(void *aes, const u8 *J0, const u8 *in, size_t len,
u8 *out)
{
u8 J0inc[AES_BLOCK_SIZE];
if (len == 0)
return;
/* 3. C = GCTR_K(inc_32(J_0), P) */
os_memcpy(J0inc, J0, AES_BLOCK_SIZE); os_memcpy(J0inc, J0, AES_BLOCK_SIZE);
inc32(J0inc); inc32(J0inc);
aes_gctr(aes, J0inc, plain, plain_len, crypt); aes_gctr(aes, J0inc, in, len, out);
}
static void aes_gcm_ghash(const u8 *H, const u8 *aad, size_t aad_len,
const u8 *crypt, size_t crypt_len, u8 *S)
{
u8 len_buf[16];
/* /*
* 4. u = 128 * ceil[len(C)/128] - len(C) * u = 128 * ceil[len(C)/128] - len(C)
* v = 128 * ceil[len(A)/128] - len(A) * v = 128 * ceil[len(A)/128] - len(A)
* 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) * S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
* (i.e., zero padded to block size A || C and lengths of each in bits) * (i.e., zero padded to block size A || C and lengths of each in bits)
*/ */
ghash_start(S); ghash_start(S);
ghash(H, aad, aad_len, S); ghash(H, aad, aad_len, S);
ghash(H, crypt, plain_len, S); ghash(H, crypt, crypt_len, S);
WPA_PUT_BE64(len_buf, aad_len * 8); WPA_PUT_BE64(len_buf, aad_len * 8);
WPA_PUT_BE64(len_buf + 8, plain_len * 8); WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
ghash(H, len_buf, sizeof(len_buf), S); ghash(H, len_buf, sizeof(len_buf), S);
wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
}
/* 6. T = MSB_t(GCTR_K(J_0, S)) */
/**
* aes_gcm_ae - GCM-AE_K(IV, P, A)
*/
int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
const u8 *plain, size_t plain_len,
const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
{
u8 H[AES_BLOCK_SIZE];
u8 J0[AES_BLOCK_SIZE];
u8 S[16];
void *aes;
aes = aes_gcm_init_hash_subkey(key, key_len, H);
if (aes == NULL)
return -1;
aes_gcm_prepare_j0(iv, iv_len, H, J0);
/* C = GCTR_K(inc_32(J_0), P) */
aes_gcm_gctr(aes, J0, plain, plain_len, crypt);
aes_gcm_ghash(H, aad, aad_len, crypt, plain_len, S);
/* T = MSB_t(GCTR_K(J_0, S)) */
aes_gctr(aes, J0, S, sizeof(S), tag); aes_gctr(aes, J0, S, sizeof(S), tag);
/* 7. Return (C, T) */ /* Return (C, T) */
aes_encrypt_deinit(aes); aes_encrypt_deinit(aes);
@ -249,57 +290,22 @@ int aes_gcm_ad(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain) const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain)
{ {
u8 H[AES_BLOCK_SIZE]; u8 H[AES_BLOCK_SIZE];
u8 J0[AES_BLOCK_SIZE], J0inc[AES_BLOCK_SIZE]; u8 J0[AES_BLOCK_SIZE];
u8 S[16], T[16], len_buf[16]; u8 S[16], T[16];
void *aes; void *aes;
aes = aes_encrypt_init(key, key_len); aes = aes_gcm_init_hash_subkey(key, key_len, H);
if (aes == NULL) if (aes == NULL)
return -1; return -1;
/* 2. Generate hash subkey H = AES_K(0^128) */ aes_gcm_prepare_j0(iv, iv_len, H, J0);
os_memset(H, 0, sizeof(H));
aes_encrypt(aes, H, H);
wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
if (iv_len == 12) { /* P = GCTR_K(inc_32(J_0), C) */
/* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ aes_gcm_gctr(aes, J0, crypt, crypt_len, plain);
os_memcpy(J0, iv, iv_len);
os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
J0[AES_BLOCK_SIZE - 1] = 0x01;
} else {
/*
* s = 128 * ceil(len(IV)/128) - len(IV)
* J_0 = GHASH_H(IV || 0^(s+64) || [len(IV)]_64)
*/
ghash_start(J0);
ghash(H, iv, iv_len, J0);
WPA_PUT_BE64(len_buf, 0);
WPA_PUT_BE64(len_buf + 8, iv_len * 8);
ghash(H, len_buf, sizeof(len_buf), J0);
}
/* 4. C = GCTR_K(inc_32(J_0), C) */ aes_gcm_ghash(H, aad, aad_len, crypt, crypt_len, S);
os_memcpy(J0inc, J0, AES_BLOCK_SIZE);
inc32(J0inc);
aes_gctr(aes, J0inc, crypt, crypt_len, plain);
/* /* T' = MSB_t(GCTR_K(J_0, S)) */
* 5. u = 128 * ceil[len(C)/128] - len(C)
* v = 128 * ceil[len(A)/128] - len(A)
* 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
* (i.e., zero padded to block size A || C and lengths of each in bits)
*/
ghash_start(S);
ghash(H, aad, aad_len, S);
ghash(H, crypt, crypt_len, S);
WPA_PUT_BE64(len_buf, aad_len * 8);
WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
ghash(H, len_buf, sizeof(len_buf), S);
wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
/* 7. T' = MSB_t(GCTR_K(J_0, S)) */
aes_gctr(aes, J0, S, sizeof(S), T); aes_gctr(aes, J0, S, sizeof(S), T);
aes_encrypt_deinit(aes); aes_encrypt_deinit(aes);