1 /******************************************************************************
2 *
3 * Copyright 2008-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains the implementation of the AES128 and AES CMAC algorithm.
22 *
23 ******************************************************************************/
24
25 #include <algorithm>
26
27 #include "crypto_toolbox/aes.h"
28 #include "crypto_toolbox/crypto_toolbox.h"
29
30 namespace bluetooth {
31 namespace crypto_toolbox {
32
33 namespace {
34
35 typedef struct {
36 uint8_t* text;
37 uint16_t len;
38 uint16_t round;
39 } tCMAC_CB;
40
41 thread_local tCMAC_CB cmac_cb;
42
43 /* Rb for AES-128 as block cipher, LSB as [0] */
44 Octet16 const_Rb{0x87, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
45
46 /** utility function to do an biteise exclusive-OR of two bit strings of the
47 * length of OCTET16_LEN. Result is stored in first argument.
48 */
xor_128(Octet16 * a,const Octet16 & b)49 static void xor_128(Octet16* a, const Octet16& b) {
50 // CHECK(a);
51 uint8_t i, *aa = a->data();
52 const uint8_t* bb = b.data();
53
54 for (i = 0; i < OCTET16_LEN; i++) {
55 aa[i] = aa[i] ^ bb[i];
56 }
57 }
58 } // namespace
59
60 /* This function computes AES_128(key, message) */
aes_128(const Octet16 & key,const Octet16 & message)61 Octet16 aes_128(const Octet16& key, const Octet16& message) {
62 Octet16 key_reversed;
63 Octet16 message_reversed;
64 Octet16 output;
65
66 std::reverse_copy(key.begin(), key.end(), key_reversed.begin());
67 std::reverse_copy(message.begin(), message.end(), message_reversed.begin());
68
69 aes_context ctx;
70 aes_set_key(key_reversed.data(), key_reversed.size(), &ctx);
71 aes_encrypt(message_reversed.data(), output.data(), &ctx);
72
73 std::reverse(output.begin(), output.end());
74 return output;
75 }
76
77 /** utility function to padding the given text to be a 128 bits data. The
78 * parameter dest is input and output parameter, it must point to a
79 * OCTET16_LEN memory space; where include length bytes valid data. */
padding(Octet16 * dest,uint8_t length)80 static void padding(Octet16* dest, uint8_t length) {
81 uint8_t i, *p = dest->data();
82 /* original last block */
83 for (i = length; i < OCTET16_LEN; i++) p[OCTET16_LEN - i - 1] = (i == length) ? 0x80 : 0;
84 }
85
86 /** utility function to left shift one bit for a 128 bits value. */
leftshift_onebit(uint8_t * input,uint8_t * output)87 static void leftshift_onebit(uint8_t* input, uint8_t* output) {
88 uint8_t i, overflow = 0, next_overflow = 0;
89 /* input[0] is LSB */
90 for (i = 0; i < OCTET16_LEN; i++) {
91 next_overflow = (input[i] & 0x80) ? 1 : 0;
92 output[i] = (input[i] << 1) | overflow;
93 overflow = next_overflow;
94 }
95 return;
96 }
97
98 /** This function is the calculation of block cipher using AES-128. */
cmac_aes_k_calculate(const Octet16 & key)99 static Octet16 cmac_aes_k_calculate(const Octet16& key) {
100 Octet16 output;
101 Octet16 x{0}; // zero initialized
102
103 uint8_t i = 1;
104 while (i <= cmac_cb.round) {
105 /* Mi' := Mi (+) X */
106 xor_128((Octet16*)&cmac_cb.text[(cmac_cb.round - i) * OCTET16_LEN], x);
107
108 output = aes_128(key, &cmac_cb.text[(cmac_cb.round - i) * OCTET16_LEN], OCTET16_LEN);
109 x = output;
110 i++;
111 }
112
113 return output;
114 }
115
116 /** This function proceeed to prepare the last block of message Mn depending on
117 * the size of the message.
118 */
cmac_prepare_last_block(const Octet16 & k1,const Octet16 & k2)119 static void cmac_prepare_last_block(const Octet16& k1, const Octet16& k2) {
120 // uint8_t x[16] = {0};
121 bool flag;
122
123 /* last block is a complete block set flag to 1 */
124 flag = ((cmac_cb.len % OCTET16_LEN) == 0 && cmac_cb.len != 0) ? true : false;
125
126 if (flag) { /* last block is complete block */
127 xor_128((Octet16*)&cmac_cb.text[0], k1);
128 } else /* padding then xor with k2 */
129 {
130 padding((Octet16*)&cmac_cb.text[0], (uint8_t)(cmac_cb.len % 16));
131
132 xor_128((Octet16*)&cmac_cb.text[0], k2);
133 }
134 }
135
136 /** This is the function to generate the two subkeys.
137 * |key| is CMAC key, expect SRK when used by SMP.
138 */
cmac_generate_subkey(const Octet16 & key)139 static void cmac_generate_subkey(const Octet16& key) {
140 Octet16 zero{};
141 Octet16 p = aes_128(key, zero.data(), OCTET16_LEN);
142
143 Octet16 k1, k2;
144 uint8_t* pp = p.data();
145
146 /* If MSB(L) = 0, then K1 = L << 1 */
147 if ((pp[OCTET16_LEN - 1] & 0x80) != 0) {
148 /* Else K1 = ( L << 1 ) (+) Rb */
149 leftshift_onebit(pp, k1.data());
150 xor_128(&k1, const_Rb);
151 } else {
152 leftshift_onebit(pp, k1.data());
153 }
154
155 if ((k1[OCTET16_LEN - 1] & 0x80) != 0) {
156 /* K2 = (K1 << 1) (+) Rb */
157 leftshift_onebit(k1.data(), k2.data());
158 xor_128(&k2, const_Rb);
159 } else {
160 /* If MSB(K1) = 0, then K2 = K1 << 1 */
161 leftshift_onebit(k1.data(), k2.data());
162 }
163
164 cmac_prepare_last_block(k1, k2);
165 }
166
167 /** key - CMAC key in little endian order
168 * input - text to be signed in little endian byte order.
169 * length - length of the input in byte.
170 */
aes_cmac(const Octet16 & key,const uint8_t * input,uint16_t length)171 Octet16 aes_cmac(const Octet16& key, const uint8_t* input, uint16_t length) {
172 uint32_t len;
173 uint16_t diff;
174 /* n is number of rounds */
175 uint16_t n = (length + OCTET16_LEN - 1) / OCTET16_LEN;
176
177 if (n == 0) n = 1;
178 len = n * OCTET16_LEN;
179
180 /* allocate a memory space of multiple of 16 bytes to hold text */
181 cmac_cb.text = (uint8_t*)alloca(len);
182 cmac_cb.round = n;
183 diff = len - length;
184
185 if (input != NULL && length > 0) {
186 memcpy(&cmac_cb.text[diff], input, (int)length);
187 cmac_cb.len = length;
188 } else {
189 cmac_cb.len = 0;
190 }
191
192 /* prepare calculation for subkey s and last block of data */
193 cmac_generate_subkey(key);
194 /* start calculation */
195 Octet16 signature = cmac_aes_k_calculate(key);
196
197 /* clean up */
198 memset(&cmac_cb, 0, sizeof(tCMAC_CB));
199 // cmac_cb.text is auto-freed by alloca
200
201 return signature;
202 }
203
204 } // namespace crypto_toolbox
205 } // namespace bluetooth
206