From 1cd7a5032a7647b9e1559e46f828ebb13458fe3a Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 8 Sep 2012 23:48:08 +0300 Subject: [PATCH] Move AES-GCM implementation into src/crypto This is a generic AES GCM and GMAC implementation that can be used for other purposes than just implementing GCMP, so it fits better in a separate file in src/crypto. Signed-hostap: Jouni Malinen --- src/crypto/Makefile | 1 + src/crypto/aes-gcm.c | 291 ++++++++++++++++++++++++++++++++++++++++++ src/crypto/aes_wrap.h | 11 +- wlantest/gcmp.c | 285 +---------------------------------------- 4 files changed, 305 insertions(+), 283 deletions(-) create mode 100644 src/crypto/aes-gcm.c diff --git a/src/crypto/Makefile b/src/crypto/Makefile index 18b50548a..1b7bb398d 100644 --- a/src/crypto/Makefile +++ b/src/crypto/Makefile @@ -19,6 +19,7 @@ LIB_OBJS= \ aes-ctr.o \ aes-eax.o \ aes-encblock.o \ + aes-gcm.o \ aes-internal.o \ aes-internal-dec.o \ aes-internal-enc.o \ diff --git a/src/crypto/aes-gcm.c b/src/crypto/aes-gcm.c new file mode 100644 index 000000000..3c020e1cc --- /dev/null +++ b/src/crypto/aes-gcm.c @@ -0,0 +1,291 @@ +/* + * Galois/Counter Mode (GCM) and GMAC with AES-128 + * + * Copyright (c) 2012, Jouni Malinen + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + */ + +#include "includes.h" + +#include "common.h" +#include "aes.h" +#include "aes_wrap.h" + +static void inc32(u8 *block) +{ + u32 val; + val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4); + val++; + WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val); +} + + +static void xor_block(u8 *dst, const u8 *src) +{ + u32 *d = (u32 *) dst; + u32 *s = (u32 *) src; + *d++ ^= *s++; + *d++ ^= *s++; + *d++ ^= *s++; + *d++ ^= *s++; +} + + +static void shift_right_block(u8 *v) +{ + u32 val; + + val = WPA_GET_BE32(v + 12); + val >>= 1; + if (v[11] & 0x01) + val |= 0x80000000; + WPA_PUT_BE32(v + 12, val); + + val = WPA_GET_BE32(v + 8); + val >>= 1; + if (v[7] & 0x01) + val |= 0x80000000; + WPA_PUT_BE32(v + 8, val); + + val = WPA_GET_BE32(v + 4); + val >>= 1; + if (v[3] & 0x01) + val |= 0x80000000; + WPA_PUT_BE32(v + 4, val); + + val = WPA_GET_BE32(v); + val >>= 1; + WPA_PUT_BE32(v, val); +} + + +/* Multiplication in GF(2^128) */ +static void gf_mult(const u8 *x, const u8 *y, u8 *z) +{ + u8 v[16]; + int i, j; + + os_memset(z, 0, 16); /* Z_0 = 0^128 */ + os_memcpy(v, y, 16); /* V_0 = Y */ + + for (i = 0; i < 16; i++) { + for (j = 0; j < 8; j++) { + if (x[i] & BIT(7 - j)) { + /* Z_(i + 1) = Z_i XOR V_i */ + xor_block(z, v); + } else { + /* Z_(i + 1) = Z_i */ + } + + if (v[15] & 0x01) { + /* V_(i + 1) = (V_i >> 1) XOR R */ + shift_right_block(v); + /* R = 11100001 || 0^120 */ + v[0] ^= 0xe1; + } else { + /* V_(i + 1) = V_i >> 1 */ + shift_right_block(v); + } + } + } +} + + +static void ghash_start(u8 *y) +{ + /* Y_0 = 0^128 */ + os_memset(y, 0, 16); +} + + +static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y) +{ + size_t m, i; + const u8 *xpos = x; + u8 tmp[16]; + + m = xlen / 16; + + for (i = 0; i < m; i++) { + /* Y_i = (Y^(i-1) XOR X_i) dot H */ + xor_block(y, xpos); + xpos += 16; + + /* dot operation: + * multiplication operation for binary Galois (finite) field of + * 2^128 elements */ + gf_mult(y, h, tmp); + os_memcpy(y, tmp, 16); + } + + if (x + xlen > xpos) { + /* Add zero padded last block */ + size_t last = x + xlen - xpos; + os_memcpy(tmp, xpos, last); + os_memset(tmp + last, 0, sizeof(tmp) - last); + + /* Y_i = (Y^(i-1) XOR X_i) dot H */ + xor_block(y, tmp); + + /* dot operation: + * multiplication operation for binary Galois (finite) field of + * 2^128 elements */ + gf_mult(y, h, tmp); + os_memcpy(y, tmp, 16); + } + + /* Return Y_m */ +} + + +static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y) +{ + size_t i, n, last; + u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE]; + const u8 *xpos = x; + u8 *ypos = y; + + if (xlen == 0) + return; + + n = xlen / 16; + + os_memcpy(cb, icb, AES_BLOCK_SIZE); + /* Full blocks */ + for (i = 0; i < n; i++) { + aes_encrypt(aes, cb, ypos); + xor_block(ypos, xpos); + xpos += AES_BLOCK_SIZE; + ypos += AES_BLOCK_SIZE; + inc32(cb); + } + + last = x + xlen - xpos; + if (last) { + /* Last, partial block */ + aes_encrypt(aes, cb, tmp); + for (i = 0; i < last; i++) + *ypos++ = *xpos++ ^ tmp[i]; + } +} + + +/** + * aes_128_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96 + */ +int aes_128_gcm_ae(const u8 *key, const u8 *iv, + const u8 *plain, size_t plain_len, + const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag) +{ + u8 H[AES_BLOCK_SIZE]; + u8 J0[AES_BLOCK_SIZE]; + u8 S[16], len_buf[16]; + void *aes; + size_t iv_len = 12; + + aes = aes_encrypt_init(key, 16); + if (aes == NULL) + return -1; + + /* 1. Generate hash subkey H = AES_K(0^128) */ + os_memset(H, 0, sizeof(H)); + aes_encrypt(aes, H, H); + wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); + + /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ + os_memcpy(J0, iv, iv_len); + os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); + J0[AES_BLOCK_SIZE - 1] = 0x01; + + /* 3. C = GCTR_K(inc_32(J_0), P) */ + inc32(J0); + aes_gctr(aes, J0, plain, plain_len, crypt); + + /* + * 4. u = 128 * ceil[len(C)/128] - len(C) + * v = 128 * ceil[len(A)/128] - len(A) + * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) + * (i.e., zero padded to block size A || C and lengths of each in bits) + */ + ghash_start(S); + ghash(H, aad, aad_len, S); + ghash(H, crypt, plain_len, S); + WPA_PUT_BE64(len_buf, aad_len * 8); + WPA_PUT_BE64(len_buf + 8, plain_len * 8); + ghash(H, len_buf, sizeof(len_buf), S); + + wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); + + /* 6. T = MSB_t(GCTR_K(J_0, S)) */ + J0[AES_BLOCK_SIZE - 1] = 0x01; + aes_gctr(aes, J0, S, sizeof(S), tag); + + /* 7. Return (C, T) */ + + aes_encrypt_deinit(aes); + + return 0; +} + + +/** + * aes_128_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96 + */ +int aes_128_gcm_ad(const u8 *key, const u8 *iv, + const u8 *crypt, size_t crypt_len, + const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain) +{ + u8 H[AES_BLOCK_SIZE]; + u8 J0[AES_BLOCK_SIZE]; + u8 S[16], T[16], len_buf[16]; + void *aes; + size_t iv_len = 12; + + aes = aes_encrypt_init(key, 16); + if (aes == NULL) + return -1; + + /* 2. Generate hash subkey H = AES_K(0^128) */ + os_memset(H, 0, sizeof(H)); + aes_encrypt(aes, H, H); + wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); + + /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ + os_memcpy(J0, iv, iv_len); + os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); + J0[AES_BLOCK_SIZE - 1] = 0x01; + + /* 4. C = GCTR_K(inc_32(J_0), C) */ + inc32(J0); + aes_gctr(aes, J0, crypt, crypt_len, plain); + + /* + * 5. u = 128 * ceil[len(C)/128] - len(C) + * v = 128 * ceil[len(A)/128] - len(A) + * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) + * (i.e., zero padded to block size A || C and lengths of each in bits) + */ + ghash_start(S); + ghash(H, aad, aad_len, S); + ghash(H, crypt, crypt_len, S); + WPA_PUT_BE64(len_buf, aad_len * 8); + WPA_PUT_BE64(len_buf + 8, crypt_len * 8); + ghash(H, len_buf, sizeof(len_buf), S); + + wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); + + /* 7. T' = MSB_t(GCTR_K(J_0, S)) */ + J0[AES_BLOCK_SIZE - 1] = 0x01; + aes_gctr(aes, J0, S, sizeof(S), T); + + aes_encrypt_deinit(aes); + + if (os_memcmp(tag, T, 16) != 0) { + wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch"); + return -1; + } + + return 0; +} diff --git a/src/crypto/aes_wrap.h b/src/crypto/aes_wrap.h index 4791792b9..3ed07d594 100644 --- a/src/crypto/aes_wrap.h +++ b/src/crypto/aes_wrap.h @@ -6,8 +6,9 @@ * - AES-128 CTR mode encryption * - AES-128 EAX mode encryption/decryption * - AES-128 CBC + * - AES-128 GCM * - * Copyright (c) 2003-2007, Jouni Malinen + * Copyright (c) 2003-2012, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. @@ -38,5 +39,13 @@ int __must_check aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len); int __must_check aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len); +int __must_check aes_128_gcm_ae(const u8 *key, const u8 *iv, + const u8 *plain, size_t plain_len, + const u8 *aad, size_t aad_len, + u8 *crypt, u8 *tag); +int __must_check aes_128_gcm_ad(const u8 *key, const u8 *iv, + const u8 *crypt, size_t crypt_len, + const u8 *aad, size_t aad_len, const u8 *tag, + u8 *plain); #endif /* AES_WRAP_H */ diff --git a/wlantest/gcmp.c b/wlantest/gcmp.c index 935c1767e..07c98c768 100644 --- a/wlantest/gcmp.c +++ b/wlantest/gcmp.c @@ -11,289 +11,10 @@ #include "utils/common.h" #include "common/ieee802_11_defs.h" #include "crypto/aes.h" +#include "crypto/aes_wrap.h" #include "wlantest.h" -static void inc32(u8 *block) -{ - u32 val; - val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4); - val++; - WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val); -} - - -static void xor_block(u8 *dst, const u8 *src) -{ - u32 *d = (u32 *) dst; - u32 *s = (u32 *) src; - *d++ ^= *s++; - *d++ ^= *s++; - *d++ ^= *s++; - *d++ ^= *s++; -} - - -static void shift_right_block(u8 *v) -{ - u32 val; - - val = WPA_GET_BE32(v + 12); - val >>= 1; - if (v[11] & 0x01) - val |= 0x80000000; - WPA_PUT_BE32(v + 12, val); - - val = WPA_GET_BE32(v + 8); - val >>= 1; - if (v[7] & 0x01) - val |= 0x80000000; - WPA_PUT_BE32(v + 8, val); - - val = WPA_GET_BE32(v + 4); - val >>= 1; - if (v[3] & 0x01) - val |= 0x80000000; - WPA_PUT_BE32(v + 4, val); - - val = WPA_GET_BE32(v); - val >>= 1; - WPA_PUT_BE32(v, val); -} - - -/* Multiplication in GF(2^128) */ -static void gf_mult(const u8 *x, const u8 *y, u8 *z) -{ - u8 v[16]; - int i, j; - - os_memset(z, 0, 16); /* Z_0 = 0^128 */ - os_memcpy(v, y, 16); /* V_0 = Y */ - - for (i = 0; i < 16; i++) { - for (j = 0; j < 8; j++) { - if (x[i] & BIT(7 - j)) { - /* Z_(i + 1) = Z_i XOR V_i */ - xor_block(z, v); - } else { - /* Z_(i + 1) = Z_i */ - } - - if (v[15] & 0x01) { - /* V_(i + 1) = (V_i >> 1) XOR R */ - shift_right_block(v); - /* R = 11100001 || 0^120 */ - v[0] ^= 0xe1; - } else { - /* V_(i + 1) = V_i >> 1 */ - shift_right_block(v); - } - } - } -} - - -static void ghash_start(u8 *y) -{ - /* Y_0 = 0^128 */ - os_memset(y, 0, 16); -} - - -static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y) -{ - size_t m, i; - const u8 *xpos = x; - u8 tmp[16]; - - m = xlen / 16; - - for (i = 0; i < m; i++) { - /* Y_i = (Y^(i-1) XOR X_i) dot H */ - xor_block(y, xpos); - xpos += 16; - - /* dot operation: - * multiplication operation for binary Galois (finite) field of - * 2^128 elements */ - gf_mult(y, h, tmp); - os_memcpy(y, tmp, 16); - } - - if (x + xlen > xpos) { - /* Add zero padded last block */ - size_t last = x + xlen - xpos; - os_memcpy(tmp, xpos, last); - os_memset(tmp + last, 0, sizeof(tmp) - last); - - /* Y_i = (Y^(i-1) XOR X_i) dot H */ - xor_block(y, tmp); - - /* dot operation: - * multiplication operation for binary Galois (finite) field of - * 2^128 elements */ - gf_mult(y, h, tmp); - os_memcpy(y, tmp, 16); - } - - /* Return Y_m */ -} - - -static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y) -{ - size_t i, n, last; - u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE]; - const u8 *xpos = x; - u8 *ypos = y; - - if (xlen == 0) - return; - - n = xlen / 16; - - os_memcpy(cb, icb, AES_BLOCK_SIZE); - /* Full blocks */ - for (i = 0; i < n; i++) { - aes_encrypt(aes, cb, ypos); - xor_block(ypos, xpos); - xpos += AES_BLOCK_SIZE; - ypos += AES_BLOCK_SIZE; - inc32(cb); - } - - last = x + xlen - xpos; - if (last) { - /* Last, partial block */ - aes_encrypt(aes, cb, tmp); - for (i = 0; i < last; i++) - *ypos++ = *xpos++ ^ tmp[i]; - } -} - - -/** - * aes_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96 - */ -static int aes_gcm_ae(const u8 *key, const u8 *iv, - const u8 *plain, size_t plain_len, - const u8 *aad, size_t aad_len, - u8 *crypt, u8 *tag) -{ - u8 H[AES_BLOCK_SIZE]; - u8 J0[AES_BLOCK_SIZE]; - u8 S[16], len_buf[16]; - void *aes; - size_t iv_len = 12; - - aes = aes_encrypt_init(key, 16); - if (aes == NULL) - return -1; - - /* 1. Generate hash subkey H = AES_K(0^128) */ - os_memset(H, 0, sizeof(H)); - aes_encrypt(aes, H, H); - wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); - - /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ - os_memcpy(J0, iv, iv_len); - os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); - J0[AES_BLOCK_SIZE - 1] = 0x01; - - /* 3. C = GCTR_K(inc_32(J_0), P) */ - inc32(J0); - aes_gctr(aes, J0, plain, plain_len, crypt); - - /* - * 4. u = 128 * ceil[len(C)/128] - len(C) - * v = 128 * ceil[len(A)/128] - len(A) - * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) - * (i.e., zero padded to block size A || C and lengths of each in bits) - */ - ghash_start(S); - ghash(H, aad, aad_len, S); - ghash(H, crypt, plain_len, S); - WPA_PUT_BE64(len_buf, aad_len * 8); - WPA_PUT_BE64(len_buf + 8, plain_len * 8); - ghash(H, len_buf, sizeof(len_buf), S); - - wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); - - /* 6. T = MSB_t(GCTR_K(J_0, S)) */ - J0[AES_BLOCK_SIZE - 1] = 0x01; - aes_gctr(aes, J0, S, sizeof(S), tag); - - /* 7. Return (C, T) */ - - aes_encrypt_deinit(aes); - - return 0; -} - - -/** - * aes_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96 - */ -static int aes_gcm_ad(const u8 *key, const u8 *iv, - const u8 *crypt, size_t crypt_len, - const u8 *aad, size_t aad_len, const u8 *tag, - u8 *plain) -{ - u8 H[AES_BLOCK_SIZE]; - u8 J0[AES_BLOCK_SIZE]; - u8 S[16], T[16], len_buf[16]; - void *aes; - size_t iv_len = 12; - - aes = aes_encrypt_init(key, 16); - if (aes == NULL) - return -1; - - /* 2. Generate hash subkey H = AES_K(0^128) */ - os_memset(H, 0, sizeof(H)); - aes_encrypt(aes, H, H); - wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); - - /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ - os_memcpy(J0, iv, iv_len); - os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); - J0[AES_BLOCK_SIZE - 1] = 0x01; - - /* 4. C = GCTR_K(inc_32(J_0), C) */ - inc32(J0); - aes_gctr(aes, J0, crypt, crypt_len, plain); - - /* - * 5. u = 128 * ceil[len(C)/128] - len(C) - * v = 128 * ceil[len(A)/128] - len(A) - * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) - * (i.e., zero padded to block size A || C and lengths of each in bits) - */ - ghash_start(S); - ghash(H, aad, aad_len, S); - ghash(H, crypt, crypt_len, S); - WPA_PUT_BE64(len_buf, aad_len * 8); - WPA_PUT_BE64(len_buf + 8, crypt_len * 8); - ghash(H, len_buf, sizeof(len_buf), S); - - wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); - - /* 7. T' = MSB_t(GCTR_K(J_0, S)) */ - J0[AES_BLOCK_SIZE - 1] = 0x01; - aes_gctr(aes, J0, S, sizeof(S), T); - - aes_encrypt_deinit(aes); - - if (os_memcmp(tag, T, 16) != 0) { - wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch"); - return -1; - } - - return 0; -} - - static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data, u8 *aad, size_t *aad_len, u8 *nonce) { @@ -374,7 +95,7 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len); wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce)); - if (aes_gcm_ad(tk, nonce, m, mlen, aad, aad_len, m + mlen, plain) < + if (aes_128_gcm_ad(tk, nonce, m, mlen, aad, aad_len, m + mlen, plain) < 0) { u16 seq_ctrl = le_to_host16(hdr->seq_ctrl); wpa_printf(MSG_INFO, "Invalid GCMP frame: A1=" MACSTR @@ -425,7 +146,7 @@ u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos, wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len); wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce)); - if (aes_gcm_ae(tk, nonce, frame + hdrlen, plen, aad, aad_len, + if (aes_128_gcm_ae(tk, nonce, frame + hdrlen, plen, aad, aad_len, pos, pos + plen) < 0) { os_free(crypt); return NULL;