From 37c8fe2e3b3a9b893f89ec69b05acf7b80afe41b Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 8 Sep 2012 22:08:00 +0300 Subject: [PATCH] wlantest: Move GCM-AE and GCM-AD into separate functions This splits the more generic GCM operations from GCMP specific implementation. Signed-hostap: Jouni Malinen --- wlantest/gcmp.c | 345 ++++++++++++++++++++++++++---------------------- 1 file changed, 185 insertions(+), 160 deletions(-) diff --git a/wlantest/gcmp.c b/wlantest/gcmp.c index 27beea292..d1b54cec6 100644 --- a/wlantest/gcmp.c +++ b/wlantest/gcmp.c @@ -152,6 +152,179 @@ static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y) } +/** + * aes_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96 + */ +static int aes_gcm_ae(const u8 *key, const u8 *iv, + const u8 *plain, size_t plain_len, + const u8 *aad, size_t aad_len, + u8 *crypt, u8 *tag) +{ + u8 *auth, *apos; + u8 H[AES_BLOCK_SIZE]; + u8 J0[AES_BLOCK_SIZE]; + u8 S[16]; + void *aes; + size_t padlen; + size_t iv_len = 12; + + aes = aes_encrypt_init(key, 16); + if (aes == NULL) + return -1; + + /* 1. Generate hash subkey H = AES_K(0^128) */ + os_memset(H, 0, sizeof(H)); + aes_encrypt(aes, H, H); + wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); + + /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ + os_memcpy(J0, iv, iv_len); + os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); + J0[AES_BLOCK_SIZE - 1] = 0x01; + + /* 3. C = GCTR_K(inc_32(J_0), P) */ + inc32(J0); + aes_gctr(aes, J0, plain, plain_len, crypt); + + /* + * 4. u = 128 * ceil[len(C)/128] - len(C) + * v = 128 * ceil[len(A)/128] - len(A) + * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) + * (i.e., zero padded to block size A || C and lengths of each in bits) + */ + auth = os_malloc(32 + 16 + plain_len + 8 + 8); + if (auth == NULL) { + aes_encrypt_deinit(aes); + return -1; + } + + apos = auth; + + /* Zero-padded AAD */ + os_memcpy(apos, aad, aad_len); + apos += aad_len; + padlen = (16 - aad_len % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Zero-padded C */ + os_memcpy(apos, crypt, plain_len); + apos += plain_len; + padlen = (16 - plain_len % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Length of AAD and C in bits */ + WPA_PUT_BE64(apos, aad_len * 8); + apos += 8; + WPA_PUT_BE64(apos, plain_len * 8); + apos += 8; + + wpa_hexdump_key(MSG_EXCESSIVE, "GHASH_H input", auth, apos - auth); + ghash(H, auth, apos - auth, S); + wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); + os_free(auth); + + /* 6. T = MSB_t(GCTR_K(J_0, S)) */ + J0[AES_BLOCK_SIZE - 1] = 0x01; + aes_gctr(aes, J0, S, sizeof(S), tag); + + /* 7. Return (C, T) */ + + aes_encrypt_deinit(aes); + + return 0; +} + + +/** + * aes_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96 + */ +static int aes_gcm_ad(const u8 *key, const u8 *iv, + const u8 *crypt, size_t crypt_len, + const u8 *aad, size_t aad_len, const u8 *tag, + u8 *plain) +{ + u8 *auth, *apos; + u8 H[AES_BLOCK_SIZE]; + u8 J0[AES_BLOCK_SIZE]; + u8 S[16], T[16]; + void *aes; + size_t padlen; + size_t iv_len = 12; + + aes = aes_encrypt_init(key, 16); + if (aes == NULL) + return -1; + + /* 2. Generate hash subkey H = AES_K(0^128) */ + os_memset(H, 0, sizeof(H)); + aes_encrypt(aes, H, H); + wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); + + /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ + os_memcpy(J0, iv, iv_len); + os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len); + J0[AES_BLOCK_SIZE - 1] = 0x01; + + /* 4. C = GCTR_K(inc_32(J_0), C) */ + inc32(J0); + aes_gctr(aes, J0, crypt, crypt_len, plain); + + /* + * 5. u = 128 * ceil[len(C)/128] - len(C) + * v = 128 * ceil[len(A)/128] - len(A) + * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) + * (i.e., zero padded to block size A || C and lengths of each in bits) + */ + auth = os_malloc(32 + 16 + crypt_len + 8 + 8); + if (auth == NULL) { + aes_encrypt_deinit(aes); + return -1; + } + + apos = auth; + + /* Zero-padded AAD */ + os_memcpy(apos, aad, aad_len); + apos += aad_len; + padlen = (16 - aad_len % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Zero-padded C */ + os_memcpy(apos, crypt, crypt_len); + apos += crypt_len; + padlen = (16 - crypt_len % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Length of AAD and C in bits */ + WPA_PUT_BE64(apos, aad_len * 8); + apos += 8; + WPA_PUT_BE64(apos, crypt_len * 8); + apos += 8; + + wpa_hexdump(MSG_EXCESSIVE, "GHASH_H input", auth, apos - auth); + ghash(H, auth, apos - auth, S); + wpa_hexdump(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16); + os_free(auth); + + /* 7. T' = MSB_t(GCTR_K(J_0, S)) */ + J0[AES_BLOCK_SIZE - 1] = 0x01; + aes_gctr(aes, J0, S, sizeof(S), T); + + aes_encrypt_deinit(aes); + + if (os_memcmp(tag, T, 16) != 0) { + wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch"); + return -1; + } + + return 0; +} + + static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data, u8 *aad, size_t *aad_len, u8 *nonce) { @@ -213,12 +386,8 @@ static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data, u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, const u8 *data, size_t data_len, size_t *decrypted_len) { - u8 aad[2 + 30], nonce[12], *plain, *auth, *apos; - u8 H[AES_BLOCK_SIZE]; - u8 J0[AES_BLOCK_SIZE]; - u8 S[16], T[16]; - size_t aad_len, padlen, mlen; - void *aes; + u8 aad[2 + 30], nonce[12], *plain; + size_t aad_len, mlen; const u8 *m; if (data_len < 8 + 16) @@ -228,12 +397,6 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, if (plain == NULL) return NULL; - aes = aes_encrypt_init(tk, 16); - if (aes == NULL) { - os_free(plain); - return NULL; - } - m = data + 8; mlen = data_len - 8 - 16; @@ -243,86 +406,20 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", &aad[2], aad_len); wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce)); - /* GCM-AD_K(IV, C, A, T) - * - * IV = GCMP nonce - * A = AAD - * C | T = received frame - */ - - /* 2. Generate hash subkey H = AES_K(0^128) */ - os_memset(H, 0, sizeof(H)); - aes_encrypt(aes, H, H); - wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); - - /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ - os_memcpy(J0, nonce, sizeof(nonce)); - os_memset(J0 + sizeof(nonce), 0, AES_BLOCK_SIZE - sizeof(nonce)); - J0[AES_BLOCK_SIZE - 1] = 0x01; - - /* 4. C = GCTR_K(inc_32(J_0), C) */ - inc32(J0); - aes_gctr(aes, J0, m, mlen, plain); - - /* - * 5. u = 128 * ceil[len(C)/128] - len(C) - * v = 128 * ceil[len(A)/128] - len(A) - * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) - * (i.e., zero padded to block size A || C and lengths of each in bits) - */ - auth = os_malloc(32 + 16 + data_len - 16 + 8 + 8); - if (auth == NULL) { - os_free(plain); - return NULL; - } - - apos = auth; - - /* Zero-padded AAD */ - os_memcpy(apos, &aad[2], aad_len); - apos += aad_len; - padlen = (16 - aad_len % 16) % 16; - os_memset(apos, 0, padlen); - apos += padlen; - - /* Zero-padded C */ - os_memcpy(apos, m, mlen); - apos += mlen; - padlen = (16 - mlen % 16) % 16; - os_memset(apos, 0, padlen); - apos += padlen; - - /* Length of AAD and C in bits */ - WPA_PUT_BE64(apos, aad_len * 8); - apos += 8; - WPA_PUT_BE64(apos, mlen * 8); - apos += 8; - - wpa_hexdump(MSG_EXCESSIVE, "GCMP GHASH_H input", auth, apos - auth); - ghash(H, auth, apos - auth, S); - wpa_hexdump(MSG_EXCESSIVE, "GCMP S = GHASH_H(...)", S, 16); - os_free(auth); - - /* 7. T' = MSB_t(GCTR_K(J_0, S)) */ - J0[AES_BLOCK_SIZE - 1] = 0x01; - aes_gctr(aes, J0, S, sizeof(S), T); - - aes_encrypt_deinit(aes); - - if (os_memcmp(data + data_len - 16, T, 16) != 0) { + if (aes_gcm_ad(tk, nonce, m, mlen, &aad[2], aad_len, m + mlen, plain) < + 0) { u16 seq_ctrl = le_to_host16(hdr->seq_ctrl); - wpa_printf(MSG_INFO, "Invalid GCMP MIC in frame: A1=" MACSTR + wpa_printf(MSG_INFO, "Invalid GCMP frame: A1=" MACSTR " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u", MAC2STR(hdr->addr1), MAC2STR(hdr->addr2), MAC2STR(hdr->addr3), WLAN_GET_SEQ_SEQ(seq_ctrl), WLAN_GET_SEQ_FRAG(seq_ctrl)); - wpa_hexdump(MSG_DEBUG, "GCMP decrypted", plain, data_len - 16); os_free(plain); return NULL; } - *decrypted_len = data_len - 8 - 16; + *decrypted_len = mlen; return plain; } @@ -330,13 +427,9 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos, u8 *pn, int keyid, size_t *encrypted_len) { - u8 aad[2 + 30], nonce[12], *crypt, *pos, *auth, *apos; - u8 H[AES_BLOCK_SIZE]; - u8 J0[AES_BLOCK_SIZE]; - u8 S[16]; - size_t aad_len, plen, padlen; + u8 aad[2 + 30], nonce[12], *crypt, *pos; + size_t aad_len, plen; struct ieee80211_hdr *hdr; - void *aes; if (len < hdrlen || hdrlen < 24) return NULL; @@ -359,88 +452,20 @@ u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos, *pos++ = pn[1]; /* PN4 */ *pos++ = pn[0]; /* PN5 */ - aes = aes_encrypt_init(tk, 16); - if (aes == NULL) { - os_free(crypt); - return NULL; - } - os_memset(aad, 0, sizeof(aad)); gcmp_aad_nonce(hdr, crypt + hdrlen, &aad[2], &aad_len, nonce); WPA_PUT_BE16(aad, aad_len); wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", &aad[2], aad_len); wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce)); - /* GCM-AE_K(IV, P, A) - * - * IV = GCMP nonce - * A = AAD - */ - - /* 1. Generate hash subkey H = AES_K(0^128) */ - os_memset(H, 0, sizeof(H)); - aes_encrypt(aes, H, H); - wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); - - /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ - os_memcpy(J0, nonce, sizeof(nonce)); - os_memset(J0 + sizeof(nonce), 0, AES_BLOCK_SIZE - sizeof(nonce)); - J0[AES_BLOCK_SIZE - 1] = 0x01; - - /* 3. C = GCTR_K(inc_32(J_0), P) */ - inc32(J0); - aes_gctr(aes, J0, frame + hdrlen, len - hdrlen, pos); - pos += len - hdrlen; - - /* - * 4. u = 128 * ceil[len(C)/128] - len(C) - * v = 128 * ceil[len(A)/128] - len(A) - * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) - * (i.e., zero padded to block size A || C and lengths of each in bits) - */ - auth = os_malloc(32 + 16 + len - hdrlen + 8 + 8); - if (auth == NULL) { + if (aes_gcm_ae(tk, nonce, frame + hdrlen, plen, &aad[2], aad_len, + pos, pos + plen) < 0) { os_free(crypt); return NULL; } - apos = auth; - - /* Zero-padded AAD */ - os_memcpy(apos, &aad[2], aad_len); - apos += aad_len; - padlen = (16 - aad_len % 16) % 16; - os_memset(apos, 0, padlen); - apos += padlen; - - /* Zero-padded C */ - os_memcpy(apos, crypt + hdrlen + 8, plen); - apos += plen; - padlen = (16 - plen % 16) % 16; - os_memset(apos, 0, padlen); - apos += padlen; - - /* Length of AAD and C in bits */ - WPA_PUT_BE64(apos, aad_len * 8); - apos += 8; - WPA_PUT_BE64(apos, plen * 8); - apos += 8; - - wpa_hexdump(MSG_EXCESSIVE, "GCMP GHASH_H input", auth, apos - auth); - ghash(H, auth, apos - auth, S); - wpa_hexdump(MSG_EXCESSIVE, "GCMP S = GHASH_H(...)", S, 16); - os_free(auth); - - /* 6. T = MSB_t(GCTR_K(J_0, S)) */ - J0[AES_BLOCK_SIZE - 1] = 0x01; - aes_gctr(aes, J0, S, sizeof(S), pos); - wpa_hexdump(MSG_EXCESSIVE, "GCMP MIC", pos, 16); - - /* 7. Return (C, T) */ - - wpa_hexdump(MSG_EXCESSIVE, "GCMP encrypted", crypt + hdrlen + 8, plen); - - aes_encrypt_deinit(aes); + wpa_hexdump(MSG_EXCESSIVE, "GCMP MIC", pos + plen, 16); + wpa_hexdump(MSG_EXCESSIVE, "GCMP encrypted", pos, plen); *encrypted_len = hdrlen + 8 + plen + 16;