DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

OpenSSL: CMAC using the OpenSSL library for non-FIPS cases as well

Browse source 
Commit 0b5e98557e ("FIPS: Use OpenSSL CMAC implementation instead of
aes-omac1.c") added this implementation initially only for the FIPS
builds. However, there does not seem to be any remaining need to avoid
depending on the OpenSSL library implementation for builds, so move to
that implementation unconditionally to reduce the binary size a bit.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2022-04-15 11:14:51 +03:00
parent 0c61f6234f
commit ae0f6ee97e
5 changed files with 8 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
hostapd/Android.mk
View file

@ -825,7 +825,9 @@ endif
ifdef NEED_AES_ENCBLOCK ifdef NEED_AES_ENCBLOCK
AESOBJS += src/crypto/aes-encblock.c AESOBJS += src/crypto/aes-encblock.c
endif endif
ifneq ($(CONFIG_TLS), openssl)
AESOBJS += src/crypto/aes-omac1.c AESOBJS += src/crypto/aes-omac1.c
endif
ifdef NEED_AES_UNWRAP ifdef NEED_AES_UNWRAP
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
NEED_AES_DEC=y NEED_AES_DEC=y

2
hostapd/Makefile
View file

@ -932,11 +932,13 @@ endif
ifdef NEED_AES_ENCBLOCK ifdef NEED_AES_ENCBLOCK
AESOBJS += ../src/crypto/aes-encblock.o AESOBJS += ../src/crypto/aes-encblock.o
endif endif
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux) ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl) ifneq ($(CONFIG_TLS), wolfssl)
AESOBJS += ../src/crypto/aes-omac1.o AESOBJS += ../src/crypto/aes-omac1.o
endif endif
endif endif
endif
ifdef NEED_AES_UNWRAP ifdef NEED_AES_UNWRAP
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux) ifneq ($(CONFIG_TLS), linux)

7
src/crypto/crypto_openssl.c
View file

@ -16,9 +16,6 @@
#include <openssl/dh.h> #include <openssl/dh.h>
#include <openssl/hmac.h> #include <openssl/hmac.h>
#include <openssl/rand.h> #include <openssl/rand.h>
#ifdef CONFIG_OPENSSL_CMAC
#include <openssl/cmac.h>
#endif /* CONFIG_OPENSSL_CMAC */
#ifdef CONFIG_ECC #ifdef CONFIG_ECC
#include <openssl/ec.h> #include <openssl/ec.h>
#include <openssl/x509.h> #include <openssl/x509.h>
@ -28,6 +25,8 @@
#include <openssl/provider.h> #include <openssl/provider.h>
#include <openssl/core_names.h> #include <openssl/core_names.h>
#include <openssl/param_build.h> #include <openssl/param_build.h>
#else /* OpenSSL version >= 3.0 */
#include <openssl/cmac.h>
#endif /* OpenSSL version >= 3.0 */ #endif /* OpenSSL version >= 3.0 */
#include "common.h" #include "common.h"
@ -1739,7 +1738,6 @@ int crypto_get_random(void *buf, size_t len)
} }
#ifdef CONFIG_OPENSSL_CMAC
int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem, int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem,
const u8 *addr[], const size_t *len, u8 *mac) const u8 *addr[], const size_t *len, u8 *mac)
{ {
@ -1838,7 +1836,6 @@ int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
{ {
return omac1_aes_vector(key, 32, 1, &data, &data_len, mac); return omac1_aes_vector(key, 32, 1, &data, &data_len, mac);
} }
#endif /* CONFIG_OPENSSL_CMAC */
struct crypto_bignum * crypto_bignum_init(void) struct crypto_bignum * crypto_bignum_init(void)

5
wpa_supplicant/Android.mk
View file

@ -86,7 +86,6 @@ endif
ifdef CONFIG_FIPS ifdef CONFIG_FIPS
CONFIG_NO_RANDOM_POOL= CONFIG_NO_RANDOM_POOL=
CONFIG_OPENSSL_CMAC=y
endif endif
OBJS = config.c OBJS = config.c
@ -1268,9 +1267,7 @@ ifdef NEED_AES_ENCBLOCK
AESOBJS += src/crypto/aes-encblock.c AESOBJS += src/crypto/aes-encblock.c
endif endif
NEED_AES_ENC=y NEED_AES_ENC=y
ifdef CONFIG_OPENSSL_CMAC ifneq ($(CONFIG_TLS), openssl)
L_CFLAGS += -DCONFIG_OPENSSL_CMAC
else
AESOBJS += src/crypto/aes-omac1.c AESOBJS += src/crypto/aes-omac1.c
endif endif
ifdef NEED_AES_WRAP ifdef NEED_AES_WRAP

5
wpa_supplicant/Makefile
View file

@ -84,7 +84,6 @@ endif
ifdef CONFIG_FIPS ifdef CONFIG_FIPS
CONFIG_NO_RANDOM_POOL= CONFIG_NO_RANDOM_POOL=
CONFIG_OPENSSL_CMAC=y
endif endif
OBJS = config.o OBJS = config.o
@ -1362,9 +1361,7 @@ ifdef NEED_AES_ENCBLOCK
AESOBJS += ../src/crypto/aes-encblock.o AESOBJS += ../src/crypto/aes-encblock.o
endif endif
NEED_AES_ENC=y NEED_AES_ENC=y
ifdef CONFIG_OPENSSL_CMAC ifneq ($(CONFIG_TLS), openssl)
CFLAGS += -DCONFIG_OPENSSL_CMAC
else
ifneq ($(CONFIG_TLS), linux) ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl) ifneq ($(CONFIG_TLS), wolfssl)
AESOBJS += ../src/crypto/aes-omac1.o AESOBJS += ../src/crypto/aes-omac1.o