1 /* $OpenBSD: key_wrap.c,v 1.5 2017/05/02 17:07:06 mikeb Exp $ */
2
3 /*-
4 * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 /*
20 * This code implements the AES Key Wrap algorithm described in RFC 3394.
21 */
22
23 #include <sys/param.h>
24 #include <sys/systm.h>
25
26 #include <crypto/aes.h>
27 #include <crypto/key_wrap.h>
28
29 static const u_int8_t IV[8] =
30 { 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6 };
31
32 void
aes_key_wrap_set_key(aes_key_wrap_ctx * ctx,const u_int8_t * K,size_t K_len)33 aes_key_wrap_set_key(aes_key_wrap_ctx *ctx, const u_int8_t *K, size_t K_len)
34 {
35 AES_Setkey(&ctx->ctx, K, K_len);
36 }
37
38 void
aes_key_wrap_set_key_wrap_only(aes_key_wrap_ctx * ctx,const u_int8_t * K,size_t K_len)39 aes_key_wrap_set_key_wrap_only(aes_key_wrap_ctx *ctx, const u_int8_t *K,
40 size_t K_len)
41 {
42 AES_Setkey(&ctx->ctx, K, K_len);
43 }
44
45 void
aes_key_wrap(aes_key_wrap_ctx * ctx,const u_int8_t * P,size_t n,u_int8_t * C)46 aes_key_wrap(aes_key_wrap_ctx *ctx, const u_int8_t *P, size_t n, u_int8_t *C)
47 {
48 u_int64_t B[2], t;
49 u_int8_t *A, *R;
50 size_t i;
51 int j;
52
53 memmove(C + 8, P, n * 8); /* P and C may overlap */
54 A = C; /* A points to C[0] */
55 memcpy(A, IV, 8); /* A = IV, an initial value */
56
57 for (j = 0, t = 1; j <= 5; j++) {
58 R = C + 8;
59 for (i = 1; i <= n; i++, t++) {
60 /* B = A | R[i] */
61 memcpy(&B[0], A, 8);
62 memcpy(&B[1], R, 8);
63 /* B = AES(K, B) */
64 AES_Encrypt(&ctx->ctx, (caddr_t)B, (caddr_t)B);
65 /* MSB(64, B) = MSB(64, B) ^ t */
66 B[0] ^= htobe64(t);
67 /* A = MSB(64, B) */
68 memcpy(A, &B[0], 8);
69 /* R[i] = LSB(64, B) */
70 memcpy(R, &B[1], 8);
71
72 R += 8;
73 }
74 }
75 explicit_bzero(B, sizeof B);
76 }
77
78 int
aes_key_unwrap(aes_key_wrap_ctx * ctx,const u_int8_t * C,u_int8_t * P,size_t n)79 aes_key_unwrap(aes_key_wrap_ctx *ctx, const u_int8_t *C, u_int8_t *P, size_t n)
80 {
81 u_int64_t B[2], t;
82 u_int8_t A[8], *R;
83 size_t i;
84 int j;
85
86 memcpy(A, C, 8); /* A = C[0] */
87 memmove(P, C + 8, n * 8); /* P and C may overlap */
88
89 for (j = 5, t = 6 * n; j >= 0; j--) {
90 R = P + (n - 1) * 8;
91 for (i = n; i >= 1; i--, t--) {
92 /* MSB(64, B) = A */
93 memcpy(&B[0], A, 8);
94 /* MSB(64, B) = MSB(64, B) ^ t */
95 B[0] ^= htobe64(t);
96 /* B = MSB(64, B) | R[i] */
97 memcpy(&B[1], R, 8);
98 /* B = AES-1(K, B) */
99 AES_Decrypt(&ctx->ctx, (caddr_t)B, (caddr_t)B);
100 /* A = MSB(64, B) */
101 memcpy(A, &B[0], 8);
102 /* R[i] = LSB(64, B) */
103 memcpy(R, &B[1], 8);
104
105 R -= 8;
106 }
107 }
108 explicit_bzero(B, sizeof B);
109
110 /* check that A is an appropriate initial value */
111 return timingsafe_bcmp(A, IV, 8) != 0;
112 }
113