1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Copyright (c) 2011 The Chromium OS Authors.
4  * (C) Copyright 2010 - 2011 NVIDIA Corporation <www.nvidia.com>
5  */
6 
7 #include <common.h>
8 #include <log.h>
9 #include <linux/errno.h>
10 #include "crypto.h"
11 #include "uboot_aes.h"
12 
13 static u8 zero_key[16];
14 
15 #define AES_CMAC_CONST_RB 0x87  /* from RFC 4493, Figure 2.2 */
16 
17 enum security_op {
18 	SECURITY_SIGN		= 1 << 0,	/* Sign the data */
19 	SECURITY_ENCRYPT	= 1 << 1,	/* Encrypt the data */
20 };
21 
22 /**
23  * Shift a vector left by one bit
24  *
25  * \param in	Input vector
26  * \param out	Output vector
27  * \param size	Length of vector in bytes
28  */
left_shift_vector(u8 * in,u8 * out,int size)29 static void left_shift_vector(u8 *in, u8 *out, int size)
30 {
31 	int carry = 0;
32 	int i;
33 
34 	for (i = size - 1; i >= 0; i--) {
35 		out[i] = (in[i] << 1) | carry;
36 		carry = in[i] >> 7;	/* get most significant bit */
37 	}
38 }
39 
40 /**
41  * Sign a block of data, putting the result into dst.
42  *
43  * \param key			Input AES key, length AES128_KEY_LENGTH
44  * \param key_schedule		Expanded key to use
45  * \param src			Source data of length 'num_aes_blocks' blocks
46  * \param dst			Destination buffer, length AES128_KEY_LENGTH
47  * \param num_aes_blocks	Number of AES blocks to encrypt
48  */
sign_object(u8 * key,u8 * key_schedule,u8 * src,u8 * dst,u32 num_aes_blocks)49 static void sign_object(u8 *key, u8 *key_schedule, u8 *src, u8 *dst,
50 			u32 num_aes_blocks)
51 {
52 	u8 tmp_data[AES128_KEY_LENGTH];
53 	u8 iv[AES128_KEY_LENGTH] = {0};
54 	u8 left[AES128_KEY_LENGTH];
55 	u8 k1[AES128_KEY_LENGTH];
56 	u8 *cbc_chain_data;
57 	unsigned i;
58 
59 	cbc_chain_data = zero_key;	/* Convenient array of 0's for IV */
60 
61 	/* compute K1 constant needed by AES-CMAC calculation */
62 	for (i = 0; i < AES128_KEY_LENGTH; i++)
63 		tmp_data[i] = 0;
64 
65 	aes_cbc_encrypt_blocks(AES128_KEY_LENGTH, key_schedule, iv,
66 			       tmp_data, left, 1);
67 
68 	left_shift_vector(left, k1, sizeof(left));
69 
70 	if ((left[0] >> 7) != 0) /* get MSB of L */
71 		k1[AES128_KEY_LENGTH - 1] ^= AES_CMAC_CONST_RB;
72 
73 	/* compute the AES-CMAC value */
74 	for (i = 0; i < num_aes_blocks; i++) {
75 		/* Apply the chain data */
76 		aes_apply_cbc_chain_data(cbc_chain_data, src, tmp_data);
77 
78 		/* for the final block, XOR K1 into the IV */
79 		if (i == num_aes_blocks - 1)
80 			aes_apply_cbc_chain_data(tmp_data, k1, tmp_data);
81 
82 		/* encrypt the AES block */
83 		aes_encrypt(AES128_KEY_LENGTH, tmp_data,
84 			    key_schedule, dst);
85 
86 		debug("sign_obj: block %d of %d\n", i, num_aes_blocks);
87 
88 		/* Update pointers for next loop. */
89 		cbc_chain_data = dst;
90 		src += AES128_KEY_LENGTH;
91 	}
92 }
93 
94 /**
95  * Encrypt and sign a block of data (depending on security mode).
96  *
97  * \param key		Input AES key, length AES128_KEY_LENGTH
98  * \param oper		Security operations mask to perform (enum security_op)
99  * \param src		Source data
100  * \param length	Size of source data
101  * \param sig_dst	Destination address for signature, AES128_KEY_LENGTH bytes
102  */
encrypt_and_sign(u8 * key,enum security_op oper,u8 * src,u32 length,u8 * sig_dst)103 static int encrypt_and_sign(u8 *key, enum security_op oper, u8 *src,
104 			    u32 length, u8 *sig_dst)
105 {
106 	u32 num_aes_blocks;
107 	u8 key_schedule[AES128_EXPAND_KEY_LENGTH];
108 	u8 iv[AES128_KEY_LENGTH] = {0};
109 
110 	debug("encrypt_and_sign: length = %d\n", length);
111 
112 	/*
113 	 * The only need for a key is for signing/checksum purposes, so
114 	 * if not encrypting, expand a key of 0s.
115 	 */
116 	aes_expand_key(oper & SECURITY_ENCRYPT ? key : zero_key,
117 		       AES128_KEY_LENGTH, key_schedule);
118 
119 	num_aes_blocks = (length + AES128_KEY_LENGTH - 1) / AES128_KEY_LENGTH;
120 
121 	if (oper & SECURITY_ENCRYPT) {
122 		/* Perform this in place, resulting in src being encrypted. */
123 		debug("encrypt_and_sign: begin encryption\n");
124 		aes_cbc_encrypt_blocks(AES128_KEY_LENGTH, key_schedule, iv, src,
125 				       src, num_aes_blocks);
126 		debug("encrypt_and_sign: end encryption\n");
127 	}
128 
129 	if (oper & SECURITY_SIGN) {
130 		/* encrypt the data, overwriting the result in signature. */
131 		debug("encrypt_and_sign: begin signing\n");
132 		sign_object(key, key_schedule, src, sig_dst, num_aes_blocks);
133 		debug("encrypt_and_sign: end signing\n");
134 	}
135 
136 	return 0;
137 }
138 
sign_data_block(u8 * source,unsigned length,u8 * signature)139 int sign_data_block(u8 *source, unsigned length, u8 *signature)
140 {
141 	return encrypt_and_sign(zero_key, SECURITY_SIGN, source,
142 				length, signature);
143 }
144