13ff40c12SJohn Marino /*
2*a1157835SDaniel Fojt * One-key CBC MAC (OMAC1) hash with AES
33ff40c12SJohn Marino *
43ff40c12SJohn Marino * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
53ff40c12SJohn Marino *
63ff40c12SJohn Marino * This software may be distributed under the terms of the BSD license.
73ff40c12SJohn Marino * See README for more details.
83ff40c12SJohn Marino */
93ff40c12SJohn Marino
103ff40c12SJohn Marino #include "includes.h"
113ff40c12SJohn Marino
123ff40c12SJohn Marino #include "common.h"
133ff40c12SJohn Marino #include "aes.h"
143ff40c12SJohn Marino #include "aes_wrap.h"
153ff40c12SJohn Marino
gf_mulx(u8 * pad)163ff40c12SJohn Marino static void gf_mulx(u8 *pad)
173ff40c12SJohn Marino {
183ff40c12SJohn Marino int i, carry;
193ff40c12SJohn Marino
203ff40c12SJohn Marino carry = pad[0] & 0x80;
213ff40c12SJohn Marino for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
223ff40c12SJohn Marino pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
233ff40c12SJohn Marino pad[AES_BLOCK_SIZE - 1] <<= 1;
243ff40c12SJohn Marino if (carry)
253ff40c12SJohn Marino pad[AES_BLOCK_SIZE - 1] ^= 0x87;
263ff40c12SJohn Marino }
273ff40c12SJohn Marino
283ff40c12SJohn Marino
293ff40c12SJohn Marino /**
30*a1157835SDaniel Fojt * omac1_aes_vector - One-Key CBC MAC (OMAC1) hash with AES
31*a1157835SDaniel Fojt * @key: Key for the hash operation
32*a1157835SDaniel Fojt * @key_len: Key length in octets
333ff40c12SJohn Marino * @num_elem: Number of elements in the data vector
343ff40c12SJohn Marino * @addr: Pointers to the data areas
353ff40c12SJohn Marino * @len: Lengths of the data blocks
363ff40c12SJohn Marino * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
373ff40c12SJohn Marino * Returns: 0 on success, -1 on failure
383ff40c12SJohn Marino *
393ff40c12SJohn Marino * This is a mode for using block cipher (AES in this case) for authentication.
403ff40c12SJohn Marino * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
413ff40c12SJohn Marino * (SP) 800-38B.
423ff40c12SJohn Marino */
omac1_aes_vector(const u8 * key,size_t key_len,size_t num_elem,const u8 * addr[],const size_t * len,u8 * mac)43*a1157835SDaniel Fojt int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem,
443ff40c12SJohn Marino const u8 *addr[], const size_t *len, u8 *mac)
453ff40c12SJohn Marino {
463ff40c12SJohn Marino void *ctx;
473ff40c12SJohn Marino u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
483ff40c12SJohn Marino const u8 *pos, *end;
493ff40c12SJohn Marino size_t i, e, left, total_len;
503ff40c12SJohn Marino
51*a1157835SDaniel Fojt if (TEST_FAIL())
52*a1157835SDaniel Fojt return -1;
53*a1157835SDaniel Fojt
54*a1157835SDaniel Fojt ctx = aes_encrypt_init(key, key_len);
553ff40c12SJohn Marino if (ctx == NULL)
563ff40c12SJohn Marino return -1;
573ff40c12SJohn Marino os_memset(cbc, 0, AES_BLOCK_SIZE);
583ff40c12SJohn Marino
593ff40c12SJohn Marino total_len = 0;
603ff40c12SJohn Marino for (e = 0; e < num_elem; e++)
613ff40c12SJohn Marino total_len += len[e];
623ff40c12SJohn Marino left = total_len;
633ff40c12SJohn Marino
643ff40c12SJohn Marino e = 0;
653ff40c12SJohn Marino pos = addr[0];
663ff40c12SJohn Marino end = pos + len[0];
673ff40c12SJohn Marino
683ff40c12SJohn Marino while (left >= AES_BLOCK_SIZE) {
693ff40c12SJohn Marino for (i = 0; i < AES_BLOCK_SIZE; i++) {
703ff40c12SJohn Marino cbc[i] ^= *pos++;
713ff40c12SJohn Marino if (pos >= end) {
72*a1157835SDaniel Fojt /*
73*a1157835SDaniel Fojt * Stop if there are no more bytes to process
74*a1157835SDaniel Fojt * since there are no more entries in the array.
75*a1157835SDaniel Fojt */
76*a1157835SDaniel Fojt if (i + 1 == AES_BLOCK_SIZE &&
77*a1157835SDaniel Fojt left == AES_BLOCK_SIZE)
78*a1157835SDaniel Fojt break;
793ff40c12SJohn Marino e++;
803ff40c12SJohn Marino pos = addr[e];
813ff40c12SJohn Marino end = pos + len[e];
823ff40c12SJohn Marino }
833ff40c12SJohn Marino }
843ff40c12SJohn Marino if (left > AES_BLOCK_SIZE)
853ff40c12SJohn Marino aes_encrypt(ctx, cbc, cbc);
863ff40c12SJohn Marino left -= AES_BLOCK_SIZE;
873ff40c12SJohn Marino }
883ff40c12SJohn Marino
893ff40c12SJohn Marino os_memset(pad, 0, AES_BLOCK_SIZE);
903ff40c12SJohn Marino aes_encrypt(ctx, pad, pad);
913ff40c12SJohn Marino gf_mulx(pad);
923ff40c12SJohn Marino
933ff40c12SJohn Marino if (left || total_len == 0) {
943ff40c12SJohn Marino for (i = 0; i < left; i++) {
953ff40c12SJohn Marino cbc[i] ^= *pos++;
963ff40c12SJohn Marino if (pos >= end) {
97*a1157835SDaniel Fojt /*
98*a1157835SDaniel Fojt * Stop if there are no more bytes to process
99*a1157835SDaniel Fojt * since there are no more entries in the array.
100*a1157835SDaniel Fojt */
101*a1157835SDaniel Fojt if (i + 1 == left)
102*a1157835SDaniel Fojt break;
1033ff40c12SJohn Marino e++;
1043ff40c12SJohn Marino pos = addr[e];
1053ff40c12SJohn Marino end = pos + len[e];
1063ff40c12SJohn Marino }
1073ff40c12SJohn Marino }
1083ff40c12SJohn Marino cbc[left] ^= 0x80;
1093ff40c12SJohn Marino gf_mulx(pad);
1103ff40c12SJohn Marino }
1113ff40c12SJohn Marino
1123ff40c12SJohn Marino for (i = 0; i < AES_BLOCK_SIZE; i++)
1133ff40c12SJohn Marino pad[i] ^= cbc[i];
1143ff40c12SJohn Marino aes_encrypt(ctx, pad, mac);
1153ff40c12SJohn Marino aes_encrypt_deinit(ctx);
1163ff40c12SJohn Marino return 0;
1173ff40c12SJohn Marino }
1183ff40c12SJohn Marino
1193ff40c12SJohn Marino
1203ff40c12SJohn Marino /**
121*a1157835SDaniel Fojt * omac1_aes_128_vector - One-Key CBC MAC (OMAC1) hash with AES-128
122*a1157835SDaniel Fojt * @key: 128-bit key for the hash operation
123*a1157835SDaniel Fojt * @num_elem: Number of elements in the data vector
124*a1157835SDaniel Fojt * @addr: Pointers to the data areas
125*a1157835SDaniel Fojt * @len: Lengths of the data blocks
126*a1157835SDaniel Fojt * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
127*a1157835SDaniel Fojt * Returns: 0 on success, -1 on failure
128*a1157835SDaniel Fojt *
129*a1157835SDaniel Fojt * This is a mode for using block cipher (AES in this case) for authentication.
130*a1157835SDaniel Fojt * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
131*a1157835SDaniel Fojt * (SP) 800-38B.
132*a1157835SDaniel Fojt */
omac1_aes_128_vector(const u8 * key,size_t num_elem,const u8 * addr[],const size_t * len,u8 * mac)133*a1157835SDaniel Fojt int omac1_aes_128_vector(const u8 *key, size_t num_elem,
134*a1157835SDaniel Fojt const u8 *addr[], const size_t *len, u8 *mac)
135*a1157835SDaniel Fojt {
136*a1157835SDaniel Fojt return omac1_aes_vector(key, 16, num_elem, addr, len, mac);
137*a1157835SDaniel Fojt }
138*a1157835SDaniel Fojt
139*a1157835SDaniel Fojt
140*a1157835SDaniel Fojt /**
1413ff40c12SJohn Marino * omac1_aes_128 - One-Key CBC MAC (OMAC1) hash with AES-128 (aka AES-CMAC)
1423ff40c12SJohn Marino * @key: 128-bit key for the hash operation
1433ff40c12SJohn Marino * @data: Data buffer for which a MAC is determined
1443ff40c12SJohn Marino * @data_len: Length of data buffer in bytes
1453ff40c12SJohn Marino * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
1463ff40c12SJohn Marino * Returns: 0 on success, -1 on failure
1473ff40c12SJohn Marino *
1483ff40c12SJohn Marino * This is a mode for using block cipher (AES in this case) for authentication.
1493ff40c12SJohn Marino * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
1503ff40c12SJohn Marino * (SP) 800-38B.
1513ff40c12SJohn Marino */
omac1_aes_128(const u8 * key,const u8 * data,size_t data_len,u8 * mac)1523ff40c12SJohn Marino int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
1533ff40c12SJohn Marino {
1543ff40c12SJohn Marino return omac1_aes_128_vector(key, 1, &data, &data_len, mac);
1553ff40c12SJohn Marino }
156*a1157835SDaniel Fojt
157*a1157835SDaniel Fojt
158*a1157835SDaniel Fojt /**
159*a1157835SDaniel Fojt * omac1_aes_256 - One-Key CBC MAC (OMAC1) hash with AES-256 (aka AES-CMAC)
160*a1157835SDaniel Fojt * @key: 256-bit key for the hash operation
161*a1157835SDaniel Fojt * @data: Data buffer for which a MAC is determined
162*a1157835SDaniel Fojt * @data_len: Length of data buffer in bytes
163*a1157835SDaniel Fojt * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
164*a1157835SDaniel Fojt * Returns: 0 on success, -1 on failure
165*a1157835SDaniel Fojt *
166*a1157835SDaniel Fojt * This is a mode for using block cipher (AES in this case) for authentication.
167*a1157835SDaniel Fojt * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
168*a1157835SDaniel Fojt * (SP) 800-38B.
169*a1157835SDaniel Fojt */
omac1_aes_256(const u8 * key,const u8 * data,size_t data_len,u8 * mac)170*a1157835SDaniel Fojt int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
171*a1157835SDaniel Fojt {
172*a1157835SDaniel Fojt return omac1_aes_vector(key, 32, 1, &data, &data_len, mac);
173*a1157835SDaniel Fojt }
174