13ff40c12SJohn Marino /*
2*a1157835SDaniel Fojt  * AES key unwrap (RFC3394)
33ff40c12SJohn Marino  *
43ff40c12SJohn Marino  * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
53ff40c12SJohn Marino  *
63ff40c12SJohn Marino  * This software may be distributed under the terms of the BSD license.
73ff40c12SJohn Marino  * See README for more details.
83ff40c12SJohn Marino  */
93ff40c12SJohn Marino 
103ff40c12SJohn Marino #include "includes.h"
113ff40c12SJohn Marino 
123ff40c12SJohn Marino #include "common.h"
133ff40c12SJohn Marino #include "aes.h"
143ff40c12SJohn Marino #include "aes_wrap.h"
153ff40c12SJohn Marino 
163ff40c12SJohn Marino /**
17*a1157835SDaniel Fojt  * aes_unwrap - Unwrap key with AES Key Wrap Algorithm (RFC3394)
183ff40c12SJohn Marino  * @kek: Key encryption key (KEK)
19*a1157835SDaniel Fojt  * @kek_len: Length of KEK in octets
203ff40c12SJohn Marino  * @n: Length of the plaintext key in 64-bit units; e.g., 2 = 128-bit = 16
213ff40c12SJohn Marino  * bytes
223ff40c12SJohn Marino  * @cipher: Wrapped key to be unwrapped, (n + 1) * 64 bits
233ff40c12SJohn Marino  * @plain: Plaintext key, n * 64 bits
243ff40c12SJohn Marino  * Returns: 0 on success, -1 on failure (e.g., integrity verification failed)
253ff40c12SJohn Marino  */
aes_unwrap(const u8 * kek,size_t kek_len,int n,const u8 * cipher,u8 * plain)26*a1157835SDaniel Fojt int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher,
27*a1157835SDaniel Fojt 	       u8 *plain)
283ff40c12SJohn Marino {
29*a1157835SDaniel Fojt 	u8 a[8], *r, b[AES_BLOCK_SIZE];
303ff40c12SJohn Marino 	int i, j;
313ff40c12SJohn Marino 	void *ctx;
32*a1157835SDaniel Fojt 	unsigned int t;
333ff40c12SJohn Marino 
343ff40c12SJohn Marino 	/* 1) Initialize variables. */
353ff40c12SJohn Marino 	os_memcpy(a, cipher, 8);
363ff40c12SJohn Marino 	r = plain;
373ff40c12SJohn Marino 	os_memcpy(r, cipher + 8, 8 * n);
383ff40c12SJohn Marino 
39*a1157835SDaniel Fojt 	ctx = aes_decrypt_init(kek, kek_len);
403ff40c12SJohn Marino 	if (ctx == NULL)
413ff40c12SJohn Marino 		return -1;
423ff40c12SJohn Marino 
433ff40c12SJohn Marino 	/* 2) Compute intermediate values.
443ff40c12SJohn Marino 	 * For j = 5 to 0
453ff40c12SJohn Marino 	 *     For i = n to 1
463ff40c12SJohn Marino 	 *         B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i
473ff40c12SJohn Marino 	 *         A = MSB(64, B)
483ff40c12SJohn Marino 	 *         R[i] = LSB(64, B)
493ff40c12SJohn Marino 	 */
503ff40c12SJohn Marino 	for (j = 5; j >= 0; j--) {
513ff40c12SJohn Marino 		r = plain + (n - 1) * 8;
523ff40c12SJohn Marino 		for (i = n; i >= 1; i--) {
533ff40c12SJohn Marino 			os_memcpy(b, a, 8);
54*a1157835SDaniel Fojt 			t = n * j + i;
55*a1157835SDaniel Fojt 			b[7] ^= t;
56*a1157835SDaniel Fojt 			b[6] ^= t >> 8;
57*a1157835SDaniel Fojt 			b[5] ^= t >> 16;
58*a1157835SDaniel Fojt 			b[4] ^= t >> 24;
593ff40c12SJohn Marino 
603ff40c12SJohn Marino 			os_memcpy(b + 8, r, 8);
613ff40c12SJohn Marino 			aes_decrypt(ctx, b, b);
623ff40c12SJohn Marino 			os_memcpy(a, b, 8);
633ff40c12SJohn Marino 			os_memcpy(r, b + 8, 8);
643ff40c12SJohn Marino 			r -= 8;
653ff40c12SJohn Marino 		}
663ff40c12SJohn Marino 	}
673ff40c12SJohn Marino 	aes_decrypt_deinit(ctx);
683ff40c12SJohn Marino 
693ff40c12SJohn Marino 	/* 3) Output results.
703ff40c12SJohn Marino 	 *
713ff40c12SJohn Marino 	 * These are already in @plain due to the location of temporary
723ff40c12SJohn Marino 	 * variables. Just verify that the IV matches with the expected value.
733ff40c12SJohn Marino 	 */
743ff40c12SJohn Marino 	for (i = 0; i < 8; i++) {
753ff40c12SJohn Marino 		if (a[i] != 0xa6)
763ff40c12SJohn Marino 			return -1;
773ff40c12SJohn Marino 	}
783ff40c12SJohn Marino 
793ff40c12SJohn Marino 	return 0;
803ff40c12SJohn Marino }
81