13ff40c12SJohn Marino /*
2*a1157835SDaniel Fojt * AES key unwrap (RFC3394)
33ff40c12SJohn Marino *
43ff40c12SJohn Marino * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
53ff40c12SJohn Marino *
63ff40c12SJohn Marino * This software may be distributed under the terms of the BSD license.
73ff40c12SJohn Marino * See README for more details.
83ff40c12SJohn Marino */
93ff40c12SJohn Marino
103ff40c12SJohn Marino #include "includes.h"
113ff40c12SJohn Marino
123ff40c12SJohn Marino #include "common.h"
133ff40c12SJohn Marino #include "aes.h"
143ff40c12SJohn Marino #include "aes_wrap.h"
153ff40c12SJohn Marino
163ff40c12SJohn Marino /**
17*a1157835SDaniel Fojt * aes_unwrap - Unwrap key with AES Key Wrap Algorithm (RFC3394)
183ff40c12SJohn Marino * @kek: Key encryption key (KEK)
19*a1157835SDaniel Fojt * @kek_len: Length of KEK in octets
203ff40c12SJohn Marino * @n: Length of the plaintext key in 64-bit units; e.g., 2 = 128-bit = 16
213ff40c12SJohn Marino * bytes
223ff40c12SJohn Marino * @cipher: Wrapped key to be unwrapped, (n + 1) * 64 bits
233ff40c12SJohn Marino * @plain: Plaintext key, n * 64 bits
243ff40c12SJohn Marino * Returns: 0 on success, -1 on failure (e.g., integrity verification failed)
253ff40c12SJohn Marino */
aes_unwrap(const u8 * kek,size_t kek_len,int n,const u8 * cipher,u8 * plain)26*a1157835SDaniel Fojt int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher,
27*a1157835SDaniel Fojt u8 *plain)
283ff40c12SJohn Marino {
29*a1157835SDaniel Fojt u8 a[8], *r, b[AES_BLOCK_SIZE];
303ff40c12SJohn Marino int i, j;
313ff40c12SJohn Marino void *ctx;
32*a1157835SDaniel Fojt unsigned int t;
333ff40c12SJohn Marino
343ff40c12SJohn Marino /* 1) Initialize variables. */
353ff40c12SJohn Marino os_memcpy(a, cipher, 8);
363ff40c12SJohn Marino r = plain;
373ff40c12SJohn Marino os_memcpy(r, cipher + 8, 8 * n);
383ff40c12SJohn Marino
39*a1157835SDaniel Fojt ctx = aes_decrypt_init(kek, kek_len);
403ff40c12SJohn Marino if (ctx == NULL)
413ff40c12SJohn Marino return -1;
423ff40c12SJohn Marino
433ff40c12SJohn Marino /* 2) Compute intermediate values.
443ff40c12SJohn Marino * For j = 5 to 0
453ff40c12SJohn Marino * For i = n to 1
463ff40c12SJohn Marino * B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i
473ff40c12SJohn Marino * A = MSB(64, B)
483ff40c12SJohn Marino * R[i] = LSB(64, B)
493ff40c12SJohn Marino */
503ff40c12SJohn Marino for (j = 5; j >= 0; j--) {
513ff40c12SJohn Marino r = plain + (n - 1) * 8;
523ff40c12SJohn Marino for (i = n; i >= 1; i--) {
533ff40c12SJohn Marino os_memcpy(b, a, 8);
54*a1157835SDaniel Fojt t = n * j + i;
55*a1157835SDaniel Fojt b[7] ^= t;
56*a1157835SDaniel Fojt b[6] ^= t >> 8;
57*a1157835SDaniel Fojt b[5] ^= t >> 16;
58*a1157835SDaniel Fojt b[4] ^= t >> 24;
593ff40c12SJohn Marino
603ff40c12SJohn Marino os_memcpy(b + 8, r, 8);
613ff40c12SJohn Marino aes_decrypt(ctx, b, b);
623ff40c12SJohn Marino os_memcpy(a, b, 8);
633ff40c12SJohn Marino os_memcpy(r, b + 8, 8);
643ff40c12SJohn Marino r -= 8;
653ff40c12SJohn Marino }
663ff40c12SJohn Marino }
673ff40c12SJohn Marino aes_decrypt_deinit(ctx);
683ff40c12SJohn Marino
693ff40c12SJohn Marino /* 3) Output results.
703ff40c12SJohn Marino *
713ff40c12SJohn Marino * These are already in @plain due to the location of temporary
723ff40c12SJohn Marino * variables. Just verify that the IV matches with the expected value.
733ff40c12SJohn Marino */
743ff40c12SJohn Marino for (i = 0; i < 8; i++) {
753ff40c12SJohn Marino if (a[i] != 0xa6)
763ff40c12SJohn Marino return -1;
773ff40c12SJohn Marino }
783ff40c12SJohn Marino
793ff40c12SJohn Marino return 0;
803ff40c12SJohn Marino }
81