summaryrefslogtreecommitdiffstats
path: root/src/crypto/cmac
diff options
context:
space:
mode:
Diffstat (limited to 'src/crypto/cmac')
-rw-r--r--src/crypto/cmac/CMakeLists.txt17
-rw-r--r--src/crypto/cmac/cmac.c239
-rw-r--r--src/crypto/cmac/cmac_test.cc154
3 files changed, 410 insertions, 0 deletions
diff --git a/src/crypto/cmac/CMakeLists.txt b/src/crypto/cmac/CMakeLists.txt
new file mode 100644
index 0000000..8ebd80c
--- /dev/null
+++ b/src/crypto/cmac/CMakeLists.txt
@@ -0,0 +1,17 @@
+include_directories(. .. ../../include)
+
+add_library(
+ cmac
+
+ OBJECT
+
+ cmac.c
+)
+
+add_executable(
+ cmac_test
+
+ cmac_test.cc
+)
+
+target_link_libraries(cmac_test crypto)
diff --git a/src/crypto/cmac/cmac.c b/src/crypto/cmac/cmac.c
new file mode 100644
index 0000000..fa4c3c4
--- /dev/null
+++ b/src/crypto/cmac/cmac.c
@@ -0,0 +1,239 @@
+/* ====================================================================
+ * Copyright (c) 2010 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ==================================================================== */
+
+#include <openssl/cmac.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/aes.h>
+#include <openssl/cipher.h>
+#include <openssl/mem.h>
+
+
+struct cmac_ctx_st {
+ EVP_CIPHER_CTX cipher_ctx;
+ /* k1 and k2 are the CMAC subkeys. See
+ * https://tools.ietf.org/html/rfc4493#section-2.3 */
+ uint8_t k1[AES_BLOCK_SIZE];
+ uint8_t k2[AES_BLOCK_SIZE];
+ /* Last (possibly partial) scratch */
+ uint8_t block[AES_BLOCK_SIZE];
+ /* block_used contains the number of valid bytes in |block|. */
+ unsigned block_used;
+};
+
+static void CMAC_CTX_init(CMAC_CTX *ctx) {
+ EVP_CIPHER_CTX_init(&ctx->cipher_ctx);
+}
+
+static void CMAC_CTX_cleanup(CMAC_CTX *ctx) {
+ EVP_CIPHER_CTX_cleanup(&ctx->cipher_ctx);
+ OPENSSL_cleanse(ctx->k1, sizeof(ctx->k1));
+ OPENSSL_cleanse(ctx->k2, sizeof(ctx->k2));
+ OPENSSL_cleanse(ctx->block, sizeof(ctx->block));
+}
+
+int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
+ const uint8_t *in, size_t in_len) {
+ const EVP_CIPHER *cipher;
+ switch (key_len) {
+ case 16:
+ cipher = EVP_aes_128_cbc();
+ break;
+ case 32:
+ cipher = EVP_aes_256_cbc();
+ break;
+ default:
+ return 0;
+ }
+
+ size_t scratch_out_len;
+ CMAC_CTX ctx;
+ CMAC_CTX_init(&ctx);
+
+ const int ok = CMAC_Init(&ctx, key, key_len, cipher, NULL /* engine */) &&
+ CMAC_Update(&ctx, in, in_len) &&
+ CMAC_Final(&ctx, out, &scratch_out_len);
+
+ CMAC_CTX_cleanup(&ctx);
+ return ok;
+}
+
+CMAC_CTX *CMAC_CTX_new(void) {
+ CMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
+ if (ctx != NULL) {
+ CMAC_CTX_init(ctx);
+ }
+ return ctx;
+}
+
+void CMAC_CTX_free(CMAC_CTX *ctx) {
+ if (ctx == NULL) {
+ return;
+ }
+
+ CMAC_CTX_cleanup(ctx);
+ OPENSSL_free(ctx);
+}
+
+/* binary_field_mul_x treats the 128 bits at |in| as an element of GF(2¹²⁸)
+ * with a hard-coded reduction polynomial and sets |out| as x times the
+ * input.
+ *
+ * See https://tools.ietf.org/html/rfc4493#section-2.3 */
+static void binary_field_mul_x(uint8_t out[16], const uint8_t in[16]) {
+ unsigned i;
+
+ /* Shift |in| to left, including carry. */
+ for (i = 0; i < 15; i++) {
+ out[i] = (in[i] << 1) | (in[i+1] >> 7);
+ }
+
+ /* If MSB set fixup with R. */
+ const uint8_t carry = in[0] >> 7;
+ out[i] = (in[i] << 1) ^ ((0 - carry) & 0x87);
+}
+
+static const uint8_t kZeroIV[AES_BLOCK_SIZE] = {0};
+
+int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
+ const EVP_CIPHER *cipher, ENGINE *engine) {
+ uint8_t scratch[AES_BLOCK_SIZE];
+
+ if (EVP_CIPHER_block_size(cipher) != AES_BLOCK_SIZE ||
+ EVP_CIPHER_key_length(cipher) != key_len ||
+ !EVP_EncryptInit_ex(&ctx->cipher_ctx, cipher, NULL, key, kZeroIV) ||
+ !EVP_Cipher(&ctx->cipher_ctx, scratch, kZeroIV, AES_BLOCK_SIZE) ||
+ /* Reset context again ready for first data. */
+ !EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV)) {
+ return 0;
+ }
+
+ binary_field_mul_x(ctx->k1, scratch);
+ binary_field_mul_x(ctx->k2, ctx->k1);
+ ctx->block_used = 0;
+
+ return 1;
+}
+
+int CMAC_Reset(CMAC_CTX *ctx) {
+ ctx->block_used = 0;
+ return EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV);
+}
+
+int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len) {
+ uint8_t scratch[AES_BLOCK_SIZE];
+
+ if (ctx->block_used > 0) {
+ size_t todo = AES_BLOCK_SIZE - ctx->block_used;
+ if (in_len < todo) {
+ todo = in_len;
+ }
+
+ memcpy(ctx->block + ctx->block_used, in, todo);
+ in += todo;
+ in_len -= todo;
+ ctx->block_used += todo;
+
+ /* If |in_len| is zero then either |ctx->block_used| is less than
+ * |AES_BLOCK_SIZE|, in which case we can stop here, or |ctx->block_used|
+ * is exactly |AES_BLOCK_SIZE| but there's no more data to process. In the
+ * latter case we don't want to process this block now because it might be
+ * the last block and that block is treated specially. */
+ if (in_len == 0) {
+ return 1;
+ }
+
+ assert(ctx->block_used == AES_BLOCK_SIZE);
+
+ if (!EVP_Cipher(&ctx->cipher_ctx, scratch, ctx->block, AES_BLOCK_SIZE)) {
+ return 0;
+ }
+ }
+
+ /* Encrypt all but one of the remaining blocks. */
+ while (in_len > AES_BLOCK_SIZE) {
+ if (!EVP_Cipher(&ctx->cipher_ctx, scratch, in, AES_BLOCK_SIZE)) {
+ return 0;
+ }
+ in += AES_BLOCK_SIZE;
+ in_len -= AES_BLOCK_SIZE;
+ }
+
+ memcpy(ctx->block, in, in_len);
+ ctx->block_used = in_len;
+
+ return 1;
+}
+
+int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len) {
+ *out_len = AES_BLOCK_SIZE;
+ if (out == NULL) {
+ return 1;
+ }
+
+ const uint8_t *mask = ctx->k1;
+
+ if (ctx->block_used != AES_BLOCK_SIZE) {
+ /* If the last block is incomplete, terminate it with a single 'one' bit
+ * followed by zeros. */
+ ctx->block[ctx->block_used] = 0x80;
+ memset(ctx->block + ctx->block_used + 1, 0,
+ AES_BLOCK_SIZE - (ctx->block_used + 1));
+
+ mask = ctx->k2;
+ }
+
+ unsigned i;
+ for (i = 0; i < AES_BLOCK_SIZE; i++) {
+ out[i] = ctx->block[i] ^ mask[i];
+ }
+
+ return EVP_Cipher(&ctx->cipher_ctx, out, out, AES_BLOCK_SIZE);
+}
diff --git a/src/crypto/cmac/cmac_test.cc b/src/crypto/cmac/cmac_test.cc
new file mode 100644
index 0000000..0f06860
--- /dev/null
+++ b/src/crypto/cmac/cmac_test.cc
@@ -0,0 +1,154 @@
+/* Copyright (c) 2015, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <stdio.h>
+
+#include <algorithm>
+
+#include <openssl/cmac.h>
+
+#include "../test/scoped_types.h"
+
+
+static void dump(const uint8_t *got, const uint8_t *expected, size_t len) {
+ ScopedBIO bio(BIO_new_fp(stderr, 0 /* don't close */));
+
+ BIO_puts(bio.get(), "\nGot:\n");
+ BIO_hexdump(bio.get(), got, len, 2 /* indent */);
+ BIO_puts(bio.get(), "Expected:\n");
+ BIO_hexdump(bio.get(), expected, len, 2 /* indent */);
+ BIO_flush(bio.get());
+}
+
+static int test(const char *name, const uint8_t *key, size_t key_len,
+ const uint8_t *msg, size_t msg_len, const uint8_t *expected) {
+ uint8_t out[16];
+
+ if (!AES_CMAC(out, key, key_len, msg, msg_len)) {
+ fprintf(stderr, "%s: AES_CMAC failed\n", name);
+ return 0;
+ }
+
+ if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
+ fprintf(stderr, "%s: CMAC result differs:\n", name);
+ dump(out, expected, sizeof(out));
+ return 0;
+ }
+
+ ScopedCMAC_CTX ctx(CMAC_CTX_new());
+ if (!CMAC_Init(ctx.get(), key, key_len, EVP_aes_128_cbc(), NULL)) {
+ fprintf(stderr, "%s: CMAC_Init failed.\n", name);
+ return 0;
+ }
+
+ for (unsigned chunk_size = 1; chunk_size <= msg_len; chunk_size++) {
+ if (!CMAC_Reset(ctx.get())) {
+ fprintf(stderr, "%s/%u: CMAC_Reset failed.\n", name, chunk_size);
+ return 0;
+ }
+
+ size_t done = 0;
+ while (done < msg_len) {
+ size_t todo = std::min(msg_len - done, static_cast<size_t>(chunk_size));
+ if (!CMAC_Update(ctx.get(), msg + done, todo)) {
+ fprintf(stderr, "%s/%u: CMAC_Update failed.\n", name, chunk_size);
+ return 0;
+ }
+
+ done += todo;
+ }
+
+ size_t out_len;
+ if (!CMAC_Final(ctx.get(), out, &out_len)) {
+ fprintf(stderr, "%s/%u: CMAC_Final failed.\n", name, chunk_size);
+ return 0;
+ }
+
+ if (out_len != sizeof(out)) {
+ fprintf(stderr, "%s/%u: incorrect out_len: %u.\n", name, chunk_size,
+ static_cast<unsigned>(out_len));
+ return 0;
+ }
+
+ if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
+ fprintf(stderr, "%s/%u: CMAC result differs:\n", name, chunk_size);
+ dump(out, expected, sizeof(out));
+ return 0;
+ }
+ }
+
+ return 1;
+}
+
+static int rfc_4493_test_vectors(void) {
+ static const uint8_t kKey[16] = {
+ 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
+ 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c,
+ };
+ static const uint8_t kOut1[16] = {
+ 0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
+ 0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46,
+ };
+ static const uint8_t kMsg2[] = {
+ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+ 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+ };
+ static const uint8_t kOut2[16] = {
+ 0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
+ 0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c,
+ };
+ static const uint8_t kMsg3[] = {
+ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+ 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+ 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
+ 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
+ 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
+ };
+ static const uint8_t kOut3[16] = {
+ 0xdf, 0xa6, 0x67, 0x47, 0xde, 0x9a, 0xe6, 0x30,
+ 0x30, 0xca, 0x32, 0x61, 0x14, 0x97, 0xc8, 0x27,
+ };
+ static const uint8_t kMsg4[] = {
+ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+ 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+ 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
+ 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
+ 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
+ 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
+ 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
+ 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10,
+ };
+ static const uint8_t kOut4[16] = {
+ 0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
+ 0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe,
+ };
+
+ if (!test("RFC 4493 #1", kKey, sizeof(kKey), NULL, 0, kOut1) ||
+ !test("RFC 4493 #2", kKey, sizeof(kKey), kMsg2, sizeof(kMsg2), kOut2) ||
+ !test("RFC 4493 #3", kKey, sizeof(kKey), kMsg3, sizeof(kMsg3), kOut3) ||
+ !test("RFC 4493 #4", kKey, sizeof(kKey), kMsg4, sizeof(kMsg4), kOut4)) {
+ return 0;
+ }
+
+ return 1;
+}
+
+int main(int argc, char **argv) {
+ if (!rfc_4493_test_vectors()) {
+ return 1;
+ }
+
+ printf("PASS\n");
+ return 0;
+}
generated by cgit v1.1 at 2024-12-23 03:39:44 +0000