diff options
| -rw-r--r-- | Makefile.in | 2 | ||||
| -rw-r--r-- | aes_keywrap.c | 261 | ||||
| -rw-r--r-- | cryptech.h | 87 | ||||
| -rw-r--r-- | csprng.c | 4 | ||||
| -rw-r--r-- | hash.c | 2 |
5 files changed, 314 insertions, 42 deletions
diff --git a/Makefile.in b/Makefile.in index b03924b..b984151 100644 --- a/Makefile.in +++ b/Makefile.in @@ -2,7 +2,7 @@ INC = cryptech.h LIB = libcryptech.a -OBJ = ${IO_OBJ} csprng.o hash.o +OBJ = ${IO_OBJ} csprng.o hash.o aes_keywrap.o IO_OBJ = ${IO_OBJ_@FPGA_BUS@} IO_OBJ_EIM = hal_io_eim.o novena-eim.o diff --git a/aes_keywrap.c b/aes_keywrap.c new file mode 100644 index 0000000..b8f505f --- /dev/null +++ b/aes_keywrap.c @@ -0,0 +1,261 @@ +/* + * Implementation of RFC 5649 variant of AES Key Wrap, using Cryptlib + * to supply the AES ECB encryption and decryption functions. + * + * Note that there are two different block sizes involved here: the + * key wrap algorithm deals entirely with 64-bit blocks, while AES + * itself deals with 128-bit blocks. In practice, this is not as + * confusing as it sounds, because we combine two 64-bit blocks to + * create one 128-bit block just prior to performing an AES operation, + * then split the result back to 64-bit blocks immediately afterwards. + */ + +#include <stdio.h> +#include <stdlib.h> +#include <stdint.h> +#include <string.h> +#include <assert.h> + +#include "cryptech.h" + + +/* + * How long the ciphertext will be for a given plaintext length. + */ + +size_t hal_aes_keywrap_ciphertext_length(const size_t plaintext_length) +{ + return (plaintext_length + 15) & ~7; +} + + +/* + * Check the KEK, then load it into the AES core. + * Note that our AES core only supports 128 and 256 bit keys. + */ + +typedef enum { KEK_encrypting, KEK_decrypting } kek_action_t; + +static hal_error_t load_kek(const uint8_t *K, const size_t K_len, const kek_action_t action) +{ + uint8_t config[4]; + hal_error_t err; + + if (K == NULL) + return HAL_ERROR_BAD_ARGUMENTS; + + memset(config, 0, sizeof(config)); + + switch (K_len) { + case bitsToBytes(128): + config[3] &= ~AES_CONFIG_KEYLEN; + break; + case bitsToBytes(256): + config[3] |= AES_CONFIG_KEYLEN; + break; + default: + return HAL_ERROR_BAD_ARGUMENTS; + } + + switch (action) { + case KEK_encrypting: + config[3] |= AES_CONFIG_ENCDEC; + break; + case KEK_decrypting: + config[3] &= !AES_CONFIG_ENCDEC; + break; + default: + return HAL_ERROR_BAD_ARGUMENTS; + } + + /* + * Load the KEK and tell the core to expand it. + */ + + if ((err = hal_io_write(AES_ADDR_KEY0, K, K_len)) != HAL_OK || + (err = hal_io_init(AES_ADDR_CTRL)) != HAL_OK) + return err; + + return HAL_OK; +} + + +/* + * Process one block. Since AES Key Wrap always deals with 64-bit + * half blocks and since the bus is going to break this up into 32-bit + * words no matter what we do, we can eliminate a few gratuitous + * memcpy() operations by receiving our arguments as two half blocks. + * + * Since the length of these half blocks is constant, there's no real + * point in passing the length as an argument, we'd just be checking a + * constant against a constant and a smart compiler will optimize + * the whole check out. + * + * Just be VERY careful if you change anything here. + */ + +static hal_error_t do_block(uint8_t *b1, uint8_t *b2) +{ + hal_error_t err; + + assert(b1 != NULL && b2 != NULL); + + if ((err = hal_io_write(AES_ADDR_BLOCK0, b1, 8)) != HAL_OK || + (err = hal_io_write(AES_ADDR_BLOCK2, b2, 8)) != HAL_OK || + (err = hal_io_next(AES_ADDR_CTRL)) != HAL_OK || + (err = hal_io_wait_ready(AES_ADDR_STATUS)) != HAL_OK || + (err = hal_io_read(AES_ADDR_RESULT0, b1, 8)) != HAL_OK || + (err = hal_io_read(AES_ADDR_RESULT2, b2, 8)) != HAL_OK) + return err; + + return HAL_OK; +} + + +/* + * Wrap plaintext Q using KEK K, placing result in C. + * + * Q and C can overlap. For encrypt-in-place, use Q = C + 8 (that is, + * leave 8 empty bytes before the plaintext). + * + * Use hal_aes_keywrap_ciphertext_length() to calculate the correct + * buffer size. + */ + +hal_error_t hal_aes_keywrap(const uint8_t *K, const size_t K_len, + const uint8_t * const Q, + const size_t m, + uint8_t *C, + size_t *C_len) +{ + const size_t calculated_C_len = hal_aes_keywrap_ciphertext_length(m); + hal_error_t err; + uint32_t n; + long i, j; + + assert(calculated_C_len % 8 == 0); + + if (Q == NULL || C == NULL || C_len == NULL || *C_len < calculated_C_len) + return HAL_ERROR_BAD_ARGUMENTS; + + if ((err = load_kek(K, K_len, KEK_encrypting)) != HAL_OK) + return err; + + *C_len = calculated_C_len; + + if (C + 8 != Q) + memmove(C + 8, Q, m); + if (m % 8 != 0) + memset(C + 8 + m, 0, 8 - (m % 8)); + C[0] = 0xA6; + C[1] = 0x59; + C[2] = 0x59; + C[3] = 0xA6; + C[4] = (m >> 24) & 0xFF; + C[5] = (m >> 16) & 0xFF; + C[6] = (m >> 8) & 0xFF; + C[7] = (m >> 0) & 0xFF; + + n = calculated_C_len/8 - 1; + + if (n == 1) { + if ((err = do_block(C, C + 8)) != HAL_OK) + return err; + } + + else { + for (j = 0; j <= 5; j++) { + for (i = 1; i <= n; i++) { + uint32_t t = n * j + i; + if ((err = do_block(C, C + i * 8)) != HAL_OK) + return err; + C[7] ^= t & 0xFF; t >>= 8; + C[6] ^= t & 0xFF; t >>= 8; + C[5] ^= t & 0xFF; t >>= 8; + C[4] ^= t & 0xFF; + } + } + } + + return HAL_OK; +} + + +/* + * Unwrap ciphertext C using KEK K, placing result in Q. + * + * Q should be the same size as C. Q and C can overlap. + */ + +hal_error_t hal_aes_keyunwrap(const uint8_t *K, const size_t K_len, + const uint8_t * const C, + const size_t C_len, + uint8_t *Q, + size_t *Q_len) +{ + hal_error_t err; + uint32_t n; + long i, j; + size_t m; + + if (C == NULL || Q == NULL || C_len % 8 != 0 || C_len < 16 || Q_len == NULL || *Q_len < C_len) + return HAL_ERROR_BAD_ARGUMENTS; + + if ((err = load_kek(K, K_len, KEK_decrypting)) != HAL_OK) + return err; + + n = (C_len / 8) - 1; + + if (Q != C) + memmove(Q, C, C_len); + + if (n == 1) { + if ((err = do_block(Q, Q + 8)) != HAL_OK) + return err; + } + + else { + for (j = 5; j >= 0; j--) { + for (i = n; i >= 1; i--) { + uint32_t t = n * j + i; + Q[7] ^= t & 0xFF; t >>= 8; + Q[6] ^= t & 0xFF; t >>= 8; + Q[5] ^= t & 0xFF; t >>= 8; + Q[4] ^= t & 0xFF; + if ((err = do_block(Q, Q + i * 8)) != HAL_OK) + return err; + } + } + } + + if (Q[0] != 0xA6 || Q[1] != 0x59 || Q[2] != 0x59 || Q[3] != 0xA6) + return HAL_ERROR_KEYWRAP_BAD_MAGIC; + + m = (((((Q[4] << 8) + Q[5]) << 8) + Q[6]) << 8) + Q[7]; + + if (m <= 8 * (n - 1) || m > 8 * n) + return HAL_ERROR_KEYWRAP_BAD_LENGTH; + + if (m % 8 != 0) + for (i = m + 8; i < 8 * (n + 1); i++) + if (Q[i] != 0x00) + return HAL_ERROR_KEYWRAP_BAD_PADDING; + + *Q_len = m; + + memmove(Q, Q + 8, m); + + return HAL_OK; +} + +/* + * "Any programmer who fails to comply with the standard naming, formatting, + * or commenting conventions should be shot. If it so happens that it is + * inconvenient to shoot him, then he is to be politely requested to recode + * his program in adherence to the above standard." + * -- Michael Spier, Digital Equipment Corporation + * + * Local variables: + * indent-tabs-mode: nil + * End: + */ @@ -429,15 +429,18 @@ */ typedef enum { - HAL_OK, /* All's well */ - HAL_ERROR_MEMORY, /* malloc() failure or similar */ - HAL_ERROR_INCONSISTENT_ARGS, /* Inconsistent arguments given */ - HAL_ERROR_IO_SETUP_FAILED, /* Could not set up I/O with FPGA */ - HAL_ERROR_IO_TIMEOUT, /* I/O with FPGA timed out */ - HAL_ERROR_IO_UNEXPECTED, /* Unexpected response from FPGA */ - HAL_ERROR_IO_OS_ERROR, /* Operating system error talking to FPGA */ - HAL_ERROR_CSPRNG_ZEROED, /* CSPRNG is returning zeros (perhaps core not present?) */ - N_HAL_ERRORS /* Number of error codes (must be last) */ + HAL_OK, /* All's well */ + HAL_ERROR_MEMORY, /* malloc() failure or similar */ + HAL_ERROR_BAD_ARGUMENTS, /* Bad arguments given */ + HAL_ERROR_IO_SETUP_FAILED, /* Could not set up I/O with FPGA */ + HAL_ERROR_IO_TIMEOUT, /* I/O with FPGA timed out */ + HAL_ERROR_IO_UNEXPECTED, /* Unexpected response from FPGA */ + HAL_ERROR_IO_OS_ERROR, /* Operating system error talking to FPGA */ + HAL_ERROR_CSPRNG_BROKEN, /* CSPRNG is returning nonsense (perhaps core not present?) */ + HAL_ERROR_KEYWRAP_BAD_MAGIC, /* Bad magic number while unwrapping key */ + HAL_ERROR_KEYWRAP_BAD_LENGTH, /* Length out of range while unwrapping key */ + HAL_ERROR_KEYWRAP_BAD_PADDING, /* Nonzero padding detected while unwrapping key */ + N_HAL_ERRORS /* Number of error codes (must be last) */ } hal_error_t; @@ -449,39 +452,47 @@ typedef enum { * Public I/O functions. */ -void hal_io_set_debug(int onoff); -hal_error_t hal_io_write(off_t offset, const uint8_t *buf, size_t len); -hal_error_t hal_io_read(off_t offset, uint8_t *buf, size_t len); -hal_error_t hal_io_expected(off_t offset, const uint8_t *expected, size_t len); -hal_error_t hal_io_init(off_t offset); -hal_error_t hal_io_next(off_t offset); -hal_error_t hal_io_wait(off_t offset, uint8_t status, int *count); -hal_error_t hal_io_wait_ready(off_t offset); -hal_error_t hal_io_wait_valid(off_t offset); +extern void hal_io_set_debug(int onoff); +extern hal_error_t hal_io_write(off_t offset, const uint8_t *buf, size_t len); +extern hal_error_t hal_io_read(off_t offset, uint8_t *buf, size_t len); +extern hal_error_t hal_io_expected(off_t offset, const uint8_t *expected, size_t len); +extern hal_error_t hal_io_init(off_t offset); +extern hal_error_t hal_io_next(off_t offset); +extern hal_error_t hal_io_wait(off_t offset, uint8_t status, int *count); +extern hal_error_t hal_io_wait_ready(off_t offset); +extern hal_error_t hal_io_wait_valid(off_t offset); /* * Higher level public API. */ -hal_error_t hal_random(void *buffer, const size_t length); - -void hal_hash_set_debug(int onoff); -hal_error_t hash_sha1_core_present(void); -hal_error_t hash_sha256_core_present(void); -hal_error_t hash_sha512_core_present(void); -size_t hal_hash_state_size(void); -void hal_hash_state_initialize(void *state); -hal_error_t hal_hash_sha1(void *state, const uint8_t * data_buffer, const size_t data_buffer_length, - uint8_t *digest_buffer, const size_t digest_buffer_length); -hal_error_t hal_hash_sha256(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, - uint8_t *digest_buffer, const size_t digest_buffer_length); -hal_error_t hal_hash_sha512_224(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, - uint8_t *digest_buffer, const size_t digest_buffer_length); -hal_error_t hal_hash_sha512_256(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, - uint8_t *digest_buffer, const size_t digest_buffer_length); -hal_error_t hal_hash_sha384(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, - uint8_t *digest_buffer, const size_t digest_buffer_length); -hal_error_t hal_hash_sha512(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, - uint8_t *digest_buffer, const size_t digest_buffer_length); +extern hal_error_t hal_get_random(void *buffer, const size_t length); + +extern void hal_hash_set_debug(int onoff); +extern hal_error_t hash_sha1_core_present(void); +extern hal_error_t hash_sha256_core_present(void); +extern hal_error_t hash_sha512_core_present(void); +extern size_t hal_hash_state_size(void); +extern void hal_hash_state_initialize(void *state); +extern hal_error_t hal_hash_sha1(void *state, const uint8_t * data_buffer, const size_t data_buffer_length, + uint8_t *digest_buffer, const size_t digest_buffer_length); +extern hal_error_t hal_hash_sha256(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, + uint8_t *digest_buffer, const size_t digest_buffer_length); +extern hal_error_t hal_hash_sha512_224(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, + uint8_t *digest_buffer, const size_t digest_buffer_length); +extern hal_error_t hal_hash_sha512_256(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, + uint8_t *digest_buffer, const size_t digest_buffer_length); +extern hal_error_t hal_hash_sha384(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, + uint8_t *digest_buffer, const size_t digest_buffer_length); +extern hal_error_t hal_hash_sha512(void *state, const uint8_t *data_buffer, const size_t data_buffer_length, + uint8_t *digest_buffer, const size_t digest_buffer_length); + +extern hal_error_t hal_aes_keywrap(const uint8_t *kek, const size_t kek_length, + const uint8_t *plaintext, const size_t plaintext_length, + uint8_t *cyphertext, size_t *ciphertext_length); +extern hal_error_t hal_aes_keyunwrap(const uint8_t *kek, const size_t kek_length, + const uint8_t *ciphertext, const size_t ciphertext_length, + unsigned char *plaintext, size_t *plaintext_length); +extern size_t hal_aes_keywrap_ciphertext_length(const size_t plaintext_length); #endif /* _CRYPTECH_H_ */ @@ -53,7 +53,7 @@ #define WAIT_FOR_CSPRNG_VALID 1 #endif -hal_error_t hal_random(void *buffer, const size_t length) +hal_error_t hal_get_random(void *buffer, const size_t length) { uint8_t temp[4], *buf = buffer; hal_error_t err; @@ -77,7 +77,7 @@ hal_error_t hal_random(void *buffer, const size_t length) if (*buf != 0) return HAL_OK; - return HAL_ERROR_CSPRNG_ZEROED; + return HAL_ERROR_CSPRNG_BROKEN; } /* @@ -191,7 +191,7 @@ static hal_error_t hash_do_hash(hash_state_t *state, /* Opaqu (data_buffer_length > 0 && data_buffer == NULL) || (data_buffer_length == 0 && digest_buffer == NULL) || (digest_buffer != NULL && digest_buffer_length < digest_length)) - return HAL_ERROR_INCONSISTENT_ARGS; + return HAL_ERROR_BAD_ARGUMENTS; if (state->block_length == 0) state->block_length = block_length; |