1 /******************************************************************************
2 *
3 * Copyright 2008-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains the implementation of the AES128 and AES CMAC algorithm.
22 *
23 ******************************************************************************/
24
25 #include <bluetooth/log.h>
26
27 #include <algorithm>
28 #include <cstdint>
29
30 #include "aes.h"
31 #include "crypto_toolbox.h"
32 #include "hci/octets.h"
33
34 using bluetooth::hci::kOctet16Length;
35 using bluetooth::hci::Octet16;
36
37 namespace crypto_toolbox {
38
39 namespace {
40
41 typedef struct {
42 uint8_t* text;
43 uint16_t len;
44 uint16_t round;
45 } tCMAC_CB;
46
47 thread_local tCMAC_CB cmac_cb;
48
49 /* Rb for AES-128 as block cipher, LSB as [0] */
50 Octet16 const_Rb{0x87, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
51
52 /** utility function to do an biteise exclusive-OR of two bit strings of the
53 * length of kOctet16Length. Result is stored in first argument.
54 */
xor_128(Octet16 * a,const Octet16 & b)55 static void xor_128(Octet16* a, const Octet16& b) {
56 uint8_t i, *aa = a->data();
57 const uint8_t* bb = b.data();
58
59 for (i = 0; i < kOctet16Length; i++) {
60 aa[i] = aa[i] ^ bb[i];
61 }
62 }
63 } // namespace
64
65 /* This function computes AES_128(key, message) */
aes_128(const Octet16 & key,const Octet16 & message)66 Octet16 aes_128(const Octet16& key, const Octet16& message) {
67 Octet16 key_reversed;
68 Octet16 message_reversed;
69 Octet16 output;
70
71 std::reverse_copy(key.begin(), key.end(), key_reversed.begin());
72 std::reverse_copy(message.begin(), message.end(), message_reversed.begin());
73
74 aes_context ctx;
75 aes_set_key(key_reversed.data(), key_reversed.size(), &ctx);
76 aes_encrypt(message_reversed.data(), output.data(), &ctx);
77
78 std::reverse(output.begin(), output.end());
79 return output;
80 }
81
82 /** utility function to padding the given text to be a 128 bits data. The
83 * parameter dest is input and output parameter, it must point to a
84 * kOctet16Length memory space; where include length bytes valid data. */
padding(Octet16 * dest,uint8_t length)85 static void padding(Octet16* dest, uint8_t length) {
86 uint8_t i, *p = dest->data();
87 /* original last block */
88 for (i = length; i < kOctet16Length; i++) p[kOctet16Length - i - 1] = (i == length) ? 0x80 : 0;
89 }
90
91 /** utility function to left shift one bit for a 128 bits value. */
leftshift_onebit(uint8_t * input,uint8_t * output)92 static void leftshift_onebit(uint8_t* input, uint8_t* output) {
93 uint8_t i, overflow = 0, next_overflow = 0;
94 /* input[0] is LSB */
95 for (i = 0; i < kOctet16Length; i++) {
96 next_overflow = (input[i] & 0x80) ? 1 : 0;
97 output[i] = (input[i] << 1) | overflow;
98 overflow = next_overflow;
99 }
100 return;
101 }
102
103 /** This function is the calculation of block cipher using AES-128. */
cmac_aes_k_calculate(const Octet16 & key)104 static Octet16 cmac_aes_k_calculate(const Octet16& key) {
105 Octet16 output;
106 Octet16 x{0}; // zero initialized
107
108 uint16_t i = 1;
109 while (i <= cmac_cb.round) {
110 /* Mi' := Mi (+) X */
111 xor_128((Octet16*)&cmac_cb.text[(cmac_cb.round - i) * kOctet16Length], x);
112
113 output = aes_128(key, *(Octet16*)&cmac_cb.text[(cmac_cb.round - i) * kOctet16Length]);
114 x = output;
115 i++;
116 }
117
118 return output;
119 }
120
121 /** This function proceeed to prepare the last block of message Mn depending on
122 * the size of the message.
123 */
cmac_prepare_last_block(const Octet16 & k1,const Octet16 & k2)124 static void cmac_prepare_last_block(const Octet16& k1, const Octet16& k2) {
125 // uint8_t x[16] = {0};
126 bool flag;
127
128 /* last block is a complete block set flag to 1 */
129 flag = ((cmac_cb.len % kOctet16Length) == 0 && cmac_cb.len != 0) ? true : false;
130
131 if (flag) { /* last block is complete block */
132 xor_128((Octet16*)&cmac_cb.text[0], k1);
133 } else /* padding then xor with k2 */
134 {
135 padding((Octet16*)&cmac_cb.text[0], (uint8_t)(cmac_cb.len % 16));
136
137 xor_128((Octet16*)&cmac_cb.text[0], k2);
138 }
139 }
140
141 /** This is the function to generate the two subkeys.
142 * |key| is CMAC key, expect SRK when used by SMP.
143 */
cmac_generate_subkey(const Octet16 & key)144 static void cmac_generate_subkey(const Octet16& key) {
145 Octet16 zero{};
146 Octet16 p = aes_128(key, zero);
147
148 Octet16 k1, k2;
149 uint8_t* pp = p.data();
150
151 /* If MSB(L) = 0, then K1 = L << 1 */
152 if ((pp[kOctet16Length - 1] & 0x80) != 0) {
153 /* Else K1 = ( L << 1 ) (+) Rb */
154 leftshift_onebit(pp, k1.data());
155 xor_128(&k1, const_Rb);
156 } else {
157 leftshift_onebit(pp, k1.data());
158 }
159
160 if ((k1[kOctet16Length - 1] & 0x80) != 0) {
161 /* K2 = (K1 << 1) (+) Rb */
162 leftshift_onebit(k1.data(), k2.data());
163 xor_128(&k2, const_Rb);
164 } else {
165 /* If MSB(K1) = 0, then K2 = K1 << 1 */
166 leftshift_onebit(k1.data(), k2.data());
167 }
168
169 cmac_prepare_last_block(k1, k2);
170 }
171
172 /** key - CMAC key in little endian order
173 * input - text to be signed in little endian byte order.
174 * length - length of the input in byte.
175 */
aes_cmac(const Octet16 & key,const uint8_t * input,uint16_t length)176 Octet16 aes_cmac(const Octet16& key, const uint8_t* input, uint16_t length) {
177 uint32_t len;
178 uint16_t diff;
179 /* n is number of rounds */
180 uint16_t n = (length + kOctet16Length - 1) / kOctet16Length;
181
182 if (n == 0) n = 1;
183 len = n * kOctet16Length;
184
185 // log::verbose("AES128_CMAC started, allocate buffer size={}", len);
186
187 /* allocate a memory space of multiple of 16 bytes to hold text */
188 cmac_cb.text = (uint8_t*)alloca(len);
189 cmac_cb.round = n;
190 diff = len - length;
191
192 if (input != NULL && length > 0) {
193 memcpy(&cmac_cb.text[diff], input, (int)length);
194 cmac_cb.len = length;
195 } else {
196 cmac_cb.len = 0;
197 }
198
199 /* prepare calculation for subkey s and last block of data */
200 cmac_generate_subkey(key);
201 /* start calculation */
202 Octet16 signature = cmac_aes_k_calculate(key);
203
204 /* clean up */
205 memset(&cmac_cb, 0, sizeof(tCMAC_CB));
206 // cmac_cb.text is auto-freed by alloca
207
208 return signature;
209 }
210
211 } // namespace crypto_toolbox
212