1765cb46aSJouni Malinen /* 2765cb46aSJouni Malinen * AES-128-CMAC with TLen 16 for IEEE 802.11w BIP 3765cb46aSJouni Malinen * Copyright 2008, Jouni Malinen <j@w1.fi> 4765cb46aSJouni Malinen * 5765cb46aSJouni Malinen * This program is free software; you can redistribute it and/or modify 6765cb46aSJouni Malinen * it under the terms of the GNU General Public License version 2 as 7765cb46aSJouni Malinen * published by the Free Software Foundation. 8765cb46aSJouni Malinen */ 9765cb46aSJouni Malinen 10765cb46aSJouni Malinen #include <linux/kernel.h> 11765cb46aSJouni Malinen #include <linux/types.h> 12765cb46aSJouni Malinen #include <linux/crypto.h> 134afebd63SEmmanuel Grumbach #include <linux/export.h> 14765cb46aSJouni Malinen #include <linux/err.h> 150cd20a27SJohannes Berg #include <crypto/aes.h> 16765cb46aSJouni Malinen 17765cb46aSJouni Malinen #include <net/mac80211.h> 18765cb46aSJouni Malinen #include "key.h" 19765cb46aSJouni Malinen #include "aes_cmac.h" 20765cb46aSJouni Malinen 21765cb46aSJouni Malinen #define CMAC_TLEN 8 /* CMAC TLen = 64 bits (8 octets) */ 2256c52da2SJouni Malinen #define CMAC_TLEN_256 16 /* CMAC TLen = 128 bits (16 octets) */ 23765cb46aSJouni Malinen #define AAD_LEN 20 24765cb46aSJouni Malinen 25765cb46aSJouni Malinen 26765cb46aSJouni Malinen static void gf_mulx(u8 *pad) 27765cb46aSJouni Malinen { 28765cb46aSJouni Malinen int i, carry; 29765cb46aSJouni Malinen 30765cb46aSJouni Malinen carry = pad[0] & 0x80; 31765cb46aSJouni Malinen for (i = 0; i < AES_BLOCK_SIZE - 1; i++) 32765cb46aSJouni Malinen pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7); 33765cb46aSJouni Malinen pad[AES_BLOCK_SIZE - 1] <<= 1; 34765cb46aSJouni Malinen if (carry) 35765cb46aSJouni Malinen pad[AES_BLOCK_SIZE - 1] ^= 0x87; 36765cb46aSJouni Malinen } 37765cb46aSJouni Malinen 3856c52da2SJouni Malinen static void aes_cmac_vector(struct crypto_cipher *tfm, size_t num_elem, 3956c52da2SJouni Malinen const u8 *addr[], const size_t *len, u8 *mac, 4056c52da2SJouni Malinen size_t mac_len) 41765cb46aSJouni Malinen { 42d348f69fSJohannes Berg u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE]; 43765cb46aSJouni Malinen const u8 *pos, *end; 44765cb46aSJouni Malinen size_t i, e, left, total_len; 45765cb46aSJouni Malinen 46765cb46aSJouni Malinen memset(cbc, 0, AES_BLOCK_SIZE); 47765cb46aSJouni Malinen 48765cb46aSJouni Malinen total_len = 0; 49765cb46aSJouni Malinen for (e = 0; e < num_elem; e++) 50765cb46aSJouni Malinen total_len += len[e]; 51765cb46aSJouni Malinen left = total_len; 52765cb46aSJouni Malinen 53765cb46aSJouni Malinen e = 0; 54765cb46aSJouni Malinen pos = addr[0]; 55765cb46aSJouni Malinen end = pos + len[0]; 56765cb46aSJouni Malinen 57765cb46aSJouni Malinen while (left >= AES_BLOCK_SIZE) { 58765cb46aSJouni Malinen for (i = 0; i < AES_BLOCK_SIZE; i++) { 59765cb46aSJouni Malinen cbc[i] ^= *pos++; 60765cb46aSJouni Malinen if (pos >= end) { 61765cb46aSJouni Malinen e++; 62765cb46aSJouni Malinen pos = addr[e]; 63765cb46aSJouni Malinen end = pos + len[e]; 64765cb46aSJouni Malinen } 65765cb46aSJouni Malinen } 66765cb46aSJouni Malinen if (left > AES_BLOCK_SIZE) 67765cb46aSJouni Malinen crypto_cipher_encrypt_one(tfm, cbc, cbc); 68765cb46aSJouni Malinen left -= AES_BLOCK_SIZE; 69765cb46aSJouni Malinen } 70765cb46aSJouni Malinen 71765cb46aSJouni Malinen memset(pad, 0, AES_BLOCK_SIZE); 72765cb46aSJouni Malinen crypto_cipher_encrypt_one(tfm, pad, pad); 73765cb46aSJouni Malinen gf_mulx(pad); 74765cb46aSJouni Malinen 75765cb46aSJouni Malinen if (left || total_len == 0) { 76765cb46aSJouni Malinen for (i = 0; i < left; i++) { 77765cb46aSJouni Malinen cbc[i] ^= *pos++; 78765cb46aSJouni Malinen if (pos >= end) { 79765cb46aSJouni Malinen e++; 80765cb46aSJouni Malinen pos = addr[e]; 81765cb46aSJouni Malinen end = pos + len[e]; 82765cb46aSJouni Malinen } 83765cb46aSJouni Malinen } 84765cb46aSJouni Malinen cbc[left] ^= 0x80; 85765cb46aSJouni Malinen gf_mulx(pad); 86765cb46aSJouni Malinen } 87765cb46aSJouni Malinen 88765cb46aSJouni Malinen for (i = 0; i < AES_BLOCK_SIZE; i++) 89765cb46aSJouni Malinen pad[i] ^= cbc[i]; 90765cb46aSJouni Malinen crypto_cipher_encrypt_one(tfm, pad, pad); 9156c52da2SJouni Malinen memcpy(mac, pad, mac_len); 92765cb46aSJouni Malinen } 93765cb46aSJouni Malinen 94765cb46aSJouni Malinen 9575396ae6SJohannes Berg void ieee80211_aes_cmac(struct crypto_cipher *tfm, const u8 *aad, 96765cb46aSJouni Malinen const u8 *data, size_t data_len, u8 *mic) 97765cb46aSJouni Malinen { 98765cb46aSJouni Malinen const u8 *addr[3]; 99765cb46aSJouni Malinen size_t len[3]; 100765cb46aSJouni Malinen u8 zero[CMAC_TLEN]; 101765cb46aSJouni Malinen 102765cb46aSJouni Malinen memset(zero, 0, CMAC_TLEN); 103765cb46aSJouni Malinen addr[0] = aad; 104765cb46aSJouni Malinen len[0] = AAD_LEN; 105765cb46aSJouni Malinen addr[1] = data; 106765cb46aSJouni Malinen len[1] = data_len - CMAC_TLEN; 107765cb46aSJouni Malinen addr[2] = zero; 108765cb46aSJouni Malinen len[2] = CMAC_TLEN; 109765cb46aSJouni Malinen 11056c52da2SJouni Malinen aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN); 111765cb46aSJouni Malinen } 112765cb46aSJouni Malinen 11356c52da2SJouni Malinen void ieee80211_aes_cmac_256(struct crypto_cipher *tfm, const u8 *aad, 11456c52da2SJouni Malinen const u8 *data, size_t data_len, u8 *mic) 11556c52da2SJouni Malinen { 11656c52da2SJouni Malinen const u8 *addr[3]; 11756c52da2SJouni Malinen size_t len[3]; 11856c52da2SJouni Malinen u8 zero[CMAC_TLEN_256]; 119765cb46aSJouni Malinen 12056c52da2SJouni Malinen memset(zero, 0, CMAC_TLEN_256); 12156c52da2SJouni Malinen addr[0] = aad; 12256c52da2SJouni Malinen len[0] = AAD_LEN; 12356c52da2SJouni Malinen addr[1] = data; 12456c52da2SJouni Malinen len[1] = data_len - CMAC_TLEN_256; 12556c52da2SJouni Malinen addr[2] = zero; 12656c52da2SJouni Malinen len[2] = CMAC_TLEN_256; 12756c52da2SJouni Malinen 12856c52da2SJouni Malinen aes_cmac_vector(tfm, 3, addr, len, mic, CMAC_TLEN_256); 12956c52da2SJouni Malinen } 13056c52da2SJouni Malinen 13156c52da2SJouni Malinen struct crypto_cipher *ieee80211_aes_cmac_key_setup(const u8 key[], 13256c52da2SJouni Malinen size_t key_len) 133765cb46aSJouni Malinen { 134765cb46aSJouni Malinen struct crypto_cipher *tfm; 135765cb46aSJouni Malinen 136765cb46aSJouni Malinen tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC); 1371ac62ba7SBen Hutchings if (!IS_ERR(tfm)) 13856c52da2SJouni Malinen crypto_cipher_setkey(tfm, key, key_len); 139765cb46aSJouni Malinen 140765cb46aSJouni Malinen return tfm; 141765cb46aSJouni Malinen } 142765cb46aSJouni Malinen 143765cb46aSJouni Malinen 144765cb46aSJouni Malinen void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm) 145765cb46aSJouni Malinen { 146765cb46aSJouni Malinen crypto_free_cipher(tfm); 147765cb46aSJouni Malinen } 1485d0d04e4SAssaf Krauss 1495d0d04e4SAssaf Krauss void ieee80211_aes_cmac_calculate_k1_k2(struct ieee80211_key_conf *keyconf, 1505d0d04e4SAssaf Krauss u8 *k1, u8 *k2) 1515d0d04e4SAssaf Krauss { 1525d0d04e4SAssaf Krauss u8 l[AES_BLOCK_SIZE] = {}; 1535d0d04e4SAssaf Krauss struct ieee80211_key *key = 1545d0d04e4SAssaf Krauss container_of(keyconf, struct ieee80211_key, conf); 1555d0d04e4SAssaf Krauss 1565d0d04e4SAssaf Krauss crypto_cipher_encrypt_one(key->u.aes_cmac.tfm, l, l); 1575d0d04e4SAssaf Krauss 1585d0d04e4SAssaf Krauss memcpy(k1, l, AES_BLOCK_SIZE); 1595d0d04e4SAssaf Krauss gf_mulx(k1); 1605d0d04e4SAssaf Krauss 1615d0d04e4SAssaf Krauss memcpy(k2, k1, AES_BLOCK_SIZE); 1625d0d04e4SAssaf Krauss gf_mulx(k2); 1635d0d04e4SAssaf Krauss } 1645d0d04e4SAssaf Krauss EXPORT_SYMBOL(ieee80211_aes_cmac_calculate_k1_k2); 165