1 /* 2 * Copyright (c) 2011 The Chromium OS Authors. 3 * (C) Copyright 2010 - 2011 NVIDIA Corporation <www.nvidia.com> 4 * 5 * SPDX-License-Identifier: GPL-2.0+ 6 */ 7 8 #include <common.h> 9 #include <linux/errno.h> 10 #include "crypto.h" 11 #include "uboot_aes.h" 12 13 static u8 zero_key[16]; 14 15 #define AES_CMAC_CONST_RB 0x87 /* from RFC 4493, Figure 2.2 */ 16 17 enum security_op { 18 SECURITY_SIGN = 1 << 0, /* Sign the data */ 19 SECURITY_ENCRYPT = 1 << 1, /* Encrypt the data */ 20 }; 21 22 /** 23 * Shift a vector left by one bit 24 * 25 * \param in Input vector 26 * \param out Output vector 27 * \param size Length of vector in bytes 28 */ 29 static void left_shift_vector(u8 *in, u8 *out, int size) 30 { 31 int carry = 0; 32 int i; 33 34 for (i = size - 1; i >= 0; i--) { 35 out[i] = (in[i] << 1) | carry; 36 carry = in[i] >> 7; /* get most significant bit */ 37 } 38 } 39 40 /** 41 * Sign a block of data, putting the result into dst. 42 * 43 * \param key Input AES key, length AES_KEY_LENGTH 44 * \param key_schedule Expanded key to use 45 * \param src Source data of length 'num_aes_blocks' blocks 46 * \param dst Destination buffer, length AES_KEY_LENGTH 47 * \param num_aes_blocks Number of AES blocks to encrypt 48 */ 49 static void sign_object(u8 *key, u8 *key_schedule, u8 *src, u8 *dst, 50 u32 num_aes_blocks) 51 { 52 u8 tmp_data[AES_KEY_LENGTH]; 53 u8 iv[AES_KEY_LENGTH] = {0}; 54 u8 left[AES_KEY_LENGTH]; 55 u8 k1[AES_KEY_LENGTH]; 56 u8 *cbc_chain_data; 57 unsigned i; 58 59 cbc_chain_data = zero_key; /* Convenient array of 0's for IV */ 60 61 /* compute K1 constant needed by AES-CMAC calculation */ 62 for (i = 0; i < AES_KEY_LENGTH; i++) 63 tmp_data[i] = 0; 64 65 aes_cbc_encrypt_blocks(key_schedule, iv, tmp_data, left, 1); 66 67 left_shift_vector(left, k1, sizeof(left)); 68 69 if ((left[0] >> 7) != 0) /* get MSB of L */ 70 k1[AES_KEY_LENGTH-1] ^= AES_CMAC_CONST_RB; 71 72 /* compute the AES-CMAC value */ 73 for (i = 0; i < num_aes_blocks; i++) { 74 /* Apply the chain data */ 75 aes_apply_cbc_chain_data(cbc_chain_data, src, tmp_data); 76 77 /* for the final block, XOR K1 into the IV */ 78 if (i == num_aes_blocks - 1) 79 aes_apply_cbc_chain_data(tmp_data, k1, tmp_data); 80 81 /* encrypt the AES block */ 82 aes_encrypt(tmp_data, key_schedule, dst); 83 84 debug("sign_obj: block %d of %d\n", i, num_aes_blocks); 85 86 /* Update pointers for next loop. */ 87 cbc_chain_data = dst; 88 src += AES_KEY_LENGTH; 89 } 90 } 91 92 /** 93 * Encrypt and sign a block of data (depending on security mode). 94 * 95 * \param key Input AES key, length AES_KEY_LENGTH 96 * \param oper Security operations mask to perform (enum security_op) 97 * \param src Source data 98 * \param length Size of source data 99 * \param sig_dst Destination address for signature, AES_KEY_LENGTH bytes 100 */ 101 static int encrypt_and_sign(u8 *key, enum security_op oper, u8 *src, 102 u32 length, u8 *sig_dst) 103 { 104 u32 num_aes_blocks; 105 u8 key_schedule[AES_EXPAND_KEY_LENGTH]; 106 u8 iv[AES_KEY_LENGTH] = {0}; 107 108 debug("encrypt_and_sign: length = %d\n", length); 109 110 /* 111 * The only need for a key is for signing/checksum purposes, so 112 * if not encrypting, expand a key of 0s. 113 */ 114 aes_expand_key(oper & SECURITY_ENCRYPT ? key : zero_key, key_schedule); 115 116 num_aes_blocks = (length + AES_KEY_LENGTH - 1) / AES_KEY_LENGTH; 117 118 if (oper & SECURITY_ENCRYPT) { 119 /* Perform this in place, resulting in src being encrypted. */ 120 debug("encrypt_and_sign: begin encryption\n"); 121 aes_cbc_encrypt_blocks(key_schedule, iv, src, src, 122 num_aes_blocks); 123 debug("encrypt_and_sign: end encryption\n"); 124 } 125 126 if (oper & SECURITY_SIGN) { 127 /* encrypt the data, overwriting the result in signature. */ 128 debug("encrypt_and_sign: begin signing\n"); 129 sign_object(key, key_schedule, src, sig_dst, num_aes_blocks); 130 debug("encrypt_and_sign: end signing\n"); 131 } 132 133 return 0; 134 } 135 136 int sign_data_block(u8 *source, unsigned length, u8 *signature) 137 { 138 return encrypt_and_sign(zero_key, SECURITY_SIGN, source, 139 length, signature); 140 } 141