ble_mesh: Format source and header files of tinycrypt
This commit is contained in:
lly
bot
parent
12b9f59559
commit
d690e52993
|
|
@ -62,7 +62,7 @@ extern "C" {
|
||||||
#define TC_AES_KEY_SIZE (Nb*Nk)
|
#define TC_AES_KEY_SIZE (Nb*Nk)
|
||||||
|
|
||||||
typedef struct tc_aes_key_sched_struct {
|
typedef struct tc_aes_key_sched_struct {
|
||||||
unsigned int words[Nb*(Nr+1)];
|
unsigned int words[Nb * (Nr + 1)];
|
||||||
} *TCAesKeySched_t;
|
} *TCAesKeySched_t;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
@ -91,7 +91,7 @@ int tc_aes128_set_encrypt_key(TCAesKeySched_t s, const uint8_t *k);
|
||||||
* @param s IN -- initialized AES key schedule
|
* @param s IN -- initialized AES key schedule
|
||||||
*/
|
*/
|
||||||
int tc_aes_encrypt(uint8_t *out, const uint8_t *in,
|
int tc_aes_encrypt(uint8_t *out, const uint8_t *in,
|
||||||
const TCAesKeySched_t s);
|
const TCAesKeySched_t s);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief Set the AES-128 decryption key
|
* @brief Set the AES-128 decryption key
|
||||||
|
|
@ -121,7 +121,7 @@ int tc_aes128_set_decrypt_key(TCAesKeySched_t s, const uint8_t *k);
|
||||||
* @param s IN -- initialized AES key schedule
|
* @param s IN -- initialized AES key schedule
|
||||||
*/
|
*/
|
||||||
int tc_aes_decrypt(uint8_t *out, const uint8_t *in,
|
int tc_aes_decrypt(uint8_t *out, const uint8_t *in,
|
||||||
const TCAesKeySched_t s);
|
const TCAesKeySched_t s);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -108,8 +108,8 @@ extern "C" {
|
||||||
* @param sched IN -- AES key schedule for this encrypt
|
* @param sched IN -- AES key schedule for this encrypt
|
||||||
*/
|
*/
|
||||||
int tc_cbc_mode_encrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
int tc_cbc_mode_encrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
unsigned int inlen, const uint8_t *iv,
|
unsigned int inlen, const uint8_t *iv,
|
||||||
const TCAesKeySched_t sched);
|
const TCAesKeySched_t sched);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief CBC decryption procedure
|
* @brief CBC decryption procedure
|
||||||
|
|
@ -141,8 +141,8 @@ int tc_cbc_mode_encrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
int tc_cbc_mode_decrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
int tc_cbc_mode_decrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
unsigned int inlen, const uint8_t *iv,
|
unsigned int inlen, const uint8_t *iv,
|
||||||
const TCAesKeySched_t sched);
|
const TCAesKeySched_t sched);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -89,9 +89,9 @@ extern "C" {
|
||||||
|
|
||||||
/* struct tc_ccm_mode_struct represents the state of a CCM computation */
|
/* struct tc_ccm_mode_struct represents the state of a CCM computation */
|
||||||
typedef struct tc_ccm_mode_struct {
|
typedef struct tc_ccm_mode_struct {
|
||||||
TCAesKeySched_t sched; /* AES key schedule */
|
TCAesKeySched_t sched; /* AES key schedule */
|
||||||
uint8_t *nonce; /* nonce required by CCM */
|
uint8_t *nonce; /* nonce required by CCM */
|
||||||
unsigned int mlen; /* mac length in bytes (parameter t in SP-800 38C) */
|
unsigned int mlen; /* mac length in bytes (parameter t in SP-800 38C) */
|
||||||
} *TCCcmMode_t;
|
} *TCCcmMode_t;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
@ -109,7 +109,7 @@ typedef struct tc_ccm_mode_struct {
|
||||||
* @param mlen -- mac length in bytes (parameter t in SP-800 38C)
|
* @param mlen -- mac length in bytes (parameter t in SP-800 38C)
|
||||||
*/
|
*/
|
||||||
int tc_ccm_config(TCCcmMode_t c, TCAesKeySched_t sched, uint8_t *nonce,
|
int tc_ccm_config(TCCcmMode_t c, TCAesKeySched_t sched, uint8_t *nonce,
|
||||||
unsigned int nlen, unsigned int mlen);
|
unsigned int nlen, unsigned int mlen);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief CCM tag generation and encryption procedure
|
* @brief CCM tag generation and encryption procedure
|
||||||
|
|
@ -154,9 +154,9 @@ int tc_ccm_config(TCCcmMode_t c, TCAesKeySched_t sched, uint8_t *nonce,
|
||||||
* 7: always 0
|
* 7: always 0
|
||||||
*/
|
*/
|
||||||
int tc_ccm_generation_encryption(uint8_t *out, unsigned int olen,
|
int tc_ccm_generation_encryption(uint8_t *out, unsigned int olen,
|
||||||
const uint8_t *associated_data,
|
const uint8_t *associated_data,
|
||||||
unsigned int alen, const uint8_t *payload,
|
unsigned int alen, const uint8_t *payload,
|
||||||
unsigned int plen, TCCcmMode_t c);
|
unsigned int plen, TCCcmMode_t c);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief CCM decryption and tag verification procedure
|
* @brief CCM decryption and tag verification procedure
|
||||||
|
|
@ -200,9 +200,9 @@ int tc_ccm_generation_encryption(uint8_t *out, unsigned int olen,
|
||||||
* 7: always 0
|
* 7: always 0
|
||||||
*/
|
*/
|
||||||
int tc_ccm_decryption_verification(uint8_t *out, unsigned int olen,
|
int tc_ccm_decryption_verification(uint8_t *out, unsigned int olen,
|
||||||
const uint8_t *associated_data,
|
const uint8_t *associated_data,
|
||||||
unsigned int alen, const uint8_t *payload, unsigned int plen,
|
unsigned int alen, const uint8_t *payload, unsigned int plen,
|
||||||
TCCcmMode_t c);
|
TCCcmMode_t c);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -110,22 +110,22 @@ extern "C" {
|
||||||
|
|
||||||
/* struct tc_cmac_struct represents the state of a CMAC computation */
|
/* struct tc_cmac_struct represents the state of a CMAC computation */
|
||||||
typedef struct tc_cmac_struct {
|
typedef struct tc_cmac_struct {
|
||||||
/* initialization vector */
|
/* initialization vector */
|
||||||
uint8_t iv[TC_AES_BLOCK_SIZE];
|
uint8_t iv[TC_AES_BLOCK_SIZE];
|
||||||
/* used if message length is a multiple of block_size bytes */
|
/* used if message length is a multiple of block_size bytes */
|
||||||
uint8_t K1[TC_AES_BLOCK_SIZE];
|
uint8_t K1[TC_AES_BLOCK_SIZE];
|
||||||
/* used if message length isn't a multiple block_size bytes */
|
/* used if message length isn't a multiple block_size bytes */
|
||||||
uint8_t K2[TC_AES_BLOCK_SIZE];
|
uint8_t K2[TC_AES_BLOCK_SIZE];
|
||||||
/* where to put bytes that didn't fill a block */
|
/* where to put bytes that didn't fill a block */
|
||||||
uint8_t leftover[TC_AES_BLOCK_SIZE];
|
uint8_t leftover[TC_AES_BLOCK_SIZE];
|
||||||
/* identifies the encryption key */
|
/* identifies the encryption key */
|
||||||
unsigned int keyid;
|
unsigned int keyid;
|
||||||
/* next available leftover location */
|
/* next available leftover location */
|
||||||
unsigned int leftover_offset;
|
unsigned int leftover_offset;
|
||||||
/* AES key schedule */
|
/* AES key schedule */
|
||||||
TCAesKeySched_t sched;
|
TCAesKeySched_t sched;
|
||||||
/* calls to tc_cmac_update left before re-key */
|
/* calls to tc_cmac_update left before re-key */
|
||||||
uint64_t countdown;
|
uint64_t countdown;
|
||||||
} *TCCmacState_t;
|
} *TCCmacState_t;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
@ -140,7 +140,7 @@ typedef struct tc_cmac_struct {
|
||||||
* @param sched IN -- AES key schedule
|
* @param sched IN -- AES key schedule
|
||||||
*/
|
*/
|
||||||
int tc_cmac_setup(TCCmacState_t s, const uint8_t *key,
|
int tc_cmac_setup(TCCmacState_t s, const uint8_t *key,
|
||||||
TCAesKeySched_t sched);
|
TCAesKeySched_t sched);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief Erases the CMAC state
|
* @brief Erases the CMAC state
|
||||||
|
|
|
||||||
|
|
@ -99,7 +99,7 @@ extern "C" {
|
||||||
* @param sched IN -- an initialized AES key schedule
|
* @param sched IN -- an initialized AES key schedule
|
||||||
*/
|
*/
|
||||||
int tc_ctr_mode(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
int tc_ctr_mode(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
unsigned int inlen, uint8_t *ctr, const TCAesKeySched_t sched);
|
unsigned int inlen, uint8_t *ctr, const TCAesKeySched_t sched);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -68,14 +68,14 @@ extern "C" {
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
typedef struct {
|
typedef struct {
|
||||||
/* updated each time another BLOCKLEN_BYTES bytes are produced */
|
/* updated each time another BLOCKLEN_BYTES bytes are produced */
|
||||||
uint8_t V[TC_AES_BLOCK_SIZE];
|
uint8_t V[TC_AES_BLOCK_SIZE];
|
||||||
|
|
||||||
/* updated whenever the PRNG is reseeded */
|
/* updated whenever the PRNG is reseeded */
|
||||||
struct tc_aes_key_sched_struct key;
|
struct tc_aes_key_sched_struct key;
|
||||||
|
|
||||||
/* number of requests since initialization/reseeding */
|
/* number of requests since initialization/reseeding */
|
||||||
uint64_t reseedCount;
|
uint64_t reseedCount;
|
||||||
} TCCtrPrng_t;
|
} TCCtrPrng_t;
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -98,11 +98,11 @@ typedef struct {
|
||||||
* @param plen IN -- personalization length in bytes
|
* @param plen IN -- personalization length in bytes
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
int tc_ctr_prng_init(TCCtrPrng_t * const ctx,
|
int tc_ctr_prng_init(TCCtrPrng_t *const ctx,
|
||||||
uint8_t const * const entropy,
|
uint8_t const *const entropy,
|
||||||
unsigned int entropyLen,
|
unsigned int entropyLen,
|
||||||
uint8_t const * const personalization,
|
uint8_t const *const personalization,
|
||||||
unsigned int pLen);
|
unsigned int pLen);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief CTR-PRNG reseed procedure
|
* @brief CTR-PRNG reseed procedure
|
||||||
|
|
@ -123,11 +123,11 @@ int tc_ctr_prng_init(TCCtrPrng_t * const ctx,
|
||||||
* @param additional_input IN -- additional input to the prng (may be null)
|
* @param additional_input IN -- additional input to the prng (may be null)
|
||||||
* @param additionallen IN -- additional input length in bytes
|
* @param additionallen IN -- additional input length in bytes
|
||||||
*/
|
*/
|
||||||
int tc_ctr_prng_reseed(TCCtrPrng_t * const ctx,
|
int tc_ctr_prng_reseed(TCCtrPrng_t *const ctx,
|
||||||
uint8_t const * const entropy,
|
uint8_t const *const entropy,
|
||||||
unsigned int entropyLen,
|
unsigned int entropyLen,
|
||||||
uint8_t const * const additional_input,
|
uint8_t const *const additional_input,
|
||||||
unsigned int additionallen);
|
unsigned int additionallen);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief CTR-PRNG generate procedure
|
* @brief CTR-PRNG generate procedure
|
||||||
|
|
@ -145,11 +145,11 @@ int tc_ctr_prng_reseed(TCCtrPrng_t * const ctx,
|
||||||
* @param out IN/OUT -- buffer to receive output
|
* @param out IN/OUT -- buffer to receive output
|
||||||
* @param outlen IN -- size of out buffer in bytes
|
* @param outlen IN -- size of out buffer in bytes
|
||||||
*/
|
*/
|
||||||
int tc_ctr_prng_generate(TCCtrPrng_t * const ctx,
|
int tc_ctr_prng_generate(TCCtrPrng_t *const ctx,
|
||||||
uint8_t const * const additional_input,
|
uint8_t const *const additional_input,
|
||||||
unsigned int additionallen,
|
unsigned int additionallen,
|
||||||
uint8_t * const out,
|
uint8_t *const out,
|
||||||
unsigned int outlen);
|
unsigned int outlen);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief CTR-PRNG uninstantiate procedure
|
* @brief CTR-PRNG uninstantiate procedure
|
||||||
|
|
@ -157,7 +157,7 @@ int tc_ctr_prng_generate(TCCtrPrng_t * const ctx,
|
||||||
* @return none
|
* @return none
|
||||||
* @param ctx IN/OUT -- the PRNG context
|
* @param ctx IN/OUT -- the PRNG context
|
||||||
*/
|
*/
|
||||||
void tc_ctr_prng_uninstantiate(TCCtrPrng_t * const ctx);
|
void tc_ctr_prng_uninstantiate(TCCtrPrng_t *const ctx);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -108,19 +108,19 @@ typedef uint64_t uECC_dword_t;
|
||||||
|
|
||||||
/* structure that represents an elliptic curve (e.g. p256):*/
|
/* structure that represents an elliptic curve (e.g. p256):*/
|
||||||
struct uECC_Curve_t;
|
struct uECC_Curve_t;
|
||||||
typedef const struct uECC_Curve_t * uECC_Curve;
|
typedef const struct uECC_Curve_t *uECC_Curve;
|
||||||
struct uECC_Curve_t {
|
struct uECC_Curve_t {
|
||||||
wordcount_t num_words;
|
wordcount_t num_words;
|
||||||
wordcount_t num_bytes;
|
wordcount_t num_bytes;
|
||||||
bitcount_t num_n_bits;
|
bitcount_t num_n_bits;
|
||||||
uECC_word_t p[NUM_ECC_WORDS];
|
uECC_word_t p[NUM_ECC_WORDS];
|
||||||
uECC_word_t n[NUM_ECC_WORDS];
|
uECC_word_t n[NUM_ECC_WORDS];
|
||||||
uECC_word_t G[NUM_ECC_WORDS * 2];
|
uECC_word_t G[NUM_ECC_WORDS * 2];
|
||||||
uECC_word_t b[NUM_ECC_WORDS];
|
uECC_word_t b[NUM_ECC_WORDS];
|
||||||
void (*double_jacobian)(uECC_word_t * X1, uECC_word_t * Y1, uECC_word_t * Z1,
|
void (*double_jacobian)(uECC_word_t *X1, uECC_word_t *Y1, uECC_word_t *Z1,
|
||||||
uECC_Curve curve);
|
uECC_Curve curve);
|
||||||
void (*x_side)(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve);
|
void (*x_side)(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve);
|
||||||
void (*mmod_fast)(uECC_word_t *result, uECC_word_t *product);
|
void (*mmod_fast)(uECC_word_t *result, uECC_word_t *product);
|
||||||
};
|
};
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
@ -130,8 +130,8 @@ struct uECC_Curve_t {
|
||||||
* @param Z1 IN/OUT -- z coordinate
|
* @param Z1 IN/OUT -- z coordinate
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
void double_jacobian_default(uECC_word_t * X1, uECC_word_t * Y1,
|
void double_jacobian_default(uECC_word_t *X1, uECC_word_t *Y1,
|
||||||
uECC_word_t * Z1, uECC_Curve curve);
|
uECC_word_t *Z1, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes x^3 + ax + b. result must not overlap x.
|
* @brief Computes x^3 + ax + b. result must not overlap x.
|
||||||
|
|
@ -140,7 +140,7 @@ void double_jacobian_default(uECC_word_t * X1, uECC_word_t * Y1,
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
void x_side_default(uECC_word_t *result, const uECC_word_t *x,
|
void x_side_default(uECC_word_t *result, const uECC_word_t *x,
|
||||||
uECC_Curve curve);
|
uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes result = product % curve_p
|
* @brief Computes result = product % curve_p
|
||||||
|
|
@ -154,42 +154,42 @@ void vli_mmod_fast_secp256r1(unsigned int *result, unsigned int *product);
|
||||||
#define BYTES_TO_WORDS_8(a, b, c, d, e, f, g, h) 0x##d##c##b##a, 0x##h##g##f##e
|
#define BYTES_TO_WORDS_8(a, b, c, d, e, f, g, h) 0x##d##c##b##a, 0x##h##g##f##e
|
||||||
#define BYTES_TO_WORDS_4(a, b, c, d) 0x##d##c##b##a
|
#define BYTES_TO_WORDS_4(a, b, c, d) 0x##d##c##b##a
|
||||||
#define BITS_TO_WORDS(num_bits) \
|
#define BITS_TO_WORDS(num_bits) \
|
||||||
((num_bits + ((uECC_WORD_SIZE * 8) - 1)) / (uECC_WORD_SIZE * 8))
|
((num_bits + ((uECC_WORD_SIZE * 8) - 1)) / (uECC_WORD_SIZE * 8))
|
||||||
#define BITS_TO_BYTES(num_bits) ((num_bits + 7) / 8)
|
#define BITS_TO_BYTES(num_bits) ((num_bits + 7) / 8)
|
||||||
|
|
||||||
/* definition of curve NIST p-256: */
|
/* definition of curve NIST p-256: */
|
||||||
static const struct uECC_Curve_t curve_secp256r1 = {
|
static const struct uECC_Curve_t curve_secp256r1 = {
|
||||||
NUM_ECC_WORDS,
|
NUM_ECC_WORDS,
|
||||||
NUM_ECC_BYTES,
|
NUM_ECC_BYTES,
|
||||||
256, /* num_n_bits */ {
|
256, /* num_n_bits */ {
|
||||||
BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
|
BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
|
||||||
BYTES_TO_WORDS_8(FF, FF, FF, FF, 00, 00, 00, 00),
|
BYTES_TO_WORDS_8(FF, FF, FF, FF, 00, 00, 00, 00),
|
||||||
BYTES_TO_WORDS_8(00, 00, 00, 00, 00, 00, 00, 00),
|
BYTES_TO_WORDS_8(00, 00, 00, 00, 00, 00, 00, 00),
|
||||||
BYTES_TO_WORDS_8(01, 00, 00, 00, FF, FF, FF, FF)
|
BYTES_TO_WORDS_8(01, 00, 00, 00, FF, FF, FF, FF)
|
||||||
}, {
|
}, {
|
||||||
BYTES_TO_WORDS_8(51, 25, 63, FC, C2, CA, B9, F3),
|
BYTES_TO_WORDS_8(51, 25, 63, FC, C2, CA, B9, F3),
|
||||||
BYTES_TO_WORDS_8(84, 9E, 17, A7, AD, FA, E6, BC),
|
BYTES_TO_WORDS_8(84, 9E, 17, A7, AD, FA, E6, BC),
|
||||||
BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
|
BYTES_TO_WORDS_8(FF, FF, FF, FF, FF, FF, FF, FF),
|
||||||
BYTES_TO_WORDS_8(00, 00, 00, 00, FF, FF, FF, FF)
|
BYTES_TO_WORDS_8(00, 00, 00, 00, FF, FF, FF, FF)
|
||||||
}, {
|
}, {
|
||||||
BYTES_TO_WORDS_8(96, C2, 98, D8, 45, 39, A1, F4),
|
BYTES_TO_WORDS_8(96, C2, 98, D8, 45, 39, A1, F4),
|
||||||
BYTES_TO_WORDS_8(A0, 33, EB, 2D, 81, 7D, 03, 77),
|
BYTES_TO_WORDS_8(A0, 33, EB, 2D, 81, 7D, 03, 77),
|
||||||
BYTES_TO_WORDS_8(F2, 40, A4, 63, E5, E6, BC, F8),
|
BYTES_TO_WORDS_8(F2, 40, A4, 63, E5, E6, BC, F8),
|
||||||
BYTES_TO_WORDS_8(47, 42, 2C, E1, F2, D1, 17, 6B),
|
BYTES_TO_WORDS_8(47, 42, 2C, E1, F2, D1, 17, 6B),
|
||||||
|
|
||||||
BYTES_TO_WORDS_8(F5, 51, BF, 37, 68, 40, B6, CB),
|
BYTES_TO_WORDS_8(F5, 51, BF, 37, 68, 40, B6, CB),
|
||||||
BYTES_TO_WORDS_8(CE, 5E, 31, 6B, 57, 33, CE, 2B),
|
BYTES_TO_WORDS_8(CE, 5E, 31, 6B, 57, 33, CE, 2B),
|
||||||
BYTES_TO_WORDS_8(16, 9E, 0F, 7C, 4A, EB, E7, 8E),
|
BYTES_TO_WORDS_8(16, 9E, 0F, 7C, 4A, EB, E7, 8E),
|
||||||
BYTES_TO_WORDS_8(9B, 7F, 1A, FE, E2, 42, E3, 4F)
|
BYTES_TO_WORDS_8(9B, 7F, 1A, FE, E2, 42, E3, 4F)
|
||||||
}, {
|
}, {
|
||||||
BYTES_TO_WORDS_8(4B, 60, D2, 27, 3E, 3C, CE, 3B),
|
BYTES_TO_WORDS_8(4B, 60, D2, 27, 3E, 3C, CE, 3B),
|
||||||
BYTES_TO_WORDS_8(F6, B0, 53, CC, B0, 06, 1D, 65),
|
BYTES_TO_WORDS_8(F6, B0, 53, CC, B0, 06, 1D, 65),
|
||||||
BYTES_TO_WORDS_8(BC, 86, 98, 76, 55, BD, EB, B3),
|
BYTES_TO_WORDS_8(BC, 86, 98, 76, 55, BD, EB, B3),
|
||||||
BYTES_TO_WORDS_8(E7, 93, 3A, AA, D8, 35, C6, 5A)
|
BYTES_TO_WORDS_8(E7, 93, 3A, AA, D8, 35, C6, 5A)
|
||||||
},
|
},
|
||||||
&double_jacobian_default,
|
&double_jacobian_default,
|
||||||
&x_side_default,
|
&x_side_default,
|
||||||
&vli_mmod_fast_secp256r1
|
&vli_mmod_fast_secp256r1
|
||||||
};
|
};
|
||||||
|
|
||||||
uECC_Curve uECC_secp256r1(void);
|
uECC_Curve uECC_secp256r1(void);
|
||||||
|
|
@ -203,7 +203,7 @@ uECC_Curve uECC_secp256r1(void);
|
||||||
* @return a random integer in the range 0 < random < top
|
* @return a random integer in the range 0 < random < top
|
||||||
*/
|
*/
|
||||||
int uECC_generate_random_int(uECC_word_t *random, const uECC_word_t *top,
|
int uECC_generate_random_int(uECC_word_t *random, const uECC_word_t *top,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
|
|
||||||
/* uECC_RNG_Function type
|
/* uECC_RNG_Function type
|
||||||
|
|
@ -264,7 +264,7 @@ int uECC_curve_public_key_size(uECC_Curve curve);
|
||||||
* @return Returns 1 if key was computed successfully, 0 if an error occurred.
|
* @return Returns 1 if key was computed successfully, 0 if an error occurred.
|
||||||
*/
|
*/
|
||||||
int uECC_compute_public_key(const uint8_t *private_key,
|
int uECC_compute_public_key(const uint8_t *private_key,
|
||||||
uint8_t *public_key, uECC_Curve curve);
|
uint8_t *public_key, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Compute public-key.
|
* @brief Compute public-key.
|
||||||
|
|
@ -274,7 +274,7 @@ int uECC_compute_public_key(const uint8_t *private_key,
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
uECC_word_t EccPoint_compute_public_key(uECC_word_t *result,
|
uECC_word_t EccPoint_compute_public_key(uECC_word_t *result,
|
||||||
uECC_word_t *private_key, uECC_Curve curve);
|
uECC_word_t *private_key, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Regularize the bitcount for the private key so that attackers cannot
|
* @brief Regularize the bitcount for the private key so that attackers cannot
|
||||||
|
|
@ -285,8 +285,8 @@ uECC_word_t EccPoint_compute_public_key(uECC_word_t *result,
|
||||||
* @param k1 IN/OUT -- regularized k
|
* @param k1 IN/OUT -- regularized k
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
uECC_word_t regularize_k(const uECC_word_t * const k, uECC_word_t *k0,
|
uECC_word_t regularize_k(const uECC_word_t *const k, uECC_word_t *k0,
|
||||||
uECC_word_t *k1, uECC_Curve curve);
|
uECC_word_t *k1, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Point multiplication algorithm using Montgomery's ladder with co-Z
|
* @brief Point multiplication algorithm using Montgomery's ladder with co-Z
|
||||||
|
|
@ -299,9 +299,9 @@ uECC_word_t regularize_k(const uECC_word_t * const k, uECC_word_t *k0,
|
||||||
* @param num_bits IN -- number of bits in scalar
|
* @param num_bits IN -- number of bits in scalar
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
void EccPoint_mult(uECC_word_t * result, const uECC_word_t * point,
|
void EccPoint_mult(uECC_word_t *result, const uECC_word_t *point,
|
||||||
const uECC_word_t * scalar, const uECC_word_t * initial_Z,
|
const uECC_word_t *scalar, const uECC_word_t *initial_Z,
|
||||||
bitcount_t num_bits, uECC_Curve curve);
|
bitcount_t num_bits, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Constant-time comparison to zero - secure way to compare long integers
|
* @brief Constant-time comparison to zero - secure way to compare long integers
|
||||||
|
|
@ -327,7 +327,7 @@ uECC_word_t EccPoint_isZero(const uECC_word_t *point, uECC_Curve curve);
|
||||||
* @return the sign of left - right
|
* @return the sign of left - right
|
||||||
*/
|
*/
|
||||||
cmpresult_t uECC_vli_cmp(const uECC_word_t *left, const uECC_word_t *right,
|
cmpresult_t uECC_vli_cmp(const uECC_word_t *left, const uECC_word_t *right,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief computes sign of left - right, not in constant time.
|
* @brief computes sign of left - right, not in constant time.
|
||||||
|
|
@ -338,7 +338,7 @@ cmpresult_t uECC_vli_cmp(const uECC_word_t *left, const uECC_word_t *right,
|
||||||
* @return the sign of left - right
|
* @return the sign of left - right
|
||||||
*/
|
*/
|
||||||
cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left, const uECC_word_t *right,
|
cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left, const uECC_word_t *right,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes result = (left - right) % mod.
|
* @brief Computes result = (left - right) % mod.
|
||||||
|
|
@ -351,8 +351,8 @@ cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left, const uECC_word_t *righ
|
||||||
* @param num_words IN -- number of words
|
* @param num_words IN -- number of words
|
||||||
*/
|
*/
|
||||||
void uECC_vli_modSub(uECC_word_t *result, const uECC_word_t *left,
|
void uECC_vli_modSub(uECC_word_t *result, const uECC_word_t *left,
|
||||||
const uECC_word_t *right, const uECC_word_t *mod,
|
const uECC_word_t *right, const uECC_word_t *mod,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes P' = (x1', y1', Z3), P + Q = (x3, y3, Z3) or
|
* @brief Computes P' = (x1', y1', Z3), P + Q = (x3, y3, Z3) or
|
||||||
|
|
@ -364,8 +364,8 @@ void uECC_vli_modSub(uECC_word_t *result, const uECC_word_t *left,
|
||||||
* @param Y2 IN -- y coordinate of Q
|
* @param Y2 IN -- y coordinate of Q
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1, uECC_word_t * X2,
|
void XYcZ_add(uECC_word_t *X1, uECC_word_t *Y1, uECC_word_t *X2,
|
||||||
uECC_word_t * Y2, uECC_Curve curve);
|
uECC_word_t *Y2, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes (x1 * z^2, y1 * z^3)
|
* @brief Computes (x1 * z^2, y1 * z^3)
|
||||||
|
|
@ -374,8 +374,8 @@ void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1, uECC_word_t * X2,
|
||||||
* @param Z IN -- z value
|
* @param Z IN -- z value
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
void apply_z(uECC_word_t * X1, uECC_word_t * Y1, const uECC_word_t * const Z,
|
void apply_z(uECC_word_t *X1, uECC_word_t *Y1, const uECC_word_t *const Z,
|
||||||
uECC_Curve curve);
|
uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Check if bit is set.
|
* @brief Check if bit is set.
|
||||||
|
|
@ -396,7 +396,7 @@ uECC_word_t uECC_vli_testBit(const uECC_word_t *vli, bitcount_t bit);
|
||||||
* @warning Currently only designed to work for curve_p or curve_n.
|
* @warning Currently only designed to work for curve_p or curve_n.
|
||||||
*/
|
*/
|
||||||
void uECC_vli_mmod(uECC_word_t *result, uECC_word_t *product,
|
void uECC_vli_mmod(uECC_word_t *result, uECC_word_t *product,
|
||||||
const uECC_word_t *mod, wordcount_t num_words);
|
const uECC_word_t *mod, wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes modular product (using curve->mmod_fast)
|
* @brief Computes modular product (using curve->mmod_fast)
|
||||||
|
|
@ -406,7 +406,7 @@ void uECC_vli_mmod(uECC_word_t *result, uECC_word_t *product,
|
||||||
* @param curve IN -- elliptic curve
|
* @param curve IN -- elliptic curve
|
||||||
*/
|
*/
|
||||||
void uECC_vli_modMult_fast(uECC_word_t *result, const uECC_word_t *left,
|
void uECC_vli_modMult_fast(uECC_word_t *result, const uECC_word_t *left,
|
||||||
const uECC_word_t *right, uECC_Curve curve);
|
const uECC_word_t *right, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes result = left - right.
|
* @brief Computes result = left - right.
|
||||||
|
|
@ -418,7 +418,7 @@ void uECC_vli_modMult_fast(uECC_word_t *result, const uECC_word_t *left,
|
||||||
* @return borrow
|
* @return borrow
|
||||||
*/
|
*/
|
||||||
uECC_word_t uECC_vli_sub(uECC_word_t *result, const uECC_word_t *left,
|
uECC_word_t uECC_vli_sub(uECC_word_t *result, const uECC_word_t *left,
|
||||||
const uECC_word_t *right, wordcount_t num_words);
|
const uECC_word_t *right, wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Constant-time comparison function(secure way to compare long ints)
|
* @brief Constant-time comparison function(secure way to compare long ints)
|
||||||
|
|
@ -428,7 +428,7 @@ uECC_word_t uECC_vli_sub(uECC_word_t *result, const uECC_word_t *left,
|
||||||
* @return Returns 0 if left == right, 1 otherwise.
|
* @return Returns 0 if left == right, 1 otherwise.
|
||||||
*/
|
*/
|
||||||
uECC_word_t uECC_vli_equal(const uECC_word_t *left, const uECC_word_t *right,
|
uECC_word_t uECC_vli_equal(const uECC_word_t *left, const uECC_word_t *right,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes (left * right) % mod
|
* @brief Computes (left * right) % mod
|
||||||
|
|
@ -439,8 +439,8 @@ uECC_word_t uECC_vli_equal(const uECC_word_t *left, const uECC_word_t *right,
|
||||||
* @param num_words IN -- number of words
|
* @param num_words IN -- number of words
|
||||||
*/
|
*/
|
||||||
void uECC_vli_modMult(uECC_word_t *result, const uECC_word_t *left,
|
void uECC_vli_modMult(uECC_word_t *result, const uECC_word_t *left,
|
||||||
const uECC_word_t *right, const uECC_word_t *mod,
|
const uECC_word_t *right, const uECC_word_t *mod,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes (1 / input) % mod
|
* @brief Computes (1 / input) % mod
|
||||||
|
|
@ -452,7 +452,7 @@ void uECC_vli_modMult(uECC_word_t *result, const uECC_word_t *left,
|
||||||
* @param num_words -- number of words
|
* @param num_words -- number of words
|
||||||
*/
|
*/
|
||||||
void uECC_vli_modInv(uECC_word_t *result, const uECC_word_t *input,
|
void uECC_vli_modInv(uECC_word_t *result, const uECC_word_t *input,
|
||||||
const uECC_word_t *mod, wordcount_t num_words);
|
const uECC_word_t *mod, wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Sets dest = src.
|
* @brief Sets dest = src.
|
||||||
|
|
@ -461,7 +461,7 @@ void uECC_vli_modInv(uECC_word_t *result, const uECC_word_t *input,
|
||||||
* @param num_words IN -- number of words
|
* @param num_words IN -- number of words
|
||||||
*/
|
*/
|
||||||
void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src,
|
void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Computes (left + right) % mod.
|
* @brief Computes (left + right) % mod.
|
||||||
|
|
@ -474,8 +474,8 @@ void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src,
|
||||||
* @param num_words IN -- number of words
|
* @param num_words IN -- number of words
|
||||||
*/
|
*/
|
||||||
void uECC_vli_modAdd(uECC_word_t *result, const uECC_word_t *left,
|
void uECC_vli_modAdd(uECC_word_t *result, const uECC_word_t *left,
|
||||||
const uECC_word_t *right, const uECC_word_t *mod,
|
const uECC_word_t *right, const uECC_word_t *mod,
|
||||||
wordcount_t num_words);
|
wordcount_t num_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Counts the number of bits required to represent vli.
|
* @brief Counts the number of bits required to represent vli.
|
||||||
|
|
@ -484,7 +484,7 @@ void uECC_vli_modAdd(uECC_word_t *result, const uECC_word_t *left,
|
||||||
* @return number of bits in given vli
|
* @return number of bits in given vli
|
||||||
*/
|
*/
|
||||||
bitcount_t uECC_vli_numBits(const uECC_word_t *vli,
|
bitcount_t uECC_vli_numBits(const uECC_word_t *vli,
|
||||||
const wordcount_t max_words);
|
const wordcount_t max_words);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Erases (set to 0) vli
|
* @brief Erases (set to 0) vli
|
||||||
|
|
@ -520,14 +520,14 @@ int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve);
|
||||||
*/
|
*/
|
||||||
int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve);
|
int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Converts an integer in uECC native format to big-endian bytes.
|
* @brief Converts an integer in uECC native format to big-endian bytes.
|
||||||
* @param bytes OUT -- bytes representation
|
* @param bytes OUT -- bytes representation
|
||||||
* @param num_bytes IN -- number of bytes
|
* @param num_bytes IN -- number of bytes
|
||||||
* @param native IN -- uECC native representation
|
* @param native IN -- uECC native representation
|
||||||
*/
|
*/
|
||||||
void uECC_vli_nativeToBytes(uint8_t *bytes, int num_bytes,
|
void uECC_vli_nativeToBytes(uint8_t *bytes, int num_bytes,
|
||||||
const unsigned int *native);
|
const unsigned int *native);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* @brief Converts big-endian bytes to an integer in uECC native format.
|
* @brief Converts big-endian bytes to an integer in uECC native format.
|
||||||
|
|
@ -536,7 +536,7 @@ void uECC_vli_nativeToBytes(uint8_t *bytes, int num_bytes,
|
||||||
* @param num_bytes IN -- number of bytes
|
* @param num_bytes IN -- number of bytes
|
||||||
*/
|
*/
|
||||||
void uECC_vli_bytesToNative(unsigned int *native, const uint8_t *bytes,
|
void uECC_vli_bytesToNative(unsigned int *native, const uint8_t *bytes,
|
||||||
int num_bytes);
|
int num_bytes);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -102,7 +102,7 @@ int uECC_make_key(uint8_t *p_public_key, uint8_t *p_private_key, uECC_Curve curv
|
||||||
* uECC_make_key() function for real applications.
|
* uECC_make_key() function for real applications.
|
||||||
*/
|
*/
|
||||||
int uECC_make_key_with_d(uint8_t *p_public_key, uint8_t *p_private_key,
|
int uECC_make_key_with_d(uint8_t *p_public_key, uint8_t *p_private_key,
|
||||||
unsigned int *d, uECC_Curve curve);
|
unsigned int *d, uECC_Curve curve);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
@ -122,7 +122,7 @@ int uECC_make_key_with_d(uint8_t *p_public_key, uint8_t *p_private_key,
|
||||||
* order to produce a cryptographically secure symmetric key.
|
* order to produce a cryptographically secure symmetric key.
|
||||||
*/
|
*/
|
||||||
int uECC_shared_secret(const uint8_t *p_public_key, const uint8_t *p_private_key,
|
int uECC_shared_secret(const uint8_t *p_public_key, const uint8_t *p_private_key,
|
||||||
uint8_t *p_secret, uECC_Curve curve);
|
uint8_t *p_secret, uECC_Curve curve);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -103,7 +103,7 @@ extern "C" {
|
||||||
* attack.
|
* attack.
|
||||||
*/
|
*/
|
||||||
int uECC_sign(const uint8_t *p_private_key, const uint8_t *p_message_hash,
|
int uECC_sign(const uint8_t *p_private_key, const uint8_t *p_message_hash,
|
||||||
unsigned p_hash_size, uint8_t *p_signature, uECC_Curve curve);
|
unsigned p_hash_size, uint8_t *p_signature, uECC_Curve curve);
|
||||||
|
|
||||||
#ifdef ENABLE_TESTS
|
#ifdef ENABLE_TESTS
|
||||||
/*
|
/*
|
||||||
|
|
@ -111,14 +111,14 @@ int uECC_sign(const uint8_t *p_private_key, const uint8_t *p_message_hash,
|
||||||
* Refer to uECC_sign() function for real applications.
|
* Refer to uECC_sign() function for real applications.
|
||||||
*/
|
*/
|
||||||
int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
||||||
unsigned int hash_size, uECC_word_t *k, uint8_t *signature,
|
unsigned int hash_size, uECC_word_t *k, uint8_t *signature,
|
||||||
uECC_Curve curve);
|
uECC_Curve curve);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief Verify an ECDSA signature.
|
* @brief Verify an ECDSA signature.
|
||||||
* @return returns TC_SUCCESS (1) if the signature is valid
|
* @return returns TC_SUCCESS (1) if the signature is valid
|
||||||
* returns TC_FAIL (0) if the signature is invalid.
|
* returns TC_FAIL (0) if the signature is invalid.
|
||||||
*
|
*
|
||||||
* @param p_public_key IN -- The signer's public key.
|
* @param p_public_key IN -- The signer's public key.
|
||||||
* @param p_message_hash IN -- The hash of the signed data.
|
* @param p_message_hash IN -- The hash of the signed data.
|
||||||
|
|
@ -130,7 +130,7 @@ int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
||||||
* the signature values (hash_size and signature).
|
* the signature values (hash_size and signature).
|
||||||
*/
|
*/
|
||||||
int uECC_verify(const uint8_t *p_public_key, const uint8_t *p_message_hash,
|
int uECC_verify(const uint8_t *p_public_key, const uint8_t *p_message_hash,
|
||||||
unsigned int p_hash_size, const uint8_t *p_signature, uECC_Curve curve);
|
unsigned int p_hash_size, const uint8_t *p_signature, uECC_Curve curve);
|
||||||
|
|
||||||
#ifdef __cplusplus
|
#ifdef __cplusplus
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -70,10 +70,10 @@ extern "C" {
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
struct tc_hmac_state_struct {
|
struct tc_hmac_state_struct {
|
||||||
/* the internal state required by h */
|
/* the internal state required by h */
|
||||||
struct tc_sha256_state_struct hash_state;
|
struct tc_sha256_state_struct hash_state;
|
||||||
/* HMAC key schedule */
|
/* HMAC key schedule */
|
||||||
uint8_t key[2*TC_SHA256_BLOCK_SIZE];
|
uint8_t key[2 * TC_SHA256_BLOCK_SIZE];
|
||||||
};
|
};
|
||||||
typedef struct tc_hmac_state_struct *TCHmacState_t;
|
typedef struct tc_hmac_state_struct *TCHmacState_t;
|
||||||
|
|
||||||
|
|
@ -90,7 +90,7 @@ typedef struct tc_hmac_state_struct *TCHmacState_t;
|
||||||
* @param key_size IN -- the HMAC key size
|
* @param key_size IN -- the HMAC key size
|
||||||
*/
|
*/
|
||||||
int tc_hmac_set_key(TCHmacState_t ctx, const uint8_t *key,
|
int tc_hmac_set_key(TCHmacState_t ctx, const uint8_t *key,
|
||||||
unsigned int key_size);
|
unsigned int key_size);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief HMAC init procedure
|
* @brief HMAC init procedure
|
||||||
|
|
@ -112,7 +112,7 @@ int tc_hmac_init(TCHmacState_t ctx);
|
||||||
* @param data_length IN -- size of data in bytes
|
* @param data_length IN -- size of data in bytes
|
||||||
*/
|
*/
|
||||||
int tc_hmac_update(TCHmacState_t ctx, const void *data,
|
int tc_hmac_update(TCHmacState_t ctx, const void *data,
|
||||||
unsigned int data_length);
|
unsigned int data_length);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief HMAC final procedure
|
* @brief HMAC final procedure
|
||||||
|
|
|
||||||
|
|
@ -78,14 +78,14 @@ extern "C" {
|
||||||
#define TC_HMAC_PRNG_RESEED_REQ -1
|
#define TC_HMAC_PRNG_RESEED_REQ -1
|
||||||
|
|
||||||
struct tc_hmac_prng_struct {
|
struct tc_hmac_prng_struct {
|
||||||
/* the HMAC instance for this PRNG */
|
/* the HMAC instance for this PRNG */
|
||||||
struct tc_hmac_state_struct h;
|
struct tc_hmac_state_struct h;
|
||||||
/* the PRNG key */
|
/* the PRNG key */
|
||||||
uint8_t key[TC_SHA256_DIGEST_SIZE];
|
uint8_t key[TC_SHA256_DIGEST_SIZE];
|
||||||
/* PRNG state */
|
/* PRNG state */
|
||||||
uint8_t v[TC_SHA256_DIGEST_SIZE];
|
uint8_t v[TC_SHA256_DIGEST_SIZE];
|
||||||
/* calls to tc_hmac_prng_generate left before re-seed */
|
/* calls to tc_hmac_prng_generate left before re-seed */
|
||||||
unsigned int countdown;
|
unsigned int countdown;
|
||||||
};
|
};
|
||||||
|
|
||||||
typedef struct tc_hmac_prng_struct *TCHmacPrng_t;
|
typedef struct tc_hmac_prng_struct *TCHmacPrng_t;
|
||||||
|
|
@ -113,14 +113,14 @@ typedef struct tc_hmac_prng_struct *TCHmacPrng_t;
|
||||||
* @param plen IN -- personalization length in bytes
|
* @param plen IN -- personalization length in bytes
|
||||||
*/
|
*/
|
||||||
int tc_hmac_prng_init(TCHmacPrng_t prng,
|
int tc_hmac_prng_init(TCHmacPrng_t prng,
|
||||||
const uint8_t *personalization,
|
const uint8_t *personalization,
|
||||||
unsigned int plen);
|
unsigned int plen);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief HMAC-PRNG reseed procedure
|
* @brief HMAC-PRNG reseed procedure
|
||||||
* Mixes seed into prng, enables tc_hmac_prng_generate
|
* Mixes seed into prng, enables tc_hmac_prng_generate
|
||||||
* @return returns TC_CRYPTO_SUCCESS (1)
|
* @return returns TC_CRYPTO_SUCCESS (1)
|
||||||
* returns TC_CRYPTO_FAIL (0) if:
|
* returns TC_CRYPTO_FAIL (0) if:
|
||||||
* prng == NULL,
|
* prng == NULL,
|
||||||
* seed == NULL,
|
* seed == NULL,
|
||||||
* seedlen < MIN_SLEN,
|
* seedlen < MIN_SLEN,
|
||||||
|
|
@ -137,8 +137,8 @@ int tc_hmac_prng_init(TCHmacPrng_t prng,
|
||||||
* @param additionallen IN -- additional input length in bytes
|
* @param additionallen IN -- additional input length in bytes
|
||||||
*/
|
*/
|
||||||
int tc_hmac_prng_reseed(TCHmacPrng_t prng, const uint8_t *seed,
|
int tc_hmac_prng_reseed(TCHmacPrng_t prng, const uint8_t *seed,
|
||||||
unsigned int seedlen, const uint8_t *additional_input,
|
unsigned int seedlen, const uint8_t *additional_input,
|
||||||
unsigned int additionallen);
|
unsigned int additionallen);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief HMAC-PRNG generate procedure
|
* @brief HMAC-PRNG generate procedure
|
||||||
|
|
|
||||||
|
|
@ -69,10 +69,10 @@ extern "C" {
|
||||||
#define TC_SHA256_STATE_BLOCKS (TC_SHA256_DIGEST_SIZE/4)
|
#define TC_SHA256_STATE_BLOCKS (TC_SHA256_DIGEST_SIZE/4)
|
||||||
|
|
||||||
struct tc_sha256_state_struct {
|
struct tc_sha256_state_struct {
|
||||||
unsigned int iv[TC_SHA256_STATE_BLOCKS];
|
unsigned int iv[TC_SHA256_STATE_BLOCKS];
|
||||||
uint64_t bits_hashed;
|
uint64_t bits_hashed;
|
||||||
uint8_t leftover[TC_SHA256_BLOCK_SIZE];
|
uint8_t leftover[TC_SHA256_BLOCK_SIZE];
|
||||||
size_t leftover_offset;
|
size_t leftover_offset;
|
||||||
};
|
};
|
||||||
|
|
||||||
typedef struct tc_sha256_state_struct *TCSha256State_t;
|
typedef struct tc_sha256_state_struct *TCSha256State_t;
|
||||||
|
|
|
||||||
|
|
@ -59,7 +59,7 @@ extern "C" {
|
||||||
* @param from_len IN -- length of origin buffer
|
* @param from_len IN -- length of origin buffer
|
||||||
*/
|
*/
|
||||||
unsigned int _copy(uint8_t *to, unsigned int to_len,
|
unsigned int _copy(uint8_t *to, unsigned int to_len,
|
||||||
const uint8_t *from, unsigned int from_len);
|
const uint8_t *from, unsigned int from_len);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief Set the value 'val' into the buffer 'to', 'len' times.
|
* @brief Set the value 'val' into the buffer 'to', 'len' times.
|
||||||
|
|
@ -88,9 +88,9 @@ extern void _set_secure(void *to, uint8_t val, unsigned int len);
|
||||||
#else /* ! TINYCRYPT_ARCH_HAS_SET_SECURE */
|
#else /* ! TINYCRYPT_ARCH_HAS_SET_SECURE */
|
||||||
static inline void _set_secure(void *to, uint8_t val, unsigned int len)
|
static inline void _set_secure(void *to, uint8_t val, unsigned int len)
|
||||||
{
|
{
|
||||||
(void) memset(to, val, len);
|
(void) memset(to, val, len);
|
||||||
#ifdef __GNUC__
|
#ifdef __GNUC__
|
||||||
__asm__ __volatile__("" :: "g"(to) : "memory");
|
__asm__ __volatile__("" :: "g"(to) : "memory");
|
||||||
#endif /* __GNUC__ */
|
#endif /* __GNUC__ */
|
||||||
}
|
}
|
||||||
#endif /* TINYCRYPT_ARCH_HAS_SET_SECURE */
|
#endif /* TINYCRYPT_ARCH_HAS_SET_SECURE */
|
||||||
|
|
|
||||||
|
|
@ -35,33 +35,33 @@
|
||||||
#include <tinycrypt/utils.h>
|
#include <tinycrypt/utils.h>
|
||||||
|
|
||||||
static const uint8_t inv_sbox[256] = {
|
static const uint8_t inv_sbox[256] = {
|
||||||
0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e,
|
0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e,
|
||||||
0x81, 0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87,
|
0x81, 0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87,
|
||||||
0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32,
|
0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32,
|
||||||
0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
|
0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
|
||||||
0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49,
|
0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49,
|
||||||
0x6d, 0x8b, 0xd1, 0x25, 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16,
|
0x6d, 0x8b, 0xd1, 0x25, 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16,
|
||||||
0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50,
|
0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50,
|
||||||
0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
|
0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
|
||||||
0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05,
|
0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05,
|
||||||
0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02,
|
0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02,
|
||||||
0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91, 0x11, 0x41,
|
0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91, 0x11, 0x41,
|
||||||
0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
|
0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
|
||||||
0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,
|
0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,
|
||||||
0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89,
|
0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89,
|
||||||
0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b,
|
0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b,
|
||||||
0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
|
0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
|
||||||
0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59,
|
0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59,
|
||||||
0x27, 0x80, 0xec, 0x5f, 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d,
|
0x27, 0x80, 0xec, 0x5f, 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d,
|
||||||
0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d,
|
0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d,
|
||||||
0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
|
0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
|
||||||
0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63,
|
0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63,
|
||||||
0x55, 0x21, 0x0c, 0x7d
|
0x55, 0x21, 0x0c, 0x7d
|
||||||
};
|
};
|
||||||
|
|
||||||
int tc_aes128_set_decrypt_key(TCAesKeySched_t s, const uint8_t *k)
|
int tc_aes128_set_decrypt_key(TCAesKeySched_t s, const uint8_t *k)
|
||||||
{
|
{
|
||||||
return tc_aes128_set_encrypt_key(s, k);
|
return tc_aes128_set_encrypt_key(s, k);
|
||||||
}
|
}
|
||||||
|
|
||||||
#define mult8(a)(_double_byte(_double_byte(_double_byte(a))))
|
#define mult8(a)(_double_byte(_double_byte(_double_byte(a))))
|
||||||
|
|
@ -72,42 +72,42 @@ int tc_aes128_set_decrypt_key(TCAesKeySched_t s, const uint8_t *k)
|
||||||
|
|
||||||
static inline void mult_row_column(uint8_t *out, const uint8_t *in)
|
static inline void mult_row_column(uint8_t *out, const uint8_t *in)
|
||||||
{
|
{
|
||||||
out[0] = multe(in[0]) ^ multb(in[1]) ^ multd(in[2]) ^ mult9(in[3]);
|
out[0] = multe(in[0]) ^ multb(in[1]) ^ multd(in[2]) ^ mult9(in[3]);
|
||||||
out[1] = mult9(in[0]) ^ multe(in[1]) ^ multb(in[2]) ^ multd(in[3]);
|
out[1] = mult9(in[0]) ^ multe(in[1]) ^ multb(in[2]) ^ multd(in[3]);
|
||||||
out[2] = multd(in[0]) ^ mult9(in[1]) ^ multe(in[2]) ^ multb(in[3]);
|
out[2] = multd(in[0]) ^ mult9(in[1]) ^ multe(in[2]) ^ multb(in[3]);
|
||||||
out[3] = multb(in[0]) ^ multd(in[1]) ^ mult9(in[2]) ^ multe(in[3]);
|
out[3] = multb(in[0]) ^ multd(in[1]) ^ mult9(in[2]) ^ multe(in[3]);
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void inv_mix_columns(uint8_t *s)
|
static inline void inv_mix_columns(uint8_t *s)
|
||||||
{
|
{
|
||||||
uint8_t t[Nb*Nk];
|
uint8_t t[Nb * Nk];
|
||||||
|
|
||||||
mult_row_column(t, s);
|
mult_row_column(t, s);
|
||||||
mult_row_column(&t[Nb], s+Nb);
|
mult_row_column(&t[Nb], s + Nb);
|
||||||
mult_row_column(&t[2*Nb], s+(2*Nb));
|
mult_row_column(&t[2 * Nb], s + (2 * Nb));
|
||||||
mult_row_column(&t[3*Nb], s+(3*Nb));
|
mult_row_column(&t[3 * Nb], s + (3 * Nb));
|
||||||
(void)_copy(s, sizeof(t), t, sizeof(t));
|
(void)_copy(s, sizeof(t), t, sizeof(t));
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void add_round_key(uint8_t *s, const unsigned int *k)
|
static inline void add_round_key(uint8_t *s, const unsigned int *k)
|
||||||
{
|
{
|
||||||
s[0] ^= (uint8_t)(k[0] >> 24); s[1] ^= (uint8_t)(k[0] >> 16);
|
s[0] ^= (uint8_t)(k[0] >> 24); s[1] ^= (uint8_t)(k[0] >> 16);
|
||||||
s[2] ^= (uint8_t)(k[0] >> 8); s[3] ^= (uint8_t)(k[0]);
|
s[2] ^= (uint8_t)(k[0] >> 8); s[3] ^= (uint8_t)(k[0]);
|
||||||
s[4] ^= (uint8_t)(k[1] >> 24); s[5] ^= (uint8_t)(k[1] >> 16);
|
s[4] ^= (uint8_t)(k[1] >> 24); s[5] ^= (uint8_t)(k[1] >> 16);
|
||||||
s[6] ^= (uint8_t)(k[1] >> 8); s[7] ^= (uint8_t)(k[1]);
|
s[6] ^= (uint8_t)(k[1] >> 8); s[7] ^= (uint8_t)(k[1]);
|
||||||
s[8] ^= (uint8_t)(k[2] >> 24); s[9] ^= (uint8_t)(k[2] >> 16);
|
s[8] ^= (uint8_t)(k[2] >> 24); s[9] ^= (uint8_t)(k[2] >> 16);
|
||||||
s[10] ^= (uint8_t)(k[2] >> 8); s[11] ^= (uint8_t)(k[2]);
|
s[10] ^= (uint8_t)(k[2] >> 8); s[11] ^= (uint8_t)(k[2]);
|
||||||
s[12] ^= (uint8_t)(k[3] >> 24); s[13] ^= (uint8_t)(k[3] >> 16);
|
s[12] ^= (uint8_t)(k[3] >> 24); s[13] ^= (uint8_t)(k[3] >> 16);
|
||||||
s[14] ^= (uint8_t)(k[3] >> 8); s[15] ^= (uint8_t)(k[3]);
|
s[14] ^= (uint8_t)(k[3] >> 8); s[15] ^= (uint8_t)(k[3]);
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void inv_sub_bytes(uint8_t *s)
|
static inline void inv_sub_bytes(uint8_t *s)
|
||||||
{
|
{
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
for (i = 0; i < (Nb*Nk); ++i) {
|
for (i = 0; i < (Nb * Nk); ++i) {
|
||||||
s[i] = inv_sbox[s[i]];
|
s[i] = inv_sbox[s[i]];
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
@ -117,48 +117,48 @@ static inline void inv_sub_bytes(uint8_t *s)
|
||||||
*/
|
*/
|
||||||
static inline void inv_shift_rows(uint8_t *s)
|
static inline void inv_shift_rows(uint8_t *s)
|
||||||
{
|
{
|
||||||
uint8_t t[Nb*Nk];
|
uint8_t t[Nb * Nk];
|
||||||
|
|
||||||
t[0] = s[0]; t[1] = s[13]; t[2] = s[10]; t[3] = s[7];
|
t[0] = s[0]; t[1] = s[13]; t[2] = s[10]; t[3] = s[7];
|
||||||
t[4] = s[4]; t[5] = s[1]; t[6] = s[14]; t[7] = s[11];
|
t[4] = s[4]; t[5] = s[1]; t[6] = s[14]; t[7] = s[11];
|
||||||
t[8] = s[8]; t[9] = s[5]; t[10] = s[2]; t[11] = s[15];
|
t[8] = s[8]; t[9] = s[5]; t[10] = s[2]; t[11] = s[15];
|
||||||
t[12] = s[12]; t[13] = s[9]; t[14] = s[6]; t[15] = s[3];
|
t[12] = s[12]; t[13] = s[9]; t[14] = s[6]; t[15] = s[3];
|
||||||
(void)_copy(s, sizeof(t), t, sizeof(t));
|
(void)_copy(s, sizeof(t), t, sizeof(t));
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_aes_decrypt(uint8_t *out, const uint8_t *in, const TCAesKeySched_t s)
|
int tc_aes_decrypt(uint8_t *out, const uint8_t *in, const TCAesKeySched_t s)
|
||||||
{
|
{
|
||||||
uint8_t state[Nk*Nb];
|
uint8_t state[Nk * Nb];
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
if (out == (uint8_t *) 0) {
|
if (out == (uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (in == (const uint8_t *) 0) {
|
} else if (in == (const uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (s == (TCAesKeySched_t) 0) {
|
} else if (s == (TCAesKeySched_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
(void)_copy(state, sizeof(state), in, sizeof(state));
|
(void)_copy(state, sizeof(state), in, sizeof(state));
|
||||||
|
|
||||||
add_round_key(state, s->words + Nb*Nr);
|
add_round_key(state, s->words + Nb * Nr);
|
||||||
|
|
||||||
for (i = Nr - 1; i > 0; --i) {
|
for (i = Nr - 1; i > 0; --i) {
|
||||||
inv_shift_rows(state);
|
inv_shift_rows(state);
|
||||||
inv_sub_bytes(state);
|
inv_sub_bytes(state);
|
||||||
add_round_key(state, s->words + Nb*i);
|
add_round_key(state, s->words + Nb * i);
|
||||||
inv_mix_columns(state);
|
inv_mix_columns(state);
|
||||||
}
|
}
|
||||||
|
|
||||||
inv_shift_rows(state);
|
inv_shift_rows(state);
|
||||||
inv_sub_bytes(state);
|
inv_sub_bytes(state);
|
||||||
add_round_key(state, s->words);
|
add_round_key(state, s->words);
|
||||||
|
|
||||||
(void)_copy(out, sizeof(state), state, sizeof(state));
|
(void)_copy(out, sizeof(state), state, sizeof(state));
|
||||||
|
|
||||||
/*zeroing out the state buffer */
|
/*zeroing out the state buffer */
|
||||||
_set(state, TC_ZERO_BYTE, sizeof(state));
|
_set(state, TC_ZERO_BYTE, sizeof(state));
|
||||||
|
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -35,33 +35,33 @@
|
||||||
#include <tinycrypt/constants.h>
|
#include <tinycrypt/constants.h>
|
||||||
|
|
||||||
static const uint8_t sbox[256] = {
|
static const uint8_t sbox[256] = {
|
||||||
0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b,
|
0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b,
|
||||||
0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
|
0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
|
||||||
0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26,
|
0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26,
|
||||||
0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
|
0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
|
||||||
0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,
|
0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,
|
||||||
0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
|
0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
|
||||||
0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed,
|
0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed,
|
||||||
0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
|
0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
|
||||||
0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f,
|
0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f,
|
||||||
0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
|
0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
|
||||||
0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec,
|
0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec,
|
||||||
0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
|
0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
|
||||||
0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,
|
0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,
|
||||||
0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
|
0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
|
||||||
0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,
|
0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,
|
||||||
0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
|
0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
|
||||||
0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f,
|
0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f,
|
||||||
0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
|
0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
|
||||||
0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11,
|
0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11,
|
||||||
0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
|
0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
|
||||||
0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f,
|
0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f,
|
||||||
0xb0, 0x54, 0xbb, 0x16
|
0xb0, 0x54, 0xbb, 0x16
|
||||||
};
|
};
|
||||||
|
|
||||||
static inline unsigned int rotword(unsigned int a)
|
static inline unsigned int rotword(unsigned int a)
|
||||||
{
|
{
|
||||||
return (((a) >> 24)|((a) << 8));
|
return (((a) >> 24) | ((a) << 8));
|
||||||
}
|
}
|
||||||
|
|
||||||
#define subbyte(a, o)(sbox[((a) >> (o))&0xff] << (o))
|
#define subbyte(a, o)(sbox[((a) >> (o))&0xff] << (o))
|
||||||
|
|
@ -69,75 +69,75 @@ static inline unsigned int rotword(unsigned int a)
|
||||||
|
|
||||||
int tc_aes128_set_encrypt_key(TCAesKeySched_t s, const uint8_t *k)
|
int tc_aes128_set_encrypt_key(TCAesKeySched_t s, const uint8_t *k)
|
||||||
{
|
{
|
||||||
const unsigned int rconst[11] = {
|
const unsigned int rconst[11] = {
|
||||||
0x00000000, 0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000,
|
0x00000000, 0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000,
|
||||||
0x20000000, 0x40000000, 0x80000000, 0x1b000000, 0x36000000
|
0x20000000, 0x40000000, 0x80000000, 0x1b000000, 0x36000000
|
||||||
};
|
};
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
unsigned int t;
|
unsigned int t;
|
||||||
|
|
||||||
if (s == (TCAesKeySched_t) 0) {
|
if (s == (TCAesKeySched_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (k == (const uint8_t *) 0) {
|
} else if (k == (const uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
for (i = 0; i < Nk; ++i) {
|
for (i = 0; i < Nk; ++i) {
|
||||||
s->words[i] = (k[Nb*i]<<24) | (k[Nb*i+1]<<16) |
|
s->words[i] = (k[Nb * i] << 24) | (k[Nb * i + 1] << 16) |
|
||||||
(k[Nb*i+2]<<8) | (k[Nb*i+3]);
|
(k[Nb * i + 2] << 8) | (k[Nb * i + 3]);
|
||||||
}
|
}
|
||||||
|
|
||||||
for (; i < (Nb * (Nr + 1)); ++i) {
|
for (; i < (Nb * (Nr + 1)); ++i) {
|
||||||
t = s->words[i-1];
|
t = s->words[i - 1];
|
||||||
if ((i % Nk) == 0) {
|
if ((i % Nk) == 0) {
|
||||||
t = subword(rotword(t)) ^ rconst[i/Nk];
|
t = subword(rotword(t)) ^ rconst[i / Nk];
|
||||||
}
|
}
|
||||||
s->words[i] = s->words[i-Nk] ^ t;
|
s->words[i] = s->words[i - Nk] ^ t;
|
||||||
}
|
}
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void add_round_key(uint8_t *s, const unsigned int *k)
|
static inline void add_round_key(uint8_t *s, const unsigned int *k)
|
||||||
{
|
{
|
||||||
s[0] ^= (uint8_t)(k[0] >> 24); s[1] ^= (uint8_t)(k[0] >> 16);
|
s[0] ^= (uint8_t)(k[0] >> 24); s[1] ^= (uint8_t)(k[0] >> 16);
|
||||||
s[2] ^= (uint8_t)(k[0] >> 8); s[3] ^= (uint8_t)(k[0]);
|
s[2] ^= (uint8_t)(k[0] >> 8); s[3] ^= (uint8_t)(k[0]);
|
||||||
s[4] ^= (uint8_t)(k[1] >> 24); s[5] ^= (uint8_t)(k[1] >> 16);
|
s[4] ^= (uint8_t)(k[1] >> 24); s[5] ^= (uint8_t)(k[1] >> 16);
|
||||||
s[6] ^= (uint8_t)(k[1] >> 8); s[7] ^= (uint8_t)(k[1]);
|
s[6] ^= (uint8_t)(k[1] >> 8); s[7] ^= (uint8_t)(k[1]);
|
||||||
s[8] ^= (uint8_t)(k[2] >> 24); s[9] ^= (uint8_t)(k[2] >> 16);
|
s[8] ^= (uint8_t)(k[2] >> 24); s[9] ^= (uint8_t)(k[2] >> 16);
|
||||||
s[10] ^= (uint8_t)(k[2] >> 8); s[11] ^= (uint8_t)(k[2]);
|
s[10] ^= (uint8_t)(k[2] >> 8); s[11] ^= (uint8_t)(k[2]);
|
||||||
s[12] ^= (uint8_t)(k[3] >> 24); s[13] ^= (uint8_t)(k[3] >> 16);
|
s[12] ^= (uint8_t)(k[3] >> 24); s[13] ^= (uint8_t)(k[3] >> 16);
|
||||||
s[14] ^= (uint8_t)(k[3] >> 8); s[15] ^= (uint8_t)(k[3]);
|
s[14] ^= (uint8_t)(k[3] >> 8); s[15] ^= (uint8_t)(k[3]);
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void sub_bytes(uint8_t *s)
|
static inline void sub_bytes(uint8_t *s)
|
||||||
{
|
{
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
for (i = 0; i < (Nb * Nk); ++i) {
|
for (i = 0; i < (Nb * Nk); ++i) {
|
||||||
s[i] = sbox[s[i]];
|
s[i] = sbox[s[i]];
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
#define triple(a)(_double_byte(a)^(a))
|
#define triple(a)(_double_byte(a)^(a))
|
||||||
|
|
||||||
static inline void mult_row_column(uint8_t *out, const uint8_t *in)
|
static inline void mult_row_column(uint8_t *out, const uint8_t *in)
|
||||||
{
|
{
|
||||||
out[0] = _double_byte(in[0]) ^ triple(in[1]) ^ in[2] ^ in[3];
|
out[0] = _double_byte(in[0]) ^ triple(in[1]) ^ in[2] ^ in[3];
|
||||||
out[1] = in[0] ^ _double_byte(in[1]) ^ triple(in[2]) ^ in[3];
|
out[1] = in[0] ^ _double_byte(in[1]) ^ triple(in[2]) ^ in[3];
|
||||||
out[2] = in[0] ^ in[1] ^ _double_byte(in[2]) ^ triple(in[3]);
|
out[2] = in[0] ^ in[1] ^ _double_byte(in[2]) ^ triple(in[3]);
|
||||||
out[3] = triple(in[0]) ^ in[1] ^ in[2] ^ _double_byte(in[3]);
|
out[3] = triple(in[0]) ^ in[1] ^ in[2] ^ _double_byte(in[3]);
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void mix_columns(uint8_t *s)
|
static inline void mix_columns(uint8_t *s)
|
||||||
{
|
{
|
||||||
uint8_t t[Nb*Nk];
|
uint8_t t[Nb * Nk];
|
||||||
|
|
||||||
mult_row_column(t, s);
|
mult_row_column(t, s);
|
||||||
mult_row_column(&t[Nb], s+Nb);
|
mult_row_column(&t[Nb], s + Nb);
|
||||||
mult_row_column(&t[2 * Nb], s + (2 * Nb));
|
mult_row_column(&t[2 * Nb], s + (2 * Nb));
|
||||||
mult_row_column(&t[3 * Nb], s + (3 * Nb));
|
mult_row_column(&t[3 * Nb], s + (3 * Nb));
|
||||||
(void) _copy(s, sizeof(t), t, sizeof(t));
|
(void) _copy(s, sizeof(t), t, sizeof(t));
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
@ -146,46 +146,46 @@ static inline void mix_columns(uint8_t *s)
|
||||||
*/
|
*/
|
||||||
static inline void shift_rows(uint8_t *s)
|
static inline void shift_rows(uint8_t *s)
|
||||||
{
|
{
|
||||||
uint8_t t[Nb * Nk];
|
uint8_t t[Nb * Nk];
|
||||||
|
|
||||||
t[0] = s[0]; t[1] = s[5]; t[2] = s[10]; t[3] = s[15];
|
t[0] = s[0]; t[1] = s[5]; t[2] = s[10]; t[3] = s[15];
|
||||||
t[4] = s[4]; t[5] = s[9]; t[6] = s[14]; t[7] = s[3];
|
t[4] = s[4]; t[5] = s[9]; t[6] = s[14]; t[7] = s[3];
|
||||||
t[8] = s[8]; t[9] = s[13]; t[10] = s[2]; t[11] = s[7];
|
t[8] = s[8]; t[9] = s[13]; t[10] = s[2]; t[11] = s[7];
|
||||||
t[12] = s[12]; t[13] = s[1]; t[14] = s[6]; t[15] = s[11];
|
t[12] = s[12]; t[13] = s[1]; t[14] = s[6]; t[15] = s[11];
|
||||||
(void) _copy(s, sizeof(t), t, sizeof(t));
|
(void) _copy(s, sizeof(t), t, sizeof(t));
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_aes_encrypt(uint8_t *out, const uint8_t *in, const TCAesKeySched_t s)
|
int tc_aes_encrypt(uint8_t *out, const uint8_t *in, const TCAesKeySched_t s)
|
||||||
{
|
{
|
||||||
uint8_t state[Nk*Nb];
|
uint8_t state[Nk * Nb];
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
if (out == (uint8_t *) 0) {
|
if (out == (uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (in == (const uint8_t *) 0) {
|
} else if (in == (const uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (s == (TCAesKeySched_t) 0) {
|
} else if (s == (TCAesKeySched_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
(void)_copy(state, sizeof(state), in, sizeof(state));
|
(void)_copy(state, sizeof(state), in, sizeof(state));
|
||||||
add_round_key(state, s->words);
|
add_round_key(state, s->words);
|
||||||
|
|
||||||
for (i = 0; i < (Nr - 1); ++i) {
|
for (i = 0; i < (Nr - 1); ++i) {
|
||||||
sub_bytes(state);
|
sub_bytes(state);
|
||||||
shift_rows(state);
|
shift_rows(state);
|
||||||
mix_columns(state);
|
mix_columns(state);
|
||||||
add_round_key(state, s->words + Nb*(i+1));
|
add_round_key(state, s->words + Nb * (i + 1));
|
||||||
}
|
}
|
||||||
|
|
||||||
sub_bytes(state);
|
sub_bytes(state);
|
||||||
shift_rows(state);
|
shift_rows(state);
|
||||||
add_round_key(state, s->words + Nb*(i+1));
|
add_round_key(state, s->words + Nb * (i + 1));
|
||||||
|
|
||||||
(void)_copy(out, sizeof(state), state, sizeof(state));
|
(void)_copy(out, sizeof(state), state, sizeof(state));
|
||||||
|
|
||||||
/* zeroing out the state buffer */
|
/* zeroing out the state buffer */
|
||||||
_set(state, TC_ZERO_BYTE, sizeof(state));
|
_set(state, TC_ZERO_BYTE, sizeof(state));
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -35,80 +35,80 @@
|
||||||
#include <tinycrypt/utils.h>
|
#include <tinycrypt/utils.h>
|
||||||
|
|
||||||
int tc_cbc_mode_encrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
int tc_cbc_mode_encrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
unsigned int inlen, const uint8_t *iv,
|
unsigned int inlen, const uint8_t *iv,
|
||||||
const TCAesKeySched_t sched)
|
const TCAesKeySched_t sched)
|
||||||
{
|
{
|
||||||
|
|
||||||
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
||||||
unsigned int n, m;
|
unsigned int n, m;
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (out == (uint8_t *) 0 ||
|
if (out == (uint8_t *) 0 ||
|
||||||
in == (const uint8_t *) 0 ||
|
in == (const uint8_t *) 0 ||
|
||||||
sched == (TCAesKeySched_t) 0 ||
|
sched == (TCAesKeySched_t) 0 ||
|
||||||
inlen == 0 ||
|
inlen == 0 ||
|
||||||
outlen == 0 ||
|
outlen == 0 ||
|
||||||
(inlen % TC_AES_BLOCK_SIZE) != 0 ||
|
(inlen % TC_AES_BLOCK_SIZE) != 0 ||
|
||||||
(outlen % TC_AES_BLOCK_SIZE) != 0 ||
|
(outlen % TC_AES_BLOCK_SIZE) != 0 ||
|
||||||
outlen != inlen + TC_AES_BLOCK_SIZE) {
|
outlen != inlen + TC_AES_BLOCK_SIZE) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* copy iv to the buffer */
|
/* copy iv to the buffer */
|
||||||
(void)_copy(buffer, TC_AES_BLOCK_SIZE, iv, TC_AES_BLOCK_SIZE);
|
(void)_copy(buffer, TC_AES_BLOCK_SIZE, iv, TC_AES_BLOCK_SIZE);
|
||||||
/* copy iv to the output buffer */
|
/* copy iv to the output buffer */
|
||||||
(void)_copy(out, TC_AES_BLOCK_SIZE, iv, TC_AES_BLOCK_SIZE);
|
(void)_copy(out, TC_AES_BLOCK_SIZE, iv, TC_AES_BLOCK_SIZE);
|
||||||
out += TC_AES_BLOCK_SIZE;
|
out += TC_AES_BLOCK_SIZE;
|
||||||
|
|
||||||
for (n = m = 0; n < inlen; ++n) {
|
for (n = m = 0; n < inlen; ++n) {
|
||||||
buffer[m++] ^= *in++;
|
buffer[m++] ^= *in++;
|
||||||
if (m == TC_AES_BLOCK_SIZE) {
|
if (m == TC_AES_BLOCK_SIZE) {
|
||||||
(void)tc_aes_encrypt(buffer, buffer, sched);
|
(void)tc_aes_encrypt(buffer, buffer, sched);
|
||||||
(void)_copy(out, TC_AES_BLOCK_SIZE,
|
(void)_copy(out, TC_AES_BLOCK_SIZE,
|
||||||
buffer, TC_AES_BLOCK_SIZE);
|
buffer, TC_AES_BLOCK_SIZE);
|
||||||
out += TC_AES_BLOCK_SIZE;
|
out += TC_AES_BLOCK_SIZE;
|
||||||
m = 0;
|
m = 0;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_cbc_mode_decrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
int tc_cbc_mode_decrypt(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
unsigned int inlen, const uint8_t *iv,
|
unsigned int inlen, const uint8_t *iv,
|
||||||
const TCAesKeySched_t sched)
|
const TCAesKeySched_t sched)
|
||||||
{
|
{
|
||||||
|
|
||||||
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
||||||
const uint8_t *p;
|
const uint8_t *p;
|
||||||
unsigned int n, m;
|
unsigned int n, m;
|
||||||
|
|
||||||
/* sanity check the inputs */
|
/* sanity check the inputs */
|
||||||
if (out == (uint8_t *) 0 ||
|
if (out == (uint8_t *) 0 ||
|
||||||
in == (const uint8_t *) 0 ||
|
in == (const uint8_t *) 0 ||
|
||||||
sched == (TCAesKeySched_t) 0 ||
|
sched == (TCAesKeySched_t) 0 ||
|
||||||
inlen == 0 ||
|
inlen == 0 ||
|
||||||
outlen == 0 ||
|
outlen == 0 ||
|
||||||
(inlen % TC_AES_BLOCK_SIZE) != 0 ||
|
(inlen % TC_AES_BLOCK_SIZE) != 0 ||
|
||||||
(outlen % TC_AES_BLOCK_SIZE) != 0 ||
|
(outlen % TC_AES_BLOCK_SIZE) != 0 ||
|
||||||
outlen != inlen) {
|
outlen != inlen) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Note that in == iv + ciphertext, i.e. the iv and the ciphertext are
|
* Note that in == iv + ciphertext, i.e. the iv and the ciphertext are
|
||||||
* contiguous. This allows for a very efficient decryption algorithm
|
* contiguous. This allows for a very efficient decryption algorithm
|
||||||
* that would not otherwise be possible.
|
* that would not otherwise be possible.
|
||||||
*/
|
*/
|
||||||
p = iv;
|
p = iv;
|
||||||
for (n = m = 0; n < outlen; ++n) {
|
for (n = m = 0; n < outlen; ++n) {
|
||||||
if ((n % TC_AES_BLOCK_SIZE) == 0) {
|
if ((n % TC_AES_BLOCK_SIZE) == 0) {
|
||||||
(void)tc_aes_decrypt(buffer, in, sched);
|
(void)tc_aes_decrypt(buffer, in, sched);
|
||||||
in += TC_AES_BLOCK_SIZE;
|
in += TC_AES_BLOCK_SIZE;
|
||||||
m = 0;
|
m = 0;
|
||||||
}
|
}
|
||||||
*out++ = buffer[m++] ^ *p++;
|
*out++ = buffer[m++] ^ *p++;
|
||||||
}
|
}
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -37,50 +37,50 @@
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
|
|
||||||
int tc_ccm_config(TCCcmMode_t c, TCAesKeySched_t sched, uint8_t *nonce,
|
int tc_ccm_config(TCCcmMode_t c, TCAesKeySched_t sched, uint8_t *nonce,
|
||||||
unsigned int nlen, unsigned int mlen)
|
unsigned int nlen, unsigned int mlen)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (c == (TCCcmMode_t) 0 ||
|
if (c == (TCCcmMode_t) 0 ||
|
||||||
sched == (TCAesKeySched_t) 0 ||
|
sched == (TCAesKeySched_t) 0 ||
|
||||||
nonce == (uint8_t *) 0) {
|
nonce == (uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (nlen != 13) {
|
} else if (nlen != 13) {
|
||||||
return TC_CRYPTO_FAIL; /* The allowed nonce size is: 13. See documentation.*/
|
return TC_CRYPTO_FAIL; /* The allowed nonce size is: 13. See documentation.*/
|
||||||
} else if ((mlen < 4) || (mlen > 16) || (mlen & 1)) {
|
} else if ((mlen < 4) || (mlen > 16) || (mlen & 1)) {
|
||||||
return TC_CRYPTO_FAIL; /* The allowed mac sizes are: 4, 6, 8, 10, 12, 14, 16.*/
|
return TC_CRYPTO_FAIL; /* The allowed mac sizes are: 4, 6, 8, 10, 12, 14, 16.*/
|
||||||
}
|
}
|
||||||
|
|
||||||
c->mlen = mlen;
|
c->mlen = mlen;
|
||||||
c->sched = sched;
|
c->sched = sched;
|
||||||
c->nonce = nonce;
|
c->nonce = nonce;
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Variation of CBC-MAC mode used in CCM.
|
* Variation of CBC-MAC mode used in CCM.
|
||||||
*/
|
*/
|
||||||
static void ccm_cbc_mac(uint8_t *T, const uint8_t *data, unsigned int dlen,
|
static void ccm_cbc_mac(uint8_t *T, const uint8_t *data, unsigned int dlen,
|
||||||
unsigned int flag, TCAesKeySched_t sched)
|
unsigned int flag, TCAesKeySched_t sched)
|
||||||
{
|
{
|
||||||
|
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
if (flag > 0) {
|
if (flag > 0) {
|
||||||
T[0] ^= (uint8_t)(dlen >> 8);
|
T[0] ^= (uint8_t)(dlen >> 8);
|
||||||
T[1] ^= (uint8_t)(dlen);
|
T[1] ^= (uint8_t)(dlen);
|
||||||
dlen += 2; i = 2;
|
dlen += 2; i = 2;
|
||||||
} else {
|
} else {
|
||||||
i = 0;
|
i = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
while (i < dlen) {
|
while (i < dlen) {
|
||||||
T[i++ % (Nb * Nk)] ^= *data++;
|
T[i++ % (Nb * Nk)] ^= *data++;
|
||||||
if (((i % (Nb * Nk)) == 0) || dlen == i) {
|
if (((i % (Nb * Nk)) == 0) || dlen == i) {
|
||||||
(void) tc_aes_encrypt(T, T, sched);
|
(void) tc_aes_encrypt(T, T, sched);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
@ -91,176 +91,176 @@ static void ccm_cbc_mac(uint8_t *T, const uint8_t *data, unsigned int dlen,
|
||||||
* 2 bytes of the nonce.
|
* 2 bytes of the nonce.
|
||||||
*/
|
*/
|
||||||
static int ccm_ctr_mode(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
static int ccm_ctr_mode(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
unsigned int inlen, uint8_t *ctr, const TCAesKeySched_t sched)
|
unsigned int inlen, uint8_t *ctr, const TCAesKeySched_t sched)
|
||||||
{
|
{
|
||||||
|
|
||||||
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
||||||
uint8_t nonce[TC_AES_BLOCK_SIZE];
|
uint8_t nonce[TC_AES_BLOCK_SIZE];
|
||||||
uint16_t block_num;
|
uint16_t block_num;
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (out == (uint8_t *) 0 ||
|
if (out == (uint8_t *) 0 ||
|
||||||
in == (uint8_t *) 0 ||
|
in == (uint8_t *) 0 ||
|
||||||
ctr == (uint8_t *) 0 ||
|
ctr == (uint8_t *) 0 ||
|
||||||
sched == (TCAesKeySched_t) 0 ||
|
sched == (TCAesKeySched_t) 0 ||
|
||||||
inlen == 0 ||
|
inlen == 0 ||
|
||||||
outlen == 0 ||
|
outlen == 0 ||
|
||||||
outlen != inlen) {
|
outlen != inlen) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* copy the counter to the nonce */
|
/* copy the counter to the nonce */
|
||||||
(void) _copy(nonce, sizeof(nonce), ctr, sizeof(nonce));
|
(void) _copy(nonce, sizeof(nonce), ctr, sizeof(nonce));
|
||||||
|
|
||||||
/* select the last 2 bytes of the nonce to be incremented */
|
/* select the last 2 bytes of the nonce to be incremented */
|
||||||
block_num = (uint16_t) ((nonce[14] << 8)|(nonce[15]));
|
block_num = (uint16_t) ((nonce[14] << 8) | (nonce[15]));
|
||||||
for (i = 0; i < inlen; ++i) {
|
for (i = 0; i < inlen; ++i) {
|
||||||
if ((i % (TC_AES_BLOCK_SIZE)) == 0) {
|
if ((i % (TC_AES_BLOCK_SIZE)) == 0) {
|
||||||
block_num++;
|
block_num++;
|
||||||
nonce[14] = (uint8_t)(block_num >> 8);
|
nonce[14] = (uint8_t)(block_num >> 8);
|
||||||
nonce[15] = (uint8_t)(block_num);
|
nonce[15] = (uint8_t)(block_num);
|
||||||
if (!tc_aes_encrypt(buffer, nonce, sched)) {
|
if (!tc_aes_encrypt(buffer, nonce, sched)) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
/* update the output */
|
/* update the output */
|
||||||
*out++ = buffer[i % (TC_AES_BLOCK_SIZE)] ^ *in++;
|
*out++ = buffer[i % (TC_AES_BLOCK_SIZE)] ^ *in++;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* update the counter */
|
/* update the counter */
|
||||||
ctr[14] = nonce[14]; ctr[15] = nonce[15];
|
ctr[14] = nonce[14]; ctr[15] = nonce[15];
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_ccm_generation_encryption(uint8_t *out, unsigned int olen,
|
int tc_ccm_generation_encryption(uint8_t *out, unsigned int olen,
|
||||||
const uint8_t *associated_data,
|
const uint8_t *associated_data,
|
||||||
unsigned int alen, const uint8_t *payload,
|
unsigned int alen, const uint8_t *payload,
|
||||||
unsigned int plen, TCCcmMode_t c)
|
unsigned int plen, TCCcmMode_t c)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if ((out == (uint8_t *) 0) ||
|
if ((out == (uint8_t *) 0) ||
|
||||||
(c == (TCCcmMode_t) 0) ||
|
(c == (TCCcmMode_t) 0) ||
|
||||||
((plen > 0) && (payload == (uint8_t *) 0)) ||
|
((plen > 0) && (payload == (uint8_t *) 0)) ||
|
||||||
((alen > 0) && (associated_data == (uint8_t *) 0)) ||
|
((alen > 0) && (associated_data == (uint8_t *) 0)) ||
|
||||||
(alen >= TC_CCM_AAD_MAX_BYTES) || /* associated data size unsupported */
|
(alen >= TC_CCM_AAD_MAX_BYTES) || /* associated data size unsupported */
|
||||||
(plen >= TC_CCM_PAYLOAD_MAX_BYTES) || /* payload size unsupported */
|
(plen >= TC_CCM_PAYLOAD_MAX_BYTES) || /* payload size unsupported */
|
||||||
(olen < (plen + c->mlen))) { /* invalid output buffer size */
|
(olen < (plen + c->mlen))) { /* invalid output buffer size */
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
uint8_t b[Nb * Nk];
|
uint8_t b[Nb * Nk];
|
||||||
uint8_t tag[Nb * Nk];
|
uint8_t tag[Nb * Nk];
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
/* GENERATING THE AUTHENTICATION TAG: */
|
/* GENERATING THE AUTHENTICATION TAG: */
|
||||||
|
|
||||||
/* formatting the sequence b for authentication: */
|
/* formatting the sequence b for authentication: */
|
||||||
b[0] = ((alen > 0) ? 0x40:0) | (((c->mlen - 2) / 2 << 3)) | (1);
|
b[0] = ((alen > 0) ? 0x40 : 0) | (((c->mlen - 2) / 2 << 3)) | (1);
|
||||||
for (i = 1; i <= 13; ++i) {
|
for (i = 1; i <= 13; ++i) {
|
||||||
b[i] = c->nonce[i - 1];
|
b[i] = c->nonce[i - 1];
|
||||||
}
|
}
|
||||||
b[14] = (uint8_t)(plen >> 8);
|
b[14] = (uint8_t)(plen >> 8);
|
||||||
b[15] = (uint8_t)(plen);
|
b[15] = (uint8_t)(plen);
|
||||||
|
|
||||||
/* computing the authentication tag using cbc-mac: */
|
/* computing the authentication tag using cbc-mac: */
|
||||||
(void) tc_aes_encrypt(tag, b, c->sched);
|
(void) tc_aes_encrypt(tag, b, c->sched);
|
||||||
if (alen > 0) {
|
if (alen > 0) {
|
||||||
ccm_cbc_mac(tag, associated_data, alen, 1, c->sched);
|
ccm_cbc_mac(tag, associated_data, alen, 1, c->sched);
|
||||||
}
|
}
|
||||||
if (plen > 0) {
|
if (plen > 0) {
|
||||||
ccm_cbc_mac(tag, payload, plen, 0, c->sched);
|
ccm_cbc_mac(tag, payload, plen, 0, c->sched);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* ENCRYPTION: */
|
/* ENCRYPTION: */
|
||||||
|
|
||||||
/* formatting the sequence b for encryption: */
|
/* formatting the sequence b for encryption: */
|
||||||
b[0] = 1; /* q - 1 = 2 - 1 = 1 */
|
b[0] = 1; /* q - 1 = 2 - 1 = 1 */
|
||||||
b[14] = b[15] = TC_ZERO_BYTE;
|
b[14] = b[15] = TC_ZERO_BYTE;
|
||||||
|
|
||||||
/* encrypting payload using ctr mode: */
|
/* encrypting payload using ctr mode: */
|
||||||
ccm_ctr_mode(out, plen, payload, plen, b, c->sched);
|
ccm_ctr_mode(out, plen, payload, plen, b, c->sched);
|
||||||
|
|
||||||
b[14] = b[15] = TC_ZERO_BYTE; /* restoring initial counter for ctr_mode (0):*/
|
b[14] = b[15] = TC_ZERO_BYTE; /* restoring initial counter for ctr_mode (0):*/
|
||||||
|
|
||||||
/* encrypting b and adding the tag to the output: */
|
/* encrypting b and adding the tag to the output: */
|
||||||
(void) tc_aes_encrypt(b, b, c->sched);
|
(void) tc_aes_encrypt(b, b, c->sched);
|
||||||
out += plen;
|
out += plen;
|
||||||
for (i = 0; i < c->mlen; ++i) {
|
for (i = 0; i < c->mlen; ++i) {
|
||||||
*out++ = tag[i] ^ b[i];
|
*out++ = tag[i] ^ b[i];
|
||||||
}
|
}
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_ccm_decryption_verification(uint8_t *out, unsigned int olen,
|
int tc_ccm_decryption_verification(uint8_t *out, unsigned int olen,
|
||||||
const uint8_t *associated_data,
|
const uint8_t *associated_data,
|
||||||
unsigned int alen, const uint8_t *payload,
|
unsigned int alen, const uint8_t *payload,
|
||||||
unsigned int plen, TCCcmMode_t c)
|
unsigned int plen, TCCcmMode_t c)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if ((out == (uint8_t *) 0) ||
|
if ((out == (uint8_t *) 0) ||
|
||||||
(c == (TCCcmMode_t) 0) ||
|
(c == (TCCcmMode_t) 0) ||
|
||||||
((plen > 0) && (payload == (uint8_t *) 0)) ||
|
((plen > 0) && (payload == (uint8_t *) 0)) ||
|
||||||
((alen > 0) && (associated_data == (uint8_t *) 0)) ||
|
((alen > 0) && (associated_data == (uint8_t *) 0)) ||
|
||||||
(alen >= TC_CCM_AAD_MAX_BYTES) || /* associated data size unsupported */
|
(alen >= TC_CCM_AAD_MAX_BYTES) || /* associated data size unsupported */
|
||||||
(plen >= TC_CCM_PAYLOAD_MAX_BYTES) || /* payload size unsupported */
|
(plen >= TC_CCM_PAYLOAD_MAX_BYTES) || /* payload size unsupported */
|
||||||
(olen < plen - c->mlen)) { /* invalid output buffer size */
|
(olen < plen - c->mlen)) { /* invalid output buffer size */
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
uint8_t b[Nb * Nk];
|
uint8_t b[Nb * Nk];
|
||||||
uint8_t tag[Nb * Nk];
|
uint8_t tag[Nb * Nk];
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
/* DECRYPTION: */
|
/* DECRYPTION: */
|
||||||
|
|
||||||
/* formatting the sequence b for decryption: */
|
/* formatting the sequence b for decryption: */
|
||||||
b[0] = 1; /* q - 1 = 2 - 1 = 1 */
|
b[0] = 1; /* q - 1 = 2 - 1 = 1 */
|
||||||
for (i = 1; i < 14; ++i) {
|
for (i = 1; i < 14; ++i) {
|
||||||
b[i] = c->nonce[i - 1];
|
b[i] = c->nonce[i - 1];
|
||||||
}
|
}
|
||||||
b[14] = b[15] = TC_ZERO_BYTE; /* initial counter value is 0 */
|
b[14] = b[15] = TC_ZERO_BYTE; /* initial counter value is 0 */
|
||||||
|
|
||||||
/* decrypting payload using ctr mode: */
|
/* decrypting payload using ctr mode: */
|
||||||
ccm_ctr_mode(out, plen - c->mlen, payload, plen - c->mlen, b, c->sched);
|
ccm_ctr_mode(out, plen - c->mlen, payload, plen - c->mlen, b, c->sched);
|
||||||
|
|
||||||
b[14] = b[15] = TC_ZERO_BYTE; /* restoring initial counter value (0) */
|
b[14] = b[15] = TC_ZERO_BYTE; /* restoring initial counter value (0) */
|
||||||
|
|
||||||
/* encrypting b and restoring the tag from input: */
|
/* encrypting b and restoring the tag from input: */
|
||||||
(void) tc_aes_encrypt(b, b, c->sched);
|
(void) tc_aes_encrypt(b, b, c->sched);
|
||||||
for (i = 0; i < c->mlen; ++i) {
|
for (i = 0; i < c->mlen; ++i) {
|
||||||
tag[i] = *(payload + plen - c->mlen + i) ^ b[i];
|
tag[i] = *(payload + plen - c->mlen + i) ^ b[i];
|
||||||
}
|
}
|
||||||
|
|
||||||
/* VERIFYING THE AUTHENTICATION TAG: */
|
/* VERIFYING THE AUTHENTICATION TAG: */
|
||||||
|
|
||||||
/* formatting the sequence b for authentication: */
|
/* formatting the sequence b for authentication: */
|
||||||
b[0] = ((alen > 0) ? 0x40:0)|(((c->mlen - 2) / 2 << 3)) | (1);
|
b[0] = ((alen > 0) ? 0x40 : 0) | (((c->mlen - 2) / 2 << 3)) | (1);
|
||||||
for (i = 1; i < 14; ++i) {
|
for (i = 1; i < 14; ++i) {
|
||||||
b[i] = c->nonce[i - 1];
|
b[i] = c->nonce[i - 1];
|
||||||
}
|
}
|
||||||
b[14] = (uint8_t)((plen - c->mlen) >> 8);
|
b[14] = (uint8_t)((plen - c->mlen) >> 8);
|
||||||
b[15] = (uint8_t)(plen - c->mlen);
|
b[15] = (uint8_t)(plen - c->mlen);
|
||||||
|
|
||||||
/* computing the authentication tag using cbc-mac: */
|
/* computing the authentication tag using cbc-mac: */
|
||||||
(void) tc_aes_encrypt(b, b, c->sched);
|
(void) tc_aes_encrypt(b, b, c->sched);
|
||||||
if (alen > 0) {
|
if (alen > 0) {
|
||||||
ccm_cbc_mac(b, associated_data, alen, 1, c->sched);
|
ccm_cbc_mac(b, associated_data, alen, 1, c->sched);
|
||||||
}
|
}
|
||||||
if (plen > 0) {
|
if (plen > 0) {
|
||||||
ccm_cbc_mac(b, out, plen - c->mlen, 0, c->sched);
|
ccm_cbc_mac(b, out, plen - c->mlen, 0, c->sched);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* comparing the received tag and the computed one: */
|
/* comparing the received tag and the computed one: */
|
||||||
if (_compare(b, tag, c->mlen) == 0) {
|
if (_compare(b, tag, c->mlen) == 0) {
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
} else {
|
} else {
|
||||||
/* erase the decrypted buffer in case of mac validation failure: */
|
/* erase the decrypted buffer in case of mac validation failure: */
|
||||||
_set(out, 0, plen - c->mlen);
|
_set(out, 0, plen - c->mlen);
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -78,177 +78,177 @@ const unsigned char gf_wrap = 0x87;
|
||||||
void gf_double(uint8_t *out, uint8_t *in)
|
void gf_double(uint8_t *out, uint8_t *in)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* start with low order byte */
|
/* start with low order byte */
|
||||||
uint8_t *x = in + (TC_AES_BLOCK_SIZE - 1);
|
uint8_t *x = in + (TC_AES_BLOCK_SIZE - 1);
|
||||||
|
|
||||||
/* if msb == 1, we need to add the gf_wrap value, otherwise add 0 */
|
/* if msb == 1, we need to add the gf_wrap value, otherwise add 0 */
|
||||||
uint8_t carry = (in[0] >> 7) ? gf_wrap : 0;
|
uint8_t carry = (in[0] >> 7) ? gf_wrap : 0;
|
||||||
|
|
||||||
out += (TC_AES_BLOCK_SIZE - 1);
|
out += (TC_AES_BLOCK_SIZE - 1);
|
||||||
for (;;) {
|
for (;;) {
|
||||||
*out-- = (*x << 1) ^ carry;
|
*out-- = (*x << 1) ^ carry;
|
||||||
if (x == in) {
|
if (x == in) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
carry = *x-- >> 7;
|
carry = *x-- >> 7;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_cmac_setup(TCCmacState_t s, const uint8_t *key, TCAesKeySched_t sched)
|
int tc_cmac_setup(TCCmacState_t s, const uint8_t *key, TCAesKeySched_t sched)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (s == (TCCmacState_t) 0 ||
|
if (s == (TCCmacState_t) 0 ||
|
||||||
key == (const uint8_t *) 0) {
|
key == (const uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* put s into a known state */
|
/* put s into a known state */
|
||||||
_set(s, 0, sizeof(*s));
|
_set(s, 0, sizeof(*s));
|
||||||
s->sched = sched;
|
s->sched = sched;
|
||||||
|
|
||||||
/* configure the encryption key used by the underlying block cipher */
|
/* configure the encryption key used by the underlying block cipher */
|
||||||
tc_aes128_set_encrypt_key(s->sched, key);
|
tc_aes128_set_encrypt_key(s->sched, key);
|
||||||
|
|
||||||
/* compute s->K1 and s->K2 from s->iv using s->keyid */
|
/* compute s->K1 and s->K2 from s->iv using s->keyid */
|
||||||
_set(s->iv, 0, TC_AES_BLOCK_SIZE);
|
_set(s->iv, 0, TC_AES_BLOCK_SIZE);
|
||||||
tc_aes_encrypt(s->iv, s->iv, s->sched);
|
tc_aes_encrypt(s->iv, s->iv, s->sched);
|
||||||
gf_double (s->K1, s->iv);
|
gf_double (s->K1, s->iv);
|
||||||
gf_double (s->K2, s->K1);
|
gf_double (s->K2, s->K1);
|
||||||
|
|
||||||
/* reset s->iv to 0 in case someone wants to compute now */
|
/* reset s->iv to 0 in case someone wants to compute now */
|
||||||
tc_cmac_init(s);
|
tc_cmac_init(s);
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_cmac_erase(TCCmacState_t s)
|
int tc_cmac_erase(TCCmacState_t s)
|
||||||
{
|
{
|
||||||
if (s == (TCCmacState_t) 0) {
|
if (s == (TCCmacState_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* destroy the current state */
|
/* destroy the current state */
|
||||||
_set(s, 0, sizeof(*s));
|
_set(s, 0, sizeof(*s));
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_cmac_init(TCCmacState_t s)
|
int tc_cmac_init(TCCmacState_t s)
|
||||||
{
|
{
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (s == (TCCmacState_t) 0) {
|
if (s == (TCCmacState_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* CMAC starts with an all zero initialization vector */
|
/* CMAC starts with an all zero initialization vector */
|
||||||
_set(s->iv, 0, TC_AES_BLOCK_SIZE);
|
_set(s->iv, 0, TC_AES_BLOCK_SIZE);
|
||||||
|
|
||||||
/* and the leftover buffer is empty */
|
/* and the leftover buffer is empty */
|
||||||
_set(s->leftover, 0, TC_AES_BLOCK_SIZE);
|
_set(s->leftover, 0, TC_AES_BLOCK_SIZE);
|
||||||
s->leftover_offset = 0;
|
s->leftover_offset = 0;
|
||||||
|
|
||||||
/* Set countdown to max number of calls allowed before re-keying: */
|
/* Set countdown to max number of calls allowed before re-keying: */
|
||||||
s->countdown = MAX_CALLS;
|
s->countdown = MAX_CALLS;
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_cmac_update(TCCmacState_t s, const uint8_t *data, size_t data_length)
|
int tc_cmac_update(TCCmacState_t s, const uint8_t *data, size_t data_length)
|
||||||
{
|
{
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (s == (TCCmacState_t) 0) {
|
if (s == (TCCmacState_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
if (data_length == 0) {
|
if (data_length == 0) {
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
if (data == (const uint8_t *) 0) {
|
if (data == (const uint8_t *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (s->countdown == 0) {
|
if (s->countdown == 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
s->countdown--;
|
s->countdown--;
|
||||||
|
|
||||||
if (s->leftover_offset > 0) {
|
if (s->leftover_offset > 0) {
|
||||||
/* last data added to s didn't end on a TC_AES_BLOCK_SIZE byte boundary */
|
/* last data added to s didn't end on a TC_AES_BLOCK_SIZE byte boundary */
|
||||||
size_t remaining_space = TC_AES_BLOCK_SIZE - s->leftover_offset;
|
size_t remaining_space = TC_AES_BLOCK_SIZE - s->leftover_offset;
|
||||||
|
|
||||||
if (data_length < remaining_space) {
|
if (data_length < remaining_space) {
|
||||||
/* still not enough data to encrypt this time either */
|
/* still not enough data to encrypt this time either */
|
||||||
_copy(&s->leftover[s->leftover_offset], data_length, data, data_length);
|
_copy(&s->leftover[s->leftover_offset], data_length, data, data_length);
|
||||||
s->leftover_offset += data_length;
|
s->leftover_offset += data_length;
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
/* leftover block is now full; encrypt it first */
|
/* leftover block is now full; encrypt it first */
|
||||||
_copy(&s->leftover[s->leftover_offset],
|
_copy(&s->leftover[s->leftover_offset],
|
||||||
remaining_space,
|
remaining_space,
|
||||||
data,
|
data,
|
||||||
remaining_space);
|
remaining_space);
|
||||||
data_length -= remaining_space;
|
data_length -= remaining_space;
|
||||||
data += remaining_space;
|
data += remaining_space;
|
||||||
s->leftover_offset = 0;
|
s->leftover_offset = 0;
|
||||||
|
|
||||||
for (i = 0; i < TC_AES_BLOCK_SIZE; ++i) {
|
for (i = 0; i < TC_AES_BLOCK_SIZE; ++i) {
|
||||||
s->iv[i] ^= s->leftover[i];
|
s->iv[i] ^= s->leftover[i];
|
||||||
}
|
}
|
||||||
tc_aes_encrypt(s->iv, s->iv, s->sched);
|
tc_aes_encrypt(s->iv, s->iv, s->sched);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* CBC encrypt each (except the last) of the data blocks */
|
/* CBC encrypt each (except the last) of the data blocks */
|
||||||
while (data_length > TC_AES_BLOCK_SIZE) {
|
while (data_length > TC_AES_BLOCK_SIZE) {
|
||||||
for (i = 0; i < TC_AES_BLOCK_SIZE; ++i) {
|
for (i = 0; i < TC_AES_BLOCK_SIZE; ++i) {
|
||||||
s->iv[i] ^= data[i];
|
s->iv[i] ^= data[i];
|
||||||
}
|
}
|
||||||
tc_aes_encrypt(s->iv, s->iv, s->sched);
|
tc_aes_encrypt(s->iv, s->iv, s->sched);
|
||||||
data += TC_AES_BLOCK_SIZE;
|
data += TC_AES_BLOCK_SIZE;
|
||||||
data_length -= TC_AES_BLOCK_SIZE;
|
data_length -= TC_AES_BLOCK_SIZE;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (data_length > 0) {
|
if (data_length > 0) {
|
||||||
/* save leftover data for next time */
|
/* save leftover data for next time */
|
||||||
_copy(s->leftover, data_length, data, data_length);
|
_copy(s->leftover, data_length, data, data_length);
|
||||||
s->leftover_offset = data_length;
|
s->leftover_offset = data_length;
|
||||||
}
|
}
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_cmac_final(uint8_t *tag, TCCmacState_t s)
|
int tc_cmac_final(uint8_t *tag, TCCmacState_t s)
|
||||||
{
|
{
|
||||||
uint8_t *k;
|
uint8_t *k;
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (tag == (uint8_t *) 0 ||
|
if (tag == (uint8_t *) 0 ||
|
||||||
s == (TCCmacState_t) 0) {
|
s == (TCCmacState_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (s->leftover_offset == TC_AES_BLOCK_SIZE) {
|
if (s->leftover_offset == TC_AES_BLOCK_SIZE) {
|
||||||
/* the last message block is a full-sized block */
|
/* the last message block is a full-sized block */
|
||||||
k = (uint8_t *) s->K1;
|
k = (uint8_t *) s->K1;
|
||||||
} else {
|
} else {
|
||||||
/* the final message block is not a full-sized block */
|
/* the final message block is not a full-sized block */
|
||||||
size_t remaining = TC_AES_BLOCK_SIZE - s->leftover_offset;
|
size_t remaining = TC_AES_BLOCK_SIZE - s->leftover_offset;
|
||||||
|
|
||||||
_set(&s->leftover[s->leftover_offset], 0, remaining);
|
_set(&s->leftover[s->leftover_offset], 0, remaining);
|
||||||
s->leftover[s->leftover_offset] = TC_CMAC_PADDING;
|
s->leftover[s->leftover_offset] = TC_CMAC_PADDING;
|
||||||
k = (uint8_t *) s->K2;
|
k = (uint8_t *) s->K2;
|
||||||
}
|
}
|
||||||
for (i = 0; i < TC_AES_BLOCK_SIZE; ++i) {
|
for (i = 0; i < TC_AES_BLOCK_SIZE; ++i) {
|
||||||
s->iv[i] ^= s->leftover[i] ^ k[i];
|
s->iv[i] ^= s->leftover[i] ^ k[i];
|
||||||
}
|
}
|
||||||
|
|
||||||
tc_aes_encrypt(tag, s->iv, s->sched);
|
tc_aes_encrypt(tag, s->iv, s->sched);
|
||||||
|
|
||||||
/* erasing state: */
|
/* erasing state: */
|
||||||
tc_cmac_erase(s);
|
tc_cmac_erase(s);
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -35,51 +35,51 @@
|
||||||
#include <tinycrypt/utils.h>
|
#include <tinycrypt/utils.h>
|
||||||
|
|
||||||
int tc_ctr_mode(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
int tc_ctr_mode(uint8_t *out, unsigned int outlen, const uint8_t *in,
|
||||||
unsigned int inlen, uint8_t *ctr, const TCAesKeySched_t sched)
|
unsigned int inlen, uint8_t *ctr, const TCAesKeySched_t sched)
|
||||||
{
|
{
|
||||||
|
|
||||||
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
uint8_t buffer[TC_AES_BLOCK_SIZE];
|
||||||
uint8_t nonce[TC_AES_BLOCK_SIZE];
|
uint8_t nonce[TC_AES_BLOCK_SIZE];
|
||||||
unsigned int block_num;
|
unsigned int block_num;
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (out == (uint8_t *) 0 ||
|
if (out == (uint8_t *) 0 ||
|
||||||
in == (uint8_t *) 0 ||
|
in == (uint8_t *) 0 ||
|
||||||
ctr == (uint8_t *) 0 ||
|
ctr == (uint8_t *) 0 ||
|
||||||
sched == (TCAesKeySched_t) 0 ||
|
sched == (TCAesKeySched_t) 0 ||
|
||||||
inlen == 0 ||
|
inlen == 0 ||
|
||||||
outlen == 0 ||
|
outlen == 0 ||
|
||||||
outlen != inlen) {
|
outlen != inlen) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* copy the ctr to the nonce */
|
/* copy the ctr to the nonce */
|
||||||
(void)_copy(nonce, sizeof(nonce), ctr, sizeof(nonce));
|
(void)_copy(nonce, sizeof(nonce), ctr, sizeof(nonce));
|
||||||
|
|
||||||
/* select the last 4 bytes of the nonce to be incremented */
|
/* select the last 4 bytes of the nonce to be incremented */
|
||||||
block_num = (nonce[12] << 24) | (nonce[13] << 16) |
|
block_num = (nonce[12] << 24) | (nonce[13] << 16) |
|
||||||
(nonce[14] << 8) | (nonce[15]);
|
(nonce[14] << 8) | (nonce[15]);
|
||||||
for (i = 0; i < inlen; ++i) {
|
for (i = 0; i < inlen; ++i) {
|
||||||
if ((i % (TC_AES_BLOCK_SIZE)) == 0) {
|
if ((i % (TC_AES_BLOCK_SIZE)) == 0) {
|
||||||
/* encrypt data using the current nonce */
|
/* encrypt data using the current nonce */
|
||||||
if (tc_aes_encrypt(buffer, nonce, sched)) {
|
if (tc_aes_encrypt(buffer, nonce, sched)) {
|
||||||
block_num++;
|
block_num++;
|
||||||
nonce[12] = (uint8_t)(block_num >> 24);
|
nonce[12] = (uint8_t)(block_num >> 24);
|
||||||
nonce[13] = (uint8_t)(block_num >> 16);
|
nonce[13] = (uint8_t)(block_num >> 16);
|
||||||
nonce[14] = (uint8_t)(block_num >> 8);
|
nonce[14] = (uint8_t)(block_num >> 8);
|
||||||
nonce[15] = (uint8_t)(block_num);
|
nonce[15] = (uint8_t)(block_num);
|
||||||
} else {
|
} else {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
/* update the output */
|
/* update the output */
|
||||||
*out++ = buffer[i%(TC_AES_BLOCK_SIZE)] ^ *in++;
|
*out++ = buffer[i % (TC_AES_BLOCK_SIZE)] ^ *in++;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* update the counter */
|
/* update the counter */
|
||||||
ctr[12] = nonce[12]; ctr[13] = nonce[13];
|
ctr[12] = nonce[12]; ctr[13] = nonce[13];
|
||||||
ctr[14] = nonce[14]; ctr[15] = nonce[15];
|
ctr[14] = nonce[14]; ctr[15] = nonce[15];
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -52,14 +52,14 @@
|
||||||
*/
|
*/
|
||||||
static void arrInc(uint8_t arr[], unsigned int len)
|
static void arrInc(uint8_t arr[], unsigned int len)
|
||||||
{
|
{
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
if (0 != arr) {
|
if (0 != arr) {
|
||||||
for (i = len; i > 0U; i--) {
|
for (i = len; i > 0U; i--) {
|
||||||
if (++arr[i-1] != 0U) {
|
if (++arr[i - 1] != 0U) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
@ -71,209 +71,209 @@ static void arrInc(uint8_t arr[], unsigned int len)
|
||||||
* @param ctx IN/OUT -- CTR PRNG state
|
* @param ctx IN/OUT -- CTR PRNG state
|
||||||
* @param providedData IN -- data used when updating the internal state
|
* @param providedData IN -- data used when updating the internal state
|
||||||
*/
|
*/
|
||||||
static void tc_ctr_prng_update(TCCtrPrng_t * const ctx, uint8_t const * const providedData)
|
static void tc_ctr_prng_update(TCCtrPrng_t *const ctx, uint8_t const *const providedData)
|
||||||
{
|
{
|
||||||
if (0 != ctx) {
|
if (0 != ctx) {
|
||||||
/* 10.2.1.2 step 1 */
|
/* 10.2.1.2 step 1 */
|
||||||
uint8_t temp[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
|
uint8_t temp[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
|
||||||
unsigned int len = 0U;
|
unsigned int len = 0U;
|
||||||
|
|
||||||
/* 10.2.1.2 step 2 */
|
/* 10.2.1.2 step 2 */
|
||||||
while (len < sizeof temp) {
|
while (len < sizeof temp) {
|
||||||
unsigned int blocklen = sizeof(temp) - len;
|
unsigned int blocklen = sizeof(temp) - len;
|
||||||
uint8_t output_block[TC_AES_BLOCK_SIZE];
|
uint8_t output_block[TC_AES_BLOCK_SIZE];
|
||||||
|
|
||||||
/* 10.2.1.2 step 2.1 */
|
/* 10.2.1.2 step 2.1 */
|
||||||
arrInc(ctx->V, sizeof ctx->V);
|
arrInc(ctx->V, sizeof ctx->V);
|
||||||
|
|
||||||
/* 10.2.1.2 step 2.2 */
|
/* 10.2.1.2 step 2.2 */
|
||||||
if (blocklen > TC_AES_BLOCK_SIZE) {
|
if (blocklen > TC_AES_BLOCK_SIZE) {
|
||||||
blocklen = TC_AES_BLOCK_SIZE;
|
blocklen = TC_AES_BLOCK_SIZE;
|
||||||
}
|
}
|
||||||
(void)tc_aes_encrypt(output_block, ctx->V, &ctx->key);
|
(void)tc_aes_encrypt(output_block, ctx->V, &ctx->key);
|
||||||
|
|
||||||
/* 10.2.1.2 step 2.3/step 3 */
|
/* 10.2.1.2 step 2.3/step 3 */
|
||||||
memcpy(&(temp[len]), output_block, blocklen);
|
memcpy(&(temp[len]), output_block, blocklen);
|
||||||
|
|
||||||
len += blocklen;
|
len += blocklen;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.2 step 4 */
|
/* 10.2.1.2 step 4 */
|
||||||
if (0 != providedData) {
|
if (0 != providedData) {
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
for (i = 0U; i < sizeof temp; i++) {
|
for (i = 0U; i < sizeof temp; i++) {
|
||||||
temp[i] ^= providedData[i];
|
temp[i] ^= providedData[i];
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.2 step 5 */
|
/* 10.2.1.2 step 5 */
|
||||||
(void)tc_aes128_set_encrypt_key(&ctx->key, temp);
|
(void)tc_aes128_set_encrypt_key(&ctx->key, temp);
|
||||||
|
|
||||||
/* 10.2.1.2 step 6 */
|
/* 10.2.1.2 step 6 */
|
||||||
memcpy(ctx->V, &(temp[TC_AES_KEY_SIZE]), TC_AES_BLOCK_SIZE);
|
memcpy(ctx->V, &(temp[TC_AES_KEY_SIZE]), TC_AES_BLOCK_SIZE);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_ctr_prng_init(TCCtrPrng_t * const ctx,
|
int tc_ctr_prng_init(TCCtrPrng_t *const ctx,
|
||||||
uint8_t const * const entropy,
|
uint8_t const *const entropy,
|
||||||
unsigned int entropyLen,
|
unsigned int entropyLen,
|
||||||
uint8_t const * const personalization,
|
uint8_t const *const personalization,
|
||||||
unsigned int pLen)
|
unsigned int pLen)
|
||||||
{
|
{
|
||||||
int result = TC_CRYPTO_FAIL;
|
int result = TC_CRYPTO_FAIL;
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
uint8_t personalization_buf[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE] = {0U};
|
uint8_t personalization_buf[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE] = {0U};
|
||||||
uint8_t seed_material[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
|
uint8_t seed_material[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
|
||||||
uint8_t zeroArr[TC_AES_BLOCK_SIZE] = {0U};
|
uint8_t zeroArr[TC_AES_BLOCK_SIZE] = {0U};
|
||||||
|
|
||||||
if (0 != personalization) {
|
if (0 != personalization) {
|
||||||
/* 10.2.1.3.1 step 1 */
|
/* 10.2.1.3.1 step 1 */
|
||||||
unsigned int len = pLen;
|
unsigned int len = pLen;
|
||||||
if (len > sizeof personalization_buf) {
|
if (len > sizeof personalization_buf) {
|
||||||
len = sizeof personalization_buf;
|
len = sizeof personalization_buf;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.3.1 step 2 */
|
/* 10.2.1.3.1 step 2 */
|
||||||
memcpy(personalization_buf, personalization, len);
|
memcpy(personalization_buf, personalization, len);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((0 != ctx) && (0 != entropy) && (entropyLen >= sizeof seed_material)) {
|
if ((0 != ctx) && (0 != entropy) && (entropyLen >= sizeof seed_material)) {
|
||||||
/* 10.2.1.3.1 step 3 */
|
/* 10.2.1.3.1 step 3 */
|
||||||
memcpy(seed_material, entropy, sizeof seed_material);
|
memcpy(seed_material, entropy, sizeof seed_material);
|
||||||
for (i = 0U; i < sizeof seed_material; i++) {
|
for (i = 0U; i < sizeof seed_material; i++) {
|
||||||
seed_material[i] ^= personalization_buf[i];
|
seed_material[i] ^= personalization_buf[i];
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.3.1 step 4 */
|
/* 10.2.1.3.1 step 4 */
|
||||||
(void)tc_aes128_set_encrypt_key(&ctx->key, zeroArr);
|
(void)tc_aes128_set_encrypt_key(&ctx->key, zeroArr);
|
||||||
|
|
||||||
/* 10.2.1.3.1 step 5 */
|
/* 10.2.1.3.1 step 5 */
|
||||||
memset(ctx->V, 0x00, sizeof ctx->V);
|
memset(ctx->V, 0x00, sizeof ctx->V);
|
||||||
|
|
||||||
/* 10.2.1.3.1 step 6 */
|
/* 10.2.1.3.1 step 6 */
|
||||||
tc_ctr_prng_update(ctx, seed_material);
|
tc_ctr_prng_update(ctx, seed_material);
|
||||||
|
|
||||||
/* 10.2.1.3.1 step 7 */
|
/* 10.2.1.3.1 step 7 */
|
||||||
ctx->reseedCount = 1U;
|
ctx->reseedCount = 1U;
|
||||||
|
|
||||||
result = TC_CRYPTO_SUCCESS;
|
result = TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_ctr_prng_reseed(TCCtrPrng_t * const ctx,
|
int tc_ctr_prng_reseed(TCCtrPrng_t *const ctx,
|
||||||
uint8_t const * const entropy,
|
uint8_t const *const entropy,
|
||||||
unsigned int entropyLen,
|
unsigned int entropyLen,
|
||||||
uint8_t const * const additional_input,
|
uint8_t const *const additional_input,
|
||||||
unsigned int additionallen)
|
unsigned int additionallen)
|
||||||
{
|
{
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
int result = TC_CRYPTO_FAIL;
|
int result = TC_CRYPTO_FAIL;
|
||||||
uint8_t additional_input_buf[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE] = {0U};
|
uint8_t additional_input_buf[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE] = {0U};
|
||||||
uint8_t seed_material[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
|
uint8_t seed_material[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE];
|
||||||
|
|
||||||
if (0 != additional_input) {
|
if (0 != additional_input) {
|
||||||
/* 10.2.1.4.1 step 1 */
|
/* 10.2.1.4.1 step 1 */
|
||||||
unsigned int len = additionallen;
|
unsigned int len = additionallen;
|
||||||
if (len > sizeof additional_input_buf) {
|
if (len > sizeof additional_input_buf) {
|
||||||
len = sizeof additional_input_buf;
|
len = sizeof additional_input_buf;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.4.1 step 2 */
|
/* 10.2.1.4.1 step 2 */
|
||||||
memcpy(additional_input_buf, additional_input, len);
|
memcpy(additional_input_buf, additional_input, len);
|
||||||
}
|
}
|
||||||
|
|
||||||
unsigned int seedlen = (unsigned int)TC_AES_KEY_SIZE + (unsigned int)TC_AES_BLOCK_SIZE;
|
unsigned int seedlen = (unsigned int)TC_AES_KEY_SIZE + (unsigned int)TC_AES_BLOCK_SIZE;
|
||||||
if ((0 != ctx) && (entropyLen >= seedlen)) {
|
if ((0 != ctx) && (entropyLen >= seedlen)) {
|
||||||
/* 10.2.1.4.1 step 3 */
|
/* 10.2.1.4.1 step 3 */
|
||||||
memcpy(seed_material, entropy, sizeof seed_material);
|
memcpy(seed_material, entropy, sizeof seed_material);
|
||||||
for (i = 0U; i < sizeof seed_material; i++) {
|
for (i = 0U; i < sizeof seed_material; i++) {
|
||||||
seed_material[i] ^= additional_input_buf[i];
|
seed_material[i] ^= additional_input_buf[i];
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.4.1 step 4 */
|
/* 10.2.1.4.1 step 4 */
|
||||||
tc_ctr_prng_update(ctx, seed_material);
|
tc_ctr_prng_update(ctx, seed_material);
|
||||||
|
|
||||||
/* 10.2.1.4.1 step 5 */
|
/* 10.2.1.4.1 step 5 */
|
||||||
ctx->reseedCount = 1U;
|
ctx->reseedCount = 1U;
|
||||||
|
|
||||||
result = TC_CRYPTO_SUCCESS;
|
result = TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_ctr_prng_generate(TCCtrPrng_t * const ctx,
|
int tc_ctr_prng_generate(TCCtrPrng_t *const ctx,
|
||||||
uint8_t const * const additional_input,
|
uint8_t const *const additional_input,
|
||||||
unsigned int additionallen,
|
unsigned int additionallen,
|
||||||
uint8_t * const out,
|
uint8_t *const out,
|
||||||
unsigned int outlen)
|
unsigned int outlen)
|
||||||
{
|
{
|
||||||
/* 2^48 - see section 10.2.1 */
|
/* 2^48 - see section 10.2.1 */
|
||||||
static const uint64_t MAX_REQS_BEFORE_RESEED = 0x1000000000000ULL;
|
static const uint64_t MAX_REQS_BEFORE_RESEED = 0x1000000000000ULL;
|
||||||
|
|
||||||
/* 2^19 bits - see section 10.2.1 */
|
/* 2^19 bits - see section 10.2.1 */
|
||||||
static const unsigned int MAX_BYTES_PER_REQ = 65536U;
|
static const unsigned int MAX_BYTES_PER_REQ = 65536U;
|
||||||
|
|
||||||
unsigned int result = TC_CRYPTO_FAIL;
|
unsigned int result = TC_CRYPTO_FAIL;
|
||||||
|
|
||||||
if ((0 != ctx) && (0 != out) && (outlen < MAX_BYTES_PER_REQ)) {
|
if ((0 != ctx) && (0 != out) && (outlen < MAX_BYTES_PER_REQ)) {
|
||||||
/* 10.2.1.5.1 step 1 */
|
/* 10.2.1.5.1 step 1 */
|
||||||
if (ctx->reseedCount > MAX_REQS_BEFORE_RESEED) {
|
if (ctx->reseedCount > MAX_REQS_BEFORE_RESEED) {
|
||||||
result = TC_CTR_PRNG_RESEED_REQ;
|
result = TC_CTR_PRNG_RESEED_REQ;
|
||||||
} else {
|
} else {
|
||||||
uint8_t additional_input_buf[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE] = {0U};
|
uint8_t additional_input_buf[TC_AES_KEY_SIZE + TC_AES_BLOCK_SIZE] = {0U};
|
||||||
if (0 != additional_input) {
|
if (0 != additional_input) {
|
||||||
/* 10.2.1.5.1 step 2 */
|
/* 10.2.1.5.1 step 2 */
|
||||||
unsigned int len = additionallen;
|
unsigned int len = additionallen;
|
||||||
if (len > sizeof additional_input_buf) {
|
if (len > sizeof additional_input_buf) {
|
||||||
len = sizeof additional_input_buf;
|
len = sizeof additional_input_buf;
|
||||||
}
|
}
|
||||||
memcpy(additional_input_buf, additional_input, len);
|
memcpy(additional_input_buf, additional_input, len);
|
||||||
tc_ctr_prng_update(ctx, additional_input_buf);
|
tc_ctr_prng_update(ctx, additional_input_buf);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 3 - implicit */
|
/* 10.2.1.5.1 step 3 - implicit */
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 4 */
|
/* 10.2.1.5.1 step 4 */
|
||||||
unsigned int len = 0U;
|
unsigned int len = 0U;
|
||||||
while (len < outlen) {
|
while (len < outlen) {
|
||||||
unsigned int blocklen = outlen - len;
|
unsigned int blocklen = outlen - len;
|
||||||
uint8_t output_block[TC_AES_BLOCK_SIZE];
|
uint8_t output_block[TC_AES_BLOCK_SIZE];
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 4.1 */
|
/* 10.2.1.5.1 step 4.1 */
|
||||||
arrInc(ctx->V, sizeof ctx->V);
|
arrInc(ctx->V, sizeof ctx->V);
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 4.2 */
|
/* 10.2.1.5.1 step 4.2 */
|
||||||
(void)tc_aes_encrypt(output_block, ctx->V, &ctx->key);
|
(void)tc_aes_encrypt(output_block, ctx->V, &ctx->key);
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 4.3/step 5 */
|
/* 10.2.1.5.1 step 4.3/step 5 */
|
||||||
if (blocklen > TC_AES_BLOCK_SIZE) {
|
if (blocklen > TC_AES_BLOCK_SIZE) {
|
||||||
blocklen = TC_AES_BLOCK_SIZE;
|
blocklen = TC_AES_BLOCK_SIZE;
|
||||||
}
|
}
|
||||||
memcpy(&(out[len]), output_block, blocklen);
|
memcpy(&(out[len]), output_block, blocklen);
|
||||||
|
|
||||||
len += blocklen;
|
len += blocklen;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 6 */
|
/* 10.2.1.5.1 step 6 */
|
||||||
tc_ctr_prng_update(ctx, additional_input_buf);
|
tc_ctr_prng_update(ctx, additional_input_buf);
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 7 */
|
/* 10.2.1.5.1 step 7 */
|
||||||
ctx->reseedCount++;
|
ctx->reseedCount++;
|
||||||
|
|
||||||
/* 10.2.1.5.1 step 8 */
|
/* 10.2.1.5.1 step 8 */
|
||||||
result = TC_CRYPTO_SUCCESS;
|
result = TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
void tc_ctr_prng_uninstantiate(TCCtrPrng_t * const ctx)
|
void tc_ctr_prng_uninstantiate(TCCtrPrng_t *const ctx)
|
||||||
{
|
{
|
||||||
if (0 != ctx) {
|
if (0 != ctx) {
|
||||||
memset(ctx->key.words, 0x00, sizeof ctx->key.words);
|
memset(ctx->key.words, 0x00, sizeof ctx->key.words);
|
||||||
memset(ctx->V, 0x00, sizeof ctx->V);
|
memset(ctx->V, 0x00, sizeof ctx->V);
|
||||||
ctx->reseedCount = 0U;
|
ctx->reseedCount = 0U;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load diff
|
|
@ -67,132 +67,132 @@ static uECC_RNG_Function g_rng_function = 0;
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
int uECC_make_key_with_d(uint8_t *public_key, uint8_t *private_key,
|
int uECC_make_key_with_d(uint8_t *public_key, uint8_t *private_key,
|
||||||
unsigned int *d, uECC_Curve curve)
|
unsigned int *d, uECC_Curve curve)
|
||||||
{
|
{
|
||||||
|
|
||||||
uECC_word_t _private[NUM_ECC_WORDS];
|
uECC_word_t _private[NUM_ECC_WORDS];
|
||||||
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
||||||
|
|
||||||
/* This function is designed for test purposes-only (such as validating NIST
|
/* This function is designed for test purposes-only (such as validating NIST
|
||||||
* test vectors) as it uses a provided value for d instead of generating
|
* test vectors) as it uses a provided value for d instead of generating
|
||||||
* it uniformly at random. */
|
* it uniformly at random. */
|
||||||
memcpy (_private, d, NUM_ECC_BYTES);
|
memcpy (_private, d, NUM_ECC_BYTES);
|
||||||
|
|
||||||
/* Computing public-key from private: */
|
/* Computing public-key from private: */
|
||||||
if (EccPoint_compute_public_key(_public, _private, curve)) {
|
if (EccPoint_compute_public_key(_public, _private, curve)) {
|
||||||
|
|
||||||
/* Converting buffers to correct bit order: */
|
/* Converting buffers to correct bit order: */
|
||||||
uECC_vli_nativeToBytes(private_key,
|
uECC_vli_nativeToBytes(private_key,
|
||||||
BITS_TO_BYTES(curve->num_n_bits),
|
BITS_TO_BYTES(curve->num_n_bits),
|
||||||
_private);
|
_private);
|
||||||
uECC_vli_nativeToBytes(public_key,
|
uECC_vli_nativeToBytes(public_key,
|
||||||
curve->num_bytes,
|
curve->num_bytes,
|
||||||
_public);
|
_public);
|
||||||
uECC_vli_nativeToBytes(public_key + curve->num_bytes,
|
uECC_vli_nativeToBytes(public_key + curve->num_bytes,
|
||||||
curve->num_bytes,
|
curve->num_bytes,
|
||||||
_public + curve->num_words);
|
_public + curve->num_words);
|
||||||
|
|
||||||
/* erasing temporary buffer used to store secret: */
|
/* erasing temporary buffer used to store secret: */
|
||||||
_set_secure(_private, 0, NUM_ECC_BYTES);
|
_set_secure(_private, 0, NUM_ECC_BYTES);
|
||||||
|
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
int uECC_make_key(uint8_t *public_key, uint8_t *private_key, uECC_Curve curve)
|
int uECC_make_key(uint8_t *public_key, uint8_t *private_key, uECC_Curve curve)
|
||||||
{
|
{
|
||||||
|
|
||||||
uECC_word_t _random[NUM_ECC_WORDS * 2];
|
uECC_word_t _random[NUM_ECC_WORDS * 2];
|
||||||
uECC_word_t _private[NUM_ECC_WORDS];
|
uECC_word_t _private[NUM_ECC_WORDS];
|
||||||
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
||||||
uECC_word_t tries;
|
uECC_word_t tries;
|
||||||
|
|
||||||
for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
|
for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
|
||||||
/* Generating _private uniformly at random: */
|
/* Generating _private uniformly at random: */
|
||||||
uECC_RNG_Function rng_function = uECC_get_rng();
|
uECC_RNG_Function rng_function = uECC_get_rng();
|
||||||
if (!rng_function ||
|
if (!rng_function ||
|
||||||
!rng_function((uint8_t *)_random, 2 * NUM_ECC_WORDS*uECC_WORD_SIZE)) {
|
!rng_function((uint8_t *)_random, 2 * NUM_ECC_WORDS * uECC_WORD_SIZE)) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* computing modular reduction of _random (see FIPS 186.4 B.4.1): */
|
/* computing modular reduction of _random (see FIPS 186.4 B.4.1): */
|
||||||
uECC_vli_mmod(_private, _random, curve->n, BITS_TO_WORDS(curve->num_n_bits));
|
uECC_vli_mmod(_private, _random, curve->n, BITS_TO_WORDS(curve->num_n_bits));
|
||||||
|
|
||||||
/* Computing public-key from private: */
|
/* Computing public-key from private: */
|
||||||
if (EccPoint_compute_public_key(_public, _private, curve)) {
|
if (EccPoint_compute_public_key(_public, _private, curve)) {
|
||||||
|
|
||||||
/* Converting buffers to correct bit order: */
|
/* Converting buffers to correct bit order: */
|
||||||
uECC_vli_nativeToBytes(private_key,
|
uECC_vli_nativeToBytes(private_key,
|
||||||
BITS_TO_BYTES(curve->num_n_bits),
|
BITS_TO_BYTES(curve->num_n_bits),
|
||||||
_private);
|
_private);
|
||||||
uECC_vli_nativeToBytes(public_key,
|
uECC_vli_nativeToBytes(public_key,
|
||||||
curve->num_bytes,
|
curve->num_bytes,
|
||||||
_public);
|
_public);
|
||||||
uECC_vli_nativeToBytes(public_key + curve->num_bytes,
|
uECC_vli_nativeToBytes(public_key + curve->num_bytes,
|
||||||
curve->num_bytes,
|
curve->num_bytes,
|
||||||
_public + curve->num_words);
|
_public + curve->num_words);
|
||||||
|
|
||||||
/* erasing temporary buffer that stored secret: */
|
/* erasing temporary buffer that stored secret: */
|
||||||
_set_secure(_private, 0, NUM_ECC_BYTES);
|
_set_secure(_private, 0, NUM_ECC_BYTES);
|
||||||
|
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
int uECC_shared_secret(const uint8_t *public_key, const uint8_t *private_key,
|
int uECC_shared_secret(const uint8_t *public_key, const uint8_t *private_key,
|
||||||
uint8_t *secret, uECC_Curve curve)
|
uint8_t *secret, uECC_Curve curve)
|
||||||
{
|
{
|
||||||
|
|
||||||
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
||||||
uECC_word_t _private[NUM_ECC_WORDS];
|
uECC_word_t _private[NUM_ECC_WORDS];
|
||||||
|
|
||||||
uECC_word_t tmp[NUM_ECC_WORDS];
|
uECC_word_t tmp[NUM_ECC_WORDS];
|
||||||
uECC_word_t *p2[2] = {_private, tmp};
|
uECC_word_t *p2[2] = {_private, tmp};
|
||||||
uECC_word_t *initial_Z = 0;
|
uECC_word_t *initial_Z = 0;
|
||||||
uECC_word_t carry;
|
uECC_word_t carry;
|
||||||
wordcount_t num_words = curve->num_words;
|
wordcount_t num_words = curve->num_words;
|
||||||
wordcount_t num_bytes = curve->num_bytes;
|
wordcount_t num_bytes = curve->num_bytes;
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
/* Converting buffers to correct bit order: */
|
/* Converting buffers to correct bit order: */
|
||||||
uECC_vli_bytesToNative(_private,
|
uECC_vli_bytesToNative(_private,
|
||||||
private_key,
|
private_key,
|
||||||
BITS_TO_BYTES(curve->num_n_bits));
|
BITS_TO_BYTES(curve->num_n_bits));
|
||||||
uECC_vli_bytesToNative(_public,
|
uECC_vli_bytesToNative(_public,
|
||||||
public_key,
|
public_key,
|
||||||
num_bytes);
|
num_bytes);
|
||||||
uECC_vli_bytesToNative(_public + num_words,
|
uECC_vli_bytesToNative(_public + num_words,
|
||||||
public_key + num_bytes,
|
public_key + num_bytes,
|
||||||
num_bytes);
|
num_bytes);
|
||||||
|
|
||||||
/* Regularize the bitcount for the private key so that attackers cannot use a
|
/* Regularize the bitcount for the private key so that attackers cannot use a
|
||||||
* side channel attack to learn the number of leading zeros. */
|
* side channel attack to learn the number of leading zeros. */
|
||||||
carry = regularize_k(_private, _private, tmp, curve);
|
carry = regularize_k(_private, _private, tmp, curve);
|
||||||
|
|
||||||
/* If an RNG function was specified, try to get a random initial Z value to
|
/* If an RNG function was specified, try to get a random initial Z value to
|
||||||
* improve protection against side-channel attacks. */
|
* improve protection against side-channel attacks. */
|
||||||
if (g_rng_function) {
|
if (g_rng_function) {
|
||||||
if (!uECC_generate_random_int(p2[carry], curve->p, num_words)) {
|
if (!uECC_generate_random_int(p2[carry], curve->p, num_words)) {
|
||||||
r = 0;
|
r = 0;
|
||||||
goto clear_and_out;
|
goto clear_and_out;
|
||||||
}
|
}
|
||||||
initial_Z = p2[carry];
|
initial_Z = p2[carry];
|
||||||
}
|
}
|
||||||
|
|
||||||
EccPoint_mult(_public, _public, p2[!carry], initial_Z, curve->num_n_bits + 1,
|
EccPoint_mult(_public, _public, p2[!carry], initial_Z, curve->num_n_bits + 1,
|
||||||
curve);
|
curve);
|
||||||
|
|
||||||
uECC_vli_nativeToBytes(secret, num_bytes, _public);
|
uECC_vli_nativeToBytes(secret, num_bytes, _public);
|
||||||
r = !EccPoint_isZero(_public, curve);
|
r = !EccPoint_isZero(_public, curve);
|
||||||
|
|
||||||
clear_and_out:
|
clear_and_out:
|
||||||
/* erasing temporary buffer used to store secret: */
|
/* erasing temporary buffer used to store secret: */
|
||||||
_set_secure(p2, 0, sizeof(p2));
|
_set_secure(p2, 0, sizeof(p2));
|
||||||
_set_secure(tmp, 0, sizeof(tmp));
|
_set_secure(tmp, 0, sizeof(tmp));
|
||||||
_set_secure(_private, 0, sizeof(_private));
|
_set_secure(_private, 0, sizeof(_private));
|
||||||
|
|
||||||
return r;
|
return r;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -64,231 +64,230 @@ static uECC_RNG_Function g_rng_function = 0;
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
static void bits2int(uECC_word_t *native, const uint8_t *bits,
|
static void bits2int(uECC_word_t *native, const uint8_t *bits,
|
||||||
unsigned bits_size, uECC_Curve curve)
|
unsigned bits_size, uECC_Curve curve)
|
||||||
{
|
{
|
||||||
unsigned num_n_bytes = BITS_TO_BYTES(curve->num_n_bits);
|
unsigned num_n_bytes = BITS_TO_BYTES(curve->num_n_bits);
|
||||||
unsigned num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
unsigned num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
||||||
int shift;
|
int shift;
|
||||||
uECC_word_t carry;
|
uECC_word_t carry;
|
||||||
uECC_word_t *ptr;
|
uECC_word_t *ptr;
|
||||||
|
|
||||||
if (bits_size > num_n_bytes) {
|
if (bits_size > num_n_bytes) {
|
||||||
bits_size = num_n_bytes;
|
bits_size = num_n_bytes;
|
||||||
}
|
}
|
||||||
|
|
||||||
uECC_vli_clear(native, num_n_words);
|
uECC_vli_clear(native, num_n_words);
|
||||||
uECC_vli_bytesToNative(native, bits, bits_size);
|
uECC_vli_bytesToNative(native, bits, bits_size);
|
||||||
if (bits_size * 8 <= (unsigned)curve->num_n_bits) {
|
if (bits_size * 8 <= (unsigned)curve->num_n_bits) {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
shift = bits_size * 8 - curve->num_n_bits;
|
shift = bits_size * 8 - curve->num_n_bits;
|
||||||
carry = 0;
|
carry = 0;
|
||||||
ptr = native + num_n_words;
|
ptr = native + num_n_words;
|
||||||
while (ptr-- > native) {
|
while (ptr-- > native) {
|
||||||
uECC_word_t temp = *ptr;
|
uECC_word_t temp = *ptr;
|
||||||
*ptr = (temp >> shift) | carry;
|
*ptr = (temp >> shift) | carry;
|
||||||
carry = temp << (uECC_WORD_BITS - shift);
|
carry = temp << (uECC_WORD_BITS - shift);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Reduce mod curve_n */
|
/* Reduce mod curve_n */
|
||||||
if (uECC_vli_cmp_unsafe(curve->n, native, num_n_words) != 1) {
|
if (uECC_vli_cmp_unsafe(curve->n, native, num_n_words) != 1) {
|
||||||
uECC_vli_sub(native, native, curve->n, num_n_words);
|
uECC_vli_sub(native, native, curve->n, num_n_words);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash,
|
||||||
unsigned hash_size, uECC_word_t *k, uint8_t *signature,
|
unsigned hash_size, uECC_word_t *k, uint8_t *signature,
|
||||||
uECC_Curve curve)
|
uECC_Curve curve)
|
||||||
{
|
{
|
||||||
|
|
||||||
uECC_word_t tmp[NUM_ECC_WORDS];
|
uECC_word_t tmp[NUM_ECC_WORDS];
|
||||||
uECC_word_t s[NUM_ECC_WORDS];
|
uECC_word_t s[NUM_ECC_WORDS];
|
||||||
uECC_word_t *k2[2] = {tmp, s};
|
uECC_word_t *k2[2] = {tmp, s};
|
||||||
uECC_word_t p[NUM_ECC_WORDS * 2];
|
uECC_word_t p[NUM_ECC_WORDS * 2];
|
||||||
uECC_word_t carry;
|
uECC_word_t carry;
|
||||||
wordcount_t num_words = curve->num_words;
|
wordcount_t num_words = curve->num_words;
|
||||||
wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
||||||
bitcount_t num_n_bits = curve->num_n_bits;
|
bitcount_t num_n_bits = curve->num_n_bits;
|
||||||
|
|
||||||
/* Make sure 0 < k < curve_n */
|
/* Make sure 0 < k < curve_n */
|
||||||
if (uECC_vli_isZero(k, num_words) ||
|
if (uECC_vli_isZero(k, num_words) ||
|
||||||
uECC_vli_cmp(curve->n, k, num_n_words) != 1) {
|
uECC_vli_cmp(curve->n, k, num_n_words) != 1) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
carry = regularize_k(k, tmp, s, curve);
|
carry = regularize_k(k, tmp, s, curve);
|
||||||
EccPoint_mult(p, curve->G, k2[!carry], 0, num_n_bits + 1, curve);
|
EccPoint_mult(p, curve->G, k2[!carry], 0, num_n_bits + 1, curve);
|
||||||
if (uECC_vli_isZero(p, num_words)) {
|
if (uECC_vli_isZero(p, num_words)) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* If an RNG function was specified, get a random number
|
/* If an RNG function was specified, get a random number
|
||||||
to prevent side channel analysis of k. */
|
to prevent side channel analysis of k. */
|
||||||
if (!g_rng_function) {
|
if (!g_rng_function) {
|
||||||
uECC_vli_clear(tmp, num_n_words);
|
uECC_vli_clear(tmp, num_n_words);
|
||||||
tmp[0] = 1;
|
tmp[0] = 1;
|
||||||
}
|
} else if (!uECC_generate_random_int(tmp, curve->n, num_n_words)) {
|
||||||
else if (!uECC_generate_random_int(tmp, curve->n, num_n_words)) {
|
return 0;
|
||||||
return 0;
|
}
|
||||||
}
|
|
||||||
|
|
||||||
/* Prevent side channel analysis of uECC_vli_modInv() to determine
|
/* Prevent side channel analysis of uECC_vli_modInv() to determine
|
||||||
bits of k / the private key by premultiplying by a random number */
|
bits of k / the private key by premultiplying by a random number */
|
||||||
uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k' = rand * k */
|
uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k' = rand * k */
|
||||||
uECC_vli_modInv(k, k, curve->n, num_n_words); /* k = 1 / k' */
|
uECC_vli_modInv(k, k, curve->n, num_n_words); /* k = 1 / k' */
|
||||||
uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k = 1 / k */
|
uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k = 1 / k */
|
||||||
|
|
||||||
uECC_vli_nativeToBytes(signature, curve->num_bytes, p); /* store r */
|
uECC_vli_nativeToBytes(signature, curve->num_bytes, p); /* store r */
|
||||||
|
|
||||||
/* tmp = d: */
|
/* tmp = d: */
|
||||||
uECC_vli_bytesToNative(tmp, private_key, BITS_TO_BYTES(curve->num_n_bits));
|
uECC_vli_bytesToNative(tmp, private_key, BITS_TO_BYTES(curve->num_n_bits));
|
||||||
|
|
||||||
s[num_n_words - 1] = 0;
|
s[num_n_words - 1] = 0;
|
||||||
uECC_vli_set(s, p, num_words);
|
uECC_vli_set(s, p, num_words);
|
||||||
uECC_vli_modMult(s, tmp, s, curve->n, num_n_words); /* s = r*d */
|
uECC_vli_modMult(s, tmp, s, curve->n, num_n_words); /* s = r*d */
|
||||||
|
|
||||||
bits2int(tmp, message_hash, hash_size, curve);
|
bits2int(tmp, message_hash, hash_size, curve);
|
||||||
uECC_vli_modAdd(s, tmp, s, curve->n, num_n_words); /* s = e + r*d */
|
uECC_vli_modAdd(s, tmp, s, curve->n, num_n_words); /* s = e + r*d */
|
||||||
uECC_vli_modMult(s, s, k, curve->n, num_n_words); /* s = (e + r*d) / k */
|
uECC_vli_modMult(s, s, k, curve->n, num_n_words); /* s = (e + r*d) / k */
|
||||||
if (uECC_vli_numBits(s, num_n_words) > (bitcount_t)curve->num_bytes * 8) {
|
if (uECC_vli_numBits(s, num_n_words) > (bitcount_t)curve->num_bytes * 8) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
uECC_vli_nativeToBytes(signature + curve->num_bytes, curve->num_bytes, s);
|
uECC_vli_nativeToBytes(signature + curve->num_bytes, curve->num_bytes, s);
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
int uECC_sign(const uint8_t *private_key, const uint8_t *message_hash,
|
int uECC_sign(const uint8_t *private_key, const uint8_t *message_hash,
|
||||||
unsigned hash_size, uint8_t *signature, uECC_Curve curve)
|
unsigned hash_size, uint8_t *signature, uECC_Curve curve)
|
||||||
{
|
{
|
||||||
uECC_word_t _random[2*NUM_ECC_WORDS];
|
uECC_word_t _random[2 * NUM_ECC_WORDS];
|
||||||
uECC_word_t k[NUM_ECC_WORDS];
|
uECC_word_t k[NUM_ECC_WORDS];
|
||||||
uECC_word_t tries;
|
uECC_word_t tries;
|
||||||
|
|
||||||
for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
|
for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
|
||||||
/* Generating _random uniformly at random: */
|
/* Generating _random uniformly at random: */
|
||||||
uECC_RNG_Function rng_function = uECC_get_rng();
|
uECC_RNG_Function rng_function = uECC_get_rng();
|
||||||
if (!rng_function ||
|
if (!rng_function ||
|
||||||
!rng_function((uint8_t *)_random, 2*NUM_ECC_WORDS*uECC_WORD_SIZE)) {
|
!rng_function((uint8_t *)_random, 2 * NUM_ECC_WORDS * uECC_WORD_SIZE)) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
// computing k as modular reduction of _random (see FIPS 186.4 B.5.1):
|
// computing k as modular reduction of _random (see FIPS 186.4 B.5.1):
|
||||||
uECC_vli_mmod(k, _random, curve->n, BITS_TO_WORDS(curve->num_n_bits));
|
uECC_vli_mmod(k, _random, curve->n, BITS_TO_WORDS(curve->num_n_bits));
|
||||||
|
|
||||||
if (uECC_sign_with_k(private_key, message_hash, hash_size, k, signature,
|
if (uECC_sign_with_k(private_key, message_hash, hash_size, k, signature,
|
||||||
curve)) {
|
curve)) {
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static bitcount_t smax(bitcount_t a, bitcount_t b)
|
static bitcount_t smax(bitcount_t a, bitcount_t b)
|
||||||
{
|
{
|
||||||
return (a > b ? a : b);
|
return (a > b ? a : b);
|
||||||
}
|
}
|
||||||
|
|
||||||
int uECC_verify(const uint8_t *public_key, const uint8_t *message_hash,
|
int uECC_verify(const uint8_t *public_key, const uint8_t *message_hash,
|
||||||
unsigned hash_size, const uint8_t *signature,
|
unsigned hash_size, const uint8_t *signature,
|
||||||
uECC_Curve curve)
|
uECC_Curve curve)
|
||||||
{
|
{
|
||||||
|
|
||||||
uECC_word_t u1[NUM_ECC_WORDS], u2[NUM_ECC_WORDS];
|
uECC_word_t u1[NUM_ECC_WORDS], u2[NUM_ECC_WORDS];
|
||||||
uECC_word_t z[NUM_ECC_WORDS];
|
uECC_word_t z[NUM_ECC_WORDS];
|
||||||
uECC_word_t sum[NUM_ECC_WORDS * 2];
|
uECC_word_t sum[NUM_ECC_WORDS * 2];
|
||||||
uECC_word_t rx[NUM_ECC_WORDS];
|
uECC_word_t rx[NUM_ECC_WORDS];
|
||||||
uECC_word_t ry[NUM_ECC_WORDS];
|
uECC_word_t ry[NUM_ECC_WORDS];
|
||||||
uECC_word_t tx[NUM_ECC_WORDS];
|
uECC_word_t tx[NUM_ECC_WORDS];
|
||||||
uECC_word_t ty[NUM_ECC_WORDS];
|
uECC_word_t ty[NUM_ECC_WORDS];
|
||||||
uECC_word_t tz[NUM_ECC_WORDS];
|
uECC_word_t tz[NUM_ECC_WORDS];
|
||||||
const uECC_word_t *points[4];
|
const uECC_word_t *points[4];
|
||||||
const uECC_word_t *point;
|
const uECC_word_t *point;
|
||||||
bitcount_t num_bits;
|
bitcount_t num_bits;
|
||||||
bitcount_t i;
|
bitcount_t i;
|
||||||
|
|
||||||
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
uECC_word_t _public[NUM_ECC_WORDS * 2];
|
||||||
uECC_word_t r[NUM_ECC_WORDS], s[NUM_ECC_WORDS];
|
uECC_word_t r[NUM_ECC_WORDS], s[NUM_ECC_WORDS];
|
||||||
wordcount_t num_words = curve->num_words;
|
wordcount_t num_words = curve->num_words;
|
||||||
wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
|
||||||
|
|
||||||
rx[num_n_words - 1] = 0;
|
rx[num_n_words - 1] = 0;
|
||||||
r[num_n_words - 1] = 0;
|
r[num_n_words - 1] = 0;
|
||||||
s[num_n_words - 1] = 0;
|
s[num_n_words - 1] = 0;
|
||||||
|
|
||||||
uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
|
uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
|
||||||
uECC_vli_bytesToNative(_public + num_words, public_key + curve->num_bytes,
|
uECC_vli_bytesToNative(_public + num_words, public_key + curve->num_bytes,
|
||||||
curve->num_bytes);
|
curve->num_bytes);
|
||||||
uECC_vli_bytesToNative(r, signature, curve->num_bytes);
|
uECC_vli_bytesToNative(r, signature, curve->num_bytes);
|
||||||
uECC_vli_bytesToNative(s, signature + curve->num_bytes, curve->num_bytes);
|
uECC_vli_bytesToNative(s, signature + curve->num_bytes, curve->num_bytes);
|
||||||
|
|
||||||
/* r, s must not be 0. */
|
/* r, s must not be 0. */
|
||||||
if (uECC_vli_isZero(r, num_words) || uECC_vli_isZero(s, num_words)) {
|
if (uECC_vli_isZero(r, num_words) || uECC_vli_isZero(s, num_words)) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* r, s must be < n. */
|
/* r, s must be < n. */
|
||||||
if (uECC_vli_cmp_unsafe(curve->n, r, num_n_words) != 1 ||
|
if (uECC_vli_cmp_unsafe(curve->n, r, num_n_words) != 1 ||
|
||||||
uECC_vli_cmp_unsafe(curve->n, s, num_n_words) != 1) {
|
uECC_vli_cmp_unsafe(curve->n, s, num_n_words) != 1) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Calculate u1 and u2. */
|
/* Calculate u1 and u2. */
|
||||||
uECC_vli_modInv(z, s, curve->n, num_n_words); /* z = 1/s */
|
uECC_vli_modInv(z, s, curve->n, num_n_words); /* z = 1/s */
|
||||||
u1[num_n_words - 1] = 0;
|
u1[num_n_words - 1] = 0;
|
||||||
bits2int(u1, message_hash, hash_size, curve);
|
bits2int(u1, message_hash, hash_size, curve);
|
||||||
uECC_vli_modMult(u1, u1, z, curve->n, num_n_words); /* u1 = e/s */
|
uECC_vli_modMult(u1, u1, z, curve->n, num_n_words); /* u1 = e/s */
|
||||||
uECC_vli_modMult(u2, r, z, curve->n, num_n_words); /* u2 = r/s */
|
uECC_vli_modMult(u2, r, z, curve->n, num_n_words); /* u2 = r/s */
|
||||||
|
|
||||||
/* Calculate sum = G + Q. */
|
/* Calculate sum = G + Q. */
|
||||||
uECC_vli_set(sum, _public, num_words);
|
uECC_vli_set(sum, _public, num_words);
|
||||||
uECC_vli_set(sum + num_words, _public + num_words, num_words);
|
uECC_vli_set(sum + num_words, _public + num_words, num_words);
|
||||||
uECC_vli_set(tx, curve->G, num_words);
|
uECC_vli_set(tx, curve->G, num_words);
|
||||||
uECC_vli_set(ty, curve->G + num_words, num_words);
|
uECC_vli_set(ty, curve->G + num_words, num_words);
|
||||||
uECC_vli_modSub(z, sum, tx, curve->p, num_words); /* z = x2 - x1 */
|
uECC_vli_modSub(z, sum, tx, curve->p, num_words); /* z = x2 - x1 */
|
||||||
XYcZ_add(tx, ty, sum, sum + num_words, curve);
|
XYcZ_add(tx, ty, sum, sum + num_words, curve);
|
||||||
uECC_vli_modInv(z, z, curve->p, num_words); /* z = 1/z */
|
uECC_vli_modInv(z, z, curve->p, num_words); /* z = 1/z */
|
||||||
apply_z(sum, sum + num_words, z, curve);
|
apply_z(sum, sum + num_words, z, curve);
|
||||||
|
|
||||||
/* Use Shamir's trick to calculate u1*G + u2*Q */
|
/* Use Shamir's trick to calculate u1*G + u2*Q */
|
||||||
points[0] = 0;
|
points[0] = 0;
|
||||||
points[1] = curve->G;
|
points[1] = curve->G;
|
||||||
points[2] = _public;
|
points[2] = _public;
|
||||||
points[3] = sum;
|
points[3] = sum;
|
||||||
num_bits = smax(uECC_vli_numBits(u1, num_n_words),
|
num_bits = smax(uECC_vli_numBits(u1, num_n_words),
|
||||||
uECC_vli_numBits(u2, num_n_words));
|
uECC_vli_numBits(u2, num_n_words));
|
||||||
|
|
||||||
point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
|
point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
|
||||||
((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
|
((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
|
||||||
uECC_vli_set(rx, point, num_words);
|
uECC_vli_set(rx, point, num_words);
|
||||||
uECC_vli_set(ry, point + num_words, num_words);
|
uECC_vli_set(ry, point + num_words, num_words);
|
||||||
uECC_vli_clear(z, num_words);
|
uECC_vli_clear(z, num_words);
|
||||||
z[0] = 1;
|
z[0] = 1;
|
||||||
|
|
||||||
for (i = num_bits - 2; i >= 0; --i) {
|
for (i = num_bits - 2; i >= 0; --i) {
|
||||||
uECC_word_t index;
|
uECC_word_t index;
|
||||||
curve->double_jacobian(rx, ry, z, curve);
|
curve->double_jacobian(rx, ry, z, curve);
|
||||||
|
|
||||||
index = (!!uECC_vli_testBit(u1, i)) | ((!!uECC_vli_testBit(u2, i)) << 1);
|
index = (!!uECC_vli_testBit(u1, i)) | ((!!uECC_vli_testBit(u2, i)) << 1);
|
||||||
point = points[index];
|
point = points[index];
|
||||||
if (point) {
|
if (point) {
|
||||||
uECC_vli_set(tx, point, num_words);
|
uECC_vli_set(tx, point, num_words);
|
||||||
uECC_vli_set(ty, point + num_words, num_words);
|
uECC_vli_set(ty, point + num_words, num_words);
|
||||||
apply_z(tx, ty, z, curve);
|
apply_z(tx, ty, z, curve);
|
||||||
uECC_vli_modSub(tz, rx, tx, curve->p, num_words); /* Z = x2 - x1 */
|
uECC_vli_modSub(tz, rx, tx, curve->p, num_words); /* Z = x2 - x1 */
|
||||||
XYcZ_add(tx, ty, rx, ry, curve);
|
XYcZ_add(tx, ty, rx, ry, curve);
|
||||||
uECC_vli_modMult_fast(z, z, tz, curve);
|
uECC_vli_modMult_fast(z, z, tz, curve);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
uECC_vli_modInv(z, z, curve->p, num_words); /* Z = 1/Z */
|
uECC_vli_modInv(z, z, curve->p, num_words); /* Z = 1/Z */
|
||||||
apply_z(rx, ry, z, curve);
|
apply_z(rx, ry, z, curve);
|
||||||
|
|
||||||
/* v = x1 (mod n) */
|
/* v = x1 (mod n) */
|
||||||
if (uECC_vli_cmp_unsafe(curve->n, rx, num_n_words) != 1) {
|
if (uECC_vli_cmp_unsafe(curve->n, rx, num_n_words) != 1) {
|
||||||
uECC_vli_sub(rx, rx, curve->n, num_n_words);
|
uECC_vli_sub(rx, rx, curve->n, num_n_words);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Accept only if v == r. */
|
/* Accept only if v == r. */
|
||||||
return (int)(uECC_vli_equal(rx, r, num_words) == 0);
|
return (int)(uECC_vli_equal(rx, r, num_words) == 0);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -71,34 +71,36 @@
|
||||||
#define O_CLOEXEC 0
|
#define O_CLOEXEC 0
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
int default_CSPRNG(uint8_t *dest, unsigned int size) {
|
int default_CSPRNG(uint8_t *dest, unsigned int size)
|
||||||
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (dest == (uint8_t *) 0 || (size <= 0))
|
if (dest == (uint8_t *) 0 || (size <= 0)) {
|
||||||
return 0;
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
|
int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
|
||||||
if (fd == -1) {
|
|
||||||
fd = open("/dev/random", O_RDONLY | O_CLOEXEC);
|
|
||||||
if (fd == -1) {
|
if (fd == -1) {
|
||||||
return 0;
|
fd = open("/dev/random", O_RDONLY | O_CLOEXEC);
|
||||||
|
if (fd == -1) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
||||||
char *ptr = (char *)dest;
|
char *ptr = (char *)dest;
|
||||||
size_t left = (size_t) size;
|
size_t left = (size_t) size;
|
||||||
while (left > 0) {
|
while (left > 0) {
|
||||||
ssize_t bytes_read = read(fd, ptr, left);
|
ssize_t bytes_read = read(fd, ptr, left);
|
||||||
if (bytes_read <= 0) { // read failed
|
if (bytes_read <= 0) { // read failed
|
||||||
close(fd);
|
close(fd);
|
||||||
return 0;
|
return 0;
|
||||||
|
}
|
||||||
|
left -= bytes_read;
|
||||||
|
ptr += bytes_read;
|
||||||
}
|
}
|
||||||
left -= bytes_read;
|
|
||||||
ptr += bytes_read;
|
|
||||||
}
|
|
||||||
|
|
||||||
close(fd);
|
close(fd);
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
#endif /* platform */
|
#endif /* platform */
|
||||||
|
|
|
||||||
|
|
@ -36,112 +36,112 @@
|
||||||
|
|
||||||
static void rekey(uint8_t *key, const uint8_t *new_key, unsigned int key_size)
|
static void rekey(uint8_t *key, const uint8_t *new_key, unsigned int key_size)
|
||||||
{
|
{
|
||||||
const uint8_t inner_pad = (uint8_t) 0x36;
|
const uint8_t inner_pad = (uint8_t) 0x36;
|
||||||
const uint8_t outer_pad = (uint8_t) 0x5c;
|
const uint8_t outer_pad = (uint8_t) 0x5c;
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
for (i = 0; i < key_size; ++i) {
|
for (i = 0; i < key_size; ++i) {
|
||||||
key[i] = inner_pad ^ new_key[i];
|
key[i] = inner_pad ^ new_key[i];
|
||||||
key[i + TC_SHA256_BLOCK_SIZE] = outer_pad ^ new_key[i];
|
key[i + TC_SHA256_BLOCK_SIZE] = outer_pad ^ new_key[i];
|
||||||
}
|
}
|
||||||
for (; i < TC_SHA256_BLOCK_SIZE; ++i) {
|
for (; i < TC_SHA256_BLOCK_SIZE; ++i) {
|
||||||
key[i] = inner_pad; key[i + TC_SHA256_BLOCK_SIZE] = outer_pad;
|
key[i] = inner_pad; key[i + TC_SHA256_BLOCK_SIZE] = outer_pad;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_hmac_set_key(TCHmacState_t ctx, const uint8_t *key,
|
int tc_hmac_set_key(TCHmacState_t ctx, const uint8_t *key,
|
||||||
unsigned int key_size)
|
unsigned int key_size)
|
||||||
{
|
{
|
||||||
/* Input sanity check */
|
/* Input sanity check */
|
||||||
if (ctx == (TCHmacState_t) 0 ||
|
if (ctx == (TCHmacState_t) 0 ||
|
||||||
key == (const uint8_t *) 0 ||
|
key == (const uint8_t *) 0 ||
|
||||||
key_size == 0) {
|
key_size == 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
const uint8_t dummy_key[TC_SHA256_BLOCK_SIZE];
|
const uint8_t dummy_key[TC_SHA256_BLOCK_SIZE];
|
||||||
struct tc_hmac_state_struct dummy_state;
|
struct tc_hmac_state_struct dummy_state;
|
||||||
|
|
||||||
if (key_size <= TC_SHA256_BLOCK_SIZE) {
|
if (key_size <= TC_SHA256_BLOCK_SIZE) {
|
||||||
/*
|
/*
|
||||||
* The next three calls are dummy calls just to avoid
|
* The next three calls are dummy calls just to avoid
|
||||||
* certain timing attacks. Without these dummy calls,
|
* certain timing attacks. Without these dummy calls,
|
||||||
* adversaries would be able to learn whether the key_size is
|
* adversaries would be able to learn whether the key_size is
|
||||||
* greater than TC_SHA256_BLOCK_SIZE by measuring the time
|
* greater than TC_SHA256_BLOCK_SIZE by measuring the time
|
||||||
* consumed in this process.
|
* consumed in this process.
|
||||||
*/
|
*/
|
||||||
(void)tc_sha256_init(&dummy_state.hash_state);
|
(void)tc_sha256_init(&dummy_state.hash_state);
|
||||||
(void)tc_sha256_update(&dummy_state.hash_state,
|
(void)tc_sha256_update(&dummy_state.hash_state,
|
||||||
dummy_key,
|
dummy_key,
|
||||||
key_size);
|
key_size);
|
||||||
(void)tc_sha256_final(&dummy_state.key[TC_SHA256_DIGEST_SIZE],
|
(void)tc_sha256_final(&dummy_state.key[TC_SHA256_DIGEST_SIZE],
|
||||||
&dummy_state.hash_state);
|
&dummy_state.hash_state);
|
||||||
|
|
||||||
/* Actual code for when key_size <= TC_SHA256_BLOCK_SIZE: */
|
/* Actual code for when key_size <= TC_SHA256_BLOCK_SIZE: */
|
||||||
rekey(ctx->key, key, key_size);
|
rekey(ctx->key, key, key_size);
|
||||||
} else {
|
} else {
|
||||||
(void)tc_sha256_init(&ctx->hash_state);
|
(void)tc_sha256_init(&ctx->hash_state);
|
||||||
(void)tc_sha256_update(&ctx->hash_state, key, key_size);
|
(void)tc_sha256_update(&ctx->hash_state, key, key_size);
|
||||||
(void)tc_sha256_final(&ctx->key[TC_SHA256_DIGEST_SIZE],
|
(void)tc_sha256_final(&ctx->key[TC_SHA256_DIGEST_SIZE],
|
||||||
&ctx->hash_state);
|
&ctx->hash_state);
|
||||||
rekey(ctx->key,
|
rekey(ctx->key,
|
||||||
&ctx->key[TC_SHA256_DIGEST_SIZE],
|
&ctx->key[TC_SHA256_DIGEST_SIZE],
|
||||||
TC_SHA256_DIGEST_SIZE);
|
TC_SHA256_DIGEST_SIZE);
|
||||||
}
|
}
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_hmac_init(TCHmacState_t ctx)
|
int tc_hmac_init(TCHmacState_t ctx)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (ctx == (TCHmacState_t) 0) {
|
if (ctx == (TCHmacState_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
(void) tc_sha256_init(&ctx->hash_state);
|
(void) tc_sha256_init(&ctx->hash_state);
|
||||||
(void) tc_sha256_update(&ctx->hash_state, ctx->key, TC_SHA256_BLOCK_SIZE);
|
(void) tc_sha256_update(&ctx->hash_state, ctx->key, TC_SHA256_BLOCK_SIZE);
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_hmac_update(TCHmacState_t ctx,
|
int tc_hmac_update(TCHmacState_t ctx,
|
||||||
const void *data,
|
const void *data,
|
||||||
unsigned int data_length)
|
unsigned int data_length)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (ctx == (TCHmacState_t) 0) {
|
if (ctx == (TCHmacState_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
(void)tc_sha256_update(&ctx->hash_state, data, data_length);
|
(void)tc_sha256_update(&ctx->hash_state, data, data_length);
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_hmac_final(uint8_t *tag, unsigned int taglen, TCHmacState_t ctx)
|
int tc_hmac_final(uint8_t *tag, unsigned int taglen, TCHmacState_t ctx)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (tag == (uint8_t *) 0 ||
|
if (tag == (uint8_t *) 0 ||
|
||||||
taglen != TC_SHA256_DIGEST_SIZE ||
|
taglen != TC_SHA256_DIGEST_SIZE ||
|
||||||
ctx == (TCHmacState_t) 0) {
|
ctx == (TCHmacState_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
(void) tc_sha256_final(tag, &ctx->hash_state);
|
(void) tc_sha256_final(tag, &ctx->hash_state);
|
||||||
|
|
||||||
(void)tc_sha256_init(&ctx->hash_state);
|
(void)tc_sha256_init(&ctx->hash_state);
|
||||||
(void)tc_sha256_update(&ctx->hash_state,
|
(void)tc_sha256_update(&ctx->hash_state,
|
||||||
&ctx->key[TC_SHA256_BLOCK_SIZE],
|
&ctx->key[TC_SHA256_BLOCK_SIZE],
|
||||||
TC_SHA256_BLOCK_SIZE);
|
TC_SHA256_BLOCK_SIZE);
|
||||||
(void)tc_sha256_update(&ctx->hash_state, tag, TC_SHA256_DIGEST_SIZE);
|
(void)tc_sha256_update(&ctx->hash_state, tag, TC_SHA256_DIGEST_SIZE);
|
||||||
(void)tc_sha256_final(tag, &ctx->hash_state);
|
(void)tc_sha256_final(tag, &ctx->hash_state);
|
||||||
|
|
||||||
/* destroy the current state */
|
/* destroy the current state */
|
||||||
_set(ctx, 0, sizeof(*ctx));
|
_set(ctx, 0, sizeof(*ctx));
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -77,154 +77,158 @@ static const unsigned int MAX_OUT = (1 << 19);
|
||||||
*/
|
*/
|
||||||
static void update(TCHmacPrng_t prng, const uint8_t *data, unsigned int datalen, const uint8_t *additional_data, unsigned int additional_datalen)
|
static void update(TCHmacPrng_t prng, const uint8_t *data, unsigned int datalen, const uint8_t *additional_data, unsigned int additional_datalen)
|
||||||
{
|
{
|
||||||
const uint8_t separator0 = 0x00;
|
const uint8_t separator0 = 0x00;
|
||||||
const uint8_t separator1 = 0x01;
|
const uint8_t separator1 = 0x01;
|
||||||
|
|
||||||
/* configure the new prng key into the prng's instance of hmac */
|
/* configure the new prng key into the prng's instance of hmac */
|
||||||
tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
||||||
|
|
||||||
/* use current state, e and separator 0 to compute a new prng key: */
|
/* use current state, e and separator 0 to compute a new prng key: */
|
||||||
(void)tc_hmac_init(&prng->h);
|
(void)tc_hmac_init(&prng->h);
|
||||||
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
||||||
(void)tc_hmac_update(&prng->h, &separator0, sizeof(separator0));
|
(void)tc_hmac_update(&prng->h, &separator0, sizeof(separator0));
|
||||||
|
|
||||||
if (data && datalen)
|
if (data && datalen) {
|
||||||
(void)tc_hmac_update(&prng->h, data, datalen);
|
(void)tc_hmac_update(&prng->h, data, datalen);
|
||||||
if (additional_data && additional_datalen)
|
}
|
||||||
(void)tc_hmac_update(&prng->h, additional_data, additional_datalen);
|
if (additional_data && additional_datalen) {
|
||||||
|
(void)tc_hmac_update(&prng->h, additional_data, additional_datalen);
|
||||||
|
}
|
||||||
|
|
||||||
(void)tc_hmac_final(prng->key, sizeof(prng->key), &prng->h);
|
(void)tc_hmac_final(prng->key, sizeof(prng->key), &prng->h);
|
||||||
|
|
||||||
/* configure the new prng key into the prng's instance of hmac */
|
/* configure the new prng key into the prng's instance of hmac */
|
||||||
(void)tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
(void)tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
||||||
|
|
||||||
/* use the new key to compute a new state variable v */
|
/* use the new key to compute a new state variable v */
|
||||||
(void)tc_hmac_init(&prng->h);
|
(void)tc_hmac_init(&prng->h);
|
||||||
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
||||||
(void)tc_hmac_final(prng->v, sizeof(prng->v), &prng->h);
|
(void)tc_hmac_final(prng->v, sizeof(prng->v), &prng->h);
|
||||||
|
|
||||||
if (data == 0 || datalen == 0)
|
if (data == 0 || datalen == 0) {
|
||||||
return;
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
/* configure the new prng key into the prng's instance of hmac */
|
/* configure the new prng key into the prng's instance of hmac */
|
||||||
tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
||||||
|
|
||||||
/* use current state, e and separator 1 to compute a new prng key: */
|
/* use current state, e and separator 1 to compute a new prng key: */
|
||||||
(void)tc_hmac_init(&prng->h);
|
(void)tc_hmac_init(&prng->h);
|
||||||
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
||||||
(void)tc_hmac_update(&prng->h, &separator1, sizeof(separator1));
|
(void)tc_hmac_update(&prng->h, &separator1, sizeof(separator1));
|
||||||
(void)tc_hmac_update(&prng->h, data, datalen);
|
(void)tc_hmac_update(&prng->h, data, datalen);
|
||||||
if (additional_data && additional_datalen)
|
if (additional_data && additional_datalen) {
|
||||||
(void)tc_hmac_update(&prng->h, additional_data, additional_datalen);
|
(void)tc_hmac_update(&prng->h, additional_data, additional_datalen);
|
||||||
(void)tc_hmac_final(prng->key, sizeof(prng->key), &prng->h);
|
}
|
||||||
|
(void)tc_hmac_final(prng->key, sizeof(prng->key), &prng->h);
|
||||||
|
|
||||||
/* configure the new prng key into the prng's instance of hmac */
|
/* configure the new prng key into the prng's instance of hmac */
|
||||||
(void)tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
(void)tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
||||||
|
|
||||||
/* use the new key to compute a new state variable v */
|
/* use the new key to compute a new state variable v */
|
||||||
(void)tc_hmac_init(&prng->h);
|
(void)tc_hmac_init(&prng->h);
|
||||||
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
||||||
(void)tc_hmac_final(prng->v, sizeof(prng->v), &prng->h);
|
(void)tc_hmac_final(prng->v, sizeof(prng->v), &prng->h);
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_hmac_prng_init(TCHmacPrng_t prng,
|
int tc_hmac_prng_init(TCHmacPrng_t prng,
|
||||||
const uint8_t *personalization,
|
const uint8_t *personalization,
|
||||||
unsigned int plen)
|
unsigned int plen)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (prng == (TCHmacPrng_t) 0 ||
|
if (prng == (TCHmacPrng_t) 0 ||
|
||||||
personalization == (uint8_t *) 0 ||
|
personalization == (uint8_t *) 0 ||
|
||||||
plen > MAX_PLEN) {
|
plen > MAX_PLEN) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* put the generator into a known state: */
|
/* put the generator into a known state: */
|
||||||
_set(prng->key, 0x00, sizeof(prng->key));
|
_set(prng->key, 0x00, sizeof(prng->key));
|
||||||
_set(prng->v, 0x01, sizeof(prng->v));
|
_set(prng->v, 0x01, sizeof(prng->v));
|
||||||
|
|
||||||
update(prng, personalization, plen, 0, 0);
|
update(prng, personalization, plen, 0, 0);
|
||||||
|
|
||||||
/* force a reseed before allowing tc_hmac_prng_generate to succeed: */
|
/* force a reseed before allowing tc_hmac_prng_generate to succeed: */
|
||||||
prng->countdown = 0;
|
prng->countdown = 0;
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_hmac_prng_reseed(TCHmacPrng_t prng,
|
int tc_hmac_prng_reseed(TCHmacPrng_t prng,
|
||||||
const uint8_t *seed,
|
const uint8_t *seed,
|
||||||
unsigned int seedlen,
|
unsigned int seedlen,
|
||||||
const uint8_t *additional_input,
|
const uint8_t *additional_input,
|
||||||
unsigned int additionallen)
|
unsigned int additionallen)
|
||||||
{
|
{
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (prng == (TCHmacPrng_t) 0 ||
|
if (prng == (TCHmacPrng_t) 0 ||
|
||||||
seed == (const uint8_t *) 0 ||
|
seed == (const uint8_t *) 0 ||
|
||||||
seedlen < MIN_SLEN ||
|
seedlen < MIN_SLEN ||
|
||||||
seedlen > MAX_SLEN) {
|
seedlen > MAX_SLEN) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (additional_input != (const uint8_t *) 0) {
|
if (additional_input != (const uint8_t *) 0) {
|
||||||
/*
|
/*
|
||||||
* Abort if additional_input is provided but has inappropriate
|
* Abort if additional_input is provided but has inappropriate
|
||||||
* length
|
* length
|
||||||
*/
|
*/
|
||||||
if (additionallen == 0 ||
|
if (additionallen == 0 ||
|
||||||
additionallen > MAX_ALEN) {
|
additionallen > MAX_ALEN) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else {
|
} else {
|
||||||
/* call update for the seed and additional_input */
|
/* call update for the seed and additional_input */
|
||||||
update(prng, seed, seedlen, additional_input, additionallen);
|
update(prng, seed, seedlen, additional_input, additionallen);
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
/* call update only for the seed */
|
/* call update only for the seed */
|
||||||
update(prng, seed, seedlen, 0, 0);
|
update(prng, seed, seedlen, 0, 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* ... and enable hmac_prng_generate */
|
/* ... and enable hmac_prng_generate */
|
||||||
prng->countdown = MAX_GENS;
|
prng->countdown = MAX_GENS;
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_hmac_prng_generate(uint8_t *out, unsigned int outlen, TCHmacPrng_t prng)
|
int tc_hmac_prng_generate(uint8_t *out, unsigned int outlen, TCHmacPrng_t prng)
|
||||||
{
|
{
|
||||||
unsigned int bufferlen;
|
unsigned int bufferlen;
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (out == (uint8_t *) 0 ||
|
if (out == (uint8_t *) 0 ||
|
||||||
prng == (TCHmacPrng_t) 0 ||
|
prng == (TCHmacPrng_t) 0 ||
|
||||||
outlen == 0 ||
|
outlen == 0 ||
|
||||||
outlen > MAX_OUT) {
|
outlen > MAX_OUT) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (prng->countdown == 0) {
|
} else if (prng->countdown == 0) {
|
||||||
return TC_HMAC_PRNG_RESEED_REQ;
|
return TC_HMAC_PRNG_RESEED_REQ;
|
||||||
}
|
}
|
||||||
|
|
||||||
prng->countdown--;
|
prng->countdown--;
|
||||||
|
|
||||||
while (outlen != 0) {
|
while (outlen != 0) {
|
||||||
/* configure the new prng key into the prng's instance of hmac */
|
/* configure the new prng key into the prng's instance of hmac */
|
||||||
tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
tc_hmac_set_key(&prng->h, prng->key, sizeof(prng->key));
|
||||||
|
|
||||||
/* operate HMAC in OFB mode to create "random" outputs */
|
/* operate HMAC in OFB mode to create "random" outputs */
|
||||||
(void)tc_hmac_init(&prng->h);
|
(void)tc_hmac_init(&prng->h);
|
||||||
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
(void)tc_hmac_update(&prng->h, prng->v, sizeof(prng->v));
|
||||||
(void)tc_hmac_final(prng->v, sizeof(prng->v), &prng->h);
|
(void)tc_hmac_final(prng->v, sizeof(prng->v), &prng->h);
|
||||||
|
|
||||||
bufferlen = (TC_SHA256_DIGEST_SIZE > outlen) ?
|
bufferlen = (TC_SHA256_DIGEST_SIZE > outlen) ?
|
||||||
outlen : TC_SHA256_DIGEST_SIZE;
|
outlen : TC_SHA256_DIGEST_SIZE;
|
||||||
(void)_copy(out, bufferlen, prng->v, bufferlen);
|
(void)_copy(out, bufferlen, prng->v, bufferlen);
|
||||||
|
|
||||||
out += bufferlen;
|
out += bufferlen;
|
||||||
outlen = (outlen > TC_SHA256_DIGEST_SIZE) ?
|
outlen = (outlen > TC_SHA256_DIGEST_SIZE) ?
|
||||||
(outlen - TC_SHA256_DIGEST_SIZE) : 0;
|
(outlen - TC_SHA256_DIGEST_SIZE) : 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* block future PRNG compromises from revealing past state */
|
/* block future PRNG compromises from revealing past state */
|
||||||
update(prng, 0, 0, 0, 0);
|
update(prng, 0, 0, 0, 0);
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -38,101 +38,101 @@ static void compress(unsigned int *iv, const uint8_t *data);
|
||||||
|
|
||||||
int tc_sha256_init(TCSha256State_t s)
|
int tc_sha256_init(TCSha256State_t s)
|
||||||
{
|
{
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (s == (TCSha256State_t) 0) {
|
if (s == (TCSha256State_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Setting the initial state values.
|
* Setting the initial state values.
|
||||||
* These values correspond to the first 32 bits of the fractional parts
|
* These values correspond to the first 32 bits of the fractional parts
|
||||||
* of the square roots of the first 8 primes: 2, 3, 5, 7, 11, 13, 17
|
* of the square roots of the first 8 primes: 2, 3, 5, 7, 11, 13, 17
|
||||||
* and 19.
|
* and 19.
|
||||||
*/
|
*/
|
||||||
_set((uint8_t *) s, 0x00, sizeof(*s));
|
_set((uint8_t *) s, 0x00, sizeof(*s));
|
||||||
s->iv[0] = 0x6a09e667;
|
s->iv[0] = 0x6a09e667;
|
||||||
s->iv[1] = 0xbb67ae85;
|
s->iv[1] = 0xbb67ae85;
|
||||||
s->iv[2] = 0x3c6ef372;
|
s->iv[2] = 0x3c6ef372;
|
||||||
s->iv[3] = 0xa54ff53a;
|
s->iv[3] = 0xa54ff53a;
|
||||||
s->iv[4] = 0x510e527f;
|
s->iv[4] = 0x510e527f;
|
||||||
s->iv[5] = 0x9b05688c;
|
s->iv[5] = 0x9b05688c;
|
||||||
s->iv[6] = 0x1f83d9ab;
|
s->iv[6] = 0x1f83d9ab;
|
||||||
s->iv[7] = 0x5be0cd19;
|
s->iv[7] = 0x5be0cd19;
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_sha256_update(TCSha256State_t s, const uint8_t *data, size_t datalen)
|
int tc_sha256_update(TCSha256State_t s, const uint8_t *data, size_t datalen)
|
||||||
{
|
{
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (s == (TCSha256State_t) 0 ||
|
if (s == (TCSha256State_t) 0 ||
|
||||||
data == (void *) 0) {
|
data == (void *) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
} else if (datalen == 0) {
|
} else if (datalen == 0) {
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
while (datalen-- > 0) {
|
while (datalen-- > 0) {
|
||||||
s->leftover[s->leftover_offset++] = *(data++);
|
s->leftover[s->leftover_offset++] = *(data++);
|
||||||
if (s->leftover_offset >= TC_SHA256_BLOCK_SIZE) {
|
if (s->leftover_offset >= TC_SHA256_BLOCK_SIZE) {
|
||||||
compress(s->iv, s->leftover);
|
compress(s->iv, s->leftover);
|
||||||
s->leftover_offset = 0;
|
s->leftover_offset = 0;
|
||||||
s->bits_hashed += (TC_SHA256_BLOCK_SIZE << 3);
|
s->bits_hashed += (TC_SHA256_BLOCK_SIZE << 3);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tc_sha256_final(uint8_t *digest, TCSha256State_t s)
|
int tc_sha256_final(uint8_t *digest, TCSha256State_t s)
|
||||||
{
|
{
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
/* input sanity check: */
|
/* input sanity check: */
|
||||||
if (digest == (uint8_t *) 0 ||
|
if (digest == (uint8_t *) 0 ||
|
||||||
s == (TCSha256State_t) 0) {
|
s == (TCSha256State_t) 0) {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
|
|
||||||
s->bits_hashed += (s->leftover_offset << 3);
|
s->bits_hashed += (s->leftover_offset << 3);
|
||||||
|
|
||||||
s->leftover[s->leftover_offset++] = 0x80; /* always room for one byte */
|
s->leftover[s->leftover_offset++] = 0x80; /* always room for one byte */
|
||||||
if (s->leftover_offset > (sizeof(s->leftover) - 8)) {
|
if (s->leftover_offset > (sizeof(s->leftover) - 8)) {
|
||||||
/* there is not room for all the padding in this block */
|
/* there is not room for all the padding in this block */
|
||||||
_set(s->leftover + s->leftover_offset, 0x00,
|
_set(s->leftover + s->leftover_offset, 0x00,
|
||||||
sizeof(s->leftover) - s->leftover_offset);
|
sizeof(s->leftover) - s->leftover_offset);
|
||||||
compress(s->iv, s->leftover);
|
compress(s->iv, s->leftover);
|
||||||
s->leftover_offset = 0;
|
s->leftover_offset = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* add the padding and the length in big-Endian format */
|
/* add the padding and the length in big-Endian format */
|
||||||
_set(s->leftover + s->leftover_offset, 0x00,
|
_set(s->leftover + s->leftover_offset, 0x00,
|
||||||
sizeof(s->leftover) - 8 - s->leftover_offset);
|
sizeof(s->leftover) - 8 - s->leftover_offset);
|
||||||
s->leftover[sizeof(s->leftover) - 1] = (uint8_t)(s->bits_hashed);
|
s->leftover[sizeof(s->leftover) - 1] = (uint8_t)(s->bits_hashed);
|
||||||
s->leftover[sizeof(s->leftover) - 2] = (uint8_t)(s->bits_hashed >> 8);
|
s->leftover[sizeof(s->leftover) - 2] = (uint8_t)(s->bits_hashed >> 8);
|
||||||
s->leftover[sizeof(s->leftover) - 3] = (uint8_t)(s->bits_hashed >> 16);
|
s->leftover[sizeof(s->leftover) - 3] = (uint8_t)(s->bits_hashed >> 16);
|
||||||
s->leftover[sizeof(s->leftover) - 4] = (uint8_t)(s->bits_hashed >> 24);
|
s->leftover[sizeof(s->leftover) - 4] = (uint8_t)(s->bits_hashed >> 24);
|
||||||
s->leftover[sizeof(s->leftover) - 5] = (uint8_t)(s->bits_hashed >> 32);
|
s->leftover[sizeof(s->leftover) - 5] = (uint8_t)(s->bits_hashed >> 32);
|
||||||
s->leftover[sizeof(s->leftover) - 6] = (uint8_t)(s->bits_hashed >> 40);
|
s->leftover[sizeof(s->leftover) - 6] = (uint8_t)(s->bits_hashed >> 40);
|
||||||
s->leftover[sizeof(s->leftover) - 7] = (uint8_t)(s->bits_hashed >> 48);
|
s->leftover[sizeof(s->leftover) - 7] = (uint8_t)(s->bits_hashed >> 48);
|
||||||
s->leftover[sizeof(s->leftover) - 8] = (uint8_t)(s->bits_hashed >> 56);
|
s->leftover[sizeof(s->leftover) - 8] = (uint8_t)(s->bits_hashed >> 56);
|
||||||
|
|
||||||
/* hash the padding and length */
|
/* hash the padding and length */
|
||||||
compress(s->iv, s->leftover);
|
compress(s->iv, s->leftover);
|
||||||
|
|
||||||
/* copy the iv out to digest */
|
/* copy the iv out to digest */
|
||||||
for (i = 0; i < TC_SHA256_STATE_BLOCKS; ++i) {
|
for (i = 0; i < TC_SHA256_STATE_BLOCKS; ++i) {
|
||||||
unsigned int t = *((unsigned int *) &s->iv[i]);
|
unsigned int t = *((unsigned int *) &s->iv[i]);
|
||||||
*digest++ = (uint8_t)(t >> 24);
|
*digest++ = (uint8_t)(t >> 24);
|
||||||
*digest++ = (uint8_t)(t >> 16);
|
*digest++ = (uint8_t)(t >> 16);
|
||||||
*digest++ = (uint8_t)(t >> 8);
|
*digest++ = (uint8_t)(t >> 8);
|
||||||
*digest++ = (uint8_t)(t);
|
*digest++ = (uint8_t)(t);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* destroy the current state */
|
/* destroy the current state */
|
||||||
_set(s, 0, sizeof(*s));
|
_set(s, 0, sizeof(*s));
|
||||||
|
|
||||||
return TC_CRYPTO_SUCCESS;
|
return TC_CRYPTO_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
@ -141,22 +141,22 @@ int tc_sha256_final(uint8_t *digest, TCSha256State_t s)
|
||||||
* cube roots of the first 64 primes between 2 and 311.
|
* cube roots of the first 64 primes between 2 and 311.
|
||||||
*/
|
*/
|
||||||
static const unsigned int k256[64] = {
|
static const unsigned int k256[64] = {
|
||||||
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
|
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
|
||||||
0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
|
0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
|
||||||
0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
|
0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
|
||||||
0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
|
0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
|
||||||
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
|
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
|
||||||
0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
|
0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
|
||||||
0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
|
0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
|
||||||
0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
|
0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
|
||||||
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
|
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
|
||||||
0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
|
0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
|
||||||
0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
|
0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
|
||||||
};
|
};
|
||||||
|
|
||||||
static inline unsigned int ROTR(unsigned int a, unsigned int n)
|
static inline unsigned int ROTR(unsigned int a, unsigned int n)
|
||||||
{
|
{
|
||||||
return (((a) >> n) | ((a) << (32 - n)));
|
return (((a) >> n) | ((a) << (32 - n)));
|
||||||
}
|
}
|
||||||
|
|
||||||
#define Sigma0(a)(ROTR((a), 2) ^ ROTR((a), 13) ^ ROTR((a), 22))
|
#define Sigma0(a)(ROTR((a), 2) ^ ROTR((a), 13) ^ ROTR((a), 22))
|
||||||
|
|
@ -169,49 +169,49 @@ static inline unsigned int ROTR(unsigned int a, unsigned int n)
|
||||||
|
|
||||||
static inline unsigned int BigEndian(const uint8_t **c)
|
static inline unsigned int BigEndian(const uint8_t **c)
|
||||||
{
|
{
|
||||||
unsigned int n = 0;
|
unsigned int n = 0;
|
||||||
|
|
||||||
n = (((unsigned int)(*((*c)++))) << 24);
|
n = (((unsigned int)(*((*c)++))) << 24);
|
||||||
n |= ((unsigned int)(*((*c)++)) << 16);
|
n |= ((unsigned int)(*((*c)++)) << 16);
|
||||||
n |= ((unsigned int)(*((*c)++)) << 8);
|
n |= ((unsigned int)(*((*c)++)) << 8);
|
||||||
n |= ((unsigned int)(*((*c)++)));
|
n |= ((unsigned int)(*((*c)++)));
|
||||||
return n;
|
return n;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void compress(unsigned int *iv, const uint8_t *data)
|
static void compress(unsigned int *iv, const uint8_t *data)
|
||||||
{
|
{
|
||||||
unsigned int a, b, c, d, e, f, g, h;
|
unsigned int a, b, c, d, e, f, g, h;
|
||||||
unsigned int s0, s1;
|
unsigned int s0, s1;
|
||||||
unsigned int t1, t2;
|
unsigned int t1, t2;
|
||||||
unsigned int work_space[16];
|
unsigned int work_space[16];
|
||||||
unsigned int n;
|
unsigned int n;
|
||||||
unsigned int i;
|
unsigned int i;
|
||||||
|
|
||||||
a = iv[0]; b = iv[1]; c = iv[2]; d = iv[3];
|
a = iv[0]; b = iv[1]; c = iv[2]; d = iv[3];
|
||||||
e = iv[4]; f = iv[5]; g = iv[6]; h = iv[7];
|
e = iv[4]; f = iv[5]; g = iv[6]; h = iv[7];
|
||||||
|
|
||||||
for (i = 0; i < 16; ++i) {
|
for (i = 0; i < 16; ++i) {
|
||||||
n = BigEndian(&data);
|
n = BigEndian(&data);
|
||||||
t1 = work_space[i] = n;
|
t1 = work_space[i] = n;
|
||||||
t1 += h + Sigma1(e) + Ch(e, f, g) + k256[i];
|
t1 += h + Sigma1(e) + Ch(e, f, g) + k256[i];
|
||||||
t2 = Sigma0(a) + Maj(a, b, c);
|
t2 = Sigma0(a) + Maj(a, b, c);
|
||||||
h = g; g = f; f = e; e = d + t1;
|
h = g; g = f; f = e; e = d + t1;
|
||||||
d = c; c = b; b = a; a = t1 + t2;
|
d = c; c = b; b = a; a = t1 + t2;
|
||||||
}
|
}
|
||||||
|
|
||||||
for ( ; i < 64; ++i) {
|
for ( ; i < 64; ++i) {
|
||||||
s0 = work_space[(i+1)&0x0f];
|
s0 = work_space[(i + 1) & 0x0f];
|
||||||
s0 = sigma0(s0);
|
s0 = sigma0(s0);
|
||||||
s1 = work_space[(i+14)&0x0f];
|
s1 = work_space[(i + 14) & 0x0f];
|
||||||
s1 = sigma1(s1);
|
s1 = sigma1(s1);
|
||||||
|
|
||||||
t1 = work_space[i&0xf] += s0 + s1 + work_space[(i+9)&0xf];
|
t1 = work_space[i & 0xf] += s0 + s1 + work_space[(i + 9) & 0xf];
|
||||||
t1 += h + Sigma1(e) + Ch(e, f, g) + k256[i];
|
t1 += h + Sigma1(e) + Ch(e, f, g) + k256[i];
|
||||||
t2 = Sigma0(a) + Maj(a, b, c);
|
t2 = Sigma0(a) + Maj(a, b, c);
|
||||||
h = g; g = f; f = e; e = d + t1;
|
h = g; g = f; f = e; e = d + t1;
|
||||||
d = c; c = b; b = a; a = t1 + t2;
|
d = c; c = b; b = a; a = t1 + t2;
|
||||||
}
|
}
|
||||||
|
|
||||||
iv[0] += a; iv[1] += b; iv[2] += c; iv[3] += d;
|
iv[0] += a; iv[1] += b; iv[2] += c; iv[3] += d;
|
||||||
iv[4] += e; iv[5] += f; iv[6] += g; iv[7] += h;
|
iv[4] += e; iv[5] += f; iv[6] += g; iv[7] += h;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -38,19 +38,19 @@
|
||||||
#define MASK_TWENTY_SEVEN 0x1b
|
#define MASK_TWENTY_SEVEN 0x1b
|
||||||
|
|
||||||
unsigned int _copy(uint8_t *to, unsigned int to_len,
|
unsigned int _copy(uint8_t *to, unsigned int to_len,
|
||||||
const uint8_t *from, unsigned int from_len)
|
const uint8_t *from, unsigned int from_len)
|
||||||
{
|
{
|
||||||
if (from_len <= to_len) {
|
if (from_len <= to_len) {
|
||||||
(void)memcpy(to, from, from_len);
|
(void)memcpy(to, from, from_len);
|
||||||
return from_len;
|
return from_len;
|
||||||
} else {
|
} else {
|
||||||
return TC_CRYPTO_FAIL;
|
return TC_CRYPTO_FAIL;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void _set(void *to, uint8_t val, unsigned int len)
|
void _set(void *to, uint8_t val, unsigned int len)
|
||||||
{
|
{
|
||||||
(void)memset(to, val, len);
|
(void)memset(to, val, len);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
@ -58,17 +58,17 @@ void _set(void *to, uint8_t val, unsigned int len)
|
||||||
*/
|
*/
|
||||||
uint8_t _double_byte(uint8_t a)
|
uint8_t _double_byte(uint8_t a)
|
||||||
{
|
{
|
||||||
return ((a<<1) ^ ((a>>7) * MASK_TWENTY_SEVEN));
|
return ((a << 1) ^ ((a >> 7) * MASK_TWENTY_SEVEN));
|
||||||
}
|
}
|
||||||
|
|
||||||
int _compare(const uint8_t *a, const uint8_t *b, size_t size)
|
int _compare(const uint8_t *a, const uint8_t *b, size_t size)
|
||||||
{
|
{
|
||||||
const uint8_t *tempa = a;
|
const uint8_t *tempa = a;
|
||||||
const uint8_t *tempb = b;
|
const uint8_t *tempb = b;
|
||||||
uint8_t result = 0;
|
uint8_t result = 0;
|
||||||
|
|
||||||
for (unsigned int i = 0; i < size; i++) {
|
for (unsigned int i = 0; i < size; i++) {
|
||||||
result |= tempa[i] ^ tempb[i];
|
result |= tempa[i] ^ tempb[i];
|
||||||
}
|
}
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue