4 Copyright (C) Stefan Metzmacher 2012
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "../lib/crypto/crypto.h"
22 #include "lib/util/byteorder.h"
24 #define M_ ((AES_CCM_128_M - 2) / 2)
25 #define L_ (AES_CCM_128_L - 1)
27 void aes_ccm_128_init(struct aes_ccm_128_context *ctx,
28 const uint8_t K[AES_BLOCK_SIZE],
29 const uint8_t N[AES_CCM_128_NONCE_SIZE],
30 size_t a_total, size_t m_total)
34 AES_set_encrypt_key(K, 128, &ctx->aes_key);
35 memcpy(ctx->nonce, N, AES_CCM_128_NONCE_SIZE);
36 ctx->a_remain = a_total;
37 ctx->m_remain = m_total;
43 ctx->B_i[0] += 8 * M_;
47 memcpy(&ctx->B_i[1], ctx->nonce, AES_CCM_128_NONCE_SIZE);
48 RSIVAL(ctx->B_i, (AES_BLOCK_SIZE - AES_CCM_128_L), m_total);
53 AES_encrypt(ctx->B_i, ctx->X_i, &ctx->aes_key);
58 ZERO_STRUCT(ctx->B_i);
59 if (a_total >= UINT32_MAX) {
60 RSSVAL(ctx->B_i, 0, 0xFFFF);
61 RSBVAL(ctx->B_i, 2, (uint64_t)a_total);
63 } else if (a_total >= 0xFF00) {
64 RSSVAL(ctx->B_i, 0, 0xFFFE);
65 RSIVAL(ctx->B_i, 2, a_total);
67 } else if (a_total > 0) {
68 RSSVAL(ctx->B_i, 0, a_total);
76 memcpy(&ctx->A_i[1], ctx->nonce, AES_CCM_128_NONCE_SIZE);
78 ctx->S_i_ofs = AES_BLOCK_SIZE;
81 void aes_ccm_128_update(struct aes_ccm_128_context *ctx,
82 const uint8_t *v, size_t v_len)
90 if (ctx->a_remain > 0) {
91 remain = &ctx->a_remain;
93 remain = &ctx->m_remain;
96 if (unlikely(v_len > *remain)) {
100 if (ctx->B_i_ofs > 0) {
101 size_t n = MIN(AES_BLOCK_SIZE - ctx->B_i_ofs, v_len);
103 memcpy(&ctx->B_i[ctx->B_i_ofs], v, n);
110 if ((ctx->B_i_ofs == AES_BLOCK_SIZE) || (*remain == 0)) {
111 aes_block_xor(ctx->X_i, ctx->B_i, ctx->B_i);
112 AES_encrypt(ctx->B_i, ctx->X_i, &ctx->aes_key);
116 while (v_len >= AES_BLOCK_SIZE) {
117 aes_block_xor(ctx->X_i, v, ctx->B_i);
118 AES_encrypt(ctx->B_i, ctx->X_i, &ctx->aes_key);
120 v_len -= AES_BLOCK_SIZE;
121 *remain -= AES_BLOCK_SIZE;
125 ZERO_STRUCT(ctx->B_i);
126 memcpy(ctx->B_i, v, v_len);
127 ctx->B_i_ofs += v_len;
137 if (ctx->B_i_ofs > 0) {
138 aes_block_xor(ctx->X_i, ctx->B_i, ctx->B_i);
139 AES_encrypt(ctx->B_i, ctx->X_i, &ctx->aes_key);
144 static inline void aes_ccm_128_S_i(struct aes_ccm_128_context *ctx,
145 uint8_t S_i[AES_BLOCK_SIZE],
148 RSIVAL(ctx->A_i, (AES_BLOCK_SIZE - AES_CCM_128_L), i);
149 AES_encrypt(ctx->A_i, S_i, &ctx->aes_key);
152 void aes_ccm_128_crypt(struct aes_ccm_128_context *ctx,
153 uint8_t *m, size_t m_len)
156 if (ctx->S_i_ofs == AES_BLOCK_SIZE) {
158 aes_ccm_128_S_i(ctx, ctx->S_i, ctx->S_i_ctr);
162 if (likely(ctx->S_i_ofs == 0 && m_len >= AES_BLOCK_SIZE)) {
163 aes_block_xor(m, ctx->S_i, m);
165 m_len -= AES_BLOCK_SIZE;
167 aes_ccm_128_S_i(ctx, ctx->S_i, ctx->S_i_ctr);
171 m[0] ^= ctx->S_i[ctx->S_i_ofs];
178 void aes_ccm_128_digest(struct aes_ccm_128_context *ctx,
179 uint8_t digest[AES_BLOCK_SIZE])
181 if (unlikely(ctx->a_remain != 0)) {
184 if (unlikely(ctx->m_remain != 0)) {
189 aes_ccm_128_S_i(ctx, ctx->S_i, 0);
194 aes_block_xor(ctx->X_i, ctx->S_i, digest);