cmac.c 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080
  1. /**
  2. * \file cmac.c
  3. *
  4. * \brief NIST SP800-38B compliant CMAC implementation for AES and 3DES
  5. *
  6. * Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
  7. * SPDX-License-Identifier: Apache-2.0
  8. *
  9. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  10. * not use this file except in compliance with the License.
  11. * You may obtain a copy of the License at
  12. *
  13. * http://www.apache.org/licenses/LICENSE-2.0
  14. *
  15. * Unless required by applicable law or agreed to in writing, software
  16. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  17. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18. * See the License for the specific language governing permissions and
  19. * limitations under the License.
  20. *
  21. * This file is part of mbed TLS (https://tls.mbed.org)
  22. */
  23. /*
  24. * References:
  25. *
  26. * - NIST SP 800-38B Recommendation for Block Cipher Modes of Operation: The
  27. * CMAC Mode for Authentication
  28. * http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf
  29. *
  30. * - RFC 4493 - The AES-CMAC Algorithm
  31. * https://tools.ietf.org/html/rfc4493
  32. *
  33. * - RFC 4615 - The Advanced Encryption Standard-Cipher-based Message
  34. * Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128)
  35. * Algorithm for the Internet Key Exchange Protocol (IKE)
  36. * https://tools.ietf.org/html/rfc4615
  37. *
  38. * Additional test vectors: ISO/IEC 9797-1
  39. *
  40. */
  41. #if !defined(MBEDTLS_CONFIG_FILE)
  42. #include "mbedtls/config.h"
  43. #else
  44. #include MBEDTLS_CONFIG_FILE
  45. #endif
  46. #if defined(MBEDTLS_CMAC_C)
  47. #include "mbedtls/cmac.h"
  48. #include <string.h>
  49. #if defined(MBEDTLS_PLATFORM_C)
  50. #include "mbedtls/platform.h"
  51. #else
  52. #include <stdlib.h>
  53. #define mbedtls_calloc calloc
  54. #define mbedtls_free free
  55. #if defined(MBEDTLS_SELF_TEST)
  56. #include <stdio.h>
  57. #define mbedtls_printf printf
  58. #endif /* MBEDTLS_SELF_TEST */
  59. #endif /* MBEDTLS_PLATFORM_C */
  60. #if !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST)
  61. /* Implementation that should never be optimized out by the compiler */
  62. static void mbedtls_zeroize( void *v, size_t n ) {
  63. volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
  64. }
  65. /*
  66. * Multiplication by u in the Galois field of GF(2^n)
  67. *
  68. * As explained in NIST SP 800-38B, this can be computed:
  69. *
  70. * If MSB(p) = 0, then p = (p << 1)
  71. * If MSB(p) = 1, then p = (p << 1) ^ R_n
  72. * with R_64 = 0x1B and R_128 = 0x87
  73. *
  74. * Input and output MUST NOT point to the same buffer
  75. * Block size must be 8 bytes or 16 bytes - the block sizes for DES and AES.
  76. */
  77. static int cmac_multiply_by_u( unsigned char *output,
  78. const unsigned char *input,
  79. size_t blocksize )
  80. {
  81. const unsigned char R_128 = 0x87;
  82. const unsigned char R_64 = 0x1B;
  83. unsigned char R_n, mask;
  84. unsigned char overflow = 0x00;
  85. int i;
  86. if( blocksize == MBEDTLS_AES_BLOCK_SIZE )
  87. {
  88. R_n = R_128;
  89. }
  90. else if( blocksize == MBEDTLS_DES3_BLOCK_SIZE )
  91. {
  92. R_n = R_64;
  93. }
  94. else
  95. {
  96. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  97. }
  98. for( i = (int)blocksize - 1; i >= 0; i-- )
  99. {
  100. output[i] = input[i] << 1 | overflow;
  101. overflow = input[i] >> 7;
  102. }
  103. /* mask = ( input[0] >> 7 ) ? 0xff : 0x00
  104. * using bit operations to avoid branches */
  105. /* MSVC has a warning about unary minus on unsigned, but this is
  106. * well-defined and precisely what we want to do here */
  107. #if defined(_MSC_VER)
  108. #pragma warning( push )
  109. #pragma warning( disable : 4146 )
  110. #endif
  111. mask = - ( input[0] >> 7 );
  112. #if defined(_MSC_VER)
  113. #pragma warning( pop )
  114. #endif
  115. output[ blocksize - 1 ] ^= R_n & mask;
  116. return( 0 );
  117. }
  118. /*
  119. * Generate subkeys
  120. *
  121. * - as specified by RFC 4493, section 2.3 Subkey Generation Algorithm
  122. */
  123. static int cmac_generate_subkeys( mbedtls_cipher_context_t *ctx,
  124. unsigned char* K1, unsigned char* K2 )
  125. {
  126. int ret;
  127. unsigned char L[MBEDTLS_CIPHER_BLKSIZE_MAX];
  128. size_t olen, block_size;
  129. mbedtls_zeroize( L, sizeof( L ) );
  130. block_size = ctx->cipher_info->block_size;
  131. /* Calculate Ek(0) */
  132. if( ( ret = mbedtls_cipher_update( ctx, L, block_size, L, &olen ) ) != 0 )
  133. goto exit;
  134. /*
  135. * Generate K1 and K2
  136. */
  137. if( ( ret = cmac_multiply_by_u( K1, L , block_size ) ) != 0 )
  138. goto exit;
  139. if( ( ret = cmac_multiply_by_u( K2, K1 , block_size ) ) != 0 )
  140. goto exit;
  141. exit:
  142. mbedtls_zeroize( L, sizeof( L ) );
  143. return( ret );
  144. }
  145. #endif /* !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST) */
  146. #if !defined(MBEDTLS_CMAC_ALT)
  147. static void cmac_xor_block( unsigned char *output, const unsigned char *input1,
  148. const unsigned char *input2,
  149. const size_t block_size )
  150. {
  151. size_t idx;
  152. for( idx = 0; idx < block_size; idx++ )
  153. output[ idx ] = input1[ idx ] ^ input2[ idx ];
  154. }
  155. /*
  156. * Create padded last block from (partial) last block.
  157. *
  158. * We can't use the padding option from the cipher layer, as it only works for
  159. * CBC and we use ECB mode, and anyway we need to XOR K1 or K2 in addition.
  160. */
  161. static void cmac_pad( unsigned char padded_block[MBEDTLS_CIPHER_BLKSIZE_MAX],
  162. size_t padded_block_len,
  163. const unsigned char *last_block,
  164. size_t last_block_len )
  165. {
  166. size_t j;
  167. for( j = 0; j < padded_block_len; j++ )
  168. {
  169. if( j < last_block_len )
  170. padded_block[j] = last_block[j];
  171. else if( j == last_block_len )
  172. padded_block[j] = 0x80;
  173. else
  174. padded_block[j] = 0x00;
  175. }
  176. }
  177. int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx,
  178. const unsigned char *key, size_t keybits )
  179. {
  180. mbedtls_cipher_type_t type;
  181. mbedtls_cmac_context_t *cmac_ctx;
  182. int retval;
  183. if( ctx == NULL || ctx->cipher_info == NULL || key == NULL )
  184. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  185. if( ( retval = mbedtls_cipher_setkey( ctx, key, (int)keybits,
  186. MBEDTLS_ENCRYPT ) ) != 0 )
  187. return( retval );
  188. type = ctx->cipher_info->type;
  189. switch( type )
  190. {
  191. case MBEDTLS_CIPHER_AES_128_ECB:
  192. case MBEDTLS_CIPHER_AES_192_ECB:
  193. case MBEDTLS_CIPHER_AES_256_ECB:
  194. case MBEDTLS_CIPHER_DES_EDE3_ECB:
  195. break;
  196. default:
  197. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  198. }
  199. /* Allocated and initialise in the cipher context memory for the CMAC
  200. * context */
  201. cmac_ctx = mbedtls_calloc( 1, sizeof( mbedtls_cmac_context_t ) );
  202. if( cmac_ctx == NULL )
  203. return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
  204. ctx->cmac_ctx = cmac_ctx;
  205. mbedtls_zeroize( cmac_ctx->state, sizeof( cmac_ctx->state ) );
  206. return 0;
  207. }
  208. int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx,
  209. const unsigned char *input, size_t ilen )
  210. {
  211. mbedtls_cmac_context_t* cmac_ctx;
  212. unsigned char *state;
  213. int ret = 0;
  214. size_t n, j, olen, block_size;
  215. if( ctx == NULL || ctx->cipher_info == NULL || input == NULL ||
  216. ctx->cmac_ctx == NULL )
  217. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  218. cmac_ctx = ctx->cmac_ctx;
  219. block_size = ctx->cipher_info->block_size;
  220. state = ctx->cmac_ctx->state;
  221. /* Is there data still to process from the last call, that's greater in
  222. * size than a block? */
  223. if( cmac_ctx->unprocessed_len > 0 &&
  224. ilen > block_size - cmac_ctx->unprocessed_len )
  225. {
  226. memcpy( &cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
  227. input,
  228. block_size - cmac_ctx->unprocessed_len );
  229. cmac_xor_block( state, cmac_ctx->unprocessed_block, state, block_size );
  230. if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
  231. &olen ) ) != 0 )
  232. {
  233. goto exit;
  234. }
  235. input += block_size - cmac_ctx->unprocessed_len;
  236. ilen -= block_size - cmac_ctx->unprocessed_len;
  237. cmac_ctx->unprocessed_len = 0;
  238. }
  239. /* n is the number of blocks including any final partial block */
  240. n = ( ilen + block_size - 1 ) / block_size;
  241. /* Iterate across the input data in block sized chunks, excluding any
  242. * final partial or complete block */
  243. for( j = 1; j < n; j++ )
  244. {
  245. cmac_xor_block( state, input, state, block_size );
  246. if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
  247. &olen ) ) != 0 )
  248. goto exit;
  249. ilen -= block_size;
  250. input += block_size;
  251. }
  252. /* If there is data left over that wasn't aligned to a block */
  253. if( ilen > 0 )
  254. {
  255. memcpy( &cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
  256. input,
  257. ilen );
  258. cmac_ctx->unprocessed_len += ilen;
  259. }
  260. exit:
  261. return( ret );
  262. }
  263. int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx,
  264. unsigned char *output )
  265. {
  266. mbedtls_cmac_context_t* cmac_ctx;
  267. unsigned char *state, *last_block;
  268. unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
  269. unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
  270. unsigned char M_last[MBEDTLS_CIPHER_BLKSIZE_MAX];
  271. int ret;
  272. size_t olen, block_size;
  273. if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL ||
  274. output == NULL )
  275. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  276. cmac_ctx = ctx->cmac_ctx;
  277. block_size = ctx->cipher_info->block_size;
  278. state = cmac_ctx->state;
  279. mbedtls_zeroize( K1, sizeof( K1 ) );
  280. mbedtls_zeroize( K2, sizeof( K2 ) );
  281. cmac_generate_subkeys( ctx, K1, K2 );
  282. last_block = cmac_ctx->unprocessed_block;
  283. /* Calculate last block */
  284. if( cmac_ctx->unprocessed_len < block_size )
  285. {
  286. cmac_pad( M_last, block_size, last_block, cmac_ctx->unprocessed_len );
  287. cmac_xor_block( M_last, M_last, K2, block_size );
  288. }
  289. else
  290. {
  291. /* Last block is complete block */
  292. cmac_xor_block( M_last, last_block, K1, block_size );
  293. }
  294. cmac_xor_block( state, M_last, state, block_size );
  295. if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
  296. &olen ) ) != 0 )
  297. {
  298. goto exit;
  299. }
  300. memcpy( output, state, block_size );
  301. exit:
  302. /* Wipe the generated keys on the stack, and any other transients to avoid
  303. * side channel leakage */
  304. mbedtls_zeroize( K1, sizeof( K1 ) );
  305. mbedtls_zeroize( K2, sizeof( K2 ) );
  306. cmac_ctx->unprocessed_len = 0;
  307. mbedtls_zeroize( cmac_ctx->unprocessed_block,
  308. sizeof( cmac_ctx->unprocessed_block ) );
  309. mbedtls_zeroize( state, MBEDTLS_CIPHER_BLKSIZE_MAX );
  310. return( ret );
  311. }
  312. int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx )
  313. {
  314. mbedtls_cmac_context_t* cmac_ctx;
  315. if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL )
  316. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  317. cmac_ctx = ctx->cmac_ctx;
  318. /* Reset the internal state */
  319. cmac_ctx->unprocessed_len = 0;
  320. mbedtls_zeroize( cmac_ctx->unprocessed_block,
  321. sizeof( cmac_ctx->unprocessed_block ) );
  322. mbedtls_zeroize( cmac_ctx->state,
  323. sizeof( cmac_ctx->state ) );
  324. return( 0 );
  325. }
  326. int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info,
  327. const unsigned char *key, size_t keylen,
  328. const unsigned char *input, size_t ilen,
  329. unsigned char *output )
  330. {
  331. mbedtls_cipher_context_t ctx;
  332. int ret;
  333. if( cipher_info == NULL || key == NULL || input == NULL || output == NULL )
  334. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  335. mbedtls_cipher_init( &ctx );
  336. if( ( ret = mbedtls_cipher_setup( &ctx, cipher_info ) ) != 0 )
  337. goto exit;
  338. ret = mbedtls_cipher_cmac_starts( &ctx, key, keylen );
  339. if( ret != 0 )
  340. goto exit;
  341. ret = mbedtls_cipher_cmac_update( &ctx, input, ilen );
  342. if( ret != 0 )
  343. goto exit;
  344. ret = mbedtls_cipher_cmac_finish( &ctx, output );
  345. exit:
  346. mbedtls_cipher_free( &ctx );
  347. return( ret );
  348. }
  349. #if defined(MBEDTLS_AES_C)
  350. /*
  351. * Implementation of AES-CMAC-PRF-128 defined in RFC 4615
  352. */
  353. int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_length,
  354. const unsigned char *input, size_t in_len,
  355. unsigned char *output )
  356. {
  357. int ret;
  358. const mbedtls_cipher_info_t *cipher_info;
  359. unsigned char zero_key[MBEDTLS_AES_BLOCK_SIZE];
  360. unsigned char int_key[MBEDTLS_AES_BLOCK_SIZE];
  361. if( key == NULL || input == NULL || output == NULL )
  362. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  363. cipher_info = mbedtls_cipher_info_from_type( MBEDTLS_CIPHER_AES_128_ECB );
  364. if( cipher_info == NULL )
  365. {
  366. /* Failing at this point must be due to a build issue */
  367. ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
  368. goto exit;
  369. }
  370. if( key_length == MBEDTLS_AES_BLOCK_SIZE )
  371. {
  372. /* Use key as is */
  373. memcpy( int_key, key, MBEDTLS_AES_BLOCK_SIZE );
  374. }
  375. else
  376. {
  377. memset( zero_key, 0, MBEDTLS_AES_BLOCK_SIZE );
  378. ret = mbedtls_cipher_cmac( cipher_info, zero_key, 128, key,
  379. key_length, int_key );
  380. if( ret != 0 )
  381. goto exit;
  382. }
  383. ret = mbedtls_cipher_cmac( cipher_info, int_key, 128, input, in_len,
  384. output );
  385. exit:
  386. mbedtls_zeroize( int_key, sizeof( int_key ) );
  387. return( ret );
  388. }
  389. #endif /* MBEDTLS_AES_C */
  390. #endif /* !MBEDTLS_CMAC_ALT */
  391. #if defined(MBEDTLS_SELF_TEST)
  392. /*
  393. * CMAC test data for SP800-38B
  394. * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/AES_CMAC.pdf
  395. * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/TDES_CMAC.pdf
  396. *
  397. * AES-CMAC-PRF-128 test data from RFC 4615
  398. * https://tools.ietf.org/html/rfc4615#page-4
  399. */
  400. #define NB_CMAC_TESTS_PER_KEY 4
  401. #define NB_PRF_TESTS 3
  402. #if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C)
  403. /* All CMAC test inputs are truncated from the same 64 byte buffer. */
  404. static const unsigned char test_message[] = {
  405. /* PT */
  406. 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
  407. 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
  408. 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
  409. 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
  410. 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
  411. 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
  412. 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
  413. 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
  414. };
  415. #endif /* MBEDTLS_AES_C || MBEDTLS_DES_C */
  416. #if defined(MBEDTLS_AES_C)
  417. /* Truncation point of message for AES CMAC tests */
  418. static const unsigned int aes_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
  419. /* Mlen */
  420. 0,
  421. 16,
  422. 20,
  423. 64
  424. };
  425. /* CMAC-AES128 Test Data */
  426. static const unsigned char aes_128_key[16] = {
  427. 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
  428. 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
  429. };
  430. static const unsigned char aes_128_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
  431. {
  432. /* K1 */
  433. 0xfb, 0xee, 0xd6, 0x18, 0x35, 0x71, 0x33, 0x66,
  434. 0x7c, 0x85, 0xe0, 0x8f, 0x72, 0x36, 0xa8, 0xde
  435. },
  436. {
  437. /* K2 */
  438. 0xf7, 0xdd, 0xac, 0x30, 0x6a, 0xe2, 0x66, 0xcc,
  439. 0xf9, 0x0b, 0xc1, 0x1e, 0xe4, 0x6d, 0x51, 0x3b
  440. }
  441. };
  442. static const unsigned char aes_128_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
  443. {
  444. /* Example #1 */
  445. 0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
  446. 0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46
  447. },
  448. {
  449. /* Example #2 */
  450. 0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
  451. 0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c
  452. },
  453. {
  454. /* Example #3 */
  455. 0x7d, 0x85, 0x44, 0x9e, 0xa6, 0xea, 0x19, 0xc8,
  456. 0x23, 0xa7, 0xbf, 0x78, 0x83, 0x7d, 0xfa, 0xde
  457. },
  458. {
  459. /* Example #4 */
  460. 0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
  461. 0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe
  462. }
  463. };
  464. /* CMAC-AES192 Test Data */
  465. static const unsigned char aes_192_key[24] = {
  466. 0x8e, 0x73, 0xb0, 0xf7, 0xda, 0x0e, 0x64, 0x52,
  467. 0xc8, 0x10, 0xf3, 0x2b, 0x80, 0x90, 0x79, 0xe5,
  468. 0x62, 0xf8, 0xea, 0xd2, 0x52, 0x2c, 0x6b, 0x7b
  469. };
  470. static const unsigned char aes_192_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
  471. {
  472. /* K1 */
  473. 0x44, 0x8a, 0x5b, 0x1c, 0x93, 0x51, 0x4b, 0x27,
  474. 0x3e, 0xe6, 0x43, 0x9d, 0xd4, 0xda, 0xa2, 0x96
  475. },
  476. {
  477. /* K2 */
  478. 0x89, 0x14, 0xb6, 0x39, 0x26, 0xa2, 0x96, 0x4e,
  479. 0x7d, 0xcc, 0x87, 0x3b, 0xa9, 0xb5, 0x45, 0x2c
  480. }
  481. };
  482. static const unsigned char aes_192_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
  483. {
  484. /* Example #1 */
  485. 0xd1, 0x7d, 0xdf, 0x46, 0xad, 0xaa, 0xcd, 0xe5,
  486. 0x31, 0xca, 0xc4, 0x83, 0xde, 0x7a, 0x93, 0x67
  487. },
  488. {
  489. /* Example #2 */
  490. 0x9e, 0x99, 0xa7, 0xbf, 0x31, 0xe7, 0x10, 0x90,
  491. 0x06, 0x62, 0xf6, 0x5e, 0x61, 0x7c, 0x51, 0x84
  492. },
  493. {
  494. /* Example #3 */
  495. 0x3d, 0x75, 0xc1, 0x94, 0xed, 0x96, 0x07, 0x04,
  496. 0x44, 0xa9, 0xfa, 0x7e, 0xc7, 0x40, 0xec, 0xf8
  497. },
  498. {
  499. /* Example #4 */
  500. 0xa1, 0xd5, 0xdf, 0x0e, 0xed, 0x79, 0x0f, 0x79,
  501. 0x4d, 0x77, 0x58, 0x96, 0x59, 0xf3, 0x9a, 0x11
  502. }
  503. };
  504. /* CMAC-AES256 Test Data */
  505. static const unsigned char aes_256_key[32] = {
  506. 0x60, 0x3d, 0xeb, 0x10, 0x15, 0xca, 0x71, 0xbe,
  507. 0x2b, 0x73, 0xae, 0xf0, 0x85, 0x7d, 0x77, 0x81,
  508. 0x1f, 0x35, 0x2c, 0x07, 0x3b, 0x61, 0x08, 0xd7,
  509. 0x2d, 0x98, 0x10, 0xa3, 0x09, 0x14, 0xdf, 0xf4
  510. };
  511. static const unsigned char aes_256_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
  512. {
  513. /* K1 */
  514. 0xca, 0xd1, 0xed, 0x03, 0x29, 0x9e, 0xed, 0xac,
  515. 0x2e, 0x9a, 0x99, 0x80, 0x86, 0x21, 0x50, 0x2f
  516. },
  517. {
  518. /* K2 */
  519. 0x95, 0xa3, 0xda, 0x06, 0x53, 0x3d, 0xdb, 0x58,
  520. 0x5d, 0x35, 0x33, 0x01, 0x0c, 0x42, 0xa0, 0xd9
  521. }
  522. };
  523. static const unsigned char aes_256_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
  524. {
  525. /* Example #1 */
  526. 0x02, 0x89, 0x62, 0xf6, 0x1b, 0x7b, 0xf8, 0x9e,
  527. 0xfc, 0x6b, 0x55, 0x1f, 0x46, 0x67, 0xd9, 0x83
  528. },
  529. {
  530. /* Example #2 */
  531. 0x28, 0xa7, 0x02, 0x3f, 0x45, 0x2e, 0x8f, 0x82,
  532. 0xbd, 0x4b, 0xf2, 0x8d, 0x8c, 0x37, 0xc3, 0x5c
  533. },
  534. {
  535. /* Example #3 */
  536. 0x15, 0x67, 0x27, 0xdc, 0x08, 0x78, 0x94, 0x4a,
  537. 0x02, 0x3c, 0x1f, 0xe0, 0x3b, 0xad, 0x6d, 0x93
  538. },
  539. {
  540. /* Example #4 */
  541. 0xe1, 0x99, 0x21, 0x90, 0x54, 0x9f, 0x6e, 0xd5,
  542. 0x69, 0x6a, 0x2c, 0x05, 0x6c, 0x31, 0x54, 0x10
  543. }
  544. };
  545. #endif /* MBEDTLS_AES_C */
  546. #if defined(MBEDTLS_DES_C)
  547. /* Truncation point of message for 3DES CMAC tests */
  548. static const unsigned int des3_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
  549. 0,
  550. 16,
  551. 20,
  552. 32
  553. };
  554. /* CMAC-TDES (Generation) - 2 Key Test Data */
  555. static const unsigned char des3_2key_key[24] = {
  556. /* Key1 */
  557. 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
  558. /* Key2 */
  559. 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xEF, 0x01,
  560. /* Key3 */
  561. 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef
  562. };
  563. static const unsigned char des3_2key_subkeys[2][8] = {
  564. {
  565. /* K1 */
  566. 0x0d, 0xd2, 0xcb, 0x7a, 0x3d, 0x88, 0x88, 0xd9
  567. },
  568. {
  569. /* K2 */
  570. 0x1b, 0xa5, 0x96, 0xf4, 0x7b, 0x11, 0x11, 0xb2
  571. }
  572. };
  573. static const unsigned char des3_2key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE] = {
  574. {
  575. /* Sample #1 */
  576. 0x79, 0xce, 0x52, 0xa7, 0xf7, 0x86, 0xa9, 0x60
  577. },
  578. {
  579. /* Sample #2 */
  580. 0xcc, 0x18, 0xa0, 0xb7, 0x9a, 0xf2, 0x41, 0x3b
  581. },
  582. {
  583. /* Sample #3 */
  584. 0xc0, 0x6d, 0x37, 0x7e, 0xcd, 0x10, 0x19, 0x69
  585. },
  586. {
  587. /* Sample #4 */
  588. 0x9c, 0xd3, 0x35, 0x80, 0xf9, 0xb6, 0x4d, 0xfb
  589. }
  590. };
  591. /* CMAC-TDES (Generation) - 3 Key Test Data */
  592. static const unsigned char des3_3key_key[24] = {
  593. /* Key1 */
  594. 0x01, 0x23, 0x45, 0x67, 0x89, 0xaa, 0xcd, 0xef,
  595. /* Key2 */
  596. 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01,
  597. /* Key3 */
  598. 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23
  599. };
  600. static const unsigned char des3_3key_subkeys[2][8] = {
  601. {
  602. /* K1 */
  603. 0x9d, 0x74, 0xe7, 0x39, 0x33, 0x17, 0x96, 0xc0
  604. },
  605. {
  606. /* K2 */
  607. 0x3a, 0xe9, 0xce, 0x72, 0x66, 0x2f, 0x2d, 0x9b
  608. }
  609. };
  610. static const unsigned char des3_3key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE] = {
  611. {
  612. /* Sample #1 */
  613. 0x7d, 0xb0, 0xd3, 0x7d, 0xf9, 0x36, 0xc5, 0x50
  614. },
  615. {
  616. /* Sample #2 */
  617. 0x30, 0x23, 0x9c, 0xf1, 0xf5, 0x2e, 0x66, 0x09
  618. },
  619. {
  620. /* Sample #3 */
  621. 0x6c, 0x9f, 0x3e, 0xe4, 0x92, 0x3f, 0x6b, 0xe2
  622. },
  623. {
  624. /* Sample #4 */
  625. 0x99, 0x42, 0x9b, 0xd0, 0xbF, 0x79, 0x04, 0xe5
  626. }
  627. };
  628. #endif /* MBEDTLS_DES_C */
  629. #if defined(MBEDTLS_AES_C)
  630. /* AES AES-CMAC-PRF-128 Test Data */
  631. static const unsigned char PRFK[] = {
  632. /* Key */
  633. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  634. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  635. 0xed, 0xcb
  636. };
  637. /* Sizes in bytes */
  638. static const size_t PRFKlen[NB_PRF_TESTS] = {
  639. 18,
  640. 16,
  641. 10
  642. };
  643. /* Message */
  644. static const unsigned char PRFM[] = {
  645. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  646. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  647. 0x10, 0x11, 0x12, 0x13
  648. };
  649. static const unsigned char PRFT[NB_PRF_TESTS][16] = {
  650. {
  651. 0x84, 0xa3, 0x48, 0xa4, 0xa4, 0x5d, 0x23, 0x5b,
  652. 0xab, 0xff, 0xfc, 0x0d, 0x2b, 0x4d, 0xa0, 0x9a
  653. },
  654. {
  655. 0x98, 0x0a, 0xe8, 0x7b, 0x5f, 0x4c, 0x9c, 0x52,
  656. 0x14, 0xf5, 0xb6, 0xa8, 0x45, 0x5e, 0x4c, 0x2d
  657. },
  658. {
  659. 0x29, 0x0d, 0x9e, 0x11, 0x2e, 0xdb, 0x09, 0xee,
  660. 0x14, 0x1f, 0xcf, 0x64, 0xc0, 0xb7, 0x2f, 0x3d
  661. }
  662. };
  663. #endif /* MBEDTLS_AES_C */
  664. static int cmac_test_subkeys( int verbose,
  665. const char* testname,
  666. const unsigned char* key,
  667. int keybits,
  668. const unsigned char* subkeys,
  669. mbedtls_cipher_type_t cipher_type,
  670. int block_size,
  671. int num_tests )
  672. {
  673. int i, ret;
  674. mbedtls_cipher_context_t ctx;
  675. const mbedtls_cipher_info_t *cipher_info;
  676. unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
  677. unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
  678. cipher_info = mbedtls_cipher_info_from_type( cipher_type );
  679. if( cipher_info == NULL )
  680. {
  681. /* Failing at this point must be due to a build issue */
  682. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  683. }
  684. for( i = 0; i < num_tests; i++ )
  685. {
  686. if( verbose != 0 )
  687. mbedtls_printf( " %s CMAC subkey #%u: ", testname, i + 1 );
  688. mbedtls_cipher_init( &ctx );
  689. if( ( ret = mbedtls_cipher_setup( &ctx, cipher_info ) ) != 0 )
  690. {
  691. if( verbose != 0 )
  692. mbedtls_printf( "test execution failed\n" );
  693. goto cleanup;
  694. }
  695. if( ( ret = mbedtls_cipher_setkey( &ctx, key, keybits,
  696. MBEDTLS_ENCRYPT ) ) != 0 )
  697. {
  698. if( verbose != 0 )
  699. mbedtls_printf( "test execution failed\n" );
  700. goto cleanup;
  701. }
  702. ret = cmac_generate_subkeys( &ctx, K1, K2 );
  703. if( ret != 0 )
  704. {
  705. if( verbose != 0 )
  706. mbedtls_printf( "failed\n" );
  707. goto cleanup;
  708. }
  709. if( ( ret = memcmp( K1, subkeys, block_size ) ) != 0 ||
  710. ( ret = memcmp( K2, &subkeys[block_size], block_size ) ) != 0 )
  711. {
  712. if( verbose != 0 )
  713. mbedtls_printf( "failed\n" );
  714. goto cleanup;
  715. }
  716. if( verbose != 0 )
  717. mbedtls_printf( "passed\n" );
  718. mbedtls_cipher_free( &ctx );
  719. }
  720. goto exit;
  721. cleanup:
  722. mbedtls_cipher_free( &ctx );
  723. exit:
  724. return( ret );
  725. }
  726. static int cmac_test_wth_cipher( int verbose,
  727. const char* testname,
  728. const unsigned char* key,
  729. int keybits,
  730. const unsigned char* messages,
  731. const unsigned int message_lengths[4],
  732. const unsigned char* expected_result,
  733. mbedtls_cipher_type_t cipher_type,
  734. int block_size,
  735. int num_tests )
  736. {
  737. const mbedtls_cipher_info_t *cipher_info;
  738. int i, ret;
  739. unsigned char output[MBEDTLS_CIPHER_BLKSIZE_MAX];
  740. cipher_info = mbedtls_cipher_info_from_type( cipher_type );
  741. if( cipher_info == NULL )
  742. {
  743. /* Failing at this point must be due to a build issue */
  744. ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
  745. goto exit;
  746. }
  747. for( i = 0; i < num_tests; i++ )
  748. {
  749. if( verbose != 0 )
  750. mbedtls_printf( " %s CMAC #%u: ", testname, i + 1 );
  751. if( ( ret = mbedtls_cipher_cmac( cipher_info, key, keybits, messages,
  752. message_lengths[i], output ) ) != 0 )
  753. {
  754. if( verbose != 0 )
  755. mbedtls_printf( "failed\n" );
  756. goto exit;
  757. }
  758. if( ( ret = memcmp( output, &expected_result[i * block_size], block_size ) ) != 0 )
  759. {
  760. if( verbose != 0 )
  761. mbedtls_printf( "failed\n" );
  762. goto exit;
  763. }
  764. if( verbose != 0 )
  765. mbedtls_printf( "passed\n" );
  766. }
  767. exit:
  768. return( ret );
  769. }
  770. #if defined(MBEDTLS_AES_C)
  771. static int test_aes128_cmac_prf( int verbose )
  772. {
  773. int i;
  774. int ret;
  775. unsigned char output[MBEDTLS_AES_BLOCK_SIZE];
  776. for( i = 0; i < NB_PRF_TESTS; i++ )
  777. {
  778. mbedtls_printf( " AES CMAC 128 PRF #%u: ", i );
  779. ret = mbedtls_aes_cmac_prf_128( PRFK, PRFKlen[i], PRFM, 20, output );
  780. if( ret != 0 ||
  781. memcmp( output, PRFT[i], MBEDTLS_AES_BLOCK_SIZE ) != 0 )
  782. {
  783. if( verbose != 0 )
  784. mbedtls_printf( "failed\n" );
  785. return( ret );
  786. }
  787. else if( verbose != 0 )
  788. {
  789. mbedtls_printf( "passed\n" );
  790. }
  791. }
  792. return( ret );
  793. }
  794. #endif /* MBEDTLS_AES_C */
  795. int mbedtls_cmac_self_test( int verbose )
  796. {
  797. int ret;
  798. #if defined(MBEDTLS_AES_C)
  799. /* AES-128 */
  800. if( ( ret = cmac_test_subkeys( verbose,
  801. "AES 128",
  802. aes_128_key,
  803. 128,
  804. (const unsigned char*)aes_128_subkeys,
  805. MBEDTLS_CIPHER_AES_128_ECB,
  806. MBEDTLS_AES_BLOCK_SIZE,
  807. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  808. {
  809. return( ret );
  810. }
  811. if( ( ret = cmac_test_wth_cipher( verbose,
  812. "AES 128",
  813. aes_128_key,
  814. 128,
  815. test_message,
  816. aes_message_lengths,
  817. (const unsigned char*)aes_128_expected_result,
  818. MBEDTLS_CIPHER_AES_128_ECB,
  819. MBEDTLS_AES_BLOCK_SIZE,
  820. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  821. {
  822. return( ret );
  823. }
  824. /* AES-192 */
  825. if( ( ret = cmac_test_subkeys( verbose,
  826. "AES 192",
  827. aes_192_key,
  828. 192,
  829. (const unsigned char*)aes_192_subkeys,
  830. MBEDTLS_CIPHER_AES_192_ECB,
  831. MBEDTLS_AES_BLOCK_SIZE,
  832. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  833. {
  834. return( ret );
  835. }
  836. if( ( ret = cmac_test_wth_cipher( verbose,
  837. "AES 192",
  838. aes_192_key,
  839. 192,
  840. test_message,
  841. aes_message_lengths,
  842. (const unsigned char*)aes_192_expected_result,
  843. MBEDTLS_CIPHER_AES_192_ECB,
  844. MBEDTLS_AES_BLOCK_SIZE,
  845. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  846. {
  847. return( ret );
  848. }
  849. /* AES-256 */
  850. if( ( ret = cmac_test_subkeys( verbose,
  851. "AES 256",
  852. aes_256_key,
  853. 256,
  854. (const unsigned char*)aes_256_subkeys,
  855. MBEDTLS_CIPHER_AES_256_ECB,
  856. MBEDTLS_AES_BLOCK_SIZE,
  857. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  858. {
  859. return( ret );
  860. }
  861. if( ( ret = cmac_test_wth_cipher ( verbose,
  862. "AES 256",
  863. aes_256_key,
  864. 256,
  865. test_message,
  866. aes_message_lengths,
  867. (const unsigned char*)aes_256_expected_result,
  868. MBEDTLS_CIPHER_AES_256_ECB,
  869. MBEDTLS_AES_BLOCK_SIZE,
  870. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  871. {
  872. return( ret );
  873. }
  874. #endif /* MBEDTLS_AES_C */
  875. #if defined(MBEDTLS_DES_C)
  876. /* 3DES 2 key */
  877. if( ( ret = cmac_test_subkeys( verbose,
  878. "3DES 2 key",
  879. des3_2key_key,
  880. 192,
  881. (const unsigned char*)des3_2key_subkeys,
  882. MBEDTLS_CIPHER_DES_EDE3_ECB,
  883. MBEDTLS_DES3_BLOCK_SIZE,
  884. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  885. {
  886. return( ret );
  887. }
  888. if( ( ret = cmac_test_wth_cipher( verbose,
  889. "3DES 2 key",
  890. des3_2key_key,
  891. 192,
  892. test_message,
  893. des3_message_lengths,
  894. (const unsigned char*)des3_2key_expected_result,
  895. MBEDTLS_CIPHER_DES_EDE3_ECB,
  896. MBEDTLS_DES3_BLOCK_SIZE,
  897. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  898. {
  899. return( ret );
  900. }
  901. /* 3DES 3 key */
  902. if( ( ret = cmac_test_subkeys( verbose,
  903. "3DES 3 key",
  904. des3_3key_key,
  905. 192,
  906. (const unsigned char*)des3_3key_subkeys,
  907. MBEDTLS_CIPHER_DES_EDE3_ECB,
  908. MBEDTLS_DES3_BLOCK_SIZE,
  909. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  910. {
  911. return( ret );
  912. }
  913. if( ( ret = cmac_test_wth_cipher( verbose,
  914. "3DES 3 key",
  915. des3_3key_key,
  916. 192,
  917. test_message,
  918. des3_message_lengths,
  919. (const unsigned char*)des3_3key_expected_result,
  920. MBEDTLS_CIPHER_DES_EDE3_ECB,
  921. MBEDTLS_DES3_BLOCK_SIZE,
  922. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  923. {
  924. return( ret );
  925. }
  926. #endif /* MBEDTLS_DES_C */
  927. #if defined(MBEDTLS_AES_C)
  928. if( ( ret = test_aes128_cmac_prf( verbose ) ) != 0 )
  929. return( ret );
  930. #endif /* MBEDTLS_AES_C */
  931. if( verbose != 0 )
  932. mbedtls_printf( "\n" );
  933. return( 0 );
  934. }
  935. #endif /* MBEDTLS_SELF_TEST */
  936. #endif /* MBEDTLS_CMAC_C */