cmac.c 32 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082
  1. /**
  2. * \file cmac.c
  3. *
  4. * \brief NIST SP800-38B compliant CMAC implementation for AES and 3DES
  5. *
  6. * Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
  7. * SPDX-License-Identifier: Apache-2.0
  8. *
  9. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  10. * not use this file except in compliance with the License.
  11. * You may obtain a copy of the License at
  12. *
  13. * http://www.apache.org/licenses/LICENSE-2.0
  14. *
  15. * Unless required by applicable law or agreed to in writing, software
  16. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  17. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18. * See the License for the specific language governing permissions and
  19. * limitations under the License.
  20. *
  21. * This file is part of mbed TLS (https://tls.mbed.org)
  22. */
  23. /*
  24. * References:
  25. *
  26. * - NIST SP 800-38B Recommendation for Block Cipher Modes of Operation: The
  27. * CMAC Mode for Authentication
  28. * http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf
  29. *
  30. * - RFC 4493 - The AES-CMAC Algorithm
  31. * https://tools.ietf.org/html/rfc4493
  32. *
  33. * - RFC 4615 - The Advanced Encryption Standard-Cipher-based Message
  34. * Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128)
  35. * Algorithm for the Internet Key Exchange Protocol (IKE)
  36. * https://tools.ietf.org/html/rfc4615
  37. *
  38. * Additional test vectors: ISO/IEC 9797-1
  39. *
  40. */
  41. #if !defined(MBEDTLS_CONFIG_FILE)
  42. #include "mbedtls/config.h"
  43. #else
  44. #include MBEDTLS_CONFIG_FILE
  45. #endif
  46. #if defined(MBEDTLS_CMAC_C)
  47. #include "mbedtls/cmac.h"
  48. #include <string.h>
  49. #if defined(MBEDTLS_PLATFORM_C)
  50. #include "mbedtls/platform.h"
  51. #else
  52. #include <stdlib.h>
  53. #define mbedtls_calloc calloc
  54. #define mbedtls_free free
  55. #if defined(MBEDTLS_SELF_TEST)
  56. #include <stdio.h>
  57. #define mbedtls_printf printf
  58. #endif /* MBEDTLS_SELF_TEST */
  59. #endif /* MBEDTLS_PLATFORM_C */
  60. #if !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST)
  61. /* Implementation that should never be optimized out by the compiler */
  62. static void mbedtls_zeroize( void *v, size_t n ) {
  63. volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
  64. }
  65. /*
  66. * Multiplication by u in the Galois field of GF(2^n)
  67. *
  68. * As explained in NIST SP 800-38B, this can be computed:
  69. *
  70. * If MSB(p) = 0, then p = (p << 1)
  71. * If MSB(p) = 1, then p = (p << 1) ^ R_n
  72. * with R_64 = 0x1B and R_128 = 0x87
  73. *
  74. * Input and output MUST NOT point to the same buffer
  75. * Block size must be 8 bytes or 16 bytes - the block sizes for DES and AES.
  76. */
  77. static int cmac_multiply_by_u( unsigned char *output,
  78. const unsigned char *input,
  79. size_t blocksize )
  80. {
  81. const unsigned char R_128 = 0x87;
  82. const unsigned char R_64 = 0x1B;
  83. unsigned char R_n, mask;
  84. unsigned char overflow = 0x00;
  85. int i;
  86. if( blocksize == MBEDTLS_AES_BLOCK_SIZE )
  87. {
  88. R_n = R_128;
  89. }
  90. else if( blocksize == MBEDTLS_DES3_BLOCK_SIZE )
  91. {
  92. R_n = R_64;
  93. }
  94. else
  95. {
  96. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  97. }
  98. for( i = (int)blocksize - 1; i >= 0; i-- )
  99. {
  100. output[i] = input[i] << 1 | overflow;
  101. overflow = input[i] >> 7;
  102. }
  103. /* mask = ( input[0] >> 7 ) ? 0xff : 0x00
  104. * using bit operations to avoid branches */
  105. /* MSVC has a warning about unary minus on unsigned, but this is
  106. * well-defined and precisely what we want to do here */
  107. #if defined(_MSC_VER)
  108. #pragma warning( push )
  109. #pragma warning( disable : 4146 )
  110. #endif
  111. mask = - ( input[0] >> 7 );
  112. #if defined(_MSC_VER)
  113. #pragma warning( pop )
  114. #endif
  115. output[ blocksize - 1 ] ^= R_n & mask;
  116. return( 0 );
  117. }
  118. /*
  119. * Generate subkeys
  120. *
  121. * - as specified by RFC 4493, section 2.3 Subkey Generation Algorithm
  122. */
  123. static int cmac_generate_subkeys( mbedtls_cipher_context_t *ctx,
  124. unsigned char* K1, unsigned char* K2 )
  125. {
  126. int ret;
  127. unsigned char L[MBEDTLS_CIPHER_BLKSIZE_MAX];
  128. size_t olen, block_size;
  129. mbedtls_zeroize( L, sizeof( L ) );
  130. block_size = ctx->cipher_info->block_size;
  131. /* Calculate Ek(0) */
  132. if( ( ret = mbedtls_cipher_update( ctx, L, block_size, L, &olen ) ) != 0 )
  133. goto exit;
  134. /*
  135. * Generate K1 and K2
  136. */
  137. if( ( ret = cmac_multiply_by_u( K1, L , block_size ) ) != 0 )
  138. goto exit;
  139. if( ( ret = cmac_multiply_by_u( K2, K1 , block_size ) ) != 0 )
  140. goto exit;
  141. exit:
  142. mbedtls_zeroize( L, sizeof( L ) );
  143. return( ret );
  144. }
  145. #endif /* !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST) */
  146. #if !defined(MBEDTLS_CMAC_ALT)
  147. static void cmac_xor_block( unsigned char *output, const unsigned char *input1,
  148. const unsigned char *input2,
  149. const size_t block_size )
  150. {
  151. size_t idx;
  152. for( idx = 0; idx < block_size; idx++ )
  153. output[ idx ] = input1[ idx ] ^ input2[ idx ];
  154. }
  155. /*
  156. * Create padded last block from (partial) last block.
  157. *
  158. * We can't use the padding option from the cipher layer, as it only works for
  159. * CBC and we use ECB mode, and anyway we need to XOR K1 or K2 in addition.
  160. */
  161. static void cmac_pad( unsigned char padded_block[MBEDTLS_CIPHER_BLKSIZE_MAX],
  162. size_t padded_block_len,
  163. const unsigned char *last_block,
  164. size_t last_block_len )
  165. {
  166. size_t j;
  167. for( j = 0; j < padded_block_len; j++ )
  168. {
  169. if( j < last_block_len )
  170. padded_block[j] = last_block[j];
  171. else if( j == last_block_len )
  172. padded_block[j] = 0x80;
  173. else
  174. padded_block[j] = 0x00;
  175. }
  176. }
  177. int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx,
  178. const unsigned char *key, size_t keybits )
  179. {
  180. mbedtls_cipher_type_t type;
  181. mbedtls_cmac_context_t *cmac_ctx;
  182. int retval;
  183. if( ctx == NULL || ctx->cipher_info == NULL || key == NULL )
  184. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  185. if( ( retval = mbedtls_cipher_setkey( ctx, key, (int)keybits,
  186. MBEDTLS_ENCRYPT ) ) != 0 )
  187. return( retval );
  188. type = ctx->cipher_info->type;
  189. switch( type )
  190. {
  191. case MBEDTLS_CIPHER_AES_128_ECB:
  192. case MBEDTLS_CIPHER_AES_192_ECB:
  193. case MBEDTLS_CIPHER_AES_256_ECB:
  194. case MBEDTLS_CIPHER_DES_EDE3_ECB:
  195. break;
  196. default:
  197. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  198. }
  199. /* Allocated and initialise in the cipher context memory for the CMAC
  200. * context */
  201. cmac_ctx = mbedtls_calloc( 1, sizeof( mbedtls_cmac_context_t ) );
  202. if( cmac_ctx == NULL )
  203. return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
  204. ctx->cmac_ctx = cmac_ctx;
  205. mbedtls_zeroize( cmac_ctx->state, sizeof( cmac_ctx->state ) );
  206. return 0;
  207. }
  208. int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx,
  209. const unsigned char *input, size_t ilen )
  210. {
  211. mbedtls_cmac_context_t* cmac_ctx;
  212. unsigned char *state;
  213. int ret = 0;
  214. size_t n, j, olen, block_size;
  215. if( ctx == NULL || ctx->cipher_info == NULL || input == NULL ||
  216. ctx->cmac_ctx == NULL )
  217. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  218. cmac_ctx = ctx->cmac_ctx;
  219. block_size = ctx->cipher_info->block_size;
  220. state = ctx->cmac_ctx->state;
  221. /* Is there data still to process from the last call, that's greater in
  222. * size than a block? */
  223. if( cmac_ctx->unprocessed_len > 0 &&
  224. ilen > block_size - cmac_ctx->unprocessed_len )
  225. {
  226. memcpy( &cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
  227. input,
  228. block_size - cmac_ctx->unprocessed_len );
  229. cmac_xor_block( state, cmac_ctx->unprocessed_block, state, block_size );
  230. if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
  231. &olen ) ) != 0 )
  232. {
  233. goto exit;
  234. }
  235. input += block_size - cmac_ctx->unprocessed_len;
  236. ilen -= block_size - cmac_ctx->unprocessed_len;
  237. cmac_ctx->unprocessed_len = 0;
  238. }
  239. /* n is the number of blocks including any final partial block */
  240. n = ( ilen + block_size - 1 ) / block_size;
  241. /* Iterate across the input data in block sized chunks, excluding any
  242. * final partial or complete block */
  243. for( j = 1; j < n; j++ )
  244. {
  245. cmac_xor_block( state, input, state, block_size );
  246. if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
  247. &olen ) ) != 0 )
  248. goto exit;
  249. ilen -= block_size;
  250. input += block_size;
  251. }
  252. /* If there is data left over that wasn't aligned to a block */
  253. if( ilen > 0 )
  254. {
  255. memcpy( &cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
  256. input,
  257. ilen );
  258. cmac_ctx->unprocessed_len += ilen;
  259. }
  260. exit:
  261. return( ret );
  262. }
  263. int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx,
  264. unsigned char *output )
  265. {
  266. mbedtls_cmac_context_t* cmac_ctx;
  267. unsigned char *state, *last_block;
  268. unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
  269. unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
  270. unsigned char M_last[MBEDTLS_CIPHER_BLKSIZE_MAX];
  271. int ret;
  272. size_t olen, block_size;
  273. if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL ||
  274. output == NULL )
  275. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  276. cmac_ctx = ctx->cmac_ctx;
  277. block_size = ctx->cipher_info->block_size;
  278. state = cmac_ctx->state;
  279. mbedtls_zeroize( K1, sizeof( K1 ) );
  280. mbedtls_zeroize( K2, sizeof( K2 ) );
  281. cmac_generate_subkeys( ctx, K1, K2 );
  282. last_block = cmac_ctx->unprocessed_block;
  283. /* Calculate last block */
  284. if( cmac_ctx->unprocessed_len < block_size )
  285. {
  286. cmac_pad( M_last, block_size, last_block, cmac_ctx->unprocessed_len );
  287. cmac_xor_block( M_last, M_last, K2, block_size );
  288. }
  289. else
  290. {
  291. /* Last block is complete block */
  292. cmac_xor_block( M_last, last_block, K1, block_size );
  293. }
  294. cmac_xor_block( state, M_last, state, block_size );
  295. if( ( ret = mbedtls_cipher_update( ctx, state, block_size, state,
  296. &olen ) ) != 0 )
  297. {
  298. goto exit;
  299. }
  300. memcpy( output, state, block_size );
  301. exit:
  302. /* Wipe the generated keys on the stack, and any other transients to avoid
  303. * side channel leakage */
  304. mbedtls_zeroize( K1, sizeof( K1 ) );
  305. mbedtls_zeroize( K2, sizeof( K2 ) );
  306. cmac_ctx->unprocessed_len = 0;
  307. mbedtls_zeroize( cmac_ctx->unprocessed_block,
  308. sizeof( cmac_ctx->unprocessed_block ) );
  309. mbedtls_zeroize( state, MBEDTLS_CIPHER_BLKSIZE_MAX );
  310. return( ret );
  311. }
  312. int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx )
  313. {
  314. mbedtls_cmac_context_t* cmac_ctx;
  315. if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL )
  316. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  317. cmac_ctx = ctx->cmac_ctx;
  318. /* Reset the internal state */
  319. cmac_ctx->unprocessed_len = 0;
  320. mbedtls_zeroize( cmac_ctx->unprocessed_block,
  321. sizeof( cmac_ctx->unprocessed_block ) );
  322. mbedtls_zeroize( cmac_ctx->state,
  323. sizeof( cmac_ctx->state ) );
  324. return( 0 );
  325. }
  326. int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info,
  327. const unsigned char *key, size_t keylen,
  328. const unsigned char *input, size_t ilen,
  329. unsigned char *output )
  330. {
  331. mbedtls_cipher_context_t ctx;
  332. int ret;
  333. if( cipher_info == NULL || key == NULL || input == NULL || output == NULL )
  334. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  335. mbedtls_cipher_init( &ctx );
  336. if( ( ret = mbedtls_cipher_setup( &ctx, cipher_info ) ) != 0 )
  337. goto exit;
  338. ret = mbedtls_cipher_cmac_starts( &ctx, key, keylen );
  339. if( ret != 0 )
  340. goto exit;
  341. ret = mbedtls_cipher_cmac_update( &ctx, input, ilen );
  342. if( ret != 0 )
  343. goto exit;
  344. ret = mbedtls_cipher_cmac_finish( &ctx, output );
  345. exit:
  346. mbedtls_cipher_free( &ctx );
  347. return( ret );
  348. }
  349. #if defined(MBEDTLS_AES_C)
  350. /*
  351. * Implementation of AES-CMAC-PRF-128 defined in RFC 4615
  352. */
  353. int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_length,
  354. const unsigned char *input, size_t in_len,
  355. unsigned char *output )
  356. {
  357. int ret;
  358. const mbedtls_cipher_info_t *cipher_info;
  359. unsigned char zero_key[MBEDTLS_AES_BLOCK_SIZE];
  360. unsigned char int_key[MBEDTLS_AES_BLOCK_SIZE];
  361. if( key == NULL || input == NULL || output == NULL )
  362. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  363. cipher_info = mbedtls_cipher_info_from_type( MBEDTLS_CIPHER_AES_128_ECB );
  364. if( cipher_info == NULL )
  365. {
  366. /* Failing at this point must be due to a build issue */
  367. ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
  368. goto exit;
  369. }
  370. if( key_length == MBEDTLS_AES_BLOCK_SIZE )
  371. {
  372. /* Use key as is */
  373. memcpy( int_key, key, MBEDTLS_AES_BLOCK_SIZE );
  374. }
  375. else
  376. {
  377. memset( zero_key, 0, MBEDTLS_AES_BLOCK_SIZE );
  378. ret = mbedtls_cipher_cmac( cipher_info, zero_key, 128, key,
  379. key_length, int_key );
  380. if( ret != 0 )
  381. goto exit;
  382. }
  383. ret = mbedtls_cipher_cmac( cipher_info, int_key, 128, input, in_len,
  384. output );
  385. exit:
  386. mbedtls_zeroize( int_key, sizeof( int_key ) );
  387. return( ret );
  388. }
  389. #endif /* MBEDTLS_AES_C */
  390. #endif /* !MBEDTLS_CMAC_ALT */
  391. #if defined(MBEDTLS_SELF_TEST)
  392. /*
  393. * CMAC test data for SP800-38B
  394. * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/AES_CMAC.pdf
  395. * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/TDES_CMAC.pdf
  396. *
  397. * AES-CMAC-PRF-128 test data from RFC 4615
  398. * https://tools.ietf.org/html/rfc4615#page-4
  399. */
  400. #define NB_CMAC_TESTS_PER_KEY 4
  401. #define NB_PRF_TESTS 3
  402. #if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C)
  403. /* All CMAC test inputs are truncated from the same 64 byte buffer. */
  404. static const unsigned char test_message[] = {
  405. /* PT */
  406. 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
  407. 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
  408. 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
  409. 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
  410. 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
  411. 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
  412. 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
  413. 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
  414. };
  415. #endif /* MBEDTLS_AES_C || MBEDTLS_DES_C */
  416. #if defined(MBEDTLS_AES_C)
  417. /* Truncation point of message for AES CMAC tests */
  418. static const unsigned int aes_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
  419. /* Mlen */
  420. 0,
  421. 16,
  422. 20,
  423. 64
  424. };
  425. /* CMAC-AES128 Test Data */
  426. static const unsigned char aes_128_key[16] = {
  427. 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
  428. 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
  429. };
  430. static const unsigned char aes_128_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
  431. {
  432. /* K1 */
  433. 0xfb, 0xee, 0xd6, 0x18, 0x35, 0x71, 0x33, 0x66,
  434. 0x7c, 0x85, 0xe0, 0x8f, 0x72, 0x36, 0xa8, 0xde
  435. },
  436. {
  437. /* K2 */
  438. 0xf7, 0xdd, 0xac, 0x30, 0x6a, 0xe2, 0x66, 0xcc,
  439. 0xf9, 0x0b, 0xc1, 0x1e, 0xe4, 0x6d, 0x51, 0x3b
  440. }
  441. };
  442. static const unsigned char aes_128_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
  443. {
  444. /* Example #1 */
  445. 0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
  446. 0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46
  447. },
  448. {
  449. /* Example #2 */
  450. 0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
  451. 0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c
  452. },
  453. {
  454. /* Example #3 */
  455. 0x7d, 0x85, 0x44, 0x9e, 0xa6, 0xea, 0x19, 0xc8,
  456. 0x23, 0xa7, 0xbf, 0x78, 0x83, 0x7d, 0xfa, 0xde
  457. },
  458. {
  459. /* Example #4 */
  460. 0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
  461. 0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe
  462. }
  463. };
  464. /* CMAC-AES192 Test Data */
  465. static const unsigned char aes_192_key[24] = {
  466. 0x8e, 0x73, 0xb0, 0xf7, 0xda, 0x0e, 0x64, 0x52,
  467. 0xc8, 0x10, 0xf3, 0x2b, 0x80, 0x90, 0x79, 0xe5,
  468. 0x62, 0xf8, 0xea, 0xd2, 0x52, 0x2c, 0x6b, 0x7b
  469. };
  470. static const unsigned char aes_192_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
  471. {
  472. /* K1 */
  473. 0x44, 0x8a, 0x5b, 0x1c, 0x93, 0x51, 0x4b, 0x27,
  474. 0x3e, 0xe6, 0x43, 0x9d, 0xd4, 0xda, 0xa2, 0x96
  475. },
  476. {
  477. /* K2 */
  478. 0x89, 0x14, 0xb6, 0x39, 0x26, 0xa2, 0x96, 0x4e,
  479. 0x7d, 0xcc, 0x87, 0x3b, 0xa9, 0xb5, 0x45, 0x2c
  480. }
  481. };
  482. static const unsigned char aes_192_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
  483. {
  484. /* Example #1 */
  485. 0xd1, 0x7d, 0xdf, 0x46, 0xad, 0xaa, 0xcd, 0xe5,
  486. 0x31, 0xca, 0xc4, 0x83, 0xde, 0x7a, 0x93, 0x67
  487. },
  488. {
  489. /* Example #2 */
  490. 0x9e, 0x99, 0xa7, 0xbf, 0x31, 0xe7, 0x10, 0x90,
  491. 0x06, 0x62, 0xf6, 0x5e, 0x61, 0x7c, 0x51, 0x84
  492. },
  493. {
  494. /* Example #3 */
  495. 0x3d, 0x75, 0xc1, 0x94, 0xed, 0x96, 0x07, 0x04,
  496. 0x44, 0xa9, 0xfa, 0x7e, 0xc7, 0x40, 0xec, 0xf8
  497. },
  498. {
  499. /* Example #4 */
  500. 0xa1, 0xd5, 0xdf, 0x0e, 0xed, 0x79, 0x0f, 0x79,
  501. 0x4d, 0x77, 0x58, 0x96, 0x59, 0xf3, 0x9a, 0x11
  502. }
  503. };
  504. /* CMAC-AES256 Test Data */
  505. static const unsigned char aes_256_key[32] = {
  506. 0x60, 0x3d, 0xeb, 0x10, 0x15, 0xca, 0x71, 0xbe,
  507. 0x2b, 0x73, 0xae, 0xf0, 0x85, 0x7d, 0x77, 0x81,
  508. 0x1f, 0x35, 0x2c, 0x07, 0x3b, 0x61, 0x08, 0xd7,
  509. 0x2d, 0x98, 0x10, 0xa3, 0x09, 0x14, 0xdf, 0xf4
  510. };
  511. static const unsigned char aes_256_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
  512. {
  513. /* K1 */
  514. 0xca, 0xd1, 0xed, 0x03, 0x29, 0x9e, 0xed, 0xac,
  515. 0x2e, 0x9a, 0x99, 0x80, 0x86, 0x21, 0x50, 0x2f
  516. },
  517. {
  518. /* K2 */
  519. 0x95, 0xa3, 0xda, 0x06, 0x53, 0x3d, 0xdb, 0x58,
  520. 0x5d, 0x35, 0x33, 0x01, 0x0c, 0x42, 0xa0, 0xd9
  521. }
  522. };
  523. static const unsigned char aes_256_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] = {
  524. {
  525. /* Example #1 */
  526. 0x02, 0x89, 0x62, 0xf6, 0x1b, 0x7b, 0xf8, 0x9e,
  527. 0xfc, 0x6b, 0x55, 0x1f, 0x46, 0x67, 0xd9, 0x83
  528. },
  529. {
  530. /* Example #2 */
  531. 0x28, 0xa7, 0x02, 0x3f, 0x45, 0x2e, 0x8f, 0x82,
  532. 0xbd, 0x4b, 0xf2, 0x8d, 0x8c, 0x37, 0xc3, 0x5c
  533. },
  534. {
  535. /* Example #3 */
  536. 0x15, 0x67, 0x27, 0xdc, 0x08, 0x78, 0x94, 0x4a,
  537. 0x02, 0x3c, 0x1f, 0xe0, 0x3b, 0xad, 0x6d, 0x93
  538. },
  539. {
  540. /* Example #4 */
  541. 0xe1, 0x99, 0x21, 0x90, 0x54, 0x9f, 0x6e, 0xd5,
  542. 0x69, 0x6a, 0x2c, 0x05, 0x6c, 0x31, 0x54, 0x10
  543. }
  544. };
  545. #endif /* MBEDTLS_AES_C */
  546. #if defined(MBEDTLS_DES_C)
  547. /* Truncation point of message for 3DES CMAC tests */
  548. static const unsigned int des3_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
  549. 0,
  550. 16,
  551. 20,
  552. 32
  553. };
  554. /* CMAC-TDES (Generation) - 2 Key Test Data */
  555. static const unsigned char des3_2key_key[24] = {
  556. /* Key1 */
  557. 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
  558. /* Key2 */
  559. 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xEF, 0x01,
  560. /* Key3 */
  561. 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef
  562. };
  563. static const unsigned char des3_2key_subkeys[2][8] = {
  564. {
  565. /* K1 */
  566. 0x0d, 0xd2, 0xcb, 0x7a, 0x3d, 0x88, 0x88, 0xd9
  567. },
  568. {
  569. /* K2 */
  570. 0x1b, 0xa5, 0x96, 0xf4, 0x7b, 0x11, 0x11, 0xb2
  571. }
  572. };
  573. static const unsigned char des3_2key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE] = {
  574. {
  575. /* Sample #1 */
  576. 0x79, 0xce, 0x52, 0xa7, 0xf7, 0x86, 0xa9, 0x60
  577. },
  578. {
  579. /* Sample #2 */
  580. 0xcc, 0x18, 0xa0, 0xb7, 0x9a, 0xf2, 0x41, 0x3b
  581. },
  582. {
  583. /* Sample #3 */
  584. 0xc0, 0x6d, 0x37, 0x7e, 0xcd, 0x10, 0x19, 0x69
  585. },
  586. {
  587. /* Sample #4 */
  588. 0x9c, 0xd3, 0x35, 0x80, 0xf9, 0xb6, 0x4d, 0xfb
  589. }
  590. };
  591. /* CMAC-TDES (Generation) - 3 Key Test Data */
  592. static const unsigned char des3_3key_key[24] = {
  593. /* Key1 */
  594. 0x01, 0x23, 0x45, 0x67, 0x89, 0xaa, 0xcd, 0xef,
  595. /* Key2 */
  596. 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01,
  597. /* Key3 */
  598. 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23
  599. };
  600. static const unsigned char des3_3key_subkeys[2][8] = {
  601. {
  602. /* K1 */
  603. 0x9d, 0x74, 0xe7, 0x39, 0x33, 0x17, 0x96, 0xc0
  604. },
  605. {
  606. /* K2 */
  607. 0x3a, 0xe9, 0xce, 0x72, 0x66, 0x2f, 0x2d, 0x9b
  608. }
  609. };
  610. static const unsigned char des3_3key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE] = {
  611. {
  612. /* Sample #1 */
  613. 0x7d, 0xb0, 0xd3, 0x7d, 0xf9, 0x36, 0xc5, 0x50
  614. },
  615. {
  616. /* Sample #2 */
  617. 0x30, 0x23, 0x9c, 0xf1, 0xf5, 0x2e, 0x66, 0x09
  618. },
  619. {
  620. /* Sample #3 */
  621. 0x6c, 0x9f, 0x3e, 0xe4, 0x92, 0x3f, 0x6b, 0xe2
  622. },
  623. {
  624. /* Sample #4 */
  625. 0x99, 0x42, 0x9b, 0xd0, 0xbF, 0x79, 0x04, 0xe5
  626. }
  627. };
  628. #endif /* MBEDTLS_DES_C */
  629. #if defined(MBEDTLS_AES_C)
  630. /* AES AES-CMAC-PRF-128 Test Data */
  631. static const unsigned char PRFK[] = {
  632. /* Key */
  633. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  634. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  635. 0xed, 0xcb
  636. };
  637. /* Sizes in bytes */
  638. static const size_t PRFKlen[NB_PRF_TESTS] = {
  639. 18,
  640. 16,
  641. 10
  642. };
  643. /* Message */
  644. static const unsigned char PRFM[] = {
  645. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  646. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  647. 0x10, 0x11, 0x12, 0x13
  648. };
  649. static const unsigned char PRFT[NB_PRF_TESTS][16] = {
  650. {
  651. 0x84, 0xa3, 0x48, 0xa4, 0xa4, 0x5d, 0x23, 0x5b,
  652. 0xab, 0xff, 0xfc, 0x0d, 0x2b, 0x4d, 0xa0, 0x9a
  653. },
  654. {
  655. 0x98, 0x0a, 0xe8, 0x7b, 0x5f, 0x4c, 0x9c, 0x52,
  656. 0x14, 0xf5, 0xb6, 0xa8, 0x45, 0x5e, 0x4c, 0x2d
  657. },
  658. {
  659. 0x29, 0x0d, 0x9e, 0x11, 0x2e, 0xdb, 0x09, 0xee,
  660. 0x14, 0x1f, 0xcf, 0x64, 0xc0, 0xb7, 0x2f, 0x3d
  661. }
  662. };
  663. #endif /* MBEDTLS_AES_C */
  664. static int cmac_test_subkeys( int verbose,
  665. const char* testname,
  666. const unsigned char* key,
  667. int keybits,
  668. const unsigned char* subkeys,
  669. mbedtls_cipher_type_t cipher_type,
  670. int block_size,
  671. int num_tests )
  672. {
  673. int i, ret = 0;
  674. mbedtls_cipher_context_t ctx;
  675. const mbedtls_cipher_info_t *cipher_info;
  676. unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
  677. unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
  678. cipher_info = mbedtls_cipher_info_from_type( cipher_type );
  679. if( cipher_info == NULL )
  680. {
  681. /* Failing at this point must be due to a build issue */
  682. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  683. }
  684. for( i = 0; i < num_tests; i++ )
  685. {
  686. if( verbose != 0 )
  687. mbedtls_printf( " %s CMAC subkey #%u: ", testname, i + 1 );
  688. mbedtls_cipher_init( &ctx );
  689. if( ( ret = mbedtls_cipher_setup( &ctx, cipher_info ) ) != 0 )
  690. {
  691. if( verbose != 0 )
  692. mbedtls_printf( "test execution failed\n" );
  693. goto cleanup;
  694. }
  695. if( ( ret = mbedtls_cipher_setkey( &ctx, key, keybits,
  696. MBEDTLS_ENCRYPT ) ) != 0 )
  697. {
  698. if( verbose != 0 )
  699. mbedtls_printf( "test execution failed\n" );
  700. goto cleanup;
  701. }
  702. ret = cmac_generate_subkeys( &ctx, K1, K2 );
  703. if( ret != 0 )
  704. {
  705. if( verbose != 0 )
  706. mbedtls_printf( "failed\n" );
  707. goto cleanup;
  708. }
  709. if( ( ret = memcmp( K1, subkeys, block_size ) ) != 0 ||
  710. ( ret = memcmp( K2, &subkeys[block_size], block_size ) ) != 0 )
  711. {
  712. if( verbose != 0 )
  713. mbedtls_printf( "failed\n" );
  714. goto cleanup;
  715. }
  716. if( verbose != 0 )
  717. mbedtls_printf( "passed\n" );
  718. mbedtls_cipher_free( &ctx );
  719. }
  720. ret = 0;
  721. goto exit;
  722. cleanup:
  723. mbedtls_cipher_free( &ctx );
  724. exit:
  725. return( ret );
  726. }
  727. static int cmac_test_wth_cipher( int verbose,
  728. const char* testname,
  729. const unsigned char* key,
  730. int keybits,
  731. const unsigned char* messages,
  732. const unsigned int message_lengths[4],
  733. const unsigned char* expected_result,
  734. mbedtls_cipher_type_t cipher_type,
  735. int block_size,
  736. int num_tests )
  737. {
  738. const mbedtls_cipher_info_t *cipher_info;
  739. int i, ret = 0;
  740. unsigned char output[MBEDTLS_CIPHER_BLKSIZE_MAX];
  741. cipher_info = mbedtls_cipher_info_from_type( cipher_type );
  742. if( cipher_info == NULL )
  743. {
  744. /* Failing at this point must be due to a build issue */
  745. ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
  746. goto exit;
  747. }
  748. for( i = 0; i < num_tests; i++ )
  749. {
  750. if( verbose != 0 )
  751. mbedtls_printf( " %s CMAC #%u: ", testname, i + 1 );
  752. if( ( ret = mbedtls_cipher_cmac( cipher_info, key, keybits, messages,
  753. message_lengths[i], output ) ) != 0 )
  754. {
  755. if( verbose != 0 )
  756. mbedtls_printf( "failed\n" );
  757. goto exit;
  758. }
  759. if( ( ret = memcmp( output, &expected_result[i * block_size], block_size ) ) != 0 )
  760. {
  761. if( verbose != 0 )
  762. mbedtls_printf( "failed\n" );
  763. goto exit;
  764. }
  765. if( verbose != 0 )
  766. mbedtls_printf( "passed\n" );
  767. }
  768. ret = 0;
  769. exit:
  770. return( ret );
  771. }
  772. #if defined(MBEDTLS_AES_C)
  773. static int test_aes128_cmac_prf( int verbose )
  774. {
  775. int i;
  776. int ret;
  777. unsigned char output[MBEDTLS_AES_BLOCK_SIZE];
  778. for( i = 0; i < NB_PRF_TESTS; i++ )
  779. {
  780. mbedtls_printf( " AES CMAC 128 PRF #%u: ", i );
  781. ret = mbedtls_aes_cmac_prf_128( PRFK, PRFKlen[i], PRFM, 20, output );
  782. if( ret != 0 ||
  783. memcmp( output, PRFT[i], MBEDTLS_AES_BLOCK_SIZE ) != 0 )
  784. {
  785. if( verbose != 0 )
  786. mbedtls_printf( "failed\n" );
  787. return( ret );
  788. }
  789. else if( verbose != 0 )
  790. {
  791. mbedtls_printf( "passed\n" );
  792. }
  793. }
  794. return( ret );
  795. }
  796. #endif /* MBEDTLS_AES_C */
  797. int mbedtls_cmac_self_test( int verbose )
  798. {
  799. int ret;
  800. #if defined(MBEDTLS_AES_C)
  801. /* AES-128 */
  802. if( ( ret = cmac_test_subkeys( verbose,
  803. "AES 128",
  804. aes_128_key,
  805. 128,
  806. (const unsigned char*)aes_128_subkeys,
  807. MBEDTLS_CIPHER_AES_128_ECB,
  808. MBEDTLS_AES_BLOCK_SIZE,
  809. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  810. {
  811. return( ret );
  812. }
  813. if( ( ret = cmac_test_wth_cipher( verbose,
  814. "AES 128",
  815. aes_128_key,
  816. 128,
  817. test_message,
  818. aes_message_lengths,
  819. (const unsigned char*)aes_128_expected_result,
  820. MBEDTLS_CIPHER_AES_128_ECB,
  821. MBEDTLS_AES_BLOCK_SIZE,
  822. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  823. {
  824. return( ret );
  825. }
  826. /* AES-192 */
  827. if( ( ret = cmac_test_subkeys( verbose,
  828. "AES 192",
  829. aes_192_key,
  830. 192,
  831. (const unsigned char*)aes_192_subkeys,
  832. MBEDTLS_CIPHER_AES_192_ECB,
  833. MBEDTLS_AES_BLOCK_SIZE,
  834. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  835. {
  836. return( ret );
  837. }
  838. if( ( ret = cmac_test_wth_cipher( verbose,
  839. "AES 192",
  840. aes_192_key,
  841. 192,
  842. test_message,
  843. aes_message_lengths,
  844. (const unsigned char*)aes_192_expected_result,
  845. MBEDTLS_CIPHER_AES_192_ECB,
  846. MBEDTLS_AES_BLOCK_SIZE,
  847. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  848. {
  849. return( ret );
  850. }
  851. /* AES-256 */
  852. if( ( ret = cmac_test_subkeys( verbose,
  853. "AES 256",
  854. aes_256_key,
  855. 256,
  856. (const unsigned char*)aes_256_subkeys,
  857. MBEDTLS_CIPHER_AES_256_ECB,
  858. MBEDTLS_AES_BLOCK_SIZE,
  859. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  860. {
  861. return( ret );
  862. }
  863. if( ( ret = cmac_test_wth_cipher ( verbose,
  864. "AES 256",
  865. aes_256_key,
  866. 256,
  867. test_message,
  868. aes_message_lengths,
  869. (const unsigned char*)aes_256_expected_result,
  870. MBEDTLS_CIPHER_AES_256_ECB,
  871. MBEDTLS_AES_BLOCK_SIZE,
  872. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  873. {
  874. return( ret );
  875. }
  876. #endif /* MBEDTLS_AES_C */
  877. #if defined(MBEDTLS_DES_C)
  878. /* 3DES 2 key */
  879. if( ( ret = cmac_test_subkeys( verbose,
  880. "3DES 2 key",
  881. des3_2key_key,
  882. 192,
  883. (const unsigned char*)des3_2key_subkeys,
  884. MBEDTLS_CIPHER_DES_EDE3_ECB,
  885. MBEDTLS_DES3_BLOCK_SIZE,
  886. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  887. {
  888. return( ret );
  889. }
  890. if( ( ret = cmac_test_wth_cipher( verbose,
  891. "3DES 2 key",
  892. des3_2key_key,
  893. 192,
  894. test_message,
  895. des3_message_lengths,
  896. (const unsigned char*)des3_2key_expected_result,
  897. MBEDTLS_CIPHER_DES_EDE3_ECB,
  898. MBEDTLS_DES3_BLOCK_SIZE,
  899. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  900. {
  901. return( ret );
  902. }
  903. /* 3DES 3 key */
  904. if( ( ret = cmac_test_subkeys( verbose,
  905. "3DES 3 key",
  906. des3_3key_key,
  907. 192,
  908. (const unsigned char*)des3_3key_subkeys,
  909. MBEDTLS_CIPHER_DES_EDE3_ECB,
  910. MBEDTLS_DES3_BLOCK_SIZE,
  911. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  912. {
  913. return( ret );
  914. }
  915. if( ( ret = cmac_test_wth_cipher( verbose,
  916. "3DES 3 key",
  917. des3_3key_key,
  918. 192,
  919. test_message,
  920. des3_message_lengths,
  921. (const unsigned char*)des3_3key_expected_result,
  922. MBEDTLS_CIPHER_DES_EDE3_ECB,
  923. MBEDTLS_DES3_BLOCK_SIZE,
  924. NB_CMAC_TESTS_PER_KEY ) ) != 0 )
  925. {
  926. return( ret );
  927. }
  928. #endif /* MBEDTLS_DES_C */
  929. #if defined(MBEDTLS_AES_C)
  930. if( ( ret = test_aes128_cmac_prf( verbose ) ) != 0 )
  931. return( ret );
  932. #endif /* MBEDTLS_AES_C */
  933. if( verbose != 0 )
  934. mbedtls_printf( "\n" );
  935. return( 0 );
  936. }
  937. #endif /* MBEDTLS_SELF_TEST */
  938. #endif /* MBEDTLS_CMAC_C */