1/*
2 * AES-128 EAX
3 *
4 * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * Alternatively, this software may be distributed under the terms of BSD
11 * license.
12 *
13 * See README and COPYING for more details.
14 */
15
16#include "includes.h"
17
18#include "common.h"
19#include "aes.h"
20#include "aes_wrap.h"
21
22/**
23 * aes_128_eax_encrypt - AES-128 EAX mode encryption
24 * @key: Key for encryption (16 bytes)
25 * @nonce: Nonce for counter mode
26 * @nonce_len: Nonce length in bytes
27 * @hdr: Header data to be authenticity protected
28 * @hdr_len: Length of the header data bytes
29 * @data: Data to encrypt in-place
30 * @data_len: Length of data in bytes
31 * @tag: 16-byte tag value
32 * Returns: 0 on success, -1 on failure
33 */
34int aes_128_eax_encrypt(const u8 *key, const u8 *nonce, size_t nonce_len,
35			const u8 *hdr, size_t hdr_len,
36			u8 *data, size_t data_len, u8 *tag)
37{
38	u8 *buf;
39	size_t buf_len;
40	u8 nonce_mac[AES_BLOCK_SIZE], hdr_mac[AES_BLOCK_SIZE],
41		data_mac[AES_BLOCK_SIZE];
42	int i, ret = -1;
43
44	if (nonce_len > data_len)
45		buf_len = nonce_len;
46	else
47		buf_len = data_len;
48	if (hdr_len > buf_len)
49		buf_len = hdr_len;
50	buf_len += 16;
51
52	buf = os_malloc(buf_len);
53	if (buf == NULL)
54		return -1;
55
56	os_memset(buf, 0, 15);
57
58	buf[15] = 0;
59	os_memcpy(buf + 16, nonce, nonce_len);
60	if (omac1_aes_128(key, buf, 16 + nonce_len, nonce_mac))
61		goto fail;
62
63	buf[15] = 1;
64	os_memcpy(buf + 16, hdr, hdr_len);
65	if (omac1_aes_128(key, buf, 16 + hdr_len, hdr_mac))
66		goto fail;
67
68	if (aes_128_ctr_encrypt(key, nonce_mac, data, data_len))
69		goto fail;
70	buf[15] = 2;
71	os_memcpy(buf + 16, data, data_len);
72	if (omac1_aes_128(key, buf, 16 + data_len, data_mac))
73		goto fail;
74
75	for (i = 0; i < AES_BLOCK_SIZE; i++)
76		tag[i] = nonce_mac[i] ^ data_mac[i] ^ hdr_mac[i];
77
78	ret = 0;
79fail:
80	os_free(buf);
81
82	return ret;
83}
84
85
86/**
87 * aes_128_eax_decrypt - AES-128 EAX mode decryption
88 * @key: Key for decryption (16 bytes)
89 * @nonce: Nonce for counter mode
90 * @nonce_len: Nonce length in bytes
91 * @hdr: Header data to be authenticity protected
92 * @hdr_len: Length of the header data bytes
93 * @data: Data to encrypt in-place
94 * @data_len: Length of data in bytes
95 * @tag: 16-byte tag value
96 * Returns: 0 on success, -1 on failure, -2 if tag does not match
97 */
98int aes_128_eax_decrypt(const u8 *key, const u8 *nonce, size_t nonce_len,
99			const u8 *hdr, size_t hdr_len,
100			u8 *data, size_t data_len, const u8 *tag)
101{
102	u8 *buf;
103	size_t buf_len;
104	u8 nonce_mac[AES_BLOCK_SIZE], hdr_mac[AES_BLOCK_SIZE],
105		data_mac[AES_BLOCK_SIZE];
106	int i;
107
108	if (nonce_len > data_len)
109		buf_len = nonce_len;
110	else
111		buf_len = data_len;
112	if (hdr_len > buf_len)
113		buf_len = hdr_len;
114	buf_len += 16;
115
116	buf = os_malloc(buf_len);
117	if (buf == NULL)
118		return -1;
119
120	os_memset(buf, 0, 15);
121
122	buf[15] = 0;
123	os_memcpy(buf + 16, nonce, nonce_len);
124	if (omac1_aes_128(key, buf, 16 + nonce_len, nonce_mac)) {
125		os_free(buf);
126		return -1;
127	}
128
129	buf[15] = 1;
130	os_memcpy(buf + 16, hdr, hdr_len);
131	if (omac1_aes_128(key, buf, 16 + hdr_len, hdr_mac)) {
132		os_free(buf);
133		return -1;
134	}
135
136	buf[15] = 2;
137	os_memcpy(buf + 16, data, data_len);
138	if (omac1_aes_128(key, buf, 16 + data_len, data_mac)) {
139		os_free(buf);
140		return -1;
141	}
142
143	os_free(buf);
144
145	for (i = 0; i < AES_BLOCK_SIZE; i++) {
146		if (tag[i] != (nonce_mac[i] ^ data_mac[i] ^ hdr_mac[i]))
147			return -2;
148	}
149
150	return aes_128_ctr_encrypt(key, nonce_mac, data, data_len);
151}
152