1214501Srpaulo/* 2214501Srpaulo * One-key CBC MAC (OMAC1) hash with AES-128 3214501Srpaulo * 4214501Srpaulo * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi> 5214501Srpaulo * 6214501Srpaulo * This program is free software; you can redistribute it and/or modify 7214501Srpaulo * it under the terms of the GNU General Public License version 2 as 8214501Srpaulo * published by the Free Software Foundation. 9214501Srpaulo * 10214501Srpaulo * Alternatively, this software may be distributed under the terms of BSD 11214501Srpaulo * license. 12214501Srpaulo * 13214501Srpaulo * See README and COPYING for more details. 14214501Srpaulo */ 15214501Srpaulo 16214501Srpaulo#include "includes.h" 17214501Srpaulo 18214501Srpaulo#include "common.h" 19214501Srpaulo#include "aes.h" 20214501Srpaulo#include "aes_wrap.h" 21214501Srpaulo 22214501Srpaulostatic void gf_mulx(u8 *pad) 23214501Srpaulo{ 24214501Srpaulo int i, carry; 25214501Srpaulo 26214501Srpaulo carry = pad[0] & 0x80; 27214501Srpaulo for (i = 0; i < AES_BLOCK_SIZE - 1; i++) 28214501Srpaulo pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7); 29214501Srpaulo pad[AES_BLOCK_SIZE - 1] <<= 1; 30214501Srpaulo if (carry) 31214501Srpaulo pad[AES_BLOCK_SIZE - 1] ^= 0x87; 32214501Srpaulo} 33214501Srpaulo 34214501Srpaulo 35214501Srpaulo/** 36214501Srpaulo * omac1_aes_128_vector - One-Key CBC MAC (OMAC1) hash with AES-128 37214501Srpaulo * @key: 128-bit key for the hash operation 38214501Srpaulo * @num_elem: Number of elements in the data vector 39214501Srpaulo * @addr: Pointers to the data areas 40214501Srpaulo * @len: Lengths of the data blocks 41214501Srpaulo * @mac: Buffer for MAC (128 bits, i.e., 16 bytes) 42214501Srpaulo * Returns: 0 on success, -1 on failure 43214501Srpaulo * 44214501Srpaulo * This is a mode for using block cipher (AES in this case) for authentication. 45214501Srpaulo * OMAC1 was standardized with the name CMAC by NIST in a Special Publication 46214501Srpaulo * (SP) 800-38B. 47214501Srpaulo */ 48214501Srpauloint omac1_aes_128_vector(const u8 *key, size_t num_elem, 49214501Srpaulo const u8 *addr[], const size_t *len, u8 *mac) 50214501Srpaulo{ 51214501Srpaulo void *ctx; 52214501Srpaulo u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE]; 53214501Srpaulo const u8 *pos, *end; 54214501Srpaulo size_t i, e, left, total_len; 55214501Srpaulo 56214501Srpaulo ctx = aes_encrypt_init(key, 16); 57214501Srpaulo if (ctx == NULL) 58214501Srpaulo return -1; 59214501Srpaulo os_memset(cbc, 0, AES_BLOCK_SIZE); 60214501Srpaulo 61214501Srpaulo total_len = 0; 62214501Srpaulo for (e = 0; e < num_elem; e++) 63214501Srpaulo total_len += len[e]; 64214501Srpaulo left = total_len; 65214501Srpaulo 66214501Srpaulo e = 0; 67214501Srpaulo pos = addr[0]; 68214501Srpaulo end = pos + len[0]; 69214501Srpaulo 70214501Srpaulo while (left >= AES_BLOCK_SIZE) { 71214501Srpaulo for (i = 0; i < AES_BLOCK_SIZE; i++) { 72214501Srpaulo cbc[i] ^= *pos++; 73214501Srpaulo if (pos >= end) { 74214501Srpaulo e++; 75214501Srpaulo pos = addr[e]; 76214501Srpaulo end = pos + len[e]; 77214501Srpaulo } 78214501Srpaulo } 79214501Srpaulo if (left > AES_BLOCK_SIZE) 80214501Srpaulo aes_encrypt(ctx, cbc, cbc); 81214501Srpaulo left -= AES_BLOCK_SIZE; 82214501Srpaulo } 83214501Srpaulo 84214501Srpaulo os_memset(pad, 0, AES_BLOCK_SIZE); 85214501Srpaulo aes_encrypt(ctx, pad, pad); 86214501Srpaulo gf_mulx(pad); 87214501Srpaulo 88214501Srpaulo if (left || total_len == 0) { 89214501Srpaulo for (i = 0; i < left; i++) { 90214501Srpaulo cbc[i] ^= *pos++; 91214501Srpaulo if (pos >= end) { 92214501Srpaulo e++; 93214501Srpaulo pos = addr[e]; 94214501Srpaulo end = pos + len[e]; 95214501Srpaulo } 96214501Srpaulo } 97214501Srpaulo cbc[left] ^= 0x80; 98214501Srpaulo gf_mulx(pad); 99214501Srpaulo } 100214501Srpaulo 101214501Srpaulo for (i = 0; i < AES_BLOCK_SIZE; i++) 102214501Srpaulo pad[i] ^= cbc[i]; 103214501Srpaulo aes_encrypt(ctx, pad, mac); 104214501Srpaulo aes_encrypt_deinit(ctx); 105214501Srpaulo return 0; 106214501Srpaulo} 107214501Srpaulo 108214501Srpaulo 109214501Srpaulo/** 110214501Srpaulo * omac1_aes_128 - One-Key CBC MAC (OMAC1) hash with AES-128 (aka AES-CMAC) 111214501Srpaulo * @key: 128-bit key for the hash operation 112214501Srpaulo * @data: Data buffer for which a MAC is determined 113214501Srpaulo * @data_len: Length of data buffer in bytes 114214501Srpaulo * @mac: Buffer for MAC (128 bits, i.e., 16 bytes) 115214501Srpaulo * Returns: 0 on success, -1 on failure 116214501Srpaulo * 117214501Srpaulo * This is a mode for using block cipher (AES in this case) for authentication. 118214501Srpaulo * OMAC1 was standardized with the name CMAC by NIST in a Special Publication 119214501Srpaulo * (SP) 800-38B. 120214501Srpaulo */ 121214501Srpauloint omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac) 122214501Srpaulo{ 123214501Srpaulo return omac1_aes_128_vector(key, 1, &data, &data_len, mac); 124214501Srpaulo} 125