crypto.c (79c0949e9a09f6a14a6dd18dc8396029423f9b68) crypto.c (65492c5a6ab5df5091a77562dbcca2d2dc3877c0)
1// SPDX-License-Identifier: GPL-2.0
2/* Multipath TCP cryptographic functions
3 * Copyright (c) 2017 - 2019, Intel Corporation.
4 *
5 * Note: This code is based on mptcp_ctrl.c, mptcp_ipv4.c, and
6 * mptcp_ipv6 from multipath-tcp.org, authored by:
7 *
8 * Sébastien Barré <sebastien.barre@uclouvain.be>

--- 7 unchanged lines hidden (view full) ---

16 * Vlad Dogaru <vlad.dogaru@intel.com>
17 * Octavian Purdila <octavian.purdila@intel.com>
18 * John Ronan <jronan@tssg.org>
19 * Catalin Nicutar <catalin.nicutar@gmail.com>
20 * Brandon Heller <brandonh@stanford.edu>
21 */
22
23#include <linux/kernel.h>
1// SPDX-License-Identifier: GPL-2.0
2/* Multipath TCP cryptographic functions
3 * Copyright (c) 2017 - 2019, Intel Corporation.
4 *
5 * Note: This code is based on mptcp_ctrl.c, mptcp_ipv4.c, and
6 * mptcp_ipv6 from multipath-tcp.org, authored by:
7 *
8 * Sébastien Barré <sebastien.barre@uclouvain.be>

--- 7 unchanged lines hidden (view full) ---

16 * Vlad Dogaru <vlad.dogaru@intel.com>
17 * Octavian Purdila <octavian.purdila@intel.com>
18 * John Ronan <jronan@tssg.org>
19 * Catalin Nicutar <catalin.nicutar@gmail.com>
20 * Brandon Heller <brandonh@stanford.edu>
21 */
22
23#include <linux/kernel.h>
24#include <linux/cryptohash.h>
24#include <crypto/sha.h>
25#include <asm/unaligned.h>
26
27#include "protocol.h"
28
25#include <asm/unaligned.h>
26
27#include "protocol.h"
28
29struct sha1_state {
30 u32 workspace[SHA_WORKSPACE_WORDS];
31 u32 digest[SHA_DIGEST_WORDS];
32 unsigned int count;
33};
29#define SHA256_DIGEST_WORDS (SHA256_DIGEST_SIZE / 4)
34
30
35static void sha1_init(struct sha1_state *state)
36{
37 sha_init(state->digest);
38 state->count = 0;
39}
40
41static void sha1_update(struct sha1_state *state, u8 *input)
42{
43 sha_transform(state->digest, input, state->workspace);
44 state->count += SHA_MESSAGE_BYTES;
45}
46
47static void sha1_pad_final(struct sha1_state *state, u8 *input,
48 unsigned int length, __be32 *mptcp_hashed_key)
49{
50 int i;
51
52 input[length] = 0x80;
53 memset(&input[length + 1], 0, SHA_MESSAGE_BYTES - length - 9);
54 put_unaligned_be64((length + state->count) << 3,
55 &input[SHA_MESSAGE_BYTES - 8]);
56
57 sha_transform(state->digest, input, state->workspace);
58 for (i = 0; i < SHA_DIGEST_WORDS; ++i)
59 put_unaligned_be32(state->digest[i], &mptcp_hashed_key[i]);
60
61 memzero_explicit(state->workspace, SHA_WORKSPACE_WORDS << 2);
62}
63
64void mptcp_crypto_key_sha(u64 key, u32 *token, u64 *idsn)
65{
31void mptcp_crypto_key_sha(u64 key, u32 *token, u64 *idsn)
32{
66 __be32 mptcp_hashed_key[SHA_DIGEST_WORDS];
67 u8 input[SHA_MESSAGE_BYTES];
68 struct sha1_state state;
33 __be32 mptcp_hashed_key[SHA256_DIGEST_WORDS];
34 __be64 input = cpu_to_be64(key);
35 struct sha256_state state;
69
36
70 sha1_init(&state);
71 put_unaligned_be64(key, input);
72 sha1_pad_final(&state, input, 8, mptcp_hashed_key);
37 sha256_init(&state);
38 sha256_update(&state, (__force u8 *)&input, sizeof(input));
39 sha256_final(&state, (u8 *)mptcp_hashed_key);
73
74 if (token)
75 *token = be32_to_cpu(mptcp_hashed_key[0]);
76 if (idsn)
40
41 if (token)
42 *token = be32_to_cpu(mptcp_hashed_key[0]);
43 if (idsn)
77 *idsn = be64_to_cpu(*((__be64 *)&mptcp_hashed_key[3]));
44 *idsn = be64_to_cpu(*((__be64 *)&mptcp_hashed_key[6]));
78}
79
80void mptcp_crypto_hmac_sha(u64 key1, u64 key2, u32 nonce1, u32 nonce2,
45}
46
47void mptcp_crypto_hmac_sha(u64 key1, u64 key2, u32 nonce1, u32 nonce2,
81 u32 *hash_out)
48 void *hmac)
82{
49{
83 u8 input[SHA_MESSAGE_BYTES * 2];
84 struct sha1_state state;
50 u8 input[SHA256_BLOCK_SIZE + SHA256_DIGEST_SIZE];
51 __be32 mptcp_hashed_key[SHA256_DIGEST_WORDS];
52 __be32 *hash_out = (__force __be32 *)hmac;
53 struct sha256_state state;
85 u8 key1be[8];
86 u8 key2be[8];
87 int i;
88
89 put_unaligned_be64(key1, key1be);
90 put_unaligned_be64(key2, key2be);
91
92 /* Generate key xored with ipad */
93 memset(input, 0x36, SHA_MESSAGE_BYTES);
94 for (i = 0; i < 8; i++)
95 input[i] ^= key1be[i];
96 for (i = 0; i < 8; i++)
97 input[i + 8] ^= key2be[i];
98
54 u8 key1be[8];
55 u8 key2be[8];
56 int i;
57
58 put_unaligned_be64(key1, key1be);
59 put_unaligned_be64(key2, key2be);
60
61 /* Generate key xored with ipad */
62 memset(input, 0x36, SHA_MESSAGE_BYTES);
63 for (i = 0; i < 8; i++)
64 input[i] ^= key1be[i];
65 for (i = 0; i < 8; i++)
66 input[i + 8] ^= key2be[i];
67
99 put_unaligned_be32(nonce1, &input[SHA_MESSAGE_BYTES]);
100 put_unaligned_be32(nonce2, &input[SHA_MESSAGE_BYTES + 4]);
68 put_unaligned_be32(nonce1, &input[SHA256_BLOCK_SIZE]);
69 put_unaligned_be32(nonce2, &input[SHA256_BLOCK_SIZE + 4]);
101
70
102 sha1_init(&state);
103 sha1_update(&state, input);
71 sha256_init(&state);
72 sha256_update(&state, input, SHA256_BLOCK_SIZE + 8);
104
105 /* emit sha256(K1 || msg) on the second input block, so we can
106 * reuse 'input' for the last hashing
107 */
73
74 /* emit sha256(K1 || msg) on the second input block, so we can
75 * reuse 'input' for the last hashing
76 */
108 sha1_pad_final(&state, &input[SHA_MESSAGE_BYTES], 8,
109 (__force __be32 *)&input[SHA_MESSAGE_BYTES]);
77 sha256_final(&state, &input[SHA256_BLOCK_SIZE]);
110
111 /* Prepare second part of hmac */
112 memset(input, 0x5C, SHA_MESSAGE_BYTES);
113 for (i = 0; i < 8; i++)
114 input[i] ^= key1be[i];
115 for (i = 0; i < 8; i++)
116 input[i + 8] ^= key2be[i];
117
78
79 /* Prepare second part of hmac */
80 memset(input, 0x5C, SHA_MESSAGE_BYTES);
81 for (i = 0; i < 8; i++)
82 input[i] ^= key1be[i];
83 for (i = 0; i < 8; i++)
84 input[i + 8] ^= key2be[i];
85
118 sha1_init(&state);
119 sha1_update(&state, input);
120 sha1_pad_final(&state, &input[SHA_MESSAGE_BYTES], SHA_DIGEST_WORDS << 2,
121 (__be32 *)hash_out);
86 sha256_init(&state);
87 sha256_update(&state, input, SHA256_BLOCK_SIZE + SHA256_DIGEST_SIZE);
88 sha256_final(&state, (u8 *)mptcp_hashed_key);
89
90 /* takes only first 160 bits */
91 for (i = 0; i < 5; i++)
92 hash_out[i] = mptcp_hashed_key[i];
122}
93}
94
95#ifdef CONFIG_MPTCP_HMAC_TEST
96struct test_cast {
97 char *key;
98 char *msg;
99 char *result;
100};
101
102/* we can't reuse RFC 4231 test vectors, as we have constraint on the
103 * input and key size, and we truncate the output.
104 */
105static struct test_cast tests[] = {
106 {
107 .key = "0b0b0b0b0b0b0b0b",
108 .msg = "48692054",
109 .result = "8385e24fb4235ac37556b6b886db106284a1da67",
110 },
111 {
112 .key = "aaaaaaaaaaaaaaaa",
113 .msg = "dddddddd",
114 .result = "2c5e219164ff1dca1c4a92318d847bb6b9d44492",
115 },
116 {
117 .key = "0102030405060708",
118 .msg = "cdcdcdcd",
119 .result = "e73b9ba9969969cefb04aa0d6df18ec2fcc075b6",
120 },
121};
122
123static int __init test_mptcp_crypto(void)
124{
125 char hmac[20], hmac_hex[41];
126 u32 nonce1, nonce2;
127 u64 key1, key2;
128 int i, j;
129
130 for (i = 0; i < ARRAY_SIZE(tests); ++i) {
131 /* mptcp hmap will convert to be before computing the hmac */
132 key1 = be64_to_cpu(*((__be64 *)&tests[i].key[0]));
133 key2 = be64_to_cpu(*((__be64 *)&tests[i].key[8]));
134 nonce1 = be32_to_cpu(*((__be32 *)&tests[i].msg[0]));
135 nonce2 = be32_to_cpu(*((__be32 *)&tests[i].msg[4]));
136
137 mptcp_crypto_hmac_sha(key1, key2, nonce1, nonce2, hmac);
138 for (j = 0; j < 20; ++j)
139 sprintf(&hmac_hex[j << 1], "%02x", hmac[j] & 0xff);
140 hmac_hex[40] = 0;
141
142 if (memcmp(hmac_hex, tests[i].result, 40))
143 pr_err("test %d failed, got %s expected %s", i,
144 hmac_hex, tests[i].result);
145 else
146 pr_info("test %d [ ok ]", i);
147 }
148 return 0;
149}
150
151late_initcall(test_mptcp_crypto);
152#endif