1 /* 2 * One-key CBC MAC (OMAC1) hash with AES 3 * 4 * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi> 5 * 6 * This software may be distributed under the terms of the BSD license. 7 * See README for more details. 8 */ 9 10 #include "includes.h" 11 12 #include "common.h" 13 #include "aes.h" 14 #include "aes_wrap.h" 15 16 static void gf_mulx(u8 *pad) 17 { 18 int i, carry; 19 20 carry = pad[0] & 0x80; 21 for (i = 0; i < AES_BLOCK_SIZE - 1; i++) 22 pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7); 23 pad[AES_BLOCK_SIZE - 1] <<= 1; 24 if (carry) 25 pad[AES_BLOCK_SIZE - 1] ^= 0x87; 26 } 27 28 29 /** 30 * omac1_aes_vector - One-Key CBC MAC (OMAC1) hash with AES 31 * @key: Key for the hash operation 32 * @key_len: Key length in octets 33 * @num_elem: Number of elements in the data vector 34 * @addr: Pointers to the data areas 35 * @len: Lengths of the data blocks 36 * @mac: Buffer for MAC (128 bits, i.e., 16 bytes) 37 * Returns: 0 on success, -1 on failure 38 * 39 * This is a mode for using block cipher (AES in this case) for authentication. 40 * OMAC1 was standardized with the name CMAC by NIST in a Special Publication 41 * (SP) 800-38B. 42 */ 43 int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem, 44 const u8 *addr[], const size_t *len, u8 *mac) 45 { 46 void *ctx; 47 u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE]; 48 const u8 *pos, *end; 49 size_t i, e, left, total_len; 50 51 ctx = aes_encrypt_init(key, key_len); 52 if (ctx == NULL) 53 return -1; 54 os_memset(cbc, 0, AES_BLOCK_SIZE); 55 56 total_len = 0; 57 for (e = 0; e < num_elem; e++) 58 total_len += len[e]; 59 left = total_len; 60 61 e = 0; 62 pos = addr[0]; 63 end = pos + len[0]; 64 65 while (left >= AES_BLOCK_SIZE) { 66 for (i = 0; i < AES_BLOCK_SIZE; i++) { 67 cbc[i] ^= *pos++; 68 if (pos >= end) { 69 /* 70 * Stop if there are no more bytes to process 71 * since there are no more entries in the array. 72 */ 73 if (i + 1 == AES_BLOCK_SIZE && 74 left == AES_BLOCK_SIZE) 75 break; 76 e++; 77 pos = addr[e]; 78 end = pos + len[e]; 79 } 80 } 81 if (left > AES_BLOCK_SIZE) 82 aes_encrypt(ctx, cbc, cbc); 83 left -= AES_BLOCK_SIZE; 84 } 85 86 os_memset(pad, 0, AES_BLOCK_SIZE); 87 aes_encrypt(ctx, pad, pad); 88 gf_mulx(pad); 89 90 if (left || total_len == 0) { 91 for (i = 0; i < left; i++) { 92 cbc[i] ^= *pos++; 93 if (pos >= end) { 94 /* 95 * Stop if there are no more bytes to process 96 * since there are no more entries in the array. 97 */ 98 if (i + 1 == left) 99 break; 100 e++; 101 pos = addr[e]; 102 end = pos + len[e]; 103 } 104 } 105 cbc[left] ^= 0x80; 106 gf_mulx(pad); 107 } 108 109 for (i = 0; i < AES_BLOCK_SIZE; i++) 110 pad[i] ^= cbc[i]; 111 aes_encrypt(ctx, pad, mac); 112 aes_encrypt_deinit(ctx); 113 return 0; 114 } 115 116 117 /** 118 * omac1_aes_128_vector - One-Key CBC MAC (OMAC1) hash with AES-128 119 * @key: 128-bit key for the hash operation 120 * @num_elem: Number of elements in the data vector 121 * @addr: Pointers to the data areas 122 * @len: Lengths of the data blocks 123 * @mac: Buffer for MAC (128 bits, i.e., 16 bytes) 124 * Returns: 0 on success, -1 on failure 125 * 126 * This is a mode for using block cipher (AES in this case) for authentication. 127 * OMAC1 was standardized with the name CMAC by NIST in a Special Publication 128 * (SP) 800-38B. 129 */ 130 int omac1_aes_128_vector(const u8 *key, size_t num_elem, 131 const u8 *addr[], const size_t *len, u8 *mac) 132 { 133 return omac1_aes_vector(key, 16, num_elem, addr, len, mac); 134 } 135 136 137 /** 138 * omac1_aes_128 - One-Key CBC MAC (OMAC1) hash with AES-128 (aka AES-CMAC) 139 * @key: 128-bit key for the hash operation 140 * @data: Data buffer for which a MAC is determined 141 * @data_len: Length of data buffer in bytes 142 * @mac: Buffer for MAC (128 bits, i.e., 16 bytes) 143 * Returns: 0 on success, -1 on failure 144 * 145 * This is a mode for using block cipher (AES in this case) for authentication. 146 * OMAC1 was standardized with the name CMAC by NIST in a Special Publication 147 * (SP) 800-38B. 148 */ 149 int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac) 150 { 151 return omac1_aes_128_vector(key, 1, &data, &data_len, mac); 152 } 153 154 155 /** 156 * omac1_aes_256 - One-Key CBC MAC (OMAC1) hash with AES-256 (aka AES-CMAC) 157 * @key: 256-bit key for the hash operation 158 * @data: Data buffer for which a MAC is determined 159 * @data_len: Length of data buffer in bytes 160 * @mac: Buffer for MAC (128 bits, i.e., 16 bytes) 161 * Returns: 0 on success, -1 on failure 162 * 163 * This is a mode for using block cipher (AES in this case) for authentication. 164 * OMAC1 was standardized with the name CMAC by NIST in a Special Publication 165 * (SP) 800-38B. 166 */ 167 int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac) 168 { 169 return omac1_aes_vector(key, 32, 1, &data, &data_len, mac); 170 } 171