1e28a4053SRui Paulo /* 2*5b9c547cSRui Paulo * AES key unwrap (RFC3394) 3e28a4053SRui Paulo * 4e28a4053SRui Paulo * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi> 5e28a4053SRui Paulo * 6f05cddf9SRui Paulo * This software may be distributed under the terms of the BSD license. 7f05cddf9SRui Paulo * See README for more details. 8e28a4053SRui Paulo */ 9e28a4053SRui Paulo 10e28a4053SRui Paulo #include "includes.h" 11e28a4053SRui Paulo 12e28a4053SRui Paulo #include "common.h" 13e28a4053SRui Paulo #include "aes.h" 14e28a4053SRui Paulo #include "aes_wrap.h" 15e28a4053SRui Paulo 16e28a4053SRui Paulo /** 17*5b9c547cSRui Paulo * aes_unwrap - Unwrap key with AES Key Wrap Algorithm (RFC3394) 18e28a4053SRui Paulo * @kek: Key encryption key (KEK) 19*5b9c547cSRui Paulo * @kek_len: Length of KEK in octets 20e28a4053SRui Paulo * @n: Length of the plaintext key in 64-bit units; e.g., 2 = 128-bit = 16 21e28a4053SRui Paulo * bytes 22e28a4053SRui Paulo * @cipher: Wrapped key to be unwrapped, (n + 1) * 64 bits 23e28a4053SRui Paulo * @plain: Plaintext key, n * 64 bits 24e28a4053SRui Paulo * Returns: 0 on success, -1 on failure (e.g., integrity verification failed) 25e28a4053SRui Paulo */ 26*5b9c547cSRui Paulo int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, 27*5b9c547cSRui Paulo u8 *plain) 28e28a4053SRui Paulo { 29*5b9c547cSRui Paulo u8 a[8], *r, b[AES_BLOCK_SIZE]; 30e28a4053SRui Paulo int i, j; 31e28a4053SRui Paulo void *ctx; 32*5b9c547cSRui Paulo unsigned int t; 33e28a4053SRui Paulo 34e28a4053SRui Paulo /* 1) Initialize variables. */ 35e28a4053SRui Paulo os_memcpy(a, cipher, 8); 36e28a4053SRui Paulo r = plain; 37e28a4053SRui Paulo os_memcpy(r, cipher + 8, 8 * n); 38e28a4053SRui Paulo 39*5b9c547cSRui Paulo ctx = aes_decrypt_init(kek, kek_len); 40e28a4053SRui Paulo if (ctx == NULL) 41e28a4053SRui Paulo return -1; 42e28a4053SRui Paulo 43e28a4053SRui Paulo /* 2) Compute intermediate values. 44e28a4053SRui Paulo * For j = 5 to 0 45e28a4053SRui Paulo * For i = n to 1 46e28a4053SRui Paulo * B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i 47e28a4053SRui Paulo * A = MSB(64, B) 48e28a4053SRui Paulo * R[i] = LSB(64, B) 49e28a4053SRui Paulo */ 50e28a4053SRui Paulo for (j = 5; j >= 0; j--) { 51e28a4053SRui Paulo r = plain + (n - 1) * 8; 52e28a4053SRui Paulo for (i = n; i >= 1; i--) { 53e28a4053SRui Paulo os_memcpy(b, a, 8); 54*5b9c547cSRui Paulo t = n * j + i; 55*5b9c547cSRui Paulo b[7] ^= t; 56*5b9c547cSRui Paulo b[6] ^= t >> 8; 57*5b9c547cSRui Paulo b[5] ^= t >> 16; 58*5b9c547cSRui Paulo b[4] ^= t >> 24; 59e28a4053SRui Paulo 60e28a4053SRui Paulo os_memcpy(b + 8, r, 8); 61e28a4053SRui Paulo aes_decrypt(ctx, b, b); 62e28a4053SRui Paulo os_memcpy(a, b, 8); 63e28a4053SRui Paulo os_memcpy(r, b + 8, 8); 64e28a4053SRui Paulo r -= 8; 65e28a4053SRui Paulo } 66e28a4053SRui Paulo } 67e28a4053SRui Paulo aes_decrypt_deinit(ctx); 68e28a4053SRui Paulo 69e28a4053SRui Paulo /* 3) Output results. 70e28a4053SRui Paulo * 71e28a4053SRui Paulo * These are already in @plain due to the location of temporary 72e28a4053SRui Paulo * variables. Just verify that the IV matches with the expected value. 73e28a4053SRui Paulo */ 74e28a4053SRui Paulo for (i = 0; i < 8; i++) { 75e28a4053SRui Paulo if (a[i] != 0xa6) 76e28a4053SRui Paulo return -1; 77e28a4053SRui Paulo } 78e28a4053SRui Paulo 79e28a4053SRui Paulo return 0; 80e28a4053SRui Paulo } 81