1*e28a4053SRui Paulo /* 2*e28a4053SRui Paulo * AES key unwrap (128-bit KEK, RFC3394) 3*e28a4053SRui Paulo * 4*e28a4053SRui Paulo * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi> 5*e28a4053SRui Paulo * 6*e28a4053SRui Paulo * This program is free software; you can redistribute it and/or modify 7*e28a4053SRui Paulo * it under the terms of the GNU General Public License version 2 as 8*e28a4053SRui Paulo * published by the Free Software Foundation. 9*e28a4053SRui Paulo * 10*e28a4053SRui Paulo * Alternatively, this software may be distributed under the terms of BSD 11*e28a4053SRui Paulo * license. 12*e28a4053SRui Paulo * 13*e28a4053SRui Paulo * See README and COPYING for more details. 14*e28a4053SRui Paulo */ 15*e28a4053SRui Paulo 16*e28a4053SRui Paulo #include "includes.h" 17*e28a4053SRui Paulo 18*e28a4053SRui Paulo #include "common.h" 19*e28a4053SRui Paulo #include "aes.h" 20*e28a4053SRui Paulo #include "aes_wrap.h" 21*e28a4053SRui Paulo 22*e28a4053SRui Paulo /** 23*e28a4053SRui Paulo * aes_unwrap - Unwrap key with AES Key Wrap Algorithm (128-bit KEK) (RFC3394) 24*e28a4053SRui Paulo * @kek: Key encryption key (KEK) 25*e28a4053SRui Paulo * @n: Length of the plaintext key in 64-bit units; e.g., 2 = 128-bit = 16 26*e28a4053SRui Paulo * bytes 27*e28a4053SRui Paulo * @cipher: Wrapped key to be unwrapped, (n + 1) * 64 bits 28*e28a4053SRui Paulo * @plain: Plaintext key, n * 64 bits 29*e28a4053SRui Paulo * Returns: 0 on success, -1 on failure (e.g., integrity verification failed) 30*e28a4053SRui Paulo */ 31*e28a4053SRui Paulo int aes_unwrap(const u8 *kek, int n, const u8 *cipher, u8 *plain) 32*e28a4053SRui Paulo { 33*e28a4053SRui Paulo u8 a[8], *r, b[16]; 34*e28a4053SRui Paulo int i, j; 35*e28a4053SRui Paulo void *ctx; 36*e28a4053SRui Paulo 37*e28a4053SRui Paulo /* 1) Initialize variables. */ 38*e28a4053SRui Paulo os_memcpy(a, cipher, 8); 39*e28a4053SRui Paulo r = plain; 40*e28a4053SRui Paulo os_memcpy(r, cipher + 8, 8 * n); 41*e28a4053SRui Paulo 42*e28a4053SRui Paulo ctx = aes_decrypt_init(kek, 16); 43*e28a4053SRui Paulo if (ctx == NULL) 44*e28a4053SRui Paulo return -1; 45*e28a4053SRui Paulo 46*e28a4053SRui Paulo /* 2) Compute intermediate values. 47*e28a4053SRui Paulo * For j = 5 to 0 48*e28a4053SRui Paulo * For i = n to 1 49*e28a4053SRui Paulo * B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i 50*e28a4053SRui Paulo * A = MSB(64, B) 51*e28a4053SRui Paulo * R[i] = LSB(64, B) 52*e28a4053SRui Paulo */ 53*e28a4053SRui Paulo for (j = 5; j >= 0; j--) { 54*e28a4053SRui Paulo r = plain + (n - 1) * 8; 55*e28a4053SRui Paulo for (i = n; i >= 1; i--) { 56*e28a4053SRui Paulo os_memcpy(b, a, 8); 57*e28a4053SRui Paulo b[7] ^= n * j + i; 58*e28a4053SRui Paulo 59*e28a4053SRui Paulo os_memcpy(b + 8, r, 8); 60*e28a4053SRui Paulo aes_decrypt(ctx, b, b); 61*e28a4053SRui Paulo os_memcpy(a, b, 8); 62*e28a4053SRui Paulo os_memcpy(r, b + 8, 8); 63*e28a4053SRui Paulo r -= 8; 64*e28a4053SRui Paulo } 65*e28a4053SRui Paulo } 66*e28a4053SRui Paulo aes_decrypt_deinit(ctx); 67*e28a4053SRui Paulo 68*e28a4053SRui Paulo /* 3) Output results. 69*e28a4053SRui Paulo * 70*e28a4053SRui Paulo * These are already in @plain due to the location of temporary 71*e28a4053SRui Paulo * variables. Just verify that the IV matches with the expected value. 72*e28a4053SRui Paulo */ 73*e28a4053SRui Paulo for (i = 0; i < 8; i++) { 74*e28a4053SRui Paulo if (a[i] != 0xa6) 75*e28a4053SRui Paulo return -1; 76*e28a4053SRui Paulo } 77*e28a4053SRui Paulo 78*e28a4053SRui Paulo return 0; 79*e28a4053SRui Paulo } 80