1e28a4053SRui Paulo /* 2*5b9c547cSRui Paulo * AES Key Wrap Algorithm (RFC3394) 3e28a4053SRui Paulo * 4e28a4053SRui Paulo * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi> 5e28a4053SRui Paulo * 6f05cddf9SRui Paulo * This software may be distributed under the terms of the BSD license. 7f05cddf9SRui Paulo * See README for more details. 8e28a4053SRui Paulo */ 9e28a4053SRui Paulo 10e28a4053SRui Paulo #include "includes.h" 11e28a4053SRui Paulo 12e28a4053SRui Paulo #include "common.h" 13e28a4053SRui Paulo #include "aes.h" 14e28a4053SRui Paulo #include "aes_wrap.h" 15e28a4053SRui Paulo 16e28a4053SRui Paulo /** 17*5b9c547cSRui Paulo * aes_wrap - Wrap keys with AES Key Wrap Algorithm (RFC3394) 18*5b9c547cSRui Paulo * @kek: Key encryption key (KEK) 19*5b9c547cSRui Paulo * @kek_len: Length of KEK in octets 20e28a4053SRui Paulo * @n: Length of the plaintext key in 64-bit units; e.g., 2 = 128-bit = 16 21e28a4053SRui Paulo * bytes 22e28a4053SRui Paulo * @plain: Plaintext key to be wrapped, n * 64 bits 23e28a4053SRui Paulo * @cipher: Wrapped key, (n + 1) * 64 bits 24e28a4053SRui Paulo * Returns: 0 on success, -1 on failure 25e28a4053SRui Paulo */ 26*5b9c547cSRui Paulo int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher) 27e28a4053SRui Paulo { 28*5b9c547cSRui Paulo u8 *a, *r, b[AES_BLOCK_SIZE]; 29e28a4053SRui Paulo int i, j; 30e28a4053SRui Paulo void *ctx; 31*5b9c547cSRui Paulo unsigned int t; 32e28a4053SRui Paulo 33e28a4053SRui Paulo a = cipher; 34e28a4053SRui Paulo r = cipher + 8; 35e28a4053SRui Paulo 36e28a4053SRui Paulo /* 1) Initialize variables. */ 37e28a4053SRui Paulo os_memset(a, 0xa6, 8); 38e28a4053SRui Paulo os_memcpy(r, plain, 8 * n); 39e28a4053SRui Paulo 40*5b9c547cSRui Paulo ctx = aes_encrypt_init(kek, kek_len); 41e28a4053SRui Paulo if (ctx == NULL) 42e28a4053SRui Paulo return -1; 43e28a4053SRui Paulo 44e28a4053SRui Paulo /* 2) Calculate intermediate values. 45e28a4053SRui Paulo * For j = 0 to 5 46e28a4053SRui Paulo * For i=1 to n 47e28a4053SRui Paulo * B = AES(K, A | R[i]) 48e28a4053SRui Paulo * A = MSB(64, B) ^ t where t = (n*j)+i 49e28a4053SRui Paulo * R[i] = LSB(64, B) 50e28a4053SRui Paulo */ 51e28a4053SRui Paulo for (j = 0; j <= 5; j++) { 52e28a4053SRui Paulo r = cipher + 8; 53e28a4053SRui Paulo for (i = 1; i <= n; i++) { 54e28a4053SRui Paulo os_memcpy(b, a, 8); 55e28a4053SRui Paulo os_memcpy(b + 8, r, 8); 56e28a4053SRui Paulo aes_encrypt(ctx, b, b); 57e28a4053SRui Paulo os_memcpy(a, b, 8); 58*5b9c547cSRui Paulo t = n * j + i; 59*5b9c547cSRui Paulo a[7] ^= t; 60*5b9c547cSRui Paulo a[6] ^= t >> 8; 61*5b9c547cSRui Paulo a[5] ^= t >> 16; 62*5b9c547cSRui Paulo a[4] ^= t >> 24; 63e28a4053SRui Paulo os_memcpy(r, b + 8, 8); 64e28a4053SRui Paulo r += 8; 65e28a4053SRui Paulo } 66e28a4053SRui Paulo } 67e28a4053SRui Paulo aes_encrypt_deinit(ctx); 68e28a4053SRui Paulo 69e28a4053SRui Paulo /* 3) Output the results. 70e28a4053SRui Paulo * 71e28a4053SRui Paulo * These are already in @cipher due to the location of temporary 72e28a4053SRui Paulo * variables. 73e28a4053SRui Paulo */ 74e28a4053SRui Paulo 75e28a4053SRui Paulo return 0; 76e28a4053SRui Paulo } 77