1*e28a4053SRui Paulo /* 2*e28a4053SRui Paulo * AES Key Wrap Algorithm (128-bit KEK) (RFC3394) 3*e28a4053SRui Paulo * 4*e28a4053SRui Paulo * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi> 5*e28a4053SRui Paulo * 6*e28a4053SRui Paulo * This program is free software; you can redistribute it and/or modify 7*e28a4053SRui Paulo * it under the terms of the GNU General Public License version 2 as 8*e28a4053SRui Paulo * published by the Free Software Foundation. 9*e28a4053SRui Paulo * 10*e28a4053SRui Paulo * Alternatively, this software may be distributed under the terms of BSD 11*e28a4053SRui Paulo * license. 12*e28a4053SRui Paulo * 13*e28a4053SRui Paulo * See README and COPYING for more details. 14*e28a4053SRui Paulo */ 15*e28a4053SRui Paulo 16*e28a4053SRui Paulo #include "includes.h" 17*e28a4053SRui Paulo 18*e28a4053SRui Paulo #include "common.h" 19*e28a4053SRui Paulo #include "aes.h" 20*e28a4053SRui Paulo #include "aes_wrap.h" 21*e28a4053SRui Paulo 22*e28a4053SRui Paulo /** 23*e28a4053SRui Paulo * aes_wrap - Wrap keys with AES Key Wrap Algorithm (128-bit KEK) (RFC3394) 24*e28a4053SRui Paulo * @kek: 16-octet Key encryption key (KEK) 25*e28a4053SRui Paulo * @n: Length of the plaintext key in 64-bit units; e.g., 2 = 128-bit = 16 26*e28a4053SRui Paulo * bytes 27*e28a4053SRui Paulo * @plain: Plaintext key to be wrapped, n * 64 bits 28*e28a4053SRui Paulo * @cipher: Wrapped key, (n + 1) * 64 bits 29*e28a4053SRui Paulo * Returns: 0 on success, -1 on failure 30*e28a4053SRui Paulo */ 31*e28a4053SRui Paulo int aes_wrap(const u8 *kek, int n, const u8 *plain, u8 *cipher) 32*e28a4053SRui Paulo { 33*e28a4053SRui Paulo u8 *a, *r, b[16]; 34*e28a4053SRui Paulo int i, j; 35*e28a4053SRui Paulo void *ctx; 36*e28a4053SRui Paulo 37*e28a4053SRui Paulo a = cipher; 38*e28a4053SRui Paulo r = cipher + 8; 39*e28a4053SRui Paulo 40*e28a4053SRui Paulo /* 1) Initialize variables. */ 41*e28a4053SRui Paulo os_memset(a, 0xa6, 8); 42*e28a4053SRui Paulo os_memcpy(r, plain, 8 * n); 43*e28a4053SRui Paulo 44*e28a4053SRui Paulo ctx = aes_encrypt_init(kek, 16); 45*e28a4053SRui Paulo if (ctx == NULL) 46*e28a4053SRui Paulo return -1; 47*e28a4053SRui Paulo 48*e28a4053SRui Paulo /* 2) Calculate intermediate values. 49*e28a4053SRui Paulo * For j = 0 to 5 50*e28a4053SRui Paulo * For i=1 to n 51*e28a4053SRui Paulo * B = AES(K, A | R[i]) 52*e28a4053SRui Paulo * A = MSB(64, B) ^ t where t = (n*j)+i 53*e28a4053SRui Paulo * R[i] = LSB(64, B) 54*e28a4053SRui Paulo */ 55*e28a4053SRui Paulo for (j = 0; j <= 5; j++) { 56*e28a4053SRui Paulo r = cipher + 8; 57*e28a4053SRui Paulo for (i = 1; i <= n; i++) { 58*e28a4053SRui Paulo os_memcpy(b, a, 8); 59*e28a4053SRui Paulo os_memcpy(b + 8, r, 8); 60*e28a4053SRui Paulo aes_encrypt(ctx, b, b); 61*e28a4053SRui Paulo os_memcpy(a, b, 8); 62*e28a4053SRui Paulo a[7] ^= n * j + i; 63*e28a4053SRui Paulo os_memcpy(r, b + 8, 8); 64*e28a4053SRui Paulo r += 8; 65*e28a4053SRui Paulo } 66*e28a4053SRui Paulo } 67*e28a4053SRui Paulo aes_encrypt_deinit(ctx); 68*e28a4053SRui Paulo 69*e28a4053SRui Paulo /* 3) Output the results. 70*e28a4053SRui Paulo * 71*e28a4053SRui Paulo * These are already in @cipher due to the location of temporary 72*e28a4053SRui Paulo * variables. 73*e28a4053SRui Paulo */ 74*e28a4053SRui Paulo 75*e28a4053SRui Paulo return 0; 76*e28a4053SRui Paulo } 77