Move AES-GCM implementation into src/crypto

This is a generic AES GCM and GMAC implementation that can be used for
other purposes than just implementing GCMP, so it fits better in a
separate file in src/crypto.

Signed-hostap: Jouni Malinen <j@w1.fi>

src/crypto/Makefile

@@ -19,6 +19,7 @@ LIB_OBJS= \
 	aes-ctr.o \
 	aes-eax.o \
 	aes-encblock.o \
+	aes-gcm.o \
 	aes-internal.o \
 	aes-internal-dec.o \
 	aes-internal-enc.o \

src/crypto/aes-gcm.c

@@ -0,0 +1,291 @@
+/*
+ * Galois/Counter Mode (GCM) and GMAC with AES-128
+ *
+ * Copyright (c) 2012, Jouni Malinen <j@w1.fi>
+ *
+ * This software may be distributed under the terms of the BSD license.
+ * See README for more details.
+ */
+
+#include "includes.h"
+
+#include "common.h"
+#include "aes.h"
+#include "aes_wrap.h"
+
+static void inc32(u8 *block)
+{
+	u32 val;
+	val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4);
+	val++;
+	WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val);
+}
+
+
+static void xor_block(u8 *dst, const u8 *src)
+{
+	u32 *d = (u32 *) dst;
+	u32 *s = (u32 *) src;
+	*d++ ^= *s++;
+	*d++ ^= *s++;
+	*d++ ^= *s++;
+	*d++ ^= *s++;
+}
+
+
+static void shift_right_block(u8 *v)
+{
+	u32 val;
+
+	val = WPA_GET_BE32(v + 12);
+	val >>= 1;
+	if (v[11] & 0x01)
+		val |= 0x80000000;
+	WPA_PUT_BE32(v + 12, val);
+
+	val = WPA_GET_BE32(v + 8);
+	val >>= 1;
+	if (v[7] & 0x01)
+		val |= 0x80000000;
+	WPA_PUT_BE32(v + 8, val);
+
+	val = WPA_GET_BE32(v + 4);
+	val >>= 1;
+	if (v[3] & 0x01)
+		val |= 0x80000000;
+	WPA_PUT_BE32(v + 4, val);
+
+	val = WPA_GET_BE32(v);
+	val >>= 1;
+	WPA_PUT_BE32(v, val);
+}
+
+
+/* Multiplication in GF(2^128) */
+static void gf_mult(const u8 *x, const u8 *y, u8 *z)
+{
+	u8 v[16];
+	int i, j;
+
+	os_memset(z, 0, 16); /* Z_0 = 0^128 */
+	os_memcpy(v, y, 16); /* V_0 = Y */
+
+	for (i = 0; i < 16; i++) {
+		for (j = 0; j < 8; j++) {
+			if (x[i] & BIT(7 - j)) {
+				/* Z_(i + 1) = Z_i XOR V_i */
+				xor_block(z, v);
+			} else {
+				/* Z_(i + 1) = Z_i */
+			}
+
+			if (v[15] & 0x01) {
+				/* V_(i + 1) = (V_i >> 1) XOR R */
+				shift_right_block(v);
+				/* R = 11100001 || 0^120 */
+				v[0] ^= 0xe1;
+			} else {
+				/* V_(i + 1) = V_i >> 1 */
+				shift_right_block(v);
+			}
+		}
+	}
+}
+
+
+static void ghash_start(u8 *y)
+{
+	/* Y_0 = 0^128 */
+	os_memset(y, 0, 16);
+}
+
+
+static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y)
+{
+	size_t m, i;
+	const u8 *xpos = x;
+	u8 tmp[16];
+
+	m = xlen / 16;
+
+	for (i = 0; i < m; i++) {
+		/* Y_i = (Y^(i-1) XOR X_i) dot H */
+		xor_block(y, xpos);
+		xpos += 16;
+
+		/* dot operation:
+		 * multiplication operation for binary Galois (finite) field of
+		 * 2^128 elements */
+		gf_mult(y, h, tmp);
+		os_memcpy(y, tmp, 16);
+	}
+
+	if (x + xlen > xpos) {
+		/* Add zero padded last block */
+		size_t last = x + xlen - xpos;
+		os_memcpy(tmp, xpos, last);
+		os_memset(tmp + last, 0, sizeof(tmp) - last);
+
+		/* Y_i = (Y^(i-1) XOR X_i) dot H */
+		xor_block(y, tmp);
+
+		/* dot operation:
+		 * multiplication operation for binary Galois (finite) field of
+		 * 2^128 elements */
+		gf_mult(y, h, tmp);
+		os_memcpy(y, tmp, 16);
+	}
+
+	/* Return Y_m */
+}
+
+
+static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
+{
+	size_t i, n, last;
+	u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE];
+	const u8 *xpos = x;
+	u8 *ypos = y;
+
+	if (xlen == 0)
+		return;
+
+	n = xlen / 16;
+
+	os_memcpy(cb, icb, AES_BLOCK_SIZE);
+	/* Full blocks */
+	for (i = 0; i < n; i++) {
+		aes_encrypt(aes, cb, ypos);
+		xor_block(ypos, xpos);
+		xpos += AES_BLOCK_SIZE;
+		ypos += AES_BLOCK_SIZE;
+		inc32(cb);
+	}
+
+	last = x + xlen - xpos;
+	if (last) {
+		/* Last, partial block */
+		aes_encrypt(aes, cb, tmp);
+		for (i = 0; i < last; i++)
+			*ypos++ = *xpos++ ^ tmp[i];
+	}
+}
+
+
+/**
+ * aes_128_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96
+ */
+int aes_128_gcm_ae(const u8 *key, const u8 *iv,
+		   const u8 *plain, size_t plain_len,
+		   const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
+{
+	u8 H[AES_BLOCK_SIZE];
+	u8 J0[AES_BLOCK_SIZE];
+	u8 S[16], len_buf[16];
+	void *aes;
+	size_t iv_len = 12;
+
+	aes = aes_encrypt_init(key, 16);
+	if (aes == NULL)
+		return -1;
+
+	/* 1. Generate hash subkey H = AES_K(0^128) */
+	os_memset(H, 0, sizeof(H));
+	aes_encrypt(aes, H, H);
+	wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
+
+	/* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
+	os_memcpy(J0, iv, iv_len);
+	os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
+	J0[AES_BLOCK_SIZE - 1] = 0x01;
+
+	/* 3. C = GCTR_K(inc_32(J_0), P) */
+	inc32(J0);
+	aes_gctr(aes, J0, plain, plain_len, crypt);
+
+	/*
+	 * 4. u = 128 * ceil[len(C)/128] - len(C)
+	 *    v = 128 * ceil[len(A)/128] - len(A)
+	 * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
+	 * (i.e., zero padded to block size A || C and lengths of each in bits)
+	 */
+	ghash_start(S);
+	ghash(H, aad, aad_len, S);
+	ghash(H, crypt, plain_len, S);
+	WPA_PUT_BE64(len_buf, aad_len * 8);
+	WPA_PUT_BE64(len_buf + 8, plain_len * 8);
+	ghash(H, len_buf, sizeof(len_buf), S);
+
+	wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
+
+	/* 6. T = MSB_t(GCTR_K(J_0, S)) */
+	J0[AES_BLOCK_SIZE - 1] = 0x01;
+	aes_gctr(aes, J0, S, sizeof(S), tag);
+
+	/* 7. Return (C, T) */
+
+	aes_encrypt_deinit(aes);
+
+	return 0;
+}
+
+
+/**
+ * aes_128_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96
+ */
+int aes_128_gcm_ad(const u8 *key, const u8 *iv,
+		   const u8 *crypt, size_t crypt_len,
+		   const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain)
+{
+	u8 H[AES_BLOCK_SIZE];
+	u8 J0[AES_BLOCK_SIZE];
+	u8 S[16], T[16], len_buf[16];
+	void *aes;
+	size_t iv_len = 12;
+
+	aes = aes_encrypt_init(key, 16);
+	if (aes == NULL)
+		return -1;
+
+	/* 2. Generate hash subkey H = AES_K(0^128) */
+	os_memset(H, 0, sizeof(H));
+	aes_encrypt(aes, H, H);
+	wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
+
+	/* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
+	os_memcpy(J0, iv, iv_len);
+	os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
+	J0[AES_BLOCK_SIZE - 1] = 0x01;
+
+	/* 4. C = GCTR_K(inc_32(J_0), C) */
+	inc32(J0);
+	aes_gctr(aes, J0, crypt, crypt_len, plain);
+
+	/*
+	 * 5. u = 128 * ceil[len(C)/128] - len(C)
+	 *    v = 128 * ceil[len(A)/128] - len(A)
+	 * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
+	 * (i.e., zero padded to block size A || C and lengths of each in bits)
+	 */
+	ghash_start(S);
+	ghash(H, aad, aad_len, S);
+	ghash(H, crypt, crypt_len, S);
+	WPA_PUT_BE64(len_buf, aad_len * 8);
+	WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
+	ghash(H, len_buf, sizeof(len_buf), S);
+
+	wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
+
+	/* 7. T' = MSB_t(GCTR_K(J_0, S)) */
+	J0[AES_BLOCK_SIZE - 1] = 0x01;
+	aes_gctr(aes, J0, S, sizeof(S), T);
+
+	aes_encrypt_deinit(aes);
+
+	if (os_memcmp(tag, T, 16) != 0) {
+		wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
+		return -1;
+	}
+
+	return 0;
+}

src/crypto/aes_wrap.h

@@ -6,8 +6,9 @@
  * - AES-128 CTR mode encryption
  * - AES-128 EAX mode encryption/decryption
  * - AES-128 CBC
+ * - AES-128 GCM
  *
- * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
+ * Copyright (c) 2003-2012, Jouni Malinen <j@w1.fi>
  *
  * This software may be distributed under the terms of the BSD license.
  * See README for more details.
@@ -38,5 +39,13 @@ int __must_check aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data,
 				     size_t data_len);
 int __must_check aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data,
 				     size_t data_len);
+int __must_check aes_128_gcm_ae(const u8 *key, const u8 *iv,
+				const u8 *plain, size_t plain_len,
+				const u8 *aad, size_t aad_len,
+				u8 *crypt, u8 *tag);
+int __must_check  aes_128_gcm_ad(const u8 *key, const u8 *iv,
+				 const u8 *crypt, size_t crypt_len,
+				 const u8 *aad, size_t aad_len, const u8 *tag,
+				 u8 *plain);
 
 #endif /* AES_WRAP_H */

wlantest/gcmp.c

@@ -11,289 +11,10 @@
 #include "utils/common.h"
 #include "common/ieee802_11_defs.h"
 #include "crypto/aes.h"
+#include "crypto/aes_wrap.h"
 #include "wlantest.h"
 
 
-static void inc32(u8 *block)
-{
-	u32 val;
-	val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4);
-	val++;
-	WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val);
-}
-
-
-static void xor_block(u8 *dst, const u8 *src)
-{
-	u32 *d = (u32 *) dst;
-	u32 *s = (u32 *) src;
-	*d++ ^= *s++;
-	*d++ ^= *s++;
-	*d++ ^= *s++;
-	*d++ ^= *s++;
-}
-
-
-static void shift_right_block(u8 *v)
-{
-	u32 val;
-
-	val = WPA_GET_BE32(v + 12);
-	val >>= 1;
-	if (v[11] & 0x01)
-		val |= 0x80000000;
-	WPA_PUT_BE32(v + 12, val);
-
-	val = WPA_GET_BE32(v + 8);
-	val >>= 1;
-	if (v[7] & 0x01)
-		val |= 0x80000000;
-	WPA_PUT_BE32(v + 8, val);
-
-	val = WPA_GET_BE32(v + 4);
-	val >>= 1;
-	if (v[3] & 0x01)
-		val |= 0x80000000;
-	WPA_PUT_BE32(v + 4, val);
-
-	val = WPA_GET_BE32(v);
-	val >>= 1;
-	WPA_PUT_BE32(v, val);
-}
-
-
-/* Multiplication in GF(2^128) */
-static void gf_mult(const u8 *x, const u8 *y, u8 *z)
-{
-	u8 v[16];
-	int i, j;
-
-	os_memset(z, 0, 16); /* Z_0 = 0^128 */
-	os_memcpy(v, y, 16); /* V_0 = Y */
-
-	for (i = 0; i < 16; i++) {
-		for (j = 0; j < 8; j++) {
-			if (x[i] & BIT(7 - j)) {
-				/* Z_(i + 1) = Z_i XOR V_i */
-				xor_block(z, v);
-			} else {
-				/* Z_(i + 1) = Z_i */
-			}
-
-			if (v[15] & 0x01) {
-				/* V_(i + 1) = (V_i >> 1) XOR R */
-				shift_right_block(v);
-				/* R = 11100001 || 0^120 */
-				v[0] ^= 0xe1;
-			} else {
-				/* V_(i + 1) = V_i >> 1 */
-				shift_right_block(v);
-			}
-		}
-	}
-}
-
-
-static void ghash_start(u8 *y)
-{
-	/* Y_0 = 0^128 */
-	os_memset(y, 0, 16);
-}
-
-
-static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y)
-{
-	size_t m, i;
-	const u8 *xpos = x;
-	u8 tmp[16];
-
-	m = xlen / 16;
-
-	for (i = 0; i < m; i++) {
-		/* Y_i = (Y^(i-1) XOR X_i) dot H */
-		xor_block(y, xpos);
-		xpos += 16;
-
-		/* dot operation:
-		 * multiplication operation for binary Galois (finite) field of
-		 * 2^128 elements */
-		gf_mult(y, h, tmp);
-		os_memcpy(y, tmp, 16);
-	}
-
-	if (x + xlen > xpos) {
-		/* Add zero padded last block */
-		size_t last = x + xlen - xpos;
-		os_memcpy(tmp, xpos, last);
-		os_memset(tmp + last, 0, sizeof(tmp) - last);
-
-		/* Y_i = (Y^(i-1) XOR X_i) dot H */
-		xor_block(y, tmp);
-
-		/* dot operation:
-		 * multiplication operation for binary Galois (finite) field of
-		 * 2^128 elements */
-		gf_mult(y, h, tmp);
-		os_memcpy(y, tmp, 16);
-	}
-
-	/* Return Y_m */
-}
-
-
-static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
-{
-	size_t i, n, last;
-	u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE];
-	const u8 *xpos = x;
-	u8 *ypos = y;
-
-	if (xlen == 0)
-		return;
-
-	n = xlen / 16;
-
-	os_memcpy(cb, icb, AES_BLOCK_SIZE);
-	/* Full blocks */
-	for (i = 0; i < n; i++) {
-		aes_encrypt(aes, cb, ypos);
-		xor_block(ypos, xpos);
-		xpos += AES_BLOCK_SIZE;
-		ypos += AES_BLOCK_SIZE;
-		inc32(cb);
-	}
-
-	last = x + xlen - xpos;
-	if (last) {
-		/* Last, partial block */
-		aes_encrypt(aes, cb, tmp);
-		for (i = 0; i < last; i++)
-			*ypos++ = *xpos++ ^ tmp[i];
-	}
-}
-
-
-/**
- * aes_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96
- */
-static int aes_gcm_ae(const u8 *key, const u8 *iv,
-		      const u8 *plain, size_t plain_len,
-		      const u8 *aad, size_t aad_len,
-		      u8 *crypt, u8 *tag)
-{
-	u8 H[AES_BLOCK_SIZE];
-	u8 J0[AES_BLOCK_SIZE];
-	u8 S[16], len_buf[16];
-	void *aes;
-	size_t iv_len = 12;
-
-	aes = aes_encrypt_init(key, 16);
-	if (aes == NULL)
-		return -1;
-
-	/* 1. Generate hash subkey H = AES_K(0^128) */
-	os_memset(H, 0, sizeof(H));
-	aes_encrypt(aes, H, H);
-	wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
-
-	/* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
-	os_memcpy(J0, iv, iv_len);
-	os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
-	J0[AES_BLOCK_SIZE - 1] = 0x01;
-
-	/* 3. C = GCTR_K(inc_32(J_0), P) */
-	inc32(J0);
-	aes_gctr(aes, J0, plain, plain_len, crypt);
-
-	/*
-	 * 4. u = 128 * ceil[len(C)/128] - len(C)
-	 *    v = 128 * ceil[len(A)/128] - len(A)
-	 * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
-	 * (i.e., zero padded to block size A || C and lengths of each in bits)
-	 */
-	ghash_start(S);
-	ghash(H, aad, aad_len, S);
-	ghash(H, crypt, plain_len, S);
-	WPA_PUT_BE64(len_buf, aad_len * 8);
-	WPA_PUT_BE64(len_buf + 8, plain_len * 8);
-	ghash(H, len_buf, sizeof(len_buf), S);
-
-	wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
-
-	/* 6. T = MSB_t(GCTR_K(J_0, S)) */
-	J0[AES_BLOCK_SIZE - 1] = 0x01;
-	aes_gctr(aes, J0, S, sizeof(S), tag);
-
-	/* 7. Return (C, T) */
-
-	aes_encrypt_deinit(aes);
-
-	return 0;
-}
-
-
-/**
- * aes_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96
- */
-static int aes_gcm_ad(const u8 *key, const u8 *iv,
-		      const u8 *crypt, size_t crypt_len,
-		      const u8 *aad, size_t aad_len, const u8 *tag,
-		      u8 *plain)
-{
-	u8 H[AES_BLOCK_SIZE];
-	u8 J0[AES_BLOCK_SIZE];
-	u8 S[16], T[16], len_buf[16];
-	void *aes;
-	size_t iv_len = 12;
-
-	aes = aes_encrypt_init(key, 16);
-	if (aes == NULL)
-		return -1;
-
-	/* 2. Generate hash subkey H = AES_K(0^128) */
-	os_memset(H, 0, sizeof(H));
-	aes_encrypt(aes, H, H);
-	wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
-
-	/* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
-	os_memcpy(J0, iv, iv_len);
-	os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
-	J0[AES_BLOCK_SIZE - 1] = 0x01;
-
-	/* 4. C = GCTR_K(inc_32(J_0), C) */
-	inc32(J0);
-	aes_gctr(aes, J0, crypt, crypt_len, plain);
-
-	/*
-	 * 5. u = 128 * ceil[len(C)/128] - len(C)
-	 *    v = 128 * ceil[len(A)/128] - len(A)
-	 * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
-	 * (i.e., zero padded to block size A || C and lengths of each in bits)
-	 */
-	ghash_start(S);
-	ghash(H, aad, aad_len, S);
-	ghash(H, crypt, crypt_len, S);
-	WPA_PUT_BE64(len_buf, aad_len * 8);
-	WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
-	ghash(H, len_buf, sizeof(len_buf), S);
-
-	wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
-
-	/* 7. T' = MSB_t(GCTR_K(J_0, S)) */
-	J0[AES_BLOCK_SIZE - 1] = 0x01;
-	aes_gctr(aes, J0, S, sizeof(S), T);
-
-	aes_encrypt_deinit(aes);
-
-	if (os_memcmp(tag, T, 16) != 0) {
-		wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
-		return -1;
-	}
-
-	return 0;
-}
-
-
 static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data,
 			   u8 *aad, size_t *aad_len, u8 *nonce)
 {
@@ -374,7 +95,7 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr,
 	wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len);
 	wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
 
-	if (aes_gcm_ad(tk, nonce, m, mlen, aad, aad_len, m + mlen, plain) <
+	if (aes_128_gcm_ad(tk, nonce, m, mlen, aad, aad_len, m + mlen, plain) <
 	    0) {
 		u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
 		wpa_printf(MSG_INFO, "Invalid GCMP frame: A1=" MACSTR
@@ -425,7 +146,7 @@ u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos,
 	wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len);
 	wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
 
-	if (aes_gcm_ae(tk, nonce, frame + hdrlen, plen, aad, aad_len,
+	if (aes_128_gcm_ae(tk, nonce, frame + hdrlen, plen, aad, aad_len,
 		       pos, pos + plen) < 0) {
 		os_free(crypt);
 		return NULL;