1 /******************************************************************************
3 * Copyright (C) 2008-2012 Broadcom Corporation
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
17 ******************************************************************************/
19 /******************************************************************************
21 * This file contains the implementation of the AES128 CMAC algorithm.
23 ******************************************************************************/
25 #include "bt_target.h"
27 #if SMP_INCLUDED == TRUE
31 #include "btm_ble_api.h"
44 /* Rb for AES-128 as block cipher, LSB as [0] */
45 BT_OCTET16 const_Rb = {
46 0x87, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
47 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
50 void print128(BT_OCTET16 x, const UINT8 *key_name)
52 #if SMP_DEBUG == TRUE && SMP_DEBUG_VERBOSE == TRUE
53 UINT8 *p = (UINT8 *)x;
56 SMP_TRACE_WARNING("%s(MSB ~ LSB) = ", key_name);
58 for (i = 0; i < 4; i ++)
60 SMP_TRACE_WARNING("%02x %02x %02x %02x",
61 p[BT_OCTET16_LEN - i*4 -1], p[BT_OCTET16_LEN - i*4 -2],
62 p[BT_OCTET16_LEN - i*4 -3], p[BT_OCTET16_LEN - i*4 -4]);
67 /*******************************************************************************
71 ** Description utility function to padding the given text to be a 128 bits
72 ** data. The parameter dest is input and output parameter, it
73 ** must point to a BT_OCTET16_LEN memory space; where include
74 ** length bytes valid data.
78 *******************************************************************************/
79 static void padding ( BT_OCTET16 dest, UINT8 length )
82 /* original last block */
83 for ( i = length ; i < BT_OCTET16_LEN; i++ )
84 p[BT_OCTET16_LEN - i - 1] = ( i == length ) ? 0x80 : 0;
86 /*******************************************************************************
88 ** Function leftshift_onebit
90 ** Description utility function to left shift one bit for a 128 bits value.
94 *******************************************************************************/
95 static void leftshift_onebit(UINT8 *input, UINT8 *output)
97 UINT8 i, overflow = 0 , next_overflow = 0;
98 SMP_TRACE_EVENT ("leftshift_onebit ");
100 for ( i = 0; i < BT_OCTET16_LEN ; i ++ )
102 next_overflow = (input[i] & 0x80) ? 1:0;
103 output[i] = (input[i] << 1) | overflow;
104 overflow = next_overflow;
108 /*******************************************************************************
110 ** Function cmac_aes_cleanup
112 ** Description clean up function for AES_CMAC algorithm.
116 *******************************************************************************/
117 static void cmac_aes_cleanup(void)
119 osi_free(cmac_cb.text);
120 memset(&cmac_cb, 0, sizeof(tCMAC_CB));
123 /*******************************************************************************
125 ** Function cmac_aes_k_calculate
127 ** Description This function is the calculation of block cipher using AES-128.
131 *******************************************************************************/
132 static BOOLEAN cmac_aes_k_calculate(BT_OCTET16 key, UINT8 *p_signature, UINT16 tlen)
135 UINT8 i = 1, err = 0;
139 SMP_TRACE_EVENT ("cmac_aes_k_calculate ");
141 while (i <= cmac_cb.round)
143 smp_xor_128(&cmac_cb.text[(cmac_cb.round - i)*BT_OCTET16_LEN], x); /* Mi' := Mi (+) X */
145 if (!SMP_Encrypt(key, BT_OCTET16_LEN, &cmac_cb.text[(cmac_cb.round - i)*BT_OCTET16_LEN], BT_OCTET16_LEN, &output))
151 memcpy(x, output.param_buf, BT_OCTET16_LEN);
157 p_mac = output.param_buf + (BT_OCTET16_LEN - tlen);
158 memcpy(p_signature, p_mac, tlen);
160 SMP_TRACE_DEBUG("tlen = %d p_mac = %d", tlen, p_mac);
161 SMP_TRACE_DEBUG("p_mac[0] = 0x%02x p_mac[1] = 0x%02x p_mac[2] = 0x%02x p_mac[3] = 0x%02x",
162 *p_mac, *(p_mac + 1), *(p_mac + 2), *(p_mac + 3));
163 SMP_TRACE_DEBUG("p_mac[4] = 0x%02x p_mac[5] = 0x%02x p_mac[6] = 0x%02x p_mac[7] = 0x%02x",
164 *(p_mac + 4), *(p_mac + 5), *(p_mac + 6), *(p_mac + 7));
172 /*******************************************************************************
174 ** Function cmac_prepare_last_block
176 ** Description This function proceeed to prepare the last block of message
177 ** Mn depending on the size of the message.
181 *******************************************************************************/
182 static void cmac_prepare_last_block (BT_OCTET16 k1, BT_OCTET16 k2)
184 // UINT8 x[16] = {0};
187 SMP_TRACE_EVENT ("cmac_prepare_last_block ");
188 /* last block is a complete block set flag to 1 */
189 flag = ((cmac_cb.len % BT_OCTET16_LEN) == 0 && cmac_cb.len != 0) ? TRUE : FALSE;
191 SMP_TRACE_WARNING("flag = %d round = %d", flag, cmac_cb.round);
194 { /* last block is complete block */
195 smp_xor_128(&cmac_cb.text[0], k1);
197 else /* padding then xor with k2 */
199 padding(&cmac_cb.text[0], (UINT8)(cmac_cb.len % 16));
201 smp_xor_128(&cmac_cb.text[0], k2);
204 /*******************************************************************************
206 ** Function cmac_subkey_cont
208 ** Description This is the callback function when CIPHk(0[128]) is completed.
212 *******************************************************************************/
213 static void cmac_subkey_cont(tSMP_ENC *p)
215 UINT8 k1[BT_OCTET16_LEN], k2[BT_OCTET16_LEN];
216 UINT8 *pp = p->param_buf;
217 SMP_TRACE_EVENT ("cmac_subkey_cont ");
218 print128(pp, (const UINT8 *)"K1 before shift");
220 /* If MSB(L) = 0, then K1 = L << 1 */
221 if ( (pp[BT_OCTET16_LEN - 1] & 0x80) != 0 )
223 /* Else K1 = ( L << 1 ) (+) Rb */
224 leftshift_onebit(pp, k1);
225 smp_xor_128(k1, const_Rb);
229 leftshift_onebit(pp, k1);
232 if ( (k1[BT_OCTET16_LEN - 1] & 0x80) != 0 )
234 /* K2 = (K1 << 1) (+) Rb */
235 leftshift_onebit(k1, k2);
236 smp_xor_128(k2, const_Rb);
240 /* If MSB(K1) = 0, then K2 = K1 << 1 */
241 leftshift_onebit(k1, k2);
244 print128(k1, (const UINT8 *)"K1");
245 print128(k2, (const UINT8 *)"K2");
247 cmac_prepare_last_block (k1, k2);
249 /*******************************************************************************
251 ** Function cmac_generate_subkey
253 ** Description This is the function to generate the two subkeys.
255 ** Parameters key - CMAC key, expect SRK when used by SMP.
259 *******************************************************************************/
260 static BOOLEAN cmac_generate_subkey(BT_OCTET16 key)
265 SMP_TRACE_EVENT (" cmac_generate_subkey");
267 if (SMP_Encrypt(key, BT_OCTET16_LEN, z, BT_OCTET16_LEN, &output))
269 cmac_subkey_cont(&output);;
276 /*******************************************************************************
278 ** Function aes_cipher_msg_auth_code
280 ** Description This is the AES-CMAC Generation Function with tlen implemented.
282 ** Parameters key - CMAC key in little endian order, expect SRK when used by SMP.
283 ** input - text to be signed in little endian byte order.
284 ** length - length of the input in byte.
285 ** tlen - lenth of mac desired
286 ** p_signature - data pointer to where signed data to be stored, tlen long.
288 ** Returns FALSE if out of resources, TRUE in other cases.
290 *******************************************************************************/
291 BOOLEAN aes_cipher_msg_auth_code(BT_OCTET16 key, UINT8 *input, UINT16 length,
292 UINT16 tlen, UINT8 *p_signature)
295 UINT16 n = (length + BT_OCTET16_LEN - 1) / BT_OCTET16_LEN; /* n is number of rounds */
298 SMP_TRACE_EVENT ("%s", __func__);
301 len = n * BT_OCTET16_LEN;
303 SMP_TRACE_WARNING("AES128_CMAC started, allocate buffer size = %d", len);
304 /* allocate a memory space of multiple of 16 bytes to hold text */
305 cmac_cb.text = (UINT8 *)osi_calloc(len);
309 if (input != NULL && length > 0) {
310 memcpy(&cmac_cb.text[diff] , input, (int)length);
311 cmac_cb.len = length;
316 /* prepare calculation for subkey s and last block of data */
317 if (cmac_generate_subkey(key)) {
318 /* start calculation */
319 ret = cmac_aes_k_calculate(key, p_signature, tlen);
327 #if 0 /* testing code, sample data from spec */
328 void test_cmac_cback(UINT8 *p_mac, UINT16 tlen)
330 SMP_TRACE_EVENT ("test_cmac_cback ");
331 SMP_TRACE_ERROR("test_cmac_cback");
336 SMP_TRACE_EVENT ("test_cmac ");
338 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
339 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
340 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
341 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
342 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
343 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
344 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
345 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
349 0x3c, 0x4f, 0xcf, 0x09, 0x88, 0x15, 0xf7, 0xab,
350 0xa6, 0xd2, 0xae, 0x28, 0x16, 0x15, 0x7e, 0x2b
357 for (i = 0; i < len/2; i ++)
360 M[i] = M[len -1 - i];
365 memset(&cmac_cb, 0, sizeof(tCMAC_CB));
367 SMP_TRACE_WARNING("\n Example 1: len = %d\n", len);
369 aes_cipher_msg_auth_code(key, M, len, 128, test_cmac_cback, 0);