2 * Copyright (c) 2011 The Chromium OS Authors.
3 * (C) Copyright 2010 - 2011 NVIDIA Corporation <www.nvidia.com>
5 * SPDX-License-Identifier: GPL-2.0+
13 static u8 zero_key[16];
15 #define AES_CMAC_CONST_RB 0x87 /* from RFC 4493, Figure 2.2 */
18 SECURITY_SIGN = 1 << 0, /* Sign the data */
19 SECURITY_ENCRYPT = 1 << 1, /* Encrypt the data */
22 static void debug_print_vector(char *name, u32 num_bytes, u8 *data)
26 debug("%s [%d] @0x%08x", name, num_bytes, (u32)data);
27 for (i = 0; i < num_bytes; i++) {
30 debug("%02x", data[i]);
38 * Apply chain data to the destination using EOR
40 * Each array is of length AES_AES_KEY_LENGTH.
42 * \param cbc_chain_data Chain data
43 * \param src Source data
44 * \param dst Destination data, which is modified here
46 static void apply_cbc_chain_data(u8 *cbc_chain_data, u8 *src, u8 *dst)
50 for (i = 0; i < 16; i++)
51 *dst++ = *src++ ^ *cbc_chain_data++;
55 * Encrypt some data with AES.
57 * \param key_schedule Expanded key to use
58 * \param src Source data to encrypt
59 * \param dst Destination buffer
60 * \param num_aes_blocks Number of AES blocks to encrypt
62 static void encrypt_object(u8 *key_schedule, u8 *src, u8 *dst,
65 u8 tmp_data[AES_KEY_LENGTH];
69 cbc_chain_data = zero_key; /* Convenient array of 0's for IV */
71 for (i = 0; i < num_aes_blocks; i++) {
72 debug("encrypt_object: block %d of %d\n", i, num_aes_blocks);
73 debug_print_vector("AES Src", AES_KEY_LENGTH, src);
75 /* Apply the chain data */
76 apply_cbc_chain_data(cbc_chain_data, src, tmp_data);
77 debug_print_vector("AES Xor", AES_KEY_LENGTH, tmp_data);
79 /* encrypt the AES block */
80 aes_encrypt(tmp_data, key_schedule, dst);
81 debug_print_vector("AES Dst", AES_KEY_LENGTH, dst);
83 /* Update pointers for next loop. */
85 src += AES_KEY_LENGTH;
86 dst += AES_KEY_LENGTH;
91 * Shift a vector left by one bit
93 * \param in Input vector
94 * \param out Output vector
95 * \param size Length of vector in bytes
97 static void left_shift_vector(u8 *in, u8 *out, int size)
102 for (i = size - 1; i >= 0; i--) {
103 out[i] = (in[i] << 1) | carry;
104 carry = in[i] >> 7; /* get most significant bit */
109 * Sign a block of data, putting the result into dst.
111 * \param key Input AES key, length AES_KEY_LENGTH
112 * \param key_schedule Expanded key to use
113 * \param src Source data of length 'num_aes_blocks' blocks
114 * \param dst Destination buffer, length AES_KEY_LENGTH
115 * \param num_aes_blocks Number of AES blocks to encrypt
117 static void sign_object(u8 *key, u8 *key_schedule, u8 *src, u8 *dst,
120 u8 tmp_data[AES_KEY_LENGTH];
121 u8 left[AES_KEY_LENGTH];
122 u8 k1[AES_KEY_LENGTH];
126 cbc_chain_data = zero_key; /* Convenient array of 0's for IV */
128 /* compute K1 constant needed by AES-CMAC calculation */
129 for (i = 0; i < AES_KEY_LENGTH; i++)
132 encrypt_object(key_schedule, tmp_data, left, 1);
133 debug_print_vector("AES(key, nonce)", AES_KEY_LENGTH, left);
135 left_shift_vector(left, k1, sizeof(left));
136 debug_print_vector("L", AES_KEY_LENGTH, left);
138 if ((left[0] >> 7) != 0) /* get MSB of L */
139 k1[AES_KEY_LENGTH-1] ^= AES_CMAC_CONST_RB;
140 debug_print_vector("K1", AES_KEY_LENGTH, k1);
142 /* compute the AES-CMAC value */
143 for (i = 0; i < num_aes_blocks; i++) {
144 /* Apply the chain data */
145 apply_cbc_chain_data(cbc_chain_data, src, tmp_data);
147 /* for the final block, XOR K1 into the IV */
148 if (i == num_aes_blocks - 1)
149 apply_cbc_chain_data(tmp_data, k1, tmp_data);
151 /* encrypt the AES block */
152 aes_encrypt(tmp_data, key_schedule, dst);
154 debug("sign_obj: block %d of %d\n", i, num_aes_blocks);
155 debug_print_vector("AES-CMAC Src", AES_KEY_LENGTH, src);
156 debug_print_vector("AES-CMAC Xor", AES_KEY_LENGTH, tmp_data);
157 debug_print_vector("AES-CMAC Dst", AES_KEY_LENGTH, dst);
159 /* Update pointers for next loop. */
160 cbc_chain_data = dst;
161 src += AES_KEY_LENGTH;
164 debug_print_vector("AES-CMAC Hash", AES_KEY_LENGTH, dst);
168 * Encrypt and sign a block of data (depending on security mode).
170 * \param key Input AES key, length AES_KEY_LENGTH
171 * \param oper Security operations mask to perform (enum security_op)
172 * \param src Source data
173 * \param length Size of source data
174 * \param sig_dst Destination address for signature, AES_KEY_LENGTH bytes
176 static int encrypt_and_sign(u8 *key, enum security_op oper, u8 *src,
177 u32 length, u8 *sig_dst)
180 u8 key_schedule[AES_EXPAND_KEY_LENGTH];
182 debug("encrypt_and_sign: length = %d\n", length);
183 debug_print_vector("AES key", AES_KEY_LENGTH, key);
186 * The only need for a key is for signing/checksum purposes, so
187 * if not encrypting, expand a key of 0s.
189 aes_expand_key(oper & SECURITY_ENCRYPT ? key : zero_key, key_schedule);
191 num_aes_blocks = (length + AES_KEY_LENGTH - 1) / AES_KEY_LENGTH;
193 if (oper & SECURITY_ENCRYPT) {
194 /* Perform this in place, resulting in src being encrypted. */
195 debug("encrypt_and_sign: begin encryption\n");
196 encrypt_object(key_schedule, src, src, num_aes_blocks);
197 debug("encrypt_and_sign: end encryption\n");
200 if (oper & SECURITY_SIGN) {
201 /* encrypt the data, overwriting the result in signature. */
202 debug("encrypt_and_sign: begin signing\n");
203 sign_object(key, key_schedule, src, sig_dst, num_aes_blocks);
204 debug("encrypt_and_sign: end signing\n");
210 int sign_data_block(u8 *source, unsigned length, u8 *signature)
212 return encrypt_and_sign(zero_key, SECURITY_SIGN, source,