1/**
2 * \file cmac.c
3 *
4 * \brief NIST SP800-38B compliant CMAC implementation for AES and 3DES
5 *
6 * Copyright The Mbed TLS Contributors
7 * SPDX-License-Identifier: Apache-2.0
8 *
9 * Licensed under the Apache License, Version 2.0 (the "License"); you may
10 * not use this file except in compliance with the License.
11 * You may obtain a copy of the License at
12 *
13 * http://www.apache.org/licenses/LICENSE-2.0
14 *
15 * Unless required by applicable law or agreed to in writing, software
16 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
17 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18 * See the License for the specific language governing permissions and
19 * limitations under the License.
20 */
21
22/*
23 * References:
24 *
25 * - NIST SP 800-38B Recommendation for Block Cipher Modes of Operation: The
26 * CMAC Mode for Authentication
27 * http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf
28 *
29 * - RFC 4493 - The AES-CMAC Algorithm
30 * https://tools.ietf.org/html/rfc4493
31 *
32 * - RFC 4615 - The Advanced Encryption Standard-Cipher-based Message
33 * Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128)
34 * Algorithm for the Internet Key Exchange Protocol (IKE)
35 * https://tools.ietf.org/html/rfc4615
36 *
37 * Additional test vectors: ISO/IEC 9797-1
38 *
39 */
40
41#include "common.h"
42
43#if defined(MBEDTLS_CMAC_C)
44
45#include "mbedtls/cmac.h"
46#include "mbedtls/platform_util.h"
47#include "mbedtls/error.h"
48#include "mbedtls/platform.h"
49
50#include <string.h>
51
52#if !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST)
53
54/*
55 * Multiplication by u in the Galois field of GF(2^n)
56 *
57 * As explained in NIST SP 800-38B, this can be computed:
58 *
59 * If MSB(p) = 0, then p = (p << 1)
60 * If MSB(p) = 1, then p = (p << 1) ^ R_n
61 * with R_64 = 0x1B and R_128 = 0x87
62 *
63 * Input and output MUST NOT point to the same buffer
64 * Block size must be 8 bytes or 16 bytes - the block sizes for DES and AES.
65 */
66static int cmac_multiply_by_u(unsigned char *output,
67 const unsigned char *input,
68 size_t blocksize)
69{
70 const unsigned char R_128 = 0x87;
71 const unsigned char R_64 = 0x1B;
72 unsigned char R_n, mask;
73 unsigned char overflow = 0x00;
74 int i;
75
76 if (blocksize == MBEDTLS_AES_BLOCK_SIZE) {
77 R_n = R_128;
78 } else if (blocksize == MBEDTLS_DES3_BLOCK_SIZE) {
79 R_n = R_64;
80 } else {
81 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
82 }
83
84 for (i = (int) blocksize - 1; i >= 0; i--) {
85 output[i] = input[i] << 1 | overflow;
86 overflow = input[i] >> 7;
87 }
88
89 /* mask = ( input[0] >> 7 ) ? 0xff : 0x00
90 * using bit operations to avoid branches */
91
92 /* MSVC has a warning about unary minus on unsigned, but this is
93 * well-defined and precisely what we want to do here */
94#if defined(_MSC_VER)
95#pragma warning( push )
96#pragma warning( disable : 4146 )
97#endif
98 mask = -(input[0] >> 7);
99#if defined(_MSC_VER)
100#pragma warning( pop )
101#endif
102
103 output[blocksize - 1] ^= R_n & mask;
104
105 return 0;
106}
107
108/*
109 * Generate subkeys
110 *
111 * - as specified by RFC 4493, section 2.3 Subkey Generation Algorithm
112 */
113static int cmac_generate_subkeys(mbedtls_cipher_context_t *ctx,
114 unsigned char *K1, unsigned char *K2)
115{
116 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
117 unsigned char L[MBEDTLS_CIPHER_BLKSIZE_MAX];
118 size_t olen, block_size;
119
120 mbedtls_platform_zeroize(L, sizeof(L));
121
122 block_size = ctx->cipher_info->block_size;
123
124 /* Calculate Ek(0) */
125 if ((ret = mbedtls_cipher_update(ctx, L, block_size, L, &olen)) != 0) {
126 goto exit;
127 }
128
129 /*
130 * Generate K1 and K2
131 */
132 if ((ret = cmac_multiply_by_u(K1, L, block_size)) != 0) {
133 goto exit;
134 }
135
136 if ((ret = cmac_multiply_by_u(K2, K1, block_size)) != 0) {
137 goto exit;
138 }
139
140exit:
141 mbedtls_platform_zeroize(L, sizeof(L));
142
143 return ret;
144}
145#endif /* !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST) */
146
147#if !defined(MBEDTLS_CMAC_ALT)
148static void cmac_xor_block(unsigned char *output, const unsigned char *input1,
149 const unsigned char *input2,
150 const size_t block_size)
151{
152 size_t idx;
153
154 for (idx = 0; idx < block_size; idx++) {
155 output[idx] = input1[idx] ^ input2[idx];
156 }
157}
158
159/*
160 * Create padded last block from (partial) last block.
161 *
162 * We can't use the padding option from the cipher layer, as it only works for
163 * CBC and we use ECB mode, and anyway we need to XOR K1 or K2 in addition.
164 */
165static void cmac_pad(unsigned char padded_block[MBEDTLS_CIPHER_BLKSIZE_MAX],
166 size_t padded_block_len,
167 const unsigned char *last_block,
168 size_t last_block_len)
169{
170 size_t j;
171
172 for (j = 0; j < padded_block_len; j++) {
173 if (j < last_block_len) {
174 padded_block[j] = last_block[j];
175 } else if (j == last_block_len) {
176 padded_block[j] = 0x80;
177 } else {
178 padded_block[j] = 0x00;
179 }
180 }
181}
182
183int mbedtls_cipher_cmac_starts(mbedtls_cipher_context_t *ctx,
184 const unsigned char *key, size_t keybits)
185{
186 mbedtls_cipher_type_t type;
187 mbedtls_cmac_context_t *cmac_ctx;
188 int retval;
189
190 if (ctx == NULL || ctx->cipher_info == NULL || key == NULL) {
191 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
192 }
193
194 if ((retval = mbedtls_cipher_setkey(ctx, key, (int) keybits,
195 MBEDTLS_ENCRYPT)) != 0) {
196 return retval;
197 }
198
199 type = ctx->cipher_info->type;
200
201 switch (type) {
202 case MBEDTLS_CIPHER_AES_128_ECB:
203 case MBEDTLS_CIPHER_AES_192_ECB:
204 case MBEDTLS_CIPHER_AES_256_ECB:
205 case MBEDTLS_CIPHER_DES_EDE3_ECB:
206 break;
207 default:
208 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
209 }
210
211 /* Allocated and initialise in the cipher context memory for the CMAC
212 * context */
213 cmac_ctx = mbedtls_calloc(1, sizeof(mbedtls_cmac_context_t));
214 if (cmac_ctx == NULL) {
215 return MBEDTLS_ERR_CIPHER_ALLOC_FAILED;
216 }
217
218 ctx->cmac_ctx = cmac_ctx;
219
220 mbedtls_platform_zeroize(cmac_ctx->state, sizeof(cmac_ctx->state));
221
222 return 0;
223}
224
225int mbedtls_cipher_cmac_update(mbedtls_cipher_context_t *ctx,
226 const unsigned char *input, size_t ilen)
227{
228 mbedtls_cmac_context_t *cmac_ctx;
229 unsigned char *state;
230 int ret = 0;
231 size_t n, j, olen, block_size;
232
233 if (ctx == NULL || ctx->cipher_info == NULL || input == NULL ||
234 ctx->cmac_ctx == NULL) {
235 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
236 }
237
238 cmac_ctx = ctx->cmac_ctx;
239 block_size = ctx->cipher_info->block_size;
240 state = ctx->cmac_ctx->state;
241
242 /* Is there data still to process from the last call, that's greater in
243 * size than a block? */
244 if (cmac_ctx->unprocessed_len > 0 &&
245 ilen > block_size - cmac_ctx->unprocessed_len) {
246 memcpy(&cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
247 input,
248 block_size - cmac_ctx->unprocessed_len);
249
250 cmac_xor_block(state, cmac_ctx->unprocessed_block, state, block_size);
251
252 if ((ret = mbedtls_cipher_update(ctx, state, block_size, state,
253 &olen)) != 0) {
254 goto exit;
255 }
256
257 input += block_size - cmac_ctx->unprocessed_len;
258 ilen -= block_size - cmac_ctx->unprocessed_len;
259 cmac_ctx->unprocessed_len = 0;
260 }
261
262 /* n is the number of blocks including any final partial block */
263 n = (ilen + block_size - 1) / block_size;
264
265 /* Iterate across the input data in block sized chunks, excluding any
266 * final partial or complete block */
267 for (j = 1; j < n; j++) {
268 cmac_xor_block(state, input, state, block_size);
269
270 if ((ret = mbedtls_cipher_update(ctx, state, block_size, state,
271 &olen)) != 0) {
272 goto exit;
273 }
274
275 ilen -= block_size;
276 input += block_size;
277 }
278
279 /* If there is data left over that wasn't aligned to a block */
280 if (ilen > 0) {
281 memcpy(&cmac_ctx->unprocessed_block[cmac_ctx->unprocessed_len],
282 input,
283 ilen);
284 cmac_ctx->unprocessed_len += ilen;
285 }
286
287exit:
288 return ret;
289}
290
291int mbedtls_cipher_cmac_finish(mbedtls_cipher_context_t *ctx,
292 unsigned char *output)
293{
294 mbedtls_cmac_context_t *cmac_ctx;
295 unsigned char *state, *last_block;
296 unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
297 unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
298 unsigned char M_last[MBEDTLS_CIPHER_BLKSIZE_MAX];
299 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
300 size_t olen, block_size;
301
302 if (ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL ||
303 output == NULL) {
304 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
305 }
306
307 cmac_ctx = ctx->cmac_ctx;
308 block_size = ctx->cipher_info->block_size;
309 state = cmac_ctx->state;
310
311 mbedtls_platform_zeroize(K1, sizeof(K1));
312 mbedtls_platform_zeroize(K2, sizeof(K2));
313 cmac_generate_subkeys(ctx, K1, K2);
314
315 last_block = cmac_ctx->unprocessed_block;
316
317 /* Calculate last block */
318 if (cmac_ctx->unprocessed_len < block_size) {
319 cmac_pad(M_last, block_size, last_block, cmac_ctx->unprocessed_len);
320 cmac_xor_block(M_last, M_last, K2, block_size);
321 } else {
322 /* Last block is complete block */
323 cmac_xor_block(M_last, last_block, K1, block_size);
324 }
325
326
327 cmac_xor_block(state, M_last, state, block_size);
328 if ((ret = mbedtls_cipher_update(ctx, state, block_size, state,
329 &olen)) != 0) {
330 goto exit;
331 }
332
333 memcpy(output, state, block_size);
334
335exit:
336 /* Wipe the generated keys on the stack, and any other transients to avoid
337 * side channel leakage */
338 mbedtls_platform_zeroize(K1, sizeof(K1));
339 mbedtls_platform_zeroize(K2, sizeof(K2));
340
341 cmac_ctx->unprocessed_len = 0;
342 mbedtls_platform_zeroize(cmac_ctx->unprocessed_block,
343 sizeof(cmac_ctx->unprocessed_block));
344
345 mbedtls_platform_zeroize(state, MBEDTLS_CIPHER_BLKSIZE_MAX);
346 return ret;
347}
348
349int mbedtls_cipher_cmac_reset(mbedtls_cipher_context_t *ctx)
350{
351 mbedtls_cmac_context_t *cmac_ctx;
352
353 if (ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL) {
354 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
355 }
356
357 cmac_ctx = ctx->cmac_ctx;
358
359 /* Reset the internal state */
360 cmac_ctx->unprocessed_len = 0;
361 mbedtls_platform_zeroize(cmac_ctx->unprocessed_block,
362 sizeof(cmac_ctx->unprocessed_block));
363 mbedtls_platform_zeroize(cmac_ctx->state,
364 sizeof(cmac_ctx->state));
365
366 return 0;
367}
368
369int mbedtls_cipher_cmac(const mbedtls_cipher_info_t *cipher_info,
370 const unsigned char *key, size_t keylen,
371 const unsigned char *input, size_t ilen,
372 unsigned char *output)
373{
374 mbedtls_cipher_context_t ctx;
375 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
376
377 if (cipher_info == NULL || key == NULL || input == NULL || output == NULL) {
378 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
379 }
380
381 mbedtls_cipher_init(&ctx);
382
383 if ((ret = mbedtls_cipher_setup(&ctx, cipher_info)) != 0) {
384 goto exit;
385 }
386
387 ret = mbedtls_cipher_cmac_starts(&ctx, key, keylen);
388 if (ret != 0) {
389 goto exit;
390 }
391
392 ret = mbedtls_cipher_cmac_update(&ctx, input, ilen);
393 if (ret != 0) {
394 goto exit;
395 }
396
397 ret = mbedtls_cipher_cmac_finish(&ctx, output);
398
399exit:
400 mbedtls_cipher_free(&ctx);
401
402 return ret;
403}
404
405#if defined(MBEDTLS_AES_C)
406/*
407 * Implementation of AES-CMAC-PRF-128 defined in RFC 4615
408 */
409int mbedtls_aes_cmac_prf_128(const unsigned char *key, size_t key_length,
410 const unsigned char *input, size_t in_len,
411 unsigned char output[16])
412{
413 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
414 const mbedtls_cipher_info_t *cipher_info;
415 unsigned char zero_key[MBEDTLS_AES_BLOCK_SIZE];
416 unsigned char int_key[MBEDTLS_AES_BLOCK_SIZE];
417
418 if (key == NULL || input == NULL || output == NULL) {
419 return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA;
420 }
421
422 cipher_info = mbedtls_cipher_info_from_type(MBEDTLS_CIPHER_AES_128_ECB);
423 if (cipher_info == NULL) {
424 /* Failing at this point must be due to a build issue */
425 ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
426 goto exit;
427 }
428
429 if (key_length == MBEDTLS_AES_BLOCK_SIZE) {
430 /* Use key as is */
431 memcpy(int_key, key, MBEDTLS_AES_BLOCK_SIZE);
432 } else {
433 memset(zero_key, 0, MBEDTLS_AES_BLOCK_SIZE);
434
435 ret = mbedtls_cipher_cmac(cipher_info, zero_key, 128, key,
436 key_length, int_key);
437 if (ret != 0) {
438 goto exit;
439 }
440 }
441
442 ret = mbedtls_cipher_cmac(cipher_info, int_key, 128, input, in_len,
443 output);
444
445exit:
446 mbedtls_platform_zeroize(int_key, sizeof(int_key));
447
448 return ret;
449}
450#endif /* MBEDTLS_AES_C */
451
452#endif /* !MBEDTLS_CMAC_ALT */
453
454#if defined(MBEDTLS_SELF_TEST)
455/*
456 * CMAC test data for SP800-38B
457 * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/AES_CMAC.pdf
458 * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/TDES_CMAC.pdf
459 *
460 * AES-CMAC-PRF-128 test data from RFC 4615
461 * https://tools.ietf.org/html/rfc4615#page-4
462 */
463
464#define NB_CMAC_TESTS_PER_KEY 4
465#define NB_PRF_TESTS 3
466
467#if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C)
468/* All CMAC test inputs are truncated from the same 64 byte buffer. */
469static const unsigned char test_message[] = {
470 /* PT */
471 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
472 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
473 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
474 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
475 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
476 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
477 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
478 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10
479};
480#endif /* MBEDTLS_AES_C || MBEDTLS_DES_C */
481
482#if defined(MBEDTLS_AES_C)
483/* Truncation point of message for AES CMAC tests */
484static const unsigned int aes_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
485 /* Mlen */
486 0,
487 16,
488 20,
489 64
490};
491
492/* CMAC-AES128 Test Data */
493static const unsigned char aes_128_key[16] = {
494 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
495 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c
496};
497static const unsigned char aes_128_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
498 {
499 /* K1 */
500 0xfb, 0xee, 0xd6, 0x18, 0x35, 0x71, 0x33, 0x66,
501 0x7c, 0x85, 0xe0, 0x8f, 0x72, 0x36, 0xa8, 0xde
502 },
503 {
504 /* K2 */
505 0xf7, 0xdd, 0xac, 0x30, 0x6a, 0xe2, 0x66, 0xcc,
506 0xf9, 0x0b, 0xc1, 0x1e, 0xe4, 0x6d, 0x51, 0x3b
507 }
508};
509static const unsigned char aes_128_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] =
510{
511 {
512 /* Example #1 */
513 0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
514 0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46
515 },
516 {
517 /* Example #2 */
518 0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
519 0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c
520 },
521 {
522 /* Example #3 */
523 0x7d, 0x85, 0x44, 0x9e, 0xa6, 0xea, 0x19, 0xc8,
524 0x23, 0xa7, 0xbf, 0x78, 0x83, 0x7d, 0xfa, 0xde
525 },
526 {
527 /* Example #4 */
528 0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
529 0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe
530 }
531};
532
533/* CMAC-AES192 Test Data */
534static const unsigned char aes_192_key[24] = {
535 0x8e, 0x73, 0xb0, 0xf7, 0xda, 0x0e, 0x64, 0x52,
536 0xc8, 0x10, 0xf3, 0x2b, 0x80, 0x90, 0x79, 0xe5,
537 0x62, 0xf8, 0xea, 0xd2, 0x52, 0x2c, 0x6b, 0x7b
538};
539static const unsigned char aes_192_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
540 {
541 /* K1 */
542 0x44, 0x8a, 0x5b, 0x1c, 0x93, 0x51, 0x4b, 0x27,
543 0x3e, 0xe6, 0x43, 0x9d, 0xd4, 0xda, 0xa2, 0x96
544 },
545 {
546 /* K2 */
547 0x89, 0x14, 0xb6, 0x39, 0x26, 0xa2, 0x96, 0x4e,
548 0x7d, 0xcc, 0x87, 0x3b, 0xa9, 0xb5, 0x45, 0x2c
549 }
550};
551static const unsigned char aes_192_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] =
552{
553 {
554 /* Example #1 */
555 0xd1, 0x7d, 0xdf, 0x46, 0xad, 0xaa, 0xcd, 0xe5,
556 0x31, 0xca, 0xc4, 0x83, 0xde, 0x7a, 0x93, 0x67
557 },
558 {
559 /* Example #2 */
560 0x9e, 0x99, 0xa7, 0xbf, 0x31, 0xe7, 0x10, 0x90,
561 0x06, 0x62, 0xf6, 0x5e, 0x61, 0x7c, 0x51, 0x84
562 },
563 {
564 /* Example #3 */
565 0x3d, 0x75, 0xc1, 0x94, 0xed, 0x96, 0x07, 0x04,
566 0x44, 0xa9, 0xfa, 0x7e, 0xc7, 0x40, 0xec, 0xf8
567 },
568 {
569 /* Example #4 */
570 0xa1, 0xd5, 0xdf, 0x0e, 0xed, 0x79, 0x0f, 0x79,
571 0x4d, 0x77, 0x58, 0x96, 0x59, 0xf3, 0x9a, 0x11
572 }
573};
574
575/* CMAC-AES256 Test Data */
576static const unsigned char aes_256_key[32] = {
577 0x60, 0x3d, 0xeb, 0x10, 0x15, 0xca, 0x71, 0xbe,
578 0x2b, 0x73, 0xae, 0xf0, 0x85, 0x7d, 0x77, 0x81,
579 0x1f, 0x35, 0x2c, 0x07, 0x3b, 0x61, 0x08, 0xd7,
580 0x2d, 0x98, 0x10, 0xa3, 0x09, 0x14, 0xdf, 0xf4
581};
582static const unsigned char aes_256_subkeys[2][MBEDTLS_AES_BLOCK_SIZE] = {
583 {
584 /* K1 */
585 0xca, 0xd1, 0xed, 0x03, 0x29, 0x9e, 0xed, 0xac,
586 0x2e, 0x9a, 0x99, 0x80, 0x86, 0x21, 0x50, 0x2f
587 },
588 {
589 /* K2 */
590 0x95, 0xa3, 0xda, 0x06, 0x53, 0x3d, 0xdb, 0x58,
591 0x5d, 0x35, 0x33, 0x01, 0x0c, 0x42, 0xa0, 0xd9
592 }
593};
594static const unsigned char aes_256_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_AES_BLOCK_SIZE] =
595{
596 {
597 /* Example #1 */
598 0x02, 0x89, 0x62, 0xf6, 0x1b, 0x7b, 0xf8, 0x9e,
599 0xfc, 0x6b, 0x55, 0x1f, 0x46, 0x67, 0xd9, 0x83
600 },
601 {
602 /* Example #2 */
603 0x28, 0xa7, 0x02, 0x3f, 0x45, 0x2e, 0x8f, 0x82,
604 0xbd, 0x4b, 0xf2, 0x8d, 0x8c, 0x37, 0xc3, 0x5c
605 },
606 {
607 /* Example #3 */
608 0x15, 0x67, 0x27, 0xdc, 0x08, 0x78, 0x94, 0x4a,
609 0x02, 0x3c, 0x1f, 0xe0, 0x3b, 0xad, 0x6d, 0x93
610 },
611 {
612 /* Example #4 */
613 0xe1, 0x99, 0x21, 0x90, 0x54, 0x9f, 0x6e, 0xd5,
614 0x69, 0x6a, 0x2c, 0x05, 0x6c, 0x31, 0x54, 0x10
615 }
616};
617#endif /* MBEDTLS_AES_C */
618
619#if defined(MBEDTLS_DES_C)
620/* Truncation point of message for 3DES CMAC tests */
621static const unsigned int des3_message_lengths[NB_CMAC_TESTS_PER_KEY] = {
622 0,
623 16,
624 20,
625 32
626};
627
628/* CMAC-TDES (Generation) - 2 Key Test Data */
629static const unsigned char des3_2key_key[24] = {
630 /* Key1 */
631 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
632 /* Key2 */
633 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xEF, 0x01,
634 /* Key3 */
635 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef
636};
637static const unsigned char des3_2key_subkeys[2][8] = {
638 {
639 /* K1 */
640 0x0d, 0xd2, 0xcb, 0x7a, 0x3d, 0x88, 0x88, 0xd9
641 },
642 {
643 /* K2 */
644 0x1b, 0xa5, 0x96, 0xf4, 0x7b, 0x11, 0x11, 0xb2
645 }
646};
647static const unsigned char des3_2key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE]
648 = {
649 {
650 /* Sample #1 */
651 0x79, 0xce, 0x52, 0xa7, 0xf7, 0x86, 0xa9, 0x60
652 },
653 {
654 /* Sample #2 */
655 0xcc, 0x18, 0xa0, 0xb7, 0x9a, 0xf2, 0x41, 0x3b
656 },
657 {
658 /* Sample #3 */
659 0xc0, 0x6d, 0x37, 0x7e, 0xcd, 0x10, 0x19, 0x69
660 },
661 {
662 /* Sample #4 */
663 0x9c, 0xd3, 0x35, 0x80, 0xf9, 0xb6, 0x4d, 0xfb
664 }
665 };
666
667/* CMAC-TDES (Generation) - 3 Key Test Data */
668static const unsigned char des3_3key_key[24] = {
669 /* Key1 */
670 0x01, 0x23, 0x45, 0x67, 0x89, 0xaa, 0xcd, 0xef,
671 /* Key2 */
672 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01,
673 /* Key3 */
674 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23
675};
676static const unsigned char des3_3key_subkeys[2][8] = {
677 {
678 /* K1 */
679 0x9d, 0x74, 0xe7, 0x39, 0x33, 0x17, 0x96, 0xc0
680 },
681 {
682 /* K2 */
683 0x3a, 0xe9, 0xce, 0x72, 0x66, 0x2f, 0x2d, 0x9b
684 }
685};
686static const unsigned char des3_3key_expected_result[NB_CMAC_TESTS_PER_KEY][MBEDTLS_DES3_BLOCK_SIZE]
687 = {
688 {
689 /* Sample #1 */
690 0x7d, 0xb0, 0xd3, 0x7d, 0xf9, 0x36, 0xc5, 0x50
691 },
692 {
693 /* Sample #2 */
694 0x30, 0x23, 0x9c, 0xf1, 0xf5, 0x2e, 0x66, 0x09
695 },
696 {
697 /* Sample #3 */
698 0x6c, 0x9f, 0x3e, 0xe4, 0x92, 0x3f, 0x6b, 0xe2
699 },
700 {
701 /* Sample #4 */
702 0x99, 0x42, 0x9b, 0xd0, 0xbF, 0x79, 0x04, 0xe5
703 }
704 };
705
706#endif /* MBEDTLS_DES_C */
707
708#if defined(MBEDTLS_AES_C)
709/* AES AES-CMAC-PRF-128 Test Data */
710static const unsigned char PRFK[] = {
711 /* Key */
712 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
713 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
714 0xed, 0xcb
715};
716
717/* Sizes in bytes */
718static const size_t PRFKlen[NB_PRF_TESTS] = {
719 18,
720 16,
721 10
722};
723
724/* Message */
725static const unsigned char PRFM[] = {
726 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
727 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
728 0x10, 0x11, 0x12, 0x13
729};
730
731static const unsigned char PRFT[NB_PRF_TESTS][16] = {
732 {
733 0x84, 0xa3, 0x48, 0xa4, 0xa4, 0x5d, 0x23, 0x5b,
734 0xab, 0xff, 0xfc, 0x0d, 0x2b, 0x4d, 0xa0, 0x9a
735 },
736 {
737 0x98, 0x0a, 0xe8, 0x7b, 0x5f, 0x4c, 0x9c, 0x52,
738 0x14, 0xf5, 0xb6, 0xa8, 0x45, 0x5e, 0x4c, 0x2d
739 },
740 {
741 0x29, 0x0d, 0x9e, 0x11, 0x2e, 0xdb, 0x09, 0xee,
742 0x14, 0x1f, 0xcf, 0x64, 0xc0, 0xb7, 0x2f, 0x3d
743 }
744};
745#endif /* MBEDTLS_AES_C */
746
747static int cmac_test_subkeys(int verbose,
748 const char *testname,
749 const unsigned char *key,
750 int keybits,
751 const unsigned char *subkeys,
752 mbedtls_cipher_type_t cipher_type,
753 int block_size,
754 int num_tests)
755{
756 int i, ret = 0;
757 mbedtls_cipher_context_t ctx;
758 const mbedtls_cipher_info_t *cipher_info;
759 unsigned char K1[MBEDTLS_CIPHER_BLKSIZE_MAX];
760 unsigned char K2[MBEDTLS_CIPHER_BLKSIZE_MAX];
761
762 cipher_info = mbedtls_cipher_info_from_type(cipher_type);
763 if (cipher_info == NULL) {
764 /* Failing at this point must be due to a build issue */
765 return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
766 }
767
768 for (i = 0; i < num_tests; i++) {
769 if (verbose != 0) {
770 mbedtls_printf(" %s CMAC subkey #%d: ", testname, i + 1);
771 }
772
773 mbedtls_cipher_init(&ctx);
774
775 if ((ret = mbedtls_cipher_setup(&ctx, cipher_info)) != 0) {
776 if (verbose != 0) {
777 mbedtls_printf("test execution failed\n");
778 }
779
780 goto cleanup;
781 }
782
783 if ((ret = mbedtls_cipher_setkey(&ctx, key, keybits,
784 MBEDTLS_ENCRYPT)) != 0) {
785 /* When CMAC is implemented by an alternative implementation, or
786 * the underlying primitive itself is implemented alternatively,
787 * AES-192 may be unavailable. This should not cause the selftest
788 * function to fail. */
789 if ((ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED ||
790 ret == MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE) &&
791 cipher_type == MBEDTLS_CIPHER_AES_192_ECB) {
792 if (verbose != 0) {
793 mbedtls_printf("skipped\n");
794 }
795 goto next_test;
796 }
797
798 if (verbose != 0) {
799 mbedtls_printf("test execution failed\n");
800 }
801
802 goto cleanup;
803 }
804
805 ret = cmac_generate_subkeys(&ctx, K1, K2);
806 if (ret != 0) {
807 if (verbose != 0) {
808 mbedtls_printf("failed\n");
809 }
810
811 goto cleanup;
812 }
813
814 if ((ret = memcmp(K1, subkeys, block_size)) != 0 ||
815 (ret = memcmp(K2, &subkeys[block_size], block_size)) != 0) {
816 if (verbose != 0) {
817 mbedtls_printf("failed\n");
818 }
819
820 goto cleanup;
821 }
822
823 if (verbose != 0) {
824 mbedtls_printf("passed\n");
825 }
826
827next_test:
828 mbedtls_cipher_free(&ctx);
829 }
830
831 ret = 0;
832 goto exit;
833
834cleanup:
835 mbedtls_cipher_free(&ctx);
836
837exit:
838 return ret;
839}
840
841static int cmac_test_wth_cipher(int verbose,
842 const char *testname,
843 const unsigned char *key,
844 int keybits,
845 const unsigned char *messages,
846 const unsigned int message_lengths[4],
847 const unsigned char *expected_result,
848 mbedtls_cipher_type_t cipher_type,
849 int block_size,
850 int num_tests)
851{
852 const mbedtls_cipher_info_t *cipher_info;
853 int i, ret = 0;
854 unsigned char output[MBEDTLS_CIPHER_BLKSIZE_MAX];
855
856 cipher_info = mbedtls_cipher_info_from_type(cipher_type);
857 if (cipher_info == NULL) {
858 /* Failing at this point must be due to a build issue */
859 ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
860 goto exit;
861 }
862
863 for (i = 0; i < num_tests; i++) {
864 if (verbose != 0) {
865 mbedtls_printf(" %s CMAC #%d: ", testname, i + 1);
866 }
867
868 if ((ret = mbedtls_cipher_cmac(cipher_info, key, keybits, messages,
869 message_lengths[i], output)) != 0) {
870 /* When CMAC is implemented by an alternative implementation, or
871 * the underlying primitive itself is implemented alternatively,
872 * AES-192 and/or 3DES may be unavailable. This should not cause
873 * the selftest function to fail. */
874 if ((ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED ||
875 ret == MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE) &&
876 (cipher_type == MBEDTLS_CIPHER_AES_192_ECB ||
877 cipher_type == MBEDTLS_CIPHER_DES_EDE3_ECB)) {
878 if (verbose != 0) {
879 mbedtls_printf("skipped\n");
880 }
881 continue;
882 }
883
884 if (verbose != 0) {
885 mbedtls_printf("failed\n");
886 }
887 goto exit;
888 }
889
890 if ((ret = memcmp(output, &expected_result[i * block_size], block_size)) != 0) {
891 if (verbose != 0) {
892 mbedtls_printf("failed\n");
893 }
894 goto exit;
895 }
896
897 if (verbose != 0) {
898 mbedtls_printf("passed\n");
899 }
900 }
901 ret = 0;
902
903exit:
904 return ret;
905}
906
907#if defined(MBEDTLS_AES_C)
908static int test_aes128_cmac_prf(int verbose)
909{
910 int i;
911 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
912 unsigned char output[MBEDTLS_AES_BLOCK_SIZE];
913
914 for (i = 0; i < NB_PRF_TESTS; i++) {
915 mbedtls_printf(" AES CMAC 128 PRF #%d: ", i);
916 ret = mbedtls_aes_cmac_prf_128(PRFK, PRFKlen[i], PRFM, 20, output);
917 if (ret != 0 ||
918 memcmp(output, PRFT[i], MBEDTLS_AES_BLOCK_SIZE) != 0) {
919
920 if (verbose != 0) {
921 mbedtls_printf("failed\n");
922 }
923
924 return ret;
925 } else if (verbose != 0) {
926 mbedtls_printf("passed\n");
927 }
928 }
929 return ret;
930}
931#endif /* MBEDTLS_AES_C */
932
933int mbedtls_cmac_self_test(int verbose)
934{
935 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
936
937#if defined(MBEDTLS_AES_C)
938 /* AES-128 */
939 if ((ret = cmac_test_subkeys(verbose,
940 "AES 128",
941 aes_128_key,
942 128,
943 (const unsigned char *) aes_128_subkeys,
944 MBEDTLS_CIPHER_AES_128_ECB,
945 MBEDTLS_AES_BLOCK_SIZE,
946 NB_CMAC_TESTS_PER_KEY)) != 0) {
947 return ret;
948 }
949
950 if ((ret = cmac_test_wth_cipher(verbose,
951 "AES 128",
952 aes_128_key,
953 128,
954 test_message,
955 aes_message_lengths,
956 (const unsigned char *) aes_128_expected_result,
957 MBEDTLS_CIPHER_AES_128_ECB,
958 MBEDTLS_AES_BLOCK_SIZE,
959 NB_CMAC_TESTS_PER_KEY)) != 0) {
960 return ret;
961 }
962
963 /* AES-192 */
964 if ((ret = cmac_test_subkeys(verbose,
965 "AES 192",
966 aes_192_key,
967 192,
968 (const unsigned char *) aes_192_subkeys,
969 MBEDTLS_CIPHER_AES_192_ECB,
970 MBEDTLS_AES_BLOCK_SIZE,
971 NB_CMAC_TESTS_PER_KEY)) != 0) {
972 return ret;
973 }
974
975 if ((ret = cmac_test_wth_cipher(verbose,
976 "AES 192",
977 aes_192_key,
978 192,
979 test_message,
980 aes_message_lengths,
981 (const unsigned char *) aes_192_expected_result,
982 MBEDTLS_CIPHER_AES_192_ECB,
983 MBEDTLS_AES_BLOCK_SIZE,
984 NB_CMAC_TESTS_PER_KEY)) != 0) {
985 return ret;
986 }
987
988 /* AES-256 */
989 if ((ret = cmac_test_subkeys(verbose,
990 "AES 256",
991 aes_256_key,
992 256,
993 (const unsigned char *) aes_256_subkeys,
994 MBEDTLS_CIPHER_AES_256_ECB,
995 MBEDTLS_AES_BLOCK_SIZE,
996 NB_CMAC_TESTS_PER_KEY)) != 0) {
997 return ret;
998 }
999
1000 if ((ret = cmac_test_wth_cipher(verbose,
1001 "AES 256",
1002 aes_256_key,
1003 256,
1004 test_message,
1005 aes_message_lengths,
1006 (const unsigned char *) aes_256_expected_result,
1007 MBEDTLS_CIPHER_AES_256_ECB,
1008 MBEDTLS_AES_BLOCK_SIZE,
1009 NB_CMAC_TESTS_PER_KEY)) != 0) {
1010 return ret;
1011 }
1012#endif /* MBEDTLS_AES_C */
1013
1014#if defined(MBEDTLS_DES_C)
1015 /* 3DES 2 key */
1016 if ((ret = cmac_test_subkeys(verbose,
1017 "3DES 2 key",
1018 des3_2key_key,
1019 192,
1020 (const unsigned char *) des3_2key_subkeys,
1021 MBEDTLS_CIPHER_DES_EDE3_ECB,
1022 MBEDTLS_DES3_BLOCK_SIZE,
1023 NB_CMAC_TESTS_PER_KEY)) != 0) {
1024 return ret;
1025 }
1026
1027 if ((ret = cmac_test_wth_cipher(verbose,
1028 "3DES 2 key",
1029 des3_2key_key,
1030 192,
1031 test_message,
1032 des3_message_lengths,
1033 (const unsigned char *) des3_2key_expected_result,
1034 MBEDTLS_CIPHER_DES_EDE3_ECB,
1035 MBEDTLS_DES3_BLOCK_SIZE,
1036 NB_CMAC_TESTS_PER_KEY)) != 0) {
1037 return ret;
1038 }
1039
1040 /* 3DES 3 key */
1041 if ((ret = cmac_test_subkeys(verbose,
1042 "3DES 3 key",
1043 des3_3key_key,
1044 192,
1045 (const unsigned char *) des3_3key_subkeys,
1046 MBEDTLS_CIPHER_DES_EDE3_ECB,
1047 MBEDTLS_DES3_BLOCK_SIZE,
1048 NB_CMAC_TESTS_PER_KEY)) != 0) {
1049 return ret;
1050 }
1051
1052 if ((ret = cmac_test_wth_cipher(verbose,
1053 "3DES 3 key",
1054 des3_3key_key,
1055 192,
1056 test_message,
1057 des3_message_lengths,
1058 (const unsigned char *) des3_3key_expected_result,
1059 MBEDTLS_CIPHER_DES_EDE3_ECB,
1060 MBEDTLS_DES3_BLOCK_SIZE,
1061 NB_CMAC_TESTS_PER_KEY)) != 0) {
1062 return ret;
1063 }
1064#endif /* MBEDTLS_DES_C */
1065
1066#if defined(MBEDTLS_AES_C)
1067 if ((ret = test_aes128_cmac_prf(verbose)) != 0) {
1068 return ret;
1069 }
1070#endif /* MBEDTLS_AES_C */
1071
1072 if (verbose != 0) {
1073 mbedtls_printf("\n");
1074 }
1075
1076 return 0;
1077}
1078
1079#endif /* MBEDTLS_SELF_TEST */
1080
1081#endif /* MBEDTLS_CMAC_C */
1082