xref: /onnv-gate/usr/src/common/crypto/modes/ccm.c (revision 12490:7bae494c02d3)
17188Smcpowers /*
27188Smcpowers  * CDDL HEADER START
37188Smcpowers  *
47188Smcpowers  * The contents of this file are subject to the terms of the
57188Smcpowers  * Common Development and Distribution License (the "License").
67188Smcpowers  * You may not use this file except in compliance with the License.
77188Smcpowers  *
87188Smcpowers  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97188Smcpowers  * or http://www.opensolaris.org/os/licensing.
107188Smcpowers  * See the License for the specific language governing permissions
117188Smcpowers  * and limitations under the License.
127188Smcpowers  *
137188Smcpowers  * When distributing Covered Code, include this CDDL HEADER in each
147188Smcpowers  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157188Smcpowers  * If applicable, add the following below this CDDL HEADER, with the
167188Smcpowers  * fields enclosed by brackets "[]" replaced with your own identifying
177188Smcpowers  * information: Portions Copyright [yyyy] [name of copyright owner]
187188Smcpowers  *
197188Smcpowers  * CDDL HEADER END
207188Smcpowers  */
217188Smcpowers /*
22*12490SDarren.Moffat@Sun.COM  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
237188Smcpowers  */
247188Smcpowers 
257188Smcpowers #ifndef _KERNEL
267188Smcpowers #include <strings.h>
277188Smcpowers #include <limits.h>
287188Smcpowers #include <assert.h>
297188Smcpowers #include <security/cryptoki.h>
307188Smcpowers #endif
317188Smcpowers 
327188Smcpowers #include <sys/types.h>
337188Smcpowers #include <sys/kmem.h>
347188Smcpowers #include <modes/modes.h>
357188Smcpowers #include <sys/crypto/common.h>
367188Smcpowers #include <sys/crypto/impl.h>
379392Sopensolaris@drydog.com #include <sys/byteorder.h>
387188Smcpowers 
397421SDaniel.Anderson@Sun.COM #if defined(__i386) || defined(__amd64)
407421SDaniel.Anderson@Sun.COM #define	UNALIGNED_POINTERS_PERMITTED
417421SDaniel.Anderson@Sun.COM #endif
427421SDaniel.Anderson@Sun.COM 
437188Smcpowers /*
447188Smcpowers  * Encrypt multiple blocks of data in CCM mode.  Decrypt for CCM mode
457188Smcpowers  * is done in another function.
467188Smcpowers  */
477188Smcpowers int
ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))487188Smcpowers ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
497188Smcpowers     crypto_data_t *out, size_t block_size,
507188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
517188Smcpowers     void (*copy_block)(uint8_t *, uint8_t *),
527188Smcpowers     void (*xor_block)(uint8_t *, uint8_t *))
537188Smcpowers {
547188Smcpowers 	size_t remainder = length;
557188Smcpowers 	size_t need;
567188Smcpowers 	uint8_t *datap = (uint8_t *)data;
577188Smcpowers 	uint8_t *blockp;
587188Smcpowers 	uint8_t *lastp;
597188Smcpowers 	void *iov_or_mp;
607188Smcpowers 	offset_t offset;
617188Smcpowers 	uint8_t *out_data_1;
627188Smcpowers 	uint8_t *out_data_2;
637188Smcpowers 	size_t out_data_1_len;
647188Smcpowers 	uint64_t counter;
657188Smcpowers 	uint8_t *mac_buf;
667188Smcpowers 
677188Smcpowers 	if (length + ctx->ccm_remainder_len < block_size) {
687188Smcpowers 		/* accumulate bytes here and return */
697188Smcpowers 		bcopy(datap,
707188Smcpowers 		    (uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
717188Smcpowers 		    length);
727188Smcpowers 		ctx->ccm_remainder_len += length;
737188Smcpowers 		ctx->ccm_copy_to = datap;
747188Smcpowers 		return (CRYPTO_SUCCESS);
757188Smcpowers 	}
767188Smcpowers 
777188Smcpowers 	lastp = (uint8_t *)ctx->ccm_cb;
787188Smcpowers 	if (out != NULL)
797188Smcpowers 		crypto_init_ptrs(out, &iov_or_mp, &offset);
807188Smcpowers 
817188Smcpowers 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
827188Smcpowers 
837188Smcpowers 	do {
847188Smcpowers 		/* Unprocessed data from last call. */
857188Smcpowers 		if (ctx->ccm_remainder_len > 0) {
867188Smcpowers 			need = block_size - ctx->ccm_remainder_len;
877188Smcpowers 
887188Smcpowers 			if (need > remainder)
897188Smcpowers 				return (CRYPTO_DATA_LEN_RANGE);
907188Smcpowers 
917188Smcpowers 			bcopy(datap, &((uint8_t *)ctx->ccm_remainder)
927188Smcpowers 			    [ctx->ccm_remainder_len], need);
937188Smcpowers 
947188Smcpowers 			blockp = (uint8_t *)ctx->ccm_remainder;
957188Smcpowers 		} else {
967188Smcpowers 			blockp = datap;
977188Smcpowers 		}
987188Smcpowers 
997188Smcpowers 		/*
1007188Smcpowers 		 * do CBC MAC
1017188Smcpowers 		 *
1027188Smcpowers 		 * XOR the previous cipher block current clear block.
1037188Smcpowers 		 * mac_buf always contain previous cipher block.
1047188Smcpowers 		 */
1057188Smcpowers 		xor_block(blockp, mac_buf);
1067188Smcpowers 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
1077188Smcpowers 
1087188Smcpowers 		/* ccm_cb is the counter block */
1097188Smcpowers 		encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb,
1107188Smcpowers 		    (uint8_t *)ctx->ccm_tmp);
1117188Smcpowers 
1127188Smcpowers 		lastp = (uint8_t *)ctx->ccm_tmp;
1137188Smcpowers 
1147188Smcpowers 		/*
1157188Smcpowers 		 * Increment counter. Counter bits are confined
1167188Smcpowers 		 * to the bottom 64 bits of the counter block.
1177188Smcpowers 		 */
1187421SDaniel.Anderson@Sun.COM 		counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
1197421SDaniel.Anderson@Sun.COM 		counter = htonll(counter + 1);
1207188Smcpowers 		counter &= ctx->ccm_counter_mask;
1217188Smcpowers 		ctx->ccm_cb[1] =
1227188Smcpowers 		    (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
1237188Smcpowers 
1247188Smcpowers 		/*
1257329SMark.Powers@Sun.COM 		 * XOR encrypted counter block with the current clear block.
1267188Smcpowers 		 */
1277329SMark.Powers@Sun.COM 		xor_block(blockp, lastp);
1287188Smcpowers 
1297188Smcpowers 		ctx->ccm_processed_data_len += block_size;
1307188Smcpowers 
1317188Smcpowers 		if (out == NULL) {
1327188Smcpowers 			if (ctx->ccm_remainder_len > 0) {
1337188Smcpowers 				bcopy(blockp, ctx->ccm_copy_to,
1347188Smcpowers 				    ctx->ccm_remainder_len);
1357188Smcpowers 				bcopy(blockp + ctx->ccm_remainder_len, datap,
1367188Smcpowers 				    need);
1377188Smcpowers 			}
1387188Smcpowers 		} else {
1397188Smcpowers 			crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
1407188Smcpowers 			    &out_data_1_len, &out_data_2, block_size);
1417188Smcpowers 
1427188Smcpowers 			/* copy block to where it belongs */
1437188Smcpowers 			if (out_data_1_len == block_size) {
1447188Smcpowers 				copy_block(lastp, out_data_1);
1457188Smcpowers 			} else {
1467188Smcpowers 				bcopy(lastp, out_data_1, out_data_1_len);
1477188Smcpowers 				if (out_data_2 != NULL) {
1487188Smcpowers 					bcopy(lastp + out_data_1_len,
1497188Smcpowers 					    out_data_2,
1507188Smcpowers 					    block_size - out_data_1_len);
1517188Smcpowers 				}
1527188Smcpowers 			}
1537188Smcpowers 			/* update offset */
1547188Smcpowers 			out->cd_offset += block_size;
1557188Smcpowers 		}
1567188Smcpowers 
1577188Smcpowers 		/* Update pointer to next block of data to be processed. */
1587188Smcpowers 		if (ctx->ccm_remainder_len != 0) {
1597188Smcpowers 			datap += need;
1607188Smcpowers 			ctx->ccm_remainder_len = 0;
1617188Smcpowers 		} else {
1627188Smcpowers 			datap += block_size;
1637188Smcpowers 		}
1647188Smcpowers 
1657188Smcpowers 		remainder = (size_t)&data[length] - (size_t)datap;
1667188Smcpowers 
1677188Smcpowers 		/* Incomplete last block. */
1687188Smcpowers 		if (remainder > 0 && remainder < block_size) {
1697188Smcpowers 			bcopy(datap, ctx->ccm_remainder, remainder);
1707188Smcpowers 			ctx->ccm_remainder_len = remainder;
1717188Smcpowers 			ctx->ccm_copy_to = datap;
1727188Smcpowers 			goto out;
1737188Smcpowers 		}
1747188Smcpowers 		ctx->ccm_copy_to = NULL;
1757188Smcpowers 
1767188Smcpowers 	} while (remainder > 0);
1777188Smcpowers 
1787188Smcpowers out:
1797188Smcpowers 	return (CRYPTO_SUCCESS);
1807188Smcpowers }
1817188Smcpowers 
1827188Smcpowers void
calculate_ccm_mac(ccm_ctx_t * ctx,uint8_t * ccm_mac,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))1837188Smcpowers calculate_ccm_mac(ccm_ctx_t *ctx, uint8_t *ccm_mac,
1847188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
1857188Smcpowers {
1867188Smcpowers 	uint64_t counter;
1877188Smcpowers 	uint8_t *counterp, *mac_buf;
1887188Smcpowers 	int i;
1897188Smcpowers 
1907188Smcpowers 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
1917188Smcpowers 
1927188Smcpowers 	/* first counter block start with index 0 */
1937188Smcpowers 	counter = 0;
1947188Smcpowers 	ctx->ccm_cb[1] = (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
1957188Smcpowers 
1967188Smcpowers 	counterp = (uint8_t *)ctx->ccm_tmp;
1977188Smcpowers 	encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
1987188Smcpowers 
1997188Smcpowers 	/* calculate XOR of MAC with first counter block */
2007188Smcpowers 	for (i = 0; i < ctx->ccm_mac_len; i++) {
2017188Smcpowers 		ccm_mac[i] = mac_buf[i] ^ counterp[i];
2027188Smcpowers 	}
2037188Smcpowers }
2047188Smcpowers 
2057188Smcpowers /* ARGSUSED */
2067188Smcpowers int
ccm_encrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))2077188Smcpowers ccm_encrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
2087188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
2097188Smcpowers     void (*xor_block)(uint8_t *, uint8_t *))
2107188Smcpowers {
2117188Smcpowers 	uint8_t *lastp, *mac_buf, *ccm_mac_p, *macp;
2127188Smcpowers 	void *iov_or_mp;
2137188Smcpowers 	offset_t offset;
2147188Smcpowers 	uint8_t *out_data_1;
2157188Smcpowers 	uint8_t *out_data_2;
2167188Smcpowers 	size_t out_data_1_len;
2177188Smcpowers 	int i;
2187188Smcpowers 
2197188Smcpowers 	if (out->cd_length < (ctx->ccm_remainder_len + ctx->ccm_mac_len)) {
2207188Smcpowers 		return (CRYPTO_DATA_LEN_RANGE);
2217188Smcpowers 	}
2227188Smcpowers 
2237188Smcpowers 	/*
2247188Smcpowers 	 * When we get here, the number of bytes of payload processed
2257188Smcpowers 	 * plus whatever data remains, if any,
2267188Smcpowers 	 * should be the same as the number of bytes that's being
2277188Smcpowers 	 * passed in the argument during init time.
2287188Smcpowers 	 */
2297188Smcpowers 	if ((ctx->ccm_processed_data_len + ctx->ccm_remainder_len)
2307188Smcpowers 	    != (ctx->ccm_data_len)) {
2317188Smcpowers 		return (CRYPTO_DATA_LEN_RANGE);
2327188Smcpowers 	}
2337188Smcpowers 
2347188Smcpowers 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
2357188Smcpowers 
2367188Smcpowers 	if (ctx->ccm_remainder_len > 0) {
2377188Smcpowers 
2387188Smcpowers 		/* ccm_mac_input_buf is not used for encryption */
2397188Smcpowers 		macp = (uint8_t *)ctx->ccm_mac_input_buf;
2407188Smcpowers 		bzero(macp, block_size);
2417188Smcpowers 
2427188Smcpowers 		/* copy remainder to temporary buffer */
2437188Smcpowers 		bcopy(ctx->ccm_remainder, macp, ctx->ccm_remainder_len);
2447188Smcpowers 
2457188Smcpowers 		/* calculate the CBC MAC */
2467188Smcpowers 		xor_block(macp, mac_buf);
2477188Smcpowers 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
2487188Smcpowers 
2497188Smcpowers 		/* calculate the counter mode */
2507188Smcpowers 		lastp = (uint8_t *)ctx->ccm_tmp;
2517188Smcpowers 		encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, lastp);
2527188Smcpowers 
2537188Smcpowers 		/* XOR with counter block */
2547188Smcpowers 		for (i = 0; i < ctx->ccm_remainder_len; i++) {
2557188Smcpowers 			macp[i] ^= lastp[i];
2567188Smcpowers 		}
2577188Smcpowers 		ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
2587188Smcpowers 	}
2597188Smcpowers 
2607188Smcpowers 	/* Calculate the CCM MAC */
2617188Smcpowers 	ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
2627188Smcpowers 	calculate_ccm_mac(ctx, ccm_mac_p, encrypt_block);
2637188Smcpowers 
2647188Smcpowers 	crypto_init_ptrs(out, &iov_or_mp, &offset);
2657188Smcpowers 	crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
2667188Smcpowers 	    &out_data_1_len, &out_data_2,
2677188Smcpowers 	    ctx->ccm_remainder_len + ctx->ccm_mac_len);
2687188Smcpowers 
2697188Smcpowers 	if (ctx->ccm_remainder_len > 0) {
2707188Smcpowers 
2717188Smcpowers 		/* copy temporary block to where it belongs */
2727188Smcpowers 		if (out_data_2 == NULL) {
2737188Smcpowers 			/* everything will fit in out_data_1 */
2747188Smcpowers 			bcopy(macp, out_data_1, ctx->ccm_remainder_len);
2757188Smcpowers 			bcopy(ccm_mac_p, out_data_1 + ctx->ccm_remainder_len,
2767188Smcpowers 			    ctx->ccm_mac_len);
2777188Smcpowers 		} else {
2787188Smcpowers 
2797188Smcpowers 			if (out_data_1_len < ctx->ccm_remainder_len) {
2807188Smcpowers 
2817188Smcpowers 				size_t data_2_len_used;
2827188Smcpowers 
2837188Smcpowers 				bcopy(macp, out_data_1, out_data_1_len);
2847188Smcpowers 
2857188Smcpowers 				data_2_len_used = ctx->ccm_remainder_len
2867188Smcpowers 				    - out_data_1_len;
2877188Smcpowers 
2887188Smcpowers 				bcopy((uint8_t *)macp + out_data_1_len,
2897188Smcpowers 				    out_data_2, data_2_len_used);
2907188Smcpowers 				bcopy(ccm_mac_p, out_data_2 + data_2_len_used,
2917188Smcpowers 				    ctx->ccm_mac_len);
2927188Smcpowers 			} else {
2937188Smcpowers 				bcopy(macp, out_data_1, out_data_1_len);
2947188Smcpowers 				if (out_data_1_len == ctx->ccm_remainder_len) {
2957188Smcpowers 					/* mac will be in out_data_2 */
2967188Smcpowers 					bcopy(ccm_mac_p, out_data_2,
2977188Smcpowers 					    ctx->ccm_mac_len);
2987188Smcpowers 				} else {
2997421SDaniel.Anderson@Sun.COM 					size_t len_not_used = out_data_1_len -
3007188Smcpowers 					    ctx->ccm_remainder_len;
3017188Smcpowers 					/*
3027188Smcpowers 					 * part of mac in will be in
3037188Smcpowers 					 * out_data_1, part of the mac will be
3047188Smcpowers 					 * in out_data_2
3057188Smcpowers 					 */
3067188Smcpowers 					bcopy(ccm_mac_p,
3077188Smcpowers 					    out_data_1 + ctx->ccm_remainder_len,
3087188Smcpowers 					    len_not_used);
3097188Smcpowers 					bcopy(ccm_mac_p + len_not_used,
3107188Smcpowers 					    out_data_2,
3117188Smcpowers 					    ctx->ccm_mac_len - len_not_used);
3127188Smcpowers 
3137188Smcpowers 				}
3147188Smcpowers 			}
3157188Smcpowers 		}
3167188Smcpowers 	} else {
3177188Smcpowers 		/* copy block to where it belongs */
3187188Smcpowers 		bcopy(ccm_mac_p, out_data_1, out_data_1_len);
3197188Smcpowers 		if (out_data_2 != NULL) {
3207188Smcpowers 			bcopy(ccm_mac_p + out_data_1_len, out_data_2,
3217188Smcpowers 			    block_size - out_data_1_len);
3227188Smcpowers 		}
3237188Smcpowers 	}
3247188Smcpowers 	out->cd_offset += ctx->ccm_remainder_len + ctx->ccm_mac_len;
3257188Smcpowers 	ctx->ccm_remainder_len = 0;
3267188Smcpowers 	return (CRYPTO_SUCCESS);
3277188Smcpowers }
3287188Smcpowers 
3297188Smcpowers /*
3307188Smcpowers  * This will only deal with decrypting the last block of the input that
3317188Smcpowers  * might not be a multiple of block length.
3327188Smcpowers  */
3337188Smcpowers void
ccm_decrypt_incomplete_block(ccm_ctx_t * ctx,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))3347188Smcpowers ccm_decrypt_incomplete_block(ccm_ctx_t *ctx,
3357188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
3367188Smcpowers {
3377188Smcpowers 	uint8_t *datap, *outp, *counterp;
3387188Smcpowers 	int i;
3397188Smcpowers 
3407188Smcpowers 	datap = (uint8_t *)ctx->ccm_remainder;
3417188Smcpowers 	outp = &((ctx->ccm_pt_buf)[ctx->ccm_processed_data_len]);
3427188Smcpowers 
3437188Smcpowers 	counterp = (uint8_t *)ctx->ccm_tmp;
3447188Smcpowers 	encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
3457188Smcpowers 
3467188Smcpowers 	/* XOR with counter block */
3477188Smcpowers 	for (i = 0; i < ctx->ccm_remainder_len; i++) {
3487188Smcpowers 		outp[i] = datap[i] ^ counterp[i];
3497188Smcpowers 	}
3507188Smcpowers }
3517188Smcpowers 
3527188Smcpowers /*
3537188Smcpowers  * This will decrypt the cipher text.  However, the plaintext won't be
3547188Smcpowers  * returned to the caller.  It will be returned when decrypt_final() is
3557188Smcpowers  * called if the MAC matches
3567188Smcpowers  */
3577188Smcpowers /* ARGSUSED */
3587188Smcpowers int
ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))3597188Smcpowers ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
3607188Smcpowers     crypto_data_t *out, size_t block_size,
3617188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
3627188Smcpowers     void (*copy_block)(uint8_t *, uint8_t *),
3637188Smcpowers     void (*xor_block)(uint8_t *, uint8_t *))
3647188Smcpowers {
3657188Smcpowers 	size_t remainder = length;
3667188Smcpowers 	size_t need;
3677188Smcpowers 	uint8_t *datap = (uint8_t *)data;
3687188Smcpowers 	uint8_t *blockp;
3697188Smcpowers 	uint8_t *cbp;
3707188Smcpowers 	uint64_t counter;
3717188Smcpowers 	size_t pt_len, total_decrypted_len, mac_len, pm_len, pd_len;
3727188Smcpowers 	uint8_t *resultp;
3737188Smcpowers 
3747188Smcpowers 
3757188Smcpowers 	pm_len = ctx->ccm_processed_mac_len;
3767188Smcpowers 
3777188Smcpowers 	if (pm_len > 0) {
3787188Smcpowers 		uint8_t *tmp;
3797188Smcpowers 		/*
3807188Smcpowers 		 * all ciphertext has been processed, just waiting for
3817188Smcpowers 		 * part of the value of the mac
3827188Smcpowers 		 */
3837188Smcpowers 		if ((pm_len + length) > ctx->ccm_mac_len) {
3847188Smcpowers 			return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
3857188Smcpowers 		}
3867188Smcpowers 		tmp = (uint8_t *)ctx->ccm_mac_input_buf;
3877188Smcpowers 
3887188Smcpowers 		bcopy(datap, tmp + pm_len, length);
3897188Smcpowers 
3907188Smcpowers 		ctx->ccm_processed_mac_len += length;
3917188Smcpowers 		return (CRYPTO_SUCCESS);
3927188Smcpowers 	}
3937188Smcpowers 
3947188Smcpowers 	/*
3957188Smcpowers 	 * If we decrypt the given data, what total amount of data would
3967188Smcpowers 	 * have been decrypted?
3977188Smcpowers 	 */
3987188Smcpowers 	pd_len = ctx->ccm_processed_data_len;
3997188Smcpowers 	total_decrypted_len = pd_len + length + ctx->ccm_remainder_len;
4007188Smcpowers 
4017188Smcpowers 	if (total_decrypted_len >
4027188Smcpowers 	    (ctx->ccm_data_len + ctx->ccm_mac_len)) {
4037188Smcpowers 		return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
4047188Smcpowers 	}
4057188Smcpowers 
4067188Smcpowers 	pt_len = ctx->ccm_data_len;
4077188Smcpowers 
4087188Smcpowers 	if (total_decrypted_len > pt_len) {
4097188Smcpowers 		/*
4107188Smcpowers 		 * part of the input will be the MAC, need to isolate that
4117188Smcpowers 		 * to be dealt with later.  The left-over data in
4127188Smcpowers 		 * ccm_remainder_len from last time will not be part of the
4137188Smcpowers 		 * MAC.  Otherwise, it would have already been taken out
4147188Smcpowers 		 * when this call is made last time.
4157188Smcpowers 		 */
4167188Smcpowers 		size_t pt_part = pt_len - pd_len - ctx->ccm_remainder_len;
4177188Smcpowers 
4187188Smcpowers 		mac_len = length - pt_part;
4197188Smcpowers 
4207188Smcpowers 		ctx->ccm_processed_mac_len = mac_len;
4217188Smcpowers 		bcopy(data + pt_part, ctx->ccm_mac_input_buf, mac_len);
4227188Smcpowers 
4237188Smcpowers 		if (pt_part + ctx->ccm_remainder_len < block_size) {
4247188Smcpowers 			/*
4257188Smcpowers 			 * since this is last of the ciphertext, will
4267188Smcpowers 			 * just decrypt with it here
4277188Smcpowers 			 */
4287188Smcpowers 			bcopy(datap, &((uint8_t *)ctx->ccm_remainder)
4297188Smcpowers 			    [ctx->ccm_remainder_len], pt_part);
4307188Smcpowers 			ctx->ccm_remainder_len += pt_part;
4317188Smcpowers 			ccm_decrypt_incomplete_block(ctx, encrypt_block);
432*12490SDarren.Moffat@Sun.COM 			ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
4337188Smcpowers 			ctx->ccm_remainder_len = 0;
4347188Smcpowers 			return (CRYPTO_SUCCESS);
4357188Smcpowers 		} else {
4367188Smcpowers 			/* let rest of the code handle this */
4377188Smcpowers 			length = pt_part;
4387188Smcpowers 		}
4397188Smcpowers 	} else if (length + ctx->ccm_remainder_len < block_size) {
4407188Smcpowers 			/* accumulate bytes here and return */
4417188Smcpowers 		bcopy(datap,
4427188Smcpowers 		    (uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
4437188Smcpowers 		    length);
4447188Smcpowers 		ctx->ccm_remainder_len += length;
4457188Smcpowers 		ctx->ccm_copy_to = datap;
4467188Smcpowers 		return (CRYPTO_SUCCESS);
4477188Smcpowers 	}
4487188Smcpowers 
4497188Smcpowers 	do {
4507188Smcpowers 		/* Unprocessed data from last call. */
4517188Smcpowers 		if (ctx->ccm_remainder_len > 0) {
4527188Smcpowers 			need = block_size - ctx->ccm_remainder_len;
4537188Smcpowers 
4547188Smcpowers 			if (need > remainder)
4557188Smcpowers 				return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
4567188Smcpowers 
4577188Smcpowers 			bcopy(datap, &((uint8_t *)ctx->ccm_remainder)
4587188Smcpowers 			    [ctx->ccm_remainder_len], need);
4597188Smcpowers 
4607188Smcpowers 			blockp = (uint8_t *)ctx->ccm_remainder;
4617188Smcpowers 		} else {
4627188Smcpowers 			blockp = datap;
4637188Smcpowers 		}
4647188Smcpowers 
4657188Smcpowers 		/* Calculate the counter mode, ccm_cb is the counter block */
4667188Smcpowers 		cbp = (uint8_t *)ctx->ccm_tmp;
4677188Smcpowers 		encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, cbp);
4687188Smcpowers 
4697188Smcpowers 		/*
4707188Smcpowers 		 * Increment counter.
4717188Smcpowers 		 * Counter bits are confined to the bottom 64 bits
4727188Smcpowers 		 */
4737421SDaniel.Anderson@Sun.COM 		counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
4747421SDaniel.Anderson@Sun.COM 		counter = htonll(counter + 1);
4757188Smcpowers 		counter &= ctx->ccm_counter_mask;
4767188Smcpowers 		ctx->ccm_cb[1] =
4777188Smcpowers 		    (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
4787188Smcpowers 
4797188Smcpowers 		/* XOR with the ciphertext */
4807188Smcpowers 		xor_block(blockp, cbp);
4817188Smcpowers 
4827188Smcpowers 		/* Copy the plaintext to the "holding buffer" */
4837188Smcpowers 		resultp = (uint8_t *)ctx->ccm_pt_buf +
4847188Smcpowers 		    ctx->ccm_processed_data_len;
4857188Smcpowers 		copy_block(cbp, resultp);
4867188Smcpowers 
4877188Smcpowers 		ctx->ccm_processed_data_len += block_size;
4887188Smcpowers 
4897188Smcpowers 		ctx->ccm_lastp = blockp;
4907188Smcpowers 
4917188Smcpowers 		/* Update pointer to next block of data to be processed. */
4927188Smcpowers 		if (ctx->ccm_remainder_len != 0) {
4937188Smcpowers 			datap += need;
4947188Smcpowers 			ctx->ccm_remainder_len = 0;
4957188Smcpowers 		} else {
4967188Smcpowers 			datap += block_size;
4977188Smcpowers 		}
4987188Smcpowers 
4997188Smcpowers 		remainder = (size_t)&data[length] - (size_t)datap;
5007188Smcpowers 
5017188Smcpowers 		/* Incomplete last block */
5027188Smcpowers 		if (remainder > 0 && remainder < block_size) {
5037188Smcpowers 			bcopy(datap, ctx->ccm_remainder, remainder);
5047188Smcpowers 			ctx->ccm_remainder_len = remainder;
5057188Smcpowers 			ctx->ccm_copy_to = datap;
5067188Smcpowers 			if (ctx->ccm_processed_mac_len > 0) {
5077188Smcpowers 				/*
5087188Smcpowers 				 * not expecting anymore ciphertext, just
5097188Smcpowers 				 * compute plaintext for the remaining input
5107188Smcpowers 				 */
5117188Smcpowers 				ccm_decrypt_incomplete_block(ctx,
5127188Smcpowers 				    encrypt_block);
5137188Smcpowers 				ctx->ccm_processed_data_len += remainder;
5147188Smcpowers 				ctx->ccm_remainder_len = 0;
5157188Smcpowers 			}
5167188Smcpowers 			goto out;
5177188Smcpowers 		}
5187188Smcpowers 		ctx->ccm_copy_to = NULL;
5197188Smcpowers 
5207188Smcpowers 	} while (remainder > 0);
5217188Smcpowers 
5227188Smcpowers out:
5237188Smcpowers 	return (CRYPTO_SUCCESS);
5247188Smcpowers }
5257188Smcpowers 
5267188Smcpowers int
ccm_decrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))5277188Smcpowers ccm_decrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
5287188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
5297188Smcpowers     void (*copy_block)(uint8_t *, uint8_t *),
5307188Smcpowers     void (*xor_block)(uint8_t *, uint8_t *))
5317188Smcpowers {
5327188Smcpowers 	size_t mac_remain, pt_len;
5337188Smcpowers 	uint8_t *pt, *mac_buf, *macp, *ccm_mac_p;
5347537SMark.Powers@Sun.COM 	int rv;
5357188Smcpowers 
5367188Smcpowers 	pt_len = ctx->ccm_data_len;
5377188Smcpowers 
5387188Smcpowers 	/* Make sure output buffer can fit all of the plaintext */
5397188Smcpowers 	if (out->cd_length < pt_len) {
5407188Smcpowers 		return (CRYPTO_DATA_LEN_RANGE);
5417188Smcpowers 	}
5427188Smcpowers 
5437188Smcpowers 	pt = ctx->ccm_pt_buf;
5447188Smcpowers 	mac_remain = ctx->ccm_processed_data_len;
5457188Smcpowers 	mac_buf = (uint8_t *)ctx->ccm_mac_buf;
5467188Smcpowers 
5477188Smcpowers 	macp = (uint8_t *)ctx->ccm_tmp;
5487188Smcpowers 
5497188Smcpowers 	while (mac_remain > 0) {
5507188Smcpowers 
5517188Smcpowers 		if (mac_remain < block_size) {
5527188Smcpowers 			bzero(macp, block_size);
5537188Smcpowers 			bcopy(pt, macp, mac_remain);
5547188Smcpowers 			mac_remain = 0;
5557188Smcpowers 		} else {
5567188Smcpowers 			copy_block(pt, macp);
5577188Smcpowers 			mac_remain -= block_size;
5587188Smcpowers 			pt += block_size;
5597188Smcpowers 		}
5607188Smcpowers 
5617188Smcpowers 		/* calculate the CBC MAC */
5627188Smcpowers 		xor_block(macp, mac_buf);
5637188Smcpowers 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
5647188Smcpowers 	}
5657188Smcpowers 
5667188Smcpowers 	/* Calculate the CCM MAC */
5677188Smcpowers 	ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
5687188Smcpowers 	calculate_ccm_mac((ccm_ctx_t *)ctx, ccm_mac_p, encrypt_block);
5697188Smcpowers 
5707188Smcpowers 	/* compare the input CCM MAC value with what we calculated */
5717188Smcpowers 	if (bcmp(ctx->ccm_mac_input_buf, ccm_mac_p, ctx->ccm_mac_len)) {
5727188Smcpowers 		/* They don't match */
5737188Smcpowers 		return (CRYPTO_INVALID_MAC);
5747188Smcpowers 	} else {
5757537SMark.Powers@Sun.COM 		rv = crypto_put_output_data(ctx->ccm_pt_buf, out, pt_len);
5767537SMark.Powers@Sun.COM 		if (rv != CRYPTO_SUCCESS)
5777537SMark.Powers@Sun.COM 			return (rv);
5787188Smcpowers 		out->cd_offset += pt_len;
5797188Smcpowers 	}
5807188Smcpowers 	return (CRYPTO_SUCCESS);
5817188Smcpowers }
5827188Smcpowers 
5837188Smcpowers int
ccm_validate_args(CK_AES_CCM_PARAMS * ccm_param,boolean_t is_encrypt_init)5847188Smcpowers ccm_validate_args(CK_AES_CCM_PARAMS *ccm_param, boolean_t is_encrypt_init)
5857188Smcpowers {
5867188Smcpowers 	size_t macSize, nonceSize;
5877188Smcpowers 	uint8_t q;
5887188Smcpowers 	uint64_t maxValue;
5897188Smcpowers 
5907188Smcpowers 	/*
5917188Smcpowers 	 * Check the length of the MAC.  The only valid
5927188Smcpowers 	 * lengths for the MAC are: 4, 6, 8, 10, 12, 14, 16
5937188Smcpowers 	 */
5947188Smcpowers 	macSize = ccm_param->ulMACSize;
5957188Smcpowers 	if ((macSize < 4) || (macSize > 16) || ((macSize % 2) != 0)) {
5967188Smcpowers 		return (CRYPTO_MECHANISM_PARAM_INVALID);
5977188Smcpowers 	}
5987188Smcpowers 
5997188Smcpowers 	/* Check the nonce length.  Valid values are 7, 8, 9, 10, 11, 12, 13 */
6007188Smcpowers 	nonceSize = ccm_param->ulNonceSize;
6017188Smcpowers 	if ((nonceSize < 7) || (nonceSize > 13)) {
6027188Smcpowers 		return (CRYPTO_MECHANISM_PARAM_INVALID);
6037188Smcpowers 	}
6047188Smcpowers 
6057188Smcpowers 	/* q is the length of the field storing the length, in bytes */
6067188Smcpowers 	q = (uint8_t)((15 - nonceSize) & 0xFF);
6077188Smcpowers 
6087188Smcpowers 
6097188Smcpowers 	/*
6107188Smcpowers 	 * If it is decrypt, need to make sure size of ciphertext is at least
6117188Smcpowers 	 * bigger than MAC len
6127188Smcpowers 	 */
6137188Smcpowers 	if ((!is_encrypt_init) && (ccm_param->ulDataSize < macSize)) {
6147188Smcpowers 		return (CRYPTO_MECHANISM_PARAM_INVALID);
6157188Smcpowers 	}
6167188Smcpowers 
6177188Smcpowers 	/*
6187188Smcpowers 	 * Check to make sure the length of the payload is within the
6197188Smcpowers 	 * range of values allowed by q
6207188Smcpowers 	 */
6217188Smcpowers 	if (q < 8) {
6227188Smcpowers 		maxValue = (1ULL << (q * 8)) - 1;
6237188Smcpowers 	} else {
6247188Smcpowers 		maxValue = ULONG_MAX;
6257188Smcpowers 	}
6267188Smcpowers 
6277188Smcpowers 	if (ccm_param->ulDataSize > maxValue) {
6287188Smcpowers 		return (CRYPTO_MECHANISM_PARAM_INVALID);
6297188Smcpowers 	}
6307188Smcpowers 	return (CRYPTO_SUCCESS);
6317188Smcpowers }
6327188Smcpowers 
6337188Smcpowers /*
6347188Smcpowers  * Format the first block used in CBC-MAC (B0) and the initial counter
6357188Smcpowers  * block based on formatting functions and counter generation functions
6367188Smcpowers  * specified in RFC 3610 and NIST publication 800-38C, appendix A
6377188Smcpowers  *
6387188Smcpowers  * b0 is the first block used in CBC-MAC
6397188Smcpowers  * cb0 is the first counter block
6407188Smcpowers  *
6417188Smcpowers  * It's assumed that the arguments b0 and cb0 are preallocated AES blocks
6427188Smcpowers  *
6437188Smcpowers  */
6447188Smcpowers static void
ccm_format_initial_blocks(uchar_t * nonce,ulong_t nonceSize,ulong_t authDataSize,uint8_t * b0,ccm_ctx_t * aes_ctx)6457188Smcpowers ccm_format_initial_blocks(uchar_t *nonce, ulong_t nonceSize,
6467188Smcpowers     ulong_t authDataSize, uint8_t *b0, ccm_ctx_t *aes_ctx)
6477188Smcpowers {
6487188Smcpowers 	uint64_t payloadSize;
6497188Smcpowers 	uint8_t t, q, have_adata = 0;
6507188Smcpowers 	size_t limit;
6517188Smcpowers 	int i, j, k;
6527188Smcpowers 	uint64_t mask = 0;
6537188Smcpowers 	uint8_t *cb;
6547188Smcpowers 
6557188Smcpowers 	q = (uint8_t)((15 - nonceSize) & 0xFF);
6567188Smcpowers 	t = (uint8_t)((aes_ctx->ccm_mac_len) & 0xFF);
6577188Smcpowers 
6587188Smcpowers 	/* Construct the first octet of b0 */
6597188Smcpowers 	if (authDataSize > 0) {
6607188Smcpowers 		have_adata = 1;
6617188Smcpowers 	}
6627188Smcpowers 	b0[0] = (have_adata << 6) | (((t - 2)  / 2) << 3) | (q - 1);
6637188Smcpowers 
6647188Smcpowers 	/* copy the nonce value into b0 */
6657188Smcpowers 	bcopy(nonce, &(b0[1]), nonceSize);
6667188Smcpowers 
6677188Smcpowers 	/* store the length of the payload into b0 */
6687188Smcpowers 	bzero(&(b0[1+nonceSize]), q);
6697188Smcpowers 
6707188Smcpowers 	payloadSize = aes_ctx->ccm_data_len;
6717188Smcpowers 	limit = 8 < q ? 8 : q;
6727188Smcpowers 
6737188Smcpowers 	for (i = 0, j = 0, k = 15; i < limit; i++, j += 8, k--) {
6747188Smcpowers 		b0[k] = (uint8_t)((payloadSize >> j) & 0xFF);
6757188Smcpowers 	}
6767188Smcpowers 
6777188Smcpowers 	/* format the counter block */
6787188Smcpowers 
6797188Smcpowers 	cb = (uint8_t *)aes_ctx->ccm_cb;
6807188Smcpowers 
6817188Smcpowers 	cb[0] = 0x07 & (q-1); /* first byte */
6827188Smcpowers 
6837188Smcpowers 	/* copy the nonce value into the counter block */
6847188Smcpowers 	bcopy(nonce, &(cb[1]), nonceSize);
6857188Smcpowers 
6867188Smcpowers 	bzero(&(cb[1+nonceSize]), q);
6877188Smcpowers 
6887188Smcpowers 	/* Create the mask for the counter field based on the size of nonce */
6897188Smcpowers 	q <<= 3;
6907188Smcpowers 	while (q-- > 0) {
6917188Smcpowers 		mask |= (1ULL << q);
6927188Smcpowers 	}
6937188Smcpowers 
6949392Sopensolaris@drydog.com 	aes_ctx->ccm_counter_mask = htonll(mask);
6957188Smcpowers 
6967188Smcpowers 	/*
6977188Smcpowers 	 * During calculation, we start using counter block 1, we will
6987188Smcpowers 	 * set it up right here.
6997188Smcpowers 	 * We can just set the last byte to have the value 1, because
7007188Smcpowers 	 * even with the biggest nonce of 13, the last byte of the
7017188Smcpowers 	 * counter block will be used for the counter value.
7027188Smcpowers 	 */
7037188Smcpowers 	cb[15] = 0x01;
7047188Smcpowers }
7057188Smcpowers 
7067188Smcpowers /*
7077188Smcpowers  * Encode the length of the associated data as
7087188Smcpowers  * specified in RFC 3610 and NIST publication 800-38C, appendix A
7097188Smcpowers  */
7107188Smcpowers static void
encode_adata_len(ulong_t auth_data_len,uint8_t * encoded,size_t * encoded_len)7117188Smcpowers encode_adata_len(ulong_t auth_data_len, uint8_t *encoded, size_t *encoded_len)
7127188Smcpowers {
7137421SDaniel.Anderson@Sun.COM #ifdef UNALIGNED_POINTERS_PERMITTED
7147421SDaniel.Anderson@Sun.COM 	uint32_t	*lencoded_ptr;
7157421SDaniel.Anderson@Sun.COM #ifdef _LP64
7167421SDaniel.Anderson@Sun.COM 	uint64_t	*llencoded_ptr;
7177421SDaniel.Anderson@Sun.COM #endif
7187421SDaniel.Anderson@Sun.COM #endif	/* UNALIGNED_POINTERS_PERMITTED */
7197421SDaniel.Anderson@Sun.COM 
7207188Smcpowers 	if (auth_data_len < ((1ULL<<16) - (1ULL<<8))) {
7217188Smcpowers 		/* 0 < a < (2^16-2^8) */
7227188Smcpowers 		*encoded_len = 2;
7237188Smcpowers 		encoded[0] = (auth_data_len & 0xff00) >> 8;
7247188Smcpowers 		encoded[1] = auth_data_len & 0xff;
7257188Smcpowers 
7267188Smcpowers 	} else if ((auth_data_len >= ((1ULL<<16) - (1ULL<<8))) &&
7277188Smcpowers 	    (auth_data_len < (1ULL << 31))) {
7287188Smcpowers 		/* (2^16-2^8) <= a < 2^32 */
7297188Smcpowers 		*encoded_len = 6;
7307188Smcpowers 		encoded[0] = 0xff;
7317188Smcpowers 		encoded[1] = 0xfe;
7327421SDaniel.Anderson@Sun.COM #ifdef UNALIGNED_POINTERS_PERMITTED
73311413Sopensolaris@drydog.com 		lencoded_ptr = (uint32_t *)(void *)&encoded[2];
7347421SDaniel.Anderson@Sun.COM 		*lencoded_ptr = htonl(auth_data_len);
7357421SDaniel.Anderson@Sun.COM #else
7367188Smcpowers 		encoded[2] = (auth_data_len & 0xff000000) >> 24;
7377188Smcpowers 		encoded[3] = (auth_data_len & 0xff0000) >> 16;
7387188Smcpowers 		encoded[4] = (auth_data_len & 0xff00) >> 8;
7397188Smcpowers 		encoded[5] = auth_data_len & 0xff;
7407421SDaniel.Anderson@Sun.COM #endif	/* UNALIGNED_POINTERS_PERMITTED */
7417421SDaniel.Anderson@Sun.COM 
7427188Smcpowers #ifdef _LP64
7437188Smcpowers 	} else {
7447188Smcpowers 		/* 2^32 <= a < 2^64 */
7457188Smcpowers 		*encoded_len = 10;
7467188Smcpowers 		encoded[0] = 0xff;
7477188Smcpowers 		encoded[1] = 0xff;
7487421SDaniel.Anderson@Sun.COM #ifdef UNALIGNED_POINTERS_PERMITTED
74911413Sopensolaris@drydog.com 		llencoded_ptr = (uint64_t *)(void *)&encoded[2];
7507421SDaniel.Anderson@Sun.COM 		*llencoded_ptr = htonl(auth_data_len);
7517421SDaniel.Anderson@Sun.COM #else
7527188Smcpowers 		encoded[2] = (auth_data_len & 0xff00000000000000) >> 56;
7537188Smcpowers 		encoded[3] = (auth_data_len & 0xff000000000000) >> 48;
7547188Smcpowers 		encoded[4] = (auth_data_len & 0xff0000000000) >> 40;
7557188Smcpowers 		encoded[5] = (auth_data_len & 0xff00000000) >> 32;
7567188Smcpowers 		encoded[6] = (auth_data_len & 0xff000000) >> 24;
7577188Smcpowers 		encoded[7] = (auth_data_len & 0xff0000) >> 16;
7587188Smcpowers 		encoded[8] = (auth_data_len & 0xff00) >> 8;
7597188Smcpowers 		encoded[9] = auth_data_len & 0xff;
7607421SDaniel.Anderson@Sun.COM #endif	/* UNALIGNED_POINTERS_PERMITTED */
7617188Smcpowers #endif	/* _LP64 */
7627188Smcpowers 	}
7637188Smcpowers }
7647188Smcpowers 
7657188Smcpowers /*
7667188Smcpowers  * The following function should be call at encrypt or decrypt init time
7677188Smcpowers  * for AES CCM mode.
7687188Smcpowers  */
7697188Smcpowers int
ccm_init(ccm_ctx_t * ctx,unsigned char * nonce,size_t nonce_len,unsigned char * auth_data,size_t auth_data_len,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))7707188Smcpowers ccm_init(ccm_ctx_t *ctx, unsigned char *nonce, size_t nonce_len,
7717188Smcpowers     unsigned char *auth_data, size_t auth_data_len, size_t block_size,
7727188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
7737188Smcpowers     void (*xor_block)(uint8_t *, uint8_t *))
7747188Smcpowers {
7757188Smcpowers 	uint8_t *mac_buf, *datap, *ivp, *authp;
7767188Smcpowers 	size_t remainder, processed;
7777188Smcpowers 	uint8_t encoded_a[10]; /* max encoded auth data length is 10 octets */
7787188Smcpowers 	size_t encoded_a_len = 0;
7797188Smcpowers 
7807188Smcpowers 	mac_buf = (uint8_t *)&(ctx->ccm_mac_buf);
7817188Smcpowers 
7827188Smcpowers 	/*
7837188Smcpowers 	 * Format the 1st block for CBC-MAC and construct the
7847188Smcpowers 	 * 1st counter block.
7857188Smcpowers 	 *
7867188Smcpowers 	 * aes_ctx->ccm_iv is used for storing the counter block
7877188Smcpowers 	 * mac_buf will store b0 at this time.
7887188Smcpowers 	 */
7897188Smcpowers 	ccm_format_initial_blocks(nonce, nonce_len,
7907188Smcpowers 	    auth_data_len, mac_buf, ctx);
7917188Smcpowers 
7927188Smcpowers 	/* The IV for CBC MAC for AES CCM mode is always zero */
7937188Smcpowers 	ivp = (uint8_t *)ctx->ccm_tmp;
7947188Smcpowers 	bzero(ivp, block_size);
7957188Smcpowers 
7967188Smcpowers 	xor_block(ivp, mac_buf);
7977188Smcpowers 
7987188Smcpowers 	/* encrypt the nonce */
7997188Smcpowers 	encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
8007188Smcpowers 
8017188Smcpowers 	/* take care of the associated data, if any */
8027188Smcpowers 	if (auth_data_len == 0) {
8037188Smcpowers 		return (CRYPTO_SUCCESS);
8047188Smcpowers 	}
8057188Smcpowers 
8067188Smcpowers 	encode_adata_len(auth_data_len, encoded_a, &encoded_a_len);
8077188Smcpowers 
8087188Smcpowers 	remainder = auth_data_len;
8097188Smcpowers 
8107188Smcpowers 	/* 1st block: it contains encoded associated data, and some data */
8117188Smcpowers 	authp = (uint8_t *)ctx->ccm_tmp;
8127188Smcpowers 	bzero(authp, block_size);
8137188Smcpowers 	bcopy(encoded_a, authp, encoded_a_len);
8147188Smcpowers 	processed = block_size - encoded_a_len;
8157188Smcpowers 	if (processed > auth_data_len) {
8167188Smcpowers 		/* in case auth_data is very small */
8177188Smcpowers 		processed = auth_data_len;
8187188Smcpowers 	}
8197188Smcpowers 	bcopy(auth_data, authp+encoded_a_len, processed);
8207188Smcpowers 	/* xor with previous buffer */
8217188Smcpowers 	xor_block(authp, mac_buf);
8227188Smcpowers 	encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
8237188Smcpowers 	remainder -= processed;
8247188Smcpowers 	if (remainder == 0) {
8257188Smcpowers 		/* a small amount of associated data, it's all done now */
8267188Smcpowers 		return (CRYPTO_SUCCESS);
8277188Smcpowers 	}
8287188Smcpowers 
8297188Smcpowers 	do {
8307188Smcpowers 		if (remainder < block_size) {
8317188Smcpowers 			/*
8327188Smcpowers 			 * There's not a block full of data, pad rest of
8337188Smcpowers 			 * buffer with zero
8347188Smcpowers 			 */
8357188Smcpowers 			bzero(authp, block_size);
8367188Smcpowers 			bcopy(&(auth_data[processed]), authp, remainder);
8377188Smcpowers 			datap = (uint8_t *)authp;
8387188Smcpowers 			remainder = 0;
8397188Smcpowers 		} else {
8407188Smcpowers 			datap = (uint8_t *)(&(auth_data[processed]));
8417188Smcpowers 			processed += block_size;
8427188Smcpowers 			remainder -= block_size;
8437188Smcpowers 		}
8447188Smcpowers 
8457188Smcpowers 		xor_block(datap, mac_buf);
8467188Smcpowers 		encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
8477188Smcpowers 
8487188Smcpowers 	} while (remainder > 0);
8497188Smcpowers 
8507188Smcpowers 	return (CRYPTO_SUCCESS);
8517188Smcpowers }
8527188Smcpowers 
8537188Smcpowers int
ccm_init_ctx(ccm_ctx_t * ccm_ctx,char * param,int kmflag,boolean_t is_encrypt_init,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))8547188Smcpowers ccm_init_ctx(ccm_ctx_t *ccm_ctx, char *param, int kmflag,
8557188Smcpowers     boolean_t is_encrypt_init, size_t block_size,
8567188Smcpowers     int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
8577188Smcpowers     void (*xor_block)(uint8_t *, uint8_t *))
8587188Smcpowers {
8597188Smcpowers 	int rv;
8607188Smcpowers 	CK_AES_CCM_PARAMS *ccm_param;
8617188Smcpowers 
8627188Smcpowers 	if (param != NULL) {
86311413Sopensolaris@drydog.com 		ccm_param = (CK_AES_CCM_PARAMS *)(void *)param;
8647188Smcpowers 
8657188Smcpowers 		if ((rv = ccm_validate_args(ccm_param,
8667188Smcpowers 		    is_encrypt_init)) != 0) {
8677188Smcpowers 			return (rv);
8687188Smcpowers 		}
8697188Smcpowers 
8707188Smcpowers 		ccm_ctx->ccm_mac_len = ccm_param->ulMACSize;
8717188Smcpowers 		if (is_encrypt_init) {
8727188Smcpowers 			ccm_ctx->ccm_data_len = ccm_param->ulDataSize;
8737188Smcpowers 		} else {
8747188Smcpowers 			ccm_ctx->ccm_data_len =
8757188Smcpowers 			    ccm_param->ulDataSize - ccm_ctx->ccm_mac_len;
8767188Smcpowers 			ccm_ctx->ccm_processed_mac_len = 0;
8777188Smcpowers 		}
8787188Smcpowers 		ccm_ctx->ccm_processed_data_len = 0;
8797188Smcpowers 
8807188Smcpowers 		ccm_ctx->ccm_flags |= CCM_MODE;
8817188Smcpowers 	} else {
8827188Smcpowers 		rv = CRYPTO_MECHANISM_PARAM_INVALID;
8837188Smcpowers 		goto out;
8847188Smcpowers 	}
8857188Smcpowers 
8867188Smcpowers 	if (ccm_init(ccm_ctx, ccm_param->nonce, ccm_param->ulNonceSize,
8877188Smcpowers 	    ccm_param->authData, ccm_param->ulAuthDataSize, block_size,
8887188Smcpowers 	    encrypt_block, xor_block) != 0) {
8897188Smcpowers 		rv = CRYPTO_MECHANISM_PARAM_INVALID;
8907188Smcpowers 		goto out;
8917188Smcpowers 	}
8927188Smcpowers 	if (!is_encrypt_init) {
8937188Smcpowers 		/* allocate buffer for storing decrypted plaintext */
8947188Smcpowers #ifdef _KERNEL
8957188Smcpowers 		ccm_ctx->ccm_pt_buf = kmem_alloc(ccm_ctx->ccm_data_len,
8967188Smcpowers 		    kmflag);
8977188Smcpowers #else
8987188Smcpowers 		ccm_ctx->ccm_pt_buf = malloc(ccm_ctx->ccm_data_len);
8997188Smcpowers #endif
9007188Smcpowers 		if (ccm_ctx->ccm_pt_buf == NULL) {
9017188Smcpowers 			rv = CRYPTO_HOST_MEMORY;
9027188Smcpowers 		}
9037188Smcpowers 	}
9047188Smcpowers out:
9057188Smcpowers 	return (rv);
9067188Smcpowers }
9077188Smcpowers 
9087188Smcpowers void *
ccm_alloc_ctx(int kmflag)9097188Smcpowers ccm_alloc_ctx(int kmflag)
9107188Smcpowers {
9117188Smcpowers 	ccm_ctx_t *ccm_ctx;
9127188Smcpowers 
9137188Smcpowers #ifdef _KERNEL
9147188Smcpowers 	if ((ccm_ctx = kmem_zalloc(sizeof (ccm_ctx_t), kmflag)) == NULL)
9157188Smcpowers #else
9167188Smcpowers 	if ((ccm_ctx = calloc(1, sizeof (ccm_ctx_t))) == NULL)
9177188Smcpowers #endif
9187188Smcpowers 		return (NULL);
9197188Smcpowers 
9207188Smcpowers 	ccm_ctx->ccm_flags = CCM_MODE;
9217188Smcpowers 	return (ccm_ctx);
9227188Smcpowers }
923