17188Smcpowers /*
27188Smcpowers * CDDL HEADER START
37188Smcpowers *
47188Smcpowers * The contents of this file are subject to the terms of the
57188Smcpowers * Common Development and Distribution License (the "License").
67188Smcpowers * You may not use this file except in compliance with the License.
77188Smcpowers *
87188Smcpowers * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97188Smcpowers * or http://www.opensolaris.org/os/licensing.
107188Smcpowers * See the License for the specific language governing permissions
117188Smcpowers * and limitations under the License.
127188Smcpowers *
137188Smcpowers * When distributing Covered Code, include this CDDL HEADER in each
147188Smcpowers * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157188Smcpowers * If applicable, add the following below this CDDL HEADER, with the
167188Smcpowers * fields enclosed by brackets "[]" replaced with your own identifying
177188Smcpowers * information: Portions Copyright [yyyy] [name of copyright owner]
187188Smcpowers *
197188Smcpowers * CDDL HEADER END
207188Smcpowers */
217188Smcpowers /*
22*12490SDarren.Moffat@Sun.COM * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
237188Smcpowers */
247188Smcpowers
257188Smcpowers #ifndef _KERNEL
267188Smcpowers #include <strings.h>
277188Smcpowers #include <limits.h>
287188Smcpowers #include <assert.h>
297188Smcpowers #include <security/cryptoki.h>
307188Smcpowers #endif
317188Smcpowers
327188Smcpowers #include <sys/types.h>
337188Smcpowers #include <sys/kmem.h>
347188Smcpowers #include <modes/modes.h>
357188Smcpowers #include <sys/crypto/common.h>
367188Smcpowers #include <sys/crypto/impl.h>
379392Sopensolaris@drydog.com #include <sys/byteorder.h>
387188Smcpowers
397421SDaniel.Anderson@Sun.COM #if defined(__i386) || defined(__amd64)
407421SDaniel.Anderson@Sun.COM #define UNALIGNED_POINTERS_PERMITTED
417421SDaniel.Anderson@Sun.COM #endif
427421SDaniel.Anderson@Sun.COM
437188Smcpowers /*
447188Smcpowers * Encrypt multiple blocks of data in CCM mode. Decrypt for CCM mode
457188Smcpowers * is done in another function.
467188Smcpowers */
477188Smcpowers int
ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))487188Smcpowers ccm_mode_encrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
497188Smcpowers crypto_data_t *out, size_t block_size,
507188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
517188Smcpowers void (*copy_block)(uint8_t *, uint8_t *),
527188Smcpowers void (*xor_block)(uint8_t *, uint8_t *))
537188Smcpowers {
547188Smcpowers size_t remainder = length;
557188Smcpowers size_t need;
567188Smcpowers uint8_t *datap = (uint8_t *)data;
577188Smcpowers uint8_t *blockp;
587188Smcpowers uint8_t *lastp;
597188Smcpowers void *iov_or_mp;
607188Smcpowers offset_t offset;
617188Smcpowers uint8_t *out_data_1;
627188Smcpowers uint8_t *out_data_2;
637188Smcpowers size_t out_data_1_len;
647188Smcpowers uint64_t counter;
657188Smcpowers uint8_t *mac_buf;
667188Smcpowers
677188Smcpowers if (length + ctx->ccm_remainder_len < block_size) {
687188Smcpowers /* accumulate bytes here and return */
697188Smcpowers bcopy(datap,
707188Smcpowers (uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
717188Smcpowers length);
727188Smcpowers ctx->ccm_remainder_len += length;
737188Smcpowers ctx->ccm_copy_to = datap;
747188Smcpowers return (CRYPTO_SUCCESS);
757188Smcpowers }
767188Smcpowers
777188Smcpowers lastp = (uint8_t *)ctx->ccm_cb;
787188Smcpowers if (out != NULL)
797188Smcpowers crypto_init_ptrs(out, &iov_or_mp, &offset);
807188Smcpowers
817188Smcpowers mac_buf = (uint8_t *)ctx->ccm_mac_buf;
827188Smcpowers
837188Smcpowers do {
847188Smcpowers /* Unprocessed data from last call. */
857188Smcpowers if (ctx->ccm_remainder_len > 0) {
867188Smcpowers need = block_size - ctx->ccm_remainder_len;
877188Smcpowers
887188Smcpowers if (need > remainder)
897188Smcpowers return (CRYPTO_DATA_LEN_RANGE);
907188Smcpowers
917188Smcpowers bcopy(datap, &((uint8_t *)ctx->ccm_remainder)
927188Smcpowers [ctx->ccm_remainder_len], need);
937188Smcpowers
947188Smcpowers blockp = (uint8_t *)ctx->ccm_remainder;
957188Smcpowers } else {
967188Smcpowers blockp = datap;
977188Smcpowers }
987188Smcpowers
997188Smcpowers /*
1007188Smcpowers * do CBC MAC
1017188Smcpowers *
1027188Smcpowers * XOR the previous cipher block current clear block.
1037188Smcpowers * mac_buf always contain previous cipher block.
1047188Smcpowers */
1057188Smcpowers xor_block(blockp, mac_buf);
1067188Smcpowers encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
1077188Smcpowers
1087188Smcpowers /* ccm_cb is the counter block */
1097188Smcpowers encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb,
1107188Smcpowers (uint8_t *)ctx->ccm_tmp);
1117188Smcpowers
1127188Smcpowers lastp = (uint8_t *)ctx->ccm_tmp;
1137188Smcpowers
1147188Smcpowers /*
1157188Smcpowers * Increment counter. Counter bits are confined
1167188Smcpowers * to the bottom 64 bits of the counter block.
1177188Smcpowers */
1187421SDaniel.Anderson@Sun.COM counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
1197421SDaniel.Anderson@Sun.COM counter = htonll(counter + 1);
1207188Smcpowers counter &= ctx->ccm_counter_mask;
1217188Smcpowers ctx->ccm_cb[1] =
1227188Smcpowers (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
1237188Smcpowers
1247188Smcpowers /*
1257329SMark.Powers@Sun.COM * XOR encrypted counter block with the current clear block.
1267188Smcpowers */
1277329SMark.Powers@Sun.COM xor_block(blockp, lastp);
1287188Smcpowers
1297188Smcpowers ctx->ccm_processed_data_len += block_size;
1307188Smcpowers
1317188Smcpowers if (out == NULL) {
1327188Smcpowers if (ctx->ccm_remainder_len > 0) {
1337188Smcpowers bcopy(blockp, ctx->ccm_copy_to,
1347188Smcpowers ctx->ccm_remainder_len);
1357188Smcpowers bcopy(blockp + ctx->ccm_remainder_len, datap,
1367188Smcpowers need);
1377188Smcpowers }
1387188Smcpowers } else {
1397188Smcpowers crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
1407188Smcpowers &out_data_1_len, &out_data_2, block_size);
1417188Smcpowers
1427188Smcpowers /* copy block to where it belongs */
1437188Smcpowers if (out_data_1_len == block_size) {
1447188Smcpowers copy_block(lastp, out_data_1);
1457188Smcpowers } else {
1467188Smcpowers bcopy(lastp, out_data_1, out_data_1_len);
1477188Smcpowers if (out_data_2 != NULL) {
1487188Smcpowers bcopy(lastp + out_data_1_len,
1497188Smcpowers out_data_2,
1507188Smcpowers block_size - out_data_1_len);
1517188Smcpowers }
1527188Smcpowers }
1537188Smcpowers /* update offset */
1547188Smcpowers out->cd_offset += block_size;
1557188Smcpowers }
1567188Smcpowers
1577188Smcpowers /* Update pointer to next block of data to be processed. */
1587188Smcpowers if (ctx->ccm_remainder_len != 0) {
1597188Smcpowers datap += need;
1607188Smcpowers ctx->ccm_remainder_len = 0;
1617188Smcpowers } else {
1627188Smcpowers datap += block_size;
1637188Smcpowers }
1647188Smcpowers
1657188Smcpowers remainder = (size_t)&data[length] - (size_t)datap;
1667188Smcpowers
1677188Smcpowers /* Incomplete last block. */
1687188Smcpowers if (remainder > 0 && remainder < block_size) {
1697188Smcpowers bcopy(datap, ctx->ccm_remainder, remainder);
1707188Smcpowers ctx->ccm_remainder_len = remainder;
1717188Smcpowers ctx->ccm_copy_to = datap;
1727188Smcpowers goto out;
1737188Smcpowers }
1747188Smcpowers ctx->ccm_copy_to = NULL;
1757188Smcpowers
1767188Smcpowers } while (remainder > 0);
1777188Smcpowers
1787188Smcpowers out:
1797188Smcpowers return (CRYPTO_SUCCESS);
1807188Smcpowers }
1817188Smcpowers
1827188Smcpowers void
calculate_ccm_mac(ccm_ctx_t * ctx,uint8_t * ccm_mac,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))1837188Smcpowers calculate_ccm_mac(ccm_ctx_t *ctx, uint8_t *ccm_mac,
1847188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
1857188Smcpowers {
1867188Smcpowers uint64_t counter;
1877188Smcpowers uint8_t *counterp, *mac_buf;
1887188Smcpowers int i;
1897188Smcpowers
1907188Smcpowers mac_buf = (uint8_t *)ctx->ccm_mac_buf;
1917188Smcpowers
1927188Smcpowers /* first counter block start with index 0 */
1937188Smcpowers counter = 0;
1947188Smcpowers ctx->ccm_cb[1] = (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
1957188Smcpowers
1967188Smcpowers counterp = (uint8_t *)ctx->ccm_tmp;
1977188Smcpowers encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
1987188Smcpowers
1997188Smcpowers /* calculate XOR of MAC with first counter block */
2007188Smcpowers for (i = 0; i < ctx->ccm_mac_len; i++) {
2017188Smcpowers ccm_mac[i] = mac_buf[i] ^ counterp[i];
2027188Smcpowers }
2037188Smcpowers }
2047188Smcpowers
2057188Smcpowers /* ARGSUSED */
2067188Smcpowers int
ccm_encrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))2077188Smcpowers ccm_encrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
2087188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
2097188Smcpowers void (*xor_block)(uint8_t *, uint8_t *))
2107188Smcpowers {
2117188Smcpowers uint8_t *lastp, *mac_buf, *ccm_mac_p, *macp;
2127188Smcpowers void *iov_or_mp;
2137188Smcpowers offset_t offset;
2147188Smcpowers uint8_t *out_data_1;
2157188Smcpowers uint8_t *out_data_2;
2167188Smcpowers size_t out_data_1_len;
2177188Smcpowers int i;
2187188Smcpowers
2197188Smcpowers if (out->cd_length < (ctx->ccm_remainder_len + ctx->ccm_mac_len)) {
2207188Smcpowers return (CRYPTO_DATA_LEN_RANGE);
2217188Smcpowers }
2227188Smcpowers
2237188Smcpowers /*
2247188Smcpowers * When we get here, the number of bytes of payload processed
2257188Smcpowers * plus whatever data remains, if any,
2267188Smcpowers * should be the same as the number of bytes that's being
2277188Smcpowers * passed in the argument during init time.
2287188Smcpowers */
2297188Smcpowers if ((ctx->ccm_processed_data_len + ctx->ccm_remainder_len)
2307188Smcpowers != (ctx->ccm_data_len)) {
2317188Smcpowers return (CRYPTO_DATA_LEN_RANGE);
2327188Smcpowers }
2337188Smcpowers
2347188Smcpowers mac_buf = (uint8_t *)ctx->ccm_mac_buf;
2357188Smcpowers
2367188Smcpowers if (ctx->ccm_remainder_len > 0) {
2377188Smcpowers
2387188Smcpowers /* ccm_mac_input_buf is not used for encryption */
2397188Smcpowers macp = (uint8_t *)ctx->ccm_mac_input_buf;
2407188Smcpowers bzero(macp, block_size);
2417188Smcpowers
2427188Smcpowers /* copy remainder to temporary buffer */
2437188Smcpowers bcopy(ctx->ccm_remainder, macp, ctx->ccm_remainder_len);
2447188Smcpowers
2457188Smcpowers /* calculate the CBC MAC */
2467188Smcpowers xor_block(macp, mac_buf);
2477188Smcpowers encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
2487188Smcpowers
2497188Smcpowers /* calculate the counter mode */
2507188Smcpowers lastp = (uint8_t *)ctx->ccm_tmp;
2517188Smcpowers encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, lastp);
2527188Smcpowers
2537188Smcpowers /* XOR with counter block */
2547188Smcpowers for (i = 0; i < ctx->ccm_remainder_len; i++) {
2557188Smcpowers macp[i] ^= lastp[i];
2567188Smcpowers }
2577188Smcpowers ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
2587188Smcpowers }
2597188Smcpowers
2607188Smcpowers /* Calculate the CCM MAC */
2617188Smcpowers ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
2627188Smcpowers calculate_ccm_mac(ctx, ccm_mac_p, encrypt_block);
2637188Smcpowers
2647188Smcpowers crypto_init_ptrs(out, &iov_or_mp, &offset);
2657188Smcpowers crypto_get_ptrs(out, &iov_or_mp, &offset, &out_data_1,
2667188Smcpowers &out_data_1_len, &out_data_2,
2677188Smcpowers ctx->ccm_remainder_len + ctx->ccm_mac_len);
2687188Smcpowers
2697188Smcpowers if (ctx->ccm_remainder_len > 0) {
2707188Smcpowers
2717188Smcpowers /* copy temporary block to where it belongs */
2727188Smcpowers if (out_data_2 == NULL) {
2737188Smcpowers /* everything will fit in out_data_1 */
2747188Smcpowers bcopy(macp, out_data_1, ctx->ccm_remainder_len);
2757188Smcpowers bcopy(ccm_mac_p, out_data_1 + ctx->ccm_remainder_len,
2767188Smcpowers ctx->ccm_mac_len);
2777188Smcpowers } else {
2787188Smcpowers
2797188Smcpowers if (out_data_1_len < ctx->ccm_remainder_len) {
2807188Smcpowers
2817188Smcpowers size_t data_2_len_used;
2827188Smcpowers
2837188Smcpowers bcopy(macp, out_data_1, out_data_1_len);
2847188Smcpowers
2857188Smcpowers data_2_len_used = ctx->ccm_remainder_len
2867188Smcpowers - out_data_1_len;
2877188Smcpowers
2887188Smcpowers bcopy((uint8_t *)macp + out_data_1_len,
2897188Smcpowers out_data_2, data_2_len_used);
2907188Smcpowers bcopy(ccm_mac_p, out_data_2 + data_2_len_used,
2917188Smcpowers ctx->ccm_mac_len);
2927188Smcpowers } else {
2937188Smcpowers bcopy(macp, out_data_1, out_data_1_len);
2947188Smcpowers if (out_data_1_len == ctx->ccm_remainder_len) {
2957188Smcpowers /* mac will be in out_data_2 */
2967188Smcpowers bcopy(ccm_mac_p, out_data_2,
2977188Smcpowers ctx->ccm_mac_len);
2987188Smcpowers } else {
2997421SDaniel.Anderson@Sun.COM size_t len_not_used = out_data_1_len -
3007188Smcpowers ctx->ccm_remainder_len;
3017188Smcpowers /*
3027188Smcpowers * part of mac in will be in
3037188Smcpowers * out_data_1, part of the mac will be
3047188Smcpowers * in out_data_2
3057188Smcpowers */
3067188Smcpowers bcopy(ccm_mac_p,
3077188Smcpowers out_data_1 + ctx->ccm_remainder_len,
3087188Smcpowers len_not_used);
3097188Smcpowers bcopy(ccm_mac_p + len_not_used,
3107188Smcpowers out_data_2,
3117188Smcpowers ctx->ccm_mac_len - len_not_used);
3127188Smcpowers
3137188Smcpowers }
3147188Smcpowers }
3157188Smcpowers }
3167188Smcpowers } else {
3177188Smcpowers /* copy block to where it belongs */
3187188Smcpowers bcopy(ccm_mac_p, out_data_1, out_data_1_len);
3197188Smcpowers if (out_data_2 != NULL) {
3207188Smcpowers bcopy(ccm_mac_p + out_data_1_len, out_data_2,
3217188Smcpowers block_size - out_data_1_len);
3227188Smcpowers }
3237188Smcpowers }
3247188Smcpowers out->cd_offset += ctx->ccm_remainder_len + ctx->ccm_mac_len;
3257188Smcpowers ctx->ccm_remainder_len = 0;
3267188Smcpowers return (CRYPTO_SUCCESS);
3277188Smcpowers }
3287188Smcpowers
3297188Smcpowers /*
3307188Smcpowers * This will only deal with decrypting the last block of the input that
3317188Smcpowers * might not be a multiple of block length.
3327188Smcpowers */
3337188Smcpowers void
ccm_decrypt_incomplete_block(ccm_ctx_t * ctx,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *))3347188Smcpowers ccm_decrypt_incomplete_block(ccm_ctx_t *ctx,
3357188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *))
3367188Smcpowers {
3377188Smcpowers uint8_t *datap, *outp, *counterp;
3387188Smcpowers int i;
3397188Smcpowers
3407188Smcpowers datap = (uint8_t *)ctx->ccm_remainder;
3417188Smcpowers outp = &((ctx->ccm_pt_buf)[ctx->ccm_processed_data_len]);
3427188Smcpowers
3437188Smcpowers counterp = (uint8_t *)ctx->ccm_tmp;
3447188Smcpowers encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, counterp);
3457188Smcpowers
3467188Smcpowers /* XOR with counter block */
3477188Smcpowers for (i = 0; i < ctx->ccm_remainder_len; i++) {
3487188Smcpowers outp[i] = datap[i] ^ counterp[i];
3497188Smcpowers }
3507188Smcpowers }
3517188Smcpowers
3527188Smcpowers /*
3537188Smcpowers * This will decrypt the cipher text. However, the plaintext won't be
3547188Smcpowers * returned to the caller. It will be returned when decrypt_final() is
3557188Smcpowers * called if the MAC matches
3567188Smcpowers */
3577188Smcpowers /* ARGSUSED */
3587188Smcpowers int
ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t * ctx,char * data,size_t length,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))3597188Smcpowers ccm_mode_decrypt_contiguous_blocks(ccm_ctx_t *ctx, char *data, size_t length,
3607188Smcpowers crypto_data_t *out, size_t block_size,
3617188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
3627188Smcpowers void (*copy_block)(uint8_t *, uint8_t *),
3637188Smcpowers void (*xor_block)(uint8_t *, uint8_t *))
3647188Smcpowers {
3657188Smcpowers size_t remainder = length;
3667188Smcpowers size_t need;
3677188Smcpowers uint8_t *datap = (uint8_t *)data;
3687188Smcpowers uint8_t *blockp;
3697188Smcpowers uint8_t *cbp;
3707188Smcpowers uint64_t counter;
3717188Smcpowers size_t pt_len, total_decrypted_len, mac_len, pm_len, pd_len;
3727188Smcpowers uint8_t *resultp;
3737188Smcpowers
3747188Smcpowers
3757188Smcpowers pm_len = ctx->ccm_processed_mac_len;
3767188Smcpowers
3777188Smcpowers if (pm_len > 0) {
3787188Smcpowers uint8_t *tmp;
3797188Smcpowers /*
3807188Smcpowers * all ciphertext has been processed, just waiting for
3817188Smcpowers * part of the value of the mac
3827188Smcpowers */
3837188Smcpowers if ((pm_len + length) > ctx->ccm_mac_len) {
3847188Smcpowers return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
3857188Smcpowers }
3867188Smcpowers tmp = (uint8_t *)ctx->ccm_mac_input_buf;
3877188Smcpowers
3887188Smcpowers bcopy(datap, tmp + pm_len, length);
3897188Smcpowers
3907188Smcpowers ctx->ccm_processed_mac_len += length;
3917188Smcpowers return (CRYPTO_SUCCESS);
3927188Smcpowers }
3937188Smcpowers
3947188Smcpowers /*
3957188Smcpowers * If we decrypt the given data, what total amount of data would
3967188Smcpowers * have been decrypted?
3977188Smcpowers */
3987188Smcpowers pd_len = ctx->ccm_processed_data_len;
3997188Smcpowers total_decrypted_len = pd_len + length + ctx->ccm_remainder_len;
4007188Smcpowers
4017188Smcpowers if (total_decrypted_len >
4027188Smcpowers (ctx->ccm_data_len + ctx->ccm_mac_len)) {
4037188Smcpowers return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
4047188Smcpowers }
4057188Smcpowers
4067188Smcpowers pt_len = ctx->ccm_data_len;
4077188Smcpowers
4087188Smcpowers if (total_decrypted_len > pt_len) {
4097188Smcpowers /*
4107188Smcpowers * part of the input will be the MAC, need to isolate that
4117188Smcpowers * to be dealt with later. The left-over data in
4127188Smcpowers * ccm_remainder_len from last time will not be part of the
4137188Smcpowers * MAC. Otherwise, it would have already been taken out
4147188Smcpowers * when this call is made last time.
4157188Smcpowers */
4167188Smcpowers size_t pt_part = pt_len - pd_len - ctx->ccm_remainder_len;
4177188Smcpowers
4187188Smcpowers mac_len = length - pt_part;
4197188Smcpowers
4207188Smcpowers ctx->ccm_processed_mac_len = mac_len;
4217188Smcpowers bcopy(data + pt_part, ctx->ccm_mac_input_buf, mac_len);
4227188Smcpowers
4237188Smcpowers if (pt_part + ctx->ccm_remainder_len < block_size) {
4247188Smcpowers /*
4257188Smcpowers * since this is last of the ciphertext, will
4267188Smcpowers * just decrypt with it here
4277188Smcpowers */
4287188Smcpowers bcopy(datap, &((uint8_t *)ctx->ccm_remainder)
4297188Smcpowers [ctx->ccm_remainder_len], pt_part);
4307188Smcpowers ctx->ccm_remainder_len += pt_part;
4317188Smcpowers ccm_decrypt_incomplete_block(ctx, encrypt_block);
432*12490SDarren.Moffat@Sun.COM ctx->ccm_processed_data_len += ctx->ccm_remainder_len;
4337188Smcpowers ctx->ccm_remainder_len = 0;
4347188Smcpowers return (CRYPTO_SUCCESS);
4357188Smcpowers } else {
4367188Smcpowers /* let rest of the code handle this */
4377188Smcpowers length = pt_part;
4387188Smcpowers }
4397188Smcpowers } else if (length + ctx->ccm_remainder_len < block_size) {
4407188Smcpowers /* accumulate bytes here and return */
4417188Smcpowers bcopy(datap,
4427188Smcpowers (uint8_t *)ctx->ccm_remainder + ctx->ccm_remainder_len,
4437188Smcpowers length);
4447188Smcpowers ctx->ccm_remainder_len += length;
4457188Smcpowers ctx->ccm_copy_to = datap;
4467188Smcpowers return (CRYPTO_SUCCESS);
4477188Smcpowers }
4487188Smcpowers
4497188Smcpowers do {
4507188Smcpowers /* Unprocessed data from last call. */
4517188Smcpowers if (ctx->ccm_remainder_len > 0) {
4527188Smcpowers need = block_size - ctx->ccm_remainder_len;
4537188Smcpowers
4547188Smcpowers if (need > remainder)
4557188Smcpowers return (CRYPTO_ENCRYPTED_DATA_LEN_RANGE);
4567188Smcpowers
4577188Smcpowers bcopy(datap, &((uint8_t *)ctx->ccm_remainder)
4587188Smcpowers [ctx->ccm_remainder_len], need);
4597188Smcpowers
4607188Smcpowers blockp = (uint8_t *)ctx->ccm_remainder;
4617188Smcpowers } else {
4627188Smcpowers blockp = datap;
4637188Smcpowers }
4647188Smcpowers
4657188Smcpowers /* Calculate the counter mode, ccm_cb is the counter block */
4667188Smcpowers cbp = (uint8_t *)ctx->ccm_tmp;
4677188Smcpowers encrypt_block(ctx->ccm_keysched, (uint8_t *)ctx->ccm_cb, cbp);
4687188Smcpowers
4697188Smcpowers /*
4707188Smcpowers * Increment counter.
4717188Smcpowers * Counter bits are confined to the bottom 64 bits
4727188Smcpowers */
4737421SDaniel.Anderson@Sun.COM counter = ntohll(ctx->ccm_cb[1] & ctx->ccm_counter_mask);
4747421SDaniel.Anderson@Sun.COM counter = htonll(counter + 1);
4757188Smcpowers counter &= ctx->ccm_counter_mask;
4767188Smcpowers ctx->ccm_cb[1] =
4777188Smcpowers (ctx->ccm_cb[1] & ~(ctx->ccm_counter_mask)) | counter;
4787188Smcpowers
4797188Smcpowers /* XOR with the ciphertext */
4807188Smcpowers xor_block(blockp, cbp);
4817188Smcpowers
4827188Smcpowers /* Copy the plaintext to the "holding buffer" */
4837188Smcpowers resultp = (uint8_t *)ctx->ccm_pt_buf +
4847188Smcpowers ctx->ccm_processed_data_len;
4857188Smcpowers copy_block(cbp, resultp);
4867188Smcpowers
4877188Smcpowers ctx->ccm_processed_data_len += block_size;
4887188Smcpowers
4897188Smcpowers ctx->ccm_lastp = blockp;
4907188Smcpowers
4917188Smcpowers /* Update pointer to next block of data to be processed. */
4927188Smcpowers if (ctx->ccm_remainder_len != 0) {
4937188Smcpowers datap += need;
4947188Smcpowers ctx->ccm_remainder_len = 0;
4957188Smcpowers } else {
4967188Smcpowers datap += block_size;
4977188Smcpowers }
4987188Smcpowers
4997188Smcpowers remainder = (size_t)&data[length] - (size_t)datap;
5007188Smcpowers
5017188Smcpowers /* Incomplete last block */
5027188Smcpowers if (remainder > 0 && remainder < block_size) {
5037188Smcpowers bcopy(datap, ctx->ccm_remainder, remainder);
5047188Smcpowers ctx->ccm_remainder_len = remainder;
5057188Smcpowers ctx->ccm_copy_to = datap;
5067188Smcpowers if (ctx->ccm_processed_mac_len > 0) {
5077188Smcpowers /*
5087188Smcpowers * not expecting anymore ciphertext, just
5097188Smcpowers * compute plaintext for the remaining input
5107188Smcpowers */
5117188Smcpowers ccm_decrypt_incomplete_block(ctx,
5127188Smcpowers encrypt_block);
5137188Smcpowers ctx->ccm_processed_data_len += remainder;
5147188Smcpowers ctx->ccm_remainder_len = 0;
5157188Smcpowers }
5167188Smcpowers goto out;
5177188Smcpowers }
5187188Smcpowers ctx->ccm_copy_to = NULL;
5197188Smcpowers
5207188Smcpowers } while (remainder > 0);
5217188Smcpowers
5227188Smcpowers out:
5237188Smcpowers return (CRYPTO_SUCCESS);
5247188Smcpowers }
5257188Smcpowers
5267188Smcpowers int
ccm_decrypt_final(ccm_ctx_t * ctx,crypto_data_t * out,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* copy_block)(uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))5277188Smcpowers ccm_decrypt_final(ccm_ctx_t *ctx, crypto_data_t *out, size_t block_size,
5287188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
5297188Smcpowers void (*copy_block)(uint8_t *, uint8_t *),
5307188Smcpowers void (*xor_block)(uint8_t *, uint8_t *))
5317188Smcpowers {
5327188Smcpowers size_t mac_remain, pt_len;
5337188Smcpowers uint8_t *pt, *mac_buf, *macp, *ccm_mac_p;
5347537SMark.Powers@Sun.COM int rv;
5357188Smcpowers
5367188Smcpowers pt_len = ctx->ccm_data_len;
5377188Smcpowers
5387188Smcpowers /* Make sure output buffer can fit all of the plaintext */
5397188Smcpowers if (out->cd_length < pt_len) {
5407188Smcpowers return (CRYPTO_DATA_LEN_RANGE);
5417188Smcpowers }
5427188Smcpowers
5437188Smcpowers pt = ctx->ccm_pt_buf;
5447188Smcpowers mac_remain = ctx->ccm_processed_data_len;
5457188Smcpowers mac_buf = (uint8_t *)ctx->ccm_mac_buf;
5467188Smcpowers
5477188Smcpowers macp = (uint8_t *)ctx->ccm_tmp;
5487188Smcpowers
5497188Smcpowers while (mac_remain > 0) {
5507188Smcpowers
5517188Smcpowers if (mac_remain < block_size) {
5527188Smcpowers bzero(macp, block_size);
5537188Smcpowers bcopy(pt, macp, mac_remain);
5547188Smcpowers mac_remain = 0;
5557188Smcpowers } else {
5567188Smcpowers copy_block(pt, macp);
5577188Smcpowers mac_remain -= block_size;
5587188Smcpowers pt += block_size;
5597188Smcpowers }
5607188Smcpowers
5617188Smcpowers /* calculate the CBC MAC */
5627188Smcpowers xor_block(macp, mac_buf);
5637188Smcpowers encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
5647188Smcpowers }
5657188Smcpowers
5667188Smcpowers /* Calculate the CCM MAC */
5677188Smcpowers ccm_mac_p = (uint8_t *)ctx->ccm_tmp;
5687188Smcpowers calculate_ccm_mac((ccm_ctx_t *)ctx, ccm_mac_p, encrypt_block);
5697188Smcpowers
5707188Smcpowers /* compare the input CCM MAC value with what we calculated */
5717188Smcpowers if (bcmp(ctx->ccm_mac_input_buf, ccm_mac_p, ctx->ccm_mac_len)) {
5727188Smcpowers /* They don't match */
5737188Smcpowers return (CRYPTO_INVALID_MAC);
5747188Smcpowers } else {
5757537SMark.Powers@Sun.COM rv = crypto_put_output_data(ctx->ccm_pt_buf, out, pt_len);
5767537SMark.Powers@Sun.COM if (rv != CRYPTO_SUCCESS)
5777537SMark.Powers@Sun.COM return (rv);
5787188Smcpowers out->cd_offset += pt_len;
5797188Smcpowers }
5807188Smcpowers return (CRYPTO_SUCCESS);
5817188Smcpowers }
5827188Smcpowers
5837188Smcpowers int
ccm_validate_args(CK_AES_CCM_PARAMS * ccm_param,boolean_t is_encrypt_init)5847188Smcpowers ccm_validate_args(CK_AES_CCM_PARAMS *ccm_param, boolean_t is_encrypt_init)
5857188Smcpowers {
5867188Smcpowers size_t macSize, nonceSize;
5877188Smcpowers uint8_t q;
5887188Smcpowers uint64_t maxValue;
5897188Smcpowers
5907188Smcpowers /*
5917188Smcpowers * Check the length of the MAC. The only valid
5927188Smcpowers * lengths for the MAC are: 4, 6, 8, 10, 12, 14, 16
5937188Smcpowers */
5947188Smcpowers macSize = ccm_param->ulMACSize;
5957188Smcpowers if ((macSize < 4) || (macSize > 16) || ((macSize % 2) != 0)) {
5967188Smcpowers return (CRYPTO_MECHANISM_PARAM_INVALID);
5977188Smcpowers }
5987188Smcpowers
5997188Smcpowers /* Check the nonce length. Valid values are 7, 8, 9, 10, 11, 12, 13 */
6007188Smcpowers nonceSize = ccm_param->ulNonceSize;
6017188Smcpowers if ((nonceSize < 7) || (nonceSize > 13)) {
6027188Smcpowers return (CRYPTO_MECHANISM_PARAM_INVALID);
6037188Smcpowers }
6047188Smcpowers
6057188Smcpowers /* q is the length of the field storing the length, in bytes */
6067188Smcpowers q = (uint8_t)((15 - nonceSize) & 0xFF);
6077188Smcpowers
6087188Smcpowers
6097188Smcpowers /*
6107188Smcpowers * If it is decrypt, need to make sure size of ciphertext is at least
6117188Smcpowers * bigger than MAC len
6127188Smcpowers */
6137188Smcpowers if ((!is_encrypt_init) && (ccm_param->ulDataSize < macSize)) {
6147188Smcpowers return (CRYPTO_MECHANISM_PARAM_INVALID);
6157188Smcpowers }
6167188Smcpowers
6177188Smcpowers /*
6187188Smcpowers * Check to make sure the length of the payload is within the
6197188Smcpowers * range of values allowed by q
6207188Smcpowers */
6217188Smcpowers if (q < 8) {
6227188Smcpowers maxValue = (1ULL << (q * 8)) - 1;
6237188Smcpowers } else {
6247188Smcpowers maxValue = ULONG_MAX;
6257188Smcpowers }
6267188Smcpowers
6277188Smcpowers if (ccm_param->ulDataSize > maxValue) {
6287188Smcpowers return (CRYPTO_MECHANISM_PARAM_INVALID);
6297188Smcpowers }
6307188Smcpowers return (CRYPTO_SUCCESS);
6317188Smcpowers }
6327188Smcpowers
6337188Smcpowers /*
6347188Smcpowers * Format the first block used in CBC-MAC (B0) and the initial counter
6357188Smcpowers * block based on formatting functions and counter generation functions
6367188Smcpowers * specified in RFC 3610 and NIST publication 800-38C, appendix A
6377188Smcpowers *
6387188Smcpowers * b0 is the first block used in CBC-MAC
6397188Smcpowers * cb0 is the first counter block
6407188Smcpowers *
6417188Smcpowers * It's assumed that the arguments b0 and cb0 are preallocated AES blocks
6427188Smcpowers *
6437188Smcpowers */
6447188Smcpowers static void
ccm_format_initial_blocks(uchar_t * nonce,ulong_t nonceSize,ulong_t authDataSize,uint8_t * b0,ccm_ctx_t * aes_ctx)6457188Smcpowers ccm_format_initial_blocks(uchar_t *nonce, ulong_t nonceSize,
6467188Smcpowers ulong_t authDataSize, uint8_t *b0, ccm_ctx_t *aes_ctx)
6477188Smcpowers {
6487188Smcpowers uint64_t payloadSize;
6497188Smcpowers uint8_t t, q, have_adata = 0;
6507188Smcpowers size_t limit;
6517188Smcpowers int i, j, k;
6527188Smcpowers uint64_t mask = 0;
6537188Smcpowers uint8_t *cb;
6547188Smcpowers
6557188Smcpowers q = (uint8_t)((15 - nonceSize) & 0xFF);
6567188Smcpowers t = (uint8_t)((aes_ctx->ccm_mac_len) & 0xFF);
6577188Smcpowers
6587188Smcpowers /* Construct the first octet of b0 */
6597188Smcpowers if (authDataSize > 0) {
6607188Smcpowers have_adata = 1;
6617188Smcpowers }
6627188Smcpowers b0[0] = (have_adata << 6) | (((t - 2) / 2) << 3) | (q - 1);
6637188Smcpowers
6647188Smcpowers /* copy the nonce value into b0 */
6657188Smcpowers bcopy(nonce, &(b0[1]), nonceSize);
6667188Smcpowers
6677188Smcpowers /* store the length of the payload into b0 */
6687188Smcpowers bzero(&(b0[1+nonceSize]), q);
6697188Smcpowers
6707188Smcpowers payloadSize = aes_ctx->ccm_data_len;
6717188Smcpowers limit = 8 < q ? 8 : q;
6727188Smcpowers
6737188Smcpowers for (i = 0, j = 0, k = 15; i < limit; i++, j += 8, k--) {
6747188Smcpowers b0[k] = (uint8_t)((payloadSize >> j) & 0xFF);
6757188Smcpowers }
6767188Smcpowers
6777188Smcpowers /* format the counter block */
6787188Smcpowers
6797188Smcpowers cb = (uint8_t *)aes_ctx->ccm_cb;
6807188Smcpowers
6817188Smcpowers cb[0] = 0x07 & (q-1); /* first byte */
6827188Smcpowers
6837188Smcpowers /* copy the nonce value into the counter block */
6847188Smcpowers bcopy(nonce, &(cb[1]), nonceSize);
6857188Smcpowers
6867188Smcpowers bzero(&(cb[1+nonceSize]), q);
6877188Smcpowers
6887188Smcpowers /* Create the mask for the counter field based on the size of nonce */
6897188Smcpowers q <<= 3;
6907188Smcpowers while (q-- > 0) {
6917188Smcpowers mask |= (1ULL << q);
6927188Smcpowers }
6937188Smcpowers
6949392Sopensolaris@drydog.com aes_ctx->ccm_counter_mask = htonll(mask);
6957188Smcpowers
6967188Smcpowers /*
6977188Smcpowers * During calculation, we start using counter block 1, we will
6987188Smcpowers * set it up right here.
6997188Smcpowers * We can just set the last byte to have the value 1, because
7007188Smcpowers * even with the biggest nonce of 13, the last byte of the
7017188Smcpowers * counter block will be used for the counter value.
7027188Smcpowers */
7037188Smcpowers cb[15] = 0x01;
7047188Smcpowers }
7057188Smcpowers
7067188Smcpowers /*
7077188Smcpowers * Encode the length of the associated data as
7087188Smcpowers * specified in RFC 3610 and NIST publication 800-38C, appendix A
7097188Smcpowers */
7107188Smcpowers static void
encode_adata_len(ulong_t auth_data_len,uint8_t * encoded,size_t * encoded_len)7117188Smcpowers encode_adata_len(ulong_t auth_data_len, uint8_t *encoded, size_t *encoded_len)
7127188Smcpowers {
7137421SDaniel.Anderson@Sun.COM #ifdef UNALIGNED_POINTERS_PERMITTED
7147421SDaniel.Anderson@Sun.COM uint32_t *lencoded_ptr;
7157421SDaniel.Anderson@Sun.COM #ifdef _LP64
7167421SDaniel.Anderson@Sun.COM uint64_t *llencoded_ptr;
7177421SDaniel.Anderson@Sun.COM #endif
7187421SDaniel.Anderson@Sun.COM #endif /* UNALIGNED_POINTERS_PERMITTED */
7197421SDaniel.Anderson@Sun.COM
7207188Smcpowers if (auth_data_len < ((1ULL<<16) - (1ULL<<8))) {
7217188Smcpowers /* 0 < a < (2^16-2^8) */
7227188Smcpowers *encoded_len = 2;
7237188Smcpowers encoded[0] = (auth_data_len & 0xff00) >> 8;
7247188Smcpowers encoded[1] = auth_data_len & 0xff;
7257188Smcpowers
7267188Smcpowers } else if ((auth_data_len >= ((1ULL<<16) - (1ULL<<8))) &&
7277188Smcpowers (auth_data_len < (1ULL << 31))) {
7287188Smcpowers /* (2^16-2^8) <= a < 2^32 */
7297188Smcpowers *encoded_len = 6;
7307188Smcpowers encoded[0] = 0xff;
7317188Smcpowers encoded[1] = 0xfe;
7327421SDaniel.Anderson@Sun.COM #ifdef UNALIGNED_POINTERS_PERMITTED
73311413Sopensolaris@drydog.com lencoded_ptr = (uint32_t *)(void *)&encoded[2];
7347421SDaniel.Anderson@Sun.COM *lencoded_ptr = htonl(auth_data_len);
7357421SDaniel.Anderson@Sun.COM #else
7367188Smcpowers encoded[2] = (auth_data_len & 0xff000000) >> 24;
7377188Smcpowers encoded[3] = (auth_data_len & 0xff0000) >> 16;
7387188Smcpowers encoded[4] = (auth_data_len & 0xff00) >> 8;
7397188Smcpowers encoded[5] = auth_data_len & 0xff;
7407421SDaniel.Anderson@Sun.COM #endif /* UNALIGNED_POINTERS_PERMITTED */
7417421SDaniel.Anderson@Sun.COM
7427188Smcpowers #ifdef _LP64
7437188Smcpowers } else {
7447188Smcpowers /* 2^32 <= a < 2^64 */
7457188Smcpowers *encoded_len = 10;
7467188Smcpowers encoded[0] = 0xff;
7477188Smcpowers encoded[1] = 0xff;
7487421SDaniel.Anderson@Sun.COM #ifdef UNALIGNED_POINTERS_PERMITTED
74911413Sopensolaris@drydog.com llencoded_ptr = (uint64_t *)(void *)&encoded[2];
7507421SDaniel.Anderson@Sun.COM *llencoded_ptr = htonl(auth_data_len);
7517421SDaniel.Anderson@Sun.COM #else
7527188Smcpowers encoded[2] = (auth_data_len & 0xff00000000000000) >> 56;
7537188Smcpowers encoded[3] = (auth_data_len & 0xff000000000000) >> 48;
7547188Smcpowers encoded[4] = (auth_data_len & 0xff0000000000) >> 40;
7557188Smcpowers encoded[5] = (auth_data_len & 0xff00000000) >> 32;
7567188Smcpowers encoded[6] = (auth_data_len & 0xff000000) >> 24;
7577188Smcpowers encoded[7] = (auth_data_len & 0xff0000) >> 16;
7587188Smcpowers encoded[8] = (auth_data_len & 0xff00) >> 8;
7597188Smcpowers encoded[9] = auth_data_len & 0xff;
7607421SDaniel.Anderson@Sun.COM #endif /* UNALIGNED_POINTERS_PERMITTED */
7617188Smcpowers #endif /* _LP64 */
7627188Smcpowers }
7637188Smcpowers }
7647188Smcpowers
7657188Smcpowers /*
7667188Smcpowers * The following function should be call at encrypt or decrypt init time
7677188Smcpowers * for AES CCM mode.
7687188Smcpowers */
7697188Smcpowers int
ccm_init(ccm_ctx_t * ctx,unsigned char * nonce,size_t nonce_len,unsigned char * auth_data,size_t auth_data_len,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))7707188Smcpowers ccm_init(ccm_ctx_t *ctx, unsigned char *nonce, size_t nonce_len,
7717188Smcpowers unsigned char *auth_data, size_t auth_data_len, size_t block_size,
7727188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
7737188Smcpowers void (*xor_block)(uint8_t *, uint8_t *))
7747188Smcpowers {
7757188Smcpowers uint8_t *mac_buf, *datap, *ivp, *authp;
7767188Smcpowers size_t remainder, processed;
7777188Smcpowers uint8_t encoded_a[10]; /* max encoded auth data length is 10 octets */
7787188Smcpowers size_t encoded_a_len = 0;
7797188Smcpowers
7807188Smcpowers mac_buf = (uint8_t *)&(ctx->ccm_mac_buf);
7817188Smcpowers
7827188Smcpowers /*
7837188Smcpowers * Format the 1st block for CBC-MAC and construct the
7847188Smcpowers * 1st counter block.
7857188Smcpowers *
7867188Smcpowers * aes_ctx->ccm_iv is used for storing the counter block
7877188Smcpowers * mac_buf will store b0 at this time.
7887188Smcpowers */
7897188Smcpowers ccm_format_initial_blocks(nonce, nonce_len,
7907188Smcpowers auth_data_len, mac_buf, ctx);
7917188Smcpowers
7927188Smcpowers /* The IV for CBC MAC for AES CCM mode is always zero */
7937188Smcpowers ivp = (uint8_t *)ctx->ccm_tmp;
7947188Smcpowers bzero(ivp, block_size);
7957188Smcpowers
7967188Smcpowers xor_block(ivp, mac_buf);
7977188Smcpowers
7987188Smcpowers /* encrypt the nonce */
7997188Smcpowers encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
8007188Smcpowers
8017188Smcpowers /* take care of the associated data, if any */
8027188Smcpowers if (auth_data_len == 0) {
8037188Smcpowers return (CRYPTO_SUCCESS);
8047188Smcpowers }
8057188Smcpowers
8067188Smcpowers encode_adata_len(auth_data_len, encoded_a, &encoded_a_len);
8077188Smcpowers
8087188Smcpowers remainder = auth_data_len;
8097188Smcpowers
8107188Smcpowers /* 1st block: it contains encoded associated data, and some data */
8117188Smcpowers authp = (uint8_t *)ctx->ccm_tmp;
8127188Smcpowers bzero(authp, block_size);
8137188Smcpowers bcopy(encoded_a, authp, encoded_a_len);
8147188Smcpowers processed = block_size - encoded_a_len;
8157188Smcpowers if (processed > auth_data_len) {
8167188Smcpowers /* in case auth_data is very small */
8177188Smcpowers processed = auth_data_len;
8187188Smcpowers }
8197188Smcpowers bcopy(auth_data, authp+encoded_a_len, processed);
8207188Smcpowers /* xor with previous buffer */
8217188Smcpowers xor_block(authp, mac_buf);
8227188Smcpowers encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
8237188Smcpowers remainder -= processed;
8247188Smcpowers if (remainder == 0) {
8257188Smcpowers /* a small amount of associated data, it's all done now */
8267188Smcpowers return (CRYPTO_SUCCESS);
8277188Smcpowers }
8287188Smcpowers
8297188Smcpowers do {
8307188Smcpowers if (remainder < block_size) {
8317188Smcpowers /*
8327188Smcpowers * There's not a block full of data, pad rest of
8337188Smcpowers * buffer with zero
8347188Smcpowers */
8357188Smcpowers bzero(authp, block_size);
8367188Smcpowers bcopy(&(auth_data[processed]), authp, remainder);
8377188Smcpowers datap = (uint8_t *)authp;
8387188Smcpowers remainder = 0;
8397188Smcpowers } else {
8407188Smcpowers datap = (uint8_t *)(&(auth_data[processed]));
8417188Smcpowers processed += block_size;
8427188Smcpowers remainder -= block_size;
8437188Smcpowers }
8447188Smcpowers
8457188Smcpowers xor_block(datap, mac_buf);
8467188Smcpowers encrypt_block(ctx->ccm_keysched, mac_buf, mac_buf);
8477188Smcpowers
8487188Smcpowers } while (remainder > 0);
8497188Smcpowers
8507188Smcpowers return (CRYPTO_SUCCESS);
8517188Smcpowers }
8527188Smcpowers
8537188Smcpowers int
ccm_init_ctx(ccm_ctx_t * ccm_ctx,char * param,int kmflag,boolean_t is_encrypt_init,size_t block_size,int (* encrypt_block)(const void *,const uint8_t *,uint8_t *),void (* xor_block)(uint8_t *,uint8_t *))8547188Smcpowers ccm_init_ctx(ccm_ctx_t *ccm_ctx, char *param, int kmflag,
8557188Smcpowers boolean_t is_encrypt_init, size_t block_size,
8567188Smcpowers int (*encrypt_block)(const void *, const uint8_t *, uint8_t *),
8577188Smcpowers void (*xor_block)(uint8_t *, uint8_t *))
8587188Smcpowers {
8597188Smcpowers int rv;
8607188Smcpowers CK_AES_CCM_PARAMS *ccm_param;
8617188Smcpowers
8627188Smcpowers if (param != NULL) {
86311413Sopensolaris@drydog.com ccm_param = (CK_AES_CCM_PARAMS *)(void *)param;
8647188Smcpowers
8657188Smcpowers if ((rv = ccm_validate_args(ccm_param,
8667188Smcpowers is_encrypt_init)) != 0) {
8677188Smcpowers return (rv);
8687188Smcpowers }
8697188Smcpowers
8707188Smcpowers ccm_ctx->ccm_mac_len = ccm_param->ulMACSize;
8717188Smcpowers if (is_encrypt_init) {
8727188Smcpowers ccm_ctx->ccm_data_len = ccm_param->ulDataSize;
8737188Smcpowers } else {
8747188Smcpowers ccm_ctx->ccm_data_len =
8757188Smcpowers ccm_param->ulDataSize - ccm_ctx->ccm_mac_len;
8767188Smcpowers ccm_ctx->ccm_processed_mac_len = 0;
8777188Smcpowers }
8787188Smcpowers ccm_ctx->ccm_processed_data_len = 0;
8797188Smcpowers
8807188Smcpowers ccm_ctx->ccm_flags |= CCM_MODE;
8817188Smcpowers } else {
8827188Smcpowers rv = CRYPTO_MECHANISM_PARAM_INVALID;
8837188Smcpowers goto out;
8847188Smcpowers }
8857188Smcpowers
8867188Smcpowers if (ccm_init(ccm_ctx, ccm_param->nonce, ccm_param->ulNonceSize,
8877188Smcpowers ccm_param->authData, ccm_param->ulAuthDataSize, block_size,
8887188Smcpowers encrypt_block, xor_block) != 0) {
8897188Smcpowers rv = CRYPTO_MECHANISM_PARAM_INVALID;
8907188Smcpowers goto out;
8917188Smcpowers }
8927188Smcpowers if (!is_encrypt_init) {
8937188Smcpowers /* allocate buffer for storing decrypted plaintext */
8947188Smcpowers #ifdef _KERNEL
8957188Smcpowers ccm_ctx->ccm_pt_buf = kmem_alloc(ccm_ctx->ccm_data_len,
8967188Smcpowers kmflag);
8977188Smcpowers #else
8987188Smcpowers ccm_ctx->ccm_pt_buf = malloc(ccm_ctx->ccm_data_len);
8997188Smcpowers #endif
9007188Smcpowers if (ccm_ctx->ccm_pt_buf == NULL) {
9017188Smcpowers rv = CRYPTO_HOST_MEMORY;
9027188Smcpowers }
9037188Smcpowers }
9047188Smcpowers out:
9057188Smcpowers return (rv);
9067188Smcpowers }
9077188Smcpowers
9087188Smcpowers void *
ccm_alloc_ctx(int kmflag)9097188Smcpowers ccm_alloc_ctx(int kmflag)
9107188Smcpowers {
9117188Smcpowers ccm_ctx_t *ccm_ctx;
9127188Smcpowers
9137188Smcpowers #ifdef _KERNEL
9147188Smcpowers if ((ccm_ctx = kmem_zalloc(sizeof (ccm_ctx_t), kmflag)) == NULL)
9157188Smcpowers #else
9167188Smcpowers if ((ccm_ctx = calloc(1, sizeof (ccm_ctx_t))) == NULL)
9177188Smcpowers #endif
9187188Smcpowers return (NULL);
9197188Smcpowers
9207188Smcpowers ccm_ctx->ccm_flags = CCM_MODE;
9217188Smcpowers return (ccm_ctx);
9227188Smcpowers }
923