Secure-side AES-CMAC seam implementation. More...

#include <stddef.h>
#include <stdint.h>
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_secure.h"
#include "sec_cmac_internal.h"

Include dependency graph for sec_cmac.c:

Enumerations
enum	aes_dim_t : uint16_t { k_aes_block_bytes = 16U , k_aes_word_bytes = 4U , k_aes_state_cols = 4U , k_aes_max_rk_bytes = 240U }
	AES dimensions in bytes (FIPS 197). More...
enum	aes_off_t : uint8_t { k_aes_nr_128 = 10U , k_aes_nr_256 = 14U , k_aes_ext_sub_i = 4U , k_aes_col_mask = 3U , k_aes_msb_shift = 7U , k_aes_last_byte = 15U , k_aes_rcon_seed = 1U }
	AES round counts and small byte offsets (FIPS 197). More...
enum	aes_gf_t : uint8_t { k_aes_field_poly = 0x1BU , k_cmac_rb = 0x87U , k_cmac_pad_marker = 0x80U }
	GF field constants used by AES / CMAC. More...

Functions
static ra8_err_t	internal_cmac_check_args (const uint8_t key, uint16_t key_len, const uint8_t msg, uint32_t msg_len)
	Shared precondition check for both CMAC entry points.
static uint8_t	internal_aes_xtime (uint8_t value)
	Multiply a byte by x in GF(2^8) with the AES reduction poly.
static void	internal_aes_key_expand (const uint8_t key, uint8_t nk, uint8_t nr, uint8_t rk)
	Expand an AES key into the full round-key schedule.
static void	internal_aes_sub_shift (uint8_t *s)
	Apply SubBytes + ShiftRows to the AES state in place.
static void	internal_aes_mix_columns (uint8_t *s)
	Apply MixColumns to the AES state in place.
static void	internal_aes_encrypt (const uint8_t rk, uint8_t nr, const uint8_t in, uint8_t *out)
	Encrypt one 16-byte block with AES-nr.
static void	internal_cmac_double (const uint8_t in, uint8_t out)
	Double a 128-bit value in GF(2^128) (CMAC subkey step).
static void	internal_cmac_subkeys (const uint8_t rk, uint8_t nr, uint8_t k1, uint8_t *k2)
	Derive the CMAC subkeys K1 / K2 from the expanded key.
static void	internal_cmac_build_last (const uint8_t msg, uint32_t msg_len, uint32_t last_off, bool complete, const uint8_t k1, const uint8_t k2, uint8_t last)
	Fold the (possibly padded) final CMAC block with its subkey.
static void	internal_cmac_tag (const uint8_t key, uint16_t key_len, const uint8_t msg, uint32_t msg_len, uint8_t *out_mac)
	Compute the AES-CMAC tag of a message (SP 800-38B).
ra8_err_t	priv_ra8_sec_cmac_compute (const uint8_t key, uint16_t key_len, const uint8_t msg, uint32_t msg_len, uint8_t *out_mac)
	Compute the AES-CMAC tag of a message under a symmetric key.
ra8_err_t	priv_ra8_sec_cmac_verify (const uint8_t key, uint16_t key_len, const uint8_t msg, uint32_t msg_len, const uint8_t *mac, uint16_t mac_len)
	Verify an AES-CMAC tag against a message under a symmetric key.

Variables
static const char *	s_tag = "SECMAC"
	Logging / error tag prefix for this module.
static const uint8_t	s_aes_sbox [256]
	AES S-box (FIPS 197 Fig.

Detailed Description

Secure-side AES-CMAC seam implementation.

Tag: [Ring 5 / SECAPP] {World: S}

Two interchangeable backends behind the ra8_sec_cmac_* API declared in sec_cmac_internal.h:

RA8_KEY_IMPORT_PSA_CMAC defined – delegate to the vendored TF-PSA-Crypto: psa_mac_compute for generation and psa_mac_verify for the verdict, both with PSA_ALG_CMAC over a transiently imported PSA_KEY_TYPE_AES key. NOTHING DEFINES THIS FLAG (#619). No build sets it, so this backend has never been compiled by any image, host test or gate. It is not the production path and must not be described as one. Turning it on is not a one-line change: this file is compiled into EVERY app through the libs/ra8_secure_app source set, so defining the flag globally would drag TF-PSA-Crypto into images that link no crypto library today, while defining it per-app would leave two CMAC implementations live at once with the KATs covering only one of them.
otherwise – THE PATH EVERY BUILD ACTUALLY TAKES, host and firmware alike: a self-contained AES-128 / AES-256 + CMAC reference (FIPS 197 + NIST SP 800-38B). It is exercised by the host suite against the published SP 800-38B known-answer vectors, so it is real, not a forgeable placeholder.

Both backends compute the identical standard tag, so the seam is Liskov- substitutable and the wrapped-key blob format is backend-independent.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file sec_cmac.c.

Enumeration Type Documentation

◆ aes_dim_t

enum aes_dim_t : uint16_t

AES dimensions in bytes (FIPS 197).

Enumerator
k_aes_block_bytes	AES block / CMAC tag size.
k_aes_word_bytes	Bytes per key-schedule word.
k_aes_state_cols	Columns in the AES state.
k_aes_max_rk_bytes	Round-key bytes for AES-256 (16*(14+1)).

Definition at line 222 of file sec_cmac.c.

◆ aes_gf_t

enum aes_gf_t : uint8_t

GF field constants used by AES / CMAC.

Enumerator
k_aes_field_poly	GF(2^8) reduction poly (FIPS 197 4.2).
k_cmac_rb	GF(2^128) constant (SP 800-38B 5.3).
k_cmac_pad_marker	CMAC final-block pad bit (SP 800-38B 5.5).

Definition at line 241 of file sec_cmac.c.

◆ aes_off_t

enum aes_off_t : uint8_t

AES round counts and small byte offsets (FIPS 197).

Enumerator
k_aes_nr_128	AES-128 rounds.
k_aes_nr_256	AES-256 rounds.
k_aes_ext_sub_i	AES-256 extra SubWord at iNk==4.
k_aes_col_mask	Column index wrap mask (mod 4).
k_aes_msb_shift	Byte MSB shift.
k_aes_last_byte	Index of the final byte in a block.
k_aes_rcon_seed	Rcon seed value (round 1).

Definition at line 230 of file sec_cmac.c.

Function Documentation

◆ internal_aes_encrypt()

void internal_aes_encrypt	(	const uint8_t *	rk,
		uint8_t	nr,
		const uint8_t *	in,
		uint8_t *	out )

static

Encrypt one 16-byte block with AES-nr.

FIPS 197 Sec 5.1 cipher: initial AddRoundKey, nr-1 full rounds (SubBytes/ShiftRows/MixColumns/AddRoundKey), final partial round – the per-step transforms live in internal_aes_sub_shift and internal_aes_mix_columns. The state is column-major (byte 4*c+r is row r of column c).

Parameters

[in]	rk	Round-key schedule.
[in]	nr	Round count (10 or 14).
[in]	in	16-byte plaintext block.
[out]	out	16-byte ciphertext block.

Precondition: rk, in and out are non-NULL.; rk was produced by internal_aes_key_expand for nr.

Postcondition: out holds the AES ciphertext of in.; No global state is mutated.

Note: Pure compute helper; safe from any context.

Since: 0.1.0

Definition at line 433 of file sec_cmac.c.

References internal_aes_mix_columns(), internal_aes_sub_shift(), and k_aes_block_bytes.

Referenced by internal_cmac_subkeys(), and internal_cmac_tag().

◆ internal_aes_key_expand()

void internal_aes_key_expand	(	const uint8_t *	key,
		uint8_t	nk,
		uint8_t	nr,
		uint8_t *	rk )

static

Expand an AES key into the full round-key schedule.

FIPS 197 Sec 5.2 key expansion, parameterised by nk words (4 or 8) and nr rounds (10 or 14).

Parameters

[in]	key	Raw key bytes (nk*4 long).
[in]	nk	Key words (4 for AES-128, 8 for AES-256).
[in]	nr	Round count (10 or 14).
[out]	rk	Round-key buffer (16*(nr+1) bytes).

Precondition: key and rk are non-NULL.; nk is 4 or 8 and nr matches.

Postcondition: rk holds the expanded schedule.; No global state is mutated.

Note: Pure compute helper; safe from any context.

Since: 0.1.0

Definition at line 311 of file sec_cmac.c.

References internal_aes_xtime(), k_aes_ext_sub_i, k_aes_rcon_seed, k_aes_state_cols, k_aes_word_bytes, and s_aes_sbox.

Referenced by internal_cmac_tag().

◆ internal_aes_mix_columns()

void internal_aes_mix_columns ( uint8_t * s )

static

Apply MixColumns to the AES state in place.

FIPS 197 Sec 5.1.3: multiply every state column by the fixed polynomial {03}x^3 + {01}x^2 + {01}x + {02} in GF(2^8), expressed through internal_aes_xtime doublings.

Parameters

[in,out] s 16-byte AES state.

Precondition: s is a non-NULL 16-byte state block.; Caller skips this step on the final round per FIPS 197.

Postcondition: Every column of s has been mixed.; No global state is mutated.

Note: Pure compute helper; safe from any context.

Since: 0.1.0

Definition at line 395 of file sec_cmac.c.

References internal_aes_xtime(), k_aes_state_cols, and RA8_INTERNAL.

Referenced by internal_aes_encrypt().

◆ internal_aes_sub_shift()

void internal_aes_sub_shift ( uint8_t * s )

static

Apply SubBytes + ShiftRows to the AES state in place.

FIPS 197 Sec 5.1.1/5.1.2: substitute every state byte through the S-box, then rotate row r left by r columns. The state is column-major (byte 4*c+r is row r of column c).

Parameters

[in,out] s 16-byte AES state.

Precondition: s is a non-NULL 16-byte state block.; The S-box table s_aes_sbox is the FIPS 197 constant.

Postcondition: s holds ShiftRows(SubBytes(s)).; No global state is mutated.

Note: Pure compute helper; safe from any context.

Since: 0.1.0

Definition at line 361 of file sec_cmac.c.

References k_aes_block_bytes, k_aes_col_mask, k_aes_state_cols, RA8_INTERNAL, and s_aes_sbox.

Referenced by internal_aes_encrypt().

◆ internal_aes_xtime()

uint8_t internal_aes_xtime ( uint8_t value )

static

Multiply a byte by x in GF(2^8) with the AES reduction poly.

FIPS 197 Sec 4.2: left-shift, conditionally XOR 0x1B on overflow.

Parameters

[in] value Source byte.

Returns: value doubled in the AES field.

Return values

value<<1	When the high bit was clear.
(value<<1)^0x1B	When the high bit was set.

Precondition: value is any byte.; Caller treats this as a pure expression.

Postcondition: No state is mutated.; Return depends only on value.

Note: Pure helper; safe from any context.

Since: 0.1.0

Definition at line 285 of file sec_cmac.c.

References k_aes_field_poly, k_aes_msb_shift, and RA8_INTERNAL.

Referenced by internal_aes_key_expand(), and internal_aes_mix_columns().

◆ internal_cmac_build_last()

void internal_cmac_build_last	(	const uint8_t *	msg,
		uint32_t	msg_len,
		uint32_t	last_off,
		bool	complete,
		const uint8_t *	k1,
		const uint8_t *	k2,
		uint8_t *	last )

static

Fold the (possibly padded) final CMAC block with its subkey.

SP 800-38B Sec 6.2 step 4: a complete final block is XOR-ed with K1; an incomplete (or empty-message) block is padded with 0x80 0x00... and XOR-ed with K2.

Parameters

[in]	msg	Message bytes (NULL only when msg_len==0).
[in]	msg_len	Message length in bytes.
[in]	last_off	Byte offset of the final block within msg.
[in]	complete	True when the final block is a whole 16 bytes.
[in]	k1	Subkey for complete final blocks.
[in]	k2	Subkey for padded final blocks.
[out]	last	Receives the folded 16-byte final block.

Precondition: last_off and complete describe msg per the caller.; k1 / k2 came from internal_cmac_subkeys.

Postcondition: last holds the subkey-folded final block.; No global state is mutated.

Note: Pure compute helper; safe from any context.

Since: 0.1.0

Definition at line 538 of file sec_cmac.c.

References k_aes_block_bytes, k_cmac_pad_marker, and RA8_INTERNAL.

Referenced by internal_cmac_tag().

◆ internal_cmac_check_args()

ra8_err_t internal_cmac_check_args	(	const uint8_t *	key,
		uint16_t	key_len,
		const uint8_t *	msg,
		uint32_t	msg_len )

static

Shared precondition check for both CMAC entry points.

Validates the key pointer, the key length (AES-128 or AES-256 only), the message pointer/length pairing, and the static message-size cap that keeps every downstream loop provably bounded (NASA Power of 10 Rule 2). Keeping the checks in one helper means the compute and verify paths cannot drift.

Parameters

[in]	key	Symmetric CMAC key.
[in]	key_len	Key length in bytes.
[in]	msg	Message pointer (NULL only when msg_len==0).
[in]	msg_len	Message length in bytes.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Arguments are well-formed.
k_ra8_err_null_ptr	key NULL, or msg NULL with a non-zero msg_len.
k_ra8_err_invalid_arg	key_len was neither 16 nor 32.
k_ra8_err_invalid_size	msg_len exceeded the static cap.

Precondition: key handling is delegated to RA8_CHECK_NULL_PTR.; key_len is compared against the two accepted lengths.

Postcondition: No state is mutated.; Return value depends only on the parameters.

Note: Pure validation helper; safe from any context.

Since: 0.1.0

Definition at line 80 of file sec_cmac.c.

References k_ra8_err_invalid_arg, k_ra8_err_invalid_size, k_ra8_err_null_ptr, k_ra8_ok, k_ra8_sec_cmac_key_128, k_ra8_sec_cmac_key_256, k_ra8_sec_cmac_max_msg_bytes, RA8_CHECK_NULL_PTR, and s_tag.

Referenced by priv_ra8_sec_cmac_compute(), and priv_ra8_sec_cmac_verify().

◆ internal_cmac_double()

void internal_cmac_double	(	const uint8_t *	in,
		uint8_t *	out )

static

Double a 128-bit value in GF(2^128) (CMAC subkey step).

NIST SP 800-38B Sec 6.1: left-shift the 16-byte value by one bit, XOR-ing the constant Rb (0x87) into the last byte when the top bit was set.

Parameters

[in]	in	Source 16-byte value.
[out]	out	Doubled 16-byte value.

Precondition: in and out are non-NULL 16-byte buffers.; Caller uses the result as a CMAC subkey.

Postcondition: out holds in doubled in the field.; No global state is mutated.

Note: Pure compute helper; safe from any context.

Since: 0.1.0

Definition at line 472 of file sec_cmac.c.

References k_aes_last_byte, k_aes_msb_shift, k_cmac_rb, and RA8_INTERNAL.

Referenced by internal_cmac_subkeys().

◆ internal_cmac_subkeys()

void internal_cmac_subkeys	(	const uint8_t *	rk,
		uint8_t	nr,
		uint8_t *	k1,
		uint8_t *	k2 )

static

Derive the CMAC subkeys K1 / K2 from the expanded key.

SP 800-38B Sec 6.1: L = AES(key, 0^128), K1 = 2L and K2 = 2 * K1 in GF(2^128). The intermediate L value is wiped before returning so only the subkeys leave this frame.

Parameters

[in]	rk	Round-key schedule from internal_aes_key_expand.
[in]	nr	Round count (10 or 14).
[out]	k1	Receives the full-block subkey K1 (16 bytes).
[out]	k2	Receives the padded-block subkey K2 (16 bytes).

Precondition: rk was expanded for nr rounds.; k1 and k2 are non-NULL 16-byte buffers.

Postcondition: k1 / k2 hold the SP 800-38B subkeys.; The intermediate L stack value has been wiped.

Note: Pure compute helper; uses only stack.

Since: 0.1.0

Definition at line 505 of file sec_cmac.c.

References internal_aes_encrypt(), internal_cmac_double(), k_aes_block_bytes, and ra8_secure_memzero().

Referenced by internal_cmac_tag().

◆ internal_cmac_tag()

void internal_cmac_tag	(	const uint8_t *	key,
		uint16_t	key_len,
		const uint8_t *	msg,
		uint32_t	msg_len,
		uint8_t *	out_mac )

static

Compute the AES-CMAC tag of a message (SP 800-38B).

Derives subkeys K1/K2 via internal_cmac_subkeys, chains the full blocks, and folds the (possibly padded) final block built by internal_cmac_build_last before the last AES call. Handles the empty message as a single padded block per the standard.

Parameters

[in]	key	AES key bytes.
[in]	key_len	Key length (16 or 32).
[in]	msg	Message (NULL only when msg_len==0).
[in]	msg_len	Message length (<= k_ra8_sec_cmac_max_msg_bytes).
[out]	out_mac	16-byte tag output.

Precondition: All pointers valid per the caller's validation.; msg_len is within the static cap.

Postcondition: out_mac holds the CMAC tag.; Local subkey material is wiped before return.

Note: Pure compute helper; not thread-safe (uses only stack).

Since: 0.1.0

Definition at line 589 of file sec_cmac.c.

References internal_aes_encrypt(), internal_aes_key_expand(), internal_cmac_build_last(), internal_cmac_subkeys(), k_aes_block_bytes, k_aes_last_byte, k_aes_max_rk_bytes, k_aes_nr_128, k_aes_nr_256, k_aes_word_bytes, k_ra8_sec_cmac_key_128, RA8_INTERNAL, and ra8_secure_memzero().

Referenced by priv_ra8_sec_cmac_compute(), and priv_ra8_sec_cmac_verify().

◆ priv_ra8_sec_cmac_compute()

ra8_err_t priv_ra8_sec_cmac_compute	(	const uint8_t *	key,
		uint16_t	key_len,
		const uint8_t *	msg,
		uint32_t	msg_len,
		uint8_t *	out_mac )

nodiscard

Compute the AES-CMAC tag of a message under a symmetric key.

Runs NIST SP 800-38B CMAC over msg with AES as the block cipher. key_len selects AES-128 (k_ra8_sec_cmac_key_128) or AES-256 (k_ra8_sec_cmac_key_256). The 16-byte tag is written to out_mac. The active backend (PSA or the in-tree reference) is chosen at compile time and produces the identical standard tag.

Parameters

[in]	key	Symmetric CMAC key (secret; caller-owned secure copy).
[in]	key_len	Key length: 16 (AES-128) or 32 (AES-256) bytes.
[in]	msg	Message to authenticate; NULL only when msg_len==0.
[in]	msg_len	Message length, 0 .. k_ra8_sec_cmac_max_msg_bytes.
[out]	out_mac	Destination for the k_ra8_sec_cmac_tag_bytes tag.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Tag computed and written.
k_ra8_err_null_ptr	key or out_mac (or msg when msg_len!=0) was NULL.
k_ra8_err_invalid_arg	key_len was neither 16 nor 32.
k_ra8_err_invalid_size	msg_len exceeded the static cap.
k_ra8_err_hw_error	PSA backend reported a fault (PSA build).

Precondition: key and out_mac are non-NULL.; key_len is 16 or 32.

Postcondition: On k_ra8_ok, out_mac[0..15] holds the CMAC tag.; On any error, no output byte is relied upon by the caller.

Note: Not thread-safe; secure-side serial dispatch only.

Example:: uint8_t tag[k_ra8_sec_cmac_tag_bytes];

(void)priv_ra8_sec_cmac_compute(kak, k_ra8_sec_cmac_key_256, blob, 32U, tag);

priv_ra8_sec_cmac_compute
ra8_err_t priv_ra8_sec_cmac_compute(const uint8_t *key, uint16_t key_len, const uint8_t *msg, uint32_t msg_len, uint8_t *out_mac)
Compute the AES-CMAC tag of a message under a symmetric key.
Definition sec_cmac.c:632

k_ra8_sec_cmac_key_256
@ k_ra8_sec_cmac_key_256
AES-256 key length in bytes.
Definition sec_cmac_internal.h:71

k_ra8_sec_cmac_tag_bytes
@ k_ra8_sec_cmac_tag_bytes
CMAC tag length (one AES block).
Definition sec_cmac_internal.h:69

See also: priv_ra8_sec_cmac_verify(); NIST SP 800-38B Sec 6.2 "MAC Generation".

Since: 0.1.0

Definition at line 632 of file sec_cmac.c.

References internal_cmac_check_args(), internal_cmac_tag(), k_ra8_ok, RA8_CHECK_NULL_PTR, and s_tag.

Referenced by priv_ra8_key_import_build_blob().

◆ priv_ra8_sec_cmac_verify()

ra8_err_t priv_ra8_sec_cmac_verify	(	const uint8_t *	key,
		uint16_t	key_len,
		const uint8_t *	msg,
		uint32_t	msg_len,
		const uint8_t *	mac,
		uint16_t	mac_len )

nodiscard

Verify an AES-CMAC tag against a message under a symmetric key.

Recomputes the CMAC of msg under key and compares it, in constant time, to the caller-supplied mac. A single flipped message or tag byte, or a truncated tag (mac_len != k_ra8_sec_cmac_tag_bytes), makes the verdict fail. The verdict is the module's security-critical decision.

Parameters

[in]	key	Symmetric CMAC key (secret; caller-owned secure copy).
[in]	key_len	Key length: 16 (AES-128) or 32 (AES-256) bytes.
[in]	msg	Authenticated message; NULL only when msg_len==0.
[in]	msg_len	Message length, 0 .. k_ra8_sec_cmac_max_msg_bytes.
[in]	mac	Candidate tag to check.
[in]	mac_len	Length of mac; must equal k_ra8_sec_cmac_tag_bytes.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Tag is authentic.
k_ra8_err_invalid_arg	Tag mismatch, wrong mac_len, or bad key_len.
k_ra8_err_null_ptr	key or mac (or msg when msg_len!=0) was NULL.
k_ra8_err_invalid_size	msg_len exceeded the static cap.
k_ra8_err_hw_error	PSA backend reported a fault (PSA build).

Precondition: key and mac are non-NULL.; key_len is 16 or 32.

Postcondition: No output state is produced; the return code is the whole result.; msg and mac are unmodified.

Note: Not thread-safe; secure-side serial dispatch only.

MC/DC:

Verdict decision if ((mac_len != k_ra8_sec_cmac_tag_bytes) || !ra8_ct_equal(computed, mac, k_ra8_sec_cmac_tag_bytes)) (2 conditions):

C1 = mac_len is not the expected tag length.
C2 = the recomputed tag does not equal mac. N=2 -> N+1=3 minimal vectors:
V1 (C1=F, C2=F): correct length + authentic tag -> decision F -> ok.
V2 (C1=T): truncated tag -> decision T (short-circuits C2) -> reject.
V3 (C1=F, C2=T): correct length + one flipped tag byte -> decision T -> reject. V1+V2 vary C1 (masked C2); V1+V3 vary C2 with C1 held F. Satisfies DO-178C 6.4.4.2 minimal MC/DC.

See also: priv_ra8_sec_cmac_compute(); NIST SP 800-38B Sec 6.3 "MAC Verification".

Since: 0.1.0

Definition at line 647 of file sec_cmac.c.

References internal_cmac_check_args(), internal_cmac_tag(), k_ra8_err_invalid_arg, k_ra8_ok, k_ra8_sec_cmac_tag_bytes, RA8_CHECK_NULL_PTR, ra8_ct_equal(), ra8_secure_memzero(), and s_tag.

Referenced by internal_verify_cmac().

Variable Documentation

◆ s_aes_sbox

const uint8_t s_aes_sbox[256]

static

Initial value:

                                = {
  0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
  0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
  0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
  0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
  0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
  0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
  0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
  0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
  0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
  0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
  0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
  0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
  0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
  0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
  0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
  0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16,
}

AES S-box (FIPS 197 Fig.

7). Standard substitution table.

Definition at line 248 of file sec_cmac.c.

Referenced by internal_aes_key_expand(), and internal_aes_sub_shift().

◆ s_tag

const char* s_tag = "SECMAC"

static

Logging / error tag prefix for this module.

Definition at line 48 of file sec_cmac.c.

Enumerations

Functions

Variables

Detailed Description

Enumeration Type Documentation

◆ aes_dim_t

◆ aes_gf_t

◆ aes_off_t

Function Documentation

◆ internal_aes_encrypt()

◆ internal_aes_key_expand()

◆ internal_aes_mix_columns()

◆ internal_aes_sub_shift()

◆ internal_aes_xtime()

◆ internal_cmac_build_last()

◆ internal_cmac_check_args()

◆ internal_cmac_double()

◆ internal_cmac_subkeys()

◆ internal_cmac_tag()

◆ priv_ra8_sec_cmac_compute()

◆ priv_ra8_sec_cmac_verify()

Variable Documentation

◆ s_aes_sbox

◆ s_tag