sec_cmac.c

Go to the documentation of this file.

 
#include <stddef.h>
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_secure.h"
#include "sec_cmac_internal.h"

static const char* s_tag = "SECMAC";

RA8_INTERNAL static ra8_err_t
internal_cmac_check_args(const uint8_t* key, uint16_t key_len, const uint8_t* msg, uint32_t msg_len)
{
  RA8_CHECK_NULL_PTR(key, s_tag, "cmac: key");
  if ((key_len != (uint16_t)k_ra8_sec_cmac_key_128) &&
      (key_len != (uint16_t)k_ra8_sec_cmac_key_256)) {
    return k_ra8_err_invalid_arg;
  }
  if ((msg == nullptr) && (msg_len != 0U)) {
    return k_ra8_err_null_ptr;
  }
  if (msg_len > (uint32_t)k_ra8_sec_cmac_max_msg_bytes) {
    return k_ra8_err_invalid_size;
  }
  return k_ra8_ok;
}
 
#ifdef RA8_KEY_IMPORT_PSA_CMAC
 
/* =============================================================================
 * PSA backend -- production / HIL image (TF-PSA-Crypto)
 * =============================================================================
 */
 
#include "psa/crypto.h"

RA8_INTERNAL static ra8_err_t
internal_psa_import_cmac_key(const uint8_t* key, uint16_t key_len, psa_key_id_t* out_id)
{
  psa_key_attributes_t attr = psa_key_attributes_init();
  psa_set_key_type(&attr, PSA_KEY_TYPE_AES);
  psa_set_key_algorithm(&attr, PSA_ALG_CMAC);
  psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE);
  psa_key_id_t       kid = 0;
  const psa_status_t st  = psa_import_key(&attr, key, (size_t)key_len, &kid);
  psa_reset_key_attributes(&attr);
  if (st != PSA_SUCCESS) {
    return k_ra8_err_hw_error;
  }
  *out_id = kid;
  return k_ra8_ok;
}
 
ra8_err_t priv_ra8_sec_cmac_compute(const uint8_t* key,
                                    uint16_t       key_len,
                                    const uint8_t* msg,
                                    uint32_t       msg_len,
                                    uint8_t*       out_mac)
{
  RA8_CHECK_NULL_PTR(out_mac, s_tag, "compute: out_mac");
  const ra8_err_t ck = internal_cmac_check_args(key, key_len, msg, msg_len);
  if (ck != k_ra8_ok) {
    return ck;
  }
  psa_key_id_t    kid  = 0;
  const ra8_err_t ierr = internal_psa_import_cmac_key(key, key_len, &kid);
  if (ierr != k_ra8_ok) {
    return ierr;
  }
  size_t             produced = 0U;
  const psa_status_t st       = psa_mac_compute(kid,
                                                PSA_ALG_CMAC,
                                                msg,
                                                (size_t)msg_len,
                                                out_mac,
                                                (size_t)k_ra8_sec_cmac_tag_bytes,
                                                &produced);
  (void)psa_destroy_key(kid);
  if ((st != PSA_SUCCESS) || (produced != (size_t)k_ra8_sec_cmac_tag_bytes)) {
    return k_ra8_err_hw_error;
  }
  return k_ra8_ok;
}
 
ra8_err_t priv_ra8_sec_cmac_verify(const uint8_t* key,
                                   uint16_t       key_len,
                                   const uint8_t* msg,
                                   uint32_t       msg_len,
                                   const uint8_t* mac,
                                   uint16_t       mac_len)
{
  RA8_CHECK_NULL_PTR(mac, s_tag, "verify: mac");
  const ra8_err_t ck = internal_cmac_check_args(key, key_len, msg, msg_len);
  if (ck != k_ra8_ok) {
    return ck;
  }
  psa_key_id_t    kid  = 0;
  const ra8_err_t ierr = internal_psa_import_cmac_key(key, key_len, &kid);
  if (ierr != k_ra8_ok) {
    return ierr;
  }
  /* psa_mac_verify performs the length check and a constant-time compare
   * internally, returning PSA_ERROR_INVALID_SIGNATURE on any mismatch. */
  const psa_status_t st =
    psa_mac_verify(kid, PSA_ALG_CMAC, msg, (size_t)msg_len, mac, (size_t)mac_len);
  (void)psa_destroy_key(kid);
  if (st == PSA_SUCCESS) {
    return k_ra8_ok;
  }
  if (st == PSA_ERROR_INVALID_SIGNATURE) {
    return k_ra8_err_invalid_arg;
  }
  return k_ra8_err_hw_error;
}
 
#else /* !RA8_KEY_IMPORT_PSA_CMAC -- in-tree AES-CMAC reference (host + portable) */
 
/* =============================================================================
 * Reference backend -- self-contained AES-128/256 + CMAC (FIPS 197 / SP 800-38B)
 * =============================================================================
 *
 * The AES round transform and CMAC subkey/GF(2^128) doubling below are direct
 * transcriptions of FIPS 197 and NIST SP 800-38B. The S-box and the field
 * constants are standard values, not tunable parameters; the loops all have
 * compile-time-fixed bounds. The host suite pins the output to the published
 * SP 800-38B AES-128 and AES-256 known-answer vectors.
 */

typedef enum : uint16_t {
  k_aes_block_bytes  = 16U,  
  k_aes_word_bytes   = 4U,   
  k_aes_state_cols   = 4U,   
  k_aes_max_rk_bytes = 240U, 
} aes_dim_t;

typedef enum : uint8_t {
  k_aes_nr_128    = 10U, 
  k_aes_nr_256    = 14U, 
  k_aes_ext_sub_i = 4U,  
  k_aes_col_mask  = 3U,  
  k_aes_msb_shift = 7U,  
  k_aes_last_byte = 15U, 
  k_aes_rcon_seed = 1U,  
} aes_off_t;

typedef enum : uint8_t {
  k_aes_field_poly  = 0x1BU, 
  k_cmac_rb         = 0x87U, 
  k_cmac_pad_marker = 0x80U, 
} aes_gf_t;

static const uint8_t s_aes_sbox[256] = {
  0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
  0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
  0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
  0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
  0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
  0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
  0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
  0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
  0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
  0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
  0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
  0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
  0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
  0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
  0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
  0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16,
};

RA8_INTERNAL static uint8_t internal_aes_xtime(uint8_t value)
{
  const uint8_t hi = (uint8_t)(value >> k_aes_msb_shift);
  return (uint8_t)(((uint8_t)(value << 1U)) ^ (uint8_t)(hi * (uint8_t)k_aes_field_poly));
}

RA8_INTERNAL static void
internal_aes_key_expand(const uint8_t* key, uint8_t nk, uint8_t nr, uint8_t* rk)
{
  const uint16_t total_words = (uint16_t)((uint16_t)k_aes_state_cols * (uint16_t)(nr + 1U));
  for (uint16_t i = 0U; i < ((uint16_t)nk * (uint16_t)k_aes_word_bytes); ++i) {
    rk[i] = key[i];
  }
  uint8_t rcon = (uint8_t)k_aes_rcon_seed;
  for (uint16_t i = nk; i < total_words; ++i) {
    uint8_t t[k_aes_word_bytes];
    for (uint8_t j = 0U; j < (uint8_t)k_aes_word_bytes; ++j) {
      t[j] = rk[((uint16_t)(i - 1U) * (uint16_t)k_aes_word_bytes) + j];
    }
    if ((i % nk) == 0U) {
      const uint8_t tmp = t[0];
      t[0]              = (uint8_t)(s_aes_sbox[t[1]] ^ rcon);
      t[1]              = s_aes_sbox[t[2]];
      t[2]              = s_aes_sbox[t[3]];
      t[3]              = s_aes_sbox[tmp];
      rcon              = internal_aes_xtime(rcon);
    } else if ((nk > 6U) && ((i % nk) == (uint8_t)k_aes_ext_sub_i)) {
      for (uint8_t j = 0U; j < (uint8_t)k_aes_word_bytes; ++j) {
        t[j] = s_aes_sbox[t[j]];
      }
    } else {
      /* No transform: straight copy from t[] below. */
    }
    for (uint8_t j = 0U; j < (uint8_t)k_aes_word_bytes; ++j) {
      rk[((uint16_t)i * (uint16_t)k_aes_word_bytes) + j] =
        (uint8_t)(rk[((uint16_t)(i - nk) * (uint16_t)k_aes_word_bytes) + j] ^ t[j]);
    }
  }
}

RA8_INTERNAL static void internal_aes_sub_shift(uint8_t* s)
{
  for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
    s[i] = s_aes_sbox[s[i]];
  }
  uint8_t shifted[k_aes_block_bytes];
  for (uint8_t r = 0U; r < (uint8_t)k_aes_state_cols; ++r) {
    for (uint8_t c = 0U; c < (uint8_t)k_aes_state_cols; ++c) {
      shifted[((uint8_t)(c * (uint8_t)k_aes_state_cols)) + r] =
        s[((uint8_t)(((c + r) & (uint8_t)k_aes_col_mask) * (uint8_t)k_aes_state_cols)) + r];
    }
  }
  for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
    s[i] = shifted[i];
  }
}

RA8_INTERNAL static void internal_aes_mix_columns(uint8_t* s)
{
  for (uint8_t c = 0U; c < (uint8_t)k_aes_state_cols; ++c) {
    uint8_t*      col = &s[(uint8_t)(c * (uint8_t)k_aes_state_cols)];
    const uint8_t a0  = col[0];
    const uint8_t a1  = col[1];
    const uint8_t a2  = col[2];
    const uint8_t a3  = col[3];
    col[0]            = (uint8_t)(internal_aes_xtime(a0) ^ internal_aes_xtime(a1) ^ a1 ^ a2 ^ a3);
    col[1]            = (uint8_t)(a0 ^ internal_aes_xtime(a1) ^ internal_aes_xtime(a2) ^ a2 ^ a3);
    col[2]            = (uint8_t)(a0 ^ a1 ^ internal_aes_xtime(a2) ^ internal_aes_xtime(a3) ^ a3);
    col[3]            = (uint8_t)(internal_aes_xtime(a0) ^ a0 ^ a1 ^ a2 ^ internal_aes_xtime(a3));
  }
}

RA8_INTERNAL static void
internal_aes_encrypt(const uint8_t* rk, uint8_t nr, const uint8_t* in, uint8_t* out)
{
  uint8_t s[k_aes_block_bytes];
  for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
    s[i] = (uint8_t)(in[i] ^ rk[i]);
  }
  for (uint8_t round = 1U; round <= nr; ++round) {
    internal_aes_sub_shift(s);
    if (round != nr) {
      internal_aes_mix_columns(s);
    }
    const uint8_t* round_key = &rk[(size_t)round * (size_t)k_aes_block_bytes];
    for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
      s[i] = (uint8_t)(s[i] ^ round_key[i]);
    }
  }
  for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
    out[i] = s[i];
  }
}

RA8_INTERNAL static void internal_cmac_double(const uint8_t* in, uint8_t* out)
{
  const uint8_t msb = (uint8_t)(in[0] >> k_aes_msb_shift);
  for (uint8_t i = 0U; i < (uint8_t)k_aes_last_byte; ++i) {
    out[i] = (uint8_t)((uint8_t)(in[i] << 1U) | (uint8_t)(in[i + 1U] >> k_aes_msb_shift));
  }
  out[k_aes_last_byte] = (uint8_t)(in[k_aes_last_byte] << 1U);
  if (msb != 0U) {
    out[k_aes_last_byte] = (uint8_t)(out[k_aes_last_byte] ^ (uint8_t)k_cmac_rb);
  }
}

RA8_INTERNAL static void
internal_cmac_subkeys(const uint8_t* rk, uint8_t nr, uint8_t* k1, uint8_t* k2)
{
  const uint8_t zero[k_aes_block_bytes] = {};
  uint8_t       l_val[k_aes_block_bytes];
  internal_aes_encrypt(rk, nr, zero, l_val);
  internal_cmac_double(l_val, k1);
  internal_cmac_double(k1, k2);
  ra8_secure_memzero(l_val, sizeof(l_val));
}

RA8_INTERNAL static void internal_cmac_build_last(const uint8_t* msg,
                                                  uint32_t       msg_len,
                                                  uint32_t       last_off,
                                                  bool           complete,
                                                  const uint8_t* k1,
                                                  const uint8_t* k2,
                                                  uint8_t*       last)
{
  if (complete) {
    for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
      last[i] = (uint8_t)(msg[last_off + i] ^ k1[i]);
    }
    return;
  }
  const uint32_t rem = msg_len - last_off;
  for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
    uint8_t byte = 0U;
    if ((uint32_t)i < rem) {
      byte = msg[last_off + (uint32_t)i];
    } else if ((uint32_t)i == rem) {
      byte = (uint8_t)k_cmac_pad_marker;
    } else {
      byte = 0U;
    }
    last[i] = (uint8_t)(byte ^ k2[i]);
  }
}

RA8_INTERNAL static void internal_cmac_tag(const uint8_t* key,
                                           uint16_t       key_len,
                                           const uint8_t* msg,
                                           uint32_t       msg_len,
                                           uint8_t*       out_mac)
{
  const uint8_t nk = (uint8_t)(key_len / (uint16_t)k_aes_word_bytes);
  const uint8_t nr =
    (key_len == (uint16_t)k_ra8_sec_cmac_key_128) ? (uint8_t)k_aes_nr_128 : (uint8_t)k_aes_nr_256;
  uint8_t rk[k_aes_max_rk_bytes];
  internal_aes_key_expand(key, nk, nr, rk);
 
  uint8_t k1[k_aes_block_bytes];
  uint8_t k2[k_aes_block_bytes];
  internal_cmac_subkeys(rk, nr, k1, k2);
 
  /* Block count and whether the last block is a whole 16 bytes. */
  const uint32_t n_blocks =
    (msg_len == 0U) ? 1U : ((msg_len + (uint32_t)k_aes_last_byte) / (uint32_t)k_aes_block_bytes);
  const bool     complete = (msg_len != 0U) && ((msg_len % (uint32_t)k_aes_block_bytes) == 0U);
  const uint32_t last_off = (n_blocks - 1U) * (uint32_t)k_aes_block_bytes;
 
  uint8_t last[k_aes_block_bytes];
  internal_cmac_build_last(msg, msg_len, last_off, complete, k1, k2, last);
 
  uint8_t x[k_aes_block_bytes] = {};
  uint8_t y[k_aes_block_bytes];
  for (uint32_t b = 0U; (b + 1U) < n_blocks; ++b) {
    for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
      y[i] = (uint8_t)(x[i] ^ msg[((uint32_t)b * (uint32_t)k_aes_block_bytes) + (uint32_t)i]);
    }
    internal_aes_encrypt(rk, nr, y, x);
  }
  for (uint8_t i = 0U; i < (uint8_t)k_aes_block_bytes; ++i) {
    y[i] = (uint8_t)(x[i] ^ last[i]);
  }
  internal_aes_encrypt(rk, nr, y, out_mac);
 
  ra8_secure_memzero(rk, sizeof(rk));
  ra8_secure_memzero(k1, sizeof(k1));
  ra8_secure_memzero(k2, sizeof(k2));
}
 
ra8_err_t priv_ra8_sec_cmac_compute(const uint8_t* key,
                                    uint16_t       key_len,
                                    const uint8_t* msg,
                                    uint32_t       msg_len,
                                    uint8_t*       out_mac)
{
  RA8_CHECK_NULL_PTR(out_mac, s_tag, "compute: out_mac");
  const ra8_err_t ck = internal_cmac_check_args(key, key_len, msg, msg_len);
  if (ck != k_ra8_ok) {
    return ck;
  }
  internal_cmac_tag(key, key_len, msg, msg_len, out_mac);
  return k_ra8_ok;
}
 
ra8_err_t priv_ra8_sec_cmac_verify(const uint8_t* key,
                                   uint16_t       key_len,
                                   const uint8_t* msg,
                                   uint32_t       msg_len,
                                   const uint8_t* mac,
                                   uint16_t       mac_len)
{
  RA8_CHECK_NULL_PTR(mac, s_tag, "verify: mac");
  const ra8_err_t ck = internal_cmac_check_args(key, key_len, msg, msg_len);
  if (ck != k_ra8_ok) {
    return ck;
  }
  uint8_t computed[k_ra8_sec_cmac_tag_bytes];
  internal_cmac_tag(key, key_len, msg, msg_len, computed);
  /* Security verdict: reject a wrong-length tag OR a tag that does not match
   * in constant time. ra8_ct_equal has no data-dependent early-out, so the
   * timing does not leak how many leading bytes matched (ra8_secure.h). */
  const bool len_bad = (mac_len != (uint16_t)k_ra8_sec_cmac_tag_bytes);
  const bool tag_bad = !ra8_ct_equal(computed, mac, (size_t)k_ra8_sec_cmac_tag_bytes);
  ra8_secure_memzero(computed, sizeof(computed));
  if (len_bad || tag_bad) {
    return k_ra8_err_invalid_arg;
  }
  return k_ra8_ok;
}
 
#endif /* RA8_KEY_IMPORT_PSA_CMAC */