2 * Galois/Counter Mode (GCM) and GMAC with AES
4 * Copyright (c) 2012, Jouni Malinen <j@w1.fi>
6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
16 static void inc32(u8 *block)
19 val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4);
21 WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val);
25 static void xor_block(u8 *dst, const u8 *src)
36 static void shift_right_block(u8 *v)
40 val = WPA_GET_BE32(v + 12);
44 WPA_PUT_BE32(v + 12, val);
46 val = WPA_GET_BE32(v + 8);
50 WPA_PUT_BE32(v + 8, val);
52 val = WPA_GET_BE32(v + 4);
56 WPA_PUT_BE32(v + 4, val);
58 val = WPA_GET_BE32(v);
64 /* Multiplication in GF(2^128) */
65 static void gf_mult(const u8 *x, const u8 *y, u8 *z)
70 os_memset(z, 0, 16); /* Z_0 = 0^128 */
71 os_memcpy(v, y, 16); /* V_0 = Y */
73 for (i = 0; i < 16; i++) {
74 for (j = 0; j < 8; j++) {
75 if (x[i] & BIT(7 - j)) {
76 /* Z_(i + 1) = Z_i XOR V_i */
83 /* V_(i + 1) = (V_i >> 1) XOR R */
85 /* R = 11100001 || 0^120 */
88 /* V_(i + 1) = V_i >> 1 */
96 static void ghash_start(u8 *y)
103 static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y)
111 for (i = 0; i < m; i++) {
112 /* Y_i = (Y^(i-1) XOR X_i) dot H */
117 * multiplication operation for binary Galois (finite) field of
120 os_memcpy(y, tmp, 16);
123 if (x + xlen > xpos) {
124 /* Add zero padded last block */
125 size_t last = x + xlen - xpos;
126 os_memcpy(tmp, xpos, last);
127 os_memset(tmp + last, 0, sizeof(tmp) - last);
129 /* Y_i = (Y^(i-1) XOR X_i) dot H */
133 * multiplication operation for binary Galois (finite) field of
136 os_memcpy(y, tmp, 16);
143 static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
146 u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE];
155 os_memcpy(cb, icb, AES_BLOCK_SIZE);
157 for (i = 0; i < n; i++) {
158 aes_encrypt(aes, cb, ypos);
159 xor_block(ypos, xpos);
160 xpos += AES_BLOCK_SIZE;
161 ypos += AES_BLOCK_SIZE;
165 last = x + xlen - xpos;
167 /* Last, partial block */
168 aes_encrypt(aes, cb, tmp);
169 for (i = 0; i < last; i++)
170 *ypos++ = *xpos++ ^ tmp[i];
175 static void * aes_gcm_init_hash_subkey(const u8 *key, size_t key_len, u8 *H)
179 aes = aes_encrypt_init(key, key_len);
183 /* Generate hash subkey H = AES_K(0^128) */
184 os_memset(H, 0, AES_BLOCK_SIZE);
185 aes_encrypt(aes, H, H);
186 wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH",
192 static void aes_gcm_prepare_j0(const u8 *iv, size_t iv_len, const u8 *H, u8 *J0)
197 /* Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
198 os_memcpy(J0, iv, iv_len);
199 os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
200 J0[AES_BLOCK_SIZE - 1] = 0x01;
203 * s = 128 * ceil(len(IV)/128) - len(IV)
204 * J_0 = GHASH_H(IV || 0^(s+64) || [len(IV)]_64)
207 ghash(H, iv, iv_len, J0);
208 WPA_PUT_BE64(len_buf, 0);
209 WPA_PUT_BE64(len_buf + 8, iv_len * 8);
210 ghash(H, len_buf, sizeof(len_buf), J0);
215 static void aes_gcm_gctr(void *aes, const u8 *J0, const u8 *in, size_t len,
218 u8 J0inc[AES_BLOCK_SIZE];
223 os_memcpy(J0inc, J0, AES_BLOCK_SIZE);
225 aes_gctr(aes, J0inc, in, len, out);
229 static void aes_gcm_ghash(const u8 *H, const u8 *aad, size_t aad_len,
230 const u8 *crypt, size_t crypt_len, u8 *S)
235 * u = 128 * ceil[len(C)/128] - len(C)
236 * v = 128 * ceil[len(A)/128] - len(A)
237 * S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
238 * (i.e., zero padded to block size A || C and lengths of each in bits)
241 ghash(H, aad, aad_len, S);
242 ghash(H, crypt, crypt_len, S);
243 WPA_PUT_BE64(len_buf, aad_len * 8);
244 WPA_PUT_BE64(len_buf + 8, crypt_len * 8);
245 ghash(H, len_buf, sizeof(len_buf), S);
247 wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
252 * aes_gcm_ae - GCM-AE_K(IV, P, A)
254 int aes_gcm_ae(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
255 const u8 *plain, size_t plain_len,
256 const u8 *aad, size_t aad_len, u8 *crypt, u8 *tag)
258 u8 H[AES_BLOCK_SIZE];
259 u8 J0[AES_BLOCK_SIZE];
263 aes = aes_gcm_init_hash_subkey(key, key_len, H);
267 aes_gcm_prepare_j0(iv, iv_len, H, J0);
269 /* C = GCTR_K(inc_32(J_0), P) */
270 aes_gcm_gctr(aes, J0, plain, plain_len, crypt);
272 aes_gcm_ghash(H, aad, aad_len, crypt, plain_len, S);
274 /* T = MSB_t(GCTR_K(J_0, S)) */
275 aes_gctr(aes, J0, S, sizeof(S), tag);
279 aes_encrypt_deinit(aes);
286 * aes_gcm_ad - GCM-AD_K(IV, C, A, T)
288 int aes_gcm_ad(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
289 const u8 *crypt, size_t crypt_len,
290 const u8 *aad, size_t aad_len, const u8 *tag, u8 *plain)
292 u8 H[AES_BLOCK_SIZE];
293 u8 J0[AES_BLOCK_SIZE];
297 aes = aes_gcm_init_hash_subkey(key, key_len, H);
301 aes_gcm_prepare_j0(iv, iv_len, H, J0);
303 /* P = GCTR_K(inc_32(J_0), C) */
304 aes_gcm_gctr(aes, J0, crypt, crypt_len, plain);
306 aes_gcm_ghash(H, aad, aad_len, crypt, crypt_len, S);
308 /* T' = MSB_t(GCTR_K(J_0, S)) */
309 aes_gctr(aes, J0, S, sizeof(S), T);
311 aes_encrypt_deinit(aes);
313 if (os_memcmp(tag, T, 16) != 0) {
314 wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
322 int aes_gmac(const u8 *key, size_t key_len, const u8 *iv, size_t iv_len,
323 const u8 *aad, size_t aad_len, u8 *tag)
325 return aes_gcm_ae(key, key_len, iv, iv_len, NULL, 0, aad, aad_len, NULL,