Subversion Repositories planix.SVN

#include "os.h"
#include <libsec.h>

/*
 * AES-XCBC-MAC-96 message authentication, per rfc3566.
 */
static uchar basekey[3][16] = {
        {
        0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
        0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
        },
        {
        0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
        0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
        },
        {
        0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
        0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
        },
};

void
setupAESXCBCstate(AESstate *s)          /* was setupmac96 */
{
        int i, j;
        uint q[16 / sizeof(uint)];
        uchar *p;

        assert(s->keybytes == 16);
        for(i = 0; i < 3; i++)
                aes_encrypt(s->ekey, s->rounds, basekey[i],
                        s->mackey + AESbsize*i);

        p = s->mackey;
        memset(q, 0, AESbsize);

        /*
         * put the in the right endian.  once figured, probably better
         * to use some fcall macros.
         * keys for encryption in local endianness for the algorithm...
         * only key1 is used for encryption;
         * BUG!!: I think this is what I got wrong.
         */
        for(i = 0; i < 16 / sizeof(uint); i ++){
                for(j = 0; j < sizeof(uint); j++)
                        q[i] |= p[sizeof(uint)-j-1] << 8*j;
                p += sizeof(uint);
        }
        memmove(s->mackey, q, 16);
}

/*
 * Not dealing with > 128-bit keys, not dealing with strange corner cases like
 * empty message.  Should be fine for AES-XCBC-MAC-96.
 */
uchar*
aesXCBCmac(uchar *p, int len, AESstate *s)
{
        uchar *p2, *ip, *eip, *mackey;
        uchar q[AESbsize];

        assert(s->keybytes == 16);      /* more complicated for bigger */
        memset(s->ivec, 0, AESbsize);   /* E[0] is 0+ */

        for(; len > AESbsize; len -= AESbsize){
                memmove(q, p, AESbsize);
                p2 = q;
                ip = s->ivec;
                for(eip = ip + AESbsize; ip < eip; )
                        *p2++ ^= *ip++;
                aes_encrypt((ulong *)s->mackey, s->rounds, q, s->ivec);
                p += AESbsize;
        }
        /* the last one */

        memmove(q, p, len);
        p2 = q+len;
        if(len == AESbsize)
                mackey = s->mackey + AESbsize;  /* k2 */
        else{
                mackey = s->mackey+2*AESbsize;  /* k3 */
                *p2++ = 1 << 7;                 /* padding */
                len = AESbsize - len - 1;
                memset(p2, 0, len);
        }

        ip = s->ivec;
        p2 = q;
        for(eip = ip + AESbsize; ip < eip; )
                *p2++ ^= *ip++ ^ *mackey++;
        aes_encrypt((ulong *)s->mackey, s->rounds, q, s->ivec);
        return s->ivec;                 /* only the 12 bytes leftmost */
}