2 * GCM with GMAC Protocol (GCMP)
3 * Copyright (c) 2012, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "crypto/aes.h"
17 static void inc32(u8 *block)
20 val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4);
22 WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val);
26 static void xor_block(u8 *dst, const u8 *src)
37 static void shift_right_block(u8 *v)
41 val = WPA_GET_BE32(v + 12);
45 WPA_PUT_BE32(v + 12, val);
47 val = WPA_GET_BE32(v + 8);
51 WPA_PUT_BE32(v + 8, val);
53 val = WPA_GET_BE32(v + 4);
57 WPA_PUT_BE32(v + 4, val);
59 val = WPA_GET_BE32(v);
65 /* Multiplication in GF(2^128) */
66 static void gf_mult(const u8 *x, const u8 *y, u8 *z)
71 os_memset(z, 0, 16); /* Z_0 = 0^128 */
72 os_memcpy(v, y, 16); /* V_0 = Y */
74 for (i = 0; i < 16; i++) {
75 for (j = 0; j < 8; j++) {
76 if (x[i] & BIT(7 - j)) {
77 /* Z_(i + 1) = Z_i XOR V_i */
84 /* V_(i + 1) = (V_i >> 1) XOR R */
86 /* R = 11100001 || 0^120 */
89 /* V_(i + 1) = V_i >> 1 */
97 static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y)
107 for (i = 0; i < m; i++) {
108 /* Y_i = (Y^(i-1) XOR X_i) dot H */
113 * multiplication operation for binary Galois (finite) field of
116 os_memcpy(y, tmp, 16);
123 static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
126 u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE];
135 os_memcpy(cb, icb, AES_BLOCK_SIZE);
137 for (i = 0; i < n; i++) {
138 aes_encrypt(aes, cb, ypos);
139 xor_block(ypos, xpos);
140 xpos += AES_BLOCK_SIZE;
141 ypos += AES_BLOCK_SIZE;
145 last = x + xlen - xpos;
147 /* Last, partial block */
148 aes_encrypt(aes, cb, tmp);
149 for (i = 0; i < last; i++)
150 *ypos++ = *xpos++ ^ tmp[i];
156 * aes_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96
158 static int aes_gcm_ae(const u8 *key, const u8 *iv,
159 const u8 *plain, size_t plain_len,
160 const u8 *aad, size_t aad_len,
164 u8 H[AES_BLOCK_SIZE];
165 u8 J0[AES_BLOCK_SIZE];
171 aes = aes_encrypt_init(key, 16);
175 /* 1. Generate hash subkey H = AES_K(0^128) */
176 os_memset(H, 0, sizeof(H));
177 aes_encrypt(aes, H, H);
178 wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
180 /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
181 os_memcpy(J0, iv, iv_len);
182 os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
183 J0[AES_BLOCK_SIZE - 1] = 0x01;
185 /* 3. C = GCTR_K(inc_32(J_0), P) */
187 aes_gctr(aes, J0, plain, plain_len, crypt);
190 * 4. u = 128 * ceil[len(C)/128] - len(C)
191 * v = 128 * ceil[len(A)/128] - len(A)
192 * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
193 * (i.e., zero padded to block size A || C and lengths of each in bits)
195 auth = os_malloc(32 + 16 + plain_len + 8 + 8);
197 aes_encrypt_deinit(aes);
203 /* Zero-padded AAD */
204 os_memcpy(apos, aad, aad_len);
206 padlen = (16 - aad_len % 16) % 16;
207 os_memset(apos, 0, padlen);
211 os_memcpy(apos, crypt, plain_len);
213 padlen = (16 - plain_len % 16) % 16;
214 os_memset(apos, 0, padlen);
217 /* Length of AAD and C in bits */
218 WPA_PUT_BE64(apos, aad_len * 8);
220 WPA_PUT_BE64(apos, plain_len * 8);
223 wpa_hexdump_key(MSG_EXCESSIVE, "GHASH_H input", auth, apos - auth);
224 ghash(H, auth, apos - auth, S);
225 wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
228 /* 6. T = MSB_t(GCTR_K(J_0, S)) */
229 J0[AES_BLOCK_SIZE - 1] = 0x01;
230 aes_gctr(aes, J0, S, sizeof(S), tag);
232 /* 7. Return (C, T) */
234 aes_encrypt_deinit(aes);
241 * aes_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96
243 static int aes_gcm_ad(const u8 *key, const u8 *iv,
244 const u8 *crypt, size_t crypt_len,
245 const u8 *aad, size_t aad_len, const u8 *tag,
249 u8 H[AES_BLOCK_SIZE];
250 u8 J0[AES_BLOCK_SIZE];
256 aes = aes_encrypt_init(key, 16);
260 /* 2. Generate hash subkey H = AES_K(0^128) */
261 os_memset(H, 0, sizeof(H));
262 aes_encrypt(aes, H, H);
263 wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
265 /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
266 os_memcpy(J0, iv, iv_len);
267 os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
268 J0[AES_BLOCK_SIZE - 1] = 0x01;
270 /* 4. C = GCTR_K(inc_32(J_0), C) */
272 aes_gctr(aes, J0, crypt, crypt_len, plain);
275 * 5. u = 128 * ceil[len(C)/128] - len(C)
276 * v = 128 * ceil[len(A)/128] - len(A)
277 * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
278 * (i.e., zero padded to block size A || C and lengths of each in bits)
280 auth = os_malloc(32 + 16 + crypt_len + 8 + 8);
282 aes_encrypt_deinit(aes);
288 /* Zero-padded AAD */
289 os_memcpy(apos, aad, aad_len);
291 padlen = (16 - aad_len % 16) % 16;
292 os_memset(apos, 0, padlen);
296 os_memcpy(apos, crypt, crypt_len);
298 padlen = (16 - crypt_len % 16) % 16;
299 os_memset(apos, 0, padlen);
302 /* Length of AAD and C in bits */
303 WPA_PUT_BE64(apos, aad_len * 8);
305 WPA_PUT_BE64(apos, crypt_len * 8);
308 wpa_hexdump(MSG_EXCESSIVE, "GHASH_H input", auth, apos - auth);
309 ghash(H, auth, apos - auth, S);
310 wpa_hexdump(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
313 /* 7. T' = MSB_t(GCTR_K(J_0, S)) */
314 J0[AES_BLOCK_SIZE - 1] = 0x01;
315 aes_gctr(aes, J0, S, sizeof(S), T);
317 aes_encrypt_deinit(aes);
319 if (os_memcmp(tag, T, 16) != 0) {
320 wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
328 static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data,
329 u8 *aad, size_t *aad_len, u8 *nonce)
332 int qos = 0, addr4 = 0;
335 fc = le_to_host16(hdr->frame_control);
336 stype = WLAN_FC_GET_STYPE(fc);
337 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
338 (WLAN_FC_TODS | WLAN_FC_FROMDS))
341 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
342 fc &= ~0x0070; /* Mask subtype bits */
346 fc &= ~WLAN_FC_ORDER;
347 qc = (const u8 *) (hdr + 1);
353 fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
355 WPA_PUT_LE16(aad, fc);
357 os_memcpy(pos, hdr->addr1, 3 * ETH_ALEN);
359 seq = le_to_host16(hdr->seq_ctrl);
360 seq &= ~0xfff0; /* Mask Seq#; do not modify Frag# */
361 WPA_PUT_LE16(pos, seq);
364 os_memcpy(pos, hdr + 1, addr4 * ETH_ALEN + qos * 2);
365 pos += addr4 * ETH_ALEN;
368 if (1 /* FIX: either device has SPP A-MSDU Capab = 0 */)
374 *aad_len = pos - aad;
376 os_memcpy(nonce, hdr->addr2, ETH_ALEN);
377 nonce[6] = data[7]; /* PN5 */
378 nonce[7] = data[6]; /* PN4 */
379 nonce[8] = data[5]; /* PN3 */
380 nonce[9] = data[4]; /* PN2 */
381 nonce[10] = data[1]; /* PN1 */
382 nonce[11] = data[0]; /* PN0 */
386 u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr,
387 const u8 *data, size_t data_len, size_t *decrypted_len)
389 u8 aad[30], nonce[12], *plain;
390 size_t aad_len, mlen;
393 if (data_len < 8 + 16)
396 plain = os_malloc(data_len + AES_BLOCK_SIZE);
401 mlen = data_len - 8 - 16;
403 os_memset(aad, 0, sizeof(aad));
404 gcmp_aad_nonce(hdr, data, aad, &aad_len, nonce);
405 wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len);
406 wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
408 if (aes_gcm_ad(tk, nonce, m, mlen, aad, aad_len, m + mlen, plain) <
410 u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
411 wpa_printf(MSG_INFO, "Invalid GCMP frame: A1=" MACSTR
412 " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u",
413 MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
415 WLAN_GET_SEQ_SEQ(seq_ctrl),
416 WLAN_GET_SEQ_FRAG(seq_ctrl));
421 *decrypted_len = mlen;
426 u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos,
427 u8 *pn, int keyid, size_t *encrypted_len)
429 u8 aad[30], nonce[12], *crypt, *pos;
430 size_t aad_len, plen;
431 struct ieee80211_hdr *hdr;
433 if (len < hdrlen || hdrlen < 24)
437 crypt = os_malloc(hdrlen + 8 + plen + 16 + AES_BLOCK_SIZE);
441 os_memcpy(crypt, frame, hdrlen);
442 hdr = (struct ieee80211_hdr *) crypt;
443 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
444 pos = crypt + hdrlen;
445 *pos++ = pn[5]; /* PN0 */
446 *pos++ = pn[4]; /* PN1 */
447 *pos++ = 0x00; /* Rsvd */
448 *pos++ = 0x20 | (keyid << 6);
449 *pos++ = pn[3]; /* PN2 */
450 *pos++ = pn[2]; /* PN3 */
451 *pos++ = pn[1]; /* PN4 */
452 *pos++ = pn[0]; /* PN5 */
454 os_memset(aad, 0, sizeof(aad));
455 gcmp_aad_nonce(hdr, crypt + hdrlen, aad, &aad_len, nonce);
456 wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", aad, aad_len);
457 wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
459 if (aes_gcm_ae(tk, nonce, frame + hdrlen, plen, aad, aad_len,
460 pos, pos + plen) < 0) {
465 wpa_hexdump(MSG_EXCESSIVE, "GCMP MIC", pos + plen, 16);
466 wpa_hexdump(MSG_EXCESSIVE, "GCMP encrypted", pos, plen);
468 *encrypted_len = hdrlen + 8 + plen + 16;