mirror of
https://github.com/STMicroelectronics/STM32CubeF4.git
synced 2025-05-08 19:29:40 +08:00
533 lines
16 KiB
C
533 lines
16 KiB
C
/*
|
|
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
|
* Copyright (C) 2019-2020 STMicroelectronics, All Rights Reserved
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*
|
|
* This file implements ST GCM HW services based on API from mbed TLS
|
|
*/
|
|
|
|
/* Includes ------------------------------------------------------------------*/
|
|
#include "mbedtls/gcm.h"
|
|
|
|
#if defined(MBEDTLS_GCM_C)
|
|
#if defined(MBEDTLS_GCM_ALT)
|
|
|
|
#include <string.h>
|
|
|
|
#include "mbedtls/platform_util.h"
|
|
#include "mbedtls/platform.h"
|
|
|
|
|
|
/* Parameter validation macros */
|
|
#define GCM_VALIDATE_RET( cond ) \
|
|
MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_GCM_BAD_INPUT )
|
|
#define GCM_VALIDATE( cond ) \
|
|
MBEDTLS_INTERNAL_VALIDATE( cond )
|
|
|
|
/* Private typedef -----------------------------------------------------------*/
|
|
/* Private define ------------------------------------------------------------*/
|
|
#define IV_LENGTH 12U /* implementations restrict support to 96 bits */
|
|
|
|
#if !defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
#define AAD_WORD_ALIGN 4U /* implementations restrict AAD support on a */
|
|
/* buffer multiple of 32 bits */
|
|
#endif
|
|
|
|
/* Private macro -------------------------------------------------------------*/
|
|
/* Private variables ---------------------------------------------------------*/
|
|
/* Private function prototypes -----------------------------------------------*/
|
|
/* Private functions ---------------------------------------------------------*/
|
|
|
|
/*
|
|
* Initialize a context
|
|
*/
|
|
void mbedtls_gcm_init( mbedtls_gcm_context *ctx )
|
|
{
|
|
GCM_VALIDATE( ctx != NULL );
|
|
|
|
__disable_irq();
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
/* mutex cannot be initialized twice */
|
|
if ( !cryp_mutex_started )
|
|
{
|
|
mbedtls_mutex_init( &cryp_mutex );
|
|
cryp_mutex_started = 1;
|
|
}
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
cryp_context_count++;
|
|
__enable_irq();
|
|
|
|
cryp_zeroize( (void*)ctx, sizeof(mbedtls_gcm_context) );
|
|
}
|
|
|
|
int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx,
|
|
mbedtls_cipher_id_t cipher,
|
|
const unsigned char *key,
|
|
unsigned int keybits )
|
|
{
|
|
unsigned int i;
|
|
int ret = 0;
|
|
|
|
GCM_VALIDATE_RET( ctx != NULL );
|
|
GCM_VALIDATE_RET( key != NULL );
|
|
|
|
/* Protect context access */
|
|
/* (it may occur at a same time in a threaded environment) */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_lock( &cryp_mutex ) != 0 )
|
|
return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
switch (keybits)
|
|
{
|
|
case 128:
|
|
ctx->hcryp_gcm.Init.KeySize = CRYP_KEYSIZE_128B;
|
|
break;
|
|
|
|
case 192:
|
|
#if ( USE_AES_KEY192 == 1 )
|
|
ctx->hcryp_gcm.Init.KeySize = CRYP_KEYSIZE_192B;
|
|
break;
|
|
#else
|
|
ret = MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED;
|
|
goto exit;
|
|
#endif /* USE_AES_KEY192 */
|
|
|
|
case 256:
|
|
ctx->hcryp_gcm.Init.KeySize = CRYP_KEYSIZE_256B;
|
|
break;
|
|
|
|
default :
|
|
ret = MBEDTLS_ERR_GCM_BAD_INPUT;
|
|
goto exit;
|
|
}
|
|
|
|
/* Format and fill AES key */
|
|
for( i=0; i < (keybits/32); i++ )
|
|
GET_UINT32_BE( ctx->gcm_key[i], key, 4*i );
|
|
|
|
/* include the appropriate instance name */
|
|
#if defined (AES)
|
|
ctx->hcryp_gcm.Instance = AES;
|
|
ctx->hcryp_gcm.Init.Algorithm = CRYP_AES_GCM_GMAC;
|
|
#elif defined (AES1)
|
|
ctx->hcryp_gcm.Instance = AES1;
|
|
ctx->hcryp_gcm.Init.Algorithm = CRYP_AES_GCM_GMAC;
|
|
#else /* CRYP */
|
|
ctx->hcryp_gcm.Instance = CRYP;
|
|
ctx->hcryp_gcm.Init.Algorithm = CRYP_AES_GCM;
|
|
#endif /* AES */
|
|
|
|
ctx->hcryp_gcm.Init.DataType = CRYP_DATATYPE_8B;
|
|
ctx->hcryp_gcm.Init.DataWidthUnit = CRYP_DATAWIDTHUNIT_BYTE;
|
|
ctx->hcryp_gcm.Init.pKey = ctx->gcm_key;
|
|
|
|
if ( HAL_CRYP_Init( &ctx->hcryp_gcm ) != HAL_OK )
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
|
|
/* allow multi-context of CRYP : save context */
|
|
ctx->ctx_save_cr = ctx->hcryp_gcm.Instance->CR;
|
|
|
|
exit :
|
|
/* Free context access */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_unlock( &cryp_mutex ) != 0 )
|
|
ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
return( ret );
|
|
}
|
|
|
|
int mbedtls_gcm_starts( mbedtls_gcm_context *ctx,
|
|
int mode,
|
|
const unsigned char *iv,
|
|
size_t iv_len,
|
|
const unsigned char *add,
|
|
size_t add_len )
|
|
{
|
|
int ret = 0;
|
|
unsigned int i;
|
|
__ALIGN_BEGIN static uint32_t iv_32B[4] __ALIGN_END;
|
|
|
|
GCM_VALIDATE_RET( ctx != NULL );
|
|
GCM_VALIDATE_RET( mode != MBEDTLS_GCM_ENCRYPT || mode != MBEDTLS_GCM_DECRYPT );
|
|
GCM_VALIDATE_RET( iv != NULL );
|
|
GCM_VALIDATE_RET( add_len == 0 || add != NULL );
|
|
|
|
/* IV and AD are limited to 2^64 bits, so 2^61 bytes */
|
|
/* IV is not allowed to be zero length */
|
|
if( iv_len == 0 ||
|
|
( (uint64_t) iv_len ) >> 61 != 0 ||
|
|
( (uint64_t) add_len ) >> 61 != 0 )
|
|
{
|
|
return( MBEDTLS_ERR_GCM_BAD_INPUT );
|
|
}
|
|
|
|
/* implementation restrict support to the length of 96 bits */
|
|
if( IV_LENGTH != iv_len )
|
|
{
|
|
return( MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED );
|
|
}
|
|
|
|
#if !defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
/* implementation restrict support to a buffer multiple of 32 bits */
|
|
if ((add_len % AAD_WORD_ALIGN) != 0U)
|
|
{
|
|
return( MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED );
|
|
}
|
|
#endif
|
|
|
|
/* Protect context access */
|
|
/* (it may occur at a same time in a threaded environment) */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_lock( &cryp_mutex ) != 0 )
|
|
return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
if ( HAL_CRYP_Init( &ctx->hcryp_gcm ) != HAL_OK )
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
|
|
/* allow multi-context of CRYP use: restore context */
|
|
ctx->hcryp_gcm.Instance->CR = ctx->ctx_save_cr;
|
|
|
|
ctx->mode = mode;
|
|
ctx->len = 0;
|
|
|
|
/* Set IV with invert endianness */
|
|
for( i=0; i < 3; i++ )
|
|
GET_UINT32_BE( iv_32B[i], iv, 4*i );
|
|
|
|
/* According to NIST specification, the counter value is 0x2 when
|
|
processing the first block of payload */
|
|
iv_32B[3] = 0x00000002;
|
|
|
|
ctx->hcryp_gcm.Init.pInitVect = iv_32B;
|
|
|
|
if ( add_len > 0 )
|
|
{
|
|
ctx->hcryp_gcm.Init.Header = (uint32_t *)add;
|
|
#if defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
/* header buffer in byte length */
|
|
ctx->hcryp_gcm.Init.HeaderSize = (uint32_t)add_len;
|
|
#else
|
|
/* header buffer in word length */
|
|
ctx->hcryp_gcm.Init.HeaderSize = (uint32_t)(add_len/AAD_WORD_ALIGN);
|
|
#endif
|
|
}
|
|
else
|
|
{
|
|
ctx->hcryp_gcm.Init.Header = NULL;
|
|
ctx->hcryp_gcm.Init.HeaderSize = 0;
|
|
}
|
|
|
|
#if defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
/* Additional Authentication Data in bytes unit */
|
|
ctx->hcryp_gcm.Init.HeaderWidthUnit = CRYP_HEADERWIDTHUNIT_BYTE;
|
|
#endif
|
|
|
|
/* Do not Allow IV reconfiguration at every gcm update */
|
|
ctx->hcryp_gcm.Init.KeyIVConfigSkip = CRYP_KEYIVCONFIG_ONCE;
|
|
|
|
/* reconfigure the CRYP */
|
|
if ( HAL_CRYP_SetConfig( &ctx->hcryp_gcm, &ctx->hcryp_gcm.Init ) != HAL_OK )
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
|
|
/* allow multi-context of CRYP : save context */
|
|
ctx->ctx_save_cr = ctx->hcryp_gcm.Instance->CR;
|
|
|
|
exit:
|
|
/* Free context access */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_unlock( &cryp_mutex ) != 0 )
|
|
ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
return( ret );
|
|
}
|
|
|
|
int mbedtls_gcm_update( mbedtls_gcm_context *ctx,
|
|
size_t length,
|
|
const unsigned char *input,
|
|
unsigned char *output )
|
|
{
|
|
int ret = 0;
|
|
#if !defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
size_t rest_length = 0;
|
|
#endif
|
|
|
|
GCM_VALIDATE_RET( ctx != NULL );
|
|
GCM_VALIDATE_RET( length == 0 || input != NULL );
|
|
GCM_VALIDATE_RET( length == 0 || output != NULL );
|
|
|
|
if( output > input && (size_t) ( output - input ) < length )
|
|
return( MBEDTLS_ERR_GCM_BAD_INPUT );
|
|
|
|
/* Total length is restricted to 2^39 - 256 bits, ie 2^36 - 2^5 bytes
|
|
* Also check for possible overflow */
|
|
if( ( (ctx->len + length) < ctx->len ) ||
|
|
( (uint64_t)(ctx->len + length) > 0xFFFFFFFE0ull ) )
|
|
{
|
|
return( MBEDTLS_ERR_GCM_BAD_INPUT );
|
|
}
|
|
|
|
/* Protect context access */
|
|
/* (it may occur at a same time in a threaded environment) */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_lock( &cryp_mutex ) != 0 )
|
|
return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
/* allow multi-context of CRYP use: restore context */
|
|
ctx->hcryp_gcm.Instance->CR = ctx->ctx_save_cr;
|
|
|
|
ctx->len += length;
|
|
|
|
#if !defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
/* compute remaining data (data buffer in word) */
|
|
if ((length % AAD_WORD_ALIGN) != 0U)
|
|
rest_length = length % AAD_WORD_ALIGN;
|
|
#endif
|
|
|
|
if( ctx->mode == MBEDTLS_GCM_DECRYPT )
|
|
{
|
|
if ( HAL_CRYP_Decrypt( &ctx->hcryp_gcm,
|
|
(uint32_t *)input,
|
|
length,
|
|
(uint32_t *)output,
|
|
ST_CRYP_TIMEOUT ) != HAL_OK )
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
#if !defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
/* manage last bytes */
|
|
if (rest_length !=0 )
|
|
{
|
|
if (HAL_CRYP_Decrypt(&ctx->hcryp_gcm,
|
|
(uint32_t *)(input + (length/AAD_WORD_ALIGN)),
|
|
rest_length,
|
|
(uint32_t *)(output + (length/AAD_WORD_ALIGN)),
|
|
ST_CRYP_TIMEOUT) != HAL_OK)
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
else
|
|
{
|
|
if ( HAL_CRYP_Encrypt( &ctx->hcryp_gcm,
|
|
(uint32_t *)input,
|
|
length,
|
|
(uint32_t *)output,
|
|
ST_CRYP_TIMEOUT ) != HAL_OK )
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
#if !defined(STM32_AAD_ANY_LENGTH_SUPPORT)
|
|
/* manage last bytes */
|
|
if (rest_length !=0 )
|
|
{
|
|
if (HAL_CRYP_Encrypt(&ctx->hcryp_gcm,
|
|
(uint32_t *)(input + (length/AAD_WORD_ALIGN)),
|
|
rest_length,
|
|
(uint32_t *)(output + (length/AAD_WORD_ALIGN)),
|
|
ST_CRYP_TIMEOUT) != HAL_OK)
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
/* allow multi-context of CRYP : save context */
|
|
ctx->ctx_save_cr = ctx->hcryp_gcm.Instance->CR;
|
|
|
|
exit:
|
|
/* Free context access */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_unlock( &cryp_mutex ) != 0 )
|
|
ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
return( ret );
|
|
}
|
|
|
|
int mbedtls_gcm_finish( mbedtls_gcm_context *ctx,
|
|
unsigned char *tag,
|
|
size_t tag_len )
|
|
{
|
|
int ret = 0;
|
|
__ALIGN_BEGIN uint8_t mac[16] __ALIGN_END; /* temporary mac */
|
|
|
|
GCM_VALIDATE_RET( ctx != NULL );
|
|
GCM_VALIDATE_RET( tag != NULL );
|
|
|
|
if( tag_len > 16 || tag_len < 4 )
|
|
return( MBEDTLS_ERR_GCM_BAD_INPUT );
|
|
|
|
/* Protect context access */
|
|
/* (it may occur at a same time in a threaded environment) */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_lock( &cryp_mutex ) != 0 )
|
|
return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
/* allow multi-context of CRYP use: restore context */
|
|
ctx->hcryp_gcm.Instance->CR = ctx->ctx_save_cr;
|
|
|
|
/* Tag has a variable length */
|
|
memset(mac, 0, sizeof(mac));
|
|
|
|
/* Generate the authentication TAG */
|
|
if ( HAL_CRYPEx_AESGCM_GenerateAuthTAG( &ctx->hcryp_gcm,
|
|
(uint32_t *)mac,
|
|
ST_CRYP_TIMEOUT )!= HAL_OK )
|
|
{
|
|
ret = MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
|
goto exit;
|
|
}
|
|
|
|
memcpy( tag, mac, tag_len );
|
|
|
|
/* allow multi-context of CRYP : save context */
|
|
ctx->ctx_save_cr = ctx->hcryp_gcm.Instance->CR;
|
|
|
|
exit:
|
|
/* Free context access */
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if( mbedtls_mutex_unlock( &cryp_mutex ) != 0 )
|
|
ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
|
|
return( ret );
|
|
}
|
|
|
|
int mbedtls_gcm_crypt_and_tag( mbedtls_gcm_context *ctx,
|
|
int mode,
|
|
size_t length,
|
|
const unsigned char *iv,
|
|
size_t iv_len,
|
|
const unsigned char *add,
|
|
size_t add_len,
|
|
const unsigned char *input,
|
|
unsigned char *output,
|
|
size_t tag_len,
|
|
unsigned char *tag )
|
|
{
|
|
int ret;
|
|
|
|
GCM_VALIDATE_RET( ctx != NULL );
|
|
GCM_VALIDATE_RET( iv != NULL );
|
|
GCM_VALIDATE_RET( add_len == 0 || add != NULL );
|
|
GCM_VALIDATE_RET( length == 0 || input != NULL );
|
|
GCM_VALIDATE_RET( length == 0 || output != NULL );
|
|
GCM_VALIDATE_RET( tag != NULL );
|
|
|
|
if( ( ret = mbedtls_gcm_starts( ctx, mode, iv, iv_len, add, add_len ) ) != 0 )
|
|
return( ret );
|
|
|
|
if( ( ret = mbedtls_gcm_update( ctx, length, input, output ) ) != 0 )
|
|
return( ret );
|
|
|
|
if( ( ret = mbedtls_gcm_finish( ctx, tag, tag_len ) ) != 0 )
|
|
return( ret );
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
int mbedtls_gcm_auth_decrypt( mbedtls_gcm_context *ctx,
|
|
size_t length,
|
|
const unsigned char *iv,
|
|
size_t iv_len,
|
|
const unsigned char *add,
|
|
size_t add_len,
|
|
const unsigned char *tag,
|
|
size_t tag_len,
|
|
const unsigned char *input,
|
|
unsigned char *output )
|
|
{
|
|
int ret;
|
|
unsigned char check_tag[16];
|
|
size_t i;
|
|
int diff;
|
|
|
|
GCM_VALIDATE_RET( ctx != NULL );
|
|
GCM_VALIDATE_RET( iv != NULL );
|
|
GCM_VALIDATE_RET( add_len == 0 || add != NULL );
|
|
GCM_VALIDATE_RET( tag != NULL );
|
|
GCM_VALIDATE_RET( length == 0 || input != NULL );
|
|
GCM_VALIDATE_RET( length == 0 || output != NULL );
|
|
|
|
if( ( ret = mbedtls_gcm_crypt_and_tag( ctx, MBEDTLS_GCM_DECRYPT, length,
|
|
iv, iv_len, add, add_len,
|
|
input, output, tag_len, check_tag ) ) != 0 )
|
|
{
|
|
return( ret );
|
|
}
|
|
|
|
/* Check tag in "constant-time" */
|
|
for( diff = 0, i = 0; i < tag_len; i++ )
|
|
diff |= tag[i] ^ check_tag[i];
|
|
|
|
if( diff != 0 )
|
|
{
|
|
mbedtls_platform_zeroize( output, length );
|
|
return( MBEDTLS_ERR_GCM_AUTH_FAILED );
|
|
}
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
void mbedtls_gcm_free( mbedtls_gcm_context *ctx )
|
|
{
|
|
if( ctx == NULL )
|
|
return;
|
|
|
|
__disable_irq();
|
|
if ( cryp_context_count > 0 )
|
|
cryp_context_count--;
|
|
|
|
#if defined(MBEDTLS_THREADING_C)
|
|
if ( cryp_mutex_started )
|
|
{
|
|
mbedtls_mutex_free( &cryp_mutex );
|
|
cryp_mutex_started = 0;
|
|
}
|
|
#endif /* MBEDTLS_THREADING_C */
|
|
__enable_irq();
|
|
|
|
/* Shut down CRYP on last context */
|
|
if ( cryp_context_count == 0 )
|
|
HAL_CRYP_DeInit( &ctx->hcryp_gcm );
|
|
|
|
cryp_zeroize( (void*)ctx, sizeof(mbedtls_gcm_context) );
|
|
}
|
|
|
|
#endif /*MBEDTLS_GCM_ALT*/
|
|
#endif /*MBEDTLS_GCM_C*/
|