LXR uboot/arch/arm/mach-tegra/tegra20/crypto.c

   1// SPDX-License-Identifier: GPL-2.0+
   2/*
   3 * Copyright (c) 2011 The Chromium OS Authors.
   4 * (C) Copyright 2010 - 2011 NVIDIA Corporation <www.nvidia.com>
   5 */
   6
   7#include <common.h>
   8#include <log.h>
   9#include <linux/errno.h>
  10#include "crypto.h"
  11#include "uboot_aes.h"
  12
  13static u8 zero_key[16];
  14
  15#define AES_CMAC_CONST_RB 0x87  /* from RFC 4493, Figure 2.2 */
  16
  17enum security_op {
  18        SECURITY_SIGN           = 1 << 0,       /* Sign the data */
  19        SECURITY_ENCRYPT        = 1 << 1,       /* Encrypt the data */
  20};
  21
  22/**
  23 * Shift a vector left by one bit
  24 *
  25 * \param in    Input vector
  26 * \param out   Output vector
  27 * \param size  Length of vector in bytes
  28 */
  29static void left_shift_vector(u8 *in, u8 *out, int size)
  30{
  31        int carry = 0;
  32        int i;
  33
  34        for (i = size - 1; i >= 0; i--) {
  35                out[i] = (in[i] << 1) | carry;
  36                carry = in[i] >> 7;     /* get most significant bit */
  37        }
  38}
  39
  40/**
  41 * Sign a block of data, putting the result into dst.
  42 *
  43 * \param key                   Input AES key, length AES128_KEY_LENGTH
  44 * \param key_schedule          Expanded key to use
  45 * \param src                   Source data of length 'num_aes_blocks' blocks
  46 * \param dst                   Destination buffer, length AES128_KEY_LENGTH
  47 * \param num_aes_blocks        Number of AES blocks to encrypt
  48 */
  49static void sign_object(u8 *key, u8 *key_schedule, u8 *src, u8 *dst,
  50                        u32 num_aes_blocks)
  51{
  52        u8 tmp_data[AES128_KEY_LENGTH];
  53        u8 iv[AES128_KEY_LENGTH] = {0};
  54        u8 left[AES128_KEY_LENGTH];
  55        u8 k1[AES128_KEY_LENGTH];
  56        u8 *cbc_chain_data;
  57        unsigned i;
  58
  59        cbc_chain_data = zero_key;      /* Convenient array of 0's for IV */
  60
  61        /* compute K1 constant needed by AES-CMAC calculation */
  62        for (i = 0; i < AES128_KEY_LENGTH; i++)
  63                tmp_data[i] = 0;
  64
  65        aes_cbc_encrypt_blocks(AES128_KEY_LENGTH, key_schedule, iv,
  66                               tmp_data, left, 1);
  67
  68        left_shift_vector(left, k1, sizeof(left));
  69
  70        if ((left[0] >> 7) != 0) /* get MSB of L */
  71                k1[AES128_KEY_LENGTH - 1] ^= AES_CMAC_CONST_RB;
  72
  73        /* compute the AES-CMAC value */
  74        for (i = 0; i < num_aes_blocks; i++) {
  75                /* Apply the chain data */
  76                aes_apply_cbc_chain_data(cbc_chain_data, src, tmp_data);
  77
  78                /* for the final block, XOR K1 into the IV */
  79                if (i == num_aes_blocks - 1)
  80                        aes_apply_cbc_chain_data(tmp_data, k1, tmp_data);
  81
  82                /* encrypt the AES block */
  83                aes_encrypt(AES128_KEY_LENGTH, tmp_data,
  84                            key_schedule, dst);
  85
  86                debug("sign_obj: block %d of %d\n", i, num_aes_blocks);
  87
  88                /* Update pointers for next loop. */
  89                cbc_chain_data = dst;
  90                src += AES128_KEY_LENGTH;
  91        }
  92}
  93
  94/**
  95 * Encrypt and sign a block of data (depending on security mode).
  96 *
  97 * \param key           Input AES key, length AES128_KEY_LENGTH
  98 * \param oper          Security operations mask to perform (enum security_op)
  99 * \param src           Source data
 100 * \param length        Size of source data
 101 * \param sig_dst       Destination address for signature, AES128_KEY_LENGTH bytes
 102 */
 103static int encrypt_and_sign(u8 *key, enum security_op oper, u8 *src,
 104                            u32 length, u8 *sig_dst)
 105{
 106        u32 num_aes_blocks;
 107        u8 key_schedule[AES128_EXPAND_KEY_LENGTH];
 108        u8 iv[AES128_KEY_LENGTH] = {0};
 109
 110        debug("encrypt_and_sign: length = %d\n", length);
 111
 112        /*
 113         * The only need for a key is for signing/checksum purposes, so
 114         * if not encrypting, expand a key of 0s.
 115         */
 116        aes_expand_key(oper & SECURITY_ENCRYPT ? key : zero_key,
 117                       AES128_KEY_LENGTH, key_schedule);
 118
 119        num_aes_blocks = (length + AES128_KEY_LENGTH - 1) / AES128_KEY_LENGTH;
 120
 121        if (oper & SECURITY_ENCRYPT) {
 122                /* Perform this in place, resulting in src being encrypted. */
 123                debug("encrypt_and_sign: begin encryption\n");
 124                aes_cbc_encrypt_blocks(AES128_KEY_LENGTH, key_schedule, iv, src,
 125                                       src, num_aes_blocks);
 126                debug("encrypt_and_sign: end encryption\n");
 127        }
 128
 129        if (oper & SECURITY_SIGN) {
 130                /* encrypt the data, overwriting the result in signature. */
 131                debug("encrypt_and_sign: begin signing\n");
 132                sign_object(key, key_schedule, src, sig_dst, num_aes_blocks);
 133                debug("encrypt_and_sign: end signing\n");
 134        }
 135
 136        return 0;
 137}
 138
 139int sign_data_block(u8 *source, unsigned length, u8 *signature)
 140{
 141        return encrypt_and_sign(zero_key, SECURITY_SIGN, source,
 142                                length, signature);
 143}
 144