maki/openairinterface5g
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/kdf_openssl' into integration_2022_wk06

Browse Source
This commit is contained in:
Robert Schmidt
2023-02-12 14:01:33 +01:00
parent 0d4a95b88f 986a1a80ff
commit a6145ca92b
58 changed files with 1501 additions and 937 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openair2/LAYER2/nr_pdcp/nr_pdcp_integrity_nia2.c
+39 -40
View File
@@ -21,62 +21,61 @@
#include "nr_pdcp_integrity_nia2.h"
#include <arpa/inet.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <openssl/cmac.h>
void *nr_pdcp_integrity_nia2_init(unsigned char *integrity_key)
#include "common/utils/assertions.h"
#include "openair3/SECU/aes_128.h"
#include "openair3/SECU/aes_128_cbc_cmac.h"
void *nr_pdcp_integrity_nia2_init(uint8_t integrity_key[16])
{
CMAC_CTX *ctx;
ctx = CMAC_CTX_new();
if (ctx == NULL) abort();
CMAC_Init(ctx, integrity_key, 16, EVP_aes_128_cbc(), NULL);
// This is a hack. Reduce the 3 functions to just cipher?
// No. The overhead is x8 times more. Don't change before measuring
// return integrity_key;
cbc_cmac_ctx_t* ctx = calloc(1, sizeof(cbc_cmac_ctx_t));
DevAssert(ctx != NULL && "Memory exhausted");
*ctx = init_aes_128_cbc_cmac(integrity_key);
return ctx;
}
static void compute_t(unsigned char *t, uint32_t count, int bearer,
int direction)
void nr_pdcp_integrity_nia2_integrity(void *integrity_context, unsigned char *out, unsigned char *buffer, int length, int bearer, int count, int direction)
{
t[0] = (count >> 24) & 255;
t[1] = (count >> 16) & 255;
t[2] = (count >> 8) & 255;
t[3] = (count ) & 255;
t[4] = ((bearer-1) << 3) | (direction << 2);
memset(&t[5], 0, 8-5);
}
DevAssert(integrity_context != NULL);
DevAssert(out != NULL);
DevAssert(buffer != NULL);
DevAssert(length > -1);
// Strange range: [1-32] instead of [0-31]
DevAssert(bearer > 0 && bearer < 33);
DevAssert(count > -1);
void nr_pdcp_integrity_nia2_integrity(void *integrity_context,
unsigned char *out,
unsigned char *buffer, int length,
int bearer, int count, int direction)
{
CMAC_CTX *ctx = integrity_context;
unsigned char t[8];
unsigned char mac[16];
size_t maclen;
cbc_cmac_ctx_t* ctx = (cbc_cmac_ctx_t*)integrity_context;
/* see 33.401 B.2.3 for the input to 128-EIA2
* (which is identical to 128-NIA2, see 33.501 D.3.1.3) */
compute_t(t, count, bearer, direction);
aes_128_t k_iv = {0};
memcpy(&k_iv.key, ctx->key, sizeof(k_iv.key));
k_iv.type = AES_INITIALIZATION_VECTOR_8;
k_iv.iv8.d.bearer = bearer -1;
k_iv.iv8.d.direction = direction;
k_iv.iv8.d.count = htonl(count);
CMAC_Init(ctx, NULL, 0, NULL, NULL);
CMAC_Update(ctx, t, 8);
CMAC_Update(ctx, buffer, length);
CMAC_Final(ctx, mac, &maclen);
uint8_t result[16] = {0};
byte_array_t msg = {.buf = buffer, .len = length};
cipher_aes_128_cbc_cmac((cbc_cmac_ctx_t*)integrity_context, &k_iv, msg, sizeof(result), result);
//aes_128_cbc_cmac(&k_iv, msg, sizeof(result), result);
/* AES CMAC (RFC 4493) outputs 128 bits but NR PDCP PDUs have a MAC-I of
* 32 bits (see 38.323 6.2). RFC 4493 2.1 says to truncate most significant
* bit first (so seems to say 33.401 B.2.3)
*/
memcpy(out, mac, 4);
// AES CMAC (RFC 4493) outputs 128 bits but NR PDCP PDUs have a MAC-I of
// 32 bits (see 38.323 6.2). RFC 4493 2.1 says to truncate most significant
// bit first (so seems to say 33.401 B.2.3)
// Precondition: out should have enough space...
memcpy(out, result, 4);
}
void nr_pdcp_integrity_nia2_free_integrity(void *integrity_context)
{
CMAC_CTX *ctx = integrity_context;
CMAC_CTX_free(ctx);
free( ( cbc_cmac_ctx_t*) integrity_context);
}
openair2/LAYER2/nr_pdcp/nr_pdcp_integrity_nia2.h
+3 -1
View File
@@ -22,7 +22,9 @@
#ifndef _NR_PDCP_INTEGRITY_NIA2_H_
#define _NR_PDCP_INTEGRITY_NIA2_H_
void *nr_pdcp_integrity_nia2_init(unsigned char *integrity_key);
#include <stdint.h>
void *nr_pdcp_integrity_nia2_init(uint8_t integrity_key[16]);
void nr_pdcp_integrity_nia2_integrity(void *integrity_context,
unsigned char *out,
openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c
+30 -35
View File
@@ -19,55 +19,50 @@
* contact@openairinterface.org
*/
#include "openair3/SECU/aes_128_ctr.h"
#include "common/utils/assertions.h"
#include "nr_pdcp_security_nea2.h"
#include <arpa/inet.h>
#include <assert.h>
#include <stdlib.h>
#include <string.h>
#include <nettle/nettle-meta.h>
#include <nettle/aes.h>
#include <nettle/ctr.h>
#ifndef NETTLE_VERSION_MAJOR
/* hack: include bignum.h, not version.h because version.h does not exist
* in old versions and bignum.h includes version.h (as of today).
* May completely fail to work... maybe we should skip support of old
* versions of nettle.
*/
#include <nettle/bignum.h>
#endif
void *nr_pdcp_security_nea2_init(unsigned char *ciphering_key)
{
void *ctx = calloc(1, nettle_aes128.context_size);
if (ctx == NULL) exit(1);
#if !defined(NETTLE_VERSION_MAJOR) || NETTLE_VERSION_MAJOR < 3
nettle_aes128.set_encrypt_key(ctx, 16, ciphering_key);
#else
nettle_aes128.set_encrypt_key(ctx, ciphering_key);
#endif
return ctx;
// This is a hack, IMO init, cipher and free functions should be reduced to cipher.
// Test show a ~10% more processing time
return ciphering_key;
}
void nr_pdcp_security_nea2_cipher(void *security_context,
unsigned char *buffer, int length,
int bearer, int count, int direction)
void nr_pdcp_security_nea2_cipher(void *security_context, unsigned char *buffer, int length, int bearer, int count, int direction)
{
unsigned char t[16] = {0};
DevAssert(security_context != NULL);
DevAssert(buffer != NULL);
DevAssert(length > 0);
DevAssert(bearer > -1 && bearer < 32);
DevAssert(direction > -1 && direction < 2);
DevAssert(count > -1);
t[0] = (count >> 24) & 255;
t[1] = (count >> 16) & 255;
t[2] = (count >> 8) & 255;
t[3] = (count ) & 255;
t[4] = ((bearer-1) << 3) | (direction << 2);
aes_128_t p = {0};
const uint8_t *ciphering_key = (uint8_t const *)security_context;
memcpy(p.key, ciphering_key, 16);
p.type = AES_INITIALIZATION_VECTOR_16;
p.iv16.d.count = ntohl(count);
p.iv16.d.bearer = bearer;
p.iv16.d.direction = direction;
nettle_ctr_crypt(security_context, nettle_aes128.encrypt,
nettle_aes128.block_size, t,
length, buffer, buffer);
uint8_t out[length];
memset(out, 0, length);
byte_array_t msg = {.buf = buffer, .len = length};;
aes_128_ctr(&p, msg, length, out);
memcpy(buffer, out, length);
}
void nr_pdcp_security_nea2_free_security(void *security_context)
{
free(security_context);
(void)security_context;
}
openair2/UTIL/ALG_DS/CMakeLists.txt
+2
View File
@@ -0,0 +1,2 @@
add_subdirectory(DS)
openair2/UTIL/ALG_DS/README.md
+2
View File
@@ -0,0 +1,2 @@
Algorithms and Data Structures in C for common usage
openair2/UTIL/CMakeLists.txt
+2
View File
@@ -0,0 +1,2 @@
add_subdirectory(ALG_DS)
openair2/UTIL/OSA/README
-1
View File
@@ -1,7 +1,6 @@
OAISIM Security Algorithms v0.1
Dependencies:
- nettle >= 2.5
- openssl >= 1.0.1
Compilation:
openair2/UTIL/OSA/osa_defs.h
+1 -1
View File
@@ -22,7 +22,7 @@
/*!
* \file secu_defs.h
* \brief Openair security algorithms functions implementing 3GPP TS 33.401
* \note HMAC computations are done by nettle/openssl library
* \note HMAC computations are done by openssl library
* \author Sebastien ROUX
* \date 2013
* \version 0.1
openair2/UTIL/OSA/osa_key_deriver.c
+29 -39
View File
@@ -19,31 +19,15 @@
* contact@openairinterface.org
*/
#include <stdint.h>
#include "../../../openair3/SECU/kdf.h"
#include <nettle/hmac.h>
#include <stdint.h>
#include <string.h>
#include "osa_defs.h"
#include "osa_internal.h"
#include "common/utils/LOG/log.h"
static inline
void kdf(const uint8_t *s, const uint32_t s_length, const uint8_t *key,
const uint32_t key_length, uint8_t **out, uint32_t out_length)
{
struct hmac_sha256_ctx ctx;
uint8_t *buffer;
buffer = malloc(sizeof(uint8_t) * out_length);
hmac_sha256_set_key(&ctx, key_length, key);
hmac_sha256_update(&ctx, s_length, s);
hmac_sha256_digest(&ctx, out_length, buffer);
*out = buffer;
}
/*!
* @brief Derive the keys from key and perform truncate on the generated key to
* reduce his size to 128 bits. Definition of the derivation function can
@@ -58,10 +42,9 @@ void kdf(const uint8_t *s, const uint32_t s_length, const uint8_t *key,
* @param[out] out Pointer to reference where output of KDF will be stored.
* NOTE: knas is dynamically allocated by the KDF function
*/
int derive_key(algorithm_type_dist_t alg_type, uint8_t alg_id,
const uint8_t key[32], uint8_t **out)
int derive_key(algorithm_type_dist_t alg_type, uint8_t alg_id, const uint8_t key[32], uint8_t **out)
{
uint8_t string[7];
uint8_t string[7] = {0};
/* FC */
string[0] = FC_ALG_KEY_DER;
@@ -84,7 +67,7 @@ int derive_key(algorithm_type_dist_t alg_type, uint8_t alg_id,
{
int i;
char payload[6 * sizeof(string) + 1];
int index = 0;
int index = 0;
for (i = 0; i < sizeof(string); i++)
index += sprintf(&payload[index], "0x%02x ", string[i]);
@@ -93,13 +76,17 @@ int derive_key(algorithm_type_dist_t alg_type, uint8_t alg_id,
}
#endif
kdf(string, 7, key, 32, out, 32);
byte_array_t data = {.buf = string, .len = 7};
if (*out == NULL) {
*out = malloc(sizeof(uint8_t) * 32);
DevAssert(*out != NULL && "Memory exhausted");
}
kdf(key, data, 32, *out);
return 0;
}
int nr_derive_key(algorithm_type_dist_t alg_type, uint8_t alg_id,
const uint8_t key[32], uint8_t **out)
int nr_derive_key(algorithm_type_dist_t alg_type, uint8_t alg_id, const uint8_t key[32], uint8_t **out)
{
uint8_t string[7];
@@ -120,17 +107,23 @@ int nr_derive_key(algorithm_type_dist_t alg_type, uint8_t alg_id,
string[5] = 0x00;
string[6] = 0x01;
kdf(string, 7, key, 32, out, 32);
byte_array_t data = {.buf = string, .len = 7};
if (*out == NULL) {
*out = malloc(sizeof(uint8_t) * 32);
DevAssert(*out != NULL && "Memory exhausted");
}
kdf(key, data, 32, *out);
// in NR, we use the last 16 bytes, ignoring the first 16 ones
memcpy(*out, *out+16, 16);
memcpy(*out, *out + 16, 16);
return 0;
}
int nr_derive_key_ng_ran_star(uint16_t pci, uint64_t nr_arfcn_dl, const uint8_t key[32], uint8_t *key_ng_ran_star)
{
uint8_t *out;
uint8_t s[10];
uint8_t s[10] = {0};
/* FC */
s[0] = NR_FC_ALG_KEY_NG_RAN_STAR_DER;
@@ -152,18 +145,17 @@ int nr_derive_key_ng_ran_star(uint16_t pci, uint64_t nr_arfcn_dl, const uint8_t
s[8] = 0x00;
s[9] = 0x03;
kdf(s, 10, key, 32, &out, 32);
memcpy(key_ng_ran_star, out, 32);
free(out);
byte_array_t data = {.buf = s, .len = 10};
const uint32_t len_key = 32;
kdf(key, data, len_key, key_ng_ran_star);
return 0;
}
int derive_skgNB(const uint8_t *keNB, const uint16_t sk_counter, uint8_t *skgNB)
{
uint8_t *out;
uint8_t s[5];
uint8_t s[5] = {0};
/* FC is 0x1c (see 3gpp 33.401 annex A.15) */
s[0] = 0x1c;
@@ -176,10 +168,8 @@ int derive_skgNB(const uint8_t *keNB, const uint16_t sk_counter, uint8_t *skgNB)
s[3] = 0x00;
s[4] = 0x02;
kdf(s, 5, keNB, 32, &out, 32);
memcpy(skgNB, out, 32);
free(out);
byte_array_t data = {.buf = s, .len = 5};
kdf(keNB, data, 32, skgNB);
return 0;
}
openair2/UTIL/OSA/osa_stream_eea.c
+50 -108
View File
@@ -19,16 +19,15 @@
* contact@openairinterface.org
*/
#include <arpa/inet.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <nettle/nettle-meta.h>
#include <nettle/aes.h>
#include <nettle/ctr.h>
#include "common/utils/LOG/log.h"
#include "byte_array.h"
#include "openair3//SECU//aes_128_ctr.h"
#include "assertions.h"
#include "osa_defs.h"
@@ -44,10 +43,13 @@ int stream_encrypt_eea0(stream_cipher_t *stream_cipher, uint8_t **out)
DevAssert(stream_cipher != NULL);
DevAssert(out != NULL);
LOG_D(OSA, "Entering stream_encrypt_eea0, bits length %u, bearer %u, "
"count %u, direction %s\n", stream_cipher->blength,
stream_cipher->bearer, stream_cipher->count, stream_cipher->direction == SECU_DIRECTION_DOWNLINK ?
"Downlink" : "Uplink");
LOG_D(OSA,
"Entering stream_encrypt_eea0, bits length %u, bearer %u, "
"count %u, direction %s\n",
stream_cipher->blength,
stream_cipher->bearer,
stream_cipher->count,
stream_cipher->direction == SECU_DIRECTION_DOWNLINK ? "Downlink" : "Uplink");
byte_length = (stream_cipher->blength + 7) >> 3;
@@ -59,7 +61,7 @@ int stream_encrypt_eea0(stream_cipher_t *stream_cipher, uint8_t **out)
data = *out;
}
memcpy (data, stream_cipher->message, byte_length);
memcpy(data, stream_cipher->message, byte_length);
return 0;
}
@@ -67,32 +69,32 @@ int stream_encrypt_eea0(stream_cipher_t *stream_cipher, uint8_t **out)
int stream_encrypt_eea1(stream_cipher_t *stream_cipher, uint8_t **out)
{
osa_snow_3g_context_t snow_3g_context;
int n ;
int i = 0;
uint32_t zero_bit = 0;
int n;
int i = 0;
uint32_t zero_bit = 0;
uint32_t *KS;
uint32_t K[4],IV[4];
uint32_t K[4], IV[4];
DevAssert(stream_cipher != NULL);
DevAssert(stream_cipher->key != NULL);
DevAssert(stream_cipher->key_length == 16);
DevAssert(out != NULL);
n = ( stream_cipher->blength + 31 ) / 32;
n = (stream_cipher->blength + 31) / 32;
zero_bit = stream_cipher->blength & 0x7;
memset(&snow_3g_context, 0, sizeof(snow_3g_context));
/*Initialisation*/
/* Load the confidentiality key for SNOW 3G initialization as in section
3.4. */
memcpy(K+3,stream_cipher->key+0,4); /*K[3] = key[0]; we assume
K[3]=key[0]||key[1]||...||key[31] , with key[0] the
* most important bit of key*/
memcpy(K+2,stream_cipher->key+4,4); /*K[2] = key[1];*/
memcpy(K+1,stream_cipher->key+8,4); /*K[1] = key[2];*/
memcpy(K+0,stream_cipher->key+12,4); /*K[0] = key[3]; we assume
K[0]=key[96]||key[97]||...||key[127] , with key[127] the
* least important bit of key*/
memcpy(K + 3, stream_cipher->key + 0, 4); /*K[3] = key[0]; we assume
K[3]=key[0]||key[1]||...||key[31] , with key[0] the
* most important bit of key*/
memcpy(K + 2, stream_cipher->key + 4, 4); /*K[2] = key[1];*/
memcpy(K + 1, stream_cipher->key + 8, 4); /*K[1] = key[2];*/
memcpy(K + 0, stream_cipher->key + 12, 4); /*K[0] = key[3]; we assume
K[0]=key[96]||key[97]||...||key[127] , with key[127] the
* least important bit of key*/
K[3] = hton_int32(K[3]);
K[2] = hton_int32(K[2]);
K[1] = hton_int32(K[1]);
@@ -106,26 +108,25 @@ int stream_encrypt_eea1(stream_cipher_t *stream_cipher, uint8_t **out)
/* Run SNOW 3G algorithm to generate sequence of key stream bits KS*/
osa_snow3g_initialize(K, IV, &snow_3g_context);
KS = (uint32_t *)malloc(4*n);
osa_snow3g_generate_key_stream(n,(uint32_t*)KS, &snow_3g_context);
KS = (uint32_t *)malloc(4 * n);
osa_snow3g_generate_key_stream(n, (uint32_t *)KS, &snow_3g_context);
if (zero_bit > 0) {
KS[n - 1] = KS[n - 1] & (uint32_t)(0xFFFFFFFF << (8 - zero_bit));
}
for (i=0; i<n; i++) {
for (i = 0; i < n; i++) {
KS[i] = hton_int32(KS[i]);
}
/* Exclusive-OR the input data with keystream to generate the output bit
stream */
for (i=0; i<n*4; i++) {
stream_cipher->message[i] ^= *(((uint8_t*)KS)+i);
for (i = 0; i < n * 4; i++) {
stream_cipher->message[i] ^= *(((uint8_t *)KS) + i);
}
if (zero_bit > 0) {
int ceil_index = (stream_cipher->blength+7) >> 3;
int ceil_index = (stream_cipher->blength + 7) >> 3;
stream_cipher->message[ceil_index - 1] = stream_cipher->message[ceil_index - 1] & (uint8_t)(0xFF << (8 - zero_bit));
}
@@ -136,91 +137,32 @@ int stream_encrypt_eea1(stream_cipher_t *stream_cipher, uint8_t **out)
int stream_encrypt_eea2(stream_cipher_t *stream_cipher, uint8_t **out)
{
uint8_t m[16];
uint32_t local_count;
void *ctx;
uint8_t *data = NULL;
uint32_t zero_bit = 0;
uint32_t byte_length;
DevAssert(stream_cipher != NULL);
DevAssert(out != NULL);
LOG_D(OSA, "Entering stream_encrypt_eea2, bits length %u, bearer %u, "
"count %u, direction %s\n", stream_cipher->blength,
stream_cipher->bearer, stream_cipher->count, stream_cipher->direction == SECU_DIRECTION_DOWNLINK ?
"Downlink" : "Uplink");
zero_bit = stream_cipher->blength & 0x7;
byte_length = stream_cipher->blength >> 3;
if (zero_bit > 0)
byte_length += 1;
ctx = malloc(nettle_aes128.context_size);
DevAssert(stream_cipher->key != NULL);
DevAssert(stream_cipher->key_length == 32);
DevAssert(stream_cipher->bearer < 32);
DevAssert(stream_cipher->direction < 2);
DevAssert(stream_cipher->message != NULL);
DevAssert(stream_cipher->blength > 7);
if (*out == NULL) {
/* User provided output buffer */
data = malloc(byte_length);
*out = data;
} else {
data = *out;
*out = calloc(1, (stream_cipher->blength >> 3) + 1);
DevAssert(*out != NULL && "Memory exhausted");
}
local_count = hton_int32(stream_cipher->count);
memset(m, 0, sizeof(m));
memcpy(&m[0], &local_count, 4);
m[4] = ((stream_cipher->bearer & 0x1F) << 3) |
((stream_cipher->direction & 0x01) << 2);
/* Other bits are 0 */
#if defined(SECU_DEBUG)
{
int i;
char payload[6 * byte_length + 1];
int index = 0;
for (i = 0; i < byte_length; i++)
index += sprintf(&payload[index], "0x%02x ", stream_cipher->message[i]);
LOG_D(OSA, "Original message: %s\n", payload);
}
#endif
#if NETTLE_VERSION_MAJOR < 3
nettle_aes128.set_encrypt_key(ctx, stream_cipher->key_length,
stream_cipher->key);
#else
nettle_aes128.set_encrypt_key(ctx,
stream_cipher->key);
#endif
nettle_ctr_crypt(ctx, nettle_aes128.encrypt,
nettle_aes128.block_size, m,
byte_length, data, stream_cipher->message);
if (zero_bit > 0)
data[byte_length - 1] = data[byte_length - 1] & (uint8_t)(0xFF << (8 - zero_bit));
free(ctx);
#if defined(SECU_DEBUG)
{
int i;
char payload[6 * byte_length + 1];
int index = 0;
for (i = 0; i < byte_length; i++)
index += sprintf(&payload[index], "0x%02x ", data[i]);
LOG_D(OSA, "Encrypted message: %s\n", payload);
}
#endif
aes_128_t p = {0};
memcpy(p.key, stream_cipher->key, stream_cipher->key_length);
p.type = AES_INITIALIZATION_VECTOR_16;
p.iv16.d.count = htonl(stream_cipher->count);
p.iv16.d.bearer = stream_cipher->bearer;
p.iv16.d.direction = stream_cipher->direction;
DevAssert((stream_cipher->blength & 0x07) == 0 && "Cipher length must be multiple of one octet");
const uint32_t byte_lenght = stream_cipher->blength >> 3;
// Precondition: out must have enough space, at least as much as the input
const size_t len_out = byte_lenght;
byte_array_t msg = {.buf = stream_cipher->message, .len =byte_lenght};
aes_128_ctr(&p, msg, len_out, *out);
return 0;
}
openair2/UTIL/OSA/osa_stream_eia.c
+96 -129
View File
@@ -19,6 +19,7 @@
* contact@openairinterface.org
*/
#include <arpa/inet.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
@@ -26,12 +27,9 @@
#include <math.h>
#include "assertions.h"
#include "common/utils/LOG/log.h"
#include <openssl/aes.h>
#include <openssl/cmac.h>
#include <openssl/evp.h>
#include "common/utils//LOG/log.h"
#include "openair3/SECU/aes_128_cbc_cmac.h"
#include "osa_defs.h"
#include "osa_snow3g.h"
@@ -49,7 +47,7 @@
*/
uint64_t OSA_MUL64x(uint64_t V, uint64_t c)
{
if ( V & 0x8000000000000000 )
if (V & 0x8000000000000000)
return (V << 1) ^ c;
else
return V << 1;
@@ -65,10 +63,10 @@ function.
*/
uint64_t OSA_MUL64xPOW(uint64_t V, uint32_t i, uint64_t c)
{
if ( i == 0)
if (i == 0)
return V;
else
return OSA_MUL64x( OSA_MUL64xPOW(V,i-1,c) , c);
return OSA_MUL64x(OSA_MUL64xPOW(V, i - 1, c), c);
}
/* OSA_MUL64.
* Input V: a 64-bit input.
@@ -84,33 +82,32 @@ uint64_t OSA_MUL64(uint64_t V, uint64_t P, uint64_t c)
uint64_t result = 0;
int i = 0;
for ( i=0; i<64; i++) {
if( ( P>>i ) & 0x1 )
result ^= OSA_MUL64xPOW(V,i,c);
for (i = 0; i < 64; i++) {
if ((P >> i) & 0x1)
result ^= OSA_MUL64xPOW(V, i, c);
}
return result;
}
/* osa_mask32bit.
* Input n: an integer in 1-32.
* Output : a 32 bit mask.
* Prepares a 32 bit mask with required number of 1 bits on the MSB side.
*/
* Input n: an integer in 1-32.
* Output : a 32 bit mask.
* Prepares a 32 bit mask with required number of 1 bits on the MSB side.
*/
uint32_t osa_mask32bit(int n)
{
uint32_t mask=0x0;
uint32_t mask = 0x0;
if ( n%32 == 0 )
if (n % 32 == 0)
return 0xffffffff;
while (n--)
mask = (mask>>1) ^ 0x80000000;
mask = (mask >> 1) ^ 0x80000000;
return mask;
}
/*!
* @brief Create integrity cmac t for a given message.
* @param[in] stream_cipher Structure containing various variables to setup encoding
@@ -119,29 +116,29 @@ uint32_t osa_mask32bit(int n)
int stream_compute_integrity_eia1(stream_cipher_t *stream_cipher, uint8_t out[4])
{
osa_snow_3g_context_t snow_3g_context;
uint32_t K[4],IV[4], z[5];
int i=0,D;
uint32_t MAC_I = 0;
uint64_t EVAL;
uint64_t V;
uint64_t P;
uint64_t Q;
uint64_t c;
uint64_t M_D_2;
int rem_bits;
uint32_t mask = 0;
uint32_t *message;
uint32_t K[4], IV[4], z[5];
int i = 0, D;
uint32_t MAC_I = 0;
uint64_t EVAL;
uint64_t V;
uint64_t P;
uint64_t Q;
uint64_t c;
uint64_t M_D_2;
int rem_bits;
uint32_t mask = 0;
uint32_t *message;
message = (uint32_t*)stream_cipher->message; /* To operate 32 bit message internally. */
message = (uint32_t *)stream_cipher->message; /* To operate 32 bit message internally. */
/* Load the Integrity Key for SNOW3G initialization as in section 4.4. */
memcpy(K+3,stream_cipher->key+0,4); /*K[3] = key[0]; we assume
K[3]=key[0]||key[1]||...||key[31] , with key[0] the
* most important bit of key*/
memcpy(K+2,stream_cipher->key+4,4); /*K[2] = key[1];*/
memcpy(K+1,stream_cipher->key+8,4); /*K[1] = key[2];*/
memcpy(K+0,stream_cipher->key+12,4); /*K[0] = key[3]; we assume
K[0]=key[96]||key[97]||...||key[127] , with key[127] the
* least important bit of key*/
memcpy(K + 3, stream_cipher->key + 0, 4); /*K[3] = key[0]; we assume
K[3]=key[0]||key[1]||...||key[31] , with key[0] the
* most important bit of key*/
memcpy(K + 2, stream_cipher->key + 4, 4); /*K[2] = key[1];*/
memcpy(K + 1, stream_cipher->key + 8, 4); /*K[1] = key[2];*/
memcpy(K + 0, stream_cipher->key + 12, 4); /*K[0] = key[3]; we assume
K[0]=key[96]||key[97]||...||key[127] , with key[127] the
* least important bit of key*/
K[3] = hton_int32(K[3]);
K[2] = hton_int32(K[2]);
K[1] = hton_int32(K[1]);
@@ -150,45 +147,45 @@ int stream_compute_integrity_eia1(stream_cipher_t *stream_cipher, uint8_t out[4]
section 4.4. */
IV[3] = (uint32_t)stream_cipher->count;
IV[2] = ((((uint32_t)stream_cipher->bearer) & 0x0000001F) << 27);
IV[1] = (uint32_t)(stream_cipher->count) ^ ( (uint32_t)(stream_cipher->direction) << 31 ) ;
IV[1] = (uint32_t)(stream_cipher->count) ^ ((uint32_t)(stream_cipher->direction) << 31);
IV[0] = ((((uint32_t)stream_cipher->bearer) & 0x0000001F) << 27) ^ ((uint32_t)(stream_cipher->direction & 0x00000001) << 15);
//printf ("K:\n");
//hexprint(K, 16);
//printf ("K[0]:%08X\n",K[0]);
//printf ("K[1]:%08X\n",K[1]);
//printf ("K[2]:%08X\n",K[2]);
//printf ("K[3]:%08X\n",K[3]);
// printf ("K:\n");
// hexprint(K, 16);
// printf ("K[0]:%08X\n",K[0]);
// printf ("K[1]:%08X\n",K[1]);
// printf ("K[2]:%08X\n",K[2]);
// printf ("K[3]:%08X\n",K[3]);
//printf ("IV:\n");
//hexprint(IV, 16);
//printf ("IV[0]:%08X\n",IV[0]);
//printf ("IV[1]:%08X\n",IV[1]);
//printf ("IV[2]:%08X\n",IV[2]);
//printf ("IV[3]:%08X\n",IV[3]);
// printf ("IV:\n");
// hexprint(IV, 16);
// printf ("IV[0]:%08X\n",IV[0]);
// printf ("IV[1]:%08X\n",IV[1]);
// printf ("IV[2]:%08X\n",IV[2]);
// printf ("IV[3]:%08X\n",IV[3]);
z[0] = z[1] = z[2] = z[3] = z[4] = 0;
/* Run SNOW 3G to produce 5 keystream words z_1, z_2, z_3, z_4 and z_5. */
osa_snow3g_initialize(K, IV, &snow_3g_context);
osa_snow3g_generate_key_stream(5, z, &snow_3g_context);
//printf ("z[0]:%08X\n",z[0]);
//printf ("z[1]:%08X\n",z[1]);
//printf ("z[2]:%08X\n",z[2]);
//printf ("z[3]:%08X\n",z[3]);
//printf ("z[4]:%08X\n",z[4]);
// printf ("z[0]:%08X\n",z[0]);
// printf ("z[1]:%08X\n",z[1]);
// printf ("z[2]:%08X\n",z[2]);
// printf ("z[3]:%08X\n",z[3]);
// printf ("z[4]:%08X\n",z[4]);
P = ((uint64_t)z[0] << 32) | (uint64_t)z[1];
Q = ((uint64_t)z[2] << 32) | (uint64_t)z[3];
//printf ("P:%16lX\n",P);
//printf ("Q:%16lX\n",Q);
// printf ("P:%16lX\n",P);
// printf ("Q:%16lX\n",Q);
/* Calculation */
D = ceil( stream_cipher->blength / 64.0 ) + 1;
//printf ("D:%d\n",D);
D = ceil(stream_cipher->blength / 64.0) + 1;
// printf ("D:%d\n",D);
EVAL = 0;
c = 0x1b;
/* for 0 <= i <= D-3 */
for (i=0; i<D-2; i++) {
V = EVAL ^ ( (uint64_t)hton_int32(message[2*i]) << 32 | (uint64_t)hton_int32(message[2*i+1]) );
EVAL = OSA_MUL64(V,P,c);
//printf ("Mi: %16X %16X\tEVAL: %16lX\n",hton_int32(message[2*i]),hton_int32(message[2*i+1]), EVAL);
for (i = 0; i < D - 2; i++) {
V = EVAL ^ ((uint64_t)hton_int32(message[2 * i]) << 32 | (uint64_t)hton_int32(message[2 * i + 1]));
EVAL = OSA_MUL64(V, P, c);
// printf ("Mi: %16X %16X\tEVAL: %16lX\n",hton_int32(message[2*i]),hton_int32(message[2*i+1]), EVAL);
}
/* for D-2 */
@@ -197,23 +194,22 @@ int stream_compute_integrity_eia1(stream_cipher_t *stream_cipher, uint8_t out[4]
if (rem_bits == 0)
rem_bits = 64;
mask = osa_mask32bit(rem_bits%32);
mask = osa_mask32bit(rem_bits % 32);
if (rem_bits > 32) {
M_D_2 = ( (uint64_t) hton_int32(message[2*(D-2)]) << 32 ) |
(uint64_t) (hton_int32(message[2*(D-2)+1]) & mask);
M_D_2 = ((uint64_t)hton_int32(message[2 * (D - 2)]) << 32) | (uint64_t)(hton_int32(message[2 * (D - 2) + 1]) & mask);
} else {
M_D_2 = ( (uint64_t) hton_int32(message[2*(D-2)]) & mask) << 32 ;
M_D_2 = ((uint64_t)hton_int32(message[2 * (D - 2)]) & mask) << 32;
}
V = EVAL ^ M_D_2;
EVAL = OSA_MUL64(V,P,c);
EVAL = OSA_MUL64(V, P, c);
/* for D-1 */
EVAL ^= stream_cipher->blength;
/* Multiply by Q */
EVAL = OSA_MUL64(EVAL,Q,c);
EVAL = OSA_MUL64(EVAL, Q, c);
MAC_I = (uint32_t)(EVAL >> 32) ^ z[4];
//printf ("MAC_I:%16X\n",MAC_I);
// printf ("MAC_I:%16X\n",MAC_I);
MAC_I = hton_int32(MAC_I);
memcpy(out, &MAC_I, 4);
return 0;
@@ -221,65 +217,28 @@ int stream_compute_integrity_eia1(stream_cipher_t *stream_cipher, uint8_t out[4]
int stream_compute_integrity_eia2(stream_cipher_t *stream_cipher, uint8_t out[4])
{
uint8_t *m;
uint32_t local_count;
size_t size = 4;
uint8_t data[16];
CMAC_CTX *cmac_ctx;
uint32_t zero_bit = 0;
uint32_t m_length;
DevAssert(stream_cipher != NULL);
DevAssert(stream_cipher->key != NULL);
;
DevAssert((stream_cipher->blength & 0x7) == 0);
DevAssert(stream_cipher->key_length == 16 && "k_iv.key and stream_cipher mismatch");
DevAssert(stream_cipher->bearer < 32);
DevAssert(stream_cipher->direction < 2);
memset(data, 0, 16);
aes_128_t k_iv = {0};
memcpy(k_iv.key, stream_cipher->key, sizeof(k_iv.key));
k_iv.type = AES_INITIALIZATION_VECTOR_8;
zero_bit = stream_cipher->blength & 0x7;
k_iv.iv8.d.bearer = stream_cipher->bearer;
k_iv.iv8.d.direction = stream_cipher->direction;
k_iv.iv8.d.count = htonl(stream_cipher->count);
m_length = stream_cipher->blength >> 3;
const size_t m_length = stream_cipher->blength >> 3;
if (zero_bit > 0)
m_length += 1;
local_count = hton_int32(stream_cipher->count);
m = calloc(m_length + 8, sizeof(uint8_t));
memcpy(&m[0], &local_count, 4);
m[4] = ((stream_cipher->bearer & 0x1F) << 3) | ((stream_cipher->direction & 0x01) << 2);
memcpy(&m[8], stream_cipher->message, m_length);
#if defined(SECU_DEBUG)
{
int i;
char payload[6 * sizeof(m) + 1];
int index = 0;
LOG_T(OSA, "Blength: %u, Zero bits: %u\n",
stream_cipher->blength, zero_bit);
for (i = 0; i < sizeof(m); i++)
index += sprintf(&payload[index], "0x%02x ", m[i]);
LOG_D(OSA, "Payload: %s\n", payload);
}
#endif
cmac_ctx = CMAC_CTX_new();
CMAC_Init(cmac_ctx, stream_cipher->key, stream_cipher->key_length, EVP_aes_128_cbc(), NULL);
CMAC_Update(cmac_ctx, m, m_length + 8);
CMAC_Final(cmac_ctx, data, &size);
CMAC_CTX_free(cmac_ctx);
memcpy(out, data, 4);
free(m);
uint8_t result[16] = {0};
byte_array_t msg = {.len = m_length, .buf = stream_cipher->message };
aes_128_cbc_cmac(&k_iv, msg, sizeof(result), result);
memcpy(out, result, 4);
return 0;
}
@@ -307,10 +266,18 @@ int stream_check_integrity(uint8_t algorithm, stream_cipher_t *stream_cipher, ui
}
if (memcmp(result, expected, 4) != 0) {
LOG_E(OSA, "Mismatch found in integrity for algorithm %u,\n"
LOG_E(OSA,
"Mismatch found in integrity for algorithm %u,\n"
"\tgot %02x.%02x.%02x.%02x, expecting %02x.%02x.%02x.%02x\n",
algorithm, result[0], result[1], result[2], result[3], expected[0],
expected[1], expected[2], expected[3]);
algorithm,
result[0],
result[1],
result[2],
result[3],
expected[0],
expected[1],
expected[2],
expected[3]);
return -1;
}
}