Subset-037 §7.3 3DES CBC-MAC + KSMAC derivation. More...

#include "safecomm/mac/mac.h"
#include <string.h>

Include dependency graph for mac.c:

Data Structures
struct	des_key_schedule_t

Functions
static uint64_t	des_permute (uint64_t in, const uint8_t *table, uint8_t n, uint8_t in_bits)
static void	des_schedule (const uint8_t key[8], des_key_schedule_t *ks)
static uint64_t	des_cipher_core (uint64_t in_block, const des_key_schedule_t *ks, int decrypt)
static uint64_t	des_bytes_to_u64 (const uint8_t b[8])
static void	des_u64_to_bytes (uint64_t v, uint8_t b[8])
static void	des_ecb (const uint8_t key[8], const uint8_t in[8], int decrypt, uint8_t out[8])
	Single DES encrypt/decrypt of one 8-byte block under one 8-byte key.
static void	des3_algo3 (const uint8_t key24[24], const uint8_t in[8], uint8_t out[8])
	Subset-037-2 §6.2.2.1 "single DES with modified MAC algorithm 3": E(K3, D(K2, E(K1, block))). Used for the last block of a CBC-MAC and for KS1/KS2 of the KSMAC derivation (§6.2.3.2.3.15).
static void	des3_algo3_reversed (const uint8_t key24[24], const uint8_t in[8], uint8_t out[8])
	The same construction with K1 and K3 swapped: E(K1, D(K2, E(K3, block))). Used only for KS3 of the KSMAC derivation (§6.2.3.2.3.15, "K'AB").
safecomm_status_t	safecomm_mac_derive_ksmac (const uint8_t kmac[SAFECOMM_MAC_KEY_LEN], const uint8_t ra[SAFECOMM_MAC_RAND_LEN], const uint8_t rb[SAFECOMM_MAC_RAND_LEN], safecomm_mac_ctx_t *out_ctx)
	Derive the session key KSMAC from KMAC and the AU random values.
safecomm_status_t	safecomm_mac_compute (const safecomm_mac_ctx_t ctx, const uint8_t msg, size_t msg_len, uint8_t out_mac[SAFECOMM_MAC_LEN])
	Compute the 8-byte EuroRadio MAC over `msg`.
safecomm_status_t	safecomm_mac_verify (const safecomm_mac_ctx_t ctx, const uint8_t msg, size_t msg_len, const uint8_t rx_mac[SAFECOMM_MAC_LEN])
	Constant-time verify of a received MAC against a freshly computed one.

Variables
static const uint8_t	IP_TABLE [64]
static const uint8_t	FP_TABLE [64]
static const uint8_t	E_TABLE [48]
static const uint8_t	P_TABLE [32]
static const uint8_t	SBOX [8][4][16]
static const uint8_t	PC1_TABLE [56]
static const uint8_t	PC2_TABLE [48]
static const uint8_t	ROTATE_TABLE [16]

Detailed Description

Subset-037 §7.3 3DES CBC-MAC + KSMAC derivation.

Compliant with CENELEC EN 50128 SIL 4 and MISRA C:2012. Pure C99, fixed static buffers, constant-time verification.

Definition in file mac.c.

Function Documentation

◆ des_permute()

uint64_t des_permute	(	uint64_t	in,
		const uint8_t *	table,
		uint8_t	n,
		uint8_t	in_bits )

static

Definition at line 138 of file mac.c.

◆ des_schedule()

void des_schedule	(	const uint8_t	key[8],
		des_key_schedule_t *	ks )

static

Definition at line 152 of file mac.c.

◆ des_cipher_core()

uint64_t des_cipher_core	(	uint64_t	in_block,
		const des_key_schedule_t *	ks,
		int	decrypt )

static

Definition at line 173 of file mac.c.

◆ des_bytes_to_u64()

uint64_t des_bytes_to_u64 ( const uint8_t b[8] )

static

Definition at line 205 of file mac.c.

◆ des_u64_to_bytes()

void des_u64_to_bytes	(	uint64_t	v,
		uint8_t	b[8] )

static

Definition at line 215 of file mac.c.

◆ des_ecb()

void des_ecb	(	const uint8_t	key[8],
		const uint8_t	in[8],
		int	decrypt,
		uint8_t	out[8] )

static

Single DES encrypt/decrypt of one 8-byte block under one 8-byte key.

Definition at line 227 of file mac.c.

◆ des3_algo3()

void des3_algo3	(	const uint8_t	key24[24],
		const uint8_t	in[8],
		uint8_t	out[8] )

static

Subset-037-2 §6.2.2.1 "single DES with modified MAC algorithm 3": E(K3, D(K2, E(K1, block))). Used for the last block of a CBC-MAC and for KS1/KS2 of the KSMAC derivation (§6.2.3.2.3.15).

Definition at line 240 of file mac.c.

◆ des3_algo3_reversed()

void des3_algo3_reversed	(	const uint8_t	key24[24],
		const uint8_t	in[8],
		uint8_t	out[8] )

static

The same construction with K1 and K3 swapped: E(K1, D(K2, E(K3, block))). Used only for KS3 of the KSMAC derivation (§6.2.3.2.3.15, "K'AB").

Definition at line 253 of file mac.c.

◆ safecomm_mac_derive_ksmac()

safecomm_status_t safecomm_mac_derive_ksmac	(	const uint8_t	kmac[SAFECOMM_MAC_KEY_LEN],
		const uint8_t	ra[SAFECOMM_MAC_RAND_LEN],
		const uint8_t	rb[SAFECOMM_MAC_RAND_LEN],
		safecomm_mac_ctx_t *	out_ctx )

Derive the session key KSMAC from KMAC and the AU random values.

Implements the Subset-037 §7.3 key-derivation: the two 64-bit random numbers exchanged in AU1 (RA, sent by the caller / initiator) and AU2 (RB, sent by the responder) are combined with KMAC to produce KSMAC.

Parameters

kmac	pre-shared 24-byte KMAC for this peer pair. Non-NULL.
ra	8-byte random value from AU1. Non-NULL.
rb	8-byte random value from AU2. Non-NULL.
out_ctx	receives the derived session context. Non-NULL.

Returns: SAFECOMM_STATUS_OK, SAFECOMM_STATUS_INVALID_PARAM, or SAFECOMM_STATUS_NOT_IMPLEMENTED while this is a skeleton.

Note: REQ-SC-MAC-003.

Definition at line 267 of file mac.c.

◆ safecomm_mac_compute()

safecomm_status_t safecomm_mac_compute	(	const safecomm_mac_ctx_t *	ctx,
		const uint8_t *	msg,
		size_t	msg_len,
		uint8_t	out_mac[SAFECOMM_MAC_LEN] )

Compute the 8-byte EuroRadio MAC over msg.

Parameters

ctx	session context from safecomm_mac_derive_ksmac(). Non-NULL.
msg	the safe PDU bytes the MAC covers. Non-NULL if `msg_len` > 0.
msg_len	number of bytes in `msg`.
out_mac	receives the 8-byte MAC. Non-NULL.

Returns: SAFECOMM_STATUS_OK / _INVALID_PARAM / _NOT_INITIALISED / _NOT_IMPLEMENTED.

Note: REQ-SC-MAC-005.

Definition at line 300 of file mac.c.

◆ safecomm_mac_verify()

safecomm_status_t safecomm_mac_verify	(	const safecomm_mac_ctx_t *	ctx,
		const uint8_t *	msg,
		size_t	msg_len,
		const uint8_t	rx_mac[SAFECOMM_MAC_LEN] )

Constant-time verify of a received MAC against a freshly computed one.

Parameters

ctx	session context. Non-NULL.
msg	PDU bytes the MAC covers. Non-NULL if `msg_len` > 0.
msg_len	number of bytes in `msg`.
rx_mac	the 8-byte MAC received on the wire. Non-NULL.

Returns: SAFECOMM_STATUS_OK on match, SAFECOMM_STATUS_MAC_MISMATCH on mismatch, or _INVALID_PARAM / _NOT_IMPLEMENTED.

Note: REQ-SC-MAC-006. Comparison must not short-circuit on the first differing byte.

Definition at line 355 of file mac.c.

Variable Documentation

◆ IP_TABLE

const uint8_t IP_TABLE[64]

static

Initial value:

                              = {
    58U, 50U, 42U, 34U, 26U, 18U, 10U, 2U,
    60U, 52U, 44U, 36U, 28U, 20U, 12U, 4U,
    62U, 54U, 46U, 38U, 30U, 22U, 14U, 6U,
    64U, 56U, 48U, 40U, 32U, 24U, 16U, 8U,
    57U, 49U, 41U, 33U, 25U, 17U,  9U, 1U,
    59U, 51U, 43U, 35U, 27U, 19U, 11U, 3U,
    61U, 53U, 45U, 37U, 29U, 21U, 13U, 5U,
    63U, 55U, 47U, 39U, 31U, 23U, 15U, 7U
}

Definition at line 16 of file mac.c.

◆ FP_TABLE

const uint8_t FP_TABLE[64]

static

Initial value:

                              = {
    40U, 8U, 48U, 16U, 56U, 24U, 64U, 32U,
    39U, 7U, 47U, 15U, 55U, 23U, 63U, 31U,
    38U, 6U, 46U, 14U, 54U, 22U, 62U, 30U,
    37U, 5U, 45U, 13U, 53U, 21U, 61U, 29U,
    36U, 4U, 44U, 12U, 52U, 20U, 60U, 28U,
    35U, 3U, 43U, 11U, 51U, 19U, 59U, 27U,
    34U, 2U, 42U, 10U, 50U, 18U, 58U, 26U,
    33U, 1U, 41U,  9U, 49U, 17U, 57U, 25U
}

Definition at line 27 of file mac.c.

◆ E_TABLE

const uint8_t E_TABLE[48]

static

Initial value:

                             = {
    32U,  1U,  2U,  3U,  4U,  5U,
     4U,  5U,  6U,  7U,  8U,  9U,
     8U,  9U, 10U, 11U, 12U, 13U,
    12U, 13U, 14U, 15U, 16U, 17U,
    16U, 17U, 18U, 19U, 20U, 21U,
    20U, 21U, 22U, 23U, 24U, 25U,
    24U, 25U, 26U, 27U, 28U, 29U,
    28U, 29U, 30U, 31U, 32U,  1U
}

Definition at line 38 of file mac.c.

◆ P_TABLE

const uint8_t P_TABLE[32]

static

Initial value:

                             = {
    16U,  7U, 20U, 21U, 29U, 12U, 28U, 17U,
     1U, 15U, 23U, 26U,  5U, 18U, 31U, 10U,
     2U,  8U, 24U, 14U, 32U, 27U,  3U,  9U,
    19U, 13U, 30U,  6U, 22U, 11U,  4U, 25U
}

Definition at line 49 of file mac.c.

◆ SBOX

const uint8_t SBOX[8][4][16]

static

Definition at line 56 of file mac.c.

◆ PC1_TABLE

const uint8_t PC1_TABLE[56]

static

Initial value:

                               = {
    57U, 49U, 41U, 33U, 25U, 17U,  9U,
     1U, 58U, 50U, 42U, 34U, 26U, 18U,
    10U,  2U, 59U, 51U, 43U, 35U, 27U,
    19U, 11U,  3U, 60U, 52U, 44U, 36U,
    63U, 55U, 47U, 39U, 31U, 23U, 15U,
     7U, 62U, 54U, 46U, 38U, 30U, 22U,
    14U,  6U, 61U, 53U, 45U, 37U, 29U,
    21U, 13U,  5U, 28U, 20U, 12U,  4U
}

Definition at line 107 of file mac.c.

◆ PC2_TABLE

const uint8_t PC2_TABLE[48]

static

Initial value:

                               = {
    14U, 17U, 11U, 24U,  1U,  5U,
     3U, 28U, 15U,  6U, 21U, 10U,
    23U, 19U, 12U,  4U, 26U,  8U,
    16U,  7U, 27U, 20U, 13U,  2U,
    41U, 52U, 31U, 37U, 47U, 55U,
    30U, 40U, 51U, 45U, 33U, 48U,
    44U, 49U, 39U, 56U, 34U, 53U,
    46U, 42U, 50U, 36U, 29U, 32U
}

Definition at line 118 of file mac.c.

◆ ROTATE_TABLE

const uint8_t ROTATE_TABLE[16]

static

Initial value:

                                  = {
    1U, 1U, 2U, 2U, 2U, 2U, 2U, 2U, 1U, 2U, 2U, 2U, 2U, 2U, 2U, 1U
}

Definition at line 129 of file mac.c.

Data Structures

Functions

Variables

Detailed Description

Function Documentation

◆ des_permute()

◆ des_schedule()

◆ des_cipher_core()

◆ des_bytes_to_u64()

◆ des_u64_to_bytes()

◆ des_ecb()

◆ des3_algo3()

◆ des3_algo3_reversed()

◆ safecomm_mac_derive_ksmac()

◆ safecomm_mac_compute()

◆ safecomm_mac_verify()

Variable Documentation

◆ IP_TABLE

◆ FP_TABLE

◆ E_TABLE

◆ P_TABLE

◆ SBOX

◆ PC1_TABLE

◆ PC2_TABLE

◆ ROTATE_TABLE