mac.c

Go to the documentation of this file.

#include "safecomm/mac/mac.h"
 
#include <string.h>
 
/* ========================================================================= */
/* DES / 3DES Engine (FIPS 46-3 / NIST SP 800-20)                           */
/* ========================================================================= */
 
static const uint8_t IP_TABLE[64] = {
    58U, 50U, 42U, 34U, 26U, 18U, 10U, 2U,
    60U, 52U, 44U, 36U, 28U, 20U, 12U, 4U,
    62U, 54U, 46U, 38U, 30U, 22U, 14U, 6U,
    64U, 56U, 48U, 40U, 32U, 24U, 16U, 8U,
    57U, 49U, 41U, 33U, 25U, 17U,  9U, 1U,
    59U, 51U, 43U, 35U, 27U, 19U, 11U, 3U,
    61U, 53U, 45U, 37U, 29U, 21U, 13U, 5U,
    63U, 55U, 47U, 39U, 31U, 23U, 15U, 7U
};
 
static const uint8_t FP_TABLE[64] = {
    40U, 8U, 48U, 16U, 56U, 24U, 64U, 32U,
    39U, 7U, 47U, 15U, 55U, 23U, 63U, 31U,
    38U, 6U, 46U, 14U, 54U, 22U, 62U, 30U,
    37U, 5U, 45U, 13U, 53U, 21U, 61U, 29U,
    36U, 4U, 44U, 12U, 52U, 20U, 60U, 28U,
    35U, 3U, 43U, 11U, 51U, 19U, 59U, 27U,
    34U, 2U, 42U, 10U, 50U, 18U, 58U, 26U,
    33U, 1U, 41U,  9U, 49U, 17U, 57U, 25U
};
 
static const uint8_t E_TABLE[48] = {
    32U,  1U,  2U,  3U,  4U,  5U,
     4U,  5U,  6U,  7U,  8U,  9U,
     8U,  9U, 10U, 11U, 12U, 13U,
    12U, 13U, 14U, 15U, 16U, 17U,
    16U, 17U, 18U, 19U, 20U, 21U,
    20U, 21U, 22U, 23U, 24U, 25U,
    24U, 25U, 26U, 27U, 28U, 29U,
    28U, 29U, 30U, 31U, 32U,  1U
};
 
static const uint8_t P_TABLE[32] = {
    16U,  7U, 20U, 21U, 29U, 12U, 28U, 17U,
     1U, 15U, 23U, 26U,  5U, 18U, 31U, 10U,
     2U,  8U, 24U, 14U, 32U, 27U,  3U,  9U,
    19U, 13U, 30U,  6U, 22U, 11U,  4U, 25U
};
 
static const uint8_t SBOX[8][4][16] = {
    { /* S1 */
        { 14U,  4U, 13U,  1U,  2U, 15U, 11U,  8U,  3U, 10U,  6U, 12U,  5U,  9U,  0U,  7U },
        {  0U, 15U,  7U,  4U, 14U,  2U, 13U,  1U, 10U,  6U, 12U, 11U,  9U,  5U,  3U,  8U },
        {  4U,  1U, 14U,  8U, 13U,  6U,  2U, 11U, 15U, 12U,  9U,  7U,  3U, 10U,  5U,  0U },
        { 15U, 12U,  8U,  2U,  4U,  9U,  1U,  7U,  5U, 11U,  3U, 14U, 10U,  0U,  6U, 13U }
    },
    { /* S2 */
        { 15U,  1U,  8U, 14U,  6U, 11U,  3U,  4U,  9U,  7U,  2U, 13U, 12U,  0U,  5U, 10U },
        {  3U, 13U,  4U,  7U, 15U,  2U,  8U, 14U, 12U,  0U,  1U, 10U,  6U,  9U, 11U,  5U },
        {  0U, 14U,  7U, 11U, 10U,  4U, 13U,  1U,  5U,  8U, 12U,  6U,  9U,  3U,  2U, 15U },
        { 13U,  8U, 10U,  1U,  3U, 15U,  4U,  2U, 11U,  6U,  7U, 12U,  0U,  5U, 14U,  9U }
    },
    { /* S3 */
        { 10U,  0U,  9U, 14U,  6U,  3U, 15U,  5U,  1U, 13U, 12U,  7U, 11U,  4U,  2U,  8U },
        { 13U,  7U,  0U,  9U,  3U,  4U,  6U, 10U,  2U,  8U,  5U, 14U, 12U, 11U, 15U,  1U },
        { 13U,  6U,  4U,  9U,  8U, 15U,  3U,  0U, 11U,  1U,  2U, 12U,  5U, 10U, 14U,  7U },
        {  1U, 10U, 13U,  0U,  6U,  9U,  8U,  7U,  4U, 15U, 14U,  3U, 11U,  5U,  2U, 12U }
    },
    { /* S4 */
        {  7U, 13U, 14U,  3U,  0U,  6U,  9U, 10U,  1U,  2U,  8U,  5U, 11U, 12U,  4U, 15U },
        { 13U,  8U, 11U,  5U,  6U, 15U,  0U,  3U,  4U,  7U,  2U, 12U,  1U, 10U, 14U,  9U },
        { 10U,  6U,  9U,  0U, 12U, 11U,  7U, 13U, 15U,  1U,  3U, 14U,  5U,  2U,  8U,  4U },
        {  3U, 15U,  0U,  6U, 10U,  1U, 13U,  8U,  9U,  4U,  5U, 11U, 12U,  7U,  2U, 14U }
    },
    { /* S5 */
        {  2U, 12U,  4U,  1U,  7U, 10U, 11U,  6U,  8U,  5U,  3U, 15U, 13U,  0U, 14U,  9U },
        { 14U, 11U,  2U, 12U,  4U,  7U, 13U,  1U,  5U,  0U, 15U, 10U,  3U,  9U,  8U,  6U },
        {  4U,  2U,  1U, 11U, 10U, 13U,  7U,  8U, 15U,  9U, 12U,  5U,  6U,  3U,  0U, 14U },
        { 11U,  8U, 12U,  7U,  1U, 14U,  2U, 13U,  6U, 15U,  0U,  9U, 10U,  4U,  5U,  3U }
    },
    { /* S6 */
        { 12U,  1U, 10U, 15U,  9U,  2U,  6U,  8U,  0U, 13U,  3U,  4U, 14U,  7U,  5U, 11U },
        { 10U, 15U,  4U,  2U,  7U, 12U,  9U,  5U,  6U,  1U, 13U, 14U,  0U, 11U,  3U,  8U },
        {  9U, 14U, 15U,  5U,  2U,  8U, 12U,  3U,  7U,  0U,  4U, 10U,  1U, 13U, 11U,  6U },
        {  4U,  3U,  2U, 12U,  9U,  5U, 15U, 10U, 11U, 14U,  1U,  7U,  6U,  0U,  8U, 13U }
    },
    { /* S7 */
        {  4U, 11U,  2U, 14U, 15U,  0U,  8U, 13U,  3U, 12U,  9U,  7U,  5U, 10U,  6U,  1U },
        { 13U,  0U, 11U,  7U,  4U,  9U,  1U, 10U, 14U,  3U,  5U, 12U,  2U, 15U,  8U,  6U },
        {  1U,  4U, 11U, 13U, 12U,  3U,  7U, 14U, 10U, 15U,  6U,  8U,  0U,  5U,  9U,  2U },
        {  6U, 11U, 13U,  8U,  1U,  4U, 10U,  7U,  9U,  5U,  0U, 15U, 14U,  2U,  3U, 12U }
    },
    { /* S8 */
        { 13U,  2U,  8U,  4U,  6U, 15U, 11U,  1U, 10U,  9U,  3U, 14U,  5U,  0U, 12U,  7U },
        {  1U, 15U, 13U,  8U, 10U,  3U,  7U,  4U, 12U,  5U,  6U, 11U,  0U, 14U,  9U,  2U },
        {  7U, 11U,  4U,  1U,  9U, 12U, 14U,  2U,  0U,  6U, 10U, 13U, 15U,  3U,  5U,  8U },
        {  2U,  1U, 14U,  7U,  4U, 10U,  8U, 13U, 15U, 12U,  9U,  0U,  3U,  5U,  6U, 11U }
    }
};
 
static const uint8_t PC1_TABLE[56] = {
    57U, 49U, 41U, 33U, 25U, 17U,  9U,
     1U, 58U, 50U, 42U, 34U, 26U, 18U,
    10U,  2U, 59U, 51U, 43U, 35U, 27U,
    19U, 11U,  3U, 60U, 52U, 44U, 36U,
    63U, 55U, 47U, 39U, 31U, 23U, 15U,
     7U, 62U, 54U, 46U, 38U, 30U, 22U,
    14U,  6U, 61U, 53U, 45U, 37U, 29U,
    21U, 13U,  5U, 28U, 20U, 12U,  4U
};
 
static const uint8_t PC2_TABLE[48] = {
    14U, 17U, 11U, 24U,  1U,  5U,
     3U, 28U, 15U,  6U, 21U, 10U,
    23U, 19U, 12U,  4U, 26U,  8U,
    16U,  7U, 27U, 20U, 13U,  2U,
    41U, 52U, 31U, 37U, 47U, 55U,
    30U, 40U, 51U, 45U, 33U, 48U,
    44U, 49U, 39U, 56U, 34U, 53U,
    46U, 42U, 50U, 36U, 29U, 32U
};
 
static const uint8_t ROTATE_TABLE[16] = {
    1U, 1U, 2U, 2U, 2U, 2U, 2U, 2U, 1U, 2U, 2U, 2U, 2U, 2U, 2U, 1U
};
 
typedef struct
{
    uint64_t subkeys[16];
} des_key_schedule_t;
 
static uint64_t des_permute(uint64_t in, const uint8_t *table, uint8_t n, uint8_t in_bits)
{
    uint64_t out = 0ULL;
    for (uint8_t i = 0U; i < n; i++)
    {
        uint8_t bit_pos = (uint8_t)(in_bits - table[i]);
        if (((in >> bit_pos) & 1ULL) != 0ULL)
        {
            out |= (1ULL << (n - 1U - i));
        }
    }
    return out;
}
 
static void des_schedule(const uint8_t key[8], des_key_schedule_t *ks)
{
    uint64_t k = 0ULL;
    for (size_t i = 0U; i < 8U; i++)
    {
        k = (k << 8U) | (uint64_t)key[i];
    }
    uint64_t pc1 = des_permute(k, PC1_TABLE, 56U, 64U);
    uint32_t c = (uint32_t)((pc1 >> 28U) & 0x0FFFFFFFU);
    uint32_t d = (uint32_t)(pc1 & 0x0FFFFFFFU);
 
    for (size_t r = 0U; r < 16U; r++)
    {
        uint8_t shift = ROTATE_TABLE[r];
        c = (((c << shift) | (c >> (28U - shift)))) & 0x0FFFFFFFU;
        d = (((d << shift) | (d >> (28U - shift)))) & 0x0FFFFFFFU;
        uint64_t cd = ((uint64_t)c << 28U) | (uint64_t)d;
        ks->subkeys[r] = des_permute(cd, PC2_TABLE, 48U, 56U);
    }
}
 
static uint64_t des_cipher_core(uint64_t in_block, const des_key_schedule_t *ks, int decrypt)
{
    uint64_t ip = des_permute(in_block, IP_TABLE, 64U, 64U);
    uint32_t l = (uint32_t)(ip >> 32U);
    uint32_t r = (uint32_t)(ip & 0xFFFFFFFFU);
 
    for (size_t round = 0U; round < 16U; round++)
    {
        size_t r_idx = (decrypt != 0) ? (15U - round) : round;
        uint64_t er = des_permute((uint64_t)r, E_TABLE, 48U, 32U);
        uint64_t b = er ^ ks->subkeys[r_idx];
 
        uint32_t s_out = 0U;
        for (size_t s = 0U; s < 8U; s++)
        {
            uint8_t chunk = (uint8_t)((b >> (42U - s * 6U)) & 0x3FU);
            uint8_t row = (uint8_t)(((chunk & 0x20U) >> 4U) | (chunk & 0x01U));
            uint8_t col = (uint8_t)((chunk >> 1U) & 0x0FU);
            uint8_t val = SBOX[s][row][col];
            s_out = (s_out << 4U) | (uint32_t)val;
        }
 
        uint32_t f_res = (uint32_t)des_permute((uint64_t)s_out, P_TABLE, 32U, 32U);
        uint32_t new_r = l ^ f_res;
        l = r;
        r = new_r;
    }
 
    uint64_t pre_fp = ((uint64_t)r << 32U) | (uint64_t)l;
    return des_permute(pre_fp, FP_TABLE, 64U, 64U);
}
 
static uint64_t des_bytes_to_u64(const uint8_t b[8])
{
    uint64_t v = 0ULL;
    for (size_t i = 0U; i < 8U; i++)
    {
        v = (v << 8U) | (uint64_t)b[i];
    }
    return v;
}
 
static void des_u64_to_bytes(uint64_t v, uint8_t b[8])
{
    for (size_t i = 8U; i > 0U; i--)
    {
        b[i - 1U] = (uint8_t)(v & 0xFFU);
        v >>= 8U;
    }
}

static void des_ecb(const uint8_t key[8], const uint8_t in[8], int decrypt, uint8_t out[8])
{
    des_key_schedule_t ks;
    des_schedule(key, &ks);
    uint64_t b = des_cipher_core(des_bytes_to_u64(in), &ks, decrypt);
    des_u64_to_bytes(b, out);
}

static void des3_algo3(const uint8_t key24[24], const uint8_t in[8], uint8_t out[8])
{
    uint8_t t1[8];
    uint8_t t2[8];
    des_ecb(&key24[0], in, 0, t1);  /* Encrypt K1 */
    des_ecb(&key24[8], t1, 1, t2);  /* Decrypt K2 */
    des_ecb(&key24[16], t2, 0, out); /* Encrypt K3 */
}

static void des3_algo3_reversed(const uint8_t key24[24], const uint8_t in[8], uint8_t out[8])
{
    uint8_t t1[8];
    uint8_t t2[8];
    des_ecb(&key24[16], in, 0, t1); /* Encrypt K3 */
    des_ecb(&key24[8], t1, 1, t2);  /* Decrypt K2 */
    des_ecb(&key24[0], t2, 0, out); /* Encrypt K1 */
}
 
/* ========================================================================= */
/* Public API                                                                */
/* ========================================================================= */
 
/* REQ-SC-MAC-003: Derive KSMAC from KMAC and RA/RB (Subset-037-2 §6.2.3.2.3.13-16) */
safecomm_status_t safecomm_mac_derive_ksmac(const uint8_t kmac[SAFECOMM_MAC_KEY_LEN],
                                            const uint8_t ra[SAFECOMM_MAC_RAND_LEN],
                                            const uint8_t rb[SAFECOMM_MAC_RAND_LEN],
                                            safecomm_mac_ctx_t *out_ctx)
{
    if ((kmac == NULL) || (ra == NULL) || (rb == NULL) || (out_ctx == NULL))
    {
        return SAFECOMM_STATUS_INVALID_PARAM;
    }
 
    (void)memset(out_ctx, 0, sizeof(*out_ctx));
    out_ctx->alg = SAFECOMM_MAC_ALG_3DES_SS037;
 
    /*
     * RA = RA_L | RA_R, RB = RB_L | RB_R (32-bit halves each).
     * KS1 = E(K3,D(K2,E(K1, RA_L|RB_L)))   KS2 = E(K3,D(K2,E(K1, RA_R|RB_R)))
     * KS3 = E(K1,D(K2,E(K3, RA_L|RB_L)))  (reversed key order - "K'AB")
     */
    uint8_t block_l[8];
    uint8_t block_r[8];
    (void)memcpy(&block_l[0], &ra[0], 4U);
    (void)memcpy(&block_l[4], &rb[0], 4U);
    (void)memcpy(&block_r[0], &ra[4], 4U);
    (void)memcpy(&block_r[4], &rb[4], 4U);
 
    des3_algo3(kmac, block_l, &out_ctx->ksmac[0]);
    des3_algo3(kmac, block_r, &out_ctx->ksmac[8]);
    des3_algo3_reversed(kmac, block_l, &out_ctx->ksmac[16]);
 
    return SAFECOMM_STATUS_OK;
}
 
/* REQ-SC-MAC-005: Compute the CBC-MAC (Subset-037-2 §6.2.2) */
safecomm_status_t safecomm_mac_compute(const safecomm_mac_ctx_t *ctx,
                                       const uint8_t *msg, size_t msg_len,
                                       uint8_t out_mac[SAFECOMM_MAC_LEN])
{
    if ((ctx == NULL) || (out_mac == NULL) || ((msg == NULL) && (msg_len > 0U)))
    {
        return SAFECOMM_STATUS_INVALID_PARAM;
    }
 
    if (ctx->alg != SAFECOMM_MAC_ALG_3DES_SS037)
    {
        return SAFECOMM_STATUS_NOT_INITIALISED;
    }
 
    /*
     * ISO/IEC 9797-1 Padding Method 1: as few zero bits as needed (possibly none) to
     * reach a multiple of 64 bits. Unlike PKCS#7, a message already a multiple of 8
     * bytes gets NO extra block. An empty message still needs one (all-zero) block
     * for the algorithm to produce an output.
     */
    size_t padded_len = ((msg_len % 8U) == 0U) ? msg_len : (msg_len + (8U - (msg_len % 8U)));
    if (padded_len == 0U)
    {
        padded_len = 8U;
    }
    size_t nblocks = padded_len / 8U;
 
    uint8_t state[8];
    (void)memset(state, 0, sizeof(state)); /* H0 = 0, not enciphered before first use */
 
    for (size_t blk = 0U; blk < nblocks; blk++)
    {
        uint8_t xi[8];
        for (size_t i = 0U; i < 8U; i++)
        {
            size_t idx = (blk * 8U) + i;
            xi[i] = (idx < msg_len) ? msg[idx] : 0U; /* zero padding past msg_len */
            state[i] ^= xi[i];
        }
        if (blk < (nblocks - 1U))
        {
            uint8_t enc[8];
            des_ecb(&ctx->ksmac[0], state, 0, enc); /* Hi = E(K1, Hi-1 xor Xi) */
            (void)memcpy(state, enc, 8U);
        }
        else
        {
            des3_algo3(ctx->ksmac, state, out_mac); /* Hq = E(K3,D(K2,E(K1, Hq-1 xor Xq))) */
        }
    }
 
    return SAFECOMM_STATUS_OK;
}
 
/* REQ-SC-MAC-006: Constant-time MAC verify */
safecomm_status_t safecomm_mac_verify(const safecomm_mac_ctx_t *ctx,
                                      const uint8_t *msg, size_t msg_len,
                                      const uint8_t rx_mac[SAFECOMM_MAC_LEN])
{
    if ((ctx == NULL) || (rx_mac == NULL) || ((msg == NULL) && (msg_len > 0U)))
    {
        return SAFECOMM_STATUS_INVALID_PARAM;
    }
 
    uint8_t expected_mac[SAFECOMM_MAC_LEN];
    safecomm_status_t st = safecomm_mac_compute(ctx, msg, msg_len, expected_mac);
    if (st != SAFECOMM_STATUS_OK)
    {
        return st;
    }
 
    /* Constant-time comparison: never short-circuit */
    uint8_t diff = 0U;
    for (size_t i = 0U; i < SAFECOMM_MAC_LEN; i++)
    {
        diff |= (uint8_t)(expected_mac[i] ^ rx_mac[i]);
    }
 
    return (diff == 0U) ? SAFECOMM_STATUS_OK : SAFECOMM_STATUS_MAC_MISMATCH;
}