Add the NIST AES key wrap algorithm, as specified in RFC 3394 and

http://csrc.nist.gov/groups/ST/toolkit/documents/kms/key-wrap.pdf

3 files changed, 166 insertions, 0 deletions

diff --git a/src/constructs/rfc3394/info.txt b/src/constructs/rfc3394/info.txt
new file mode 100644
index 000000000..496f3e138
--- /dev/null
+++ b/src/constructs/rfc3394/info.txt
@@ -0,0 +1 @@
+define RFC3394_KEYWRAP
diff --git a/src/constructs/rfc3394/rfc3394.cpp b/src/constructs/rfc3394/rfc3394.cpp
new file mode 100644
index 000000000..d6909c94a
--- /dev/null
+++ b/src/constructs/rfc3394/rfc3394.cpp
@@ -0,0 +1,121 @@
+/*
+* AES Key Wrap (RFC 3394)
+* (C) 2011 Jack Lloyd
+*
+* Distributed under the terms of the Botan license
+*/
+
+#include <botan/rfc3394.h>
+#include <botan/block_cipher.h>
+#include <botan/loadstor.h>
+#include <botan/exceptn.h>
+#include <botan/internal/xor_buf.h>
+#include <memory>
+
+namespace Botan {
+
+namespace {
+
+BlockCipher* make_aes(size_t keylength,
+                      Algorithm_Factory& af)
+   {
+   if(keylength == 16)
+      return af.make_block_cipher("AES-128");
+   else if(keylength == 24)
+      return af.make_block_cipher("AES-192");
+   else if(keylength == 32)
+      return af.make_block_cipher("AES-256");
+   else
+      throw std::invalid_argument("Bad KEK length for NIST keywrap");
+   }
+
+}
+
+SecureVector<byte> rfc3394_keywrap(const MemoryRegion<byte>& key,
+                                   const SymmetricKey& kek,
+                                   Algorithm_Factory& af)
+   {
+   if(key.size() % 8 != 0)
+      throw std::invalid_argument("Bad input key size for NIST key wrap");
+
+   std::auto_ptr<BlockCipher> aes(make_aes(kek.length(), af));
+   aes->set_key(kek);
+
+   const size_t n = key.size() / 8;
+
+   SecureVector<byte> R((n + 1) * 8);
+   SecureVector<byte> A(16);
+
+   for(size_t i = 0; i != 8; ++i)
+      A[i] = 0xA6;
+
+   copy_mem(&R[8], key.begin(), key.size());
+
+   for(size_t j = 0; j <= 5; ++j)
+      {
+      for(size_t i = 1; i <= n; ++i)
+         {
+         const u32bit t = (n * j) + i;
+
+         copy_mem(&A[8], &R[8*i], 8);
+
+         aes->encrypt(&A[0]);
+         copy_mem(&R[8*i], &A[8], 8);
+
+         byte t_buf[4] = { 0 };
+         store_be(t, t_buf);
+         xor_buf(&A[4], &t_buf[0], 4);
+         }
+      }
+
+   copy_mem(&R[0], &A[0], 8);
+
+   return R;
+   }
+
+SecureVector<byte> rfc3394_keyunwrap(const MemoryRegion<byte>& key,
+                                     const SymmetricKey& kek,
+                                     Algorithm_Factory& af)
+   {
+   if(key.size() < 16 || key.size() % 8 != 0)
+      throw std::invalid_argument("Bad input key size for NIST key unwrap");
+
+   std::auto_ptr<BlockCipher> aes(make_aes(kek.length(), af));
+   aes->set_key(kek);
+
+   const size_t n = (key.size() - 8) / 8;
+
+   SecureVector<byte> R(n * 8);
+   SecureVector<byte> A(16);
+
+   for(size_t i = 0; i != 8; ++i)
+      A[i] = key[i];
+
+   copy_mem(&R[0], key.begin() + 8, key.size() - 8);
+
+   for(size_t j = 0; j <= 5; ++j)
+      {
+      for(size_t i = n; i != 0; --i)
+         {
+         const u32bit t = (5 - j) * n + i;
+
+         byte t_buf[4] = { 0 };
+         store_be(t, t_buf);
+
+         xor_buf(&A[4], &t_buf[0], 4);
+
+         copy_mem(&A[8], &R[8*(i-1)], 8);
+
+         aes->decrypt(&A[0]);
+
+         copy_mem(&R[8*(i-1)], &A[8], 8);
+         }
+      }
+
+   if(load_be<u64bit>(&A[0], 0) != 0xA6A6A6A6A6A6A6A6)
+      throw Integrity_Failure("NIST key unwrap failed");
+
+   return R;
+   }
+
+}
diff --git a/src/constructs/rfc3394/rfc3394.h b/src/constructs/rfc3394/rfc3394.h
new file mode 100644
index 000000000..7a4668735
--- /dev/null
+++ b/src/constructs/rfc3394/rfc3394.h
@@ -0,0 +1,44 @@
+/*
+* AES Key Wrap (RFC 3394)
+* (C) 2011 Jack Lloyd
+*
+* Distributed under the terms of the Botan license
+*/
+
+#ifndef BOTAN_AES_KEY_WRAP_H__
+#define BOTAN_AES_KEY_WRAP_H__
+
+#include <botan/symkey.h>
+#include <botan/algo_factory.h>
+
+namespace Botan {
+
+/**
+* Encrypt a key under a key encryption key using the algorithm
+* described in RFC 3394
+*
+* @param key the plaintext key to encrypt
+* @param kek the key encryption key
+* @param af an algorithm factory
+* @return key encrypted under kek
+*/
+SecureVector<byte> BOTAN_DLL rfc3394_keywrap(const MemoryRegion<byte>& key,
+                                             const SymmetricKey& kek,
+                                             Algorithm_Factory& af);
+
+/**
+* Decrypt a key under a key encryption key using the algorithm
+* described in RFC 3394
+*
+* @param key the encrypted key to decrypt
+* @param kek the key encryption key
+* @param af an algorithm factory
+* @return key decrypted under kek
+*/
+SecureVector<byte> BOTAN_DLL rfc3394_keyunwrap(const MemoryRegion<byte>& key,
+                                               const SymmetricKey& kek,
+                                               Algorithm_Factory& af);
+
+}
+
+#endif