1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
/*
* AES Key Wrap (RFC 3394)
* (C) 2011 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#include <botan/rfc3394.h>
#include <botan/algo_registry.h>
#include <botan/block_cipher.h>
#include <botan/loadstor.h>
#include <botan/exceptn.h>
#include <botan/internal/xor_buf.h>
namespace Botan {
namespace {
BlockCipher* make_aes(size_t keylength)
{
auto& block_ciphers = Algo_Registry<BlockCipher>::global_registry();
if(keylength == 16)
return block_ciphers.make("AES-128");
else if(keylength == 24)
return block_ciphers.make("AES-192");
else if(keylength == 32)
return block_ciphers.make("AES-256");
else
throw std::invalid_argument("Bad KEK length for NIST keywrap");
}
}
secure_vector<byte> rfc3394_keywrap(const secure_vector<byte>& key,
const SymmetricKey& kek)
{
if(key.size() % 8 != 0)
throw std::invalid_argument("Bad input key size for NIST key wrap");
std::unique_ptr<BlockCipher> aes(make_aes(kek.length()));
aes->set_key(kek);
const size_t n = key.size() / 8;
secure_vector<byte> R((n + 1) * 8);
secure_vector<byte> A(16);
for(size_t i = 0; i != 8; ++i)
A[i] = 0xA6;
copy_mem(&R[8], &key[0], key.size());
for(size_t j = 0; j <= 5; ++j)
{
for(size_t i = 1; i <= n; ++i)
{
const u32bit t = (n * j) + i;
copy_mem(&A[8], &R[8*i], 8);
aes->encrypt(&A[0]);
copy_mem(&R[8*i], &A[8], 8);
byte t_buf[4] = { 0 };
store_be(t, t_buf);
xor_buf(&A[4], &t_buf[0], 4);
}
}
copy_mem(&R[0], &A[0], 8);
return R;
}
secure_vector<byte> rfc3394_keyunwrap(const secure_vector<byte>& key,
const SymmetricKey& kek)
{
if(key.size() < 16 || key.size() % 8 != 0)
throw std::invalid_argument("Bad input key size for NIST key unwrap");
std::unique_ptr<BlockCipher> aes(make_aes(kek.length()));
aes->set_key(kek);
const size_t n = (key.size() - 8) / 8;
secure_vector<byte> R(n * 8);
secure_vector<byte> A(16);
for(size_t i = 0; i != 8; ++i)
A[i] = key[i];
copy_mem(&R[0], &key[8], key.size() - 8);
for(size_t j = 0; j <= 5; ++j)
{
for(size_t i = n; i != 0; --i)
{
const u32bit t = (5 - j) * n + i;
byte t_buf[4] = { 0 };
store_be(t, t_buf);
xor_buf(&A[4], &t_buf[0], 4);
copy_mem(&A[8], &R[8*(i-1)], 8);
aes->decrypt(&A[0]);
copy_mem(&R[8*(i-1)], &A[8], 8);
}
}
if(load_be<u64bit>(&A[0], 0) != 0xA6A6A6A6A6A6A6A6)
throw Integrity_Failure("NIST key unwrap failed");
return R;
}
}
|
