• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* hmac.c - TinyCrypt implementation of the HMAC algorithm */
2 
3 /*
4  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
5  *
6  *  Redistribution and use in source and binary forms, with or without
7  *  modification, are permitted provided that the following conditions are met:
8  *
9  *    - Redistributions of source code must retain the above copyright notice,
10  *     this list of conditions and the following disclaimer.
11  *
12  *    - Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  *    - Neither the name of Intel Corporation nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21  *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
24  *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  *  POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <tinycrypt/hmac.h>
34 #include <tinycrypt/constants.h>
35 #include <tinycrypt/utils.h>
36 
rekey(uint8_t * key,const uint8_t * new_key,unsigned int key_size)37 static void rekey(uint8_t *key, const uint8_t *new_key, unsigned int key_size)
38 {
39     const uint8_t inner_pad = (uint8_t) 0x36;
40     const uint8_t outer_pad = (uint8_t) 0x5c;
41     unsigned int i;
42 
43     for (i = 0; i < key_size; ++i) {
44         key[i] = inner_pad ^ new_key[i];
45         key[i + TC_SHA256_BLOCK_SIZE] = outer_pad ^ new_key[i];
46     }
47 
48     for (; i < TC_SHA256_BLOCK_SIZE; ++i) {
49         key[i] = inner_pad;
50         key[i + TC_SHA256_BLOCK_SIZE] = outer_pad;
51     }
52 }
53 
tc_hmac_set_key(TCHmacState_t ctx,const uint8_t * key,unsigned int key_size)54 int tc_hmac_set_key(TCHmacState_t ctx, const uint8_t *key,
55                     unsigned int key_size)
56 {
57     /* input sanity check: */
58     if (ctx == (TCHmacState_t) 0 ||
59             key == (const uint8_t *) 0 ||
60             key_size == 0) {
61         return TC_CRYPTO_FAIL;
62     }
63 
64     const uint8_t dummy_key[key_size];
65     struct tc_hmac_state_struct dummy_state;
66 
67     if (key_size <= TC_SHA256_BLOCK_SIZE) {
68         /*
69          * The next three lines consist of dummy calls just to avoid
70          * certain timing attacks. Without these dummy calls,
71          * adversaries would be able to learn whether the key_size is
72          * greater than TC_SHA256_BLOCK_SIZE by measuring the time
73          * consumed in this process.
74          */
75         (void)tc_sha256_init(&dummy_state.hash_state);
76         (void)tc_sha256_update(&dummy_state.hash_state,
77                                dummy_key,
78                                key_size);
79         (void)tc_sha256_final(&dummy_state.key[TC_SHA256_DIGEST_SIZE],
80                               &dummy_state.hash_state);
81         /* Actual code for when key_size <= TC_SHA256_BLOCK_SIZE: */
82         rekey(ctx->key, key, key_size);
83     } else {
84         (void)tc_sha256_init(&ctx->hash_state);
85         (void)tc_sha256_update(&ctx->hash_state, key, key_size);
86         (void)tc_sha256_final(&ctx->key[TC_SHA256_DIGEST_SIZE],
87                               &ctx->hash_state);
88         rekey(ctx->key,
89               &ctx->key[TC_SHA256_DIGEST_SIZE],
90               TC_SHA256_DIGEST_SIZE);
91     }
92 
93     return TC_CRYPTO_SUCCESS;
94 }
95 
tc_hmac_init(TCHmacState_t ctx)96 int tc_hmac_init(TCHmacState_t ctx)
97 {
98     /* input sanity check: */
99     if (ctx == (TCHmacState_t) 0) {
100         return TC_CRYPTO_FAIL;
101     }
102 
103     (void) tc_sha256_init(&ctx->hash_state);
104     (void) tc_sha256_update(&ctx->hash_state, ctx->key, TC_SHA256_BLOCK_SIZE);
105     return TC_CRYPTO_SUCCESS;
106 }
107 
tc_hmac_update(TCHmacState_t ctx,const void * data,unsigned int data_length)108 int tc_hmac_update(TCHmacState_t ctx,
109                    const void *data,
110                    unsigned int data_length)
111 {
112     /* input sanity check: */
113     if (ctx == (TCHmacState_t) 0) {
114         return TC_CRYPTO_FAIL;
115     }
116 
117     (void)tc_sha256_update(&ctx->hash_state, data, data_length);
118     return TC_CRYPTO_SUCCESS;
119 }
120 
tc_hmac_final(uint8_t * tag,unsigned int taglen,TCHmacState_t ctx)121 int tc_hmac_final(uint8_t *tag, unsigned int taglen, TCHmacState_t ctx)
122 {
123     /* input sanity check: */
124     if (tag == (uint8_t *) 0 ||
125             taglen != TC_SHA256_DIGEST_SIZE ||
126             ctx == (TCHmacState_t) 0) {
127         return TC_CRYPTO_FAIL;
128     }
129 
130     (void) tc_sha256_final(tag, &ctx->hash_state);
131     (void)tc_sha256_init(&ctx->hash_state);
132     (void)tc_sha256_update(&ctx->hash_state,
133                            &ctx->key[TC_SHA256_BLOCK_SIZE],
134                            TC_SHA256_BLOCK_SIZE);
135     (void)tc_sha256_update(&ctx->hash_state, tag, TC_SHA256_DIGEST_SIZE);
136     (void)tc_sha256_final(tag, &ctx->hash_state);
137     /* destroy the current state */
138     _set(ctx, 0, sizeof(*ctx));
139     return TC_CRYPTO_SUCCESS;
140 }
141