common/cryptorf/cryptolib.c

   1 /*
   2  *
   3  * SecureMemory, CryptoMemory and CryptoRF library
   4  *
   5  * Copyright (C) 2010, Flavio D. Garcia, Peter van Rossum, Roel Verdult
   6  * and Ronny Wichers Schreur. Radboud University Nijmegen
   7  *
   8  * This program is free software: you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation, either version 3 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20  *
  21  */
  22
  23 #include "cryptolib.h"
  24 #include <stdbool.h>
  25 #include <stdio.h>
  26 #include <string.h>
  27 #include <stdlib.h>
  28
  29 typedef enum {
  30     CA_ENCRYPT = 0x01,
  31     CA_DECRYPT = 0x02
  32 } CryptoAction;
  33
  34 int counter = 0;
  35
  36 static uint8_t nibbles_to_byte(nibble b0, nibble b1) {
  37     // Combine both nibbles
  38     return ((b0 << 4) | b1);
  39 }
  40
  41 static uint8_t funny_mod(uint8_t a, uint8_t m) {
  42     // Just return the input when this is less or equal than the modular value
  43     if (a < m) return a;
  44
  45     // Compute the modular value
  46     a %= m;
  47
  48     // Return the funny value, when the output was now zero, return the modular value
  49     return (a == 0) ? m : a;
  50 }
  51
  52 static uint8_t bit_rotate_left(uint8_t a, uint8_t n_bits) {
  53     // Rotate value a with the length of n_bits only 1 time
  54     uint8_t mask = (1 << n_bits) - 1;
  55     return ((a << 1) | (a >> (n_bits - 1))) & mask;
  56 }
  57
  58 /*
  59 static void reconstruct_nibbles(crypto_state s)
  60 {
  61   uint8_t b1, b5, b8, b15, b18;
  62   uint8_t b0, b4, b7, b14, b17;
  63
  64   // Extract the bytes that generated the "previous" nibble
  65   b1 = (uint8_t)((s->l >> 25) & 0x1f);
  66   b5 = (uint8_t)((s->l >> 5) & 0x1f);
  67   b8 = (uint8_t)((s->m >> 35) & 0x1f);
  68   b15 = (uint8_t)((s->r >> 15) & 0x1f);
  69   b18 = (uint8_t)(s->r & 0x1f);
  70
  71   // Reconstruct the b0 nibble
  72   s->b0 = ((b1 ^ b5) & 0x0f) & ~(b8);
  73   s->b0 |= ((b15 ^ b18) & 0x0f) & b8;
  74
  75   // Extract the bytes for the current nibble
  76   b0 = (uint8_t)((s->l >> 30) & 0x1f);
  77   b4 = (uint8_t)((s->l >> 10) & 0x1f);
  78   b7 = (uint8_t)((s->m >> 42) & 0x1f);
  79   b14 = (uint8_t)((s->r >> 20) & 0x1f);
  80   b17 = (uint8_t)((s->r >> 5) & 0x1f);
  81
  82   // Construct the values for b1 generation
  83   s->b1l = ((b0 ^ b4) & 0x0f);
  84   s->b1r = ((b14 ^ b17) & 0x0f);
  85   s->b1s = b7;
  86
  87   // Reconstruct the b1 nibble
  88   s->b1 = s->b1l  & ~(s->b1s);
  89   s->b1 |= s->b1r &  s->b1s;
  90 }
  91 */
  92 static void next_left(uint8_t in, crypto_state s) {
  93     uint8_t b3, b6, bx;
  94
  95     // Update the left cipher state with the input byte
  96     s->l ^= ((in & 0x1f) << 20);
  97
  98     // Extract the two (5 bits) values used for modular addtion
  99     b3 = (uint8_t)((s->l >> 15) & 0x1f);
 100     b6 = (uint8_t)(s->l & 0x1f);
 101
 102     // Compute the modular addition
 103     bx = funny_mod(b3 + bit_rotate_left(b6, 5), 0x1f);
 104
 105     // Rotate the left cipher state 5 bits
 106     s->l = ((s->l >> 5) | ((uint64_t)bx << 30));
 107
 108     // Save the 4 left output bits used for b1
 109     s->b1l = ((bx ^ b3) & 0x0f);
 110 }
 111
 112 static void next_right(uint8_t in, crypto_state s) {
 113     uint8_t b16, b18, bx;
 114
 115     // Update the right cipher state with the input byte
 116     s->r ^= ((in & 0xf8) << 12);
 117
 118     // Extract the two (5 bits) values used for modular addtion
 119     b16 = (uint8_t)((s->r >> 10) & 0x1f);
 120     b18 = (uint8_t)(s->r & 0x1f);
 121
 122     // Compute the modular addition
 123     bx = funny_mod(b18 + b16, 0x1f);
 124
 125     // Rotate the right cipher state 5 bits
 126     s->r = ((s->r >> 5) | ((uint64_t)bx << 20));
 127
 128     // Save the 4 right output bits used for b1
 129     s->b1r = ((bx ^ b16) & 0x0f);
 130 }
 131
 132 static void next_middle(uint8_t in, crypto_state s) {
 133     uint8_t b12, b13, bx;
 134
 135     // Update the middle cipher state with the input byte
 136     s->m ^= (((((uint64_t)in << 3) & 0x7f) | (in >> 5)) << 14);
 137
 138     // Extract the two (7 bits) values used for modular addtion
 139     b12 = (uint8_t)((s->m >> 7) & 0x7f);
 140     b13 = (uint8_t)(s->m & 0x7f);
 141
 142     // Compute the modular addition
 143     bx = (funny_mod(b12 + bit_rotate_left(b13, 7), 0x7f));
 144
 145     // Rotate the middle cipher state 7 bits
 146     s->m = ((s->m >> 7) | ((uint64_t)bx << 42));
 147
 148     // Save the 4 middle selector bits used for b1
 149     s->b1s = bx & 0x0f;
 150 }
 151
 152 static void next(const bool feedback, uint8_t in, crypto_state s) {
 153     // Initialize the (optional) input parameter
 154     uint8_t a = in;
 155
 156     // Only Cryptomemory uses feedback
 157     if (feedback) {
 158         // Construct the cipher update 'a' from (input ^ feedback)
 159         a = in ^ nibbles_to_byte(s->b0, s->b1);
 160     }
 161
 162     // Shift the cipher state
 163     next_left(a, s);
 164     next_middle(a, s);
 165     next_right(a, s);
 166
 167     // For active states we can use the available (previous) 'b1' nibble,
 168     // otherwise use reconstruct_nibbles() to generate them
 169     // reconstruct_nibbles(s)
 170
 171     // The nible from b1 shifts to b0
 172     s->b0 = s->b1;
 173
 174     // Construct the new value of nible b1
 175     s->b1 = s->b1l  & ~(s->b1s);
 176     s->b1 |= s->b1r &  s->b1s;
 177 }
 178
 179 static void next_n(const bool feedback, size_t n, uint8_t in, crypto_state s) {
 180     // While n-rounds left, shift the cipher
 181     while (n--) next(feedback, in, s);
 182 }
 183
 184 static void initialize(const bool feedback, const uint8_t *Gc, const uint8_t *Ci, const uint8_t *Q, const size_t n, crypto_state s) {
 185     size_t pos;
 186
 187     // Reset the cipher state
 188     memset(s, 0x00, sizeof(crypto_state_t));
 189
 190     // Load in the ci (tag-nonce), together with the first half of Q (reader-nonce)
 191     for (pos = 0; pos < 4; pos++) {
 192         next_n(feedback, n, Ci[2 * pos  ], s);
 193         next_n(feedback, n, Ci[2 * pos + 1], s);
 194         next(feedback, Q[pos], s);
 195     }
 196
 197     // Load in the diversified key (Gc), together with the second half of Q (reader-nonce)
 198     for (pos = 0; pos < 4; pos++) {
 199         next_n(feedback, n, Gc[2 * pos  ], s);
 200         next_n(feedback, n, Gc[2 * pos + 1], s);
 201         next(feedback, Q[pos + 4], s);
 202     }
 203 }
 204
 205 static uint8_t cm_byte(crypto_state s) {
 206     // Construct keystream byte by combining both nibbles
 207     return nibbles_to_byte(s->b0, s->b1);
 208 }
 209
 210 static uint8_t sm_byte(crypto_state s) {
 211     uint8_t ks;
 212
 213     // Construct keystream byte by combining 2 parts from 4 nibbles
 214     next_n(false, 2, 0, s);
 215     ks = s->b1 << 4;
 216     next_n(false, 2, 0, s);
 217     ks |= s->b1;
 218
 219     return ks;
 220 }
 221
 222 void print_crypto_state(const char *text, crypto_state s) {
 223     int pos;
 224
 225     printf("%s", text);
 226     for (pos = 6; pos >= 0; pos--)
 227         printf(" %02x", (uint8_t)(s->l >> (pos * 5)) & 0x1f);
 228
 229     printf(" |");
 230     for (pos = 6; pos >= 0; pos--)
 231         printf(" %02x", (uint8_t)(s->m >> (pos * 7)) & 0x7f);
 232
 233     printf(" |");
 234     for (pos = 4; pos >= 0; pos--)
 235         printf(" %02x", (uint8_t)(s->r >> (pos * 5)) & 0x1f);
 236
 237     printf(" | %02x", cm_byte(s));
 238     printf("\n");
 239 }
 240
 241 void sm_auth(const uint8_t *Gc, const uint8_t *Ci, const uint8_t *Q, uint8_t *Ch, uint8_t *Ci_1, crypto_state s) {
 242     size_t pos;
 243
 244     initialize(false, Gc, Ci, Q, 1, s);
 245
 246     // Generate challange answer for Tag and Reader
 247     for (pos = 0; pos < 8; pos++) {
 248         Ci_1[pos] = sm_byte(s);
 249         Ch[pos] = sm_byte(s);
 250     }
 251 }
 252
 253 void cm_auth(const uint8_t *Gc, const uint8_t *Ci, const uint8_t *Q, uint8_t *Ch, uint8_t *Ci_1, uint8_t *Ci_2, crypto_state s) {
 254     size_t pos;
 255
 256     initialize(true, Gc, Ci, Q, 3, s);
 257
 258     // Construct the reader-answer (challange)
 259     next_n(true, 6, 0, s);
 260     Ch[0] = cm_byte(s);
 261     for (pos = 1; pos < 8; pos++) {
 262         next_n(true, 7, 0, s);
 263         Ch [pos] = cm_byte(s);
 264     }
 265
 266     // Construct the tag-answer (Ci+1 = ff .. .. .. .. .. .. ..)
 267     Ci_1[0] = 0xff;
 268     for (pos = 1; pos < 8; pos++) {
 269         next_n(true, 2, 0, s);
 270         Ci_1[pos] = cm_byte(s);
 271     }
 272
 273     // Construct the session key (Ci+2)
 274     for (pos = 0; pos < 8; pos++) {
 275         next_n(true, 2, 0, s);
 276         Ci_2[pos] = cm_byte(s);
 277     }
 278
 279     // Prepare the cipher for encryption by shifting 3 more times
 280     next_n(true, 3, 0, s);
 281 }
 282
 283 static void cm_crypt(const CryptoAction ca, const uint8_t offset, const uint8_t len, const uint8_t *in, uint8_t *out, crypto_state s) {
 284     size_t pos;
 285     uint8_t bt;
 286
 287     next_n(true, 5, 0, s);
 288     next(true, offset, s);
 289     next_n(true, 5, 0, s);
 290     next(true, len, s);
 291     for (pos = 0; pos < len; pos++) {
 292         // Perform the crypto operation
 293         bt = in[pos] ^ cm_byte(s);
 294
 295         // Generate output
 296         if (out) out[pos] = bt;
 297
 298         // Detect where to find the plaintext for loading into cipher state
 299         if (ca == CA_DECRYPT) {
 300             next(true, bt, s);
 301         } else {
 302             next(true, in[pos], s);
 303         }
 304
 305         // Shift the cipher state 5 times
 306         next_n(true, 5, 0, s);
 307     }
 308 }
 309
 310 void cm_encrypt(const uint8_t offset, const uint8_t len, const uint8_t *pt, uint8_t *ct, crypto_state s) {
 311     next_n(true, 5, 0, s);
 312     next(true, 0, s);
 313     cm_crypt(CA_ENCRYPT, offset, len, pt, ct, s);
 314 }
 315
 316 void cm_decrypt(const uint8_t offset, const uint8_t len, const uint8_t *ct, uint8_t *pt, crypto_state s) {
 317     next_n(true, 5, 0, s);
 318     next(true, 0, s);
 319     cm_crypt(CA_DECRYPT, offset, len, ct, pt, s);
 320 }
 321
 322 void cm_grind_read_system_zone(const uint8_t offset, const uint8_t len, const uint8_t *pt, crypto_state s) {
 323     cm_crypt(CA_ENCRYPT, offset, len, pt, NULL, s);
 324 }
 325
 326 void cm_grind_set_user_zone(const uint8_t zone, crypto_state s) {
 327     next(true, zone, s);
 328 }
 329
 330 void cm_mac(uint8_t *mac, crypto_state s) {
 331     next_n(true, 10, 0, s);
 332     if (mac)
 333         mac[0] = cm_byte(s);
 334
 335     next_n(true, 5, 0, s);
 336     if (mac)
 337         mac[1] = cm_byte(s);
 338 }
 339
 340 void cm_password(const uint8_t *pt, uint8_t *ct, crypto_state s) {
 341     for (size_t pos = 0; pos < 3; pos++) {
 342         next_n(true, 5, pt[pos], s);
 343         ct[pos] = cm_byte(s);
 344     }
 345 }
 346