#include "precomp.h"

Include dependency graph for aeskw.c:

Macros
#define	SYMCRYPT_AES_SEMIBLOCK_SIZE (SYMCRYPT_AES_BLOCK_SIZE / 2)

Functions
static VOID SYMCRYPT_CALL	SymCryptAesKwxInternalWrap (_In_ PCSYMCRYPT_AES_EXPANDED_KEY pExpandedKey, _Inout_updates_bytes_(cbBuf) PBYTE pbBuf, UINT32 cbBuf)

static VOID SYMCRYPT_CALL	SymCryptAesKwxInternalUnwrap (_In_ PCSYMCRYPT_AES_EXPANDED_KEY pExpandedKey, _Inout_updates_bytes_(cbBuf) PBYTE pbBuf, UINT32 cbBuf)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptAesKwEncrypt (_In_ PCSYMCRYPT_AES_EXPANDED_KEY pExpandedKey, _In_reads_(cbSrc) PCBYTE pbSrc, SIZE_T cbSrc, _Out_writes_to_(cbDst, pcbResult) PBYTE pbDst, SIZE_T cbDst, _Out_ SIZE_T pcbResult)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptAesKwDecrypt (_In_ PCSYMCRYPT_AES_EXPANDED_KEY pExpandedKey, _In_reads_(cbSrc) PCBYTE pbSrc, SIZE_T cbSrc, _Out_writes_to_(cbDst, pcbResult) PBYTE pbDst, SIZE_T cbDst, _Out_ SIZE_T pcbResult)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptAesKwpEncrypt (_In_ PCSYMCRYPT_AES_EXPANDED_KEY pExpandedKey, _In_reads_(cbSrc) PCBYTE pbSrc, SIZE_T cbSrc, _Out_writes_to_(cbDst, pcbResult) PBYTE pbDst, SIZE_T cbDst, _Out_ SIZE_T pcbResult)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptAesKwpDecrypt (_In_ PCSYMCRYPT_AES_EXPANDED_KEY pExpandedKey, _In_reads_(cbSrc) PCBYTE pbSrc, SIZE_T cbSrc, _Out_writes_to_(cbDst, pcbResult) PBYTE pbDst, SIZE_T cbDst, _Out_ SIZE_T pcbResult)

Variables
const UINT64	SymCryptAesKwDefaultICV = 0xA6A6A6A6A6A6A6A6

const UINT32	SymCryptAesKwpDefaultICV = 0xA65959A6

const SIZE_T	SymCryptAesKWMinPlaintextLen = 16u

const SIZE_T	SymCryptAesKWMaxPlaintextLen = (1u<<31)-8

const SIZE_T	SymCryptAesKWMinCiphertextLen = 24u

const SIZE_T	SymCryptAesKWMaxCiphertextLen = (1u<<31)

const SIZE_T	SymCryptAesKWPMinPlaintextLen = 1u

const SIZE_T	SymCryptAesKWPMaxPlaintextLen = (1u<<31)-8

const SIZE_T	SymCryptAesKWPMinCiphertextLen = 16u

const SIZE_T	SymCryptAesKWPMaxCiphertextLen = (1u<<31)

Macro Definition Documentation

◆ SYMCRYPT_AES_SEMIBLOCK_SIZE

#define SYMCRYPT_AES_SEMIBLOCK_SIZE (SYMCRYPT_AES_BLOCK_SIZE / 2)

Definition at line 33 of file aeskw.c.

Function Documentation

◆ SymCryptAesKwDecrypt()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptAesKwDecrypt	(	_In_ PCSYMCRYPT_AES_EXPANDED_KEY	pExpandedKey,
		_In_reads_(cbSrc) PCBYTE	pbSrc,
		SIZE_T	cbSrc,
		_Out_writes_to_(cbDst, *pcbResult) PBYTE	pbDst,
		SIZE_T	cbDst,
		_Out_ SIZE_T *	pcbResult
	)

Definition at line 228 of file aeskw.c.

{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
    PBYTE  pbScratch = NULL;
    UINT32 cbScratch = 0;
 
    if( (cbSrc < SymCryptAesKWMinCiphertextLen) ||
        (cbSrc > SymCryptAesKWMaxCiphertextLen) ||
        ((cbSrc & (SYMCRYPT_AES_SEMIBLOCK_SIZE-1)) != 0) )
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }
 
    cbScratch = (UINT32) cbSrc;
    if( cbDst < cbScratch-SYMCRYPT_AES_SEMIBLOCK_SIZE )
    {
        scError = SYMCRYPT_BUFFER_TOO_SMALL;
        goto cleanup;
    }
 
    pbScratch = SymCryptCallbackAlloc( cbScratch );
    if( pbScratch == NULL )
    {
        scError = SYMCRYPT_MEMORY_ALLOCATION_FAILURE;
        goto cleanup;
    }
 
    // set up input buffer as C
    memcpy( pbScratch, pbSrc, cbSrc );
 
    // decrypt input buffer in place
    SymCryptAesKwxInternalUnwrap( pExpandedKey, pbScratch, cbScratch );
 
    // check first semi-block has the expected value
    if( SYMCRYPT_LOAD_LSBFIRST64( pbScratch ) != SymCryptAesKwDefaultICV )
    {
        scError = SYMCRYPT_AUTHENTICATION_FAILURE;
        goto cleanup;
    }
 
    // copy decrypted buffer to output
    memcpy( pbDst, pbScratch+SYMCRYPT_AES_SEMIBLOCK_SIZE, cbScratch-SYMCRYPT_AES_SEMIBLOCK_SIZE );
    *pcbResult = cbScratch-SYMCRYPT_AES_SEMIBLOCK_SIZE;
 
cleanup:
    if( pbScratch != NULL )
    {
        SymCryptWipe( pbScratch, cbScratch );
        SymCryptCallbackFree( pbScratch );
    }
    return scError;
 
}

◆ SymCryptAesKwEncrypt()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptAesKwEncrypt	(	_In_ PCSYMCRYPT_AES_EXPANDED_KEY	pExpandedKey,
		_In_reads_(cbSrc) PCBYTE	pbSrc,
		SIZE_T	cbSrc,
		_Out_writes_to_(cbDst, *pcbResult) PBYTE	pbDst,
		SIZE_T	cbDst,
		_Out_ SIZE_T *	pcbResult
	)

Definition at line 172 of file aeskw.c.

{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
    PBYTE  pbScratch = NULL;
    UINT32 cbScratch = 0;
 
    if( (cbSrc < SymCryptAesKWMinPlaintextLen) ||
        (cbSrc > SymCryptAesKWMaxPlaintextLen) ||
        ((cbSrc & (SYMCRYPT_AES_SEMIBLOCK_SIZE-1)) != 0) )
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }
 
    cbScratch = ((UINT32) cbSrc)+SYMCRYPT_AES_SEMIBLOCK_SIZE;
    if( cbDst < cbScratch )
    {
        scError = SYMCRYPT_BUFFER_TOO_SMALL;
        goto cleanup;
    }
 
    pbScratch = SymCryptCallbackAlloc( cbScratch );
    if( pbScratch == NULL )
    {
        scError = SYMCRYPT_MEMORY_ALLOCATION_FAILURE;
        goto cleanup;
    }
 
    // set up input buffer as ICV1 || P
    SYMCRYPT_STORE_LSBFIRST64( pbScratch, SymCryptAesKwDefaultICV );
    memcpy( pbScratch+8, pbSrc, cbSrc );
 
    // encrypt input buffer in place
    SymCryptAesKwxInternalWrap( pExpandedKey, pbScratch, cbScratch );
 
    // copy encrypted buffer to output
    memcpy( pbDst, pbScratch, cbScratch );
    *pcbResult = cbScratch;
 
cleanup:
    if( pbScratch != NULL )
    {
        SymCryptWipe( pbScratch, cbScratch );
        SymCryptCallbackFree( pbScratch );
    }
    return scError;
}

◆ SymCryptAesKwpDecrypt()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptAesKwpDecrypt	(	_In_ PCSYMCRYPT_AES_EXPANDED_KEY	pExpandedKey,
		_In_reads_(cbSrc) PCBYTE	pbSrc,
		SIZE_T	cbSrc,
		_Out_writes_to_(cbDst, *pcbResult) PBYTE	pbDst,
		SIZE_T	cbDst,
		_Out_ SIZE_T *	pcbResult
	)

Definition at line 365 of file aeskw.c.

{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
    PBYTE  pbScratch = NULL;
    UINT32 cbScratch = 0;
    UINT32 cbPlaintext = 0;
    UINT32 cbPad = 0;
    UINT32 mVerificationError = 0;  // Mask indicating whether the decrypted buffer is malformed
    UINT32 mIsPlaintext = 0;        // Mask for plaintext bytes in the final semi-block
 
    if( (cbSrc < SymCryptAesKWPMinCiphertextLen) ||
        (cbSrc > SymCryptAesKWPMaxCiphertextLen) ||
        ((cbSrc & (SYMCRYPT_AES_SEMIBLOCK_SIZE-1)) != 0) )
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }
 
    cbScratch = (UINT32) cbSrc;
    if( cbDst < cbScratch-SYMCRYPT_AES_SEMIBLOCK_SIZE-7 )
    {
        scError = SYMCRYPT_BUFFER_TOO_SMALL;
        goto cleanup;
    }
 
    pbScratch = SymCryptCallbackAlloc( cbScratch );
    if( pbScratch == NULL )
    {
        scError = SYMCRYPT_MEMORY_ALLOCATION_FAILURE;
        goto cleanup;
    }
 
    // set up input buffer as C
    memcpy( pbScratch, pbSrc, cbSrc );
 
    // decrypt input buffer in place
    if( cbScratch == SYMCRYPT_AES_BLOCK_SIZE )
    {
        // special case for AES-KWP with small ciphertext
        SymCryptAesDecrypt( pExpandedKey, pbScratch, pbScratch );
    } else {
        SymCryptAesKwxInternalUnwrap( pExpandedKey, pbScratch, cbScratch );
    }
 
    // Check if the decrypted buffer is of an expected form
    // check bytes [0..3] are expected ICV
    mVerificationError |= SYMCRYPT_LOAD_LSBFIRST32( pbScratch ) ^ SymCryptAesKwpDefaultICV;
 
    // check bytes [4..7] are a valid plaintext length (i.e. computed cbPad in range [0,7])
    cbPlaintext = SYMCRYPT_LOAD_MSBFIRST32( pbScratch+4 );
    cbPad = (UINT32) cbSrc - cbPlaintext - SYMCRYPT_AES_SEMIBLOCK_SIZE;
    mVerificationError |= (cbPad & 0xfffffff8);
 
    // check that padding is all 0s
    for( UINT32 i = 1; i<SYMCRYPT_AES_SEMIBLOCK_SIZE; i++ )
    {
        mIsPlaintext = SymCryptMask32LtU31(i, SYMCRYPT_AES_SEMIBLOCK_SIZE-(cbPad&7));
        mVerificationError |= ((UINT32) pbScratch[ cbScratch-SYMCRYPT_AES_SEMIBLOCK_SIZE+i ]) & ~mIsPlaintext;
    }
 
    // Now if there was any verification error, we fail
    if( mVerificationError != 0 )
    {
        scError = SYMCRYPT_AUTHENTICATION_FAILURE;
        goto cleanup;
    }
 
    // We are variable time w.r.t. the plaintext length on success
    if( cbDst < cbPlaintext )
    {
        scError = SYMCRYPT_BUFFER_TOO_SMALL;
        goto cleanup;
    }
 
    // copy decrypted buffer to output
    memcpy( pbDst, pbScratch+SYMCRYPT_AES_SEMIBLOCK_SIZE, cbPlaintext );
    *pcbResult = cbPlaintext;
 
cleanup:
    if( pbScratch != NULL )
    {
        SymCryptWipe( pbScratch, cbScratch );
        SymCryptCallbackFree( pbScratch );
    }
    return scError;
 
}

◆ SymCryptAesKwpEncrypt()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptAesKwpEncrypt	(	_In_ PCSYMCRYPT_AES_EXPANDED_KEY	pExpandedKey,
		_In_reads_(cbSrc) PCBYTE	pbSrc,
		SIZE_T	cbSrc,
		_Out_writes_to_(cbDst, *pcbResult) PBYTE	pbDst,
		SIZE_T	cbDst,
		_Out_ SIZE_T *	pcbResult
	)

Definition at line 291 of file aeskw.c.

{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
    PBYTE  pbScratch = NULL;
    UINT32 cbScratch = 0;
    UINT32 cbPad = 0;
 
    if( (cbSrc < SymCryptAesKWPMinPlaintextLen) ||
        (cbSrc > SymCryptAesKWPMaxPlaintextLen) )
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }
 
    cbPad = SYMCRYPT_AES_SEMIBLOCK_SIZE - ((UINT32) cbSrc & (SYMCRYPT_AES_SEMIBLOCK_SIZE-1));
    if( cbPad == SYMCRYPT_AES_SEMIBLOCK_SIZE )
    {
        cbPad = 0;
    }
 
    cbScratch = (UINT32) cbSrc + SYMCRYPT_AES_SEMIBLOCK_SIZE + cbPad;
    if( cbDst < cbScratch )
    {
        scError = SYMCRYPT_BUFFER_TOO_SMALL;
        goto cleanup;
    }
 
    SYMCRYPT_ASSERT( cbScratch >= 16 );
 
    pbScratch = SymCryptCallbackAlloc( cbScratch );
    if( pbScratch == NULL )
    {
        scError = SYMCRYPT_MEMORY_ALLOCATION_FAILURE;
        goto cleanup;
    }
 
    // set up input buffer as ICV2 || len(P) || P || PAD
    SYMCRYPT_STORE_LSBFIRST32( pbScratch,   SymCryptAesKwpDefaultICV );
    SYMCRYPT_STORE_MSBFIRST32( pbScratch+4, (UINT32) cbSrc );
    // pad by unconditionally setting the last 8 bytes to 0
    // then overwrite some or all of the padding bytes with plaintext
    SYMCRYPT_STORE_LSBFIRST64( pbScratch+cbScratch-SYMCRYPT_AES_SEMIBLOCK_SIZE, 0u );
    memcpy( pbScratch+8, pbSrc, cbSrc );
 
    // encrypt input buffer in place
    if( cbScratch == SYMCRYPT_AES_BLOCK_SIZE )
    {
        // special case for AES-KWP with small plaintext
        SymCryptAesEncrypt( pExpandedKey, pbScratch, pbScratch );
    } else {
        SymCryptAesKwxInternalWrap( pExpandedKey, pbScratch, cbScratch );
    }
 
    // copy encrypted buffer to output
    memcpy( pbDst, pbScratch, cbScratch );
    *pcbResult = cbScratch;
 
cleanup:
    if( pbScratch != NULL )
    {
        SymCryptWipe( pbScratch, cbScratch );
        SymCryptCallbackFree( pbScratch );
    }
    return scError;
}

◆ SymCryptAesKwxInternalUnwrap()

static VOID SYMCRYPT_CALL SymCryptAesKwxInternalUnwrap	(	_In_ PCSYMCRYPT_AES_EXPANDED_KEY	pExpandedKey,
		_Inout_updates_bytes_(cbBuf) PBYTE	pbBuf,
		UINT32	cbBuf
	)

static

Definition at line 116 of file aeskw.c.

{
    SYMCRYPT_ALIGN BYTE activeBlock[SYMCRYPT_AES_BLOCK_SIZE];
    const UINT32 nSemiBlocks = cbBuf / SYMCRYPT_AES_SEMIBLOCK_SIZE; // n per SP 800-38F
    UINT64 decryptionIdx = 6*(nSemiBlocks-1);                       // t per SP 800-38F
    UINT64 lowHalfTemp = 0;
 
    SYMCRYPT_ASSERT((cbBuf & (SYMCRYPT_AES_SEMIBLOCK_SIZE-1)) == 0);
    SYMCRYPT_ASSERT(cbBuf >= SymCryptAesKWMinCiphertextLen);
    SYMCRYPT_ASSERT(cbBuf <= SymCryptAesKWMaxCiphertextLen);
 
    // Special case for first decryption
    // Initialize the low half temporary with the first semi-block of input
    lowHalfTemp = SYMCRYPT_LOAD_LSBFIRST64( pbBuf );
 
    for( UINT32 outerLoopCnt = 0; outerLoopCnt < 6; outerLoopCnt++ )
    {
        for( UINT32 innerLoopCnt = nSemiBlocks-1; innerLoopCnt > 0; innerLoopCnt-- )
        {
            SIZE_T bufOffset = innerLoopCnt*SYMCRYPT_AES_SEMIBLOCK_SIZE;
 
            // Update low half with decryptionIdx and store to low half of active block
            lowHalfTemp ^= SYMCRYPT_BSWAP64( decryptionIdx );
            SYMCRYPT_STORE_LSBFIRST64( activeBlock, lowHalfTemp );
 
            // Initialize the high half of active block to semi-block from buf
            memcpy( activeBlock+SYMCRYPT_AES_SEMIBLOCK_SIZE, pbBuf+bufOffset, SYMCRYPT_AES_SEMIBLOCK_SIZE);
 
            // Decrypt activeBlock in place
            SymCryptAesDecrypt( pExpandedKey, activeBlock, activeBlock );
 
            // Store the high half of result back to semi-block from buf
            memcpy( pbBuf+bufOffset, activeBlock+SYMCRYPT_AES_SEMIBLOCK_SIZE, SYMCRYPT_AES_SEMIBLOCK_SIZE );
 
            // Update decryptionIdx
            decryptionIdx--;
 
            // Use the low half of the result to set the low half temporary
            lowHalfTemp = SYMCRYPT_LOAD_LSBFIRST64( activeBlock );
        }
    }
 
    SYMCRYPT_ASSERT( decryptionIdx == 0 );
 
    // Special case for last decryption
    // Store the final low half of decryption as the first semi-block of output
    SYMCRYPT_STORE_LSBFIRST64( pbBuf, lowHalfTemp );
 
    SymCryptWipeKnownSize( activeBlock, sizeof(activeBlock) );
}

Referenced by SymCryptAesKwDecrypt(), and SymCryptAesKwpDecrypt().

◆ SymCryptAesKwxInternalWrap()

static VOID SYMCRYPT_CALL SymCryptAesKwxInternalWrap	(	_In_ PCSYMCRYPT_AES_EXPANDED_KEY	pExpandedKey,
		_Inout_updates_bytes_(cbBuf) PBYTE	pbBuf,
		UINT32	cbBuf
	)

static

Definition at line 54 of file aeskw.c.

{
    SYMCRYPT_ALIGN BYTE activeBlock[SYMCRYPT_AES_BLOCK_SIZE];
    const UINT32 nSemiBlocks = cbBuf / SYMCRYPT_AES_SEMIBLOCK_SIZE; // n per SP 800-38F
    UINT64 encryptionIdx = 1;                                       // t per SP 800-38F
    UINT64 lowHalfTemp = 0;
 
    SYMCRYPT_ASSERT((cbBuf & (SYMCRYPT_AES_SEMIBLOCK_SIZE-1)) == 0);
    SYMCRYPT_ASSERT(cbBuf >= SymCryptAesKWMinCiphertextLen);
    SYMCRYPT_ASSERT(cbBuf <= SymCryptAesKWMaxCiphertextLen);
 
    // Special case for first encryption
    // Initialize the low half of active block with the first semi-block of input
    memcpy( activeBlock, pbBuf, SYMCRYPT_AES_SEMIBLOCK_SIZE);
 
    for( UINT32 outerLoopCnt = 0; outerLoopCnt < 6; outerLoopCnt++ )
    {
        for( UINT32 innerLoopCnt = 1; innerLoopCnt < nSemiBlocks; innerLoopCnt++ )
        {
            SIZE_T bufOffset = innerLoopCnt*SYMCRYPT_AES_SEMIBLOCK_SIZE;
 
            // Initialize the high half of active block to semi-block from buf
            memcpy( activeBlock+SYMCRYPT_AES_SEMIBLOCK_SIZE, pbBuf+bufOffset, SYMCRYPT_AES_SEMIBLOCK_SIZE);
 
            // Encrypt activeBlock in place
            SymCryptAesEncrypt( pExpandedKey, activeBlock, activeBlock );
 
            // Store the high half of result back to semi-block from buf
            memcpy( pbBuf+bufOffset, activeBlock+SYMCRYPT_AES_SEMIBLOCK_SIZE, SYMCRYPT_AES_SEMIBLOCK_SIZE );
 
            // Use the low half of the result and the next encryptionIdx to
            // initialize the low half of the next encryption
            lowHalfTemp = SYMCRYPT_LOAD_LSBFIRST64( activeBlock );
            lowHalfTemp ^= SYMCRYPT_BSWAP64( encryptionIdx );
            SYMCRYPT_STORE_LSBFIRST64( activeBlock, lowHalfTemp );
 
            // Update encryptionIdx
            encryptionIdx++;
        }
    }
 
    SYMCRYPT_ASSERT( (encryptionIdx-1) == (nSemiBlocks-1)*6 );
 
    // Special case for last encryption
    // Store the final low half of encryption as the first semi-block of output
    SYMCRYPT_STORE_LSBFIRST64( pbBuf, lowHalfTemp );
 
    SymCryptWipeKnownSize( activeBlock, sizeof(activeBlock) );
}