aes.h (34886B)
1 /* aes.h 2 * 3 * Copyright (C) 2006-2025 wolfSSL Inc. 4 * 5 * This file is part of wolfSSL. 6 * 7 * wolfSSL is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 3 of the License, or 10 * (at your option) any later version. 11 * 12 * wolfSSL is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA 20 */ 21 22 /*! 23 \file wolfssl/wolfcrypt/aes.h 24 */ 25 /* 26 27 DESCRIPTION 28 This library provides the interfaces to the Advanced Encryption Standard (AES) 29 for encrypting and decrypting data. AES is the standard known for a symmetric 30 block cipher mechanism that uses n-bit binary string parameter key with 128-bits, 31 192-bits, and 256-bits of key sizes. 32 33 */ 34 #ifndef WOLF_CRYPT_AES_H 35 #define WOLF_CRYPT_AES_H 36 37 #include <wolfssl/wolfcrypt/types.h> 38 39 #if !defined(NO_AES) || defined(WOLFSSL_SM4) 40 typedef struct Gcm { 41 ALIGN16 byte H[16]; 42 #ifdef OPENSSL_EXTRA 43 word32 aadH[4]; /* additional authenticated data GHASH */ 44 word32 aadLen; /* additional authenticated data len */ 45 #endif 46 #ifdef GCM_TABLE 47 /* key-based fast multiplication table. */ 48 ALIGN16 byte M0[256][16]; 49 #elif defined(GCM_TABLE_4BIT) 50 #if defined(BIG_ENDIAN_ORDER) || defined(WC_16BIT_CPU) 51 ALIGN16 byte M0[16][16]; 52 #else 53 ALIGN16 byte M0[32][16]; 54 #endif 55 #endif /* GCM_TABLE */ 56 } Gcm; 57 58 #if FIPS_VERSION3_GE(6,0,0) 59 extern const unsigned int wolfCrypt_FIPS_aes_ro_sanity[2]; 60 WOLFSSL_LOCAL int wolfCrypt_FIPS_AES_sanity(void); 61 #endif 62 63 WOLFSSL_LOCAL void GenerateM0(Gcm* gcm); 64 #if !defined(__aarch64__) && defined(WOLFSSL_ARMASM) 65 WOLFSSL_LOCAL void GMULT(byte* X, byte* Y); 66 #endif 67 WOLFSSL_LOCAL void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c, 68 word32 cSz, byte* s, word32 sSz); 69 #endif 70 71 #ifndef NO_AES 72 73 #if defined(HAVE_FIPS) && \ 74 defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2) 75 #include <wolfssl/wolfcrypt/fips.h> 76 #endif /* HAVE_FIPS_VERSION >= 2 */ 77 78 #ifndef WC_NO_RNG 79 #include <wolfssl/wolfcrypt/random.h> 80 #endif 81 #ifdef STM32_CRYPTO 82 #include <wolfssl/wolfcrypt/port/st/stm32.h> 83 #endif 84 85 #ifdef WOLFSSL_IMXRT_DCP 86 #include "fsl_dcp.h" 87 #endif 88 89 #ifdef WOLFSSL_XILINX_CRYPT 90 #ifdef WOLFSSL_XILINX_CRYPT_VERSAL 91 #include <wolfssl/wolfcrypt/port/xilinx/xil-versal-glue.h> 92 #include <xsecure_aesclient.h> 93 #if !defined(WOLFSSL_XILINX_AES_KEY_SRC) 94 #define WOLFSSL_XILINX_AES_KEY_SRC XSECURE_AES_USER_KEY_0 95 #endif 96 #else /* versal */ 97 #include <xsecure_aes.h> 98 #if !defined(WOLFSSL_XILINX_AES_KEY_SRC) 99 #define WOLFSSL_XILINX_AES_KEY_SRC XSECURE_CSU_AES_KEY_SRC_KUP 100 #endif 101 #endif /* !versal */ 102 #endif /* WOLFSSL_XILINX_CRYPT */ 103 104 #if defined(WOLFSSL_XILINX_CRYPT) || defined(WOLFSSL_AFALG_XILINX_AES) 105 #if !defined(WOLFSSL_XILINX_AES_KEY_SRC) 106 #define WOLFSSL_XILINX_AES_KEY_SRC 0 107 #endif /* !defined(WOLFSSL_XILINX_AES_KEY_SRC) */ 108 #endif /* all Xilinx crypto */ 109 110 #ifdef WOLFSSL_SE050 111 #include <wolfssl/wolfcrypt/port/nxp/se050_port.h> 112 #endif 113 114 #if defined(WOLFSSL_AFALG) || defined(WOLFSSL_AFALG_XILINX_AES) 115 /* included for struct msghdr */ 116 #include <wolfssl/wolfcrypt/port/af_alg/wc_afalg.h> 117 #endif 118 119 #if defined(WOLFSSL_KCAPI_AES) 120 #include <wolfssl/wolfcrypt/port/kcapi/wc_kcapi.h> 121 #endif 122 123 #if defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC) 124 #include <wolfssl/wolfcrypt/port/devcrypto/wc_devcrypto.h> 125 #endif 126 127 #ifdef WOLFSSL_SILABS_SE_ACCEL 128 #include <wolfssl/wolfcrypt/port/silabs/silabs_aes.h> 129 #endif 130 131 132 #if defined(HAVE_AESGCM) && !defined(WC_NO_RNG) 133 #include <wolfssl/wolfcrypt/random.h> 134 #endif 135 136 #if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES) 137 #include <psa/crypto.h> 138 #endif 139 140 #if defined(WOLFSSL_CRYPTOCELL) 141 #include <wolfssl/wolfcrypt/port/arm/cryptoCell.h> 142 #endif 143 144 #if (defined(WOLFSSL_RENESAS_TSIP_TLS) && \ 145 defined(WOLFSSL_RENESAS_TSIP_TLS_AES_CRYPT)) ||\ 146 defined(WOLFSSL_RENESAS_TSIP_CRYPTONLY) 147 #include <wolfssl/wolfcrypt/port/Renesas/renesas_tsip_types.h> 148 #endif 149 150 #if defined(WOLFSSL_RENESAS_FSPSM) 151 #include <wolfssl/wolfcrypt/port/Renesas/renesas-fspsm-crypt.h> 152 #endif 153 154 #ifdef WOLFSSL_MAXQ10XX_CRYPTO 155 #include <wolfssl/wolfcrypt/port/maxim/maxq10xx.h> 156 #endif 157 158 159 #ifdef __cplusplus 160 extern "C" { 161 #endif 162 163 #ifndef WOLFSSL_AES_KEY_SIZE_ENUM 164 #define WOLFSSL_AES_KEY_SIZE_ENUM 165 /* these are required for FIPS and non-FIPS */ 166 enum { 167 AES_128_KEY_SIZE = 16, /* for 128 bit */ 168 AES_192_KEY_SIZE = 24, /* for 192 bit */ 169 AES_256_KEY_SIZE = 32, /* for 256 bit */ 170 171 AES_IV_SIZE = 16 /* always block size */ 172 }; 173 #endif 174 175 /* avoid redefinition of structs */ 176 #if !defined(HAVE_FIPS) || \ 177 (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)) 178 179 #ifdef WOLFSSL_ASYNC_CRYPT 180 #include <wolfssl/wolfcrypt/async.h> 181 #endif 182 183 enum { 184 AES_ENC_TYPE = WC_CIPHER_AES, /* cipher unique type */ 185 AES_ENCRYPTION = 0, 186 AES_DECRYPTION = 1, 187 #ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS 188 AES_ENCRYPTION_AND_DECRYPTION = 2, 189 #endif 190 191 WC_AES_BLOCK_SIZE = 16, 192 #ifdef OPENSSL_COEXIST 193 /* allow OPENSSL_COEXIST applications to detect absence of AES_BLOCK_SIZE 194 * and presence of WC_AES_BLOCK_SIZE. 195 * 196 * if WC_NO_COMPAT_AES_BLOCK_SIZE is defined, WC_AES_BLOCK_SIZE is 197 * available, otherwise AES_BLOCK_SIZE is available. 198 */ 199 #define WC_NO_COMPAT_AES_BLOCK_SIZE 200 #else 201 #define AES_BLOCK_SIZE WC_AES_BLOCK_SIZE 202 #endif 203 204 KEYWRAP_BLOCK_SIZE = 8, 205 206 GCM_NONCE_MAX_SZ = 16, /* wolfCrypt's maximum nonce size allowed. */ 207 GCM_NONCE_MID_SZ = 12, /* The default nonce size for AES-GCM. */ 208 GCM_NONCE_MIN_SZ = 8, /* wolfCrypt's minimum nonce size allowed. */ 209 CCM_NONCE_MIN_SZ = 7, 210 CCM_NONCE_MAX_SZ = 13, 211 CTR_SZ = 4, 212 AES_IV_FIXED_SZ = 4, 213 #ifdef WOLFSSL_AES_CFB 214 AES_CFB_MODE = 1, 215 #endif 216 #ifdef WOLFSSL_AES_OFB 217 AES_OFB_MODE = 2, 218 #endif 219 #ifdef WOLFSSL_AES_XTS 220 AES_XTS_MODE = 3, 221 #endif 222 223 #ifdef WOLF_PRIVATE_KEY_ID 224 AES_MAX_ID_LEN = 32, 225 AES_MAX_LABEL_LEN = 32, 226 #endif 227 228 WOLF_ENUM_DUMMY_LAST_ELEMENT(AES) 229 }; 230 231 #ifdef WC_AES_BITSLICED 232 #ifdef WC_AES_BS_WORD_SIZE 233 #define BS_WORD_SIZE WC_AES_BS_WORD_SIZE 234 #elif defined(NO_64BIT) 235 #define BS_WORD_SIZE 32 236 #else 237 #define BS_WORD_SIZE 64 238 #endif 239 240 /* Number of bits to a block. */ 241 #define AES_BLOCK_BITS (WC_AES_BLOCK_SIZE * 8) 242 /* Number of bytes of input that can be processed in one call. */ 243 #define BS_BLOCK_SIZE (WC_AES_BLOCK_SIZE * BS_WORD_SIZE) 244 /* Number of words in a block. */ 245 #define BS_BLOCK_WORDS (AES_BLOCK_BITS / BS_WORD_SIZE) 246 247 #if BS_WORD_SIZE == 64 248 typedef word64 bs_word; 249 #define BS_WORD_SHIFT 6 250 #define bs_bswap(x) ByteReverseWord64(x) 251 #elif BS_WORD_SIZE == 32 252 typedef word32 bs_word; 253 #define BS_WORD_SHIFT 5 254 #define bs_bswap(x) ByteReverseWord32(x) 255 #elif BS_WORD_SIZE == 16 256 typedef word16 bs_word; 257 #define BS_WORD_SHIFT 4 258 #define bs_bswap(x) ByteReverseWord16(x) 259 #elif BS_WORD_SIZE == 8 260 typedef word8 bs_word; 261 #define BS_WORD_SHIFT 3 262 #define bs_bswap(x) (x) 263 #else 264 #error "Word size not supported" 265 #endif 266 #endif 267 268 struct Aes { 269 ALIGN16 word32 key[60]; 270 #ifdef WC_AES_BITSLICED 271 /* Extra key schedule space required for bit-slicing technique. */ 272 ALIGN16 bs_word bs_key[15 * WC_AES_BLOCK_SIZE * BS_WORD_SIZE]; 273 #endif 274 word32 rounds; 275 #ifdef WC_C_DYNAMIC_FALLBACK 276 word32 key_C_fallback[60]; 277 #endif 278 int keylen; 279 280 ALIGN16 word32 reg[WC_AES_BLOCK_SIZE / sizeof(word32)]; /* for CBC mode */ 281 ALIGN16 word32 tmp[WC_AES_BLOCK_SIZE / sizeof(word32)]; /* same */ 282 283 #if defined(HAVE_AESGCM) || defined(HAVE_AESCCM) 284 word32 invokeCtr[2]; 285 word32 nonceSz; 286 #endif 287 #ifdef HAVE_AESGCM 288 Gcm gcm; 289 290 #ifdef WOLFSSL_SE050 291 sss_symmetric_t aes_ctx; /* used as the function context */ 292 int ctxInitDone; 293 word32 keyId; 294 byte keyIdSet; 295 byte useSWCrypt; /* Use SW crypt instead of SE050, before SCP03 auth */ 296 #endif 297 #ifdef HAVE_CAVIUM_OCTEON_SYNC 298 word32 y0; 299 #endif 300 #endif /* HAVE_AESGCM */ 301 #ifdef WOLFSSL_CAAM 302 int blackKey; /* black key / hsm key id */ 303 #endif 304 #ifdef WOLFSSL_AESNI 305 byte use_aesni; 306 #if defined(WOLFSSL_LINUXKM) || defined(WC_WANT_FLAG_DONT_USE_AESNI) 307 /* Note, we can't support WC_FLAG_DONT_USE_AESNI by default because we 308 * need to support legacy applications that call wc_AesSetKey() on 309 * uninited struct Aes. For details see the software implementation of 310 * wc_AesSetKeyLocal() (aes.c). 311 */ 312 #define WC_FLAG_DONT_USE_AESNI 2 313 #endif 314 #endif /* WOLFSSL_AESNI */ 315 #if defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \ 316 !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO) 317 byte use_aes_hw_crypto; 318 #ifdef HAVE_AESGCM 319 byte use_pmull_hw_crypto; 320 byte use_sha3_hw_crypto; 321 #endif 322 #endif /* __aarch64__ && WOLFSSL_ARMASM && !WOLFSSL_ARMASM_NO_HW_CRYPTO */ 323 #ifdef WOLF_CRYPTO_CB 324 int devId; 325 void* devCtx; 326 #endif 327 #ifdef WOLF_PRIVATE_KEY_ID 328 byte id[AES_MAX_ID_LEN]; 329 int idLen; 330 char label[AES_MAX_LABEL_LEN]; 331 int labelLen; 332 #endif 333 #ifdef WOLFSSL_ASYNC_CRYPT 334 WC_ASYNC_DEV asyncDev; 335 #endif /* WOLFSSL_ASYNC_CRYPT */ 336 #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \ 337 defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \ 338 defined(WOLFSSL_AES_CTS) 339 word32 left; /* unused bytes left from last call */ 340 #endif 341 #ifdef WOLFSSL_XILINX_CRYPT 342 #ifdef WOLFSSL_XILINX_CRYPT_VERSAL 343 wc_Xsecure xSec; 344 XSecure_AesKeySize xKeySize; 345 int aadStyle; 346 byte keyInit[WOLFSSL_XSECURE_AES_KEY_SIZE] ALIGN64; 347 #else 348 XSecure_Aes xilAes; 349 XCsuDma dma; 350 word32 keyInit[8]; 351 #endif 352 word32 kup; 353 #endif 354 #if defined(WOLFSSL_AFALG) || defined(WOLFSSL_AFALG_XILINX_AES) 355 int alFd; /* server socket to bind to */ 356 int rdFd; /* socket to read from */ 357 struct msghdr msg; 358 int dir; /* flag for encrypt or decrypt */ 359 #ifdef WOLFSSL_AFALG_XILINX_AES 360 word32 msgBuf[CMSG_SPACE(4) + CMSG_SPACE(sizeof(struct af_alg_iv) + 361 GCM_NONCE_MID_SZ)]; 362 #endif 363 #endif 364 #if defined(WOLFSSL_KCAPI_AES) 365 struct kcapi_handle* handle; 366 int init; 367 #endif 368 #if defined(WOLF_CRYPTO_CB) || (defined(WOLFSSL_DEVCRYPTO) && \ 369 (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))) || \ 370 (defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)) || \ 371 defined(WOLFSSL_KCAPI_AES) 372 word32 devKey[AES_MAX_KEY_SIZE/WOLFSSL_BIT_SIZE/sizeof(word32)]; /* raw key */ 373 #ifdef HAVE_CAVIUM_OCTEON_SYNC 374 int keySet; 375 #endif 376 #endif 377 #if defined(WOLFSSL_DEVCRYPTO) && \ 378 (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC)) 379 WC_CRYPTODEV ctx; 380 #endif 381 #if defined(WOLFSSL_CRYPTOCELL) 382 aes_context_t ctx; 383 #endif 384 #if (defined(WOLFSSL_RENESAS_TSIP_TLS) && \ 385 defined(WOLFSSL_RENESAS_TSIP_TLS_AES_CRYPT)) ||\ 386 defined(WOLFSSL_RENESAS_TSIP_CRYPTONLY) 387 TSIP_AES_CTX ctx; 388 #endif 389 #if defined(WOLFSSL_RENESAS_FSPSM) 390 FSPSM_AES_CTX ctx; 391 #endif 392 #if defined(WOLFSSL_IMXRT_DCP) 393 dcp_handle_t handle; 394 #endif 395 #if defined(WOLFSSL_SILABS_SE_ACCEL) 396 silabs_aes_t ctx; 397 #endif 398 #ifdef WOLFSSL_MAXQ10XX_CRYPTO 399 maxq_aes_t maxq_ctx; 400 #endif 401 #if defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES) 402 psa_key_id_t key_id; 403 psa_cipher_operation_t psa_ctx; 404 int ctx_initialized; 405 int key_need_importing; 406 #endif 407 void* heap; /* memory hint to use */ 408 #ifdef WOLFSSL_AESGCM_STREAM 409 #if !defined(WOLFSSL_SMALL_STACK) || defined(WOLFSSL_AESNI) 410 ALIGN16 byte streamData[5 * WC_AES_BLOCK_SIZE]; 411 #else 412 byte* streamData; 413 word32 streamData_sz; 414 #endif 415 word32 aSz; 416 word32 cSz; 417 byte over; 418 byte aOver; 419 byte cOver; 420 WC_BITFIELD gcmKeySet:1; 421 WC_BITFIELD nonceSet:1; 422 WC_BITFIELD ctrSet:1; 423 #endif 424 #ifdef WC_DEBUG_CIPHER_LIFECYCLE 425 void *CipherLifecycleTag; /* used for dummy allocation and initialization, 426 * trackable by sanitizers. 427 */ 428 #endif 429 #ifdef WOLFSSL_AES_CTS 430 byte ctsBlock[WC_AES_BLOCK_SIZE * 2]; 431 #endif 432 }; 433 434 #ifndef WC_AES_TYPE_DEFINED 435 typedef struct Aes Aes; 436 #define WC_AES_TYPE_DEFINED 437 #endif 438 439 #ifdef WOLFSSL_AES_XTS 440 #if FIPS_VERSION3_GE(6,0,0) 441 /* SP800-38E - Restrict data unit to 2^20 blocks per key. A block is 442 * WC_AES_BLOCK_SIZE or 16-bytes (128-bits). So each key may only be used to 443 * protect up to 1,048,576 blocks of WC_AES_BLOCK_SIZE (16,777,216 bytes) 444 */ 445 #define FIPS_AES_XTS_MAX_BYTES_PER_TWEAK 16777216 446 #endif 447 struct XtsAes { 448 Aes aes; 449 #ifdef WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS 450 Aes aes_decrypt; 451 #endif 452 Aes tweak; 453 }; 454 455 #ifdef WOLFSSL_AESXTS_STREAM 456 struct XtsAesStreamData { 457 byte tweak_block[WC_AES_BLOCK_SIZE]; 458 word32 bytes_crypted_with_this_tweak; 459 }; 460 #endif 461 462 #ifndef WC_AESXTS_TYPE_DEFINED 463 typedef struct XtsAes XtsAes; 464 typedef struct XtsAesStreamData XtsAesStreamData; 465 #define WC_AESXTS_TYPE_DEFINED 466 #endif 467 468 #endif 469 470 471 #if (!defined(WC_AESFREE_IS_MANDATORY)) && \ 472 (defined(WC_DEBUG_CIPHER_LIFECYCLE) || \ 473 (defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)) || \ 474 defined(WOLFSSL_AFALG) || defined(WOLFSSL_AFALG_XILINX_AES) || \ 475 defined(WOLFSSL_KCAPI_AES) || \ 476 (defined(WOLFSSL_DEVCRYPTO) && \ 477 (defined(WOLFSSL_DEVCRYPTO_AES) || \ 478 defined(WOLFSSL_DEVCRYPTO_CBC))) || \ 479 defined(WOLFSSL_IMXRT_DCP) || \ 480 (defined(WOLFSSL_AESGCM_STREAM) && defined(WOLFSSL_SMALL_STACK) && \ 481 !defined(WOLFSSL_AESNI)) || \ 482 (defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)) || \ 483 (defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)) || \ 484 defined(WOLFSSL_MAXQ10XX_CRYPTO) || \ 485 ((defined(WOLFSSL_RENESAS_FSPSM_TLS) || \ 486 defined(WOLFSSL_RENESAS_FSPSM_CRYPTONLY)) && \ 487 !defined(NO_WOLFSSL_RENESAS_FSPSM_AES))) 488 #define WC_AESFREE_IS_MANDATORY 489 #endif 490 491 #ifdef HAVE_AESGCM 492 struct Gmac { 493 Aes aes; 494 }; 495 496 #ifndef WC_AESGCM_TYPE_DEFINED 497 typedef struct Gmac Gmac; 498 #define WC_AESGCM_TYPE_DEFINED 499 #endif 500 501 #endif /* HAVE_AESGCM */ 502 #endif /* HAVE_FIPS */ 503 504 505 /* Authenticate cipher function prototypes */ 506 typedef int (*wc_AesAuthEncryptFunc)(Aes* aes, byte* out, 507 const byte* in, word32 sz, 508 const byte* iv, word32 ivSz, 509 byte* authTag, word32 authTagSz, 510 const byte* authIn, word32 authInSz); 511 typedef int (*wc_AesAuthDecryptFunc)(Aes* aes, byte* out, 512 const byte* in, word32 sz, 513 const byte* iv, word32 ivSz, 514 const byte* authTag, word32 authTagSz, 515 const byte* authIn, word32 authInSz); 516 517 /* AES-CBC */ 518 WOLFSSL_API int wc_AesSetKey(Aes* aes, const byte* key, word32 len, 519 const byte* iv, int dir); 520 WOLFSSL_API int wc_AesSetIV(Aes* aes, const byte* iv); 521 522 #ifdef HAVE_AES_CBC 523 WOLFSSL_API int wc_AesCbcEncrypt(Aes* aes, byte* out, 524 const byte* in, word32 sz); 525 WOLFSSL_API int wc_AesCbcDecrypt(Aes* aes, byte* out, 526 const byte* in, word32 sz); 527 #endif 528 529 #ifdef WOLFSSL_AES_CFB 530 WOLFSSL_API int wc_AesCfbEncrypt(Aes* aes, byte* out, 531 const byte* in, word32 sz); 532 WOLFSSL_API int wc_AesCfb1Encrypt(Aes* aes, byte* out, 533 const byte* in, word32 sz); 534 WOLFSSL_API int wc_AesCfb8Encrypt(Aes* aes, byte* out, 535 const byte* in, word32 sz); 536 #ifdef HAVE_AES_DECRYPT 537 WOLFSSL_API int wc_AesCfbDecrypt(Aes* aes, byte* out, 538 const byte* in, word32 sz); 539 WOLFSSL_API int wc_AesCfb1Decrypt(Aes* aes, byte* out, 540 const byte* in, word32 sz); 541 WOLFSSL_API int wc_AesCfb8Decrypt(Aes* aes, byte* out, 542 const byte* in, word32 sz); 543 #endif /* HAVE_AES_DECRYPT */ 544 #endif /* WOLFSSL_AES_CFB */ 545 546 #ifdef WOLFSSL_AES_OFB 547 WOLFSSL_API int wc_AesOfbEncrypt(Aes* aes, byte* out, 548 const byte* in, word32 sz); 549 #ifdef HAVE_AES_DECRYPT 550 WOLFSSL_API int wc_AesOfbDecrypt(Aes* aes, byte* out, 551 const byte* in, word32 sz); 552 #endif /* HAVE_AES_DECRYPT */ 553 #endif /* WOLFSSL_AES_OFB */ 554 555 #ifdef HAVE_AES_ECB 556 WOLFSSL_API int wc_AesEcbEncrypt(Aes* aes, byte* out, 557 const byte* in, word32 sz); 558 WOLFSSL_API int wc_AesEcbDecrypt(Aes* aes, byte* out, 559 const byte* in, word32 sz); 560 #endif 561 562 /* AES-CTR */ 563 #ifdef WOLFSSL_AES_COUNTER 564 WOLFSSL_API int wc_AesCtrEncrypt(Aes* aes, byte* out, 565 const byte* in, word32 sz); 566 WOLFSSL_API int wc_AesCtrSetKey(Aes* aes, const byte* key, word32 len, 567 const byte* iv, int dir); 568 569 #endif 570 /* AES-DIRECT */ 571 #if defined(WOLFSSL_AES_DIRECT) 572 #if defined(BUILDING_WOLFSSL) 573 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesEncryptDirect(Aes* aes, byte* out, 574 const byte* in); 575 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesDecryptDirect(Aes* aes, byte* out, 576 const byte* in); 577 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesSetKeyDirect(Aes* aes, 578 const byte* key, 579 word32 len, 580 const byte* iv, int dir); 581 #else 582 WOLFSSL_API int wc_AesEncryptDirect(Aes* aes, byte* out, const byte* in); 583 WOLFSSL_API int wc_AesDecryptDirect(Aes* aes, byte* out, const byte* in); 584 WOLFSSL_API int wc_AesSetKeyDirect(Aes* aes, const byte* key, word32 len, 585 const byte* iv, int dir); 586 #endif 587 #endif 588 589 #ifdef HAVE_AESGCM 590 #ifdef WOLFSSL_XILINX_CRYPT 591 WOLFSSL_API int wc_AesGcmSetKey_ex(Aes* aes, const byte* key, word32 len, 592 word32 kup); 593 #elif defined(WOLFSSL_AFALG_XILINX_AES) 594 WOLFSSL_LOCAL int wc_AesGcmSetKey_ex(Aes* aes, const byte* key, word32 len, 595 word32 kup); 596 #endif 597 WOLFSSL_API int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len); 598 WOLFSSL_API int wc_AesGcmEncrypt(Aes* aes, byte* out, 599 const byte* in, word32 sz, 600 const byte* iv, word32 ivSz, 601 byte* authTag, word32 authTagSz, 602 const byte* authIn, word32 authInSz); 603 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesGcmDecrypt(Aes* aes, byte* out, 604 const byte* in, word32 sz, 605 const byte* iv, word32 ivSz, 606 const byte* authTag, word32 authTagSz, 607 const byte* authIn, word32 authInSz); 608 #ifdef WOLFSSL_AESGCM_STREAM 609 WOLFSSL_API int wc_AesGcmInit(Aes* aes, const byte* key, word32 len, 610 const byte* iv, word32 ivSz); 611 612 WOLFSSL_API int wc_AesGcmEncryptInit(Aes* aes, const byte* key, word32 len, 613 const byte* iv, word32 ivSz); 614 WOLFSSL_API int wc_AesGcmEncryptInit_ex(Aes* aes, const byte* key, word32 len, 615 byte* ivOut, word32 ivOutSz); 616 WOLFSSL_API int wc_AesGcmEncryptUpdate(Aes* aes, byte* out, const byte* in, 617 word32 sz, const byte* authIn, word32 authInSz); 618 WOLFSSL_API int wc_AesGcmEncryptFinal(Aes* aes, byte* authTag, 619 word32 authTagSz); 620 621 WOLFSSL_API int wc_AesGcmDecryptInit(Aes* aes, const byte* key, word32 len, 622 const byte* iv, word32 ivSz); 623 WOLFSSL_API int wc_AesGcmDecryptUpdate(Aes* aes, byte* out, const byte* in, 624 word32 sz, const byte* authIn, word32 authInSz); 625 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesGcmDecryptFinal(Aes* aes, 626 const byte* authTag, word32 authTagSz); 627 #endif 628 629 #ifndef WC_NO_RNG 630 WOLFSSL_API int wc_AesGcmSetExtIV(Aes* aes, const byte* iv, word32 ivSz); 631 WOLFSSL_API int wc_AesGcmSetIV(Aes* aes, word32 ivSz, 632 const byte* ivFixed, word32 ivFixedSz, 633 WC_RNG* rng); 634 WOLFSSL_API int wc_AesGcmEncrypt_ex(Aes* aes, byte* out, 635 const byte* in, word32 sz, 636 byte* ivOut, word32 ivOutSz, 637 byte* authTag, word32 authTagSz, 638 const byte* authIn, word32 authInSz); 639 #endif /* WC_NO_RNG */ 640 641 WOLFSSL_API int wc_GmacSetKey(Gmac* gmac, const byte* key, word32 len); 642 WOLFSSL_API int wc_GmacUpdate(Gmac* gmac, const byte* iv, word32 ivSz, 643 const byte* authIn, word32 authInSz, 644 byte* authTag, word32 authTagSz); 645 #ifndef WC_NO_RNG 646 WOLFSSL_API int wc_Gmac(const byte* key, word32 keySz, byte* iv, word32 ivSz, 647 const byte* authIn, word32 authInSz, 648 byte* authTag, word32 authTagSz, WC_RNG* rng); 649 WOLFSSL_API int wc_GmacVerify(const byte* key, word32 keySz, 650 const byte* iv, word32 ivSz, 651 const byte* authIn, word32 authInSz, 652 const byte* authTag, word32 authTagSz); 653 #endif /* WC_NO_RNG */ 654 #endif /* HAVE_AESGCM */ 655 #ifdef HAVE_AESCCM 656 WOLFSSL_LOCAL int wc_AesCcmCheckTagSize(int sz); 657 WOLFSSL_API int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz); 658 WOLFSSL_API int wc_AesCcmEncrypt(Aes* aes, byte* out, 659 const byte* in, word32 inSz, 660 const byte* nonce, word32 nonceSz, 661 byte* authTag, word32 authTagSz, 662 const byte* authIn, word32 authInSz); 663 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesCcmDecrypt(Aes* aes, byte* out, 664 const byte* in, word32 inSz, 665 const byte* nonce, word32 nonceSz, 666 const byte* authTag, word32 authTagSz, 667 const byte* authIn, word32 authInSz); 668 WOLFSSL_API int wc_AesCcmSetNonce(Aes* aes, 669 const byte* nonce, word32 nonceSz); 670 WOLFSSL_API int wc_AesCcmEncrypt_ex(Aes* aes, byte* out, 671 const byte* in, word32 sz, 672 byte* ivOut, word32 ivOutSz, 673 byte* authTag, word32 authTagSz, 674 const byte* authIn, word32 authInSz); 675 #endif /* HAVE_AESCCM */ 676 677 #ifdef HAVE_AES_KEYWRAP 678 WOLFSSL_API int wc_AesKeyWrap(const byte* key, word32 keySz, 679 const byte* in, word32 inSz, 680 byte* out, word32 outSz, 681 const byte* iv); 682 WOLFSSL_API int wc_AesKeyWrap_ex(Aes *aes, 683 const byte* in, word32 inSz, 684 byte* out, word32 outSz, 685 const byte* iv); 686 WOLFSSL_API int wc_AesKeyUnWrap(const byte* key, word32 keySz, 687 const byte* in, word32 inSz, 688 byte* out, word32 outSz, 689 const byte* iv); 690 WOLFSSL_API int wc_AesKeyUnWrap_ex(Aes *aes, 691 const byte* in, word32 inSz, 692 byte* out, word32 outSz, 693 const byte* iv); 694 #endif /* HAVE_AES_KEYWRAP */ 695 696 #ifdef WOLFSSL_AES_XTS 697 698 WOLFSSL_API int wc_AesXtsInit(XtsAes* aes, void* heap, int devId); 699 700 WOLFSSL_API int wc_AesXtsSetKeyNoInit(XtsAes* aes, const byte* key, 701 word32 len, int dir); 702 703 WOLFSSL_API int wc_AesXtsSetKey(XtsAes* aes, const byte* key, 704 word32 len, int dir, void* heap, int devId); 705 706 WOLFSSL_API int wc_AesXtsEncryptSector(XtsAes* aes, byte* out, 707 const byte* in, word32 sz, word64 sector); 708 709 WOLFSSL_API int wc_AesXtsDecryptSector(XtsAes* aes, byte* out, 710 const byte* in, word32 sz, word64 sector); 711 712 WOLFSSL_API int wc_AesXtsEncrypt(XtsAes* aes, byte* out, 713 const byte* in, word32 sz, const byte* i, word32 iSz); 714 715 WOLFSSL_API int wc_AesXtsDecrypt(XtsAes* aes, byte* out, 716 const byte* in, word32 sz, const byte* i, word32 iSz); 717 718 WOLFSSL_API int wc_AesXtsEncryptConsecutiveSectors(XtsAes* aes, 719 byte* out, const byte* in, word32 sz, word64 sector, 720 word32 sectorSz); 721 722 WOLFSSL_API int wc_AesXtsDecryptConsecutiveSectors(XtsAes* aes, 723 byte* out, const byte* in, word32 sz, word64 sector, 724 word32 sectorSz); 725 726 #ifdef WOLFSSL_AESXTS_STREAM 727 728 WOLFSSL_API int wc_AesXtsEncryptInit(XtsAes* aes, const byte* i, word32 iSz, 729 struct XtsAesStreamData *stream); 730 731 WOLFSSL_API int wc_AesXtsDecryptInit(XtsAes* aes, const byte* i, word32 iSz, 732 struct XtsAesStreamData *stream); 733 734 WOLFSSL_API int wc_AesXtsEncryptUpdate(XtsAes* aes, byte* out, 735 const byte* in, word32 sz, struct XtsAesStreamData *stream); 736 737 WOLFSSL_API int wc_AesXtsDecryptUpdate(XtsAes* aes, byte* out, 738 const byte* in, word32 sz, struct XtsAesStreamData *stream); 739 740 WOLFSSL_API int wc_AesXtsEncryptFinal(XtsAes* aes, byte* out, 741 const byte* in, word32 sz, struct XtsAesStreamData *stream); 742 743 WOLFSSL_API int wc_AesXtsDecryptFinal(XtsAes* aes, byte* out, 744 const byte* in, word32 sz, struct XtsAesStreamData *stream); 745 746 #endif /* WOLFSSL_AESXTS_STREAM */ 747 748 WOLFSSL_API int wc_AesXtsFree(XtsAes* aes); 749 #endif 750 751 WOLFSSL_API int wc_AesGetKeySize(Aes* aes, word32* keySize); 752 753 WOLFSSL_API int wc_AesInit(Aes* aes, void* heap, int devId); 754 #ifdef WOLF_PRIVATE_KEY_ID 755 WOLFSSL_API int wc_AesInit_Id(Aes* aes, unsigned char* id, int len, void* heap, 756 int devId); 757 WOLFSSL_API int wc_AesInit_Label(Aes* aes, const char* label, void* heap, 758 int devId); 759 #endif 760 WOLFSSL_API void wc_AesFree(Aes* aes); 761 #ifndef WC_NO_CONSTRUCTORS 762 WOLFSSL_API Aes* wc_AesNew(void* heap, int devId, int *result_code); 763 WOLFSSL_API int wc_AesDelete(Aes* aes, Aes** aes_p); 764 #endif 765 766 #ifdef WOLFSSL_AES_SIV 767 typedef struct AesSivAssoc { 768 const byte* assoc; 769 word32 assocSz; 770 } AesSivAssoc; 771 772 WOLFSSL_API 773 int wc_AesSivEncrypt(const byte* key, word32 keySz, const byte* assoc, 774 word32 assocSz, const byte* nonce, word32 nonceSz, 775 const byte* in, word32 inSz, byte* siv, byte* out); 776 WOLFSSL_API WARN_UNUSED_RESULT 777 int wc_AesSivDecrypt(const byte* key, word32 keySz, const byte* assoc, 778 word32 assocSz, const byte* nonce, word32 nonceSz, 779 const byte* in, word32 inSz, byte* siv, byte* out); 780 781 WOLFSSL_API 782 int wc_AesSivEncrypt_ex(const byte* key, word32 keySz, const AesSivAssoc* assoc, 783 word32 numAssoc, const byte* nonce, word32 nonceSz, 784 const byte* in, word32 inSz, byte* siv, byte* out); 785 WOLFSSL_API WARN_UNUSED_RESULT 786 int wc_AesSivDecrypt_ex(const byte* key, word32 keySz, const AesSivAssoc* assoc, 787 word32 numAssoc, const byte* nonce, word32 nonceSz, 788 const byte* in, word32 inSz, byte* siv, byte* out); 789 #endif 790 791 #ifdef WOLFSSL_AES_EAX 792 793 /* Because of the circular dependency between AES and CMAC, we need to prevent 794 * inclusion of AES EAX from CMAC to avoid a recursive inclusion */ 795 #ifndef WOLF_CRYPT_CMAC_H 796 #include <wolfssl/wolfcrypt/cmac.h> 797 struct AesEax { 798 Aes aes; 799 Cmac nonceCmac; 800 Cmac aadCmac; 801 Cmac ciphertextCmac; 802 byte nonceCmacFinal[WC_AES_BLOCK_SIZE]; 803 byte aadCmacFinal[WC_AES_BLOCK_SIZE]; 804 byte ciphertextCmacFinal[WC_AES_BLOCK_SIZE]; 805 byte prefixBuf[WC_AES_BLOCK_SIZE]; 806 }; 807 #endif /* !defined(WOLF_CRYPT_CMAC_H) */ 808 809 typedef struct AesEax AesEax; 810 811 /* One-shot API */ 812 WOLFSSL_API int wc_AesEaxEncryptAuth(const byte* key, word32 keySz, byte* out, 813 const byte* in, word32 inSz, 814 const byte* nonce, word32 nonceSz, 815 /* output computed auth tag */ 816 byte* authTag, word32 authTagSz, 817 /* input data to authenticate (header) */ 818 const byte* authIn, word32 authInSz); 819 820 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesEaxDecryptAuth(const byte* key, 821 word32 keySz, byte* out, 822 const byte* in, word32 inSz, 823 const byte* nonce, word32 nonceSz, 824 /* auth tag to verify against */ 825 const byte* authTag, word32 authTagSz, 826 /* input data to authenticate (header) */ 827 const byte* authIn, word32 authInSz); 828 829 /* Incremental API */ 830 WOLFSSL_API int wc_AesEaxInit(AesEax* eax, 831 const byte* key, word32 keySz, 832 const byte* nonce, word32 nonceSz, 833 const byte* authIn, word32 authInSz); 834 835 WOLFSSL_API int wc_AesEaxEncryptUpdate(AesEax* eax, byte* out, 836 const byte* in, word32 inSz, 837 const byte* authIn, word32 authInSz); 838 839 WOLFSSL_API int wc_AesEaxDecryptUpdate(AesEax* eax, byte* out, 840 const byte* in, word32 inSz, 841 const byte* authIn, word32 authInSz); 842 843 WOLFSSL_API int wc_AesEaxAuthDataUpdate(AesEax* eax, 844 const byte* authIn, word32 authInSz); 845 846 WOLFSSL_API int wc_AesEaxEncryptFinal(AesEax* eax, 847 byte* authTag, word32 authTagSz); 848 849 WOLFSSL_API WARN_UNUSED_RESULT int wc_AesEaxDecryptFinal(AesEax* eax, 850 const byte* authIn, word32 authInSz); 851 852 WOLFSSL_API int wc_AesEaxFree(AesEax* eax); 853 854 #endif /* WOLFSSL_AES_EAX */ 855 856 #ifdef WOLFSSL_AES_CTS 857 /* Ciphertext stealing encryption compatible with RFC2040 and RFC3962. */ 858 859 /* One-shot API */ 860 WOLFSSL_API int wc_AesCtsEncrypt(const byte* key, word32 keySz, byte* out, 861 const byte* in, word32 inSz, 862 const byte* iv); 863 WOLFSSL_API int wc_AesCtsDecrypt(const byte* key, word32 keySz, byte* out, 864 const byte* in, word32 inSz, 865 const byte* iv); 866 867 /* Incremental API */ 868 WOLFSSL_API int wc_AesCtsEncryptUpdate(Aes* aes, byte* out, word32* outSz, 869 const byte* in, word32 inSz); 870 WOLFSSL_API int wc_AesCtsDecryptUpdate(Aes* aes, byte* out, word32* outSz, 871 const byte* in, word32 inSz); 872 WOLFSSL_API int wc_AesCtsEncryptFinal(Aes* aes, byte* out, word32* outSz); 873 WOLFSSL_API int wc_AesCtsDecryptFinal(Aes* aes, byte* out, word32* outSz); 874 875 876 #endif 877 878 #if defined(__aarch64__) && defined(WOLFSSL_ARMASM) && \ 879 !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO) 880 881 /* GHASH one block of data. 882 * 883 * XOR block into tag and GMULT with H. 884 * 885 * @param [in, out] aes AES GCM object. 886 * @param [in] block Block of AAD or cipher text. 887 */ 888 #define GHASH_ONE_BLOCK_AARCH64(aes, block) \ 889 do { \ 890 xorbuf(AES_TAG(aes), block, WC_AES_BLOCK_SIZE); \ 891 GMULT_AARCH64(AES_TAG(aes), aes->gcm.H); \ 892 } \ 893 while (0) 894 895 WOLFSSL_LOCAL int AES_set_key_AARCH64(const unsigned char *userKey, 896 const int keylen, Aes* aes, int dir); 897 WOLFSSL_LOCAL void AES_encrypt_AARCH64(const byte* inBlock, byte* outBlock, 898 byte* key, int nr); 899 WOLFSSL_LOCAL void AES_decrypt_AARCH64(const byte* inBlock, byte* outBlock, 900 byte* key, int nr); 901 WOLFSSL_LOCAL void AES_CBC_encrypt_AARCH64(const byte* in, byte* out, word32 sz, 902 byte* reg, byte* key, int rounds); 903 WOLFSSL_LOCAL void AES_CBC_decrypt_AARCH64(const byte* in, byte* out, word32 sz, 904 byte* reg, byte* key, int rounds); 905 WOLFSSL_LOCAL void AES_CTR_encrypt_AARCH64(Aes* aes, byte* out, const byte* in, 906 word32 sz); 907 WOLFSSL_LOCAL void GMULT_AARCH64(byte* X, byte* Y); 908 #ifdef WOLFSSL_AESGCM_STREAM 909 WOLFSSL_LOCAL void GHASH_UPDATE_AARCH64(Aes* aes, const byte* a, word32 aSz, 910 const byte* c, word32 cSz); 911 WOLFSSL_LOCAL void AES_GCM_init_AARCH64(Aes* aes, const byte* iv, word32 ivSz); 912 WOLFSSL_LOCAL void AES_GCM_crypt_update_AARCH64(Aes* aes, byte* out, 913 const byte* in, word32 sz); 914 WOLFSSL_LOCAL void AES_GCM_final_AARCH64(Aes* aes, byte* authTag, 915 word32 authTagSz); 916 #endif 917 WOLFSSL_LOCAL void AES_GCM_set_key_AARCH64(Aes* aes, byte* iv); 918 WOLFSSL_LOCAL void AES_GCM_encrypt_AARCH64(Aes* aes, byte* out, const byte* in, 919 word32 sz, const byte* iv, word32 ivSz, byte* authTag, word32 authTagSz, 920 const byte* authIn, word32 authInSz); 921 WOLFSSL_LOCAL int AES_GCM_decrypt_AARCH64(Aes* aes, byte* out, const byte* in, 922 word32 sz, const byte* iv, word32 ivSz, const byte* authTag, 923 word32 authTagSz, const byte* authIn, word32 authInSz); 924 925 #ifdef WOLFSSL_AES_XTS 926 WOLFSSL_LOCAL void AES_XTS_encrypt_AARCH64(XtsAes* xaes, byte* out, 927 const byte* in, word32 sz, const byte* i); 928 WOLFSSL_LOCAL void AES_XTS_decrypt_AARCH64(XtsAes* xaes, byte* out, 929 const byte* in, word32 sz, const byte* i); 930 #endif /* WOLFSSL_AES_XTS */ 931 #endif /* __aarch64__ && WOLFSSL_ARMASM && !WOLFSSL_ARMASM_NO_HW_CRYPTO */ 932 933 #ifdef __cplusplus 934 } /* extern "C" */ 935 #endif 936 937 938 #endif /* NO_AES */ 939 #endif /* WOLF_CRYPT_AES_H */