1 /*
2 * Copyright (C) 2018 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "crypto_toolbox.h"
18
19 #include <bluetooth/log.h>
20 #include <endian.h>
21
22 #include <algorithm>
23
24 #include "hci/octets.h"
25
26 using bluetooth::hci::kOctet16Length;
27 using bluetooth::hci::kOctet32Length;
28 using bluetooth::hci::Octet16;
29
30 namespace crypto_toolbox {
31
h6(const Octet16 & w,std::array<uint8_t,4> keyid)32 Octet16 h6(const Octet16& w, std::array<uint8_t, 4> keyid) {
33 return aes_cmac(w, keyid.data(), keyid.size());
34 }
35
h7(const Octet16 & salt,const Octet16 & w)36 Octet16 h7(const Octet16& salt, const Octet16& w) { return aes_cmac(salt, w.data(), w.size()); }
37
f4(const uint8_t * u,const uint8_t * v,const Octet16 & x,uint8_t z)38 Octet16 f4(const uint8_t* u, const uint8_t* v, const Octet16& x, uint8_t z) {
39 constexpr size_t msg_len =
40 kOctet32Length /* U size */ + kOctet32Length /* V size */ + 1 /* Z size */;
41
42 #if 0
43 log::verbose("U={}, V={}, X={}, Z={:x}", HexEncode(u, kOctet32Length),
44 HexEncode(v, kOctet32Length), HexEncode(x.data(), x.size()), z);
45 #endif
46
47 std::array<uint8_t, msg_len> msg;
48 auto it = msg.begin();
49 it = std::copy(&z, &z + 1, it);
50 it = std::copy(v, v + kOctet32Length, it);
51 it = std::copy(u, u + kOctet32Length, it);
52 return aes_cmac(x, msg.data(), msg.size());
53 }
54
55 /** helper for f5 */
calculate_mac_key_or_ltk(const Octet16 & t,uint8_t counter,uint8_t * key_id,const Octet16 & n1,const Octet16 & n2,uint8_t * a1,uint8_t * a2,uint8_t * length)56 static Octet16 calculate_mac_key_or_ltk(const Octet16& t, uint8_t counter, uint8_t* key_id,
57 const Octet16& n1, const Octet16& n2, uint8_t* a1,
58 uint8_t* a2, uint8_t* length) {
59 constexpr size_t msg_len = 1 /* Counter size */ + 4 /* keyID size */ +
60 kOctet16Length /* N1 size */ + kOctet16Length /* N2 size */ +
61 7 /* A1 size*/ + 7 /* A2 size*/ + 2 /* Length size */;
62
63 std::array<uint8_t, msg_len> msg;
64 auto it = msg.begin();
65 it = std::copy(length, length + 2, it);
66 it = std::copy(a2, a2 + 7, it);
67 it = std::copy(a1, a1 + 7, it);
68 it = std::copy(n2.begin(), n2.end(), it);
69 it = std::copy(n1.begin(), n1.end(), it);
70 it = std::copy(key_id, key_id + 4, it);
71 it = std::copy(&counter, &counter + 1, it);
72
73 return aes_cmac(t, msg.data(), msg.size());
74 }
75
f5(const uint8_t * w,const Octet16 & n1,const Octet16 & n2,uint8_t * a1,uint8_t * a2,Octet16 * mac_key,Octet16 * ltk)76 void f5(const uint8_t* w, const Octet16& n1, const Octet16& n2, uint8_t* a1, uint8_t* a2,
77 Octet16* mac_key, Octet16* ltk) {
78 #if 0
79 log::verbose("W={}, N1={}, N2={}, A1={}, A2={}", HexEncode(w, kOctet32Length),
80 HexEncode(n1.data(), n1.size()), HexEncode(n2.data(), n2.size()),
81 HexEncode(a1, 7), HexEncode(a2, 7));
82 #endif
83
84 const Octet16 salt{0xBE, 0x83, 0x60, 0x5A, 0xDB, 0x0B, 0x37, 0x60,
85 0x38, 0xA5, 0xF5, 0xAA, 0x91, 0x83, 0x88, 0x6C};
86 Octet16 t = aes_cmac(salt, w, kOctet32Length);
87
88 #if 0
89 log::verbose("T={}", HexEncode(t.data(), t.size()));
90 #endif
91
92 uint8_t key_id[4] = {0x65, 0x6c, 0x74, 0x62}; /* 0x62746c65 */
93 uint8_t length[2] = {0x00, 0x01}; /* 0x0100 */
94
95 *mac_key = calculate_mac_key_or_ltk(t, 0, key_id, n1, n2, a1, a2, length);
96
97 *ltk = calculate_mac_key_or_ltk(t, 1, key_id, n1, n2, a1, a2, length);
98
99 #if 0
100 log::verbose("mac_key={}", HexEncode(mac_key->data(), mac_key->size()));
101 log::verbose("ltk={}", HexEncode(ltk->data(), ltk->size()));
102 #endif
103 }
104
f6(const Octet16 & w,const Octet16 & n1,const Octet16 & n2,const Octet16 & r,uint8_t * iocap,uint8_t * a1,uint8_t * a2)105 Octet16 f6(const Octet16& w, const Octet16& n1, const Octet16& n2, const Octet16& r, uint8_t* iocap,
106 uint8_t* a1, uint8_t* a2) {
107 const uint8_t msg_len = kOctet16Length /* N1 size */ + kOctet16Length /* N2 size */ +
108 kOctet16Length /* R size */ + 3 /* IOcap size */ + 7 /* A1 size*/ +
109 7 /* A2 size*/;
110 #if 0
111 log::verbose("W={}, N1={}, N2={}, R={}, IOcap={}, A1={}, A2={}",
112 HexEncode(w.data(), w.size()), HexEncode(n1.data(), n1.size()),
113 HexEncode(n2.data(), n2.size()), HexEncode(r.data(), r.size()),
114 HexEncode(iocap, 3), HexEncode(a1, 7), HexEncode(a2, 7));
115 #endif
116
117 std::array<uint8_t, msg_len> msg;
118 auto it = msg.begin();
119 it = std::copy(a2, a2 + 7, it);
120 it = std::copy(a1, a1 + 7, it);
121 it = std::copy(iocap, iocap + 3, it);
122 it = std::copy(r.begin(), r.end(), it);
123 it = std::copy(n2.begin(), n2.end(), it);
124 it = std::copy(n1.begin(), n1.end(), it);
125
126 return aes_cmac(w, msg.data(), msg.size());
127 }
128
g2(const uint8_t * u,const uint8_t * v,const Octet16 & x,const Octet16 & y)129 uint32_t g2(const uint8_t* u, const uint8_t* v, const Octet16& x, const Octet16& y) {
130 constexpr size_t msg_len = kOctet32Length /* U size */ + kOctet32Length /* V size */
131 + kOctet16Length /* Y size */;
132 #if 0
133 log::verbose("U={}, V={}, X={}, Y={}", HexEncode(u, kOctet32Length),
134 HexEncode(v, kOctet32Length), HexEncode(x.data(), x.size()),
135 HexEncode(y.data(), y.size()));
136 #endif
137
138 std::array<uint8_t, msg_len> msg;
139 auto it = msg.begin();
140 it = std::copy(y.begin(), y.end(), it);
141 it = std::copy(v, v + kOctet32Length, it);
142 it = std::copy(u, u + kOctet32Length, it);
143
144 Octet16 cmac = aes_cmac(x, msg.data(), msg.size());
145
146 /* vres = cmac mod 2**32 mod 10**6 */
147 return le32toh(*(uint32_t*)cmac.data()) % 1000000;
148 }
149
ltk_to_link_key(const Octet16 & ltk,bool use_h7)150 Octet16 ltk_to_link_key(const Octet16& ltk, bool use_h7) {
151 Octet16 ilk; /* intermidiate link key */
152 if (use_h7) {
153 constexpr Octet16 salt{0x31, 0x70, 0x6D, 0x74, 0x00, 0x00, 0x00, 0x00,
154 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
155 ilk = h7(salt, ltk);
156 } else {
157 /* "tmp1" mapping to extended ASCII, little endian*/
158 constexpr std::array<uint8_t, 4> keyID_tmp1 = {0x31, 0x70, 0x6D, 0x74};
159 ilk = h6(ltk, keyID_tmp1);
160 }
161
162 /* "lebr" mapping to extended ASCII, little endian */
163 constexpr std::array<uint8_t, 4> keyID_lebr = {0x72, 0x62, 0x65, 0x6c};
164 return h6(ilk, keyID_lebr);
165 }
166
link_key_to_ltk(const Octet16 & link_key,bool use_h7)167 Octet16 link_key_to_ltk(const Octet16& link_key, bool use_h7) {
168 Octet16 iltk; /* intermidiate long term key */
169 if (use_h7) {
170 constexpr Octet16 salt{0x32, 0x70, 0x6D, 0x74, 0x00, 0x00, 0x00, 0x00,
171 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
172 iltk = h7(salt, link_key);
173 } else {
174 /* "tmp2" mapping to extended ASCII, little endian */
175 constexpr std::array<uint8_t, 4> keyID_tmp2 = {0x32, 0x70, 0x6D, 0x74};
176 iltk = h6(link_key, keyID_tmp2);
177 }
178
179 /* "brle" mapping to extended ASCII, little endian */
180 constexpr std::array<uint8_t, 4> keyID_brle = {0x65, 0x6c, 0x72, 0x62};
181 return h6(iltk, keyID_brle);
182 }
183
c1(const Octet16 & k,const Octet16 & r,const uint8_t * preq,const uint8_t * pres,const uint8_t iat,const uint8_t * ia,const uint8_t rat,const uint8_t * ra)184 Octet16 c1(const Octet16& k, const Octet16& r, const uint8_t* preq, const uint8_t* pres,
185 const uint8_t iat, const uint8_t* ia, const uint8_t rat, const uint8_t* ra) {
186 Octet16 p1;
187 auto it = p1.begin();
188 it = std::copy(&iat, &iat + 1, it);
189 it = std::copy(&rat, &rat + 1, it);
190 it = std::copy(preq, preq + 7, it);
191 it = std::copy(pres, pres + 7, it);
192
193 for (uint8_t i = 0; i < kOctet16Length; i++) {
194 p1[i] = r[i] ^ p1[i];
195 }
196
197 Octet16 p1bis = aes_128(k, p1);
198
199 std::array<uint8_t, 4> padding{0};
200 Octet16 p2;
201 it = p2.begin();
202 it = std::copy(ra, ra + 6, it);
203 it = std::copy(ia, ia + 6, it);
204 it = std::copy(padding.begin(), padding.end(), it);
205
206 for (uint8_t i = 0; i < kOctet16Length; i++) {
207 p2[i] = p1bis[i] ^ p2[i];
208 }
209
210 return aes_128(k, p2);
211 }
212
s1(const Octet16 & k,const Octet16 & r1,const Octet16 & r2)213 Octet16 s1(const Octet16& k, const Octet16& r1, const Octet16& r2) {
214 Octet16 text{0};
215 memcpy(text.data(), r1.data(), kOctet16Length / 2);
216 memcpy(text.data() + kOctet16Length / 2, r2.data(), kOctet16Length / 2);
217
218 return aes_128(k, text);
219 }
220
221 } // namespace crypto_toolbox
222