gost_keywrap.c

Go to the documentation of this file.

/**********************************************************************
 *                          keywrap.c                                 *
 *             Copyright (c) 2005-2006 Cryptocom LTD                  *
 *         This file is distributed under the same license as OpenSSL *
 *                                                                    *
 * Implementation of CryptoPro key wrap algorithm, as defined in      *
 *               RFC 4357 p 6.3 and 6.4                               *
 *                  Doesn't need OpenSSL                              *
 **********************************************************************/
#include <string.h>
#include "gost89.h"
#include "gost_keywrap.h"

/* Diversifies key using random UserKey Material
 * Implements RFC 4357 p 6.5 key diversification algorithm 
 * 
 * inputKey - 32byte key to be diversified
 * ukm - 8byte user key material
 * outputKey - 32byte buffer to store diversified key 
 *
 */
void keyDiversifyCryptoPro(gost_ctx *ctx,const unsigned char *inputKey, const unsigned char *ukm, unsigned char *outputKey)
    {

    u4 k,s1,s2;
    int i,j,mask;
    unsigned char S[8];
    memcpy(outputKey,inputKey,32);
    for (i=0;i<8;i++) 
        {
        /* Make array of integers from key */
        /* Compute IV S*/
        s1=0,s2=0;
        for (j=0,mask=1;j<8;j++,mask<<=1) 
            {
            k=((u4)outputKey[4*j])|(outputKey[4*j+1]<<8)|
                (outputKey[4*j+2]<<16)|(outputKey[4*j+3]<<24);
            if (mask & ukm[i]) 
                {
                s1+=k;
                }
            else 
                {
                s2+=k;
                }
            }
        S[0]=(unsigned char)(s1&0xff);
        S[1]=(unsigned char)((s1>>8)&0xff);
        S[2]=(unsigned char)((s1>>16)&0xff);
        S[3]=(unsigned char)((s1>>24)&0xff); 
        S[4]=(unsigned char)(s2&0xff);
        S[5]=(unsigned char)((s2>>8)&0xff);
        S[6]=(unsigned char)((s2>>16)&0xff);
        S[7]=(unsigned char)((s2>>24)&0xff); 
        gost_key(ctx,outputKey);
        gost_enc_cfb(ctx,S,outputKey,outputKey,4);
        }
    }   
    

/*
 * Wraps key using RFC 4357 6.3
 * ctx - gost encryption context, initialized with some S-boxes 
 * keyExchangeKey (KEK) 32-byte (256-bit) shared key
 * ukm - 8 byte (64 bit) user key material, 
 * sessionKey - 32-byte (256-bit) key to be wrapped
 * wrappedKey - 44-byte buffer to store wrapped key
 */ 

int keyWrapCryptoPro(gost_ctx *ctx,const unsigned char *keyExchangeKey, const unsigned char *ukm,
    const   unsigned char *sessionKey, unsigned char *wrappedKey) 
    {
    unsigned char kek_ukm[32];
    keyDiversifyCryptoPro(ctx,keyExchangeKey,ukm,kek_ukm);
    gost_key(ctx,kek_ukm);
    memcpy(wrappedKey,ukm,8);
    gost_enc(ctx,sessionKey,wrappedKey+8,4);
    gost_mac_iv(ctx,32,ukm,sessionKey,32,wrappedKey+40);
    return 1;
    }
/*
 * Unwraps key using RFC 4357 6.4
 * ctx - gost encryption context, initialized with some S-boxes 
 * keyExchangeKey 32-byte shared key
 * wrappedKey  44 byte key to be unwrapped (concatenation of 8-byte UKM,
 * 32 byte  encrypted key and 4 byte MAC  
 * 
 * sessionKEy - 32byte buffer to store sessionKey in
 * Returns 1 if key is decrypted successfully, and 0 if MAC doesn't match
 */ 

int keyUnwrapCryptoPro(gost_ctx *ctx,const unsigned char *keyExchangeKey,
    const unsigned char *wrappedKey, unsigned char *sessionKey) 
    {
    unsigned char kek_ukm[32],cek_mac[4];
    keyDiversifyCryptoPro(ctx,keyExchangeKey,wrappedKey 
        /* First 8 bytes of wrapped Key is ukm */
        ,kek_ukm);
    gost_key(ctx,kek_ukm);
    gost_dec(ctx,wrappedKey+8,sessionKey,4);
    gost_mac_iv(ctx,32,wrappedKey,sessionKey,32,cek_mac);
    if (memcmp(cek_mac,wrappedKey+40,4)) 
        {
        return 0;
        }       
    return 1;       
    }