From e78775eed2be169787199798189ad1e965f8c0a7 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 2 Jul 2020 10:57:00 -0400 Subject: [PATCH 1/2] Use a fake random key in AES calculations Create an additional field in the AES context to store a randomized fake key. Signed-off-by: Andrzej Kurek --- include/mbedtls/aes.h | 1 + library/aes.c | 16 ++++++++++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h index 6990be0ee7..055107ad0e 100644 --- a/include/mbedtls/aes.h +++ b/include/mbedtls/aes.h @@ -87,6 +87,7 @@ typedef struct mbedtls_aes_context { int nr; /*!< The number of rounds. */ uint32_t *rk; /*!< AES round keys. */ + uint32_t frk[8]; /*!< Fake AES round keys. */ #if defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) && !defined(MBEDTLS_PADLOCK_C) uint32_t buf[44]; /*!< Unaligned data buffer */ #else /* MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH */ diff --git a/library/aes.c b/library/aes.c index e9e7544492..03dabd8b53 100644 --- a/library/aes.c +++ b/library/aes.c @@ -675,6 +675,16 @@ void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx ) } #endif /* MBEDTLS_CIPHER_MODE_XTS */ +static void mbedtls_generate_fake_key( unsigned int keybits, mbedtls_aes_context *ctx ) +{ + unsigned int qword; + + for( qword = keybits >> 5; qword > 0; qword-- ) + { + ctx->frk[ qword - 1 ] = mbedtls_platform_random_uint32(); + } +} + /* * AES key schedule (encryption) */ @@ -719,6 +729,7 @@ int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, else #endif ctx->rk = RK = ctx->buf; + mbedtls_generate_fake_key( keybits, ctx ); #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) @@ -858,6 +869,7 @@ int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, else #endif ctx->rk = RK = ctx->buf; + mbedtls_generate_fake_key( keybits, ctx ); /* Also checks keybits */ if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 ) @@ -1071,7 +1083,7 @@ int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, uint8_t round_ctrl_table[( 14 + AES_SCA_CM_ROUNDS + 2 )]; aes_data_real.rk_ptr = ctx->rk; - aes_data_fake.rk_ptr = ctx->rk; + aes_data_fake.rk_ptr = ctx->frk; aes_data_table[0] = &aes_data_real; aes_data_table[1] = &aes_data_fake; @@ -1351,7 +1363,7 @@ int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, uint8_t round_ctrl_table[( 14 + AES_SCA_CM_ROUNDS + 2 )]; aes_data_real.rk_ptr = ctx->rk; - aes_data_fake.rk_ptr = ctx->rk; + aes_data_fake.rk_ptr = ctx->frk; aes_data_table[0] = &aes_data_real; aes_data_table[1] = &aes_data_fake; From fac2f9b4ce90cf9a203dcaa15c44b4290741270d Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Sun, 19 Jul 2020 00:32:34 -0400 Subject: [PATCH 2/2] aes: move the fake key operations to AES_SCA_COUNTERMEASURES define Signed-off-by: Andrzej Kurek --- include/mbedtls/aes.h | 2 ++ library/aes.c | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h index 055107ad0e..cb7d726aef 100644 --- a/include/mbedtls/aes.h +++ b/include/mbedtls/aes.h @@ -87,7 +87,9 @@ typedef struct mbedtls_aes_context { int nr; /*!< The number of rounds. */ uint32_t *rk; /*!< AES round keys. */ +#if defined(MBEDTLS_AES_SCA_COUNTERMEASURES) uint32_t frk[8]; /*!< Fake AES round keys. */ +#endif #if defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) && !defined(MBEDTLS_PADLOCK_C) uint32_t buf[44]; /*!< Unaligned data buffer */ #else /* MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH */ diff --git a/library/aes.c b/library/aes.c index 03dabd8b53..e7a888f1a6 100644 --- a/library/aes.c +++ b/library/aes.c @@ -675,6 +675,7 @@ void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx ) } #endif /* MBEDTLS_CIPHER_MODE_XTS */ +#if defined(MBEDTLS_AES_SCA_COUNTERMEASURES) static void mbedtls_generate_fake_key( unsigned int keybits, mbedtls_aes_context *ctx ) { unsigned int qword; @@ -684,6 +685,7 @@ static void mbedtls_generate_fake_key( unsigned int keybits, mbedtls_aes_context ctx->frk[ qword - 1 ] = mbedtls_platform_random_uint32(); } } +#endif /* MBEDTLS_AES_SCA_COUNTERMEASURES */ /* * AES key schedule (encryption) @@ -729,7 +731,9 @@ int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, else #endif ctx->rk = RK = ctx->buf; +#if defined(MBEDTLS_AES_SCA_COUNTERMEASURES) mbedtls_generate_fake_key( keybits, ctx ); +#endif #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) @@ -869,7 +873,9 @@ int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, else #endif ctx->rk = RK = ctx->buf; +#if defined(MBEDTLS_AES_SCA_COUNTERMEASURES) mbedtls_generate_fake_key( keybits, ctx ); +#endif /* Also checks keybits */ if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 ) @@ -1084,6 +1090,7 @@ int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, aes_data_real.rk_ptr = ctx->rk; aes_data_fake.rk_ptr = ctx->frk; + aes_data_table[0] = &aes_data_real; aes_data_table[1] = &aes_data_fake; @@ -1364,6 +1371,7 @@ int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, aes_data_real.rk_ptr = ctx->rk; aes_data_fake.rk_ptr = ctx->frk; + aes_data_table[0] = &aes_data_real; aes_data_table[1] = &aes_data_fake;