NimBLE: Add mbedTLS support as an option to Tinycrypt

- Adds option to use mbedTLS instead of tinycrypt for crypto algorithms,
  includes changes related to NimBLE `ble_mesh` as well.

nimble/host/mesh/include/mesh/glue.h

@@ -37,11 +37,22 @@
 #include "../src/ble_sm_priv.h"
 #include "../src/ble_hs_hci_priv.h"
 
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+#include "mbedtls/aes.h"
+#include "mbedtls/cipher.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/cmac.h"
+#include "mbedtls/ecdh.h"
+#include "mbedtls/ecp.h"
+
+#else
 #include "tinycrypt/aes.h"
 #include "tinycrypt/constants.h"
 #include "tinycrypt/utils.h"
 #include "tinycrypt/cmac_mode.h"
 #include "tinycrypt/ecc_dh.h"
+#endif
 
 #if MYNEWT_VAL(BLE_MESH_SETTINGS)
 #include "config/config.h"

nimble/host/mesh/src/crypto.c

@@ -12,20 +12,75 @@
 #include <string.h>
 #include <stdbool.h>
 #include <errno.h>
+#include "syscfg/syscfg.h"
 
+#if (MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS))
+#include "mbedtls/aes.h"
+#include "mbedtls/cipher.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/cmac.h"
+#include "mbedtls/ecdh.h"
+#include "mbedtls/ecp.h"
+
+#else
 #include <tinycrypt/constants.h>
 #include <tinycrypt/utils.h>
 #include <tinycrypt/aes.h>
 #include <tinycrypt/cmac_mode.h>
 #include <tinycrypt/ccm_mode.h>
+#endif
 
 #include "crypto.h"
 
 #define NET_MIC_LEN(pdu) (((pdu)[1] & 0x80) ? 8 : 4)
 #define APP_MIC_LEN(aszmic) ((aszmic) ? 8 : 4)
 
-int bt_mesh_aes_cmac(const uint8_t key[16], struct bt_mesh_sg *sg,
-		     size_t sg_len, uint8_t mac[16])
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+int bt_mesh_aes_cmac(const u8_t key[16], struct bt_mesh_sg *sg,
+		     size_t sg_len, u8_t mac[16])
+{
+    int rc = BLE_HS_EUNKNOWN;
+    mbedtls_cipher_context_t ctx = {0};
+    const mbedtls_cipher_info_t *cipher_info;
+
+    mbedtls_cipher_init(&ctx);
+
+    cipher_info = mbedtls_cipher_info_from_type(MBEDTLS_CIPHER_AES_128_ECB);
+    if (cipher_info == NULL) {
+        goto exit;
+    }
+
+    if (mbedtls_cipher_setup(&ctx, cipher_info) != 0) {
+        goto exit;
+    }
+
+    rc = mbedtls_cipher_cmac_starts(&ctx, key, 128);
+    if (rc != 0) {
+        goto exit;
+    }
+
+    for (; sg_len; sg_len--, sg++) {
+        if (sg->len != 0 && sg->data != NULL) {
+            if ((rc = mbedtls_cipher_cmac_update(&ctx, sg->data, sg->len)) != 0) {
+                goto exit;
+            }
+        }
+    }
+    rc = mbedtls_cipher_cmac_finish(&ctx, mac);
+
+exit:
+    mbedtls_cipher_free(&ctx);
+    if (rc != 0) {
+        return -EIO;
+    }
+
+    return 0;
+}
+
+#else
+int bt_mesh_aes_cmac(const u8_t key[16], struct bt_mesh_sg *sg,
+		     size_t sg_len, u8_t mac[16])
 {
 	struct tc_aes_key_sched_struct sched;
 	struct tc_cmac_struct state;
@@ -47,6 +102,7 @@ int bt_mesh_aes_cmac(const uint8_t key[16], struct bt_mesh_sg *sg,
 
 	return 0;
 }
+#endif
 
 int bt_mesh_k1(const uint8_t *ikm, size_t ikm_len, const uint8_t salt[16],
 	       const char *info, uint8_t okm[16])

nimble/host/mesh/src/glue.c

@@ -117,7 +117,6 @@ free:
     os_mbuf_free_chain(om);
 }
 
-
 void net_buf_simple_clone(const struct os_mbuf *original,
 	struct os_mbuf *clone)
 {
@@ -125,10 +124,29 @@ void net_buf_simple_clone(const struct os_mbuf *original,
 }
 
 
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
 int
 bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
 {
-    struct tc_aes_key_sched_struct s;
+    mbedtls_aes_context s = {0};
+    mbedtls_aes_init(&s);
+
+    if (mbedtls_aes_setkey_enc(&s, key, 128) != 0) {
+        return BLE_HS_EUNKNOWN;
+    }
+
+    if (mbedtls_aes_crypt_ecb(&s, MBEDTLS_AES_ENCRYPT, plaintext, enc_data) != 0) {
+        return BLE_HS_EUNKNOWN;
+    }
+
+    return 0;
+}
+
+#else
+int
+bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
+{
+    struct tc_aes_key_sched_struct s = {0};
 
     if (tc_aes128_set_encrypt_key(&s, key) == TC_CRYPTO_FAIL) {
         return BLE_HS_EUNKNOWN;
@@ -140,6 +158,7 @@ bt_encrypt_be(const uint8_t *key, const uint8_t *plaintext, uint8_t *enc_data)
 
     return 0;
 }
+#endif
 
 uint16_t
 net_buf_simple_pull_le16(struct os_mbuf *om)

nimble/host/src/ble_sm_alg.c

@@ -28,6 +28,20 @@
 
 #include "nimble/ble.h"
 #include "ble_hs_priv.h"
+
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+#include "mbedtls/aes.h"
+
+#if MYNEWT_VAL(BLE_SM_SC)
+#include "mbedtls/cipher.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/cmac.h"
+#include "mbedtls/ecdh.h"
+#include "mbedtls/ecp.h"
+#endif
+
+#else
 #include "tinycrypt/aes.h"
 #include "tinycrypt/constants.h"
 #include "tinycrypt/utils.h"
@@ -40,9 +54,17 @@
 #endif
 #endif
 
+#endif
+
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+#if MYNEWT_VAL(BLE_SM_SC)
+static mbedtls_ecp_keypair keypair;
+#endif
+#else
 #if MYNEWT_VAL(BLE_SM_SC) && MYNEWT_VAL(TRNG)
 static struct trng_dev *g_trng;
 #endif
+#endif
 
 static void
 ble_sm_alg_xor_128(const uint8_t *p, const uint8_t *q, uint8_t *r)
@@ -58,11 +80,26 @@ static int
 ble_sm_alg_encrypt(const uint8_t *key, const uint8_t *plaintext,
                    uint8_t *enc_data)
 {
-    struct tc_aes_key_sched_struct s;
     uint8_t tmp[16];
 
     swap_buf(tmp, key, 16);
 
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+    mbedtls_aes_context s = {0};
+
+    mbedtls_aes_init(&s);
+    if (mbedtls_aes_setkey_enc(&s, tmp, 128) != 0) {
+        return BLE_HS_EUNKNOWN;
+    }
+
+    swap_buf(tmp, plaintext, 16);
+
+    if (mbedtls_aes_crypt_ecb(&s, MBEDTLS_AES_ENCRYPT, tmp, enc_data) != 0) {
+        return BLE_HS_EUNKNOWN;
+    }
+#else
+    struct tc_aes_key_sched_struct s;
+
     if (tc_aes128_set_encrypt_key(&s, tmp) == TC_CRYPTO_FAIL) {
         return BLE_HS_EUNKNOWN;
     }
@@ -72,6 +109,7 @@ ble_sm_alg_encrypt(const uint8_t *key, const uint8_t *plaintext,
     if (tc_aes_encrypt(enc_data, tmp, &s) == TC_CRYPTO_FAIL) {
         return BLE_HS_EUNKNOWN;
     }
+#endif
 
     swap_in_place(enc_data, 16);
 
@@ -202,6 +240,46 @@ ble_sm_alg_log_buf(const char *name, const uint8_t *buf, int len)
  * @param len                   Length of the message in octets.
  * @param out                   Output; message authentication code.
  */
+
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+static int
+ble_sm_alg_aes_cmac(const uint8_t *key, const uint8_t *in, size_t len,
+                    uint8_t *out)
+{
+    int rc = BLE_HS_EUNKNOWN;
+    mbedtls_cipher_context_t ctx = {0};
+    const mbedtls_cipher_info_t *cipher_info;
+
+    mbedtls_cipher_init(&ctx);
+
+    cipher_info = mbedtls_cipher_info_from_type(MBEDTLS_CIPHER_AES_128_ECB);
+
+    if (cipher_info == NULL) {
+        goto exit;
+    }
+
+    if (mbedtls_cipher_setup(&ctx, cipher_info) != 0) {
+        goto exit;
+    }
+
+    rc = mbedtls_cipher_cmac_starts(&ctx, key, 128);
+    if (rc != 0) {
+        goto exit;
+    }
+
+    rc = mbedtls_cipher_cmac_update(&ctx, in, len);
+    if (rc != 0) {
+        goto exit;
+    }
+
+    rc = mbedtls_cipher_cmac_finish(&ctx, out);
+
+exit:
+    mbedtls_cipher_free(&ctx);
+    return rc;
+}
+
+#else
 static int
 ble_sm_alg_aes_cmac(const uint8_t *key, const uint8_t *in, size_t len,
                     uint8_t *out)
@@ -223,6 +301,7 @@ ble_sm_alg_aes_cmac(const uint8_t *key, const uint8_t *in, size_t len,
 
     return 0;
 }
+#endif
 
 int
 ble_sm_alg_f4(const uint8_t *u, const uint8_t *v, const uint8_t *x,
@@ -425,12 +504,82 @@ ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_
     uint8_t dh[32];
     uint8_t pk[64];
     uint8_t priv[32];
-    int rc;
+    int rc = BLE_HS_EUNKNOWN;
 
     swap_buf(pk, peer_pub_key_x, 32);
     swap_buf(&pk[32], peer_pub_key_y, 32);
     swap_buf(priv, our_priv_key, 32);
 
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+    struct mbedtls_ecp_point pt = {0}, Q = {0};
+    mbedtls_mpi z = {0}, d = {0};
+    mbedtls_ctr_drbg_context ctr_drbg = {0};
+    mbedtls_entropy_context entropy = {0};
+
+    uint8_t pub[65] = {0};
+    /* Hardcoded first byte of pub key for MBEDTLS_ECP_PF_UNCOMPRESSED */
+    pub[0] = 0x04;
+    memcpy(&pub[1], pk, 64);
+
+    /* Initialize the required structures here */
+    mbedtls_ecp_point_init(&pt);
+    mbedtls_ecp_point_init(&Q);
+    mbedtls_ctr_drbg_init(&ctr_drbg);
+    mbedtls_entropy_init(&entropy);
+    mbedtls_mpi_init(&d);
+    mbedtls_mpi_init(&z);
+
+    /* Below 3 steps are to validate public key on curve secp256r1 */
+    if (mbedtls_ecp_group_load(&keypair.grp, MBEDTLS_ECP_DP_SECP256R1) != 0) {
+        goto exit;
+    }
+
+    if (mbedtls_ecp_point_read_binary(&keypair.grp, &pt, pub, 65) != 0) {
+        goto exit;
+    }
+
+    if (mbedtls_ecp_check_pubkey(&keypair.grp, &pt) != 0) {
+        goto exit;
+    }
+
+    /* Set PRNG */
+    if ( ( rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
+                                      NULL, 0) ) != 0) {
+        goto exit;
+    }
+
+    /* Prepare point Q from pub key */
+    if (mbedtls_ecp_point_read_binary(&keypair.grp, &Q, pub, 65) != 0) {
+        goto exit;
+    }
+
+    if (mbedtls_mpi_read_binary(&d, priv, 32) != 0) {
+        goto exit;
+    }
+
+    rc = mbedtls_ecdh_compute_shared(&keypair.grp, &z, &Q, &d,
+                                     mbedtls_ctr_drbg_random, &ctr_drbg);
+    if (rc != 0) {
+        goto exit;
+    }
+
+    rc = mbedtls_mpi_write_binary(&z, dh, 32);
+    if (rc != 0) {
+        goto exit;
+    }
+
+exit:
+    mbedtls_ecp_point_free(&pt);
+    mbedtls_mpi_free(&z);
+    mbedtls_mpi_free(&d);
+    mbedtls_ecp_point_free(&Q);
+    mbedtls_entropy_free(&entropy);
+    mbedtls_ctr_drbg_free(&ctr_drbg);
+    if (rc != 0) {
+        return BLE_HS_EUNKNOWN;
+    }
+
+#else
     if (uECC_valid_public_key(pk, &curve_secp256r1) < 0) {
         return BLE_HS_EUNKNOWN;
     }
@@ -439,9 +588,9 @@ ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_
     if (rc == TC_CRYPTO_FAIL) {
         return BLE_HS_EUNKNOWN;
     }
+#endif
 
     swap_buf(out_dhkey, dh, 32);
-
     return 0;
 }
 
@@ -465,6 +614,55 @@ static const uint8_t ble_sm_alg_dbg_pub_key[64] = {
 };
 #endif
 
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+static int
+mbedtls_gen_keypair(uint8_t *public_key, uint8_t *private_key)
+{
+    int rc = BLE_HS_EUNKNOWN;
+    mbedtls_entropy_context entropy = {0};
+    mbedtls_ctr_drbg_context ctr_drbg = {0};
+
+
+    mbedtls_entropy_init(&entropy);
+    mbedtls_ctr_drbg_init(&ctr_drbg);
+    mbedtls_ecp_keypair_init(&keypair);
+
+    if (( rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
+                                NULL, 0)) != 0) {
+        goto exit;
+    }
+
+    if ((rc = mbedtls_ecp_gen_key(MBEDTLS_ECP_DP_SECP256R1, &keypair,
+                                  mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) {
+        goto exit;
+    }
+
+    if (( rc = mbedtls_mpi_write_binary(&keypair.d, private_key, 32)) != 0) {
+        goto exit;
+    }
+
+    size_t olen = 0;
+    uint8_t pub[65] = {0};
+
+    if ((rc = mbedtls_ecp_point_write_binary(&keypair.grp, &keypair.Q, MBEDTLS_ECP_PF_UNCOMPRESSED,
+                                             &olen, pub, 65)) != 0) {
+        goto exit;
+    }
+
+    memcpy(public_key, &pub[1], 64);
+
+exit:
+    mbedtls_ctr_drbg_free( &ctr_drbg );
+    mbedtls_entropy_free( &entropy );
+    if (rc != 0) {
+        mbedtls_ecp_keypair_free(&keypair);
+        return BLE_HS_EUNKNOWN;
+    }
+
+    return 0;
+}
+#endif
+
 /**
  * pub: 64 bytes
  * priv: 32 bytes
@@ -480,9 +678,16 @@ ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
     uint8_t pk[64];
 
     do {
+
+#if MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS)
+        if (mbedtls_gen_keypair(pk, priv) != 0) {
+            return BLE_HS_EUNKNOWN;
+        }
+#else
         if (uECC_make_key(pk, priv, &curve_secp256r1) != TC_CRYPTO_SUCCESS) {
             return BLE_HS_EUNKNOWN;
         }
+#endif
 
         /* Make sure generated key isn't debug key. */
     } while (memcmp(priv, ble_sm_alg_dbg_priv_key, 32) == 0);
@@ -498,7 +703,7 @@ ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 #if MYNEWT_VAL(SELFTEST)
 /* Unit tests rely on custom RNG function not being set */
 #define ble_sm_alg_rand NULL
-#else
+#elif !(MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS))
 /* used by uECC to get random data */
 static int
 ble_sm_alg_rand(uint8_t *dst, unsigned int size)
@@ -529,7 +734,10 @@ ble_sm_alg_rand(uint8_t *dst, unsigned int size)
 void
 ble_sm_alg_ecc_init(void)
 {
+#if (!MYNEWT_VAL(BLE_CRYPTO_STACK_MBEDTLS))
     uECC_set_rng(ble_sm_alg_rand);
+#endif
+    return;
 }
 
 #endif