diff --git a/configure.ac b/configure.ac index db771e357..eb9d6d0a1 100644 --- a/configure.ac +++ b/configure.ac @@ -428,6 +428,11 @@ AM_CONDITIONAL([OPENTHREAD_ENABLE_NCP], [test "${enable_ncp}" != "no"]) AM_CONDITIONAL([OPENTHREAD_ENABLE_NCP_SPI], [test "${enable_ncp}" = "spi"]) AM_CONDITIONAL([OPENTHREAD_ENABLE_NCP_UART], [test "${enable_ncp}" = "uart"]) +MBEDTLS_CPPFLAGS="-I\${abs_top_srcdir}/third_party/mbedtls" +MBEDTLS_CPPFLAGS="${MBEDTLS_CPPFLAGS} -I\${abs_top_srcdir}/third_party/mbedtls/repo/include" +MBEDTLS_CPPFLAGS="${MBEDTLS_CPPFLAGS} -I\${abs_top_srcdir}/third_party/mbedtls/repo/include/mbedtls" +MBEDTLS_CPPFLAGS="${MBEDTLS_CPPFLAGS} -DMBEDTLS_CONFIG_FILE=\\\"mbedtls-config.h\\\"" + # # Diagnostics Library # @@ -602,6 +607,10 @@ if test "${ac_no_link}" != "yes"; then AC_CHECK_FUNCS([memcpy]) fi +# Add any mbedtls CPPFLAGS + +CPPFLAGS="${CPPFLAGS} ${MBEDTLS_CPPFLAGS}" + # Add any code coverage CPPFLAGS and LDFLAGS CPPFLAGS="${CPPFLAGS} ${NL_COVERAGE_CPPFLAGS}" @@ -620,7 +629,6 @@ AC_CONFIG_FILES([ Makefile include/Makefile include/cli/Makefile -include/crypto/Makefile include/ncp/Makefile include/platform/Makefile src/Makefile diff --git a/include/Makefile.am b/include/Makefile.am index 49fe532f5..62e26605b 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -32,7 +32,6 @@ include $(abs_top_nlbuild_autotools_dir)/automake/pre.am DIST_SUBDIRS = \ cli \ - crypto \ ncp \ platform \ $(NULL) @@ -41,7 +40,6 @@ DIST_SUBDIRS = \ SUBDIRS = \ cli \ - crypto \ ncp \ platform \ $(NULL) @@ -50,7 +48,6 @@ SUBDIRS = \ PRETTY_SUBDIRS = \ cli \ - crypto \ ncp \ platform \ $(NULL) diff --git a/include/crypto/Makefile.am b/include/crypto/Makefile.am deleted file mode 100644 index d21f3a1cd..000000000 --- a/include/crypto/Makefile.am +++ /dev/null @@ -1,41 +0,0 @@ -# -# Copyright (c) 2016, Nest Labs, Inc. -# All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# 1. Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# 2. Redistributions in binary form must reproduce the above copyright -# notice, this list of conditions and the following disclaimer in the -# documentation and/or other materials provided with the distribution. -# 3. Neither the name of the copyright holder nor the -# names of its contributors may be used to endorse or promote products -# derived from this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE -# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR -# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF -# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS -# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN -# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE -# POSSIBILITY OF SUCH DAMAGE. -# - -include $(abs_top_nlbuild_autotools_dir)/automake/pre.am - -ot_crypto_headers = \ - aes_ecb.h \ - hmac_sha256.h \ - $(NULL) - -ot_cryptodir = $(includedir)/crypto -dist_ot_crypto_HEADERS = $(ot_crypto_headers) - -install-headers: install-includeHEADERS - -include $(abs_top_nlbuild_autotools_dir)/automake/post.am diff --git a/src/core/Makefile.am b/src/core/Makefile.am index fbbb1a27f..34accd94f 100644 --- a/src/core/Makefile.am +++ b/src/core/Makefile.am @@ -30,7 +30,7 @@ include $(abs_top_nlbuild_autotools_dir)/automake/pre.am lib_LIBRARIES = libopenthread.a -libopenthread_a_CPPFLAGS = \ +libopenthread_a_CPPFLAGS = \ -I$(top_srcdir)/include \ $(OPENTHREAD_TARGET_DEFINES) \ $(NULL) @@ -44,6 +44,9 @@ libopenthread_a_SOURCES = \ common/tasklet.cpp \ common/timer.cpp \ crypto/aes_ccm.cpp \ + crypto/aes_ecb.cpp \ + crypto/hmac_sha256.cpp \ + crypto/mbedtls.cpp \ mac/mac.cpp \ mac/mac_frame.cpp \ mac/mac_whitelist.cpp \ @@ -88,6 +91,9 @@ noinst_HEADERS = \ common/tasklet.hpp \ common/timer.hpp \ crypto/aes_ccm.hpp \ + crypto/aes_ecb.hpp \ + crypto/hmac_sha256.hpp \ + crypto/mbedtls.hpp \ mac/mac.hpp \ mac/mac_frame.hpp \ mac/mac_whitelist.hpp \ diff --git a/src/core/crypto/aes_ccm.cpp b/src/core/crypto/aes_ccm.cpp index 130d5cd24..7f151bacf 100644 --- a/src/core/crypto/aes_ccm.cpp +++ b/src/core/crypto/aes_ccm.cpp @@ -40,7 +40,7 @@ namespace Crypto { ThreadError AesCcm::SetKey(const uint8_t *aKey, uint16_t aKeyLength) { - otCryptoAesEcbSetKey(aKey, 8 * aKeyLength); + mEcb.SetKey(aKey, 8 * aKeyLength); return kThreadError_None; } @@ -113,7 +113,7 @@ void AesCcm::Init(uint32_t aHeaderLength, uint32_t aPlainTextLength, uint8_t aTa } // encrypt initial block - otCryptoAesEcbEncrypt(mBlock, mBlock); + mEcb.Encrypt(mBlock, mBlock); // process header if (aHeaderLength > 0) @@ -169,7 +169,7 @@ void AesCcm::Header(const void *aHeader, uint32_t aHeaderLength) { if (mBlockLength == sizeof(mBlock)) { - otCryptoAesEcbEncrypt(mBlock, mBlock); + mEcb.Encrypt(mBlock, mBlock); mBlockLength = 0; } @@ -183,7 +183,7 @@ void AesCcm::Header(const void *aHeader, uint32_t aHeaderLength) // process remainder if (mBlockLength != 0) { - otCryptoAesEcbEncrypt(mBlock, mBlock); + mEcb.Encrypt(mBlock, mBlock); } mBlockLength = 0; @@ -210,7 +210,7 @@ void AesCcm::Payload(void *plaintext, void *ciphertext, uint32_t len, bool aEncr } } - otCryptoAesEcbEncrypt(mCtr, mCtrPad); + mEcb.Encrypt(mCtr, mCtrPad); mCtrLength = 0; } @@ -227,7 +227,7 @@ void AesCcm::Payload(void *plaintext, void *ciphertext, uint32_t len, bool aEncr if (mBlockLength == sizeof(mBlock)) { - otCryptoAesEcbEncrypt(mBlock, mBlock); + mEcb.Encrypt(mBlock, mBlock); mBlockLength = 0; } @@ -240,7 +240,7 @@ void AesCcm::Payload(void *plaintext, void *ciphertext, uint32_t len, bool aEncr { if (mBlockLength != 0) { - otCryptoAesEcbEncrypt(mBlock, mBlock); + mEcb.Encrypt(mBlock, mBlock); } // reset counter @@ -259,7 +259,7 @@ void AesCcm::Finalize(void *tag, uint8_t *aTagLength) if (mTagLength > 0) { - otCryptoAesEcbEncrypt(mCtr, mCtrPad); + mEcb.Encrypt(mCtr, mCtrPad); for (int i = 0; i < mTagLength; i++) { diff --git a/src/core/crypto/aes_ccm.hpp b/src/core/crypto/aes_ccm.hpp index 7a6d67993..367a8b4e0 100644 --- a/src/core/crypto/aes_ccm.hpp +++ b/src/core/crypto/aes_ccm.hpp @@ -37,7 +37,7 @@ #include #include -#include +#include namespace Thread { namespace Crypto { @@ -108,9 +108,10 @@ public: void Finalize(void *aTag, uint8_t *aTagLength); private: - uint8_t mBlock[otAesBlockSize]; - uint8_t mCtr[otAesBlockSize]; - uint8_t mCtrPad[otAesBlockSize]; + AesEcb mEcb; + uint8_t mBlock[AesEcb::kBlockSize]; + uint8_t mCtr[AesEcb::kBlockSize]; + uint8_t mCtrPad[AesEcb::kBlockSize]; uint8_t mNonceLength; uint32_t mHeaderLength; uint32_t mHeaderCur; diff --git a/src/core/crypto/aes_ecb.cpp b/src/core/crypto/aes_ecb.cpp new file mode 100644 index 000000000..71130f878 --- /dev/null +++ b/src/core/crypto/aes_ecb.cpp @@ -0,0 +1,51 @@ +/* + * Copyright (c) 2016, Nest Labs, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the copyright holder nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * @file + * This file implements AES-ECB. + */ + +#include + +namespace Thread { +namespace Crypto { + +void AesEcb::SetKey(const uint8_t *aKey, uint16_t aKeyLength) +{ + mbedtls_aes_init(&mContext); + mbedtls_aes_setkey_enc(&mContext, aKey, aKeyLength); +} + +void AesEcb::Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize]) +{ + mbedtls_aes_crypt_ecb(&mContext, MBEDTLS_AES_ENCRYPT, aInput, aOutput); +} + +} // namespace Crypto +} // namespace Thread diff --git a/include/crypto/hmac_sha256.h b/src/core/crypto/aes_ecb.hpp similarity index 63% rename from include/crypto/hmac_sha256.h rename to src/core/crypto/aes_ecb.hpp index 9728c2a6d..3cbbca2f3 100644 --- a/include/crypto/hmac_sha256.h +++ b/src/core/crypto/aes_ecb.hpp @@ -28,18 +28,16 @@ /** * @file - * @brief - * This file includes the platform abstraction for HMAC SHA-256 computations. + * This file includes definitions for performing AES-ECB computations. */ -#ifndef HMAC_SHA256_H_ -#define HMAC_SHA256_H_ +#ifndef AES_ECB_HPP_ +#define AES_ECB_HPP_ -#include +#include -#ifdef __cplusplus -extern "C" { -#endif +namespace Thread { +namespace Crypto { /** * @addtogroup core-security @@ -48,44 +46,46 @@ extern "C" { * */ -enum +/** + * This class implements AES ECB computation. + * + */ +class AesEcb { - otCryptoSha256Size = 32, ///< SHA-256 hash size (bytes) +public: + enum + { + kBlockSize = 16, ///< AES-128 block size (bytes). + }; + + /** + * This method sets the key. + * + * @param[in] aKey A pointer to the key. + * @param[in] aKeyLength The key length in bytes. + * + */ + void SetKey(const uint8_t *aKey, uint16_t aKeyLength); + + /** + * This method encrypts data. + * + * @param[in] aInput A pointer to the input buffer. + * @param[out] aOutput A pointer to the output buffer. + * + */ + void Encrypt(const uint8_t aInput[kBlockSize], uint8_t aOutput[kBlockSize]); + +private: + mbedtls_aes_context mContext; }; -/** - * This method sets the key. - * - * @param[in] aKey A pointer to the key. - * @param[in] aKeyLength The key length in bytes. - * - */ -void otCryptoHmacSha256Start(const void *aKey, uint16_t aKeyLength); - -/** - * This method inputs bytes into the HMAC computation. - * - * @param[in] aBuf A pointer to the input buffer. - * @param[in] aBufLength The length of @p aBuf in bytes. - * - */ -void otCryptoHmacSha256Update(const void *aBuf, uint16_t aBufLength); - -/** - * This method finalizes the hash computation. - * - * @param[out] aHash A pointer to the output buffer. - * - */ -void otCryptoHmacSha256Finish(uint8_t aHash[otCryptoSha256Size]); - /** * @} * */ -#ifdef __cplusplus -} // end of extern "C" -#endif +} // namespace Crypto +} // namespace Thread -#endif // HMAC_SHA256_H_ +#endif // AES_ECB_HPP_ diff --git a/src/core/crypto/hmac_sha256.cpp b/src/core/crypto/hmac_sha256.cpp new file mode 100644 index 000000000..8dcbde587 --- /dev/null +++ b/src/core/crypto/hmac_sha256.cpp @@ -0,0 +1,60 @@ +/* + * Copyright (c) 2016, Nest Labs, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the copyright holder nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * @file + * This file implements HMAC SHA-256. + */ + +#include + +namespace Thread { +namespace Crypto { + +void HmacSha256::Start(const uint8_t *aKey, uint16_t aKeyLength) +{ + const mbedtls_md_info_t *mdInfo = NULL; + mbedtls_md_init(&mContext); + mdInfo = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256); + mbedtls_md_setup(&mContext, mdInfo, 1); + mbedtls_md_hmac_starts(&mContext, aKey, aKeyLength); +} + +void HmacSha256::Update(const uint8_t *aBuf, uint16_t aBufLength) +{ + mbedtls_md_hmac_update(&mContext, aBuf, aBufLength); +} + +void HmacSha256::Finish(uint8_t aHash[kHashSize]) +{ + mbedtls_md_hmac_finish(&mContext, aHash); + mbedtls_md_free(&mContext); +} + +} // namespace Crypto +} // namespace Thread diff --git a/src/core/crypto/hmac_sha256.hpp b/src/core/crypto/hmac_sha256.hpp new file mode 100644 index 000000000..dafd2f464 --- /dev/null +++ b/src/core/crypto/hmac_sha256.hpp @@ -0,0 +1,101 @@ +/* + * Copyright (c) 2016, Nest Labs, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the copyright holder nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * @file + * This file includes definitions for performing HMAC SHA-256 computations. + */ + +#ifndef HMAC_SHA256_HPP_ +#define HMAC_SHA256_HPP_ + +#include + +#include + +namespace Thread { +namespace Crypto { + +/** + * @addtogroup core-security + * + * @{ + * + */ + +/** + * This class implements HMAC SHA-256 computation. + * + */ +class HmacSha256 +{ +public: + enum + { + kHashSize = 32, ///< SHA-256 hash size (bytes) + }; + + /** + * This method sets the key. + * + * @param[in] aKey A pointer to the key. + * @param[in] aKeyLength The key length in bytes. + * + */ + void Start(const uint8_t *aKey, uint16_t aKeyLength); + + /** + * This method inputs bytes into the HMAC computation. + * + * @param[in] aBuf A pointer to the input buffer. + * @param[in] aBufLength The length of @p aBuf in bytes. + * + */ + void Update(const uint8_t *aBuf, uint16_t aBufLength); + + /** + * This method finalizes the hash computation. + * + * @param[out] aHash A pointer to the output buffer. + * + */ + void Finish(uint8_t aHash[kHashSize]); + +private: + mbedtls_md_context_t mContext; +}; + +/** + * @} + * + */ + +} // namespace Crypto +} // namespace Thread + +#endif // HMAC_SHA256_HPP_ diff --git a/src/core/crypto/mbedtls.cpp b/src/core/crypto/mbedtls.cpp new file mode 100644 index 000000000..56830d0cf --- /dev/null +++ b/src/core/crypto/mbedtls.cpp @@ -0,0 +1,45 @@ +/* + * Copyright (c) 2016, Nest Labs, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the copyright holder nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * @file + * This file implements the use of mbedTLS. + */ + +#include + +namespace Thread { +namespace Crypto { + +MbedTls::MbedTls(void) +{ + mbedtls_memory_buffer_alloc_init(mMemory, sizeof(mMemory)); +} + +} // namespace Crypto +} // namespace Thread diff --git a/include/crypto/aes_ecb.h b/src/core/crypto/mbedtls.hpp similarity index 69% rename from include/crypto/aes_ecb.h rename to src/core/crypto/mbedtls.hpp index 585c416a2..75815400b 100644 --- a/include/crypto/aes_ecb.h +++ b/src/core/crypto/mbedtls.hpp @@ -28,20 +28,18 @@ /** * @file - * @brief - * This file includes the platform abstraction for AES ECB computations. + * This file includes definitions for using mbedTLS. */ -#ifndef AES_ECB_H_ -#define AES_ECB_H_ +#ifndef OT_MBEDTLS_HPP_ +#define OT_MBEDTLS_HPP_ #include -#include +#include -#ifdef __cplusplus -extern "C" { -#endif +namespace Thread { +namespace Crypto { /** * @addtogroup core-security @@ -50,36 +48,34 @@ extern "C" { * */ -enum +/** + * This class implements mbedTLS memory. + * + */ +class MbedTls { - otAesBlockSize = 16, ///< AES-128 block size. +public: + enum + { + kMemorySize = 512, ///< Size of memory buffer (bytes). + }; + + /** + * This constructor initializes the object. + * + */ + MbedTls(void); + +private: + unsigned char mMemory[kMemorySize]; }; -/** - * This method sets the key. - * - * @param[in] aKey A pointer to the key. - * @param[in] aKeyLength Length of the key in bytes. - * - */ -void otCryptoAesEcbSetKey(const void *aKey, uint16_t aKeyLength); - -/** - * This method encrypts data. - * - * @param[in] aInput A pointer to the input. - * @param[out] aOutput A pointer to the output. - * - */ -void otCryptoAesEcbEncrypt(const uint8_t aInput[otAesBlockSize], uint8_t aOutput[otAesBlockSize]); - /** * @} * */ -#ifdef __cplusplus -} // end of extern "C" -#endif +} // namespace Crypto +} // namespace Thread -#endif // AES_ECB_H_ +#endif // OT_MBEDTLS_HPP_ diff --git a/src/core/openthread.cpp b/src/core/openthread.cpp index 1b6905024..9e59aa2f3 100644 --- a/src/core/openthread.cpp +++ b/src/core/openthread.cpp @@ -40,6 +40,7 @@ #include #include #include +#include #include #include #include @@ -57,6 +58,8 @@ ThreadNetif *sThreadNetif; static Ip6::NetifCallback sNetifCallback; static bool mEnabled = false; +static otDEFINE_ALIGNED_VAR(sMbedTlsRaw, sizeof(Crypto::MbedTls), uint64_t); + static otDEFINE_ALIGNED_VAR(sIp6Raw, sizeof(Ip6::Ip6), uint64_t); Ip6::Ip6 *sIp6; @@ -872,6 +875,7 @@ ThreadError otEnable(void) VerifyOrExit(!mEnabled, error = kThreadError_InvalidState); otLogInfoApi("otEnable\n"); + new(&sMbedTlsRaw) Crypto::MbedTls; sIp6 = new(&sIp6Raw) Ip6::Ip6; sThreadNetif = new(&sThreadNetifRaw) ThreadNetif(*sIp6); mEnabled = true; diff --git a/src/core/thread/key_manager.cpp b/src/core/thread/key_manager.cpp index 22a63e79b..6e291d9eb 100644 --- a/src/core/thread/key_manager.cpp +++ b/src/core/thread/key_manager.cpp @@ -32,7 +32,7 @@ */ #include -#include +#include #include #include #include @@ -83,18 +83,19 @@ exit: ThreadError KeyManager::ComputeKey(uint32_t aKeySequence, uint8_t *aKey) { + Crypto::HmacSha256 hmac; uint8_t keySequenceBytes[4]; - otCryptoHmacSha256Start(mMasterKey, mMasterKeyLength); + hmac.Start(mMasterKey, mMasterKeyLength); keySequenceBytes[0] = (aKeySequence >> 24) & 0xff; keySequenceBytes[1] = (aKeySequence >> 16) & 0xff; keySequenceBytes[2] = (aKeySequence >> 8) & 0xff; keySequenceBytes[3] = aKeySequence & 0xff; - otCryptoHmacSha256Update(keySequenceBytes, sizeof(keySequenceBytes)); - otCryptoHmacSha256Update(kThreadString, sizeof(kThreadString)); + hmac.Update(keySequenceBytes, sizeof(keySequenceBytes)); + hmac.Update(kThreadString, sizeof(kThreadString)); - otCryptoHmacSha256Finish(aKey); + hmac.Finish(aKey); return kThreadError_None; } diff --git a/src/core/thread/key_manager.hpp b/src/core/thread/key_manager.hpp index bb5bad2ef..e314ddea5 100644 --- a/src/core/thread/key_manager.hpp +++ b/src/core/thread/key_manager.hpp @@ -37,7 +37,7 @@ #include #include -#include +#include namespace Thread { @@ -181,9 +181,9 @@ private: uint8_t mMasterKeyLength; uint32_t mKeySequence; - uint8_t mKey[otCryptoSha256Size]; + uint8_t mKey[Crypto::HmacSha256::kHashSize]; - uint8_t mTemporaryKey[otCryptoSha256Size]; + uint8_t mTemporaryKey[Crypto::HmacSha256::kHashSize]; uint32_t mMacFrameCounter; uint32_t mMleFrameCounter; diff --git a/tests/unit/test_aes.cpp b/tests/unit/test_aes.cpp index c1332d01c..3ec049d30 100644 --- a/tests/unit/test_aes.cpp +++ b/tests/unit/test_aes.cpp @@ -30,8 +30,11 @@ #include #include #include +#include #include +static Thread::Crypto::MbedTls mbedtls; + extern"C" void otSignalTaskletPending(void) { } diff --git a/tests/unit/test_hmac_sha256.cpp b/tests/unit/test_hmac_sha256.cpp index b0f5458c6..633ed121c 100644 --- a/tests/unit/test_hmac_sha256.cpp +++ b/tests/unit/test_hmac_sha256.cpp @@ -31,7 +31,10 @@ #include #include -#include +#include +#include + +static Thread::Crypto::MbedTls mbedtls; extern"C" void otSignalTaskletPending(void) { @@ -43,7 +46,7 @@ void TestHmacSha256(void) { const char *key; const char *data; - uint8_t hash[otCryptoSha256Size]; + uint8_t hash[Thread::Crypto::HmacSha256::kHashSize]; } tests[] = { { @@ -63,13 +66,14 @@ void TestHmacSha256(void) }, }; - uint8_t hash[otCryptoSha256Size]; + Thread::Crypto::HmacSha256 hmac; + uint8_t hash[Thread::Crypto::HmacSha256::kHashSize]; for (int i = 0; tests[i].key != NULL; i++) { - otCryptoHmacSha256Start(tests[i].key, static_cast(strlen(tests[i].key))); - otCryptoHmacSha256Update(tests[i].data, static_cast(strlen(tests[i].data))); - otCryptoHmacSha256Finish(hash); + hmac.Start(reinterpret_cast(tests[i].key), static_cast(strlen(tests[i].key))); + hmac.Update(reinterpret_cast(tests[i].data), static_cast(strlen(tests[i].data))); + hmac.Finish(hash); VerifyOrQuit(memcmp(hash, tests[i].hash, sizeof(tests[i].hash)) == 0, "HMAC-SHA-256 failed\n"); diff --git a/third_party/mbedtls/Makefile.am b/third_party/mbedtls/Makefile.am index 917ef46ae..f49421701 100644 --- a/third_party/mbedtls/Makefile.am +++ b/third_party/mbedtls/Makefile.am @@ -38,7 +38,6 @@ libmbedcrypto_a_CPPFLAGS = \ $(NULL) libmbedcrypto_a_SOURCES = \ - mbedcrypto.c \ repo/library/aes.c \ repo/library/md.c \ repo/library/md_wrap.c \ diff --git a/third_party/mbedtls/mbedcrypto.c b/third_party/mbedtls/mbedcrypto.c deleted file mode 100644 index fc60bd81f..000000000 --- a/third_party/mbedtls/mbedcrypto.c +++ /dev/null @@ -1,89 +0,0 @@ -/* - * Copyright 2016 Nest Labs Inc. All Rights Reserved. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -#include -#include -#include - -#include - -#include -#include -#include - -#include -#include - -/** - * @def MBED_MEMORY_BUF_SIZE - * - * The size of the memory buffer used by mbedtls. - * - */ -#define MBED_MEMORY_BUF_SIZE 512 - -void mbedInit(void); - -static bool sIsInitialized = false; -static unsigned char sMemoryBuf[MBED_MEMORY_BUF_SIZE]; - -static mbedtls_aes_context sAesContext; -static mbedtls_md_context_t sSha256Context; - -void mbedInit(void) -{ - if (sIsInitialized) - { - return; - } - - mbedtls_memory_buffer_alloc_init(sMemoryBuf, sizeof(sMemoryBuf)); - sIsInitialized = true; -} - -void otCryptoHmacSha256Start(const void *aKey, uint16_t aKeyLength) -{ - const mbedtls_md_info_t *mdInfo = NULL; - - mbedInit(); - - mbedtls_md_init(&sSha256Context); - mdInfo = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256); - mbedtls_md_setup(&sSha256Context, mdInfo, 1); - mbedtls_md_hmac_starts(&sSha256Context, aKey, aKeyLength); -} - -void otCryptoHmacSha256Update(const void *aBuf, uint16_t aBufLength) -{ - mbedtls_md_hmac_update(&sSha256Context, aBuf, aBufLength); -} - -void otCryptoHmacSha256Finish(uint8_t aHash[otCryptoSha256Size]) -{ - mbedtls_md_hmac_finish(&sSha256Context, aHash); - mbedtls_md_free(&sSha256Context); -} - -void otCryptoAesEcbSetKey(const void *aKey, uint16_t aKeyLength) -{ - mbedtls_aes_init(&sAesContext); - mbedtls_aes_setkey_enc(&sAesContext, aKey, aKeyLength); -} - -void otCryptoAesEcbEncrypt(const uint8_t aInput[otAesBlockSize], uint8_t aOutput[otAesBlockSize]) -{ - mbedtls_aes_crypt_ecb(&sAesContext, MBEDTLS_AES_ENCRYPT, aInput, aOutput); -}