1 /*
2 * Copyright (c) 2017 Nordic Semiconductor ASA
3 * Copyright (c) 2015-2016 Intel Corporation
4 *
5 * SPDX-License-Identifier: Apache-2.0
6 */
7
8 #include <string.h>
9 #include <errno.h>
10
11 #include <zephyr/kernel.h>
12 #include <zephyr/sys/byteorder.h>
13 #include <zephyr/sys/check.h>
14
15 #include <zephyr/bluetooth/bluetooth.h>
16 #include <zephyr/bluetooth/hci.h>
17 #include <zephyr/bluetooth/conn.h>
18 #include <zephyr/bluetooth/crypto.h>
19
20 #include "psa/crypto.h"
21
22 #include "common/bt_str.h"
23
24 #include "hci_core.h"
25
26 #define LOG_LEVEL CONFIG_BT_HCI_CORE_LOG_LEVEL
27 #include <zephyr/logging/log.h>
28 LOG_MODULE_REGISTER(bt_host_crypto);
29
bt_crypto_init(void)30 int bt_crypto_init(void)
31 {
32 psa_status_t status = psa_crypto_init();
33
34 if (status != PSA_SUCCESS) {
35 LOG_ERR("psa_crypto_init() failed %d", status);
36 return -EIO;
37 }
38 return 0;
39 }
40
41 #if defined(CONFIG_BT_HOST_CRYPTO_PRNG)
bt_rand(void * buf,size_t len)42 int bt_rand(void *buf, size_t len)
43 {
44 psa_status_t status = psa_generate_random(buf, len);
45
46 if (status == PSA_SUCCESS) {
47 return 0;
48 }
49
50 LOG_ERR("psa_generate_random() failed %d", status);
51 return -EIO;
52 }
53 #else /* !CONFIG_BT_HOST_CRYPTO_PRNG */
bt_rand(void * buf,size_t len)54 int bt_rand(void *buf, size_t len)
55 {
56 CHECKIF(buf == NULL || len == 0) {
57 return -EINVAL;
58 }
59
60 return bt_hci_le_rand(buf, len);
61 }
62 #endif /* CONFIG_BT_HOST_CRYPTO_PRNG */
63
bt_encrypt_le(const uint8_t key[16],const uint8_t plaintext[16],uint8_t enc_data[16])64 int bt_encrypt_le(const uint8_t key[16], const uint8_t plaintext[16],
65 uint8_t enc_data[16])
66 {
67 psa_key_attributes_t attr = PSA_KEY_ATTRIBUTES_INIT;
68 psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
69 psa_status_t status, destroy_status;
70 size_t out_len;
71 uint8_t tmp[16];
72
73 CHECKIF(key == NULL || plaintext == NULL || enc_data == NULL) {
74 return -EINVAL;
75 }
76
77 LOG_DBG("key %s", bt_hex(key, 16));
78 LOG_DBG("plaintext %s", bt_hex(plaintext, 16));
79
80 sys_memcpy_swap(tmp, key, 16);
81
82 psa_set_key_type(&attr, PSA_KEY_TYPE_AES);
83 psa_set_key_bits(&attr, 128);
84 psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_ENCRYPT);
85 psa_set_key_algorithm(&attr, PSA_ALG_ECB_NO_PADDING);
86 status = psa_import_key(&attr, tmp, 16, &key_id);
87 if (status != PSA_SUCCESS) {
88 LOG_ERR("Failed to import AES key %d", status);
89 return -EINVAL;
90 }
91
92 sys_memcpy_swap(tmp, plaintext, 16);
93
94 status = psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING, tmp, 16,
95 enc_data, 16, &out_len);
96 if (status != PSA_SUCCESS) {
97 LOG_ERR("AES encryption failed %d", status);
98 }
99
100 destroy_status = psa_destroy_key(key_id);
101 if (destroy_status != PSA_SUCCESS) {
102 LOG_ERR("Failed to destroy AES key %d", destroy_status);
103 }
104
105 if ((status != PSA_SUCCESS) || (destroy_status != PSA_SUCCESS)) {
106 return -EIO;
107 }
108
109 sys_mem_swap(enc_data, 16);
110
111 LOG_DBG("enc_data %s", bt_hex(enc_data, 16));
112
113 return 0;
114 }
115
bt_encrypt_be(const uint8_t key[16],const uint8_t plaintext[16],uint8_t enc_data[16])116 int bt_encrypt_be(const uint8_t key[16], const uint8_t plaintext[16],
117 uint8_t enc_data[16])
118 {
119 psa_key_attributes_t attr = PSA_KEY_ATTRIBUTES_INIT;
120 psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
121 psa_status_t status, destroy_status;
122 size_t out_len;
123
124 CHECKIF(key == NULL || plaintext == NULL || enc_data == NULL) {
125 return -EINVAL;
126 }
127
128 LOG_DBG("key %s", bt_hex(key, 16));
129 LOG_DBG("plaintext %s", bt_hex(plaintext, 16));
130
131 psa_set_key_type(&attr, PSA_KEY_TYPE_AES);
132 psa_set_key_bits(&attr, 128);
133 psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_ENCRYPT);
134 psa_set_key_algorithm(&attr, PSA_ALG_ECB_NO_PADDING);
135 status = psa_import_key(&attr, key, 16, &key_id);
136 if (status != PSA_SUCCESS) {
137 LOG_ERR("Failed to import AES key %d", status);
138 return -EINVAL;
139 }
140
141 status = psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING,
142 plaintext, 16, enc_data, 16, &out_len);
143 if (status != PSA_SUCCESS) {
144 LOG_ERR("AES encryption failed %d", status);
145 }
146
147 destroy_status = psa_destroy_key(key_id);
148 if (destroy_status != PSA_SUCCESS) {
149 LOG_ERR("Failed to destroy AES key %d", destroy_status);
150 }
151
152 if ((status != PSA_SUCCESS) || (destroy_status != PSA_SUCCESS)) {
153 return -EIO;
154 }
155
156 LOG_DBG("enc_data %s", bt_hex(enc_data, 16));
157
158 return 0;
159 }
160
