1 /*
2 * Copyright (c) 2017 Nordic Semiconductor ASA
3 * Copyright (c) 2015-2016 Intel Corporation
4 *
5 * SPDX-License-Identifier: Apache-2.0
6 */
7
8 #include <string.h>
9 #include <errno.h>
10
11 #include <zephyr/kernel.h>
12 #include <zephyr/sys/byteorder.h>
13 #include <zephyr/sys/check.h>
14
15 #include <zephyr/bluetooth/bluetooth.h>
16 #include <zephyr/bluetooth/hci.h>
17 #include <zephyr/bluetooth/conn.h>
18 #include <zephyr/bluetooth/crypto.h>
19
20 #include "psa/crypto.h"
21
22 #include "common/bt_str.h"
23
24 #include "hci_core.h"
25
26 #define LOG_LEVEL CONFIG_BT_HCI_CORE_LOG_LEVEL
27 #include <zephyr/logging/log.h>
28 LOG_MODULE_REGISTER(bt_host_crypto);
29
prng_init(void)30 int prng_init(void)
31 {
32 if (psa_crypto_init() != PSA_SUCCESS) {
33 LOG_ERR("psa_crypto_init() failed");
34 return -EIO;
35 }
36 return 0;
37 }
38
39 #if defined(CONFIG_BT_HOST_CRYPTO_PRNG)
bt_rand(void * buf,size_t len)40 int bt_rand(void *buf, size_t len)
41 {
42 if (psa_generate_random(buf, len) == PSA_SUCCESS) {
43 return 0;
44 }
45
46 LOG_ERR("psa_generate_random() failed");
47 return -EIO;
48 }
49 #else /* !CONFIG_BT_HOST_CRYPTO_PRNG */
bt_rand(void * buf,size_t len)50 int bt_rand(void *buf, size_t len)
51 {
52 CHECKIF(buf == NULL || len == 0) {
53 return -EINVAL;
54 }
55
56 return bt_hci_le_rand(buf, len);
57 }
58 #endif /* CONFIG_BT_HOST_CRYPTO_PRNG */
59
bt_encrypt_le(const uint8_t key[16],const uint8_t plaintext[16],uint8_t enc_data[16])60 int bt_encrypt_le(const uint8_t key[16], const uint8_t plaintext[16],
61 uint8_t enc_data[16])
62 {
63 psa_key_attributes_t attr = PSA_KEY_ATTRIBUTES_INIT;
64 psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
65 psa_status_t status, destroy_status;
66 size_t out_len;
67 uint8_t tmp[16];
68
69 CHECKIF(key == NULL || plaintext == NULL || enc_data == NULL) {
70 return -EINVAL;
71 }
72
73 LOG_DBG("key %s", bt_hex(key, 16));
74 LOG_DBG("plaintext %s", bt_hex(plaintext, 16));
75
76 sys_memcpy_swap(tmp, key, 16);
77
78 psa_set_key_type(&attr, PSA_KEY_TYPE_AES);
79 psa_set_key_bits(&attr, 128);
80 psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_ENCRYPT);
81 psa_set_key_algorithm(&attr, PSA_ALG_ECB_NO_PADDING);
82 if (psa_import_key(&attr, tmp, 16, &key_id) != PSA_SUCCESS) {
83 LOG_ERR("Failed to import AES key");
84 return -EINVAL;
85 }
86
87 sys_memcpy_swap(tmp, plaintext, 16);
88
89 status = psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING, tmp, 16,
90 enc_data, 16, &out_len);
91 if (status != PSA_SUCCESS) {
92 LOG_ERR("AES encryption failed");
93 }
94
95 destroy_status = psa_destroy_key(key_id);
96 if (destroy_status != PSA_SUCCESS) {
97 LOG_ERR("Failed to destroy AES key");
98 }
99
100 if ((status != PSA_SUCCESS) || (destroy_status != PSA_SUCCESS)) {
101 return -EIO;
102 }
103
104 sys_mem_swap(enc_data, 16);
105
106 LOG_DBG("enc_data %s", bt_hex(enc_data, 16));
107
108 return 0;
109 }
110
bt_encrypt_be(const uint8_t key[16],const uint8_t plaintext[16],uint8_t enc_data[16])111 int bt_encrypt_be(const uint8_t key[16], const uint8_t plaintext[16],
112 uint8_t enc_data[16])
113 {
114 psa_key_attributes_t attr = PSA_KEY_ATTRIBUTES_INIT;
115 psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
116 psa_status_t status, destroy_status;
117 size_t out_len;
118
119 CHECKIF(key == NULL || plaintext == NULL || enc_data == NULL) {
120 return -EINVAL;
121 }
122
123 LOG_DBG("key %s", bt_hex(key, 16));
124 LOG_DBG("plaintext %s", bt_hex(plaintext, 16));
125
126 psa_set_key_type(&attr, PSA_KEY_TYPE_AES);
127 psa_set_key_bits(&attr, 128);
128 psa_set_key_usage_flags(&attr, PSA_KEY_USAGE_ENCRYPT);
129 psa_set_key_algorithm(&attr, PSA_ALG_ECB_NO_PADDING);
130 if (psa_import_key(&attr, key, 16, &key_id) != PSA_SUCCESS) {
131 LOG_ERR("Failed to import AES key");
132 return -EINVAL;
133 }
134
135 status = psa_cipher_encrypt(key_id, PSA_ALG_ECB_NO_PADDING,
136 plaintext, 16, enc_data, 16, &out_len);
137 if (status != PSA_SUCCESS) {
138 LOG_ERR("AES encryption failed");
139 }
140
141 destroy_status = psa_destroy_key(key_id);
142 if (destroy_status != PSA_SUCCESS) {
143 LOG_ERR("Failed to destroy AES key");
144 }
145
146 if ((status != PSA_SUCCESS) || (destroy_status != PSA_SUCCESS)) {
147 return -EIO;
148 }
149
150 LOG_DBG("enc_data %s", bt_hex(enc_data, 16));
151
152 return 0;
153 }
154
