/* cmac.c

 *

 * Copyright (C) 2006-2026 wolfSSL Inc.

 *

 * This file is part of wolfSSL.

 *

 * wolfSSL is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 3 of the License, or

 * (at your option) any later version.

 *

 * wolfSSL is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA

 */

#define WC_FIPS_LL_CRYPTO

#define _WC_BUILDING_CMAC_C

#include <wolfssl/wolfcrypt/libwolfssl_sources.h>

#ifdef WOLFSSL_QNX_CAAM

#include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>

#endif

#if defined(WOLFSSL_HASH_KEEP)

#include <wolfssl/wolfcrypt/hash.h>

#endif

#if defined(WOLFSSL_CMAC)

#if defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)

    #ifdef USE_WINDOWS_API

        #pragma code_seg(".fipsA$c")

        #pragma const_seg(".fipsB$c")

    #endif

#endif

#ifdef NO_INLINE

    #include <wolfssl/wolfcrypt/misc.h>

#else

    #define WOLFSSL_MISC_INCLUDED

    #include <wolfcrypt/src/misc.c>

#endif

#include <wolfssl/wolfcrypt/aes.h>

#include <wolfssl/wolfcrypt/cmac.h>

#ifdef WOLF_CRYPTO_CB

    #include <wolfssl/wolfcrypt/cryptocb.h>

#endif

#if FIPS_VERSION3_GE(6,0,0)

    const unsigned int wolfCrypt_FIPS_cmac_ro_sanity[2] =

                                                     { 0x1a2b3c4d, 0x00000003 };

    int wolfCrypt_FIPS_CMAC_sanity(void)

    {

        return 0;

    }

#endif

#ifdef WOLFSSL_HASH_KEEP

/* Some hardware have issues with update, this function stores the data to be

 * hashed into an array. Once ready, the Final operation is called on all of the

 * data to be hashed at once.

 * returns 0 on success

 */

int wc_CMAC_Grow(Cmac* cmac, const byte* in, int inSz)

{

    if ((cmac == NULL) || (in == NULL && inSz != 0))

        return BAD_FUNC_ARG;

    return _wc_Hash_Grow(&cmac->msg, &cmac->used, &cmac->len, in, inSz, cmac->aes.heap);

}

#endif /* WOLFSSL_HASH_KEEP */

#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)

/* Used by AES-SIV. See aes.c. */

void ShiftAndXorRb(byte* out, byte* in)

{

    int i, j, xorRb;

    int mask = 0, last = 0;

    byte Rb = 0x87;

    xorRb = (in[0] & 0x80) != 0;

    for (i = 1, j = WC_AES_BLOCK_SIZE - 1; i <= WC_AES_BLOCK_SIZE; i++, j--) {

        last = (in[j] & 0x80) ? 1 : 0;

        out[j] = (byte)((in[j] << 1) | mask);

        mask = last;

        if (xorRb) {

            out[j] ^= Rb;

            Rb = 0;

        }

    }

}

#endif /* !NO_AES && WOLFSSL_AES_DIRECT */

#define CMAC_AES_INIT_PLAIN  0

#ifdef WOLF_PRIVATE_KEY_ID

#define CMAC_AES_INIT_ID     1

#define CMAC_AES_INIT_LABEL  2

#endif

static int _InitCmac_common(Cmac* cmac, const byte* key, word32 keySz,

                            int type, void* unused, void* heap, int devId,

                            int aesInitType, unsigned char* id, int idLen,

                            const char* label)

{

    int ret = 0;

#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)

    byte useSW = 0;

#endif

    if (cmac == NULL || type != WC_CMAC_AES) {

        return BAD_FUNC_ARG;

    }

#if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)

    /* save if we should use SW crypt, restore after memset */

    useSW = cmac->useSWCrypt;

#endif

    XMEMSET(cmac, 0, sizeof(Cmac));

    /* Stash heap so the cryptocb can read it from the zeroed cmac. */

#ifndef NO_AES

    cmac->aes.heap = heap;

#else

    cmac->heap = heap;

#endif

    /* Store id/label on the Cmac struct so the crypto callback can

     * inspect them to determine the hardware key slot. */

#ifdef WOLF_PRIVATE_KEY_ID

    cmac->aesInitType = aesInitType;

    if (aesInitType == CMAC_AES_INIT_ID && id != NULL && idLen > 0) {

        if (idLen > (int)sizeof(cmac->id)) {

            return BAD_FUNC_ARG;

        }

        XMEMCPY(cmac->id, id, (word32)idLen);

        cmac->idLen = idLen;

    }

    else if (aesInitType == CMAC_AES_INIT_LABEL && label != NULL) {

        int labelLen = (int)XSTRLEN(label);

        if (labelLen > 0 && labelLen < (int)sizeof(cmac->label)) {

            XMEMCPY(cmac->label, label, (word32)labelLen);

            cmac->labelLen = labelLen;

        }

    }

#endif

    (void)aesInitType;

    (void)id;

    (void)idLen;

    (void)label;

#ifdef WOLF_CRYPTO_CB

    /* Set devId regardless of value (invalid or not) */

    cmac->devId = devId;

    /* Set before the cryptocb early return so wc_CmacFree can clean up. */

    cmac->type = (CmacType)type;

    #ifndef WOLF_CRYPTO_CB_FIND

    if (devId != INVALID_DEVID)

    #endif

    {

        cmac->devCtx = NULL;

        ret = wc_CryptoCb_Cmac(cmac, key, keySz, NULL, 0, NULL, NULL,

                type, unused);

        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {

            return ret;

        }

        /* fall-through when unavailable, reset ret for software path */

        ret = 0;

        (void)ret;

    }

#else

    (void)devId;

#endif

    (void)unused;

    (void)heap;

    if (key == NULL || keySz == 0) {

        return BAD_FUNC_ARG;

    }

    switch (type) {

#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)

    case WC_CMAC_AES:

        cmac->type = WC_CMAC_AES;

        switch (aesInitType) {

#ifdef WOLF_PRIVATE_KEY_ID

        case CMAC_AES_INIT_ID:

            if (id == NULL || idLen == 0 || label != NULL) {

                ret = BAD_FUNC_ARG;

            }

            else {

                ret = wc_AesInit_Id(&cmac->aes, id, idLen, heap, devId);

            }

            break;

        case CMAC_AES_INIT_LABEL:

            if (label == NULL || id != NULL || idLen != 0) {

                ret = BAD_FUNC_ARG;

            }

            else {

                ret = wc_AesInit_Label(&cmac->aes, label, heap, devId);

            }

            break;

#endif

        default:

            if (id != NULL || idLen != 0 || label != NULL) {

                ret = BAD_FUNC_ARG;

            }

            else {

                ret = wc_AesInit(&cmac->aes, heap, devId);

            }

            break;

        }

        if (ret != 0) {

            return ret;

        }

    #if defined(WOLFSSL_SE050) && defined(WOLFSSL_SE050_CRYPT)

        cmac->useSWCrypt = useSW;

        if (cmac->useSWCrypt == 1) {

            cmac->aes.useSWCrypt = 1;

        }

    #endif

        if (ret == 0) {

            ret = wc_AesSetKey(&cmac->aes, key, keySz, NULL, AES_ENCRYPTION);

        }

        if (ret == 0) {

            byte l[WC_AES_BLOCK_SIZE];

            XMEMSET(l, 0, WC_AES_BLOCK_SIZE);

#ifdef WOLFSSL_CHECK_MEM_ZERO

            wc_MemZero_Add("InitInternal l", l, WC_AES_BLOCK_SIZE);

#endif

#ifndef HAVE_SELFTEST

            ret = wc_AesEncryptDirect(&cmac->aes, l, l);

            if (ret == 0) {

                ShiftAndXorRb(cmac->k1, l);

                ShiftAndXorRb(cmac->k2, cmac->k1);

            }

#else

            wc_AesEncryptDirect(&cmac->aes, l, l);

            ShiftAndXorRb(cmac->k1, l);

            ShiftAndXorRb(cmac->k2, cmac->k1);

#endif

            ForceZero(l, WC_AES_BLOCK_SIZE);

#ifdef WOLFSSL_CHECK_MEM_ZERO

            wc_MemZero_Check(l, WC_AES_BLOCK_SIZE);

#endif

        }

        if (ret != 0) {

            wc_AesFree(&cmac->aes);

            cmac->type = WC_CMAC_NONE;

        }

        break;

#endif /* !NO_AES && WOLFSSL_AES_DIRECT */

    default:

        return BAD_FUNC_ARG;

    }

    return ret;

}

/* returns 0 on success */

int wc_InitCmac_ex(Cmac* cmac, const byte* key, word32 keySz,

                int type, void* unused, void* heap, int devId)

{

    return _InitCmac_common(cmac, key, keySz, type, unused, heap, devId,

                            CMAC_AES_INIT_PLAIN, NULL, 0, NULL);

}

int wc_InitCmac(Cmac* cmac, const byte* key, word32 keySz,

                int type, void* unused)

{

#ifdef WOLFSSL_QNX_CAAM

    int devId = WOLFSSL_CAAM_DEVID;

#else

    int devId = INVALID_DEVID;

#endif

    return wc_InitCmac_ex(cmac, key, keySz, type, unused, NULL, devId);

}

#ifdef WOLF_PRIVATE_KEY_ID

/* returns 0 on success */

int wc_InitCmac_Id(Cmac* cmac, const byte* key, word32 keySz,

                   int type, void* unused, unsigned char* id, int len,

                   void* heap, int devId)

{

    return _InitCmac_common(cmac, key, keySz, type, unused, heap, devId,

                            CMAC_AES_INIT_ID, id, len, NULL);

}

/* returns 0 on success */

int wc_InitCmac_Label(Cmac* cmac, const byte* key, word32 keySz,

                      int type, void* unused, const char* label,

                      void* heap, int devId)

{

    return _InitCmac_common(cmac, key, keySz, type, unused, heap, devId,

                            CMAC_AES_INIT_LABEL, NULL, 0, label);

}

#endif /* WOLF_PRIVATE_KEY_ID */

int wc_CmacUpdate(Cmac* cmac, const byte* in, word32 inSz)

{

    int ret = 0;

    if ((cmac == NULL) || (in == NULL && inSz != 0)) {

        return BAD_FUNC_ARG;

    }

#ifdef WOLF_CRYPTO_CB

    #ifndef WOLF_CRYPTO_CB_FIND

    if (cmac->devId != INVALID_DEVID)

    #endif

    {

        ret = wc_CryptoCb_Cmac(cmac, NULL, 0, in, inSz,

            NULL, NULL, (int)cmac->type, NULL);

        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))

            return ret;

        /* fall-through when unavailable */

    }

#endif

    /* Clear CRYPTOCB_UNAVAILABLE return code */

    ret = 0;

    switch (cmac->type) {

#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)

    case WC_CMAC_AES:

    {

#ifdef HAVE_SELFTEST

        while ((ret == 0) && (inSz != 0)) {

            word32 add = min(inSz, WC_AES_BLOCK_SIZE - cmac->bufferSz);

            XMEMCPY(&cmac->buffer[cmac->bufferSz], in, add);

            cmac->bufferSz += add;

            in += add;

            inSz -= add;

            if (cmac->bufferSz == WC_AES_BLOCK_SIZE && inSz != 0) {

                xorbuf(cmac->buffer, cmac->digest, WC_AES_BLOCK_SIZE);

                wc_AesEncryptDirect(&cmac->aes, cmac->digest,

                        cmac->buffer);

                cmac->totalSz += WC_AES_BLOCK_SIZE;

                cmac->bufferSz = 0;

            }

        }

#else

        (void)ret;

        ret = wc_local_CmacUpdateAes(cmac, in, inSz);

#endif

    }; break;

#endif /* !NO_AES && WOLFSSL_AES_DIRECT */

    case WC_CMAC_NONE:

    default:

        ret = BAD_FUNC_ARG;

    }

    return ret;

}

int wc_CmacFree(Cmac* cmac)

{

    if (cmac == NULL)

        return BAD_FUNC_ARG;

#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)

    /* Let the device release any per-context state it hung off cmac->devCtx

     * before the struct is zeroed (e.g. an offload context never finalized). */

    #ifndef WOLF_CRYPTO_CB_FIND

    if (cmac->devId != INVALID_DEVID)

    #endif

    {

        (void)wc_CryptoCb_Free(cmac->devId, WC_ALGO_TYPE_CMAC, (int)cmac->type,

            0, cmac);

    }

#endif

#if defined(WOLFSSL_HASH_KEEP)

    /* TODO: msg is leaked if wc_CmacFinal() is not called

     * e.g. when multiple calls to wc_CmacUpdate() and one fails but

     * wc_CmacFinal() not called. */

    XFREE(cmac->msg, cmac->aes.heap, DYNAMIC_TYPE_TMP_BUFFER);

#endif

    switch (cmac->type) {

#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)

    case WC_CMAC_AES:

        wc_AesFree(&cmac->aes);

        break;

#endif /* !NO_AES && WOLFSSL_AES_DIRECT */

    case WC_CMAC_NONE:

    default:

        /* Nothing to do */

        (void)cmac;

    }

    ForceZero(cmac, sizeof(Cmac));

    return 0;

}

int wc_CmacFinalNoFree(Cmac* cmac, byte* out, word32* outSz)

{

    int ret = 0;

    if (cmac == NULL || out == NULL || outSz == NULL) {

        return BAD_FUNC_ARG;

    }

    if (*outSz < WC_CMAC_TAG_MIN_SZ || *outSz > WC_CMAC_TAG_MAX_SZ) {

        return BUFFER_E;

    }

#ifdef WOLF_CRYPTO_CB

    #ifndef WOLF_CRYPTO_CB_FIND

    if (cmac->devId != INVALID_DEVID)

    #endif

    {

        ret = wc_CryptoCb_Cmac(cmac, NULL, 0, NULL, 0, out, outSz,

            (int)cmac->type, NULL);

        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))

            return ret;

        /* Clear CRYPTOCB_UNAVAILABLE return code */

       ret = 0;

        /* fall-through when unavailable */

    }

#endif

    if (ret == 0) {

        switch (cmac->type) {

    #if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)

        case WC_CMAC_AES:

        {

            const byte* subKey;

            word32 remainder;

            if (cmac->bufferSz == WC_AES_BLOCK_SIZE) {

                subKey = cmac->k1;

            }

            else {

                /* ensure we will have a valid remainder value */

                if (cmac->bufferSz > WC_AES_BLOCK_SIZE) {

                    ret = BAD_STATE_E;

                    break;

                }

                remainder = WC_AES_BLOCK_SIZE - cmac->bufferSz;

                if (remainder == 0) {

                    remainder = WC_AES_BLOCK_SIZE;

                }

                if (remainder > 1) {

                    XMEMSET(cmac->buffer + WC_AES_BLOCK_SIZE - remainder, 0,

                            remainder);

                }

                cmac->buffer[WC_AES_BLOCK_SIZE - remainder] = 0x80;

                subKey = cmac->k2;

            }

            xorbuf(cmac->buffer, cmac->digest, WC_AES_BLOCK_SIZE);

            xorbuf(cmac->buffer, subKey, WC_AES_BLOCK_SIZE);

#ifndef HAVE_SELFTEST

            ret = wc_AesEncryptDirect(&cmac->aes, cmac->digest, cmac->buffer);

            if (ret == 0) {

                XMEMCPY(out, cmac->digest, *outSz);

            }

#else

            wc_AesEncryptDirect(&cmac->aes, cmac->digest, cmac->buffer);

            XMEMCPY(out, cmac->digest, *outSz);

#endif

        }; break;

    #endif /* !NO_AES && WOLFSSL_AES_DIRECT */

        case WC_CMAC_NONE:

        default:

            ret = BAD_FUNC_ARG;

        }

    }

    return ret;

}

int wc_CmacFinal(Cmac* cmac, byte* out, word32* outSz)

{

    int ret = 0;

    if (cmac == NULL)

        return BAD_FUNC_ARG;

    ret = wc_CmacFinalNoFree(cmac, out, outSz);

    (void)wc_CmacFree(cmac);

    return ret;

}

#if !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)

int wc_AesCmacGenerate_ex(Cmac* cmac,

                          byte* out, word32* outSz,

                          const byte* in, word32 inSz,

                          const byte* key, word32 keySz,

                          void* heap, int devId)

{

    int ret = 0;

    if (cmac == NULL) {

        return BAD_FUNC_ARG;

    }

#ifdef WOLF_CRYPTO_CB

    /* Set devId regardless of value (invalid or not) */

    cmac->devId = devId;

    #ifndef WOLF_CRYPTO_CB_FIND

    if (devId != INVALID_DEVID)

    #endif

    {

        ret = wc_CryptoCb_Cmac(cmac, key, keySz, in, inSz, out, outSz,

                WC_CMAC_AES, NULL);

        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))

            return ret;

         /* Clear CRYPTOCB_UNAVAILABLE return code */

        ret = 0;

        /* fall-through when unavailable */

    }

#endif

    if ( ((out == NULL) && (outSz != NULL) && (*outSz > 0))

         || (in == NULL && inSz > 0)

         || (key == NULL && keySz > 0))  {

        return BAD_FUNC_ARG;

    }

    /* Init step is optional */

    if (key != NULL) {

        ret = wc_InitCmac_ex(cmac, key, keySz, WC_CMAC_AES, NULL, heap, devId);

    }

    if (ret == 0) {

        ret = wc_CmacUpdate(cmac, in, inSz);

        /* Ensure we are freed and zeroed if not calling wc_CmacFinal */

        if (ret != 0) {

            (void)wc_CmacFree(cmac);

        }

    }

    if (ret == 0) {

        ret = wc_CmacFinal(cmac, out, outSz);

    }

    return ret;

}

int wc_AesCmacGenerate(byte* out, word32* outSz,

                       const byte* in, word32 inSz,

                       const byte* key, word32 keySz)

{

    int ret = 0;

    WC_DECLARE_VAR(cmac, Cmac, 1, 0);

    if (out == NULL || (in == NULL && inSz > 0) || key == NULL || keySz == 0) {

        return BAD_FUNC_ARG;

    }

#ifdef WOLFSSL_SMALL_STACK

    if ((cmac = (Cmac *)XMALLOC(sizeof *cmac, NULL,

                                DYNAMIC_TYPE_CMAC)) == NULL) {

        return MEMORY_E;

    }

#endif

#ifdef WOLFSSL_CHECK_MEM_ZERO

    XMEMSET(((unsigned char *)cmac) + sizeof(Aes), 0xff,

        sizeof(Cmac) - sizeof(Aes));

    /* Aes part is checked by wc_AesFree. */

    wc_MemZero_Add("wc_AesCmacGenerate_ex cmac",

        ((unsigned char *)cmac) + sizeof(Aes), sizeof(Cmac) - sizeof(Aes));

#endif

    ret = wc_AesCmacGenerate_ex(cmac,

                                out, outSz,

                                in, inSz,

                                key, keySz,

                                NULL,

                                INVALID_DEVID);

#ifdef WOLFSSL_SMALL_STACK

    XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC);

#elif defined(WOLFSSL_CHECK_MEM_ZERO)

    wc_MemZero_Check(cmac, sizeof(Cmac));

#endif

    return ret;

}

int wc_AesCmacVerify_ex(Cmac* cmac,

                        const byte* check, word32 checkSz,

                        const byte* in, word32 inSz,

                        const byte* key, word32 keySz,

                        void* heap, int devId)

{

    int ret = 0;

    byte a[WC_AES_BLOCK_SIZE];

    word32 aSz;

    int compareRet;

    if (cmac == NULL || check == NULL || checkSz < WC_CMAC_TAG_MIN_SZ ||

            checkSz > WC_AES_BLOCK_SIZE || (in == NULL && inSz != 0)) {

        return BAD_FUNC_ARG;

    }

    aSz = checkSz;

    XMEMSET(a, 0, sizeof(a));

    ret = wc_AesCmacGenerate_ex(cmac,

                                a, &aSz,

                                in, inSz,

                                key, keySz,

                                heap,

                                devId);

    /* aSz is passed by reference to wc_AesCmacGenerate_ex, which on the

     * WOLF_CRYPTO_CB path forwards it to a user-supplied callback that may

     * write back any value. Reject anything that does not match the user

     * provided length. */

    if (ret == 0 && aSz != checkSz) {

        ret = BAD_STATE_E;

    }

    if (ret == 0) {

        compareRet = ConstantCompare(check, a, (int)aSz);

        ret = compareRet ? MAC_CMP_FAILED_E : 0;

    }

    return ret;

}

int wc_AesCmacVerify(const byte* check, word32 checkSz,

                     const byte* in, word32 inSz,

                     const byte* key, word32 keySz)

{

    int ret = 0;

    WC_DECLARE_VAR(cmac, Cmac, 1, 0);

    if (check == NULL || checkSz < WC_CMAC_TAG_MIN_SZ ||

            checkSz > WC_AES_BLOCK_SIZE || (in == NULL && inSz > 0) ||

            key == NULL || keySz == 0) {

        return BAD_FUNC_ARG;

    }

#ifdef WOLFSSL_SMALL_STACK

    if ((cmac = (Cmac *)XMALLOC(sizeof *cmac, NULL,

                                DYNAMIC_TYPE_CMAC)) == NULL) {

        return MEMORY_E;

    }

#endif

#ifdef WOLFSSL_CHECK_MEM_ZERO

    XMEMSET(((unsigned char *)cmac) + sizeof(Aes), 0xff,

        sizeof(Cmac) - sizeof(Aes));

    /* Aes part is checked by wc_AesFree. */

    wc_MemZero_Add("wc_AesCmacGenerate_ex cmac",

        ((unsigned char *)cmac) + sizeof(Aes), sizeof(Cmac) - sizeof(Aes));

#endif

    ret = wc_AesCmacVerify_ex(cmac,

                              check, checkSz,

                              in, inSz,

                              key, keySz,

                              NULL,

                              INVALID_DEVID);

#ifdef WOLFSSL_SMALL_STACK

    XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC);

#elif defined(WOLFSSL_CHECK_MEM_ZERO)

    wc_MemZero_Check(cmac, sizeof(Cmac));

#endif

    return ret;

}

#endif /* !NO_AES && WOLFSSL_AES_DIRECT */

#endif /* WOLFSSL_CMAC */