Update pairing mechanism and add MAC

src/CMakeLists.txt

@@ -9,6 +9,8 @@
 
 set(DBB-FIRMWARE-SOURCES
         aes.c
+        sharedsecret.c
+        aescbcb64.c
         base58.c
         base64.c
         pbkdf2.c
@@ -31,6 +33,7 @@ set(DBB-FIRMWARE-SOURCES
         ataes132.c
         flash.c
         touch.c
+        ecdh.c
 )
 
 if(USE_SECP256K1_LIB)

src/aescbcb64.c

@@ -0,0 +1,192 @@
+/*
+
+ The MIT License (MIT)
+
+ Copyright (c) 2015-2018 Douglas J. Bakkum
+
+ Permission is hereby granted, free of charge, to any person obtaining
+ a copy of this software and associated documentation files (the "Software"),
+ to deal in the Software without restriction, including without limitation
+ the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ and/or sell copies of the Software, and to permit persons to whom the
+ Software is furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+ OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ OTHER DEALINGS IN THE SOFTWARE.
+
+*/
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "aescbcb64.h"
+#include "hmac.h"
+#include "commander.h"
+#include "sharedsecret.h"
+#include "memory.h"
+#include "base64.h"
+#include "aes.h"
+#include "sha2.h"
+#include "random.h"
+#include "flags.h"
+#include "utils.h"
+
+// Must free() returned value
+static uint8_t *aescbcb64_init_and_encrypt(const unsigned char *in, int inlen,
+        int *out_len,
+        const uint8_t *key)
+{
+    int  pads;
+    int  inpadlen = inlen + N_BLOCK - inlen % N_BLOCK;
+    unsigned char inpad[inpadlen];
+    unsigned char enc[inpadlen];
+    unsigned char iv[N_BLOCK];
+    uint8_t *enc_cat = malloc(sizeof(uint8_t) * (inpadlen +
+                              N_BLOCK)); // concatenating [ iv0  |  enc ]
+    *out_len = inpadlen + N_BLOCK;
+
+    aes_context ctx[1];
+
+    // Set cipher key
+    memset(ctx, 0, sizeof(ctx));
+    aes_set_key(key, 32, ctx);
+
+    // PKCS7 padding
+    memcpy(inpad, in, inlen);
+    for (pads = 0; pads < N_BLOCK - inlen % N_BLOCK; pads++ ) {
+        inpad[inlen + pads] = (N_BLOCK - inlen % N_BLOCK);
+    }
+
+    // Make a random initialization vector
+    if (random_bytes((uint8_t *)iv, N_BLOCK, 0) == DBB_ERROR) {
+        commander_fill_report(cmd_str(CMD_random), NULL, DBB_ERR_MEM_ATAES);
+        utils_zero(inpad, inpadlen);
+        utils_zero(ctx, sizeof(ctx));
+        return NULL;
+    }
+    memcpy(enc_cat, iv, N_BLOCK);
+
+    // CBC encrypt multiple blocks
+    aes_cbc_encrypt(inpad, enc, inpadlen / N_BLOCK, iv, ctx);
+    memcpy(enc_cat + N_BLOCK, enc, inpadlen);
+
+    utils_zero(inpad, inpadlen);
+    utils_zero(ctx, sizeof(ctx));
+    return enc_cat;
+}
+
+
+// Must free() returned value (allocated inside base64() function)
+char *aescbcb64_encrypt(const unsigned char *in, int inlen, int *out_b64len,
+                        const uint8_t *key)
+{
+    int out_len;
+    uint8_t *enc_cat = aescbcb64_init_and_encrypt(in, inlen, &out_len, key);
+    // base64 encoding
+    char *b64;
+    b64 = base64(enc_cat, out_len, out_b64len);
+    free(enc_cat);
+    return b64;
+}
+
+// Encrypts a given constant char array of length inlen using the AES algorithm with CBC mode,
+// appends its SHA256 HMAC and base64 encodes the result.
+//
+// Must free() returned value
+char *aescbcb64_hmac_encrypt(const unsigned char *in, int inlen, int *out_b64len,
+                             const uint8_t *shared_secret)
+{
+    uint8_t encryption_key[SHA256_DIGEST_LENGTH];
+    uint8_t authentication_key[SHA256_DIGEST_LENGTH];
+
+    sharedsecret_derive_keys(shared_secret, encryption_key, authentication_key);
+
+    int encrypt_len;
+    uint8_t *encrypted = aescbcb64_init_and_encrypt(in,
+                         inlen,
+                         &encrypt_len,
+                         encryption_key);
+    uint8_t hmac[SHA256_DIGEST_LENGTH];
+    hmac_sha256(authentication_key, SHA256_DIGEST_LENGTH, encrypted, encrypt_len, hmac);
+
+    uint8_t authenticated_encrypted_msg[encrypt_len + SHA256_DIGEST_LENGTH];
+    memcpy(authenticated_encrypted_msg, encrypted, encrypt_len);
+    memcpy(authenticated_encrypted_msg + encrypt_len, hmac, SHA256_DIGEST_LENGTH);
+
+    free(encrypted);
+    utils_zero(encryption_key, sizeof(encryption_key));
+    utils_zero(authentication_key, sizeof(authentication_key));
+    char *b64 = base64(authenticated_encrypted_msg, encrypt_len + SHA256_DIGEST_LENGTH,
+                       out_b64len);
+    return b64;
+}
+
+char *aescbcb64_init_and_decrypt(uint8_t *ub64, int ub64len, int *decrypt_len,
+                                 const uint8_t *key)
+{
+    *decrypt_len = 0;
+
+    // Set cipher key
+    aes_context ctx[1];
+    memset(ctx, 0, sizeof(ctx));
+    aes_set_key(key, 32, ctx);
+
+    unsigned char dec_pad[ub64len - N_BLOCK];
+    aes_cbc_decrypt(ub64 + N_BLOCK, dec_pad, ub64len / N_BLOCK - 1, ub64, ctx);
+
+    // Strip PKCS7 padding
+    int padlen = dec_pad[ub64len - N_BLOCK - 1];
+    if (ub64len - N_BLOCK - padlen <= 0) {
+        utils_zero(dec_pad, sizeof(dec_pad));
+        utils_zero(ctx, sizeof(ctx));
+        return NULL;
+    }
+    char *dec = malloc(ub64len - N_BLOCK - padlen + 1); // +1 for null termination
+    if (!dec) {
+        utils_zero(dec_pad, sizeof(dec_pad));
+        utils_zero(ctx, sizeof(ctx));
+        return NULL;
+    }
+    memcpy(dec, dec_pad, ub64len - N_BLOCK - padlen);
+    dec[ub64len - N_BLOCK - padlen] = '\0';
+    *decrypt_len = ub64len - N_BLOCK - padlen + 1;
+    utils_zero(dec_pad, sizeof(dec_pad));
+    utils_zero(ctx, sizeof(ctx));
+    return dec;
+}
+
+// Must free() returned value
+char *aescbcb64_decrypt(const unsigned char *in, int inlen, int *decrypt_len,
+                        const uint8_t *key)
+{
+    if (!in || inlen == 0) {
+        return NULL;
+    }
+
+    // Unbase64
+    int ub64len;
+    unsigned char *ub64 = unbase64((const char *)in, inlen, &ub64len);
+    if (!ub64) {
+        return NULL;
+    }
+    if ((ub64len % N_BLOCK) || ub64len < N_BLOCK) {
+        free(ub64);
+        return NULL;
+    }
+
+    char *ret = aescbcb64_init_and_decrypt(ub64, ub64len, decrypt_len, key);
+    memset(ub64, 0, ub64len);
+    free(ub64);
+    return ret;
+}
+
+

src/aescbcb64.h

@@ -0,0 +1,43 @@
+/*
+
+ The MIT License (MIT)
+
+ Copyright (c) 2015-2018 Douglas J. Bakkum
+
+ Permission is hereby granted, free of charge, to any person obtaining
+ a copy of this software and associated documentation files (the "Software"),
+ to deal in the Software without restriction, including without limitation
+ the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ and/or sell copies of the Software, and to permit persons to whom the
+ Software is furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+ OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ OTHER DEALINGS IN THE SOFTWARE.
+
+*/
+
+#ifndef _AESCBCB64_H_
+#define _AESCBCB64_H_
+
+
+char *aescbcb64_hmac_encrypt(const unsigned char *in, int inlen,
+                             int *out_b64len, const uint8_t *shared_secret);
+
+char *aescbcb64_init_and_decrypt(uint8_t *ub64, int ub64len, int *decrypt_len,
+                                 const uint8_t *key);
+
+char *aescbcb64_encrypt(const unsigned char *in, int inlen,
+                        int *out_b64len, const uint8_t *key);
+
+char *aescbcb64_decrypt(const unsigned char *in, int inlen,
+                        int *decrypt_len, const uint8_t *key);
+
+#endif