Merge pull request #37 from anhu/ccm

Add support for AES-CCM.
wolfSSL · Jan 2, 2025 · aa0fd6d · aa0fd6d
2 parents 6bee701 + d32bd83
commit aa0fd6d
Show file tree

Hide file tree

Showing 8 changed files with 476 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -32,7 +32,10 @@ cd wolfPKCS11
 make
 make check
 ```
+### Optional: AES-CCM Support
 
+To have AES-CCM support in wolfPKCS11, simiply configure wolfSSL with the
+addition of `--enable-aesccm`
 
 ### TPM support with wolfTPM
 

diff --git a/configure.ac b/configure.ac
@@ -238,6 +238,18 @@ else
     DISABLE_DEFS="$DISABLE_DEFS -DHAVE_AESGCM"
 fi
 
+AC_ARG_ENABLE([aesccm],
+    [AS_HELP_STRING([--enable-aesccm],[Enable AES-CCM (default: disabled)])],
+    [ ENABLED_AESCCM=$enableval ],
+    [ ENABLED_AESCCM=no ]
+    )
+if test "$ENABLED_AES" = "yes" && test "$ENABLED_AESCCM" = "yes"
+then
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"
+else
+    DISABLE_DEFS="$DISABLE_DEFS -DHAVE_AESCCM"
+fi
+
 AC_ARG_ENABLE([hmac],
     [AS_HELP_STRING([--enable-hmac],[Enable HMAC (default: enabled)])],
     [ ENABLED_HMAC=$enableval ],
@@ -501,6 +513,7 @@ echo "   * Single threaded:            $ENABLED_SINGLETHREADED"
 echo "   * AES:                        $ENABLED_AES"
 echo "   * AES-CBC:                    $ENABLED_AESCBC"
 echo "   * AES-GCM:                    $ENABLED_AESGCM"
+echo "   * AES-CCM:                    $ENABLED_AESCCM"
 echo "   * MD5:                        $ENABLED_MD5"
 echo "   * SHA:                        $ENABLED_SHA1"
 echo "   * SHA-224:                    $ENABLED_SHA224"

diff --git a/src/crypto.c b/src/crypto.c
@@ -1288,6 +1288,30 @@ CK_RV C_EncryptInit(CK_SESSION_HANDLE hSession,
             break;
         }
     #endif
+
+    #ifdef HAVE_AESCCM
+        case CKM_AES_CCM: {
+             CK_CCM_PARAMS* params;
+
+            if (type != CKK_AES)
+                return CKR_KEY_TYPE_INCONSISTENT;
+            if (pMechanism->pParameter == NULL)
+                return CKR_MECHANISM_PARAM_INVALID;
+            if (pMechanism->ulParameterLen != sizeof(CK_CCM_PARAMS))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+            params = (CK_CCM_PARAMS*)pMechanism->pParameter;
+            ret = WP11_Session_SetCcmParams(session,
+                                            (int)params->ulDataLen,
+                                            params->pIv, (int)params->ulIvLen,
+                                            params->pAAD, (int)params->ulAADLen,
+                                            (int)params->ulMacLen);
+            if (ret != 0)
+                return CKR_MECHANISM_PARAM_INVALID;
+            init = WP11_INIT_AES_CCM_ENC;
+            break;
+        }
+    #endif
 #endif
         default:
             (void)type;
@@ -1471,6 +1495,27 @@ CK_RV C_Encrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
             *pulEncryptedDataLen = encDataLen;
             break;
     #endif
+    #ifdef HAVE_AESCCM
+        case CKM_AES_CCM:
+            if (!WP11_Session_IsOpInitialized(session, WP11_INIT_AES_CCM_ENC))
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+            encDataLen = (word32)ulDataLen +
+                                            WP11_AesCcm_GetMacLen(session);
+            if (pEncryptedData == NULL) {
+                *pulEncryptedDataLen = encDataLen;
+                return CKR_OK;
+            }
+            if (encDataLen > (word32)*pulEncryptedDataLen)
+                return CKR_BUFFER_TOO_SMALL;
+
+            ret = WP11_AesCcm_Encrypt(pData, (int)ulDataLen, pEncryptedData,
+                                      &encDataLen, obj, session);
+            if (ret < 0)
+                return CKR_FUNCTION_FAILED;
+            *pulEncryptedDataLen = encDataLen;
+            break;
+    #endif
 #endif
         default:
             (void)ret;
@@ -1858,6 +1903,29 @@ CK_RV C_DecryptInit(CK_SESSION_HANDLE hSession,
             break;
         }
     #endif
+    #ifdef HAVE_AESCCM
+        case CKM_AES_CCM: {
+            CK_CCM_PARAMS* params;
+
+            if (type != CKK_AES)
+                return CKR_KEY_TYPE_INCONSISTENT;
+            if (pMechanism->pParameter == NULL)
+                return CKR_MECHANISM_PARAM_INVALID;
+            if (pMechanism->ulParameterLen != sizeof(CK_CCM_PARAMS))
+                return CKR_MECHANISM_PARAM_INVALID;
+
+            params = (CK_CCM_PARAMS*)pMechanism->pParameter;
+            ret = WP11_Session_SetCcmParams(session,
+                                            (int)params->ulDataLen,
+                                            params->pIv, (int)params->ulIvLen,
+                                            params->pAAD, (int)params->ulAADLen,
+                                            (int)params->ulMacLen);
+            if (ret != 0)
+                return CKR_MECHANISM_PARAM_INVALID;
+            init = WP11_INIT_AES_CCM_DEC;
+            break;
+        }
+    #endif
 #endif
         default:
             (void)type;
@@ -2042,6 +2110,27 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
             *pulDataLen = decDataLen;
             break;
     #endif
+    #ifdef HAVE_AESCCM
+        case CKM_AES_CCM:
+            if (!WP11_Session_IsOpInitialized(session, WP11_INIT_AES_CCM_DEC))
+                return CKR_OPERATION_NOT_INITIALIZED;
+
+            decDataLen = (word32)ulEncryptedDataLen -
+                                            WP11_AesCcm_GetMacLen(session);
+            if (pData == NULL) {
+                *pulDataLen = decDataLen;
+                return CKR_OK;
+            }
+            if (decDataLen > (word32)*pulDataLen)
+                return CKR_BUFFER_TOO_SMALL;
+
+            ret = WP11_AesCcm_Decrypt(pEncryptedData, (int)ulEncryptedDataLen,
+                                      pData, &decDataLen, obj, session);
+            if (ret < 0)
+                return CKR_FUNCTION_FAILED;
+            *pulDataLen = decDataLen;
+            break;
+    #endif
 #endif
         default:
             (void)decDataLen;