Skip to content

Commit 52e4449

Browse files
dgarskedgarske
authored
Merge pull request #563 from padelsbach/padelsbach/aesgcm-rdseed
Extend AES minimal and rdseed examples
2 parents 498d78e + 1ac9c87 commit 52e4449

File tree

6 files changed

+457
-50
lines changed

6 files changed

+457
-50
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,8 @@ crypto/aes/aesctr-file-encrypt
137137
crypto/aes/aesgcm-file-encrypt
138138
crypto/aes/aesgcm-oneshot
139139
crypto/aes/aesgcm-minimal
140+
crypto/aes/aesgcm-file-minimal
141+
crypto/aes/rdseed/aesgcm-rdseed
140142
crypto/camellia/camellia-encrypt
141143
crypto/pkcs12/pkcs12-create-example
142144
crypto/pkcs12/pkcs12-example

‎crypto/aes/Makefile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ CFLAGS=-Wall
33
WOLFSSL_INSTALL_DIR=/usr/local
44
LIBS=-L$(WOLFSSL_INSTALL_DIR)/lib -lwolfssl -lm
55

6-
all: aes-file-encrypt aescfb-file-encrypt aesctr-file-encrypt aesgcm-file-encrypt aesgcm-oneshot aesgcm-minimal
6+
all: aes-file-encrypt aescfb-file-encrypt aesctr-file-encrypt aesgcm-file-encrypt aesgcm-file-minimal aesgcm-oneshot aesgcm-minimal
77

88
aes-file-encrypt: aes-file-encrypt.o
99
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
@@ -23,7 +23,10 @@ aesgcm-oneshot: aesgcm-oneshot.o
2323
aesgcm-minimal: aesgcm-minimal.o
2424
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
2525

26+
aesgcm-file-minimal: aesgcm-file-minimal.o
27+
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
28+
2629
.PHONY: clean
2730

2831
clean:
29-
rm -f *.o aes-file-encrypt aescfb-file-encrypt aesctr-file-encrypt aesgcm-file-encrypt text* aesgcm-oneshot aesgcm-minimal
32+
rm -f *.o aes-file-encrypt aescfb-file-encrypt aesctr-file-encrypt aesgcm-file-encrypt aesgcm-file-minimal text* aesgcm-oneshot aesgcm-minimal

‎crypto/aes/aesgcm-file-minimal.c‎

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
/* aesgcm-file-minimal.c
2+
*
3+
* Copyright (C) 2006-2026 wolfSSL Inc.
4+
*
5+
* This file is part of wolfSSL.
6+
*
7+
* wolfSSL is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 2 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfSSL is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
#ifndef WOLFSSL_USER_SETTINGS
23+
#include <wolfssl/options.h>
24+
#endif
25+
#include <wolfssl/wolfcrypt/aes.h>
26+
#include <wolfssl/wolfcrypt/random.h>
27+
28+
#include <stdio.h>
29+
#include <stdlib.h>
30+
#include <string.h>
31+
32+
#define KEY_SZ AES_256_KEY_SIZE
33+
#define NONCE_SZ GCM_NONCE_MID_SZ
34+
#define TAG_SZ AES_BLOCK_SIZE
35+
36+
static int Encrypt(const byte* key, const byte* iv, const byte* in,
37+
word32 inSz, byte* out, byte* tag)
38+
{
39+
Aes aes;
40+
int ret;
41+
ret = wc_AesInit(&aes, NULL, INVALID_DEVID);
42+
if (ret == 0) {
43+
ret = wc_AesGcmSetKey(&aes, key, KEY_SZ);
44+
}
45+
if (ret == 0) {
46+
ret = wc_AesGcmEncrypt(&aes, out, in, inSz, iv, NONCE_SZ,
47+
tag, TAG_SZ, NULL, 0);
48+
}
49+
wc_AesFree(&aes);
50+
return ret;
51+
}
52+
53+
static int Decrypt(const byte* key, const byte* iv, const byte* in,
54+
word32 inSz, byte* out, const byte* tag)
55+
{
56+
Aes aes;
57+
int ret;
58+
ret = wc_AesInit(&aes, NULL, INVALID_DEVID);
59+
if (ret == 0) {
60+
ret = wc_AesGcmSetKey(&aes, key, KEY_SZ);
61+
}
62+
if (ret == 0) {
63+
ret = wc_AesGcmDecrypt(&aes, out, in, inSz, iv, NONCE_SZ,
64+
tag, TAG_SZ, NULL, 0);
65+
}
66+
wc_AesFree(&aes);
67+
return ret;
68+
}
69+
70+
static int ReadFile(const char* path, byte** data, word32* sz)
71+
{
72+
FILE* file;
73+
long fileSz;
74+
byte* buf;
75+
76+
*data = NULL;
77+
*sz = 0;
78+
file = fopen(path, "rb");
79+
if (file == NULL) {
80+
return -1;
81+
}
82+
if (fseek(file, 0, SEEK_END) != 0) {
83+
fclose(file);
84+
return -1;
85+
}
86+
fileSz = ftell(file);
87+
if (fileSz < 0) {
88+
fclose(file);
89+
return -1;
90+
}
91+
if (fseek(file, 0, SEEK_SET) != 0) {
92+
fclose(file);
93+
return -1;
94+
}
95+
buf = (byte*)malloc((size_t)fileSz);
96+
if (buf == NULL && fileSz != 0) {
97+
fclose(file);
98+
return -1;
99+
}
100+
if (fileSz != 0 && fread(buf, 1, (size_t)fileSz, file) != (size_t)fileSz) {
101+
free(buf);
102+
fclose(file);
103+
return -1;
104+
}
105+
fclose(file);
106+
*data = buf;
107+
*sz = fileSz;
108+
return 0;
109+
}
110+
111+
static int WriteFile(const char* path, const byte* data, long dataSz)
112+
{
113+
FILE* file = fopen(path, "wb");
114+
if (file == NULL) {
115+
return -1;
116+
}
117+
if (dataSz != 0 &&
118+
fwrite(data, 1, (size_t)dataSz, file) != (size_t)dataSz) {
119+
fclose(file);
120+
return -1;
121+
}
122+
fclose(file);
123+
return 0;
124+
}
125+
126+
static void print_hex(const char* label, const byte* data, word32 sz)
127+
{
128+
word32 i;
129+
printf("%s: ", label);
130+
for (i = 0; i < sz; i++) {
131+
printf("%02x", data[i]);
132+
}
133+
printf("\n");
134+
}
135+
136+
int main(int argc, char** argv)
137+
{
138+
byte key[KEY_SZ], iv[NONCE_SZ], tag[TAG_SZ];
139+
byte* plaintext = NULL;
140+
byte* ciphertext = NULL;
141+
byte* decrypted = NULL;
142+
word32 plaintextSz = 0;
143+
WC_RNG rng;
144+
int ret;
145+
146+
if (argc != 4) {
147+
printf("Usage: %s <input-file> <encrypted-file> <decrypted-file>\n",
148+
argv[0]);
149+
return 1;
150+
}
151+
152+
if (ReadFile(argv[1], &plaintext, &plaintextSz) != 0) {
153+
printf("Failed to read: %s\n", argv[1]);
154+
return 1;
155+
}
156+
157+
ciphertext = (byte*)malloc((size_t)plaintextSz);
158+
decrypted = (byte*)malloc((size_t)plaintextSz);
159+
if ((ciphertext == NULL || decrypted == NULL) && plaintextSz != 0) {
160+
printf("alloc failed\n");
161+
ret = 1;
162+
goto exit;
163+
}
164+
165+
ret = wc_InitRng(&rng);
166+
if (ret == 0) {
167+
ret = wc_RNG_GenerateBlock(&rng, key, KEY_SZ);
168+
if (ret == 0) {
169+
ret = wc_RNG_GenerateBlock(&rng, iv, NONCE_SZ);
170+
}
171+
wc_FreeRng(&rng);
172+
}
173+
if (ret != 0) {
174+
printf("Key/IV generation failed: %d\n", ret);
175+
goto exit;
176+
}
177+
178+
ret = Encrypt(key, iv, plaintext, plaintextSz, ciphertext, tag);
179+
if (ret != 0) {
180+
printf("Encryption failed: %d\n", ret);
181+
goto exit;
182+
}
183+
184+
if (WriteFile(argv[2], ciphertext, plaintextSz) != 0) {
185+
printf("Failed to write: %s\n", argv[2]);
186+
ret = 1;
187+
goto exit;
188+
}
189+
190+
ret = Decrypt(key, iv, ciphertext, plaintextSz, decrypted, tag);
191+
if (ret != 0) {
192+
printf("Decryption failed: %d\n", ret);
193+
goto exit;
194+
}
195+
196+
if (WriteFile(argv[3], decrypted, plaintextSz) != 0) {
197+
printf("Failed to write: %s\n", argv[3]);
198+
ret = 1;
199+
goto exit;
200+
}
201+
202+
print_hex("Key", key, KEY_SZ);
203+
print_hex("IV", iv, NONCE_SZ);
204+
print_hex("Tag", tag, TAG_SZ);
205+
printf("Encrypted %u bytes to %s\n", plaintextSz, argv[2]);
206+
printf("Decrypted %u bytes to %s\n", plaintextSz, argv[3]);
207+
208+
if (memcmp(plaintext, decrypted, (size_t)plaintextSz) == 0) {
209+
printf("Round-trip OK: decrypted output matches original input\n");
210+
}
211+
else {
212+
printf("Round-trip FAILED: mismatch\n");
213+
ret = 1;
214+
}
215+
216+
exit:
217+
free(decrypted);
218+
free(ciphertext);
219+
free(plaintext);
220+
return ret;
221+
}

‎crypto/aes/aesgcm-minimal.c‎

Lines changed: 2 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
#include <wolfssl/options.h>
2424
#endif
2525
#include <wolfssl/wolfcrypt/aes.h>
26-
#include <wolfssl/wolfcrypt/error-crypt.h>
2726
#include <wolfssl/wolfcrypt/random.h>
2827

2928
#include <stdio.h>
@@ -33,58 +32,12 @@
3332
#define NONCE_SZ GCM_NONCE_MID_SZ
3433
#define TAG_SZ AES_BLOCK_SIZE
3534

36-
/* Optional setup path: seed wolfSSL RNG via RDSEED when available. */
37-
#if defined(__x86_64__)
38-
#define RDSEED_ENABLED 1
39-
#endif
40-
41-
#if defined(WC_RNG_SEED_CB) && defined(RDSEED_ENABLED)
42-
#include <immintrin.h>
43-
44-
/* wc_RngSeed_Cb: feed wolfSSL DRBG seed using RDSEED. */
45-
__attribute__((target("rdseed")))
46-
static int RdseedSeedCb(OS_Seed* os, byte* seed, word32 sz)
47-
{
48-
word32 i = 0;
49-
(void)os;
50-
51-
while (i < sz) {
52-
unsigned long long v = 0;
53-
int ok = 0;
54-
int tries;
55-
word32 n;
56-
57-
for (tries = 0; tries < 16; tries++) {
58-
if (_rdseed64_step(&v)) {
59-
ok = 1;
60-
break;
61-
}
62-
}
63-
if (!ok) {
64-
return RNG_FAILURE_E;
65-
}
66-
67-
n = (sz - i < (word32)sizeof(v)) ? (sz - i) : (word32)sizeof(v);
68-
memcpy(seed + i, &v, n);
69-
i += n;
70-
}
71-
return 0;
72-
}
73-
#endif
74-
7535
static int GenerateKeyAndIv(byte* key, byte* iv)
7636
{
7737
WC_RNG rng;
7838
int ret;
7939

80-
/* Setup: initialize RNG and (optionally) override seed source. */
81-
#if defined(WC_RNG_SEED_CB) && defined(RDSEED_ENABLED)
82-
wc_SetSeed_Cb(RdseedSeedCb);
8340
ret = wc_InitRng(&rng);
84-
wc_SetSeed_Cb(NULL);
85-
#else
86-
ret = wc_InitRng(&rng);
87-
#endif
8841
if (ret != 0) {
8942
return ret;
9043
}
@@ -137,8 +90,9 @@ static int Decrypt(const byte* key, const byte* iv, const byte* ciphertext,
13790

13891
void print_hex(const char* label, const byte* data, word32 sz)
13992
{
93+
word32 i;
14094
printf("%s: ", label);
141-
for (word32 i = 0; i < sz; i++) {
95+
for (i = 0; i < sz; i++) {
14296
printf("%02x", data[i]);
14397
}
14498
printf("\n");

‎crypto/aes/rdseed/Makefile‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
CC ?= gcc
2+
WOLFSSL_INSTALL_DIR ?= /usr/local
3+
4+
CPPFLAGS ?= -I$(WOLFSSL_INSTALL_DIR)/include
5+
CFLAGS ?= -O2 -Wall -Wextra -Werror
6+
CFLAGS += -mrdseed
7+
LDFLAGS ?=
8+
LDLIBS ?= -L$(WOLFSSL_INSTALL_DIR)/lib -lwolfssl -lm
9+
10+
all: aesgcm-rdseed
11+
12+
aesgcm-rdseed: aesgcm-rdseed.o
13+
$(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS)
14+
15+
clean:
16+
rm -f *.o aesgcm-rdseed
17+
18+
.PHONY: all clean

0 commit comments

Comments
 (0)