commit e78775eed2be169787199798189ad1e965f8c0a7
author Andrzej Kurek <andrzej.kurek@arm.com> Thu Jul 02 10:57:00 2020 -0400
committer Andrzej Kurek <andrzej.kurek@arm.com> Sat Jul 18 05:21:32 2020 -0400
tree 67c8791fae205e4317deecfe4044cd15a28b81ff
parent 4b700a3db35405dc28a6aab432a6d9be23435f1e

Use a fake random key in AES calculations

Create an additional field in the AES context to store a randomized fake key.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>

include/mbedtls/aes.h

diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h
index 6990be0..055107a 100644
--- a/include/mbedtls/aes.h
+++ b/include/mbedtls/aes.h
@@ -87,6 +87,7 @@
 {
     int nr;                     /*!< The number of rounds. */
     uint32_t *rk;               /*!< AES round keys. */
+    uint32_t frk[8];            /*!< Fake AES round keys. */
 #if defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) && !defined(MBEDTLS_PADLOCK_C)
     uint32_t buf[44];           /*!< Unaligned data buffer */
 #else /* MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH */

library/aes.c

diff --git a/library/aes.c b/library/aes.c
index e9e7544..03dabd8 100644
--- a/library/aes.c
+++ b/library/aes.c
@@ -675,6 +675,16 @@
 }
 #endif /* MBEDTLS_CIPHER_MODE_XTS */
 
+static void mbedtls_generate_fake_key( unsigned int keybits, mbedtls_aes_context *ctx )
+{
+    unsigned int qword;
+
+    for( qword = keybits >> 5; qword > 0; qword-- )
+    {
+        ctx->frk[ qword - 1 ] = mbedtls_platform_random_uint32();
+    }
+}
+
 /*
  * AES key schedule (encryption)
  */
@@ -719,6 +729,7 @@
     else
 #endif
     ctx->rk = RK = ctx->buf;
+    mbedtls_generate_fake_key( keybits, ctx );
 
 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
@@ -858,6 +869,7 @@
     else
 #endif
     ctx->rk = RK = ctx->buf;
+    mbedtls_generate_fake_key( keybits, ctx );
 
     /* Also checks keybits */
     if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 )
@@ -1071,7 +1083,7 @@
     uint8_t round_ctrl_table[( 14 + AES_SCA_CM_ROUNDS + 2 )];
 
     aes_data_real.rk_ptr = ctx->rk;
-    aes_data_fake.rk_ptr = ctx->rk;
+    aes_data_fake.rk_ptr = ctx->frk;
     aes_data_table[0] = &aes_data_real;
     aes_data_table[1] = &aes_data_fake;
 
@@ -1351,7 +1363,7 @@
     uint8_t round_ctrl_table[( 14 + AES_SCA_CM_ROUNDS + 2 )];
 
     aes_data_real.rk_ptr = ctx->rk;
-    aes_data_fake.rk_ptr = ctx->rk;
+    aes_data_fake.rk_ptr = ctx->frk;
     aes_data_table[0] = &aes_data_real;
     aes_data_table[1] = &aes_data_fake;