1 // Copyright 2022 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/mac/aes_cmac_key.h"
18
19 #include <memory>
20 #include <string>
21
22 #include "absl/base/attributes.h"
23 #include "absl/strings/escaping.h"
24 #include "absl/strings/str_format.h"
25 #include "absl/types/optional.h"
26 #include "tink/mac/aes_cmac_parameters.h"
27 #include "tink/partial_key_access_token.h"
28 #include "tink/restricted_data.h"
29 #include "tink/subtle/subtle_util.h"
30 #include "tink/util/status.h"
31 #include "tink/util/statusor.h"
32
33 namespace crypto {
34 namespace tink {
35
Create(const AesCmacParameters & parameters,const RestrictedData & key_bytes,absl::optional<int> id_requirement,PartialKeyAccessToken token)36 util::StatusOr<AesCmacKey> AesCmacKey::Create(
37 const AesCmacParameters& parameters, const RestrictedData& key_bytes,
38 absl::optional<int> id_requirement, PartialKeyAccessToken token) {
39 if (parameters.KeySizeInBytes() != key_bytes.size()) {
40 return util::Status(absl::StatusCode::kInvalidArgument,
41 "Key size does not match AES-CMAC parameters");
42 }
43 if (parameters.HasIdRequirement() && !id_requirement.has_value()) {
44 return util::Status(
45 absl::StatusCode::kInvalidArgument,
46 "Cannot create key without ID requirement with parameters with ID "
47 "requirement");
48 }
49 if (!parameters.HasIdRequirement() && id_requirement.has_value()) {
50 return util::Status(
51 absl::StatusCode::kInvalidArgument,
52 "Cannot create key with ID requirement with parameters without ID "
53 "requirement");
54 }
55 util::StatusOr<std::string> output_prefix =
56 ComputeOutputPrefix(parameters, id_requirement);
57 if (!output_prefix.ok()) {
58 return output_prefix.status();
59 }
60 return AesCmacKey(parameters, key_bytes, id_requirement,
61 *std::move(output_prefix));
62 }
63
ComputeOutputPrefix(const AesCmacParameters & parameters,absl::optional<int> id_requirement)64 util::StatusOr<std::string> AesCmacKey::ComputeOutputPrefix(
65 const AesCmacParameters& parameters, absl::optional<int> id_requirement) {
66 switch (parameters.GetVariant()) {
67 case AesCmacParameters::Variant::kNoPrefix:
68 return std::string(""); // Empty prefix.
69 case AesCmacParameters::Variant::kLegacy:
70 ABSL_FALLTHROUGH_INTENDED;
71 case AesCmacParameters::Variant::kCrunchy:
72 if (!id_requirement.has_value()) {
73 return util::Status(
74 absl::StatusCode::kInvalidArgument,
75 "id requirement must have value with kCrunchy or kLegacy");
76 }
77 return absl::StrCat(absl::HexStringToBytes("00"),
78 subtle::BigEndian32(*id_requirement));
79 case AesCmacParameters::Variant::kTink:
80 if (!id_requirement.has_value()) {
81 return util::Status(absl::StatusCode::kInvalidArgument,
82 "id requirement must have value with kTink");
83 }
84 return absl::StrCat(absl::HexStringToBytes("01"),
85 subtle::BigEndian32(*id_requirement));
86 default:
87 return util::Status(
88 absl::StatusCode::kInvalidArgument,
89 absl::StrCat("Invalid variant: ", parameters.GetVariant()));
90 }
91 }
92
operator ==(const Key & other) const93 bool AesCmacKey::operator==(const Key& other) const {
94 const AesCmacKey* that = dynamic_cast<const AesCmacKey*>(&other);
95 if (that == nullptr) {
96 return false;
97 }
98 if (GetParameters() != that->GetParameters()) {
99 return false;
100 }
101 if (id_requirement_ != that->id_requirement_) {
102 return false;
103 }
104 return key_bytes_ == that->key_bytes_;
105 }
106
107 } // namespace tink
108 } // namespace crypto
109