Support 192 and 256-bit keys for AES

esp-hal/CHANGELOG.md

@@ -35,6 +35,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fixed writes to SPI not flushing before attempting to write, causing corrupted writes (#1381)
 - fix AdcConfig::adc_calibrate for xtensa targets (#1379)
 - Fixed a divide by zero panic when setting the LEDC duty cycle to 0 with `SetDutyCycle::set_duty_cycle` (#1403)
+- Support 192 and 256-bit keys for AES (#1316)
 
 ### Changed
 

esp-hal/src/aes/mod.rs

@@ -37,10 +37,10 @@
 //!
 //! ```no_run
 //! let mut block = block_buf.clone();
-//! aes.process(&mut block, Mode::Encryption128, &keybuf);
+//! aes.process(&mut block, Mode::Encryption128, keybuf.into());
 //! let hw_encrypted = block.clone();
 //!
-//! aes.process(&mut block, Mode::Decryption128, &keybuf);
+//! aes.process(&mut block, Mode::Decryption128, keybuf.into());
 //! let hw_decrypted = block;
 //! ```
 //!
@@ -97,7 +97,7 @@
 //!         hw_encrypted,
 //!         Mode::Encryption128,
 //!         CipherMode::Ecb,
-//!         keybuf,
+//!         &keybuf,
 //!     )
 //!     .unwrap();
 //! transfer.wait().unwrap();
@@ -122,6 +122,49 @@ mod aes_spec_impl;
 
 const ALIGN_SIZE: usize = core::mem::size_of::<u32>();
 
+/// Represents the various key sizes allowed for AES encryption and decryption.
+pub enum Key {
+    /// 128-bit AES key
+    Key16([u8; 16]),
+    #[cfg(any(feature = "esp32", feature = "esp32s2"))]
+    /// 192-bit AES key
+    Key24([u8; 24]),
+    /// 256-bit AES key
+    Key32([u8; 32]),
+}
+
+// Implementing From for easy conversion from array to Key enum.
+impl From<[u8; 16]> for Key {
+    fn from(key: [u8; 16]) -> Self {
+        Key::Key16(key)
+    }
+}
+
+#[cfg(any(feature = "esp32", feature = "esp32s2"))]
+impl From<[u8; 24]> for Key {
+    fn from(key: [u8; 24]) -> Self {
+        Key::Key24(key)
+    }
+}
+
+impl From<[u8; 32]> for Key {
+    fn from(key: [u8; 32]) -> Self {
+        Key::Key32(key)
+    }
+}
+
+impl Key {
+    /// Returns a slice representation of the AES key.
+    fn as_slice(&self) -> &[u8] {
+        match self {
+            Key::Key16(ref key) => key,
+            #[cfg(any(feature = "esp32", feature = "esp32s2"))]
+            Key::Key24(ref key) => key,
+            Key::Key32(ref key) => key,
+        }
+    }
+}
+
 pub enum Mode {
     Encryption128 = 0,
     #[cfg(any(esp32, esp32s2))]
@@ -154,8 +197,9 @@ impl<'d> Aes<'d> {
     }
 
     /// Encrypts/Decrypts the given buffer based on `mode` parameter
-    pub fn process(&mut self, block: &mut [u8; 16], mode: Mode, key: &[u8; 16]) {
-        self.write_key(key);
+    pub fn process(&mut self, block: &mut [u8; 16], mode: Mode, key: Key) {
+        // Convert from Key enum to required byte slice
+        self.write_key(key.as_slice());
         self.set_mode(mode as u8);
         self.set_block(block);
         self.start();
@@ -396,7 +440,7 @@ pub mod dma {
             read_buffer: &'t mut RXBUF,
             mode: Mode,
             cipher_mode: CipherMode,
-            key: [u8; 16],
+            key: &[u8],
         ) -> Result<AesDmaTransferRxTx<'t, 'd, C>, crate::dma::DmaError>
         where
             TXBUF: ReadBuffer<Word = u8>,
@@ -427,7 +471,7 @@ pub mod dma {
             read_buffer_len: usize,
             mode: Mode,
             cipher_mode: CipherMode,
-            key: [u8; 16],
+            key: &[u8],
         ) -> Result<(), crate::dma::DmaError> {
             // AES has to be restarted after each calculation
             self.reset_aes();
@@ -457,7 +501,7 @@ pub mod dma {
             self.enable_interrupt();
             self.set_mode(mode);
             self.set_cipher_mode(cipher_mode);
-            self.write_key(&key);
+            self.write_key(key);
 
             // TODO: verify 16?
             self.set_num_block(16);

examples/src/bin/aes.rs

@@ -37,15 +37,15 @@ fn main() -> ! {
 
     let mut block = block_buf.clone();
     let pre_hw_encrypt = cycles();
-    aes.process(&mut block, Mode::Encryption128, &keybuf);
+    aes.process(&mut block, Mode::Encryption128, keybuf.into());
     let post_hw_encrypt = cycles();
     println!(
         "it took {} cycles for hw encrypt",
         post_hw_encrypt - pre_hw_encrypt
     );
     let hw_encrypted = block.clone();
     let pre_hw_decrypt = cycles();
-    aes.process(&mut block, Mode::Decryption128, &keybuf);
+    aes.process(&mut block, Mode::Decryption128, keybuf.into());
     let post_hw_decrypt = cycles();
     println!(
         "it took {} cycles for hw decrypt",
@@ -73,14 +73,10 @@ fn main() -> ! {
     );
     let sw_decrypted = block;
 
-    assert!(eq(&sw_encrypted.into(), &hw_encrypted));
-    assert!(eq(&sw_decrypted.into(), &hw_decrypted));
+    assert!(&sw_encrypted as &[u8] == &hw_encrypted);
+    assert!(&sw_decrypted as &[u8] == &hw_decrypted);
 
     println!("done");
 
     loop {}
 }
-
-fn eq(slice1: &[u8; 16], slice2: &[u8; 16]) -> bool {
-    slice1.iter().zip(slice2.iter()).all(|(a, b)| a == b)
-}

examples/src/bin/aes_dma.rs

@@ -50,7 +50,7 @@ fn main() -> ! {
             &mut output,
             Mode::Encryption128,
             CipherMode::Ecb,
-            keytext,
+            &keytext,
         )
         .unwrap();
     transfer.wait().unwrap();
@@ -72,7 +72,7 @@ fn main() -> ! {
             &mut output,
             Mode::Decryption128,
             CipherMode::Ecb,
-            keytext,
+            &keytext,
         )
         .unwrap();
     transfer.wait().unwrap();
@@ -109,13 +109,9 @@ fn main() -> ! {
     );
     let sw_decrypted = block.clone();
 
-    assert!(eq(&sw_encrypted.into(), &hw_encrypted));
-    assert!(eq(&sw_decrypted.into(), &hw_decrypted));
+    assert!(&sw_encrypted as &[u8] == &hw_encrypted);
+    assert!(&sw_decrypted as &[u8] == &hw_decrypted);
 
     println!("done");
     loop {}
 }
-
-fn eq(slice1: &[u8; 16], slice2: &[u8; 16]) -> bool {
-    slice1.iter().zip(slice2.iter()).all(|(a, b)| a == b)
-}

hil-test/tests/aes.rs

@@ -53,7 +53,7 @@ mod tests {
         block_buf[..plaintext.len()].copy_from_slice(plaintext);
 
         let mut block = block_buf.clone();
-        ctx.aes.process(&mut block, Mode::Encryption128, &keybuf);
+        ctx.aes.process(&mut block, Mode::Encryption128, keybuf.into());
         assert_eq!(block, encrypted_message);
     }
 
@@ -70,7 +70,7 @@ mod tests {
         keybuf[..keytext.len()].copy_from_slice(keytext);
 
         ctx.aes
-            .process(&mut encrypted_message, Mode::Decryption128, &keybuf);
+            .process(&mut encrypted_message, Mode::Decryption128, keybuf.into());
         assert_eq!(&encrypted_message[..plaintext.len()], plaintext);
     }
 
@@ -91,7 +91,7 @@ mod tests {
         block_buf[..plaintext.len()].copy_from_slice(plaintext);
 
         let mut block = block_buf.clone();
-        ctx.aes.process(&mut block, Mode::Encryption192, &keybuf);
+        ctx.aes.process(&mut block, Mode::Encryption192, keybuf.into());
         assert_eq!(block, encrypted_message);
     }
 
@@ -109,7 +109,7 @@ mod tests {
         keybuf[..keytext.len()].copy_from_slice(keytext);
 
         ctx.aes
-            .process(&mut encrypted_message, Mode::Decryption192, &keybuf);
+            .process(&mut encrypted_message, Mode::Decryption192, keybuf.into());
         assert_eq!(&encrypted_message[..plaintext.len()], plaintext);
     }
 
@@ -129,7 +129,7 @@ mod tests {
         block_buf[..plaintext.len()].copy_from_slice(plaintext);
 
         let mut block = block_buf.clone();
-        ctx.aes.process(&mut block, Mode::Encryption256, &keybuf);
+        ctx.aes.process(&mut block, Mode::Encryption256, keybuf.into());
         assert_eq!(block, encrypted_message);
     }
 
@@ -146,7 +146,7 @@ mod tests {
         keybuf[..keytext.len()].copy_from_slice(keytext);
 
         ctx.aes
-            .process(&mut encrypted_message, Mode::Decryption256, &keybuf);
+            .process(&mut encrypted_message, Mode::Decryption256, keybuf.into());
         assert_eq!(&encrypted_message[..plaintext.len()], plaintext);
     }
 }

hil-test/tests/aes_dma.rs

@@ -66,7 +66,7 @@ mod tests {
                 &mut output,
                 Mode::Encryption128,
                 CipherMode::Ecb,
-                keybuf,
+                &keybuf,
             )
             .unwrap();
         transfer.wait().unwrap();
@@ -111,7 +111,7 @@ mod tests {
                 &mut output,
                 Mode::Decryption128,
                 CipherMode::Ecb,
-                keybuf,
+                &keybuf,
             )
             .unwrap();
         transfer.wait().unwrap();
@@ -157,7 +157,7 @@ mod tests {
                 &mut output,
                 Mode::Encryption256,
                 CipherMode::Ecb,
-                keybuf,
+                &keybuf,
             )
             .unwrap();
         transfer.wait().unwrap();
@@ -202,7 +202,7 @@ mod tests {
                 &mut output,
                 Mode::Decryption256,
                 CipherMode::Ecb,
-                keybuf,
+                &keybuf,
             )
             .unwrap();
         transfer.wait().unwrap();