You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mynewt.apache.org by "mkasenberg (via GitHub)" <gi...@apache.org> on 2024/04/11 12:01:00 UTC
[PR] nimble: controller: Add DRBG for Channel Sounding [mynewt-nimble]
mkasenberg opened a new pull request, #1761:
URL: https://github.com/apache/mynewt-nimble/pull/1761
(no comment)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] nimble/ll: Add DRBG for Channel Sounding [mynewt-nimble]
Posted by "sjanc (via GitHub)" <gi...@apache.org>.
sjanc commented on code in PR #1761:
URL: https://github.com/apache/mynewt-nimble/pull/1761#discussion_r2581619801
##########
nimble/controller/src/ble_ll_cs_drbg.c:
##########
@@ -0,0 +1,681 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#include <syscfg/syscfg.h>
+#if MYNEWT_VAL(BLE_LL_CHANNEL_SOUNDING)
+#include <stdint.h>
+#include <assert.h>
+#include <os/endian.h>
+#include "nimble/ble.h"
+#include "mbedtls/aes.h"
+#include "ble_ll_cs_drbg_priv.h"
+#if !(BABBLESIM || MYNEWT_VAL(SELFTEST))
+#include "controller/ble_hw.h"
+#endif
+
+static const uint8_t rtt_seq_len[] = { 0, 4, 12, 4, 8, 12, 16 };
+
+/**
+ * Security function e generates 128-bit encrypted_data from a 128-bit key
+ * and 128-bit data using the AES-128-bit block cypher.
+ */
+int
+ble_ll_cs_drbg_e(const uint8_t *key, const uint8_t *data, uint8_t *out_data)
+{
+ struct ble_encryption_block ecb;
+ int rc = 0;
+
+ /* The cryptographic function uses the leftmost to rightmost
+ * representation (MSO to LSO).
+ */
+ swap_buf(ecb.key, key, BLE_ENC_BLOCK_SIZE);
+ swap_buf(ecb.plain_text, data, BLE_ENC_BLOCK_SIZE);
+
+#if BABBLESIM || MYNEWT_VAL(SELFTEST)
+ /* Use software to encrypt the data */
+ mbedtls_aes_context aes_ctx;
+ mbedtls_aes_init(&aes_ctx);
+ mbedtls_aes_setkey_enc(&aes_ctx, ecb.key, 16 * 8);
+ rc = mbedtls_aes_crypt_ecb(&aes_ctx, MBEDTLS_AES_ENCRYPT, ecb.plain_text,
+ ecb.cipher_text);
+ mbedtls_aes_free(&aes_ctx);
+#else
+ /* Use hardware to encrypt the data */
+ rc = ble_hw_encrypt_block(&ecb);
+#endif
+
+ if (!rc) {
+ swap_buf(out_data, ecb.cipher_text, BLE_ENC_BLOCK_SIZE);
+ } else {
+ rc = -1;
+ }
+
+ return rc;
+}
+
+/**
+ * DRBG chain function f7.
+ * - k - 128-bit key
+ * - in - an input bit string whose length is a multiple of 128 bits and
+ * generates an output that is 128 bits long using a cipher block
+ * chaining technique.
+ * - out - processed bit string
+ */
+int
+ble_ll_cs_drbg_f7(const uint8_t *k, const uint8_t *in, uint8_t len, uint8_t *out)
+{
+ int rc = 0;
+ int i;
+ const uint64_t *block;
+ uint64_t *hout = (uint64_t *)out;
+
+ memset(hout, 0, 16);
+
+ /* Starting with the leftmost bits (MSO) of input_bit_string, split into
+ * 128-bit blocks
+ */
+ for (i = len - 16; i >= 0; i -= 16) {
+ block = (uint64_t *)&in[i];
+ /* XOR a 128-bit block in two steps */
+ *hout ^= *block;
+ *(hout + 1) ^= *(block + 1);
+
+ rc = ble_ll_cs_drbg_e(k, out, out);
+ if (rc) {
+ break;
+ }
+ }
+
+ return rc;
+}
+
+/**
+ * DRBG derivation function f8.
+ * - input - 320-bit input bit string
+ * - sm - output, generated 256-bit seed material (SM)
+ */
+int
+ble_ll_cs_drbg_f8(const uint8_t *input, uint8_t *sm)
+{
+ int rc;
+ uint8_t k[16] = { 0x0F, 0x0E, 0x0D, 0x0C, 0x0B, 0x0A, 0x09, 0x08,
+ 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00 };
+ uint8_t k2[16] = { 0 };
+ uint8_t x[16] = { 0 };
+ /* buf contains V || S */
+ uint8_t buf[80] = { 0 };
+ uint8_t *s = buf;
+ uint8_t *v = buf + 64;
+
+ /* S = 0x0000002800000020 || input_bit_string || 0x80 ||
+ * 0x000000000000000000000000000000
+ */
+ s[15] = 0x80;
+ memcpy(s + 16, input, 40);
+ put_le64(s + 56, 0x0000002800000020);
+
+ /* K2 = f7( K, V || S ) */
+ rc = ble_ll_cs_drbg_f7(k, buf, 80, k2);
+ if (rc) {
+ return rc;
+ }
+
+ /* V = 0x00000001000000000000000000000000 */
+ v[12] = 0x01;
+
+ /* X = f7( K, V || S ) */
+ rc = ble_ll_cs_drbg_f7(k, buf, 80, x);
+ if (rc) {
+ return rc;
+ }
+
+ /* Calculate the most significant part of SM:
+ * SM = e( K2, X )
+ */
+ rc = ble_ll_cs_drbg_e(k2, x, sm + 16);
+ if (rc) {
+ return rc;
+ }
+
+ /* Calculate the least significant part of SM and concatenate
+ * both parts:
+ * SM = SM || e( K2, SM )
+ */
+ rc = ble_ll_cs_drbg_e(k2, sm + 16, sm);
+
+ return rc;
+}
+
+/**
+ * DRBG update function f9 is used to update and refresh a DRBG 128-bit
+ * temporal key K and a 128-bit nonce vector V using a 256-bit seed material
+ * (SM) that may carry fresh entropy. The SM value may also be 0 if f9 is
+ * called for backtracking purposes.
+ * - sm - 256-bit seed material
+ * - k_in - 128-bit key
+ * - v_in - 128-bit nonce vector
+ */
+int
+ble_ll_cs_drbg_f9(const uint8_t *sm, uint8_t *k, uint8_t *v)
+{
+ int rc;
+ uint8_t x[32] = { 0 };
+ uint64_t *x_p = (uint64_t *)x;
+ uint64_t *sm_p = (uint64_t *)sm;
+
+ /* V = V[127:8] || (( V[7:0] + 1 ) mod 2^8) */
+ v[0]++;
+ rc = ble_ll_cs_drbg_e(k, v, x + 16);
+ if (rc) {
+ return rc;
+ }
+
+ v[0]++;
+ /* Again V = V[127:8] || (( V[7:0] + 1 ) mod 2^8) */
+ rc = ble_ll_cs_drbg_e(k, v, x);
+ if (rc) {
+ return rc;
+ }
+
+ /* X = X ⊕ SM */
+ x_p[0] ^= sm_p[0];
+ x_p[1] ^= sm_p[1];
+ x_p[2] ^= sm_p[2];
+ x_p[3] ^= sm_p[3];
+
+ memcpy(v, x, 16);
+ memcpy(k, x + 16, 16);
+
+ return 0;
+}
+
+/**
+ * DRBG instantiation function h9.
+ * - iv - 128-bit initialization vector (CS_IV)
+ * - in - 64-bit instantiation nonce (CS_IN)
+ * - pv - 128-bit personalization vector (CS_PV)
+ * - key - output, 128-bit temporal key (K_DRBG)
+ * - nonce_v - output, 128-bit nonce vector (V_DRBG)
+ */
+int
+ble_ll_cs_drbg_h9(const uint8_t *iv, const uint8_t *in, const uint8_t *pv,
+ uint8_t *key, uint8_t *nonce_v)
+{
+ int rc;
+ uint8_t input_bit_string[40] = { 0 };
+ uint8_t sm[32] = { 0 };
+
+ /* 320-bit input bit string created from concatenated vectors
+ * CS_IV || CS_IN || CS_PV
+ */
+ memcpy(input_bit_string, pv, 16);
+ memcpy(input_bit_string + 16, in, 8);
+ memcpy(input_bit_string + 24, iv, 16);
+
+ /* Generate seed material (SM) */
+ rc = ble_ll_cs_drbg_f8(input_bit_string, sm);
+ if (rc) {
+ return rc;
+ }
+
+ /* Generate K_DRBG and V_DRBG */
+ memset(key, 0, 16);
+ memset(nonce_v, 0, 16);
+ rc = ble_ll_cs_drbg_f9(sm, key, nonce_v);
+
+ return rc;
+}
+
+/**
+ * Random bit generation function CS_DRBG
+ * - transaction_id - CSTransactionID,
+ * - drbg_ctx - the drbg context, already inited with keys,
+ * - output - output buffer,
+ * - len - number of bytes to be generated.
+ */
+int
+ble_ll_cs_drbg_rand(struct ble_ll_cs_drbg_ctx *drbg_ctx, uint16_t step_count,
+ uint8_t transaction_id, uint8_t *output, uint8_t len)
+{
+ int rc;
+ uint8_t rand_len = 0;
+ uint8_t nonce[16];
+ struct ble_ll_cs_transaction_cache *cache = &drbg_ctx->t_cache[transaction_id];
+
+ /* Set the fixed values of the DRGB nonce */
+ memcpy(nonce, drbg_ctx->nonce_v, sizeof(nonce));
+ /* Set the Transaction_Counter */
+ if (cache->last_step_count != step_count) {
+ cache->transaction_counter = 0;
+ cache->last_step_count = step_count;
+ }
+ nonce[0] += cache->transaction_counter;
+ /* Set the Transaction_Identifier */
+ nonce[1] += transaction_id;
+ /* Set the CS Step_Counter */
+ put_le16(&nonce[2], step_count + get_le16(&nonce[2]));
+
+ while (len > 0) {
+ if (cache->free_bytes > 0) {
+ /* Use bytes from previous DRBG invocation */
+
+ if (len < cache->free_bytes) {
+ rand_len = len;
+ } else {
+ rand_len = cache->free_bytes;
+ }
+
+ cache->free_bytes -= rand_len;
+ /* [0] is LSO, [15] is MSO. Return cached bytes starting from MSO. */
+ memcpy(output, cache->random_bytes + cache->free_bytes, rand_len);
+
+ len -= rand_len;
+ output += rand_len;
+ } else {
+ /* Invoke CS_DRBG to get fresh 128-bit sequence */
+ rc = ble_ll_cs_drbg_e(drbg_ctx->key, nonce, cache->random_bytes);
+ if (rc) {
+ return rc;
+ }
+
+ cache->free_bytes = sizeof(cache->random_bytes);
+ /* Increment the transaction counter */
+ ++nonce[0];
+ ++cache->transaction_counter;
+ }
+ }
+
+ return 0;
+}
+
+/** Channel Sounding random number generation function hr1 */
+int
+ble_ll_cs_drbg_rand_hr1(struct ble_ll_cs_drbg_ctx *drbg_ctx, uint16_t step_count,
+ uint8_t transaction_id, uint8_t r, uint8_t *r_out)
+{
+ int rc;
+ uint16_t t_rand;
+ uint8_t random_bits;
+
+ if (r <= 1) {
+ *r_out = 0;
+
+ return 0;
+ }
+
+ rc = ble_ll_cs_drbg_rand(drbg_ctx, step_count, transaction_id, &random_bits, 1);
+ if (rc) {
+ return rc;
+ }
+
+ t_rand = r * random_bits;
+
+ if ((t_rand & 0xFF) < (256 % r)) {
+ rc = ble_ll_cs_drbg_rand(drbg_ctx, step_count, transaction_id,
+ &random_bits, 1);
+ *r_out = ((256 * random_bits * r) + t_rand) / 65536;
+ } else {
+ *r_out = t_rand / 256;
+ }
+
+ return rc;
+}
+
+int
+ble_ll_cs_drbg_shuffle_cr1(struct ble_ll_cs_drbg_ctx *drbg_ctx, uint16_t step_count,
+ uint8_t transaction_id, uint8_t *channel_array,
+ uint8_t *shuffled_array, uint8_t len)
+{
+ int rc;
+ uint8_t i, j;
+
+ for (i = 0; i < len; ++i) {
+ rc = ble_ll_cs_drbg_rand_hr1(drbg_ctx, step_count, transaction_id, i + 1, &j);
+ if (rc) {
+ return rc;
+ }
+
+ if (i != j) {
+ shuffled_array[i] = shuffled_array[j];
+ }
+
+ shuffled_array[j] = channel_array[i];
+ }
+
+ return 0;
+}
+
+static int
+cs_autocorrelation_score(uint32_t sequence)
+{
+ int i, k, score = 0;
Review Comment:
should those be unsigned and abs() dropped? (at least clang seems to be complaining)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] nimble/ll: Add DRBG for Channel Sounding [mynewt-nimble]
Posted by "mkasenberg (via GitHub)" <gi...@apache.org>.
mkasenberg commented on code in PR #1761:
URL: https://github.com/apache/mynewt-nimble/pull/1761#discussion_r2582398156
##########
nimble/controller/src/ble_ll_cs_drbg.c:
##########
@@ -0,0 +1,681 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#include <syscfg/syscfg.h>
+#if MYNEWT_VAL(BLE_LL_CHANNEL_SOUNDING)
+#include <stdint.h>
+#include <assert.h>
+#include <os/endian.h>
+#include "nimble/ble.h"
+#include "mbedtls/aes.h"
+#include "ble_ll_cs_drbg_priv.h"
+#if !(BABBLESIM || MYNEWT_VAL(SELFTEST))
+#include "controller/ble_hw.h"
+#endif
+
+static const uint8_t rtt_seq_len[] = { 0, 4, 12, 4, 8, 12, 16 };
+
+/**
+ * Security function e generates 128-bit encrypted_data from a 128-bit key
+ * and 128-bit data using the AES-128-bit block cypher.
+ */
+int
+ble_ll_cs_drbg_e(const uint8_t *key, const uint8_t *data, uint8_t *out_data)
+{
+ struct ble_encryption_block ecb;
+ int rc = 0;
+
+ /* The cryptographic function uses the leftmost to rightmost
+ * representation (MSO to LSO).
+ */
+ swap_buf(ecb.key, key, BLE_ENC_BLOCK_SIZE);
+ swap_buf(ecb.plain_text, data, BLE_ENC_BLOCK_SIZE);
+
+#if BABBLESIM || MYNEWT_VAL(SELFTEST)
+ /* Use software to encrypt the data */
+ mbedtls_aes_context aes_ctx;
+ mbedtls_aes_init(&aes_ctx);
+ mbedtls_aes_setkey_enc(&aes_ctx, ecb.key, 16 * 8);
+ rc = mbedtls_aes_crypt_ecb(&aes_ctx, MBEDTLS_AES_ENCRYPT, ecb.plain_text,
+ ecb.cipher_text);
+ mbedtls_aes_free(&aes_ctx);
+#else
+ /* Use hardware to encrypt the data */
+ rc = ble_hw_encrypt_block(&ecb);
+#endif
+
+ if (!rc) {
+ swap_buf(out_data, ecb.cipher_text, BLE_ENC_BLOCK_SIZE);
+ } else {
+ rc = -1;
+ }
+
+ return rc;
+}
+
+/**
+ * DRBG chain function f7.
+ * - k - 128-bit key
+ * - in - an input bit string whose length is a multiple of 128 bits and
+ * generates an output that is 128 bits long using a cipher block
+ * chaining technique.
+ * - out - processed bit string
+ */
+int
+ble_ll_cs_drbg_f7(const uint8_t *k, const uint8_t *in, uint8_t len, uint8_t *out)
+{
+ int rc = 0;
+ int i;
+ const uint64_t *block;
+ uint64_t *hout = (uint64_t *)out;
+
+ memset(hout, 0, 16);
+
+ /* Starting with the leftmost bits (MSO) of input_bit_string, split into
+ * 128-bit blocks
+ */
+ for (i = len - 16; i >= 0; i -= 16) {
+ block = (uint64_t *)&in[i];
+ /* XOR a 128-bit block in two steps */
+ *hout ^= *block;
+ *(hout + 1) ^= *(block + 1);
+
+ rc = ble_ll_cs_drbg_e(k, out, out);
+ if (rc) {
+ break;
+ }
+ }
+
+ return rc;
+}
+
+/**
+ * DRBG derivation function f8.
+ * - input - 320-bit input bit string
+ * - sm - output, generated 256-bit seed material (SM)
+ */
+int
+ble_ll_cs_drbg_f8(const uint8_t *input, uint8_t *sm)
+{
+ int rc;
+ uint8_t k[16] = { 0x0F, 0x0E, 0x0D, 0x0C, 0x0B, 0x0A, 0x09, 0x08,
+ 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00 };
+ uint8_t k2[16] = { 0 };
+ uint8_t x[16] = { 0 };
+ /* buf contains V || S */
+ uint8_t buf[80] = { 0 };
+ uint8_t *s = buf;
+ uint8_t *v = buf + 64;
+
+ /* S = 0x0000002800000020 || input_bit_string || 0x80 ||
+ * 0x000000000000000000000000000000
+ */
+ s[15] = 0x80;
+ memcpy(s + 16, input, 40);
+ put_le64(s + 56, 0x0000002800000020);
+
+ /* K2 = f7( K, V || S ) */
+ rc = ble_ll_cs_drbg_f7(k, buf, 80, k2);
+ if (rc) {
+ return rc;
+ }
+
+ /* V = 0x00000001000000000000000000000000 */
+ v[12] = 0x01;
+
+ /* X = f7( K, V || S ) */
+ rc = ble_ll_cs_drbg_f7(k, buf, 80, x);
+ if (rc) {
+ return rc;
+ }
+
+ /* Calculate the most significant part of SM:
+ * SM = e( K2, X )
+ */
+ rc = ble_ll_cs_drbg_e(k2, x, sm + 16);
+ if (rc) {
+ return rc;
+ }
+
+ /* Calculate the least significant part of SM and concatenate
+ * both parts:
+ * SM = SM || e( K2, SM )
+ */
+ rc = ble_ll_cs_drbg_e(k2, sm + 16, sm);
+
+ return rc;
+}
+
+/**
+ * DRBG update function f9 is used to update and refresh a DRBG 128-bit
+ * temporal key K and a 128-bit nonce vector V using a 256-bit seed material
+ * (SM) that may carry fresh entropy. The SM value may also be 0 if f9 is
+ * called for backtracking purposes.
+ * - sm - 256-bit seed material
+ * - k_in - 128-bit key
+ * - v_in - 128-bit nonce vector
+ */
+int
+ble_ll_cs_drbg_f9(const uint8_t *sm, uint8_t *k, uint8_t *v)
+{
+ int rc;
+ uint8_t x[32] = { 0 };
+ uint64_t *x_p = (uint64_t *)x;
+ uint64_t *sm_p = (uint64_t *)sm;
+
+ /* V = V[127:8] || (( V[7:0] + 1 ) mod 2^8) */
+ v[0]++;
+ rc = ble_ll_cs_drbg_e(k, v, x + 16);
+ if (rc) {
+ return rc;
+ }
+
+ v[0]++;
+ /* Again V = V[127:8] || (( V[7:0] + 1 ) mod 2^8) */
+ rc = ble_ll_cs_drbg_e(k, v, x);
+ if (rc) {
+ return rc;
+ }
+
+ /* X = X ⊕ SM */
+ x_p[0] ^= sm_p[0];
+ x_p[1] ^= sm_p[1];
+ x_p[2] ^= sm_p[2];
+ x_p[3] ^= sm_p[3];
+
+ memcpy(v, x, 16);
+ memcpy(k, x + 16, 16);
+
+ return 0;
+}
+
+/**
+ * DRBG instantiation function h9.
+ * - iv - 128-bit initialization vector (CS_IV)
+ * - in - 64-bit instantiation nonce (CS_IN)
+ * - pv - 128-bit personalization vector (CS_PV)
+ * - key - output, 128-bit temporal key (K_DRBG)
+ * - nonce_v - output, 128-bit nonce vector (V_DRBG)
+ */
+int
+ble_ll_cs_drbg_h9(const uint8_t *iv, const uint8_t *in, const uint8_t *pv,
+ uint8_t *key, uint8_t *nonce_v)
+{
+ int rc;
+ uint8_t input_bit_string[40] = { 0 };
+ uint8_t sm[32] = { 0 };
+
+ /* 320-bit input bit string created from concatenated vectors
+ * CS_IV || CS_IN || CS_PV
+ */
+ memcpy(input_bit_string, pv, 16);
+ memcpy(input_bit_string + 16, in, 8);
+ memcpy(input_bit_string + 24, iv, 16);
+
+ /* Generate seed material (SM) */
+ rc = ble_ll_cs_drbg_f8(input_bit_string, sm);
+ if (rc) {
+ return rc;
+ }
+
+ /* Generate K_DRBG and V_DRBG */
+ memset(key, 0, 16);
+ memset(nonce_v, 0, 16);
+ rc = ble_ll_cs_drbg_f9(sm, key, nonce_v);
+
+ return rc;
+}
+
+/**
+ * Random bit generation function CS_DRBG
+ * - transaction_id - CSTransactionID,
+ * - drbg_ctx - the drbg context, already inited with keys,
+ * - output - output buffer,
+ * - len - number of bytes to be generated.
+ */
+int
+ble_ll_cs_drbg_rand(struct ble_ll_cs_drbg_ctx *drbg_ctx, uint16_t step_count,
+ uint8_t transaction_id, uint8_t *output, uint8_t len)
+{
+ int rc;
+ uint8_t rand_len = 0;
+ uint8_t nonce[16];
+ struct ble_ll_cs_transaction_cache *cache = &drbg_ctx->t_cache[transaction_id];
+
+ /* Set the fixed values of the DRGB nonce */
+ memcpy(nonce, drbg_ctx->nonce_v, sizeof(nonce));
+ /* Set the Transaction_Counter */
+ if (cache->last_step_count != step_count) {
+ cache->transaction_counter = 0;
+ cache->last_step_count = step_count;
+ }
+ nonce[0] += cache->transaction_counter;
+ /* Set the Transaction_Identifier */
+ nonce[1] += transaction_id;
+ /* Set the CS Step_Counter */
+ put_le16(&nonce[2], step_count + get_le16(&nonce[2]));
+
+ while (len > 0) {
+ if (cache->free_bytes > 0) {
+ /* Use bytes from previous DRBG invocation */
+
+ if (len < cache->free_bytes) {
+ rand_len = len;
+ } else {
+ rand_len = cache->free_bytes;
+ }
+
+ cache->free_bytes -= rand_len;
+ /* [0] is LSO, [15] is MSO. Return cached bytes starting from MSO. */
+ memcpy(output, cache->random_bytes + cache->free_bytes, rand_len);
+
+ len -= rand_len;
+ output += rand_len;
+ } else {
+ /* Invoke CS_DRBG to get fresh 128-bit sequence */
+ rc = ble_ll_cs_drbg_e(drbg_ctx->key, nonce, cache->random_bytes);
+ if (rc) {
+ return rc;
+ }
+
+ cache->free_bytes = sizeof(cache->random_bytes);
+ /* Increment the transaction counter */
+ ++nonce[0];
+ ++cache->transaction_counter;
+ }
+ }
+
+ return 0;
+}
+
+/** Channel Sounding random number generation function hr1 */
+int
+ble_ll_cs_drbg_rand_hr1(struct ble_ll_cs_drbg_ctx *drbg_ctx, uint16_t step_count,
+ uint8_t transaction_id, uint8_t r, uint8_t *r_out)
+{
+ int rc;
+ uint16_t t_rand;
+ uint8_t random_bits;
+
+ if (r <= 1) {
+ *r_out = 0;
+
+ return 0;
+ }
+
+ rc = ble_ll_cs_drbg_rand(drbg_ctx, step_count, transaction_id, &random_bits, 1);
+ if (rc) {
+ return rc;
+ }
+
+ t_rand = r * random_bits;
+
+ if ((t_rand & 0xFF) < (256 % r)) {
+ rc = ble_ll_cs_drbg_rand(drbg_ctx, step_count, transaction_id,
+ &random_bits, 1);
+ *r_out = ((256 * random_bits * r) + t_rand) / 65536;
+ } else {
+ *r_out = t_rand / 256;
+ }
+
+ return rc;
+}
+
+int
+ble_ll_cs_drbg_shuffle_cr1(struct ble_ll_cs_drbg_ctx *drbg_ctx, uint16_t step_count,
+ uint8_t transaction_id, uint8_t *channel_array,
+ uint8_t *shuffled_array, uint8_t len)
+{
+ int rc;
+ uint8_t i, j;
+
+ for (i = 0; i < len; ++i) {
+ rc = ble_ll_cs_drbg_rand_hr1(drbg_ctx, step_count, transaction_id, i + 1, &j);
+ if (rc) {
+ return rc;
+ }
+
+ if (i != j) {
+ shuffled_array[i] = shuffled_array[j];
+ }
+
+ shuffled_array[j] = channel_array[i];
+ }
+
+ return 0;
+}
+
+static int
+cs_autocorrelation_score(uint32_t sequence)
+{
+ int i, k, score = 0;
Review Comment:
Yes, `i` and `k` should be `uint8_t`. For context, this function implements this
<img width="1386" height="419" alt="image" src="https://github.com/user-attachments/assets/9c26fd74-4d3c-4e82-8b13-d9595b4b5d6b" />
(Bluetooth Core Specification Version 6.1 | Vol 6, Part H, 2.2.1 Channel Sounding Access Address selection rules)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] nimble: controller: Add DRBG for Channel Sounding [mynewt-nimble]
Posted by "mkasenberg (via GitHub)" <gi...@apache.org>.
mkasenberg commented on PR #1761:
URL: https://github.com/apache/mynewt-nimble/pull/1761#issuecomment-2774949873
Just rebase
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org