2
0

cmac.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274
  1. /*
  2. * Copyright 2010-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * CMAC low level APIs are deprecated for public use, but still ok for internal
  11. * use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <stdio.h>
  15. #include <stdlib.h>
  16. #include <string.h>
  17. #include "internal/cryptlib.h"
  18. #include <openssl/cmac.h>
  19. #include <openssl/err.h>
  20. #define LOCAL_BUF_SIZE 2048
  21. struct CMAC_CTX_st {
  22. /* Cipher context to use */
  23. EVP_CIPHER_CTX *cctx;
  24. /* Keys k1 and k2 */
  25. unsigned char k1[EVP_MAX_BLOCK_LENGTH];
  26. unsigned char k2[EVP_MAX_BLOCK_LENGTH];
  27. /* Temporary block */
  28. unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
  29. /* Last (possibly partial) block */
  30. unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
  31. /* Number of bytes in last block: -1 means context not initialised */
  32. int nlast_block;
  33. };
  34. /* Make temporary keys K1 and K2 */
  35. static void make_kn(unsigned char *k1, const unsigned char *l, int bl)
  36. {
  37. int i;
  38. unsigned char c = l[0], carry = c >> 7, cnext;
  39. /* Shift block to left, including carry */
  40. for (i = 0; i < bl - 1; i++, c = cnext)
  41. k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);
  42. /* If MSB set fixup with R */
  43. k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
  44. }
  45. CMAC_CTX *CMAC_CTX_new(void)
  46. {
  47. CMAC_CTX *ctx;
  48. if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL)
  49. return NULL;
  50. ctx->cctx = EVP_CIPHER_CTX_new();
  51. if (ctx->cctx == NULL) {
  52. OPENSSL_free(ctx);
  53. return NULL;
  54. }
  55. ctx->nlast_block = -1;
  56. return ctx;
  57. }
  58. void CMAC_CTX_cleanup(CMAC_CTX *ctx)
  59. {
  60. EVP_CIPHER_CTX_reset(ctx->cctx);
  61. OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
  62. OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
  63. OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);
  64. OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
  65. ctx->nlast_block = -1;
  66. }
  67. EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx)
  68. {
  69. return ctx->cctx;
  70. }
  71. void CMAC_CTX_free(CMAC_CTX *ctx)
  72. {
  73. if (!ctx)
  74. return;
  75. CMAC_CTX_cleanup(ctx);
  76. EVP_CIPHER_CTX_free(ctx->cctx);
  77. OPENSSL_free(ctx);
  78. }
  79. int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in)
  80. {
  81. int bl;
  82. if (in->nlast_block == -1)
  83. return 0;
  84. if ((bl = EVP_CIPHER_CTX_get_block_size(in->cctx)) < 0)
  85. return 0;
  86. if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
  87. return 0;
  88. memcpy(out->k1, in->k1, bl);
  89. memcpy(out->k2, in->k2, bl);
  90. memcpy(out->tbl, in->tbl, bl);
  91. memcpy(out->last_block, in->last_block, bl);
  92. out->nlast_block = in->nlast_block;
  93. return 1;
  94. }
  95. int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
  96. const EVP_CIPHER *cipher, ENGINE *impl)
  97. {
  98. static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
  99. /* All zeros means restart */
  100. if (!key && !cipher && !impl && keylen == 0) {
  101. /* Not initialised */
  102. if (ctx->nlast_block == -1)
  103. return 0;
  104. if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
  105. return 0;
  106. memset(ctx->tbl, 0, EVP_CIPHER_CTX_get_block_size(ctx->cctx));
  107. ctx->nlast_block = 0;
  108. return 1;
  109. }
  110. /* Initialise context */
  111. if (cipher != NULL) {
  112. /* Ensure we can't use this ctx until we also have a key */
  113. ctx->nlast_block = -1;
  114. if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
  115. return 0;
  116. }
  117. /* Non-NULL key means initialisation complete */
  118. if (key != NULL) {
  119. int bl;
  120. /* If anything fails then ensure we can't use this ctx */
  121. ctx->nlast_block = -1;
  122. if (EVP_CIPHER_CTX_get0_cipher(ctx->cctx) == NULL)
  123. return 0;
  124. if (EVP_CIPHER_CTX_set_key_length(ctx->cctx, keylen) <= 0)
  125. return 0;
  126. if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, key, zero_iv))
  127. return 0;
  128. if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) < 0)
  129. return 0;
  130. if (EVP_Cipher(ctx->cctx, ctx->tbl, zero_iv, bl) <= 0)
  131. return 0;
  132. make_kn(ctx->k1, ctx->tbl, bl);
  133. make_kn(ctx->k2, ctx->k1, bl);
  134. OPENSSL_cleanse(ctx->tbl, bl);
  135. /* Reset context again ready for first data block */
  136. if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
  137. return 0;
  138. /* Zero tbl so resume works */
  139. memset(ctx->tbl, 0, bl);
  140. ctx->nlast_block = 0;
  141. }
  142. return 1;
  143. }
  144. int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
  145. {
  146. const unsigned char *data = in;
  147. int bl;
  148. size_t max_burst_blocks, cipher_blocks;
  149. unsigned char buf[LOCAL_BUF_SIZE];
  150. if (ctx->nlast_block == -1)
  151. return 0;
  152. if (dlen == 0)
  153. return 1;
  154. if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) < 0)
  155. return 0;
  156. /* Copy into partial block if we need to */
  157. if (ctx->nlast_block > 0) {
  158. size_t nleft;
  159. nleft = bl - ctx->nlast_block;
  160. if (dlen < nleft)
  161. nleft = dlen;
  162. memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
  163. dlen -= nleft;
  164. ctx->nlast_block += nleft;
  165. /* If no more to process return */
  166. if (dlen == 0)
  167. return 1;
  168. data += nleft;
  169. /* Else not final block so encrypt it */
  170. if (EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl) <= 0)
  171. return 0;
  172. }
  173. /* Encrypt all but one of the complete blocks left */
  174. max_burst_blocks = LOCAL_BUF_SIZE / bl;
  175. cipher_blocks = (dlen - 1) / bl;
  176. if (max_burst_blocks == 0) {
  177. /*
  178. * When block length is greater than local buffer size,
  179. * use ctx->tbl as cipher output.
  180. */
  181. while (dlen > (size_t)bl) {
  182. if (EVP_Cipher(ctx->cctx, ctx->tbl, data, bl) <= 0)
  183. return 0;
  184. dlen -= bl;
  185. data += bl;
  186. }
  187. } else {
  188. while (cipher_blocks > max_burst_blocks) {
  189. if (EVP_Cipher(ctx->cctx, buf, data, max_burst_blocks * bl) <= 0)
  190. return 0;
  191. dlen -= max_burst_blocks * bl;
  192. data += max_burst_blocks * bl;
  193. cipher_blocks -= max_burst_blocks;
  194. }
  195. if (cipher_blocks > 0) {
  196. if (EVP_Cipher(ctx->cctx, buf, data, cipher_blocks * bl) <= 0)
  197. return 0;
  198. dlen -= cipher_blocks * bl;
  199. data += cipher_blocks * bl;
  200. memcpy(ctx->tbl, &buf[(cipher_blocks - 1) * bl], bl);
  201. }
  202. }
  203. /* Copy any data left to last block buffer */
  204. memcpy(ctx->last_block, data, dlen);
  205. ctx->nlast_block = dlen;
  206. return 1;
  207. }
  208. int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
  209. {
  210. int i, bl, lb;
  211. if (ctx->nlast_block == -1)
  212. return 0;
  213. if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) < 0)
  214. return 0;
  215. if (poutlen != NULL)
  216. *poutlen = (size_t)bl;
  217. if (!out)
  218. return 1;
  219. lb = ctx->nlast_block;
  220. /* Is last block complete? */
  221. if (lb == bl) {
  222. for (i = 0; i < bl; i++)
  223. out[i] = ctx->last_block[i] ^ ctx->k1[i];
  224. } else {
  225. ctx->last_block[lb] = 0x80;
  226. if (bl - lb > 1)
  227. memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
  228. for (i = 0; i < bl; i++)
  229. out[i] = ctx->last_block[i] ^ ctx->k2[i];
  230. }
  231. if (EVP_Cipher(ctx->cctx, out, out, bl) <= 0) {
  232. OPENSSL_cleanse(out, bl);
  233. return 0;
  234. }
  235. return 1;
  236. }
  237. int CMAC_resume(CMAC_CTX *ctx)
  238. {
  239. if (ctx->nlast_block == -1)
  240. return 0;
  241. /*
  242. * The buffer "tbl" contains the last fully encrypted block which is the
  243. * last IV (or all zeroes if no last encrypted block). The last block has
  244. * not been modified since CMAC_final(). So reinitialising using the last
  245. * decrypted block will allow CMAC to continue after calling
  246. * CMAC_Final().
  247. */
  248. return EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, ctx->tbl);
  249. }