cipher_chacha20_poly1305_hw.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415
  1. /*
  2. * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /* chacha20_poly1305 cipher implementation */
  10. #include "internal/endian.h"
  11. #include "cipher_chacha20_poly1305.h"
  12. static int chacha_poly1305_tls_init(PROV_CIPHER_CTX *bctx,
  13. unsigned char *aad, size_t alen)
  14. {
  15. unsigned int len;
  16. PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
  17. if (alen != EVP_AEAD_TLS1_AAD_LEN)
  18. return 0;
  19. memcpy(ctx->tls_aad, aad, EVP_AEAD_TLS1_AAD_LEN);
  20. len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 | aad[EVP_AEAD_TLS1_AAD_LEN - 1];
  21. aad = ctx->tls_aad;
  22. if (!bctx->enc) {
  23. if (len < POLY1305_BLOCK_SIZE)
  24. return 0;
  25. len -= POLY1305_BLOCK_SIZE; /* discount attached tag */
  26. aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
  27. aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
  28. }
  29. ctx->tls_payload_length = len;
  30. /* merge record sequence number as per RFC7905 */
  31. ctx->chacha.counter[1] = ctx->nonce[0];
  32. ctx->chacha.counter[2] = ctx->nonce[1] ^ CHACHA_U8TOU32(aad);
  33. ctx->chacha.counter[3] = ctx->nonce[2] ^ CHACHA_U8TOU32(aad+4);
  34. ctx->mac_inited = 0;
  35. return POLY1305_BLOCK_SIZE; /* tag length */
  36. }
  37. static int chacha_poly1305_tls_iv_set_fixed(PROV_CIPHER_CTX *bctx,
  38. unsigned char *fixed, size_t flen)
  39. {
  40. PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
  41. if (flen != CHACHA20_POLY1305_IVLEN)
  42. return 0;
  43. ctx->nonce[0] = ctx->chacha.counter[1] = CHACHA_U8TOU32(fixed);
  44. ctx->nonce[1] = ctx->chacha.counter[2] = CHACHA_U8TOU32(fixed + 4);
  45. ctx->nonce[2] = ctx->chacha.counter[3] = CHACHA_U8TOU32(fixed + 8);
  46. return 1;
  47. }
  48. static int chacha20_poly1305_initkey(PROV_CIPHER_CTX *bctx,
  49. const unsigned char *key, size_t keylen)
  50. {
  51. PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
  52. ctx->len.aad = 0;
  53. ctx->len.text = 0;
  54. ctx->aad = 0;
  55. ctx->mac_inited = 0;
  56. ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  57. if (bctx->enc)
  58. return ossl_chacha20_einit(&ctx->chacha, key, keylen, NULL, 0, NULL);
  59. else
  60. return ossl_chacha20_dinit(&ctx->chacha, key, keylen, NULL, 0, NULL);
  61. }
  62. static int chacha20_poly1305_initiv(PROV_CIPHER_CTX *bctx)
  63. {
  64. PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
  65. unsigned char tempiv[CHACHA_CTR_SIZE] = { 0 };
  66. int ret = 1;
  67. ctx->len.aad = 0;
  68. ctx->len.text = 0;
  69. ctx->aad = 0;
  70. ctx->mac_inited = 0;
  71. ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  72. /* pad on the left */
  73. if (ctx->nonce_len <= CHACHA_CTR_SIZE) {
  74. memcpy(tempiv + CHACHA_CTR_SIZE - ctx->nonce_len, bctx->oiv,
  75. ctx->nonce_len);
  76. if (bctx->enc)
  77. ret = ossl_chacha20_einit(&ctx->chacha, NULL, 0,
  78. tempiv, sizeof(tempiv), NULL);
  79. else
  80. ret = ossl_chacha20_dinit(&ctx->chacha, NULL, 0,
  81. tempiv, sizeof(tempiv), NULL);
  82. ctx->nonce[0] = ctx->chacha.counter[1];
  83. ctx->nonce[1] = ctx->chacha.counter[2];
  84. ctx->nonce[2] = ctx->chacha.counter[3];
  85. bctx->iv_set = 1;
  86. }
  87. return ret;
  88. }
  89. #if !defined(OPENSSL_SMALL_FOOTPRINT)
  90. # if defined(POLY1305_ASM) && (defined(__x86_64) || defined(__x86_64__) \
  91. || defined(_M_AMD64) || defined(_M_X64))
  92. # define XOR128_HELPERS
  93. void *xor128_encrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
  94. void *xor128_decrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
  95. static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 };
  96. # else
  97. static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
  98. # endif
  99. static int chacha20_poly1305_tls_cipher(PROV_CIPHER_CTX *bctx,
  100. unsigned char *out,
  101. size_t *out_padlen,
  102. const unsigned char *in, size_t len)
  103. {
  104. PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
  105. POLY1305 *poly = &ctx->poly1305;
  106. size_t tail, tohash_len, buf_len, plen = ctx->tls_payload_length;
  107. unsigned char *buf, *tohash, *ctr, storage[sizeof(zero) + 32];
  108. DECLARE_IS_ENDIAN;
  109. buf = storage + ((0 - (size_t)storage) & 15); /* align */
  110. ctr = buf + CHACHA_BLK_SIZE;
  111. tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;
  112. # ifdef XOR128_HELPERS
  113. if (plen <= 3 * CHACHA_BLK_SIZE) {
  114. ctx->chacha.counter[0] = 0;
  115. buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE);
  116. ChaCha20_ctr32(buf, zero, buf_len, ctx->chacha.key.d, ctx->chacha.counter);
  117. Poly1305_Init(poly, buf);
  118. ctx->chacha.partial_len = 0;
  119. memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
  120. tohash_len = POLY1305_BLOCK_SIZE;
  121. ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  122. ctx->len.text = plen;
  123. if (plen) {
  124. if (bctx->enc)
  125. ctr = xor128_encrypt_n_pad(out, in, ctr, plen);
  126. else
  127. ctr = xor128_decrypt_n_pad(out, in, ctr, plen);
  128. in += plen;
  129. out += plen;
  130. tohash_len = (size_t)(ctr - tohash);
  131. }
  132. }
  133. # else
  134. if (plen <= CHACHA_BLK_SIZE) {
  135. size_t i;
  136. ctx->chacha.counter[0] = 0;
  137. ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE),
  138. ctx->chacha.key.d, ctx->chacha.counter);
  139. Poly1305_Init(poly, buf);
  140. ctx->chacha.partial_len = 0;
  141. memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
  142. tohash_len = POLY1305_BLOCK_SIZE;
  143. ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  144. ctx->len.text = plen;
  145. if (bctx->enc) {
  146. for (i = 0; i < plen; i++)
  147. out[i] = ctr[i] ^= in[i];
  148. } else {
  149. for (i = 0; i < plen; i++) {
  150. unsigned char c = in[i];
  151. out[i] = ctr[i] ^ c;
  152. ctr[i] = c;
  153. }
  154. }
  155. in += i;
  156. out += i;
  157. tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
  158. memset(ctr + i, 0, tail);
  159. ctr += i + tail;
  160. tohash_len += i + tail;
  161. }
  162. # endif
  163. else {
  164. ctx->chacha.counter[0] = 0;
  165. ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE),
  166. ctx->chacha.key.d, ctx->chacha.counter);
  167. Poly1305_Init(poly, buf);
  168. ctx->chacha.counter[0] = 1;
  169. ctx->chacha.partial_len = 0;
  170. Poly1305_Update(poly, ctx->tls_aad, POLY1305_BLOCK_SIZE);
  171. tohash = ctr;
  172. tohash_len = 0;
  173. ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  174. ctx->len.text = plen;
  175. if (bctx->enc) {
  176. ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
  177. Poly1305_Update(poly, out, plen);
  178. } else {
  179. Poly1305_Update(poly, in, plen);
  180. ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
  181. }
  182. in += plen;
  183. out += plen;
  184. tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
  185. Poly1305_Update(poly, zero, tail);
  186. }
  187. if (IS_LITTLE_ENDIAN) {
  188. memcpy(ctr, (unsigned char *)&ctx->len, POLY1305_BLOCK_SIZE);
  189. } else {
  190. ctr[0] = (unsigned char)(ctx->len.aad);
  191. ctr[1] = (unsigned char)(ctx->len.aad>>8);
  192. ctr[2] = (unsigned char)(ctx->len.aad>>16);
  193. ctr[3] = (unsigned char)(ctx->len.aad>>24);
  194. ctr[4] = (unsigned char)(ctx->len.aad>>32);
  195. ctr[5] = (unsigned char)(ctx->len.aad>>40);
  196. ctr[6] = (unsigned char)(ctx->len.aad>>48);
  197. ctr[7] = (unsigned char)(ctx->len.aad>>56);
  198. ctr[8] = (unsigned char)(ctx->len.text);
  199. ctr[9] = (unsigned char)(ctx->len.text>>8);
  200. ctr[10] = (unsigned char)(ctx->len.text>>16);
  201. ctr[11] = (unsigned char)(ctx->len.text>>24);
  202. ctr[12] = (unsigned char)(ctx->len.text>>32);
  203. ctr[13] = (unsigned char)(ctx->len.text>>40);
  204. ctr[14] = (unsigned char)(ctx->len.text>>48);
  205. ctr[15] = (unsigned char)(ctx->len.text>>56);
  206. }
  207. tohash_len += POLY1305_BLOCK_SIZE;
  208. Poly1305_Update(poly, tohash, tohash_len);
  209. OPENSSL_cleanse(buf, buf_len);
  210. Poly1305_Final(poly, bctx->enc ? ctx->tag : tohash);
  211. ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  212. if (bctx->enc) {
  213. memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
  214. } else {
  215. if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
  216. if (len > POLY1305_BLOCK_SIZE)
  217. memset(out - (len - POLY1305_BLOCK_SIZE), 0,
  218. len - POLY1305_BLOCK_SIZE);
  219. return 0;
  220. }
  221. /* Strip the tag */
  222. len -= POLY1305_BLOCK_SIZE;
  223. }
  224. *out_padlen = len;
  225. return 1;
  226. }
  227. #else
  228. static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 };
  229. #endif /* OPENSSL_SMALL_FOOTPRINT */
  230. static int chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX *bctx,
  231. unsigned char *out, size_t *outl,
  232. const unsigned char *in, size_t inl)
  233. {
  234. PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
  235. POLY1305 *poly = &ctx->poly1305;
  236. size_t rem, plen = ctx->tls_payload_length;
  237. size_t olen = 0;
  238. int rv = 0;
  239. DECLARE_IS_ENDIAN;
  240. if (!ctx->mac_inited) {
  241. if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL) {
  242. if (inl != plen + POLY1305_BLOCK_SIZE)
  243. return 0;
  244. #if !defined(OPENSSL_SMALL_FOOTPRINT)
  245. return chacha20_poly1305_tls_cipher(bctx, out, outl, in, inl);
  246. #endif
  247. }
  248. ctx->chacha.counter[0] = 0;
  249. ChaCha20_ctr32(ctx->chacha.buf, zero, CHACHA_BLK_SIZE,
  250. ctx->chacha.key.d, ctx->chacha.counter);
  251. Poly1305_Init(poly, ctx->chacha.buf);
  252. ctx->chacha.counter[0] = 1;
  253. ctx->chacha.partial_len = 0;
  254. ctx->len.aad = ctx->len.text = 0;
  255. ctx->mac_inited = 1;
  256. if (plen != NO_TLS_PAYLOAD_LENGTH) {
  257. Poly1305_Update(poly, ctx->tls_aad, EVP_AEAD_TLS1_AAD_LEN);
  258. ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  259. ctx->aad = 1;
  260. }
  261. }
  262. if (in != NULL) { /* aad or text */
  263. if (out == NULL) { /* aad */
  264. Poly1305_Update(poly, in, inl);
  265. ctx->len.aad += inl;
  266. ctx->aad = 1;
  267. goto finish;
  268. } else { /* plain- or ciphertext */
  269. if (ctx->aad) { /* wrap up aad */
  270. if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
  271. Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
  272. ctx->aad = 0;
  273. }
  274. ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  275. if (plen == NO_TLS_PAYLOAD_LENGTH)
  276. plen = inl;
  277. else if (inl != plen + POLY1305_BLOCK_SIZE)
  278. goto err;
  279. if (bctx->enc) { /* plaintext */
  280. ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
  281. Poly1305_Update(poly, out, plen);
  282. in += plen;
  283. out += plen;
  284. ctx->len.text += plen;
  285. } else { /* ciphertext */
  286. Poly1305_Update(poly, in, plen);
  287. ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
  288. in += plen;
  289. out += plen;
  290. ctx->len.text += plen;
  291. }
  292. }
  293. }
  294. /* explicit final, or tls mode */
  295. if (in == NULL || inl != plen) {
  296. unsigned char temp[POLY1305_BLOCK_SIZE];
  297. if (ctx->aad) { /* wrap up aad */
  298. if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
  299. Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
  300. ctx->aad = 0;
  301. }
  302. if ((rem = (size_t)ctx->len.text % POLY1305_BLOCK_SIZE))
  303. Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
  304. if (IS_LITTLE_ENDIAN) {
  305. Poly1305_Update(poly, (unsigned char *)&ctx->len,
  306. POLY1305_BLOCK_SIZE);
  307. } else {
  308. temp[0] = (unsigned char)(ctx->len.aad);
  309. temp[1] = (unsigned char)(ctx->len.aad>>8);
  310. temp[2] = (unsigned char)(ctx->len.aad>>16);
  311. temp[3] = (unsigned char)(ctx->len.aad>>24);
  312. temp[4] = (unsigned char)(ctx->len.aad>>32);
  313. temp[5] = (unsigned char)(ctx->len.aad>>40);
  314. temp[6] = (unsigned char)(ctx->len.aad>>48);
  315. temp[7] = (unsigned char)(ctx->len.aad>>56);
  316. temp[8] = (unsigned char)(ctx->len.text);
  317. temp[9] = (unsigned char)(ctx->len.text>>8);
  318. temp[10] = (unsigned char)(ctx->len.text>>16);
  319. temp[11] = (unsigned char)(ctx->len.text>>24);
  320. temp[12] = (unsigned char)(ctx->len.text>>32);
  321. temp[13] = (unsigned char)(ctx->len.text>>40);
  322. temp[14] = (unsigned char)(ctx->len.text>>48);
  323. temp[15] = (unsigned char)(ctx->len.text>>56);
  324. Poly1305_Update(poly, temp, POLY1305_BLOCK_SIZE);
  325. }
  326. Poly1305_Final(poly, bctx->enc ? ctx->tag : temp);
  327. ctx->mac_inited = 0;
  328. if (in != NULL && inl != plen) {
  329. if (bctx->enc) {
  330. memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
  331. } else {
  332. if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
  333. memset(out - plen, 0, plen);
  334. goto err;
  335. }
  336. /* Strip the tag */
  337. inl -= POLY1305_BLOCK_SIZE;
  338. }
  339. }
  340. else if (!bctx->enc) {
  341. if (CRYPTO_memcmp(temp, ctx->tag, ctx->tag_len))
  342. goto err;
  343. }
  344. }
  345. finish:
  346. olen = inl;
  347. rv = 1;
  348. err:
  349. *outl = olen;
  350. return rv;
  351. }
  352. static const PROV_CIPHER_HW_CHACHA20_POLY1305 chacha20poly1305_hw =
  353. {
  354. { chacha20_poly1305_initkey, NULL },
  355. chacha20_poly1305_aead_cipher,
  356. chacha20_poly1305_initiv,
  357. chacha_poly1305_tls_init,
  358. chacha_poly1305_tls_iv_set_fixed
  359. };
  360. const PROV_CIPHER_HW *ossl_prov_cipher_hw_chacha20_poly1305(size_t keybits)
  361. {
  362. return (PROV_CIPHER_HW *)&chacha20poly1305_hw;
  363. }