ciphercommon_ccm.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453
  1. /*
  2. * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /* Dispatch functions for ccm mode */
  10. #include <openssl/proverr.h>
  11. #include "prov/ciphercommon.h"
  12. #include "prov/ciphercommon_ccm.h"
  13. #include "prov/providercommon.h"
  14. static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
  15. size_t *padlen, const unsigned char *in,
  16. size_t len);
  17. static int ccm_tls_init(PROV_CCM_CTX *ctx, unsigned char *aad, size_t alen)
  18. {
  19. size_t len;
  20. if (!ossl_prov_is_running() || alen != EVP_AEAD_TLS1_AAD_LEN)
  21. return 0;
  22. /* Save the aad for later use. */
  23. memcpy(ctx->buf, aad, alen);
  24. ctx->tls_aad_len = alen;
  25. len = ctx->buf[alen - 2] << 8 | ctx->buf[alen - 1];
  26. if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
  27. return 0;
  28. /* Correct length for explicit iv. */
  29. len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
  30. if (!ctx->enc) {
  31. if (len < ctx->m)
  32. return 0;
  33. /* Correct length for tag. */
  34. len -= ctx->m;
  35. }
  36. ctx->buf[alen - 2] = (unsigned char)(len >> 8);
  37. ctx->buf[alen - 1] = (unsigned char)(len & 0xff);
  38. /* Extra padding: tag appended to record. */
  39. return ctx->m;
  40. }
  41. static int ccm_tls_iv_set_fixed(PROV_CCM_CTX *ctx, unsigned char *fixed,
  42. size_t flen)
  43. {
  44. if (flen != EVP_CCM_TLS_FIXED_IV_LEN)
  45. return 0;
  46. /* Copy to first part of the iv. */
  47. memcpy(ctx->iv, fixed, flen);
  48. return 1;
  49. }
  50. static size_t ccm_get_ivlen(PROV_CCM_CTX *ctx)
  51. {
  52. return 15 - ctx->l;
  53. }
  54. int ossl_ccm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
  55. {
  56. PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
  57. const OSSL_PARAM *p;
  58. size_t sz;
  59. if (params == NULL)
  60. return 1;
  61. p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG);
  62. if (p != NULL) {
  63. if (p->data_type != OSSL_PARAM_OCTET_STRING) {
  64. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
  65. return 0;
  66. }
  67. if ((p->data_size & 1) || (p->data_size < 4) || p->data_size > 16) {
  68. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH);
  69. return 0;
  70. }
  71. if (p->data != NULL) {
  72. if (ctx->enc) {
  73. ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_NEEDED);
  74. return 0;
  75. }
  76. memcpy(ctx->buf, p->data, p->data_size);
  77. ctx->tag_set = 1;
  78. }
  79. ctx->m = p->data_size;
  80. }
  81. p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN);
  82. if (p != NULL) {
  83. size_t ivlen;
  84. if (!OSSL_PARAM_get_size_t(p, &sz)) {
  85. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
  86. return 0;
  87. }
  88. ivlen = 15 - sz;
  89. if (ivlen < 2 || ivlen > 8) {
  90. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
  91. return 0;
  92. }
  93. ctx->l = ivlen;
  94. }
  95. p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
  96. if (p != NULL) {
  97. if (p->data_type != OSSL_PARAM_OCTET_STRING) {
  98. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
  99. return 0;
  100. }
  101. sz = ccm_tls_init(ctx, p->data, p->data_size);
  102. if (sz == 0) {
  103. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA);
  104. return 0;
  105. }
  106. ctx->tls_aad_pad_sz = sz;
  107. }
  108. p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED);
  109. if (p != NULL) {
  110. if (p->data_type != OSSL_PARAM_OCTET_STRING) {
  111. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
  112. return 0;
  113. }
  114. if (ccm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
  115. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
  116. return 0;
  117. }
  118. }
  119. return 1;
  120. }
  121. int ossl_ccm_get_ctx_params(void *vctx, OSSL_PARAM params[])
  122. {
  123. PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
  124. OSSL_PARAM *p;
  125. p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN);
  126. if (p != NULL && !OSSL_PARAM_set_size_t(p, ccm_get_ivlen(ctx))) {
  127. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
  128. return 0;
  129. }
  130. p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN);
  131. if (p != NULL) {
  132. size_t m = ctx->m;
  133. if (!OSSL_PARAM_set_size_t(p, m)) {
  134. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
  135. return 0;
  136. }
  137. }
  138. p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV);
  139. if (p != NULL) {
  140. if (ccm_get_ivlen(ctx) > p->data_size) {
  141. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
  142. return 0;
  143. }
  144. if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)
  145. && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) {
  146. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
  147. return 0;
  148. }
  149. }
  150. p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_UPDATED_IV);
  151. if (p != NULL) {
  152. if (ccm_get_ivlen(ctx) > p->data_size) {
  153. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
  154. return 0;
  155. }
  156. if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)
  157. && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) {
  158. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
  159. return 0;
  160. }
  161. }
  162. p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN);
  163. if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) {
  164. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
  165. return 0;
  166. }
  167. p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD);
  168. if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
  169. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
  170. return 0;
  171. }
  172. p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG);
  173. if (p != NULL) {
  174. if (!ctx->enc || !ctx->tag_set) {
  175. ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_SET);
  176. return 0;
  177. }
  178. if (p->data_type != OSSL_PARAM_OCTET_STRING) {
  179. ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
  180. return 0;
  181. }
  182. if (!ctx->hw->gettag(ctx, p->data, p->data_size))
  183. return 0;
  184. ctx->tag_set = 0;
  185. ctx->iv_set = 0;
  186. ctx->len_set = 0;
  187. }
  188. return 1;
  189. }
  190. static int ccm_init(void *vctx, const unsigned char *key, size_t keylen,
  191. const unsigned char *iv, size_t ivlen,
  192. const OSSL_PARAM params[], int enc)
  193. {
  194. PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
  195. if (!ossl_prov_is_running())
  196. return 0;
  197. ctx->enc = enc;
  198. if (iv != NULL) {
  199. if (ivlen != ccm_get_ivlen(ctx)) {
  200. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
  201. return 0;
  202. }
  203. memcpy(ctx->iv, iv, ivlen);
  204. ctx->iv_set = 1;
  205. }
  206. if (key != NULL) {
  207. if (keylen != ctx->keylen) {
  208. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
  209. return 0;
  210. }
  211. if (!ctx->hw->setkey(ctx, key, keylen))
  212. return 0;
  213. }
  214. return ossl_ccm_set_ctx_params(ctx, params);
  215. }
  216. int ossl_ccm_einit(void *vctx, const unsigned char *key, size_t keylen,
  217. const unsigned char *iv, size_t ivlen,
  218. const OSSL_PARAM params[])
  219. {
  220. return ccm_init(vctx, key, keylen, iv, ivlen, params, 1);
  221. }
  222. int ossl_ccm_dinit(void *vctx, const unsigned char *key, size_t keylen,
  223. const unsigned char *iv, size_t ivlen,
  224. const OSSL_PARAM params[])
  225. {
  226. return ccm_init(vctx, key, keylen, iv, ivlen, params, 0);
  227. }
  228. int ossl_ccm_stream_update(void *vctx, unsigned char *out, size_t *outl,
  229. size_t outsize, const unsigned char *in,
  230. size_t inl)
  231. {
  232. PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
  233. if (outsize < inl) {
  234. ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
  235. return 0;
  236. }
  237. if (!ccm_cipher_internal(ctx, out, outl, in, inl)) {
  238. ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
  239. return 0;
  240. }
  241. return 1;
  242. }
  243. int ossl_ccm_stream_final(void *vctx, unsigned char *out, size_t *outl,
  244. size_t outsize)
  245. {
  246. PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
  247. int i;
  248. if (!ossl_prov_is_running())
  249. return 0;
  250. i = ccm_cipher_internal(ctx, out, outl, NULL, 0);
  251. if (i <= 0)
  252. return 0;
  253. *outl = 0;
  254. return 1;
  255. }
  256. int ossl_ccm_cipher(void *vctx, unsigned char *out, size_t *outl, size_t outsize,
  257. const unsigned char *in, size_t inl)
  258. {
  259. PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
  260. if (!ossl_prov_is_running())
  261. return 0;
  262. if (outsize < inl) {
  263. ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
  264. return 0;
  265. }
  266. if (ccm_cipher_internal(ctx, out, outl, in, inl) <= 0)
  267. return 0;
  268. *outl = inl;
  269. return 1;
  270. }
  271. /* Copy the buffered iv */
  272. static int ccm_set_iv(PROV_CCM_CTX *ctx, size_t mlen)
  273. {
  274. const PROV_CCM_HW *hw = ctx->hw;
  275. if (!hw->setiv(ctx, ctx->iv, ccm_get_ivlen(ctx), mlen))
  276. return 0;
  277. ctx->len_set = 1;
  278. return 1;
  279. }
  280. static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
  281. unsigned char *out, size_t *padlen,
  282. const unsigned char *in, size_t len)
  283. {
  284. int rv = 0;
  285. size_t olen = 0;
  286. if (!ossl_prov_is_running())
  287. goto err;
  288. /* Encrypt/decrypt must be performed in place */
  289. if (in == NULL || out != in || len < EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m)
  290. goto err;
  291. /* If encrypting set explicit IV from sequence number (start of AAD) */
  292. if (ctx->enc)
  293. memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
  294. /* Get rest of IV from explicit IV */
  295. memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
  296. /* Correct length value */
  297. len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
  298. if (!ccm_set_iv(ctx, len))
  299. goto err;
  300. /* Use saved AAD */
  301. if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))
  302. goto err;
  303. /* Fix buffer to point to payload */
  304. in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
  305. out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
  306. if (ctx->enc) {
  307. if (!ctx->hw->auth_encrypt(ctx, in, out, len, out + len, ctx->m))
  308. goto err;
  309. olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
  310. } else {
  311. if (!ctx->hw->auth_decrypt(ctx, in, out, len,
  312. (unsigned char *)in + len, ctx->m))
  313. goto err;
  314. olen = len;
  315. }
  316. rv = 1;
  317. err:
  318. *padlen = olen;
  319. return rv;
  320. }
  321. static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
  322. size_t *padlen, const unsigned char *in,
  323. size_t len)
  324. {
  325. int rv = 0;
  326. size_t olen = 0;
  327. const PROV_CCM_HW *hw = ctx->hw;
  328. /* If no key set, return error */
  329. if (!ctx->key_set)
  330. return 0;
  331. if (ctx->tls_aad_len != UNINITIALISED_SIZET)
  332. return ccm_tls_cipher(ctx, out, padlen, in, len);
  333. /* EVP_*Final() doesn't return any data */
  334. if (in == NULL && out != NULL)
  335. goto finish;
  336. if (!ctx->iv_set)
  337. goto err;
  338. if (out == NULL) {
  339. if (in == NULL) {
  340. if (!ccm_set_iv(ctx, len))
  341. goto err;
  342. } else {
  343. /* If we have AAD, we need a message length */
  344. if (!ctx->len_set && len)
  345. goto err;
  346. if (!hw->setaad(ctx, in, len))
  347. goto err;
  348. }
  349. } else {
  350. /* If not set length yet do it */
  351. if (!ctx->len_set && !ccm_set_iv(ctx, len))
  352. goto err;
  353. if (ctx->enc) {
  354. if (!hw->auth_encrypt(ctx, in, out, len, NULL, 0))
  355. goto err;
  356. ctx->tag_set = 1;
  357. } else {
  358. /* The tag must be set before actually decrypting data */
  359. if (!ctx->tag_set)
  360. goto err;
  361. if (!hw->auth_decrypt(ctx, in, out, len, ctx->buf, ctx->m))
  362. goto err;
  363. /* Finished - reset flags so calling this method again will fail */
  364. ctx->iv_set = 0;
  365. ctx->tag_set = 0;
  366. ctx->len_set = 0;
  367. }
  368. }
  369. olen = len;
  370. finish:
  371. rv = 1;
  372. err:
  373. *padlen = olen;
  374. return rv;
  375. }
  376. void ossl_ccm_initctx(PROV_CCM_CTX *ctx, size_t keybits, const PROV_CCM_HW *hw)
  377. {
  378. ctx->keylen = keybits / 8;
  379. ctx->key_set = 0;
  380. ctx->iv_set = 0;
  381. ctx->tag_set = 0;
  382. ctx->len_set = 0;
  383. ctx->l = 8;
  384. ctx->m = 12;
  385. ctx->tls_aad_len = UNINITIALISED_SIZET;
  386. ctx->hw = hw;
  387. }