fips_drbg_ctr.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436
  1. /* fips/rand/fips_drbg_ctr.c */
  2. /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  3. * project.
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 2011 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. */
  53. #include <stdlib.h>
  54. #include <string.h>
  55. #include <openssl/crypto.h>
  56. #include <openssl/fips.h>
  57. #include <openssl/fips_rand.h>
  58. #include "fips_rand_lcl.h"
  59. static void inc_128(DRBG_CTR_CTX *cctx)
  60. {
  61. int i;
  62. unsigned char c;
  63. unsigned char *p = cctx->V + 15;
  64. for (i = 0; i < 16; i++)
  65. {
  66. c = *p;
  67. c++;
  68. *p = c;
  69. if (c)
  70. return;
  71. p--;
  72. }
  73. }
  74. static void ctr_XOR(DRBG_CTR_CTX *cctx, const unsigned char *in, size_t inlen)
  75. {
  76. size_t i, n;
  77. /* Any zero padding will have no effect on the result as we
  78. * are XORing. So just process however much input we have.
  79. */
  80. if (!in || !inlen)
  81. return;
  82. if (inlen < cctx->keylen)
  83. n = inlen;
  84. else
  85. n = cctx->keylen;
  86. for (i = 0; i < n; i++)
  87. cctx->K[i] ^= in[i];
  88. if (inlen <= cctx->keylen)
  89. return;
  90. n = inlen - cctx->keylen;
  91. /* Should never happen */
  92. if (n > 16)
  93. n = 16;
  94. for (i = 0; i < 16; i++)
  95. cctx->V[i] ^= in[i + cctx->keylen];
  96. }
  97. /* Process a complete block using BCC algorithm of SPP 800-90 10.4.3 */
  98. static void ctr_BCC_block(DRBG_CTR_CTX *cctx, unsigned char *out,
  99. const unsigned char *in)
  100. {
  101. int i;
  102. for (i = 0; i < 16; i++)
  103. out[i] ^= in[i];
  104. AES_encrypt(out, out, &cctx->df_ks);
  105. #if 0
  106. fprintf(stderr, "BCC in+out\n");
  107. BIO_dump_fp(stderr, in, 16);
  108. BIO_dump_fp(stderr, out, 16);
  109. #endif
  110. }
  111. /* Handle several BCC operations for as much data as we need for K and X */
  112. static void ctr_BCC_blocks(DRBG_CTR_CTX *cctx, const unsigned char *in)
  113. {
  114. ctr_BCC_block(cctx, cctx->KX, in);
  115. ctr_BCC_block(cctx, cctx->KX + 16, in);
  116. if (cctx->keylen != 16)
  117. ctr_BCC_block(cctx, cctx->KX + 32, in);
  118. }
  119. /* Initialise BCC blocks: these have the value 0,1,2 in leftmost positions:
  120. * see 10.4.2 stage 7.
  121. */
  122. static void ctr_BCC_init(DRBG_CTR_CTX *cctx)
  123. {
  124. memset(cctx->KX, 0, 48);
  125. memset(cctx->bltmp, 0, 16);
  126. ctr_BCC_block(cctx, cctx->KX, cctx->bltmp);
  127. cctx->bltmp[3] = 1;
  128. ctr_BCC_block(cctx, cctx->KX + 16, cctx->bltmp);
  129. if (cctx->keylen != 16)
  130. {
  131. cctx->bltmp[3] = 2;
  132. ctr_BCC_block(cctx, cctx->KX + 32, cctx->bltmp);
  133. }
  134. }
  135. /* Process several blocks into BCC algorithm, some possibly partial */
  136. static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
  137. const unsigned char *in, size_t inlen)
  138. {
  139. if (!in || !inlen)
  140. return;
  141. /* If we have partial block handle it first */
  142. if (cctx->bltmp_pos)
  143. {
  144. size_t left = 16 - cctx->bltmp_pos;
  145. /* If we now have a complete block process it */
  146. if (inlen >= left)
  147. {
  148. memcpy(cctx->bltmp + cctx->bltmp_pos, in, left);
  149. ctr_BCC_blocks(cctx, cctx->bltmp);
  150. cctx->bltmp_pos = 0;
  151. inlen -= left;
  152. in += left;
  153. }
  154. }
  155. /* Process zero or more complete blocks */
  156. while (inlen >= 16)
  157. {
  158. ctr_BCC_blocks(cctx, in);
  159. in += 16;
  160. inlen -= 16;
  161. }
  162. /* Copy any remaining partial block to the temporary buffer */
  163. if (inlen > 0)
  164. {
  165. memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen);
  166. cctx->bltmp_pos += inlen;
  167. }
  168. }
  169. static void ctr_BCC_final(DRBG_CTR_CTX *cctx)
  170. {
  171. if (cctx->bltmp_pos)
  172. {
  173. memset(cctx->bltmp + cctx->bltmp_pos, 0, 16 - cctx->bltmp_pos);
  174. ctr_BCC_blocks(cctx, cctx->bltmp);
  175. }
  176. }
  177. static void ctr_df(DRBG_CTR_CTX *cctx,
  178. const unsigned char *in1, size_t in1len,
  179. const unsigned char *in2, size_t in2len,
  180. const unsigned char *in3, size_t in3len)
  181. {
  182. size_t inlen;
  183. unsigned char *p = cctx->bltmp;
  184. static unsigned char c80 = 0x80;
  185. ctr_BCC_init(cctx);
  186. if (!in1)
  187. in1len = 0;
  188. if (!in2)
  189. in2len = 0;
  190. if (!in3)
  191. in3len = 0;
  192. inlen = in1len + in2len + in3len;
  193. /* Initialise L||N in temporary block */
  194. *p++ = (inlen >> 24) & 0xff;
  195. *p++ = (inlen >> 16) & 0xff;
  196. *p++ = (inlen >> 8) & 0xff;
  197. *p++ = inlen & 0xff;
  198. /* NB keylen is at most 32 bytes */
  199. *p++ = 0;
  200. *p++ = 0;
  201. *p++ = 0;
  202. *p = (unsigned char)((cctx->keylen + 16) & 0xff);
  203. cctx->bltmp_pos = 8;
  204. ctr_BCC_update(cctx, in1, in1len);
  205. ctr_BCC_update(cctx, in2, in2len);
  206. ctr_BCC_update(cctx, in3, in3len);
  207. ctr_BCC_update(cctx, &c80, 1);
  208. ctr_BCC_final(cctx);
  209. /* Set up key K */
  210. AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks);
  211. /* X follows key K */
  212. AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks);
  213. AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks);
  214. if (cctx->keylen != 16)
  215. AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks);
  216. #if 0
  217. fprintf(stderr, "Output of ctr_df:\n");
  218. BIO_dump_fp(stderr, cctx->KX, cctx->keylen + 16);
  219. #endif
  220. }
  221. /* NB the no-df Update in SP800-90 specifies a constant input length
  222. * of seedlen, however other uses of this algorithm pad the input with
  223. * zeroes if necessary and have up to two parameters XORed together,
  224. * handle both cases in this function instead.
  225. */
  226. static void ctr_Update(DRBG_CTX *dctx,
  227. const unsigned char *in1, size_t in1len,
  228. const unsigned char *in2, size_t in2len,
  229. const unsigned char *nonce, size_t noncelen)
  230. {
  231. DRBG_CTR_CTX *cctx = &dctx->d.ctr;
  232. /* ks is already setup for correct key */
  233. inc_128(cctx);
  234. AES_encrypt(cctx->V, cctx->K, &cctx->ks);
  235. /* If keylen longer than 128 bits need extra encrypt */
  236. if (cctx->keylen != 16)
  237. {
  238. inc_128(cctx);
  239. AES_encrypt(cctx->V, cctx->K + 16, &cctx->ks);
  240. }
  241. inc_128(cctx);
  242. AES_encrypt(cctx->V, cctx->V, &cctx->ks);
  243. /* If 192 bit key part of V is on end of K */
  244. if (cctx->keylen == 24)
  245. {
  246. memcpy(cctx->V + 8, cctx->V, 8);
  247. memcpy(cctx->V, cctx->K + 24, 8);
  248. }
  249. if (dctx->xflags & DRBG_FLAG_CTR_USE_DF)
  250. {
  251. /* If no input reuse existing derived value */
  252. if (in1 || nonce || in2)
  253. ctr_df(cctx, in1, in1len, nonce, noncelen, in2, in2len);
  254. /* If this a reuse input in1len != 0 */
  255. if (in1len)
  256. ctr_XOR(cctx, cctx->KX, dctx->seedlen);
  257. }
  258. else
  259. {
  260. ctr_XOR(cctx, in1, in1len);
  261. ctr_XOR(cctx, in2, in2len);
  262. }
  263. AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks);
  264. #if 0
  265. fprintf(stderr, "K+V after update is:\n");
  266. BIO_dump_fp(stderr, cctx->K, cctx->keylen);
  267. BIO_dump_fp(stderr, cctx->V, 16);
  268. #endif
  269. }
  270. static int drbg_ctr_instantiate(DRBG_CTX *dctx,
  271. const unsigned char *ent, size_t entlen,
  272. const unsigned char *nonce, size_t noncelen,
  273. const unsigned char *pers, size_t perslen)
  274. {
  275. DRBG_CTR_CTX *cctx = &dctx->d.ctr;
  276. memset(cctx->K, 0, sizeof(cctx->K));
  277. memset(cctx->V, 0, sizeof(cctx->V));
  278. AES_set_encrypt_key(cctx->K, dctx->strength, &cctx->ks);
  279. ctr_Update(dctx, ent, entlen, pers, perslen, nonce, noncelen);
  280. return 1;
  281. }
  282. static int drbg_ctr_reseed(DRBG_CTX *dctx,
  283. const unsigned char *ent, size_t entlen,
  284. const unsigned char *adin, size_t adinlen)
  285. {
  286. ctr_Update(dctx, ent, entlen, adin, adinlen, NULL, 0);
  287. return 1;
  288. }
  289. static int drbg_ctr_generate(DRBG_CTX *dctx,
  290. unsigned char *out, size_t outlen,
  291. const unsigned char *adin, size_t adinlen)
  292. {
  293. DRBG_CTR_CTX *cctx = &dctx->d.ctr;
  294. if (adin && adinlen)
  295. {
  296. ctr_Update(dctx, adin, adinlen, NULL, 0, NULL, 0);
  297. /* This means we reuse derived value */
  298. if (dctx->xflags & DRBG_FLAG_CTR_USE_DF)
  299. {
  300. adin = NULL;
  301. adinlen = 1;
  302. }
  303. }
  304. else
  305. adinlen = 0;
  306. for (;;)
  307. {
  308. inc_128(cctx);
  309. if (!(dctx->xflags & DRBG_FLAG_TEST) && !dctx->lb_valid)
  310. {
  311. AES_encrypt(cctx->V, dctx->lb, &cctx->ks);
  312. dctx->lb_valid = 1;
  313. continue;
  314. }
  315. if (outlen < 16)
  316. {
  317. /* Use K as temp space as it will be updated */
  318. AES_encrypt(cctx->V, cctx->K, &cctx->ks);
  319. if (!fips_drbg_cprng_test(dctx, cctx->K))
  320. return 0;
  321. memcpy(out, cctx->K, outlen);
  322. break;
  323. }
  324. AES_encrypt(cctx->V, out, &cctx->ks);
  325. if (!fips_drbg_cprng_test(dctx, out))
  326. return 0;
  327. out += 16;
  328. outlen -= 16;
  329. if (outlen == 0)
  330. break;
  331. }
  332. ctr_Update(dctx, adin, adinlen, NULL, 0, NULL, 0);
  333. return 1;
  334. }
  335. static int drbg_ctr_uninstantiate(DRBG_CTX *dctx)
  336. {
  337. memset(&dctx->d.ctr, 0, sizeof(DRBG_CTR_CTX));
  338. return 1;
  339. }
  340. int fips_drbg_ctr_init(DRBG_CTX *dctx)
  341. {
  342. DRBG_CTR_CTX *cctx = &dctx->d.ctr;
  343. size_t keylen;
  344. switch (dctx->type)
  345. {
  346. case NID_aes_128_ctr:
  347. keylen = 16;
  348. break;
  349. case NID_aes_192_ctr:
  350. keylen = 24;
  351. break;
  352. case NID_aes_256_ctr:
  353. keylen = 32;
  354. break;
  355. default:
  356. return -2;
  357. }
  358. dctx->instantiate = drbg_ctr_instantiate;
  359. dctx->reseed = drbg_ctr_reseed;
  360. dctx->generate = drbg_ctr_generate;
  361. dctx->uninstantiate = drbg_ctr_uninstantiate;
  362. cctx->keylen = keylen;
  363. dctx->strength = keylen * 8;
  364. dctx->blocklength = 16;
  365. dctx->seedlen = keylen + 16;
  366. if (dctx->xflags & DRBG_FLAG_CTR_USE_DF)
  367. {
  368. /* df initialisation */
  369. static unsigned char df_key[32] =
  370. {
  371. 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
  372. 0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,
  373. 0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,
  374. 0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f
  375. };
  376. /* Set key schedule for df_key */
  377. AES_set_encrypt_key(df_key, dctx->strength, &cctx->df_ks);
  378. dctx->min_entropy = cctx->keylen;
  379. dctx->max_entropy = DRBG_MAX_LENGTH;
  380. dctx->min_nonce = dctx->min_entropy / 2;
  381. dctx->max_nonce = DRBG_MAX_LENGTH;
  382. dctx->max_pers = DRBG_MAX_LENGTH;
  383. dctx->max_adin = DRBG_MAX_LENGTH;
  384. }
  385. else
  386. {
  387. dctx->min_entropy = dctx->seedlen;
  388. dctx->max_entropy = dctx->seedlen;
  389. /* Nonce not used */
  390. dctx->min_nonce = 0;
  391. dctx->max_nonce = 0;
  392. dctx->max_pers = dctx->seedlen;
  393. dctx->max_adin = dctx->seedlen;
  394. }
  395. dctx->max_request = 1<<16;
  396. dctx->reseed_interval = 1<<24;
  397. return 1;
  398. }