e_des3.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426
  1. /*
  2. * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * DES low level APIs are deprecated for public use, but still ok for internal
  11. * use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <stdio.h>
  15. #include "internal/cryptlib.h"
  16. #ifndef OPENSSL_NO_DES
  17. # include <openssl/objects.h>
  18. # include "crypto/evp.h"
  19. # include "crypto/sha.h"
  20. # include <openssl/des.h>
  21. # include <openssl/rand.h>
  22. # include "evp_local.h"
  23. typedef struct {
  24. union {
  25. OSSL_UNION_ALIGN;
  26. DES_key_schedule ks[3];
  27. } ks;
  28. union {
  29. void (*cbc) (const void *, void *, size_t,
  30. const DES_key_schedule *, unsigned char *);
  31. } stream;
  32. } DES_EDE_KEY;
  33. # define ks1 ks.ks[0]
  34. # define ks2 ks.ks[1]
  35. # define ks3 ks.ks[2]
  36. # if defined(AES_ASM) && (defined(__sparc) || defined(__sparc__))
  37. /* ---------^^^ this is not a typo, just a way to detect that
  38. * assembler support was in general requested... */
  39. # include "crypto/sparc_arch.h"
  40. # define SPARC_DES_CAPABLE (OPENSSL_sparcv9cap_P[1] & CFR_DES)
  41. void des_t4_key_expand(const void *key, DES_key_schedule *ks);
  42. void des_t4_ede3_cbc_encrypt(const void *inp, void *out, size_t len,
  43. const DES_key_schedule ks[3], unsigned char iv[8]);
  44. void des_t4_ede3_cbc_decrypt(const void *inp, void *out, size_t len,
  45. const DES_key_schedule ks[3], unsigned char iv[8]);
  46. # endif
  47. static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  48. const unsigned char *iv, int enc);
  49. static int des_ede3_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  50. const unsigned char *iv, int enc);
  51. static int des3_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr);
  52. # define data(ctx) EVP_C_DATA(DES_EDE_KEY,ctx)
  53. /*
  54. * Because of various casts and different args can't use
  55. * IMPLEMENT_BLOCK_CIPHER
  56. */
  57. static int des_ede_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  58. const unsigned char *in, size_t inl)
  59. {
  60. BLOCK_CIPHER_ecb_loop()
  61. DES_ecb3_encrypt((const_DES_cblock *)(in + i),
  62. (DES_cblock *)(out + i),
  63. &data(ctx)->ks1, &data(ctx)->ks2,
  64. &data(ctx)->ks3, EVP_CIPHER_CTX_is_encrypting(ctx));
  65. return 1;
  66. }
  67. static int des_ede_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  68. const unsigned char *in, size_t inl)
  69. {
  70. while (inl >= EVP_MAXCHUNK) {
  71. int num = EVP_CIPHER_CTX_get_num(ctx);
  72. DES_ede3_ofb64_encrypt(in, out, (long)EVP_MAXCHUNK,
  73. &data(ctx)->ks1, &data(ctx)->ks2,
  74. &data(ctx)->ks3,
  75. (DES_cblock *)ctx->iv,
  76. &num);
  77. EVP_CIPHER_CTX_set_num(ctx, num);
  78. inl -= EVP_MAXCHUNK;
  79. in += EVP_MAXCHUNK;
  80. out += EVP_MAXCHUNK;
  81. }
  82. if (inl) {
  83. int num = EVP_CIPHER_CTX_get_num(ctx);
  84. DES_ede3_ofb64_encrypt(in, out, (long)inl,
  85. &data(ctx)->ks1, &data(ctx)->ks2,
  86. &data(ctx)->ks3,
  87. (DES_cblock *)ctx->iv,
  88. &num);
  89. EVP_CIPHER_CTX_set_num(ctx, num);
  90. }
  91. return 1;
  92. }
  93. static int des_ede_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  94. const unsigned char *in, size_t inl)
  95. {
  96. DES_EDE_KEY *dat = data(ctx);
  97. if (dat->stream.cbc != NULL) {
  98. (*dat->stream.cbc) (in, out, inl, dat->ks.ks,
  99. ctx->iv);
  100. return 1;
  101. }
  102. while (inl >= EVP_MAXCHUNK) {
  103. DES_ede3_cbc_encrypt(in, out, (long)EVP_MAXCHUNK,
  104. &dat->ks1, &dat->ks2, &dat->ks3,
  105. (DES_cblock *)ctx->iv,
  106. EVP_CIPHER_CTX_is_encrypting(ctx));
  107. inl -= EVP_MAXCHUNK;
  108. in += EVP_MAXCHUNK;
  109. out += EVP_MAXCHUNK;
  110. }
  111. if (inl)
  112. DES_ede3_cbc_encrypt(in, out, (long)inl,
  113. &dat->ks1, &dat->ks2, &dat->ks3,
  114. (DES_cblock *)ctx->iv,
  115. EVP_CIPHER_CTX_is_encrypting(ctx));
  116. return 1;
  117. }
  118. static int des_ede_cfb64_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  119. const unsigned char *in, size_t inl)
  120. {
  121. while (inl >= EVP_MAXCHUNK) {
  122. int num = EVP_CIPHER_CTX_get_num(ctx);
  123. DES_ede3_cfb64_encrypt(in, out, (long)EVP_MAXCHUNK,
  124. &data(ctx)->ks1, &data(ctx)->ks2,
  125. &data(ctx)->ks3, (DES_cblock *)ctx->iv,
  126. &num, EVP_CIPHER_CTX_is_encrypting(ctx));
  127. EVP_CIPHER_CTX_set_num(ctx, num);
  128. inl -= EVP_MAXCHUNK;
  129. in += EVP_MAXCHUNK;
  130. out += EVP_MAXCHUNK;
  131. }
  132. if (inl) {
  133. int num = EVP_CIPHER_CTX_get_num(ctx);
  134. DES_ede3_cfb64_encrypt(in, out, (long)inl,
  135. &data(ctx)->ks1, &data(ctx)->ks2,
  136. &data(ctx)->ks3, (DES_cblock *)ctx->iv,
  137. &num, EVP_CIPHER_CTX_is_encrypting(ctx));
  138. EVP_CIPHER_CTX_set_num(ctx, num);
  139. }
  140. return 1;
  141. }
  142. /*
  143. * Although we have a CFB-r implementation for 3-DES, it doesn't pack the
  144. * right way, so wrap it here
  145. */
  146. static int des_ede3_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  147. const unsigned char *in, size_t inl)
  148. {
  149. size_t n;
  150. unsigned char c[1];
  151. unsigned char d[1] = { 0 }; /* Appease Coverity */
  152. if (!EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))
  153. inl *= 8;
  154. for (n = 0; n < inl; ++n) {
  155. c[0] = (in[n / 8] & (1 << (7 - n % 8))) ? 0x80 : 0;
  156. DES_ede3_cfb_encrypt(c, d, 1, 1,
  157. &data(ctx)->ks1, &data(ctx)->ks2,
  158. &data(ctx)->ks3, (DES_cblock *)ctx->iv,
  159. EVP_CIPHER_CTX_is_encrypting(ctx));
  160. out[n / 8] = (out[n / 8] & ~(0x80 >> (unsigned int)(n % 8)))
  161. | ((d[0] & 0x80) >> (unsigned int)(n % 8));
  162. }
  163. return 1;
  164. }
  165. static int des_ede3_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  166. const unsigned char *in, size_t inl)
  167. {
  168. while (inl >= EVP_MAXCHUNK) {
  169. DES_ede3_cfb_encrypt(in, out, 8, (long)EVP_MAXCHUNK,
  170. &data(ctx)->ks1, &data(ctx)->ks2,
  171. &data(ctx)->ks3, (DES_cblock *)ctx->iv,
  172. EVP_CIPHER_CTX_is_encrypting(ctx));
  173. inl -= EVP_MAXCHUNK;
  174. in += EVP_MAXCHUNK;
  175. out += EVP_MAXCHUNK;
  176. }
  177. if (inl)
  178. DES_ede3_cfb_encrypt(in, out, 8, (long)inl,
  179. &data(ctx)->ks1, &data(ctx)->ks2,
  180. &data(ctx)->ks3, (DES_cblock *)ctx->iv,
  181. EVP_CIPHER_CTX_is_encrypting(ctx));
  182. return 1;
  183. }
  184. BLOCK_CIPHER_defs(des_ede, DES_EDE_KEY, NID_des_ede, 8, 16, 8, 64,
  185. EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,
  186. des_ede_init_key, NULL, NULL, NULL, des3_ctrl)
  187. # define des_ede3_cfb64_cipher des_ede_cfb64_cipher
  188. # define des_ede3_ofb_cipher des_ede_ofb_cipher
  189. # define des_ede3_cbc_cipher des_ede_cbc_cipher
  190. # define des_ede3_ecb_cipher des_ede_ecb_cipher
  191. BLOCK_CIPHER_defs(des_ede3, DES_EDE_KEY, NID_des_ede3, 8, 24, 8, 64,
  192. EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,
  193. des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)
  194. BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 1,
  195. EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,
  196. des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)
  197. BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 8,
  198. EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1,
  199. des_ede3_init_key, NULL, NULL, NULL, des3_ctrl)
  200. static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  201. const unsigned char *iv, int enc)
  202. {
  203. DES_cblock *deskey = (DES_cblock *)key;
  204. DES_EDE_KEY *dat = data(ctx);
  205. dat->stream.cbc = NULL;
  206. # if defined(SPARC_DES_CAPABLE)
  207. if (SPARC_DES_CAPABLE) {
  208. int mode = EVP_CIPHER_CTX_get_mode(ctx);
  209. if (mode == EVP_CIPH_CBC_MODE) {
  210. des_t4_key_expand(&deskey[0], &dat->ks1);
  211. des_t4_key_expand(&deskey[1], &dat->ks2);
  212. memcpy(&dat->ks3, &dat->ks1, sizeof(dat->ks1));
  213. dat->stream.cbc = enc ? des_t4_ede3_cbc_encrypt :
  214. des_t4_ede3_cbc_decrypt;
  215. return 1;
  216. }
  217. }
  218. # endif
  219. DES_set_key_unchecked(&deskey[0], &dat->ks1);
  220. DES_set_key_unchecked(&deskey[1], &dat->ks2);
  221. memcpy(&dat->ks3, &dat->ks1, sizeof(dat->ks1));
  222. return 1;
  223. }
  224. static int des_ede3_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
  225. const unsigned char *iv, int enc)
  226. {
  227. DES_cblock *deskey = (DES_cblock *)key;
  228. DES_EDE_KEY *dat = data(ctx);
  229. dat->stream.cbc = NULL;
  230. # if defined(SPARC_DES_CAPABLE)
  231. if (SPARC_DES_CAPABLE) {
  232. int mode = EVP_CIPHER_CTX_get_mode(ctx);
  233. if (mode == EVP_CIPH_CBC_MODE) {
  234. des_t4_key_expand(&deskey[0], &dat->ks1);
  235. des_t4_key_expand(&deskey[1], &dat->ks2);
  236. des_t4_key_expand(&deskey[2], &dat->ks3);
  237. dat->stream.cbc = enc ? des_t4_ede3_cbc_encrypt :
  238. des_t4_ede3_cbc_decrypt;
  239. return 1;
  240. }
  241. }
  242. # endif
  243. DES_set_key_unchecked(&deskey[0], &dat->ks1);
  244. DES_set_key_unchecked(&deskey[1], &dat->ks2);
  245. DES_set_key_unchecked(&deskey[2], &dat->ks3);
  246. return 1;
  247. }
  248. static int des3_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
  249. {
  250. DES_cblock *deskey = ptr;
  251. int kl;
  252. switch (type) {
  253. case EVP_CTRL_RAND_KEY:
  254. kl = EVP_CIPHER_CTX_get_key_length(ctx);
  255. if (kl < 0 || RAND_priv_bytes(ptr, kl) <= 0)
  256. return 0;
  257. DES_set_odd_parity(deskey);
  258. if (kl >= 16)
  259. DES_set_odd_parity(deskey + 1);
  260. if (kl >= 24)
  261. DES_set_odd_parity(deskey + 2);
  262. return 1;
  263. default:
  264. return -1;
  265. }
  266. }
  267. const EVP_CIPHER *EVP_des_ede(void)
  268. {
  269. return &des_ede_ecb;
  270. }
  271. const EVP_CIPHER *EVP_des_ede3(void)
  272. {
  273. return &des_ede3_ecb;
  274. }
  275. # include <openssl/sha.h>
  276. static const unsigned char wrap_iv[8] =
  277. { 0x4a, 0xdd, 0xa2, 0x2c, 0x79, 0xe8, 0x21, 0x05 };
  278. static int des_ede3_unwrap(EVP_CIPHER_CTX *ctx, unsigned char *out,
  279. const unsigned char *in, size_t inl)
  280. {
  281. unsigned char icv[8], iv[8], sha1tmp[SHA_DIGEST_LENGTH];
  282. int rv = -1;
  283. if (inl < 24)
  284. return -1;
  285. if (out == NULL)
  286. return inl - 16;
  287. memcpy(ctx->iv, wrap_iv, 8);
  288. /* Decrypt first block which will end up as icv */
  289. des_ede_cbc_cipher(ctx, icv, in, 8);
  290. /* Decrypt central blocks */
  291. /*
  292. * If decrypting in place move whole output along a block so the next
  293. * des_ede_cbc_cipher is in place.
  294. */
  295. if (out == in) {
  296. memmove(out, out + 8, inl - 8);
  297. in -= 8;
  298. }
  299. des_ede_cbc_cipher(ctx, out, in + 8, inl - 16);
  300. /* Decrypt final block which will be IV */
  301. des_ede_cbc_cipher(ctx, iv, in + inl - 8, 8);
  302. /* Reverse order of everything */
  303. BUF_reverse(icv, NULL, 8);
  304. BUF_reverse(out, NULL, inl - 16);
  305. BUF_reverse(ctx->iv, iv, 8);
  306. /* Decrypt again using new IV */
  307. des_ede_cbc_cipher(ctx, out, out, inl - 16);
  308. des_ede_cbc_cipher(ctx, icv, icv, 8);
  309. if (ossl_sha1(out, inl - 16, sha1tmp) /* Work out hash of first portion */
  310. && CRYPTO_memcmp(sha1tmp, icv, 8) == 0)
  311. rv = inl - 16;
  312. OPENSSL_cleanse(icv, 8);
  313. OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH);
  314. OPENSSL_cleanse(iv, 8);
  315. OPENSSL_cleanse(ctx->iv, 8);
  316. if (rv == -1)
  317. OPENSSL_cleanse(out, inl - 16);
  318. return rv;
  319. }
  320. static int des_ede3_wrap(EVP_CIPHER_CTX *ctx, unsigned char *out,
  321. const unsigned char *in, size_t inl)
  322. {
  323. unsigned char sha1tmp[SHA_DIGEST_LENGTH];
  324. if (out == NULL)
  325. return inl + 16;
  326. /* Copy input to output buffer + 8 so we have space for IV */
  327. memmove(out + 8, in, inl);
  328. /* Work out ICV */
  329. if (!ossl_sha1(in, inl, sha1tmp))
  330. return -1;
  331. memcpy(out + inl + 8, sha1tmp, 8);
  332. OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH);
  333. /* Generate random IV */
  334. if (RAND_bytes(ctx->iv, 8) <= 0)
  335. return -1;
  336. memcpy(out, ctx->iv, 8);
  337. /* Encrypt everything after IV in place */
  338. des_ede_cbc_cipher(ctx, out + 8, out + 8, inl + 8);
  339. BUF_reverse(out, NULL, inl + 16);
  340. memcpy(ctx->iv, wrap_iv, 8);
  341. des_ede_cbc_cipher(ctx, out, out, inl + 16);
  342. return inl + 16;
  343. }
  344. static int des_ede3_wrap_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  345. const unsigned char *in, size_t inl)
  346. {
  347. /*
  348. * Sanity check input length: we typically only wrap keys so EVP_MAXCHUNK
  349. * is more than will ever be needed. Also input length must be a multiple
  350. * of 8 bits.
  351. */
  352. if (inl >= EVP_MAXCHUNK || inl % 8)
  353. return -1;
  354. if (ossl_is_partially_overlapping(out, in, inl)) {
  355. ERR_raise(ERR_LIB_EVP, EVP_R_PARTIALLY_OVERLAPPING);
  356. return 0;
  357. }
  358. if (EVP_CIPHER_CTX_is_encrypting(ctx))
  359. return des_ede3_wrap(ctx, out, in, inl);
  360. else
  361. return des_ede3_unwrap(ctx, out, in, inl);
  362. }
  363. static const EVP_CIPHER des3_wrap = {
  364. NID_id_smime_alg_CMS3DESwrap,
  365. 8, 24, 0,
  366. EVP_CIPH_WRAP_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER
  367. | EVP_CIPH_FLAG_DEFAULT_ASN1,
  368. EVP_ORIG_GLOBAL,
  369. des_ede3_init_key, des_ede3_wrap_cipher,
  370. NULL,
  371. sizeof(DES_EDE_KEY),
  372. NULL, NULL, NULL, NULL
  373. };
  374. const EVP_CIPHER *EVP_des_ede3_wrap(void)
  375. {
  376. return &des3_wrap;
  377. }
  378. #endif