2
0

e_chacha20_poly1305.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635
  1. /*
  2. * Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #include "internal/endian.h"
  12. #ifndef OPENSSL_NO_CHACHA
  13. # include <openssl/evp.h>
  14. # include <openssl/objects.h>
  15. # include "crypto/evp.h"
  16. # include "evp_local.h"
  17. # include "crypto/chacha.h"
  18. typedef struct {
  19. union {
  20. OSSL_UNION_ALIGN; /* this ensures even sizeof(EVP_CHACHA_KEY)%8==0 */
  21. unsigned int d[CHACHA_KEY_SIZE / 4];
  22. } key;
  23. unsigned int counter[CHACHA_CTR_SIZE / 4];
  24. unsigned char buf[CHACHA_BLK_SIZE];
  25. unsigned int partial_len;
  26. } EVP_CHACHA_KEY;
  27. #define data(ctx) ((EVP_CHACHA_KEY *)(ctx)->cipher_data)
  28. #define CHACHA20_POLY1305_MAX_IVLEN 12
  29. static int chacha_init_key(EVP_CIPHER_CTX *ctx,
  30. const unsigned char user_key[CHACHA_KEY_SIZE],
  31. const unsigned char iv[CHACHA_CTR_SIZE], int enc)
  32. {
  33. EVP_CHACHA_KEY *key = data(ctx);
  34. unsigned int i;
  35. if (user_key)
  36. for (i = 0; i < CHACHA_KEY_SIZE; i+=4) {
  37. key->key.d[i/4] = CHACHA_U8TOU32(user_key+i);
  38. }
  39. if (iv)
  40. for (i = 0; i < CHACHA_CTR_SIZE; i+=4) {
  41. key->counter[i/4] = CHACHA_U8TOU32(iv+i);
  42. }
  43. key->partial_len = 0;
  44. return 1;
  45. }
  46. static int chacha_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  47. const unsigned char *inp, size_t len)
  48. {
  49. EVP_CHACHA_KEY *key = data(ctx);
  50. unsigned int n, rem, ctr32;
  51. if ((n = key->partial_len)) {
  52. while (len && n < CHACHA_BLK_SIZE) {
  53. *out++ = *inp++ ^ key->buf[n++];
  54. len--;
  55. }
  56. key->partial_len = n;
  57. if (len == 0)
  58. return 1;
  59. if (n == CHACHA_BLK_SIZE) {
  60. key->partial_len = 0;
  61. key->counter[0]++;
  62. if (key->counter[0] == 0)
  63. key->counter[1]++;
  64. }
  65. }
  66. rem = (unsigned int)(len % CHACHA_BLK_SIZE);
  67. len -= rem;
  68. ctr32 = key->counter[0];
  69. while (len >= CHACHA_BLK_SIZE) {
  70. size_t blocks = len / CHACHA_BLK_SIZE;
  71. /*
  72. * 1<<28 is just a not-so-small yet not-so-large number...
  73. * Below condition is practically never met, but it has to
  74. * be checked for code correctness.
  75. */
  76. if (sizeof(size_t)>sizeof(unsigned int) && blocks>(1U<<28))
  77. blocks = (1U<<28);
  78. /*
  79. * As ChaCha20_ctr32 operates on 32-bit counter, caller
  80. * has to handle overflow. 'if' below detects the
  81. * overflow, which is then handled by limiting the
  82. * amount of blocks to the exact overflow point...
  83. */
  84. ctr32 += (unsigned int)blocks;
  85. if (ctr32 < blocks) {
  86. blocks -= ctr32;
  87. ctr32 = 0;
  88. }
  89. blocks *= CHACHA_BLK_SIZE;
  90. ChaCha20_ctr32(out, inp, blocks, key->key.d, key->counter);
  91. len -= blocks;
  92. inp += blocks;
  93. out += blocks;
  94. key->counter[0] = ctr32;
  95. if (ctr32 == 0) key->counter[1]++;
  96. }
  97. if (rem) {
  98. memset(key->buf, 0, sizeof(key->buf));
  99. ChaCha20_ctr32(key->buf, key->buf, CHACHA_BLK_SIZE,
  100. key->key.d, key->counter);
  101. for (n = 0; n < rem; n++)
  102. out[n] = inp[n] ^ key->buf[n];
  103. key->partial_len = rem;
  104. }
  105. return 1;
  106. }
  107. static const EVP_CIPHER chacha20 = {
  108. NID_chacha20,
  109. 1, /* block_size */
  110. CHACHA_KEY_SIZE, /* key_len */
  111. CHACHA_CTR_SIZE, /* iv_len, 128-bit counter in the context */
  112. EVP_CIPH_CUSTOM_IV | EVP_CIPH_ALWAYS_CALL_INIT,
  113. EVP_ORIG_GLOBAL,
  114. chacha_init_key,
  115. chacha_cipher,
  116. NULL,
  117. sizeof(EVP_CHACHA_KEY),
  118. NULL,
  119. NULL,
  120. NULL,
  121. NULL
  122. };
  123. const EVP_CIPHER *EVP_chacha20(void)
  124. {
  125. return &chacha20;
  126. }
  127. # ifndef OPENSSL_NO_POLY1305
  128. # include "crypto/poly1305.h"
  129. typedef struct {
  130. EVP_CHACHA_KEY key;
  131. unsigned int nonce[12/4];
  132. unsigned char tag[POLY1305_BLOCK_SIZE];
  133. unsigned char tls_aad[POLY1305_BLOCK_SIZE];
  134. struct { uint64_t aad, text; } len;
  135. int aad, mac_inited, tag_len, nonce_len;
  136. size_t tls_payload_length;
  137. } EVP_CHACHA_AEAD_CTX;
  138. # define NO_TLS_PAYLOAD_LENGTH ((size_t)-1)
  139. # define aead_data(ctx) ((EVP_CHACHA_AEAD_CTX *)(ctx)->cipher_data)
  140. # define POLY1305_ctx(actx) ((POLY1305 *)(actx + 1))
  141. static int chacha20_poly1305_init_key(EVP_CIPHER_CTX *ctx,
  142. const unsigned char *inkey,
  143. const unsigned char *iv, int enc)
  144. {
  145. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  146. if (!inkey && !iv)
  147. return 1;
  148. actx->len.aad = 0;
  149. actx->len.text = 0;
  150. actx->aad = 0;
  151. actx->mac_inited = 0;
  152. actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  153. if (iv != NULL) {
  154. unsigned char temp[CHACHA_CTR_SIZE] = { 0 };
  155. /* pad on the left */
  156. if (actx->nonce_len <= CHACHA_CTR_SIZE)
  157. memcpy(temp + CHACHA_CTR_SIZE - actx->nonce_len, iv,
  158. actx->nonce_len);
  159. chacha_init_key(ctx, inkey, temp, enc);
  160. actx->nonce[0] = actx->key.counter[1];
  161. actx->nonce[1] = actx->key.counter[2];
  162. actx->nonce[2] = actx->key.counter[3];
  163. } else {
  164. chacha_init_key(ctx, inkey, NULL, enc);
  165. }
  166. return 1;
  167. }
  168. # if !defined(OPENSSL_SMALL_FOOTPRINT)
  169. # if defined(POLY1305_ASM) && (defined(__x86_64) || defined(__x86_64__) || \
  170. defined(_M_AMD64) || defined(_M_X64))
  171. # define XOR128_HELPERS
  172. void *xor128_encrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
  173. void *xor128_decrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
  174. static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 };
  175. # else
  176. static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
  177. # endif
  178. static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  179. const unsigned char *in, size_t len)
  180. {
  181. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  182. size_t tail, tohash_len, buf_len, plen = actx->tls_payload_length;
  183. unsigned char *buf, *tohash, *ctr, storage[sizeof(zero) + 32];
  184. if (len != plen + POLY1305_BLOCK_SIZE)
  185. return -1;
  186. buf = storage + ((0 - (size_t)storage) & 15); /* align */
  187. ctr = buf + CHACHA_BLK_SIZE;
  188. tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;
  189. # ifdef XOR128_HELPERS
  190. if (plen <= 3 * CHACHA_BLK_SIZE) {
  191. actx->key.counter[0] = 0;
  192. buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE);
  193. ChaCha20_ctr32(buf, zero, buf_len, actx->key.key.d,
  194. actx->key.counter);
  195. Poly1305_Init(POLY1305_ctx(actx), buf);
  196. actx->key.partial_len = 0;
  197. memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);
  198. tohash_len = POLY1305_BLOCK_SIZE;
  199. actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  200. actx->len.text = plen;
  201. if (plen) {
  202. if (EVP_CIPHER_CTX_is_encrypting(ctx))
  203. ctr = xor128_encrypt_n_pad(out, in, ctr, plen);
  204. else
  205. ctr = xor128_decrypt_n_pad(out, in, ctr, plen);
  206. in += plen;
  207. out += plen;
  208. tohash_len = (size_t)(ctr - tohash);
  209. }
  210. }
  211. # else
  212. if (plen <= CHACHA_BLK_SIZE) {
  213. size_t i;
  214. actx->key.counter[0] = 0;
  215. ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE),
  216. actx->key.key.d, actx->key.counter);
  217. Poly1305_Init(POLY1305_ctx(actx), buf);
  218. actx->key.partial_len = 0;
  219. memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);
  220. tohash_len = POLY1305_BLOCK_SIZE;
  221. actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  222. actx->len.text = plen;
  223. if (EVP_CIPHER_CTX_is_encrypting(ctx)) {
  224. for (i = 0; i < plen; i++) {
  225. out[i] = ctr[i] ^= in[i];
  226. }
  227. } else {
  228. for (i = 0; i < plen; i++) {
  229. unsigned char c = in[i];
  230. out[i] = ctr[i] ^ c;
  231. ctr[i] = c;
  232. }
  233. }
  234. in += i;
  235. out += i;
  236. tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
  237. memset(ctr + i, 0, tail);
  238. ctr += i + tail;
  239. tohash_len += i + tail;
  240. }
  241. # endif
  242. else {
  243. actx->key.counter[0] = 0;
  244. ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE),
  245. actx->key.key.d, actx->key.counter);
  246. Poly1305_Init(POLY1305_ctx(actx), buf);
  247. actx->key.counter[0] = 1;
  248. actx->key.partial_len = 0;
  249. Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad, POLY1305_BLOCK_SIZE);
  250. tohash = ctr;
  251. tohash_len = 0;
  252. actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  253. actx->len.text = plen;
  254. if (EVP_CIPHER_CTX_is_encrypting(ctx)) {
  255. ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
  256. Poly1305_Update(POLY1305_ctx(actx), out, plen);
  257. } else {
  258. Poly1305_Update(POLY1305_ctx(actx), in, plen);
  259. ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
  260. }
  261. in += plen;
  262. out += plen;
  263. tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
  264. Poly1305_Update(POLY1305_ctx(actx), zero, tail);
  265. }
  266. {
  267. DECLARE_IS_ENDIAN;
  268. if (IS_LITTLE_ENDIAN) {
  269. memcpy(ctr, (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
  270. } else {
  271. ctr[0] = (unsigned char)(actx->len.aad);
  272. ctr[1] = (unsigned char)(actx->len.aad>>8);
  273. ctr[2] = (unsigned char)(actx->len.aad>>16);
  274. ctr[3] = (unsigned char)(actx->len.aad>>24);
  275. ctr[4] = (unsigned char)(actx->len.aad>>32);
  276. ctr[5] = (unsigned char)(actx->len.aad>>40);
  277. ctr[6] = (unsigned char)(actx->len.aad>>48);
  278. ctr[7] = (unsigned char)(actx->len.aad>>56);
  279. ctr[8] = (unsigned char)(actx->len.text);
  280. ctr[9] = (unsigned char)(actx->len.text>>8);
  281. ctr[10] = (unsigned char)(actx->len.text>>16);
  282. ctr[11] = (unsigned char)(actx->len.text>>24);
  283. ctr[12] = (unsigned char)(actx->len.text>>32);
  284. ctr[13] = (unsigned char)(actx->len.text>>40);
  285. ctr[14] = (unsigned char)(actx->len.text>>48);
  286. ctr[15] = (unsigned char)(actx->len.text>>56);
  287. }
  288. tohash_len += POLY1305_BLOCK_SIZE;
  289. }
  290. Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);
  291. OPENSSL_cleanse(buf, buf_len);
  292. Poly1305_Final(POLY1305_ctx(actx),
  293. EVP_CIPHER_CTX_is_encrypting(ctx) ? actx->tag : tohash);
  294. actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  295. if (EVP_CIPHER_CTX_is_encrypting(ctx)) {
  296. memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
  297. } else {
  298. if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
  299. memset(out - (len - POLY1305_BLOCK_SIZE), 0,
  300. len - POLY1305_BLOCK_SIZE);
  301. return -1;
  302. }
  303. }
  304. return len;
  305. }
  306. # else
  307. static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 };
  308. # endif
  309. static int chacha20_poly1305_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  310. const unsigned char *in, size_t len)
  311. {
  312. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  313. size_t rem, plen = actx->tls_payload_length;
  314. if (!actx->mac_inited) {
  315. # if !defined(OPENSSL_SMALL_FOOTPRINT)
  316. if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL)
  317. return chacha20_poly1305_tls_cipher(ctx, out, in, len);
  318. # endif
  319. actx->key.counter[0] = 0;
  320. ChaCha20_ctr32(actx->key.buf, zero, CHACHA_BLK_SIZE,
  321. actx->key.key.d, actx->key.counter);
  322. Poly1305_Init(POLY1305_ctx(actx), actx->key.buf);
  323. actx->key.counter[0] = 1;
  324. actx->key.partial_len = 0;
  325. actx->len.aad = actx->len.text = 0;
  326. actx->mac_inited = 1;
  327. if (plen != NO_TLS_PAYLOAD_LENGTH) {
  328. Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad,
  329. EVP_AEAD_TLS1_AAD_LEN);
  330. actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
  331. actx->aad = 1;
  332. }
  333. }
  334. if (in) { /* aad or text */
  335. if (out == NULL) { /* aad */
  336. Poly1305_Update(POLY1305_ctx(actx), in, len);
  337. actx->len.aad += len;
  338. actx->aad = 1;
  339. return len;
  340. } else { /* plain- or ciphertext */
  341. if (actx->aad) { /* wrap up aad */
  342. if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
  343. Poly1305_Update(POLY1305_ctx(actx), zero,
  344. POLY1305_BLOCK_SIZE - rem);
  345. actx->aad = 0;
  346. }
  347. actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  348. if (plen == NO_TLS_PAYLOAD_LENGTH)
  349. plen = len;
  350. else if (len != plen + POLY1305_BLOCK_SIZE)
  351. return -1;
  352. if (EVP_CIPHER_CTX_is_encrypting(ctx)) { /* plaintext */
  353. chacha_cipher(ctx, out, in, plen);
  354. Poly1305_Update(POLY1305_ctx(actx), out, plen);
  355. in += plen;
  356. out += plen;
  357. actx->len.text += plen;
  358. } else { /* ciphertext */
  359. Poly1305_Update(POLY1305_ctx(actx), in, plen);
  360. chacha_cipher(ctx, out, in, plen);
  361. in += plen;
  362. out += plen;
  363. actx->len.text += plen;
  364. }
  365. }
  366. }
  367. if (in == NULL /* explicit final */
  368. || plen != len) { /* or tls mode */
  369. DECLARE_IS_ENDIAN;
  370. unsigned char temp[POLY1305_BLOCK_SIZE];
  371. if (actx->aad) { /* wrap up aad */
  372. if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
  373. Poly1305_Update(POLY1305_ctx(actx), zero,
  374. POLY1305_BLOCK_SIZE - rem);
  375. actx->aad = 0;
  376. }
  377. if ((rem = (size_t)actx->len.text % POLY1305_BLOCK_SIZE))
  378. Poly1305_Update(POLY1305_ctx(actx), zero,
  379. POLY1305_BLOCK_SIZE - rem);
  380. if (IS_LITTLE_ENDIAN) {
  381. Poly1305_Update(POLY1305_ctx(actx),
  382. (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
  383. } else {
  384. temp[0] = (unsigned char)(actx->len.aad);
  385. temp[1] = (unsigned char)(actx->len.aad>>8);
  386. temp[2] = (unsigned char)(actx->len.aad>>16);
  387. temp[3] = (unsigned char)(actx->len.aad>>24);
  388. temp[4] = (unsigned char)(actx->len.aad>>32);
  389. temp[5] = (unsigned char)(actx->len.aad>>40);
  390. temp[6] = (unsigned char)(actx->len.aad>>48);
  391. temp[7] = (unsigned char)(actx->len.aad>>56);
  392. temp[8] = (unsigned char)(actx->len.text);
  393. temp[9] = (unsigned char)(actx->len.text>>8);
  394. temp[10] = (unsigned char)(actx->len.text>>16);
  395. temp[11] = (unsigned char)(actx->len.text>>24);
  396. temp[12] = (unsigned char)(actx->len.text>>32);
  397. temp[13] = (unsigned char)(actx->len.text>>40);
  398. temp[14] = (unsigned char)(actx->len.text>>48);
  399. temp[15] = (unsigned char)(actx->len.text>>56);
  400. Poly1305_Update(POLY1305_ctx(actx), temp, POLY1305_BLOCK_SIZE);
  401. }
  402. Poly1305_Final(POLY1305_ctx(actx),
  403. EVP_CIPHER_CTX_is_encrypting(ctx) ? actx->tag : temp);
  404. actx->mac_inited = 0;
  405. if (in != NULL && len != plen) { /* tls mode */
  406. if (EVP_CIPHER_CTX_is_encrypting(ctx)) {
  407. memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
  408. } else {
  409. if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
  410. memset(out - plen, 0, plen);
  411. return -1;
  412. }
  413. }
  414. }
  415. else if (!EVP_CIPHER_CTX_is_encrypting(ctx)) {
  416. if (CRYPTO_memcmp(temp, actx->tag, actx->tag_len))
  417. return -1;
  418. }
  419. }
  420. return len;
  421. }
  422. static int chacha20_poly1305_cleanup(EVP_CIPHER_CTX *ctx)
  423. {
  424. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  425. if (actx)
  426. OPENSSL_cleanse(ctx->cipher_data, sizeof(*actx) + Poly1305_ctx_size());
  427. return 1;
  428. }
  429. static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
  430. void *ptr)
  431. {
  432. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  433. switch (type) {
  434. case EVP_CTRL_INIT:
  435. if (actx == NULL)
  436. actx = ctx->cipher_data
  437. = OPENSSL_zalloc(sizeof(*actx) + Poly1305_ctx_size());
  438. if (actx == NULL) {
  439. ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
  440. return 0;
  441. }
  442. actx->len.aad = 0;
  443. actx->len.text = 0;
  444. actx->aad = 0;
  445. actx->mac_inited = 0;
  446. actx->tag_len = 0;
  447. actx->nonce_len = 12;
  448. actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  449. memset(actx->tls_aad, 0, POLY1305_BLOCK_SIZE);
  450. return 1;
  451. case EVP_CTRL_COPY:
  452. if (actx) {
  453. EVP_CIPHER_CTX *dst = (EVP_CIPHER_CTX *)ptr;
  454. dst->cipher_data =
  455. OPENSSL_memdup(actx, sizeof(*actx) + Poly1305_ctx_size());
  456. if (dst->cipher_data == NULL) {
  457. ERR_raise(ERR_LIB_EVP, EVP_R_COPY_ERROR);
  458. return 0;
  459. }
  460. }
  461. return 1;
  462. case EVP_CTRL_GET_IVLEN:
  463. *(int *)ptr = actx->nonce_len;
  464. return 1;
  465. case EVP_CTRL_AEAD_SET_IVLEN:
  466. if (arg <= 0 || arg > CHACHA20_POLY1305_MAX_IVLEN)
  467. return 0;
  468. actx->nonce_len = arg;
  469. return 1;
  470. case EVP_CTRL_AEAD_SET_IV_FIXED:
  471. if (arg != 12)
  472. return 0;
  473. actx->nonce[0] = actx->key.counter[1]
  474. = CHACHA_U8TOU32((unsigned char *)ptr);
  475. actx->nonce[1] = actx->key.counter[2]
  476. = CHACHA_U8TOU32((unsigned char *)ptr+4);
  477. actx->nonce[2] = actx->key.counter[3]
  478. = CHACHA_U8TOU32((unsigned char *)ptr+8);
  479. return 1;
  480. case EVP_CTRL_AEAD_SET_TAG:
  481. if (arg <= 0 || arg > POLY1305_BLOCK_SIZE)
  482. return 0;
  483. if (ptr != NULL) {
  484. memcpy(actx->tag, ptr, arg);
  485. actx->tag_len = arg;
  486. }
  487. return 1;
  488. case EVP_CTRL_AEAD_GET_TAG:
  489. if (arg <= 0 || arg > POLY1305_BLOCK_SIZE ||
  490. !EVP_CIPHER_CTX_is_encrypting(ctx))
  491. return 0;
  492. memcpy(ptr, actx->tag, arg);
  493. return 1;
  494. case EVP_CTRL_AEAD_TLS1_AAD:
  495. if (arg != EVP_AEAD_TLS1_AAD_LEN)
  496. return 0;
  497. {
  498. unsigned int len;
  499. unsigned char *aad = ptr;
  500. memcpy(actx->tls_aad, ptr, EVP_AEAD_TLS1_AAD_LEN);
  501. len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 |
  502. aad[EVP_AEAD_TLS1_AAD_LEN - 1];
  503. aad = actx->tls_aad;
  504. if (!EVP_CIPHER_CTX_is_encrypting(ctx)) {
  505. if (len < POLY1305_BLOCK_SIZE)
  506. return 0;
  507. len -= POLY1305_BLOCK_SIZE; /* discount attached tag */
  508. aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
  509. aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
  510. }
  511. actx->tls_payload_length = len;
  512. /*
  513. * merge record sequence number as per RFC7905
  514. */
  515. actx->key.counter[1] = actx->nonce[0];
  516. actx->key.counter[2] = actx->nonce[1] ^ CHACHA_U8TOU32(aad);
  517. actx->key.counter[3] = actx->nonce[2] ^ CHACHA_U8TOU32(aad+4);
  518. actx->mac_inited = 0;
  519. return POLY1305_BLOCK_SIZE; /* tag length */
  520. }
  521. case EVP_CTRL_AEAD_SET_MAC_KEY:
  522. /* no-op */
  523. return 1;
  524. default:
  525. return -1;
  526. }
  527. }
  528. static EVP_CIPHER chacha20_poly1305 = {
  529. NID_chacha20_poly1305,
  530. 1, /* block_size */
  531. CHACHA_KEY_SIZE, /* key_len */
  532. 12, /* iv_len, 96-bit nonce in the context */
  533. EVP_CIPH_FLAG_AEAD_CIPHER | EVP_CIPH_CUSTOM_IV |
  534. EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
  535. EVP_CIPH_CUSTOM_COPY | EVP_CIPH_FLAG_CUSTOM_CIPHER |
  536. EVP_CIPH_CUSTOM_IV_LENGTH,
  537. EVP_ORIG_GLOBAL,
  538. chacha20_poly1305_init_key,
  539. chacha20_poly1305_cipher,
  540. chacha20_poly1305_cleanup,
  541. 0, /* 0 moves context-specific structure allocation to ctrl */
  542. NULL, /* set_asn1_parameters */
  543. NULL, /* get_asn1_parameters */
  544. chacha20_poly1305_ctrl,
  545. NULL /* app_data */
  546. };
  547. const EVP_CIPHER *EVP_chacha20_poly1305(void)
  548. {
  549. return(&chacha20_poly1305);
  550. }
  551. # endif
  552. #endif