Coverage Report

Created: 2024-11-21 07:03

/src/boringssl/crypto/cipher_extra/e_aesctrhmac.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright (c) 2017, Google Inc.
2
 *
3
 * Permission to use, copy, modify, and/or distribute this software for any
4
 * purpose with or without fee is hereby granted, provided that the above
5
 * copyright notice and this permission notice appear in all copies.
6
 *
7
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10
 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12
 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13
 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15
#include <openssl/aead.h>
16
17
#include <assert.h>
18
19
#include <openssl/cipher.h>
20
#include <openssl/crypto.h>
21
#include <openssl/err.h>
22
#include <openssl/sha.h>
23
24
#include "../fipsmodule/cipher/internal.h"
25
26
27
2
#define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
28
0
#define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
29
30
struct aead_aes_ctr_hmac_sha256_ctx {
31
  union {
32
    double align;
33
    AES_KEY ks;
34
  } ks;
35
  ctr128_f ctr;
36
  block128_f block;
37
  SHA256_CTX inner_init_state;
38
  SHA256_CTX outer_init_state;
39
};
40
41
static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
42
                  sizeof(struct aead_aes_ctr_hmac_sha256_ctx),
43
              "AEAD state is too small");
44
static_assert(alignof(union evp_aead_ctx_st_state) >=
45
                  alignof(struct aead_aes_ctr_hmac_sha256_ctx),
46
              "AEAD state has insufficient alignment");
47
48
static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer,
49
1
                      const uint8_t hmac_key[32]) {
50
1
  static const size_t hmac_key_len = 32;
51
1
  uint8_t block[SHA256_CBLOCK];
52
1
  OPENSSL_memcpy(block, hmac_key, hmac_key_len);
53
1
  OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len);
54
55
1
  unsigned i;
56
33
  for (i = 0; i < hmac_key_len; i++) {
57
32
    block[i] ^= 0x36;
58
32
  }
59
60
1
  SHA256_Init(out_inner);
61
1
  SHA256_Update(out_inner, block, sizeof(block));
62
63
1
  OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len);
64
33
  for (i = 0; i < hmac_key_len; i++) {
65
32
    block[i] ^= (0x36 ^ 0x5c);
66
32
  }
67
68
1
  SHA256_Init(out_outer);
69
1
  SHA256_Update(out_outer, block, sizeof(block));
70
1
}
71
72
static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
73
1
                                         size_t key_len, size_t tag_len) {
74
1
  struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
75
1
      (struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state;
76
1
  static const size_t hmac_key_len = 32;
77
78
1
  if (key_len < hmac_key_len) {
79
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
80
0
    return 0;  // EVP_AEAD_CTX_init should catch this.
81
0
  }
82
83
1
  const size_t aes_key_len = key_len - hmac_key_len;
84
1
  if (aes_key_len != 16 && aes_key_len != 32) {
85
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
86
0
    return 0;  // EVP_AEAD_CTX_init should catch this.
87
0
  }
88
89
1
  if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
90
1
    tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN;
91
1
  }
92
93
1
  if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) {
94
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
95
0
    return 0;
96
0
  }
97
98
1
  aes_ctx->ctr =
99
1
      aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len);
100
1
  ctx->tag_len = tag_len;
101
1
  hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state,
102
1
            key + aes_key_len);
103
104
1
  return 1;
105
1
}
106
107
1
static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {}
108
109
0
static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
110
0
  unsigned i;
111
0
  uint8_t bytes[8];
112
113
0
  for (i = 0; i < sizeof(bytes); i++) {
114
0
    bytes[i] = value & 0xff;
115
0
    value >>= 8;
116
0
  }
117
0
  SHA256_Update(sha256, bytes, sizeof(bytes));
118
0
}
119
120
static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
121
                           const SHA256_CTX *inner_init_state,
122
                           const SHA256_CTX *outer_init_state,
123
                           const uint8_t *ad, size_t ad_len,
124
                           const uint8_t *nonce, const uint8_t *ciphertext,
125
0
                           size_t ciphertext_len) {
126
0
  SHA256_CTX sha256;
127
0
  OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
128
0
  hmac_update_uint64(&sha256, ad_len);
129
0
  hmac_update_uint64(&sha256, ciphertext_len);
130
0
  SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
131
0
  SHA256_Update(&sha256, ad, ad_len);
132
133
  // Pad with zeros to the end of the SHA-256 block.
134
0
  const unsigned num_padding =
135
0
      (SHA256_CBLOCK - ((sizeof(uint64_t)*2 +
136
0
                         EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) %
137
0
                        SHA256_CBLOCK)) %
138
0
      SHA256_CBLOCK;
139
0
  uint8_t padding[SHA256_CBLOCK];
140
0
  OPENSSL_memset(padding, 0, num_padding);
141
0
  SHA256_Update(&sha256, padding, num_padding);
142
143
0
  SHA256_Update(&sha256, ciphertext, ciphertext_len);
144
145
0
  uint8_t inner_digest[SHA256_DIGEST_LENGTH];
146
0
  SHA256_Final(inner_digest, &sha256);
147
148
0
  OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256));
149
0
  SHA256_Update(&sha256, inner_digest, sizeof(inner_digest));
150
0
  SHA256_Final(out, &sha256);
151
0
}
152
153
static void aead_aes_ctr_hmac_sha256_crypt(
154
    const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out,
155
0
    const uint8_t *in, size_t len, const uint8_t *nonce) {
156
  // Since the AEAD operation is one-shot, keeping a buffer of unused keystream
157
  // bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it.
158
0
  uint8_t partial_block_buffer[AES_BLOCK_SIZE];
159
0
  unsigned partial_block_offset = 0;
160
0
  OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
161
162
0
  uint8_t counter[AES_BLOCK_SIZE];
163
0
  OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
164
0
  OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4);
165
166
0
  if (aes_ctx->ctr) {
167
0
    CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter,
168
0
                                partial_block_buffer, &partial_block_offset,
169
0
                                aes_ctx->ctr);
170
0
  } else {
171
0
    CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter,
172
0
                          partial_block_buffer, &partial_block_offset,
173
0
                          aes_ctx->block);
174
0
  }
175
0
}
176
177
static int aead_aes_ctr_hmac_sha256_seal_scatter(
178
    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
179
    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
180
    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
181
0
    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
182
0
  const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
183
0
      (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
184
0
  const uint64_t in_len_64 = in_len;
185
186
0
  if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
187
     // This input is so large it would overflow the 32-bit block counter.
188
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
189
0
    return 0;
190
0
  }
191
192
0
  if (max_out_tag_len < ctx->tag_len) {
193
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
194
0
    return 0;
195
0
  }
196
197
0
  if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
198
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
199
0
    return 0;
200
0
  }
201
202
0
  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
203
204
0
  uint8_t hmac_result[SHA256_DIGEST_LENGTH];
205
0
  hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
206
0
                 &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len);
207
0
  OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len);
208
0
  *out_tag_len = ctx->tag_len;
209
210
0
  return 1;
211
0
}
212
213
static int aead_aes_ctr_hmac_sha256_open_gather(
214
    const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce,
215
    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag,
216
0
    size_t in_tag_len, const uint8_t *ad, size_t ad_len) {
217
0
  const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
218
0
      (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
219
220
0
  if (in_tag_len != ctx->tag_len) {
221
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
222
0
    return 0;
223
0
  }
224
225
0
  if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
226
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
227
0
    return 0;
228
0
  }
229
230
0
  uint8_t hmac_result[SHA256_DIGEST_LENGTH];
231
0
  hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
232
0
                 &aes_ctx->outer_init_state, ad, ad_len, nonce, in,
233
0
                 in_len);
234
0
  if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) {
235
0
    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
236
0
    return 0;
237
0
  }
238
239
0
  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
240
241
0
  return 1;
242
0
}
243
244
static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
245
    16 /* AES key */ + 32 /* HMAC key */,
246
    12,                                    // nonce length
247
    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
248
    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
249
    0,                                     // seal_scatter_supports_extra_in
250
251
    aead_aes_ctr_hmac_sha256_init,
252
    NULL /* init_with_direction */,
253
    aead_aes_ctr_hmac_sha256_cleanup,
254
    NULL /* open */,
255
    aead_aes_ctr_hmac_sha256_seal_scatter,
256
    aead_aes_ctr_hmac_sha256_open_gather,
257
    NULL /* get_iv */,
258
    NULL /* tag_len */,
259
};
260
261
static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
262
    32 /* AES key */ + 32 /* HMAC key */,
263
    12,                                    // nonce length
264
    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
265
    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
266
    0,                                     // seal_scatter_supports_extra_in
267
268
    aead_aes_ctr_hmac_sha256_init,
269
    NULL /* init_with_direction */,
270
    aead_aes_ctr_hmac_sha256_cleanup,
271
    NULL /* open */,
272
    aead_aes_ctr_hmac_sha256_seal_scatter,
273
    aead_aes_ctr_hmac_sha256_open_gather,
274
    NULL /* get_iv */,
275
    NULL /* tag_len */,
276
};
277
278
4
const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) {
279
4
  return &aead_aes_128_ctr_hmac_sha256;
280
4
}
281
282
2
const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) {
283
2
  return &aead_aes_256_ctr_hmac_sha256;
284
2
}