/src/boringssl/crypto/cipher_extra/e_aesctrhmac.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* Copyright (c) 2017, Google Inc. |
2 | | * |
3 | | * Permission to use, copy, modify, and/or distribute this software for any |
4 | | * purpose with or without fee is hereby granted, provided that the above |
5 | | * copyright notice and this permission notice appear in all copies. |
6 | | * |
7 | | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
8 | | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
9 | | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
10 | | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
11 | | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
12 | | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
13 | | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
14 | | |
15 | | #include <openssl/aead.h> |
16 | | |
17 | | #include <assert.h> |
18 | | |
19 | | #include <openssl/cipher.h> |
20 | | #include <openssl/crypto.h> |
21 | | #include <openssl/err.h> |
22 | | #include <openssl/sha.h> |
23 | | |
24 | | #include "../fipsmodule/cipher/internal.h" |
25 | | |
26 | | |
27 | 2 | #define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH |
28 | 0 | #define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12 |
29 | | |
30 | | struct aead_aes_ctr_hmac_sha256_ctx { |
31 | | union { |
32 | | double align; |
33 | | AES_KEY ks; |
34 | | } ks; |
35 | | ctr128_f ctr; |
36 | | block128_f block; |
37 | | SHA256_CTX inner_init_state; |
38 | | SHA256_CTX outer_init_state; |
39 | | }; |
40 | | |
41 | | static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >= |
42 | | sizeof(struct aead_aes_ctr_hmac_sha256_ctx), |
43 | | "AEAD state is too small"); |
44 | | static_assert(alignof(union evp_aead_ctx_st_state) >= |
45 | | alignof(struct aead_aes_ctr_hmac_sha256_ctx), |
46 | | "AEAD state has insufficient alignment"); |
47 | | |
48 | | static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer, |
49 | 1 | const uint8_t hmac_key[32]) { |
50 | 1 | static const size_t hmac_key_len = 32; |
51 | 1 | uint8_t block[SHA256_CBLOCK]; |
52 | 1 | OPENSSL_memcpy(block, hmac_key, hmac_key_len); |
53 | 1 | OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len); |
54 | | |
55 | 1 | unsigned i; |
56 | 33 | for (i = 0; i < hmac_key_len; i++) { |
57 | 32 | block[i] ^= 0x36; |
58 | 32 | } |
59 | | |
60 | 1 | SHA256_Init(out_inner); |
61 | 1 | SHA256_Update(out_inner, block, sizeof(block)); |
62 | | |
63 | 1 | OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len); |
64 | 33 | for (i = 0; i < hmac_key_len; i++) { |
65 | 32 | block[i] ^= (0x36 ^ 0x5c); |
66 | 32 | } |
67 | | |
68 | 1 | SHA256_Init(out_outer); |
69 | 1 | SHA256_Update(out_outer, block, sizeof(block)); |
70 | 1 | } |
71 | | |
72 | | static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key, |
73 | 1 | size_t key_len, size_t tag_len) { |
74 | 1 | struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = |
75 | 1 | (struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state; |
76 | 1 | static const size_t hmac_key_len = 32; |
77 | | |
78 | 1 | if (key_len < hmac_key_len) { |
79 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); |
80 | 0 | return 0; // EVP_AEAD_CTX_init should catch this. |
81 | 0 | } |
82 | | |
83 | 1 | const size_t aes_key_len = key_len - hmac_key_len; |
84 | 1 | if (aes_key_len != 16 && aes_key_len != 32) { |
85 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); |
86 | 0 | return 0; // EVP_AEAD_CTX_init should catch this. |
87 | 0 | } |
88 | | |
89 | 1 | if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) { |
90 | 1 | tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN; |
91 | 1 | } |
92 | | |
93 | 1 | if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) { |
94 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE); |
95 | 0 | return 0; |
96 | 0 | } |
97 | | |
98 | 1 | aes_ctx->ctr = |
99 | 1 | aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len); |
100 | 1 | ctx->tag_len = tag_len; |
101 | 1 | hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state, |
102 | 1 | key + aes_key_len); |
103 | | |
104 | 1 | return 1; |
105 | 1 | } |
106 | | |
107 | 1 | static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {} |
108 | | |
109 | 0 | static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) { |
110 | 0 | unsigned i; |
111 | 0 | uint8_t bytes[8]; |
112 | |
|
113 | 0 | for (i = 0; i < sizeof(bytes); i++) { |
114 | 0 | bytes[i] = value & 0xff; |
115 | 0 | value >>= 8; |
116 | 0 | } |
117 | 0 | SHA256_Update(sha256, bytes, sizeof(bytes)); |
118 | 0 | } |
119 | | |
120 | | static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH], |
121 | | const SHA256_CTX *inner_init_state, |
122 | | const SHA256_CTX *outer_init_state, |
123 | | const uint8_t *ad, size_t ad_len, |
124 | | const uint8_t *nonce, const uint8_t *ciphertext, |
125 | 0 | size_t ciphertext_len) { |
126 | 0 | SHA256_CTX sha256; |
127 | 0 | OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256)); |
128 | 0 | hmac_update_uint64(&sha256, ad_len); |
129 | 0 | hmac_update_uint64(&sha256, ciphertext_len); |
130 | 0 | SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN); |
131 | 0 | SHA256_Update(&sha256, ad, ad_len); |
132 | | |
133 | | // Pad with zeros to the end of the SHA-256 block. |
134 | 0 | const unsigned num_padding = |
135 | 0 | (SHA256_CBLOCK - ((sizeof(uint64_t)*2 + |
136 | 0 | EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) % |
137 | 0 | SHA256_CBLOCK)) % |
138 | 0 | SHA256_CBLOCK; |
139 | 0 | uint8_t padding[SHA256_CBLOCK]; |
140 | 0 | OPENSSL_memset(padding, 0, num_padding); |
141 | 0 | SHA256_Update(&sha256, padding, num_padding); |
142 | |
|
143 | 0 | SHA256_Update(&sha256, ciphertext, ciphertext_len); |
144 | |
|
145 | 0 | uint8_t inner_digest[SHA256_DIGEST_LENGTH]; |
146 | 0 | SHA256_Final(inner_digest, &sha256); |
147 | |
|
148 | 0 | OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256)); |
149 | 0 | SHA256_Update(&sha256, inner_digest, sizeof(inner_digest)); |
150 | 0 | SHA256_Final(out, &sha256); |
151 | 0 | } |
152 | | |
153 | | static void aead_aes_ctr_hmac_sha256_crypt( |
154 | | const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out, |
155 | 0 | const uint8_t *in, size_t len, const uint8_t *nonce) { |
156 | | // Since the AEAD operation is one-shot, keeping a buffer of unused keystream |
157 | | // bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it. |
158 | 0 | uint8_t partial_block_buffer[AES_BLOCK_SIZE]; |
159 | 0 | unsigned partial_block_offset = 0; |
160 | 0 | OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer)); |
161 | |
|
162 | 0 | uint8_t counter[AES_BLOCK_SIZE]; |
163 | 0 | OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN); |
164 | 0 | OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4); |
165 | |
|
166 | 0 | if (aes_ctx->ctr) { |
167 | 0 | CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter, |
168 | 0 | partial_block_buffer, &partial_block_offset, |
169 | 0 | aes_ctx->ctr); |
170 | 0 | } else { |
171 | 0 | CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter, |
172 | 0 | partial_block_buffer, &partial_block_offset, |
173 | 0 | aes_ctx->block); |
174 | 0 | } |
175 | 0 | } |
176 | | |
177 | | static int aead_aes_ctr_hmac_sha256_seal_scatter( |
178 | | const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag, |
179 | | size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce, |
180 | | size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in, |
181 | 0 | size_t extra_in_len, const uint8_t *ad, size_t ad_len) { |
182 | 0 | const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = |
183 | 0 | (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state; |
184 | 0 | const uint64_t in_len_64 = in_len; |
185 | |
|
186 | 0 | if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) { |
187 | | // This input is so large it would overflow the 32-bit block counter. |
188 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE); |
189 | 0 | return 0; |
190 | 0 | } |
191 | | |
192 | 0 | if (max_out_tag_len < ctx->tag_len) { |
193 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL); |
194 | 0 | return 0; |
195 | 0 | } |
196 | | |
197 | 0 | if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) { |
198 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE); |
199 | 0 | return 0; |
200 | 0 | } |
201 | | |
202 | 0 | aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce); |
203 | |
|
204 | 0 | uint8_t hmac_result[SHA256_DIGEST_LENGTH]; |
205 | 0 | hmac_calculate(hmac_result, &aes_ctx->inner_init_state, |
206 | 0 | &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len); |
207 | 0 | OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len); |
208 | 0 | *out_tag_len = ctx->tag_len; |
209 | |
|
210 | 0 | return 1; |
211 | 0 | } |
212 | | |
213 | | static int aead_aes_ctr_hmac_sha256_open_gather( |
214 | | const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce, |
215 | | size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag, |
216 | 0 | size_t in_tag_len, const uint8_t *ad, size_t ad_len) { |
217 | 0 | const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = |
218 | 0 | (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state; |
219 | |
|
220 | 0 | if (in_tag_len != ctx->tag_len) { |
221 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT); |
222 | 0 | return 0; |
223 | 0 | } |
224 | | |
225 | 0 | if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) { |
226 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE); |
227 | 0 | return 0; |
228 | 0 | } |
229 | | |
230 | 0 | uint8_t hmac_result[SHA256_DIGEST_LENGTH]; |
231 | 0 | hmac_calculate(hmac_result, &aes_ctx->inner_init_state, |
232 | 0 | &aes_ctx->outer_init_state, ad, ad_len, nonce, in, |
233 | 0 | in_len); |
234 | 0 | if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) { |
235 | 0 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT); |
236 | 0 | return 0; |
237 | 0 | } |
238 | | |
239 | 0 | aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce); |
240 | |
|
241 | 0 | return 1; |
242 | 0 | } |
243 | | |
244 | | static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = { |
245 | | 16 /* AES key */ + 32 /* HMAC key */, |
246 | | 12, // nonce length |
247 | | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead |
248 | | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length |
249 | | 0, // seal_scatter_supports_extra_in |
250 | | |
251 | | aead_aes_ctr_hmac_sha256_init, |
252 | | NULL /* init_with_direction */, |
253 | | aead_aes_ctr_hmac_sha256_cleanup, |
254 | | NULL /* open */, |
255 | | aead_aes_ctr_hmac_sha256_seal_scatter, |
256 | | aead_aes_ctr_hmac_sha256_open_gather, |
257 | | NULL /* get_iv */, |
258 | | NULL /* tag_len */, |
259 | | }; |
260 | | |
261 | | static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = { |
262 | | 32 /* AES key */ + 32 /* HMAC key */, |
263 | | 12, // nonce length |
264 | | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead |
265 | | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length |
266 | | 0, // seal_scatter_supports_extra_in |
267 | | |
268 | | aead_aes_ctr_hmac_sha256_init, |
269 | | NULL /* init_with_direction */, |
270 | | aead_aes_ctr_hmac_sha256_cleanup, |
271 | | NULL /* open */, |
272 | | aead_aes_ctr_hmac_sha256_seal_scatter, |
273 | | aead_aes_ctr_hmac_sha256_open_gather, |
274 | | NULL /* get_iv */, |
275 | | NULL /* tag_len */, |
276 | | }; |
277 | | |
278 | 4 | const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) { |
279 | 4 | return &aead_aes_128_ctr_hmac_sha256; |
280 | 4 | } |
281 | | |
282 | 2 | const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) { |
283 | 2 | return &aead_aes_256_ctr_hmac_sha256; |
284 | 2 | } |