/src/boringssl/crypto/fipsmodule/aes/key_wrap.c.inc
Line | Count | Source (jump to first uncovered line) |
1 | | /* ==================================================================== |
2 | | * Copyright (c) 2001-2011 The OpenSSL Project. All rights reserved. |
3 | | * |
4 | | * Redistribution and use in source and binary forms, with or without |
5 | | * modification, are permitted provided that the following conditions |
6 | | * are met: |
7 | | * |
8 | | * 1. Redistributions of source code must retain the above copyright |
9 | | * notice, this list of conditions and the following disclaimer. |
10 | | * |
11 | | * 2. Redistributions in binary form must reproduce the above copyright |
12 | | * notice, this list of conditions and the following disclaimer in |
13 | | * the documentation and/or other materials provided with the |
14 | | * distribution. |
15 | | * |
16 | | * 3. All advertising materials mentioning features or use of this |
17 | | * software must display the following acknowledgment: |
18 | | * "This product includes software developed by the OpenSSL Project |
19 | | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
20 | | * |
21 | | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
22 | | * endorse or promote products derived from this software without |
23 | | * prior written permission. For written permission, please contact |
24 | | * openssl-core@openssl.org. |
25 | | * |
26 | | * 5. Products derived from this software may not be called "OpenSSL" |
27 | | * nor may "OpenSSL" appear in their names without prior written |
28 | | * permission of the OpenSSL Project. |
29 | | * |
30 | | * 6. Redistributions of any form whatsoever must retain the following |
31 | | * acknowledgment: |
32 | | * "This product includes software developed by the OpenSSL Project |
33 | | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
34 | | * |
35 | | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
36 | | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
37 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
38 | | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
39 | | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
40 | | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
41 | | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
42 | | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
43 | | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
44 | | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
45 | | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
46 | | * OF THE POSSIBILITY OF SUCH DAMAGE. |
47 | | * ==================================================================== */ |
48 | | |
49 | | #include <openssl/aes.h> |
50 | | |
51 | | #include <assert.h> |
52 | | #include <limits.h> |
53 | | #include <string.h> |
54 | | |
55 | | #include <openssl/mem.h> |
56 | | |
57 | | #include "../../internal.h" |
58 | | #include "../service_indicator/internal.h" |
59 | | |
60 | | |
61 | | // kDefaultIV is the default IV value given in RFC 3394, 2.2.3.1. |
62 | | static const uint8_t kDefaultIV[] = { |
63 | | 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, |
64 | | }; |
65 | | |
66 | | static const unsigned kBound = 6; |
67 | | |
68 | | int AES_wrap_key(const AES_KEY *key, const uint8_t *iv, uint8_t *out, |
69 | 0 | const uint8_t *in, size_t in_len) { |
70 | | // See RFC 3394, section 2.2.1. Additionally, note that section 2 requires the |
71 | | // plaintext be at least two 8-byte blocks. |
72 | |
|
73 | 0 | if (in_len > INT_MAX - 8 || in_len < 16 || in_len % 8 != 0) { |
74 | 0 | return -1; |
75 | 0 | } |
76 | | |
77 | 0 | if (iv == NULL) { |
78 | 0 | iv = kDefaultIV; |
79 | 0 | } |
80 | |
|
81 | 0 | OPENSSL_memmove(out + 8, in, in_len); |
82 | 0 | uint8_t A[AES_BLOCK_SIZE]; |
83 | 0 | OPENSSL_memcpy(A, iv, 8); |
84 | |
|
85 | 0 | size_t n = in_len / 8; |
86 | |
|
87 | 0 | for (unsigned j = 0; j < kBound; j++) { |
88 | 0 | for (size_t i = 1; i <= n; i++) { |
89 | 0 | OPENSSL_memcpy(A + 8, out + 8 * i, 8); |
90 | 0 | AES_encrypt(A, A, key); |
91 | |
|
92 | 0 | uint32_t t = (uint32_t)(n * j + i); |
93 | 0 | A[7] ^= t & 0xff; |
94 | 0 | A[6] ^= (t >> 8) & 0xff; |
95 | 0 | A[5] ^= (t >> 16) & 0xff; |
96 | 0 | A[4] ^= (t >> 24) & 0xff; |
97 | 0 | OPENSSL_memcpy(out + 8 * i, A + 8, 8); |
98 | 0 | } |
99 | 0 | } |
100 | |
|
101 | 0 | OPENSSL_memcpy(out, A, 8); |
102 | 0 | FIPS_service_indicator_update_state(); |
103 | 0 | return (int)in_len + 8; |
104 | 0 | } |
105 | | |
106 | | // aes_unwrap_key_inner performs steps one and two from |
107 | | // https://tools.ietf.org/html/rfc3394#section-2.2.2 |
108 | | static int aes_unwrap_key_inner(const AES_KEY *key, uint8_t *out, |
109 | | uint8_t out_iv[8], const uint8_t *in, |
110 | 0 | size_t in_len) { |
111 | | // See RFC 3394, section 2.2.2. Additionally, note that section 2 requires the |
112 | | // plaintext be at least two 8-byte blocks, so the ciphertext must be at least |
113 | | // three blocks. |
114 | |
|
115 | 0 | if (in_len > INT_MAX || in_len < 24 || in_len % 8 != 0) { |
116 | 0 | return 0; |
117 | 0 | } |
118 | | |
119 | 0 | uint8_t A[AES_BLOCK_SIZE]; |
120 | 0 | OPENSSL_memcpy(A, in, 8); |
121 | 0 | OPENSSL_memmove(out, in + 8, in_len - 8); |
122 | |
|
123 | 0 | size_t n = (in_len / 8) - 1; |
124 | |
|
125 | 0 | for (unsigned j = kBound - 1; j < kBound; j--) { |
126 | 0 | for (size_t i = n; i > 0; i--) { |
127 | 0 | uint32_t t = (uint32_t)(n * j + i); |
128 | 0 | A[7] ^= t & 0xff; |
129 | 0 | A[6] ^= (t >> 8) & 0xff; |
130 | 0 | A[5] ^= (t >> 16) & 0xff; |
131 | 0 | A[4] ^= (t >> 24) & 0xff; |
132 | 0 | OPENSSL_memcpy(A + 8, out + 8 * (i - 1), 8); |
133 | 0 | AES_decrypt(A, A, key); |
134 | 0 | OPENSSL_memcpy(out + 8 * (i - 1), A + 8, 8); |
135 | 0 | } |
136 | 0 | } |
137 | |
|
138 | 0 | memcpy(out_iv, A, 8); |
139 | 0 | return 1; |
140 | 0 | } |
141 | | |
142 | | int AES_unwrap_key(const AES_KEY *key, const uint8_t *iv, uint8_t *out, |
143 | 0 | const uint8_t *in, size_t in_len) { |
144 | 0 | uint8_t calculated_iv[8]; |
145 | 0 | if (!aes_unwrap_key_inner(key, out, calculated_iv, in, in_len)) { |
146 | 0 | return -1; |
147 | 0 | } |
148 | | |
149 | 0 | if (iv == NULL) { |
150 | 0 | iv = kDefaultIV; |
151 | 0 | } |
152 | 0 | if (CRYPTO_memcmp(calculated_iv, iv, 8) != 0) { |
153 | 0 | return -1; |
154 | 0 | } |
155 | | |
156 | 0 | FIPS_service_indicator_update_state(); |
157 | 0 | return (int)in_len - 8; |
158 | 0 | } |
159 | | |
160 | | // kPaddingConstant is used in Key Wrap with Padding. See |
161 | | // https://tools.ietf.org/html/rfc5649#section-3 |
162 | | static const uint8_t kPaddingConstant[4] = {0xa6, 0x59, 0x59, 0xa6}; |
163 | | |
164 | | int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len, |
165 | 0 | size_t max_out, const uint8_t *in, size_t in_len) { |
166 | | // See https://tools.ietf.org/html/rfc5649#section-4.1 |
167 | 0 | const uint64_t in_len64 = in_len; |
168 | 0 | const size_t padded_len = (in_len + 7) & ~7; |
169 | 0 | *out_len = 0; |
170 | 0 | if (in_len == 0 || in_len64 > 0xffffffffu || in_len + 7 < in_len || |
171 | 0 | padded_len + 8 < padded_len || max_out < padded_len + 8) { |
172 | 0 | return 0; |
173 | 0 | } |
174 | | |
175 | 0 | uint8_t block[AES_BLOCK_SIZE]; |
176 | 0 | memcpy(block, kPaddingConstant, sizeof(kPaddingConstant)); |
177 | 0 | CRYPTO_store_u32_be(block + 4, (uint32_t)in_len); |
178 | |
|
179 | 0 | if (in_len <= 8) { |
180 | 0 | memset(block + 8, 0, 8); |
181 | 0 | memcpy(block + 8, in, in_len); |
182 | 0 | AES_encrypt(block, out, key); |
183 | 0 | *out_len = AES_BLOCK_SIZE; |
184 | 0 | return 1; |
185 | 0 | } |
186 | | |
187 | 0 | uint8_t *padded_in = OPENSSL_malloc(padded_len); |
188 | 0 | if (padded_in == NULL) { |
189 | 0 | return 0; |
190 | 0 | } |
191 | 0 | assert(padded_len >= 8); |
192 | 0 | memset(padded_in + padded_len - 8, 0, 8); |
193 | 0 | memcpy(padded_in, in, in_len); |
194 | 0 | FIPS_service_indicator_lock_state(); |
195 | 0 | const int ret = AES_wrap_key(key, block, out, padded_in, padded_len); |
196 | 0 | FIPS_service_indicator_unlock_state(); |
197 | 0 | OPENSSL_free(padded_in); |
198 | 0 | if (ret < 0) { |
199 | 0 | return 0; |
200 | 0 | } |
201 | 0 | *out_len = ret; |
202 | 0 | FIPS_service_indicator_update_state(); |
203 | 0 | return 1; |
204 | 0 | } |
205 | | |
206 | | int AES_unwrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len, |
207 | 0 | size_t max_out, const uint8_t *in, size_t in_len) { |
208 | 0 | *out_len = 0; |
209 | 0 | if (in_len < AES_BLOCK_SIZE || max_out < in_len - 8) { |
210 | 0 | return 0; |
211 | 0 | } |
212 | | |
213 | 0 | uint8_t iv[8]; |
214 | 0 | if (in_len == AES_BLOCK_SIZE) { |
215 | 0 | uint8_t block[AES_BLOCK_SIZE]; |
216 | 0 | AES_decrypt(in, block, key); |
217 | 0 | memcpy(iv, block, sizeof(iv)); |
218 | 0 | memcpy(out, block + 8, 8); |
219 | 0 | } else if (!aes_unwrap_key_inner(key, out, iv, in, in_len)) { |
220 | 0 | return 0; |
221 | 0 | } |
222 | 0 | assert(in_len % 8 == 0); |
223 | | |
224 | 0 | crypto_word_t ok = constant_time_eq_int( |
225 | 0 | CRYPTO_memcmp(iv, kPaddingConstant, sizeof(kPaddingConstant)), 0); |
226 | |
|
227 | 0 | const size_t claimed_len = CRYPTO_load_u32_be(iv + 4); |
228 | 0 | ok &= ~constant_time_is_zero_w(claimed_len); |
229 | 0 | ok &= constant_time_eq_w((claimed_len - 1) >> 3, (in_len - 9) >> 3); |
230 | | |
231 | | // Check that padding bytes are all zero. |
232 | 0 | for (size_t i = in_len - 15; i < in_len - 8; i++) { |
233 | 0 | ok &= constant_time_is_zero_w(constant_time_ge_8(i, claimed_len) & out[i]); |
234 | 0 | } |
235 | |
|
236 | 0 | *out_len = constant_time_select_w(ok, claimed_len, 0); |
237 | 0 | const int ret = ok & 1; |
238 | 0 | if (ret) { |
239 | 0 | FIPS_service_indicator_update_state(); |
240 | 0 | } |
241 | 0 | return ret; |
242 | 0 | } |