/src/mbedtls/library/cipher.c
Line | Count | Source (jump to first uncovered line) |
1 | | /** |
2 | | * \file cipher.c |
3 | | * |
4 | | * \brief Generic cipher wrapper for Mbed TLS |
5 | | * |
6 | | * \author Adriaan de Jong <dejong@fox-it.com> |
7 | | * |
8 | | * Copyright The Mbed TLS Contributors |
9 | | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
10 | | */ |
11 | | |
12 | | #include "common.h" |
13 | | |
14 | | #if defined(MBEDTLS_CIPHER_C) |
15 | | |
16 | | #include "mbedtls/cipher.h" |
17 | | #include "cipher_wrap.h" |
18 | | #include "mbedtls/platform_util.h" |
19 | | #include "mbedtls/error.h" |
20 | | #include "mbedtls/constant_time.h" |
21 | | #include "constant_time_internal.h" |
22 | | |
23 | | #include <stdlib.h> |
24 | | #include <string.h> |
25 | | |
26 | | #if defined(MBEDTLS_CHACHAPOLY_C) |
27 | | #include "mbedtls/chachapoly.h" |
28 | | #endif |
29 | | |
30 | | #if defined(MBEDTLS_GCM_C) |
31 | | #include "mbedtls/gcm.h" |
32 | | #endif |
33 | | |
34 | | #if defined(MBEDTLS_CCM_C) |
35 | | #include "mbedtls/ccm.h" |
36 | | #endif |
37 | | |
38 | | #if defined(MBEDTLS_CHACHA20_C) |
39 | | #include "mbedtls/chacha20.h" |
40 | | #endif |
41 | | |
42 | | #if defined(MBEDTLS_CMAC_C) |
43 | | #include "mbedtls/cmac.h" |
44 | | #endif |
45 | | |
46 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
47 | | #include "psa/crypto.h" |
48 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
49 | | |
50 | | #if defined(MBEDTLS_NIST_KW_C) |
51 | | #include "mbedtls/nist_kw.h" |
52 | | #endif |
53 | | |
54 | | #include "mbedtls/platform.h" |
55 | | |
56 | | static int supported_init = 0; |
57 | | |
58 | | static inline const mbedtls_cipher_base_t *mbedtls_cipher_get_base( |
59 | | const mbedtls_cipher_info_t *info) |
60 | 14.9k | { |
61 | 14.9k | return mbedtls_cipher_base_lookup_table[info->base_idx]; |
62 | 14.9k | } |
63 | | |
64 | | const int *mbedtls_cipher_list(void) |
65 | 0 | { |
66 | 0 | const mbedtls_cipher_definition_t *def; |
67 | 0 | int *type; |
68 | |
|
69 | 0 | if (!supported_init) { |
70 | 0 | def = mbedtls_cipher_definitions; |
71 | 0 | type = mbedtls_cipher_supported; |
72 | |
|
73 | 0 | while (def->type != 0) { |
74 | 0 | *type++ = (*def++).type; |
75 | 0 | } |
76 | |
|
77 | 0 | *type = 0; |
78 | |
|
79 | 0 | supported_init = 1; |
80 | 0 | } |
81 | |
|
82 | 0 | return mbedtls_cipher_supported; |
83 | 0 | } |
84 | | |
85 | | const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( |
86 | | const mbedtls_cipher_type_t cipher_type) |
87 | 1.71k | { |
88 | 1.71k | const mbedtls_cipher_definition_t *def; |
89 | | |
90 | 61.3k | for (def = mbedtls_cipher_definitions; def->info != NULL; def++) { |
91 | 61.3k | if (def->type == cipher_type) { |
92 | 1.71k | return def->info; |
93 | 1.71k | } |
94 | 61.3k | } |
95 | | |
96 | 0 | return NULL; |
97 | 1.71k | } |
98 | | |
99 | | const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( |
100 | | const char *cipher_name) |
101 | 0 | { |
102 | 0 | const mbedtls_cipher_definition_t *def; |
103 | |
|
104 | 0 | if (NULL == cipher_name) { |
105 | 0 | return NULL; |
106 | 0 | } |
107 | | |
108 | 0 | for (def = mbedtls_cipher_definitions; def->info != NULL; def++) { |
109 | 0 | if (!strcmp(def->info->name, cipher_name)) { |
110 | 0 | return def->info; |
111 | 0 | } |
112 | 0 | } |
113 | | |
114 | 0 | return NULL; |
115 | 0 | } |
116 | | |
117 | | const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( |
118 | | const mbedtls_cipher_id_t cipher_id, |
119 | | int key_bitlen, |
120 | | const mbedtls_cipher_mode_t mode) |
121 | 267 | { |
122 | 267 | const mbedtls_cipher_definition_t *def; |
123 | | |
124 | 5.17k | for (def = mbedtls_cipher_definitions; def->info != NULL; def++) { |
125 | 5.17k | if (mbedtls_cipher_get_base(def->info)->cipher == cipher_id && |
126 | 5.17k | mbedtls_cipher_info_get_key_bitlen(def->info) == (unsigned) key_bitlen && |
127 | 5.17k | def->info->mode == mode) { |
128 | 267 | return def->info; |
129 | 267 | } |
130 | 5.17k | } |
131 | | |
132 | 0 | return NULL; |
133 | 267 | } |
134 | | |
135 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
136 | | static inline psa_key_type_t mbedtls_psa_translate_cipher_type( |
137 | | mbedtls_cipher_type_t cipher) |
138 | | { |
139 | | switch (cipher) { |
140 | | case MBEDTLS_CIPHER_AES_128_CCM: |
141 | | case MBEDTLS_CIPHER_AES_192_CCM: |
142 | | case MBEDTLS_CIPHER_AES_256_CCM: |
143 | | case MBEDTLS_CIPHER_AES_128_CCM_STAR_NO_TAG: |
144 | | case MBEDTLS_CIPHER_AES_192_CCM_STAR_NO_TAG: |
145 | | case MBEDTLS_CIPHER_AES_256_CCM_STAR_NO_TAG: |
146 | | case MBEDTLS_CIPHER_AES_128_GCM: |
147 | | case MBEDTLS_CIPHER_AES_192_GCM: |
148 | | case MBEDTLS_CIPHER_AES_256_GCM: |
149 | | case MBEDTLS_CIPHER_AES_128_CBC: |
150 | | case MBEDTLS_CIPHER_AES_192_CBC: |
151 | | case MBEDTLS_CIPHER_AES_256_CBC: |
152 | | case MBEDTLS_CIPHER_AES_128_ECB: |
153 | | case MBEDTLS_CIPHER_AES_192_ECB: |
154 | | case MBEDTLS_CIPHER_AES_256_ECB: |
155 | | return PSA_KEY_TYPE_AES; |
156 | | |
157 | | /* ARIA not yet supported in PSA. */ |
158 | | /* case MBEDTLS_CIPHER_ARIA_128_CCM: |
159 | | case MBEDTLS_CIPHER_ARIA_192_CCM: |
160 | | case MBEDTLS_CIPHER_ARIA_256_CCM: |
161 | | case MBEDTLS_CIPHER_ARIA_128_CCM_STAR_NO_TAG: |
162 | | case MBEDTLS_CIPHER_ARIA_192_CCM_STAR_NO_TAG: |
163 | | case MBEDTLS_CIPHER_ARIA_256_CCM_STAR_NO_TAG: |
164 | | case MBEDTLS_CIPHER_ARIA_128_GCM: |
165 | | case MBEDTLS_CIPHER_ARIA_192_GCM: |
166 | | case MBEDTLS_CIPHER_ARIA_256_GCM: |
167 | | case MBEDTLS_CIPHER_ARIA_128_CBC: |
168 | | case MBEDTLS_CIPHER_ARIA_192_CBC: |
169 | | case MBEDTLS_CIPHER_ARIA_256_CBC: |
170 | | return( PSA_KEY_TYPE_ARIA ); */ |
171 | | |
172 | | default: |
173 | | return 0; |
174 | | } |
175 | | } |
176 | | |
177 | | static inline psa_algorithm_t mbedtls_psa_translate_cipher_mode( |
178 | | mbedtls_cipher_mode_t mode, size_t taglen) |
179 | | { |
180 | | switch (mode) { |
181 | | case MBEDTLS_MODE_ECB: |
182 | | return PSA_ALG_ECB_NO_PADDING; |
183 | | case MBEDTLS_MODE_GCM: |
184 | | return PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, taglen); |
185 | | case MBEDTLS_MODE_CCM: |
186 | | return PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen); |
187 | | case MBEDTLS_MODE_CCM_STAR_NO_TAG: |
188 | | return PSA_ALG_CCM_STAR_NO_TAG; |
189 | | case MBEDTLS_MODE_CBC: |
190 | | if (taglen == 0) { |
191 | | return PSA_ALG_CBC_NO_PADDING; |
192 | | } else { |
193 | | return 0; |
194 | | } |
195 | | default: |
196 | | return 0; |
197 | | } |
198 | | } |
199 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
200 | | |
201 | | void mbedtls_cipher_init(mbedtls_cipher_context_t *ctx) |
202 | 1.73k | { |
203 | 1.73k | memset(ctx, 0, sizeof(mbedtls_cipher_context_t)); |
204 | 1.73k | } |
205 | | |
206 | | void mbedtls_cipher_free(mbedtls_cipher_context_t *ctx) |
207 | 2.37k | { |
208 | 2.37k | if (ctx == NULL) { |
209 | 0 | return; |
210 | 0 | } |
211 | | |
212 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
213 | | if (ctx->psa_enabled == 1) { |
214 | | if (ctx->cipher_ctx != NULL) { |
215 | | mbedtls_cipher_context_psa * const cipher_psa = |
216 | | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
217 | | |
218 | | if (cipher_psa->slot_state == MBEDTLS_CIPHER_PSA_KEY_OWNED) { |
219 | | /* xxx_free() doesn't allow to return failures. */ |
220 | | (void) psa_destroy_key(cipher_psa->slot); |
221 | | } |
222 | | |
223 | | mbedtls_zeroize_and_free(cipher_psa, sizeof(*cipher_psa)); |
224 | | } |
225 | | |
226 | | mbedtls_platform_zeroize(ctx, sizeof(mbedtls_cipher_context_t)); |
227 | | return; |
228 | | } |
229 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
230 | | |
231 | 2.37k | #if defined(MBEDTLS_CMAC_C) |
232 | 2.37k | if (ctx->cmac_ctx) { |
233 | 2 | mbedtls_zeroize_and_free(ctx->cmac_ctx, |
234 | 2 | sizeof(mbedtls_cmac_context_t)); |
235 | 2 | } |
236 | 2.37k | #endif |
237 | | |
238 | 2.37k | if (ctx->cipher_ctx) { |
239 | 1.24k | mbedtls_cipher_get_base(ctx->cipher_info)->ctx_free_func(ctx->cipher_ctx); |
240 | 1.24k | } |
241 | | |
242 | 2.37k | mbedtls_platform_zeroize(ctx, sizeof(mbedtls_cipher_context_t)); |
243 | 2.37k | } |
244 | | |
245 | | int mbedtls_cipher_setup(mbedtls_cipher_context_t *ctx, |
246 | | const mbedtls_cipher_info_t *cipher_info) |
247 | 1.24k | { |
248 | 1.24k | if (cipher_info == NULL) { |
249 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
250 | 0 | } |
251 | | |
252 | 1.24k | memset(ctx, 0, sizeof(mbedtls_cipher_context_t)); |
253 | | |
254 | 1.24k | if (mbedtls_cipher_get_base(cipher_info)->ctx_alloc_func != NULL) { |
255 | 1.24k | ctx->cipher_ctx = mbedtls_cipher_get_base(cipher_info)->ctx_alloc_func(); |
256 | 1.24k | if (ctx->cipher_ctx == NULL) { |
257 | 0 | return MBEDTLS_ERR_CIPHER_ALLOC_FAILED; |
258 | 0 | } |
259 | 1.24k | } |
260 | | |
261 | 1.24k | ctx->cipher_info = cipher_info; |
262 | | |
263 | 1.24k | return 0; |
264 | 1.24k | } |
265 | | |
266 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
267 | | int mbedtls_cipher_setup_psa(mbedtls_cipher_context_t *ctx, |
268 | | const mbedtls_cipher_info_t *cipher_info, |
269 | | size_t taglen) |
270 | | { |
271 | | psa_algorithm_t alg; |
272 | | mbedtls_cipher_context_psa *cipher_psa; |
273 | | |
274 | | if (NULL == cipher_info || NULL == ctx) { |
275 | | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
276 | | } |
277 | | |
278 | | /* Check that the underlying cipher mode and cipher type are |
279 | | * supported by the underlying PSA Crypto implementation. */ |
280 | | alg = mbedtls_psa_translate_cipher_mode(((mbedtls_cipher_mode_t) cipher_info->mode), taglen); |
281 | | if (alg == 0) { |
282 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
283 | | } |
284 | | if (mbedtls_psa_translate_cipher_type(((mbedtls_cipher_type_t) cipher_info->type)) == 0) { |
285 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
286 | | } |
287 | | |
288 | | memset(ctx, 0, sizeof(mbedtls_cipher_context_t)); |
289 | | |
290 | | cipher_psa = mbedtls_calloc(1, sizeof(mbedtls_cipher_context_psa)); |
291 | | if (cipher_psa == NULL) { |
292 | | return MBEDTLS_ERR_CIPHER_ALLOC_FAILED; |
293 | | } |
294 | | cipher_psa->alg = alg; |
295 | | ctx->cipher_ctx = cipher_psa; |
296 | | ctx->cipher_info = cipher_info; |
297 | | ctx->psa_enabled = 1; |
298 | | return 0; |
299 | | } |
300 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
301 | | |
302 | | int mbedtls_cipher_setkey(mbedtls_cipher_context_t *ctx, |
303 | | const unsigned char *key, |
304 | | int key_bitlen, |
305 | | const mbedtls_operation_t operation) |
306 | 1.24k | { |
307 | 1.24k | if (operation != MBEDTLS_ENCRYPT && operation != MBEDTLS_DECRYPT) { |
308 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
309 | 0 | } |
310 | 1.24k | if (ctx->cipher_info == NULL) { |
311 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
312 | 0 | } |
313 | | #if defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) |
314 | | if (MBEDTLS_MODE_ECB == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) && |
315 | | MBEDTLS_DECRYPT == operation) { |
316 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
317 | | } |
318 | | #endif |
319 | | |
320 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
321 | | if (ctx->psa_enabled == 1) { |
322 | | mbedtls_cipher_context_psa * const cipher_psa = |
323 | | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
324 | | |
325 | | size_t const key_bytelen = ((size_t) key_bitlen + 7) / 8; |
326 | | |
327 | | psa_status_t status; |
328 | | psa_key_type_t key_type; |
329 | | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
330 | | |
331 | | /* PSA Crypto API only accepts byte-aligned keys. */ |
332 | | if (key_bitlen % 8 != 0) { |
333 | | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
334 | | } |
335 | | |
336 | | /* Don't allow keys to be set multiple times. */ |
337 | | if (cipher_psa->slot_state != MBEDTLS_CIPHER_PSA_KEY_UNSET) { |
338 | | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
339 | | } |
340 | | |
341 | | key_type = mbedtls_psa_translate_cipher_type( |
342 | | ((mbedtls_cipher_type_t) ctx->cipher_info->type)); |
343 | | if (key_type == 0) { |
344 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
345 | | } |
346 | | psa_set_key_type(&attributes, key_type); |
347 | | |
348 | | /* Mbed TLS' cipher layer doesn't enforce the mode of operation |
349 | | * (encrypt vs. decrypt): it is possible to setup a key for encryption |
350 | | * and use it for AEAD decryption. Until tests relying on this |
351 | | * are changed, allow any usage in PSA. */ |
352 | | psa_set_key_usage_flags(&attributes, |
353 | | PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT); |
354 | | psa_set_key_algorithm(&attributes, cipher_psa->alg); |
355 | | |
356 | | status = psa_import_key(&attributes, key, key_bytelen, |
357 | | &cipher_psa->slot); |
358 | | switch (status) { |
359 | | case PSA_SUCCESS: |
360 | | break; |
361 | | case PSA_ERROR_INSUFFICIENT_MEMORY: |
362 | | return MBEDTLS_ERR_CIPHER_ALLOC_FAILED; |
363 | | case PSA_ERROR_NOT_SUPPORTED: |
364 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
365 | | default: |
366 | | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
367 | | } |
368 | | /* Indicate that we own the key slot and need to |
369 | | * destroy it in mbedtls_cipher_free(). */ |
370 | | cipher_psa->slot_state = MBEDTLS_CIPHER_PSA_KEY_OWNED; |
371 | | |
372 | | ctx->key_bitlen = key_bitlen; |
373 | | ctx->operation = operation; |
374 | | return 0; |
375 | | } |
376 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
377 | | |
378 | 1.24k | if ((ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN) == 0 && |
379 | 1.24k | (int) mbedtls_cipher_info_get_key_bitlen(ctx->cipher_info) != key_bitlen) { |
380 | 455 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
381 | 455 | } |
382 | | |
383 | 791 | ctx->key_bitlen = key_bitlen; |
384 | 791 | ctx->operation = operation; |
385 | | |
386 | 791 | #if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) |
387 | | /* |
388 | | * For OFB, CFB and CTR mode always use the encryption key schedule |
389 | | */ |
390 | 791 | if (MBEDTLS_ENCRYPT == operation || |
391 | 791 | MBEDTLS_MODE_CFB == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
392 | 791 | MBEDTLS_MODE_OFB == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
393 | 791 | MBEDTLS_MODE_CTR == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
394 | 531 | return mbedtls_cipher_get_base(ctx->cipher_info)->setkey_enc_func(ctx->cipher_ctx, key, |
395 | 531 | ctx->key_bitlen); |
396 | 531 | } |
397 | | |
398 | 260 | if (MBEDTLS_DECRYPT == operation) { |
399 | 260 | return mbedtls_cipher_get_base(ctx->cipher_info)->setkey_dec_func(ctx->cipher_ctx, key, |
400 | 260 | ctx->key_bitlen); |
401 | 260 | } |
402 | | #else |
403 | | if (operation == MBEDTLS_ENCRYPT || operation == MBEDTLS_DECRYPT) { |
404 | | return mbedtls_cipher_get_base(ctx->cipher_info)->setkey_enc_func(ctx->cipher_ctx, key, |
405 | | ctx->key_bitlen); |
406 | | } |
407 | | #endif |
408 | | |
409 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
410 | 260 | } |
411 | | |
412 | | int mbedtls_cipher_set_iv(mbedtls_cipher_context_t *ctx, |
413 | | const unsigned char *iv, |
414 | | size_t iv_len) |
415 | 227 | { |
416 | 227 | size_t actual_iv_size; |
417 | | |
418 | 227 | if (ctx->cipher_info == NULL) { |
419 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
420 | 0 | } |
421 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
422 | | if (ctx->psa_enabled == 1) { |
423 | | /* While PSA Crypto has an API for multipart |
424 | | * operations, we currently don't make it |
425 | | * accessible through the cipher layer. */ |
426 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
427 | | } |
428 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
429 | | |
430 | | /* avoid buffer overflow in ctx->iv */ |
431 | 227 | if (iv_len > MBEDTLS_MAX_IV_LENGTH) { |
432 | 24 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
433 | 24 | } |
434 | | |
435 | 203 | if ((ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN) != 0) { |
436 | 49 | actual_iv_size = iv_len; |
437 | 154 | } else { |
438 | 154 | actual_iv_size = mbedtls_cipher_info_get_iv_size(ctx->cipher_info); |
439 | | |
440 | | /* avoid reading past the end of input buffer */ |
441 | 154 | if (actual_iv_size > iv_len) { |
442 | 9 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
443 | 9 | } |
444 | 154 | } |
445 | | |
446 | 194 | #if defined(MBEDTLS_CHACHA20_C) |
447 | 194 | if (((mbedtls_cipher_type_t) ctx->cipher_info->type) == MBEDTLS_CIPHER_CHACHA20) { |
448 | | /* Even though the actual_iv_size is overwritten with a correct value |
449 | | * of 12 from the cipher info, return an error to indicate that |
450 | | * the input iv_len is wrong. */ |
451 | 0 | if (iv_len != 12) { |
452 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
453 | 0 | } |
454 | | |
455 | 0 | if (0 != mbedtls_chacha20_starts((mbedtls_chacha20_context *) ctx->cipher_ctx, |
456 | 0 | iv, |
457 | 0 | 0U)) { /* Initial counter value */ |
458 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
459 | 0 | } |
460 | 0 | } |
461 | 194 | #if defined(MBEDTLS_CHACHAPOLY_C) |
462 | 194 | if (((mbedtls_cipher_type_t) ctx->cipher_info->type) == MBEDTLS_CIPHER_CHACHA20_POLY1305 && |
463 | 194 | iv_len != 12) { |
464 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
465 | 0 | } |
466 | 194 | #endif |
467 | 194 | #endif |
468 | | |
469 | 194 | #if defined(MBEDTLS_GCM_C) |
470 | 194 | if (MBEDTLS_MODE_GCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
471 | 45 | return mbedtls_gcm_starts((mbedtls_gcm_context *) ctx->cipher_ctx, |
472 | 45 | ctx->operation, |
473 | 45 | iv, iv_len); |
474 | 45 | } |
475 | 149 | #endif |
476 | | |
477 | 149 | #if defined(MBEDTLS_CCM_C) |
478 | 149 | if (MBEDTLS_MODE_CCM_STAR_NO_TAG == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
479 | 2 | int set_lengths_result; |
480 | 2 | int ccm_star_mode; |
481 | | |
482 | 2 | set_lengths_result = mbedtls_ccm_set_lengths( |
483 | 2 | (mbedtls_ccm_context *) ctx->cipher_ctx, |
484 | 2 | 0, 0, 0); |
485 | 2 | if (set_lengths_result != 0) { |
486 | 0 | return set_lengths_result; |
487 | 0 | } |
488 | | |
489 | 2 | if (ctx->operation == MBEDTLS_DECRYPT) { |
490 | 2 | ccm_star_mode = MBEDTLS_CCM_STAR_DECRYPT; |
491 | 2 | } else if (ctx->operation == MBEDTLS_ENCRYPT) { |
492 | 0 | ccm_star_mode = MBEDTLS_CCM_STAR_ENCRYPT; |
493 | 0 | } else { |
494 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
495 | 0 | } |
496 | | |
497 | 2 | return mbedtls_ccm_starts((mbedtls_ccm_context *) ctx->cipher_ctx, |
498 | 2 | ccm_star_mode, |
499 | 2 | iv, iv_len); |
500 | 2 | } |
501 | 147 | #endif |
502 | | |
503 | 147 | if (actual_iv_size != 0) { |
504 | 124 | memcpy(ctx->iv, iv, actual_iv_size); |
505 | 124 | ctx->iv_size = actual_iv_size; |
506 | 124 | } |
507 | | |
508 | 147 | return 0; |
509 | 149 | } |
510 | | |
511 | | int mbedtls_cipher_reset(mbedtls_cipher_context_t *ctx) |
512 | 491 | { |
513 | 491 | if (ctx->cipher_info == NULL) { |
514 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
515 | 0 | } |
516 | | |
517 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
518 | | if (ctx->psa_enabled == 1) { |
519 | | /* We don't support resetting PSA-based |
520 | | * cipher contexts, yet. */ |
521 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
522 | | } |
523 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
524 | | |
525 | 491 | ctx->unprocessed_len = 0; |
526 | | |
527 | 491 | return 0; |
528 | 491 | } |
529 | | |
530 | | #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) |
531 | | int mbedtls_cipher_update_ad(mbedtls_cipher_context_t *ctx, |
532 | | const unsigned char *ad, size_t ad_len) |
533 | 171 | { |
534 | 171 | if (ctx->cipher_info == NULL) { |
535 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
536 | 0 | } |
537 | | |
538 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
539 | | if (ctx->psa_enabled == 1) { |
540 | | /* While PSA Crypto has an API for multipart |
541 | | * operations, we currently don't make it |
542 | | * accessible through the cipher layer. */ |
543 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
544 | | } |
545 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
546 | | |
547 | 171 | #if defined(MBEDTLS_GCM_C) |
548 | 171 | if (MBEDTLS_MODE_GCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
549 | 45 | return mbedtls_gcm_update_ad((mbedtls_gcm_context *) ctx->cipher_ctx, |
550 | 45 | ad, ad_len); |
551 | 45 | } |
552 | 126 | #endif |
553 | | |
554 | 126 | #if defined(MBEDTLS_CHACHAPOLY_C) |
555 | 126 | if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ((mbedtls_cipher_type_t) ctx->cipher_info->type)) { |
556 | 8 | int result; |
557 | 8 | mbedtls_chachapoly_mode_t mode; |
558 | | |
559 | 8 | mode = (ctx->operation == MBEDTLS_ENCRYPT) |
560 | 8 | ? MBEDTLS_CHACHAPOLY_ENCRYPT |
561 | 8 | : MBEDTLS_CHACHAPOLY_DECRYPT; |
562 | | |
563 | 8 | result = mbedtls_chachapoly_starts((mbedtls_chachapoly_context *) ctx->cipher_ctx, |
564 | 8 | ctx->iv, |
565 | 8 | mode); |
566 | 8 | if (result != 0) { |
567 | 0 | return result; |
568 | 0 | } |
569 | | |
570 | 8 | return mbedtls_chachapoly_update_aad((mbedtls_chachapoly_context *) ctx->cipher_ctx, |
571 | 8 | ad, ad_len); |
572 | 8 | } |
573 | 118 | #endif |
574 | | |
575 | 118 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
576 | 126 | } |
577 | | #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ |
578 | | |
579 | | int mbedtls_cipher_update(mbedtls_cipher_context_t *ctx, const unsigned char *input, |
580 | | size_t ilen, unsigned char *output, size_t *olen) |
581 | 5.51k | { |
582 | 5.51k | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
583 | 5.51k | size_t block_size; |
584 | | |
585 | 5.51k | if (ctx->cipher_info == NULL) { |
586 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
587 | 0 | } |
588 | | |
589 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
590 | | if (ctx->psa_enabled == 1) { |
591 | | /* While PSA Crypto has an API for multipart |
592 | | * operations, we currently don't make it |
593 | | * accessible through the cipher layer. */ |
594 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
595 | | } |
596 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
597 | | |
598 | 5.51k | *olen = 0; |
599 | 5.51k | block_size = mbedtls_cipher_get_block_size(ctx); |
600 | 5.51k | if (0 == block_size) { |
601 | 0 | return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT; |
602 | 0 | } |
603 | | |
604 | 5.51k | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_ECB) { |
605 | 5.17k | if (ilen != block_size) { |
606 | 0 | return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED; |
607 | 0 | } |
608 | | |
609 | 5.17k | *olen = ilen; |
610 | | |
611 | 5.17k | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->ecb_func(ctx->cipher_ctx, |
612 | 5.17k | ctx->operation, input, |
613 | 5.17k | output))) { |
614 | 0 | return ret; |
615 | 0 | } |
616 | | |
617 | 5.17k | return 0; |
618 | 5.17k | } |
619 | | |
620 | 337 | #if defined(MBEDTLS_GCM_C) |
621 | 337 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_GCM) { |
622 | 262 | return mbedtls_gcm_update((mbedtls_gcm_context *) ctx->cipher_ctx, |
623 | 262 | input, ilen, |
624 | 262 | output, ilen, olen); |
625 | 262 | } |
626 | 75 | #endif |
627 | | |
628 | 75 | #if defined(MBEDTLS_CCM_C) |
629 | 75 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_CCM_STAR_NO_TAG) { |
630 | 2 | return mbedtls_ccm_update((mbedtls_ccm_context *) ctx->cipher_ctx, |
631 | 2 | input, ilen, |
632 | 2 | output, ilen, olen); |
633 | 2 | } |
634 | 73 | #endif |
635 | | |
636 | 73 | #if defined(MBEDTLS_CHACHAPOLY_C) |
637 | 73 | if (((mbedtls_cipher_type_t) ctx->cipher_info->type) == MBEDTLS_CIPHER_CHACHA20_POLY1305) { |
638 | 8 | *olen = ilen; |
639 | 8 | return mbedtls_chachapoly_update((mbedtls_chachapoly_context *) ctx->cipher_ctx, |
640 | 8 | ilen, input, output); |
641 | 8 | } |
642 | 65 | #endif |
643 | | |
644 | 65 | if (input == output && |
645 | 65 | (ctx->unprocessed_len != 0 || ilen % block_size)) { |
646 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
647 | 0 | } |
648 | | |
649 | 65 | #if defined(MBEDTLS_CIPHER_MODE_CBC) |
650 | 65 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_CBC) { |
651 | 12 | size_t copy_len = 0; |
652 | | |
653 | | /* |
654 | | * If there is not enough data for a full block, cache it. |
655 | | */ |
656 | 12 | if ((ctx->operation == MBEDTLS_DECRYPT && NULL != ctx->add_padding && |
657 | 12 | ilen <= block_size - ctx->unprocessed_len) || |
658 | 12 | (ctx->operation == MBEDTLS_DECRYPT && NULL == ctx->add_padding && |
659 | 8 | ilen < block_size - ctx->unprocessed_len) || |
660 | 12 | (ctx->operation == MBEDTLS_ENCRYPT && |
661 | 8 | ilen < block_size - ctx->unprocessed_len)) { |
662 | 7 | memcpy(&(ctx->unprocessed_data[ctx->unprocessed_len]), input, |
663 | 7 | ilen); |
664 | | |
665 | 7 | ctx->unprocessed_len += ilen; |
666 | 7 | return 0; |
667 | 7 | } |
668 | | |
669 | | /* |
670 | | * Process cached data first |
671 | | */ |
672 | 5 | if (0 != ctx->unprocessed_len) { |
673 | 2 | copy_len = block_size - ctx->unprocessed_len; |
674 | | |
675 | 2 | memcpy(&(ctx->unprocessed_data[ctx->unprocessed_len]), input, |
676 | 2 | copy_len); |
677 | | |
678 | 2 | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->cbc_func(ctx->cipher_ctx, |
679 | 2 | ctx->operation, |
680 | 2 | block_size, ctx->iv, |
681 | 2 | ctx-> |
682 | 2 | unprocessed_data, |
683 | 2 | output))) { |
684 | 0 | return ret; |
685 | 0 | } |
686 | | |
687 | 2 | *olen += block_size; |
688 | 2 | output += block_size; |
689 | 2 | ctx->unprocessed_len = 0; |
690 | | |
691 | 2 | input += copy_len; |
692 | 2 | ilen -= copy_len; |
693 | 2 | } |
694 | | |
695 | | /* |
696 | | * Cache final, incomplete block |
697 | | */ |
698 | 5 | if (0 != ilen) { |
699 | | /* Encryption: only cache partial blocks |
700 | | * Decryption w/ padding: always keep at least one whole block |
701 | | * Decryption w/o padding: only cache partial blocks |
702 | | */ |
703 | 4 | copy_len = ilen % block_size; |
704 | 4 | if (copy_len == 0 && |
705 | 4 | ctx->operation == MBEDTLS_DECRYPT && |
706 | 4 | NULL != ctx->add_padding) { |
707 | 3 | copy_len = block_size; |
708 | 3 | } |
709 | | |
710 | 4 | memcpy(ctx->unprocessed_data, &(input[ilen - copy_len]), |
711 | 4 | copy_len); |
712 | | |
713 | 4 | ctx->unprocessed_len += copy_len; |
714 | 4 | ilen -= copy_len; |
715 | 4 | } |
716 | | |
717 | | /* |
718 | | * Process remaining full blocks |
719 | | */ |
720 | 5 | if (ilen) { |
721 | 3 | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->cbc_func(ctx->cipher_ctx, |
722 | 3 | ctx->operation, |
723 | 3 | ilen, ctx->iv, |
724 | 3 | input, |
725 | 3 | output))) { |
726 | 0 | return ret; |
727 | 0 | } |
728 | | |
729 | 3 | *olen += ilen; |
730 | 3 | } |
731 | | |
732 | 5 | return 0; |
733 | 5 | } |
734 | 53 | #endif /* MBEDTLS_CIPHER_MODE_CBC */ |
735 | | |
736 | 53 | #if defined(MBEDTLS_CIPHER_MODE_CFB) |
737 | 53 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_CFB) { |
738 | 4 | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->cfb_func(ctx->cipher_ctx, |
739 | 4 | ctx->operation, ilen, |
740 | 4 | &ctx->unprocessed_len, |
741 | 4 | ctx->iv, |
742 | 4 | input, output))) { |
743 | 0 | return ret; |
744 | 0 | } |
745 | | |
746 | 4 | *olen = ilen; |
747 | | |
748 | 4 | return 0; |
749 | 4 | } |
750 | 49 | #endif /* MBEDTLS_CIPHER_MODE_CFB */ |
751 | | |
752 | 49 | #if defined(MBEDTLS_CIPHER_MODE_OFB) |
753 | 49 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_OFB) { |
754 | 38 | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->ofb_func(ctx->cipher_ctx, |
755 | 38 | ilen, |
756 | 38 | &ctx->unprocessed_len, |
757 | 38 | ctx->iv, |
758 | 38 | input, output))) { |
759 | 0 | return ret; |
760 | 0 | } |
761 | | |
762 | 38 | *olen = ilen; |
763 | | |
764 | 38 | return 0; |
765 | 38 | } |
766 | 11 | #endif /* MBEDTLS_CIPHER_MODE_OFB */ |
767 | | |
768 | 11 | #if defined(MBEDTLS_CIPHER_MODE_CTR) |
769 | 11 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_CTR) { |
770 | 11 | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->ctr_func(ctx->cipher_ctx, |
771 | 11 | ilen, |
772 | 11 | &ctx->unprocessed_len, |
773 | 11 | ctx->iv, |
774 | 11 | ctx->unprocessed_data, |
775 | 11 | input, output))) { |
776 | 0 | return ret; |
777 | 0 | } |
778 | | |
779 | 11 | *olen = ilen; |
780 | | |
781 | 11 | return 0; |
782 | 11 | } |
783 | 0 | #endif /* MBEDTLS_CIPHER_MODE_CTR */ |
784 | | |
785 | 0 | #if defined(MBEDTLS_CIPHER_MODE_XTS) |
786 | 0 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_XTS) { |
787 | 0 | if (ctx->unprocessed_len > 0) { |
788 | | /* We can only process an entire data unit at a time. */ |
789 | 0 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
790 | 0 | } |
791 | | |
792 | 0 | ret = mbedtls_cipher_get_base(ctx->cipher_info)->xts_func(ctx->cipher_ctx, |
793 | 0 | ctx->operation, |
794 | 0 | ilen, |
795 | 0 | ctx->iv, |
796 | 0 | input, |
797 | 0 | output); |
798 | 0 | if (ret != 0) { |
799 | 0 | return ret; |
800 | 0 | } |
801 | | |
802 | 0 | *olen = ilen; |
803 | |
|
804 | 0 | return 0; |
805 | 0 | } |
806 | 0 | #endif /* MBEDTLS_CIPHER_MODE_XTS */ |
807 | | |
808 | 0 | #if defined(MBEDTLS_CIPHER_MODE_STREAM) |
809 | 0 | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) == MBEDTLS_MODE_STREAM) { |
810 | 0 | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->stream_func(ctx->cipher_ctx, |
811 | 0 | ilen, input, |
812 | 0 | output))) { |
813 | 0 | return ret; |
814 | 0 | } |
815 | | |
816 | 0 | *olen = ilen; |
817 | |
|
818 | 0 | return 0; |
819 | 0 | } |
820 | 0 | #endif /* MBEDTLS_CIPHER_MODE_STREAM */ |
821 | | |
822 | 0 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
823 | 0 | } |
824 | | |
825 | | #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) |
826 | | #if defined(MBEDTLS_CIPHER_PADDING_PKCS7) |
827 | | /* |
828 | | * PKCS7 (and PKCS5) padding: fill with ll bytes, with ll = padding_len |
829 | | */ |
830 | | static void add_pkcs_padding(unsigned char *output, size_t output_len, |
831 | | size_t data_len) |
832 | 1 | { |
833 | 1 | size_t padding_len = output_len - data_len; |
834 | 1 | unsigned char i; |
835 | | |
836 | 17 | for (i = 0; i < padding_len; i++) { |
837 | 16 | output[data_len + i] = (unsigned char) padding_len; |
838 | 16 | } |
839 | 1 | } |
840 | | |
841 | | static int get_pkcs_padding(unsigned char *input, size_t input_len, |
842 | | size_t *data_len) |
843 | 4 | { |
844 | 4 | size_t i, pad_idx; |
845 | 4 | unsigned char padding_len; |
846 | | |
847 | 4 | if (NULL == input || NULL == data_len) { |
848 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
849 | 0 | } |
850 | | |
851 | 4 | padding_len = input[input_len - 1]; |
852 | 4 | if (padding_len == 0 || padding_len > input_len) { |
853 | 3 | return MBEDTLS_ERR_CIPHER_INVALID_PADDING; |
854 | 3 | } |
855 | 1 | *data_len = input_len - padding_len; |
856 | | |
857 | 1 | mbedtls_ct_condition_t bad = mbedtls_ct_uint_gt(padding_len, input_len); |
858 | 1 | bad = mbedtls_ct_bool_or(bad, mbedtls_ct_uint_eq(padding_len, 0)); |
859 | | |
860 | | /* The number of bytes checked must be independent of padding_len, |
861 | | * so pick input_len, which is usually 8 or 16 (one block) */ |
862 | 1 | pad_idx = input_len - padding_len; |
863 | 9 | for (i = 0; i < input_len; i++) { |
864 | 8 | mbedtls_ct_condition_t in_padding = mbedtls_ct_uint_ge(i, pad_idx); |
865 | 8 | mbedtls_ct_condition_t different = mbedtls_ct_uint_ne(input[i], padding_len); |
866 | 8 | bad = mbedtls_ct_bool_or(bad, mbedtls_ct_bool_and(in_padding, different)); |
867 | 8 | } |
868 | | |
869 | 1 | return mbedtls_ct_error_if_else_0(bad, MBEDTLS_ERR_CIPHER_INVALID_PADDING); |
870 | 4 | } |
871 | | #endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */ |
872 | | |
873 | | #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS) |
874 | | /* |
875 | | * One and zeros padding: fill with 80 00 ... 00 |
876 | | */ |
877 | | static void add_one_and_zeros_padding(unsigned char *output, |
878 | | size_t output_len, size_t data_len) |
879 | 0 | { |
880 | 0 | size_t padding_len = output_len - data_len; |
881 | 0 | unsigned char i = 0; |
882 | |
|
883 | 0 | output[data_len] = 0x80; |
884 | 0 | for (i = 1; i < padding_len; i++) { |
885 | 0 | output[data_len + i] = 0x00; |
886 | 0 | } |
887 | 0 | } |
888 | | |
889 | | static int get_one_and_zeros_padding(unsigned char *input, size_t input_len, |
890 | | size_t *data_len) |
891 | 0 | { |
892 | 0 | if (NULL == input || NULL == data_len) { |
893 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
894 | 0 | } |
895 | | |
896 | 0 | mbedtls_ct_condition_t in_padding = MBEDTLS_CT_TRUE; |
897 | 0 | mbedtls_ct_condition_t bad = MBEDTLS_CT_TRUE; |
898 | |
|
899 | 0 | *data_len = 0; |
900 | |
|
901 | 0 | for (ptrdiff_t i = (ptrdiff_t) (input_len) - 1; i >= 0; i--) { |
902 | 0 | mbedtls_ct_condition_t is_nonzero = mbedtls_ct_bool(input[i]); |
903 | |
|
904 | 0 | mbedtls_ct_condition_t hit_first_nonzero = mbedtls_ct_bool_and(is_nonzero, in_padding); |
905 | |
|
906 | 0 | *data_len = mbedtls_ct_size_if(hit_first_nonzero, i, *data_len); |
907 | |
|
908 | 0 | bad = mbedtls_ct_bool_if(hit_first_nonzero, mbedtls_ct_uint_ne(input[i], 0x80), bad); |
909 | |
|
910 | 0 | in_padding = mbedtls_ct_bool_and(in_padding, mbedtls_ct_bool_not(is_nonzero)); |
911 | 0 | } |
912 | |
|
913 | 0 | return mbedtls_ct_error_if_else_0(bad, MBEDTLS_ERR_CIPHER_INVALID_PADDING); |
914 | 0 | } |
915 | | #endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */ |
916 | | |
917 | | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN) |
918 | | /* |
919 | | * Zeros and len padding: fill with 00 ... 00 ll, where ll is padding length |
920 | | */ |
921 | | static void add_zeros_and_len_padding(unsigned char *output, |
922 | | size_t output_len, size_t data_len) |
923 | 0 | { |
924 | 0 | size_t padding_len = output_len - data_len; |
925 | 0 | unsigned char i = 0; |
926 | |
|
927 | 0 | for (i = 1; i < padding_len; i++) { |
928 | 0 | output[data_len + i - 1] = 0x00; |
929 | 0 | } |
930 | 0 | output[output_len - 1] = (unsigned char) padding_len; |
931 | 0 | } |
932 | | |
933 | | static int get_zeros_and_len_padding(unsigned char *input, size_t input_len, |
934 | | size_t *data_len) |
935 | 0 | { |
936 | 0 | size_t i, pad_idx; |
937 | 0 | unsigned char padding_len; |
938 | 0 | mbedtls_ct_condition_t bad; |
939 | |
|
940 | 0 | if (NULL == input || NULL == data_len) { |
941 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
942 | 0 | } |
943 | | |
944 | 0 | padding_len = input[input_len - 1]; |
945 | 0 | *data_len = input_len - padding_len; |
946 | | |
947 | | /* Avoid logical || since it results in a branch */ |
948 | 0 | bad = mbedtls_ct_uint_gt(padding_len, input_len); |
949 | 0 | bad = mbedtls_ct_bool_or(bad, mbedtls_ct_uint_eq(padding_len, 0)); |
950 | | |
951 | | /* The number of bytes checked must be independent of padding_len */ |
952 | 0 | pad_idx = input_len - padding_len; |
953 | 0 | for (i = 0; i < input_len - 1; i++) { |
954 | 0 | mbedtls_ct_condition_t is_padding = mbedtls_ct_uint_ge(i, pad_idx); |
955 | 0 | mbedtls_ct_condition_t nonzero_pad_byte; |
956 | 0 | nonzero_pad_byte = mbedtls_ct_bool_if_else_0(is_padding, mbedtls_ct_bool(input[i])); |
957 | 0 | bad = mbedtls_ct_bool_or(bad, nonzero_pad_byte); |
958 | 0 | } |
959 | |
|
960 | 0 | return mbedtls_ct_error_if_else_0(bad, MBEDTLS_ERR_CIPHER_INVALID_PADDING); |
961 | 0 | } |
962 | | #endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */ |
963 | | |
964 | | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS) |
965 | | /* |
966 | | * Zero padding: fill with 00 ... 00 |
967 | | */ |
968 | | static void add_zeros_padding(unsigned char *output, |
969 | | size_t output_len, size_t data_len) |
970 | 0 | { |
971 | 0 | memset(output + data_len, 0, output_len - data_len); |
972 | 0 | } |
973 | | |
974 | | static int get_zeros_padding(unsigned char *input, size_t input_len, |
975 | | size_t *data_len) |
976 | 0 | { |
977 | 0 | size_t i; |
978 | 0 | mbedtls_ct_condition_t done = MBEDTLS_CT_FALSE, prev_done; |
979 | |
|
980 | 0 | if (NULL == input || NULL == data_len) { |
981 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
982 | 0 | } |
983 | | |
984 | 0 | *data_len = 0; |
985 | 0 | for (i = input_len; i > 0; i--) { |
986 | 0 | prev_done = done; |
987 | 0 | done = mbedtls_ct_bool_or(done, mbedtls_ct_uint_ne(input[i-1], 0)); |
988 | 0 | *data_len = mbedtls_ct_size_if(mbedtls_ct_bool_ne(done, prev_done), i, *data_len); |
989 | 0 | } |
990 | |
|
991 | 0 | return 0; |
992 | 0 | } |
993 | | #endif /* MBEDTLS_CIPHER_PADDING_ZEROS */ |
994 | | |
995 | | /* |
996 | | * No padding: don't pad :) |
997 | | * |
998 | | * There is no add_padding function (check for NULL in mbedtls_cipher_finish) |
999 | | * but a trivial get_padding function |
1000 | | */ |
1001 | | static int get_no_padding(unsigned char *input, size_t input_len, |
1002 | | size_t *data_len) |
1003 | 0 | { |
1004 | 0 | if (NULL == input || NULL == data_len) { |
1005 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1006 | 0 | } |
1007 | | |
1008 | 0 | *data_len = input_len; |
1009 | |
|
1010 | 0 | return 0; |
1011 | 0 | } |
1012 | | #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ |
1013 | | |
1014 | | int mbedtls_cipher_finish(mbedtls_cipher_context_t *ctx, |
1015 | | unsigned char *output, size_t *olen) |
1016 | 74 | { |
1017 | 74 | if (ctx->cipher_info == NULL) { |
1018 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1019 | 0 | } |
1020 | | |
1021 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1022 | | if (ctx->psa_enabled == 1) { |
1023 | | /* While PSA Crypto has an API for multipart |
1024 | | * operations, we currently don't make it |
1025 | | * accessible through the cipher layer. */ |
1026 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1027 | | } |
1028 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
1029 | | |
1030 | 74 | *olen = 0; |
1031 | | |
1032 | 74 | #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) |
1033 | | /* CBC mode requires padding so we make sure a call to |
1034 | | * mbedtls_cipher_set_padding_mode has been done successfully. */ |
1035 | 74 | if (MBEDTLS_MODE_CBC == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1036 | 5 | if (ctx->get_padding == NULL) { |
1037 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1038 | 0 | } |
1039 | 5 | } |
1040 | 74 | #endif |
1041 | | |
1042 | 74 | if (MBEDTLS_MODE_CFB == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1043 | 74 | MBEDTLS_MODE_OFB == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1044 | 74 | MBEDTLS_MODE_CTR == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1045 | 74 | MBEDTLS_MODE_GCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1046 | 74 | MBEDTLS_MODE_CCM_STAR_NO_TAG == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1047 | 74 | MBEDTLS_MODE_XTS == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1048 | 74 | MBEDTLS_MODE_STREAM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1049 | 59 | return 0; |
1050 | 59 | } |
1051 | | |
1052 | 15 | if ((MBEDTLS_CIPHER_CHACHA20 == ((mbedtls_cipher_type_t) ctx->cipher_info->type)) || |
1053 | 15 | (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ((mbedtls_cipher_type_t) ctx->cipher_info->type))) { |
1054 | 8 | return 0; |
1055 | 8 | } |
1056 | | |
1057 | 7 | if (MBEDTLS_MODE_ECB == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1058 | 2 | if (ctx->unprocessed_len != 0) { |
1059 | 0 | return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED; |
1060 | 0 | } |
1061 | | |
1062 | 2 | return 0; |
1063 | 2 | } |
1064 | | |
1065 | 5 | #if defined(MBEDTLS_CIPHER_MODE_CBC) |
1066 | 5 | if (MBEDTLS_MODE_CBC == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1067 | 5 | int ret = 0; |
1068 | | |
1069 | 5 | if (MBEDTLS_ENCRYPT == ctx->operation) { |
1070 | | /* check for 'no padding' mode */ |
1071 | 1 | if (NULL == ctx->add_padding) { |
1072 | 0 | if (0 != ctx->unprocessed_len) { |
1073 | 0 | return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED; |
1074 | 0 | } |
1075 | | |
1076 | 0 | return 0; |
1077 | 0 | } |
1078 | | |
1079 | 1 | ctx->add_padding(ctx->unprocessed_data, mbedtls_cipher_get_iv_size(ctx), |
1080 | 1 | ctx->unprocessed_len); |
1081 | 4 | } else if (mbedtls_cipher_get_block_size(ctx) != ctx->unprocessed_len) { |
1082 | | /* |
1083 | | * For decrypt operations, expect a full block, |
1084 | | * or an empty block if no padding |
1085 | | */ |
1086 | 0 | if (NULL == ctx->add_padding && 0 == ctx->unprocessed_len) { |
1087 | 0 | return 0; |
1088 | 0 | } |
1089 | | |
1090 | 0 | return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED; |
1091 | 0 | } |
1092 | | |
1093 | | /* cipher block */ |
1094 | 5 | if (0 != (ret = mbedtls_cipher_get_base(ctx->cipher_info)->cbc_func(ctx->cipher_ctx, |
1095 | 5 | ctx->operation, |
1096 | 5 | mbedtls_cipher_get_block_size( |
1097 | 5 | ctx), |
1098 | 5 | ctx->iv, |
1099 | 5 | ctx->unprocessed_data, |
1100 | 5 | output))) { |
1101 | 0 | return ret; |
1102 | 0 | } |
1103 | | |
1104 | | /* Set output size for decryption */ |
1105 | 5 | if (MBEDTLS_DECRYPT == ctx->operation) { |
1106 | 4 | return ctx->get_padding(output, mbedtls_cipher_get_block_size(ctx), |
1107 | 4 | olen); |
1108 | 4 | } |
1109 | | |
1110 | | /* Set output size for encryption */ |
1111 | 1 | *olen = mbedtls_cipher_get_block_size(ctx); |
1112 | 1 | return 0; |
1113 | 5 | } |
1114 | | #else |
1115 | | ((void) output); |
1116 | | #endif /* MBEDTLS_CIPHER_MODE_CBC */ |
1117 | | |
1118 | 0 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1119 | 5 | } |
1120 | | |
1121 | | #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) |
1122 | | int mbedtls_cipher_set_padding_mode(mbedtls_cipher_context_t *ctx, |
1123 | | mbedtls_cipher_padding_t mode) |
1124 | 5 | { |
1125 | 5 | if (NULL == ctx->cipher_info || |
1126 | 5 | MBEDTLS_MODE_CBC != ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1127 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1128 | 0 | } |
1129 | | |
1130 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1131 | | if (ctx->psa_enabled == 1) { |
1132 | | /* While PSA Crypto knows about CBC padding |
1133 | | * schemes, we currently don't make them |
1134 | | * accessible through the cipher layer. */ |
1135 | | if (mode != MBEDTLS_PADDING_NONE) { |
1136 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1137 | | } |
1138 | | |
1139 | | return 0; |
1140 | | } |
1141 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
1142 | | |
1143 | 5 | switch (mode) { |
1144 | 0 | #if defined(MBEDTLS_CIPHER_PADDING_PKCS7) |
1145 | 5 | case MBEDTLS_PADDING_PKCS7: |
1146 | 5 | ctx->add_padding = add_pkcs_padding; |
1147 | 5 | ctx->get_padding = get_pkcs_padding; |
1148 | 5 | break; |
1149 | 0 | #endif |
1150 | 0 | #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS) |
1151 | 0 | case MBEDTLS_PADDING_ONE_AND_ZEROS: |
1152 | 0 | ctx->add_padding = add_one_and_zeros_padding; |
1153 | 0 | ctx->get_padding = get_one_and_zeros_padding; |
1154 | 0 | break; |
1155 | 0 | #endif |
1156 | 0 | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN) |
1157 | 0 | case MBEDTLS_PADDING_ZEROS_AND_LEN: |
1158 | 0 | ctx->add_padding = add_zeros_and_len_padding; |
1159 | 0 | ctx->get_padding = get_zeros_and_len_padding; |
1160 | 0 | break; |
1161 | 0 | #endif |
1162 | 0 | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS) |
1163 | 0 | case MBEDTLS_PADDING_ZEROS: |
1164 | 0 | ctx->add_padding = add_zeros_padding; |
1165 | 0 | ctx->get_padding = get_zeros_padding; |
1166 | 0 | break; |
1167 | 0 | #endif |
1168 | 0 | case MBEDTLS_PADDING_NONE: |
1169 | 0 | ctx->add_padding = NULL; |
1170 | 0 | ctx->get_padding = get_no_padding; |
1171 | 0 | break; |
1172 | | |
1173 | 0 | default: |
1174 | 0 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1175 | 5 | } |
1176 | | |
1177 | 5 | return 0; |
1178 | 5 | } |
1179 | | #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ |
1180 | | |
1181 | | #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) |
1182 | | int mbedtls_cipher_write_tag(mbedtls_cipher_context_t *ctx, |
1183 | | unsigned char *tag, size_t tag_len) |
1184 | 0 | { |
1185 | 0 | if (ctx->cipher_info == NULL) { |
1186 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1187 | 0 | } |
1188 | | |
1189 | 0 | if (MBEDTLS_ENCRYPT != ctx->operation) { |
1190 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1191 | 0 | } |
1192 | | |
1193 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1194 | | if (ctx->psa_enabled == 1) { |
1195 | | /* While PSA Crypto has an API for multipart |
1196 | | * operations, we currently don't make it |
1197 | | * accessible through the cipher layer. */ |
1198 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1199 | | } |
1200 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
1201 | | |
1202 | 0 | #if defined(MBEDTLS_GCM_C) |
1203 | 0 | if (MBEDTLS_MODE_GCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1204 | 0 | size_t output_length; |
1205 | | /* The code here doesn't yet support alternative implementations |
1206 | | * that can delay up to a block of output. */ |
1207 | 0 | return mbedtls_gcm_finish((mbedtls_gcm_context *) ctx->cipher_ctx, |
1208 | 0 | NULL, 0, &output_length, |
1209 | 0 | tag, tag_len); |
1210 | 0 | } |
1211 | 0 | #endif |
1212 | | |
1213 | 0 | #if defined(MBEDTLS_CHACHAPOLY_C) |
1214 | 0 | if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ((mbedtls_cipher_type_t) ctx->cipher_info->type)) { |
1215 | | /* Don't allow truncated MAC for Poly1305 */ |
1216 | 0 | if (tag_len != 16U) { |
1217 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1218 | 0 | } |
1219 | | |
1220 | 0 | return mbedtls_chachapoly_finish( |
1221 | 0 | (mbedtls_chachapoly_context *) ctx->cipher_ctx, tag); |
1222 | 0 | } |
1223 | 0 | #endif |
1224 | | |
1225 | 0 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1226 | 0 | } |
1227 | | |
1228 | | int mbedtls_cipher_check_tag(mbedtls_cipher_context_t *ctx, |
1229 | | const unsigned char *tag, size_t tag_len) |
1230 | 0 | { |
1231 | 0 | unsigned char check_tag[16]; |
1232 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
1233 | |
|
1234 | 0 | if (ctx->cipher_info == NULL) { |
1235 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1236 | 0 | } |
1237 | | |
1238 | 0 | if (MBEDTLS_DECRYPT != ctx->operation) { |
1239 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1240 | 0 | } |
1241 | | |
1242 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1243 | | if (ctx->psa_enabled == 1) { |
1244 | | /* While PSA Crypto has an API for multipart |
1245 | | * operations, we currently don't make it |
1246 | | * accessible through the cipher layer. */ |
1247 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1248 | | } |
1249 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
1250 | | |
1251 | | /* Status to return on a non-authenticated algorithm. */ |
1252 | 0 | ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1253 | |
|
1254 | 0 | #if defined(MBEDTLS_GCM_C) |
1255 | 0 | if (MBEDTLS_MODE_GCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1256 | 0 | size_t output_length; |
1257 | | /* The code here doesn't yet support alternative implementations |
1258 | | * that can delay up to a block of output. */ |
1259 | |
|
1260 | 0 | if (tag_len > sizeof(check_tag)) { |
1261 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1262 | 0 | } |
1263 | | |
1264 | 0 | if (0 != (ret = mbedtls_gcm_finish( |
1265 | 0 | (mbedtls_gcm_context *) ctx->cipher_ctx, |
1266 | 0 | NULL, 0, &output_length, |
1267 | 0 | check_tag, tag_len))) { |
1268 | 0 | return ret; |
1269 | 0 | } |
1270 | | |
1271 | | /* Check the tag in "constant-time" */ |
1272 | 0 | if (mbedtls_ct_memcmp(tag, check_tag, tag_len) != 0) { |
1273 | 0 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
1274 | 0 | goto exit; |
1275 | 0 | } |
1276 | 0 | } |
1277 | 0 | #endif /* MBEDTLS_GCM_C */ |
1278 | | |
1279 | 0 | #if defined(MBEDTLS_CHACHAPOLY_C) |
1280 | 0 | if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ((mbedtls_cipher_type_t) ctx->cipher_info->type)) { |
1281 | | /* Don't allow truncated MAC for Poly1305 */ |
1282 | 0 | if (tag_len != sizeof(check_tag)) { |
1283 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1284 | 0 | } |
1285 | | |
1286 | 0 | ret = mbedtls_chachapoly_finish( |
1287 | 0 | (mbedtls_chachapoly_context *) ctx->cipher_ctx, check_tag); |
1288 | 0 | if (ret != 0) { |
1289 | 0 | return ret; |
1290 | 0 | } |
1291 | | |
1292 | | /* Check the tag in "constant-time" */ |
1293 | 0 | if (mbedtls_ct_memcmp(tag, check_tag, tag_len) != 0) { |
1294 | 0 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
1295 | 0 | goto exit; |
1296 | 0 | } |
1297 | 0 | } |
1298 | 0 | #endif /* MBEDTLS_CHACHAPOLY_C */ |
1299 | | |
1300 | 0 | exit: |
1301 | 0 | mbedtls_platform_zeroize(check_tag, tag_len); |
1302 | 0 | return ret; |
1303 | 0 | } |
1304 | | #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ |
1305 | | |
1306 | | /* |
1307 | | * Packet-oriented wrapper for non-AEAD modes |
1308 | | */ |
1309 | | int mbedtls_cipher_crypt(mbedtls_cipher_context_t *ctx, |
1310 | | const unsigned char *iv, size_t iv_len, |
1311 | | const unsigned char *input, size_t ilen, |
1312 | | unsigned char *output, size_t *olen) |
1313 | 0 | { |
1314 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
1315 | 0 | size_t finish_olen; |
1316 | |
|
1317 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1318 | | if (ctx->psa_enabled == 1) { |
1319 | | /* As in the non-PSA case, we don't check that |
1320 | | * a key has been set. If not, the key slot will |
1321 | | * still be in its default state of 0, which is |
1322 | | * guaranteed to be invalid, hence the PSA-call |
1323 | | * below will gracefully fail. */ |
1324 | | mbedtls_cipher_context_psa * const cipher_psa = |
1325 | | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
1326 | | |
1327 | | psa_status_t status; |
1328 | | psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT; |
1329 | | size_t part_len; |
1330 | | |
1331 | | if (ctx->operation == MBEDTLS_DECRYPT) { |
1332 | | status = psa_cipher_decrypt_setup(&cipher_op, |
1333 | | cipher_psa->slot, |
1334 | | cipher_psa->alg); |
1335 | | } else if (ctx->operation == MBEDTLS_ENCRYPT) { |
1336 | | status = psa_cipher_encrypt_setup(&cipher_op, |
1337 | | cipher_psa->slot, |
1338 | | cipher_psa->alg); |
1339 | | } else { |
1340 | | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1341 | | } |
1342 | | |
1343 | | /* In the following, we can immediately return on an error, |
1344 | | * because the PSA Crypto API guarantees that cipher operations |
1345 | | * are terminated by unsuccessful calls to psa_cipher_update(), |
1346 | | * and by any call to psa_cipher_finish(). */ |
1347 | | if (status != PSA_SUCCESS) { |
1348 | | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
1349 | | } |
1350 | | |
1351 | | if (((mbedtls_cipher_mode_t) ctx->cipher_info->mode) != MBEDTLS_MODE_ECB) { |
1352 | | status = psa_cipher_set_iv(&cipher_op, iv, iv_len); |
1353 | | if (status != PSA_SUCCESS) { |
1354 | | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
1355 | | } |
1356 | | } |
1357 | | |
1358 | | status = psa_cipher_update(&cipher_op, |
1359 | | input, ilen, |
1360 | | output, ilen, olen); |
1361 | | if (status != PSA_SUCCESS) { |
1362 | | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
1363 | | } |
1364 | | |
1365 | | status = psa_cipher_finish(&cipher_op, |
1366 | | output + *olen, ilen - *olen, |
1367 | | &part_len); |
1368 | | if (status != PSA_SUCCESS) { |
1369 | | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
1370 | | } |
1371 | | |
1372 | | *olen += part_len; |
1373 | | return 0; |
1374 | | } |
1375 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
1376 | |
|
1377 | 0 | if ((ret = mbedtls_cipher_set_iv(ctx, iv, iv_len)) != 0) { |
1378 | 0 | return ret; |
1379 | 0 | } |
1380 | | |
1381 | 0 | if ((ret = mbedtls_cipher_reset(ctx)) != 0) { |
1382 | 0 | return ret; |
1383 | 0 | } |
1384 | | |
1385 | 0 | if ((ret = mbedtls_cipher_update(ctx, input, ilen, |
1386 | 0 | output, olen)) != 0) { |
1387 | 0 | return ret; |
1388 | 0 | } |
1389 | | |
1390 | 0 | if ((ret = mbedtls_cipher_finish(ctx, output + *olen, |
1391 | 0 | &finish_olen)) != 0) { |
1392 | 0 | return ret; |
1393 | 0 | } |
1394 | | |
1395 | 0 | *olen += finish_olen; |
1396 | |
|
1397 | 0 | return 0; |
1398 | 0 | } |
1399 | | |
1400 | | #if defined(MBEDTLS_CIPHER_MODE_AEAD) |
1401 | | /* |
1402 | | * Packet-oriented encryption for AEAD modes: internal function used by |
1403 | | * mbedtls_cipher_auth_encrypt_ext(). |
1404 | | */ |
1405 | | static int mbedtls_cipher_aead_encrypt(mbedtls_cipher_context_t *ctx, |
1406 | | const unsigned char *iv, size_t iv_len, |
1407 | | const unsigned char *ad, size_t ad_len, |
1408 | | const unsigned char *input, size_t ilen, |
1409 | | unsigned char *output, size_t *olen, |
1410 | | unsigned char *tag, size_t tag_len) |
1411 | 49 | { |
1412 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1413 | | if (ctx->psa_enabled == 1) { |
1414 | | /* As in the non-PSA case, we don't check that |
1415 | | * a key has been set. If not, the key slot will |
1416 | | * still be in its default state of 0, which is |
1417 | | * guaranteed to be invalid, hence the PSA-call |
1418 | | * below will gracefully fail. */ |
1419 | | mbedtls_cipher_context_psa * const cipher_psa = |
1420 | | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
1421 | | |
1422 | | psa_status_t status; |
1423 | | |
1424 | | /* PSA Crypto API always writes the authentication tag |
1425 | | * at the end of the encrypted message. */ |
1426 | | if (output == NULL || tag != output + ilen) { |
1427 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1428 | | } |
1429 | | |
1430 | | status = psa_aead_encrypt(cipher_psa->slot, |
1431 | | cipher_psa->alg, |
1432 | | iv, iv_len, |
1433 | | ad, ad_len, |
1434 | | input, ilen, |
1435 | | output, ilen + tag_len, olen); |
1436 | | if (status != PSA_SUCCESS) { |
1437 | | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
1438 | | } |
1439 | | |
1440 | | *olen -= tag_len; |
1441 | | return 0; |
1442 | | } |
1443 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
1444 | | |
1445 | 49 | #if defined(MBEDTLS_GCM_C) |
1446 | 49 | if (MBEDTLS_MODE_GCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1447 | 44 | *olen = ilen; |
1448 | 44 | return mbedtls_gcm_crypt_and_tag(ctx->cipher_ctx, MBEDTLS_GCM_ENCRYPT, |
1449 | 44 | ilen, iv, iv_len, ad, ad_len, |
1450 | 44 | input, output, tag_len, tag); |
1451 | 44 | } |
1452 | 5 | #endif /* MBEDTLS_GCM_C */ |
1453 | 5 | #if defined(MBEDTLS_CCM_C) |
1454 | 5 | if (MBEDTLS_MODE_CCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1455 | 0 | *olen = ilen; |
1456 | 0 | return mbedtls_ccm_encrypt_and_tag(ctx->cipher_ctx, ilen, |
1457 | 0 | iv, iv_len, ad, ad_len, input, output, |
1458 | 0 | tag, tag_len); |
1459 | 0 | } |
1460 | 5 | #endif /* MBEDTLS_CCM_C */ |
1461 | 5 | #if defined(MBEDTLS_CHACHAPOLY_C) |
1462 | 5 | if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ((mbedtls_cipher_type_t) ctx->cipher_info->type)) { |
1463 | | /* ChachaPoly has fixed length nonce and MAC (tag) */ |
1464 | 1 | if ((iv_len != mbedtls_cipher_info_get_iv_size(ctx->cipher_info)) || |
1465 | 1 | (tag_len != 16U)) { |
1466 | 1 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1467 | 1 | } |
1468 | | |
1469 | 0 | *olen = ilen; |
1470 | 0 | return mbedtls_chachapoly_encrypt_and_tag(ctx->cipher_ctx, |
1471 | 0 | ilen, iv, ad, ad_len, input, output, tag); |
1472 | 1 | } |
1473 | 4 | #endif /* MBEDTLS_CHACHAPOLY_C */ |
1474 | | |
1475 | 4 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1476 | 5 | } |
1477 | | |
1478 | | /* |
1479 | | * Packet-oriented encryption for AEAD modes: internal function used by |
1480 | | * mbedtls_cipher_auth_encrypt_ext(). |
1481 | | */ |
1482 | | static int mbedtls_cipher_aead_decrypt(mbedtls_cipher_context_t *ctx, |
1483 | | const unsigned char *iv, size_t iv_len, |
1484 | | const unsigned char *ad, size_t ad_len, |
1485 | | const unsigned char *input, size_t ilen, |
1486 | | unsigned char *output, size_t *olen, |
1487 | | const unsigned char *tag, size_t tag_len) |
1488 | 166 | { |
1489 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1490 | | if (ctx->psa_enabled == 1) { |
1491 | | /* As in the non-PSA case, we don't check that |
1492 | | * a key has been set. If not, the key slot will |
1493 | | * still be in its default state of 0, which is |
1494 | | * guaranteed to be invalid, hence the PSA-call |
1495 | | * below will gracefully fail. */ |
1496 | | mbedtls_cipher_context_psa * const cipher_psa = |
1497 | | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
1498 | | |
1499 | | psa_status_t status; |
1500 | | |
1501 | | /* PSA Crypto API always writes the authentication tag |
1502 | | * at the end of the encrypted message. */ |
1503 | | if (input == NULL || tag != input + ilen) { |
1504 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1505 | | } |
1506 | | |
1507 | | status = psa_aead_decrypt(cipher_psa->slot, |
1508 | | cipher_psa->alg, |
1509 | | iv, iv_len, |
1510 | | ad, ad_len, |
1511 | | input, ilen + tag_len, |
1512 | | output, ilen, olen); |
1513 | | if (status == PSA_ERROR_INVALID_SIGNATURE) { |
1514 | | return MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
1515 | | } else if (status != PSA_SUCCESS) { |
1516 | | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
1517 | | } |
1518 | | |
1519 | | return 0; |
1520 | | } |
1521 | | #endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ |
1522 | | |
1523 | 166 | #if defined(MBEDTLS_GCM_C) |
1524 | 166 | if (MBEDTLS_MODE_GCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1525 | 55 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
1526 | | |
1527 | 55 | *olen = ilen; |
1528 | 55 | ret = mbedtls_gcm_auth_decrypt(ctx->cipher_ctx, ilen, |
1529 | 55 | iv, iv_len, ad, ad_len, |
1530 | 55 | tag, tag_len, input, output); |
1531 | | |
1532 | 55 | if (ret == MBEDTLS_ERR_GCM_AUTH_FAILED) { |
1533 | 6 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
1534 | 6 | } |
1535 | | |
1536 | 55 | return ret; |
1537 | 55 | } |
1538 | 111 | #endif /* MBEDTLS_GCM_C */ |
1539 | 111 | #if defined(MBEDTLS_CCM_C) |
1540 | 111 | if (MBEDTLS_MODE_CCM == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) { |
1541 | 15 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
1542 | | |
1543 | 15 | *olen = ilen; |
1544 | 15 | ret = mbedtls_ccm_auth_decrypt(ctx->cipher_ctx, ilen, |
1545 | 15 | iv, iv_len, ad, ad_len, |
1546 | 15 | input, output, tag, tag_len); |
1547 | | |
1548 | 15 | if (ret == MBEDTLS_ERR_CCM_AUTH_FAILED) { |
1549 | 13 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
1550 | 13 | } |
1551 | | |
1552 | 15 | return ret; |
1553 | 15 | } |
1554 | 96 | #endif /* MBEDTLS_CCM_C */ |
1555 | 96 | #if defined(MBEDTLS_CHACHAPOLY_C) |
1556 | 96 | if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ((mbedtls_cipher_type_t) ctx->cipher_info->type)) { |
1557 | 39 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
1558 | | |
1559 | | /* ChachaPoly has fixed length nonce and MAC (tag) */ |
1560 | 39 | if ((iv_len != mbedtls_cipher_info_get_iv_size(ctx->cipher_info)) || |
1561 | 39 | (tag_len != 16U)) { |
1562 | 10 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1563 | 10 | } |
1564 | | |
1565 | 29 | *olen = ilen; |
1566 | 29 | ret = mbedtls_chachapoly_auth_decrypt(ctx->cipher_ctx, ilen, |
1567 | 29 | iv, ad, ad_len, tag, input, output); |
1568 | | |
1569 | 29 | if (ret == MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED) { |
1570 | 29 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
1571 | 29 | } |
1572 | | |
1573 | 29 | return ret; |
1574 | 39 | } |
1575 | 57 | #endif /* MBEDTLS_CHACHAPOLY_C */ |
1576 | | |
1577 | 57 | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1578 | 96 | } |
1579 | | #endif /* MBEDTLS_CIPHER_MODE_AEAD */ |
1580 | | |
1581 | | #if defined(MBEDTLS_CIPHER_MODE_AEAD) || defined(MBEDTLS_NIST_KW_C) |
1582 | | /* |
1583 | | * Packet-oriented encryption for AEAD/NIST_KW: public function. |
1584 | | */ |
1585 | | int mbedtls_cipher_auth_encrypt_ext(mbedtls_cipher_context_t *ctx, |
1586 | | const unsigned char *iv, size_t iv_len, |
1587 | | const unsigned char *ad, size_t ad_len, |
1588 | | const unsigned char *input, size_t ilen, |
1589 | | unsigned char *output, size_t output_len, |
1590 | | size_t *olen, size_t tag_len) |
1591 | 98 | { |
1592 | 98 | #if defined(MBEDTLS_NIST_KW_C) |
1593 | 98 | if ( |
1594 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1595 | | ctx->psa_enabled == 0 && |
1596 | | #endif |
1597 | 98 | (MBEDTLS_MODE_KW == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1598 | 98 | MBEDTLS_MODE_KWP == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode))) { |
1599 | 1 | mbedtls_nist_kw_mode_t mode = |
1600 | 1 | (MBEDTLS_MODE_KW == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) ? |
1601 | 1 | MBEDTLS_KW_MODE_KW : MBEDTLS_KW_MODE_KWP; |
1602 | | |
1603 | | /* There is no iv, tag or ad associated with KW and KWP, |
1604 | | * so these length should be 0 as documented. */ |
1605 | 1 | if (iv_len != 0 || tag_len != 0 || ad_len != 0) { |
1606 | 1 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1607 | 1 | } |
1608 | | |
1609 | 0 | (void) iv; |
1610 | 0 | (void) ad; |
1611 | |
|
1612 | 0 | return mbedtls_nist_kw_wrap(ctx->cipher_ctx, mode, input, ilen, |
1613 | 0 | output, olen, output_len); |
1614 | 1 | } |
1615 | 97 | #endif /* MBEDTLS_NIST_KW_C */ |
1616 | | |
1617 | 97 | #if defined(MBEDTLS_CIPHER_MODE_AEAD) |
1618 | | /* AEAD case: check length before passing on to shared function */ |
1619 | 97 | if (output_len < ilen + tag_len) { |
1620 | 48 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1621 | 48 | } |
1622 | | |
1623 | 49 | int ret = mbedtls_cipher_aead_encrypt(ctx, iv, iv_len, ad, ad_len, |
1624 | 49 | input, ilen, output, olen, |
1625 | 49 | output + ilen, tag_len); |
1626 | 49 | *olen += tag_len; |
1627 | 49 | return ret; |
1628 | | #else |
1629 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1630 | | #endif /* MBEDTLS_CIPHER_MODE_AEAD */ |
1631 | 97 | } |
1632 | | |
1633 | | /* |
1634 | | * Packet-oriented decryption for AEAD/NIST_KW: public function. |
1635 | | */ |
1636 | | int mbedtls_cipher_auth_decrypt_ext(mbedtls_cipher_context_t *ctx, |
1637 | | const unsigned char *iv, size_t iv_len, |
1638 | | const unsigned char *ad, size_t ad_len, |
1639 | | const unsigned char *input, size_t ilen, |
1640 | | unsigned char *output, size_t output_len, |
1641 | | size_t *olen, size_t tag_len) |
1642 | 167 | { |
1643 | 167 | #if defined(MBEDTLS_NIST_KW_C) |
1644 | 167 | if ( |
1645 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) |
1646 | | ctx->psa_enabled == 0 && |
1647 | | #endif |
1648 | 167 | (MBEDTLS_MODE_KW == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode) || |
1649 | 167 | MBEDTLS_MODE_KWP == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode))) { |
1650 | 1 | mbedtls_nist_kw_mode_t mode = |
1651 | 1 | (MBEDTLS_MODE_KW == ((mbedtls_cipher_mode_t) ctx->cipher_info->mode)) ? |
1652 | 1 | MBEDTLS_KW_MODE_KW : MBEDTLS_KW_MODE_KWP; |
1653 | | |
1654 | | /* There is no iv, tag or ad associated with KW and KWP, |
1655 | | * so these length should be 0 as documented. */ |
1656 | 1 | if (iv_len != 0 || tag_len != 0 || ad_len != 0) { |
1657 | 1 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1658 | 1 | } |
1659 | | |
1660 | 0 | (void) iv; |
1661 | 0 | (void) ad; |
1662 | |
|
1663 | 0 | return mbedtls_nist_kw_unwrap(ctx->cipher_ctx, mode, input, ilen, |
1664 | 0 | output, olen, output_len); |
1665 | 1 | } |
1666 | 166 | #endif /* MBEDTLS_NIST_KW_C */ |
1667 | | |
1668 | 166 | #if defined(MBEDTLS_CIPHER_MODE_AEAD) |
1669 | | /* AEAD case: check length before passing on to shared function */ |
1670 | 166 | if (ilen < tag_len || output_len < ilen - tag_len) { |
1671 | 0 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
1672 | 0 | } |
1673 | | |
1674 | 166 | return mbedtls_cipher_aead_decrypt(ctx, iv, iv_len, ad, ad_len, |
1675 | 166 | input, ilen - tag_len, output, olen, |
1676 | 166 | input + ilen - tag_len, tag_len); |
1677 | | #else |
1678 | | return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE; |
1679 | | #endif /* MBEDTLS_CIPHER_MODE_AEAD */ |
1680 | 166 | } |
1681 | | #endif /* MBEDTLS_CIPHER_MODE_AEAD || MBEDTLS_NIST_KW_C */ |
1682 | | |
1683 | | #endif /* MBEDTLS_CIPHER_C */ |