/src/openssl111/crypto/cmac/cmac.c

Source (jump to first uncovered line)
/*
 * Copyright 2010-2020 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "internal/cryptlib.h"
#include <openssl/cmac.h>
#include <openssl/err.h>

struct CMAC_CTX_st {
    /* Cipher context to use */
    EVP_CIPHER_CTX *cctx;
    /* Keys k1 and k2 */
    unsigned char k1[EVP_MAX_BLOCK_LENGTH];
    unsigned char k2[EVP_MAX_BLOCK_LENGTH];
    /* Temporary block */
    unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
    /* Last (possibly partial) block */
    unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
    /* Number of bytes in last block: -1 means context not initialised */
    int nlast_block;
};

/* Make temporary keys K1 and K2 */

static void make_kn(unsigned char *k1, const unsigned char *l, int bl)
{
    int i;
    unsigned char c = l[0], carry = c >> 7, cnext;

    /* Shift block to left, including carry */
    for (i = 0; i < bl - 1; i++, c = cnext)
        k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);

    /* If MSB set fixup with R */
    k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
}

CMAC_CTX *CMAC_CTX_new(void)
{
    CMAC_CTX *ctx;

    if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL) {
        CRYPTOerr(CRYPTO_F_CMAC_CTX_NEW, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    ctx->cctx = EVP_CIPHER_CTX_new();
    if (ctx->cctx == NULL) {
        OPENSSL_free(ctx);
        return NULL;
    }
    ctx->nlast_block = -1;
    return ctx;
}

void CMAC_CTX_cleanup(CMAC_CTX *ctx)
{
    EVP_CIPHER_CTX_reset(ctx->cctx);
    OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
    ctx->nlast_block = -1;
}

EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx)
{
    return ctx->cctx;
}

void CMAC_CTX_free(CMAC_CTX *ctx)
{
    if (!ctx)
        return;
    CMAC_CTX_cleanup(ctx);
    EVP_CIPHER_CTX_free(ctx->cctx);
    OPENSSL_free(ctx);
}

int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in)
{
    int bl;
    if (in->nlast_block == -1)
        return 0;
    if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
        return 0;
    bl = EVP_CIPHER_CTX_block_size(in->cctx);
    memcpy(out->k1, in->k1, bl);
    memcpy(out->k2, in->k2, bl);
    memcpy(out->tbl, in->tbl, bl);
    memcpy(out->last_block, in->last_block, bl);
    out->nlast_block = in->nlast_block;
    return 1;
}

int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
              const EVP_CIPHER *cipher, ENGINE *impl)
{
    static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
    /* All zeros means restart */
    if (!key && !cipher && !impl && keylen == 0) {
        /* Not initialised */
        if (ctx->nlast_block == -1)
            return 0;
        if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
            return 0;
        memset(ctx->tbl, 0, EVP_CIPHER_CTX_block_size(ctx->cctx));
        ctx->nlast_block = 0;
        return 1;
    }
    /* Initialise context */
    if (cipher != NULL) {
        /* Ensure we can't use this ctx until we also have a key */
        ctx->nlast_block = -1;
        if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
            return 0;
    }
    /* Non-NULL key means initialisation complete */
    if (key != NULL) {
        int bl;

        /* If anything fails then ensure we can't use this ctx */
        ctx->nlast_block = -1;
        if (!EVP_CIPHER_CTX_cipher(ctx->cctx))
            return 0;
        if (!EVP_CIPHER_CTX_set_key_length(ctx->cctx, keylen))
            return 0;
        if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, key, zero_iv))
            return 0;
        bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
        if (EVP_Cipher(ctx->cctx, ctx->tbl, zero_iv, bl) <= 0)
            return 0;
        make_kn(ctx->k1, ctx->tbl, bl);
        make_kn(ctx->k2, ctx->k1, bl);
        OPENSSL_cleanse(ctx->tbl, bl);
        /* Reset context again ready for first data block */
        if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
            return 0;
        /* Zero tbl so resume works */
        memset(ctx->tbl, 0, bl);
        ctx->nlast_block = 0;
    }
    return 1;
}

int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
{
    const unsigned char *data = in;
    size_t bl;
    if (ctx->nlast_block == -1)
        return 0;
    if (dlen == 0)
        return 1;
    bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
    /* Copy into partial block if we need to */
    if (ctx->nlast_block > 0) {
        size_t nleft;
        nleft = bl - ctx->nlast_block;
        if (dlen < nleft)
            nleft = dlen;
        memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
        dlen -= nleft;
        ctx->nlast_block += nleft;
        /* If no more to process return */
        if (dlen == 0)
            return 1;
        data += nleft;
        /* Else not final block so encrypt it */
        if (EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl) <= 0)
            return 0;
    }
    /* Encrypt all but one of the complete blocks left */
    while (dlen > bl) {
        if (EVP_Cipher(ctx->cctx, ctx->tbl, data, bl) <= 0)
            return 0;
        dlen -= bl;
        data += bl;
    }
    /* Copy any data left to last block buffer */
    memcpy(ctx->last_block, data, dlen);
    ctx->nlast_block = dlen;
    return 1;

}

int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
{
    int i, bl, lb;
    if (ctx->nlast_block == -1)
        return 0;
    bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
    *poutlen = (size_t)bl;
    if (!out)
        return 1;
    lb = ctx->nlast_block;
    /* Is last block complete? */
    if (lb == bl) {
        for (i = 0; i < bl; i++)
            out[i] = ctx->last_block[i] ^ ctx->k1[i];
    } else {
        ctx->last_block[lb] = 0x80;
        if (bl - lb > 1)
            memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
        for (i = 0; i < bl; i++)
            out[i] = ctx->last_block[i] ^ ctx->k2[i];
    }
    if (!EVP_Cipher(ctx->cctx, out, out, bl)) {
        OPENSSL_cleanse(out, bl);
        return 0;
    }
    return 1;
}

int CMAC_resume(CMAC_CTX *ctx)
{
    if (ctx->nlast_block == -1)
        return 0;
    /*
     * The buffer "tbl" contains the last fully encrypted block which is the
     * last IV (or all zeroes if no last encrypted block). The last block has
     * not been modified since CMAC_final(). So reinitialising using the last
     * decrypted block will allow CMAC to continue after calling
     * CMAC_Final().
     */
    return EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, ctx->tbl);
}

Coverage Report

Created: 2023-06-08 06:41

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2010-2020 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the OpenSSL license (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include <stdlib.h>
12		#include <string.h>
13		#include "internal/cryptlib.h"
14		#include <openssl/cmac.h>
15		#include <openssl/err.h>
16
17		struct CMAC_CTX_st {
18		/* Cipher context to use */
19		EVP_CIPHER_CTX *cctx;
20		/* Keys k1 and k2 */
21		unsigned char k1[EVP_MAX_BLOCK_LENGTH];
22		unsigned char k2[EVP_MAX_BLOCK_LENGTH];
23		/* Temporary block */
24		unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
25		/* Last (possibly partial) block */
26		unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
27		/* Number of bytes in last block: -1 means context not initialised */
28		int nlast_block;
29		};
30
31		/* Make temporary keys K1 and K2 */
32
33		static void make_kn(unsigned char k1, const unsigned char l, int bl)
34	0	{
35	0	int i;
36	0	unsigned char c = l[0], carry = c >> 7, cnext;
37
38		/* Shift block to left, including carry */
39	0	for (i = 0; i < bl - 1; i++, c = cnext)
40	0	k1[i] = (c << 1) \| ((cnext = l[i + 1]) >> 7);
41
42		/* If MSB set fixup with R */
43	0	k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
44	0	}
45
46		CMAC_CTX *CMAC_CTX_new(void)
47	0	{
48	0	CMAC_CTX *ctx;
49
50	0	if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL) {
51	0	CRYPTOerr(CRYPTO_F_CMAC_CTX_NEW, ERR_R_MALLOC_FAILURE);
52	0	return NULL;
53	0	}
54	0	ctx->cctx = EVP_CIPHER_CTX_new();
55	0	if (ctx->cctx == NULL) {
56	0	OPENSSL_free(ctx);
57	0	return NULL;
58	0	}
59	0	ctx->nlast_block = -1;
60	0	return ctx;
61	0	}
62
63		void CMAC_CTX_cleanup(CMAC_CTX *ctx)
64	0	{
65	0	EVP_CIPHER_CTX_reset(ctx->cctx);
66	0	OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
67	0	OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
68	0	OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);
69	0	OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
70	0	ctx->nlast_block = -1;
71	0	}
72
73		EVP_CIPHER_CTX CMAC_CTX_get0_cipher_ctx(CMAC_CTX ctx)
74	0	{
75	0	return ctx->cctx;
76	0	}
77
78		void CMAC_CTX_free(CMAC_CTX *ctx)
79	0	{
80	0	if (!ctx)
81	0	return;
82	0	CMAC_CTX_cleanup(ctx);
83	0	EVP_CIPHER_CTX_free(ctx->cctx);
84	0	OPENSSL_free(ctx);
85	0	}
86
87		int CMAC_CTX_copy(CMAC_CTX out, const CMAC_CTX in)
88	0	{
89	0	int bl;
90	0	if (in->nlast_block == -1)
91	0	return 0;
92	0	if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
93	0	return 0;
94	0	bl = EVP_CIPHER_CTX_block_size(in->cctx);
95	0	memcpy(out->k1, in->k1, bl);
96	0	memcpy(out->k2, in->k2, bl);
97	0	memcpy(out->tbl, in->tbl, bl);
98	0	memcpy(out->last_block, in->last_block, bl);
99	0	out->nlast_block = in->nlast_block;
100	0	return 1;
101	0	}
102
103		int CMAC_Init(CMAC_CTX ctx, const void key, size_t keylen,
104		const EVP_CIPHER cipher, ENGINE impl)
105	0	{
106	0	static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
107		/* All zeros means restart */
108	0	if (!key && !cipher && !impl && keylen == 0) {
109		/* Not initialised */
110	0	if (ctx->nlast_block == -1)
111	0	return 0;
112	0	if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
113	0	return 0;
114	0	memset(ctx->tbl, 0, EVP_CIPHER_CTX_block_size(ctx->cctx));
115	0	ctx->nlast_block = 0;
116	0	return 1;
117	0	}
118		/* Initialise context */
119	0	if (cipher != NULL) {
120		/* Ensure we can't use this ctx until we also have a key */
121	0	ctx->nlast_block = -1;
122	0	if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
123	0	return 0;
124	0	}
125		/* Non-NULL key means initialisation complete */
126	0	if (key != NULL) {
127	0	int bl;
128
129		/* If anything fails then ensure we can't use this ctx */
130	0	ctx->nlast_block = -1;
131	0	if (!EVP_CIPHER_CTX_cipher(ctx->cctx))
132	0	return 0;
133	0	if (!EVP_CIPHER_CTX_set_key_length(ctx->cctx, keylen))
134	0	return 0;
135	0	if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, key, zero_iv))
136	0	return 0;
137	0	bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
138	0	if (EVP_Cipher(ctx->cctx, ctx->tbl, zero_iv, bl) <= 0)
139	0	return 0;
140	0	make_kn(ctx->k1, ctx->tbl, bl);
141	0	make_kn(ctx->k2, ctx->k1, bl);
142	0	OPENSSL_cleanse(ctx->tbl, bl);
143		/* Reset context again ready for first data block */
144	0	if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
145	0	return 0;
146		/* Zero tbl so resume works */
147	0	memset(ctx->tbl, 0, bl);
148	0	ctx->nlast_block = 0;
149	0	}
150	0	return 1;
151	0	}
152
153		int CMAC_Update(CMAC_CTX ctx, const void in, size_t dlen)
154	0	{
155	0	const unsigned char *data = in;
156	0	size_t bl;
157	0	if (ctx->nlast_block == -1)
158	0	return 0;
159	0	if (dlen == 0)
160	0	return 1;
161	0	bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
162		/* Copy into partial block if we need to */
163	0	if (ctx->nlast_block > 0) {
164	0	size_t nleft;
165	0	nleft = bl - ctx->nlast_block;
166	0	if (dlen < nleft)
167	0	nleft = dlen;
168	0	memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
169	0	dlen -= nleft;
170	0	ctx->nlast_block += nleft;
171		/* If no more to process return */
172	0	if (dlen == 0)
173	0	return 1;
174	0	data += nleft;
175		/* Else not final block so encrypt it */
176	0	if (EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl) <= 0)
177	0	return 0;
178	0	}
179		/* Encrypt all but one of the complete blocks left */
180	0	while (dlen > bl) {
181	0	if (EVP_Cipher(ctx->cctx, ctx->tbl, data, bl) <= 0)
182	0	return 0;
183	0	dlen -= bl;
184	0	data += bl;
185	0	}
186		/* Copy any data left to last block buffer */
187	0	memcpy(ctx->last_block, data, dlen);
188	0	ctx->nlast_block = dlen;
189	0	return 1;
190
191	0	}
192
193		int CMAC_Final(CMAC_CTX ctx, unsigned char out, size_t *poutlen)
194	0	{
195	0	int i, bl, lb;
196	0	if (ctx->nlast_block == -1)
197	0	return 0;
198	0	bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
199	0	*poutlen = (size_t)bl;
200	0	if (!out)
201	0	return 1;
202	0	lb = ctx->nlast_block;
203		/* Is last block complete? */
204	0	if (lb == bl) {
205	0	for (i = 0; i < bl; i++)
206	0	out[i] = ctx->last_block[i] ^ ctx->k1[i];
207	0	} else {
208	0	ctx->last_block[lb] = 0x80;
209	0	if (bl - lb > 1)
210	0	memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
211	0	for (i = 0; i < bl; i++)
212	0	out[i] = ctx->last_block[i] ^ ctx->k2[i];
213	0	}
214	0	if (!EVP_Cipher(ctx->cctx, out, out, bl)) {
215	0	OPENSSL_cleanse(out, bl);
216	0	return 0;
217	0	}
218	0	return 1;
219	0	}
220
221		int CMAC_resume(CMAC_CTX *ctx)
222	0	{
223	0	if (ctx->nlast_block == -1)
224	0	return 0;
225		/*
226		* The buffer "tbl" contains the last fully encrypted block which is the
227		* last IV (or all zeroes if no last encrypted block). The last block has
228		* not been modified since CMAC_final(). So reinitialising using the last
229		* decrypted block will allow CMAC to continue after calling
230		* CMAC_Final().
231		*/
232	0	return EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, ctx->tbl);
233	0	}