/src/openssl36/crypto/cmac/cmac.c

Source
/*
 * Copyright 2010-2025 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*
 * CMAC low level APIs are deprecated for public use, but still ok for internal
 * use.
 */
#include "internal/deprecated.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "internal/cryptlib.h"
#include <openssl/cmac.h>
#include <openssl/err.h>
#include "crypto/cmac.h"

#define LOCAL_BUF_SIZE 2048
struct CMAC_CTX_st {
    /* Cipher context to use */
    EVP_CIPHER_CTX *cctx;
    /* Keys k1 and k2 */
    unsigned char k1[EVP_MAX_BLOCK_LENGTH];
    unsigned char k2[EVP_MAX_BLOCK_LENGTH];
    /* Temporary block */
    unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
    /* Last (possibly partial) block */
    unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
    /* Number of bytes in last block: -1 means context not initialised */
    int nlast_block;
};

/* Make temporary keys K1 and K2 */

static void make_kn(unsigned char *k1, const unsigned char *l, int bl)
{
    int i;
    unsigned char c = l[0], carry = c >> 7, cnext;

    /* Shift block to left, including carry */
    for (i = 0; i < bl - 1; i++, c = cnext)
        k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);

    /* If MSB set fixup with R */
    k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
}

CMAC_CTX *CMAC_CTX_new(void)
{
    CMAC_CTX *ctx;

    if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL)
        return NULL;
    ctx->cctx = EVP_CIPHER_CTX_new();
    if (ctx->cctx == NULL) {
        OPENSSL_free(ctx);
        return NULL;
    }
    ctx->nlast_block = -1;
    return ctx;
}

void CMAC_CTX_cleanup(CMAC_CTX *ctx)
{
    EVP_CIPHER_CTX_reset(ctx->cctx);
    OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
    ctx->nlast_block = -1;
}

EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx)
{
    return ctx->cctx;
}

void CMAC_CTX_free(CMAC_CTX *ctx)
{
    if (!ctx)
        return;
    CMAC_CTX_cleanup(ctx);
    EVP_CIPHER_CTX_free(ctx->cctx);
    OPENSSL_free(ctx);
}

int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in)
{
    int bl;

    if (in->nlast_block == -1)
        return 0;
    if ((bl = EVP_CIPHER_CTX_get_block_size(in->cctx)) == 0)
        return 0;
    if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
        return 0;
    memcpy(out->k1, in->k1, bl);
    memcpy(out->k2, in->k2, bl);
    memcpy(out->tbl, in->tbl, bl);
    memcpy(out->last_block, in->last_block, bl);
    out->nlast_block = in->nlast_block;
    return 1;
}

int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen,
    const EVP_CIPHER *cipher, ENGINE *impl,
    const OSSL_PARAM param[])
{
    static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
    int block_len;

    /* All zeros means restart */
    if (!key && !cipher && !impl && keylen == 0) {
        /* Not initialised */
        if (ctx->nlast_block == -1)
            return 0;
        if (!EVP_EncryptInit_ex2(ctx->cctx, NULL, NULL, zero_iv, param))
            return 0;
        block_len = EVP_CIPHER_CTX_get_block_size(ctx->cctx);
        if (block_len == 0)
            return 0;
        memset(ctx->tbl, 0, block_len);
        ctx->nlast_block = 0;
        return 1;
    }
    /* Initialise context */
    if (cipher != NULL) {
        /* Ensure we can't use this ctx until we also have a key */
        ctx->nlast_block = -1;
        if (impl != NULL) {
            if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
                return 0;
        } else {
            if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param))
                return 0;
        }
    }
    /* Non-NULL key means initialisation complete */
    if (key != NULL) {
        int bl;

        /* If anything fails then ensure we can't use this ctx */
        ctx->nlast_block = -1;
        if (EVP_CIPHER_CTX_get0_cipher(ctx->cctx) == NULL)
            return 0;
        if (keylen > INT_MAX
            || EVP_CIPHER_CTX_set_key_length(ctx->cctx, (int)keylen) <= 0)
            return 0;
        if (!EVP_EncryptInit_ex2(ctx->cctx, NULL, key, zero_iv, param))
            return 0;
        if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) < 0)
            return 0;
        if (EVP_Cipher(ctx->cctx, ctx->tbl, zero_iv, bl) <= 0)
            return 0;
        make_kn(ctx->k1, ctx->tbl, bl);
        make_kn(ctx->k2, ctx->k1, bl);
        OPENSSL_cleanse(ctx->tbl, bl);
        /* Reset context again ready for first data block */
        if (!EVP_EncryptInit_ex2(ctx->cctx, NULL, NULL, zero_iv, param))
            return 0;
        /* Zero tbl so resume works */
        memset(ctx->tbl, 0, bl);
        ctx->nlast_block = 0;
    }
    return 1;
}

int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
    const EVP_CIPHER *cipher, ENGINE *impl)
{
    return ossl_cmac_init(ctx, key, keylen, cipher, impl, NULL);
}

int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
{
    const unsigned char *data = in;
    int bl;
    size_t max_burst_blocks, cipher_blocks;
    unsigned char buf[LOCAL_BUF_SIZE];

    if (ctx->nlast_block == -1)
        return 0;
    if (dlen == 0)
        return 1;
    if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
        return 0;
    /* Copy into partial block if we need to */
    if (ctx->nlast_block > 0) {
        size_t nleft;

        nleft = bl - ctx->nlast_block;
        if (dlen < nleft)
            nleft = dlen;
        memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
        dlen -= nleft;
        ctx->nlast_block += (int)nleft;
        /* If no more to process return */
        if (dlen == 0)
            return 1;
        data += nleft;
        /* Else not final block so encrypt it */
        if (EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl) <= 0)
            return 0;
    }
    /* Encrypt all but one of the complete blocks left */

    max_burst_blocks = LOCAL_BUF_SIZE / bl;
    cipher_blocks = (dlen - 1) / bl;
    if (max_burst_blocks == 0) {
        /*
         * When block length is greater than local buffer size,
         * use ctx->tbl as cipher output.
         */
        while (dlen > (size_t)bl) {
            if (EVP_Cipher(ctx->cctx, ctx->tbl, data, bl) <= 0)
                return 0;
            dlen -= bl;
            data += bl;
        }
    } else {
        while (cipher_blocks > max_burst_blocks) {
            if (EVP_Cipher(ctx->cctx, buf, data, (int)(max_burst_blocks * bl)) <= 0)
                return 0;
            dlen -= max_burst_blocks * bl;
            data += max_burst_blocks * bl;
            cipher_blocks -= max_burst_blocks;
        }
        if (cipher_blocks > 0) {
            if (EVP_Cipher(ctx->cctx, buf, data, (int)(cipher_blocks * bl)) <= 0)
                return 0;
            dlen -= cipher_blocks * bl;
            data += cipher_blocks * bl;
            memcpy(ctx->tbl, &buf[(cipher_blocks - 1) * bl], bl);
        }
    }
    /* Copy any data left to last block buffer */
    memcpy(ctx->last_block, data, dlen);
    ctx->nlast_block = (int)dlen;
    return 1;
}

int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
{
    int i, bl, lb;

    if (ctx->nlast_block == -1)
        return 0;
    if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
        return 0;
    if (poutlen != NULL)
        *poutlen = (size_t)bl;
    if (!out)
        return 1;
    lb = ctx->nlast_block;
    /* Is last block complete? */
    if (lb == bl) {
        for (i = 0; i < bl; i++)
            out[i] = ctx->last_block[i] ^ ctx->k1[i];
    } else {
        ctx->last_block[lb] = 0x80;
        if (bl - lb > 1)
            memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
        for (i = 0; i < bl; i++)
            out[i] = ctx->last_block[i] ^ ctx->k2[i];
    }
    if (EVP_Cipher(ctx->cctx, out, out, bl) <= 0) {
        OPENSSL_cleanse(out, bl);
        return 0;
    }
    return 1;
}

int CMAC_resume(CMAC_CTX *ctx)
{
    if (ctx->nlast_block == -1)
        return 0;
    /*
     * The buffer "tbl" contains the last fully encrypted block which is the
     * last IV (or all zeroes if no last encrypted block). The last block has
     * not been modified since CMAC_final(). So reinitialising using the last
     * decrypted block will allow CMAC to continue after calling
     * CMAC_Final().
     */
    return EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, ctx->tbl);
}

Coverage Report

Created: 2026-02-14 07:20

Line	Count	Source
1		/*
2		* Copyright 2010-2025 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		/*
11		* CMAC low level APIs are deprecated for public use, but still ok for internal
12		* use.
13		*/
14		#include "internal/deprecated.h"
15
16		#include <stdio.h>
17		#include <stdlib.h>
18		#include <string.h>
19		#include "internal/cryptlib.h"
20		#include <openssl/cmac.h>
21		#include <openssl/err.h>
22		#include "crypto/cmac.h"
23
24	1.12k	#define LOCAL_BUF_SIZE 2048
25		struct CMAC_CTX_st {
26		/* Cipher context to use */
27		EVP_CIPHER_CTX *cctx;
28		/* Keys k1 and k2 */
29		unsigned char k1[EVP_MAX_BLOCK_LENGTH];
30		unsigned char k2[EVP_MAX_BLOCK_LENGTH];
31		/* Temporary block */
32		unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
33		/* Last (possibly partial) block */
34		unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
35		/* Number of bytes in last block: -1 means context not initialised */
36		int nlast_block;
37		};
38
39		/* Make temporary keys K1 and K2 */
40
41		static void make_kn(unsigned char k1, const unsigned char l, int bl)
42	604	{
43	604	int i;
44	604	unsigned char c = l[0], carry = c >> 7, cnext;
45
46		/* Shift block to left, including carry */
47	8.56k	for (i = 0; i < bl - 1; i++, c = cnext)
48	7.95k	k1[i] = (c << 1) \| ((cnext = l[i + 1]) >> 7);
49
50		/* If MSB set fixup with R */
51	604	k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
52	604	}
53
54		CMAC_CTX *CMAC_CTX_new(void)
55	833	{
56	833	CMAC_CTX *ctx;
57
58	833	if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL)
59	0	return NULL;
60	833	ctx->cctx = EVP_CIPHER_CTX_new();
61	833	if (ctx->cctx == NULL) {
62	0	OPENSSL_free(ctx);
63	0	return NULL;
64	0	}
65	833	ctx->nlast_block = -1;
66	833	return ctx;
67	833	}
68
69		void CMAC_CTX_cleanup(CMAC_CTX *ctx)
70	833	{
71	833	EVP_CIPHER_CTX_reset(ctx->cctx);
72	833	OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
73	833	OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
74	833	OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);
75	833	OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
76	833	ctx->nlast_block = -1;
77	833	}
78
79		EVP_CIPHER_CTX CMAC_CTX_get0_cipher_ctx(CMAC_CTX ctx)
80	547	{
81	547	return ctx->cctx;
82	547	}
83
84		void CMAC_CTX_free(CMAC_CTX *ctx)
85	833	{
86	833	if (!ctx)
87	0	return;
88	833	CMAC_CTX_cleanup(ctx);
89	833	EVP_CIPHER_CTX_free(ctx->cctx);
90	833	OPENSSL_free(ctx);
91	833	}
92
93		int CMAC_CTX_copy(CMAC_CTX out, const CMAC_CTX in)
94	376	{
95	376	int bl;
96
97	376	if (in->nlast_block == -1)
98	0	return 0;
99	376	if ((bl = EVP_CIPHER_CTX_get_block_size(in->cctx)) == 0)
100	0	return 0;
101	376	if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
102	0	return 0;
103	376	memcpy(out->k1, in->k1, bl);
104	376	memcpy(out->k2, in->k2, bl);
105	376	memcpy(out->tbl, in->tbl, bl);
106	376	memcpy(out->last_block, in->last_block, bl);
107	376	out->nlast_block = in->nlast_block;
108	376	return 1;
109	376	}
110
111		int ossl_cmac_init(CMAC_CTX ctx, const void key, size_t keylen,
112		const EVP_CIPHER cipher, ENGINE impl,
113		const OSSL_PARAM param[])
114	199	{
115	199	static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
116	199	int block_len;
117
118		/* All zeros means restart */
119	199	if (!key && !cipher && !impl && keylen == 0) {
120		/* Not initialised */
121	0	if (ctx->nlast_block == -1)
122	0	return 0;
123	0	if (!EVP_EncryptInit_ex2(ctx->cctx, NULL, NULL, zero_iv, param))
124	0	return 0;
125	0	block_len = EVP_CIPHER_CTX_get_block_size(ctx->cctx);
126	0	if (block_len == 0)
127	0	return 0;
128	0	memset(ctx->tbl, 0, block_len);
129	0	ctx->nlast_block = 0;
130	0	return 1;
131	0	}
132		/* Initialise context */
133	199	if (cipher != NULL) {
134		/* Ensure we can't use this ctx until we also have a key */
135	116	ctx->nlast_block = -1;
136	116	if (impl != NULL) {
137	0	if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
138	0	return 0;
139	116	} else {
140	116	if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param))
141	0	return 0;
142	116	}
143	116	}
144		/* Non-NULL key means initialisation complete */
145	199	if (key != NULL) {
146	199	int bl;
147
148		/* If anything fails then ensure we can't use this ctx */
149	199	ctx->nlast_block = -1;
150	199	if (EVP_CIPHER_CTX_get0_cipher(ctx->cctx) == NULL)
151	3	return 0;
152	196	if (keylen > INT_MAX
153	196	\|\| EVP_CIPHER_CTX_set_key_length(ctx->cctx, (int)keylen) <= 0)
154	50	return 0;
155	146	if (!EVP_EncryptInit_ex2(ctx->cctx, NULL, key, zero_iv, param))
156	0	return 0;
157	146	if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) < 0)
158	0	return 0;
159	146	if (EVP_Cipher(ctx->cctx, ctx->tbl, zero_iv, bl) <= 0)
160	0	return 0;
161	146	make_kn(ctx->k1, ctx->tbl, bl);
162	146	make_kn(ctx->k2, ctx->k1, bl);
163	146	OPENSSL_cleanse(ctx->tbl, bl);
164		/* Reset context again ready for first data block */
165	146	if (!EVP_EncryptInit_ex2(ctx->cctx, NULL, NULL, zero_iv, param))
166	0	return 0;
167		/* Zero tbl so resume works */
168	146	memset(ctx->tbl, 0, bl);
169	146	ctx->nlast_block = 0;
170	146	}
171	146	return 1;
172	199	}
173
174		int CMAC_Init(CMAC_CTX ctx, const void key, size_t keylen,
175		const EVP_CIPHER cipher, ENGINE impl)
176	0	{
177	0	return ossl_cmac_init(ctx, key, keylen, cipher, impl, NULL);
178	0	}
179
180		int CMAC_Update(CMAC_CTX ctx, const void in, size_t dlen)
181	1.56k	{
182	1.56k	const unsigned char *data = in;
183	1.56k	int bl;
184	1.56k	size_t max_burst_blocks, cipher_blocks;
185	1.56k	unsigned char buf[LOCAL_BUF_SIZE];
186
187	1.56k	if (ctx->nlast_block == -1)
188	0	return 0;
189	1.56k	if (dlen == 0)
190	62	return 1;
191	1.50k	if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
192	0	return 0;
193		/* Copy into partial block if we need to */
194	1.50k	if (ctx->nlast_block > 0) {
195	1.12k	size_t nleft;
196
197	1.12k	nleft = bl - ctx->nlast_block;
198	1.12k	if (dlen < nleft)
199	322	nleft = dlen;
200	1.12k	memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
201	1.12k	dlen -= nleft;
202	1.12k	ctx->nlast_block += (int)nleft;
203		/* If no more to process return */
204	1.12k	if (dlen == 0)
205	376	return 1;
206	748	data += nleft;
207		/* Else not final block so encrypt it */
208	748	if (EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl) <= 0)
209	0	return 0;
210	748	}
211		/* Encrypt all but one of the complete blocks left */
212
213	1.12k	max_burst_blocks = LOCAL_BUF_SIZE / bl;
214	1.12k	cipher_blocks = (dlen - 1) / bl;
215	1.12k	if (max_burst_blocks == 0) {
216		/*
217		* When block length is greater than local buffer size,
218		* use ctx->tbl as cipher output.
219		*/
220	0	while (dlen > (size_t)bl) {
221	0	if (EVP_Cipher(ctx->cctx, ctx->tbl, data, bl) <= 0)
222	0	return 0;
223	0	dlen -= bl;
224	0	data += bl;
225	0	}
226	1.12k	} else {
227	6.17k	while (cipher_blocks > max_burst_blocks) {
228	5.04k	if (EVP_Cipher(ctx->cctx, buf, data, (int)(max_burst_blocks * bl)) <= 0)
229	0	return 0;
230	5.04k	dlen -= max_burst_blocks * bl;
231	5.04k	data += max_burst_blocks * bl;
232	5.04k	cipher_blocks -= max_burst_blocks;
233	5.04k	}
234	1.12k	if (cipher_blocks > 0) {
235	544	if (EVP_Cipher(ctx->cctx, buf, data, (int)(cipher_blocks * bl)) <= 0)
236	0	return 0;
237	544	dlen -= cipher_blocks * bl;
238	544	data += cipher_blocks * bl;
239	544	memcpy(ctx->tbl, &buf[(cipher_blocks - 1) * bl], bl);
240	544	}
241	1.12k	}
242		/* Copy any data left to last block buffer */
243	1.12k	memcpy(ctx->last_block, data, dlen);
244	1.12k	ctx->nlast_block = (int)dlen;
245	1.12k	return 1;
246	1.12k	}
247
248		int CMAC_Final(CMAC_CTX ctx, unsigned char out, size_t *poutlen)
249	376	{
250	376	int i, bl, lb;
251
252	376	if (ctx->nlast_block == -1)
253	0	return 0;
254	376	if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
255	0	return 0;
256	376	if (poutlen != NULL)
257	376	*poutlen = (size_t)bl;
258	376	if (!out)
259	0	return 1;
260	376	lb = ctx->nlast_block;
261		/* Is last block complete? */
262	376	if (lb == bl) {
263	520	for (i = 0; i < bl; i++)
264	480	out[i] = ctx->last_block[i] ^ ctx->k1[i];
265	336	} else {
266	336	ctx->last_block[lb] = 0x80;
267	336	if (bl - lb > 1)
268	304	memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
269	4.88k	for (i = 0; i < bl; i++)
270	4.54k	out[i] = ctx->last_block[i] ^ ctx->k2[i];
271	336	}
272	376	if (EVP_Cipher(ctx->cctx, out, out, bl) <= 0) {
273	0	OPENSSL_cleanse(out, bl);
274	0	return 0;
275	0	}
276	376	return 1;
277	376	}
278
279		int CMAC_resume(CMAC_CTX *ctx)
280	0	{
281	0	if (ctx->nlast_block == -1)
282	0	return 0;
283		/*
284		* The buffer "tbl" contains the last fully encrypted block which is the
285		* last IV (or all zeroes if no last encrypted block). The last block has
286		* not been modified since CMAC_final(). So reinitialising using the last
287		* decrypted block will allow CMAC to continue after calling
288		* CMAC_Final().
289		*/
290	0	return EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, ctx->tbl);
291	0	}