[thirdparty/openssl.git] / crypto / cmac / cmac.c

/*
 * Copyright 2010-2024 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*
 * CMAC low level APIs are deprecated for public use, but still ok for internal
 * use.
 */
#include "internal/deprecated.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "internal/cryptlib.h"
#include <openssl/cmac.h>
#include <openssl/err.h>

#define LOCAL_BUF_SIZE 2048
struct CMAC_CTX_st {
    /* Cipher context to use */
    EVP_CIPHER_CTX *cctx;
    /* Keys k1 and k2 */
    unsigned char k1[EVP_MAX_BLOCK_LENGTH];
    unsigned char k2[EVP_MAX_BLOCK_LENGTH];
    /* Temporary block */
    unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
    /* Last (possibly partial) block */
    unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
    /* Number of bytes in last block: -1 means context not initialised */
    int nlast_block;
};

/* Make temporary keys K1 and K2 */

static void make_kn(unsigned char *k1, const unsigned char *l, int bl)
{
    int i;
    unsigned char c = l[0], carry = c >> 7, cnext;

    /* Shift block to left, including carry */
    for (i = 0; i < bl - 1; i++, c = cnext)
        k1[i] = (c << 1) | ((cnext = l[i + 1]) >> 7);

    /* If MSB set fixup with R */
    k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
}

CMAC_CTX *CMAC_CTX_new(void)
{
    CMAC_CTX *ctx;

    if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL)
        return NULL;
    ctx->cctx = EVP_CIPHER_CTX_new();
    if (ctx->cctx == NULL) {
        OPENSSL_free(ctx);
        return NULL;
    }
    ctx->nlast_block = -1;
    return ctx;
}

void CMAC_CTX_cleanup(CMAC_CTX *ctx)
{
    EVP_CIPHER_CTX_reset(ctx->cctx);
    OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);
    OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
    ctx->nlast_block = -1;
}

EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx)
{
    return ctx->cctx;
}

void CMAC_CTX_free(CMAC_CTX *ctx)
{
    if (!ctx)
        return;
    CMAC_CTX_cleanup(ctx);
    EVP_CIPHER_CTX_free(ctx->cctx);
    OPENSSL_free(ctx);
}

int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in)
{
    int bl;

    if (in->nlast_block == -1)
        return 0;
    if ((bl = EVP_CIPHER_CTX_get_block_size(in->cctx)) == 0)
        return 0;
    if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
        return 0;
    memcpy(out->k1, in->k1, bl);
    memcpy(out->k2, in->k2, bl);
    memcpy(out->tbl, in->tbl, bl);
    memcpy(out->last_block, in->last_block, bl);
    out->nlast_block = in->nlast_block;
    return 1;
}

int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
              const EVP_CIPHER *cipher, ENGINE *impl)
{
    static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
    int block_len;

    /* All zeros means restart */
    if (!key && !cipher && !impl && keylen == 0) {
        /* Not initialised */
        if (ctx->nlast_block == -1)
            return 0;
        if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
            return 0;
        block_len = EVP_CIPHER_CTX_get_block_size(ctx->cctx);
        if (block_len == 0)
            return 0;
        memset(ctx->tbl, 0, block_len);
        ctx->nlast_block = 0;
        return 1;
    }
    /* Initialise context */
    if (cipher != NULL) {
        /* Ensure we can't use this ctx until we also have a key */
        ctx->nlast_block = -1;
        if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
            return 0;
    }
    /* Non-NULL key means initialisation complete */
    if (key != NULL) {
        int bl;

        /* If anything fails then ensure we can't use this ctx */
        ctx->nlast_block = -1;
        if (EVP_CIPHER_CTX_get0_cipher(ctx->cctx) == NULL)
            return 0;
        if (EVP_CIPHER_CTX_set_key_length(ctx->cctx, keylen) <= 0)
            return 0;
        if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, key, zero_iv))
            return 0;
        if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) < 0)
            return 0;
        if (EVP_Cipher(ctx->cctx, ctx->tbl, zero_iv, bl) <= 0)
            return 0;
        make_kn(ctx->k1, ctx->tbl, bl);
        make_kn(ctx->k2, ctx->k1, bl);
        OPENSSL_cleanse(ctx->tbl, bl);
        /* Reset context again ready for first data block */
        if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
            return 0;
        /* Zero tbl so resume works */
        memset(ctx->tbl, 0, bl);
        ctx->nlast_block = 0;
    }
    return 1;
}

int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)
{
    const unsigned char *data = in;
    int bl;
    size_t max_burst_blocks, cipher_blocks;
    unsigned char buf[LOCAL_BUF_SIZE];

    if (ctx->nlast_block == -1)
        return 0;
    if (dlen == 0)
        return 1;
    if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
        return 0;
    /* Copy into partial block if we need to */
    if (ctx->nlast_block > 0) {
        size_t nleft;

        nleft = bl - ctx->nlast_block;
        if (dlen < nleft)
            nleft = dlen;
        memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
        dlen -= nleft;
        ctx->nlast_block += nleft;
        /* If no more to process return */
        if (dlen == 0)
            return 1;
        data += nleft;
        /* Else not final block so encrypt it */
        if (EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl) <= 0)
            return 0;
    }
    /* Encrypt all but one of the complete blocks left */

    max_burst_blocks = LOCAL_BUF_SIZE / bl;
    cipher_blocks = (dlen - 1) / bl;
    if (max_burst_blocks == 0) {
        /*
         * When block length is greater than local buffer size,
         * use ctx->tbl as cipher output.
         */
        while (dlen > (size_t)bl) {
            if (EVP_Cipher(ctx->cctx, ctx->tbl, data, bl) <= 0)
                return 0;
            dlen -= bl;
            data += bl;
        }
    } else {
        while (cipher_blocks > max_burst_blocks) {
            if (EVP_Cipher(ctx->cctx, buf, data, max_burst_blocks * bl) <= 0)
                return 0;
            dlen -= max_burst_blocks * bl;
            data += max_burst_blocks * bl;
            cipher_blocks -= max_burst_blocks;
        }
        if (cipher_blocks > 0) {
            if (EVP_Cipher(ctx->cctx, buf, data, cipher_blocks * bl) <= 0)
                return 0;
            dlen -= cipher_blocks * bl;
            data += cipher_blocks * bl;
            memcpy(ctx->tbl, &buf[(cipher_blocks - 1) * bl], bl);
        }
    }
    /* Copy any data left to last block buffer */
    memcpy(ctx->last_block, data, dlen);
    ctx->nlast_block = dlen;
    return 1;

}

int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen)
{
    int i, bl, lb;

    if (ctx->nlast_block == -1)
        return 0;
    if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
        return 0;
    if (poutlen != NULL)
        *poutlen = (size_t)bl;
    if (!out)
        return 1;
    lb = ctx->nlast_block;
    /* Is last block complete? */
    if (lb == bl) {
        for (i = 0; i < bl; i++)
            out[i] = ctx->last_block[i] ^ ctx->k1[i];
    } else {
        ctx->last_block[lb] = 0x80;
        if (bl - lb > 1)
            memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
        for (i = 0; i < bl; i++)
            out[i] = ctx->last_block[i] ^ ctx->k2[i];
    }
    if (EVP_Cipher(ctx->cctx, out, out, bl) <= 0) {
        OPENSSL_cleanse(out, bl);
        return 0;
    }
    return 1;
}

int CMAC_resume(CMAC_CTX *ctx)
{
    if (ctx->nlast_block == -1)
        return 0;
    /*
     * The buffer "tbl" contains the last fully encrypted block which is the
     * last IV (or all zeroes if no last encrypted block). The last block has
     * not been modified since CMAC_final(). So reinitialising using the last
     * decrypted block will allow CMAC to continue after calling
     * CMAC_Final().
     */
    return EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, ctx->tbl);
}
Commit	Line	Data
0f113f3e	1	/*
b6461792	2	* Copyright 2010-2024 The OpenSSL Project Authors. All Rights Reserved.
8c968e03	3	*
8de396f8	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
4f22f405 RS	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
8c968e03 DSH	8	*/
8c968e03 DSH	9
a6d572e6 P	10	/*
	11	* CMAC low level APIs are deprecated for public use, but still ok for internal
	12	* use.
	13	*/
	14	#include "internal/deprecated.h"
	15
8c968e03 DSH	16	#include <stdio.h>
	17	#include <stdlib.h>
	18	#include <string.h>
b39fc560	19	#include "internal/cryptlib.h"
8c968e03	20	#include <openssl/cmac.h>
7de2b9c4	21	#include <openssl/err.h>
8c968e03	22
dc19f2f6	23	#define LOCAL_BUF_SIZE 2048
0f113f3e MC	24	struct CMAC_CTX_st {
0f113f3e MC	25	/* Cipher context to use */
846ec07d	26	EVP_CIPHER_CTX *cctx;
0f113f3e MC	27	/* Keys k1 and k2 */
	28	unsigned char k1[EVP_MAX_BLOCK_LENGTH];
	29	unsigned char k2[EVP_MAX_BLOCK_LENGTH];
	30	/* Temporary block */
	31	unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
	32	/* Last (possibly partial) block */
	33	unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
	34	/* Number of bytes in last block: -1 means context not initialised */
	35	int nlast_block;
	36	};
8c968e03 DSH	37
	38	/* Make temporary keys K1 and K2 */
	39
03cf7e78	40	static void make_kn(unsigned char k1, const unsigned char l, int bl)
0f113f3e MC	41	{
	42	int i;
	43	unsigned char c = l[0], carry = c >> 7, cnext;
03cf7e78	44
0f113f3e MC	45	/* Shift block to left, including carry */
	46	for (i = 0; i < bl - 1; i++, c = cnext)
	47	k1[i] = (c << 1) \| ((cnext = l[i + 1]) >> 7);
03cf7e78	48
0f113f3e MC	49	/* If MSB set fixup with R */
	50	k1[i] = (c << 1) ^ ((0 - carry) & (bl == 16 ? 0x87 : 0x1b));
	51	}
8c968e03 DSH	52
8c968e03 DSH	53	CMAC_CTX *CMAC_CTX_new(void)
0f113f3e MC	54	{
0f113f3e MC	55	CMAC_CTX *ctx;
b4faea50	56
e077455e	57	if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL)
0f113f3e	58	return NULL;
846ec07d RL	59	ctx->cctx = EVP_CIPHER_CTX_new();
	60	if (ctx->cctx == NULL) {
	61	OPENSSL_free(ctx);
	62	return NULL;
	63	}
0f113f3e MC	64	ctx->nlast_block = -1;
	65	return ctx;
	66	}
8c968e03 DSH	67
8c968e03 DSH	68	void CMAC_CTX_cleanup(CMAC_CTX *ctx)
0f113f3e	69	{
15d95dd7	70	EVP_CIPHER_CTX_reset(ctx->cctx);
0f113f3e MC	71	OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
	72	OPENSSL_cleanse(ctx->k1, EVP_MAX_BLOCK_LENGTH);
	73	OPENSSL_cleanse(ctx->k2, EVP_MAX_BLOCK_LENGTH);
	74	OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
	75	ctx->nlast_block = -1;
	76	}
8c968e03 DSH	77
8c968e03 DSH	78	EVP_CIPHER_CTX CMAC_CTX_get0_cipher_ctx(CMAC_CTX ctx)
0f113f3e	79	{
846ec07d	80	return ctx->cctx;
0f113f3e	81	}
8c968e03 DSH	82
8c968e03 DSH	83	void CMAC_CTX_free(CMAC_CTX *ctx)
0f113f3e	84	{
efa7dd64 RS	85	if (!ctx)
efa7dd64 RS	86	return;
0f113f3e	87	CMAC_CTX_cleanup(ctx);
5c6c4c5c	88	EVP_CIPHER_CTX_free(ctx->cctx);
0f113f3e MC	89	OPENSSL_free(ctx);
0f113f3e MC	90	}
8c968e03	91
c8ef656d	92	int CMAC_CTX_copy(CMAC_CTX out, const CMAC_CTX in)
0f113f3e MC	93	{
0f113f3e MC	94	int bl;
d5f85429	95
0f113f3e MC	96	if (in->nlast_block == -1)
0f113f3e MC	97	return 0;
6f22bcd6	98	if ((bl = EVP_CIPHER_CTX_get_block_size(in->cctx)) == 0)
d5f85429	99	return 0;
846ec07d	100	if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
0f113f3e	101	return 0;
0f113f3e MC	102	memcpy(out->k1, in->k1, bl);
	103	memcpy(out->k2, in->k2, bl);
	104	memcpy(out->tbl, in->tbl, bl);
	105	memcpy(out->last_block, in->last_block, bl);
	106	out->nlast_block = in->nlast_block;
	107	return 1;
	108	}
c8ef656d	109
0f113f3e MC	110	int CMAC_Init(CMAC_CTX ctx, const void key, size_t keylen,
	111	const EVP_CIPHER cipher, ENGINE impl)
	112	{
	113	static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
6f22bcd6	114	int block_len;
d5f85429	115
0f113f3e MC	116	/* All zeros means restart */
	117	if (!key && !cipher && !impl && keylen == 0) {
	118	/* Not initialised */
	119	if (ctx->nlast_block == -1)
	120	return 0;
846ec07d	121	if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
0f113f3e	122	return 0;
6f22bcd6 NH	123	block_len = EVP_CIPHER_CTX_get_block_size(ctx->cctx);
	124	if (block_len == 0)
	125	return 0;
	126	memset(ctx->tbl, 0, block_len);
0f113f3e MC	127	ctx->nlast_block = 0;
	128	return 1;
	129	}
0d4fb843	130	/* Initialise context */
b896d943 MC	131	if (cipher != NULL) {
	132	/* Ensure we can't use this ctx until we also have a key */
	133	ctx->nlast_block = -1;
	134	if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
	135	return 0;
	136	}
0f113f3e	137	/* Non-NULL key means initialisation complete */
b896d943	138	if (key != NULL) {
0f113f3e	139	int bl;
d5f85429	140
b896d943 MC	141	/* If anything fails then ensure we can't use this ctx */
b896d943 MC	142	ctx->nlast_block = -1;
8d9fec17	143	if (EVP_CIPHER_CTX_get0_cipher(ctx->cctx) == NULL)
0f113f3e	144	return 0;
8d9fec17	145	if (EVP_CIPHER_CTX_set_key_length(ctx->cctx, keylen) <= 0)
0f113f3e	146	return 0;
846ec07d	147	if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, key, zero_iv))
0f113f3e	148	return 0;
ed576acd	149	if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) < 0)
d5f85429	150	return 0;
154ea425	151	if (EVP_Cipher(ctx->cctx, ctx->tbl, zero_iv, bl) <= 0)
0f113f3e MC	152	return 0;
	153	make_kn(ctx->k1, ctx->tbl, bl);
	154	make_kn(ctx->k2, ctx->k1, bl);
	155	OPENSSL_cleanse(ctx->tbl, bl);
	156	/* Reset context again ready for first data block */
846ec07d	157	if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
0f113f3e MC	158	return 0;
	159	/* Zero tbl so resume works */
	160	memset(ctx->tbl, 0, bl);
	161	ctx->nlast_block = 0;
	162	}
	163	return 1;
	164	}
8c968e03 DSH	165
8c968e03 DSH	166	int CMAC_Update(CMAC_CTX ctx, const void in, size_t dlen)
0f113f3e MC	167	{
0f113f3e MC	168	const unsigned char *data = in;
d5f85429	169	int bl;
dc19f2f6	170	size_t max_burst_blocks, cipher_blocks;
dc19f2f6	171	unsigned char buf[LOCAL_BUF_SIZE];
d5f85429	172
0f113f3e MC	173	if (ctx->nlast_block == -1)
	174	return 0;
	175	if (dlen == 0)
	176	return 1;
6f22bcd6	177	if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
d5f85429	178	return 0;
0f113f3e MC	179	/* Copy into partial block if we need to */
	180	if (ctx->nlast_block > 0) {
	181	size_t nleft;
d5f85429	182
0f113f3e MC	183	nleft = bl - ctx->nlast_block;
	184	if (dlen < nleft)
	185	nleft = dlen;
	186	memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
	187	dlen -= nleft;
	188	ctx->nlast_block += nleft;
	189	/* If no more to process return */
	190	if (dlen == 0)
	191	return 1;
	192	data += nleft;
	193	/* Else not final block so encrypt it */
154ea425	194	if (EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl) <= 0)
0f113f3e MC	195	return 0;
	196	}
	197	/* Encrypt all but one of the complete blocks left */
dc19f2f6	198
	199	max_burst_blocks = LOCAL_BUF_SIZE / bl;
	200	cipher_blocks = (dlen - 1) / bl;
	201	if (max_burst_blocks == 0) {
	202	/*
e8dc77f8	203	* When block length is greater than local buffer size,
dc19f2f6	204	* use ctx->tbl as cipher output.
	205	*/
	206	while (dlen > (size_t)bl) {
	207	if (EVP_Cipher(ctx->cctx, ctx->tbl, data, bl) <= 0)
	208	return 0;
	209	dlen -= bl;
	210	data += bl;
	211	}
	212	} else {
	213	while (cipher_blocks > max_burst_blocks) {
	214	if (EVP_Cipher(ctx->cctx, buf, data, max_burst_blocks * bl) <= 0)
	215	return 0;
	216	dlen -= max_burst_blocks * bl;
	217	data += max_burst_blocks * bl;
	218	cipher_blocks -= max_burst_blocks;
	219	}
	220	if (cipher_blocks > 0) {
	221	if (EVP_Cipher(ctx->cctx, buf, data, cipher_blocks * bl) <= 0)
	222	return 0;
	223	dlen -= cipher_blocks * bl;
	224	data += cipher_blocks * bl;
	225	memcpy(ctx->tbl, &buf[(cipher_blocks - 1) * bl], bl);
	226	}
0f113f3e MC	227	}
	228	/* Copy any data left to last block buffer */
	229	memcpy(ctx->last_block, data, dlen);
	230	ctx->nlast_block = dlen;
	231	return 1;
8c968e03	232
0f113f3e	233	}
8c968e03	234
c8ef656d	235	int CMAC_Final(CMAC_CTX ctx, unsigned char out, size_t *poutlen)
0f113f3e MC	236	{
0f113f3e MC	237	int i, bl, lb;
d5f85429	238
0f113f3e MC	239	if (ctx->nlast_block == -1)
0f113f3e MC	240	return 0;
6f22bcd6	241	if ((bl = EVP_CIPHER_CTX_get_block_size(ctx->cctx)) == 0)
d5f85429	242	return 0;
f6dead1b RH	243	if (poutlen != NULL)
f6dead1b RH	244	*poutlen = (size_t)bl;
0f113f3e MC	245	if (!out)
	246	return 1;
	247	lb = ctx->nlast_block;
	248	/* Is last block complete? */
	249	if (lb == bl) {
	250	for (i = 0; i < bl; i++)
	251	out[i] = ctx->last_block[i] ^ ctx->k1[i];
	252	} else {
	253	ctx->last_block[lb] = 0x80;
	254	if (bl - lb > 1)
	255	memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
	256	for (i = 0; i < bl; i++)
	257	out[i] = ctx->last_block[i] ^ ctx->k2[i];
	258	}
6d774732	259	if (EVP_Cipher(ctx->cctx, out, out, bl) <= 0) {
0f113f3e MC	260	OPENSSL_cleanse(out, bl);
	261	return 0;
	262	}
	263	return 1;
	264	}
c8ef656d DSH	265
c8ef656d DSH	266	int CMAC_resume(CMAC_CTX *ctx)
0f113f3e MC	267	{
	268	if (ctx->nlast_block == -1)
	269	return 0;
	270	/*
0d4fb843	271	* The buffer "tbl" contains the last fully encrypted block which is the
0f113f3e	272	* last IV (or all zeroes if no last encrypted block). The last block has
0d4fb843	273	* not been modified since CMAC_final(). So reinitialising using the last
0f113f3e MC	274	* decrypted block will allow CMAC to continue after calling
	275	* CMAC_Final().
	276	*/
512fdfdf	277	return EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, ctx->tbl);
0f113f3e	278	}