[thirdparty/openssl.git] / crypto / rand / drbg_hmac.c

/*
 * Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdlib.h>
#include <string.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include "internal/thread_once.h"
#include "rand_lcl.h"

/*
 * Called twice by SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process.
 *
 * hmac is an object that holds the input/output Key and Value (K and V).
 * inbyte is 0x00 on the first call and 0x01 on the second call.
 * in1, in2, in3 are optional inputs that can be NULL.
 * in1len, in2len, in3len are the lengths of the input buffers.
 *
 * The returned K,V is:
 *   hmac->K = HMAC(hmac->K, hmac->V || inbyte || [in1] || [in2] || [in3])
 *   hmac->V = HMAC(hmac->K, hmac->V)
 *
 * Returns zero if an error occurs otherwise it returns 1.
 */
static int do_hmac(RAND_DRBG_HMAC *hmac, unsigned char inbyte,
                   const unsigned char *in1, size_t in1len,
                   const unsigned char *in2, size_t in2len,
                   const unsigned char *in3, size_t in3len)
{
    HMAC_CTX *ctx = hmac->ctx;

    return HMAC_Init_ex(ctx, hmac->K, hmac->blocklen, hmac->md, NULL)
           /* K = HMAC(K, V || inbyte || [in1] || [in2] || [in3]) */
           && HMAC_Update(ctx, hmac->V, hmac->blocklen)
           && HMAC_Update(ctx, &inbyte, 1)
           && (in1 == NULL || in1len == 0 || HMAC_Update(ctx, in1, in1len))
           && (in2 == NULL || in2len == 0 || HMAC_Update(ctx, in2, in2len))
           && (in3 == NULL || in3len == 0 || HMAC_Update(ctx, in3, in3len))
           && HMAC_Final(ctx, hmac->K, NULL)
           /* V = HMAC(K, V) */
           && HMAC_Init_ex(ctx, hmac->K, hmac->blocklen, hmac->md, NULL)
           && HMAC_Update(ctx, hmac->V, hmac->blocklen)
           && HMAC_Final(ctx, hmac->V, NULL);
}

/*
 * SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process
 *
 *
 * Updates the drbg objects Key(K) and Value(V) using the following algorithm:
 *   K,V = do_hmac(hmac, 0, in1, in2, in3)
 *   if (any input is not NULL)
 *     K,V = do_hmac(hmac, 1, in1, in2, in3)
 *
 * where in1, in2, in3 are optional input buffers that can be NULL.
 *       in1len, in2len, in3len are the lengths of the input buffers.
 *
 * Returns zero if an error occurs otherwise it returns 1.
 */
static int drbg_hmac_update(RAND_DRBG *drbg,
                            const unsigned char *in1, size_t in1len,
                            const unsigned char *in2, size_t in2len,
                            const unsigned char *in3, size_t in3len)
{
    RAND_DRBG_HMAC *hmac = &drbg->data.hmac;

    /* (Steps 1-2) K = HMAC(K, V||0x00||provided_data). V = HMAC(K,V) */
    if (!do_hmac(hmac, 0x00, in1, in1len, in2, in2len, in3, in3len))
        return 0;
    /* (Step 3) If provided_data == NULL then return (K,V) */
    if (in1len == 0 && in2len == 0 && in3len == 0)
        return 1;
    /* (Steps 4-5) K = HMAC(K, V||0x01||provided_data). V = HMAC(K,V) */
    return do_hmac(hmac, 0x01, in1, in1len, in2, in2len, in3, in3len);
}

/*
 * SP800-90Ar1 10.1.2.3 HMAC_DRBG_Instantiate_Process:
 *
 * This sets the drbg Key (K) to all zeros, and Value (V) to all 1's.
 * and then calls (K,V) = drbg_hmac_update() with input parameters:
 *   ent = entropy data (Can be NULL) of length ent_len.
 *   nonce = nonce data (Can be NULL) of length nonce_len.
 *   pstr = personalization data (Can be NULL) of length pstr_len.
 *
 * Returns zero if an error occurs otherwise it returns 1.
 */
static int drbg_hmac_instantiate(RAND_DRBG *drbg,
                                 const unsigned char *ent, size_t ent_len,
                                 const unsigned char *nonce, size_t nonce_len,
                                 const unsigned char *pstr, size_t pstr_len)
{
    RAND_DRBG_HMAC *hmac = &drbg->data.hmac;

    /* (Step 2) Key = 0x00 00...00 */
    memset(hmac->K, 0x00, hmac->blocklen);
    /* (Step 3) V = 0x01 01...01 */
    memset(hmac->V, 0x01, hmac->blocklen);
    /* (Step 4) (K,V) = HMAC_DRBG_Update(entropy||nonce||pers string, K, V) */
    return drbg_hmac_update(drbg, ent, ent_len, nonce, nonce_len, pstr,
                            pstr_len);
}

/*
 * SP800-90Ar1 10.1.2.4 HMAC_DRBG_Reseed_Process:
 *
 * Reseeds the drbg's Key (K) and Value (V) by calling
 * (K,V) = drbg_hmac_update() with the following input parameters:
 *   ent = entropy input data (Can be NULL) of length ent_len.
 *   adin = additional input data (Can be NULL) of length adin_len.
 *
 * Returns zero if an error occurs otherwise it returns 1.
 */
static int drbg_hmac_reseed(RAND_DRBG *drbg,
                            const unsigned char *ent, size_t ent_len,
                            const unsigned char *adin, size_t adin_len)
{
    /* (Step 2) (K,V) = HMAC_DRBG_Update(entropy||additional_input, K, V) */
    return drbg_hmac_update(drbg, ent, ent_len, adin, adin_len, NULL, 0);
}

/*
 * SP800-90Ar1 10.1.2.5 HMAC_DRBG_Generate_Process:
 *
 * Generates pseudo random bytes and updates the internal K,V for the drbg.
 * out is a buffer to fill with outlen bytes of pseudo random data.
 * adin is an additional_input string of size adin_len that may be NULL.
 *
 * Returns zero if an error occurs otherwise it returns 1.
 */
static int drbg_hmac_generate(RAND_DRBG *drbg,
                              unsigned char *out, size_t outlen,
                              const unsigned char *adin, size_t adin_len)
{
    RAND_DRBG_HMAC *hmac = &drbg->data.hmac;
    HMAC_CTX *ctx = hmac->ctx;
    const unsigned char *temp = hmac->V;

    /* (Step 2) if adin != NULL then (K,V) = HMAC_DRBG_Update(adin, K, V) */
    if (adin != NULL
            && adin_len > 0
            && !drbg_hmac_update(drbg, adin, adin_len, NULL, 0, NULL, 0))
        return 0;

    /*
     * (Steps 3-5) temp = NULL
     *             while (len(temp) < outlen) {
     *                 V = HMAC(K, V)
     *                 temp = temp || V
     *             }
     */
    for (;;) {
        if (!HMAC_Init_ex(ctx, hmac->K, hmac->blocklen, hmac->md, NULL)
                || !HMAC_Update(ctx, temp, hmac->blocklen))
            return 0;

        if (outlen > hmac->blocklen) {
            if (!HMAC_Final(ctx, out, NULL))
                return 0;
            temp = out;
        } else {
            if (!HMAC_Final(ctx, hmac->V, NULL))
                return 0;
            memcpy(out, hmac->V, outlen);
            break;
        }
        out += hmac->blocklen;
        outlen -= hmac->blocklen;
    }
    /* (Step 6) (K,V) = HMAC_DRBG_Update(adin, K, V) */
    if (!drbg_hmac_update(drbg, adin, adin_len, NULL, 0, NULL, 0))
        return 0;

    return 1;
}

static int drbg_hmac_uninstantiate(RAND_DRBG *drbg)
{
    HMAC_CTX_free(drbg->data.hmac.ctx);
    OPENSSL_cleanse(&drbg->data.hmac, sizeof(drbg->data.hmac));
    return 1;
}

static RAND_DRBG_METHOD drbg_hmac_meth = {
    drbg_hmac_instantiate,
    drbg_hmac_reseed,
    drbg_hmac_generate,
    drbg_hmac_uninstantiate
};

int drbg_hmac_init(RAND_DRBG *drbg)
{
    const EVP_MD *md = NULL;
    RAND_DRBG_HMAC *hmac = &drbg->data.hmac;

    /* Any approved digest is allowed - assume we pass digest (not NID_hmac*) */
    md = EVP_get_digestbynid(drbg->type);
    if (md == NULL)
        return 0;

    drbg->meth = &drbg_hmac_meth;

    if (hmac->ctx == NULL) {
        hmac->ctx = HMAC_CTX_new();
        if (hmac->ctx == NULL)
            return 0;
    }

    /* These are taken from SP 800-90 10.1 Table 2 */
    hmac->md = md;
    hmac->blocklen = EVP_MD_size(md);
    /* See SP800-57 Part1 Rev4 5.6.1 Table 3 */
    drbg->strength = 64 * (int)(hmac->blocklen >> 3);
    if (drbg->strength > 256)
        drbg->strength = 256;
    drbg->seedlen = hmac->blocklen;

    drbg->min_entropylen = drbg->strength / 8;
    drbg->max_entropylen = DRBG_MAX_LENGTH;

    drbg->min_noncelen = drbg->min_entropylen / 2;
    drbg->max_noncelen = DRBG_MAX_LENGTH;

    drbg->max_perslen = DRBG_MAX_LENGTH;
    drbg->max_adinlen = DRBG_MAX_LENGTH;

    /* Maximum number of bits per request = 2^19 = 2^16 bytes*/
    drbg->max_request = 1 << 16;

    return 1;
}
Commit	Line	Data
8bf36651 SL	1	/*
	2	* Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
	3	*
	4	* Licensed under the OpenSSL license (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
	10	#include <stdlib.h>
	11	#include <string.h>
	12	#include <openssl/crypto.h>
	13	#include <openssl/err.h>
	14	#include <openssl/rand.h>
	15	#include "internal/thread_once.h"
	16	#include "rand_lcl.h"
	17
	18	/*
	19	* Called twice by SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process.
	20	*
	21	* hmac is an object that holds the input/output Key and Value (K and V).
	22	* inbyte is 0x00 on the first call and 0x01 on the second call.
	23	* in1, in2, in3 are optional inputs that can be NULL.
	24	* in1len, in2len, in3len are the lengths of the input buffers.
	25	*
	26	* The returned K,V is:
	27	* hmac->K = HMAC(hmac->K, hmac->V \|\| inbyte \|\| [in1] \|\| [in2] \|\| [in3])
	28	* hmac->V = HMAC(hmac->K, hmac->V)
	29	*
	30	* Returns zero if an error occurs otherwise it returns 1.
	31	*/
	32	static int do_hmac(RAND_DRBG_HMAC *hmac, unsigned char inbyte,
	33	const unsigned char *in1, size_t in1len,
	34	const unsigned char *in2, size_t in2len,
	35	const unsigned char *in3, size_t in3len)
	36	{
	37	HMAC_CTX *ctx = hmac->ctx;
	38
	39	return HMAC_Init_ex(ctx, hmac->K, hmac->blocklen, hmac->md, NULL)
	40	/* K = HMAC(K, V \|\| inbyte \|\| [in1] \|\| [in2] \|\| [in3]) */
	41	&& HMAC_Update(ctx, hmac->V, hmac->blocklen)
	42	&& HMAC_Update(ctx, &inbyte, 1)
	43	&& (in1 == NULL \|\| in1len == 0 \|\| HMAC_Update(ctx, in1, in1len))
	44	&& (in2 == NULL \|\| in2len == 0 \|\| HMAC_Update(ctx, in2, in2len))
	45	&& (in3 == NULL \|\| in3len == 0 \|\| HMAC_Update(ctx, in3, in3len))
	46	&& HMAC_Final(ctx, hmac->K, NULL)
	47	/* V = HMAC(K, V) */
	48	&& HMAC_Init_ex(ctx, hmac->K, hmac->blocklen, hmac->md, NULL)
	49	&& HMAC_Update(ctx, hmac->V, hmac->blocklen)
	50	&& HMAC_Final(ctx, hmac->V, NULL);
	51	}
	52
	53	/*
	54	* SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process
	55	*
	56	*
	57	* Updates the drbg objects Key(K) and Value(V) using the following algorithm:
	58	* K,V = do_hmac(hmac, 0, in1, in2, in3)
	59	* if (any input is not NULL)
	60	* K,V = do_hmac(hmac, 1, in1, in2, in3)
	61	*
	62	* where in1, in2, in3 are optional input buffers that can be NULL.
	63	* in1len, in2len, in3len are the lengths of the input buffers.
	64	*
65	* Returns zero if an error occurs otherwise it returns 1.
66	*/
67	static int drbg_hmac_update(RAND_DRBG *drbg,
68	const unsigned char *in1, size_t in1len,
69	const unsigned char *in2, size_t in2len,
70	const unsigned char *in3, size_t in3len)
71	{
72	RAND_DRBG_HMAC *hmac = &drbg->data.hmac;
73
74	/* (Steps 1-2) K = HMAC(K, V\|\|0x00\|\|provided_data). V = HMAC(K,V) */
75	if (!do_hmac(hmac, 0x00, in1, in1len, in2, in2len, in3, in3len))
76	return 0;
77	/* (Step 3) If provided_data == NULL then return (K,V) */
78	if (in1len == 0 && in2len == 0 && in3len == 0)
79	return 1;
80	/* (Steps 4-5) K = HMAC(K, V\|\|0x01\|\|provided_data). V = HMAC(K,V) */
81	return do_hmac(hmac, 0x01, in1, in1len, in2, in2len, in3, in3len);
82	}
83
84	/*
85	* SP800-90Ar1 10.1.2.3 HMAC_DRBG_Instantiate_Process:
86	*
87	* This sets the drbg Key (K) to all zeros, and Value (V) to all 1's.
88	* and then calls (K,V) = drbg_hmac_update() with input parameters:
89	* ent = entropy data (Can be NULL) of length ent_len.
90	* nonce = nonce data (Can be NULL) of length nonce_len.
91	* pstr = personalization data (Can be NULL) of length pstr_len.
92	*
93	* Returns zero if an error occurs otherwise it returns 1.
94	*/
95	static int drbg_hmac_instantiate(RAND_DRBG *drbg,
96	const unsigned char *ent, size_t ent_len,
97	const unsigned char *nonce, size_t nonce_len,
98	const unsigned char *pstr, size_t pstr_len)
99	{
100	RAND_DRBG_HMAC *hmac = &drbg->data.hmac;
101
102	/* (Step 2) Key = 0x00 00...00 */
103	memset(hmac->K, 0x00, hmac->blocklen);
104	/* (Step 3) V = 0x01 01...01 */
105	memset(hmac->V, 0x01, hmac->blocklen);
106	/* (Step 4) (K,V) = HMAC_DRBG_Update(entropy\|\|nonce\|\|pers string, K, V) */
107	return drbg_hmac_update(drbg, ent, ent_len, nonce, nonce_len, pstr,
108	pstr_len);
109	}
110
111	/*
112	* SP800-90Ar1 10.1.2.4 HMAC_DRBG_Reseed_Process:
113	*
114	* Reseeds the drbg's Key (K) and Value (V) by calling
115	* (K,V) = drbg_hmac_update() with the following input parameters:
116	* ent = entropy input data (Can be NULL) of length ent_len.
117	* adin = additional input data (Can be NULL) of length adin_len.
118	*
119	* Returns zero if an error occurs otherwise it returns 1.
120	*/
121	static int drbg_hmac_reseed(RAND_DRBG *drbg,
122	const unsigned char *ent, size_t ent_len,
123	const unsigned char *adin, size_t adin_len)
124	{
125	/* (Step 2) (K,V) = HMAC_DRBG_Update(entropy\|\|additional_input, K, V) */
126	return drbg_hmac_update(drbg, ent, ent_len, adin, adin_len, NULL, 0);
127	}
128
129	/*
130	* SP800-90Ar1 10.1.2.5 HMAC_DRBG_Generate_Process:
131	*
132	* Generates pseudo random bytes and updates the internal K,V for the drbg.
133	* out is a buffer to fill with outlen bytes of pseudo random data.
134	* adin is an additional_input string of size adin_len that may be NULL.
135	*
136	* Returns zero if an error occurs otherwise it returns 1.
137	*/
138	static int drbg_hmac_generate(RAND_DRBG *drbg,
139	unsigned char *out, size_t outlen,
140	const unsigned char *adin, size_t adin_len)
141	{
142	RAND_DRBG_HMAC *hmac = &drbg->data.hmac;
143	HMAC_CTX *ctx = hmac->ctx;
144	const unsigned char *temp = hmac->V;
145
146	/* (Step 2) if adin != NULL then (K,V) = HMAC_DRBG_Update(adin, K, V) */
147	if (adin != NULL
148	&& adin_len > 0
149	&& !drbg_hmac_update(drbg, adin, adin_len, NULL, 0, NULL, 0))
150	return 0;
151
152	/*
153	* (Steps 3-5) temp = NULL
154	* while (len(temp) < outlen) {
155	* V = HMAC(K, V)
156	* temp = temp \|\| V
157	* }
158	*/
159	for (;;) {
160	if (!HMAC_Init_ex(ctx, hmac->K, hmac->blocklen, hmac->md, NULL)
161	\|\| !HMAC_Update(ctx, temp, hmac->blocklen))
162	return 0;
163
164	if (outlen > hmac->blocklen) {
165	if (!HMAC_Final(ctx, out, NULL))
166	return 0;
167	temp = out;
168	} else {
169	if (!HMAC_Final(ctx, hmac->V, NULL))
170	return 0;
171	memcpy(out, hmac->V, outlen);
172	break;
173	}
174	out += hmac->blocklen;
175	outlen -= hmac->blocklen;
176	}
177	/* (Step 6) (K,V) = HMAC_DRBG_Update(adin, K, V) */
178	if (!drbg_hmac_update(drbg, adin, adin_len, NULL, 0, NULL, 0))
179	return 0;
180
181	return 1;
182	}
183
184	static int drbg_hmac_uninstantiate(RAND_DRBG *drbg)
185	{
186	HMAC_CTX_free(drbg->data.hmac.ctx);
187	OPENSSL_cleanse(&drbg->data.hmac, sizeof(drbg->data.hmac));
188	return 1;
189	}
190
191	static RAND_DRBG_METHOD drbg_hmac_meth = {
192	drbg_hmac_instantiate,
193	drbg_hmac_reseed,
194	drbg_hmac_generate,
195	drbg_hmac_uninstantiate
196	};
197
198	int drbg_hmac_init(RAND_DRBG *drbg)
199	{
200	const EVP_MD *md = NULL;
201	RAND_DRBG_HMAC *hmac = &drbg->data.hmac;
202
203	/* Any approved digest is allowed - assume we pass digest (not NID_hmac) /
204	md = EVP_get_digestbynid(drbg->type);
205	if (md == NULL)
206	return 0;
207
208	drbg->meth = &drbg_hmac_meth;
209
210	if (hmac->ctx == NULL) {
211	hmac->ctx = HMAC_CTX_new();
212	if (hmac->ctx == NULL)
213	return 0;
214	}
215
216	/* These are taken from SP 800-90 10.1 Table 2 */
217	hmac->md = md;
218	hmac->blocklen = EVP_MD_size(md);
219	/* See SP800-57 Part1 Rev4 5.6.1 Table 3 */
220	drbg->strength = 64 * (int)(hmac->blocklen >> 3);
221	if (drbg->strength > 256)
222	drbg->strength = 256;
223	drbg->seedlen = hmac->blocklen;
224
225	drbg->min_entropylen = drbg->strength / 8;
3064b551	226	drbg->max_entropylen = DRBG_MAX_LENGTH;
8bf36651 SL	227
8bf36651 SL	228	drbg->min_noncelen = drbg->min_entropylen / 2;
3064b551	229	drbg->max_noncelen = DRBG_MAX_LENGTH;
8bf36651 SL	230
	231	drbg->max_perslen = DRBG_MAX_LENGTH;
	232	drbg->max_adinlen = DRBG_MAX_LENGTH;
	233
	234	/* Maximum number of bits per request = 2^19 = 2^16 bytes*/
	235	drbg->max_request = 1 << 16;
	236
	237	return 1;
	238	}