]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
33388b44 | 2 | * Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved. |
a693ead6 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
a693ead6 BL |
8 | */ |
9 | ||
3fddbb26 MC |
10 | /* |
11 | * This file has no dependencies on the rest of libssl because it is shared | |
12 | * with the providers. It contains functions for low level MAC calculations. | |
13 | * Responsibility for this lies with the HMAC implementation in the | |
14 | * providers. However there are legacy code paths in libssl which also need to | |
15 | * do this. In time those legacy code paths can be removed and this file can be | |
16 | * moved out of libssl. | |
17 | */ | |
18 | ||
19 | ||
85d843c8 | 20 | /* |
781aa7ab | 21 | * MD5 and SHA-1 low level APIs are deprecated for public use, but still ok for |
85d843c8 P |
22 | * internal use. |
23 | */ | |
24 | #include "internal/deprecated.h" | |
25 | ||
706457b7 | 26 | #include "internal/constant_time.h" |
67dc995e | 27 | #include "internal/cryptlib.h" |
a693ead6 | 28 | |
3fddbb26 | 29 | #include <openssl/evp.h> |
a693ead6 BL |
30 | #include <openssl/md5.h> |
31 | #include <openssl/sha.h> | |
32 | ||
3fddbb26 MC |
33 | char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx); |
34 | int ssl3_cbc_digest_record(const EVP_MD *md, | |
35 | unsigned char *md_out, | |
36 | size_t *md_out_size, | |
37 | const unsigned char header[13], | |
38 | const unsigned char *data, | |
e08f86dd | 39 | size_t data_size, |
3fddbb26 MC |
40 | size_t data_plus_mac_plus_padding_size, |
41 | const unsigned char *mac_secret, | |
42 | size_t mac_secret_length, char is_sslv3); | |
43 | ||
44 | # define l2n(l,c) (*((c)++)=(unsigned char)(((l)>>24)&0xff), \ | |
45 | *((c)++)=(unsigned char)(((l)>>16)&0xff), \ | |
46 | *((c)++)=(unsigned char)(((l)>> 8)&0xff), \ | |
47 | *((c)++)=(unsigned char)(((l) )&0xff)) | |
48 | ||
49 | # define l2n6(l,c) (*((c)++)=(unsigned char)(((l)>>40)&0xff), \ | |
50 | *((c)++)=(unsigned char)(((l)>>32)&0xff), \ | |
51 | *((c)++)=(unsigned char)(((l)>>24)&0xff), \ | |
52 | *((c)++)=(unsigned char)(((l)>>16)&0xff), \ | |
53 | *((c)++)=(unsigned char)(((l)>> 8)&0xff), \ | |
54 | *((c)++)=(unsigned char)(((l) )&0xff)) | |
55 | ||
56 | # define l2n8(l,c) (*((c)++)=(unsigned char)(((l)>>56)&0xff), \ | |
57 | *((c)++)=(unsigned char)(((l)>>48)&0xff), \ | |
58 | *((c)++)=(unsigned char)(((l)>>40)&0xff), \ | |
59 | *((c)++)=(unsigned char)(((l)>>32)&0xff), \ | |
60 | *((c)++)=(unsigned char)(((l)>>24)&0xff), \ | |
61 | *((c)++)=(unsigned char)(((l)>>16)&0xff), \ | |
62 | *((c)++)=(unsigned char)(((l)>> 8)&0xff), \ | |
63 | *((c)++)=(unsigned char)(((l) )&0xff)) | |
64 | ||
0f113f3e MC |
65 | /* |
66 | * MAX_HASH_BIT_COUNT_BYTES is the maximum number of bytes in the hash's | |
67 | * length field. (SHA-384/512 have 128-bit length.) | |
68 | */ | |
a693ead6 BL |
69 | #define MAX_HASH_BIT_COUNT_BYTES 16 |
70 | ||
0f113f3e MC |
71 | /* |
72 | * MAX_HASH_BLOCK_SIZE is the maximum hash block size that we'll support. | |
a693ead6 | 73 | * Currently SHA-384/512 has a 128-byte block size and that's the largest |
0f113f3e MC |
74 | * supported by TLS.) |
75 | */ | |
a693ead6 BL |
76 | #define MAX_HASH_BLOCK_SIZE 128 |
77 | ||
83926159 | 78 | #ifndef FIPS_MODULE |
0f113f3e | 79 | /* |
aa97970c | 80 | * u32toLE serializes an unsigned, 32-bit number (n) as four bytes at (p) in |
0f113f3e MC |
81 | * little-endian order. The value of p is advanced by four. |
82 | */ | |
83926159 SL |
83 | # define u32toLE(n, p) \ |
84 | (*((p)++)=(unsigned char)(n), \ | |
85 | *((p)++)=(unsigned char)(n>>8), \ | |
86 | *((p)++)=(unsigned char)(n>>16), \ | |
87 | *((p)++)=(unsigned char)(n>>24)) | |
0f113f3e MC |
88 | |
89 | /* | |
90 | * These functions serialize the state of a hash and thus perform the | |
91 | * standard "final" operation without adding the padding and length that such | |
92 | * a function typically does. | |
93 | */ | |
94 | static void tls1_md5_final_raw(void *ctx, unsigned char *md_out) | |
95 | { | |
96 | MD5_CTX *md5 = ctx; | |
97 | u32toLE(md5->A, md_out); | |
98 | u32toLE(md5->B, md_out); | |
99 | u32toLE(md5->C, md_out); | |
100 | u32toLE(md5->D, md_out); | |
101 | } | |
83926159 | 102 | #endif /* FIPS_MODULE */ |
0f113f3e MC |
103 | |
104 | static void tls1_sha1_final_raw(void *ctx, unsigned char *md_out) | |
105 | { | |
106 | SHA_CTX *sha1 = ctx; | |
107 | l2n(sha1->h0, md_out); | |
108 | l2n(sha1->h1, md_out); | |
109 | l2n(sha1->h2, md_out); | |
110 | l2n(sha1->h3, md_out); | |
111 | l2n(sha1->h4, md_out); | |
112 | } | |
113 | ||
0f113f3e MC |
114 | static void tls1_sha256_final_raw(void *ctx, unsigned char *md_out) |
115 | { | |
116 | SHA256_CTX *sha256 = ctx; | |
117 | unsigned i; | |
118 | ||
119 | for (i = 0; i < 8; i++) { | |
120 | l2n(sha256->h[i], md_out); | |
121 | } | |
122 | } | |
123 | ||
0f113f3e MC |
124 | static void tls1_sha512_final_raw(void *ctx, unsigned char *md_out) |
125 | { | |
126 | SHA512_CTX *sha512 = ctx; | |
127 | unsigned i; | |
128 | ||
129 | for (i = 0; i < 8; i++) { | |
130 | l2n8(sha512->h[i], md_out); | |
131 | } | |
132 | } | |
133 | ||
474e469b RS |
134 | #undef LARGEST_DIGEST_CTX |
135 | #define LARGEST_DIGEST_CTX SHA512_CTX | |
a693ead6 | 136 | |
1d97c843 TH |
137 | /*- |
138 | * ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS | |
a693ead6 BL |
139 | * record. |
140 | * | |
141 | * ctx: the EVP_MD_CTX from which we take the hash function. | |
142 | * ssl3_cbc_record_digest_supported must return true for this EVP_MD_CTX. | |
143 | * md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written. | |
144 | * md_out_size: if non-NULL, the number of output bytes is written here. | |
145 | * header: the 13-byte, TLS record header. | |
478b50cf | 146 | * data: the record data itself, less any preceding explicit IV. |
e08f86dd MC |
147 | * data_size: the secret, reported length of the data once the MAC and padding |
148 | * has been removed. | |
a693ead6 | 149 | * data_plus_mac_plus_padding_size: the public length of the whole |
e08f86dd | 150 | * record, including MAC and padding. |
a693ead6 BL |
151 | * is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS. |
152 | * | |
e08f86dd | 153 | * On entry: we know that data is data_plus_mac_plus_padding_size in length |
5f3d93e4 | 154 | * Returns 1 on success or 0 on error |
1d97c843 | 155 | */ |
3fddbb26 | 156 | int ssl3_cbc_digest_record(const EVP_MD *md, |
a230b26e EK |
157 | unsigned char *md_out, |
158 | size_t *md_out_size, | |
159 | const unsigned char header[13], | |
160 | const unsigned char *data, | |
e08f86dd | 161 | size_t data_size, |
a230b26e EK |
162 | size_t data_plus_mac_plus_padding_size, |
163 | const unsigned char *mac_secret, | |
d0e7c31d | 164 | size_t mac_secret_length, char is_sslv3) |
0f113f3e MC |
165 | { |
166 | union { | |
39147079 | 167 | OSSL_UNION_ALIGN; |
0f113f3e MC |
168 | unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; |
169 | } md_state; | |
170 | void (*md_final_raw) (void *ctx, unsigned char *md_out); | |
171 | void (*md_transform) (void *ctx, const unsigned char *block); | |
d0e7c31d MC |
172 | size_t md_size, md_block_size = 64; |
173 | size_t sslv3_pad_length = 40, header_length, variance_blocks, | |
0f113f3e MC |
174 | len, max_mac_bytes, num_blocks, |
175 | num_starting_blocks, k, mac_end_offset, c, index_a, index_b; | |
d0e7c31d | 176 | size_t bits; /* at most 18 bits */ |
0f113f3e MC |
177 | unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES]; |
178 | /* hmac_pad is the masked HMAC key. */ | |
179 | unsigned char hmac_pad[MAX_HASH_BLOCK_SIZE]; | |
180 | unsigned char first_block[MAX_HASH_BLOCK_SIZE]; | |
181 | unsigned char mac_out[EVP_MAX_MD_SIZE]; | |
d0e7c31d MC |
182 | size_t i, j; |
183 | unsigned md_out_size_u; | |
6e59a892 | 184 | EVP_MD_CTX *md_ctx = NULL; |
0f113f3e MC |
185 | /* |
186 | * mdLengthSize is the number of bytes in the length field that | |
187 | * terminates * the hash. | |
188 | */ | |
d0e7c31d | 189 | size_t md_length_size = 8; |
0f113f3e | 190 | char length_is_big_endian = 1; |
73d391ad | 191 | int ret = 0; |
0f113f3e MC |
192 | |
193 | /* | |
194 | * This is a, hopefully redundant, check that allows us to forget about | |
195 | * many possible overflows later in this function. | |
196 | */ | |
380a522f MC |
197 | if (!ossl_assert(data_plus_mac_plus_padding_size < 1024 * 1024)) |
198 | return 0; | |
0f113f3e | 199 | |
13c9843c | 200 | if (EVP_MD_is_a(md, "MD5")) { |
83926159 SL |
201 | #ifdef FIPS_MODULE |
202 | return 0; | |
203 | #else | |
5f3d93e4 MC |
204 | if (MD5_Init((MD5_CTX *)md_state.c) <= 0) |
205 | return 0; | |
0f113f3e MC |
206 | md_final_raw = tls1_md5_final_raw; |
207 | md_transform = | |
208 | (void (*)(void *ctx, const unsigned char *block))MD5_Transform; | |
209 | md_size = 16; | |
210 | sslv3_pad_length = 48; | |
211 | length_is_big_endian = 0; | |
83926159 | 212 | #endif |
13c9843c | 213 | } else if (EVP_MD_is_a(md, "SHA1")) { |
5f3d93e4 MC |
214 | if (SHA1_Init((SHA_CTX *)md_state.c) <= 0) |
215 | return 0; | |
0f113f3e MC |
216 | md_final_raw = tls1_sha1_final_raw; |
217 | md_transform = | |
218 | (void (*)(void *ctx, const unsigned char *block))SHA1_Transform; | |
219 | md_size = 20; | |
13c9843c | 220 | } else if (EVP_MD_is_a(md, "SHA2-224")) { |
5f3d93e4 MC |
221 | if (SHA224_Init((SHA256_CTX *)md_state.c) <= 0) |
222 | return 0; | |
0f113f3e MC |
223 | md_final_raw = tls1_sha256_final_raw; |
224 | md_transform = | |
225 | (void (*)(void *ctx, const unsigned char *block))SHA256_Transform; | |
226 | md_size = 224 / 8; | |
13c9843c | 227 | } else if (EVP_MD_is_a(md, "SHA2-256")) { |
5f3d93e4 MC |
228 | if (SHA256_Init((SHA256_CTX *)md_state.c) <= 0) |
229 | return 0; | |
0f113f3e MC |
230 | md_final_raw = tls1_sha256_final_raw; |
231 | md_transform = | |
232 | (void (*)(void *ctx, const unsigned char *block))SHA256_Transform; | |
233 | md_size = 32; | |
13c9843c | 234 | } else if (EVP_MD_is_a(md, "SHA2-384")) { |
5f3d93e4 MC |
235 | if (SHA384_Init((SHA512_CTX *)md_state.c) <= 0) |
236 | return 0; | |
0f113f3e MC |
237 | md_final_raw = tls1_sha512_final_raw; |
238 | md_transform = | |
239 | (void (*)(void *ctx, const unsigned char *block))SHA512_Transform; | |
240 | md_size = 384 / 8; | |
241 | md_block_size = 128; | |
242 | md_length_size = 16; | |
13c9843c | 243 | } else if (EVP_MD_is_a(md, "SHA2-512")) { |
5f3d93e4 MC |
244 | if (SHA512_Init((SHA512_CTX *)md_state.c) <= 0) |
245 | return 0; | |
0f113f3e MC |
246 | md_final_raw = tls1_sha512_final_raw; |
247 | md_transform = | |
248 | (void (*)(void *ctx, const unsigned char *block))SHA512_Transform; | |
249 | md_size = 64; | |
250 | md_block_size = 128; | |
251 | md_length_size = 16; | |
13c9843c | 252 | } else { |
0f113f3e MC |
253 | /* |
254 | * ssl3_cbc_record_digest_supported should have been called first to | |
255 | * check that the hash function is supported. | |
256 | */ | |
b77f3ed1 | 257 | if (md_out_size != NULL) |
5c649375 | 258 | *md_out_size = 0; |
b77f3ed1 | 259 | return ossl_assert(0); |
0f113f3e MC |
260 | } |
261 | ||
b77f3ed1 MC |
262 | if (!ossl_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES) |
263 | || !ossl_assert(md_block_size <= MAX_HASH_BLOCK_SIZE) | |
264 | || !ossl_assert(md_size <= EVP_MAX_MD_SIZE)) | |
380a522f | 265 | return 0; |
0f113f3e MC |
266 | |
267 | header_length = 13; | |
268 | if (is_sslv3) { | |
269 | header_length = mac_secret_length + sslv3_pad_length + 8 /* sequence | |
270 | * number */ + | |
271 | 1 /* record type */ + | |
272 | 2 /* record length */ ; | |
273 | } | |
274 | ||
275 | /* | |
276 | * variance_blocks is the number of blocks of the hash that we have to | |
277 | * calculate in constant time because they could be altered by the | |
278 | * padding value. In SSLv3, the padding must be minimal so the end of | |
279 | * the plaintext varies by, at most, 15+20 = 35 bytes. (We conservatively | |
280 | * assume that the MAC size varies from 0..20 bytes.) In case the 9 bytes | |
281 | * of hash termination (0x80 + 64-bit length) don't fit in the final | |
282 | * block, we say that the final two blocks can vary based on the padding. | |
283 | * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not | |
cb8164b0 | 284 | * required to be minimal. Therefore we say that the final |variance_blocks| |
285 | * blocks can | |
0f113f3e MC |
286 | * vary based on the padding. Later in the function, if the message is |
287 | * short and there obviously cannot be this many blocks then | |
288 | * variance_blocks can be reduced. | |
289 | */ | |
cb8164b0 | 290 | variance_blocks = is_sslv3 ? 2 : ( ((255 + 1 + md_size + md_block_size - 1) / md_block_size) + 1); |
0f113f3e MC |
291 | /* |
292 | * From now on we're dealing with the MAC, which conceptually has 13 | |
293 | * bytes of `header' before the start of the data (TLS) or 71/75 bytes | |
294 | * (SSLv3) | |
295 | */ | |
296 | len = data_plus_mac_plus_padding_size + header_length; | |
297 | /* | |
298 | * max_mac_bytes contains the maximum bytes of bytes in the MAC, | |
299 | * including * |header|, assuming that there's no padding. | |
300 | */ | |
301 | max_mac_bytes = len - md_size - 1; | |
302 | /* num_blocks is the maximum number of hash blocks. */ | |
303 | num_blocks = | |
304 | (max_mac_bytes + 1 + md_length_size + md_block_size - | |
305 | 1) / md_block_size; | |
306 | /* | |
307 | * In order to calculate the MAC in constant time we have to handle the | |
308 | * final blocks specially because the padding value could cause the end | |
309 | * to appear somewhere in the final |variance_blocks| blocks and we can't | |
310 | * leak where. However, |num_starting_blocks| worth of data can be hashed | |
311 | * right away because no padding value can affect whether they are | |
312 | * plaintext. | |
313 | */ | |
314 | num_starting_blocks = 0; | |
315 | /* | |
316 | * k is the starting byte offset into the conceptual header||data where | |
317 | * we start processing. | |
318 | */ | |
319 | k = 0; | |
320 | /* | |
321 | * mac_end_offset is the index just past the end of the data to be MACed. | |
322 | */ | |
e08f86dd | 323 | mac_end_offset = data_size + header_length; |
0f113f3e MC |
324 | /* |
325 | * c is the index of the 0x80 byte in the final hash block that contains | |
326 | * application data. | |
327 | */ | |
328 | c = mac_end_offset % md_block_size; | |
329 | /* | |
330 | * index_a is the hash block number that contains the 0x80 terminating | |
331 | * value. | |
332 | */ | |
333 | index_a = mac_end_offset / md_block_size; | |
334 | /* | |
335 | * index_b is the hash block number that contains the 64-bit hash length, | |
336 | * in bits. | |
337 | */ | |
338 | index_b = (mac_end_offset + md_length_size) / md_block_size; | |
339 | /* | |
340 | * bits is the hash-length in bits. It includes the additional hash block | |
341 | * for the masked HMAC key, or whole of |header| in the case of SSLv3. | |
342 | */ | |
343 | ||
344 | /* | |
345 | * For SSLv3, if we're going to have any starting blocks then we need at | |
346 | * least two because the header is larger than a single block. | |
347 | */ | |
348 | if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0)) { | |
349 | num_starting_blocks = num_blocks - variance_blocks; | |
350 | k = md_block_size * num_starting_blocks; | |
351 | } | |
352 | ||
353 | bits = 8 * mac_end_offset; | |
354 | if (!is_sslv3) { | |
355 | /* | |
356 | * Compute the initial HMAC block. For SSLv3, the padding and secret | |
357 | * bytes are included in |header| because they take more than a | |
358 | * single block. | |
359 | */ | |
360 | bits += 8 * md_block_size; | |
361 | memset(hmac_pad, 0, md_block_size); | |
380a522f MC |
362 | if (!ossl_assert(mac_secret_length <= sizeof(hmac_pad))) |
363 | return 0; | |
0f113f3e MC |
364 | memcpy(hmac_pad, mac_secret, mac_secret_length); |
365 | for (i = 0; i < md_block_size; i++) | |
366 | hmac_pad[i] ^= 0x36; | |
367 | ||
368 | md_transform(md_state.c, hmac_pad); | |
369 | } | |
370 | ||
371 | if (length_is_big_endian) { | |
372 | memset(length_bytes, 0, md_length_size - 4); | |
373 | length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24); | |
374 | length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16); | |
375 | length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8); | |
376 | length_bytes[md_length_size - 1] = (unsigned char)bits; | |
377 | } else { | |
378 | memset(length_bytes, 0, md_length_size); | |
379 | length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24); | |
380 | length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16); | |
381 | length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8); | |
382 | length_bytes[md_length_size - 8] = (unsigned char)bits; | |
383 | } | |
384 | ||
385 | if (k > 0) { | |
386 | if (is_sslv3) { | |
348240c6 | 387 | size_t overhang; |
29b0a15a | 388 | |
0f113f3e MC |
389 | /* |
390 | * The SSLv3 header is larger than a single block. overhang is | |
391 | * the number of bytes beyond a single block that the header | |
29b0a15a MC |
392 | * consumes: either 7 bytes (SHA1) or 11 bytes (MD5). There are no |
393 | * ciphersuites in SSLv3 that are not SHA1 or MD5 based and | |
394 | * therefore we can be confident that the header_length will be | |
395 | * greater than |md_block_size|. However we add a sanity check just | |
396 | * in case | |
0f113f3e | 397 | */ |
29b0a15a MC |
398 | if (header_length <= md_block_size) { |
399 | /* Should never happen */ | |
5f3d93e4 | 400 | return 0; |
29b0a15a MC |
401 | } |
402 | overhang = header_length - md_block_size; | |
0f113f3e MC |
403 | md_transform(md_state.c, header); |
404 | memcpy(first_block, header + md_block_size, overhang); | |
405 | memcpy(first_block + overhang, data, md_block_size - overhang); | |
406 | md_transform(md_state.c, first_block); | |
407 | for (i = 1; i < k / md_block_size - 1; i++) | |
408 | md_transform(md_state.c, data + md_block_size * i - overhang); | |
409 | } else { | |
410 | /* k is a multiple of md_block_size. */ | |
411 | memcpy(first_block, header, 13); | |
412 | memcpy(first_block + 13, data, md_block_size - 13); | |
413 | md_transform(md_state.c, first_block); | |
414 | for (i = 1; i < k / md_block_size; i++) | |
415 | md_transform(md_state.c, data + md_block_size * i - 13); | |
416 | } | |
417 | } | |
418 | ||
419 | memset(mac_out, 0, sizeof(mac_out)); | |
420 | ||
421 | /* | |
422 | * We now process the final hash blocks. For each block, we construct it | |
423 | * in constant time. If the |i==index_a| then we'll include the 0x80 | |
424 | * bytes and zero pad etc. For each block we selectively copy it, in | |
425 | * constant time, to |mac_out|. | |
426 | */ | |
427 | for (i = num_starting_blocks; i <= num_starting_blocks + variance_blocks; | |
428 | i++) { | |
429 | unsigned char block[MAX_HASH_BLOCK_SIZE]; | |
2688e7a0 MC |
430 | unsigned char is_block_a = constant_time_eq_8_s(i, index_a); |
431 | unsigned char is_block_b = constant_time_eq_8_s(i, index_b); | |
0f113f3e MC |
432 | for (j = 0; j < md_block_size; j++) { |
433 | unsigned char b = 0, is_past_c, is_past_cp1; | |
434 | if (k < header_length) | |
435 | b = header[k]; | |
436 | else if (k < data_plus_mac_plus_padding_size + header_length) | |
437 | b = data[k - header_length]; | |
438 | k++; | |
439 | ||
2688e7a0 MC |
440 | is_past_c = is_block_a & constant_time_ge_8_s(j, c); |
441 | is_past_cp1 = is_block_a & constant_time_ge_8_s(j, c + 1); | |
0f113f3e MC |
442 | /* |
443 | * If this is the block containing the end of the application | |
444 | * data, and we are at the offset for the 0x80 value, then | |
445 | * overwrite b with 0x80. | |
446 | */ | |
447 | b = constant_time_select_8(is_past_c, 0x80, b); | |
448 | /* | |
3519bae5 XL |
449 | * If this block contains the end of the application data |
450 | * and we're past the 0x80 value then just write zero. | |
0f113f3e MC |
451 | */ |
452 | b = b & ~is_past_cp1; | |
453 | /* | |
454 | * If this is index_b (the final block), but not index_a (the end | |
455 | * of the data), then the 64-bit length didn't fit into index_a | |
456 | * and we're having to add an extra block of zeros. | |
457 | */ | |
458 | b &= ~is_block_b | is_block_a; | |
459 | ||
460 | /* | |
461 | * The final bytes of one of the blocks contains the length. | |
462 | */ | |
463 | if (j >= md_block_size - md_length_size) { | |
464 | /* If this is index_b, write a length byte. */ | |
465 | b = constant_time_select_8(is_block_b, | |
466 | length_bytes[j - | |
467 | (md_block_size - | |
468 | md_length_size)], b); | |
469 | } | |
470 | block[j] = b; | |
471 | } | |
472 | ||
473 | md_transform(md_state.c, block); | |
474 | md_final_raw(md_state.c, block); | |
475 | /* If this is index_b, copy the hash value to |mac_out|. */ | |
476 | for (j = 0; j < md_size; j++) | |
477 | mac_out[j] |= block[j] & is_block_b; | |
478 | } | |
479 | ||
bfb0641f | 480 | md_ctx = EVP_MD_CTX_new(); |
6e59a892 RL |
481 | if (md_ctx == NULL) |
482 | goto err; | |
3fddbb26 | 483 | |
73d391ad | 484 | if (EVP_DigestInit_ex(md_ctx, md, NULL /* engine */ ) <= 0) |
5f3d93e4 | 485 | goto err; |
0f113f3e MC |
486 | if (is_sslv3) { |
487 | /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */ | |
488 | memset(hmac_pad, 0x5c, sslv3_pad_length); | |
489 | ||
6e59a892 | 490 | if (EVP_DigestUpdate(md_ctx, mac_secret, mac_secret_length) <= 0 |
a230b26e EK |
491 | || EVP_DigestUpdate(md_ctx, hmac_pad, sslv3_pad_length) <= 0 |
492 | || EVP_DigestUpdate(md_ctx, mac_out, md_size) <= 0) | |
5f3d93e4 | 493 | goto err; |
0f113f3e MC |
494 | } else { |
495 | /* Complete the HMAC in the standard manner. */ | |
496 | for (i = 0; i < md_block_size; i++) | |
497 | hmac_pad[i] ^= 0x6a; | |
498 | ||
6e59a892 | 499 | if (EVP_DigestUpdate(md_ctx, hmac_pad, md_block_size) <= 0 |
a230b26e | 500 | || EVP_DigestUpdate(md_ctx, mac_out, md_size) <= 0) |
5f3d93e4 | 501 | goto err; |
0f113f3e | 502 | } |
d0e7c31d | 503 | /* TODO(size_t): Convert me */ |
6e59a892 | 504 | ret = EVP_DigestFinal(md_ctx, md_out, &md_out_size_u); |
0f113f3e MC |
505 | if (ret && md_out_size) |
506 | *md_out_size = md_out_size_u; | |
5f3d93e4 | 507 | |
73d391ad | 508 | ret = 1; |
a230b26e | 509 | err: |
bfb0641f | 510 | EVP_MD_CTX_free(md_ctx); |
73d391ad | 511 | return ret; |
0f113f3e | 512 | } |