providers/implementations/rands/drbg_hmac.c

   1 /*
   2  * Copyright 2011-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdlib.h>
  11 #include <string.h>
  12 #include <openssl/crypto.h>
  13 #include <openssl/err.h>
  14 #include <openssl/rand.h>
  15 #include <openssl/proverr.h>
  16 #include "internal/thread_once.h"
  17 #include "prov/providercommon.h"
  18 #include "prov/implementations.h"
  19 #include "prov/provider_ctx.h"
  20 #include "prov/hmac_drbg.h"
  21 #include "drbg_local.h"
  22
  23 static OSSL_FUNC_rand_newctx_fn drbg_hmac_new_wrapper;
  24 static OSSL_FUNC_rand_freectx_fn drbg_hmac_free;
  25 static OSSL_FUNC_rand_instantiate_fn drbg_hmac_instantiate_wrapper;
  26 static OSSL_FUNC_rand_uninstantiate_fn drbg_hmac_uninstantiate_wrapper;
  27 static OSSL_FUNC_rand_generate_fn drbg_hmac_generate_wrapper;
  28 static OSSL_FUNC_rand_reseed_fn drbg_hmac_reseed_wrapper;
  29 static OSSL_FUNC_rand_settable_ctx_params_fn drbg_hmac_settable_ctx_params;
  30 static OSSL_FUNC_rand_set_ctx_params_fn drbg_hmac_set_ctx_params;
  31 static OSSL_FUNC_rand_gettable_ctx_params_fn drbg_hmac_gettable_ctx_params;
  32 static OSSL_FUNC_rand_get_ctx_params_fn drbg_hmac_get_ctx_params;
  33 static OSSL_FUNC_rand_verify_zeroization_fn drbg_hmac_verify_zeroization;
  34
  35 /*
  36  * Called twice by SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process.
  37  *
  38  * hmac is an object that holds the input/output Key and Value (K and V).
  39  * inbyte is 0x00 on the first call and 0x01 on the second call.
  40  * in1, in2, in3 are optional inputs that can be NULL.
  41  * in1len, in2len, in3len are the lengths of the input buffers.
  42  *
  43  * The returned K,V is:
  44  *   hmac->K = HMAC(hmac->K, hmac->V || inbyte || [in1] || [in2] || [in3])
  45  *   hmac->V = HMAC(hmac->K, hmac->V)
  46  *
  47  * Returns zero if an error occurs otherwise it returns 1.
  48  */
  49 static int do_hmac(PROV_DRBG_HMAC *hmac, unsigned char inbyte,
  50                    const unsigned char *in1, size_t in1len,
  51                    const unsigned char *in2, size_t in2len,
  52                    const unsigned char *in3, size_t in3len)
  53 {
  54     EVP_MAC_CTX *ctx = hmac->ctx;
  55
  56     if (!EVP_MAC_init(ctx, hmac->K, hmac->blocklen, NULL)
  57             /* K = HMAC(K, V || inbyte || [in1] || [in2] || [in3]) */
  58             || !EVP_MAC_update(ctx, hmac->V, hmac->blocklen)
  59             || !EVP_MAC_update(ctx, &inbyte, 1)
  60             || !(in1 == NULL || in1len == 0 || EVP_MAC_update(ctx, in1, in1len))
  61             || !(in2 == NULL || in2len == 0 || EVP_MAC_update(ctx, in2, in2len))
  62             || !(in3 == NULL || in3len == 0 || EVP_MAC_update(ctx, in3, in3len))
  63             || !EVP_MAC_final(ctx, hmac->K, NULL, sizeof(hmac->K)))
  64         return 0;
  65
  66    /* V = HMAC(K, V) */
  67     return EVP_MAC_init(ctx, hmac->K, hmac->blocklen, NULL)
  68            && EVP_MAC_update(ctx, hmac->V, hmac->blocklen)
  69            && EVP_MAC_final(ctx, hmac->V, NULL, sizeof(hmac->V));
  70 }
  71
  72 /*
  73  * SP800-90Ar1 10.1.2.2 HMAC_DRBG_Update_Process
  74  *
  75  *
  76  * Updates the drbg objects Key(K) and Value(V) using the following algorithm:
  77  *   K,V = do_hmac(hmac, 0, in1, in2, in3)
  78  *   if (any input is not NULL)
  79  *     K,V = do_hmac(hmac, 1, in1, in2, in3)
  80  *
  81  * where in1, in2, in3 are optional input buffers that can be NULL.
  82  *       in1len, in2len, in3len are the lengths of the input buffers.
  83  *
  84  * Returns zero if an error occurs otherwise it returns 1.
  85  */
  86 static int drbg_hmac_update(PROV_DRBG_HMAC *hmac,
  87                             const unsigned char *in1, size_t in1len,
  88                             const unsigned char *in2, size_t in2len,
  89                             const unsigned char *in3, size_t in3len)
  90 {
  91     /* (Steps 1-2) K = HMAC(K, V||0x00||provided_data). V = HMAC(K,V) */
  92     if (!do_hmac(hmac, 0x00, in1, in1len, in2, in2len, in3, in3len))
  93         return 0;
  94     /* (Step 3) If provided_data == NULL then return (K,V) */
  95     if (in1len == 0 && in2len == 0 && in3len == 0)
  96         return 1;
  97     /* (Steps 4-5) K = HMAC(K, V||0x01||provided_data). V = HMAC(K,V) */
  98     return do_hmac(hmac, 0x01, in1, in1len, in2, in2len, in3, in3len);
  99 }
 100
 101 /*
 102  * SP800-90Ar1 10.1.2.3 HMAC_DRBG_Instantiate_Process:
 103  *
 104  * This sets the drbg Key (K) to all zeros, and Value (V) to all 1's.
 105  * and then calls (K,V) = drbg_hmac_update() with input parameters:
 106  *   ent = entropy data (Can be NULL) of length ent_len.
 107  *   nonce = nonce data (Can be NULL) of length nonce_len.
 108  *   pstr = personalization data (Can be NULL) of length pstr_len.
 109  *
 110  * Returns zero if an error occurs otherwise it returns 1.
 111  */
 112 int ossl_drbg_hmac_init(PROV_DRBG_HMAC *hmac,
 113                         const unsigned char *ent, size_t ent_len,
 114                         const unsigned char *nonce, size_t nonce_len,
 115                         const unsigned char *pstr, size_t pstr_len)
 116 {
 117     if (hmac->ctx == NULL) {
 118         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MAC);
 119         return 0;
 120     }
 121
 122     /* (Step 2) Key = 0x00 00...00 */
 123     memset(hmac->K, 0x00, hmac->blocklen);
 124     /* (Step 3) V = 0x01 01...01 */
 125     memset(hmac->V, 0x01, hmac->blocklen);
 126     /* (Step 4) (K,V) = HMAC_DRBG_Update(entropy||nonce||pers string, K, V) */
 127     return drbg_hmac_update(hmac, ent, ent_len, nonce, nonce_len, pstr,
 128                             pstr_len);
 129 }
 130 static int drbg_hmac_instantiate(PROV_DRBG *drbg,
 131                                  const unsigned char *ent, size_t ent_len,
 132                                  const unsigned char *nonce, size_t nonce_len,
 133                                  const unsigned char *pstr, size_t pstr_len)
 134 {
 135     return ossl_drbg_hmac_init((PROV_DRBG_HMAC *)drbg->data, ent, ent_len,
 136                                nonce, nonce_len, pstr, pstr_len);
 137 }
 138
 139 static int drbg_hmac_instantiate_wrapper(void *vdrbg, unsigned int strength,
 140                                          int prediction_resistance,
 141                                          const unsigned char *pstr,
 142                                          size_t pstr_len,
 143                                          const OSSL_PARAM params[])
 144 {
 145     PROV_DRBG *drbg = (PROV_DRBG *)vdrbg;
 146
 147     if (!ossl_prov_is_running() || !drbg_hmac_set_ctx_params(drbg, params))
 148         return 0;
 149     return ossl_prov_drbg_instantiate(drbg, strength, prediction_resistance,
 150                                       pstr, pstr_len);
 151 }
 152
 153 /*
 154  * SP800-90Ar1 10.1.2.4 HMAC_DRBG_Reseed_Process:
 155  *
 156  * Reseeds the drbg's Key (K) and Value (V) by calling
 157  * (K,V) = drbg_hmac_update() with the following input parameters:
 158  *   ent = entropy input data (Can be NULL) of length ent_len.
 159  *   adin = additional input data (Can be NULL) of length adin_len.
 160  *
 161  * Returns zero if an error occurs otherwise it returns 1.
 162  */
 163 static int drbg_hmac_reseed(PROV_DRBG *drbg,
 164                             const unsigned char *ent, size_t ent_len,
 165                             const unsigned char *adin, size_t adin_len)
 166 {
 167     PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data;
 168
 169     /* (Step 2) (K,V) = HMAC_DRBG_Update(entropy||additional_input, K, V) */
 170     return drbg_hmac_update(hmac, ent, ent_len, adin, adin_len, NULL, 0);
 171 }
 172
 173 static int drbg_hmac_reseed_wrapper(void *vdrbg, int prediction_resistance,
 174                                     const unsigned char *ent, size_t ent_len,
 175                                     const unsigned char *adin, size_t adin_len)
 176 {
 177     PROV_DRBG *drbg = (PROV_DRBG *)vdrbg;
 178
 179     return ossl_prov_drbg_reseed(drbg, prediction_resistance, ent, ent_len,
 180                                  adin, adin_len);
 181 }
 182
 183 /*
 184  * SP800-90Ar1 10.1.2.5 HMAC_DRBG_Generate_Process:
 185  *
 186  * Generates pseudo random bytes and updates the internal K,V for the drbg.
 187  * out is a buffer to fill with outlen bytes of pseudo random data.
 188  * adin is an additional_input string of size adin_len that may be NULL.
 189  *
 190  * Returns zero if an error occurs otherwise it returns 1.
 191  */
 192 int ossl_drbg_hmac_generate(PROV_DRBG_HMAC *hmac,
 193                             unsigned char *out, size_t outlen,
 194                             const unsigned char *adin, size_t adin_len)
 195 {
 196     EVP_MAC_CTX *ctx = hmac->ctx;
 197     const unsigned char *temp = hmac->V;
 198
 199     /* (Step 2) if adin != NULL then (K,V) = HMAC_DRBG_Update(adin, K, V) */
 200     if (adin != NULL
 201             && adin_len > 0
 202             && !drbg_hmac_update(hmac, adin, adin_len, NULL, 0, NULL, 0))
 203         return 0;
 204
 205     /*
 206      * (Steps 3-5) temp = NULL
 207      *             while (len(temp) < outlen) {
 208      *                 V = HMAC(K, V)
 209      *                 temp = temp || V
 210      *             }
 211      */
 212     for (;;) {
 213         if (!EVP_MAC_init(ctx, hmac->K, hmac->blocklen, NULL)
 214             || !EVP_MAC_update(ctx, temp, hmac->blocklen))
 215             return 0;
 216
 217         if (outlen > hmac->blocklen) {
 218             if (!EVP_MAC_final(ctx, out, NULL, outlen))
 219                 return 0;
 220             temp = out;
 221         } else {
 222             if (!EVP_MAC_final(ctx, hmac->V, NULL, sizeof(hmac->V)))
 223                 return 0;
 224             memcpy(out, hmac->V, outlen);
 225             break;
 226         }
 227         out += hmac->blocklen;
 228         outlen -= hmac->blocklen;
 229     }
 230     /* (Step 6) (K,V) = HMAC_DRBG_Update(adin, K, V) */
 231     if (!drbg_hmac_update(hmac, adin, adin_len, NULL, 0, NULL, 0))
 232         return 0;
 233
 234     return 1;
 235 }
 236
 237 static int drbg_hmac_generate(PROV_DRBG *drbg,
 238                               unsigned char *out, size_t outlen,
 239                               const unsigned char *adin, size_t adin_len)
 240 {
 241     return ossl_drbg_hmac_generate((PROV_DRBG_HMAC *)drbg->data, out, outlen,
 242                                     adin, adin_len);
 243 }
 244
 245 static int drbg_hmac_generate_wrapper(void *vdrbg,
 246      unsigned char *out, size_t outlen, unsigned int strength,
 247      int prediction_resistance, const unsigned char *adin, size_t adin_len)
 248 {
 249     PROV_DRBG *drbg = (PROV_DRBG *)vdrbg;
 250
 251     return ossl_prov_drbg_generate(drbg, out, outlen, strength,
 252                                    prediction_resistance, adin, adin_len);
 253 }
 254
 255 static int drbg_hmac_uninstantiate(PROV_DRBG *drbg)
 256 {
 257     PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data;
 258
 259     OPENSSL_cleanse(hmac->K, sizeof(hmac->K));
 260     OPENSSL_cleanse(hmac->V, sizeof(hmac->V));
 261     return ossl_prov_drbg_uninstantiate(drbg);
 262 }
 263
 264 static int drbg_hmac_uninstantiate_wrapper(void *vdrbg)
 265 {
 266     return drbg_hmac_uninstantiate((PROV_DRBG *)vdrbg);
 267 }
 268
 269 static int drbg_hmac_verify_zeroization(void *vdrbg)
 270 {
 271     PROV_DRBG *drbg = (PROV_DRBG *)vdrbg;
 272     PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data;
 273
 274     PROV_DRBG_VERYIFY_ZEROIZATION(hmac->K);
 275     PROV_DRBG_VERYIFY_ZEROIZATION(hmac->V);
 276     return 1;
 277 }
 278
 279 static int drbg_hmac_new(PROV_DRBG *drbg)
 280 {
 281     PROV_DRBG_HMAC *hmac;
 282
 283     hmac = OPENSSL_secure_zalloc(sizeof(*hmac));
 284     if (hmac == NULL)
 285         return 0;
 286
 287     drbg->data = hmac;
 288     /* See SP800-57 Part1 Rev4 5.6.1 Table 3 */
 289     drbg->max_entropylen = DRBG_MAX_LENGTH;
 290     drbg->max_noncelen = DRBG_MAX_LENGTH;
 291     drbg->max_perslen = DRBG_MAX_LENGTH;
 292     drbg->max_adinlen = DRBG_MAX_LENGTH;
 293
 294     /* Maximum number of bits per request = 2^19  = 2^16 bytes */
 295     drbg->max_request = 1 << 16;
 296     return 1;
 297 }
 298
 299 static void *drbg_hmac_new_wrapper(void *provctx, void *parent,
 300                                    const OSSL_DISPATCH *parent_dispatch)
 301 {
 302     return ossl_rand_drbg_new(provctx, parent, parent_dispatch, &drbg_hmac_new,
 303                               &drbg_hmac_instantiate, &drbg_hmac_uninstantiate,
 304                               &drbg_hmac_reseed, &drbg_hmac_generate);
 305 }
 306
 307 static void drbg_hmac_free(void *vdrbg)
 308 {
 309     PROV_DRBG *drbg = (PROV_DRBG *)vdrbg;
 310     PROV_DRBG_HMAC *hmac;
 311
 312     if (drbg != NULL && (hmac = (PROV_DRBG_HMAC *)drbg->data) != NULL) {
 313         EVP_MAC_CTX_free(hmac->ctx);
 314         ossl_prov_digest_reset(&hmac->digest);
 315         OPENSSL_secure_clear_free(hmac, sizeof(*hmac));
 316     }
 317     ossl_rand_drbg_free(drbg);
 318 }
 319
 320 static int drbg_hmac_get_ctx_params(void *vdrbg, OSSL_PARAM params[])
 321 {
 322     PROV_DRBG *drbg = (PROV_DRBG *)vdrbg;
 323     PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)drbg->data;
 324     const char *name;
 325     const EVP_MD *md;
 326     OSSL_PARAM *p;
 327
 328     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_MAC);
 329     if (p != NULL) {
 330         if (hmac->ctx == NULL)
 331             return 0;
 332         name = EVP_MAC_get0_name(EVP_MAC_CTX_get0_mac(hmac->ctx));
 333         if (!OSSL_PARAM_set_utf8_string(p, name))
 334             return 0;
 335     }
 336
 337     p = OSSL_PARAM_locate(params, OSSL_DRBG_PARAM_DIGEST);
 338     if (p != NULL) {
 339         md = ossl_prov_digest_md(&hmac->digest);
 340         if (md == NULL || !OSSL_PARAM_set_utf8_string(p, EVP_MD_get0_name(md)))
 341             return 0;
 342     }
 343
 344     return ossl_drbg_get_ctx_params(drbg, params);
 345 }
 346
 347 static const OSSL_PARAM *drbg_hmac_gettable_ctx_params(ossl_unused void *vctx,
 348                                                        ossl_unused void *p_ctx)
 349 {
 350     static const OSSL_PARAM known_gettable_ctx_params[] = {
 351         OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_MAC, NULL, 0),
 352         OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_DIGEST, NULL, 0),
 353         OSSL_PARAM_DRBG_GETTABLE_CTX_COMMON,
 354         OSSL_PARAM_END
 355     };
 356     return known_gettable_ctx_params;
 357 }
 358
 359 static int drbg_hmac_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 360 {
 361     PROV_DRBG *ctx = (PROV_DRBG *)vctx;
 362     PROV_DRBG_HMAC *hmac = (PROV_DRBG_HMAC *)ctx->data;
 363     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
 364     const EVP_MD *md;
 365
 366     if (!ossl_prov_digest_load_from_params(&hmac->digest, params, libctx))
 367         return 0;
 368
 369     md = ossl_prov_digest_md(&hmac->digest);
 370     if (md != NULL && !ossl_drbg_verify_digest(libctx, md))
 371         return 0;   /* Error already raised for us */
 372
 373     if (!ossl_prov_macctx_load_from_params(&hmac->ctx, params,
 374                                            NULL, NULL, NULL, libctx))
 375         return 0;
 376
 377     if (md != NULL && hmac->ctx != NULL) {
 378         /* These are taken from SP 800-90 10.1 Table 2 */
 379         hmac->blocklen = EVP_MD_get_size(md);
 380         /* See SP800-57 Part1 Rev4 5.6.1 Table 3 */
 381         ctx->strength = 64 * (int)(hmac->blocklen >> 3);
 382         if (ctx->strength > 256)
 383             ctx->strength = 256;
 384         ctx->seedlen = hmac->blocklen;
 385         ctx->min_entropylen = ctx->strength / 8;
 386         ctx->min_noncelen = ctx->min_entropylen / 2;
 387     }
 388
 389     return ossl_drbg_set_ctx_params(ctx, params);
 390 }
 391
 392 static const OSSL_PARAM *drbg_hmac_settable_ctx_params(ossl_unused void *vctx,
 393                                                        ossl_unused void *p_ctx)
 394 {
 395     static const OSSL_PARAM known_settable_ctx_params[] = {
 396         OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_PROPERTIES, NULL, 0),
 397         OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_DIGEST, NULL, 0),
 398         OSSL_PARAM_utf8_string(OSSL_DRBG_PARAM_MAC, NULL, 0),
 399         OSSL_PARAM_DRBG_SETTABLE_CTX_COMMON,
 400         OSSL_PARAM_END
 401     };
 402     return known_settable_ctx_params;
 403 }
 404
 405 const OSSL_DISPATCH ossl_drbg_ossl_hmac_functions[] = {
 406     { OSSL_FUNC_RAND_NEWCTX, (void(*)(void))drbg_hmac_new_wrapper },
 407     { OSSL_FUNC_RAND_FREECTX, (void(*)(void))drbg_hmac_free },
 408     { OSSL_FUNC_RAND_INSTANTIATE,
 409       (void(*)(void))drbg_hmac_instantiate_wrapper },
 410     { OSSL_FUNC_RAND_UNINSTANTIATE,
 411       (void(*)(void))drbg_hmac_uninstantiate_wrapper },
 412     { OSSL_FUNC_RAND_GENERATE, (void(*)(void))drbg_hmac_generate_wrapper },
 413     { OSSL_FUNC_RAND_RESEED, (void(*)(void))drbg_hmac_reseed_wrapper },
 414     { OSSL_FUNC_RAND_ENABLE_LOCKING, (void(*)(void))ossl_drbg_enable_locking },
 415     { OSSL_FUNC_RAND_LOCK, (void(*)(void))ossl_drbg_lock },
 416     { OSSL_FUNC_RAND_UNLOCK, (void(*)(void))ossl_drbg_unlock },
 417     { OSSL_FUNC_RAND_SETTABLE_CTX_PARAMS,
 418       (void(*)(void))drbg_hmac_settable_ctx_params },
 419     { OSSL_FUNC_RAND_SET_CTX_PARAMS, (void(*)(void))drbg_hmac_set_ctx_params },
 420     { OSSL_FUNC_RAND_GETTABLE_CTX_PARAMS,
 421       (void(*)(void))drbg_hmac_gettable_ctx_params },
 422     { OSSL_FUNC_RAND_GET_CTX_PARAMS, (void(*)(void))drbg_hmac_get_ctx_params },
 423     { OSSL_FUNC_RAND_VERIFY_ZEROIZATION,
 424       (void(*)(void))drbg_hmac_verify_zeroization },
 425     { OSSL_FUNC_RAND_GET_SEED, (void(*)(void))ossl_drbg_get_seed },
 426     { OSSL_FUNC_RAND_CLEAR_SEED, (void(*)(void))ossl_drbg_clear_seed },
 427     { 0, NULL }
 428 };