]>
Commit | Line | Data |
---|---|---|
ca392b29 SL |
1 | /* |
2 | * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * | |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include "cipher_aes.h" | |
11 | #include "internal/providercommonerr.h" | |
12 | #include "internal/provider_algs.h" | |
13 | ||
14 | /* AES wrap with padding has IV length of 4, without padding 8 */ | |
15 | #define AES_WRAP_PAD_IVLEN 4 | |
16 | #define AES_WRAP_NOPAD_IVLEN 8 | |
17 | ||
18 | /* TODO(3.0) Figure out what flags need to be passed */ | |
19 | #define WRAP_FLAGS (EVP_CIPH_WRAP_MODE \ | |
20 | | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \ | |
21 | | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_FLAG_DEFAULT_ASN1) | |
22 | ||
23 | typedef size_t (*aeswrap_fn)(void *key, const unsigned char *iv, | |
24 | unsigned char *out, const unsigned char *in, | |
25 | size_t inlen, block128_f block); | |
26 | ||
27 | static OSSL_OP_cipher_encrypt_init_fn aes_wrap_einit; | |
28 | static OSSL_OP_cipher_decrypt_init_fn aes_wrap_dinit; | |
29 | static OSSL_OP_cipher_update_fn aes_wrap_cipher; | |
30 | static OSSL_OP_cipher_final_fn aes_wrap_final; | |
31 | static OSSL_OP_cipher_freectx_fn aes_wrap_freectx; | |
32 | ||
33 | typedef struct prov_aes_wrap_ctx_st { | |
34 | PROV_CIPHER_CTX base; | |
35 | union { | |
36 | OSSL_UNION_ALIGN; | |
37 | AES_KEY ks; | |
38 | } ks; | |
39 | unsigned int iv_set : 1; | |
40 | aeswrap_fn wrapfn; | |
41 | ||
42 | } PROV_AES_WRAP_CTX; | |
43 | ||
44 | ||
45 | static void *aes_wrap_newctx(size_t kbits, size_t blkbits, | |
46 | size_t ivbits, unsigned int mode, uint64_t flags) | |
47 | { | |
48 | PROV_AES_WRAP_CTX *wctx = OPENSSL_zalloc(sizeof(*wctx)); | |
49 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)wctx; | |
50 | ||
51 | if (ctx != NULL) { | |
52 | cipher_generic_initkey(ctx, kbits, blkbits, ivbits, mode, flags, | |
53 | NULL, NULL); | |
54 | ctx->pad = (ctx->ivlen == AES_WRAP_PAD_IVLEN); | |
55 | } | |
56 | return wctx; | |
57 | } | |
58 | ||
59 | static void aes_wrap_freectx(void *vctx) | |
60 | { | |
61 | PROV_AES_WRAP_CTX *wctx = (PROV_AES_WRAP_CTX *)vctx; | |
62 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx; | |
63 | ||
64 | OPENSSL_cleanse(ctx->iv, sizeof(ctx->iv)); | |
65 | OPENSSL_clear_free(wctx, sizeof(*wctx)); | |
66 | } | |
67 | ||
68 | static int aes_wrap_init(void *vctx, const unsigned char *key, | |
69 | size_t keylen, const unsigned char *iv, | |
70 | size_t ivlen, int enc) | |
71 | { | |
72 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx; | |
73 | PROV_AES_WRAP_CTX *wctx = (PROV_AES_WRAP_CTX *)vctx; | |
74 | ||
75 | ctx->enc = enc; | |
76 | ctx->block = enc ? (block128_f)AES_encrypt : (block128_f)AES_decrypt; | |
77 | if (ctx->pad) | |
78 | wctx->wrapfn = enc ? CRYPTO_128_wrap_pad : CRYPTO_128_unwrap_pad; | |
79 | else | |
80 | wctx->wrapfn = enc ? CRYPTO_128_wrap : CRYPTO_128_unwrap; | |
81 | ||
82 | if (iv != NULL) { | |
83 | ctx->ivlen = ivlen; | |
84 | memcpy(ctx->iv, iv, ivlen); | |
85 | wctx->iv_set = 1; | |
86 | } | |
87 | if (key != NULL) { | |
88 | if (keylen != ctx->keylen) { | |
89 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); | |
90 | return 0; | |
91 | } | |
92 | if (ctx->enc) | |
93 | AES_set_encrypt_key(key, keylen * 8, &wctx->ks.ks); | |
94 | else | |
95 | AES_set_decrypt_key(key, keylen * 8, &wctx->ks.ks); | |
96 | } | |
97 | return 1; | |
98 | } | |
99 | ||
100 | static int aes_wrap_einit(void *ctx, const unsigned char *key, size_t keylen, | |
101 | const unsigned char *iv, size_t ivlen) | |
102 | { | |
103 | return aes_wrap_init(ctx, key, keylen, iv, ivlen, 1); | |
104 | } | |
105 | ||
106 | static int aes_wrap_dinit(void *ctx, const unsigned char *key, size_t keylen, | |
107 | const unsigned char *iv, size_t ivlen) | |
108 | { | |
109 | return aes_wrap_init(ctx, key, keylen, iv, ivlen, 0); | |
110 | } | |
111 | ||
112 | static int aes_wrap_cipher_internal(void *vctx, unsigned char *out, | |
113 | const unsigned char *in, size_t inlen) | |
114 | { | |
115 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx; | |
116 | PROV_AES_WRAP_CTX *wctx = (PROV_AES_WRAP_CTX *)vctx; | |
117 | size_t rv; | |
118 | int pad = ctx->pad; | |
119 | ||
120 | /* No final operation so always return zero length */ | |
121 | if (in == NULL) | |
122 | return 0; | |
123 | ||
124 | /* Input length must always be non-zero */ | |
125 | if (inlen == 0) | |
126 | return -1; | |
127 | ||
128 | /* If decrypting need at least 16 bytes and multiple of 8 */ | |
129 | if (!ctx->enc && (inlen < 16 || inlen & 0x7)) | |
130 | return -1; | |
131 | ||
132 | /* If not padding input must be multiple of 8 */ | |
133 | if (!pad && inlen & 0x7) | |
134 | return -1; | |
135 | ||
136 | if (out == NULL) { | |
137 | if (ctx->enc) { | |
138 | /* If padding round up to multiple of 8 */ | |
139 | if (pad) | |
140 | inlen = (inlen + 7) / 8 * 8; | |
141 | /* 8 byte prefix */ | |
142 | return inlen + 8; | |
143 | } else { | |
144 | /* | |
145 | * If not padding output will be exactly 8 bytes smaller than | |
146 | * input. If padding it will be at least 8 bytes smaller but we | |
147 | * don't know how much. | |
148 | */ | |
149 | return inlen - 8; | |
150 | } | |
151 | } | |
152 | ||
153 | rv = wctx->wrapfn(&wctx->ks.ks, wctx->iv_set ? ctx->iv : NULL, out, in, | |
154 | inlen, ctx->block); | |
155 | return rv ? (int)rv : -1; | |
156 | } | |
157 | ||
158 | static int aes_wrap_final(void *vctx, unsigned char *out, size_t *outl, | |
159 | size_t outsize) | |
160 | { | |
161 | *outl = 0; | |
162 | return 1; | |
163 | } | |
164 | ||
165 | static int aes_wrap_cipher(void *vctx, | |
166 | unsigned char *out, size_t *outl, size_t outsize, | |
167 | const unsigned char *in, size_t inl) | |
168 | { | |
169 | PROV_AES_WRAP_CTX *ctx = (PROV_AES_WRAP_CTX *)vctx; | |
170 | size_t len; | |
171 | ||
172 | if (outsize < inl) { | |
173 | ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); | |
174 | return -1; | |
175 | } | |
176 | ||
177 | len = aes_wrap_cipher_internal(ctx, out, in, inl); | |
178 | if (len == 0) | |
179 | return -1; | |
180 | ||
181 | *outl = len; | |
182 | return 1; | |
183 | } | |
184 | ||
185 | static int aes_wrap_set_ctx_params(void *vctx, const OSSL_PARAM params[]) | |
186 | { | |
187 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx; | |
188 | const OSSL_PARAM *p; | |
189 | size_t keylen = 0; | |
190 | ||
191 | p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_KEYLEN); | |
192 | if (p != NULL) { | |
193 | if (!OSSL_PARAM_get_size_t(p, &keylen)) { | |
194 | ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); | |
195 | return 0; | |
196 | } | |
197 | if (ctx->keylen != keylen) { | |
198 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); | |
199 | return 0; | |
200 | } | |
201 | } | |
202 | return 1; | |
203 | } | |
204 | ||
205 | #define IMPLEMENT_cipher(mode, fname, UCMODE, flags, kbits, blkbits, ivbits) \ | |
206 | static OSSL_OP_cipher_get_params_fn aes_##kbits##_##fname##_get_params; \ | |
207 | static int aes_##kbits##_##fname##_get_params(OSSL_PARAM params[]) \ | |
208 | { \ | |
209 | return cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE, \ | |
210 | flags, kbits, blkbits, ivbits); \ | |
211 | } \ | |
212 | static OSSL_OP_cipher_newctx_fn aes_##kbits##fname##_newctx; \ | |
213 | static void *aes_##kbits##fname##_newctx(void *provctx) \ | |
214 | { \ | |
215 | return aes_##mode##_newctx(kbits, blkbits, ivbits, \ | |
216 | EVP_CIPH_##UCMODE##_MODE, flags); \ | |
217 | } \ | |
218 | const OSSL_DISPATCH aes##kbits##fname##_functions[] = { \ | |
219 | { OSSL_FUNC_CIPHER_NEWCTX, \ | |
220 | (void (*)(void))aes_##kbits##fname##_newctx }, \ | |
221 | { OSSL_FUNC_CIPHER_ENCRYPT_INIT, (void (*)(void))aes_##mode##_einit }, \ | |
222 | { OSSL_FUNC_CIPHER_DECRYPT_INIT, (void (*)(void))aes_##mode##_dinit }, \ | |
223 | { OSSL_FUNC_CIPHER_UPDATE, (void (*)(void))aes_##mode##_cipher }, \ | |
224 | { OSSL_FUNC_CIPHER_FINAL, (void (*)(void))aes_##mode##_final }, \ | |
225 | { OSSL_FUNC_CIPHER_FREECTX, (void (*)(void))aes_##mode##_freectx }, \ | |
226 | { OSSL_FUNC_CIPHER_GET_PARAMS, \ | |
227 | (void (*)(void))aes_##kbits##_##fname##_get_params }, \ | |
228 | { OSSL_FUNC_CIPHER_GETTABLE_PARAMS, \ | |
229 | (void (*)(void))cipher_generic_gettable_params }, \ | |
230 | { OSSL_FUNC_CIPHER_GET_CTX_PARAMS, \ | |
231 | (void (*)(void))cipher_generic_get_ctx_params }, \ | |
232 | { OSSL_FUNC_CIPHER_SET_CTX_PARAMS, \ | |
233 | (void (*)(void))aes_wrap_set_ctx_params }, \ | |
234 | { OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \ | |
235 | (void (*)(void))cipher_generic_gettable_ctx_params }, \ | |
236 | { OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \ | |
237 | (void (*)(void))cipher_generic_settable_ctx_params }, \ | |
238 | { 0, NULL } \ | |
239 | } | |
240 | ||
241 | IMPLEMENT_cipher(wrap, wrap, WRAP, WRAP_FLAGS, 256, 64, AES_WRAP_NOPAD_IVLEN * 8); | |
242 | IMPLEMENT_cipher(wrap, wrap, WRAP, WRAP_FLAGS, 192, 64, AES_WRAP_NOPAD_IVLEN * 8); | |
243 | IMPLEMENT_cipher(wrap, wrap, WRAP, WRAP_FLAGS, 128, 64, AES_WRAP_NOPAD_IVLEN * 8); | |
244 | IMPLEMENT_cipher(wrap, wrappad, WRAP, WRAP_FLAGS, 256, 64, AES_WRAP_PAD_IVLEN * 8); | |
245 | IMPLEMENT_cipher(wrap, wrappad, WRAP, WRAP_FLAGS, 192, 64, AES_WRAP_PAD_IVLEN * 8); | |
246 | IMPLEMENT_cipher(wrap, wrappad, WRAP, WRAP_FLAGS, 128, 64, AES_WRAP_PAD_IVLEN * 8); |