]> git.ipfire.org Git - thirdparty/openssl.git/blame - crypto/evp/e_aes.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Excise AES-XTS FIPS check.
[thirdparty/openssl.git] / crypto / evp / e_aes.c
CommitLineData
aa6bb135 1/*
35fd9953 2 * Copyright 2001-2019 The OpenSSL Project Authors. All Rights Reserved.
deb2c1a1 3 *
aa6bb135
RS		 4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
deb2c1a1
DSH		 8 */
9
8c84b677 10#include <openssl/opensslconf.h>
5158c763
MC		 11#include <openssl/crypto.h>
12#include <openssl/evp.h>
13#include <openssl/err.h>
14#include <string.h>
15#include <assert.h>
16#include <openssl/aes.h>
17#include "internal/evp_int.h"
18#include "modes_lcl.h"
19#include <openssl/rand.h>
7141ba31 20#include "evp_locl.h"
0f113f3e
MC		 21
22typedef struct {
23 union {
24 double align;
25 AES_KEY ks;
26 } ks;
27 block128_f block;
28 union {
29 cbc128_f cbc;
30 ctr128_f ctr;
31 } stream;
32} EVP_AES_KEY;
33
34typedef struct {
35 union {
36 double align;
37 AES_KEY ks;
38 } ks; /* AES key schedule to use */
39 int key_set; /* Set if key initialised */
40 int iv_set; /* Set if an iv is set */
41 GCM128_CONTEXT gcm;
42 unsigned char *iv; /* Temporary IV store */
43 int ivlen; /* IV length */
44 int taglen;
45 int iv_gen; /* It is OK to generate IVs */
46 int tls_aad_len; /* TLS AAD length */
47 ctr128_f ctr;
48} EVP_AES_GCM_CTX;
49
50typedef struct {
51 union {
52 double align;
53 AES_KEY ks;
54 } ks1, ks2; /* AES key schedules to use */
55 XTS128_CONTEXT xts;
56 void (*stream) (const unsigned char *in,
57 unsigned char *out, size_t length,
58 const AES_KEY *key1, const AES_KEY *key2,
59 const unsigned char iv[16]);
60} EVP_AES_XTS_CTX;
61
62typedef struct {
63 union {
64 double align;
65 AES_KEY ks;
66 } ks; /* AES key schedule to use */
67 int key_set; /* Set if key initialised */
68 int iv_set; /* Set if an iv is set */
69 int tag_set; /* Set if tag is valid */
70 int len_set; /* Set if message length set */
71 int L, M; /* L and M parameters from RFC3610 */
e75c5a79 72 int tls_aad_len; /* TLS AAD length */
0f113f3e
MC		 73 CCM128_CONTEXT ccm;
74 ccm128_f str;
75} EVP_AES_CCM_CTX;
76
5158c763 77#ifndef OPENSSL_NO_OCB
0f113f3e 78typedef struct {
bdc985b1
AP		 79 union {
80 double align;
81 AES_KEY ks;
82 } ksenc; /* AES key schedule to use for encryption */
83 union {
84 double align;
85 AES_KEY ks;
86 } ksdec; /* AES key schedule to use for decryption */
0f113f3e
MC		 87 int key_set; /* Set if key initialised */
88 int iv_set; /* Set if an iv is set */
89 OCB128_CONTEXT ocb;
90 unsigned char *iv; /* Temporary IV store */
91 unsigned char tag[16];
92 unsigned char data_buf[16]; /* Store partial data blocks */
93 unsigned char aad_buf[16]; /* Store partial AAD blocks */
94 int data_buf_len;
95 int aad_buf_len;
96 int ivlen; /* IV length */
97 int taglen;
98} EVP_AES_OCB_CTX;
5158c763 99#endif
e6b336ef 100
5158c763 101#define MAXBITCHUNK ((size_t)1<<(sizeof(size_t)*8-4))
17f121de 102
5158c763 103#ifdef VPAES_ASM
8ca28da0 104int vpaes_set_encrypt_key(const unsigned char *userKey, int bits,
0f113f3e 105 AES_KEY *key);
8ca28da0 106int vpaes_set_decrypt_key(const unsigned char *userKey, int bits,
0f113f3e 107 AES_KEY *key);
8ca28da0
AP		 108
109void vpaes_encrypt(const unsigned char *in, unsigned char *out,
0f113f3e 110 const AES_KEY *key);
8ca28da0 111void vpaes_decrypt(const unsigned char *in, unsigned char *out,
0f113f3e 112 const AES_KEY *key);
8ca28da0
AP		 113
114void vpaes_cbc_encrypt(const unsigned char *in,
0f113f3e
MC		 115 unsigned char *out,
116 size_t length,
117 const AES_KEY *key, unsigned char *ivec, int enc);
5158c763
MC		 118#endif
119#ifdef BSAES_ASM
a75a52a4 120void bsaes_cbc_encrypt(const unsigned char *in, unsigned char *out,
0f113f3e
MC		 121 size_t length, const AES_KEY *key,
122 unsigned char ivec[16], int enc);
993adc05 123void bsaes_ctr32_encrypt_blocks(const unsigned char *in, unsigned char *out,
0f113f3e
MC		 124 size_t len, const AES_KEY *key,
125 const unsigned char ivec[16]);
60d4e99c 126void bsaes_xts_encrypt(const unsigned char *inp, unsigned char *out,
0f113f3e
MC		 127 size_t len, const AES_KEY *key1,
128 const AES_KEY *key2, const unsigned char iv[16]);
60d4e99c 129void bsaes_xts_decrypt(const unsigned char *inp, unsigned char *out,
0f113f3e
MC		 130 size_t len, const AES_KEY *key1,
131 const AES_KEY *key2, const unsigned char iv[16]);
5158c763
MC		 132#endif
133#ifdef AES_CTR_ASM
07904e0c 134void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out,
0f113f3e
MC		 135 size_t blocks, const AES_KEY *key,
136 const unsigned char ivec[AES_BLOCK_SIZE]);
5158c763
MC		 137#endif
138#ifdef AES_XTS_ASM
96cce820 139void AES_xts_encrypt(const unsigned char *inp, unsigned char *out, size_t len,
0f113f3e
MC		 140 const AES_KEY *key1, const AES_KEY *key2,
141 const unsigned char iv[16]);
96cce820 142void AES_xts_decrypt(const unsigned char *inp, unsigned char *out, size_t len,
0f113f3e
MC		 143 const AES_KEY *key1, const AES_KEY *key2,
144 const unsigned char iv[16]);
5158c763 145#endif
8ca28da0 146
03a5e5ae
PS		 147/* increment counter (64-bit int) by 1 */
148static void ctr64_inc(unsigned char *counter)
149{
150 int n = 8;
151 unsigned char c;
152
153 do {
154 --n;
155 c = counter[n];
156 ++c;
157 counter[n] = c;
158 if (c)
159 return;
160 } while (n);
161}
162
6944565b 163#if defined(OPENSSL_CPUID_OBJ) && (defined(__powerpc__) || defined(__ppc__) || defined(_ARCH_PPC))
5158c763
MC		 164# include "ppc_arch.h"
165# ifdef VPAES_ASM
166# define VPAES_CAPABLE (OPENSSL_ppccap_P & PPC_ALTIVEC)
de51e830 167# endif
5158c763
MC		 168# define HWAES_CAPABLE (OPENSSL_ppccap_P & PPC_CRYPTO207)
169# define HWAES_set_encrypt_key aes_p8_set_encrypt_key
170# define HWAES_set_decrypt_key aes_p8_set_decrypt_key
171# define HWAES_encrypt aes_p8_encrypt
172# define HWAES_decrypt aes_p8_decrypt
173# define HWAES_cbc_encrypt aes_p8_cbc_encrypt
174# define HWAES_ctr32_encrypt_blocks aes_p8_ctr32_encrypt_blocks
46f047d7
AP		 175# define HWAES_xts_encrypt aes_p8_xts_encrypt
176# define HWAES_xts_decrypt aes_p8_xts_decrypt
5158c763 177#endif
07f3e4f3 178
5158c763 179#if defined(AES_ASM) && !defined(I386_ONLY) && ( \
0f113f3e
MC		 180 ((defined(__i386) || defined(__i386__) || \
181 defined(_M_IX86)) && defined(OPENSSL_IA32_SSE2))|| \
182 defined(__x86_64) || defined(__x86_64__) || \
b1a07c38 183 defined(_M_AMD64) || defined(_M_X64) )
8ca28da0 184
c5f6da54 185extern unsigned int OPENSSL_ia32cap_P[];
8ca28da0 186
5158c763
MC		 187# ifdef VPAES_ASM
188# define VPAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32)))
189# endif
190# ifdef BSAES_ASM
191# define BSAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32)))
192# endif
17f121de
AP		 193/*
194 * AES-NI section
195 */
5158c763 196# define AESNI_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(57-32)))
d1fff483
AP		 197
198int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
0f113f3e 199 AES_KEY *key);
d1fff483 200int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
0f113f3e 201 AES_KEY *key);
d1fff483
AP		 202
203void aesni_encrypt(const unsigned char *in, unsigned char *out,
0f113f3e 204 const AES_KEY *key);
d1fff483 205void aesni_decrypt(const unsigned char *in, unsigned char *out,
0f113f3e 206 const AES_KEY *key);
d1fff483
AP		 207
208void aesni_ecb_encrypt(const unsigned char *in,
0f113f3e
MC		 209 unsigned char *out,
210 size_t length, const AES_KEY *key, int enc);
d1fff483 211void aesni_cbc_encrypt(const unsigned char *in,
0f113f3e
MC		 212 unsigned char *out,
213 size_t length,
214 const AES_KEY *key, unsigned char *ivec, int enc);
d1fff483
AP		 215
216void aesni_ctr32_encrypt_blocks(const unsigned char *in,
0f113f3e
MC		 217 unsigned char *out,
218 size_t blocks,
219 const void *key, const unsigned char *ivec);
17f121de
AP		 220
221void aesni_xts_encrypt(const unsigned char *in,
0f113f3e
MC		 222 unsigned char *out,
223 size_t length,
224 const AES_KEY *key1, const AES_KEY *key2,
225 const unsigned char iv[16]);
17f121de
AP		 226
227void aesni_xts_decrypt(const unsigned char *in,
0f113f3e
MC		 228 unsigned char *out,
229 size_t length,
230 const AES_KEY *key1, const AES_KEY *key2,
231 const unsigned char iv[16]);
232
233void aesni_ccm64_encrypt_blocks(const unsigned char *in,
234 unsigned char *out,
235 size_t blocks,
236 const void *key,
237 const unsigned char ivec[16],
238 unsigned char cmac[16]);
239
240void aesni_ccm64_decrypt_blocks(const unsigned char *in,
241 unsigned char *out,
242 size_t blocks,
243 const void *key,
244 const unsigned char ivec[16],
245 unsigned char cmac[16]);
246
5158c763 247# if defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)
4e049c52 248size_t aesni_gcm_encrypt(const unsigned char *in,
0f113f3e
MC		 249 unsigned char *out,
250 size_t len,
251 const void *key, unsigned char ivec[16], u64 *Xi);
5158c763 252# define AES_gcm_encrypt aesni_gcm_encrypt
4e049c52 253size_t aesni_gcm_decrypt(const unsigned char *in,
0f113f3e
MC		 254 unsigned char *out,
255 size_t len,
256 const void *key, unsigned char ivec[16], u64 *Xi);
5158c763 257# define AES_gcm_decrypt aesni_gcm_decrypt
0f113f3e
MC		 258void gcm_ghash_avx(u64 Xi[2], const u128 Htable[16], const u8 *in,
259 size_t len);
5158c763 260# define AES_GCM_ASM(gctx) (gctx->ctr==aesni_ctr32_encrypt_blocks && \
0f113f3e 261 gctx->gcm.ghash==gcm_ghash_avx)
5158c763 262# define AES_GCM_ASM2(gctx) (gctx->gcm.block==(block128_f)aesni_encrypt && \
0f113f3e 263 gctx->gcm.ghash==gcm_ghash_avx)
5158c763
MC		 264# undef AES_GCM_ASM2 /* minor size optimization */
265# endif
4e049c52 266
17f121de 267static int aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 268 const unsigned char *iv, int enc)
269{
270 int ret, mode;
6435f0f6 271 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
0f113f3e 272
6435f0f6 273 mode = EVP_CIPHER_CTX_mode(ctx);
0f113f3e
MC		 274 if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE)
275 && !enc) {
6435f0f6
RL		 276 ret = aesni_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
277 &dat->ks.ks);
0f113f3e
MC		 278 dat->block = (block128_f) aesni_decrypt;
279 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
280 (cbc128_f) aesni_cbc_encrypt : NULL;
281 } else {
6435f0f6
RL		 282 ret = aesni_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
283 &dat->ks.ks);
0f113f3e
MC		 284 dat->block = (block128_f) aesni_encrypt;
285 if (mode == EVP_CIPH_CBC_MODE)
286 dat->stream.cbc = (cbc128_f) aesni_cbc_encrypt;
287 else if (mode == EVP_CIPH_CTR_MODE)
288 dat->stream.ctr = (ctr128_f) aesni_ctr32_encrypt_blocks;
289 else
290 dat->stream.cbc = NULL;
291 }
292
293 if (ret < 0) {
294 EVPerr(EVP_F_AESNI_INIT_KEY, EVP_R_AES_KEY_SETUP_FAILED);
295 return 0;
296 }
297
298 return 1;
299}
300
301static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
302 const unsigned char *in, size_t len)
d1fff483 303{
6435f0f6
RL		 304 aesni_cbc_encrypt(in, out, len, &EVP_C_DATA(EVP_AES_KEY,ctx)->ks.ks,
305 EVP_CIPHER_CTX_iv_noconst(ctx),
306 EVP_CIPHER_CTX_encrypting(ctx));
d1fff483 307
0f113f3e 308 return 1;
d1fff483
AP		 309}
310
0f113f3e
MC		 311static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
312 const unsigned char *in, size_t len)
d1fff483 313{
6435f0f6 314 size_t bl = EVP_CIPHER_CTX_block_size(ctx);
d1fff483 315
0f113f3e
MC		 316 if (len < bl)
317 return 1;
d1fff483 318
6435f0f6
RL		 319 aesni_ecb_encrypt(in, out, len, &EVP_C_DATA(EVP_AES_KEY,ctx)->ks.ks,
320 EVP_CIPHER_CTX_encrypting(ctx));
d1fff483 321
0f113f3e 322 return 1;
d1fff483
AP		 323}
324
5158c763 325# define aesni_ofb_cipher aes_ofb_cipher
0f113f3e
MC		 326static int aesni_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
327 const unsigned char *in, size_t len);
d1fff483 328
5158c763 329# define aesni_cfb_cipher aes_cfb_cipher
0f113f3e
MC		 330static int aesni_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
331 const unsigned char *in, size_t len);
d1fff483 332
5158c763 333# define aesni_cfb8_cipher aes_cfb8_cipher
0f113f3e
MC		 334static int aesni_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
335 const unsigned char *in, size_t len);
d1fff483 336
5158c763 337# define aesni_cfb1_cipher aes_cfb1_cipher
0f113f3e
MC		 338static int aesni_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
339 const unsigned char *in, size_t len);
d1fff483 340
5158c763 341# define aesni_ctr_cipher aes_ctr_cipher
17f121de 342static int aesni_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 343 const unsigned char *in, size_t len);
d1fff483 344
17f121de 345static int aesni_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 346 const unsigned char *iv, int enc)
347{
6435f0f6 348 EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,ctx);
0f113f3e
MC		 349 if (!iv && !key)
350 return 1;
351 if (key) {
6435f0f6
RL		 352 aesni_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
353 &gctx->ks.ks);
0f113f3e
MC		 354 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f) aesni_encrypt);
355 gctx->ctr = (ctr128_f) aesni_ctr32_encrypt_blocks;
356 /*
357 * If we have an iv can set it directly, otherwise use saved IV.
358 */
359 if (iv == NULL && gctx->iv_set)
360 iv = gctx->iv;
361 if (iv) {
362 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
363 gctx->iv_set = 1;
364 }
365 gctx->key_set = 1;
366 } else {
367 /* If key set use IV, otherwise copy */
368 if (gctx->key_set)
369 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
370 else
371 memcpy(gctx->iv, iv, gctx->ivlen);
372 gctx->iv_set = 1;
373 gctx->iv_gen = 0;
374 }
375 return 1;
376}
377
5158c763 378# define aesni_gcm_cipher aes_gcm_cipher
17f121de 379static int aesni_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 380 const unsigned char *in, size_t len);
17f121de
AP		 381
382static int aesni_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 383 const unsigned char *iv, int enc)
384{
6435f0f6 385 EVP_AES_XTS_CTX *xctx = EVP_C_DATA(EVP_AES_XTS_CTX,ctx);
2a5f63c9 386
0f113f3e
MC		 387 if (!iv && !key)
388 return 1;
389
390 if (key) {
2a5f63c9
P		 391 /* The key is two half length keys in reality */
392 const int bytes = EVP_CIPHER_CTX_key_length(ctx) / 2;
2a5f63c9
P		 393
394 /*
395 * Verify that the two keys are different.
396 *
397 * This addresses Rogaway's vulnerability.
398 * See comment in aes_xts_init_key() below.
399 */
58ae5a47 400 if (enc && CRYPTO_memcmp(key, key + bytes, bytes) == 0) {
2a5f63c9
P		 401 EVPerr(EVP_F_AESNI_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS);
402 return 0;
403 }
404
0f113f3e
MC		 405 /* key_len is two AES keys */
406 if (enc) {
6435f0f6
RL		 407 aesni_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4,
408 &xctx->ks1.ks);
0f113f3e
MC		 409 xctx->xts.block1 = (block128_f) aesni_encrypt;
410 xctx->stream = aesni_xts_encrypt;
411 } else {
6435f0f6
RL		 412 aesni_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4,
413 &xctx->ks1.ks);
0f113f3e
MC		 414 xctx->xts.block1 = (block128_f) aesni_decrypt;
415 xctx->stream = aesni_xts_decrypt;
416 }
417
6435f0f6
RL		 418 aesni_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2,
419 EVP_CIPHER_CTX_key_length(ctx) * 4,
420 &xctx->ks2.ks);
0f113f3e
MC		 421 xctx->xts.block2 = (block128_f) aesni_encrypt;
422
423 xctx->xts.key1 = &xctx->ks1;
424 }
425
426 if (iv) {
427 xctx->xts.key2 = &xctx->ks2;
6435f0f6 428 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, 16);
0f113f3e
MC		 429 }
430
431 return 1;
432}
433
5158c763 434# define aesni_xts_cipher aes_xts_cipher
17f121de 435static int aesni_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 436 const unsigned char *in, size_t len);
17f121de
AP		 437
438static int aesni_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 439 const unsigned char *iv, int enc)
440{
6435f0f6 441 EVP_AES_CCM_CTX *cctx = EVP_C_DATA(EVP_AES_CCM_CTX,ctx);
0f113f3e
MC		 442 if (!iv && !key)
443 return 1;
444 if (key) {
6435f0f6
RL		 445 aesni_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
446 &cctx->ks.ks);
0f113f3e
MC		 447 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
448 &cctx->ks, (block128_f) aesni_encrypt);
449 cctx->str = enc ? (ccm128_f) aesni_ccm64_encrypt_blocks :
450 (ccm128_f) aesni_ccm64_decrypt_blocks;
451 cctx->key_set = 1;
452 }
453 if (iv) {
6435f0f6 454 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, 15 - cctx->L);
0f113f3e
MC		 455 cctx->iv_set = 1;
456 }
457 return 1;
458}
459
5158c763 460# define aesni_ccm_cipher aes_ccm_cipher
17f121de 461static int aesni_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 462 const unsigned char *in, size_t len);
17f121de 463
5158c763 464# ifndef OPENSSL_NO_OCB
bd30091c
AP		 465void aesni_ocb_encrypt(const unsigned char *in, unsigned char *out,
466 size_t blocks, const void *key,
467 size_t start_block_num,
468 unsigned char offset_i[16],
469 const unsigned char L_[][16],
470 unsigned char checksum[16]);
471void aesni_ocb_decrypt(const unsigned char *in, unsigned char *out,
472 size_t blocks, const void *key,
473 size_t start_block_num,
474 unsigned char offset_i[16],
475 const unsigned char L_[][16],
476 unsigned char checksum[16]);
477
e6b336ef 478static int aesni_ocb_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 479 const unsigned char *iv, int enc)
480{
6435f0f6 481 EVP_AES_OCB_CTX *octx = EVP_C_DATA(EVP_AES_OCB_CTX,ctx);
0f113f3e
MC		 482 if (!iv && !key)
483 return 1;
484 if (key) {
485 do {
486 /*
487 * We set both the encrypt and decrypt key here because decrypt
488 * needs both. We could possibly optimise to remove setting the
489 * decrypt for an encryption operation.
490 */
6435f0f6
RL		 491 aesni_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
492 &octx->ksenc.ks);
493 aesni_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
494 &octx->ksdec.ks);
bdc985b1
AP		 495 if (!CRYPTO_ocb128_init(&octx->ocb,
496 &octx->ksenc.ks, &octx->ksdec.ks,
0f113f3e 497 (block128_f) aesni_encrypt,
bd30091c
AP		 498 (block128_f) aesni_decrypt,
499 enc ? aesni_ocb_encrypt
500 : aesni_ocb_decrypt))
0f113f3e
MC		 501 return 0;
502 }
503 while (0);
504
505 /*
506 * If we have an iv we can set it directly, otherwise use saved IV.
507 */
508 if (iv == NULL && octx->iv_set)
509 iv = octx->iv;
510 if (iv) {
511 if (CRYPTO_ocb128_setiv(&octx->ocb, iv, octx->ivlen, octx->taglen)
512 != 1)
513 return 0;
514 octx->iv_set = 1;
515 }
516 octx->key_set = 1;
517 } else {
518 /* If key set use IV, otherwise copy */
519 if (octx->key_set)
520 CRYPTO_ocb128_setiv(&octx->ocb, iv, octx->ivlen, octx->taglen);
521 else
522 memcpy(octx->iv, iv, octx->ivlen);
523 octx->iv_set = 1;
524 }
525 return 1;
526}
527
5158c763 528# define aesni_ocb_cipher aes_ocb_cipher
e6b336ef 529static int aesni_ocb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 530 const unsigned char *in, size_t len);
5158c763 531# endif /* OPENSSL_NO_OCB */
e6b336ef 532
5158c763 533# define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
17f121de 534static const EVP_CIPHER aesni_##keylen##_##mode = { \
0f113f3e
MC		 535 nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
536 flags|EVP_CIPH_##MODE##_MODE, \
537 aesni_init_key, \
538 aesni_##mode##_cipher, \
539 NULL, \
540 sizeof(EVP_AES_KEY), \
541 NULL,NULL,NULL,NULL }; \
17f121de 542static const EVP_CIPHER aes_##keylen##_##mode = { \
0f113f3e
MC		 543 nid##_##keylen##_##nmode,blocksize, \
544 keylen/8,ivlen, \
545 flags|EVP_CIPH_##MODE##_MODE, \
546 aes_init_key, \
547 aes_##mode##_cipher, \
548 NULL, \
549 sizeof(EVP_AES_KEY), \
550 NULL,NULL,NULL,NULL }; \
17f121de 551const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
8ca28da0 552{ return AESNI_CAPABLE?&aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
17f121de 553
5158c763 554# define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
17f121de 555static const EVP_CIPHER aesni_##keylen##_##mode = { \
0f113f3e
MC		 556 nid##_##keylen##_##mode,blocksize, \
557 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
558 flags|EVP_CIPH_##MODE##_MODE, \
559 aesni_##mode##_init_key, \
560 aesni_##mode##_cipher, \
561 aes_##mode##_cleanup, \
562 sizeof(EVP_AES_##MODE##_CTX), \
563 NULL,NULL,aes_##mode##_ctrl,NULL }; \
17f121de 564static const EVP_CIPHER aes_##keylen##_##mode = { \
0f113f3e
MC		 565 nid##_##keylen##_##mode,blocksize, \
566 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
567 flags|EVP_CIPH_##MODE##_MODE, \
568 aes_##mode##_init_key, \
569 aes_##mode##_cipher, \
570 aes_##mode##_cleanup, \
571 sizeof(EVP_AES_##MODE##_CTX), \
572 NULL,NULL,aes_##mode##_ctrl,NULL }; \
17f121de 573const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
8ca28da0 574{ return AESNI_CAPABLE?&aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
d1fff483 575
5158c763 576#elif defined(AES_ASM) && (defined(__sparc) || defined(__sparc__))
c5f6da54 577
5158c763 578# include "sparc_arch.h"
c5f6da54
AP		 579
580extern unsigned int OPENSSL_sparcv9cap_P[];
581
6944565b
AP		 582/*
583 * Initial Fujitsu SPARC64 X support
584 */
585# define HWAES_CAPABLE (OPENSSL_sparcv9cap_P[0] & SPARCV9_FJAESX)
586# define HWAES_set_encrypt_key aes_fx_set_encrypt_key
587# define HWAES_set_decrypt_key aes_fx_set_decrypt_key
588# define HWAES_encrypt aes_fx_encrypt
589# define HWAES_decrypt aes_fx_decrypt
365f95ad
AP		 590# define HWAES_cbc_encrypt aes_fx_cbc_encrypt
591# define HWAES_ctr32_encrypt_blocks aes_fx_ctr32_encrypt_blocks
6944565b 592
5158c763 593# define SPARC_AES_CAPABLE (OPENSSL_sparcv9cap_P[1] & CFR_AES)
c5f6da54 594
0f113f3e
MC		 595void aes_t4_set_encrypt_key(const unsigned char *key, int bits, AES_KEY *ks);
596void aes_t4_set_decrypt_key(const unsigned char *key, int bits, AES_KEY *ks);
597void aes_t4_encrypt(const unsigned char *in, unsigned char *out,
598 const AES_KEY *key);
599void aes_t4_decrypt(const unsigned char *in, unsigned char *out,
600 const AES_KEY *key);
c5f6da54
AP		 601/*
602 * Key-length specific subroutines were chosen for following reason.
603 * Each SPARC T4 core can execute up to 8 threads which share core's
604 * resources. Loading as much key material to registers allows to
605 * minimize references to shared memory interface, as well as amount
606 * of instructions in inner loops [much needed on T4]. But then having
607 * non-key-length specific routines would require conditional branches
608 * either in inner loops or on subroutines' entries. Former is hardly
609 * acceptable, while latter means code size increase to size occupied
0d4fb843 610 * by multiple key-length specific subroutines, so why fight?
c5f6da54 611 */
0f113f3e
MC		 612void aes128_t4_cbc_encrypt(const unsigned char *in, unsigned char *out,
613 size_t len, const AES_KEY *key,
614 unsigned char *ivec);
615void aes128_t4_cbc_decrypt(const unsigned char *in, unsigned char *out,
616 size_t len, const AES_KEY *key,
617 unsigned char *ivec);
618void aes192_t4_cbc_encrypt(const unsigned char *in, unsigned char *out,
619 size_t len, const AES_KEY *key,
620 unsigned char *ivec);
621void aes192_t4_cbc_decrypt(const unsigned char *in, unsigned char *out,
622 size_t len, const AES_KEY *key,
623 unsigned char *ivec);
624void aes256_t4_cbc_encrypt(const unsigned char *in, unsigned char *out,
625 size_t len, const AES_KEY *key,
626 unsigned char *ivec);
627void aes256_t4_cbc_decrypt(const unsigned char *in, unsigned char *out,
628 size_t len, const AES_KEY *key,
629 unsigned char *ivec);
630void aes128_t4_ctr32_encrypt(const unsigned char *in, unsigned char *out,
631 size_t blocks, const AES_KEY *key,
632 unsigned char *ivec);
633void aes192_t4_ctr32_encrypt(const unsigned char *in, unsigned char *out,
634 size_t blocks, const AES_KEY *key,
635 unsigned char *ivec);
636void aes256_t4_ctr32_encrypt(const unsigned char *in, unsigned char *out,
637 size_t blocks, const AES_KEY *key,
638 unsigned char *ivec);
639void aes128_t4_xts_encrypt(const unsigned char *in, unsigned char *out,
640 size_t blocks, const AES_KEY *key1,
641 const AES_KEY *key2, const unsigned char *ivec);
642void aes128_t4_xts_decrypt(const unsigned char *in, unsigned char *out,
643 size_t blocks, const AES_KEY *key1,
644 const AES_KEY *key2, const unsigned char *ivec);
645void aes256_t4_xts_encrypt(const unsigned char *in, unsigned char *out,
646 size_t blocks, const AES_KEY *key1,
647 const AES_KEY *key2, const unsigned char *ivec);
648void aes256_t4_xts_decrypt(const unsigned char *in, unsigned char *out,
649 size_t blocks, const AES_KEY *key1,
650 const AES_KEY *key2, const unsigned char *ivec);
c5f6da54
AP		 651
652static int aes_t4_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 653 const unsigned char *iv, int enc)
654{
655 int ret, mode, bits;
6435f0f6 656 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
0f113f3e 657
6435f0f6
RL		 658 mode = EVP_CIPHER_CTX_mode(ctx);
659 bits = EVP_CIPHER_CTX_key_length(ctx) * 8;
0f113f3e
MC		 660 if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE)
661 && !enc) {
662 ret = 0;
6435f0f6 663 aes_t4_set_decrypt_key(key, bits, &dat->ks.ks);
0f113f3e
MC		 664 dat->block = (block128_f) aes_t4_decrypt;
665 switch (bits) {
666 case 128:
667 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
668 (cbc128_f) aes128_t4_cbc_decrypt : NULL;
669 break;
670 case 192:
671 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
672 (cbc128_f) aes192_t4_cbc_decrypt : NULL;
673 break;
674 case 256:
675 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
676 (cbc128_f) aes256_t4_cbc_decrypt : NULL;
677 break;
678 default:
679 ret = -1;
680 }
681 } else {
682 ret = 0;
6435f0f6 683 aes_t4_set_encrypt_key(key, bits, &dat->ks.ks);
0f113f3e
MC		 684 dat->block = (block128_f) aes_t4_encrypt;
685 switch (bits) {
686 case 128:
687 if (mode == EVP_CIPH_CBC_MODE)
688 dat->stream.cbc = (cbc128_f) aes128_t4_cbc_encrypt;
689 else if (mode == EVP_CIPH_CTR_MODE)
690 dat->stream.ctr = (ctr128_f) aes128_t4_ctr32_encrypt;
691 else
692 dat->stream.cbc = NULL;
693 break;
694 case 192:
695 if (mode == EVP_CIPH_CBC_MODE)
696 dat->stream.cbc = (cbc128_f) aes192_t4_cbc_encrypt;
697 else if (mode == EVP_CIPH_CTR_MODE)
698 dat->stream.ctr = (ctr128_f) aes192_t4_ctr32_encrypt;
699 else
700 dat->stream.cbc = NULL;
701 break;
702 case 256:
703 if (mode == EVP_CIPH_CBC_MODE)
704 dat->stream.cbc = (cbc128_f) aes256_t4_cbc_encrypt;
705 else if (mode == EVP_CIPH_CTR_MODE)
706 dat->stream.ctr = (ctr128_f) aes256_t4_ctr32_encrypt;
707 else
708 dat->stream.cbc = NULL;
709 break;
710 default:
711 ret = -1;
712 }
713 }
714
715 if (ret < 0) {
716 EVPerr(EVP_F_AES_T4_INIT_KEY, EVP_R_AES_KEY_SETUP_FAILED);
717 return 0;
718 }
719
720 return 1;
721}
722
5158c763 723# define aes_t4_cbc_cipher aes_cbc_cipher
0f113f3e
MC		 724static int aes_t4_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
725 const unsigned char *in, size_t len);
726
5158c763 727# define aes_t4_ecb_cipher aes_ecb_cipher
0f113f3e
MC		 728static int aes_t4_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
729 const unsigned char *in, size_t len);
730
5158c763 731# define aes_t4_ofb_cipher aes_ofb_cipher
0f113f3e
MC		 732static int aes_t4_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
733 const unsigned char *in, size_t len);
734
5158c763 735# define aes_t4_cfb_cipher aes_cfb_cipher
0f113f3e
MC		 736static int aes_t4_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
737 const unsigned char *in, size_t len);
738
5158c763 739# define aes_t4_cfb8_cipher aes_cfb8_cipher
0f113f3e
MC		 740static int aes_t4_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
741 const unsigned char *in, size_t len);
742
5158c763 743# define aes_t4_cfb1_cipher aes_cfb1_cipher
0f113f3e
MC		 744static int aes_t4_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
745 const unsigned char *in, size_t len);
746
5158c763 747# define aes_t4_ctr_cipher aes_ctr_cipher
c5f6da54 748static int aes_t4_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 749 const unsigned char *in, size_t len);
c5f6da54
AP		 750
751static int aes_t4_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 752 const unsigned char *iv, int enc)
753{
6435f0f6 754 EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,ctx);
0f113f3e
MC		 755 if (!iv && !key)
756 return 1;
757 if (key) {
6435f0f6 758 int bits = EVP_CIPHER_CTX_key_length(ctx) * 8;
0f113f3e
MC		 759 aes_t4_set_encrypt_key(key, bits, &gctx->ks.ks);
760 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
761 (block128_f) aes_t4_encrypt);
762 switch (bits) {
763 case 128:
764 gctx->ctr = (ctr128_f) aes128_t4_ctr32_encrypt;
765 break;
766 case 192:
767 gctx->ctr = (ctr128_f) aes192_t4_ctr32_encrypt;
768 break;
769 case 256:
770 gctx->ctr = (ctr128_f) aes256_t4_ctr32_encrypt;
771 break;
772 default:
773 return 0;
774 }
775 /*
776 * If we have an iv can set it directly, otherwise use saved IV.
777 */
778 if (iv == NULL && gctx->iv_set)
779 iv = gctx->iv;
780 if (iv) {
781 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
782 gctx->iv_set = 1;
783 }
784 gctx->key_set = 1;
785 } else {
786 /* If key set use IV, otherwise copy */
787 if (gctx->key_set)
788 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
789 else
790 memcpy(gctx->iv, iv, gctx->ivlen);
791 gctx->iv_set = 1;
792 gctx->iv_gen = 0;
793 }
794 return 1;
795}
796
5158c763 797# define aes_t4_gcm_cipher aes_gcm_cipher
c5f6da54 798static int aes_t4_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 799 const unsigned char *in, size_t len);
c5f6da54
AP		 800
801static int aes_t4_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 802 const unsigned char *iv, int enc)
803{
6435f0f6 804 EVP_AES_XTS_CTX *xctx = EVP_C_DATA(EVP_AES_XTS_CTX,ctx);
2a5f63c9 805
0f113f3e
MC		 806 if (!iv && !key)
807 return 1;
808
809 if (key) {
2a5f63c9
P		 810 /* The key is two half length keys in reality */
811 const int bytes = EVP_CIPHER_CTX_key_length(ctx) / 2;
812 const int bits = bytes * 8;
813
814 /*
815 * Verify that the two keys are different.
816 *
817 * This addresses Rogaway's vulnerability.
818 * See comment in aes_xts_init_key() below.
819 */
58ae5a47 820 if (enc && CRYPTO_memcmp(key, key + bytes, bytes) == 0) {
2a5f63c9
P		 821 EVPerr(EVP_F_AES_T4_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS);
822 return 0;
823 }
824
0f113f3e
MC		 825 xctx->stream = NULL;
826 /* key_len is two AES keys */
827 if (enc) {
828 aes_t4_set_encrypt_key(key, bits, &xctx->ks1.ks);
829 xctx->xts.block1 = (block128_f) aes_t4_encrypt;
830 switch (bits) {
831 case 128:
832 xctx->stream = aes128_t4_xts_encrypt;
833 break;
0f113f3e
MC		 834 case 256:
835 xctx->stream = aes256_t4_xts_encrypt;
836 break;
837 default:
838 return 0;
839 }
840 } else {
6435f0f6
RL		 841 aes_t4_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4,
842 &xctx->ks1.ks);
0f113f3e
MC		 843 xctx->xts.block1 = (block128_f) aes_t4_decrypt;
844 switch (bits) {
845 case 128:
846 xctx->stream = aes128_t4_xts_decrypt;
847 break;
0f113f3e
MC		 848 case 256:
849 xctx->stream = aes256_t4_xts_decrypt;
850 break;
851 default:
852 return 0;
853 }
854 }
855
6435f0f6
RL		 856 aes_t4_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2,
857 EVP_CIPHER_CTX_key_length(ctx) * 4,
858 &xctx->ks2.ks);
0f113f3e
MC		 859 xctx->xts.block2 = (block128_f) aes_t4_encrypt;
860
861 xctx->xts.key1 = &xctx->ks1;
862 }
863
864 if (iv) {
865 xctx->xts.key2 = &xctx->ks2;
6435f0f6 866 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, 16);
0f113f3e
MC		 867 }
868
869 return 1;
870}
871
5158c763 872# define aes_t4_xts_cipher aes_xts_cipher
c5f6da54 873static int aes_t4_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 874 const unsigned char *in, size_t len);
c5f6da54
AP		 875
876static int aes_t4_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 877 const unsigned char *iv, int enc)
878{
6435f0f6 879 EVP_AES_CCM_CTX *cctx = EVP_C_DATA(EVP_AES_CCM_CTX,ctx);
0f113f3e
MC		 880 if (!iv && !key)
881 return 1;
882 if (key) {
6435f0f6 883 int bits = EVP_CIPHER_CTX_key_length(ctx) * 8;
0f113f3e
MC		 884 aes_t4_set_encrypt_key(key, bits, &cctx->ks.ks);
885 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
886 &cctx->ks, (block128_f) aes_t4_encrypt);
bdc985b1 887 cctx->str = NULL;
0f113f3e
MC		 888 cctx->key_set = 1;
889 }
890 if (iv) {
6435f0f6 891 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, 15 - cctx->L);
0f113f3e
MC		 892 cctx->iv_set = 1;
893 }
894 return 1;
895}
896
5158c763 897# define aes_t4_ccm_cipher aes_ccm_cipher
c5f6da54 898static int aes_t4_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 899 const unsigned char *in, size_t len);
c5f6da54 900
5158c763 901# ifndef OPENSSL_NO_OCB
e6b336ef 902static int aes_t4_ocb_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 903 const unsigned char *iv, int enc)
904{
6435f0f6 905 EVP_AES_OCB_CTX *octx = EVP_C_DATA(EVP_AES_OCB_CTX,ctx);
0f113f3e
MC		 906 if (!iv && !key)
907 return 1;
908 if (key) {
909 do {
910 /*
911 * We set both the encrypt and decrypt key here because decrypt
912 * needs both. We could possibly optimise to remove setting the
913 * decrypt for an encryption operation.
914 */
6435f0f6
RL		 915 aes_t4_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
916 &octx->ksenc.ks);
917 aes_t4_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
918 &octx->ksdec.ks);
bdc985b1
AP		 919 if (!CRYPTO_ocb128_init(&octx->ocb,
920 &octx->ksenc.ks, &octx->ksdec.ks,
0f113f3e 921 (block128_f) aes_t4_encrypt,
02dc0b82
AP		 922 (block128_f) aes_t4_decrypt,
923 NULL))
0f113f3e
MC		 924 return 0;
925 }
926 while (0);
927
928 /*
929 * If we have an iv we can set it directly, otherwise use saved IV.
930 */
931 if (iv == NULL && octx->iv_set)
932 iv = octx->iv;
933 if (iv) {
934 if (CRYPTO_ocb128_setiv(&octx->ocb, iv, octx->ivlen, octx->taglen)
935 != 1)
936 return 0;
937 octx->iv_set = 1;
938 }
939 octx->key_set = 1;
940 } else {
941 /* If key set use IV, otherwise copy */
942 if (octx->key_set)
943 CRYPTO_ocb128_setiv(&octx->ocb, iv, octx->ivlen, octx->taglen);
944 else
945 memcpy(octx->iv, iv, octx->ivlen);
946 octx->iv_set = 1;
947 }
948 return 1;
949}
950
5158c763 951# define aes_t4_ocb_cipher aes_ocb_cipher
e6b336ef 952static int aes_t4_ocb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e 953 const unsigned char *in, size_t len);
5158c763 954# endif /* OPENSSL_NO_OCB */
e6b336ef 955
5158c763 956# define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
c5f6da54 957static const EVP_CIPHER aes_t4_##keylen##_##mode = { \
0f113f3e
MC		 958 nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
959 flags|EVP_CIPH_##MODE##_MODE, \
960 aes_t4_init_key, \
961 aes_t4_##mode##_cipher, \
962 NULL, \
963 sizeof(EVP_AES_KEY), \
964 NULL,NULL,NULL,NULL }; \
c5f6da54 965static const EVP_CIPHER aes_##keylen##_##mode = { \
0f113f3e
MC		 966 nid##_##keylen##_##nmode,blocksize, \
967 keylen/8,ivlen, \
968 flags|EVP_CIPH_##MODE##_MODE, \
969 aes_init_key, \
970 aes_##mode##_cipher, \
971 NULL, \
972 sizeof(EVP_AES_KEY), \
973 NULL,NULL,NULL,NULL }; \
c5f6da54
AP		 974const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
975{ return SPARC_AES_CAPABLE?&aes_t4_##keylen##_##mode:&aes_##keylen##_##mode; }
976
5158c763 977# define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
c5f6da54 978static const EVP_CIPHER aes_t4_##keylen##_##mode = { \
0f113f3e
MC		 979 nid##_##keylen##_##mode,blocksize, \
980 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
981 flags|EVP_CIPH_##MODE##_MODE, \
982 aes_t4_##mode##_init_key, \
983 aes_t4_##mode##_cipher, \
984 aes_##mode##_cleanup, \
985 sizeof(EVP_AES_##MODE##_CTX), \
986 NULL,NULL,aes_##mode##_ctrl,NULL }; \
c5f6da54 987static const EVP_CIPHER aes_##keylen##_##mode = { \
0f113f3e
MC		 988 nid##_##keylen##_##mode,blocksize, \
989 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
990 flags|EVP_CIPH_##MODE##_MODE, \
991 aes_##mode##_init_key, \
992 aes_##mode##_cipher, \
993 aes_##mode##_cleanup, \
994 sizeof(EVP_AES_##MODE##_CTX), \
995 NULL,NULL,aes_##mode##_ctrl,NULL }; \
c5f6da54
AP		 996const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
997{ return SPARC_AES_CAPABLE?&aes_t4_##keylen##_##mode:&aes_##keylen##_##mode; }
998
96530eea
PS		 999#elif defined(OPENSSL_CPUID_OBJ) && defined(__s390__)
1000/*
1001 * IBM S390X support
1002 */
1003# include "s390x_arch.h"
1004
55bd169f
PS		 1005typedef struct {
1006 union {
1007 double align;
1008 /*-
1009 * KM-AES parameter block - begin
1010 * (see z/Architecture Principles of Operation >= SA22-7832-06)
1011 */
1012 struct {
1013 unsigned char k[32];
1014 } param;
1015 /* KM-AES parameter block - end */
1016 } km;
1017 unsigned int fc;
1018} S390X_AES_ECB_CTX;
1019
dacd2a87
PS		 1020typedef struct {
1021 union {
1022 double align;
1023 /*-
1024 * KMO-AES parameter block - begin
1025 * (see z/Architecture Principles of Operation >= SA22-7832-08)
1026 */
1027 struct {
1028 unsigned char cv[16];
1029 unsigned char k[32];
1030 } param;
1031 /* KMO-AES parameter block - end */
1032 } kmo;
1033 unsigned int fc;
1034
1035 int res;
1036} S390X_AES_OFB_CTX;
1037
74d38a86
PS		 1038typedef struct {
1039 union {
1040 double align;
1041 /*-
1042 * KMF-AES parameter block - begin
1043 * (see z/Architecture Principles of Operation >= SA22-7832-08)
1044 */
1045 struct {
1046 unsigned char cv[16];
1047 unsigned char k[32];
1048 } param;
1049 /* KMF-AES parameter block - end */
1050 } kmf;
1051 unsigned int fc;
1052
1053 int res;
1054} S390X_AES_CFB_CTX;
1055
96530eea
PS		 1056typedef struct {
1057 union {
1058 double align;
1059 /*-
5d2a6f4b
PS		 1060 * KMA-GCM-AES parameter block - begin
1061 * (see z/Architecture Principles of Operation >= SA22-7832-11)
96530eea
PS		 1062 */
1063 struct {
1064 unsigned char reserved[12];
1065 union {
1066 unsigned int w;
1067 unsigned char b[4];
1068 } cv;
1069 union {
1070 unsigned long long g[2];
1071 unsigned char b[16];
1072 } t;
1073 unsigned char h[16];
1074 unsigned long long taadl;
1075 unsigned long long tpcl;
1076 union {
1077 unsigned long long g[2];
1078 unsigned int w[4];
1079 } j0;
1080 unsigned char k[32];
1081 } param;
5d2a6f4b 1082 /* KMA-GCM-AES parameter block - end */
96530eea
PS		 1083 } kma;
1084 unsigned int fc;
1085 int key_set;
1086
1087 unsigned char *iv;
1088 int ivlen;
1089 int iv_set;
1090 int iv_gen;
1091
1092 int taglen;
1093
1094 unsigned char ares[16];
1095 unsigned char mres[16];
1096 unsigned char kres[16];
1097 int areslen;
1098 int mreslen;
1099 int kreslen;
1100
1101 int tls_aad_len;
1102} S390X_AES_GCM_CTX;
1103
39f5b069
PS		 1104typedef struct {
1105 union {
1106 double align;
1107 /*-
1108 * Padding is chosen so that ccm.kmac_param.k overlaps with key.k and
1109 * ccm.fc with key.k.rounds. Remember that on s390x, an AES_KEY's
1110 * rounds field is used to store the function code and that the key
1111 * schedule is not stored (if aes hardware support is detected).
1112 */
1113 struct {
1114 unsigned char pad[16];
1115 AES_KEY k;
1116 } key;
1117
1118 struct {
1119 /*-
1120 * KMAC-AES parameter block - begin
1121 * (see z/Architecture Principles of Operation >= SA22-7832-08)
1122 */
1123 struct {
1124 union {
1125 unsigned long long g[2];
1126 unsigned char b[16];
1127 } icv;
1128 unsigned char k[32];
1129 } kmac_param;
1130 /* KMAC-AES paramater block - end */
1131
1132 union {
1133 unsigned long long g[2];
1134 unsigned char b[16];
1135 } nonce;
1136 union {
1137 unsigned long long g[2];
1138 unsigned char b[16];
1139 } buf;
1140
1141 unsigned long long blocks;
1142 int l;
1143 int m;
1144 int tls_aad_len;
1145 int iv_set;
1146 int tag_set;
1147 int len_set;
1148 int key_set;
1149
1150 unsigned char pad[140];
1151 unsigned int fc;
1152 } ccm;
1153 } aes;
1154} S390X_AES_CCM_CTX;
1155
55bd169f
PS		 1156/* Convert key size to function code: [16,24,32] -> [18,19,20]. */
1157# define S390X_AES_FC(keylen) (S390X_AES_128 + ((((keylen) << 3) - 128) >> 6))
1158
1159/* Most modes of operation need km for partial block processing. */
1160# define S390X_aes_128_CAPABLE (OPENSSL_s390xcap_P.km[0] & \
1161 S390X_CAPBIT(S390X_AES_128))
1162# define S390X_aes_192_CAPABLE (OPENSSL_s390xcap_P.km[0] & \
1163 S390X_CAPBIT(S390X_AES_192))
1164# define S390X_aes_256_CAPABLE (OPENSSL_s390xcap_P.km[0] & \
1165 S390X_CAPBIT(S390X_AES_256))
96530eea
PS		 1166
1167# define s390x_aes_init_key aes_init_key
1168static int s390x_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
1169 const unsigned char *iv, int enc);
1170
1171# define S390X_aes_128_cbc_CAPABLE 1 /* checked by callee */
1172# define S390X_aes_192_cbc_CAPABLE 1
1173# define S390X_aes_256_cbc_CAPABLE 1
55bd169f
PS		 1174# define S390X_AES_CBC_CTX EVP_AES_KEY
1175
1176# define s390x_aes_cbc_init_key aes_init_key
96530eea
PS		 1177
1178# define s390x_aes_cbc_cipher aes_cbc_cipher
1179static int s390x_aes_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1180 const unsigned char *in, size_t len);
1181
55bd169f
PS		 1182# define S390X_aes_128_ecb_CAPABLE S390X_aes_128_CAPABLE
1183# define S390X_aes_192_ecb_CAPABLE S390X_aes_192_CAPABLE
1184# define S390X_aes_256_ecb_CAPABLE S390X_aes_256_CAPABLE
1185
1186static int s390x_aes_ecb_init_key(EVP_CIPHER_CTX *ctx,
1187 const unsigned char *key,
1188 const unsigned char *iv, int enc)
1189{
1190 S390X_AES_ECB_CTX *cctx = EVP_C_DATA(S390X_AES_ECB_CTX, ctx);
1191 const int keylen = EVP_CIPHER_CTX_key_length(ctx);
1192
1193 cctx->fc = S390X_AES_FC(keylen);
1194 if (!enc)
1195 cctx->fc |= S390X_DECRYPT;
1196
1197 memcpy(cctx->km.param.k, key, keylen);
1198 return 1;
1199}
96530eea 1200
96530eea 1201static int s390x_aes_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
55bd169f
PS		 1202 const unsigned char *in, size_t len)
1203{
1204 S390X_AES_ECB_CTX *cctx = EVP_C_DATA(S390X_AES_ECB_CTX, ctx);
1205
1206 s390x_km(in, len, out, cctx->fc, &cctx->km.param);
1207 return 1;
1208}
96530eea 1209
dacd2a87
PS		 1210# define S390X_aes_128_ofb_CAPABLE (S390X_aes_128_CAPABLE && \
1211 (OPENSSL_s390xcap_P.kmo[0] & \
1212 S390X_CAPBIT(S390X_AES_128)))
1213# define S390X_aes_192_ofb_CAPABLE (S390X_aes_192_CAPABLE && \
1214 (OPENSSL_s390xcap_P.kmo[0] & \
1215 S390X_CAPBIT(S390X_AES_192)))
1216# define S390X_aes_256_ofb_CAPABLE (S390X_aes_256_CAPABLE && \
1217 (OPENSSL_s390xcap_P.kmo[0] & \
1218 S390X_CAPBIT(S390X_AES_256)))
1219
1220static int s390x_aes_ofb_init_key(EVP_CIPHER_CTX *ctx,
1221 const unsigned char *key,
1222 const unsigned char *ivec, int enc)
1223{
1224 S390X_AES_OFB_CTX *cctx = EVP_C_DATA(S390X_AES_OFB_CTX, ctx);
1225 const unsigned char *iv = EVP_CIPHER_CTX_original_iv(ctx);
1226 const int keylen = EVP_CIPHER_CTX_key_length(ctx);
1227 const int ivlen = EVP_CIPHER_CTX_iv_length(ctx);
55bd169f 1228
dacd2a87
PS		 1229 memcpy(cctx->kmo.param.cv, iv, ivlen);
1230 memcpy(cctx->kmo.param.k, key, keylen);
1231 cctx->fc = S390X_AES_FC(keylen);
1232 cctx->res = 0;
1233 return 1;
1234}
96530eea 1235
96530eea 1236static int s390x_aes_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
dacd2a87
PS		 1237 const unsigned char *in, size_t len)
1238{
1239 S390X_AES_OFB_CTX *cctx = EVP_C_DATA(S390X_AES_OFB_CTX, ctx);
1240 int n = cctx->res;
1241 int rem;
1242
1243 while (n && len) {
1244 *out = *in ^ cctx->kmo.param.cv[n];
1245 n = (n + 1) & 0xf;
1246 --len;
1247 ++in;
1248 ++out;
1249 }
1250
1251 rem = len & 0xf;
1252
1253 len &= ~(size_t)0xf;
1254 if (len) {
1255 s390x_kmo(in, len, out, cctx->fc, &cctx->kmo.param);
1256
1257 out += len;
1258 in += len;
1259 }
1260
1261 if (rem) {
1262 s390x_km(cctx->kmo.param.cv, 16, cctx->kmo.param.cv, cctx->fc,
1263 cctx->kmo.param.k);
1264
1265 while (rem--) {
1266 out[n] = in[n] ^ cctx->kmo.param.cv[n];
1267 ++n;
1268 }
1269 }
1270
1271 cctx->res = n;
1272 return 1;
1273}
96530eea 1274
74d38a86
PS		 1275# define S390X_aes_128_cfb_CAPABLE (S390X_aes_128_CAPABLE && \
1276 (OPENSSL_s390xcap_P.kmf[0] & \
1277 S390X_CAPBIT(S390X_AES_128)))
1278# define S390X_aes_192_cfb_CAPABLE (S390X_aes_192_CAPABLE && \
1279 (OPENSSL_s390xcap_P.kmf[0] & \
1280 S390X_CAPBIT(S390X_AES_192)))
1281# define S390X_aes_256_cfb_CAPABLE (S390X_aes_256_CAPABLE && \
1282 (OPENSSL_s390xcap_P.kmf[0] & \
1283 S390X_CAPBIT(S390X_AES_256)))
1284
1285static int s390x_aes_cfb_init_key(EVP_CIPHER_CTX *ctx,
1286 const unsigned char *key,
1287 const unsigned char *ivec, int enc)
1288{
1289 S390X_AES_CFB_CTX *cctx = EVP_C_DATA(S390X_AES_CFB_CTX, ctx);
1290 const unsigned char *iv = EVP_CIPHER_CTX_original_iv(ctx);
1291 const int keylen = EVP_CIPHER_CTX_key_length(ctx);
1292 const int ivlen = EVP_CIPHER_CTX_iv_length(ctx);
1293
1294 cctx->fc = S390X_AES_FC(keylen);
1295 cctx->fc |= 16 << 24; /* 16 bytes cipher feedback */
1296 if (!enc)
1297 cctx->fc |= S390X_DECRYPT;
55bd169f 1298
74d38a86
PS		 1299 cctx->res = 0;
1300 memcpy(cctx->kmf.param.cv, iv, ivlen);
1301 memcpy(cctx->kmf.param.k, key, keylen);
1302 return 1;
1303}
96530eea 1304
96530eea 1305static int s390x_aes_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
74d38a86
PS		 1306 const unsigned char *in, size_t len)
1307{
1308 S390X_AES_CFB_CTX *cctx = EVP_C_DATA(S390X_AES_CFB_CTX, ctx);
1309 const int keylen = EVP_CIPHER_CTX_key_length(ctx);
1310 const int enc = EVP_CIPHER_CTX_encrypting(ctx);
1311 int n = cctx->res;
1312 int rem;
1313 unsigned char tmp;
1314
1315 while (n && len) {
1316 tmp = *in;
1317 *out = cctx->kmf.param.cv[n] ^ tmp;
1318 cctx->kmf.param.cv[n] = enc ? *out : tmp;
1319 n = (n + 1) & 0xf;
1320 --len;
1321 ++in;
1322 ++out;
1323 }
1324
1325 rem = len & 0xf;
1326
1327 len &= ~(size_t)0xf;
1328 if (len) {
1329 s390x_kmf(in, len, out, cctx->fc, &cctx->kmf.param);
1330
1331 out += len;
1332 in += len;
1333 }
1334
1335 if (rem) {
1336 s390x_km(cctx->kmf.param.cv, 16, cctx->kmf.param.cv,
1337 S390X_AES_FC(keylen), cctx->kmf.param.k);
1338
1339 while (rem--) {
1340 tmp = in[n];
1341 out[n] = cctx->kmf.param.cv[n] ^ tmp;
1342 cctx->kmf.param.cv[n] = enc ? out[n] : tmp;
1343 ++n;
1344 }
1345 }
96530eea 1346
74d38a86
PS		 1347 cctx->res = n;
1348 return 1;
1349}
1350
1351# define S390X_aes_128_cfb8_CAPABLE (OPENSSL_s390xcap_P.kmf[0] & \
1352 S390X_CAPBIT(S390X_AES_128))
1353# define S390X_aes_192_cfb8_CAPABLE (OPENSSL_s390xcap_P.kmf[0] & \
1354 S390X_CAPBIT(S390X_AES_192))
1355# define S390X_aes_256_cfb8_CAPABLE (OPENSSL_s390xcap_P.kmf[0] & \
1356 S390X_CAPBIT(S390X_AES_256))
1357
1358static int s390x_aes_cfb8_init_key(EVP_CIPHER_CTX *ctx,
1359 const unsigned char *key,
1360 const unsigned char *ivec, int enc)
1361{
1362 S390X_AES_CFB_CTX *cctx = EVP_C_DATA(S390X_AES_CFB_CTX, ctx);
1363 const unsigned char *iv = EVP_CIPHER_CTX_original_iv(ctx);
1364 const int keylen = EVP_CIPHER_CTX_key_length(ctx);
1365 const int ivlen = EVP_CIPHER_CTX_iv_length(ctx);
1366
1367 cctx->fc = S390X_AES_FC(keylen);
1368 cctx->fc |= 1 << 24; /* 1 byte cipher feedback */
1369 if (!enc)
1370 cctx->fc |= S390X_DECRYPT;
96530eea 1371
74d38a86
PS		 1372 memcpy(cctx->kmf.param.cv, iv, ivlen);
1373 memcpy(cctx->kmf.param.k, key, keylen);
1374 return 1;
1375}
55bd169f 1376
96530eea 1377static int s390x_aes_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
74d38a86
PS		 1378 const unsigned char *in, size_t len)
1379{
1380 S390X_AES_CFB_CTX *cctx = EVP_C_DATA(S390X_AES_CFB_CTX, ctx);
1381
1382 s390x_kmf(in, len, out, cctx->fc, &cctx->kmf.param);
1383 return 1;
1384}
96530eea
PS		 1385
1386# define S390X_aes_128_cfb1_CAPABLE 0
1387# define S390X_aes_192_cfb1_CAPABLE 0
1388# define S390X_aes_256_cfb1_CAPABLE 0
1389
55bd169f
PS		 1390# define s390x_aes_cfb1_init_key aes_init_key
1391
96530eea
PS		 1392# define s390x_aes_cfb1_cipher aes_cfb1_cipher
1393static int s390x_aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1394 const unsigned char *in, size_t len);
1395
1396# define S390X_aes_128_ctr_CAPABLE 1 /* checked by callee */
1397# define S390X_aes_192_ctr_CAPABLE 1
1398# define S390X_aes_256_ctr_CAPABLE 1
55bd169f
PS		 1399# define S390X_AES_CTR_CTX EVP_AES_KEY
1400
1401# define s390x_aes_ctr_init_key aes_init_key
96530eea
PS		 1402
1403# define s390x_aes_ctr_cipher aes_ctr_cipher
1404static int s390x_aes_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1405 const unsigned char *in, size_t len);
1406
1407# define S390X_aes_128_gcm_CAPABLE (S390X_aes_128_CAPABLE && \
1408 (OPENSSL_s390xcap_P.kma[0] & \
1409 S390X_CAPBIT(S390X_AES_128)))
1410# define S390X_aes_192_gcm_CAPABLE (S390X_aes_192_CAPABLE && \
1411 (OPENSSL_s390xcap_P.kma[0] & \
1412 S390X_CAPBIT(S390X_AES_192)))
1413# define S390X_aes_256_gcm_CAPABLE (S390X_aes_256_CAPABLE && \
1414 (OPENSSL_s390xcap_P.kma[0] & \
1415 S390X_CAPBIT(S390X_AES_256)))
1416
1417/* iv + padding length for iv lenghts != 12 */
1418# define S390X_gcm_ivpadlen(i) ((((i) + 15) >> 4 << 4) + 16)
1419
5d2a6f4b
PS		 1420/*-
1421 * Process additional authenticated data. Returns 0 on success. Code is
1422 * big-endian.
1423 */
96530eea
PS		 1424static int s390x_aes_gcm_aad(S390X_AES_GCM_CTX *ctx, const unsigned char *aad,
1425 size_t len)
1426{
1427 unsigned long long alen;
1428 int n, rem;
1429
1430 if (ctx->kma.param.tpcl)
1431 return -2;
1432
1433 alen = ctx->kma.param.taadl + len;
1434 if (alen > (U64(1) << 61) || (sizeof(len) == 8 && alen < len))
1435 return -1;
1436 ctx->kma.param.taadl = alen;
1437
1438 n = ctx->areslen;
1439 if (n) {
1440 while (n && len) {
1441 ctx->ares[n] = *aad;
1442 n = (n + 1) & 0xf;
1443 ++aad;
1444 --len;
1445 }
1446 /* ctx->ares contains a complete block if offset has wrapped around */
1447 if (!n) {
1448 s390x_kma(ctx->ares, 16, NULL, 0, NULL, ctx->fc, &ctx->kma.param);
1449 ctx->fc |= S390X_KMA_HS;
1450 }
1451 ctx->areslen = n;
1452 }
1453
1454 rem = len & 0xf;
1455
25868993 1456 len &= ~(size_t)0xf;
96530eea
PS		 1457 if (len) {
1458 s390x_kma(aad, len, NULL, 0, NULL, ctx->fc, &ctx->kma.param);
1459 aad += len;
1460 ctx->fc |= S390X_KMA_HS;
1461 }
1462
1463 if (rem) {
1464 ctx->areslen = rem;
1465
1466 do {
1467 --rem;
1468 ctx->ares[rem] = aad[rem];
1469 } while (rem);
1470 }
1471 return 0;
1472}
1473
5d2a6f4b
PS		 1474/*-
1475 * En/de-crypt plain/cipher-text and authenticate ciphertext. Returns 0 for
1476 * success. Code is big-endian.
1477 */
96530eea
PS		 1478static int s390x_aes_gcm(S390X_AES_GCM_CTX *ctx, const unsigned char *in,
1479 unsigned char *out, size_t len)
1480{
1481 const unsigned char *inptr;
1482 unsigned long long mlen;
1483 union {
1484 unsigned int w[4];
1485 unsigned char b[16];
1486 } buf;
1487 size_t inlen;
1488 int n, rem, i;
1489
1490 mlen = ctx->kma.param.tpcl + len;
1491 if (mlen > ((U64(1) << 36) - 32) || (sizeof(len) == 8 && mlen < len))
1492 return -1;
1493 ctx->kma.param.tpcl = mlen;
1494
1495 n = ctx->mreslen;
1496 if (n) {
1497 inptr = in;
1498 inlen = len;
1499 while (n && inlen) {
1500 ctx->mres[n] = *inptr;
1501 n = (n + 1) & 0xf;
1502 ++inptr;
1503 --inlen;
1504 }
1505 /* ctx->mres contains a complete block if offset has wrapped around */
1506 if (!n) {
1507 s390x_kma(ctx->ares, ctx->areslen, ctx->mres, 16, buf.b,
1508 ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);
1509 ctx->fc |= S390X_KMA_HS;
1510 ctx->areslen = 0;
1511
1512 /* previous call already encrypted/decrypted its remainder,
1513 * see comment below */
1514 n = ctx->mreslen;
1515 while (n) {
1516 *out = buf.b[n];
1517 n = (n + 1) & 0xf;
1518 ++out;
1519 ++in;
1520 --len;
1521 }
1522 ctx->mreslen = 0;
1523 }
1524 }
1525
1526 rem = len & 0xf;
1527
25868993 1528 len &= ~(size_t)0xf;
96530eea
PS		 1529 if (len) {
1530 s390x_kma(ctx->ares, ctx->areslen, in, len, out,
1531 ctx->fc | S390X_KMA_LAAD, &ctx->kma.param);
1532 in += len;
1533 out += len;
1534 ctx->fc |= S390X_KMA_HS;
1535 ctx->areslen = 0;
1536 }
1537
1538 /*-
1539 * If there is a remainder, it has to be saved such that it can be
1540 * processed by kma later. However, we also have to do the for-now
1541 * unauthenticated encryption/decryption part here and now...
1542 */
1543 if (rem) {
1544 if (!ctx->mreslen) {
1545 buf.w[0] = ctx->kma.param.j0.w[0];
1546 buf.w[1] = ctx->kma.param.j0.w[1];
1547 buf.w[2] = ctx->kma.param.j0.w[2];
1548 buf.w[3] = ctx->kma.param.cv.w + 1;
1549 s390x_km(buf.b, 16, ctx->kres, ctx->fc & 0x1f, &ctx->kma.param.k);
1550 }
1551
1552 n = ctx->mreslen;
1553 for (i = 0; i < rem; i++) {
1554 ctx->mres[n + i] = in[i];
1555 out[i] = in[i] ^ ctx->kres[n + i];
1556 }
1557
1558 ctx->mreslen += rem;
1559 }
1560 return 0;
1561}
1562
5d2a6f4b
PS		 1563/*-
1564 * Initialize context structure. Code is big-endian.
1565 */
96530eea
PS		 1566static void s390x_aes_gcm_setiv(S390X_AES_GCM_CTX *ctx,
1567 const unsigned char *iv)
1568{
1569 ctx->kma.param.t.g[0] = 0;
1570 ctx->kma.param.t.g[1] = 0;
1571 ctx->kma.param.tpcl = 0;
1572 ctx->kma.param.taadl = 0;
1573 ctx->mreslen = 0;
1574 ctx->areslen = 0;
1575 ctx->kreslen = 0;
1576
1577 if (ctx->ivlen == 12) {
1578 memcpy(&ctx->kma.param.j0, iv, ctx->ivlen);
1579 ctx->kma.param.j0.w[3] = 1;
1580 ctx->kma.param.cv.w = 1;
1581 } else {
1582 /* ctx->iv has the right size and is already padded. */
1583 memcpy(ctx->iv, iv, ctx->ivlen);
1584 s390x_kma(ctx->iv, S390X_gcm_ivpadlen(ctx->ivlen), NULL, 0, NULL,
1585 ctx->fc, &ctx->kma.param);
1586 ctx->fc |= S390X_KMA_HS;
1587
1588 ctx->kma.param.j0.g[0] = ctx->kma.param.t.g[0];
1589 ctx->kma.param.j0.g[1] = ctx->kma.param.t.g[1];
1590 ctx->kma.param.cv.w = ctx->kma.param.j0.w[3];
1591 ctx->kma.param.t.g[0] = 0;
1592 ctx->kma.param.t.g[1] = 0;
1593 }
1594}
1595
5d2a6f4b
PS		 1596/*-
1597 * Performs various operations on the context structure depending on control
1598 * type. Returns 1 for success, 0 for failure and -1 for unknown control type.
1599 * Code is big-endian.
1600 */
96530eea
PS		 1601static int s390x_aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1602{
1603 S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);
1604 S390X_AES_GCM_CTX *gctx_out;
1605 EVP_CIPHER_CTX *out;
1606 unsigned char *buf, *iv;
1607 int ivlen, enc, len;
1608
1609 switch (type) {
1610 case EVP_CTRL_INIT:
1611 ivlen = EVP_CIPHER_CTX_iv_length(c);
1612 iv = EVP_CIPHER_CTX_iv_noconst(c);
1613 gctx->key_set = 0;
1614 gctx->iv_set = 0;
1615 gctx->ivlen = ivlen;
1616 gctx->iv = iv;
1617 gctx->taglen = -1;
1618 gctx->iv_gen = 0;
1619 gctx->tls_aad_len = -1;
1620 return 1;
1621
1622 case EVP_CTRL_AEAD_SET_IVLEN:
1623 if (arg <= 0)
1624 return 0;
1625
1626 if (arg != 12) {
1627 iv = EVP_CIPHER_CTX_iv_noconst(c);
1628 len = S390X_gcm_ivpadlen(arg);
1629
1630 /* Allocate memory for iv if needed. */
1631 if (gctx->ivlen == 12 || len > S390X_gcm_ivpadlen(gctx->ivlen)) {
1632 if (gctx->iv != iv)
1633 OPENSSL_free(gctx->iv);
1634
cdb10bae
RS		 1635 if ((gctx->iv = OPENSSL_malloc(len)) == NULL) {
1636 EVPerr(EVP_F_S390X_AES_GCM_CTRL, ERR_R_MALLOC_FAILURE);
96530eea 1637 return 0;
cdb10bae 1638 }
96530eea
PS		 1639 }
1640 /* Add padding. */
1641 memset(gctx->iv + arg, 0, len - arg - 8);
1642 *((unsigned long long *)(gctx->iv + len - 8)) = arg << 3;
1643 }
1644 gctx->ivlen = arg;
1645 return 1;
1646
1647 case EVP_CTRL_AEAD_SET_TAG:
1648 buf = EVP_CIPHER_CTX_buf_noconst(c);
1649 enc = EVP_CIPHER_CTX_encrypting(c);
1650 if (arg <= 0 || arg > 16 || enc)
1651 return 0;
1652
1653 memcpy(buf, ptr, arg);
1654 gctx->taglen = arg;
1655 return 1;
1656
1657 case EVP_CTRL_AEAD_GET_TAG:
1658 enc = EVP_CIPHER_CTX_encrypting(c);
1659 if (arg <= 0 || arg > 16 || !enc || gctx->taglen < 0)
1660 return 0;
1661
1662 memcpy(ptr, gctx->kma.param.t.b, arg);
1663 return 1;
1664
1665 case EVP_CTRL_GCM_SET_IV_FIXED:
1666 /* Special case: -1 length restores whole iv */
1667 if (arg == -1) {
1668 memcpy(gctx->iv, ptr, gctx->ivlen);
1669 gctx->iv_gen = 1;
1670 return 1;
1671 }
1672 /*
1673 * Fixed field must be at least 4 bytes and invocation field at least
1674 * 8.
1675 */
1676 if ((arg < 4) || (gctx->ivlen - arg) < 8)
1677 return 0;
1678
1679 if (arg)
1680 memcpy(gctx->iv, ptr, arg);
1681
1682 enc = EVP_CIPHER_CTX_encrypting(c);
16cfc2c9
KR		 1683 if (enc && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
1684 return 0;
96530eea
PS		 1685
1686 gctx->iv_gen = 1;
1687 return 1;
1688
1689 case EVP_CTRL_GCM_IV_GEN:
1690 if (gctx->iv_gen == 0 || gctx->key_set == 0)
1691 return 0;
1692
1693 s390x_aes_gcm_setiv(gctx, gctx->iv);
1694
1695 if (arg <= 0 || arg > gctx->ivlen)
1696 arg = gctx->ivlen;
1697
1698 memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
1699 /*
1700 * Invocation field will be at least 8 bytes in size and so no need
1701 * to check wrap around or increment more than last 8 bytes.
1702 */
03a5e5ae 1703 ctr64_inc(gctx->iv + gctx->ivlen - 8);
96530eea
PS		 1704 gctx->iv_set = 1;
1705 return 1;
1706
1707 case EVP_CTRL_GCM_SET_IV_INV:
1708 enc = EVP_CIPHER_CTX_encrypting(c);
1709 if (gctx->iv_gen == 0 || gctx->key_set == 0 || enc)
1710 return 0;
1711
1712 memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
1713 s390x_aes_gcm_setiv(gctx, gctx->iv);
1714 gctx->iv_set = 1;
1715 return 1;
1716
1717 case EVP_CTRL_AEAD_TLS1_AAD:
1718 /* Save the aad for later use. */
1719 if (arg != EVP_AEAD_TLS1_AAD_LEN)
1720 return 0;
1721
1722 buf = EVP_CIPHER_CTX_buf_noconst(c);
1723 memcpy(buf, ptr, arg);
1724 gctx->tls_aad_len = arg;
1725
1726 len = buf[arg - 2] << 8 | buf[arg - 1];
1727 /* Correct length for explicit iv. */
1728 if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
1729 return 0;
1730 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
1731
1732 /* If decrypting correct for tag too. */
1733 enc = EVP_CIPHER_CTX_encrypting(c);
1734 if (!enc) {
1735 if (len < EVP_GCM_TLS_TAG_LEN)
1736 return 0;
1737 len -= EVP_GCM_TLS_TAG_LEN;
1738 }
1739 buf[arg - 2] = len >> 8;
1740 buf[arg - 1] = len & 0xff;
1741 /* Extra padding: tag appended to record. */
1742 return EVP_GCM_TLS_TAG_LEN;
1743
1744 case EVP_CTRL_COPY:
1745 out = ptr;
1746 gctx_out = EVP_C_DATA(S390X_AES_GCM_CTX, out);
1747 iv = EVP_CIPHER_CTX_iv_noconst(c);
1748
1749 if (gctx->iv == iv) {
1750 gctx_out->iv = EVP_CIPHER_CTX_iv_noconst(out);
1751 } else {
1752 len = S390X_gcm_ivpadlen(gctx->ivlen);
1753
cdb10bae
RS		 1754 if ((gctx_out->iv = OPENSSL_malloc(len)) == NULL) {
1755 EVPerr(EVP_F_S390X_AES_GCM_CTRL, ERR_R_MALLOC_FAILURE);
96530eea 1756 return 0;
cdb10bae 1757 }
96530eea
PS		 1758
1759 memcpy(gctx_out->iv, gctx->iv, len);
1760 }
1761 return 1;
1762
1763 default:
1764 return -1;
1765 }
1766}
1767
5d2a6f4b
PS		 1768/*-
1769 * Set key and/or iv. Returns 1 on success. Otherwise 0 is returned.
1770 */
96530eea
PS		 1771static int s390x_aes_gcm_init_key(EVP_CIPHER_CTX *ctx,
1772 const unsigned char *key,
1773 const unsigned char *iv, int enc)
1774{
1775 S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
1776 int keylen;
1777
1778 if (iv == NULL && key == NULL)
1779 return 1;
1780
1781 if (key != NULL) {
1782 keylen = EVP_CIPHER_CTX_key_length(ctx);
1783 memcpy(&gctx->kma.param.k, key, keylen);
1784
8eb399fb 1785 gctx->fc = S390X_AES_FC(keylen);
96530eea
PS		 1786 if (!enc)
1787 gctx->fc |= S390X_DECRYPT;
1788
1789 if (iv == NULL && gctx->iv_set)
1790 iv = gctx->iv;
1791
1792 if (iv != NULL) {
1793 s390x_aes_gcm_setiv(gctx, iv);
1794 gctx->iv_set = 1;
1795 }
1796 gctx->key_set = 1;
1797 } else {
1798 if (gctx->key_set)
1799 s390x_aes_gcm_setiv(gctx, iv);
1800 else
1801 memcpy(gctx->iv, iv, gctx->ivlen);
1802
1803 gctx->iv_set = 1;
1804 gctx->iv_gen = 0;
1805 }
1806 return 1;
1807}
1808
5d2a6f4b
PS		 1809/*-
1810 * En/de-crypt and authenticate TLS packet. Returns the number of bytes written
1811 * if successful. Otherwise -1 is returned. Code is big-endian.
1812 */
96530eea
PS		 1813static int s390x_aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1814 const unsigned char *in, size_t len)
1815{
1816 S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
1817 const unsigned char *buf = EVP_CIPHER_CTX_buf_noconst(ctx);
1818 const int enc = EVP_CIPHER_CTX_encrypting(ctx);
1819 int rv = -1;
1820
1821 if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
1822 return -1;
1823
1824 if (EVP_CIPHER_CTX_ctrl(ctx, enc ? EVP_CTRL_GCM_IV_GEN
1825 : EVP_CTRL_GCM_SET_IV_INV,
1826 EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
1827 goto err;
1828
1829 in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1830 out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1831 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
1832
1833 gctx->kma.param.taadl = gctx->tls_aad_len << 3;
1834 gctx->kma.param.tpcl = len << 3;
1835 s390x_kma(buf, gctx->tls_aad_len, in, len, out,
1836 gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);
1837
1838 if (enc) {
1839 memcpy(out + len, gctx->kma.param.t.b, EVP_GCM_TLS_TAG_LEN);
1840 rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
1841 } else {
1842 if (CRYPTO_memcmp(gctx->kma.param.t.b, in + len,
1843 EVP_GCM_TLS_TAG_LEN)) {
1844 OPENSSL_cleanse(out, len);
1845 goto err;
1846 }
1847 rv = len;
1848 }
1849err:
1850 gctx->iv_set = 0;
1851 gctx->tls_aad_len = -1;
1852 return rv;
1853}
1854
5d2a6f4b
PS		 1855/*-
1856 * Called from EVP layer to initialize context, process additional
1857 * authenticated data, en/de-crypt plain/cipher-text and authenticate
1858 * ciphertext or process a TLS packet, depending on context. Returns bytes
1859 * written on success. Otherwise -1 is returned. Code is big-endian.
1860 */
96530eea
PS		 1861static int s390x_aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1862 const unsigned char *in, size_t len)
1863{
1864 S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, ctx);
1865 unsigned char *buf, tmp[16];
1866 int enc;
1867
1868 if (!gctx->key_set)
1869 return -1;
1870
1871 if (gctx->tls_aad_len >= 0)
1872 return s390x_aes_gcm_tls_cipher(ctx, out, in, len);
1873
1874 if (!gctx->iv_set)
1875 return -1;
1876
1877 if (in != NULL) {
1878 if (out == NULL) {
1879 if (s390x_aes_gcm_aad(gctx, in, len))
1880 return -1;
1881 } else {
1882 if (s390x_aes_gcm(gctx, in, out, len))
1883 return -1;
1884 }
1885 return len;
1886 } else {
1887 gctx->kma.param.taadl <<= 3;
1888 gctx->kma.param.tpcl <<= 3;
1889 s390x_kma(gctx->ares, gctx->areslen, gctx->mres, gctx->mreslen, tmp,
1890 gctx->fc | S390X_KMA_LAAD | S390X_KMA_LPC, &gctx->kma.param);
1891 /* recall that we already did en-/decrypt gctx->mres
1892 * and returned it to caller... */
1893 OPENSSL_cleanse(tmp, gctx->mreslen);
1894 gctx->iv_set = 0;
1895
1896 enc = EVP_CIPHER_CTX_encrypting(ctx);
1897 if (enc) {
1898 gctx->taglen = 16;
1899 } else {
1900 if (gctx->taglen < 0)
1901 return -1;
1902
1903 buf = EVP_CIPHER_CTX_buf_noconst(ctx);
1904 if (CRYPTO_memcmp(buf, gctx->kma.param.t.b, gctx->taglen))
1905 return -1;
1906 }
1907 return 0;
1908 }
1909}
1910
1911static int s390x_aes_gcm_cleanup(EVP_CIPHER_CTX *c)
1912{
1913 S390X_AES_GCM_CTX *gctx = EVP_C_DATA(S390X_AES_GCM_CTX, c);
1914 const unsigned char *iv;
1915
1916 if (gctx == NULL)
1917 return 0;
1918
1919 iv = EVP_CIPHER_CTX_iv(c);
1920 if (iv != gctx->iv)
1921 OPENSSL_free(gctx->iv);
1922
1923 OPENSSL_cleanse(gctx, sizeof(*gctx));
1924 return 1;
1925}
1926
1927# define S390X_AES_XTS_CTX EVP_AES_XTS_CTX
1928# define S390X_aes_128_xts_CAPABLE 1 /* checked by callee */
1929# define S390X_aes_256_xts_CAPABLE 1
1930
1931# define s390x_aes_xts_init_key aes_xts_init_key
1932static int s390x_aes_xts_init_key(EVP_CIPHER_CTX *ctx,
1933 const unsigned char *key,
1934 const unsigned char *iv, int enc);
1935# define s390x_aes_xts_cipher aes_xts_cipher
1936static int s390x_aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1937 const unsigned char *in, size_t len);
1938# define s390x_aes_xts_ctrl aes_xts_ctrl
1939static int s390x_aes_xts_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
1940# define s390x_aes_xts_cleanup aes_xts_cleanup
1941
39f5b069
PS		 1942# define S390X_aes_128_ccm_CAPABLE (S390X_aes_128_CAPABLE && \
1943 (OPENSSL_s390xcap_P.kmac[0] & \
1944 S390X_CAPBIT(S390X_AES_128)))
1945# define S390X_aes_192_ccm_CAPABLE (S390X_aes_192_CAPABLE && \
1946 (OPENSSL_s390xcap_P.kmac[0] & \
1947 S390X_CAPBIT(S390X_AES_192)))
1948# define S390X_aes_256_ccm_CAPABLE (S390X_aes_256_CAPABLE && \
1949 (OPENSSL_s390xcap_P.kmac[0] & \
1950 S390X_CAPBIT(S390X_AES_256)))
1951
1952# define S390X_CCM_AAD_FLAG 0x40
1953
1954/*-
1955 * Set nonce and length fields. Code is big-endian.
1956 */
1957static inline void s390x_aes_ccm_setiv(S390X_AES_CCM_CTX *ctx,
1958 const unsigned char *nonce,
1959 size_t mlen)
1960{
1961 ctx->aes.ccm.nonce.b[0] &= ~S390X_CCM_AAD_FLAG;
1962 ctx->aes.ccm.nonce.g[1] = mlen;
1963 memcpy(ctx->aes.ccm.nonce.b + 1, nonce, 15 - ctx->aes.ccm.l);
1964}
1965
1966/*-
1967 * Process additional authenticated data. Code is big-endian.
1968 */
1969static void s390x_aes_ccm_aad(S390X_AES_CCM_CTX *ctx, const unsigned char *aad,
1970 size_t alen)
1971{
1972 unsigned char *ptr;
1973 int i, rem;
1974
1975 if (!alen)
1976 return;
1977
1978 ctx->aes.ccm.nonce.b[0] |= S390X_CCM_AAD_FLAG;
1979
1980 /* Suppress 'type-punned pointer dereference' warning. */
1981 ptr = ctx->aes.ccm.buf.b;
1982
1983 if (alen < ((1 << 16) - (1 << 8))) {
1984 *(uint16_t *)ptr = alen;
1985 i = 2;
1986 } else if (sizeof(alen) == 8
1987 && alen >= (size_t)1 << (32 % (sizeof(alen) * 8))) {
1988 *(uint16_t *)ptr = 0xffff;
1989 *(uint64_t *)(ptr + 2) = alen;
1990 i = 10;
1991 } else {
1992 *(uint16_t *)ptr = 0xfffe;
1993 *(uint32_t *)(ptr + 2) = alen;
1994 i = 6;
1995 }
1996
1997 while (i < 16 && alen) {
1998 ctx->aes.ccm.buf.b[i] = *aad;
1999 ++aad;
2000 --alen;
2001 ++i;
2002 }
2003 while (i < 16) {
2004 ctx->aes.ccm.buf.b[i] = 0;
2005 ++i;
2006 }
2007
2008 ctx->aes.ccm.kmac_param.icv.g[0] = 0;
2009 ctx->aes.ccm.kmac_param.icv.g[1] = 0;
2010 s390x_kmac(ctx->aes.ccm.nonce.b, 32, ctx->aes.ccm.fc,
2011 &ctx->aes.ccm.kmac_param);
2012 ctx->aes.ccm.blocks += 2;
2013
2014 rem = alen & 0xf;
25868993 2015 alen &= ~(size_t)0xf;
39f5b069
PS		 2016 if (alen) {
2017 s390x_kmac(aad, alen, ctx->aes.ccm.fc, &ctx->aes.ccm.kmac_param);
2018 ctx->aes.ccm.blocks += alen >> 4;
2019 aad += alen;
2020 }
2021 if (rem) {
2022 for (i = 0; i < rem; i++)
2023 ctx->aes.ccm.kmac_param.icv.b[i] ^= aad[i];
2024
2025 s390x_km(ctx->aes.ccm.kmac_param.icv.b, 16,
2026 ctx->aes.ccm.kmac_param.icv.b, ctx->aes.ccm.fc,
2027 ctx->aes.ccm.kmac_param.k);
2028 ctx->aes.ccm.blocks++;
2029 }
2030}
2031
2032/*-
2033 * En/de-crypt plain/cipher-text. Compute tag from plaintext. Returns 0 for
2034 * success.
2035 */
2036static int s390x_aes_ccm(S390X_AES_CCM_CTX *ctx, const unsigned char *in,
2037 unsigned char *out, size_t len, int enc)
2038{
2039 size_t n, rem;
2040 unsigned int i, l, num;
2041 unsigned char flags;
2042
2043 flags = ctx->aes.ccm.nonce.b[0];
2044 if (!(flags & S390X_CCM_AAD_FLAG)) {
2045 s390x_km(ctx->aes.ccm.nonce.b, 16, ctx->aes.ccm.kmac_param.icv.b,
2046 ctx->aes.ccm.fc, ctx->aes.ccm.kmac_param.k);
2047 ctx->aes.ccm.blocks++;
2048 }
2049 l = flags & 0x7;
2050 ctx->aes.ccm.nonce.b[0] = l;
2051
2052 /*-
2053 * Reconstruct length from encoded length field
2054 * and initialize it with counter value.
2055 */
2056 n = 0;
2057 for (i = 15 - l; i < 15; i++) {
2058 n |= ctx->aes.ccm.nonce.b[i];
2059 ctx->aes.ccm.nonce.b[i] = 0;
2060 n <<= 8;
2061 }
2062 n |= ctx->aes.ccm.nonce.b[15];
2063 ctx->aes.ccm.nonce.b[15] = 1;
2064
2065 if (n != len)
2066 return -1; /* length mismatch */
2067
2068 if (enc) {
2069 /* Two operations per block plus one for tag encryption */
2070 ctx->aes.ccm.blocks += (((len + 15) >> 4) << 1) + 1;
2071 if (ctx->aes.ccm.blocks > (1ULL << 61))
2072 return -2; /* too much data */
2073 }
2074
2075 num = 0;
2076 rem = len & 0xf;
25868993 2077 len &= ~(size_t)0xf;
39f5b069
PS		 2078
2079 if (enc) {
2080 /* mac-then-encrypt */
2081 if (len)
2082 s390x_kmac(in, len, ctx->aes.ccm.fc, &ctx->aes.ccm.kmac_param);
2083 if (rem) {
2084 for (i = 0; i < rem; i++)
2085 ctx->aes.ccm.kmac_param.icv.b[i] ^= in[len + i];
2086
2087 s390x_km(ctx->aes.ccm.kmac_param.icv.b, 16,
2088 ctx->aes.ccm.kmac_param.icv.b, ctx->aes.ccm.fc,
2089 ctx->aes.ccm.kmac_param.k);
2090 }
2091
2092 CRYPTO_ctr128_encrypt_ctr32(in, out, len + rem, &ctx->aes.key.k,
2093 ctx->aes.ccm.nonce.b, ctx->aes.ccm.buf.b,
2094 &num, (ctr128_f)AES_ctr32_encrypt);
2095 } else {
2096 /* decrypt-then-mac */
2097 CRYPTO_ctr128_encrypt_ctr32(in, out, len + rem, &ctx->aes.key.k,
2098 ctx->aes.ccm.nonce.b, ctx->aes.ccm.buf.b,
2099 &num, (ctr128_f)AES_ctr32_encrypt);
2100
2101 if (len)
2102 s390x_kmac(out, len, ctx->aes.ccm.fc, &ctx->aes.ccm.kmac_param);
2103 if (rem) {
2104 for (i = 0; i < rem; i++)
2105 ctx->aes.ccm.kmac_param.icv.b[i] ^= out[len + i];
2106
2107 s390x_km(ctx->aes.ccm.kmac_param.icv.b, 16,
2108 ctx->aes.ccm.kmac_param.icv.b, ctx->aes.ccm.fc,
2109 ctx->aes.ccm.kmac_param.k);
2110 }
2111 }
2112 /* encrypt tag */
2113 for (i = 15 - l; i < 16; i++)
2114 ctx->aes.ccm.nonce.b[i] = 0;
2115
2116 s390x_km(ctx->aes.ccm.nonce.b, 16, ctx->aes.ccm.buf.b, ctx->aes.ccm.fc,
2117 ctx->aes.ccm.kmac_param.k);
2118 ctx->aes.ccm.kmac_param.icv.g[0] ^= ctx->aes.ccm.buf.g[0];
2119 ctx->aes.ccm.kmac_param.icv.g[1] ^= ctx->aes.ccm.buf.g[1];
2120
2121 ctx->aes.ccm.nonce.b[0] = flags; /* restore flags field */
2122 return 0;
2123}
2124
2125/*-
2126 * En/de-crypt and authenticate TLS packet. Returns the number of bytes written
2127 * if successful. Otherwise -1 is returned.
2128 */
2129static int s390x_aes_ccm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2130 const unsigned char *in, size_t len)
2131{
2132 S390X_AES_CCM_CTX *cctx = EVP_C_DATA(S390X_AES_CCM_CTX, ctx);
2133 unsigned char *ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
2134 unsigned char *buf = EVP_CIPHER_CTX_buf_noconst(ctx);
2135 const int enc = EVP_CIPHER_CTX_encrypting(ctx);
2136
2137 if (out != in
2138 || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)cctx->aes.ccm.m))
2139 return -1;
2140
2141 if (enc) {
2142 /* Set explicit iv (sequence number). */
2143 memcpy(out, buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
2144 }
2145
2146 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->aes.ccm.m;
2147 /*-
2148 * Get explicit iv (sequence number). We already have fixed iv
2149 * (server/client_write_iv) here.
2150 */
2151 memcpy(ivec + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
2152 s390x_aes_ccm_setiv(cctx, ivec, len);
2153
2154 /* Process aad (sequence number|type|version|length) */
2155 s390x_aes_ccm_aad(cctx, buf, cctx->aes.ccm.tls_aad_len);
2156
2157 in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
2158 out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
96530eea 2159
39f5b069
PS		 2160 if (enc) {
2161 if (s390x_aes_ccm(cctx, in, out, len, enc))
2162 return -1;
2163
2164 memcpy(out + len, cctx->aes.ccm.kmac_param.icv.b, cctx->aes.ccm.m);
2165 return len + EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->aes.ccm.m;
2166 } else {
2167 if (!s390x_aes_ccm(cctx, in, out, len, enc)) {
2168 if (!CRYPTO_memcmp(cctx->aes.ccm.kmac_param.icv.b, in + len,
2169 cctx->aes.ccm.m))
2170 return len;
2171 }
2172
2173 OPENSSL_cleanse(out, len);
2174 return -1;
2175 }
2176}
2177
2178/*-
2179 * Set key and flag field and/or iv. Returns 1 if successful. Otherwise 0 is
2180 * returned.
2181 */
96530eea
PS		 2182static int s390x_aes_ccm_init_key(EVP_CIPHER_CTX *ctx,
2183 const unsigned char *key,
39f5b069
PS		 2184 const unsigned char *iv, int enc)
2185{
2186 S390X_AES_CCM_CTX *cctx = EVP_C_DATA(S390X_AES_CCM_CTX, ctx);
2187 unsigned char *ivec;
2188 int keylen;
2189
2190 if (iv == NULL && key == NULL)
2191 return 1;
2192
2193 if (key != NULL) {
2194 keylen = EVP_CIPHER_CTX_key_length(ctx);
8eb399fb 2195 cctx->aes.ccm.fc = S390X_AES_FC(keylen);
39f5b069
PS		 2196 memcpy(cctx->aes.ccm.kmac_param.k, key, keylen);
2197
2198 /* Store encoded m and l. */
2199 cctx->aes.ccm.nonce.b[0] = ((cctx->aes.ccm.l - 1) & 0x7)
2200 | (((cctx->aes.ccm.m - 2) >> 1) & 0x7) << 3;
2201 memset(cctx->aes.ccm.nonce.b + 1, 0,
2202 sizeof(cctx->aes.ccm.nonce.b));
2203 cctx->aes.ccm.blocks = 0;
2204
2205 cctx->aes.ccm.key_set = 1;
2206 }
2207
2208 if (iv != NULL) {
2209 ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
2210 memcpy(ivec, iv, 15 - cctx->aes.ccm.l);
2211
2212 cctx->aes.ccm.iv_set = 1;
2213 }
2214
2215 return 1;
2216}
2217
2218/*-
2219 * Called from EVP layer to initialize context, process additional
2220 * authenticated data, en/de-crypt plain/cipher-text and authenticate
2221 * plaintext or process a TLS packet, depending on context. Returns bytes
2222 * written on success. Otherwise -1 is returned.
2223 */
96530eea 2224static int s390x_aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
39f5b069
PS		 2225 const unsigned char *in, size_t len)
2226{
2227 S390X_AES_CCM_CTX *cctx = EVP_C_DATA(S390X_AES_CCM_CTX, ctx);
2228 const int enc = EVP_CIPHER_CTX_encrypting(ctx);
2229 int rv;
2230 unsigned char *buf, *ivec;
2231
2232 if (!cctx->aes.ccm.key_set)
2233 return -1;
2234
2235 if (cctx->aes.ccm.tls_aad_len >= 0)
2236 return s390x_aes_ccm_tls_cipher(ctx, out, in, len);
2237
2238 /*-
2239 * Final(): Does not return any data. Recall that ccm is mac-then-encrypt
2240 * so integrity must be checked already at Update() i.e., before
2241 * potentially corrupted data is output.
2242 */
2243 if (in == NULL && out != NULL)
2244 return 0;
2245
2246 if (!cctx->aes.ccm.iv_set)
2247 return -1;
2248
39f5b069
PS		 2249 if (out == NULL) {
2250 /* Update(): Pass message length. */
2251 if (in == NULL) {
2252 ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
2253 s390x_aes_ccm_setiv(cctx, ivec, len);
2254
2255 cctx->aes.ccm.len_set = 1;
2256 return len;
2257 }
2258
2259 /* Update(): Process aad. */
2260 if (!cctx->aes.ccm.len_set && len)
2261 return -1;
2262
2263 s390x_aes_ccm_aad(cctx, in, len);
2264 return len;
2265 }
2266
2341db5c
PS		 2267 /* The tag must be set before actually decrypting data */
2268 if (!enc && !cctx->aes.ccm.tag_set)
2269 return -1;
2270
39f5b069
PS		 2271 /* Update(): Process message. */
2272
2273 if (!cctx->aes.ccm.len_set) {
2274 /*-
c257f61f 2275 * In case message length was not previously set explicitly via
39f5b069
PS		 2276 * Update(), set it now.
2277 */
2278 ivec = EVP_CIPHER_CTX_iv_noconst(ctx);
2279 s390x_aes_ccm_setiv(cctx, ivec, len);
2280
2281 cctx->aes.ccm.len_set = 1;
2282 }
2283
2284 if (enc) {
2285 if (s390x_aes_ccm(cctx, in, out, len, enc))
2286 return -1;
2287
2288 cctx->aes.ccm.tag_set = 1;
2289 return len;
2290 } else {
2291 rv = -1;
2292
2293 if (!s390x_aes_ccm(cctx, in, out, len, enc)) {
2294 buf = EVP_CIPHER_CTX_buf_noconst(ctx);
2295 if (!CRYPTO_memcmp(cctx->aes.ccm.kmac_param.icv.b, buf,
2296 cctx->aes.ccm.m))
2297 rv = len;
2298 }
2299
2300 if (rv == -1)
2301 OPENSSL_cleanse(out, len);
2302
2303 cctx->aes.ccm.iv_set = 0;
2304 cctx->aes.ccm.tag_set = 0;
2305 cctx->aes.ccm.len_set = 0;
2306 return rv;
2307 }
2308}
2309
2310/*-
2311 * Performs various operations on the context structure depending on control
2312 * type. Returns 1 for success, 0 for failure and -1 for unknown control type.
2313 * Code is big-endian.
2314 */
2315static int s390x_aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
2316{
2317 S390X_AES_CCM_CTX *cctx = EVP_C_DATA(S390X_AES_CCM_CTX, c);
2318 unsigned char *buf, *iv;
2319 int enc, len;
2320
2321 switch (type) {
2322 case EVP_CTRL_INIT:
2323 cctx->aes.ccm.key_set = 0;
2324 cctx->aes.ccm.iv_set = 0;
2325 cctx->aes.ccm.l = 8;
2326 cctx->aes.ccm.m = 12;
2327 cctx->aes.ccm.tag_set = 0;
2328 cctx->aes.ccm.len_set = 0;
2329 cctx->aes.ccm.tls_aad_len = -1;
2330 return 1;
2331
2332 case EVP_CTRL_AEAD_TLS1_AAD:
2333 if (arg != EVP_AEAD_TLS1_AAD_LEN)
2334 return 0;
2335
2336 /* Save the aad for later use. */
2337 buf = EVP_CIPHER_CTX_buf_noconst(c);
2338 memcpy(buf, ptr, arg);
2339 cctx->aes.ccm.tls_aad_len = arg;
2340
03a5e5ae 2341 len = buf[arg - 2] << 8 | buf[arg - 1];
39f5b069
PS		 2342 if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
2343 return 0;
2344
2345 /* Correct length for explicit iv. */
2346 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
2347
2348 enc = EVP_CIPHER_CTX_encrypting(c);
2349 if (!enc) {
2350 if (len < cctx->aes.ccm.m)
2351 return 0;
2352
2353 /* Correct length for tag. */
2354 len -= cctx->aes.ccm.m;
2355 }
2356
03a5e5ae
PS		 2357 buf[arg - 2] = len >> 8;
2358 buf[arg - 1] = len & 0xff;
2359
39f5b069
PS		 2360 /* Extra padding: tag appended to record. */
2361 return cctx->aes.ccm.m;
2362
2363 case EVP_CTRL_CCM_SET_IV_FIXED:
2364 if (arg != EVP_CCM_TLS_FIXED_IV_LEN)
2365 return 0;
2366
2367 /* Copy to first part of the iv. */
2368 iv = EVP_CIPHER_CTX_iv_noconst(c);
2369 memcpy(iv, ptr, arg);
2370 return 1;
2371
2372 case EVP_CTRL_AEAD_SET_IVLEN:
2373 arg = 15 - arg;
2374 /* fall-through */
2375
2376 case EVP_CTRL_CCM_SET_L:
2377 if (arg < 2 || arg > 8)
2378 return 0;
2379
2380 cctx->aes.ccm.l = arg;
2381 return 1;
2382
2383 case EVP_CTRL_AEAD_SET_TAG:
2384 if ((arg & 1) || arg < 4 || arg > 16)
2385 return 0;
2386
2387 enc = EVP_CIPHER_CTX_encrypting(c);
2388 if (enc && ptr)
2389 return 0;
2390
2391 if (ptr) {
2392 cctx->aes.ccm.tag_set = 1;
2393 buf = EVP_CIPHER_CTX_buf_noconst(c);
2394 memcpy(buf, ptr, arg);
2395 }
2396
2397 cctx->aes.ccm.m = arg;
2398 return 1;
2399
2400 case EVP_CTRL_AEAD_GET_TAG:
2401 enc = EVP_CIPHER_CTX_encrypting(c);
2402 if (!enc || !cctx->aes.ccm.tag_set)
2403 return 0;
2404
2405 if(arg < cctx->aes.ccm.m)
2406 return 0;
2407
2408 memcpy(ptr, cctx->aes.ccm.kmac_param.icv.b, cctx->aes.ccm.m);
2409 cctx->aes.ccm.tag_set = 0;
2410 cctx->aes.ccm.iv_set = 0;
2411 cctx->aes.ccm.len_set = 0;
2412 return 1;
2413
2414 case EVP_CTRL_COPY:
2415 return 1;
2416
2417 default:
2418 return -1;
2419 }
2420}
2421
96530eea
PS		 2422# define s390x_aes_ccm_cleanup aes_ccm_cleanup
2423
2424# ifndef OPENSSL_NO_OCB
2425# define S390X_AES_OCB_CTX EVP_AES_OCB_CTX
2426# define S390X_aes_128_ocb_CAPABLE 0
2427# define S390X_aes_192_ocb_CAPABLE 0
2428# define S390X_aes_256_ocb_CAPABLE 0
2429
2430# define s390x_aes_ocb_init_key aes_ocb_init_key
2431static int s390x_aes_ocb_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
2432 const unsigned char *iv, int enc);
2433# define s390x_aes_ocb_cipher aes_ocb_cipher
2434static int s390x_aes_ocb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2435 const unsigned char *in, size_t len);
2436# define s390x_aes_ocb_cleanup aes_ocb_cleanup
2437static int s390x_aes_ocb_cleanup(EVP_CIPHER_CTX *);
2438# define s390x_aes_ocb_ctrl aes_ocb_ctrl
2439static int s390x_aes_ocb_ctrl(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
2440# endif
2441
2442# define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode, \
2443 MODE,flags) \
2444static const EVP_CIPHER s390x_aes_##keylen##_##mode = { \
2445 nid##_##keylen##_##nmode,blocksize, \
2446 keylen / 8, \
2447 ivlen, \
2448 flags | EVP_CIPH_##MODE##_MODE, \
55bd169f 2449 s390x_aes_##mode##_init_key, \
96530eea
PS		 2450 s390x_aes_##mode##_cipher, \
2451 NULL, \
55bd169f 2452 sizeof(S390X_AES_##MODE##_CTX), \
96530eea
PS		 2453 NULL, \
2454 NULL, \
2455 NULL, \
2456 NULL \
2457}; \
2458static const EVP_CIPHER aes_##keylen##_##mode = { \
2459 nid##_##keylen##_##nmode, \
2460 blocksize, \
2461 keylen / 8, \
2462 ivlen, \
2463 flags | EVP_CIPH_##MODE##_MODE, \
2464 aes_init_key, \
2465 aes_##mode##_cipher, \
2466 NULL, \
2467 sizeof(EVP_AES_KEY), \
55bd169f
PS		 2468 NULL, \
2469 NULL, \
2470 NULL, \
2471 NULL \
96530eea
PS		 2472}; \
2473const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
2474{ \
2475 return S390X_aes_##keylen##_##mode##_CAPABLE ? \
2476 &s390x_aes_##keylen##_##mode : &aes_##keylen##_##mode; \
2477}
2478
2479# define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags)\
2480static const EVP_CIPHER s390x_aes_##keylen##_##mode = { \
2481 nid##_##keylen##_##mode, \
2482 blocksize, \
2483 (EVP_CIPH_##MODE##_MODE == EVP_CIPH_XTS_MODE ? 2 : 1) * keylen / 8, \
2484 ivlen, \
2485 flags | EVP_CIPH_##MODE##_MODE, \
2486 s390x_aes_##mode##_init_key, \
2487 s390x_aes_##mode##_cipher, \
2488 s390x_aes_##mode##_cleanup, \
2489 sizeof(S390X_AES_##MODE##_CTX), \
2490 NULL, \
2491 NULL, \
2492 s390x_aes_##mode##_ctrl, \
2493 NULL \
2494}; \
2495static const EVP_CIPHER aes_##keylen##_##mode = { \
2496 nid##_##keylen##_##mode,blocksize, \
2497 (EVP_CIPH_##MODE##_MODE == EVP_CIPH_XTS_MODE ? 2 : 1) * keylen / 8, \
2498 ivlen, \
2499 flags | EVP_CIPH_##MODE##_MODE, \
2500 aes_##mode##_init_key, \
2501 aes_##mode##_cipher, \
2502 aes_##mode##_cleanup, \
2503 sizeof(EVP_AES_##MODE##_CTX), \
2504 NULL, \
2505 NULL, \
2506 aes_##mode##_ctrl, \
2507 NULL \
2508}; \
2509const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
2510{ \
2511 return S390X_aes_##keylen##_##mode##_CAPABLE ? \
2512 &s390x_aes_##keylen##_##mode : &aes_##keylen##_##mode; \
2513}
2514
5158c763 2515#else
17f121de 2516
5158c763 2517# define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
17f121de 2518static const EVP_CIPHER aes_##keylen##_##mode = { \
0f113f3e
MC		 2519 nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
2520 flags|EVP_CIPH_##MODE##_MODE, \
2521 aes_init_key, \
2522 aes_##mode##_cipher, \
2523 NULL, \
2524 sizeof(EVP_AES_KEY), \
2525 NULL,NULL,NULL,NULL }; \
17f121de
AP		 2526const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
2527{ return &aes_##keylen##_##mode; }
d1fff483 2528
5158c763 2529# define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
17f121de 2530static const EVP_CIPHER aes_##keylen##_##mode = { \
0f113f3e
MC		 2531 nid##_##keylen##_##mode,blocksize, \
2532 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
2533 flags|EVP_CIPH_##MODE##_MODE, \
2534 aes_##mode##_init_key, \
2535 aes_##mode##_cipher, \
2536 aes_##mode##_cleanup, \
2537 sizeof(EVP_AES_##MODE##_CTX), \
2538 NULL,NULL,aes_##mode##_ctrl,NULL }; \
17f121de
AP		 2539const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
2540{ return &aes_##keylen##_##mode; }
9575d1a9 2541
5158c763 2542#endif
9575d1a9 2543
5158c763
MC		 2544#if defined(OPENSSL_CPUID_OBJ) && (defined(__arm__) || defined(__arm) || defined(__aarch64__))
2545# include "arm_arch.h"
2546# if __ARM_MAX_ARCH__>=7
2547# if defined(BSAES_ASM)
2548# define BSAES_CAPABLE (OPENSSL_armcap_P & ARMV7_NEON)
2549# endif
2550# if defined(VPAES_ASM)
2551# define VPAES_CAPABLE (OPENSSL_armcap_P & ARMV7_NEON)
0f113f3e 2552# endif
5158c763
MC		 2553# define HWAES_CAPABLE (OPENSSL_armcap_P & ARMV8_AES)
2554# define HWAES_set_encrypt_key aes_v8_set_encrypt_key
2555# define HWAES_set_decrypt_key aes_v8_set_decrypt_key
2556# define HWAES_encrypt aes_v8_encrypt
2557# define HWAES_decrypt aes_v8_decrypt
2558# define HWAES_cbc_encrypt aes_v8_cbc_encrypt
2559# define HWAES_ctr32_encrypt_blocks aes_v8_ctr32_encrypt_blocks
ddacb8f2 2560# endif
5158c763 2561#endif
d1fff483 2562
5158c763 2563#if defined(HWAES_CAPABLE)
ddacb8f2 2564int HWAES_set_encrypt_key(const unsigned char *userKey, const int bits,
0f113f3e 2565 AES_KEY *key);
ddacb8f2 2566int HWAES_set_decrypt_key(const unsigned char *userKey, const int bits,
0f113f3e 2567 AES_KEY *key);
ddacb8f2 2568void HWAES_encrypt(const unsigned char *in, unsigned char *out,
0f113f3e 2569 const AES_KEY *key);
ddacb8f2 2570void HWAES_decrypt(const unsigned char *in, unsigned char *out,
0f113f3e 2571 const AES_KEY *key);
ddacb8f2 2572void HWAES_cbc_encrypt(const unsigned char *in, unsigned char *out,
0f113f3e
MC		 2573 size_t length, const AES_KEY *key,
2574 unsigned char *ivec, const int enc);
ddacb8f2 2575void HWAES_ctr32_encrypt_blocks(const unsigned char *in, unsigned char *out,
0f113f3e
MC		 2576 size_t len, const AES_KEY *key,
2577 const unsigned char ivec[16]);
46f047d7
AP		 2578void HWAES_xts_encrypt(const unsigned char *inp, unsigned char *out,
2579 size_t len, const AES_KEY *key1,
2580 const AES_KEY *key2, const unsigned char iv[16]);
2581void HWAES_xts_decrypt(const unsigned char *inp, unsigned char *out,
2582 size_t len, const AES_KEY *key1,
2583 const AES_KEY *key2, const unsigned char iv[16]);
5158c763 2584#endif
ddacb8f2 2585
5158c763 2586#define BLOCK_CIPHER_generic_pack(nid,keylen,flags) \
0f113f3e
MC		 2587 BLOCK_CIPHER_generic(nid,keylen,16,16,cbc,cbc,CBC,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \
2588 BLOCK_CIPHER_generic(nid,keylen,16,0,ecb,ecb,ECB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \
2589 BLOCK_CIPHER_generic(nid,keylen,1,16,ofb128,ofb,OFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \
2590 BLOCK_CIPHER_generic(nid,keylen,1,16,cfb128,cfb,CFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \
2591 BLOCK_CIPHER_generic(nid,keylen,1,16,cfb1,cfb1,CFB,flags) \
2592 BLOCK_CIPHER_generic(nid,keylen,1,16,cfb8,cfb8,CFB,flags) \
2593 BLOCK_CIPHER_generic(nid,keylen,1,16,ctr,ctr,CTR,flags)
d1fff483
AP		 2594
2595static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 2596 const unsigned char *iv, int enc)
2597{
2598 int ret, mode;
6435f0f6 2599 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
0f113f3e 2600
6435f0f6 2601 mode = EVP_CIPHER_CTX_mode(ctx);
0f113f3e 2602 if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE)
c01a3c6d 2603 && !enc) {
5158c763 2604#ifdef HWAES_CAPABLE
0f113f3e 2605 if (HWAES_CAPABLE) {
6435f0f6
RL		 2606 ret = HWAES_set_decrypt_key(key,
2607 EVP_CIPHER_CTX_key_length(ctx) * 8,
2608 &dat->ks.ks);
0f113f3e
MC		 2609 dat->block = (block128_f) HWAES_decrypt;
2610 dat->stream.cbc = NULL;
5158c763 2611# ifdef HWAES_cbc_encrypt
0f113f3e
MC		 2612 if (mode == EVP_CIPH_CBC_MODE)
2613 dat->stream.cbc = (cbc128_f) HWAES_cbc_encrypt;
0f113f3e 2614# endif
5158c763
MC		 2615 } else
2616#endif
2617#ifdef BSAES_CAPABLE
0f113f3e 2618 if (BSAES_CAPABLE && mode == EVP_CIPH_CBC_MODE) {
6435f0f6
RL		 2619 ret = AES_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
2620 &dat->ks.ks);
0f113f3e
MC		 2621 dat->block = (block128_f) AES_decrypt;
2622 dat->stream.cbc = (cbc128_f) bsaes_cbc_encrypt;
2623 } else
5158c763
MC		 2624#endif
2625#ifdef VPAES_CAPABLE
0f113f3e 2626 if (VPAES_CAPABLE) {
6435f0f6
RL		 2627 ret = vpaes_set_decrypt_key(key,
2628 EVP_CIPHER_CTX_key_length(ctx) * 8,
2629 &dat->ks.ks);
0f113f3e
MC		 2630 dat->block = (block128_f) vpaes_decrypt;
2631 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
2632 (cbc128_f) vpaes_cbc_encrypt : NULL;
2633 } else
5158c763 2634#endif
0f113f3e 2635 {
6435f0f6
RL		 2636 ret = AES_set_decrypt_key(key,
2637 EVP_CIPHER_CTX_key_length(ctx) * 8,
2638 &dat->ks.ks);
0f113f3e
MC		 2639 dat->block = (block128_f) AES_decrypt;
2640 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
2641 (cbc128_f) AES_cbc_encrypt : NULL;
c01a3c6d 2642 }
0f113f3e 2643 } else
5158c763 2644#ifdef HWAES_CAPABLE
0f113f3e 2645 if (HWAES_CAPABLE) {
6435f0f6
RL		 2646 ret = HWAES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
2647 &dat->ks.ks);
0f113f3e
MC		 2648 dat->block = (block128_f) HWAES_encrypt;
2649 dat->stream.cbc = NULL;
5158c763 2650# ifdef HWAES_cbc_encrypt
0f113f3e
MC		 2651 if (mode == EVP_CIPH_CBC_MODE)
2652 dat->stream.cbc = (cbc128_f) HWAES_cbc_encrypt;
2653 else
5158c763
MC		 2654# endif
2655# ifdef HWAES_ctr32_encrypt_blocks
0f113f3e
MC		 2656 if (mode == EVP_CIPH_CTR_MODE)
2657 dat->stream.ctr = (ctr128_f) HWAES_ctr32_encrypt_blocks;
2658 else
5158c763 2659# endif
0f113f3e
MC		 2660 (void)0; /* terminate potentially open 'else' */
2661 } else
5158c763
MC		 2662#endif
2663#ifdef BSAES_CAPABLE
0f113f3e 2664 if (BSAES_CAPABLE && mode == EVP_CIPH_CTR_MODE) {
6435f0f6
RL		 2665 ret = AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
2666 &dat->ks.ks);
0f113f3e
MC		 2667 dat->block = (block128_f) AES_encrypt;
2668 dat->stream.ctr = (ctr128_f) bsaes_ctr32_encrypt_blocks;
2669 } else
5158c763
MC		 2670#endif
2671#ifdef VPAES_CAPABLE
0f113f3e 2672 if (VPAES_CAPABLE) {
6435f0f6
RL		 2673 ret = vpaes_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
2674 &dat->ks.ks);
0f113f3e
MC		 2675 dat->block = (block128_f) vpaes_encrypt;
2676 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
2677 (cbc128_f) vpaes_cbc_encrypt : NULL;
2678 } else
5158c763 2679#endif
0f113f3e 2680 {
6435f0f6
RL		 2681 ret = AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
2682 &dat->ks.ks);
0f113f3e
MC		 2683 dat->block = (block128_f) AES_encrypt;
2684 dat->stream.cbc = mode == EVP_CIPH_CBC_MODE ?
2685 (cbc128_f) AES_cbc_encrypt : NULL;
5158c763 2686#ifdef AES_CTR_ASM
0f113f3e
MC		 2687 if (mode == EVP_CIPH_CTR_MODE)
2688 dat->stream.ctr = (ctr128_f) AES_ctr32_encrypt;
5158c763 2689#endif
0f113f3e 2690 }
d1fff483 2691
0f113f3e
MC		 2692 if (ret < 0) {
2693 EVPerr(EVP_F_AES_INIT_KEY, EVP_R_AES_KEY_SETUP_FAILED);
2694 return 0;
2695 }
d1fff483 2696
0f113f3e
MC		 2697 return 1;
2698}
d1fff483 2699
0f113f3e
MC		 2700static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2701 const unsigned char *in, size_t len)
17f121de 2702{
6435f0f6 2703 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
8ca28da0 2704
0f113f3e 2705 if (dat->stream.cbc)
6435f0f6
RL		 2706 (*dat->stream.cbc) (in, out, len, &dat->ks,
2707 EVP_CIPHER_CTX_iv_noconst(ctx),
2708 EVP_CIPHER_CTX_encrypting(ctx));
2709 else if (EVP_CIPHER_CTX_encrypting(ctx))
2710 CRYPTO_cbc128_encrypt(in, out, len, &dat->ks,
2711 EVP_CIPHER_CTX_iv_noconst(ctx), dat->block);
0f113f3e 2712 else
6435f0f6
RL		 2713 CRYPTO_cbc128_decrypt(in, out, len, &dat->ks,
2714 EVP_CIPHER_CTX_iv_noconst(ctx), dat->block);
17f121de 2715
0f113f3e 2716 return 1;
17f121de
AP		 2717}
2718
0f113f3e
MC		 2719static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2720 const unsigned char *in, size_t len)
17f121de 2721{
6435f0f6 2722 size_t bl = EVP_CIPHER_CTX_block_size(ctx);
0f113f3e 2723 size_t i;
6435f0f6 2724 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
17f121de 2725
0f113f3e
MC		 2726 if (len < bl)
2727 return 1;
17f121de 2728
0f113f3e
MC		 2729 for (i = 0, len -= bl; i <= len; i += bl)
2730 (*dat->block) (in + i, out + i, &dat->ks);
17f121de 2731
0f113f3e 2732 return 1;
17f121de 2733}
deb2c1a1 2734
0f113f3e
MC		 2735static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2736 const unsigned char *in, size_t len)
17f121de 2737{
6435f0f6 2738 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
8ca28da0 2739
6435f0f6 2740 int num = EVP_CIPHER_CTX_num(ctx);
0f113f3e 2741 CRYPTO_ofb128_encrypt(in, out, len, &dat->ks,
6435f0f6
RL		 2742 EVP_CIPHER_CTX_iv_noconst(ctx), &num, dat->block);
2743 EVP_CIPHER_CTX_set_num(ctx, num);
0f113f3e 2744 return 1;
17f121de 2745}
deb2c1a1 2746
0f113f3e
MC		 2747static int aes_cfb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2748 const unsigned char *in, size_t len)
17f121de 2749{
6435f0f6 2750 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
8ca28da0 2751
6435f0f6 2752 int num = EVP_CIPHER_CTX_num(ctx);
0f113f3e 2753 CRYPTO_cfb128_encrypt(in, out, len, &dat->ks,
6435f0f6
RL		 2754 EVP_CIPHER_CTX_iv_noconst(ctx), &num,
2755 EVP_CIPHER_CTX_encrypting(ctx), dat->block);
2756 EVP_CIPHER_CTX_set_num(ctx, num);
0f113f3e 2757 return 1;
17f121de
AP		 2758}
2759
0f113f3e
MC		 2760static int aes_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2761 const unsigned char *in, size_t len)
17f121de 2762{
6435f0f6 2763 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
8ca28da0 2764
6435f0f6 2765 int num = EVP_CIPHER_CTX_num(ctx);
0f113f3e 2766 CRYPTO_cfb128_8_encrypt(in, out, len, &dat->ks,
6435f0f6
RL		 2767 EVP_CIPHER_CTX_iv_noconst(ctx), &num,
2768 EVP_CIPHER_CTX_encrypting(ctx), dat->block);
2769 EVP_CIPHER_CTX_set_num(ctx, num);
0f113f3e 2770 return 1;
17f121de 2771}
8d1ebe0b 2772
0f113f3e
MC		 2773static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2774 const unsigned char *in, size_t len)
17f121de 2775{
6435f0f6 2776 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
0f113f3e 2777
6435f0f6
RL		 2778 if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS)) {
2779 int num = EVP_CIPHER_CTX_num(ctx);
0f113f3e 2780 CRYPTO_cfb128_1_encrypt(in, out, len, &dat->ks,
6435f0f6
RL		 2781 EVP_CIPHER_CTX_iv_noconst(ctx), &num,
2782 EVP_CIPHER_CTX_encrypting(ctx), dat->block);
2783 EVP_CIPHER_CTX_set_num(ctx, num);
0f113f3e
MC		 2784 return 1;
2785 }
2786
2787 while (len >= MAXBITCHUNK) {
6435f0f6 2788 int num = EVP_CIPHER_CTX_num(ctx);
0f113f3e 2789 CRYPTO_cfb128_1_encrypt(in, out, MAXBITCHUNK * 8, &dat->ks,
6435f0f6
RL		 2790 EVP_CIPHER_CTX_iv_noconst(ctx), &num,
2791 EVP_CIPHER_CTX_encrypting(ctx), dat->block);
2792 EVP_CIPHER_CTX_set_num(ctx, num);
0f113f3e 2793 len -= MAXBITCHUNK;
604e591e
BE		 2794 out += MAXBITCHUNK;
2795 in += MAXBITCHUNK;
0f113f3e 2796 }
6435f0f6
RL		 2797 if (len) {
2798 int num = EVP_CIPHER_CTX_num(ctx);
0f113f3e 2799 CRYPTO_cfb128_1_encrypt(in, out, len * 8, &dat->ks,
6435f0f6
RL		 2800 EVP_CIPHER_CTX_iv_noconst(ctx), &num,
2801 EVP_CIPHER_CTX_encrypting(ctx), dat->block);
2802 EVP_CIPHER_CTX_set_num(ctx, num);
2803 }
0f113f3e
MC		 2804
2805 return 1;
17f121de 2806}
8d1ebe0b 2807
0f113f3e
MC		 2808static int aes_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
2809 const unsigned char *in, size_t len)
d976f992 2810{
6435f0f6
RL		 2811 unsigned int num = EVP_CIPHER_CTX_num(ctx);
2812 EVP_AES_KEY *dat = EVP_C_DATA(EVP_AES_KEY,ctx);
0f113f3e
MC		 2813
2814 if (dat->stream.ctr)
2815 CRYPTO_ctr128_encrypt_ctr32(in, out, len, &dat->ks,
6435f0f6
RL		 2816 EVP_CIPHER_CTX_iv_noconst(ctx),
2817 EVP_CIPHER_CTX_buf_noconst(ctx),
2818 &num, dat->stream.ctr);
0f113f3e
MC		 2819 else
2820 CRYPTO_ctr128_encrypt(in, out, len, &dat->ks,
6435f0f6
RL		 2821 EVP_CIPHER_CTX_iv_noconst(ctx),
2822 EVP_CIPHER_CTX_buf_noconst(ctx), &num,
2823 dat->block);
2824 EVP_CIPHER_CTX_set_num(ctx, num);
0f113f3e 2825 return 1;
d976f992
AP		 2826}
2827
0f113f3e
MC		 2828BLOCK_CIPHER_generic_pack(NID_aes, 128, 0)
2829 BLOCK_CIPHER_generic_pack(NID_aes, 192, 0)
2830 BLOCK_CIPHER_generic_pack(NID_aes, 256, 0)
bdaa5415
DSH		 2831
2832static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
0f113f3e 2833{
6435f0f6 2834 EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,c);
273a0218
BE		 2835 if (gctx == NULL)
2836 return 0;
0f113f3e 2837 OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
6435f0f6 2838 if (gctx->iv != EVP_CIPHER_CTX_iv_noconst(c))
0f113f3e
MC		 2839 OPENSSL_free(gctx->iv);
2840 return 1;
2841}
bdaa5415
DSH		 2842
2843static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
0f113f3e 2844{
6435f0f6 2845 EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,c);
0f113f3e
MC		 2846 switch (type) {
2847 case EVP_CTRL_INIT:
2848 gctx->key_set = 0;
2849 gctx->iv_set = 0;
c5307d9c
AP		 2850 gctx->ivlen = c->cipher->iv_len;
2851 gctx->iv = c->iv;
0f113f3e
MC		 2852 gctx->taglen = -1;
2853 gctx->iv_gen = 0;
2854 gctx->tls_aad_len = -1;
2855 return 1;
2856
e640fa02 2857 case EVP_CTRL_AEAD_SET_IVLEN:
0f113f3e
MC		 2858 if (arg <= 0)
2859 return 0;
2860 /* Allocate memory for IV if needed */
2861 if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen)) {
c5307d9c 2862 if (gctx->iv != c->iv)
0f113f3e 2863 OPENSSL_free(gctx->iv);
cdb10bae
RS		 2864 if ((gctx->iv = OPENSSL_malloc(arg)) == NULL) {
2865 EVPerr(EVP_F_AES_GCM_CTRL, ERR_R_MALLOC_FAILURE);
0f113f3e 2866 return 0;
cdb10bae 2867 }
0f113f3e
MC		 2868 }
2869 gctx->ivlen = arg;
2870 return 1;
2871
e640fa02 2872 case EVP_CTRL_AEAD_SET_TAG:
c5307d9c 2873 if (arg <= 0 || arg > 16 || c->encrypt)
0f113f3e 2874 return 0;
c5307d9c 2875 memcpy(c->buf, ptr, arg);
0f113f3e
MC		 2876 gctx->taglen = arg;
2877 return 1;
2878
e640fa02 2879 case EVP_CTRL_AEAD_GET_TAG:
c5307d9c 2880 if (arg <= 0 || arg > 16 || !c->encrypt
6435f0f6 2881 || gctx->taglen < 0)
0f113f3e 2882 return 0;
c5307d9c 2883 memcpy(ptr, c->buf, arg);
0f113f3e
MC		 2884 return 1;
2885
2886 case EVP_CTRL_GCM_SET_IV_FIXED:
2887 /* Special case: -1 length restores whole IV */
2888 if (arg == -1) {
2889 memcpy(gctx->iv, ptr, gctx->ivlen);
2890 gctx->iv_gen = 1;
2891 return 1;
2892 }
2893 /*
2894 * Fixed field must be at least 4 bytes and invocation field at least
2895 * 8.
2896 */
2897 if ((arg < 4) || (gctx->ivlen - arg) < 8)
2898 return 0;
2899 if (arg)
2900 memcpy(gctx->iv, ptr, arg);
c5307d9c 2901 if (c->encrypt && RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
16cfc2c9 2902 return 0;
0f113f3e
MC		 2903 gctx->iv_gen = 1;
2904 return 1;
2905
2906 case EVP_CTRL_GCM_IV_GEN:
2907 if (gctx->iv_gen == 0 || gctx->key_set == 0)
2908 return 0;
2909 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
2910 if (arg <= 0 || arg > gctx->ivlen)
2911 arg = gctx->ivlen;
2912 memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
2913 /*
2914 * Invocation field will be at least 8 bytes in size and so no need
2915 * to check wrap around or increment more than last 8 bytes.
2916 */
2917 ctr64_inc(gctx->iv + gctx->ivlen - 8);
2918 gctx->iv_set = 1;
2919 return 1;
2920
2921 case EVP_CTRL_GCM_SET_IV_INV:
c5307d9c 2922 if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt)
0f113f3e
MC		 2923 return 0;
2924 memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
2925 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
2926 gctx->iv_set = 1;
2927 return 1;
2928
2929 case EVP_CTRL_AEAD_TLS1_AAD:
2930 /* Save the AAD for later use */
c8269881 2931 if (arg != EVP_AEAD_TLS1_AAD_LEN)
0f113f3e 2932 return 0;
c5307d9c 2933 memcpy(c->buf, ptr, arg);
0f113f3e
MC		 2934 gctx->tls_aad_len = arg;
2935 {
c5307d9c 2936 unsigned int len = c->buf[arg - 2] << 8 | c->buf[arg - 1];
0f113f3e 2937 /* Correct length for explicit IV */
2198b3a5
AP		 2938 if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
2939 return 0;
0f113f3e
MC		 2940 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
2941 /* If decrypting correct for tag too */
c5307d9c 2942 if (!c->encrypt) {
2198b3a5
AP		 2943 if (len < EVP_GCM_TLS_TAG_LEN)
2944 return 0;
0f113f3e 2945 len -= EVP_GCM_TLS_TAG_LEN;
2198b3a5 2946 }
c5307d9c
AP		 2947 c->buf[arg - 2] = len >> 8;
2948 c->buf[arg - 1] = len & 0xff;
0f113f3e
MC		 2949 }
2950 /* Extra padding: tag appended to record */
2951 return EVP_GCM_TLS_TAG_LEN;
2952
2953 case EVP_CTRL_COPY:
2954 {
2955 EVP_CIPHER_CTX *out = ptr;
6435f0f6 2956 EVP_AES_GCM_CTX *gctx_out = EVP_C_DATA(EVP_AES_GCM_CTX,out);
0f113f3e
MC		 2957 if (gctx->gcm.key) {
2958 if (gctx->gcm.key != &gctx->ks)
2959 return 0;
2960 gctx_out->gcm.key = &gctx_out->ks;
2961 }
c5307d9c
AP		 2962 if (gctx->iv == c->iv)
2963 gctx_out->iv = out->iv;
0f113f3e 2964 else {
cdb10bae
RS		 2965 if ((gctx_out->iv = OPENSSL_malloc(gctx->ivlen)) == NULL) {
2966 EVPerr(EVP_F_AES_GCM_CTRL, ERR_R_MALLOC_FAILURE);
0f113f3e 2967 return 0;
cdb10bae 2968 }
0f113f3e
MC		 2969 memcpy(gctx_out->iv, gctx->iv, gctx->ivlen);
2970 }
2971 return 1;
2972 }
2973
2974 default:
2975 return -1;
2976
2977 }
2978}
bdaa5415
DSH		 2979
2980static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 2981 const unsigned char *iv, int enc)
2982{
6435f0f6 2983 EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,ctx);
0f113f3e
MC		 2984 if (!iv && !key)
2985 return 1;
2986 if (key) {
2987 do {
5158c763 2988#ifdef HWAES_CAPABLE
0f113f3e 2989 if (HWAES_CAPABLE) {
c5307d9c 2990 HWAES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
0f113f3e
MC		 2991 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
2992 (block128_f) HWAES_encrypt);
5158c763 2993# ifdef HWAES_ctr32_encrypt_blocks
0f113f3e 2994 gctx->ctr = (ctr128_f) HWAES_ctr32_encrypt_blocks;
5158c763 2995# else
0f113f3e 2996 gctx->ctr = NULL;
5158c763 2997# endif
0f113f3e
MC		 2998 break;
2999 } else
5158c763
MC		 3000#endif
3001#ifdef BSAES_CAPABLE
0f113f3e 3002 if (BSAES_CAPABLE) {
c5307d9c 3003 AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
0f113f3e
MC		 3004 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
3005 (block128_f) AES_encrypt);
3006 gctx->ctr = (ctr128_f) bsaes_ctr32_encrypt_blocks;
3007 break;
3008 } else
5158c763
MC		 3009#endif
3010#ifdef VPAES_CAPABLE
0f113f3e 3011 if (VPAES_CAPABLE) {
c5307d9c 3012 vpaes_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
0f113f3e
MC		 3013 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
3014 (block128_f) vpaes_encrypt);
3015 gctx->ctr = NULL;
3016 break;
3017 } else
5158c763 3018#endif
0f113f3e
MC		 3019 (void)0; /* terminate potentially open 'else' */
3020
c5307d9c 3021 AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
0f113f3e
MC		 3022 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
3023 (block128_f) AES_encrypt);
5158c763 3024#ifdef AES_CTR_ASM
0f113f3e 3025 gctx->ctr = (ctr128_f) AES_ctr32_encrypt;
5158c763 3026#else
0f113f3e 3027 gctx->ctr = NULL;
5158c763 3028#endif
0f113f3e
MC		 3029 } while (0);
3030
3031 /*
3032 * If we have an iv can set it directly, otherwise use saved IV.
3033 */
3034 if (iv == NULL && gctx->iv_set)
3035 iv = gctx->iv;
3036 if (iv) {
3037 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
3038 gctx->iv_set = 1;
3039 }
3040 gctx->key_set = 1;
3041 } else {
3042 /* If key set use IV, otherwise copy */
3043 if (gctx->key_set)
3044 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
3045 else
3046 memcpy(gctx->iv, iv, gctx->ivlen);
3047 gctx->iv_set = 1;
3048 gctx->iv_gen = 0;
3049 }
3050 return 1;
3051}
3052
3053/*
3054 * Handle TLS GCM packet format. This consists of the last portion of the IV
28dd49fa
DSH		 3055 * followed by the payload and finally the tag. On encrypt generate IV,
3056 * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
3057 * and verify tag.
3058 */
3059
3060static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e
MC		 3061 const unsigned char *in, size_t len)
3062{
6435f0f6 3063 EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,ctx);
0f113f3e
MC		 3064 int rv = -1;
3065 /* Encrypt/decrypt must be performed in place */
3066 if (out != in
3067 || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
3068 return -1;
3069 /*
3070 * Set IV from start of buffer or generate IV and write to start of
3071 * buffer.
3072 */
c5307d9c
AP		 3073 if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ? EVP_CTRL_GCM_IV_GEN
3074 : EVP_CTRL_GCM_SET_IV_INV,
0f113f3e
MC		 3075 EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
3076 goto err;
3077 /* Use saved AAD */
c5307d9c 3078 if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))
0f113f3e
MC		 3079 goto err;
3080 /* Fix buffer and length to point to payload */
3081 in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
3082 out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
3083 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
c5307d9c 3084 if (ctx->encrypt) {
0f113f3e
MC		 3085 /* Encrypt payload */
3086 if (gctx->ctr) {
3087 size_t bulk = 0;
5158c763 3088#if defined(AES_GCM_ASM)
0f113f3e
MC		 3089 if (len >= 32 && AES_GCM_ASM(gctx)) {
3090 if (CRYPTO_gcm128_encrypt(&gctx->gcm, NULL, NULL, 0))
3091 return -1;
3092
3093 bulk = AES_gcm_encrypt(in, out, len,
3094 gctx->gcm.key,
3095 gctx->gcm.Yi.c, gctx->gcm.Xi.u);
3096 gctx->gcm.len.u[1] += bulk;
3097 }
5158c763 3098#endif
0f113f3e
MC		 3099 if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
3100 in + bulk,
3101 out + bulk,
3102 len - bulk, gctx->ctr))
3103 goto err;
3104 } else {
3105 size_t bulk = 0;
5158c763 3106#if defined(AES_GCM_ASM2)
0f113f3e
MC		 3107 if (len >= 32 && AES_GCM_ASM2(gctx)) {
3108 if (CRYPTO_gcm128_encrypt(&gctx->gcm, NULL, NULL, 0))
3109 return -1;
3110
3111 bulk = AES_gcm_encrypt(in, out, len,
3112 gctx->gcm.key,
3113 gctx->gcm.Yi.c, gctx->gcm.Xi.u);
3114 gctx->gcm.len.u[1] += bulk;
3115 }
5158c763 3116#endif
0f113f3e
MC		 3117 if (CRYPTO_gcm128_encrypt(&gctx->gcm,
3118 in + bulk, out + bulk, len - bulk))
3119 goto err;
3120 }
3121 out += len;
3122 /* Finally write tag */
3123 CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);
3124 rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
3125 } else {
3126 /* Decrypt */
3127 if (gctx->ctr) {
3128 size_t bulk = 0;
5158c763 3129#if defined(AES_GCM_ASM)
0f113f3e
MC		 3130 if (len >= 16 && AES_GCM_ASM(gctx)) {
3131 if (CRYPTO_gcm128_decrypt(&gctx->gcm, NULL, NULL, 0))
3132 return -1;
3133
3134 bulk = AES_gcm_decrypt(in, out, len,
3135 gctx->gcm.key,
3136 gctx->gcm.Yi.c, gctx->gcm.Xi.u);
3137 gctx->gcm.len.u[1] += bulk;
3138 }
5158c763 3139#endif
0f113f3e
MC		 3140 if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,
3141 in + bulk,
3142 out + bulk,
3143 len - bulk, gctx->ctr))
3144 goto err;
3145 } else {
3146 size_t bulk = 0;
5158c763 3147#if defined(AES_GCM_ASM2)
0f113f3e
MC		 3148 if (len >= 16 && AES_GCM_ASM2(gctx)) {
3149 if (CRYPTO_gcm128_decrypt(&gctx->gcm, NULL, NULL, 0))
3150 return -1;
3151
3152 bulk = AES_gcm_decrypt(in, out, len,
3153 gctx->gcm.key,
3154 gctx->gcm.Yi.c, gctx->gcm.Xi.u);
3155 gctx->gcm.len.u[1] += bulk;
3156 }
5158c763 3157#endif
0f113f3e
MC		 3158 if (CRYPTO_gcm128_decrypt(&gctx->gcm,
3159 in + bulk, out + bulk, len - bulk))
3160 goto err;
3161 }
3162 /* Retrieve tag */
c5307d9c 3163 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, EVP_GCM_TLS_TAG_LEN);
0f113f3e 3164 /* If tag mismatch wipe buffer */
c5307d9c 3165 if (CRYPTO_memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {
0f113f3e
MC		 3166 OPENSSL_cleanse(out, len);
3167 goto err;
3168 }
3169 rv = len;
3170 }
3171
3172 err:
3173 gctx->iv_set = 0;
3174 gctx->tls_aad_len = -1;
3175 return rv;
3176}
28dd49fa 3177
17f121de 3178static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e
MC		 3179 const unsigned char *in, size_t len)
3180{
6435f0f6 3181 EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,ctx);
0f113f3e
MC		 3182 /* If not set up, return error */
3183 if (!gctx->key_set)
3184 return -1;
3185
3186 if (gctx->tls_aad_len >= 0)
3187 return aes_gcm_tls_cipher(ctx, out, in, len);
3188
3189 if (!gctx->iv_set)
3190 return -1;
3191 if (in) {
3192 if (out == NULL) {
3193 if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
3194 return -1;
c5307d9c 3195 } else if (ctx->encrypt) {
0f113f3e
MC		 3196 if (gctx->ctr) {
3197 size_t bulk = 0;
5158c763 3198#if defined(AES_GCM_ASM)
0f113f3e
MC		 3199 if (len >= 32 && AES_GCM_ASM(gctx)) {
3200 size_t res = (16 - gctx->gcm.mres) % 16;
3201
3202 if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, res))
3203 return -1;
3204
3205 bulk = AES_gcm_encrypt(in + res,
3206 out + res, len - res,
3207 gctx->gcm.key, gctx->gcm.Yi.c,
3208 gctx->gcm.Xi.u);
3209 gctx->gcm.len.u[1] += bulk;
3210 bulk += res;
3211 }
5158c763 3212#endif
0f113f3e
MC		 3213 if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
3214 in + bulk,
3215 out + bulk,
3216 len - bulk, gctx->ctr))
3217 return -1;
3218 } else {
3219 size_t bulk = 0;
5158c763 3220#if defined(AES_GCM_ASM2)
0f113f3e
MC		 3221 if (len >= 32 && AES_GCM_ASM2(gctx)) {
3222 size_t res = (16 - gctx->gcm.mres) % 16;
3223
3224 if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, res))
3225 return -1;
3226
3227 bulk = AES_gcm_encrypt(in + res,
3228 out + res, len - res,
3229 gctx->gcm.key, gctx->gcm.Yi.c,
3230 gctx->gcm.Xi.u);
3231 gctx->gcm.len.u[1] += bulk;
3232 bulk += res;
3233 }
5158c763 3234#endif
0f113f3e
MC		 3235 if (CRYPTO_gcm128_encrypt(&gctx->gcm,
3236 in + bulk, out + bulk, len - bulk))
3237 return -1;
3238 }
3239 } else {
3240 if (gctx->ctr) {
3241 size_t bulk = 0;
5158c763 3242#if defined(AES_GCM_ASM)
0f113f3e
MC		 3243 if (len >= 16 && AES_GCM_ASM(gctx)) {
3244 size_t res = (16 - gctx->gcm.mres) % 16;
3245
3246 if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, res))
3247 return -1;
3248
3249 bulk = AES_gcm_decrypt(in + res,
3250 out + res, len - res,
3251 gctx->gcm.key,
3252 gctx->gcm.Yi.c, gctx->gcm.Xi.u);
3253 gctx->gcm.len.u[1] += bulk;
3254 bulk += res;
3255 }
5158c763 3256#endif
0f113f3e
MC		 3257 if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,
3258 in + bulk,
3259 out + bulk,
3260 len - bulk, gctx->ctr))
3261 return -1;
3262 } else {
3263 size_t bulk = 0;
5158c763 3264#if defined(AES_GCM_ASM2)
0f113f3e
MC		 3265 if (len >= 16 && AES_GCM_ASM2(gctx)) {
3266 size_t res = (16 - gctx->gcm.mres) % 16;
3267
3268 if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, res))
3269 return -1;
3270
3271 bulk = AES_gcm_decrypt(in + res,
3272 out + res, len - res,
3273 gctx->gcm.key,
3274 gctx->gcm.Yi.c, gctx->gcm.Xi.u);
3275 gctx->gcm.len.u[1] += bulk;
3276 bulk += res;
3277 }
5158c763 3278#endif
0f113f3e
MC		 3279 if (CRYPTO_gcm128_decrypt(&gctx->gcm,
3280 in + bulk, out + bulk, len - bulk))
3281 return -1;
3282 }
3283 }
3284 return len;
3285 } else {
c5307d9c 3286 if (!ctx->encrypt) {
0f113f3e
MC		 3287 if (gctx->taglen < 0)
3288 return -1;
c5307d9c 3289 if (CRYPTO_gcm128_finish(&gctx->gcm, ctx->buf, gctx->taglen) != 0)
0f113f3e
MC		 3290 return -1;
3291 gctx->iv_set = 0;
3292 return 0;
3293 }
c5307d9c 3294 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
0f113f3e
MC		 3295 gctx->taglen = 16;
3296 /* Don't reuse the IV */
3297 gctx->iv_set = 0;
3298 return 0;
3299 }
3300
3301}
3302
5158c763 3303#define CUSTOM_FLAGS (EVP_CIPH_FLAG_DEFAULT_ASN1 \
0f113f3e
MC		 3304 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
3305 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \
3306 | EVP_CIPH_CUSTOM_COPY)
3307
3308BLOCK_CIPHER_custom(NID_aes, 128, 1, 12, gcm, GCM,
3309 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
3310 BLOCK_CIPHER_custom(NID_aes, 192, 1, 12, gcm, GCM,
3311 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
3312 BLOCK_CIPHER_custom(NID_aes, 256, 1, 12, gcm, GCM,
3313 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
32a2d8dd
DSH		 3314
3315static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
0f113f3e 3316{
2a5f63c9
P		 3317 EVP_AES_XTS_CTX *xctx = EVP_C_DATA(EVP_AES_XTS_CTX, c);
3318
0f113f3e
MC		 3319 if (type == EVP_CTRL_COPY) {
3320 EVP_CIPHER_CTX *out = ptr;
6435f0f6 3321 EVP_AES_XTS_CTX *xctx_out = EVP_C_DATA(EVP_AES_XTS_CTX,out);
2a5f63c9 3322
0f113f3e
MC		 3323 if (xctx->xts.key1) {
3324 if (xctx->xts.key1 != &xctx->ks1)
3325 return 0;
3326 xctx_out->xts.key1 = &xctx_out->ks1;
3327 }
3328 if (xctx->xts.key2) {
3329 if (xctx->xts.key2 != &xctx->ks2)
3330 return 0;
3331 xctx_out->xts.key2 = &xctx_out->ks2;
3332 }
3333 return 1;
3334 } else if (type != EVP_CTRL_INIT)
3335 return -1;
3336 /* key1 and key2 are used as an indicator both key and IV are set */
3337 xctx->xts.key1 = NULL;
3338 xctx->xts.key2 = NULL;
3339 return 1;
3340}
32a2d8dd
DSH		 3341
3342static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 3343 const unsigned char *iv, int enc)
3344{
6435f0f6 3345 EVP_AES_XTS_CTX *xctx = EVP_C_DATA(EVP_AES_XTS_CTX,ctx);
2a5f63c9 3346
0f113f3e
MC		 3347 if (!iv && !key)
3348 return 1;
3349
3350 if (key)
3351 do {
2a5f63c9
P		 3352 /* The key is two half length keys in reality */
3353 const int bytes = EVP_CIPHER_CTX_key_length(ctx) / 2;
2a5f63c9
P		 3354
3355 /*
3356 * Verify that the two keys are different.
3357 *
3358 * This addresses the vulnerability described in Rogaway's
3359 * September 2004 paper:
3360 *
3361 * "Efficient Instantiations of Tweakable Blockciphers and
3362 * Refinements to Modes OCB and PMAC".
3363 * (http://web.cs.ucdavis.edu/~rogaway/papers/offsets.pdf)
3364 *
3365 * FIPS 140-2 IG A.9 XTS-AES Key Generation Requirements states
3366 * that:
3367 * "The check for Key_1 != Key_2 shall be done at any place
3368 * BEFORE using the keys in the XTS-AES algorithm to process
3369 * data with them."
3370 */
58ae5a47 3371 if (enc && CRYPTO_memcmp(key, key + bytes, bytes) == 0) {
2a5f63c9
P		 3372 EVPerr(EVP_F_AES_XTS_INIT_KEY, EVP_R_XTS_DUPLICATED_KEYS);
3373 return 0;
3374 }
3375
5158c763 3376#ifdef AES_XTS_ASM
0f113f3e 3377 xctx->stream = enc ? AES_xts_encrypt : AES_xts_decrypt;
5158c763 3378#else
0f113f3e 3379 xctx->stream = NULL;
5158c763 3380#endif
0f113f3e 3381 /* key_len is two AES keys */
5158c763 3382#ifdef HWAES_CAPABLE
0f113f3e
MC		 3383 if (HWAES_CAPABLE) {
3384 if (enc) {
6435f0f6
RL		 3385 HWAES_set_encrypt_key(key,
3386 EVP_CIPHER_CTX_key_length(ctx) * 4,
0f113f3e
MC		 3387 &xctx->ks1.ks);
3388 xctx->xts.block1 = (block128_f) HWAES_encrypt;
46f047d7
AP		 3389# ifdef HWAES_xts_encrypt
3390 xctx->stream = HWAES_xts_encrypt;
3391# endif
0f113f3e 3392 } else {
6435f0f6
RL		 3393 HWAES_set_decrypt_key(key,
3394 EVP_CIPHER_CTX_key_length(ctx) * 4,
0f113f3e
MC		 3395 &xctx->ks1.ks);
3396 xctx->xts.block1 = (block128_f) HWAES_decrypt;
46f047d7
AP		 3397# ifdef HWAES_xts_decrypt
3398 xctx->stream = HWAES_xts_decrypt;
3399#endif
0f113f3e
MC		 3400 }
3401
6435f0f6
RL		 3402 HWAES_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2,
3403 EVP_CIPHER_CTX_key_length(ctx) * 4,
3404 &xctx->ks2.ks);
0f113f3e
MC		 3405 xctx->xts.block2 = (block128_f) HWAES_encrypt;
3406
3407 xctx->xts.key1 = &xctx->ks1;
3408 break;
3409 } else
5158c763
MC		 3410#endif
3411#ifdef BSAES_CAPABLE
0f113f3e
MC		 3412 if (BSAES_CAPABLE)
3413 xctx->stream = enc ? bsaes_xts_encrypt : bsaes_xts_decrypt;
3414 else
5158c763
MC		 3415#endif
3416#ifdef VPAES_CAPABLE
0f113f3e
MC		 3417 if (VPAES_CAPABLE) {
3418 if (enc) {
6435f0f6
RL		 3419 vpaes_set_encrypt_key(key,
3420 EVP_CIPHER_CTX_key_length(ctx) * 4,
0f113f3e
MC		 3421 &xctx->ks1.ks);
3422 xctx->xts.block1 = (block128_f) vpaes_encrypt;
3423 } else {
6435f0f6
RL		 3424 vpaes_set_decrypt_key(key,
3425 EVP_CIPHER_CTX_key_length(ctx) * 4,
0f113f3e
MC		 3426 &xctx->ks1.ks);
3427 xctx->xts.block1 = (block128_f) vpaes_decrypt;
3428 }
3429
6435f0f6
RL		 3430 vpaes_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2,
3431 EVP_CIPHER_CTX_key_length(ctx) * 4,
3432 &xctx->ks2.ks);
0f113f3e
MC		 3433 xctx->xts.block2 = (block128_f) vpaes_encrypt;
3434
3435 xctx->xts.key1 = &xctx->ks1;
3436 break;
3437 } else
5158c763 3438#endif
0f113f3e
MC		 3439 (void)0; /* terminate potentially open 'else' */
3440
3441 if (enc) {
6435f0f6
RL		 3442 AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4,
3443 &xctx->ks1.ks);
0f113f3e
MC		 3444 xctx->xts.block1 = (block128_f) AES_encrypt;
3445 } else {
6435f0f6
RL		 3446 AES_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 4,
3447 &xctx->ks1.ks);
0f113f3e
MC		 3448 xctx->xts.block1 = (block128_f) AES_decrypt;
3449 }
3450
6435f0f6
RL		 3451 AES_set_encrypt_key(key + EVP_CIPHER_CTX_key_length(ctx) / 2,
3452 EVP_CIPHER_CTX_key_length(ctx) * 4,
3453 &xctx->ks2.ks);
0f113f3e
MC		 3454 xctx->xts.block2 = (block128_f) AES_encrypt;
3455
3456 xctx->xts.key1 = &xctx->ks1;
3457 } while (0);
3458
3459 if (iv) {
3460 xctx->xts.key2 = &xctx->ks2;
6435f0f6 3461 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, 16);
0f113f3e
MC		 3462 }
3463
3464 return 1;
3465}
32a2d8dd 3466
17f121de 3467static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e
MC		 3468 const unsigned char *in, size_t len)
3469{
6435f0f6 3470 EVP_AES_XTS_CTX *xctx = EVP_C_DATA(EVP_AES_XTS_CTX,ctx);
0f113f3e
MC		 3471 if (!xctx->xts.key1 || !xctx->xts.key2)
3472 return 0;
3473 if (!out || !in || len < AES_BLOCK_SIZE)
3474 return 0;
3475 if (xctx->stream)
3476 (*xctx->stream) (in, out, len,
6435f0f6
RL		 3477 xctx->xts.key1, xctx->xts.key2,
3478 EVP_CIPHER_CTX_iv_noconst(ctx));
3479 else if (CRYPTO_xts128_encrypt(&xctx->xts, EVP_CIPHER_CTX_iv_noconst(ctx),
3480 in, out, len,
3481 EVP_CIPHER_CTX_encrypting(ctx)))
0f113f3e
MC		 3482 return 0;
3483 return 1;
3484}
3485
5158c763 3486#define aes_xts_cleanup NULL
0f113f3e 3487
5158c763 3488#define XTS_FLAGS (EVP_CIPH_FLAG_DEFAULT_ASN1 | EVP_CIPH_CUSTOM_IV \
0f113f3e
MC		 3489 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT \
3490 | EVP_CIPH_CUSTOM_COPY)
3491
3492BLOCK_CIPHER_custom(NID_aes, 128, 1, 16, xts, XTS, XTS_FLAGS)
3493 BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)
23916810
DSH		 3494
3495static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
0f113f3e 3496{
6435f0f6 3497 EVP_AES_CCM_CTX *cctx = EVP_C_DATA(EVP_AES_CCM_CTX,c);
0f113f3e
MC		 3498 switch (type) {
3499 case EVP_CTRL_INIT:
3500 cctx->key_set = 0;
3501 cctx->iv_set = 0;
3502 cctx->L = 8;
3503 cctx->M = 12;
3504 cctx->tag_set = 0;
3505 cctx->len_set = 0;
e75c5a79
DSH		 3506 cctx->tls_aad_len = -1;
3507 return 1;
3508
3509 case EVP_CTRL_AEAD_TLS1_AAD:
3510 /* Save the AAD for later use */
3511 if (arg != EVP_AEAD_TLS1_AAD_LEN)
3512 return 0;
6435f0f6 3513 memcpy(EVP_CIPHER_CTX_buf_noconst(c), ptr, arg);
e75c5a79
DSH		 3514 cctx->tls_aad_len = arg;
3515 {
6435f0f6
RL		 3516 uint16_t len =
3517 EVP_CIPHER_CTX_buf_noconst(c)[arg - 2] << 8
3518 | EVP_CIPHER_CTX_buf_noconst(c)[arg - 1];
e75c5a79 3519 /* Correct length for explicit IV */
2198b3a5
AP		 3520 if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
3521 return 0;
e75c5a79
DSH		 3522 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
3523 /* If decrypting correct for tag too */
2198b3a5
AP		 3524 if (!EVP_CIPHER_CTX_encrypting(c)) {
3525 if (len < cctx->M)
3526 return 0;
e75c5a79 3527 len -= cctx->M;
2198b3a5 3528 }
6435f0f6
RL		 3529 EVP_CIPHER_CTX_buf_noconst(c)[arg - 2] = len >> 8;
3530 EVP_CIPHER_CTX_buf_noconst(c)[arg - 1] = len & 0xff;
e75c5a79
DSH		 3531 }
3532 /* Extra padding: tag appended to record */
3533 return cctx->M;
3534
3535 case EVP_CTRL_CCM_SET_IV_FIXED:
3536 /* Sanity check length */
3537 if (arg != EVP_CCM_TLS_FIXED_IV_LEN)
3538 return 0;
3539 /* Just copy to first part of IV */
6435f0f6 3540 memcpy(EVP_CIPHER_CTX_iv_noconst(c), ptr, arg);
0f113f3e
MC		 3541 return 1;
3542
e640fa02 3543 case EVP_CTRL_AEAD_SET_IVLEN:
0f113f3e 3544 arg = 15 - arg;
018fcbec 3545 /* fall thru */
0f113f3e
MC		 3546 case EVP_CTRL_CCM_SET_L:
3547 if (arg < 2 || arg > 8)
3548 return 0;
3549 cctx->L = arg;
3550 return 1;
3551
e640fa02 3552 case EVP_CTRL_AEAD_SET_TAG:
0f113f3e
MC		 3553 if ((arg & 1) || arg < 4 || arg > 16)
3554 return 0;
6435f0f6 3555 if (EVP_CIPHER_CTX_encrypting(c) && ptr)
0f113f3e
MC		 3556 return 0;
3557 if (ptr) {
3558 cctx->tag_set = 1;
6435f0f6 3559 memcpy(EVP_CIPHER_CTX_buf_noconst(c), ptr, arg);
0f113f3e
MC		 3560 }
3561 cctx->M = arg;
3562 return 1;
3563
e640fa02 3564 case EVP_CTRL_AEAD_GET_TAG:
6435f0f6 3565 if (!EVP_CIPHER_CTX_encrypting(c) || !cctx->tag_set)
0f113f3e
MC		 3566 return 0;
3567 if (!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
3568 return 0;
3569 cctx->tag_set = 0;
3570 cctx->iv_set = 0;
3571 cctx->len_set = 0;
3572 return 1;
3573
3574 case EVP_CTRL_COPY:
3575 {
3576 EVP_CIPHER_CTX *out = ptr;
6435f0f6 3577 EVP_AES_CCM_CTX *cctx_out = EVP_C_DATA(EVP_AES_CCM_CTX,out);
0f113f3e
MC		 3578 if (cctx->ccm.key) {
3579 if (cctx->ccm.key != &cctx->ks)
3580 return 0;
3581 cctx_out->ccm.key = &cctx_out->ks;
3582 }
3583 return 1;
3584 }
3585
3586 default:
3587 return -1;
3588
3589 }
3590}
23916810
DSH		 3591
3592static int aes_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 3593 const unsigned char *iv, int enc)
3594{
6435f0f6 3595 EVP_AES_CCM_CTX *cctx = EVP_C_DATA(EVP_AES_CCM_CTX,ctx);
0f113f3e
MC		 3596 if (!iv && !key)
3597 return 1;
3598 if (key)
3599 do {
5158c763 3600#ifdef HWAES_CAPABLE
0f113f3e 3601 if (HWAES_CAPABLE) {
6435f0f6
RL		 3602 HWAES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
3603 &cctx->ks.ks);
0f113f3e
MC		 3604
3605 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
3606 &cctx->ks, (block128_f) HWAES_encrypt);
3607 cctx->str = NULL;
3608 cctx->key_set = 1;
3609 break;
3610 } else
5158c763
MC		 3611#endif
3612#ifdef VPAES_CAPABLE
0f113f3e 3613 if (VPAES_CAPABLE) {
6435f0f6
RL		 3614 vpaes_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
3615 &cctx->ks.ks);
0f113f3e
MC		 3616 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
3617 &cctx->ks, (block128_f) vpaes_encrypt);
3618 cctx->str = NULL;
3619 cctx->key_set = 1;
3620 break;
3621 }
5158c763 3622#endif
6435f0f6
RL		 3623 AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
3624 &cctx->ks.ks);
0f113f3e
MC		 3625 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
3626 &cctx->ks, (block128_f) AES_encrypt);
3627 cctx->str = NULL;
3628 cctx->key_set = 1;
3629 } while (0);
3630 if (iv) {
6435f0f6 3631 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, 15 - cctx->L);
0f113f3e
MC		 3632 cctx->iv_set = 1;
3633 }
3634 return 1;
3635}
23916810 3636
e75c5a79
DSH		 3637static int aes_ccm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
3638 const unsigned char *in, size_t len)
3639{
6435f0f6 3640 EVP_AES_CCM_CTX *cctx = EVP_C_DATA(EVP_AES_CCM_CTX,ctx);
e75c5a79
DSH		 3641 CCM128_CONTEXT *ccm = &cctx->ccm;
3642 /* Encrypt/decrypt must be performed in place */
3643 if (out != in || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)cctx->M))
3644 return -1;
3645 /* If encrypting set explicit IV from sequence number (start of AAD) */
6435f0f6
RL		 3646 if (EVP_CIPHER_CTX_encrypting(ctx))
3647 memcpy(out, EVP_CIPHER_CTX_buf_noconst(ctx),
3648 EVP_CCM_TLS_EXPLICIT_IV_LEN);
e75c5a79 3649 /* Get rest of IV from explicit IV */
6435f0f6
RL		 3650 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx) + EVP_CCM_TLS_FIXED_IV_LEN, in,
3651 EVP_CCM_TLS_EXPLICIT_IV_LEN);
e75c5a79
DSH		 3652 /* Correct length value */
3653 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->M;
6435f0f6
RL		 3654 if (CRYPTO_ccm128_setiv(ccm, EVP_CIPHER_CTX_iv_noconst(ctx), 15 - cctx->L,
3655 len))
e75c5a79
DSH		 3656 return -1;
3657 /* Use saved AAD */
6435f0f6 3658 CRYPTO_ccm128_aad(ccm, EVP_CIPHER_CTX_buf_noconst(ctx), cctx->tls_aad_len);
e75c5a79
DSH		 3659 /* Fix buffer to point to payload */
3660 in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
3661 out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
6435f0f6 3662 if (EVP_CIPHER_CTX_encrypting(ctx)) {
e75c5a79
DSH		 3663 if (cctx->str ? CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,
3664 cctx->str) :
3665 CRYPTO_ccm128_encrypt(ccm, in, out, len))
3666 return -1;
3667 if (!CRYPTO_ccm128_tag(ccm, out + len, cctx->M))
3668 return -1;
3669 return len + EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->M;
3670 } else {
3671 if (cctx->str ? !CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,
3672 cctx->str) :
3673 !CRYPTO_ccm128_decrypt(ccm, in, out, len)) {
3674 unsigned char tag[16];
3675 if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) {
3676 if (!CRYPTO_memcmp(tag, in + len, cctx->M))
3677 return len;
3678 }
3679 }
3680 OPENSSL_cleanse(out, len);
3681 return -1;
3682 }
3683}
3684
17f121de 3685static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e
MC		 3686 const unsigned char *in, size_t len)
3687{
6435f0f6 3688 EVP_AES_CCM_CTX *cctx = EVP_C_DATA(EVP_AES_CCM_CTX,ctx);
0f113f3e
MC		 3689 CCM128_CONTEXT *ccm = &cctx->ccm;
3690 /* If not set up, return error */
e75c5a79
DSH		 3691 if (!cctx->key_set)
3692 return -1;
3693
3694 if (cctx->tls_aad_len >= 0)
3695 return aes_ccm_tls_cipher(ctx, out, in, len);
3696
197421b1
DSH		 3697 /* EVP_*Final() doesn't return any data */
3698 if (in == NULL && out != NULL)
3699 return 0;
3700
e75c5a79 3701 if (!cctx->iv_set)
0f113f3e 3702 return -1;
e75c5a79 3703
0f113f3e
MC		 3704 if (!out) {
3705 if (!in) {
6435f0f6
RL		 3706 if (CRYPTO_ccm128_setiv(ccm, EVP_CIPHER_CTX_iv_noconst(ctx),
3707 15 - cctx->L, len))
0f113f3e
MC		 3708 return -1;
3709 cctx->len_set = 1;
3710 return len;
3711 }
3712 /* If have AAD need message length */
3713 if (!cctx->len_set && len)
3714 return -1;
3715 CRYPTO_ccm128_aad(ccm, in, len);
3716 return len;
3717 }
b48e3be9
TN		 3718
3719 /* The tag must be set before actually decrypting data */
3720 if (!EVP_CIPHER_CTX_encrypting(ctx) && !cctx->tag_set)
3721 return -1;
3722
0f113f3e
MC		 3723 /* If not set length yet do it */
3724 if (!cctx->len_set) {
6435f0f6
RL		 3725 if (CRYPTO_ccm128_setiv(ccm, EVP_CIPHER_CTX_iv_noconst(ctx),
3726 15 - cctx->L, len))
0f113f3e
MC		 3727 return -1;
3728 cctx->len_set = 1;
3729 }
6435f0f6 3730 if (EVP_CIPHER_CTX_encrypting(ctx)) {
0f113f3e
MC		 3731 if (cctx->str ? CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,
3732 cctx->str) :
3733 CRYPTO_ccm128_encrypt(ccm, in, out, len))
3734 return -1;
3735 cctx->tag_set = 1;
3736 return len;
3737 } else {
3738 int rv = -1;
3739 if (cctx->str ? !CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,
3740 cctx->str) :
3741 !CRYPTO_ccm128_decrypt(ccm, in, out, len)) {
3742 unsigned char tag[16];
3743 if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) {
6435f0f6
RL		 3744 if (!CRYPTO_memcmp(tag, EVP_CIPHER_CTX_buf_noconst(ctx),
3745 cctx->M))
0f113f3e
MC		 3746 rv = len;
3747 }
3748 }
3749 if (rv == -1)
3750 OPENSSL_cleanse(out, len);
3751 cctx->iv_set = 0;
3752 cctx->tag_set = 0;
3753 cctx->len_set = 0;
3754 return rv;
3755 }
0f113f3e
MC		 3756}
3757
5158c763 3758#define aes_ccm_cleanup NULL
0f113f3e 3759
e75c5a79
DSH		 3760BLOCK_CIPHER_custom(NID_aes, 128, 1, 12, ccm, CCM,
3761 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
3762 BLOCK_CIPHER_custom(NID_aes, 192, 1, 12, ccm, CCM,
3763 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
3764 BLOCK_CIPHER_custom(NID_aes, 256, 1, 12, ccm, CCM,
3765 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
0f113f3e
MC		 3766
3767typedef struct {
3768 union {
3769 double align;
3770 AES_KEY ks;
3771 } ks;
3772 /* Indicates if IV has been set */
3773 unsigned char *iv;
3774} EVP_AES_WRAP_CTX;
97cf1f6c
DSH		 3775
3776static int aes_wrap_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 3777 const unsigned char *iv, int enc)
3778{
6435f0f6 3779 EVP_AES_WRAP_CTX *wctx = EVP_C_DATA(EVP_AES_WRAP_CTX,ctx);
0f113f3e
MC		 3780 if (!iv && !key)
3781 return 1;
3782 if (key) {
6435f0f6
RL		 3783 if (EVP_CIPHER_CTX_encrypting(ctx))
3784 AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
3785 &wctx->ks.ks);
0f113f3e 3786 else
6435f0f6
RL		 3787 AES_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
3788 &wctx->ks.ks);
0f113f3e
MC		 3789 if (!iv)
3790 wctx->iv = NULL;
3791 }
3792 if (iv) {
6435f0f6
RL		 3793 memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, EVP_CIPHER_CTX_iv_length(ctx));
3794 wctx->iv = EVP_CIPHER_CTX_iv_noconst(ctx);
0f113f3e
MC		 3795 }
3796 return 1;
3797}
97cf1f6c
DSH		 3798
3799static int aes_wrap_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e
MC		 3800 const unsigned char *in, size_t inlen)
3801{
6435f0f6 3802 EVP_AES_WRAP_CTX *wctx = EVP_C_DATA(EVP_AES_WRAP_CTX,ctx);
0f113f3e
MC		 3803 size_t rv;
3804 /* AES wrap with padding has IV length of 4, without padding 8 */
3805 int pad = EVP_CIPHER_CTX_iv_length(ctx) == 4;
3806 /* No final operation so always return zero length */
3807 if (!in)
3808 return 0;
3809 /* Input length must always be non-zero */
3810 if (!inlen)
3811 return -1;
3812 /* If decrypting need at least 16 bytes and multiple of 8 */
6435f0f6 3813 if (!EVP_CIPHER_CTX_encrypting(ctx) && (inlen < 16 || inlen & 0x7))
0f113f3e
MC		 3814 return -1;
3815 /* If not padding input must be multiple of 8 */
3816 if (!pad && inlen & 0x7)
3817 return -1;
7141ba31
MC		 3818 if (is_partially_overlapping(out, in, inlen)) {
3819 EVPerr(EVP_F_AES_WRAP_CIPHER, EVP_R_PARTIALLY_OVERLAPPING);
3820 return 0;
3821 }
0f113f3e 3822 if (!out) {
6435f0f6 3823 if (EVP_CIPHER_CTX_encrypting(ctx)) {
0f113f3e
MC		 3824 /* If padding round up to multiple of 8 */
3825 if (pad)
3826 inlen = (inlen + 7) / 8 * 8;
3827 /* 8 byte prefix */
3828 return inlen + 8;
3829 } else {
3830 /*
3831 * If not padding output will be exactly 8 bytes smaller than
3832 * input. If padding it will be at least 8 bytes smaller but we
3833 * don't know how much.
3834 */
3835 return inlen - 8;
3836 }
3837 }
3838 if (pad) {
6435f0f6 3839 if (EVP_CIPHER_CTX_encrypting(ctx))
0f113f3e
MC		 3840 rv = CRYPTO_128_wrap_pad(&wctx->ks.ks, wctx->iv,
3841 out, in, inlen,
3842 (block128_f) AES_encrypt);
3843 else
3844 rv = CRYPTO_128_unwrap_pad(&wctx->ks.ks, wctx->iv,
3845 out, in, inlen,
3846 (block128_f) AES_decrypt);
3847 } else {
6435f0f6 3848 if (EVP_CIPHER_CTX_encrypting(ctx))
0f113f3e
MC		 3849 rv = CRYPTO_128_wrap(&wctx->ks.ks, wctx->iv,
3850 out, in, inlen, (block128_f) AES_encrypt);
3851 else
3852 rv = CRYPTO_128_unwrap(&wctx->ks.ks, wctx->iv,
3853 out, in, inlen, (block128_f) AES_decrypt);
3854 }
3855 return rv ? (int)rv : -1;
3856}
3857
5158c763 3858#define WRAP_FLAGS (EVP_CIPH_WRAP_MODE \
0f113f3e
MC		 3859 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
3860 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_FLAG_DEFAULT_ASN1)
97cf1f6c
DSH		 3861
3862static const EVP_CIPHER aes_128_wrap = {
0f113f3e
MC		 3863 NID_id_aes128_wrap,
3864 8, 16, 8, WRAP_FLAGS,
3865 aes_wrap_init_key, aes_wrap_cipher,
3866 NULL,
3867 sizeof(EVP_AES_WRAP_CTX),
3868 NULL, NULL, NULL, NULL
3869};
97cf1f6c
DSH		 3870
3871const EVP_CIPHER *EVP_aes_128_wrap(void)
0f113f3e
MC		 3872{
3873 return &aes_128_wrap;
3874}
97cf1f6c
DSH		 3875
3876static const EVP_CIPHER aes_192_wrap = {
0f113f3e
MC		 3877 NID_id_aes192_wrap,
3878 8, 24, 8, WRAP_FLAGS,
3879 aes_wrap_init_key, aes_wrap_cipher,
3880 NULL,
3881 sizeof(EVP_AES_WRAP_CTX),
3882 NULL, NULL, NULL, NULL
3883};
97cf1f6c
DSH		 3884
3885const EVP_CIPHER *EVP_aes_192_wrap(void)
0f113f3e
MC		 3886{
3887 return &aes_192_wrap;
3888}
97cf1f6c
DSH		 3889
3890static const EVP_CIPHER aes_256_wrap = {
0f113f3e
MC		 3891 NID_id_aes256_wrap,
3892 8, 32, 8, WRAP_FLAGS,
3893 aes_wrap_init_key, aes_wrap_cipher,
3894 NULL,
3895 sizeof(EVP_AES_WRAP_CTX),
3896 NULL, NULL, NULL, NULL
3897};
97cf1f6c
DSH		 3898
3899const EVP_CIPHER *EVP_aes_256_wrap(void)
0f113f3e
MC		 3900{
3901 return &aes_256_wrap;
3902}
97cf1f6c 3903
d31fed73 3904static const EVP_CIPHER aes_128_wrap_pad = {
0f113f3e
MC		 3905 NID_id_aes128_wrap_pad,
3906 8, 16, 4, WRAP_FLAGS,
3907 aes_wrap_init_key, aes_wrap_cipher,
3908 NULL,
3909 sizeof(EVP_AES_WRAP_CTX),
3910 NULL, NULL, NULL, NULL
3911};
d31fed73
DSH		 3912
3913const EVP_CIPHER *EVP_aes_128_wrap_pad(void)
0f113f3e
MC		 3914{
3915 return &aes_128_wrap_pad;
3916}
d31fed73
DSH		 3917
3918static const EVP_CIPHER aes_192_wrap_pad = {
0f113f3e
MC		 3919 NID_id_aes192_wrap_pad,
3920 8, 24, 4, WRAP_FLAGS,
3921 aes_wrap_init_key, aes_wrap_cipher,
3922 NULL,
3923 sizeof(EVP_AES_WRAP_CTX),
3924 NULL, NULL, NULL, NULL
3925};
d31fed73
DSH		 3926
3927const EVP_CIPHER *EVP_aes_192_wrap_pad(void)
0f113f3e
MC		 3928{
3929 return &aes_192_wrap_pad;
3930}
d31fed73
DSH		 3931
3932static const EVP_CIPHER aes_256_wrap_pad = {
0f113f3e
MC		 3933 NID_id_aes256_wrap_pad,
3934 8, 32, 4, WRAP_FLAGS,
3935 aes_wrap_init_key, aes_wrap_cipher,
3936 NULL,
3937 sizeof(EVP_AES_WRAP_CTX),
3938 NULL, NULL, NULL, NULL
3939};
d31fed73
DSH		 3940
3941const EVP_CIPHER *EVP_aes_256_wrap_pad(void)
0f113f3e
MC		 3942{
3943 return &aes_256_wrap_pad;
3944}
d31fed73 3945
5158c763 3946#ifndef OPENSSL_NO_OCB
e6b336ef 3947static int aes_ocb_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
0f113f3e 3948{
6435f0f6 3949 EVP_AES_OCB_CTX *octx = EVP_C_DATA(EVP_AES_OCB_CTX,c);
0f113f3e
MC		 3950 EVP_CIPHER_CTX *newc;
3951 EVP_AES_OCB_CTX *new_octx;
3952
3953 switch (type) {
3954 case EVP_CTRL_INIT:
3955 octx->key_set = 0;
3956 octx->iv_set = 0;
6435f0f6
RL		 3957 octx->ivlen = EVP_CIPHER_CTX_iv_length(c);
3958 octx->iv = EVP_CIPHER_CTX_iv_noconst(c);
0f113f3e
MC		 3959 octx->taglen = 16;
3960 octx->data_buf_len = 0;
3961 octx->aad_buf_len = 0;
3962 return 1;
3963
e640fa02 3964 case EVP_CTRL_AEAD_SET_IVLEN:
0f113f3e
MC		 3965 /* IV len must be 1 to 15 */
3966 if (arg <= 0 || arg > 15)
3967 return 0;
3968
3969 octx->ivlen = arg;
3970 return 1;
3971
e640fa02 3972 case EVP_CTRL_AEAD_SET_TAG:
d57d135c
MC		 3973 if (!ptr) {
3974 /* Tag len must be 0 to 16 */
3975 if (arg < 0 || arg > 16)
3976 return 0;
3977
3978 octx->taglen = arg;
3979 return 1;
3980 }
6435f0f6 3981 if (arg != octx->taglen || EVP_CIPHER_CTX_encrypting(c))
0f113f3e
MC		 3982 return 0;
3983 memcpy(octx->tag, ptr, arg);
3984 return 1;
3985
e640fa02 3986 case EVP_CTRL_AEAD_GET_TAG:
6435f0f6 3987 if (arg != octx->taglen || !EVP_CIPHER_CTX_encrypting(c))
0f113f3e
MC		 3988 return 0;
3989
3990 memcpy(ptr, octx->tag, arg);
3991 return 1;
3992
3993 case EVP_CTRL_COPY:
3994 newc = (EVP_CIPHER_CTX *)ptr;
6435f0f6 3995 new_octx = EVP_C_DATA(EVP_AES_OCB_CTX,newc);
0f113f3e 3996 return CRYPTO_ocb128_copy_ctx(&new_octx->ocb, &octx->ocb,
bdc985b1
AP		 3997 &new_octx->ksenc.ks,
3998 &new_octx->ksdec.ks);
0f113f3e
MC		 3999
4000 default:
4001 return -1;
4002
4003 }
4004}
e6b336ef 4005
5158c763
MC		 4006# ifdef HWAES_CAPABLE
4007# ifdef HWAES_ocb_encrypt
02dc0b82
AP		 4008void HWAES_ocb_encrypt(const unsigned char *in, unsigned char *out,
4009 size_t blocks, const void *key,
4010 size_t start_block_num,
4011 unsigned char offset_i[16],
4012 const unsigned char L_[][16],
4013 unsigned char checksum[16]);
5158c763 4014# else
365f95ad 4015# define HWAES_ocb_encrypt ((ocb128_f)NULL)
5158c763
MC		 4016# endif
4017# ifdef HWAES_ocb_decrypt
02dc0b82
AP		 4018void HWAES_ocb_decrypt(const unsigned char *in, unsigned char *out,
4019 size_t blocks, const void *key,
4020 size_t start_block_num,
4021 unsigned char offset_i[16],
4022 const unsigned char L_[][16],
4023 unsigned char checksum[16]);
5158c763 4024# else
365f95ad 4025# define HWAES_ocb_decrypt ((ocb128_f)NULL)
02dc0b82 4026# endif
5158c763 4027# endif
02dc0b82 4028
e6b336ef 4029static int aes_ocb_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
0f113f3e
MC		 4030 const unsigned char *iv, int enc)
4031{
6435f0f6 4032 EVP_AES_OCB_CTX *octx = EVP_C_DATA(EVP_AES_OCB_CTX,ctx);
0f113f3e
MC		 4033 if (!iv && !key)
4034 return 1;
4035 if (key) {
4036 do {
4037 /*
4038 * We set both the encrypt and decrypt key here because decrypt
4039 * needs both. We could possibly optimise to remove setting the
4040 * decrypt for an encryption operation.
4041 */
5158c763 4042# ifdef HWAES_CAPABLE
02dc0b82 4043 if (HWAES_CAPABLE) {
6435f0f6
RL		 4044 HWAES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
4045 &octx->ksenc.ks);
4046 HWAES_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
4047 &octx->ksdec.ks);
02dc0b82
AP		 4048 if (!CRYPTO_ocb128_init(&octx->ocb,
4049 &octx->ksenc.ks, &octx->ksdec.ks,
4050 (block128_f) HWAES_encrypt,
4051 (block128_f) HWAES_decrypt,
4052 enc ? HWAES_ocb_encrypt
4053 : HWAES_ocb_decrypt))
4054 return 0;
4055 break;
4056 }
5158c763
MC		 4057# endif
4058# ifdef VPAES_CAPABLE
0f113f3e 4059 if (VPAES_CAPABLE) {
6435f0f6
RL		 4060 vpaes_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
4061 &octx->ksenc.ks);
4062 vpaes_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
4063 &octx->ksdec.ks);
bdc985b1
AP		 4064 if (!CRYPTO_ocb128_init(&octx->ocb,
4065 &octx->ksenc.ks, &octx->ksdec.ks,
4066 (block128_f) vpaes_encrypt,
bd30091c
AP		 4067 (block128_f) vpaes_decrypt,
4068 NULL))
0f113f3e
MC		 4069 return 0;
4070 break;
4071 }
5158c763 4072# endif
6435f0f6
RL		 4073 AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
4074 &octx->ksenc.ks);
4075 AES_set_decrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
4076 &octx->ksdec.ks);
bdc985b1
AP		 4077 if (!CRYPTO_ocb128_init(&octx->ocb,
4078 &octx->ksenc.ks, &octx->ksdec.ks,
0f113f3e 4079 (block128_f) AES_encrypt,
bd30091c
AP		 4080 (block128_f) AES_decrypt,
4081 NULL))
0f113f3e
MC		 4082 return 0;
4083 }
4084 while (0);
4085
4086 /*
4087 * If we have an iv we can set it directly, otherwise use saved IV.
4088 */
4089 if (iv == NULL && octx->iv_set)
4090 iv = octx->iv;
4091 if (iv) {
4092 if (CRYPTO_ocb128_setiv(&octx->ocb, iv, octx->ivlen, octx->taglen)
4093 != 1)
4094 return 0;
4095 octx->iv_set = 1;
4096 }
4097 octx->key_set = 1;
4098 } else {
4099 /* If key set use IV, otherwise copy */
4100 if (octx->key_set)
4101 CRYPTO_ocb128_setiv(&octx->ocb, iv, octx->ivlen, octx->taglen);
4102 else
4103 memcpy(octx->iv, iv, octx->ivlen);
4104 octx->iv_set = 1;
4105 }
4106 return 1;
4107}
e6b336ef
MC		 4108
4109static int aes_ocb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
0f113f3e
MC		 4110 const unsigned char *in, size_t len)
4111{
4112 unsigned char *buf;
4113 int *buf_len;
4114 int written_len = 0;
4115 size_t trailing_len;
6435f0f6 4116 EVP_AES_OCB_CTX *octx = EVP_C_DATA(EVP_AES_OCB_CTX,ctx);
0f113f3e
MC		 4117
4118 /* If IV or Key not set then return error */
4119 if (!octx->iv_set)
4120 return -1;
4121
4122 if (!octx->key_set)
4123 return -1;
4124
0ba5a9ea 4125 if (in != NULL) {
0f113f3e
MC		 4126 /*
4127 * Need to ensure we are only passing full blocks to low level OCB
4128 * routines. We do it here rather than in EVP_EncryptUpdate/
4129 * EVP_DecryptUpdate because we need to pass full blocks of AAD too
4130 * and those routines don't support that
4131 */
4132
4133 /* Are we dealing with AAD or normal data here? */
4134 if (out == NULL) {
4135 buf = octx->aad_buf;
4136 buf_len = &(octx->aad_buf_len);
4137 } else {
4138 buf = octx->data_buf;
4139 buf_len = &(octx->data_buf_len);
7141ba31
MC		 4140
4141 if (is_partially_overlapping(out + *buf_len, in, len)) {
4142 EVPerr(EVP_F_AES_OCB_CIPHER, EVP_R_PARTIALLY_OVERLAPPING);
4143 return 0;
4144 }
0f113f3e
MC		 4145 }
4146
4147 /*
4148 * If we've got a partially filled buffer from a previous call then
4149 * use that data first
4150 */
0ba5a9ea 4151 if (*buf_len > 0) {
0f113f3e
MC		 4152 unsigned int remaining;
4153
0ba5a9ea 4154 remaining = AES_BLOCK_SIZE - (*buf_len);
0f113f3e
MC		 4155 if (remaining > len) {
4156 memcpy(buf + (*buf_len), in, len);
4157 *(buf_len) += len;
4158 return 0;
4159 }
4160 memcpy(buf + (*buf_len), in, remaining);
4161
4162 /*
4163 * If we get here we've filled the buffer, so process it
4164 */
4165 len -= remaining;
4166 in += remaining;
4167 if (out == NULL) {
0ba5a9ea 4168 if (!CRYPTO_ocb128_aad(&octx->ocb, buf, AES_BLOCK_SIZE))
0f113f3e 4169 return -1;
6435f0f6 4170 } else if (EVP_CIPHER_CTX_encrypting(ctx)) {
0ba5a9ea
MC		 4171 if (!CRYPTO_ocb128_encrypt(&octx->ocb, buf, out,
4172 AES_BLOCK_SIZE))
0f113f3e
MC		 4173 return -1;
4174 } else {
0ba5a9ea
MC		 4175 if (!CRYPTO_ocb128_decrypt(&octx->ocb, buf, out,
4176 AES_BLOCK_SIZE))
0f113f3e
MC		 4177 return -1;
4178 }
0ba5a9ea 4179 written_len = AES_BLOCK_SIZE;
0f113f3e 4180 *buf_len = 0;
7c12c7b6
MC		 4181 if (out != NULL)
4182 out += AES_BLOCK_SIZE;
0f113f3e
MC		 4183 }
4184
4185 /* Do we have a partial block to handle at the end? */
0ba5a9ea 4186 trailing_len = len % AES_BLOCK_SIZE;
0f113f3e
MC		 4187
4188 /*
4189 * If we've got some full blocks to handle, then process these first
4190 */
4191 if (len != trailing_len) {
4192 if (out == NULL) {
4193 if (!CRYPTO_ocb128_aad(&octx->ocb, in, len - trailing_len))
4194 return -1;
6435f0f6 4195 } else if (EVP_CIPHER_CTX_encrypting(ctx)) {
0f113f3e
MC		 4196 if (!CRYPTO_ocb128_encrypt
4197 (&octx->ocb, in, out, len - trailing_len))
4198 return -1;
4199 } else {
4200 if (!CRYPTO_ocb128_decrypt
4201 (&octx->ocb, in, out, len - trailing_len))
4202 return -1;
4203 }
4204 written_len += len - trailing_len;
4205 in += len - trailing_len;
4206 }
4207
4208 /* Handle any trailing partial block */
0ba5a9ea 4209 if (trailing_len > 0) {
0f113f3e
MC		 4210 memcpy(buf, in, trailing_len);
4211 *buf_len = trailing_len;
4212 }
4213
4214 return written_len;
4215 } else {
4216 /*
4217 * First of all empty the buffer of any partial block that we might
4218 * have been provided - both for data and AAD
4219 */
0ba5a9ea 4220 if (octx->data_buf_len > 0) {
6435f0f6 4221 if (EVP_CIPHER_CTX_encrypting(ctx)) {
0f113f3e
MC		 4222 if (!CRYPTO_ocb128_encrypt(&octx->ocb, octx->data_buf, out,
4223 octx->data_buf_len))
4224 return -1;
4225 } else {
4226 if (!CRYPTO_ocb128_decrypt(&octx->ocb, octx->data_buf, out,
4227 octx->data_buf_len))
4228 return -1;
4229 }
4230 written_len = octx->data_buf_len;
4231 octx->data_buf_len = 0;
4232 }
0ba5a9ea 4233 if (octx->aad_buf_len > 0) {
0f113f3e
MC		 4234 if (!CRYPTO_ocb128_aad
4235 (&octx->ocb, octx->aad_buf, octx->aad_buf_len))
4236 return -1;
4237 octx->aad_buf_len = 0;
4238 }
4239 /* If decrypting then verify */
6435f0f6 4240 if (!EVP_CIPHER_CTX_encrypting(ctx)) {
0f113f3e
MC		 4241 if (octx->taglen < 0)
4242 return -1;
4243 if (CRYPTO_ocb128_finish(&octx->ocb,
4244 octx->tag, octx->taglen) != 0)
4245 return -1;
4246 octx->iv_set = 0;
4247 return written_len;
4248 }
4249 /* If encrypting then just get the tag */
4250 if (CRYPTO_ocb128_tag(&octx->ocb, octx->tag, 16) != 1)
4251 return -1;
4252 /* Don't reuse the IV */
4253 octx->iv_set = 0;
4254 return written_len;
4255 }
4256}
e6b336ef
MC		 4257
4258static int aes_ocb_cleanup(EVP_CIPHER_CTX *c)
0f113f3e 4259{
6435f0f6 4260 EVP_AES_OCB_CTX *octx = EVP_C_DATA(EVP_AES_OCB_CTX,c);
0f113f3e
MC		 4261 CRYPTO_ocb128_cleanup(&octx->ocb);
4262 return 1;
4263}
e6b336ef 4264
c4aede20
MC		 4265BLOCK_CIPHER_custom(NID_aes, 128, 16, 12, ocb, OCB,
4266 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
4267BLOCK_CIPHER_custom(NID_aes, 192, 16, 12, ocb, OCB,
4268 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
4269BLOCK_CIPHER_custom(NID_aes, 256, 16, 12, ocb, OCB,
4270 EVP_CIPH_FLAG_AEAD_CIPHER | CUSTOM_FLAGS)
5158c763 4271#endif /* OPENSSL_NO_OCB */
A mirror of the official openssl repository