]>
Commit | Line | Data |
---|---|---|
62867571 RS |
1 | /* |
2 | * Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved. | |
c608171d | 3 | * |
4a8b0c55 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
62867571 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
c608171d AP |
8 | */ |
9 | ||
a8fca728 | 10 | /* |
781aa7ab P |
11 | * MD5 and RC4 low level APIs are deprecated for public use, but still ok for |
12 | * internal use. | |
a8fca728 P |
13 | */ |
14 | #include "internal/deprecated.h" | |
15 | ||
f702256d | 16 | #include <internal/cryptlib.h> |
c608171d AP |
17 | #include <openssl/opensslconf.h> |
18 | ||
19 | #include <stdio.h> | |
20 | #include <string.h> | |
21 | ||
22 | #if !defined(OPENSSL_NO_RC4) && !defined(OPENSSL_NO_MD5) | |
23 | ||
1e4a355d | 24 | # include <openssl/crypto.h> |
0f113f3e MC |
25 | # include <openssl/evp.h> |
26 | # include <openssl/objects.h> | |
27 | # include <openssl/rc4.h> | |
28 | # include <openssl/md5.h> | |
25f2138b | 29 | # include "crypto/evp.h" |
0f113f3e | 30 | |
0f113f3e MC |
31 | typedef struct { |
32 | RC4_KEY ks; | |
33 | MD5_CTX head, tail, md; | |
34 | size_t payload_length; | |
35 | } EVP_RC4_HMAC_MD5; | |
c608171d | 36 | |
0f113f3e | 37 | # define NO_PAYLOAD_LENGTH ((size_t)-1) |
6dd9b0fc | 38 | |
0f113f3e MC |
39 | void rc4_md5_enc(RC4_KEY *key, const void *in0, void *out, |
40 | MD5_CTX *ctx, const void *inp, size_t blocks); | |
c608171d | 41 | |
44ab2dfd | 42 | # define data(ctx) ((EVP_RC4_HMAC_MD5 *)EVP_CIPHER_CTX_get_cipher_data(ctx)) |
c608171d AP |
43 | |
44 | static int rc4_hmac_md5_init_key(EVP_CIPHER_CTX *ctx, | |
0f113f3e MC |
45 | const unsigned char *inkey, |
46 | const unsigned char *iv, int enc) | |
47 | { | |
48 | EVP_RC4_HMAC_MD5 *key = data(ctx); | |
c608171d | 49 | |
0f113f3e | 50 | RC4_set_key(&key->ks, EVP_CIPHER_CTX_key_length(ctx), inkey); |
c608171d | 51 | |
0f113f3e MC |
52 | MD5_Init(&key->head); /* handy when benchmarking */ |
53 | key->tail = key->head; | |
54 | key->md = key->head; | |
c608171d | 55 | |
0f113f3e | 56 | key->payload_length = NO_PAYLOAD_LENGTH; |
c608171d | 57 | |
0f113f3e MC |
58 | return 1; |
59 | } | |
c608171d | 60 | |
dd6b2706 | 61 | # if defined(RC4_ASM) && defined(MD5_ASM) && ( \ |
0f113f3e | 62 | defined(__x86_64) || defined(__x86_64__) || \ |
b1a07c38 | 63 | defined(_M_AMD64) || defined(_M_X64) ) |
0f113f3e MC |
64 | # define STITCHED_CALL |
65 | # endif | |
c608171d | 66 | |
0f113f3e MC |
67 | # if !defined(STITCHED_CALL) |
68 | # define rc4_off 0 | |
69 | # define md5_off 0 | |
70 | # endif | |
c608171d AP |
71 | |
72 | static int rc4_hmac_md5_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, | |
0f113f3e MC |
73 | const unsigned char *in, size_t len) |
74 | { | |
75 | EVP_RC4_HMAC_MD5 *key = data(ctx); | |
76 | # if defined(STITCHED_CALL) | |
77 | size_t rc4_off = 32 - 1 - (key->ks.x & (32 - 1)), /* 32 is $MOD from | |
78 | * rc4_md5-x86_64.pl */ | |
79 | md5_off = MD5_CBLOCK - key->md.num, blocks; | |
80 | unsigned int l; | |
0f113f3e MC |
81 | # endif |
82 | size_t plen = key->payload_length; | |
83 | ||
84 | if (plen != NO_PAYLOAD_LENGTH && len != (plen + MD5_DIGEST_LENGTH)) | |
85 | return 0; | |
86 | ||
936166af | 87 | if (EVP_CIPHER_CTX_encrypting(ctx)) { |
0f113f3e MC |
88 | if (plen == NO_PAYLOAD_LENGTH) |
89 | plen = len; | |
90 | # if defined(STITCHED_CALL) | |
91 | /* cipher has to "fall behind" */ | |
92 | if (rc4_off > md5_off) | |
93 | md5_off += MD5_CBLOCK; | |
94 | ||
95 | if (plen > md5_off && (blocks = (plen - md5_off) / MD5_CBLOCK) && | |
96 | (OPENSSL_ia32cap_P[0] & (1 << 20)) == 0) { | |
97 | MD5_Update(&key->md, in, md5_off); | |
98 | RC4(&key->ks, rc4_off, in, out); | |
99 | ||
100 | rc4_md5_enc(&key->ks, in + rc4_off, out + rc4_off, | |
101 | &key->md, in + md5_off, blocks); | |
102 | blocks *= MD5_CBLOCK; | |
103 | rc4_off += blocks; | |
104 | md5_off += blocks; | |
105 | key->md.Nh += blocks >> 29; | |
106 | key->md.Nl += blocks <<= 3; | |
107 | if (key->md.Nl < (unsigned int)blocks) | |
108 | key->md.Nh++; | |
109 | } else { | |
110 | rc4_off = 0; | |
111 | md5_off = 0; | |
112 | } | |
113 | # endif | |
114 | MD5_Update(&key->md, in + md5_off, plen - md5_off); | |
115 | ||
116 | if (plen != len) { /* "TLS" mode of operation */ | |
117 | if (in != out) | |
118 | memcpy(out + rc4_off, in + rc4_off, plen - rc4_off); | |
119 | ||
120 | /* calculate HMAC and append it to payload */ | |
121 | MD5_Final(out + plen, &key->md); | |
122 | key->md = key->tail; | |
123 | MD5_Update(&key->md, out + plen, MD5_DIGEST_LENGTH); | |
124 | MD5_Final(out + plen, &key->md); | |
125 | /* encrypt HMAC at once */ | |
126 | RC4(&key->ks, len - rc4_off, out + rc4_off, out + rc4_off); | |
127 | } else { | |
128 | RC4(&key->ks, len - rc4_off, in + rc4_off, out + rc4_off); | |
129 | } | |
130 | } else { | |
131 | unsigned char mac[MD5_DIGEST_LENGTH]; | |
132 | # if defined(STITCHED_CALL) | |
133 | /* digest has to "fall behind" */ | |
134 | if (md5_off > rc4_off) | |
135 | rc4_off += 2 * MD5_CBLOCK; | |
136 | else | |
137 | rc4_off += MD5_CBLOCK; | |
138 | ||
139 | if (len > rc4_off && (blocks = (len - rc4_off) / MD5_CBLOCK) && | |
140 | (OPENSSL_ia32cap_P[0] & (1 << 20)) == 0) { | |
141 | RC4(&key->ks, rc4_off, in, out); | |
142 | MD5_Update(&key->md, out, md5_off); | |
143 | ||
144 | rc4_md5_enc(&key->ks, in + rc4_off, out + rc4_off, | |
145 | &key->md, out + md5_off, blocks); | |
146 | blocks *= MD5_CBLOCK; | |
147 | rc4_off += blocks; | |
148 | md5_off += blocks; | |
149 | l = (key->md.Nl + (blocks << 3)) & 0xffffffffU; | |
150 | if (l < key->md.Nl) | |
151 | key->md.Nh++; | |
152 | key->md.Nl = l; | |
153 | key->md.Nh += blocks >> 29; | |
154 | } else { | |
155 | md5_off = 0; | |
156 | rc4_off = 0; | |
157 | } | |
158 | # endif | |
159 | /* decrypt HMAC at once */ | |
160 | RC4(&key->ks, len - rc4_off, in + rc4_off, out + rc4_off); | |
161 | if (plen != NO_PAYLOAD_LENGTH) { /* "TLS" mode of operation */ | |
162 | MD5_Update(&key->md, out + md5_off, plen - md5_off); | |
163 | ||
164 | /* calculate HMAC and verify it */ | |
165 | MD5_Final(mac, &key->md); | |
166 | key->md = key->tail; | |
167 | MD5_Update(&key->md, mac, MD5_DIGEST_LENGTH); | |
168 | MD5_Final(mac, &key->md); | |
169 | ||
1e4a355d | 170 | if (CRYPTO_memcmp(out + plen, mac, MD5_DIGEST_LENGTH)) |
0f113f3e MC |
171 | return 0; |
172 | } else { | |
173 | MD5_Update(&key->md, out + md5_off, len - md5_off); | |
174 | } | |
175 | } | |
176 | ||
177 | key->payload_length = NO_PAYLOAD_LENGTH; | |
178 | ||
179 | return 1; | |
180 | } | |
181 | ||
182 | static int rc4_hmac_md5_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, | |
183 | void *ptr) | |
184 | { | |
185 | EVP_RC4_HMAC_MD5 *key = data(ctx); | |
186 | ||
187 | switch (type) { | |
188 | case EVP_CTRL_AEAD_SET_MAC_KEY: | |
189 | { | |
190 | unsigned int i; | |
191 | unsigned char hmac_key[64]; | |
192 | ||
193 | memset(hmac_key, 0, sizeof(hmac_key)); | |
194 | ||
195 | if (arg > (int)sizeof(hmac_key)) { | |
196 | MD5_Init(&key->head); | |
197 | MD5_Update(&key->head, ptr, arg); | |
198 | MD5_Final(hmac_key, &key->head); | |
199 | } else { | |
200 | memcpy(hmac_key, ptr, arg); | |
201 | } | |
202 | ||
203 | for (i = 0; i < sizeof(hmac_key); i++) | |
204 | hmac_key[i] ^= 0x36; /* ipad */ | |
205 | MD5_Init(&key->head); | |
206 | MD5_Update(&key->head, hmac_key, sizeof(hmac_key)); | |
207 | ||
208 | for (i = 0; i < sizeof(hmac_key); i++) | |
209 | hmac_key[i] ^= 0x36 ^ 0x5c; /* opad */ | |
210 | MD5_Init(&key->tail); | |
211 | MD5_Update(&key->tail, hmac_key, sizeof(hmac_key)); | |
212 | ||
0def528b MC |
213 | OPENSSL_cleanse(hmac_key, sizeof(hmac_key)); |
214 | ||
0f113f3e MC |
215 | return 1; |
216 | } | |
217 | case EVP_CTRL_AEAD_TLS1_AAD: | |
218 | { | |
219 | unsigned char *p = ptr; | |
c8269881 MC |
220 | unsigned int len; |
221 | ||
222 | if (arg != EVP_AEAD_TLS1_AAD_LEN) | |
223 | return -1; | |
224 | ||
225 | len = p[arg - 2] << 8 | p[arg - 1]; | |
0f113f3e | 226 | |
936166af | 227 | if (!EVP_CIPHER_CTX_encrypting(ctx)) { |
8e204996 AP |
228 | if (len < MD5_DIGEST_LENGTH) |
229 | return -1; | |
0f113f3e MC |
230 | len -= MD5_DIGEST_LENGTH; |
231 | p[arg - 2] = len >> 8; | |
232 | p[arg - 1] = len; | |
233 | } | |
234 | key->payload_length = len; | |
235 | key->md = key->head; | |
236 | MD5_Update(&key->md, p, arg); | |
237 | ||
238 | return MD5_DIGEST_LENGTH; | |
239 | } | |
240 | default: | |
241 | return -1; | |
242 | } | |
243 | } | |
244 | ||
245 | static EVP_CIPHER r4_hmac_md5_cipher = { | |
246 | # ifdef NID_rc4_hmac_md5 | |
247 | NID_rc4_hmac_md5, | |
248 | # else | |
249 | NID_undef, | |
250 | # endif | |
251 | 1, EVP_RC4_KEY_SIZE, 0, | |
252 | EVP_CIPH_STREAM_CIPHER | EVP_CIPH_VARIABLE_LENGTH | | |
253 | EVP_CIPH_FLAG_AEAD_CIPHER, | |
254 | rc4_hmac_md5_init_key, | |
255 | rc4_hmac_md5_cipher, | |
256 | NULL, | |
257 | sizeof(EVP_RC4_HMAC_MD5), | |
258 | NULL, | |
259 | NULL, | |
260 | rc4_hmac_md5_ctrl, | |
261 | NULL | |
262 | }; | |
c608171d AP |
263 | |
264 | const EVP_CIPHER *EVP_rc4_hmac_md5(void) | |
0f113f3e | 265 | { |
26a7d938 | 266 | return &r4_hmac_md5_cipher; |
0f113f3e | 267 | } |
c608171d | 268 | #endif |