[thirdparty/openssl.git] / providers / common / ciphers / cipher_ccm.c

/*
 * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/* Dispatch functions for ccm mode */

#include "cipher_local.h"
#include "internal/ciphers/cipher_ccm.h"
#include "internal/providercommonerr.h"

static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
                               size_t *padlen, const unsigned char *in,
                               size_t len);

static int ccm_tls_init(PROV_CCM_CTX *ctx, unsigned char *aad, size_t alen)
{
    size_t len;

    if (alen != EVP_AEAD_TLS1_AAD_LEN)
        return 0;

    /* Save the aad for later use. */
    memcpy(ctx->buf, aad, alen);
    ctx->tls_aad_len = alen;

    len = ctx->buf[alen - 2] << 8 | ctx->buf[alen - 1];
    if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
        return 0;

    /* Correct length for explicit iv. */
    len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;

    if (!ctx->enc) {
        if (len < ctx->m)
            return 0;
        /* Correct length for tag. */
        len -= ctx->m;
    }
    ctx->buf[alen - 2] = (unsigned char)(len >> 8);
    ctx->buf[alen - 1] = (unsigned char)(len & 0xff);

    /* Extra padding: tag appended to record. */
    return ctx->m;
}

static int ccm_tls_iv_set_fixed(PROV_CCM_CTX *ctx, unsigned char *fixed,
                                size_t flen)
{
    if (flen != EVP_CCM_TLS_FIXED_IV_LEN)
        return 0;

    /* Copy to first part of the iv. */
    memcpy(ctx->iv, fixed, flen);
    return 1;
}

static size_t ccm_get_ivlen(PROV_CCM_CTX *ctx)
{
    return 15 - ctx->l;
}

int ccm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
{
    PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
    const OSSL_PARAM *p;
    size_t sz;

    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG);
    if (p != NULL) {
        if (p->data_type != OSSL_PARAM_OCTET_STRING) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
            return 0;
        }
        if ((p->data_size & 1) || (p->data_size < 4) || p->data_size > 16) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAGLEN);
            return 0;
        }

        if (p->data != NULL) {
            if (ctx->enc) {
                ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_NEEDED);
                return 0;
            }
            memcpy(ctx->buf, p->data, p->data_size);
            ctx->tag_set = 1;
        }
        ctx->m = p->data_size;
    }

    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN);
    if (p != NULL) {
        size_t ivlen;

        if (!OSSL_PARAM_get_size_t(p, &sz)) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
            return 0;
        }
        ivlen = 15 - sz;
        if (ivlen < 2 || ivlen > 8) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
            return 0;
        }
        ctx->l = ivlen;
    }

    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
    if (p != NULL) {
        if (p->data_type != OSSL_PARAM_OCTET_STRING) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
            return 0;
        }
        sz = ccm_tls_init(ctx, p->data, p->data_size);
        if (sz == 0) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA);
            return 0;
        }
        ctx->tls_aad_pad_sz = sz;
    }

    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED);
    if (p != NULL) {
        if (p->data_type != OSSL_PARAM_OCTET_STRING) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
            return 0;
        }
        if (ccm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
            return 0;
        }
    }

    return 1;
}

int ccm_get_ctx_params(void *vctx, OSSL_PARAM params[])
{
    PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
    OSSL_PARAM *p;

    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN);
    if (p != NULL && !OSSL_PARAM_set_size_t(p, ccm_get_ivlen(ctx))) {
        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
        return 0;
    }

    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN);
    if (p != NULL) {
        size_t m = ctx->m;

        if (!OSSL_PARAM_set_size_t(p, m)) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
            return 0;
        }
    }

    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV);
    if (p != NULL) {
        if (ccm_get_ivlen(ctx) != p->data_size) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
            return 0;
        }
        if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
            return 0;
        }
    }

    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN);
    if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) {
        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
        return 0;
    }

    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD);
    if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
        return 0;
    }

    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG);
    if (p != NULL) {
        if (!ctx->enc || !ctx->tag_set) {
            ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOTSET);
            return 0;
        }
        if (p->data_type != OSSL_PARAM_OCTET_STRING) {
            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
            return 0;
        }
        if (!ctx->hw->gettag(ctx, p->data, p->data_size))
            return 0;
        ctx->tag_set = 0;
        ctx->iv_set = 0;
        ctx->len_set = 0;
    }
    return 1;
}

static int ccm_init(void *vctx, const unsigned char *key, size_t keylen,
                    const unsigned char *iv, size_t ivlen, int enc)
{
    PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;

    ctx->enc = enc;

    if (iv != NULL) {
        if (ivlen != ccm_get_ivlen(ctx)) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
            return 0;
        }

        memcpy(ctx->iv, iv, ivlen);
        ctx->iv_set = 1;
    }
    if (key != NULL) {
        if (keylen != ctx->keylen) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEYLEN);
            return 0;
        }
        return ctx->hw->setkey(ctx, key, keylen);
    }
    return 1;
}

int ccm_einit(void *vctx, const unsigned char *key, size_t keylen,
                     const unsigned char *iv, size_t ivlen)
{
    return ccm_init(vctx, key, keylen, iv, ivlen, 1);
}

int ccm_dinit(void *vctx, const unsigned char *key, size_t keylen,
                     const unsigned char *iv, size_t ivlen)
{
    return ccm_init(vctx, key, keylen, iv, ivlen, 0);
}

int ccm_stream_update(void *vctx, unsigned char *out, size_t *outl,
                             size_t outsize, const unsigned char *in,
                             size_t inl)
{
    PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;

    if (outsize < inl) {
        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
        return 0;
    }

    if (!ccm_cipher_internal(ctx, out, outl, in, inl)) {
        ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
        return 0;
    }
    return 1;
}

int ccm_stream_final(void *vctx, unsigned char *out, size_t *outl,
                            size_t outsize)
{
    PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
    int i;

    i = ccm_cipher_internal(ctx, out, outl, NULL, 0);
    if (i <= 0)
        return 0;

    *outl = 0;
    return 1;
}

int ccm_cipher(void *vctx,
                      unsigned char *out, size_t *outl, size_t outsize,
                      const unsigned char *in, size_t inl)
{
    PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;

    if (outsize < inl) {
        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
        return -1;
    }

    if (ccm_cipher_internal(ctx, out, outl, in, inl) <= 0)
        return -1;

    *outl = inl;
    return 1;
}

/* Copy the buffered iv */
static int ccm_set_iv(PROV_CCM_CTX *ctx, size_t mlen)
{
    const PROV_CCM_HW *hw = ctx->hw;

    if (!hw->setiv(ctx, ctx->iv, ccm_get_ivlen(ctx), mlen))
        return 0;
    ctx->len_set = 1;
    return 1;
}

static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
                          unsigned char *out, size_t *padlen,
                          const unsigned char *in, size_t len)
{
    int rv = 0;
    size_t olen = 0;

    /* Encrypt/decrypt must be performed in place */
    if (out != in || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)ctx->m))
        goto err;

    /* If encrypting set explicit IV from sequence number (start of AAD) */
    if (ctx->enc)
        memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
    /* Get rest of IV from explicit IV */
    memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
    /* Correct length value */
    len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
    if (!ccm_set_iv(ctx, len))
        goto err;

    /* Use saved AAD */
    if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))
        goto err;

    /* Fix buffer to point to payload */
    in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
    out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
    if (ctx->enc) {
        if (!ctx->hw->auth_encrypt(ctx, in, out, len,  out + len, ctx->m))
            goto err;
        olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
    } else {
        if (!ctx->hw->auth_decrypt(ctx, in, out, len,
                                   (unsigned char *)in + len, ctx->m))
            goto err;
        olen = len;
    }
    rv = 1;
err:
    *padlen = olen;
    return rv;
}

static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
                               size_t *padlen, const unsigned char *in,
                               size_t len)
{
    int rv = 0;
    size_t olen = 0;
    const PROV_CCM_HW *hw = ctx->hw;

    /* If no key set, return error */
    if (!ctx->key_set)
        return 0;

    if (ctx->tls_aad_len != UNINITIALISED_SIZET)
        return ccm_tls_cipher(ctx, out, padlen, in, len);

    /* EVP_*Final() doesn't return any data */
    if (in == NULL && out != NULL)
        goto finish;

    if (!ctx->iv_set)
        goto err;

    if (out == NULL) {
        if (in == NULL) {
            if (!ccm_set_iv(ctx, len))
                goto err;
        } else {
            /* If we have AAD, we need a message length */
            if (!ctx->len_set && len)
                goto err;
            if (!hw->setaad(ctx, in, len))
                goto err;
        }
    } else {
        /* If not set length yet do it */
        if (!ctx->len_set && !ccm_set_iv(ctx, len))
            goto err;

        if (ctx->enc) {
            if (!hw->auth_encrypt(ctx, in, out, len, NULL, 0))
                goto err;
            ctx->tag_set = 1;
        } else {
            /* The tag must be set before actually decrypting data */
            if (!ctx->tag_set)
                goto err;

            if (!hw->auth_decrypt(ctx, in, out, len, ctx->buf, ctx->m))
                goto err;
            /* Finished - reset flags so calling this method again will fail */
            ctx->iv_set = 0;
            ctx->tag_set = 0;
            ctx->len_set = 0;
        }
    }
    olen = len;
finish:
    rv = 1;
err:
    *padlen = olen;
    return rv;
}

void ccm_initctx(PROV_CCM_CTX *ctx, size_t keybits, const PROV_CCM_HW *hw)
{
    ctx->keylen = keybits / 8;
    ctx->key_set = 0;
    ctx->iv_set = 0;
    ctx->tag_set = 0;
    ctx->len_set = 0;
    ctx->l = 8;
    ctx->m = 12;
    ctx->tls_aad_len = UNINITIALISED_SIZET;
    ctx->hw = hw;
}

void ccm_finalctx(PROV_CCM_CTX *ctx)
{
    OPENSSL_cleanse(ctx->iv, sizeof(ctx->iv));
}
Commit	Line	Data
3bfe9005 SL	1	/*
	2	* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
	3	*
	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
e1178600 SL	10	/* Dispatch functions for ccm mode */
e1178600 SL	11
706457b7	12	#include "cipher_local.h"
4a42e264 SL	13	#include "internal/ciphers/cipher_ccm.h"
4a42e264 SL	14	#include "internal/providercommonerr.h"
3bfe9005 SL	15
	16	static int ccm_cipher_internal(PROV_CCM_CTX ctx, unsigned char out,
	17	size_t padlen, const unsigned char in,
	18	size_t len);
	19
	20	static int ccm_tls_init(PROV_CCM_CTX ctx, unsigned char aad, size_t alen)
	21	{
	22	size_t len;
	23
	24	if (alen != EVP_AEAD_TLS1_AAD_LEN)
	25	return 0;
	26
	27	/* Save the aad for later use. */
	28	memcpy(ctx->buf, aad, alen);
	29	ctx->tls_aad_len = alen;
	30
	31	len = ctx->buf[alen - 2] << 8 \| ctx->buf[alen - 1];
	32	if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
	33	return 0;
	34
	35	/* Correct length for explicit iv. */
	36	len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
	37
	38	if (!ctx->enc) {
	39	if (len < ctx->m)
	40	return 0;
	41	/* Correct length for tag. */
	42	len -= ctx->m;
	43	}
	44	ctx->buf[alen - 2] = (unsigned char)(len >> 8);
	45	ctx->buf[alen - 1] = (unsigned char)(len & 0xff);
	46
	47	/* Extra padding: tag appended to record. */
	48	return ctx->m;
	49	}
	50
	51	static int ccm_tls_iv_set_fixed(PROV_CCM_CTX ctx, unsigned char fixed,
	52	size_t flen)
	53	{
	54	if (flen != EVP_CCM_TLS_FIXED_IV_LEN)
	55	return 0;
	56
	57	/* Copy to first part of the iv. */
	58	memcpy(ctx->iv, fixed, flen);
	59	return 1;
	60	}
	61
	62	static size_t ccm_get_ivlen(PROV_CCM_CTX *ctx)
	63	{
	64	return 15 - ctx->l;
	65	}
	66
e1178600	67	int ccm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
3bfe9005 SL	68	{
	69	PROV_CCM_CTX ctx = (PROV_CCM_CTX )vctx;
	70	const OSSL_PARAM *p;
	71	size_t sz;
	72
	73	p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG);
	74	if (p != NULL) {
	75	if (p->data_type != OSSL_PARAM_OCTET_STRING) {
	76	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
	77	return 0;
	78	}
	79	if ((p->data_size & 1) \|\| (p->data_size < 4) \|\| p->data_size > 16) {
	80	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAGLEN);
	81	return 0;
	82	}
	83
	84	if (p->data != NULL) {
	85	if (ctx->enc) {
	86	ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_NEEDED);
	87	return 0;
	88	}
	89	memcpy(ctx->buf, p->data, p->data_size);
	90	ctx->tag_set = 1;
	91	}
	92	ctx->m = p->data_size;
	93	}
	94
	95	p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN);
	96	if (p != NULL) {
	97	size_t ivlen;
	98
	99	if (!OSSL_PARAM_get_size_t(p, &sz)) {
	100	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
	101	return 0;
	102	}
	103	ivlen = 15 - sz;
	104	if (ivlen < 2 \|\| ivlen > 8) {
	105	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
	106	return 0;
	107	}
	108	ctx->l = ivlen;
	109	}
	110
	111	p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
	112	if (p != NULL) {
	113	if (p->data_type != OSSL_PARAM_OCTET_STRING) {
	114	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
	115	return 0;
	116	}
	117	sz = ccm_tls_init(ctx, p->data, p->data_size);
	118	if (sz == 0) {
	119	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA);
	120	return 0;
	121	}
	122	ctx->tls_aad_pad_sz = sz;
	123	}
	124
	125	p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED);
	126	if (p != NULL) {
	127	if (p->data_type != OSSL_PARAM_OCTET_STRING) {
	128	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
	129	return 0;
	130	}
	131	if (ccm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
132	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
133	return 0;
134	}
135	}
136
137	return 1;
138	}
139
e1178600	140	int ccm_get_ctx_params(void *vctx, OSSL_PARAM params[])
3bfe9005 SL	141	{
	142	PROV_CCM_CTX ctx = (PROV_CCM_CTX )vctx;
	143	OSSL_PARAM *p;
	144
	145	p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN);
1c3ace68	146	if (p != NULL && !OSSL_PARAM_set_size_t(p, ccm_get_ivlen(ctx))) {
3bfe9005 SL	147	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
	148	return 0;
	149	}
	150
dc64dc2e SL	151	p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN);
	152	if (p != NULL) {
	153	size_t m = ctx->m;
	154
	155	if (!OSSL_PARAM_set_size_t(p, m)) {
	156	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
	157	return 0;
	158	}
	159	}
	160
3bfe9005 SL	161	p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV);
	162	if (p != NULL) {
	163	if (ccm_get_ivlen(ctx) != p->data_size) {
	164	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
	165	return 0;
	166	}
	167	if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)) {
	168	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
	169	return 0;
	170	}
	171	}
	172
	173	p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN);
1c3ace68	174	if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) {
3bfe9005 SL	175	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
	176	return 0;
	177	}
	178
	179	p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD);
	180	if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
	181	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
	182	return 0;
	183	}
	184
	185	p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG);
	186	if (p != NULL) {
	187	if (!ctx->enc \|\| !ctx->tag_set) {
	188	ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOTSET);
	189	return 0;
	190	}
	191	if (p->data_type != OSSL_PARAM_OCTET_STRING) {
	192	ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
	193	return 0;
	194	}
	195	if (!ctx->hw->gettag(ctx, p->data, p->data_size))
	196	return 0;
	197	ctx->tag_set = 0;
	198	ctx->iv_set = 0;
	199	ctx->len_set = 0;
	200	}
	201	return 1;
	202	}
	203
	204	static int ccm_init(void vctx, const unsigned char key, size_t keylen,
	205	const unsigned char *iv, size_t ivlen, int enc)
	206	{
	207	PROV_CCM_CTX ctx = (PROV_CCM_CTX )vctx;
	208
	209	ctx->enc = enc;
	210
	211	if (iv != NULL) {
	212	if (ivlen != ccm_get_ivlen(ctx)) {
	213	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
	214	return 0;
	215	}
	216
	217	memcpy(ctx->iv, iv, ivlen);
	218	ctx->iv_set = 1;
	219	}
	220	if (key != NULL) {
	221	if (keylen != ctx->keylen) {
	222	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEYLEN);
	223	return 0;
	224	}
	225	return ctx->hw->setkey(ctx, key, keylen);
	226	}
	227	return 1;
	228	}
	229
e1178600	230	int ccm_einit(void vctx, const unsigned char key, size_t keylen,
3bfe9005 SL	231	const unsigned char *iv, size_t ivlen)
	232	{
	233	return ccm_init(vctx, key, keylen, iv, ivlen, 1);
	234	}
	235
e1178600	236	int ccm_dinit(void vctx, const unsigned char key, size_t keylen,
3bfe9005 SL	237	const unsigned char *iv, size_t ivlen)
	238	{
	239	return ccm_init(vctx, key, keylen, iv, ivlen, 0);
	240	}
	241
e1178600	242	int ccm_stream_update(void vctx, unsigned char out, size_t *outl,
3bfe9005 SL	243	size_t outsize, const unsigned char *in,
	244	size_t inl)
	245	{
	246	PROV_CCM_CTX ctx = (PROV_CCM_CTX )vctx;
	247
	248	if (outsize < inl) {
	249	ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
	250	return 0;
	251	}
	252
	253	if (!ccm_cipher_internal(ctx, out, outl, in, inl)) {
	254	ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
	255	return 0;
	256	}
	257	return 1;
	258	}
	259
e1178600	260	int ccm_stream_final(void vctx, unsigned char out, size_t *outl,
3bfe9005 SL	261	size_t outsize)
	262	{
	263	PROV_CCM_CTX ctx = (PROV_CCM_CTX )vctx;
	264	int i;
	265
	266	i = ccm_cipher_internal(ctx, out, outl, NULL, 0);
	267	if (i <= 0)
	268	return 0;
	269
	270	*outl = 0;
	271	return 1;
	272	}
	273
e1178600	274	int ccm_cipher(void *vctx,
3bfe9005 SL	275	unsigned char out, size_t outl, size_t outsize,
	276	const unsigned char *in, size_t inl)
	277	{
	278	PROV_CCM_CTX ctx = (PROV_CCM_CTX )vctx;
	279
	280	if (outsize < inl) {
	281	ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
	282	return -1;
	283	}
	284
	285	if (ccm_cipher_internal(ctx, out, outl, in, inl) <= 0)
	286	return -1;
	287
	288	*outl = inl;
	289	return 1;
	290	}
	291
	292	/* Copy the buffered iv */
	293	static int ccm_set_iv(PROV_CCM_CTX *ctx, size_t mlen)
	294	{
	295	const PROV_CCM_HW *hw = ctx->hw;
	296
	297	if (!hw->setiv(ctx, ctx->iv, ccm_get_ivlen(ctx), mlen))
	298	return 0;
	299	ctx->len_set = 1;
	300	return 1;
	301	}
	302
	303	static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
	304	unsigned char out, size_t padlen,
	305	const unsigned char *in, size_t len)
	306	{
	307	int rv = 0;
	308	size_t olen = 0;
	309
	310	/* Encrypt/decrypt must be performed in place */
	311	if (out != in \|\| len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)ctx->m))
	312	goto err;
	313
	314	/* If encrypting set explicit IV from sequence number (start of AAD) */
	315	if (ctx->enc)
	316	memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
	317	/* Get rest of IV from explicit IV */
	318	memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
	319	/* Correct length value */
	320	len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
	321	if (!ccm_set_iv(ctx, len))
	322	goto err;
	323
	324	/* Use saved AAD */
	325	if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))
	326	goto err;
	327
	328	/* Fix buffer to point to payload */
	329	in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
	330	out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
	331	if (ctx->enc) {
	332	if (!ctx->hw->auth_encrypt(ctx, in, out, len, out + len, ctx->m))
	333	goto err;
	334	olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
	335	} else {
	336	if (!ctx->hw->auth_decrypt(ctx, in, out, len,
	337	(unsigned char *)in + len, ctx->m))
	338	goto err;
339	olen = len;
340	}
341	rv = 1;
342	err:
343	*padlen = olen;
344	return rv;
345	}
346
347	static int ccm_cipher_internal(PROV_CCM_CTX ctx, unsigned char out,
348	size_t padlen, const unsigned char in,
349	size_t len)
350	{
351	int rv = 0;
352	size_t olen = 0;
353	const PROV_CCM_HW *hw = ctx->hw;
354
355	/* If no key set, return error */
356	if (!ctx->key_set)
357	return 0;
358
dc64dc2e	359	if (ctx->tls_aad_len != UNINITIALISED_SIZET)
3bfe9005 SL	360	return ccm_tls_cipher(ctx, out, padlen, in, len);
	361
	362	/* EVP_Final() doesn't return any data /
	363	if (in == NULL && out != NULL)
37a830e7	364	goto finish;
3bfe9005 SL	365
	366	if (!ctx->iv_set)
	367	goto err;
	368
	369	if (out == NULL) {
	370	if (in == NULL) {
	371	if (!ccm_set_iv(ctx, len))
	372	goto err;
	373	} else {
	374	/* If we have AAD, we need a message length */
	375	if (!ctx->len_set && len)
	376	goto err;
	377	if (!hw->setaad(ctx, in, len))
	378	goto err;
	379	}
	380	} else {
	381	/* If not set length yet do it */
	382	if (!ctx->len_set && !ccm_set_iv(ctx, len))
	383	goto err;
	384
	385	if (ctx->enc) {
	386	if (!hw->auth_encrypt(ctx, in, out, len, NULL, 0))
	387	goto err;
	388	ctx->tag_set = 1;
	389	} else {
	390	/* The tag must be set before actually decrypting data */
	391	if (!ctx->tag_set)
	392	goto err;
	393
	394	if (!hw->auth_decrypt(ctx, in, out, len, ctx->buf, ctx->m))
	395	goto err;
	396	/* Finished - reset flags so calling this method again will fail */
	397	ctx->iv_set = 0;
	398	ctx->tag_set = 0;
	399	ctx->len_set = 0;
	400	}
	401	}
	402	olen = len;
37a830e7	403	finish:
3bfe9005 SL	404	rv = 1;
	405	err:
	406	*padlen = olen;
	407	return rv;
	408	}
	409
e1178600	410	void ccm_initctx(PROV_CCM_CTX ctx, size_t keybits, const PROV_CCM_HW hw)
3bfe9005 SL	411	{
	412	ctx->keylen = keybits / 8;
	413	ctx->key_set = 0;
	414	ctx->iv_set = 0;
	415	ctx->tag_set = 0;
	416	ctx->len_set = 0;
	417	ctx->l = 8;
	418	ctx->m = 12;
dc64dc2e	419	ctx->tls_aad_len = UNINITIALISED_SIZET;
3bfe9005 SL	420	ctx->hw = hw;
	421	}
	422
e1178600	423	void ccm_finalctx(PROV_CCM_CTX *ctx)
3bfe9005 SL	424	{
	425	OPENSSL_cleanse(ctx->iv, sizeof(ctx->iv));
	426	}