1 /* ====================================================================
2 * Copyright (c) 2001 The OpenSSL Project. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in
13 * the documentation and/or other materials provided with the
16 * 3. All advertising materials mentioning features or use of this
17 * software must display the following acknowledgment:
18 * "This product includes software developed by the OpenSSL Project
19 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
21 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
22 * endorse or promote products derived from this software without
23 * prior written permission. For written permission, please contact
24 * openssl-core@openssl.org.
26 * 5. Products derived from this software may not be called "OpenSSL"
27 * nor may "OpenSSL" appear in their names without prior written
28 * permission of the OpenSSL Project.
30 * 6. Redistributions of any form whatsoever must retain the following
32 * "This product includes software developed by the OpenSSL Project
33 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
35 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
36 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
38 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
39 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
41 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
42 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
44 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
45 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
46 * OF THE POSSIBILITY OF SUCH DAMAGE.
47 * ====================================================================
51 #define OPENSSL_FIPSAPI
53 #include <openssl/opensslconf.h>
54 #ifndef OPENSSL_NO_AES
55 #include <openssl/evp.h>
56 #include <openssl/err.h>
59 #include <openssl/aes.h>
61 #include "modes_lcl.h"
62 #include <openssl/rand.h>
64 static int aes_init_key(EVP_CIPHER_CTX
*ctx
, const unsigned char *key
,
65 const unsigned char *iv
, int enc
);
72 #define data(ctx) EVP_C_DATA(EVP_AES_KEY,ctx)
74 IMPLEMENT_BLOCK_CIPHER(aes_128
, ks
, AES
, EVP_AES_KEY
,
75 NID_aes_128
, 16, 16, 16, 128,
76 EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
,
77 aes_init_key
, NULL
, NULL
, NULL
, NULL
)
78 IMPLEMENT_BLOCK_CIPHER(aes_192
, ks
, AES
, EVP_AES_KEY
,
79 NID_aes_192
, 16, 24, 16, 128,
80 EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
,
81 aes_init_key
, NULL
, NULL
, NULL
, NULL
)
82 IMPLEMENT_BLOCK_CIPHER(aes_256
, ks
, AES
, EVP_AES_KEY
,
83 NID_aes_256
, 16, 32, 16, 128,
84 EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
,
85 aes_init_key
, NULL
, NULL
, NULL
, NULL
)
87 #define IMPLEMENT_AES_CFBR(ksize,cbits) IMPLEMENT_CFBR(aes,AES,EVP_AES_KEY,ks,ksize,cbits,16,EVP_CIPH_FLAG_FIPS)
89 IMPLEMENT_AES_CFBR(128,1)
90 IMPLEMENT_AES_CFBR(192,1)
91 IMPLEMENT_AES_CFBR(256,1)
93 IMPLEMENT_AES_CFBR(128,8)
94 IMPLEMENT_AES_CFBR(192,8)
95 IMPLEMENT_AES_CFBR(256,8)
97 static int aes_counter (EVP_CIPHER_CTX
*ctx
, unsigned char *out
,
98 const unsigned char *in
, size_t len
)
103 void AES_ctr32_encrypt(const unsigned char *in
, unsigned char *out
,
104 size_t blocks
, const AES_KEY
*key
,
105 const unsigned char ivec
[AES_BLOCK_SIZE
]);
107 CRYPTO_ctr128_encrypt_ctr32(in
,out
,len
,
108 &((EVP_AES_KEY
*)ctx
->cipher_data
)->ks
,
109 ctx
->iv
,ctx
->buf
,&num
,(ctr128_f
)AES_ctr32_encrypt
);
111 CRYPTO_ctr128_encrypt(in
,out
,len
,
112 &((EVP_AES_KEY
*)ctx
->cipher_data
)->ks
,
113 ctx
->iv
,ctx
->buf
,&num
,(block128_f
)AES_encrypt
);
115 ctx
->num
= (size_t)num
;
119 static const EVP_CIPHER aes_128_ctr_cipher
=
121 NID_aes_128_ctr
,1,16,16,
122 EVP_CIPH_CTR_MODE
|EVP_CIPH_FLAG_FIPS
,
133 const EVP_CIPHER
*EVP_aes_128_ctr (void)
134 { return &aes_128_ctr_cipher
; }
136 static const EVP_CIPHER aes_192_ctr_cipher
=
138 NID_aes_192_ctr
,1,24,16,
139 EVP_CIPH_CTR_MODE
|EVP_CIPH_FLAG_FIPS
,
150 const EVP_CIPHER
*EVP_aes_192_ctr (void)
151 { return &aes_192_ctr_cipher
; }
153 static const EVP_CIPHER aes_256_ctr_cipher
=
155 NID_aes_256_ctr
,1,32,16,
156 EVP_CIPH_CTR_MODE
|EVP_CIPH_FLAG_FIPS
,
167 const EVP_CIPHER
*EVP_aes_256_ctr (void)
168 { return &aes_256_ctr_cipher
; }
170 static int aes_init_key(EVP_CIPHER_CTX
*ctx
, const unsigned char *key
,
171 const unsigned char *iv
, int enc
)
175 if (((ctx
->cipher
->flags
& EVP_CIPH_MODE
) == EVP_CIPH_ECB_MODE
176 || (ctx
->cipher
->flags
& EVP_CIPH_MODE
) == EVP_CIPH_CBC_MODE
)
178 ret
=AES_set_decrypt_key(key
, ctx
->key_len
* 8, ctx
->cipher_data
);
180 ret
=AES_set_encrypt_key(key
, ctx
->key_len
* 8, ctx
->cipher_data
);
184 EVPerr(EVP_F_AES_INIT_KEY
,EVP_R_AES_KEY_SETUP_FAILED
);
193 /* AES key schedule to use */
195 /* Set if key initialised */
197 /* Set if an iv is set */
200 /* Temporary IV store */
205 unsigned char tag
[16];
207 /* It is OK to generate IVs */
211 static int aes_gcm_cleanup(EVP_CIPHER_CTX
*c
)
213 EVP_AES_GCM_CTX
*gctx
= c
->cipher_data
;
214 OPENSSL_cleanse(&gctx
->gcm
, sizeof(gctx
->gcm
));
215 if (gctx
->iv
!= c
->iv
)
216 OPENSSL_free(gctx
->iv
);
220 /* increment counter (64-bit int) by 1 */
221 static void ctr64_inc(unsigned char *counter
) {
234 static int aes_gcm_ctrl(EVP_CIPHER_CTX
*c
, int type
, int arg
, void *ptr
)
236 EVP_AES_GCM_CTX
*gctx
= c
->cipher_data
;
242 gctx
->ivlen
= c
->cipher
->iv_len
;
248 case EVP_CTRL_GCM_SET_IVLEN
:
252 if (FIPS_mode() && !(c
->flags
& EVP_CIPH_FLAG_NON_FIPS_ALLOW
)
256 /* Allocate memory for IV if needed */
257 if ((arg
> EVP_MAX_IV_LENGTH
) && (arg
> gctx
->ivlen
))
259 if (gctx
->iv
!= c
->iv
)
260 OPENSSL_free(gctx
->iv
);
261 gctx
->iv
= OPENSSL_malloc(arg
);
268 case EVP_CTRL_GCM_SET_TAG
:
269 if (arg
<= 0 || arg
> 16 || c
->encrypt
)
271 memcpy(gctx
->tag
, ptr
, arg
);
275 case EVP_CTRL_GCM_GET_TAG
:
276 if (arg
<= 0 || arg
> 16 || !c
->encrypt
|| gctx
->taglen
< 0)
278 memcpy(ptr
, gctx
->tag
, arg
);
281 case EVP_CTRL_GCM_SET_IV_FIXED
:
282 /* Special case: -1 length restores whole IV */
285 memcpy(gctx
->iv
, ptr
, gctx
->ivlen
);
289 /* Fixed field must be at least 4 bytes and invocation field
292 if ((arg
< 4) || (gctx
->ivlen
- arg
) < 8)
295 memcpy(gctx
->iv
, ptr
, arg
);
296 if (RAND_bytes(gctx
->iv
+ arg
, gctx
->ivlen
- arg
) <= 0)
301 case EVP_CTRL_GCM_IV_GEN
:
302 if (gctx
->iv_gen
== 0 || gctx
->key_set
== 0)
304 CRYPTO_gcm128_setiv(&gctx
->gcm
, gctx
->iv
, gctx
->ivlen
);
305 memcpy(ptr
, gctx
->iv
, gctx
->ivlen
);
306 /* Invocation field will be at least 8 bytes in size and
307 * so no need to check wrap around or increment more than
310 ctr64_inc(gctx
->iv
+ gctx
->ivlen
- 8);
320 static int aes_gcm_init_key(EVP_CIPHER_CTX
*ctx
, const unsigned char *key
,
321 const unsigned char *iv
, int enc
)
323 EVP_AES_GCM_CTX
*gctx
= ctx
->cipher_data
;
328 AES_set_encrypt_key(key
, ctx
->key_len
* 8, &gctx
->ks
);
329 CRYPTO_gcm128_init(&gctx
->gcm
, &gctx
->ks
, (block128_f
)AES_encrypt
);
330 /* If we have an iv can set it directly, otherwise use
333 if (iv
== NULL
&& gctx
->iv_set
)
337 CRYPTO_gcm128_setiv(&gctx
->gcm
, iv
, gctx
->ivlen
);
344 /* If key set use IV, otherwise copy */
346 CRYPTO_gcm128_setiv(&gctx
->gcm
, iv
, gctx
->ivlen
);
348 memcpy(gctx
->iv
, iv
, gctx
->ivlen
);
355 static int aes_gcm(EVP_CIPHER_CTX
*ctx
, unsigned char *out
,
356 const unsigned char *in
, size_t len
)
358 EVP_AES_GCM_CTX
*gctx
= ctx
->cipher_data
;
359 /* If not set up, return error */
360 if (!gctx
->iv_set
&& !gctx
->key_set
)
362 if (!ctx
->encrypt
&& gctx
->taglen
< 0)
368 if (CRYPTO_gcm128_aad(&gctx
->gcm
, in
, len
))
371 else if (ctx
->encrypt
)
373 if (CRYPTO_gcm128_encrypt(&gctx
->gcm
, in
, out
, len
))
378 if (CRYPTO_gcm128_decrypt(&gctx
->gcm
, in
, out
, len
))
387 if (CRYPTO_gcm128_finish(&gctx
->gcm
,
388 gctx
->tag
, gctx
->taglen
) != 0)
393 CRYPTO_gcm128_tag(&gctx
->gcm
, gctx
->tag
, 16);
395 /* Don't reuse the IV */
402 static const EVP_CIPHER aes_128_gcm_cipher
=
404 NID_aes_128_gcm
,1,16,12,
405 EVP_CIPH_GCM_MODE
|EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
406 | EVP_CIPH_CUSTOM_IV
| EVP_CIPH_FLAG_CUSTOM_CIPHER
407 | EVP_CIPH_ALWAYS_CALL_INIT
| EVP_CIPH_CTRL_INIT
408 | EVP_CIPH_FLAG_FIPS
,
412 sizeof(EVP_AES_GCM_CTX
),
419 const EVP_CIPHER
*EVP_aes_128_gcm (void)
420 { return &aes_128_gcm_cipher
; }
422 static const EVP_CIPHER aes_192_gcm_cipher
=
424 NID_aes_128_gcm
,1,24,12,
425 EVP_CIPH_GCM_MODE
|EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
426 | EVP_CIPH_CUSTOM_IV
| EVP_CIPH_FLAG_CUSTOM_CIPHER
427 | EVP_CIPH_ALWAYS_CALL_INIT
| EVP_CIPH_CTRL_INIT
428 | EVP_CIPH_FLAG_FIPS
,
432 sizeof(EVP_AES_GCM_CTX
),
439 const EVP_CIPHER
*EVP_aes_192_gcm (void)
440 { return &aes_192_gcm_cipher
; }
442 static const EVP_CIPHER aes_256_gcm_cipher
=
444 NID_aes_128_gcm
,1,32,12,
445 EVP_CIPH_GCM_MODE
|EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
446 | EVP_CIPH_CUSTOM_IV
| EVP_CIPH_FLAG_CUSTOM_CIPHER
447 | EVP_CIPH_ALWAYS_CALL_INIT
| EVP_CIPH_CTRL_INIT
448 | EVP_CIPH_FLAG_FIPS
,
452 sizeof(EVP_AES_GCM_CTX
),
459 const EVP_CIPHER
*EVP_aes_256_gcm (void)
460 { return &aes_256_gcm_cipher
; }
464 /* AES key schedules to use */
469 static int aes_xts_ctrl(EVP_CIPHER_CTX
*c
, int type
, int arg
, void *ptr
)
471 EVP_AES_XTS_CTX
*xctx
= c
->cipher_data
;
472 if (type
!= EVP_CTRL_INIT
)
474 /* key1 and key2 are used as an indicator both key and IV are set */
475 xctx
->xts
.key1
= NULL
;
476 xctx
->xts
.key2
= NULL
;
477 xctx
->xts
.block1
= (block128_f
)AES_encrypt
;
478 xctx
->xts
.block2
= (block128_f
)AES_encrypt
;
482 static int aes_xts_init_key(EVP_CIPHER_CTX
*ctx
, const unsigned char *key
,
483 const unsigned char *iv
, int enc
)
485 EVP_AES_XTS_CTX
*xctx
= ctx
->cipher_data
;
491 AES_set_encrypt_key(key
, ctx
->key_len
* 8, &xctx
->ks1
);
492 AES_set_encrypt_key(key
+ ctx
->key_len
, ctx
->key_len
* 8,
495 xctx
->xts
.key1
= &xctx
->ks1
;
496 xctx
->xts
.block1
= (block128_f
)AES_encrypt
;
497 xctx
->xts
.block2
= (block128_f
)AES_encrypt
;
502 xctx
->xts
.key2
= &xctx
->ks2
;
503 memcpy(ctx
->iv
, iv
, 16);
509 static int aes_xts(EVP_CIPHER_CTX
*ctx
, unsigned char *out
,
510 const unsigned char *in
, size_t len
)
512 EVP_AES_XTS_CTX
*xctx
= ctx
->cipher_data
;
513 if (!xctx
->xts
.key1
|| !xctx
->xts
.key2
)
517 if (CRYPTO_xts128_encrypt(&xctx
->xts
, ctx
->iv
, in
, out
, len
,
523 static const EVP_CIPHER aes_128_xts_cipher
=
525 NID_aes_128_xts
,16,32,16,
526 EVP_CIPH_XTS_MODE
|EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
527 | EVP_CIPH_CUSTOM_IV
| EVP_CIPH_FLAG_CUSTOM_CIPHER
528 | EVP_CIPH_ALWAYS_CALL_INIT
| EVP_CIPH_CTRL_INIT
,
532 sizeof(EVP_AES_XTS_CTX
),
539 const EVP_CIPHER
*EVP_aes_128_xts (void)
540 { return &aes_128_xts_cipher
; }
542 static const EVP_CIPHER aes_256_xts_cipher
=
544 NID_aes_256_xts
,16,64,16,
545 EVP_CIPH_XTS_MODE
|EVP_CIPH_FLAG_FIPS
|EVP_CIPH_FLAG_DEFAULT_ASN1
546 | EVP_CIPH_CUSTOM_IV
| EVP_CIPH_FLAG_CUSTOM_CIPHER
547 | EVP_CIPH_ALWAYS_CALL_INIT
| EVP_CIPH_CTRL_INIT
,
551 sizeof(EVP_AES_XTS_CTX
),
558 const EVP_CIPHER
*EVP_aes_256_xts (void)
559 { return &aes_256_xts_cipher
; }