]>
Commit | Line | Data |
---|---|---|
b1ceb439 | 1 | /* |
3c2bdd7d | 2 | * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. |
b1ceb439 | 3 | * |
a6ed19dc | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
b1ceb439 TS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include <string.h> | |
11 | #include <stdlib.h> | |
12 | #include <openssl/crypto.h> | |
459b15d4 | 13 | #include <openssl/evp.h> |
776796e8 RL |
14 | #include <openssl/core_names.h> |
15 | #include <openssl/params.h> | |
e23d850f | 16 | #include "internal/endian.h" |
25f2138b DMSP |
17 | #include "crypto/modes.h" |
18 | #include "crypto/siv.h" | |
b1ceb439 TS |
19 | |
20 | #ifndef OPENSSL_NO_SIV | |
21 | ||
22 | __owur static ossl_inline uint32_t rotl8(uint32_t x) | |
23 | { | |
24 | return (x << 8) | (x >> 24); | |
25 | } | |
26 | ||
27 | __owur static ossl_inline uint32_t rotr8(uint32_t x) | |
28 | { | |
29 | return (x >> 8) | (x << 24); | |
30 | } | |
31 | ||
32 | __owur static ossl_inline uint64_t byteswap8(uint64_t x) | |
33 | { | |
34 | uint32_t high = (uint32_t)(x >> 32); | |
35 | uint32_t low = (uint32_t)x; | |
36 | ||
37 | high = (rotl8(high) & 0x00ff00ff) | (rotr8(high) & 0xff00ff00); | |
38 | low = (rotl8(low) & 0x00ff00ff) | (rotr8(low) & 0xff00ff00); | |
39 | return ((uint64_t)low) << 32 | (uint64_t)high; | |
40 | } | |
41 | ||
42 | __owur static ossl_inline uint64_t siv128_getword(SIV_BLOCK const *b, size_t i) | |
43 | { | |
e23d850f | 44 | DECLARE_IS_ENDIAN; |
b1ceb439 | 45 | |
e23d850f | 46 | if (IS_LITTLE_ENDIAN) |
b1ceb439 TS |
47 | return byteswap8(b->word[i]); |
48 | return b->word[i]; | |
49 | } | |
50 | ||
51 | static ossl_inline void siv128_putword(SIV_BLOCK *b, size_t i, uint64_t x) | |
52 | { | |
e23d850f | 53 | DECLARE_IS_ENDIAN; |
b1ceb439 | 54 | |
e23d850f | 55 | if (IS_LITTLE_ENDIAN) |
b1ceb439 TS |
56 | b->word[i] = byteswap8(x); |
57 | else | |
58 | b->word[i] = x; | |
59 | } | |
60 | ||
61 | static ossl_inline void siv128_xorblock(SIV_BLOCK *x, | |
62 | SIV_BLOCK const *y) | |
63 | { | |
64 | x->word[0] ^= y->word[0]; | |
65 | x->word[1] ^= y->word[1]; | |
66 | } | |
67 | ||
68 | /* | |
69 | * Doubles |b|, which is 16 bytes representing an element | |
70 | * of GF(2**128) modulo the irreducible polynomial | |
71 | * x**128 + x**7 + x**2 + x + 1. | |
72 | * Assumes two's-complement arithmetic | |
73 | */ | |
74 | static ossl_inline void siv128_dbl(SIV_BLOCK *b) | |
75 | { | |
76 | uint64_t high = siv128_getword(b, 0); | |
77 | uint64_t low = siv128_getword(b, 1); | |
78 | uint64_t high_carry = high & (((uint64_t)1) << 63); | |
79 | uint64_t low_carry = low & (((uint64_t)1) << 63); | |
80 | int64_t low_mask = -((int64_t)(high_carry >> 63)) & 0x87; | |
81 | uint64_t high_mask = low_carry >> 63; | |
82 | ||
83 | high = (high << 1) | high_mask; | |
84 | low = (low << 1) ^ (uint64_t)low_mask; | |
85 | siv128_putword(b, 0, high); | |
86 | siv128_putword(b, 1, low); | |
87 | } | |
88 | ||
89 | __owur static ossl_inline int siv128_do_s2v_p(SIV128_CONTEXT *ctx, SIV_BLOCK *out, | |
90 | unsigned char const* in, size_t len) | |
91 | { | |
92 | SIV_BLOCK t; | |
93 | size_t out_len = sizeof(out->byte); | |
be5fc053 KR |
94 | EVP_MAC_CTX *mac_ctx; |
95 | int ret = 0; | |
b1ceb439 | 96 | |
865adf97 | 97 | mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init); |
be5fc053 | 98 | if (mac_ctx == NULL) |
b1ceb439 TS |
99 | return 0; |
100 | ||
101 | if (len >= SIV_LEN) { | |
be5fc053 KR |
102 | if (!EVP_MAC_update(mac_ctx, in, len - SIV_LEN)) |
103 | goto err; | |
b1ceb439 TS |
104 | memcpy(&t, in + (len-SIV_LEN), SIV_LEN); |
105 | siv128_xorblock(&t, &ctx->d); | |
be5fc053 KR |
106 | if (!EVP_MAC_update(mac_ctx, t.byte, SIV_LEN)) |
107 | goto err; | |
b1ceb439 TS |
108 | } else { |
109 | memset(&t, 0, sizeof(t)); | |
110 | memcpy(&t, in, len); | |
111 | t.byte[len] = 0x80; | |
112 | siv128_dbl(&ctx->d); | |
113 | siv128_xorblock(&t, &ctx->d); | |
be5fc053 KR |
114 | if (!EVP_MAC_update(mac_ctx, t.byte, SIV_LEN)) |
115 | goto err; | |
b1ceb439 | 116 | } |
776796e8 | 117 | if (!EVP_MAC_final(mac_ctx, out->byte, &out_len, sizeof(out->byte)) |
b1ceb439 | 118 | || out_len != SIV_LEN) |
be5fc053 KR |
119 | goto err; |
120 | ||
121 | ret = 1; | |
122 | ||
123 | err: | |
865adf97 | 124 | EVP_MAC_CTX_free(mac_ctx); |
be5fc053 | 125 | return ret; |
b1ceb439 TS |
126 | } |
127 | ||
128 | ||
129 | __owur static ossl_inline int siv128_do_encrypt(EVP_CIPHER_CTX *ctx, unsigned char *out, | |
130 | unsigned char const *in, size_t len, | |
131 | SIV_BLOCK *icv) | |
132 | { | |
133 | int out_len = (int)len; | |
134 | ||
135 | if (!EVP_CipherInit_ex(ctx, NULL, NULL, NULL, icv->byte, 1)) | |
136 | return 0; | |
137 | return EVP_EncryptUpdate(ctx, out, &out_len, in, out_len); | |
138 | } | |
139 | ||
140 | /* | |
141 | * Create a new SIV128_CONTEXT | |
142 | */ | |
7bbadfc1 | 143 | SIV128_CONTEXT *ossl_siv128_new(const unsigned char *key, int klen, |
90409da6 | 144 | EVP_CIPHER *cbc, EVP_CIPHER *ctr, |
b4250010 | 145 | OSSL_LIB_CTX *libctx, const char *propq) |
b1ceb439 TS |
146 | { |
147 | SIV128_CONTEXT *ctx; | |
148 | int ret; | |
149 | ||
150 | if ((ctx = OPENSSL_malloc(sizeof(*ctx))) != NULL) { | |
7bbadfc1 | 151 | ret = ossl_siv128_init(ctx, key, klen, cbc, ctr, libctx, propq); |
b1ceb439 TS |
152 | if (ret) |
153 | return ctx; | |
154 | OPENSSL_free(ctx); | |
155 | } | |
156 | ||
157 | return NULL; | |
158 | } | |
159 | ||
160 | /* | |
161 | * Initialise an existing SIV128_CONTEXT | |
162 | */ | |
7bbadfc1 | 163 | int ossl_siv128_init(SIV128_CONTEXT *ctx, const unsigned char *key, int klen, |
90409da6 | 164 | const EVP_CIPHER *cbc, const EVP_CIPHER *ctr, |
b4250010 | 165 | OSSL_LIB_CTX *libctx, const char *propq) |
b1ceb439 TS |
166 | { |
167 | static const unsigned char zero[SIV_LEN] = { 0 }; | |
168 | size_t out_len = SIV_LEN; | |
be5fc053 | 169 | EVP_MAC_CTX *mac_ctx = NULL; |
776796e8 | 170 | OSSL_PARAM params[3]; |
bc8c3e1c | 171 | const char *cbc_name; |
776796e8 | 172 | |
bc8c3e1c SL |
173 | if (ctx == NULL) |
174 | return 0; | |
b1ceb439 TS |
175 | |
176 | memset(&ctx->d, 0, sizeof(ctx->d)); | |
90409da6 SL |
177 | EVP_CIPHER_CTX_free(ctx->cipher_ctx); |
178 | EVP_MAC_CTX_free(ctx->mac_ctx_init); | |
179 | EVP_MAC_free(ctx->mac); | |
180 | ctx->mac = NULL; | |
b1ceb439 | 181 | ctx->cipher_ctx = NULL; |
9a3b5b76 | 182 | ctx->mac_ctx_init = NULL; |
b1ceb439 | 183 | |
bc8c3e1c SL |
184 | if (key == NULL || cbc == NULL || ctr == NULL) |
185 | return 0; | |
186 | ||
ed576acd | 187 | cbc_name = EVP_CIPHER_get0_name(cbc); |
bc8c3e1c SL |
188 | params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER, |
189 | (char *)cbc_name, 0); | |
190 | params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, | |
191 | (void *)key, klen); | |
192 | params[2] = OSSL_PARAM_construct_end(); | |
193 | ||
194 | if ((ctx->cipher_ctx = EVP_CIPHER_CTX_new()) == NULL | |
81ff9eeb | 195 | || (ctx->mac = |
90409da6 | 196 | EVP_MAC_fetch(libctx, OSSL_MAC_NAME_CMAC, propq)) == NULL |
865adf97 MC |
197 | || (ctx->mac_ctx_init = EVP_MAC_CTX_new(ctx->mac)) == NULL |
198 | || !EVP_MAC_CTX_set_params(ctx->mac_ctx_init, params) | |
b1ceb439 | 199 | || !EVP_EncryptInit_ex(ctx->cipher_ctx, ctr, NULL, key + klen, NULL) |
865adf97 | 200 | || (mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init)) == NULL |
be5fc053 | 201 | || !EVP_MAC_update(mac_ctx, zero, sizeof(zero)) |
776796e8 RL |
202 | || !EVP_MAC_final(mac_ctx, ctx->d.byte, &out_len, |
203 | sizeof(ctx->d.byte))) { | |
b1ceb439 | 204 | EVP_CIPHER_CTX_free(ctx->cipher_ctx); |
865adf97 MC |
205 | EVP_MAC_CTX_free(ctx->mac_ctx_init); |
206 | EVP_MAC_CTX_free(mac_ctx); | |
776796e8 | 207 | EVP_MAC_free(ctx->mac); |
b1ceb439 TS |
208 | return 0; |
209 | } | |
865adf97 | 210 | EVP_MAC_CTX_free(mac_ctx); |
b1ceb439 TS |
211 | |
212 | ctx->final_ret = -1; | |
213 | ctx->crypto_ok = 1; | |
214 | ||
215 | return 1; | |
216 | } | |
217 | ||
218 | /* | |
219 | * Copy an SIV128_CONTEXT object | |
220 | */ | |
7bbadfc1 | 221 | int ossl_siv128_copy_ctx(SIV128_CONTEXT *dest, SIV128_CONTEXT *src) |
b1ceb439 TS |
222 | { |
223 | memcpy(&dest->d, &src->d, sizeof(src->d)); | |
90409da6 SL |
224 | if (dest->cipher_ctx == NULL) { |
225 | dest->cipher_ctx = EVP_CIPHER_CTX_new(); | |
226 | if (dest->cipher_ctx == NULL) | |
227 | return 0; | |
228 | } | |
b1ceb439 TS |
229 | if (!EVP_CIPHER_CTX_copy(dest->cipher_ctx, src->cipher_ctx)) |
230 | return 0; | |
865adf97 MC |
231 | EVP_MAC_CTX_free(dest->mac_ctx_init); |
232 | dest->mac_ctx_init = EVP_MAC_CTX_dup(src->mac_ctx_init); | |
be5fc053 | 233 | if (dest->mac_ctx_init == NULL) |
b1ceb439 | 234 | return 0; |
90409da6 SL |
235 | dest->mac = src->mac; |
236 | if (dest->mac != NULL) | |
237 | EVP_MAC_up_ref(dest->mac); | |
b1ceb439 TS |
238 | return 1; |
239 | } | |
240 | ||
241 | /* | |
242 | * Provide any AAD. This can be called multiple times. | |
243 | * Per RFC5297, the last piece of associated data | |
244 | * is the nonce, but it's not treated special | |
245 | */ | |
7bbadfc1 | 246 | int ossl_siv128_aad(SIV128_CONTEXT *ctx, const unsigned char *aad, |
b1ceb439 TS |
247 | size_t len) |
248 | { | |
9a3b5b76 | 249 | SIV_BLOCK mac_out; |
b1ceb439 | 250 | size_t out_len = SIV_LEN; |
be5fc053 | 251 | EVP_MAC_CTX *mac_ctx; |
b1ceb439 TS |
252 | |
253 | siv128_dbl(&ctx->d); | |
254 | ||
865adf97 | 255 | if ((mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init)) == NULL |
be5fc053 | 256 | || !EVP_MAC_update(mac_ctx, aad, len) |
776796e8 RL |
257 | || !EVP_MAC_final(mac_ctx, mac_out.byte, &out_len, |
258 | sizeof(mac_out.byte)) | |
be5fc053 | 259 | || out_len != SIV_LEN) { |
865adf97 | 260 | EVP_MAC_CTX_free(mac_ctx); |
b1ceb439 | 261 | return 0; |
be5fc053 | 262 | } |
865adf97 | 263 | EVP_MAC_CTX_free(mac_ctx); |
b1ceb439 | 264 | |
9a3b5b76 | 265 | siv128_xorblock(&ctx->d, &mac_out); |
b1ceb439 TS |
266 | |
267 | return 1; | |
b1ceb439 TS |
268 | } |
269 | ||
270 | /* | |
271 | * Provide any data to be encrypted. This can be called once. | |
272 | */ | |
7bbadfc1 | 273 | int ossl_siv128_encrypt(SIV128_CONTEXT *ctx, |
b1ceb439 TS |
274 | const unsigned char *in, unsigned char *out, |
275 | size_t len) | |
276 | { | |
277 | SIV_BLOCK q; | |
278 | ||
279 | /* can only do one crypto operation */ | |
280 | if (ctx->crypto_ok == 0) | |
281 | return 0; | |
282 | ctx->crypto_ok--; | |
283 | ||
284 | if (!siv128_do_s2v_p(ctx, &q, in, len)) | |
285 | return 0; | |
286 | ||
287 | memcpy(ctx->tag.byte, &q, SIV_LEN); | |
288 | q.byte[8] &= 0x7f; | |
289 | q.byte[12] &= 0x7f; | |
290 | ||
291 | if (!siv128_do_encrypt(ctx->cipher_ctx, out, in, len, &q)) | |
292 | return 0; | |
293 | ctx->final_ret = 0; | |
294 | return len; | |
295 | } | |
296 | ||
297 | /* | |
298 | * Provide any data to be decrypted. This can be called once. | |
299 | */ | |
7bbadfc1 | 300 | int ossl_siv128_decrypt(SIV128_CONTEXT *ctx, |
b1ceb439 TS |
301 | const unsigned char *in, unsigned char *out, |
302 | size_t len) | |
303 | { | |
304 | unsigned char* p; | |
305 | SIV_BLOCK t, q; | |
306 | int i; | |
307 | ||
308 | /* can only do one crypto operation */ | |
309 | if (ctx->crypto_ok == 0) | |
310 | return 0; | |
311 | ctx->crypto_ok--; | |
312 | ||
313 | memcpy(&q, ctx->tag.byte, SIV_LEN); | |
314 | q.byte[8] &= 0x7f; | |
315 | q.byte[12] &= 0x7f; | |
316 | ||
317 | if (!siv128_do_encrypt(ctx->cipher_ctx, out, in, len, &q) | |
318 | || !siv128_do_s2v_p(ctx, &t, out, len)) | |
319 | return 0; | |
320 | ||
321 | p = ctx->tag.byte; | |
322 | for (i = 0; i < SIV_LEN; i++) | |
323 | t.byte[i] ^= p[i]; | |
324 | ||
325 | if ((t.word[0] | t.word[1]) != 0) { | |
326 | OPENSSL_cleanse(out, len); | |
327 | return 0; | |
328 | } | |
329 | ctx->final_ret = 0; | |
330 | return len; | |
331 | } | |
332 | ||
333 | /* | |
334 | * Return the already calculated final result. | |
335 | */ | |
7bbadfc1 | 336 | int ossl_siv128_finish(SIV128_CONTEXT *ctx) |
b1ceb439 TS |
337 | { |
338 | return ctx->final_ret; | |
339 | } | |
340 | ||
341 | /* | |
342 | * Set the tag | |
343 | */ | |
7bbadfc1 | 344 | int ossl_siv128_set_tag(SIV128_CONTEXT *ctx, const unsigned char *tag, size_t len) |
b1ceb439 TS |
345 | { |
346 | if (len != SIV_LEN) | |
347 | return 0; | |
348 | ||
349 | /* Copy the tag from the supplied buffer */ | |
350 | memcpy(ctx->tag.byte, tag, len); | |
351 | return 1; | |
352 | } | |
353 | ||
354 | /* | |
355 | * Retrieve the calculated tag | |
356 | */ | |
7bbadfc1 | 357 | int ossl_siv128_get_tag(SIV128_CONTEXT *ctx, unsigned char *tag, size_t len) |
b1ceb439 TS |
358 | { |
359 | if (len != SIV_LEN) | |
360 | return 0; | |
361 | ||
362 | /* Copy the tag into the supplied buffer */ | |
363 | memcpy(tag, ctx->tag.byte, len); | |
364 | return 1; | |
365 | } | |
366 | ||
367 | /* | |
368 | * Release all resources | |
369 | */ | |
7bbadfc1 | 370 | int ossl_siv128_cleanup(SIV128_CONTEXT *ctx) |
b1ceb439 TS |
371 | { |
372 | if (ctx != NULL) { | |
373 | EVP_CIPHER_CTX_free(ctx->cipher_ctx); | |
374 | ctx->cipher_ctx = NULL; | |
865adf97 | 375 | EVP_MAC_CTX_free(ctx->mac_ctx_init); |
9a3b5b76 | 376 | ctx->mac_ctx_init = NULL; |
776796e8 RL |
377 | EVP_MAC_free(ctx->mac); |
378 | ctx->mac = NULL; | |
b1ceb439 TS |
379 | OPENSSL_cleanse(&ctx->d, sizeof(ctx->d)); |
380 | OPENSSL_cleanse(&ctx->tag, sizeof(ctx->tag)); | |
381 | ctx->final_ret = -1; | |
382 | ctx->crypto_ok = 1; | |
383 | } | |
384 | return 1; | |
385 | } | |
386 | ||
7bbadfc1 | 387 | int ossl_siv128_speed(SIV128_CONTEXT *ctx, int arg) |
b1ceb439 TS |
388 | { |
389 | ctx->crypto_ok = (arg == 1) ? -1 : 1; | |
390 | return 1; | |
391 | } | |
392 | ||
393 | #endif /* OPENSSL_NO_SIV */ |