• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /**
2  * \file cipher.h
3  *
4  * \brief This file contains an abstraction interface for use with the cipher
5  * primitives provided by the library. It provides a common interface to all of
6  * the available cipher operations.
7  *
8  * \author Adriaan de Jong <dejong@fox-it.com>
9  */
10 /*
11  *  Copyright The Mbed TLS Contributors
12  *  SPDX-License-Identifier: Apache-2.0
13  *
14  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
15  *  not use this file except in compliance with the License.
16  *  You may obtain a copy of the License at
17  *
18  *  http://www.apache.org/licenses/LICENSE-2.0
19  *
20  *  Unless required by applicable law or agreed to in writing, software
21  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
22  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
23  *  See the License for the specific language governing permissions and
24  *  limitations under the License.
25  */
26 
27 #ifndef MBEDTLS_CIPHER_H
28 #define MBEDTLS_CIPHER_H
29 #include "mbedtls/private_access.h"
30 
31 #include "mbedtls/build_info.h"
32 
33 #include <stddef.h>
34 #include "mbedtls/platform_util.h"
35 
36 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
37 #define MBEDTLS_CIPHER_MODE_AEAD
38 #endif
39 
40 #if defined(MBEDTLS_CIPHER_MODE_CBC)
41 #define MBEDTLS_CIPHER_MODE_WITH_PADDING
42 #endif
43 
44 #if defined(MBEDTLS_CIPHER_NULL_CIPHER) || \
45     defined(MBEDTLS_CHACHA20_C)
46 #define MBEDTLS_CIPHER_MODE_STREAM
47 #endif
48 
49 #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
50     !defined(inline) && !defined(__cplusplus)
51 #define inline __inline
52 #endif
53 
54 /** The selected feature is not available. */
55 #define MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE  -0x6080
56 /** Bad input parameters. */
57 #define MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA       -0x6100
58 /** Failed to allocate memory. */
59 #define MBEDTLS_ERR_CIPHER_ALLOC_FAILED         -0x6180
60 /** Input data contains invalid padding and is rejected. */
61 #define MBEDTLS_ERR_CIPHER_INVALID_PADDING      -0x6200
62 /** Decryption of block requires a full block. */
63 #define MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED  -0x6280
64 /** Authentication failed (for AEAD modes). */
65 #define MBEDTLS_ERR_CIPHER_AUTH_FAILED          -0x6300
66 /** The context is invalid. For example, because it was freed. */
67 #define MBEDTLS_ERR_CIPHER_INVALID_CONTEXT      -0x6380
68 
69 #define MBEDTLS_CIPHER_VARIABLE_IV_LEN     0x01    /**< Cipher accepts IVs of variable length. */
70 #define MBEDTLS_CIPHER_VARIABLE_KEY_LEN    0x02    /**< Cipher accepts keys of variable length. */
71 
72 #ifdef __cplusplus
73 extern "C" {
74 #endif
75 
76 /**
77  * \brief     Supported cipher types.
78  *
79  * \warning   DES is considered weak cipher and its use
80  *            constitutes a security risk. Arm recommends considering stronger
81  *            ciphers instead.
82  */
83 typedef enum {
84     MBEDTLS_CIPHER_ID_NONE = 0,  /**< Placeholder to mark the end of cipher ID lists. */
85     MBEDTLS_CIPHER_ID_NULL,      /**< The identity cipher, treated as a stream cipher. */
86     MBEDTLS_CIPHER_ID_AES,       /**< The AES cipher. */
87     MBEDTLS_CIPHER_ID_DES,       /**< The DES cipher. */
88     MBEDTLS_CIPHER_ID_3DES,      /**< The Triple DES cipher. */
89     MBEDTLS_CIPHER_ID_CAMELLIA,  /**< The Camellia cipher. */
90     MBEDTLS_CIPHER_ID_ARIA,      /**< The Aria cipher. */
91     MBEDTLS_CIPHER_ID_CHACHA20,  /**< The ChaCha20 cipher. */
92 } mbedtls_cipher_id_t;
93 
94 /**
95  * \brief     Supported {cipher type, cipher mode} pairs.
96  *
97  * \warning   DES is considered weak cipher and its use
98  *            constitutes a security risk. Arm recommends considering stronger
99  *            ciphers instead.
100  */
101 typedef enum {
102     MBEDTLS_CIPHER_NONE = 0,             /**< Placeholder to mark the end of cipher-pair lists. */
103     MBEDTLS_CIPHER_NULL,                 /**< The identity stream cipher. */
104     MBEDTLS_CIPHER_AES_128_ECB,          /**< AES cipher with 128-bit ECB mode. */
105     MBEDTLS_CIPHER_AES_192_ECB,          /**< AES cipher with 192-bit ECB mode. */
106     MBEDTLS_CIPHER_AES_256_ECB,          /**< AES cipher with 256-bit ECB mode. */
107     MBEDTLS_CIPHER_AES_128_CBC,          /**< AES cipher with 128-bit CBC mode. */
108     MBEDTLS_CIPHER_AES_192_CBC,          /**< AES cipher with 192-bit CBC mode. */
109     MBEDTLS_CIPHER_AES_256_CBC,          /**< AES cipher with 256-bit CBC mode. */
110     MBEDTLS_CIPHER_AES_128_CFB128,       /**< AES cipher with 128-bit CFB128 mode. */
111     MBEDTLS_CIPHER_AES_192_CFB128,       /**< AES cipher with 192-bit CFB128 mode. */
112     MBEDTLS_CIPHER_AES_256_CFB128,       /**< AES cipher with 256-bit CFB128 mode. */
113     MBEDTLS_CIPHER_AES_128_CTR,          /**< AES cipher with 128-bit CTR mode. */
114     MBEDTLS_CIPHER_AES_192_CTR,          /**< AES cipher with 192-bit CTR mode. */
115     MBEDTLS_CIPHER_AES_256_CTR,          /**< AES cipher with 256-bit CTR mode. */
116     MBEDTLS_CIPHER_AES_128_GCM,          /**< AES cipher with 128-bit GCM mode. */
117     MBEDTLS_CIPHER_AES_192_GCM,          /**< AES cipher with 192-bit GCM mode. */
118     MBEDTLS_CIPHER_AES_256_GCM,          /**< AES cipher with 256-bit GCM mode. */
119     MBEDTLS_CIPHER_CAMELLIA_128_ECB,     /**< Camellia cipher with 128-bit ECB mode. */
120     MBEDTLS_CIPHER_CAMELLIA_192_ECB,     /**< Camellia cipher with 192-bit ECB mode. */
121     MBEDTLS_CIPHER_CAMELLIA_256_ECB,     /**< Camellia cipher with 256-bit ECB mode. */
122     MBEDTLS_CIPHER_CAMELLIA_128_CBC,     /**< Camellia cipher with 128-bit CBC mode. */
123     MBEDTLS_CIPHER_CAMELLIA_192_CBC,     /**< Camellia cipher with 192-bit CBC mode. */
124     MBEDTLS_CIPHER_CAMELLIA_256_CBC,     /**< Camellia cipher with 256-bit CBC mode. */
125     MBEDTLS_CIPHER_CAMELLIA_128_CFB128,  /**< Camellia cipher with 128-bit CFB128 mode. */
126     MBEDTLS_CIPHER_CAMELLIA_192_CFB128,  /**< Camellia cipher with 192-bit CFB128 mode. */
127     MBEDTLS_CIPHER_CAMELLIA_256_CFB128,  /**< Camellia cipher with 256-bit CFB128 mode. */
128     MBEDTLS_CIPHER_CAMELLIA_128_CTR,     /**< Camellia cipher with 128-bit CTR mode. */
129     MBEDTLS_CIPHER_CAMELLIA_192_CTR,     /**< Camellia cipher with 192-bit CTR mode. */
130     MBEDTLS_CIPHER_CAMELLIA_256_CTR,     /**< Camellia cipher with 256-bit CTR mode. */
131     MBEDTLS_CIPHER_CAMELLIA_128_GCM,     /**< Camellia cipher with 128-bit GCM mode. */
132     MBEDTLS_CIPHER_CAMELLIA_192_GCM,     /**< Camellia cipher with 192-bit GCM mode. */
133     MBEDTLS_CIPHER_CAMELLIA_256_GCM,     /**< Camellia cipher with 256-bit GCM mode. */
134     MBEDTLS_CIPHER_DES_ECB,              /**< DES cipher with ECB mode. */
135     MBEDTLS_CIPHER_DES_CBC,              /**< DES cipher with CBC mode. */
136     MBEDTLS_CIPHER_DES_EDE_ECB,          /**< DES cipher with EDE ECB mode. */
137     MBEDTLS_CIPHER_DES_EDE_CBC,          /**< DES cipher with EDE CBC mode. */
138     MBEDTLS_CIPHER_DES_EDE3_ECB,         /**< DES cipher with EDE3 ECB mode. */
139     MBEDTLS_CIPHER_DES_EDE3_CBC,         /**< DES cipher with EDE3 CBC mode. */
140     MBEDTLS_CIPHER_AES_128_CCM,          /**< AES cipher with 128-bit CCM mode. */
141     MBEDTLS_CIPHER_AES_192_CCM,          /**< AES cipher with 192-bit CCM mode. */
142     MBEDTLS_CIPHER_AES_256_CCM,          /**< AES cipher with 256-bit CCM mode. */
143     MBEDTLS_CIPHER_AES_128_CCM_STAR_NO_TAG, /**< AES cipher with 128-bit CCM_STAR_NO_TAG mode. */
144     MBEDTLS_CIPHER_AES_192_CCM_STAR_NO_TAG, /**< AES cipher with 192-bit CCM_STAR_NO_TAG mode. */
145     MBEDTLS_CIPHER_AES_256_CCM_STAR_NO_TAG, /**< AES cipher with 256-bit CCM_STAR_NO_TAG mode. */
146     MBEDTLS_CIPHER_CAMELLIA_128_CCM,     /**< Camellia cipher with 128-bit CCM mode. */
147     MBEDTLS_CIPHER_CAMELLIA_192_CCM,     /**< Camellia cipher with 192-bit CCM mode. */
148     MBEDTLS_CIPHER_CAMELLIA_256_CCM,     /**< Camellia cipher with 256-bit CCM mode. */
149     MBEDTLS_CIPHER_CAMELLIA_128_CCM_STAR_NO_TAG, /**< Camellia cipher with 128-bit CCM_STAR_NO_TAG mode. */
150     MBEDTLS_CIPHER_CAMELLIA_192_CCM_STAR_NO_TAG, /**< Camellia cipher with 192-bit CCM_STAR_NO_TAG mode. */
151     MBEDTLS_CIPHER_CAMELLIA_256_CCM_STAR_NO_TAG, /**< Camellia cipher with 256-bit CCM_STAR_NO_TAG mode. */
152     MBEDTLS_CIPHER_ARIA_128_ECB,         /**< Aria cipher with 128-bit key and ECB mode. */
153     MBEDTLS_CIPHER_ARIA_192_ECB,         /**< Aria cipher with 192-bit key and ECB mode. */
154     MBEDTLS_CIPHER_ARIA_256_ECB,         /**< Aria cipher with 256-bit key and ECB mode. */
155     MBEDTLS_CIPHER_ARIA_128_CBC,         /**< Aria cipher with 128-bit key and CBC mode. */
156     MBEDTLS_CIPHER_ARIA_192_CBC,         /**< Aria cipher with 192-bit key and CBC mode. */
157     MBEDTLS_CIPHER_ARIA_256_CBC,         /**< Aria cipher with 256-bit key and CBC mode. */
158     MBEDTLS_CIPHER_ARIA_128_CFB128,      /**< Aria cipher with 128-bit key and CFB-128 mode. */
159     MBEDTLS_CIPHER_ARIA_192_CFB128,      /**< Aria cipher with 192-bit key and CFB-128 mode. */
160     MBEDTLS_CIPHER_ARIA_256_CFB128,      /**< Aria cipher with 256-bit key and CFB-128 mode. */
161     MBEDTLS_CIPHER_ARIA_128_CTR,         /**< Aria cipher with 128-bit key and CTR mode. */
162     MBEDTLS_CIPHER_ARIA_192_CTR,         /**< Aria cipher with 192-bit key and CTR mode. */
163     MBEDTLS_CIPHER_ARIA_256_CTR,         /**< Aria cipher with 256-bit key and CTR mode. */
164     MBEDTLS_CIPHER_ARIA_128_GCM,         /**< Aria cipher with 128-bit key and GCM mode. */
165     MBEDTLS_CIPHER_ARIA_192_GCM,         /**< Aria cipher with 192-bit key and GCM mode. */
166     MBEDTLS_CIPHER_ARIA_256_GCM,         /**< Aria cipher with 256-bit key and GCM mode. */
167     MBEDTLS_CIPHER_ARIA_128_CCM,         /**< Aria cipher with 128-bit key and CCM mode. */
168     MBEDTLS_CIPHER_ARIA_192_CCM,         /**< Aria cipher with 192-bit key and CCM mode. */
169     MBEDTLS_CIPHER_ARIA_256_CCM,         /**< Aria cipher with 256-bit key and CCM mode. */
170     MBEDTLS_CIPHER_ARIA_128_CCM_STAR_NO_TAG, /**< Aria cipher with 128-bit key and CCM_STAR_NO_TAG mode. */
171     MBEDTLS_CIPHER_ARIA_192_CCM_STAR_NO_TAG, /**< Aria cipher with 192-bit key and CCM_STAR_NO_TAG mode. */
172     MBEDTLS_CIPHER_ARIA_256_CCM_STAR_NO_TAG, /**< Aria cipher with 256-bit key and CCM_STAR_NO_TAG mode. */
173     MBEDTLS_CIPHER_AES_128_OFB,          /**< AES 128-bit cipher in OFB mode. */
174     MBEDTLS_CIPHER_AES_192_OFB,          /**< AES 192-bit cipher in OFB mode. */
175     MBEDTLS_CIPHER_AES_256_OFB,          /**< AES 256-bit cipher in OFB mode. */
176     MBEDTLS_CIPHER_AES_128_XTS,          /**< AES 128-bit cipher in XTS block mode. */
177     MBEDTLS_CIPHER_AES_256_XTS,          /**< AES 256-bit cipher in XTS block mode. */
178     MBEDTLS_CIPHER_CHACHA20,             /**< ChaCha20 stream cipher. */
179     MBEDTLS_CIPHER_CHACHA20_POLY1305,    /**< ChaCha20-Poly1305 AEAD cipher. */
180     MBEDTLS_CIPHER_AES_128_KW,           /**< AES cipher with 128-bit NIST KW mode. */
181     MBEDTLS_CIPHER_AES_192_KW,           /**< AES cipher with 192-bit NIST KW mode. */
182     MBEDTLS_CIPHER_AES_256_KW,           /**< AES cipher with 256-bit NIST KW mode. */
183     MBEDTLS_CIPHER_AES_128_KWP,          /**< AES cipher with 128-bit NIST KWP mode. */
184     MBEDTLS_CIPHER_AES_192_KWP,          /**< AES cipher with 192-bit NIST KWP mode. */
185     MBEDTLS_CIPHER_AES_256_KWP,          /**< AES cipher with 256-bit NIST KWP mode. */
186 } mbedtls_cipher_type_t;
187 
188 /** Supported cipher modes. */
189 typedef enum {
190     MBEDTLS_MODE_NONE = 0,               /**< None.                        */
191     MBEDTLS_MODE_ECB,                    /**< The ECB cipher mode.         */
192     MBEDTLS_MODE_CBC,                    /**< The CBC cipher mode.         */
193     MBEDTLS_MODE_CFB,                    /**< The CFB cipher mode.         */
194     MBEDTLS_MODE_OFB,                    /**< The OFB cipher mode.         */
195     MBEDTLS_MODE_CTR,                    /**< The CTR cipher mode.         */
196     MBEDTLS_MODE_GCM,                    /**< The GCM cipher mode.         */
197     MBEDTLS_MODE_STREAM,                 /**< The stream cipher mode.      */
198     MBEDTLS_MODE_CCM,                    /**< The CCM cipher mode.         */
199     MBEDTLS_MODE_CCM_STAR_NO_TAG,        /**< The CCM*-no-tag cipher mode. */
200     MBEDTLS_MODE_XTS,                    /**< The XTS cipher mode.         */
201     MBEDTLS_MODE_CHACHAPOLY,             /**< The ChaCha-Poly cipher mode. */
202     MBEDTLS_MODE_KW,                     /**< The SP800-38F KW mode */
203     MBEDTLS_MODE_KWP,                    /**< The SP800-38F KWP mode */
204 } mbedtls_cipher_mode_t;
205 
206 /** Supported cipher padding types. */
207 typedef enum {
208     MBEDTLS_PADDING_PKCS7 = 0,     /**< PKCS7 padding (default).        */
209     MBEDTLS_PADDING_ONE_AND_ZEROS, /**< ISO/IEC 7816-4 padding.         */
210     MBEDTLS_PADDING_ZEROS_AND_LEN, /**< ANSI X.923 padding.             */
211     MBEDTLS_PADDING_ZEROS,         /**< Zero padding (not reversible). */
212     MBEDTLS_PADDING_NONE,          /**< Never pad (full blocks only).   */
213 } mbedtls_cipher_padding_t;
214 
215 /** Type of operation. */
216 typedef enum {
217     MBEDTLS_OPERATION_NONE = -1,
218     MBEDTLS_DECRYPT = 0,
219     MBEDTLS_ENCRYPT,
220 } mbedtls_operation_t;
221 
222 enum {
223     /** Undefined key length. */
224     MBEDTLS_KEY_LENGTH_NONE = 0,
225     /** Key length, in bits (including parity), for DES keys. */
226     MBEDTLS_KEY_LENGTH_DES  = 64,
227     /** Key length in bits, including parity, for DES in two-key EDE. */
228     MBEDTLS_KEY_LENGTH_DES_EDE = 128,
229     /** Key length in bits, including parity, for DES in three-key EDE. */
230     MBEDTLS_KEY_LENGTH_DES_EDE3 = 192,
231 };
232 
233 /** Maximum length of any IV, in Bytes. */
234 /* This should ideally be derived automatically from list of ciphers.
235  * This should be kept in sync with MBEDTLS_SSL_MAX_IV_LENGTH defined
236  * in library/ssl_misc.h. */
237 #define MBEDTLS_MAX_IV_LENGTH      16
238 
239 /** Maximum block size of any cipher, in Bytes. */
240 /* This should ideally be derived automatically from list of ciphers.
241  * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined
242  * in library/ssl_misc.h. */
243 #define MBEDTLS_MAX_BLOCK_LENGTH   16
244 
245 /** Maximum key length, in Bytes. */
246 /* This should ideally be derived automatically from list of ciphers.
247  * For now, only check whether XTS is enabled which uses 64 Byte keys,
248  * and use 32 Bytes as an upper bound for the maximum key length otherwise.
249  * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined
250  * in library/ssl_misc.h, which however deliberately ignores the case of XTS
251  * since the latter isn't used in SSL/TLS. */
252 #if defined(MBEDTLS_CIPHER_MODE_XTS)
253 #define MBEDTLS_MAX_KEY_LENGTH     64
254 #else
255 #define MBEDTLS_MAX_KEY_LENGTH     32
256 #endif /* MBEDTLS_CIPHER_MODE_XTS */
257 
258 /**
259  * Base cipher information (opaque struct).
260  */
261 typedef struct mbedtls_cipher_base_t mbedtls_cipher_base_t;
262 
263 /**
264  * CMAC context (opaque struct).
265  */
266 typedef struct mbedtls_cmac_context_t mbedtls_cmac_context_t;
267 
268 /**
269  * Cipher information. Allows calling cipher functions
270  * in a generic way.
271  *
272  * \note        The library does not support custom cipher info structures,
273  *              only built-in structures returned by the functions
274  *              mbedtls_cipher_info_from_string(),
275  *              mbedtls_cipher_info_from_type(),
276  *              mbedtls_cipher_info_from_values(),
277  *              mbedtls_cipher_info_from_psa().
278  */
279 typedef struct mbedtls_cipher_info_t
280 {
281     /** Full cipher identifier. For example,
282      * MBEDTLS_CIPHER_AES_256_CBC.
283      */
284     mbedtls_cipher_type_t MBEDTLS_PRIVATE(type);
285 
286     /** The cipher mode. For example, MBEDTLS_MODE_CBC. */
287     mbedtls_cipher_mode_t MBEDTLS_PRIVATE(mode);
288 
289     /** The cipher key length, in bits. This is the
290      * default length for variable sized ciphers.
291      * Includes parity bits for ciphers like DES.
292      */
293     unsigned int MBEDTLS_PRIVATE(key_bitlen);
294 
295     /** Name of the cipher. */
296     const char * MBEDTLS_PRIVATE(name);
297 
298     /** IV or nonce size, in Bytes.
299      * For ciphers that accept variable IV sizes,
300      * this is the recommended size.
301      */
302     unsigned int MBEDTLS_PRIVATE(iv_size);
303 
304     /** Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and
305      *  MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the
306      *  cipher supports variable IV or variable key sizes, respectively.
307      */
308     int MBEDTLS_PRIVATE(flags);
309 
310     /** The block size, in Bytes. */
311     unsigned int MBEDTLS_PRIVATE(block_size);
312 
313     /** Struct for base cipher information and functions. */
314     const mbedtls_cipher_base_t *MBEDTLS_PRIVATE(base);
315 
316 } mbedtls_cipher_info_t;
317 
318 /**
319  * Generic cipher context.
320  */
321 typedef struct mbedtls_cipher_context_t
322 {
323     /** Information about the associated cipher. */
324     const mbedtls_cipher_info_t *MBEDTLS_PRIVATE(cipher_info);
325 
326     /** Key length to use. */
327     int MBEDTLS_PRIVATE(key_bitlen);
328 
329     /** Operation that the key of the context has been
330      * initialized for.
331      */
332     mbedtls_operation_t MBEDTLS_PRIVATE(operation);
333 
334 #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
335     /** Padding functions to use, if relevant for
336      * the specific cipher mode.
337      */
338     void (*MBEDTLS_PRIVATE(add_padding))( unsigned char *output, size_t olen, size_t data_len );
339     int (*MBEDTLS_PRIVATE(get_padding))( unsigned char *input, size_t ilen, size_t *data_len );
340 #endif
341 
342     /** Buffer for input that has not been processed yet. */
343     unsigned char MBEDTLS_PRIVATE(unprocessed_data)[MBEDTLS_MAX_BLOCK_LENGTH];
344 
345     /** Number of Bytes that have not been processed yet. */
346     size_t MBEDTLS_PRIVATE(unprocessed_len);
347 
348     /** Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number
349      * for XTS-mode. */
350     unsigned char MBEDTLS_PRIVATE(iv)[MBEDTLS_MAX_IV_LENGTH];
351 
352     /** IV size in Bytes, for ciphers with variable-length IVs. */
353     size_t MBEDTLS_PRIVATE(iv_size);
354 
355     /** The cipher-specific context. */
356     void *MBEDTLS_PRIVATE(cipher_ctx);
357 
358 #if defined(MBEDTLS_CMAC_C)
359     /** CMAC-specific context. */
360     mbedtls_cmac_context_t *MBEDTLS_PRIVATE(cmac_ctx);
361 #endif
362 
363 #if defined(MBEDTLS_USE_PSA_CRYPTO)
364     /** Indicates whether the cipher operations should be performed
365      *  by Mbed TLS' own crypto library or an external implementation
366      *  of the PSA Crypto API.
367      *  This is unset if the cipher context was established through
368      *  mbedtls_cipher_setup(), and set if it was established through
369      *  mbedtls_cipher_setup_psa().
370      */
371     unsigned char MBEDTLS_PRIVATE(psa_enabled);
372 #endif /* MBEDTLS_USE_PSA_CRYPTO */
373 
374 } mbedtls_cipher_context_t;
375 
376 /**
377  * \brief This function retrieves the list of ciphers supported
378  *        by the generic cipher module.
379  *
380  *        For any cipher identifier in the returned list, you can
381  *        obtain the corresponding generic cipher information structure
382  *        via mbedtls_cipher_info_from_type(), which can then be used
383  *        to prepare a cipher context via mbedtls_cipher_setup().
384  *
385  *
386  * \return      A statically-allocated array of cipher identifiers
387  *              of type cipher_type_t. The last entry is zero.
388  */
389 const int *mbedtls_cipher_list( void );
390 
391 /**
392  * \brief               This function retrieves the cipher-information
393  *                      structure associated with the given cipher name.
394  *
395  * \param cipher_name   Name of the cipher to search for. This must not be
396  *                      \c NULL.
397  *
398  * \return              The cipher information structure associated with the
399  *                      given \p cipher_name.
400  * \return              \c NULL if the associated cipher information is not found.
401  */
402 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( const char *cipher_name );
403 
404 /**
405  * \brief               This function retrieves the cipher-information
406  *                      structure associated with the given cipher type.
407  *
408  * \param cipher_type   Type of the cipher to search for.
409  *
410  * \return              The cipher information structure associated with the
411  *                      given \p cipher_type.
412  * \return              \c NULL if the associated cipher information is not found.
413  */
414 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( const mbedtls_cipher_type_t cipher_type );
415 
416 /**
417  * \brief               This function retrieves the cipher-information
418  *                      structure associated with the given cipher ID,
419  *                      key size and mode.
420  *
421  * \param cipher_id     The ID of the cipher to search for. For example,
422  *                      #MBEDTLS_CIPHER_ID_AES.
423  * \param key_bitlen    The length of the key in bits.
424  * \param mode          The cipher mode. For example, #MBEDTLS_MODE_CBC.
425  *
426  * \return              The cipher information structure associated with the
427  *                      given \p cipher_id.
428  * \return              \c NULL if the associated cipher information is not found.
429  */
430 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( const mbedtls_cipher_id_t cipher_id,
431                                               int key_bitlen,
432                                               const mbedtls_cipher_mode_t mode );
433 
434 /**
435  * \brief               Retrieve the identifier for a cipher info structure.
436  *
437  * \param[in] info      The cipher info structure to query.
438  *                      This may be \c NULL.
439  *
440  * \return              The full cipher identifier (\c MBEDTLS_CIPHER_xxx).
441  * \return              #MBEDTLS_CIPHER_NONE if \p info is \c NULL.
442  */
mbedtls_cipher_info_get_type(const mbedtls_cipher_info_t * info)443 static inline mbedtls_cipher_type_t mbedtls_cipher_info_get_type(
444     const mbedtls_cipher_info_t *info )
445 {
446     if( info == NULL )
447         return( MBEDTLS_CIPHER_NONE );
448     else
449         return( info->MBEDTLS_PRIVATE(type) );
450 }
451 
452 /**
453  * \brief               Retrieve the operation mode for a cipher info structure.
454  *
455  * \param[in] info      The cipher info structure to query.
456  *                      This may be \c NULL.
457  *
458  * \return              The cipher mode (\c MBEDTLS_MODE_xxx).
459  * \return              #MBEDTLS_MODE_NONE if \p info is \c NULL.
460  */
mbedtls_cipher_info_get_mode(const mbedtls_cipher_info_t * info)461 static inline mbedtls_cipher_mode_t mbedtls_cipher_info_get_mode(
462     const mbedtls_cipher_info_t *info )
463 {
464     if( info == NULL )
465         return( MBEDTLS_MODE_NONE );
466     else
467         return( info->MBEDTLS_PRIVATE(mode) );
468 }
469 
470 /**
471  * \brief               Retrieve the key size for a cipher info structure.
472  *
473  * \param[in] info      The cipher info structure to query.
474  *                      This may be \c NULL.
475  *
476  * \return              The key length in bits.
477  *                      For variable-sized ciphers, this is the default length.
478  *                      For DES, this includes the parity bits.
479  * \return              \c 0 if \p info is \c NULL.
480  */
mbedtls_cipher_info_get_key_bitlen(const mbedtls_cipher_info_t * info)481 static inline size_t mbedtls_cipher_info_get_key_bitlen(
482     const mbedtls_cipher_info_t *info )
483 {
484     if( info == NULL )
485         return( 0 );
486     else
487         return( info->MBEDTLS_PRIVATE(key_bitlen) );
488 }
489 
490 /**
491  * \brief               Retrieve the human-readable name for a
492  *                      cipher info structure.
493  *
494  * \param[in] info      The cipher info structure to query.
495  *                      This may be \c NULL.
496  *
497  * \return              The cipher name, which is a human readable string,
498  *                      with static storage duration.
499  * \return              \c NULL if \c info is \p NULL.
500  */
mbedtls_cipher_info_get_name(const mbedtls_cipher_info_t * info)501 static inline const char *mbedtls_cipher_info_get_name(
502     const mbedtls_cipher_info_t *info )
503 {
504     if( info == NULL )
505         return( NULL );
506     else
507         return( info->MBEDTLS_PRIVATE(name) );
508 }
509 
510 /**
511  * \brief       This function returns the size of the IV or nonce
512  *              for the cipher info structure, in bytes.
513  *
514  * \param info  The cipher info structure. This may be \c NULL.
515  *
516  * \return      The recommended IV size.
517  * \return      \c 0 for ciphers not using an IV or a nonce.
518  * \return      \c 0 if \p info is \c NULL.
519  */
mbedtls_cipher_info_get_iv_size(const mbedtls_cipher_info_t * info)520 static inline size_t mbedtls_cipher_info_get_iv_size(
521     const mbedtls_cipher_info_t *info )
522 {
523     if( info == NULL )
524         return( 0 );
525 
526     return( (size_t) info->MBEDTLS_PRIVATE(iv_size) );
527 }
528 
529 /**
530  * \brief        This function returns the block size of the given
531  *               cipher info structure in bytes.
532  *
533  * \param info   The cipher info structure. This may be \c NULL.
534  *
535  * \return       The block size of the cipher.
536  * \return       \c 1 if the cipher is a stream cipher.
537  * \return       \c 0 if \p info is \c NULL.
538  */
mbedtls_cipher_info_get_block_size(const mbedtls_cipher_info_t * info)539 static inline size_t mbedtls_cipher_info_get_block_size(
540     const mbedtls_cipher_info_t *info )
541 {
542     if( info == NULL )
543         return( 0 );
544 
545     return( (size_t) info->MBEDTLS_PRIVATE(block_size) );
546 }
547 
548 /**
549  * \brief        This function returns a non-zero value if the key length for
550  *               the given cipher is variable.
551  *
552  * \param info   The cipher info structure. This may be \c NULL.
553  *
554  * \return       Non-zero if the key length is variable, \c 0 otherwise.
555  * \return       \c 0 if the given pointer is \c NULL.
556  */
mbedtls_cipher_info_has_variable_key_bitlen(const mbedtls_cipher_info_t * info)557 static inline int mbedtls_cipher_info_has_variable_key_bitlen(
558     const mbedtls_cipher_info_t *info )
559 {
560     if( info == NULL )
561         return( 0 );
562 
563     return( info->MBEDTLS_PRIVATE(flags) & MBEDTLS_CIPHER_VARIABLE_KEY_LEN );
564 }
565 
566 /**
567  * \brief        This function returns a non-zero value if the IV size for
568  *               the given cipher is variable.
569  *
570  * \param info   The cipher info structure. This may be \c NULL.
571  *
572  * \return       Non-zero if the IV size is variable, \c 0 otherwise.
573  * \return       \c 0 if the given pointer is \c NULL.
574  */
mbedtls_cipher_info_has_variable_iv_size(const mbedtls_cipher_info_t * info)575 static inline int mbedtls_cipher_info_has_variable_iv_size(
576     const mbedtls_cipher_info_t *info )
577 {
578     if( info == NULL )
579         return( 0 );
580 
581     return( info->MBEDTLS_PRIVATE(flags) & MBEDTLS_CIPHER_VARIABLE_IV_LEN );
582 }
583 
584 /**
585  * \brief               This function initializes a \p cipher_context as NONE.
586  *
587  * \param ctx           The context to be initialized. This must not be \c NULL.
588  */
589 void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx );
590 
591 /**
592  * \brief               This function frees and clears the cipher-specific
593  *                      context of \p ctx. Freeing \p ctx itself remains the
594  *                      responsibility of the caller.
595  *
596  * \param ctx           The context to be freed. If this is \c NULL, the
597  *                      function has no effect, otherwise this must point to an
598  *                      initialized context.
599  */
600 void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx );
601 
602 
603 /**
604  * \brief               This function prepares a cipher context for
605  *                      use with the given cipher primitive.
606  *
607  * \note                After calling this function, you should call
608  *                      mbedtls_cipher_setkey() and, if the mode uses padding,
609  *                      mbedtls_cipher_set_padding_mode(), then for each
610  *                      message to encrypt or decrypt with this key, either:
611  *                      - mbedtls_cipher_crypt() for one-shot processing with
612  *                      non-AEAD modes;
613  *                      - mbedtls_cipher_auth_encrypt_ext() or
614  *                      mbedtls_cipher_auth_decrypt_ext() for one-shot
615  *                      processing with AEAD modes or NIST_KW;
616  *                      - for multi-part processing, see the documentation of
617  *                      mbedtls_cipher_reset().
618  *
619  * \param ctx           The context to prepare. This must be initialized by
620  *                      a call to mbedtls_cipher_init() first.
621  * \param cipher_info   The cipher to use.
622  *
623  * \return              \c 0 on success.
624  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
625  *                      parameter-verification failure.
626  * \return              #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the
627  *                      cipher-specific context fails.
628  */
629 int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx,
630                           const mbedtls_cipher_info_t *cipher_info );
631 
632 #if defined(MBEDTLS_USE_PSA_CRYPTO)
633 /**
634  * \brief               This function initializes a cipher context for
635  *                      PSA-based use with the given cipher primitive.
636  *
637  * \note                See #MBEDTLS_USE_PSA_CRYPTO for information on PSA.
638  *
639  * \param ctx           The context to initialize. May not be \c NULL.
640  * \param cipher_info   The cipher to use.
641  * \param taglen        For AEAD ciphers, the length in bytes of the
642  *                      authentication tag to use. Subsequent uses of
643  *                      mbedtls_cipher_auth_encrypt_ext() or
644  *                      mbedtls_cipher_auth_decrypt_ext() must provide
645  *                      the same tag length.
646  *                      For non-AEAD ciphers, the value must be \c 0.
647  *
648  * \return              \c 0 on success.
649  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
650  *                      parameter-verification failure.
651  * \return              #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the
652  *                      cipher-specific context fails.
653  */
654 int mbedtls_cipher_setup_psa( mbedtls_cipher_context_t *ctx,
655                               const mbedtls_cipher_info_t *cipher_info,
656                               size_t taglen );
657 #endif /* MBEDTLS_USE_PSA_CRYPTO */
658 
659 /**
660  * \brief        This function returns the block size of the given cipher
661  *               in bytes.
662  *
663  * \param ctx    The context of the cipher.
664  *
665  * \return       The block size of the underlying cipher.
666  * \return       \c 1 if the cipher is a stream cipher.
667  * \return       \c 0 if \p ctx has not been initialized.
668  */
mbedtls_cipher_get_block_size(const mbedtls_cipher_context_t * ctx)669 static inline unsigned int mbedtls_cipher_get_block_size(
670     const mbedtls_cipher_context_t *ctx )
671 {
672     MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 );
673     if( ctx->MBEDTLS_PRIVATE(cipher_info) == NULL )
674         return 0;
675 
676     return ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(block_size);
677 }
678 
679 /**
680  * \brief        This function returns the mode of operation for
681  *               the cipher. For example, MBEDTLS_MODE_CBC.
682  *
683  * \param ctx    The context of the cipher. This must be initialized.
684  *
685  * \return       The mode of operation.
686  * \return       #MBEDTLS_MODE_NONE if \p ctx has not been initialized.
687  */
mbedtls_cipher_get_cipher_mode(const mbedtls_cipher_context_t * ctx)688 static inline mbedtls_cipher_mode_t mbedtls_cipher_get_cipher_mode(
689     const mbedtls_cipher_context_t *ctx )
690 {
691     MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, MBEDTLS_MODE_NONE );
692     if( ctx->MBEDTLS_PRIVATE(cipher_info) == NULL )
693         return MBEDTLS_MODE_NONE;
694 
695     return ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(mode);
696 }
697 
698 /**
699  * \brief       This function returns the size of the IV or nonce
700  *              of the cipher, in Bytes.
701  *
702  * \param ctx   The context of the cipher. This must be initialized.
703  *
704  * \return      The recommended IV size if no IV has been set.
705  * \return      \c 0 for ciphers not using an IV or a nonce.
706  * \return      The actual size if an IV has been set.
707  */
mbedtls_cipher_get_iv_size(const mbedtls_cipher_context_t * ctx)708 static inline int mbedtls_cipher_get_iv_size(
709     const mbedtls_cipher_context_t *ctx )
710 {
711     MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 );
712     if( ctx->MBEDTLS_PRIVATE(cipher_info) == NULL )
713         return 0;
714 
715     if( ctx->MBEDTLS_PRIVATE(iv_size) != 0 )
716         return (int) ctx->MBEDTLS_PRIVATE(iv_size);
717 
718     return (int) ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(iv_size);
719 }
720 
721 /**
722  * \brief               This function returns the type of the given cipher.
723  *
724  * \param ctx           The context of the cipher. This must be initialized.
725  *
726  * \return              The type of the cipher.
727  * \return              #MBEDTLS_CIPHER_NONE if \p ctx has not been initialized.
728  */
mbedtls_cipher_get_type(const mbedtls_cipher_context_t * ctx)729 static inline mbedtls_cipher_type_t mbedtls_cipher_get_type(
730     const mbedtls_cipher_context_t *ctx )
731 {
732     MBEDTLS_INTERNAL_VALIDATE_RET(
733         ctx != NULL, MBEDTLS_CIPHER_NONE );
734     if( ctx->MBEDTLS_PRIVATE(cipher_info) == NULL )
735         return MBEDTLS_CIPHER_NONE;
736 
737     return ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(type);
738 }
739 
740 /**
741  * \brief               This function returns the name of the given cipher
742  *                      as a string.
743  *
744  * \param ctx           The context of the cipher. This must be initialized.
745  *
746  * \return              The name of the cipher.
747  * \return              NULL if \p ctx has not been not initialized.
748  */
mbedtls_cipher_get_name(const mbedtls_cipher_context_t * ctx)749 static inline const char *mbedtls_cipher_get_name(
750     const mbedtls_cipher_context_t *ctx )
751 {
752     MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 );
753     if( ctx->MBEDTLS_PRIVATE(cipher_info) == NULL )
754         return 0;
755 
756     return ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(name);
757 }
758 
759 /**
760  * \brief               This function returns the key length of the cipher.
761  *
762  * \param ctx           The context of the cipher. This must be initialized.
763  *
764  * \return              The key length of the cipher in bits.
765  * \return              #MBEDTLS_KEY_LENGTH_NONE if ctx \p has not been
766  *                      initialized.
767  */
mbedtls_cipher_get_key_bitlen(const mbedtls_cipher_context_t * ctx)768 static inline int mbedtls_cipher_get_key_bitlen(
769     const mbedtls_cipher_context_t *ctx )
770 {
771     MBEDTLS_INTERNAL_VALIDATE_RET(
772         ctx != NULL, MBEDTLS_KEY_LENGTH_NONE );
773     if( ctx->MBEDTLS_PRIVATE(cipher_info) == NULL )
774         return MBEDTLS_KEY_LENGTH_NONE;
775 
776     return (int) ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(key_bitlen);
777 }
778 
779 /**
780  * \brief          This function returns the operation of the given cipher.
781  *
782  * \param ctx      The context of the cipher. This must be initialized.
783  *
784  * \return         The type of operation: #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT.
785  * \return         #MBEDTLS_OPERATION_NONE if \p ctx has not been initialized.
786  */
mbedtls_cipher_get_operation(const mbedtls_cipher_context_t * ctx)787 static inline mbedtls_operation_t mbedtls_cipher_get_operation(
788     const mbedtls_cipher_context_t *ctx )
789 {
790     MBEDTLS_INTERNAL_VALIDATE_RET(
791         ctx != NULL, MBEDTLS_OPERATION_NONE );
792     if( ctx->MBEDTLS_PRIVATE(cipher_info) == NULL )
793         return MBEDTLS_OPERATION_NONE;
794 
795     return ctx->MBEDTLS_PRIVATE(operation);
796 }
797 
798 /**
799  * \brief               This function sets the key to use with the given context.
800  *
801  * \param ctx           The generic cipher context. This must be initialized and
802  *                      bound to a cipher information structure.
803  * \param key           The key to use. This must be a readable buffer of at
804  *                      least \p key_bitlen Bits.
805  * \param key_bitlen    The key length to use, in Bits.
806  * \param operation     The operation that the key will be used for:
807  *                      #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT.
808  *
809  * \return              \c 0 on success.
810  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
811  *                      parameter-verification failure.
812  * \return              A cipher-specific error code on failure.
813  */
814 int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx,
815                            const unsigned char *key,
816                            int key_bitlen,
817                            const mbedtls_operation_t operation );
818 
819 #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
820 /**
821  * \brief               This function sets the padding mode, for cipher modes
822  *                      that use padding.
823  *
824  *                      The default passing mode is PKCS7 padding.
825  *
826  * \param ctx           The generic cipher context. This must be initialized and
827  *                      bound to a cipher information structure.
828  * \param mode          The padding mode.
829  *
830  * \return              \c 0 on success.
831  * \return              #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE
832  *                      if the selected padding mode is not supported.
833  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA if the cipher mode
834  *                      does not support padding.
835  */
836 int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx,
837                                      mbedtls_cipher_padding_t mode );
838 #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
839 
840 /**
841  * \brief           This function sets the initialization vector (IV)
842  *                  or nonce.
843  *
844  * \note            Some ciphers do not use IVs nor nonce. For these
845  *                  ciphers, this function has no effect.
846  *
847  * \param ctx       The generic cipher context. This must be initialized and
848  *                  bound to a cipher information structure.
849  * \param iv        The IV to use, or NONCE_COUNTER for CTR-mode ciphers. This
850  *                  must be a readable buffer of at least \p iv_len Bytes.
851  * \param iv_len    The IV length for ciphers with variable-size IV.
852  *                  This parameter is discarded by ciphers with fixed-size IV.
853  *
854  * \return          \c 0 on success.
855  * \return          #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
856  *                  parameter-verification failure.
857  */
858 int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
859                            const unsigned char *iv,
860                            size_t iv_len );
861 
862 /**
863  * \brief         This function resets the cipher state.
864  *
865  * \note          With non-AEAD ciphers, the order of calls for each message
866  *                is as follows:
867  *                1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce.
868  *                2. mbedtls_cipher_reset()
869  *                3. mbedtls_cipher_update() one or more times
870  *                4. mbedtls_cipher_finish()
871  *                .
872  *                This sequence can be repeated to encrypt or decrypt multiple
873  *                messages with the same key.
874  *
875  * \note          With AEAD ciphers, the order of calls for each message
876  *                is as follows:
877  *                1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce.
878  *                2. mbedtls_cipher_reset()
879  *                3. mbedtls_cipher_update_ad()
880  *                4. mbedtls_cipher_update() one or more times
881  *                5. mbedtls_cipher_finish()
882  *                6. mbedtls_cipher_check_tag() (for decryption) or
883  *                mbedtls_cipher_write_tag() (for encryption).
884  *                .
885  *                This sequence can be repeated to encrypt or decrypt multiple
886  *                messages with the same key.
887  *
888  * \param ctx     The generic cipher context. This must be bound to a key.
889  *
890  * \return        \c 0 on success.
891  * \return        #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
892  *                parameter-verification failure.
893  */
894 int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx );
895 
896 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
897 /**
898  * \brief               This function adds additional data for AEAD ciphers.
899  *                      Currently supported with GCM and ChaCha20+Poly1305.
900  *
901  * \param ctx           The generic cipher context. This must be initialized.
902  * \param ad            The additional data to use. This must be a readable
903  *                      buffer of at least \p ad_len Bytes.
904  * \param ad_len        The length of \p ad in Bytes.
905  *
906  * \return              \c 0 on success.
907  * \return              A specific error code on failure.
908  */
909 int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
910                       const unsigned char *ad, size_t ad_len );
911 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
912 
913 /**
914  * \brief               The generic cipher update function. It encrypts or
915  *                      decrypts using the given cipher context. Writes as
916  *                      many block-sized blocks of data as possible to output.
917  *                      Any data that cannot be written immediately is either
918  *                      added to the next block, or flushed when
919  *                      mbedtls_cipher_finish() is called.
920  *                      Exception: For MBEDTLS_MODE_ECB, expects a single block
921  *                      in size. For example, 16 Bytes for AES.
922  *
923  * \param ctx           The generic cipher context. This must be initialized and
924  *                      bound to a key.
925  * \param input         The buffer holding the input data. This must be a
926  *                      readable buffer of at least \p ilen Bytes.
927  * \param ilen          The length of the input data.
928  * \param output        The buffer for the output data. This must be able to
929  *                      hold at least `ilen + block_size`. This must not be the
930  *                      same buffer as \p input.
931  * \param olen          The length of the output data, to be updated with the
932  *                      actual number of Bytes written. This must not be
933  *                      \c NULL.
934  *
935  * \return              \c 0 on success.
936  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
937  *                      parameter-verification failure.
938  * \return              #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE on an
939  *                      unsupported mode for a cipher.
940  * \return              A cipher-specific error code on failure.
941  */
942 int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx,
943                            const unsigned char *input,
944                            size_t ilen, unsigned char *output,
945                            size_t *olen );
946 
947 /**
948  * \brief               The generic cipher finalization function. If data still
949  *                      needs to be flushed from an incomplete block, the data
950  *                      contained in it is padded to the size of
951  *                      the last block, and written to the \p output buffer.
952  *
953  * \param ctx           The generic cipher context. This must be initialized and
954  *                      bound to a key.
955  * \param output        The buffer to write data to. This needs to be a writable
956  *                      buffer of at least \p block_size Bytes.
957  * \param olen          The length of the data written to the \p output buffer.
958  *                      This may not be \c NULL.
959  *
960  * \return              \c 0 on success.
961  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
962  *                      parameter-verification failure.
963  * \return              #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption
964  *                      expecting a full block but not receiving one.
965  * \return              #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding
966  *                      while decrypting.
967  * \return              A cipher-specific error code on failure.
968  */
969 int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
970                    unsigned char *output, size_t *olen );
971 
972 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
973 /**
974  * \brief               This function writes a tag for AEAD ciphers.
975  *                      Currently supported with GCM and ChaCha20+Poly1305.
976  *                      This must be called after mbedtls_cipher_finish().
977  *
978  * \param ctx           The generic cipher context. This must be initialized,
979  *                      bound to a key, and have just completed a cipher
980  *                      operation through mbedtls_cipher_finish() the tag for
981  *                      which should be written.
982  * \param tag           The buffer to write the tag to. This must be a writable
983  *                      buffer of at least \p tag_len Bytes.
984  * \param tag_len       The length of the tag to write.
985  *
986  * \return              \c 0 on success.
987  * \return              A specific error code on failure.
988  */
989 int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
990                       unsigned char *tag, size_t tag_len );
991 
992 /**
993  * \brief               This function checks the tag for AEAD ciphers.
994  *                      Currently supported with GCM and ChaCha20+Poly1305.
995  *                      This must be called after mbedtls_cipher_finish().
996  *
997  * \param ctx           The generic cipher context. This must be initialized.
998  * \param tag           The buffer holding the tag. This must be a readable
999  *                      buffer of at least \p tag_len Bytes.
1000  * \param tag_len       The length of the tag to check.
1001  *
1002  * \return              \c 0 on success.
1003  * \return              A specific error code on failure.
1004  */
1005 int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
1006                       const unsigned char *tag, size_t tag_len );
1007 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
1008 
1009 /**
1010  * \brief               The generic all-in-one encryption/decryption function,
1011  *                      for all ciphers except AEAD constructs.
1012  *
1013  * \param ctx           The generic cipher context. This must be initialized.
1014  * \param iv            The IV to use, or NONCE_COUNTER for CTR-mode ciphers.
1015  *                      This must be a readable buffer of at least \p iv_len
1016  *                      Bytes.
1017  * \param iv_len        The IV length for ciphers with variable-size IV.
1018  *                      This parameter is discarded by ciphers with fixed-size
1019  *                      IV.
1020  * \param input         The buffer holding the input data. This must be a
1021  *                      readable buffer of at least \p ilen Bytes.
1022  * \param ilen          The length of the input data in Bytes.
1023  * \param output        The buffer for the output data. This must be able to
1024  *                      hold at least `ilen + block_size`. This must not be the
1025  *                      same buffer as \p input.
1026  * \param olen          The length of the output data, to be updated with the
1027  *                      actual number of Bytes written. This must not be
1028  *                      \c NULL.
1029  *
1030  * \note                Some ciphers do not use IVs nor nonce. For these
1031  *                      ciphers, use \p iv = NULL and \p iv_len = 0.
1032  *
1033  * \return              \c 0 on success.
1034  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
1035  *                      parameter-verification failure.
1036  * \return              #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption
1037  *                      expecting a full block but not receiving one.
1038  * \return              #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding
1039  *                      while decrypting.
1040  * \return              A cipher-specific error code on failure.
1041  */
1042 int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx,
1043                   const unsigned char *iv, size_t iv_len,
1044                   const unsigned char *input, size_t ilen,
1045                   unsigned char *output, size_t *olen );
1046 
1047 #if defined(MBEDTLS_CIPHER_MODE_AEAD) || defined(MBEDTLS_NIST_KW_C)
1048 /**
1049  * \brief               The authenticated encryption (AEAD/NIST_KW) function.
1050  *
1051  * \note                For AEAD modes, the tag will be appended to the
1052  *                      ciphertext, as recommended by RFC 5116.
1053  *                      (NIST_KW doesn't have a separate tag.)
1054  *
1055  * \param ctx           The generic cipher context. This must be initialized and
1056  *                      bound to a key, with an AEAD algorithm or NIST_KW.
1057  * \param iv            The nonce to use. This must be a readable buffer of
1058  *                      at least \p iv_len Bytes and may be \c NULL if \p
1059  *                      iv_len is \c 0.
1060  * \param iv_len        The length of the nonce. For AEAD ciphers, this must
1061  *                      satisfy the constraints imposed by the cipher used.
1062  *                      For NIST_KW, this must be \c 0.
1063  * \param ad            The additional data to authenticate. This must be a
1064  *                      readable buffer of at least \p ad_len Bytes, and may
1065  *                      be \c NULL is \p ad_len is \c 0.
1066  * \param ad_len        The length of \p ad. For NIST_KW, this must be \c 0.
1067  * \param input         The buffer holding the input data. This must be a
1068  *                      readable buffer of at least \p ilen Bytes, and may be
1069  *                      \c NULL if \p ilen is \c 0.
1070  * \param ilen          The length of the input data.
1071  * \param output        The buffer for the output data. This must be a
1072  *                      writable buffer of at least \p output_len Bytes, and
1073  *                      must not be \c NULL.
1074  * \param output_len    The length of the \p output buffer in Bytes. For AEAD
1075  *                      ciphers, this must be at least \p ilen + \p tag_len.
1076  *                      For NIST_KW, this must be at least \p ilen + 8
1077  *                      (rounded up to a multiple of 8 if KWP is used);
1078  *                      \p ilen + 15 is always a safe value.
1079  * \param olen          This will be filled with the actual number of Bytes
1080  *                      written to the \p output buffer. This must point to a
1081  *                      writable object of type \c size_t.
1082  * \param tag_len       The desired length of the authentication tag. For AEAD
1083  *                      ciphers, this must match the constraints imposed by
1084  *                      the cipher used, and in particular must not be \c 0.
1085  *                      For NIST_KW, this must be \c 0.
1086  *
1087  * \return              \c 0 on success.
1088  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
1089  *                      parameter-verification failure.
1090  * \return              A cipher-specific error code on failure.
1091  */
1092 int mbedtls_cipher_auth_encrypt_ext( mbedtls_cipher_context_t *ctx,
1093                          const unsigned char *iv, size_t iv_len,
1094                          const unsigned char *ad, size_t ad_len,
1095                          const unsigned char *input, size_t ilen,
1096                          unsigned char *output, size_t output_len,
1097                          size_t *olen, size_t tag_len );
1098 
1099 /**
1100  * \brief               The authenticated encryption (AEAD/NIST_KW) function.
1101  *
1102  * \note                If the data is not authentic, then the output buffer
1103  *                      is zeroed out to prevent the unauthentic plaintext being
1104  *                      used, making this interface safer.
1105  *
1106  * \note                For AEAD modes, the tag must be appended to the
1107  *                      ciphertext, as recommended by RFC 5116.
1108  *                      (NIST_KW doesn't have a separate tag.)
1109  *
1110  * \param ctx           The generic cipher context. This must be initialized and
1111  *                      bound to a key, with an AEAD algorithm or NIST_KW.
1112  * \param iv            The nonce to use. This must be a readable buffer of
1113  *                      at least \p iv_len Bytes and may be \c NULL if \p
1114  *                      iv_len is \c 0.
1115  * \param iv_len        The length of the nonce. For AEAD ciphers, this must
1116  *                      satisfy the constraints imposed by the cipher used.
1117  *                      For NIST_KW, this must be \c 0.
1118  * \param ad            The additional data to authenticate. This must be a
1119  *                      readable buffer of at least \p ad_len Bytes, and may
1120  *                      be \c NULL is \p ad_len is \c 0.
1121  * \param ad_len        The length of \p ad. For NIST_KW, this must be \c 0.
1122  * \param input         The buffer holding the input data. This must be a
1123  *                      readable buffer of at least \p ilen Bytes, and may be
1124  *                      \c NULL if \p ilen is \c 0.
1125  * \param ilen          The length of the input data. For AEAD ciphers this
1126  *                      must be at least \p tag_len. For NIST_KW this must be
1127  *                      at least \c 8.
1128  * \param output        The buffer for the output data. This must be a
1129  *                      writable buffer of at least \p output_len Bytes, and
1130  *                      may be \c NULL if \p output_len is \c 0.
1131  * \param output_len    The length of the \p output buffer in Bytes. For AEAD
1132  *                      ciphers, this must be at least \p ilen - \p tag_len.
1133  *                      For NIST_KW, this must be at least \p ilen - 8.
1134  * \param olen          This will be filled with the actual number of Bytes
1135  *                      written to the \p output buffer. This must point to a
1136  *                      writable object of type \c size_t.
1137  * \param tag_len       The actual length of the authentication tag. For AEAD
1138  *                      ciphers, this must match the constraints imposed by
1139  *                      the cipher used, and in particular must not be \c 0.
1140  *                      For NIST_KW, this must be \c 0.
1141  *
1142  * \return              \c 0 on success.
1143  * \return              #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on
1144  *                      parameter-verification failure.
1145  * \return              #MBEDTLS_ERR_CIPHER_AUTH_FAILED if data is not authentic.
1146  * \return              A cipher-specific error code on failure.
1147  */
1148 int mbedtls_cipher_auth_decrypt_ext( mbedtls_cipher_context_t *ctx,
1149                          const unsigned char *iv, size_t iv_len,
1150                          const unsigned char *ad, size_t ad_len,
1151                          const unsigned char *input, size_t ilen,
1152                          unsigned char *output, size_t output_len,
1153                          size_t *olen, size_t tag_len );
1154 #endif /* MBEDTLS_CIPHER_MODE_AEAD || MBEDTLS_NIST_KW_C */
1155 #ifdef __cplusplus
1156 }
1157 #endif
1158 
1159 #endif /* MBEDTLS_CIPHER_H */
1160