1 /*
2 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* Dispatch functions for ccm mode */
11
12 #include <openssl/proverr.h>
13 #include "prov/ciphercommon.h"
14 #include "prov/ciphercommon_ccm.h"
15 #include "prov/providercommon.h"
16
17 static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
18 size_t *padlen, const unsigned char *in,
19 size_t len);
20
ccm_tls_init(PROV_CCM_CTX * ctx,unsigned char * aad,size_t alen)21 static int ccm_tls_init(PROV_CCM_CTX *ctx, unsigned char *aad, size_t alen)
22 {
23 size_t len;
24
25 if (!ossl_prov_is_running() || alen != EVP_AEAD_TLS1_AAD_LEN)
26 return 0;
27
28 /* Save the aad for later use. */
29 memcpy(ctx->buf, aad, alen);
30 ctx->tls_aad_len = alen;
31
32 len = ctx->buf[alen - 2] << 8 | ctx->buf[alen - 1];
33 if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
34 return 0;
35
36 /* Correct length for explicit iv. */
37 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
38
39 if (!ctx->enc) {
40 if (len < ctx->m)
41 return 0;
42 /* Correct length for tag. */
43 len -= ctx->m;
44 }
45 ctx->buf[alen - 2] = (unsigned char)(len >> 8);
46 ctx->buf[alen - 1] = (unsigned char)(len & 0xff);
47
48 /* Extra padding: tag appended to record. */
49 return ctx->m;
50 }
51
ccm_tls_iv_set_fixed(PROV_CCM_CTX * ctx,unsigned char * fixed,size_t flen)52 static int ccm_tls_iv_set_fixed(PROV_CCM_CTX *ctx, unsigned char *fixed,
53 size_t flen)
54 {
55 if (flen != EVP_CCM_TLS_FIXED_IV_LEN)
56 return 0;
57
58 /* Copy to first part of the iv. */
59 memcpy(ctx->iv, fixed, flen);
60 return 1;
61 }
62
ccm_get_ivlen(PROV_CCM_CTX * ctx)63 static size_t ccm_get_ivlen(PROV_CCM_CTX *ctx)
64 {
65 return 15 - ctx->l;
66 }
67
ossl_ccm_set_ctx_params(void * vctx,const OSSL_PARAM params[])68 int ossl_ccm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
69 {
70 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
71 const OSSL_PARAM *p;
72 size_t sz;
73
74 if (params == NULL)
75 return 1;
76
77 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG);
78 if (p != NULL) {
79 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
80 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
81 return 0;
82 }
83 if ((p->data_size & 1) || (p->data_size < 4) || p->data_size > 16) {
84 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH);
85 return 0;
86 }
87
88 if (p->data != NULL) {
89 if (ctx->enc) {
90 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_NEEDED);
91 return 0;
92 }
93 memcpy(ctx->buf, p->data, p->data_size);
94 ctx->tag_set = 1;
95 }
96 ctx->m = p->data_size;
97 }
98
99 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN);
100 if (p != NULL) {
101 size_t ivlen;
102
103 if (!OSSL_PARAM_get_size_t(p, &sz)) {
104 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
105 return 0;
106 }
107 ivlen = 15 - sz;
108 if (ivlen < 2 || ivlen > 8) {
109 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
110 return 0;
111 }
112 ctx->l = ivlen;
113 }
114
115 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
116 if (p != NULL) {
117 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
118 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
119 return 0;
120 }
121 sz = ccm_tls_init(ctx, p->data, p->data_size);
122 if (sz == 0) {
123 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA);
124 return 0;
125 }
126 ctx->tls_aad_pad_sz = sz;
127 }
128
129 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED);
130 if (p != NULL) {
131 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
132 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
133 return 0;
134 }
135 if (ccm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
136 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
137 return 0;
138 }
139 }
140
141 return 1;
142 }
143
ossl_ccm_get_ctx_params(void * vctx,OSSL_PARAM params[])144 int ossl_ccm_get_ctx_params(void *vctx, OSSL_PARAM params[])
145 {
146 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
147 OSSL_PARAM *p;
148
149 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN);
150 if (p != NULL && !OSSL_PARAM_set_size_t(p, ccm_get_ivlen(ctx))) {
151 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
152 return 0;
153 }
154
155 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN);
156 if (p != NULL) {
157 size_t m = ctx->m;
158
159 if (!OSSL_PARAM_set_size_t(p, m)) {
160 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
161 return 0;
162 }
163 }
164
165 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV);
166 if (p != NULL) {
167 if (ccm_get_ivlen(ctx) > p->data_size) {
168 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
169 return 0;
170 }
171 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)
172 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) {
173 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
174 return 0;
175 }
176 }
177
178 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_UPDATED_IV);
179 if (p != NULL) {
180 if (ccm_get_ivlen(ctx) > p->data_size) {
181 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
182 return 0;
183 }
184 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)
185 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) {
186 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
187 return 0;
188 }
189 }
190
191 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN);
192 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) {
193 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
194 return 0;
195 }
196
197 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD);
198 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
199 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
200 return 0;
201 }
202
203 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG);
204 if (p != NULL) {
205 if (!ctx->enc || !ctx->tag_set) {
206 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_SET);
207 return 0;
208 }
209 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
210 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
211 return 0;
212 }
213 if (!ctx->hw->gettag(ctx, p->data, p->data_size))
214 return 0;
215 ctx->tag_set = 0;
216 ctx->iv_set = 0;
217 ctx->len_set = 0;
218 }
219 return 1;
220 }
221
ccm_init(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[],int enc)222 static int ccm_init(void *vctx, const unsigned char *key, size_t keylen,
223 const unsigned char *iv, size_t ivlen,
224 const OSSL_PARAM params[], int enc)
225 {
226 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
227
228 if (!ossl_prov_is_running())
229 return 0;
230
231 ctx->enc = enc;
232
233 if (iv != NULL) {
234 if (ivlen != ccm_get_ivlen(ctx)) {
235 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
236 return 0;
237 }
238 memcpy(ctx->iv, iv, ivlen);
239 ctx->iv_set = 1;
240 }
241 if (key != NULL) {
242 if (keylen != ctx->keylen) {
243 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
244 return 0;
245 }
246 if (!ctx->hw->setkey(ctx, key, keylen))
247 return 0;
248 }
249 return ossl_ccm_set_ctx_params(ctx, params);
250 }
251
ossl_ccm_einit(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[])252 int ossl_ccm_einit(void *vctx, const unsigned char *key, size_t keylen,
253 const unsigned char *iv, size_t ivlen,
254 const OSSL_PARAM params[])
255 {
256 return ccm_init(vctx, key, keylen, iv, ivlen, params, 1);
257 }
258
ossl_ccm_dinit(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[])259 int ossl_ccm_dinit(void *vctx, const unsigned char *key, size_t keylen,
260 const unsigned char *iv, size_t ivlen,
261 const OSSL_PARAM params[])
262 {
263 return ccm_init(vctx, key, keylen, iv, ivlen, params, 0);
264 }
265
ossl_ccm_stream_update(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)266 int ossl_ccm_stream_update(void *vctx, unsigned char *out, size_t *outl,
267 size_t outsize, const unsigned char *in,
268 size_t inl)
269 {
270 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
271
272 if (outsize < inl) {
273 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
274 return 0;
275 }
276
277 if (!ccm_cipher_internal(ctx, out, outl, in, inl)) {
278 ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
279 return 0;
280 }
281 return 1;
282 }
283
ossl_ccm_stream_final(void * vctx,unsigned char * out,size_t * outl,size_t outsize)284 int ossl_ccm_stream_final(void *vctx, unsigned char *out, size_t *outl,
285 size_t outsize)
286 {
287 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
288 int i;
289
290 if (!ossl_prov_is_running())
291 return 0;
292
293 i = ccm_cipher_internal(ctx, out, outl, NULL, 0);
294 if (i <= 0)
295 return 0;
296
297 *outl = 0;
298 return 1;
299 }
300
ossl_ccm_cipher(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)301 int ossl_ccm_cipher(void *vctx, unsigned char *out, size_t *outl, size_t outsize,
302 const unsigned char *in, size_t inl)
303 {
304 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
305
306 if (!ossl_prov_is_running())
307 return 0;
308
309 if (outsize < inl) {
310 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
311 return 0;
312 }
313
314 if (ccm_cipher_internal(ctx, out, outl, in, inl) <= 0)
315 return 0;
316
317 *outl = inl;
318 return 1;
319 }
320
321 /* Copy the buffered iv */
ccm_set_iv(PROV_CCM_CTX * ctx,size_t mlen)322 static int ccm_set_iv(PROV_CCM_CTX *ctx, size_t mlen)
323 {
324 const PROV_CCM_HW *hw = ctx->hw;
325
326 if (!hw->setiv(ctx, ctx->iv, ccm_get_ivlen(ctx), mlen))
327 return 0;
328 ctx->len_set = 1;
329 return 1;
330 }
331
ccm_tls_cipher(PROV_CCM_CTX * ctx,unsigned char * out,size_t * padlen,const unsigned char * in,size_t len)332 static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
333 unsigned char *out, size_t *padlen,
334 const unsigned char *in, size_t len)
335 {
336 int rv = 0;
337 size_t olen = 0;
338
339 if (!ossl_prov_is_running())
340 goto err;
341
342 /* Encrypt/decrypt must be performed in place */
343 if (in == NULL || out != in || len < EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m)
344 goto err;
345
346 /* If encrypting set explicit IV from sequence number (start of AAD) */
347 if (ctx->enc)
348 memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
349 /* Get rest of IV from explicit IV */
350 memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
351 /* Correct length value */
352 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
353 if (!ccm_set_iv(ctx, len))
354 goto err;
355
356 /* Use saved AAD */
357 if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))
358 goto err;
359
360 /* Fix buffer to point to payload */
361 in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
362 out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
363 if (ctx->enc) {
364 if (!ctx->hw->auth_encrypt(ctx, in, out, len, out + len, ctx->m))
365 goto err;
366 olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
367 } else {
368 if (!ctx->hw->auth_decrypt(ctx, in, out, len,
369 (unsigned char *)in + len, ctx->m))
370 goto err;
371 olen = len;
372 }
373 rv = 1;
374 err:
375 *padlen = olen;
376 return rv;
377 }
378
ccm_cipher_internal(PROV_CCM_CTX * ctx,unsigned char * out,size_t * padlen,const unsigned char * in,size_t len)379 static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
380 size_t *padlen, const unsigned char *in,
381 size_t len)
382 {
383 int rv = 0;
384 size_t olen = 0;
385 const PROV_CCM_HW *hw = ctx->hw;
386
387 /* If no key set, return error */
388 if (!ctx->key_set)
389 return 0;
390
391 if (ctx->tls_aad_len != UNINITIALISED_SIZET)
392 return ccm_tls_cipher(ctx, out, padlen, in, len);
393
394 /* EVP_*Final() doesn't return any data */
395 if (in == NULL && out != NULL)
396 goto finish;
397
398 if (!ctx->iv_set)
399 goto err;
400
401 if (out == NULL) {
402 if (in == NULL) {
403 if (!ccm_set_iv(ctx, len))
404 goto err;
405 } else {
406 /* If we have AAD, we need a message length */
407 if (!ctx->len_set && len)
408 goto err;
409 if (!hw->setaad(ctx, in, len))
410 goto err;
411 }
412 } else {
413 /* If not set length yet do it */
414 if (!ctx->len_set && !ccm_set_iv(ctx, len))
415 goto err;
416
417 if (ctx->enc) {
418 if (!hw->auth_encrypt(ctx, in, out, len, NULL, 0))
419 goto err;
420 ctx->tag_set = 1;
421 } else {
422 /* The tag must be set before actually decrypting data */
423 if (!ctx->tag_set)
424 goto err;
425
426 if (!hw->auth_decrypt(ctx, in, out, len, ctx->buf, ctx->m))
427 goto err;
428 /* Finished - reset flags so calling this method again will fail */
429 ctx->iv_set = 0;
430 ctx->tag_set = 0;
431 ctx->len_set = 0;
432 }
433 }
434 olen = len;
435 finish:
436 rv = 1;
437 err:
438 *padlen = olen;
439 return rv;
440 }
441
ossl_ccm_initctx(PROV_CCM_CTX * ctx,size_t keybits,const PROV_CCM_HW * hw)442 void ossl_ccm_initctx(PROV_CCM_CTX *ctx, size_t keybits, const PROV_CCM_HW *hw)
443 {
444 ctx->keylen = keybits / 8;
445 ctx->key_set = 0;
446 ctx->iv_set = 0;
447 ctx->tag_set = 0;
448 ctx->len_set = 0;
449 ctx->l = 8;
450 ctx->m = 12;
451 ctx->tls_aad_len = UNINITIALISED_SIZET;
452 ctx->hw = hw;
453 }
454