1 /*
2 * Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <string.h>
13 #include <openssl/core_names.h>
14 #include <openssl/evp.h>
15 #include <openssl/params.h>
16 #include <openssl/err.h>
17
18 /*
19 * This is a demonstration of how to compute Poly1305-AES using the OpenSSL
20 * Poly1305 and AES providers and the EVP API.
21 *
22 * Please note that:
23 *
24 * - Poly1305 must never be used alone and must be used in conjunction with
25 * another primitive which processes the input nonce to be secure;
26 *
27 * - you must never pass a nonce to the Poly1305 primitive directly;
28 *
29 * - Poly1305 exhibits catastrophic failure (that is, can be broken) if a
30 * nonce is ever reused for a given key.
31 *
32 * If you are looking for a general purpose MAC, you should consider using a
33 * different MAC and looking at one of the other examples, unless you have a
34 * good familiarity with the details and caveats of Poly1305.
35 *
36 * This example uses AES, as described in the original paper, "The Poly1305-AES
37 * message authentication code":
38 * https://cr.yp.to/mac/poly1305-20050329.pdf
39 *
40 * The test vectors below are from that paper.
41 */
42
43 /*
44 * Hard coding the key into an application is very bad.
45 * It is done here solely for educational purposes.
46 * These are the "r" and "k" inputs to Poly1305-AES.
47 */
48 static const unsigned char test_r[] = {
49 0x85, 0x1f, 0xc4, 0x0c, 0x34, 0x67, 0xac, 0x0b,
50 0xe0, 0x5c, 0xc2, 0x04, 0x04, 0xf3, 0xf7, 0x00
51 };
52
53 static const unsigned char test_k[] = {
54 0xec, 0x07, 0x4c, 0x83, 0x55, 0x80, 0x74, 0x17,
55 0x01, 0x42, 0x5b, 0x62, 0x32, 0x35, 0xad, 0xd6
56 };
57
58 /*
59 * Hard coding a nonce must not be done under any circumstances and is done here
60 * purely for demonstration purposes. Please note that Poly1305 exhibits
61 * catastrophic failure (that is, can be broken) if a nonce is ever reused for a
62 * given key.
63 */
64 static const unsigned char test_n[] = {
65 0xfb, 0x44, 0x73, 0x50, 0xc4, 0xe8, 0x68, 0xc5,
66 0x2a, 0xc3, 0x27, 0x5c, 0xf9, 0xd4, 0x32, 0x7e
67 };
68
69 /* Input message. */
70 static const unsigned char test_m[] = {
71 0xf3, 0xf6
72 };
73
74 static const unsigned char expected_output[] = {
75 0xf4, 0xc6, 0x33, 0xc3, 0x04, 0x4f, 0xc1, 0x45,
76 0xf8, 0x4f, 0x33, 0x5c, 0xb8, 0x19, 0x53, 0xde
77 };
78
79 /*
80 * A property query used for selecting the POLY1305 implementation.
81 */
82 static char *propq = NULL;
83
main(int argc,char ** argv)84 int main(int argc, char **argv)
85 {
86 int rv = EXIT_FAILURE;
87 EVP_CIPHER *aes = NULL;
88 EVP_CIPHER_CTX *aesctx = NULL;
89 EVP_MAC *mac = NULL;
90 EVP_MAC_CTX *mctx = NULL;
91 unsigned char composite_key[32];
92 unsigned char out[16];
93 OSSL_LIB_CTX *library_context = NULL;
94 size_t out_len = 0;
95 int aes_len = 0;
96
97 library_context = OSSL_LIB_CTX_new();
98 if (library_context == NULL) {
99 fprintf(stderr, "OSSL_LIB_CTX_new() returned NULL\n");
100 goto end;
101 }
102
103 /* Fetch the Poly1305 implementation */
104 mac = EVP_MAC_fetch(library_context, "POLY1305", propq);
105 if (mac == NULL) {
106 fprintf(stderr, "EVP_MAC_fetch() returned NULL\n");
107 goto end;
108 }
109
110 /* Create a context for the Poly1305 operation */
111 mctx = EVP_MAC_CTX_new(mac);
112 if (mctx == NULL) {
113 fprintf(stderr, "EVP_MAC_CTX_new() returned NULL\n");
114 goto end;
115 }
116
117 /* Fetch the AES implementation */
118 aes = EVP_CIPHER_fetch(library_context, "AES-128-ECB", propq);
119 if (aes == NULL) {
120 fprintf(stderr, "EVP_CIPHER_fetch() returned NULL\n");
121 goto end;
122 }
123
124 /* Create a context for AES */
125 aesctx = EVP_CIPHER_CTX_new();
126 if (aesctx == NULL) {
127 fprintf(stderr, "EVP_CIPHER_CTX_new() returned NULL\n");
128 goto end;
129 }
130
131 /* Initialize the AES cipher with the 128-bit key k */
132 if (!EVP_EncryptInit_ex(aesctx, aes, NULL, test_k, NULL)) {
133 fprintf(stderr, "EVP_EncryptInit_ex() failed\n");
134 goto end;
135 }
136
137 /*
138 * Disable padding for the AES cipher. We do not strictly need to do this as
139 * we are encrypting a single block and thus there are no alignment or
140 * padding concerns, but this ensures that the operation below fails if
141 * padding would be required for some reason, which in this circumstance
142 * would indicate an implementation bug.
143 */
144 if (!EVP_CIPHER_CTX_set_padding(aesctx, 0)) {
145 fprintf(stderr, "EVP_CIPHER_CTX_set_padding() failed\n");
146 goto end;
147 }
148
149 /*
150 * Computes the value AES_k(n) which we need for our Poly1305-AES
151 * computation below.
152 */
153 if (!EVP_EncryptUpdate(aesctx, composite_key + 16, &aes_len,
154 test_n, sizeof(test_n))) {
155 fprintf(stderr, "EVP_EncryptUpdate() failed\n");
156 goto end;
157 }
158
159 /*
160 * The Poly1305 provider expects the key r to be passed as the first 16
161 * bytes of the "key" and the processed nonce (that is, AES_k(n)) to be
162 * passed as the second 16 bytes of the "key". We already put the processed
163 * nonce in the correct place above, so copy r into place.
164 */
165 memcpy(composite_key, test_r, 16);
166
167 /* Initialise the Poly1305 operation */
168 if (!EVP_MAC_init(mctx, composite_key, sizeof(composite_key), NULL)) {
169 fprintf(stderr, "EVP_MAC_init() failed\n");
170 goto end;
171 }
172
173 /* Make one or more calls to process the data to be authenticated */
174 if (!EVP_MAC_update(mctx, test_m, sizeof(test_m))) {
175 fprintf(stderr, "EVP_MAC_update() failed\n");
176 goto end;
177 }
178
179 /* Make one call to the final to get the MAC */
180 if (!EVP_MAC_final(mctx, out, &out_len, sizeof(out))) {
181 fprintf(stderr, "EVP_MAC_final() failed\n");
182 goto end;
183 }
184
185 printf("Generated MAC:\n");
186 BIO_dump_indent_fp(stdout, out, out_len, 2);
187 putchar('\n');
188
189 if (out_len != sizeof(expected_output)) {
190 fprintf(stderr, "Generated MAC has an unexpected length\n");
191 goto end;
192 }
193
194 if (CRYPTO_memcmp(expected_output, out, sizeof(expected_output)) != 0) {
195 fprintf(stderr, "Generated MAC does not match expected value\n");
196 goto end;
197 }
198
199 rv = EXIT_SUCCESS;
200 end:
201 EVP_CIPHER_CTX_free(aesctx);
202 EVP_CIPHER_free(aes);
203 EVP_MAC_CTX_free(mctx);
204 EVP_MAC_free(mac);
205 OSSL_LIB_CTX_free(library_context);
206 if (rv != EXIT_SUCCESS)
207 ERR_print_errors_fp(stderr);
208 return rv;
209 }
210