1 /* Copyright (c) 2014, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <assert.h>
16 #include <limits.h>
17 #include <string.h>
18
19 #include <openssl/aead.h>
20 #include <openssl/cipher.h>
21 #include <openssl/err.h>
22 #include <openssl/hmac.h>
23 #include <openssl/md5.h>
24 #include <openssl/mem.h>
25 #include <openssl/sha.h>
26
27 #include "internal.h"
28 #include "../internal.h"
29 #include "../fipsmodule/cipher/internal.h"
30
31
32 typedef struct {
33 EVP_CIPHER_CTX cipher_ctx;
34 EVP_MD_CTX md_ctx;
35 } AEAD_SSL3_CTX;
36
ssl3_mac(AEAD_SSL3_CTX * ssl3_ctx,uint8_t * out,unsigned * out_len,const uint8_t * ad,size_t ad_len,const uint8_t * in,size_t in_len)37 static int ssl3_mac(AEAD_SSL3_CTX *ssl3_ctx, uint8_t *out, unsigned *out_len,
38 const uint8_t *ad, size_t ad_len, const uint8_t *in,
39 size_t in_len) {
40 size_t md_size = EVP_MD_CTX_size(&ssl3_ctx->md_ctx);
41 size_t pad_len = (md_size == 20) ? 40 : 48;
42
43 /* To allow for CBC mode which changes cipher length, |ad| doesn't include the
44 * length for legacy ciphers. */
45 uint8_t ad_extra[2];
46 ad_extra[0] = (uint8_t)(in_len >> 8);
47 ad_extra[1] = (uint8_t)(in_len & 0xff);
48
49 EVP_MD_CTX md_ctx;
50 EVP_MD_CTX_init(&md_ctx);
51
52 uint8_t pad[48];
53 uint8_t tmp[EVP_MAX_MD_SIZE];
54 OPENSSL_memset(pad, 0x36, pad_len);
55 if (!EVP_MD_CTX_copy_ex(&md_ctx, &ssl3_ctx->md_ctx) ||
56 !EVP_DigestUpdate(&md_ctx, pad, pad_len) ||
57 !EVP_DigestUpdate(&md_ctx, ad, ad_len) ||
58 !EVP_DigestUpdate(&md_ctx, ad_extra, sizeof(ad_extra)) ||
59 !EVP_DigestUpdate(&md_ctx, in, in_len) ||
60 !EVP_DigestFinal_ex(&md_ctx, tmp, NULL)) {
61 EVP_MD_CTX_cleanup(&md_ctx);
62 return 0;
63 }
64
65 OPENSSL_memset(pad, 0x5c, pad_len);
66 if (!EVP_MD_CTX_copy_ex(&md_ctx, &ssl3_ctx->md_ctx) ||
67 !EVP_DigestUpdate(&md_ctx, pad, pad_len) ||
68 !EVP_DigestUpdate(&md_ctx, tmp, md_size) ||
69 !EVP_DigestFinal_ex(&md_ctx, out, out_len)) {
70 EVP_MD_CTX_cleanup(&md_ctx);
71 return 0;
72 }
73 EVP_MD_CTX_cleanup(&md_ctx);
74 return 1;
75 }
76
aead_ssl3_cleanup(EVP_AEAD_CTX * ctx)77 static void aead_ssl3_cleanup(EVP_AEAD_CTX *ctx) {
78 AEAD_SSL3_CTX *ssl3_ctx = (AEAD_SSL3_CTX *)ctx->aead_state;
79 EVP_CIPHER_CTX_cleanup(&ssl3_ctx->cipher_ctx);
80 EVP_MD_CTX_cleanup(&ssl3_ctx->md_ctx);
81 OPENSSL_free(ssl3_ctx);
82 ctx->aead_state = NULL;
83 }
84
aead_ssl3_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len,enum evp_aead_direction_t dir,const EVP_CIPHER * cipher,const EVP_MD * md)85 static int aead_ssl3_init(EVP_AEAD_CTX *ctx, const uint8_t *key, size_t key_len,
86 size_t tag_len, enum evp_aead_direction_t dir,
87 const EVP_CIPHER *cipher, const EVP_MD *md) {
88 if (tag_len != EVP_AEAD_DEFAULT_TAG_LENGTH &&
89 tag_len != EVP_MD_size(md)) {
90 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_TAG_SIZE);
91 return 0;
92 }
93
94 if (key_len != EVP_AEAD_key_length(ctx->aead)) {
95 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
96 return 0;
97 }
98
99 size_t mac_key_len = EVP_MD_size(md);
100 size_t enc_key_len = EVP_CIPHER_key_length(cipher);
101 assert(mac_key_len + enc_key_len + EVP_CIPHER_iv_length(cipher) == key_len);
102
103 AEAD_SSL3_CTX *ssl3_ctx = OPENSSL_malloc(sizeof(AEAD_SSL3_CTX));
104 if (ssl3_ctx == NULL) {
105 OPENSSL_PUT_ERROR(CIPHER, ERR_R_MALLOC_FAILURE);
106 return 0;
107 }
108 EVP_CIPHER_CTX_init(&ssl3_ctx->cipher_ctx);
109 EVP_MD_CTX_init(&ssl3_ctx->md_ctx);
110
111 ctx->aead_state = ssl3_ctx;
112 if (!EVP_CipherInit_ex(&ssl3_ctx->cipher_ctx, cipher, NULL, &key[mac_key_len],
113 &key[mac_key_len + enc_key_len],
114 dir == evp_aead_seal) ||
115 !EVP_DigestInit_ex(&ssl3_ctx->md_ctx, md, NULL) ||
116 !EVP_DigestUpdate(&ssl3_ctx->md_ctx, key, mac_key_len)) {
117 aead_ssl3_cleanup(ctx);
118 ctx->aead_state = NULL;
119 return 0;
120 }
121 EVP_CIPHER_CTX_set_padding(&ssl3_ctx->cipher_ctx, 0);
122
123 return 1;
124 }
125
aead_ssl3_seal_scatter(const EVP_AEAD_CTX * ctx,uint8_t * out,uint8_t * out_tag,size_t * out_tag_len,size_t max_out_tag_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * extra_in,size_t extra_in_len,const uint8_t * ad,size_t ad_len)126 static int aead_ssl3_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
127 uint8_t *out_tag, size_t *out_tag_len,
128 size_t max_out_tag_len, const uint8_t *nonce,
129 size_t nonce_len, const uint8_t *in,
130 size_t in_len, const uint8_t *extra_in,
131 size_t extra_in_len, const uint8_t *ad,
132 size_t ad_len) {
133 AEAD_SSL3_CTX *ssl3_ctx = (AEAD_SSL3_CTX *)ctx->aead_state;
134
135 if (!ssl3_ctx->cipher_ctx.encrypt) {
136 /* Unlike a normal AEAD, an SSL3 AEAD may only be used in one direction. */
137 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_OPERATION);
138 return 0;
139 }
140
141 if (in_len > INT_MAX) {
142 /* EVP_CIPHER takes int as input. */
143 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
144 return 0;
145 }
146
147 const size_t max_overhead = EVP_AEAD_max_overhead(ctx->aead);
148 if (max_out_tag_len < max_overhead) {
149 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
150 return 0;
151 }
152
153 if (nonce_len != 0) {
154 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_IV_TOO_LARGE);
155 return 0;
156 }
157
158 if (ad_len != 11 - 2 /* length bytes */) {
159 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_AD_SIZE);
160 return 0;
161 }
162
163 /* Compute the MAC. This must be first in case the operation is being done
164 * in-place. */
165 uint8_t mac[EVP_MAX_MD_SIZE];
166 unsigned mac_len;
167 if (!ssl3_mac(ssl3_ctx, mac, &mac_len, ad, ad_len, in, in_len)) {
168 return 0;
169 }
170
171 /* Encrypt the input. */
172 int len;
173 if (!EVP_EncryptUpdate(&ssl3_ctx->cipher_ctx, out, &len, in,
174 (int)in_len)) {
175 return 0;
176 }
177
178 const size_t block_size = EVP_CIPHER_CTX_block_size(&ssl3_ctx->cipher_ctx);
179
180 /* Feed the MAC into the cipher in two steps. First complete the final partial
181 * block from encrypting the input and split the result between |out| and
182 * |out_tag|. Then encrypt the remainder. */
183
184 size_t early_mac_len = (block_size - (in_len % block_size)) % block_size;
185 if (early_mac_len != 0) {
186 assert(len + block_size - early_mac_len == in_len);
187 uint8_t buf[EVP_MAX_BLOCK_LENGTH];
188 int buf_len;
189 if (!EVP_EncryptUpdate(&ssl3_ctx->cipher_ctx, buf, &buf_len, mac,
190 (int)early_mac_len)) {
191 return 0;
192 }
193 assert(buf_len == (int)block_size);
194 OPENSSL_memcpy(out + len, buf, block_size - early_mac_len);
195 OPENSSL_memcpy(out_tag, buf + block_size - early_mac_len, early_mac_len);
196 }
197 size_t tag_len = early_mac_len;
198
199 if (!EVP_EncryptUpdate(&ssl3_ctx->cipher_ctx, out_tag + tag_len, &len,
200 mac + tag_len, mac_len - tag_len)) {
201 return 0;
202 }
203 tag_len += len;
204
205 if (block_size > 1) {
206 assert(block_size <= 256);
207 assert(EVP_CIPHER_CTX_mode(&ssl3_ctx->cipher_ctx) == EVP_CIPH_CBC_MODE);
208
209 /* Compute padding and feed that into the cipher. */
210 uint8_t padding[256];
211 size_t padding_len = block_size - ((in_len + mac_len) % block_size);
212 OPENSSL_memset(padding, 0, padding_len - 1);
213 padding[padding_len - 1] = padding_len - 1;
214 if (!EVP_EncryptUpdate(&ssl3_ctx->cipher_ctx, out_tag + tag_len, &len, padding,
215 (int)padding_len)) {
216 return 0;
217 }
218 tag_len += len;
219 }
220
221 if (!EVP_EncryptFinal_ex(&ssl3_ctx->cipher_ctx, out_tag + tag_len, &len)) {
222 return 0;
223 }
224 tag_len += len;
225 assert(tag_len <= max_overhead);
226
227 *out_tag_len = tag_len;
228 return 1;
229 }
230
aead_ssl3_open(const EVP_AEAD_CTX * ctx,uint8_t * out,size_t * out_len,size_t max_out_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len)231 static int aead_ssl3_open(const EVP_AEAD_CTX *ctx, uint8_t *out,
232 size_t *out_len, size_t max_out_len,
233 const uint8_t *nonce, size_t nonce_len,
234 const uint8_t *in, size_t in_len,
235 const uint8_t *ad, size_t ad_len) {
236 AEAD_SSL3_CTX *ssl3_ctx = (AEAD_SSL3_CTX *)ctx->aead_state;
237
238 if (ssl3_ctx->cipher_ctx.encrypt) {
239 /* Unlike a normal AEAD, an SSL3 AEAD may only be used in one direction. */
240 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_OPERATION);
241 return 0;
242 }
243
244 size_t mac_len = EVP_MD_CTX_size(&ssl3_ctx->md_ctx);
245 if (in_len < mac_len) {
246 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
247 return 0;
248 }
249
250 if (max_out_len < in_len) {
251 /* This requires that the caller provide space for the MAC, even though it
252 * will always be removed on return. */
253 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
254 return 0;
255 }
256
257 if (nonce_len != 0) {
258 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
259 return 0;
260 }
261
262 if (ad_len != 11 - 2 /* length bytes */) {
263 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_AD_SIZE);
264 return 0;
265 }
266
267 if (in_len > INT_MAX) {
268 /* EVP_CIPHER takes int as input. */
269 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
270 return 0;
271 }
272
273 /* Decrypt to get the plaintext + MAC + padding. */
274 size_t total = 0;
275 int len;
276 if (!EVP_DecryptUpdate(&ssl3_ctx->cipher_ctx, out, &len, in, (int)in_len)) {
277 return 0;
278 }
279 total += len;
280 if (!EVP_DecryptFinal_ex(&ssl3_ctx->cipher_ctx, out + total, &len)) {
281 return 0;
282 }
283 total += len;
284 assert(total == in_len);
285
286 /* Remove CBC padding and MAC. This would normally be timing-sensitive, but
287 * SSLv3 CBC ciphers are already broken. Support will be removed eventually.
288 * https://www.openssl.org/~bodo/ssl-poodle.pdf */
289 size_t data_len;
290 if (EVP_CIPHER_CTX_mode(&ssl3_ctx->cipher_ctx) == EVP_CIPH_CBC_MODE) {
291 unsigned padding_length = out[total - 1];
292 if (total < padding_length + 1 + mac_len) {
293 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
294 return 0;
295 }
296 /* The padding must be minimal. */
297 if (padding_length + 1 > EVP_CIPHER_CTX_block_size(&ssl3_ctx->cipher_ctx)) {
298 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
299 return 0;
300 }
301 data_len = total - padding_length - 1 - mac_len;
302 } else {
303 data_len = total - mac_len;
304 }
305
306 /* Compute the MAC and compare against the one in the record. */
307 uint8_t mac[EVP_MAX_MD_SIZE];
308 if (!ssl3_mac(ssl3_ctx, mac, NULL, ad, ad_len, out, data_len)) {
309 return 0;
310 }
311 if (CRYPTO_memcmp(&out[data_len], mac, mac_len) != 0) {
312 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
313 return 0;
314 }
315
316 *out_len = data_len;
317 return 1;
318 }
319
aead_ssl3_get_iv(const EVP_AEAD_CTX * ctx,const uint8_t ** out_iv,size_t * out_iv_len)320 static int aead_ssl3_get_iv(const EVP_AEAD_CTX *ctx, const uint8_t **out_iv,
321 size_t *out_iv_len) {
322 AEAD_SSL3_CTX *ssl3_ctx = (AEAD_SSL3_CTX *)ctx->aead_state;
323 const size_t iv_len = EVP_CIPHER_CTX_iv_length(&ssl3_ctx->cipher_ctx);
324 if (iv_len <= 1) {
325 return 0;
326 }
327
328 *out_iv = ssl3_ctx->cipher_ctx.iv;
329 *out_iv_len = iv_len;
330 return 1;
331 }
332
aead_aes_128_cbc_sha1_ssl3_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len,enum evp_aead_direction_t dir)333 static int aead_aes_128_cbc_sha1_ssl3_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
334 size_t key_len, size_t tag_len,
335 enum evp_aead_direction_t dir) {
336 return aead_ssl3_init(ctx, key, key_len, tag_len, dir, EVP_aes_128_cbc(),
337 EVP_sha1());
338 }
339
aead_aes_256_cbc_sha1_ssl3_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len,enum evp_aead_direction_t dir)340 static int aead_aes_256_cbc_sha1_ssl3_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
341 size_t key_len, size_t tag_len,
342 enum evp_aead_direction_t dir) {
343 return aead_ssl3_init(ctx, key, key_len, tag_len, dir, EVP_aes_256_cbc(),
344 EVP_sha1());
345 }
aead_des_ede3_cbc_sha1_ssl3_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len,enum evp_aead_direction_t dir)346 static int aead_des_ede3_cbc_sha1_ssl3_init(EVP_AEAD_CTX *ctx,
347 const uint8_t *key, size_t key_len,
348 size_t tag_len,
349 enum evp_aead_direction_t dir) {
350 return aead_ssl3_init(ctx, key, key_len, tag_len, dir, EVP_des_ede3_cbc(),
351 EVP_sha1());
352 }
353
aead_null_sha1_ssl3_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len,enum evp_aead_direction_t dir)354 static int aead_null_sha1_ssl3_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
355 size_t key_len, size_t tag_len,
356 enum evp_aead_direction_t dir) {
357 return aead_ssl3_init(ctx, key, key_len, tag_len, dir, EVP_enc_null(),
358 EVP_sha1());
359 }
360
361 static const EVP_AEAD aead_aes_128_cbc_sha1_ssl3 = {
362 SHA_DIGEST_LENGTH + 16 + 16, /* key len (SHA1 + AES128 + IV) */
363 0, /* nonce len */
364 16 + SHA_DIGEST_LENGTH, /* overhead (padding + SHA1) */
365 SHA_DIGEST_LENGTH, /* max tag length */
366 0, /* seal_scatter_supports_extra_in */
367
368 NULL, /* init */
369 aead_aes_128_cbc_sha1_ssl3_init,
370 aead_ssl3_cleanup,
371 aead_ssl3_open,
372 aead_ssl3_seal_scatter,
373 NULL, /* open_gather */
374 aead_ssl3_get_iv,
375 };
376
377 static const EVP_AEAD aead_aes_256_cbc_sha1_ssl3 = {
378 SHA_DIGEST_LENGTH + 32 + 16, /* key len (SHA1 + AES256 + IV) */
379 0, /* nonce len */
380 16 + SHA_DIGEST_LENGTH, /* overhead (padding + SHA1) */
381 SHA_DIGEST_LENGTH, /* max tag length */
382 0, /* seal_scatter_supports_extra_in */
383
384 NULL, /* init */
385 aead_aes_256_cbc_sha1_ssl3_init,
386 aead_ssl3_cleanup,
387 aead_ssl3_open,
388 aead_ssl3_seal_scatter,
389 NULL, /* open_gather */
390 aead_ssl3_get_iv,
391 };
392
393 static const EVP_AEAD aead_des_ede3_cbc_sha1_ssl3 = {
394 SHA_DIGEST_LENGTH + 24 + 8, /* key len (SHA1 + 3DES + IV) */
395 0, /* nonce len */
396 8 + SHA_DIGEST_LENGTH, /* overhead (padding + SHA1) */
397 SHA_DIGEST_LENGTH, /* max tag length */
398 0, /* seal_scatter_supports_extra_in */
399
400 NULL, /* init */
401 aead_des_ede3_cbc_sha1_ssl3_init,
402 aead_ssl3_cleanup,
403 aead_ssl3_open,
404 aead_ssl3_seal_scatter,
405 NULL, /* open_gather */
406 aead_ssl3_get_iv,
407 };
408
409 static const EVP_AEAD aead_null_sha1_ssl3 = {
410 SHA_DIGEST_LENGTH, /* key len */
411 0, /* nonce len */
412 SHA_DIGEST_LENGTH, /* overhead (SHA1) */
413 SHA_DIGEST_LENGTH, /* max tag length */
414 0, /* seal_scatter_supports_extra_in */
415
416 NULL, /* init */
417 aead_null_sha1_ssl3_init,
418 aead_ssl3_cleanup,
419 aead_ssl3_open,
420 aead_ssl3_seal_scatter,
421 NULL, /* open_gather */
422 NULL, /* get_iv */
423 };
424
EVP_aead_aes_128_cbc_sha1_ssl3(void)425 const EVP_AEAD *EVP_aead_aes_128_cbc_sha1_ssl3(void) {
426 return &aead_aes_128_cbc_sha1_ssl3;
427 }
428
EVP_aead_aes_256_cbc_sha1_ssl3(void)429 const EVP_AEAD *EVP_aead_aes_256_cbc_sha1_ssl3(void) {
430 return &aead_aes_256_cbc_sha1_ssl3;
431 }
432
EVP_aead_des_ede3_cbc_sha1_ssl3(void)433 const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_ssl3(void) {
434 return &aead_des_ede3_cbc_sha1_ssl3;
435 }
436
EVP_aead_null_sha1_ssl3(void)437 const EVP_AEAD *EVP_aead_null_sha1_ssl3(void) { return &aead_null_sha1_ssl3; }
438