1 /* Copyright (c) 2015, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/ssl.h>
16
17 #include <assert.h>
18 #include <string.h>
19
20 #include <openssl/aead.h>
21 #include <openssl/err.h>
22 #include <openssl/rand.h>
23
24 #include "../crypto/internal.h"
25 #include "internal.h"
26
27
SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,uint16_t version,int is_dtls,const SSL_CIPHER * cipher,const uint8_t * enc_key,size_t enc_key_len,const uint8_t * mac_key,size_t mac_key_len,const uint8_t * fixed_iv,size_t fixed_iv_len)28 SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,
29 uint16_t version, int is_dtls,
30 const SSL_CIPHER *cipher, const uint8_t *enc_key,
31 size_t enc_key_len, const uint8_t *mac_key,
32 size_t mac_key_len, const uint8_t *fixed_iv,
33 size_t fixed_iv_len) {
34 const EVP_AEAD *aead;
35 size_t expected_mac_key_len, expected_fixed_iv_len;
36 if (!ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len,
37 &expected_fixed_iv_len, cipher, version,
38 is_dtls) ||
39 /* Ensure the caller returned correct key sizes. */
40 expected_fixed_iv_len != fixed_iv_len ||
41 expected_mac_key_len != mac_key_len) {
42 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
43 return 0;
44 }
45
46 uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH];
47 if (mac_key_len > 0) {
48 /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher
49 * suites). */
50 if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) {
51 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
52 return 0;
53 }
54 OPENSSL_memcpy(merged_key, mac_key, mac_key_len);
55 OPENSSL_memcpy(merged_key + mac_key_len, enc_key, enc_key_len);
56 OPENSSL_memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv,
57 fixed_iv_len);
58 enc_key = merged_key;
59 enc_key_len += mac_key_len;
60 enc_key_len += fixed_iv_len;
61 }
62
63 SSL_AEAD_CTX *aead_ctx = (SSL_AEAD_CTX *)OPENSSL_malloc(sizeof(SSL_AEAD_CTX));
64 if (aead_ctx == NULL) {
65 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
66 return NULL;
67 }
68 OPENSSL_memset(aead_ctx, 0, sizeof(SSL_AEAD_CTX));
69 aead_ctx->cipher = cipher;
70 aead_ctx->version = version;
71
72 if (!EVP_AEAD_CTX_init_with_direction(
73 &aead_ctx->ctx, aead, enc_key, enc_key_len,
74 EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) {
75 OPENSSL_free(aead_ctx);
76 return NULL;
77 }
78
79 assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH);
80 static_assert(EVP_AEAD_MAX_NONCE_LENGTH < 256,
81 "variable_nonce_len doesn't fit in uint8_t");
82 aead_ctx->variable_nonce_len = (uint8_t)EVP_AEAD_nonce_length(aead);
83 if (mac_key_len == 0) {
84 assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce));
85 OPENSSL_memcpy(aead_ctx->fixed_nonce, fixed_iv, fixed_iv_len);
86 aead_ctx->fixed_nonce_len = fixed_iv_len;
87
88 if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) {
89 /* The fixed nonce into the actual nonce (the sequence number). */
90 aead_ctx->xor_fixed_nonce = 1;
91 aead_ctx->variable_nonce_len = 8;
92 } else {
93 /* The fixed IV is prepended to the nonce. */
94 assert(fixed_iv_len <= aead_ctx->variable_nonce_len);
95 aead_ctx->variable_nonce_len -= fixed_iv_len;
96 }
97
98 /* AES-GCM uses an explicit nonce. */
99 if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) {
100 aead_ctx->variable_nonce_included_in_record = 1;
101 }
102
103 /* The TLS 1.3 construction XORs the fixed nonce into the sequence number
104 * and omits the additional data. */
105 if (version >= TLS1_3_VERSION) {
106 aead_ctx->xor_fixed_nonce = 1;
107 aead_ctx->variable_nonce_len = 8;
108 aead_ctx->variable_nonce_included_in_record = 0;
109 aead_ctx->omit_ad = 1;
110 assert(fixed_iv_len >= aead_ctx->variable_nonce_len);
111 }
112 } else {
113 assert(version < TLS1_3_VERSION);
114 aead_ctx->variable_nonce_included_in_record = 1;
115 aead_ctx->random_variable_nonce = 1;
116 aead_ctx->omit_length_in_ad = 1;
117 aead_ctx->omit_version_in_ad = (version == SSL3_VERSION);
118 }
119
120 return aead_ctx;
121 }
122
SSL_AEAD_CTX_free(SSL_AEAD_CTX * aead)123 void SSL_AEAD_CTX_free(SSL_AEAD_CTX *aead) {
124 if (aead == NULL) {
125 return;
126 }
127 EVP_AEAD_CTX_cleanup(&aead->ctx);
128 OPENSSL_free(aead);
129 }
130
SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX * aead)131 size_t SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX *aead) {
132 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
133 aead = NULL;
134 #endif
135
136 if (aead != NULL && aead->variable_nonce_included_in_record) {
137 return aead->variable_nonce_len;
138 }
139 return 0;
140 }
141
SSL_AEAD_CTX_max_suffix_len(const SSL_AEAD_CTX * aead,size_t extra_in_len)142 size_t SSL_AEAD_CTX_max_suffix_len(const SSL_AEAD_CTX *aead,
143 size_t extra_in_len) {
144 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
145 aead = NULL;
146 #endif
147
148 return extra_in_len +
149 (aead == NULL ? 0 : EVP_AEAD_max_overhead(aead->ctx.aead));
150 }
151
SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX * aead)152 size_t SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX *aead) {
153 return SSL_AEAD_CTX_explicit_nonce_len(aead) +
154 SSL_AEAD_CTX_max_suffix_len(aead, 0);
155 }
156
157 /* ssl_aead_ctx_get_ad writes the additional data for |aead| into |out| and
158 * returns the number of bytes written. */
ssl_aead_ctx_get_ad(SSL_AEAD_CTX * aead,uint8_t out[13],uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],size_t plaintext_len)159 static size_t ssl_aead_ctx_get_ad(SSL_AEAD_CTX *aead, uint8_t out[13],
160 uint8_t type, uint16_t wire_version,
161 const uint8_t seqnum[8],
162 size_t plaintext_len) {
163 if (aead->omit_ad) {
164 return 0;
165 }
166
167 OPENSSL_memcpy(out, seqnum, 8);
168 size_t len = 8;
169 out[len++] = type;
170 if (!aead->omit_version_in_ad) {
171 out[len++] = (uint8_t)(wire_version >> 8);
172 out[len++] = (uint8_t)wire_version;
173 }
174 if (!aead->omit_length_in_ad) {
175 out[len++] = (uint8_t)(plaintext_len >> 8);
176 out[len++] = (uint8_t)plaintext_len;
177 }
178 return len;
179 }
180
SSL_AEAD_CTX_open(SSL_AEAD_CTX * aead,CBS * out,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],uint8_t * in,size_t in_len)181 int SSL_AEAD_CTX_open(SSL_AEAD_CTX *aead, CBS *out, uint8_t type,
182 uint16_t wire_version, const uint8_t seqnum[8],
183 uint8_t *in, size_t in_len) {
184 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
185 aead = NULL;
186 #endif
187
188 if (aead == NULL) {
189 /* Handle the initial NULL cipher. */
190 CBS_init(out, in, in_len);
191 return 1;
192 }
193
194 /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed
195 * overhead. Otherwise the parameter is unused. */
196 size_t plaintext_len = 0;
197 if (!aead->omit_length_in_ad) {
198 size_t overhead = SSL_AEAD_CTX_max_overhead(aead);
199 if (in_len < overhead) {
200 /* Publicly invalid. */
201 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
202 return 0;
203 }
204 plaintext_len = in_len - overhead;
205 }
206 uint8_t ad[13];
207 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
208 plaintext_len);
209
210 /* Assemble the nonce. */
211 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
212 size_t nonce_len = 0;
213
214 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
215 if (aead->xor_fixed_nonce) {
216 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
217 OPENSSL_memset(nonce, 0, nonce_len);
218 } else {
219 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
220 nonce_len += aead->fixed_nonce_len;
221 }
222
223 /* Add the variable nonce. */
224 if (aead->variable_nonce_included_in_record) {
225 if (in_len < aead->variable_nonce_len) {
226 /* Publicly invalid. */
227 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
228 return 0;
229 }
230 OPENSSL_memcpy(nonce + nonce_len, in, aead->variable_nonce_len);
231 in += aead->variable_nonce_len;
232 in_len -= aead->variable_nonce_len;
233 } else {
234 assert(aead->variable_nonce_len == 8);
235 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
236 }
237 nonce_len += aead->variable_nonce_len;
238
239 /* XOR the fixed nonce, if necessary. */
240 if (aead->xor_fixed_nonce) {
241 assert(nonce_len == aead->fixed_nonce_len);
242 for (size_t i = 0; i < aead->fixed_nonce_len; i++) {
243 nonce[i] ^= aead->fixed_nonce[i];
244 }
245 }
246
247 /* Decrypt in-place. */
248 size_t len;
249 if (!EVP_AEAD_CTX_open(&aead->ctx, in, &len, in_len, nonce, nonce_len,
250 in, in_len, ad, ad_len)) {
251 return 0;
252 }
253 CBS_init(out, in, len);
254 return 1;
255 }
256
SSL_AEAD_CTX_seal_scatter(SSL_AEAD_CTX * aead,uint8_t * out_prefix,uint8_t * out,uint8_t * out_suffix,size_t * out_suffix_len,size_t max_out_suffix_len,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],const uint8_t * in,size_t in_len,const uint8_t * extra_in,size_t extra_in_len)257 int SSL_AEAD_CTX_seal_scatter(SSL_AEAD_CTX *aead, uint8_t *out_prefix,
258 uint8_t *out, uint8_t *out_suffix,
259 size_t *out_suffix_len, size_t max_out_suffix_len,
260 uint8_t type, uint16_t wire_version,
261 const uint8_t seqnum[8], const uint8_t *in,
262 size_t in_len, const uint8_t *extra_in,
263 size_t extra_in_len) {
264 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
265 aead = NULL;
266 #endif
267
268 if ((in != out && buffers_alias(in, in_len, out, in_len)) ||
269 buffers_alias(in, in_len, out_suffix, max_out_suffix_len)) {
270 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
271 return 0;
272 }
273 if (extra_in_len > max_out_suffix_len) {
274 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
275 return 0;
276 }
277
278 if (aead == NULL) {
279 /* Handle the initial NULL cipher. */
280 OPENSSL_memmove(out, in, in_len);
281 OPENSSL_memmove(out_suffix, extra_in, extra_in_len);
282 *out_suffix_len = extra_in_len;
283 return 1;
284 }
285
286 uint8_t ad[13];
287 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
288 in_len);
289
290 /* Assemble the nonce. */
291 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
292 size_t nonce_len = 0;
293
294 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
295 if (aead->xor_fixed_nonce) {
296 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
297 OPENSSL_memset(nonce, 0, nonce_len);
298 } else {
299 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
300 nonce_len += aead->fixed_nonce_len;
301 }
302
303 /* Select the variable nonce. */
304 if (aead->random_variable_nonce) {
305 assert(aead->variable_nonce_included_in_record);
306 if (!RAND_bytes(nonce + nonce_len, aead->variable_nonce_len)) {
307 return 0;
308 }
309 } else {
310 /* When sending we use the sequence number as the variable part of the
311 * nonce. */
312 assert(aead->variable_nonce_len == 8);
313 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
314 }
315 nonce_len += aead->variable_nonce_len;
316
317 /* Emit the variable nonce if included in the record. */
318 if (aead->variable_nonce_included_in_record) {
319 assert(!aead->xor_fixed_nonce);
320 if (buffers_alias(in, in_len, out_prefix, aead->variable_nonce_len)) {
321 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
322 return 0;
323 }
324 OPENSSL_memcpy(out_prefix, nonce + aead->fixed_nonce_len,
325 aead->variable_nonce_len);
326 }
327
328 /* XOR the fixed nonce, if necessary. */
329 if (aead->xor_fixed_nonce) {
330 assert(nonce_len == aead->fixed_nonce_len);
331 for (size_t i = 0; i < aead->fixed_nonce_len; i++) {
332 nonce[i] ^= aead->fixed_nonce[i];
333 }
334 }
335
336 return EVP_AEAD_CTX_seal_scatter(&aead->ctx, out, out_suffix, out_suffix_len,
337 max_out_suffix_len, nonce, nonce_len, in,
338 in_len, extra_in, extra_in_len, ad, ad_len);
339 }
340
SSL_AEAD_CTX_seal(SSL_AEAD_CTX * aead,uint8_t * out,size_t * out_len,size_t max_out_len,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],const uint8_t * in,size_t in_len)341 int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len,
342 size_t max_out_len, uint8_t type, uint16_t wire_version,
343 const uint8_t seqnum[8], const uint8_t *in,
344 size_t in_len) {
345 size_t prefix_len = SSL_AEAD_CTX_explicit_nonce_len(aead);
346 if (in_len + prefix_len < in_len) {
347 OPENSSL_PUT_ERROR(CIPHER, SSL_R_RECORD_TOO_LARGE);
348 return 0;
349 }
350 if (in_len + prefix_len > max_out_len) {
351 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
352 return 0;
353 }
354
355 size_t suffix_len;
356 if (!SSL_AEAD_CTX_seal_scatter(aead, out, out + prefix_len,
357 out + prefix_len + in_len, &suffix_len,
358 max_out_len - prefix_len - in_len, type,
359 wire_version, seqnum, in, in_len, 0, 0)) {
360 return 0;
361 }
362 assert(suffix_len <= SSL_AEAD_CTX_max_suffix_len(aead, 0));
363 *out_len = prefix_len + in_len + suffix_len;
364 return 1;
365 }
366