1 /*
2 * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* Dispatch functions for ccm mode */
11
12 #include <openssl/proverr.h>
13 #include "prov/ciphercommon.h"
14 #include "prov/ciphercommon_ccm.h"
15 #include "prov/providercommon.h"
16
17 static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
18 size_t *padlen, const unsigned char *in,
19 size_t len);
20
ccm_tls_init(PROV_CCM_CTX * ctx,unsigned char * aad,size_t alen)21 static int ccm_tls_init(PROV_CCM_CTX *ctx, unsigned char *aad, size_t alen)
22 {
23 size_t len;
24
25 if (!ossl_prov_is_running() || alen != EVP_AEAD_TLS1_AAD_LEN)
26 return 0;
27
28 /* Save the aad for later use. */
29 memcpy(ctx->buf, aad, alen);
30 ctx->tls_aad_len = alen;
31
32 len = ctx->buf[alen - 2] << 8 | ctx->buf[alen - 1];
33 if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
34 return 0;
35
36 /* Correct length for explicit iv. */
37 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
38
39 if (!ctx->enc) {
40 if (len < ctx->m)
41 return 0;
42 /* Correct length for tag. */
43 len -= ctx->m;
44 }
45 ctx->buf[alen - 2] = (unsigned char)(len >> 8);
46 ctx->buf[alen - 1] = (unsigned char)(len & 0xff);
47
48 /* Extra padding: tag appended to record. */
49 return ctx->m;
50 }
51
ccm_tls_iv_set_fixed(PROV_CCM_CTX * ctx,unsigned char * fixed,size_t flen)52 static int ccm_tls_iv_set_fixed(PROV_CCM_CTX *ctx, unsigned char *fixed,
53 size_t flen)
54 {
55 if (flen != EVP_CCM_TLS_FIXED_IV_LEN)
56 return 0;
57
58 /* Copy to first part of the iv. */
59 memcpy(ctx->iv, fixed, flen);
60 return 1;
61 }
62
ccm_get_ivlen(PROV_CCM_CTX * ctx)63 static size_t ccm_get_ivlen(PROV_CCM_CTX *ctx)
64 {
65 return 15 - ctx->l;
66 }
67
ossl_ccm_set_ctx_params(void * vctx,const OSSL_PARAM params[])68 int ossl_ccm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
69 {
70 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
71 const OSSL_PARAM *p;
72 size_t sz;
73
74 if (ossl_param_is_empty(params))
75 return 1;
76
77 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG);
78 if (p != NULL) {
79 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
80 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
81 return 0;
82 }
83 if ((p->data_size & 1) || (p->data_size < 4) || p->data_size > 16) {
84 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH);
85 return 0;
86 }
87
88 if (p->data != NULL) {
89 if (ctx->enc) {
90 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_NEEDED);
91 return 0;
92 }
93 memcpy(ctx->buf, p->data, p->data_size);
94 ctx->tag_set = 1;
95 }
96 ctx->m = p->data_size;
97 }
98
99 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN);
100 if (p != NULL) {
101 size_t ivlen;
102
103 if (!OSSL_PARAM_get_size_t(p, &sz)) {
104 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
105 return 0;
106 }
107 ivlen = 15 - sz;
108 if (ivlen < 2 || ivlen > 8) {
109 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
110 return 0;
111 }
112 if (ctx->l != ivlen) {
113 ctx->l = ivlen;
114 ctx->iv_set = 0;
115 }
116 }
117
118 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
119 if (p != NULL) {
120 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
121 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
122 return 0;
123 }
124 sz = ccm_tls_init(ctx, p->data, p->data_size);
125 if (sz == 0) {
126 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA);
127 return 0;
128 }
129 ctx->tls_aad_pad_sz = sz;
130 }
131
132 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED);
133 if (p != NULL) {
134 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
135 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
136 return 0;
137 }
138 if (ccm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
139 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
140 return 0;
141 }
142 }
143
144 return 1;
145 }
146
ossl_ccm_get_ctx_params(void * vctx,OSSL_PARAM params[])147 int ossl_ccm_get_ctx_params(void *vctx, OSSL_PARAM params[])
148 {
149 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
150 OSSL_PARAM *p;
151
152 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN);
153 if (p != NULL && !OSSL_PARAM_set_size_t(p, ccm_get_ivlen(ctx))) {
154 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
155 return 0;
156 }
157
158 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN);
159 if (p != NULL) {
160 size_t m = ctx->m;
161
162 if (!OSSL_PARAM_set_size_t(p, m)) {
163 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
164 return 0;
165 }
166 }
167
168 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV);
169 if (p != NULL) {
170 if (ccm_get_ivlen(ctx) > p->data_size) {
171 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
172 return 0;
173 }
174 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)
175 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) {
176 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
177 return 0;
178 }
179 }
180
181 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_UPDATED_IV);
182 if (p != NULL) {
183 if (ccm_get_ivlen(ctx) > p->data_size) {
184 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
185 return 0;
186 }
187 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)
188 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) {
189 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
190 return 0;
191 }
192 }
193
194 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN);
195 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) {
196 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
197 return 0;
198 }
199
200 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD);
201 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
202 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
203 return 0;
204 }
205
206 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG);
207 if (p != NULL) {
208 if (!ctx->enc || !ctx->tag_set) {
209 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_SET);
210 return 0;
211 }
212 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
213 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
214 return 0;
215 }
216 if (!ctx->hw->gettag(ctx, p->data, p->data_size))
217 return 0;
218 ctx->tag_set = 0;
219 ctx->iv_set = 0;
220 ctx->len_set = 0;
221 }
222 return 1;
223 }
224
ccm_init(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[],int enc)225 static int ccm_init(void *vctx, const unsigned char *key, size_t keylen,
226 const unsigned char *iv, size_t ivlen,
227 const OSSL_PARAM params[], int enc)
228 {
229 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
230
231 if (!ossl_prov_is_running())
232 return 0;
233
234 ctx->enc = enc;
235
236 if (iv != NULL) {
237 if (ivlen != ccm_get_ivlen(ctx)) {
238 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
239 return 0;
240 }
241 memcpy(ctx->iv, iv, ivlen);
242 ctx->iv_set = 1;
243 }
244 if (key != NULL) {
245 if (keylen != ctx->keylen) {
246 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
247 return 0;
248 }
249 if (!ctx->hw->setkey(ctx, key, keylen))
250 return 0;
251 }
252 return ossl_ccm_set_ctx_params(ctx, params);
253 }
254
ossl_ccm_einit(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[])255 int ossl_ccm_einit(void *vctx, const unsigned char *key, size_t keylen,
256 const unsigned char *iv, size_t ivlen,
257 const OSSL_PARAM params[])
258 {
259 return ccm_init(vctx, key, keylen, iv, ivlen, params, 1);
260 }
261
ossl_ccm_dinit(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[])262 int ossl_ccm_dinit(void *vctx, const unsigned char *key, size_t keylen,
263 const unsigned char *iv, size_t ivlen,
264 const OSSL_PARAM params[])
265 {
266 return ccm_init(vctx, key, keylen, iv, ivlen, params, 0);
267 }
268
ossl_ccm_stream_update(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)269 int ossl_ccm_stream_update(void *vctx, unsigned char *out, size_t *outl,
270 size_t outsize, const unsigned char *in,
271 size_t inl)
272 {
273 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
274
275 if (outsize < inl) {
276 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
277 return 0;
278 }
279
280 if (!ccm_cipher_internal(ctx, out, outl, in, inl)) {
281 ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
282 return 0;
283 }
284 return 1;
285 }
286
ossl_ccm_stream_final(void * vctx,unsigned char * out,size_t * outl,size_t outsize)287 int ossl_ccm_stream_final(void *vctx, unsigned char *out, size_t *outl,
288 size_t outsize)
289 {
290 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
291 unsigned char dummy_in = 0, dummy_out = 0;
292
293 if (!ossl_prov_is_running())
294 return 0;
295
296 /*
297 * Encryption sets tag_set after processing the payload, while successful
298 * decryption clears iv_set. Use those transitions to avoid processing an
299 * operation twice.
300 */
301 if (!ctx->key_set
302 || (ctx->iv_set && (!ctx->enc || !ctx->tag_set)
303 && ccm_cipher_internal(ctx, &dummy_out, outl, &dummy_in, 0) <= 0))
304 return 0;
305
306 *outl = 0;
307 return 1;
308 }
309
ossl_ccm_cipher(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)310 int ossl_ccm_cipher(void *vctx, unsigned char *out, size_t *outl, size_t outsize,
311 const unsigned char *in, size_t inl)
312 {
313 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
314
315 if (!ossl_prov_is_running())
316 return 0;
317
318 if (in == NULL)
319 return ossl_ccm_stream_final(vctx, out, outl, outsize);
320
321 if (outsize < inl) {
322 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
323 return 0;
324 }
325
326 if (ccm_cipher_internal(ctx, out, outl, in, inl) <= 0)
327 return 0;
328
329 *outl = inl;
330 return 1;
331 }
332
333 /* Copy the buffered iv */
ccm_set_iv(PROV_CCM_CTX * ctx,size_t mlen)334 static int ccm_set_iv(PROV_CCM_CTX *ctx, size_t mlen)
335 {
336 const PROV_CCM_HW *hw = ctx->hw;
337
338 if (!hw->setiv(ctx, ctx->iv, ccm_get_ivlen(ctx), mlen))
339 return 0;
340 ctx->len_set = 1;
341 return 1;
342 }
343
ccm_tls_cipher(PROV_CCM_CTX * ctx,unsigned char * out,size_t * padlen,const unsigned char * in,size_t len)344 static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
345 unsigned char *out, size_t *padlen,
346 const unsigned char *in, size_t len)
347 {
348 int rv = 0;
349 size_t olen = 0;
350
351 if (!ossl_prov_is_running())
352 goto err;
353
354 /* Encrypt/decrypt must be performed in place */
355 if (in == NULL || out != in || len < EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m)
356 goto err;
357
358 /* If encrypting set explicit IV from sequence number (start of AAD) */
359 if (ctx->enc)
360 memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
361 /* Get rest of IV from explicit IV */
362 memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
363 /* Correct length value */
364 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
365 if (!ccm_set_iv(ctx, len))
366 goto err;
367
368 /* Use saved AAD */
369 if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))
370 goto err;
371
372 /* Fix buffer to point to payload */
373 in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
374 out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
375 if (ctx->enc) {
376 if (!ctx->hw->auth_encrypt(ctx, in, out, len, out + len, ctx->m))
377 goto err;
378 olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
379 } else {
380 if (!ctx->hw->auth_decrypt(ctx, in, out, len,
381 (unsigned char *)in + len, ctx->m))
382 goto err;
383 olen = len;
384 }
385 rv = 1;
386 err:
387 *padlen = olen;
388 return rv;
389 }
390
ccm_cipher_internal(PROV_CCM_CTX * ctx,unsigned char * out,size_t * padlen,const unsigned char * in,size_t len)391 static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
392 size_t *padlen, const unsigned char *in,
393 size_t len)
394 {
395 int rv = 0;
396 size_t olen = 0;
397 const PROV_CCM_HW *hw = ctx->hw;
398
399 /* If no key set, return error */
400 if (!ctx->key_set)
401 return 0;
402
403 if (ctx->tls_aad_len != UNINITIALISED_SIZET)
404 return ccm_tls_cipher(ctx, out, padlen, in, len);
405
406 /* EVP_*Final() doesn't return any data */
407 if (in == NULL && out != NULL)
408 goto finish;
409
410 if (!ctx->iv_set)
411 goto err;
412
413 if (out == NULL) {
414 if (in == NULL) {
415 if (!ccm_set_iv(ctx, len))
416 goto err;
417 } else {
418 /* If we have AAD, we need a message length */
419 if (!ctx->len_set && len)
420 goto err;
421 if (!hw->setaad(ctx, in, len))
422 goto err;
423 }
424 } else {
425 /* If not set length yet do it */
426 if (!ctx->len_set && !ccm_set_iv(ctx, len))
427 goto err;
428
429 if (ctx->enc) {
430 if (!hw->auth_encrypt(ctx, in, out, len, NULL, 0))
431 goto err;
432 ctx->tag_set = 1;
433 } else {
434 /* The tag must be set before actually decrypting data */
435 if (!ctx->tag_set)
436 goto err;
437
438 if (!hw->auth_decrypt(ctx, in, out, len, ctx->buf, ctx->m))
439 goto err;
440 /* Finished - reset flags so calling this method again will fail */
441 ctx->iv_set = 0;
442 ctx->tag_set = 0;
443 ctx->len_set = 0;
444 }
445 }
446 olen = len;
447 finish:
448 rv = 1;
449 err:
450 *padlen = olen;
451 return rv;
452 }
453
ossl_ccm_initctx(PROV_CCM_CTX * ctx,size_t keybits,const PROV_CCM_HW * hw)454 void ossl_ccm_initctx(PROV_CCM_CTX *ctx, size_t keybits, const PROV_CCM_HW *hw)
455 {
456 ctx->keylen = keybits / 8;
457 ctx->key_set = 0;
458 ctx->iv_set = 0;
459 ctx->tag_set = 0;
460 ctx->len_set = 0;
461 ctx->l = 8;
462 ctx->m = 12;
463 ctx->tls_aad_len = UNINITIALISED_SIZET;
464 ctx->hw = hw;
465 }
466