1 /*
2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* Dispatch functions for gcm mode */
11
12 #include <openssl/rand.h>
13 #include <openssl/proverr.h>
14 #include "prov/ciphercommon.h"
15 #include "prov/ciphercommon_gcm.h"
16 #include "prov/providercommon.h"
17 #include "prov/provider_ctx.h"
18 #include "internal/param_names.h"
19
20 static int gcm_tls_init(PROV_GCM_CTX *dat, unsigned char *aad, size_t aad_len);
21 static int gcm_tls_iv_set_fixed(PROV_GCM_CTX *ctx, unsigned char *iv,
22 size_t len);
23 static int gcm_tls_cipher(PROV_GCM_CTX *ctx, unsigned char *out, size_t *padlen,
24 const unsigned char *in, size_t len);
25 static int gcm_cipher_internal(PROV_GCM_CTX *ctx, unsigned char *out,
26 size_t *padlen, const unsigned char *in,
27 size_t len);
28
29 /*
30 * Called from EVP_CipherInit when there is currently no context via
31 * the new_ctx() function
32 */
ossl_gcm_initctx(void * provctx,PROV_GCM_CTX * ctx,size_t keybits,const PROV_GCM_HW * hw)33 void ossl_gcm_initctx(void *provctx, PROV_GCM_CTX *ctx, size_t keybits,
34 const PROV_GCM_HW *hw)
35 {
36 ctx->pad = 1;
37 ctx->mode = EVP_CIPH_GCM_MODE;
38 ctx->taglen = UNINITIALISED_SIZET;
39 ctx->tls_aad_len = UNINITIALISED_SIZET;
40 ctx->ivlen = (EVP_GCM_TLS_FIXED_IV_LEN + EVP_GCM_TLS_EXPLICIT_IV_LEN);
41 ctx->keylen = keybits / 8;
42 ctx->hw = hw;
43 ctx->libctx = PROV_LIBCTX_OF(provctx);
44 }
45
46 /*
47 * Called by EVP_CipherInit via the _einit and _dinit functions
48 */
gcm_init(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[],int enc)49 static int gcm_init(void *vctx, const unsigned char *key, size_t keylen,
50 const unsigned char *iv, size_t ivlen,
51 const OSSL_PARAM params[], int enc)
52 {
53 PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
54
55 if (!ossl_prov_is_running())
56 return 0;
57
58 ctx->enc = enc;
59
60 if (iv != NULL) {
61 if (ivlen == 0 || ivlen > sizeof(ctx->iv)) {
62 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
63 return 0;
64 }
65 ctx->ivlen = ivlen;
66 memcpy(ctx->iv, iv, ivlen);
67 ctx->iv_state = IV_STATE_BUFFERED;
68 }
69
70 if (key != NULL) {
71 if (keylen != ctx->keylen) {
72 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
73 return 0;
74 }
75 if (!ctx->hw->setkey(ctx, key, ctx->keylen))
76 return 0;
77 ctx->tls_enc_records = 0;
78 }
79 return ossl_gcm_set_ctx_params(ctx, params);
80 }
81
ossl_gcm_einit(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[])82 int ossl_gcm_einit(void *vctx, const unsigned char *key, size_t keylen,
83 const unsigned char *iv, size_t ivlen,
84 const OSSL_PARAM params[])
85 {
86 return gcm_init(vctx, key, keylen, iv, ivlen, params, 1);
87 }
88
ossl_gcm_dinit(void * vctx,const unsigned char * key,size_t keylen,const unsigned char * iv,size_t ivlen,const OSSL_PARAM params[])89 int ossl_gcm_dinit(void *vctx, const unsigned char *key, size_t keylen,
90 const unsigned char *iv, size_t ivlen,
91 const OSSL_PARAM params[])
92 {
93 return gcm_init(vctx, key, keylen, iv, ivlen, params, 0);
94 }
95
96 /* increment counter (64-bit int) by 1 */
ctr64_inc(unsigned char * counter)97 static void ctr64_inc(unsigned char *counter)
98 {
99 int n = 8;
100 unsigned char c;
101
102 do {
103 --n;
104 c = counter[n];
105 ++c;
106 counter[n] = c;
107 if (c > 0)
108 return;
109 } while (n > 0);
110 }
111
getivgen(PROV_GCM_CTX * ctx,unsigned char * out,size_t olen)112 static int getivgen(PROV_GCM_CTX *ctx, unsigned char *out, size_t olen)
113 {
114 if (!ctx->iv_gen
115 || !ctx->key_set
116 || !ctx->hw->setiv(ctx, ctx->iv, ctx->ivlen))
117 return 0;
118 if (olen == 0 || olen > ctx->ivlen)
119 olen = ctx->ivlen;
120 memcpy(out, ctx->iv + ctx->ivlen - olen, olen);
121 /*
122 * Invocation field will be at least 8 bytes in size and so no need
123 * to check wrap around or increment more than last 8 bytes.
124 */
125 ctr64_inc(ctx->iv + ctx->ivlen - 8);
126 ctx->iv_state = IV_STATE_COPIED;
127 return 1;
128 }
129
setivinv(PROV_GCM_CTX * ctx,unsigned char * in,size_t inl)130 static int setivinv(PROV_GCM_CTX *ctx, unsigned char *in, size_t inl)
131 {
132 if (!ctx->iv_gen
133 || !ctx->key_set
134 || ctx->enc)
135 return 0;
136
137 memcpy(ctx->iv + ctx->ivlen - inl, in, inl);
138 if (!ctx->hw->setiv(ctx, ctx->iv, ctx->ivlen))
139 return 0;
140 ctx->iv_state = IV_STATE_COPIED;
141 return 1;
142 }
143
ossl_gcm_get_ctx_params(void * vctx,OSSL_PARAM params[])144 int ossl_gcm_get_ctx_params(void *vctx, OSSL_PARAM params[])
145 {
146 PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
147 OSSL_PARAM *p;
148 size_t sz;
149 int type;
150
151 for (p = params; p->key != NULL; p++) {
152 type = ossl_param_find_pidx(p->key);
153 switch (type) {
154 default:
155 break;
156
157 case PIDX_CIPHER_PARAM_IVLEN:
158 if (!OSSL_PARAM_set_size_t(p, ctx->ivlen)) {
159 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
160 return 0;
161 }
162 break;
163
164 case PIDX_CIPHER_PARAM_KEYLEN:
165 if (!OSSL_PARAM_set_size_t(p, ctx->keylen)) {
166 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
167 return 0;
168 }
169 break;
170
171 case PIDX_CIPHER_PARAM_AEAD_TAGLEN: {
172 size_t taglen = (ctx->taglen != UNINITIALISED_SIZET) ? ctx->taglen : GCM_TAG_MAX_SIZE;
173
174 if (!OSSL_PARAM_set_size_t(p, taglen)) {
175 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
176 return 0;
177 }
178 } break;
179
180 case PIDX_CIPHER_PARAM_IV:
181 if (ctx->iv_state == IV_STATE_UNINITIALISED)
182 return 0;
183 if (ctx->ivlen > p->data_size) {
184 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
185 return 0;
186 }
187 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, ctx->ivlen)
188 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, ctx->ivlen)) {
189 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
190 return 0;
191 }
192 break;
193
194 case PIDX_CIPHER_PARAM_UPDATED_IV:
195 if (ctx->iv_state == IV_STATE_UNINITIALISED)
196 return 0;
197 if (ctx->ivlen > p->data_size) {
198 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
199 return 0;
200 }
201 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, ctx->ivlen)
202 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, ctx->ivlen)) {
203 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
204 return 0;
205 }
206 break;
207
208 case PIDX_CIPHER_PARAM_AEAD_TLS1_AAD_PAD:
209 if (!OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
210 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
211 return 0;
212 }
213 break;
214
215 case PIDX_CIPHER_PARAM_AEAD_TAG:
216 sz = p->data_size;
217 if (sz == 0
218 || sz > EVP_GCM_TLS_TAG_LEN
219 || !ctx->enc
220 || ctx->taglen == UNINITIALISED_SIZET) {
221 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG);
222 return 0;
223 }
224 if (!OSSL_PARAM_set_octet_string(p, ctx->buf, sz)) {
225 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
226 return 0;
227 }
228 break;
229
230 case PIDX_CIPHER_PARAM_AEAD_TLS1_GET_IV_GEN:
231 if (p->data == NULL
232 || p->data_type != OSSL_PARAM_OCTET_STRING
233 || !getivgen(ctx, p->data, p->data_size))
234 return 0;
235 break;
236 case PIDX_CIPHER_PARAM_AEAD_IV_GENERATED:
237 if (!OSSL_PARAM_set_uint(p, ctx->iv_gen_rand))
238 return 0;
239 }
240 }
241 return 1;
242 }
243
ossl_gcm_set_ctx_params(void * vctx,const OSSL_PARAM params[])244 int ossl_gcm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
245 {
246 PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
247 const OSSL_PARAM *p;
248 size_t sz;
249 void *vp;
250 int type;
251
252 if (ossl_param_is_empty(params))
253 return 1;
254
255 for (p = params; p->key != NULL; p++) {
256 type = ossl_param_find_pidx(p->key);
257 switch (type) {
258 default:
259 break;
260
261 case PIDX_CIPHER_PARAM_AEAD_TAG:
262 vp = ctx->buf;
263 if (!OSSL_PARAM_get_octet_string(p, &vp, EVP_GCM_TLS_TAG_LEN, &sz)) {
264 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
265 return 0;
266 }
267 if (sz == 0 || ctx->enc) {
268 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG);
269 return 0;
270 }
271 ctx->taglen = sz;
272 break;
273
274 case PIDX_CIPHER_PARAM_AEAD_IVLEN:
275 if (!OSSL_PARAM_get_size_t(p, &sz)) {
276 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
277 return 0;
278 }
279 if (sz == 0 || sz > sizeof(ctx->iv)) {
280 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
281 return 0;
282 }
283 if (ctx->ivlen != sz) {
284 /* If the iv was already set or autogenerated, it is invalid. */
285 if (ctx->iv_state != IV_STATE_UNINITIALISED)
286 ctx->iv_state = IV_STATE_FINISHED;
287 ctx->ivlen = sz;
288 }
289 break;
290
291 case PIDX_CIPHER_PARAM_AEAD_TLS1_AAD:
292 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
293 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
294 return 0;
295 }
296 sz = gcm_tls_init(ctx, p->data, p->data_size);
297 if (sz == 0) {
298 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_AAD);
299 return 0;
300 }
301 ctx->tls_aad_pad_sz = sz;
302 break;
303
304 case PIDX_CIPHER_PARAM_AEAD_TLS1_IV_FIXED:
305 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
306 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
307 return 0;
308 }
309 if (gcm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
310 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
311 return 0;
312 }
313 break;
314
315 case PIDX_CIPHER_PARAM_AEAD_TLS1_SET_IV_INV:
316 if (p->data == NULL
317 || p->data_type != OSSL_PARAM_OCTET_STRING
318 || !setivinv(ctx, p->data, p->data_size))
319 return 0;
320 break;
321 }
322 }
323
324 return 1;
325 }
326
ossl_gcm_stream_update(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)327 int ossl_gcm_stream_update(void *vctx, unsigned char *out, size_t *outl,
328 size_t outsize, const unsigned char *in, size_t inl)
329 {
330 PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
331
332 if (inl == 0) {
333 *outl = 0;
334 return 1;
335 }
336
337 if (outsize < inl) {
338 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
339 return 0;
340 }
341
342 if (gcm_cipher_internal(ctx, out, outl, in, inl) <= 0) {
343 ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
344 return 0;
345 }
346 return 1;
347 }
348
ossl_gcm_stream_final(void * vctx,unsigned char * out,size_t * outl,size_t outsize)349 int ossl_gcm_stream_final(void *vctx, unsigned char *out, size_t *outl,
350 size_t outsize)
351 {
352 PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
353 int i;
354
355 if (!ossl_prov_is_running())
356 return 0;
357
358 i = gcm_cipher_internal(ctx, out, outl, NULL, 0);
359 if (i <= 0)
360 return 0;
361
362 *outl = 0;
363 return 1;
364 }
365
ossl_gcm_cipher(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)366 int ossl_gcm_cipher(void *vctx,
367 unsigned char *out, size_t *outl, size_t outsize,
368 const unsigned char *in, size_t inl)
369 {
370 PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
371
372 if (!ossl_prov_is_running())
373 return 0;
374
375 if (outsize < inl) {
376 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
377 return 0;
378 }
379
380 if (gcm_cipher_internal(ctx, out, outl, in, inl) <= 0)
381 return 0;
382
383 *outl = inl;
384 return 1;
385 }
386
387 /*
388 * See SP800-38D (GCM) Section 8 "Uniqueness requirement on IVS and keys"
389 *
390 * See also 8.2.2 RBG-based construction.
391 * Random construction consists of a free field (which can be NULL) and a
392 * random field which will use a DRBG that can return at least 96 bits of
393 * entropy strength. (The DRBG must be seeded by the FIPS module).
394 */
gcm_iv_generate(PROV_GCM_CTX * ctx,int offset)395 static int gcm_iv_generate(PROV_GCM_CTX *ctx, int offset)
396 {
397 int sz = ctx->ivlen - offset;
398
399 /* Must be at least 96 bits */
400 if (sz <= 0 || ctx->ivlen < GCM_IV_DEFAULT_SIZE)
401 return 0;
402
403 /* Use DRBG to generate random iv */
404 if (RAND_bytes_ex(ctx->libctx, ctx->iv + offset, sz, 0) <= 0)
405 return 0;
406 ctx->iv_state = IV_STATE_BUFFERED;
407 ctx->iv_gen_rand = 1;
408 return 1;
409 }
410
gcm_cipher_internal(PROV_GCM_CTX * ctx,unsigned char * out,size_t * padlen,const unsigned char * in,size_t len)411 static int gcm_cipher_internal(PROV_GCM_CTX *ctx, unsigned char *out,
412 size_t *padlen, const unsigned char *in,
413 size_t len)
414 {
415 size_t olen = 0;
416 int rv = 0;
417 const PROV_GCM_HW *hw = ctx->hw;
418
419 if (ctx->tls_aad_len != UNINITIALISED_SIZET)
420 return gcm_tls_cipher(ctx, out, padlen, in, len);
421
422 if (!ctx->key_set || ctx->iv_state == IV_STATE_FINISHED)
423 goto err;
424
425 /*
426 * FIPS requires generation of AES-GCM IV's inside the FIPS module.
427 * The IV can still be set externally (the security policy will state that
428 * this is not FIPS compliant). There are some applications
429 * where setting the IV externally is the only option available.
430 */
431 if (ctx->iv_state == IV_STATE_UNINITIALISED) {
432 if (!ctx->enc || !gcm_iv_generate(ctx, 0))
433 goto err;
434 }
435
436 if (ctx->iv_state == IV_STATE_BUFFERED) {
437 if (!hw->setiv(ctx, ctx->iv, ctx->ivlen))
438 goto err;
439 ctx->iv_state = IV_STATE_COPIED;
440 }
441
442 if (in != NULL) {
443 /* The input is AAD if out is NULL */
444 if (out == NULL) {
445 if (!hw->aadupdate(ctx, in, len))
446 goto err;
447 } else {
448 /* The input is ciphertext OR plaintext */
449 if (!hw->cipherupdate(ctx, in, len, out))
450 goto err;
451 }
452 } else {
453 /* The tag must be set before actually decrypting data */
454 if (!ctx->enc && ctx->taglen == UNINITIALISED_SIZET)
455 goto err;
456 if (!hw->cipherfinal(ctx, ctx->buf))
457 goto err;
458 ctx->iv_state = IV_STATE_FINISHED; /* Don't reuse the IV */
459 goto finish;
460 }
461 olen = len;
462 finish:
463 rv = 1;
464 err:
465 *padlen = olen;
466 return rv;
467 }
468
gcm_tls_init(PROV_GCM_CTX * dat,unsigned char * aad,size_t aad_len)469 static int gcm_tls_init(PROV_GCM_CTX *dat, unsigned char *aad, size_t aad_len)
470 {
471 unsigned char *buf;
472 size_t len;
473
474 if (!ossl_prov_is_running() || aad_len != EVP_AEAD_TLS1_AAD_LEN)
475 return 0;
476
477 /* Save the aad for later use. */
478 buf = dat->buf;
479 memcpy(buf, aad, aad_len);
480 dat->tls_aad_len = aad_len;
481
482 len = buf[aad_len - 2] << 8 | buf[aad_len - 1];
483 /* Correct length for explicit iv. */
484 if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
485 return 0;
486 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
487
488 /* If decrypting correct for tag too. */
489 if (!dat->enc) {
490 if (len < EVP_GCM_TLS_TAG_LEN)
491 return 0;
492 len -= EVP_GCM_TLS_TAG_LEN;
493 }
494 buf[aad_len - 2] = (unsigned char)(len >> 8);
495 buf[aad_len - 1] = (unsigned char)(len & 0xff);
496 /* Extra padding: tag appended to record. */
497 return EVP_GCM_TLS_TAG_LEN;
498 }
499
gcm_tls_iv_set_fixed(PROV_GCM_CTX * ctx,unsigned char * iv,size_t len)500 static int gcm_tls_iv_set_fixed(PROV_GCM_CTX *ctx, unsigned char *iv,
501 size_t len)
502 {
503 /* Special case: -1 length restores whole IV */
504 if (len == (size_t)-1) {
505 memcpy(ctx->iv, iv, ctx->ivlen);
506 ctx->iv_gen = 1;
507 ctx->iv_state = IV_STATE_BUFFERED;
508 return 1;
509 }
510 /* Fixed field must be at least 4 bytes and invocation field at least 8 */
511 if ((len < EVP_GCM_TLS_FIXED_IV_LEN)
512 || (ctx->ivlen - (int)len) < EVP_GCM_TLS_EXPLICIT_IV_LEN)
513 return 0;
514 if (len > 0)
515 memcpy(ctx->iv, iv, len);
516 if (ctx->enc) {
517 if (RAND_bytes_ex(ctx->libctx, ctx->iv + len, ctx->ivlen - len, 0) <= 0)
518 return 0;
519 ctx->iv_gen_rand = 1;
520 }
521 ctx->iv_gen = 1;
522 ctx->iv_state = IV_STATE_BUFFERED;
523 return 1;
524 }
525
526 /*
527 * Handle TLS GCM packet format. This consists of the last portion of the IV
528 * followed by the payload and finally the tag. On encrypt generate IV,
529 * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
530 * and verify tag.
531 */
gcm_tls_cipher(PROV_GCM_CTX * ctx,unsigned char * out,size_t * padlen,const unsigned char * in,size_t len)532 static int gcm_tls_cipher(PROV_GCM_CTX *ctx, unsigned char *out, size_t *padlen,
533 const unsigned char *in, size_t len)
534 {
535 int rv = 0;
536 size_t arg = EVP_GCM_TLS_EXPLICIT_IV_LEN;
537 size_t plen = 0;
538 unsigned char *tag = NULL;
539
540 if (!ossl_prov_is_running() || !ctx->key_set)
541 goto err;
542
543 /* Encrypt/decrypt must be performed in place */
544 if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
545 goto err;
546
547 /*
548 * Check for too many keys as per FIPS 140-2 IG A.5 "Key/IV Pair Uniqueness
549 * Requirements from SP 800-38D". The requirements is for one party to the
550 * communication to fail after 2^64 - 1 keys. We do this on the encrypting
551 * side only.
552 */
553 if (ctx->enc && ++ctx->tls_enc_records == 0) {
554 ERR_raise(ERR_LIB_PROV, PROV_R_TOO_MANY_RECORDS);
555 goto err;
556 }
557
558 /*
559 * Set IV from start of buffer or generate IV and write to start of
560 * buffer.
561 */
562 if (ctx->enc) {
563 if (!getivgen(ctx, out, arg))
564 goto err;
565 } else {
566 if (!setivinv(ctx, out, arg))
567 goto err;
568 }
569
570 /* Fix buffer and length to point to payload */
571 in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
572 out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
573 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
574
575 tag = ctx->enc ? out + len : (unsigned char *)in + len;
576 if (!ctx->hw->oneshot(ctx, ctx->buf, ctx->tls_aad_len, in, len, out, tag,
577 EVP_GCM_TLS_TAG_LEN)) {
578 if (!ctx->enc)
579 OPENSSL_cleanse(out, len);
580 goto err;
581 }
582 if (ctx->enc)
583 plen = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
584 else
585 plen = len;
586
587 rv = 1;
588 err:
589 ctx->iv_state = IV_STATE_FINISHED;
590 ctx->tls_aad_len = UNINITIALISED_SIZET;
591 *padlen = plen;
592 return rv;
593 }
594