1 /* 2 * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <string.h> 11 #include <stdlib.h> 12 #include <openssl/crypto.h> 13 #include <openssl/evp.h> 14 #include <openssl/core_names.h> 15 #include <openssl/params.h> 16 #include "internal/endian.h" 17 #include "crypto/modes.h" 18 #include "crypto/siv.h" 19 20 #ifndef OPENSSL_NO_SIV 21 22 __owur static ossl_inline uint32_t rotl8(uint32_t x) 23 { 24 return (x << 8) | (x >> 24); 25 } 26 27 __owur static ossl_inline uint32_t rotr8(uint32_t x) 28 { 29 return (x >> 8) | (x << 24); 30 } 31 32 __owur static ossl_inline uint64_t byteswap8(uint64_t x) 33 { 34 uint32_t high = (uint32_t)(x >> 32); 35 uint32_t low = (uint32_t)x; 36 37 high = (rotl8(high) & 0x00ff00ff) | (rotr8(high) & 0xff00ff00); 38 low = (rotl8(low) & 0x00ff00ff) | (rotr8(low) & 0xff00ff00); 39 return ((uint64_t)low) << 32 | (uint64_t)high; 40 } 41 42 __owur static ossl_inline uint64_t siv128_getword(SIV_BLOCK const *b, size_t i) 43 { 44 DECLARE_IS_ENDIAN; 45 46 if (IS_LITTLE_ENDIAN) 47 return byteswap8(b->word[i]); 48 return b->word[i]; 49 } 50 51 static ossl_inline void siv128_putword(SIV_BLOCK *b, size_t i, uint64_t x) 52 { 53 DECLARE_IS_ENDIAN; 54 55 if (IS_LITTLE_ENDIAN) 56 b->word[i] = byteswap8(x); 57 else 58 b->word[i] = x; 59 } 60 61 static ossl_inline void siv128_xorblock(SIV_BLOCK *x, 62 SIV_BLOCK const *y) 63 { 64 x->word[0] ^= y->word[0]; 65 x->word[1] ^= y->word[1]; 66 } 67 68 /* 69 * Doubles |b|, which is 16 bytes representing an element 70 * of GF(2**128) modulo the irreducible polynomial 71 * x**128 + x**7 + x**2 + x + 1. 72 * Assumes two's-complement arithmetic 73 */ 74 static ossl_inline void siv128_dbl(SIV_BLOCK *b) 75 { 76 uint64_t high = siv128_getword(b, 0); 77 uint64_t low = siv128_getword(b, 1); 78 uint64_t high_carry = high & (((uint64_t)1) << 63); 79 uint64_t low_carry = low & (((uint64_t)1) << 63); 80 int64_t low_mask = -((int64_t)(high_carry >> 63)) & 0x87; 81 uint64_t high_mask = low_carry >> 63; 82 83 high = (high << 1) | high_mask; 84 low = (low << 1) ^ (uint64_t)low_mask; 85 siv128_putword(b, 0, high); 86 siv128_putword(b, 1, low); 87 } 88 89 __owur static ossl_inline int siv128_do_s2v_p(SIV128_CONTEXT *ctx, SIV_BLOCK *out, 90 unsigned char const* in, size_t len) 91 { 92 SIV_BLOCK t; 93 size_t out_len = sizeof(out->byte); 94 EVP_MAC_CTX *mac_ctx; 95 int ret = 0; 96 97 mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init); 98 if (mac_ctx == NULL) 99 return 0; 100 101 if (len >= SIV_LEN) { 102 if (!EVP_MAC_update(mac_ctx, in, len - SIV_LEN)) 103 goto err; 104 memcpy(&t, in + (len-SIV_LEN), SIV_LEN); 105 siv128_xorblock(&t, &ctx->d); 106 if (!EVP_MAC_update(mac_ctx, t.byte, SIV_LEN)) 107 goto err; 108 } else { 109 memset(&t, 0, sizeof(t)); 110 memcpy(&t, in, len); 111 t.byte[len] = 0x80; 112 siv128_dbl(&ctx->d); 113 siv128_xorblock(&t, &ctx->d); 114 if (!EVP_MAC_update(mac_ctx, t.byte, SIV_LEN)) 115 goto err; 116 } 117 if (!EVP_MAC_final(mac_ctx, out->byte, &out_len, sizeof(out->byte)) 118 || out_len != SIV_LEN) 119 goto err; 120 121 ret = 1; 122 123 err: 124 EVP_MAC_CTX_free(mac_ctx); 125 return ret; 126 } 127 128 129 __owur static ossl_inline int siv128_do_encrypt(EVP_CIPHER_CTX *ctx, unsigned char *out, 130 unsigned char const *in, size_t len, 131 SIV_BLOCK *icv) 132 { 133 int out_len = (int)len; 134 135 if (!EVP_CipherInit_ex(ctx, NULL, NULL, NULL, icv->byte, 1)) 136 return 0; 137 return EVP_EncryptUpdate(ctx, out, &out_len, in, out_len); 138 } 139 140 /* 141 * Create a new SIV128_CONTEXT 142 */ 143 SIV128_CONTEXT *ossl_siv128_new(const unsigned char *key, int klen, 144 EVP_CIPHER *cbc, EVP_CIPHER *ctr, 145 OSSL_LIB_CTX *libctx, const char *propq) 146 { 147 SIV128_CONTEXT *ctx; 148 int ret; 149 150 if ((ctx = OPENSSL_malloc(sizeof(*ctx))) != NULL) { 151 ret = ossl_siv128_init(ctx, key, klen, cbc, ctr, libctx, propq); 152 if (ret) 153 return ctx; 154 OPENSSL_free(ctx); 155 } 156 157 return NULL; 158 } 159 160 /* 161 * Initialise an existing SIV128_CONTEXT 162 */ 163 int ossl_siv128_init(SIV128_CONTEXT *ctx, const unsigned char *key, int klen, 164 const EVP_CIPHER *cbc, const EVP_CIPHER *ctr, 165 OSSL_LIB_CTX *libctx, const char *propq) 166 { 167 static const unsigned char zero[SIV_LEN] = { 0 }; 168 size_t out_len = SIV_LEN; 169 EVP_MAC_CTX *mac_ctx = NULL; 170 OSSL_PARAM params[3]; 171 const char *cbc_name; 172 173 if (ctx == NULL) 174 return 0; 175 176 memset(&ctx->d, 0, sizeof(ctx->d)); 177 EVP_CIPHER_CTX_free(ctx->cipher_ctx); 178 EVP_MAC_CTX_free(ctx->mac_ctx_init); 179 EVP_MAC_free(ctx->mac); 180 ctx->mac = NULL; 181 ctx->cipher_ctx = NULL; 182 ctx->mac_ctx_init = NULL; 183 184 if (key == NULL || cbc == NULL || ctr == NULL) 185 return 0; 186 187 cbc_name = EVP_CIPHER_get0_name(cbc); 188 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER, 189 (char *)cbc_name, 0); 190 params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, 191 (void *)key, klen); 192 params[2] = OSSL_PARAM_construct_end(); 193 194 if ((ctx->cipher_ctx = EVP_CIPHER_CTX_new()) == NULL 195 || (ctx->mac = 196 EVP_MAC_fetch(libctx, OSSL_MAC_NAME_CMAC, propq)) == NULL 197 || (ctx->mac_ctx_init = EVP_MAC_CTX_new(ctx->mac)) == NULL 198 || !EVP_MAC_CTX_set_params(ctx->mac_ctx_init, params) 199 || !EVP_EncryptInit_ex(ctx->cipher_ctx, ctr, NULL, key + klen, NULL) 200 || (mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init)) == NULL 201 || !EVP_MAC_update(mac_ctx, zero, sizeof(zero)) 202 || !EVP_MAC_final(mac_ctx, ctx->d.byte, &out_len, 203 sizeof(ctx->d.byte))) { 204 EVP_CIPHER_CTX_free(ctx->cipher_ctx); 205 ctx->cipher_ctx = NULL; 206 EVP_MAC_CTX_free(ctx->mac_ctx_init); 207 ctx->mac_ctx_init = NULL; 208 EVP_MAC_CTX_free(mac_ctx); 209 EVP_MAC_free(ctx->mac); 210 ctx->mac = NULL; 211 return 0; 212 } 213 EVP_MAC_CTX_free(mac_ctx); 214 215 ctx->final_ret = -1; 216 ctx->crypto_ok = 1; 217 218 return 1; 219 } 220 221 /* 222 * Copy an SIV128_CONTEXT object 223 */ 224 int ossl_siv128_copy_ctx(SIV128_CONTEXT *dest, SIV128_CONTEXT *src) 225 { 226 memcpy(&dest->d, &src->d, sizeof(src->d)); 227 if (dest->cipher_ctx == NULL) { 228 dest->cipher_ctx = EVP_CIPHER_CTX_new(); 229 if (dest->cipher_ctx == NULL) 230 return 0; 231 } 232 if (!EVP_CIPHER_CTX_copy(dest->cipher_ctx, src->cipher_ctx)) 233 return 0; 234 EVP_MAC_CTX_free(dest->mac_ctx_init); 235 dest->mac_ctx_init = EVP_MAC_CTX_dup(src->mac_ctx_init); 236 if (dest->mac_ctx_init == NULL) 237 return 0; 238 dest->mac = src->mac; 239 if (dest->mac != NULL) 240 EVP_MAC_up_ref(dest->mac); 241 return 1; 242 } 243 244 /* 245 * Provide any AAD. This can be called multiple times. 246 * Per RFC5297, the last piece of associated data 247 * is the nonce, but it's not treated special 248 */ 249 int ossl_siv128_aad(SIV128_CONTEXT *ctx, const unsigned char *aad, 250 size_t len) 251 { 252 SIV_BLOCK mac_out; 253 size_t out_len = SIV_LEN; 254 EVP_MAC_CTX *mac_ctx; 255 256 siv128_dbl(&ctx->d); 257 258 if ((mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init)) == NULL 259 || !EVP_MAC_update(mac_ctx, aad, len) 260 || !EVP_MAC_final(mac_ctx, mac_out.byte, &out_len, 261 sizeof(mac_out.byte)) 262 || out_len != SIV_LEN) { 263 EVP_MAC_CTX_free(mac_ctx); 264 return 0; 265 } 266 EVP_MAC_CTX_free(mac_ctx); 267 268 siv128_xorblock(&ctx->d, &mac_out); 269 270 return 1; 271 } 272 273 /* 274 * Provide any data to be encrypted. This can be called once. 275 */ 276 int ossl_siv128_encrypt(SIV128_CONTEXT *ctx, 277 const unsigned char *in, unsigned char *out, 278 size_t len) 279 { 280 SIV_BLOCK q; 281 282 /* can only do one crypto operation */ 283 if (ctx->crypto_ok == 0) 284 return 0; 285 ctx->crypto_ok--; 286 287 if (!siv128_do_s2v_p(ctx, &q, in, len)) 288 return 0; 289 290 memcpy(ctx->tag.byte, &q, SIV_LEN); 291 q.byte[8] &= 0x7f; 292 q.byte[12] &= 0x7f; 293 294 if (!siv128_do_encrypt(ctx->cipher_ctx, out, in, len, &q)) 295 return 0; 296 ctx->final_ret = 0; 297 return 1; 298 } 299 300 /* 301 * Provide any data to be decrypted. This can be called once. 302 */ 303 int ossl_siv128_decrypt(SIV128_CONTEXT *ctx, 304 const unsigned char *in, unsigned char *out, 305 size_t len) 306 { 307 unsigned char* p; 308 SIV_BLOCK t, q; 309 int i; 310 311 /* can only do one crypto operation */ 312 if (ctx->crypto_ok == 0) 313 return 0; 314 ctx->crypto_ok--; 315 316 memcpy(&q, ctx->tag.byte, SIV_LEN); 317 q.byte[8] &= 0x7f; 318 q.byte[12] &= 0x7f; 319 320 if (!siv128_do_encrypt(ctx->cipher_ctx, out, in, len, &q) 321 || !siv128_do_s2v_p(ctx, &t, out, len)) 322 return 0; 323 324 p = ctx->tag.byte; 325 for (i = 0; i < SIV_LEN; i++) 326 t.byte[i] ^= p[i]; 327 328 if ((t.word[0] | t.word[1]) != 0) { 329 OPENSSL_cleanse(out, len); 330 return 0; 331 } 332 ctx->final_ret = 0; 333 return 1; 334 } 335 336 /* 337 * Return the already calculated final result. 338 */ 339 int ossl_siv128_finish(SIV128_CONTEXT *ctx) 340 { 341 return ctx->final_ret; 342 } 343 344 /* 345 * Set the tag 346 */ 347 int ossl_siv128_set_tag(SIV128_CONTEXT *ctx, const unsigned char *tag, size_t len) 348 { 349 if (len != SIV_LEN) 350 return 0; 351 352 /* Copy the tag from the supplied buffer */ 353 memcpy(ctx->tag.byte, tag, len); 354 return 1; 355 } 356 357 /* 358 * Retrieve the calculated tag 359 */ 360 int ossl_siv128_get_tag(SIV128_CONTEXT *ctx, unsigned char *tag, size_t len) 361 { 362 if (len != SIV_LEN) 363 return 0; 364 365 /* Copy the tag into the supplied buffer */ 366 memcpy(tag, ctx->tag.byte, len); 367 return 1; 368 } 369 370 /* 371 * Release all resources 372 */ 373 int ossl_siv128_cleanup(SIV128_CONTEXT *ctx) 374 { 375 if (ctx != NULL) { 376 EVP_CIPHER_CTX_free(ctx->cipher_ctx); 377 ctx->cipher_ctx = NULL; 378 EVP_MAC_CTX_free(ctx->mac_ctx_init); 379 ctx->mac_ctx_init = NULL; 380 EVP_MAC_free(ctx->mac); 381 ctx->mac = NULL; 382 OPENSSL_cleanse(&ctx->d, sizeof(ctx->d)); 383 OPENSSL_cleanse(&ctx->tag, sizeof(ctx->tag)); 384 ctx->final_ret = -1; 385 ctx->crypto_ok = 1; 386 } 387 return 1; 388 } 389 390 int ossl_siv128_speed(SIV128_CONTEXT *ctx, int arg) 391 { 392 ctx->crypto_ok = (arg == 1) ? -1 : 1; 393 return 1; 394 } 395 396 #endif /* OPENSSL_NO_SIV */ 397