1 /* 2 * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <string.h> 11 #include <stdlib.h> 12 #include <openssl/crypto.h> 13 #include <openssl/evp.h> 14 #include <openssl/core_names.h> 15 #include <openssl/params.h> 16 #include "internal/endian.h" 17 #include "crypto/modes.h" 18 #include "crypto/siv.h" 19 20 #ifndef OPENSSL_NO_SIV 21 22 __owur static ossl_inline uint32_t rotl8(uint32_t x) 23 { 24 return (x << 8) | (x >> 24); 25 } 26 27 __owur static ossl_inline uint32_t rotr8(uint32_t x) 28 { 29 return (x >> 8) | (x << 24); 30 } 31 32 __owur static ossl_inline uint64_t byteswap8(uint64_t x) 33 { 34 uint32_t high = (uint32_t)(x >> 32); 35 uint32_t low = (uint32_t)x; 36 37 high = (rotl8(high) & 0x00ff00ff) | (rotr8(high) & 0xff00ff00); 38 low = (rotl8(low) & 0x00ff00ff) | (rotr8(low) & 0xff00ff00); 39 return ((uint64_t)low) << 32 | (uint64_t)high; 40 } 41 42 __owur static ossl_inline uint64_t siv128_getword(SIV_BLOCK const *b, size_t i) 43 { 44 DECLARE_IS_ENDIAN; 45 46 if (IS_LITTLE_ENDIAN) 47 return byteswap8(b->word[i]); 48 return b->word[i]; 49 } 50 51 static ossl_inline void siv128_putword(SIV_BLOCK *b, size_t i, uint64_t x) 52 { 53 DECLARE_IS_ENDIAN; 54 55 if (IS_LITTLE_ENDIAN) 56 b->word[i] = byteswap8(x); 57 else 58 b->word[i] = x; 59 } 60 61 static ossl_inline void siv128_xorblock(SIV_BLOCK *x, 62 SIV_BLOCK const *y) 63 { 64 x->word[0] ^= y->word[0]; 65 x->word[1] ^= y->word[1]; 66 } 67 68 /* 69 * Doubles |b|, which is 16 bytes representing an element 70 * of GF(2**128) modulo the irreducible polynomial 71 * x**128 + x**7 + x**2 + x + 1. 72 * Assumes two's-complement arithmetic 73 */ 74 static ossl_inline void siv128_dbl(SIV_BLOCK *b) 75 { 76 uint64_t high = siv128_getword(b, 0); 77 uint64_t low = siv128_getword(b, 1); 78 uint64_t high_carry = high & (((uint64_t)1) << 63); 79 uint64_t low_carry = low & (((uint64_t)1) << 63); 80 int64_t low_mask = -((int64_t)(high_carry >> 63)) & 0x87; 81 uint64_t high_mask = low_carry >> 63; 82 83 high = (high << 1) | high_mask; 84 low = (low << 1) ^ (uint64_t)low_mask; 85 siv128_putword(b, 0, high); 86 siv128_putword(b, 1, low); 87 } 88 89 __owur static ossl_inline int siv128_do_s2v_p(SIV128_CONTEXT *ctx, SIV_BLOCK *out, 90 unsigned char const* in, size_t len) 91 { 92 SIV_BLOCK t; 93 size_t out_len = sizeof(out->byte); 94 EVP_MAC_CTX *mac_ctx; 95 int ret = 0; 96 97 mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init); 98 if (mac_ctx == NULL) 99 return 0; 100 101 if (len >= SIV_LEN) { 102 if (!EVP_MAC_update(mac_ctx, in, len - SIV_LEN)) 103 goto err; 104 memcpy(&t, in + (len-SIV_LEN), SIV_LEN); 105 siv128_xorblock(&t, &ctx->d); 106 if (!EVP_MAC_update(mac_ctx, t.byte, SIV_LEN)) 107 goto err; 108 } else { 109 memset(&t, 0, sizeof(t)); 110 memcpy(&t, in, len); 111 t.byte[len] = 0x80; 112 siv128_dbl(&ctx->d); 113 siv128_xorblock(&t, &ctx->d); 114 if (!EVP_MAC_update(mac_ctx, t.byte, SIV_LEN)) 115 goto err; 116 } 117 if (!EVP_MAC_final(mac_ctx, out->byte, &out_len, sizeof(out->byte)) 118 || out_len != SIV_LEN) 119 goto err; 120 121 ret = 1; 122 123 err: 124 EVP_MAC_CTX_free(mac_ctx); 125 return ret; 126 } 127 128 129 __owur static ossl_inline int siv128_do_encrypt(EVP_CIPHER_CTX *ctx, unsigned char *out, 130 unsigned char const *in, size_t len, 131 SIV_BLOCK *icv) 132 { 133 int out_len = (int)len; 134 135 if (!EVP_CipherInit_ex(ctx, NULL, NULL, NULL, icv->byte, 1)) 136 return 0; 137 return EVP_EncryptUpdate(ctx, out, &out_len, in, out_len); 138 } 139 140 /* 141 * Create a new SIV128_CONTEXT 142 */ 143 SIV128_CONTEXT *ossl_siv128_new(const unsigned char *key, int klen, 144 EVP_CIPHER *cbc, EVP_CIPHER *ctr, 145 OSSL_LIB_CTX *libctx, const char *propq) 146 { 147 SIV128_CONTEXT *ctx; 148 int ret; 149 150 if ((ctx = OPENSSL_malloc(sizeof(*ctx))) != NULL) { 151 ret = ossl_siv128_init(ctx, key, klen, cbc, ctr, libctx, propq); 152 if (ret) 153 return ctx; 154 OPENSSL_free(ctx); 155 } 156 157 return NULL; 158 } 159 160 /* 161 * Initialise an existing SIV128_CONTEXT 162 */ 163 int ossl_siv128_init(SIV128_CONTEXT *ctx, const unsigned char *key, int klen, 164 const EVP_CIPHER *cbc, const EVP_CIPHER *ctr, 165 OSSL_LIB_CTX *libctx, const char *propq) 166 { 167 static const unsigned char zero[SIV_LEN] = { 0 }; 168 size_t out_len = SIV_LEN; 169 EVP_MAC_CTX *mac_ctx = NULL; 170 OSSL_PARAM params[3]; 171 const char *cbc_name; 172 173 if (ctx == NULL) 174 return 0; 175 176 memset(&ctx->d, 0, sizeof(ctx->d)); 177 EVP_CIPHER_CTX_free(ctx->cipher_ctx); 178 EVP_MAC_CTX_free(ctx->mac_ctx_init); 179 EVP_MAC_free(ctx->mac); 180 ctx->mac = NULL; 181 ctx->cipher_ctx = NULL; 182 ctx->mac_ctx_init = NULL; 183 184 if (key == NULL || cbc == NULL || ctr == NULL) 185 return 0; 186 187 cbc_name = EVP_CIPHER_get0_name(cbc); 188 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER, 189 (char *)cbc_name, 0); 190 params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, 191 (void *)key, klen); 192 params[2] = OSSL_PARAM_construct_end(); 193 194 if ((ctx->cipher_ctx = EVP_CIPHER_CTX_new()) == NULL 195 || (ctx->mac = 196 EVP_MAC_fetch(libctx, OSSL_MAC_NAME_CMAC, propq)) == NULL 197 || (ctx->mac_ctx_init = EVP_MAC_CTX_new(ctx->mac)) == NULL 198 || !EVP_MAC_CTX_set_params(ctx->mac_ctx_init, params) 199 || !EVP_EncryptInit_ex(ctx->cipher_ctx, ctr, NULL, key + klen, NULL) 200 || (mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init)) == NULL 201 || !EVP_MAC_update(mac_ctx, zero, sizeof(zero)) 202 || !EVP_MAC_final(mac_ctx, ctx->d.byte, &out_len, 203 sizeof(ctx->d.byte))) { 204 EVP_CIPHER_CTX_free(ctx->cipher_ctx); 205 EVP_MAC_CTX_free(ctx->mac_ctx_init); 206 EVP_MAC_CTX_free(mac_ctx); 207 EVP_MAC_free(ctx->mac); 208 return 0; 209 } 210 EVP_MAC_CTX_free(mac_ctx); 211 212 ctx->final_ret = -1; 213 ctx->crypto_ok = 1; 214 215 return 1; 216 } 217 218 /* 219 * Copy an SIV128_CONTEXT object 220 */ 221 int ossl_siv128_copy_ctx(SIV128_CONTEXT *dest, SIV128_CONTEXT *src) 222 { 223 memcpy(&dest->d, &src->d, sizeof(src->d)); 224 if (dest->cipher_ctx == NULL) { 225 dest->cipher_ctx = EVP_CIPHER_CTX_new(); 226 if (dest->cipher_ctx == NULL) 227 return 0; 228 } 229 if (!EVP_CIPHER_CTX_copy(dest->cipher_ctx, src->cipher_ctx)) 230 return 0; 231 EVP_MAC_CTX_free(dest->mac_ctx_init); 232 dest->mac_ctx_init = EVP_MAC_CTX_dup(src->mac_ctx_init); 233 if (dest->mac_ctx_init == NULL) 234 return 0; 235 dest->mac = src->mac; 236 if (dest->mac != NULL) 237 EVP_MAC_up_ref(dest->mac); 238 return 1; 239 } 240 241 /* 242 * Provide any AAD. This can be called multiple times. 243 * Per RFC5297, the last piece of associated data 244 * is the nonce, but it's not treated special 245 */ 246 int ossl_siv128_aad(SIV128_CONTEXT *ctx, const unsigned char *aad, 247 size_t len) 248 { 249 SIV_BLOCK mac_out; 250 size_t out_len = SIV_LEN; 251 EVP_MAC_CTX *mac_ctx; 252 253 siv128_dbl(&ctx->d); 254 255 if ((mac_ctx = EVP_MAC_CTX_dup(ctx->mac_ctx_init)) == NULL 256 || !EVP_MAC_update(mac_ctx, aad, len) 257 || !EVP_MAC_final(mac_ctx, mac_out.byte, &out_len, 258 sizeof(mac_out.byte)) 259 || out_len != SIV_LEN) { 260 EVP_MAC_CTX_free(mac_ctx); 261 return 0; 262 } 263 EVP_MAC_CTX_free(mac_ctx); 264 265 siv128_xorblock(&ctx->d, &mac_out); 266 267 return 1; 268 } 269 270 /* 271 * Provide any data to be encrypted. This can be called once. 272 */ 273 int ossl_siv128_encrypt(SIV128_CONTEXT *ctx, 274 const unsigned char *in, unsigned char *out, 275 size_t len) 276 { 277 SIV_BLOCK q; 278 279 /* can only do one crypto operation */ 280 if (ctx->crypto_ok == 0) 281 return 0; 282 ctx->crypto_ok--; 283 284 if (!siv128_do_s2v_p(ctx, &q, in, len)) 285 return 0; 286 287 memcpy(ctx->tag.byte, &q, SIV_LEN); 288 q.byte[8] &= 0x7f; 289 q.byte[12] &= 0x7f; 290 291 if (!siv128_do_encrypt(ctx->cipher_ctx, out, in, len, &q)) 292 return 0; 293 ctx->final_ret = 0; 294 return len; 295 } 296 297 /* 298 * Provide any data to be decrypted. This can be called once. 299 */ 300 int ossl_siv128_decrypt(SIV128_CONTEXT *ctx, 301 const unsigned char *in, unsigned char *out, 302 size_t len) 303 { 304 unsigned char* p; 305 SIV_BLOCK t, q; 306 int i; 307 308 /* can only do one crypto operation */ 309 if (ctx->crypto_ok == 0) 310 return 0; 311 ctx->crypto_ok--; 312 313 memcpy(&q, ctx->tag.byte, SIV_LEN); 314 q.byte[8] &= 0x7f; 315 q.byte[12] &= 0x7f; 316 317 if (!siv128_do_encrypt(ctx->cipher_ctx, out, in, len, &q) 318 || !siv128_do_s2v_p(ctx, &t, out, len)) 319 return 0; 320 321 p = ctx->tag.byte; 322 for (i = 0; i < SIV_LEN; i++) 323 t.byte[i] ^= p[i]; 324 325 if ((t.word[0] | t.word[1]) != 0) { 326 OPENSSL_cleanse(out, len); 327 return 0; 328 } 329 ctx->final_ret = 0; 330 return len; 331 } 332 333 /* 334 * Return the already calculated final result. 335 */ 336 int ossl_siv128_finish(SIV128_CONTEXT *ctx) 337 { 338 return ctx->final_ret; 339 } 340 341 /* 342 * Set the tag 343 */ 344 int ossl_siv128_set_tag(SIV128_CONTEXT *ctx, const unsigned char *tag, size_t len) 345 { 346 if (len != SIV_LEN) 347 return 0; 348 349 /* Copy the tag from the supplied buffer */ 350 memcpy(ctx->tag.byte, tag, len); 351 return 1; 352 } 353 354 /* 355 * Retrieve the calculated tag 356 */ 357 int ossl_siv128_get_tag(SIV128_CONTEXT *ctx, unsigned char *tag, size_t len) 358 { 359 if (len != SIV_LEN) 360 return 0; 361 362 /* Copy the tag into the supplied buffer */ 363 memcpy(tag, ctx->tag.byte, len); 364 return 1; 365 } 366 367 /* 368 * Release all resources 369 */ 370 int ossl_siv128_cleanup(SIV128_CONTEXT *ctx) 371 { 372 if (ctx != NULL) { 373 EVP_CIPHER_CTX_free(ctx->cipher_ctx); 374 ctx->cipher_ctx = NULL; 375 EVP_MAC_CTX_free(ctx->mac_ctx_init); 376 ctx->mac_ctx_init = NULL; 377 EVP_MAC_free(ctx->mac); 378 ctx->mac = NULL; 379 OPENSSL_cleanse(&ctx->d, sizeof(ctx->d)); 380 OPENSSL_cleanse(&ctx->tag, sizeof(ctx->tag)); 381 ctx->final_ret = -1; 382 ctx->crypto_ok = 1; 383 } 384 return 1; 385 } 386 387 int ossl_siv128_speed(SIV128_CONTEXT *ctx, int arg) 388 { 389 ctx->crypto_ok = (arg == 1) ? -1 : 1; 390 return 1; 391 } 392 393 #endif /* OPENSSL_NO_SIV */ 394