1 /* 2 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* Dispatch functions for ccm mode */ 11 12 #include <openssl/proverr.h> 13 #include "prov/ciphercommon.h" 14 #include "prov/ciphercommon_ccm.h" 15 #include "prov/providercommon.h" 16 17 static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out, 18 size_t *padlen, const unsigned char *in, 19 size_t len); 20 21 static int ccm_tls_init(PROV_CCM_CTX *ctx, unsigned char *aad, size_t alen) 22 { 23 size_t len; 24 25 if (!ossl_prov_is_running() || alen != EVP_AEAD_TLS1_AAD_LEN) 26 return 0; 27 28 /* Save the aad for later use. */ 29 memcpy(ctx->buf, aad, alen); 30 ctx->tls_aad_len = alen; 31 32 len = ctx->buf[alen - 2] << 8 | ctx->buf[alen - 1]; 33 if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN) 34 return 0; 35 36 /* Correct length for explicit iv. */ 37 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN; 38 39 if (!ctx->enc) { 40 if (len < ctx->m) 41 return 0; 42 /* Correct length for tag. */ 43 len -= ctx->m; 44 } 45 ctx->buf[alen - 2] = (unsigned char)(len >> 8); 46 ctx->buf[alen - 1] = (unsigned char)(len & 0xff); 47 48 /* Extra padding: tag appended to record. */ 49 return ctx->m; 50 } 51 52 static int ccm_tls_iv_set_fixed(PROV_CCM_CTX *ctx, unsigned char *fixed, 53 size_t flen) 54 { 55 if (flen != EVP_CCM_TLS_FIXED_IV_LEN) 56 return 0; 57 58 /* Copy to first part of the iv. */ 59 memcpy(ctx->iv, fixed, flen); 60 return 1; 61 } 62 63 static size_t ccm_get_ivlen(PROV_CCM_CTX *ctx) 64 { 65 return 15 - ctx->l; 66 } 67 68 int ossl_ccm_set_ctx_params(void *vctx, const OSSL_PARAM params[]) 69 { 70 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx; 71 const OSSL_PARAM *p; 72 size_t sz; 73 74 if (params == NULL) 75 return 1; 76 77 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG); 78 if (p != NULL) { 79 if (p->data_type != OSSL_PARAM_OCTET_STRING) { 80 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); 81 return 0; 82 } 83 if ((p->data_size & 1) || (p->data_size < 4) || p->data_size > 16) { 84 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH); 85 return 0; 86 } 87 88 if (p->data != NULL) { 89 if (ctx->enc) { 90 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_NEEDED); 91 return 0; 92 } 93 memcpy(ctx->buf, p->data, p->data_size); 94 ctx->tag_set = 1; 95 } 96 ctx->m = p->data_size; 97 } 98 99 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN); 100 if (p != NULL) { 101 size_t ivlen; 102 103 if (!OSSL_PARAM_get_size_t(p, &sz)) { 104 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); 105 return 0; 106 } 107 ivlen = 15 - sz; 108 if (ivlen < 2 || ivlen > 8) { 109 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH); 110 return 0; 111 } 112 ctx->l = ivlen; 113 } 114 115 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD); 116 if (p != NULL) { 117 if (p->data_type != OSSL_PARAM_OCTET_STRING) { 118 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); 119 return 0; 120 } 121 sz = ccm_tls_init(ctx, p->data, p->data_size); 122 if (sz == 0) { 123 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA); 124 return 0; 125 } 126 ctx->tls_aad_pad_sz = sz; 127 } 128 129 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED); 130 if (p != NULL) { 131 if (p->data_type != OSSL_PARAM_OCTET_STRING) { 132 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); 133 return 0; 134 } 135 if (ccm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) { 136 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH); 137 return 0; 138 } 139 } 140 141 return 1; 142 } 143 144 int ossl_ccm_get_ctx_params(void *vctx, OSSL_PARAM params[]) 145 { 146 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx; 147 OSSL_PARAM *p; 148 149 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN); 150 if (p != NULL && !OSSL_PARAM_set_size_t(p, ccm_get_ivlen(ctx))) { 151 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); 152 return 0; 153 } 154 155 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN); 156 if (p != NULL) { 157 size_t m = ctx->m; 158 159 if (!OSSL_PARAM_set_size_t(p, m)) { 160 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); 161 return 0; 162 } 163 } 164 165 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV); 166 if (p != NULL) { 167 if (ccm_get_ivlen(ctx) > p->data_size) { 168 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH); 169 return 0; 170 } 171 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size) 172 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) { 173 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); 174 return 0; 175 } 176 } 177 178 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_UPDATED_IV); 179 if (p != NULL) { 180 if (ccm_get_ivlen(ctx) > p->data_size) { 181 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH); 182 return 0; 183 } 184 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size) 185 && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, p->data_size)) { 186 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); 187 return 0; 188 } 189 } 190 191 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN); 192 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) { 193 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); 194 return 0; 195 } 196 197 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD); 198 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) { 199 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); 200 return 0; 201 } 202 203 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG); 204 if (p != NULL) { 205 if (!ctx->enc || !ctx->tag_set) { 206 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_SET); 207 return 0; 208 } 209 if (p->data_type != OSSL_PARAM_OCTET_STRING) { 210 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER); 211 return 0; 212 } 213 if (!ctx->hw->gettag(ctx, p->data, p->data_size)) 214 return 0; 215 ctx->tag_set = 0; 216 ctx->iv_set = 0; 217 ctx->len_set = 0; 218 } 219 return 1; 220 } 221 222 static int ccm_init(void *vctx, const unsigned char *key, size_t keylen, 223 const unsigned char *iv, size_t ivlen, 224 const OSSL_PARAM params[], int enc) 225 { 226 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx; 227 228 if (!ossl_prov_is_running()) 229 return 0; 230 231 ctx->enc = enc; 232 233 if (iv != NULL) { 234 if (ivlen != ccm_get_ivlen(ctx)) { 235 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH); 236 return 0; 237 } 238 memcpy(ctx->iv, iv, ivlen); 239 ctx->iv_set = 1; 240 } 241 if (key != NULL) { 242 if (keylen != ctx->keylen) { 243 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); 244 return 0; 245 } 246 if (!ctx->hw->setkey(ctx, key, keylen)) 247 return 0; 248 } 249 return ossl_ccm_set_ctx_params(ctx, params); 250 } 251 252 int ossl_ccm_einit(void *vctx, const unsigned char *key, size_t keylen, 253 const unsigned char *iv, size_t ivlen, 254 const OSSL_PARAM params[]) 255 { 256 return ccm_init(vctx, key, keylen, iv, ivlen, params, 1); 257 } 258 259 int ossl_ccm_dinit(void *vctx, const unsigned char *key, size_t keylen, 260 const unsigned char *iv, size_t ivlen, 261 const OSSL_PARAM params[]) 262 { 263 return ccm_init(vctx, key, keylen, iv, ivlen, params, 0); 264 } 265 266 int ossl_ccm_stream_update(void *vctx, unsigned char *out, size_t *outl, 267 size_t outsize, const unsigned char *in, 268 size_t inl) 269 { 270 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx; 271 272 if (outsize < inl) { 273 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); 274 return 0; 275 } 276 277 if (!ccm_cipher_internal(ctx, out, outl, in, inl)) { 278 ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED); 279 return 0; 280 } 281 return 1; 282 } 283 284 int ossl_ccm_stream_final(void *vctx, unsigned char *out, size_t *outl, 285 size_t outsize) 286 { 287 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx; 288 int i; 289 290 if (!ossl_prov_is_running()) 291 return 0; 292 293 i = ccm_cipher_internal(ctx, out, outl, NULL, 0); 294 if (i <= 0) 295 return 0; 296 297 *outl = 0; 298 return 1; 299 } 300 301 int ossl_ccm_cipher(void *vctx, unsigned char *out, size_t *outl, size_t outsize, 302 const unsigned char *in, size_t inl) 303 { 304 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx; 305 306 if (!ossl_prov_is_running()) 307 return 0; 308 309 if (outsize < inl) { 310 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); 311 return 0; 312 } 313 314 if (ccm_cipher_internal(ctx, out, outl, in, inl) <= 0) 315 return 0; 316 317 *outl = inl; 318 return 1; 319 } 320 321 /* Copy the buffered iv */ 322 static int ccm_set_iv(PROV_CCM_CTX *ctx, size_t mlen) 323 { 324 const PROV_CCM_HW *hw = ctx->hw; 325 326 if (!hw->setiv(ctx, ctx->iv, ccm_get_ivlen(ctx), mlen)) 327 return 0; 328 ctx->len_set = 1; 329 return 1; 330 } 331 332 static int ccm_tls_cipher(PROV_CCM_CTX *ctx, 333 unsigned char *out, size_t *padlen, 334 const unsigned char *in, size_t len) 335 { 336 int rv = 0; 337 size_t olen = 0; 338 339 if (!ossl_prov_is_running()) 340 goto err; 341 342 /* Encrypt/decrypt must be performed in place */ 343 if (in == NULL || out != in || len < EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m) 344 goto err; 345 346 /* If encrypting set explicit IV from sequence number (start of AAD) */ 347 if (ctx->enc) 348 memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN); 349 /* Get rest of IV from explicit IV */ 350 memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN); 351 /* Correct length value */ 352 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m; 353 if (!ccm_set_iv(ctx, len)) 354 goto err; 355 356 /* Use saved AAD */ 357 if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len)) 358 goto err; 359 360 /* Fix buffer to point to payload */ 361 in += EVP_CCM_TLS_EXPLICIT_IV_LEN; 362 out += EVP_CCM_TLS_EXPLICIT_IV_LEN; 363 if (ctx->enc) { 364 if (!ctx->hw->auth_encrypt(ctx, in, out, len, out + len, ctx->m)) 365 goto err; 366 olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m; 367 } else { 368 if (!ctx->hw->auth_decrypt(ctx, in, out, len, 369 (unsigned char *)in + len, ctx->m)) 370 goto err; 371 olen = len; 372 } 373 rv = 1; 374 err: 375 *padlen = olen; 376 return rv; 377 } 378 379 static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out, 380 size_t *padlen, const unsigned char *in, 381 size_t len) 382 { 383 int rv = 0; 384 size_t olen = 0; 385 const PROV_CCM_HW *hw = ctx->hw; 386 387 /* If no key set, return error */ 388 if (!ctx->key_set) 389 return 0; 390 391 if (ctx->tls_aad_len != UNINITIALISED_SIZET) 392 return ccm_tls_cipher(ctx, out, padlen, in, len); 393 394 /* EVP_*Final() doesn't return any data */ 395 if (in == NULL && out != NULL) 396 goto finish; 397 398 if (!ctx->iv_set) 399 goto err; 400 401 if (out == NULL) { 402 if (in == NULL) { 403 if (!ccm_set_iv(ctx, len)) 404 goto err; 405 } else { 406 /* If we have AAD, we need a message length */ 407 if (!ctx->len_set && len) 408 goto err; 409 if (!hw->setaad(ctx, in, len)) 410 goto err; 411 } 412 } else { 413 /* If not set length yet do it */ 414 if (!ctx->len_set && !ccm_set_iv(ctx, len)) 415 goto err; 416 417 if (ctx->enc) { 418 if (!hw->auth_encrypt(ctx, in, out, len, NULL, 0)) 419 goto err; 420 ctx->tag_set = 1; 421 } else { 422 /* The tag must be set before actually decrypting data */ 423 if (!ctx->tag_set) 424 goto err; 425 426 if (!hw->auth_decrypt(ctx, in, out, len, ctx->buf, ctx->m)) 427 goto err; 428 /* Finished - reset flags so calling this method again will fail */ 429 ctx->iv_set = 0; 430 ctx->tag_set = 0; 431 ctx->len_set = 0; 432 } 433 } 434 olen = len; 435 finish: 436 rv = 1; 437 err: 438 *padlen = olen; 439 return rv; 440 } 441 442 void ossl_ccm_initctx(PROV_CCM_CTX *ctx, size_t keybits, const PROV_CCM_HW *hw) 443 { 444 ctx->keylen = keybits / 8; 445 ctx->key_set = 0; 446 ctx->iv_set = 0; 447 ctx->tag_set = 0; 448 ctx->len_set = 0; 449 ctx->l = 8; 450 ctx->m = 12; 451 ctx->tls_aad_len = UNINITIALISED_SIZET; 452 ctx->hw = hw; 453 } 454