Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 1 | /* Copyright (c) 2017, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
| 15 | #include <openssl/aead.h> |
| 16 | #include <openssl/cipher.h> |
| 17 | #include <openssl/crypto.h> |
| 18 | #include <openssl/err.h> |
| 19 | #include <openssl/sha.h> |
| 20 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 21 | #include "../fipsmodule/cipher/internal.h" |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 22 | |
| 23 | |
| 24 | #define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH |
| 25 | #define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12 |
| 26 | |
| 27 | struct aead_aes_ctr_hmac_sha256_ctx { |
| 28 | union { |
| 29 | double align; |
| 30 | AES_KEY ks; |
| 31 | } ks; |
| 32 | ctr128_f ctr; |
| 33 | block128_f block; |
| 34 | SHA256_CTX inner_init_state; |
| 35 | SHA256_CTX outer_init_state; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 36 | }; |
| 37 | |
| 38 | static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer, |
| 39 | const uint8_t hmac_key[32]) { |
| 40 | static const size_t hmac_key_len = 32; |
| 41 | uint8_t block[SHA256_CBLOCK]; |
| 42 | OPENSSL_memcpy(block, hmac_key, hmac_key_len); |
| 43 | OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len); |
| 44 | |
| 45 | unsigned i; |
| 46 | for (i = 0; i < hmac_key_len; i++) { |
| 47 | block[i] ^= 0x36; |
| 48 | } |
| 49 | |
| 50 | SHA256_Init(out_inner); |
| 51 | SHA256_Update(out_inner, block, sizeof(block)); |
| 52 | |
| 53 | OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len); |
| 54 | for (i = 0; i < hmac_key_len; i++) { |
| 55 | block[i] ^= (0x36 ^ 0x5c); |
| 56 | } |
| 57 | |
| 58 | SHA256_Init(out_outer); |
| 59 | SHA256_Update(out_outer, block, sizeof(block)); |
| 60 | } |
| 61 | |
| 62 | static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key, |
| 63 | size_t key_len, size_t tag_len) { |
| 64 | struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx; |
| 65 | static const size_t hmac_key_len = 32; |
| 66 | |
| 67 | if (key_len < hmac_key_len) { |
| 68 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); |
| 69 | return 0; /* EVP_AEAD_CTX_init should catch this. */ |
| 70 | } |
| 71 | |
| 72 | const size_t aes_key_len = key_len - hmac_key_len; |
| 73 | if (aes_key_len != 16 && aes_key_len != 32) { |
| 74 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); |
| 75 | return 0; /* EVP_AEAD_CTX_init should catch this. */ |
| 76 | } |
| 77 | |
| 78 | if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) { |
| 79 | tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN; |
| 80 | } |
| 81 | |
| 82 | if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) { |
| 83 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE); |
| 84 | return 0; |
| 85 | } |
| 86 | |
| 87 | aes_ctx = OPENSSL_malloc(sizeof(struct aead_aes_ctr_hmac_sha256_ctx)); |
| 88 | if (aes_ctx == NULL) { |
| 89 | OPENSSL_PUT_ERROR(CIPHER, ERR_R_MALLOC_FAILURE); |
| 90 | return 0; |
| 91 | } |
| 92 | |
| 93 | aes_ctx->ctr = |
| 94 | aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 95 | ctx->tag_len = tag_len; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 96 | hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state, |
| 97 | key + aes_key_len); |
| 98 | |
| 99 | ctx->aead_state = aes_ctx; |
| 100 | |
| 101 | return 1; |
| 102 | } |
| 103 | |
| 104 | static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) { |
| 105 | struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state; |
| 106 | OPENSSL_cleanse(aes_ctx, sizeof(struct aead_aes_ctr_hmac_sha256_ctx)); |
| 107 | OPENSSL_free(aes_ctx); |
| 108 | } |
| 109 | |
| 110 | static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) { |
| 111 | unsigned i; |
| 112 | uint8_t bytes[8]; |
| 113 | |
| 114 | for (i = 0; i < sizeof(bytes); i++) { |
| 115 | bytes[i] = value & 0xff; |
| 116 | value >>= 8; |
| 117 | } |
| 118 | SHA256_Update(sha256, bytes, sizeof(bytes)); |
| 119 | } |
| 120 | |
| 121 | static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH], |
| 122 | const SHA256_CTX *inner_init_state, |
| 123 | const SHA256_CTX *outer_init_state, |
| 124 | const uint8_t *ad, size_t ad_len, |
| 125 | const uint8_t *nonce, const uint8_t *ciphertext, |
| 126 | size_t ciphertext_len) { |
| 127 | SHA256_CTX sha256; |
| 128 | OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256)); |
| 129 | hmac_update_uint64(&sha256, ad_len); |
| 130 | hmac_update_uint64(&sha256, ciphertext_len); |
| 131 | SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN); |
| 132 | SHA256_Update(&sha256, ad, ad_len); |
| 133 | |
| 134 | /* Pad with zeros to the end of the SHA-256 block. */ |
| 135 | const unsigned num_padding = |
| 136 | (SHA256_CBLOCK - ((sizeof(uint64_t)*2 + |
| 137 | EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) % |
| 138 | SHA256_CBLOCK)) % |
| 139 | SHA256_CBLOCK; |
| 140 | uint8_t padding[SHA256_CBLOCK]; |
| 141 | OPENSSL_memset(padding, 0, num_padding); |
| 142 | SHA256_Update(&sha256, padding, num_padding); |
| 143 | |
| 144 | SHA256_Update(&sha256, ciphertext, ciphertext_len); |
| 145 | |
| 146 | uint8_t inner_digest[SHA256_DIGEST_LENGTH]; |
| 147 | SHA256_Final(inner_digest, &sha256); |
| 148 | |
| 149 | OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256)); |
| 150 | SHA256_Update(&sha256, inner_digest, sizeof(inner_digest)); |
| 151 | SHA256_Final(out, &sha256); |
| 152 | } |
| 153 | |
| 154 | static void aead_aes_ctr_hmac_sha256_crypt( |
| 155 | const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out, |
| 156 | const uint8_t *in, size_t len, const uint8_t *nonce) { |
| 157 | /* Since the AEAD operation is one-shot, keeping a buffer of unused keystream |
| 158 | * bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it. */ |
| 159 | uint8_t partial_block_buffer[AES_BLOCK_SIZE]; |
| 160 | unsigned partial_block_offset = 0; |
| 161 | OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer)); |
| 162 | |
| 163 | uint8_t counter[AES_BLOCK_SIZE]; |
| 164 | OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN); |
| 165 | OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4); |
| 166 | |
| 167 | if (aes_ctx->ctr) { |
| 168 | CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter, |
| 169 | partial_block_buffer, &partial_block_offset, |
| 170 | aes_ctx->ctr); |
| 171 | } else { |
| 172 | CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter, |
| 173 | partial_block_buffer, &partial_block_offset, |
| 174 | aes_ctx->block); |
| 175 | } |
| 176 | } |
| 177 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 178 | static int aead_aes_ctr_hmac_sha256_seal_scatter( |
| 179 | const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag, |
| 180 | size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce, |
| 181 | size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad, |
| 182 | size_t ad_len) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 183 | const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state; |
| 184 | const uint64_t in_len_64 = in_len; |
| 185 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 186 | if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) { |
| 187 | /* This input is so large it would overflow the 32-bit block counter. */ |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 188 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE); |
| 189 | return 0; |
| 190 | } |
| 191 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 192 | if (max_out_tag_len < ctx->tag_len) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 193 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL); |
| 194 | return 0; |
| 195 | } |
| 196 | |
| 197 | if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) { |
| 198 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE); |
| 199 | return 0; |
| 200 | } |
| 201 | |
| 202 | aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce); |
| 203 | |
| 204 | uint8_t hmac_result[SHA256_DIGEST_LENGTH]; |
| 205 | hmac_calculate(hmac_result, &aes_ctx->inner_init_state, |
| 206 | &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 207 | OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len); |
| 208 | *out_tag_len = ctx->tag_len; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 209 | |
| 210 | return 1; |
| 211 | } |
| 212 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 213 | static int aead_aes_ctr_hmac_sha256_open_gather( |
| 214 | const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce, |
| 215 | size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag, |
| 216 | size_t in_tag_len, const uint8_t *ad, size_t ad_len) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 217 | const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 218 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 219 | if (in_tag_len != ctx->tag_len) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 220 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT); |
| 221 | return 0; |
| 222 | } |
| 223 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 224 | if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) { |
| 225 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE); |
| 226 | return 0; |
| 227 | } |
| 228 | |
| 229 | uint8_t hmac_result[SHA256_DIGEST_LENGTH]; |
| 230 | hmac_calculate(hmac_result, &aes_ctx->inner_init_state, |
| 231 | &aes_ctx->outer_init_state, ad, ad_len, nonce, in, |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 232 | in_len); |
| 233 | if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 234 | OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT); |
| 235 | return 0; |
| 236 | } |
| 237 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 238 | aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce); |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 239 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 240 | return 1; |
| 241 | } |
| 242 | |
| 243 | static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = { |
| 244 | 16 /* AES key */ + 32 /* HMAC key */, |
| 245 | 12, /* nonce length */ |
| 246 | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */ |
| 247 | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */ |
| 248 | |
| 249 | aead_aes_ctr_hmac_sha256_init, |
| 250 | NULL /* init_with_direction */, |
| 251 | aead_aes_ctr_hmac_sha256_cleanup, |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 252 | NULL /* open */, |
| 253 | aead_aes_ctr_hmac_sha256_seal_scatter, |
| 254 | aead_aes_ctr_hmac_sha256_open_gather, |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 255 | NULL /* get_iv */, |
| 256 | }; |
| 257 | |
| 258 | static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = { |
| 259 | 32 /* AES key */ + 32 /* HMAC key */, |
| 260 | 12, /* nonce length */ |
| 261 | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */ |
| 262 | EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */ |
| 263 | |
| 264 | aead_aes_ctr_hmac_sha256_init, |
| 265 | NULL /* init_with_direction */, |
| 266 | aead_aes_ctr_hmac_sha256_cleanup, |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 267 | NULL /* open */, |
| 268 | aead_aes_ctr_hmac_sha256_seal_scatter, |
| 269 | aead_aes_ctr_hmac_sha256_open_gather, |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 270 | NULL /* get_iv */, |
| 271 | }; |
| 272 | |
| 273 | const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) { |
| 274 | return &aead_aes_128_ctr_hmac_sha256; |
| 275 | } |
| 276 | |
| 277 | const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) { |
| 278 | return &aead_aes_256_ctr_hmac_sha256; |
| 279 | } |