1 /* Copyright (c) 2017, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/aead.h>
16
17 #include <assert.h>
18
19 #include <openssl/cipher.h>
20 #include <openssl/crypto.h>
21 #include <openssl/err.h>
22 #include <openssl/sha.h>
23
24 #include "../fipsmodule/cipher/internal.h"
25
26
27 #define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
28 #define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
29
30 struct aead_aes_ctr_hmac_sha256_ctx {
31 union {
32 double align;
33 AES_KEY ks;
34 } ks;
35 ctr128_f ctr;
36 block128_f block;
37 SHA256_CTX inner_init_state;
38 SHA256_CTX outer_init_state;
39 };
40
41 static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
42 sizeof(struct aead_aes_ctr_hmac_sha256_ctx),
43 "AEAD state is too small");
44 static_assert(alignof(union evp_aead_ctx_st_state) >=
45 alignof(struct aead_aes_ctr_hmac_sha256_ctx),
46 "AEAD state has insufficient alignment");
47
hmac_init(SHA256_CTX * out_inner,SHA256_CTX * out_outer,const uint8_t hmac_key[32])48 static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer,
49 const uint8_t hmac_key[32]) {
50 static const size_t hmac_key_len = 32;
51 uint8_t block[SHA256_CBLOCK];
52 OPENSSL_memcpy(block, hmac_key, hmac_key_len);
53 OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len);
54
55 unsigned i;
56 for (i = 0; i < hmac_key_len; i++) {
57 block[i] ^= 0x36;
58 }
59
60 SHA256_Init(out_inner);
61 SHA256_Update(out_inner, block, sizeof(block));
62
63 OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len);
64 for (i = 0; i < hmac_key_len; i++) {
65 block[i] ^= (0x36 ^ 0x5c);
66 }
67
68 SHA256_Init(out_outer);
69 SHA256_Update(out_outer, block, sizeof(block));
70 }
71
aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len)72 static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
73 size_t key_len, size_t tag_len) {
74 struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
75 (struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state;
76 static const size_t hmac_key_len = 32;
77
78 if (key_len < hmac_key_len) {
79 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
80 return 0; // EVP_AEAD_CTX_init should catch this.
81 }
82
83 const size_t aes_key_len = key_len - hmac_key_len;
84 if (aes_key_len != 16 && aes_key_len != 32) {
85 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
86 return 0; // EVP_AEAD_CTX_init should catch this.
87 }
88
89 if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
90 tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN;
91 }
92
93 if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) {
94 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
95 return 0;
96 }
97
98 aes_ctx->ctr =
99 aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len);
100 ctx->tag_len = tag_len;
101 hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state,
102 key + aes_key_len);
103
104 return 1;
105 }
106
aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX * ctx)107 static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {}
108
hmac_update_uint64(SHA256_CTX * sha256,uint64_t value)109 static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
110 unsigned i;
111 uint8_t bytes[8];
112
113 for (i = 0; i < sizeof(bytes); i++) {
114 bytes[i] = value & 0xff;
115 value >>= 8;
116 }
117 SHA256_Update(sha256, bytes, sizeof(bytes));
118 }
119
hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],const SHA256_CTX * inner_init_state,const SHA256_CTX * outer_init_state,const uint8_t * ad,size_t ad_len,const uint8_t * nonce,const uint8_t * ciphertext,size_t ciphertext_len)120 static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
121 const SHA256_CTX *inner_init_state,
122 const SHA256_CTX *outer_init_state,
123 const uint8_t *ad, size_t ad_len,
124 const uint8_t *nonce, const uint8_t *ciphertext,
125 size_t ciphertext_len) {
126 SHA256_CTX sha256;
127 OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
128 hmac_update_uint64(&sha256, ad_len);
129 hmac_update_uint64(&sha256, ciphertext_len);
130 SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
131 SHA256_Update(&sha256, ad, ad_len);
132
133 // Pad with zeros to the end of the SHA-256 block.
134 const unsigned num_padding =
135 (SHA256_CBLOCK - ((sizeof(uint64_t)*2 +
136 EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) %
137 SHA256_CBLOCK)) %
138 SHA256_CBLOCK;
139 uint8_t padding[SHA256_CBLOCK];
140 OPENSSL_memset(padding, 0, num_padding);
141 SHA256_Update(&sha256, padding, num_padding);
142
143 SHA256_Update(&sha256, ciphertext, ciphertext_len);
144
145 uint8_t inner_digest[SHA256_DIGEST_LENGTH];
146 SHA256_Final(inner_digest, &sha256);
147
148 OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256));
149 SHA256_Update(&sha256, inner_digest, sizeof(inner_digest));
150 SHA256_Final(out, &sha256);
151 }
152
aead_aes_ctr_hmac_sha256_crypt(const struct aead_aes_ctr_hmac_sha256_ctx * aes_ctx,uint8_t * out,const uint8_t * in,size_t len,const uint8_t * nonce)153 static void aead_aes_ctr_hmac_sha256_crypt(
154 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out,
155 const uint8_t *in, size_t len, const uint8_t *nonce) {
156 // Since the AEAD operation is one-shot, keeping a buffer of unused keystream
157 // bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it.
158 uint8_t partial_block_buffer[AES_BLOCK_SIZE];
159 unsigned partial_block_offset = 0;
160 OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
161
162 uint8_t counter[AES_BLOCK_SIZE];
163 OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
164 OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4);
165
166 if (aes_ctx->ctr) {
167 CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter,
168 partial_block_buffer, &partial_block_offset,
169 aes_ctx->ctr);
170 } else {
171 CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter,
172 partial_block_buffer, &partial_block_offset,
173 aes_ctx->block);
174 }
175 }
176
aead_aes_ctr_hmac_sha256_seal_scatter(const EVP_AEAD_CTX * ctx,uint8_t * out,uint8_t * out_tag,size_t * out_tag_len,size_t max_out_tag_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * extra_in,size_t extra_in_len,const uint8_t * ad,size_t ad_len)177 static int aead_aes_ctr_hmac_sha256_seal_scatter(
178 const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
179 size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
180 size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
181 size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
182 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
183 (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
184 const uint64_t in_len_64 = in_len;
185
186 if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
187 // This input is so large it would overflow the 32-bit block counter.
188 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
189 return 0;
190 }
191
192 if (max_out_tag_len < ctx->tag_len) {
193 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
194 return 0;
195 }
196
197 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
198 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
199 return 0;
200 }
201
202 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
203
204 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
205 hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
206 &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len);
207 OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len);
208 *out_tag_len = ctx->tag_len;
209
210 return 1;
211 }
212
aead_aes_ctr_hmac_sha256_open_gather(const EVP_AEAD_CTX * ctx,uint8_t * out,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * in_tag,size_t in_tag_len,const uint8_t * ad,size_t ad_len)213 static int aead_aes_ctr_hmac_sha256_open_gather(
214 const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce,
215 size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag,
216 size_t in_tag_len, const uint8_t *ad, size_t ad_len) {
217 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
218 (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
219
220 if (in_tag_len != ctx->tag_len) {
221 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
222 return 0;
223 }
224
225 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
226 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
227 return 0;
228 }
229
230 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
231 hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
232 &aes_ctx->outer_init_state, ad, ad_len, nonce, in,
233 in_len);
234 if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) {
235 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
236 return 0;
237 }
238
239 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
240
241 return 1;
242 }
243
244 static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
245 16 /* AES key */ + 32 /* HMAC key */,
246 12, // nonce length
247 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead
248 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length
249 0, // seal_scatter_supports_extra_in
250
251 aead_aes_ctr_hmac_sha256_init,
252 NULL /* init_with_direction */,
253 aead_aes_ctr_hmac_sha256_cleanup,
254 NULL /* open */,
255 aead_aes_ctr_hmac_sha256_seal_scatter,
256 aead_aes_ctr_hmac_sha256_open_gather,
257 NULL /* get_iv */,
258 NULL /* tag_len */,
259 };
260
261 static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
262 32 /* AES key */ + 32 /* HMAC key */,
263 12, // nonce length
264 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead
265 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length
266 0, // seal_scatter_supports_extra_in
267
268 aead_aes_ctr_hmac_sha256_init,
269 NULL /* init_with_direction */,
270 aead_aes_ctr_hmac_sha256_cleanup,
271 NULL /* open */,
272 aead_aes_ctr_hmac_sha256_seal_scatter,
273 aead_aes_ctr_hmac_sha256_open_gather,
274 NULL /* get_iv */,
275 NULL /* tag_len */,
276 };
277
EVP_aead_aes_128_ctr_hmac_sha256(void)278 const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) {
279 return &aead_aes_128_ctr_hmac_sha256;
280 }
281
EVP_aead_aes_256_ctr_hmac_sha256(void)282 const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) {
283 return &aead_aes_256_ctr_hmac_sha256;
284 }
285