1/*
2 * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/* chacha20_poly1305 cipher implementation */
11
12#include "cipher_chacha20_poly1305.h"
13
14static int chacha_poly1305_tls_init(PROV_CIPHER_CTX *bctx,
15 unsigned char *aad, size_t alen)
16{
17 unsigned int len;
18 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
19
20 if (alen != EVP_AEAD_TLS1_AAD_LEN)
21 return 0;
22
23 memcpy(ctx->tls_aad, aad, EVP_AEAD_TLS1_AAD_LEN);
24 len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 | aad[EVP_AEAD_TLS1_AAD_LEN - 1];
25 aad = ctx->tls_aad;
26 if (!bctx->enc) {
27 if (len < POLY1305_BLOCK_SIZE)
28 return 0;
29 len -= POLY1305_BLOCK_SIZE; /* discount attached tag */
30 aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
31 aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
32 }
33 ctx->tls_payload_length = len;
34
35 /* merge record sequence number as per RFC7905 */
36 ctx->chacha.counter[1] = ctx->nonce[0];
37 ctx->chacha.counter[2] = ctx->nonce[1] ^ CHACHA_U8TOU32(aad);
38 ctx->chacha.counter[3] = ctx->nonce[2] ^ CHACHA_U8TOU32(aad+4);
39 ctx->mac_inited = 0;
40
41 return POLY1305_BLOCK_SIZE; /* tag length */
42}
43
44static int chacha_poly1305_tls_iv_set_fixed(PROV_CIPHER_CTX *bctx,
45 unsigned char *fixed, size_t flen)
46{
47 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
48
49 if (flen != CHACHA20_POLY1305_IVLEN)
50 return 0;
51 ctx->nonce[0] = ctx->chacha.counter[1] = CHACHA_U8TOU32(fixed);
52 ctx->nonce[1] = ctx->chacha.counter[2] = CHACHA_U8TOU32(fixed + 4);
53 ctx->nonce[2] = ctx->chacha.counter[3] = CHACHA_U8TOU32(fixed + 8);
54 return 1;
55}
56
57
58static int chacha20_poly1305_initkey(PROV_CIPHER_CTX *bctx,
59 const unsigned char *key, size_t keylen)
60{
61 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
62
63 ctx->len.aad = 0;
64 ctx->len.text = 0;
65 ctx->aad = 0;
66 ctx->mac_inited = 0;
67 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
68
69 if (bctx->enc)
70 return chacha20_einit(&ctx->chacha, key, keylen, NULL, 0);
71 else
72 return chacha20_dinit(&ctx->chacha, key, keylen, NULL, 0);
73}
74
75static int chacha20_poly1305_initiv(PROV_CIPHER_CTX *bctx)
76{
77 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
78 unsigned char tempiv[CHACHA_CTR_SIZE] = { 0 };
79 int ret = 1;
80
81 /* pad on the left */
82 if (ctx->nonce_len <= CHACHA_CTR_SIZE) {
83 memcpy(tempiv + CHACHA_CTR_SIZE - ctx->nonce_len, bctx->oiv,
84 ctx->nonce_len);
85
86 if (bctx->enc)
87 ret = chacha20_einit(&ctx->chacha, NULL, 0, tempiv, sizeof(tempiv));
88 else
89 ret = chacha20_dinit(&ctx->chacha, NULL, 0, tempiv, sizeof(tempiv));
90 ctx->nonce[0] = ctx->chacha.counter[1];
91 ctx->nonce[1] = ctx->chacha.counter[2];
92 ctx->nonce[2] = ctx->chacha.counter[3];
93 bctx->iv_set = 1;
94 }
95 return ret;
96}
97
98#if !defined(OPENSSL_SMALL_FOOTPRINT)
99
100# if defined(POLY1305_ASM) && (defined(__x86_64) || defined(__x86_64__) \
101 || defined(_M_AMD64) || defined(_M_X64))
102# define XOR128_HELPERS
103void *xor128_encrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
104void *xor128_decrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
105static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 };
106# else
107static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
108# endif
109
110static int chacha20_poly1305_tls_cipher(PROV_CIPHER_CTX *bctx,
111 unsigned char *out,
112 size_t *out_padlen,
113 const unsigned char *in, size_t len)
114{
115 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
116 POLY1305 *poly = &ctx->poly1305;
117 size_t tail, tohash_len, buf_len, plen = ctx->tls_payload_length;
118 unsigned char *buf, *tohash, *ctr, storage[sizeof(zero) + 32];
119
120 const union {
121 long one;
122 char little;
123 } is_endian = { 1 };
124
125 if (len != plen + POLY1305_BLOCK_SIZE)
126 return 0;
127
128 buf = storage + ((0 - (size_t)storage) & 15); /* align */
129 ctr = buf + CHACHA_BLK_SIZE;
130 tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;
131
132# ifdef XOR128_HELPERS
133 if (plen <= 3 * CHACHA_BLK_SIZE) {
134 ctx->chacha.counter[0] = 0;
135 buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE);
136 ChaCha20_ctr32(buf, zero, buf_len, ctx->chacha.key.d, ctx->chacha.counter);
137 Poly1305_Init(poly, buf);
138 ctx->chacha.partial_len = 0;
139 memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
140 tohash_len = POLY1305_BLOCK_SIZE;
141 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
142 ctx->len.text = plen;
143
144 if (plen) {
145 if (bctx->enc)
146 ctr = xor128_encrypt_n_pad(out, in, ctr, plen);
147 else
148 ctr = xor128_decrypt_n_pad(out, in, ctr, plen);
149
150 in += plen;
151 out += plen;
152 tohash_len = (size_t)(ctr - tohash);
153 }
154 }
155# else
156 if (plen <= CHACHA_BLK_SIZE) {
157 size_t i;
158
159 ctx->chacha.counter[0] = 0;
160 ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE),
161 ctx->chacha.key.d, ctx->chacha.counter);
162 Poly1305_Init(poly, buf);
163 ctx->chacha.partial_len = 0;
164 memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
165 tohash_len = POLY1305_BLOCK_SIZE;
166 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
167 ctx->len.text = plen;
168
169 if (bctx->enc) {
170 for (i = 0; i < plen; i++)
171 out[i] = ctr[i] ^= in[i];
172 } else {
173 for (i = 0; i < plen; i++) {
174 unsigned char c = in[i];
175
176 out[i] = ctr[i] ^ c;
177 ctr[i] = c;
178 }
179 }
180
181 in += i;
182 out += i;
183
184 tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
185 memset(ctr + i, 0, tail);
186 ctr += i + tail;
187 tohash_len += i + tail;
188 }
189# endif
190 else {
191 ctx->chacha.counter[0] = 0;
192 ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE),
193 ctx->chacha.key.d, ctx->chacha.counter);
194 Poly1305_Init(poly, buf);
195 ctx->chacha.counter[0] = 1;
196 ctx->chacha.partial_len = 0;
197 Poly1305_Update(poly, ctx->tls_aad, POLY1305_BLOCK_SIZE);
198 tohash = ctr;
199 tohash_len = 0;
200 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
201 ctx->len.text = plen;
202
203 if (bctx->enc) {
204 ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
205 Poly1305_Update(poly, out, plen);
206 } else {
207 Poly1305_Update(poly, in, plen);
208 ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
209 }
210
211 in += plen;
212 out += plen;
213 tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
214 Poly1305_Update(poly, zero, tail);
215 }
216
217 if (is_endian.little) {
218 memcpy(ctr, (unsigned char *)&ctx->len, POLY1305_BLOCK_SIZE);
219 } else {
220 ctr[0] = (unsigned char)(ctx->len.aad);
221 ctr[1] = (unsigned char)(ctx->len.aad>>8);
222 ctr[2] = (unsigned char)(ctx->len.aad>>16);
223 ctr[3] = (unsigned char)(ctx->len.aad>>24);
224 ctr[4] = (unsigned char)(ctx->len.aad>>32);
225 ctr[5] = (unsigned char)(ctx->len.aad>>40);
226 ctr[6] = (unsigned char)(ctx->len.aad>>48);
227 ctr[7] = (unsigned char)(ctx->len.aad>>56);
228
229 ctr[8] = (unsigned char)(ctx->len.text);
230 ctr[9] = (unsigned char)(ctx->len.text>>8);
231 ctr[10] = (unsigned char)(ctx->len.text>>16);
232 ctr[11] = (unsigned char)(ctx->len.text>>24);
233 ctr[12] = (unsigned char)(ctx->len.text>>32);
234 ctr[13] = (unsigned char)(ctx->len.text>>40);
235 ctr[14] = (unsigned char)(ctx->len.text>>48);
236 ctr[15] = (unsigned char)(ctx->len.text>>56);
237 }
238 tohash_len += POLY1305_BLOCK_SIZE;
239
240 Poly1305_Update(poly, tohash, tohash_len);
241 OPENSSL_cleanse(buf, buf_len);
242 Poly1305_Final(poly, bctx->enc ? ctx->tag : tohash);
243
244 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
245
246 if (bctx->enc) {
247 memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
248 } else {
249 if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
250 if (len > POLY1305_BLOCK_SIZE)
251 memset(out - (len - POLY1305_BLOCK_SIZE), 0,
252 len - POLY1305_BLOCK_SIZE);
253 return 0;
254 }
255 }
256
257 *out_padlen = len;
258 return 1;
259}
260#else
261static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 };
262#endif /* OPENSSL_SMALL_FOOTPRINT */
263
264static int chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX *bctx,
265 unsigned char *out, size_t *outl,
266 const unsigned char *in, size_t inl)
267{
268 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
269 POLY1305 *poly = &ctx->poly1305;
270 size_t rem, plen = ctx->tls_payload_length;
271 size_t olen = 0;
272 int rv = 0;
273
274 const union {
275 long one;
276 char little;
277 } is_endian = { 1 };
278
279 if (!ctx->mac_inited) {
280#if !defined(OPENSSL_SMALL_FOOTPRINT)
281 if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL) {
282 return chacha20_poly1305_tls_cipher(bctx, out, outl, in, inl);
283 }
284#endif
285 ctx->chacha.counter[0] = 0;
286 ChaCha20_ctr32(ctx->chacha.buf, zero, CHACHA_BLK_SIZE,
287 ctx->chacha.key.d, ctx->chacha.counter);
288 Poly1305_Init(poly, ctx->chacha.buf);
289 ctx->chacha.counter[0] = 1;
290 ctx->chacha.partial_len = 0;
291 ctx->len.aad = ctx->len.text = 0;
292 ctx->mac_inited = 1;
293 if (plen != NO_TLS_PAYLOAD_LENGTH) {
294 Poly1305_Update(poly, ctx->tls_aad, EVP_AEAD_TLS1_AAD_LEN);
295 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
296 ctx->aad = 1;
297 }
298 }
299
300 if (in != NULL) { /* aad or text */
301 if (out == NULL) { /* aad */
302 Poly1305_Update(poly, in, inl);
303 ctx->len.aad += inl;
304 ctx->aad = 1;
305 goto finish;
306 } else { /* plain- or ciphertext */
307 if (ctx->aad) { /* wrap up aad */
308 if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
309 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
310 ctx->aad = 0;
311 }
312
313 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
314 if (plen == NO_TLS_PAYLOAD_LENGTH)
315 plen = inl;
316 else if (inl != plen + POLY1305_BLOCK_SIZE)
317 goto err;
318
319 if (bctx->enc) { /* plaintext */
320 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
321 Poly1305_Update(poly, out, plen);
322 in += plen;
323 out += plen;
324 ctx->len.text += plen;
325 } else { /* ciphertext */
326 Poly1305_Update(poly, in, plen);
327 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
328 in += plen;
329 out += plen;
330 ctx->len.text += plen;
331 }
332 }
333 }
334 /* explicit final, or tls mode */
335 if (in == NULL || inl != plen) {
336
337 unsigned char temp[POLY1305_BLOCK_SIZE];
338
339 if (ctx->aad) { /* wrap up aad */
340 if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
341 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
342 ctx->aad = 0;
343 }
344
345 if ((rem = (size_t)ctx->len.text % POLY1305_BLOCK_SIZE))
346 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
347
348 if (is_endian.little) {
349 Poly1305_Update(poly, (unsigned char *)&ctx->len,
350 POLY1305_BLOCK_SIZE);
351 } else {
352 temp[0] = (unsigned char)(ctx->len.aad);
353 temp[1] = (unsigned char)(ctx->len.aad>>8);
354 temp[2] = (unsigned char)(ctx->len.aad>>16);
355 temp[3] = (unsigned char)(ctx->len.aad>>24);
356 temp[4] = (unsigned char)(ctx->len.aad>>32);
357 temp[5] = (unsigned char)(ctx->len.aad>>40);
358 temp[6] = (unsigned char)(ctx->len.aad>>48);
359 temp[7] = (unsigned char)(ctx->len.aad>>56);
360 temp[8] = (unsigned char)(ctx->len.text);
361 temp[9] = (unsigned char)(ctx->len.text>>8);
362 temp[10] = (unsigned char)(ctx->len.text>>16);
363 temp[11] = (unsigned char)(ctx->len.text>>24);
364 temp[12] = (unsigned char)(ctx->len.text>>32);
365 temp[13] = (unsigned char)(ctx->len.text>>40);
366 temp[14] = (unsigned char)(ctx->len.text>>48);
367 temp[15] = (unsigned char)(ctx->len.text>>56);
368 Poly1305_Update(poly, temp, POLY1305_BLOCK_SIZE);
369 }
370 Poly1305_Final(poly, bctx->enc ? ctx->tag : temp);
371 ctx->mac_inited = 0;
372
373 if (in != NULL && inl != plen) {
374 if (bctx->enc) {
375 memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
376 } else {
377 if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
378 memset(out - plen, 0, plen);
379 goto err;
380 }
381 }
382 }
383 else if (!bctx->enc) {
384 if (CRYPTO_memcmp(temp, ctx->tag, ctx->tag_len))
385 goto err;
386 }
387 }
388finish:
389 olen = inl;
390 rv = 1;
391err:
392 *outl = olen;
393 return rv;
394}
395
396static const PROV_CIPHER_HW_CHACHA20_POLY1305 chacha20poly1305_hw =
397{
398 { chacha20_poly1305_initkey, NULL },
399 chacha20_poly1305_aead_cipher,
400 chacha20_poly1305_initiv,
401 chacha_poly1305_tls_init,
402 chacha_poly1305_tls_iv_set_fixed
403};
404
405const PROV_CIPHER_HW *PROV_CIPHER_HW_chacha20_poly1305(size_t keybits)
406{
407 return (PROV_CIPHER_HW *)&chacha20poly1305_hw;
408}
409