1/*
2 * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/* Dispatch functions for ccm mode */
11
12#include "prov/ciphercommon.h"
13#include "prov/ciphercommon_ccm.h"
14#include "prov/providercommonerr.h"
15
16static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
17 size_t *padlen, const unsigned char *in,
18 size_t len);
19
20static int ccm_tls_init(PROV_CCM_CTX *ctx, unsigned char *aad, size_t alen)
21{
22 size_t len;
23
24 if (alen != EVP_AEAD_TLS1_AAD_LEN)
25 return 0;
26
27 /* Save the aad for later use. */
28 memcpy(ctx->buf, aad, alen);
29 ctx->tls_aad_len = alen;
30
31 len = ctx->buf[alen - 2] << 8 | ctx->buf[alen - 1];
32 if (len < EVP_CCM_TLS_EXPLICIT_IV_LEN)
33 return 0;
34
35 /* Correct length for explicit iv. */
36 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
37
38 if (!ctx->enc) {
39 if (len < ctx->m)
40 return 0;
41 /* Correct length for tag. */
42 len -= ctx->m;
43 }
44 ctx->buf[alen - 2] = (unsigned char)(len >> 8);
45 ctx->buf[alen - 1] = (unsigned char)(len & 0xff);
46
47 /* Extra padding: tag appended to record. */
48 return ctx->m;
49}
50
51static int ccm_tls_iv_set_fixed(PROV_CCM_CTX *ctx, unsigned char *fixed,
52 size_t flen)
53{
54 if (flen != EVP_CCM_TLS_FIXED_IV_LEN)
55 return 0;
56
57 /* Copy to first part of the iv. */
58 memcpy(ctx->iv, fixed, flen);
59 return 1;
60}
61
62static size_t ccm_get_ivlen(PROV_CCM_CTX *ctx)
63{
64 return 15 - ctx->l;
65}
66
67int ccm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
68{
69 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
70 const OSSL_PARAM *p;
71 size_t sz;
72
73 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG);
74 if (p != NULL) {
75 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
76 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
77 return 0;
78 }
79 if ((p->data_size & 1) || (p->data_size < 4) || p->data_size > 16) {
80 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAGLEN);
81 return 0;
82 }
83
84 if (p->data != NULL) {
85 if (ctx->enc) {
86 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOT_NEEDED);
87 return 0;
88 }
89 memcpy(ctx->buf, p->data, p->data_size);
90 ctx->tag_set = 1;
91 }
92 ctx->m = p->data_size;
93 }
94
95 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN);
96 if (p != NULL) {
97 size_t ivlen;
98
99 if (!OSSL_PARAM_get_size_t(p, &sz)) {
100 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
101 return 0;
102 }
103 ivlen = 15 - sz;
104 if (ivlen < 2 || ivlen > 8) {
105 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
106 return 0;
107 }
108 ctx->l = ivlen;
109 }
110
111 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
112 if (p != NULL) {
113 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
114 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
115 return 0;
116 }
117 sz = ccm_tls_init(ctx, p->data, p->data_size);
118 if (sz == 0) {
119 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DATA);
120 return 0;
121 }
122 ctx->tls_aad_pad_sz = sz;
123 }
124
125 p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED);
126 if (p != NULL) {
127 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
128 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
129 return 0;
130 }
131 if (ccm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
132 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
133 return 0;
134 }
135 }
136
137 return 1;
138}
139
140int ccm_get_ctx_params(void *vctx, OSSL_PARAM params[])
141{
142 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
143 OSSL_PARAM *p;
144
145 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN);
146 if (p != NULL && !OSSL_PARAM_set_size_t(p, ccm_get_ivlen(ctx))) {
147 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
148 return 0;
149 }
150
151 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN);
152 if (p != NULL) {
153 size_t m = ctx->m;
154
155 if (!OSSL_PARAM_set_size_t(p, m)) {
156 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
157 return 0;
158 }
159 }
160
161 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV);
162 if (p != NULL) {
163 if (ccm_get_ivlen(ctx) != p->data_size) {
164 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
165 return 0;
166 }
167 if (!OSSL_PARAM_set_octet_string(p, ctx->iv, p->data_size)) {
168 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
169 return 0;
170 }
171 }
172
173 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN);
174 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) {
175 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
176 return 0;
177 }
178
179 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD);
180 if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
181 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
182 return 0;
183 }
184
185 p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG);
186 if (p != NULL) {
187 if (!ctx->enc || !ctx->tag_set) {
188 ERR_raise(ERR_LIB_PROV, PROV_R_TAG_NOTSET);
189 return 0;
190 }
191 if (p->data_type != OSSL_PARAM_OCTET_STRING) {
192 ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
193 return 0;
194 }
195 if (!ctx->hw->gettag(ctx, p->data, p->data_size))
196 return 0;
197 ctx->tag_set = 0;
198 ctx->iv_set = 0;
199 ctx->len_set = 0;
200 }
201 return 1;
202}
203
204static int ccm_init(void *vctx, const unsigned char *key, size_t keylen,
205 const unsigned char *iv, size_t ivlen, int enc)
206{
207 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
208
209 ctx->enc = enc;
210
211 if (iv != NULL) {
212 if (ivlen != ccm_get_ivlen(ctx)) {
213 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IVLEN);
214 return 0;
215 }
216 memcpy(ctx->iv, iv, ivlen);
217 ctx->iv_set = 1;
218 }
219 if (key != NULL) {
220 if (keylen != ctx->keylen) {
221 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEYLEN);
222 return 0;
223 }
224 return ctx->hw->setkey(ctx, key, keylen);
225 }
226 return 1;
227}
228
229int ccm_einit(void *vctx, const unsigned char *key, size_t keylen,
230 const unsigned char *iv, size_t ivlen)
231{
232 return ccm_init(vctx, key, keylen, iv, ivlen, 1);
233}
234
235int ccm_dinit(void *vctx, const unsigned char *key, size_t keylen,
236 const unsigned char *iv, size_t ivlen)
237{
238 return ccm_init(vctx, key, keylen, iv, ivlen, 0);
239}
240
241int ccm_stream_update(void *vctx, unsigned char *out, size_t *outl,
242 size_t outsize, const unsigned char *in,
243 size_t inl)
244{
245 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
246
247 if (outsize < inl) {
248 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
249 return 0;
250 }
251
252 if (!ccm_cipher_internal(ctx, out, outl, in, inl)) {
253 ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
254 return 0;
255 }
256 return 1;
257}
258
259int ccm_stream_final(void *vctx, unsigned char *out, size_t *outl,
260 size_t outsize)
261{
262 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
263 int i;
264
265 i = ccm_cipher_internal(ctx, out, outl, NULL, 0);
266 if (i <= 0)
267 return 0;
268
269 *outl = 0;
270 return 1;
271}
272
273int ccm_cipher(void *vctx,
274 unsigned char *out, size_t *outl, size_t outsize,
275 const unsigned char *in, size_t inl)
276{
277 PROV_CCM_CTX *ctx = (PROV_CCM_CTX *)vctx;
278
279 if (outsize < inl) {
280 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
281 return 0;
282 }
283
284 if (ccm_cipher_internal(ctx, out, outl, in, inl) <= 0)
285 return 0;
286
287 *outl = inl;
288 return 1;
289}
290
291/* Copy the buffered iv */
292static int ccm_set_iv(PROV_CCM_CTX *ctx, size_t mlen)
293{
294 const PROV_CCM_HW *hw = ctx->hw;
295
296 if (!hw->setiv(ctx, ctx->iv, ccm_get_ivlen(ctx), mlen))
297 return 0;
298 ctx->len_set = 1;
299 return 1;
300}
301
302static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
303 unsigned char *out, size_t *padlen,
304 const unsigned char *in, size_t len)
305{
306 int rv = 0;
307 size_t olen = 0;
308
309 /* Encrypt/decrypt must be performed in place */
310 if (out != in || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)ctx->m))
311 goto err;
312
313 /* If encrypting set explicit IV from sequence number (start of AAD) */
314 if (ctx->enc)
315 memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
316 /* Get rest of IV from explicit IV */
317 memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
318 /* Correct length value */
319 len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
320 if (!ccm_set_iv(ctx, len))
321 goto err;
322
323 /* Use saved AAD */
324 if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))
325 goto err;
326
327 /* Fix buffer to point to payload */
328 in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
329 out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
330 if (ctx->enc) {
331 if (!ctx->hw->auth_encrypt(ctx, in, out, len, out + len, ctx->m))
332 goto err;
333 olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
334 } else {
335 if (!ctx->hw->auth_decrypt(ctx, in, out, len,
336 (unsigned char *)in + len, ctx->m))
337 goto err;
338 olen = len;
339 }
340 rv = 1;
341err:
342 *padlen = olen;
343 return rv;
344}
345
346static int ccm_cipher_internal(PROV_CCM_CTX *ctx, unsigned char *out,
347 size_t *padlen, const unsigned char *in,
348 size_t len)
349{
350 int rv = 0;
351 size_t olen = 0;
352 const PROV_CCM_HW *hw = ctx->hw;
353
354 /* If no key set, return error */
355 if (!ctx->key_set)
356 return 0;
357
358 if (ctx->tls_aad_len != UNINITIALISED_SIZET)
359 return ccm_tls_cipher(ctx, out, padlen, in, len);
360
361 /* EVP_*Final() doesn't return any data */
362 if (in == NULL && out != NULL)
363 goto finish;
364
365 if (!ctx->iv_set)
366 goto err;
367
368 if (out == NULL) {
369 if (in == NULL) {
370 if (!ccm_set_iv(ctx, len))
371 goto err;
372 } else {
373 /* If we have AAD, we need a message length */
374 if (!ctx->len_set && len)
375 goto err;
376 if (!hw->setaad(ctx, in, len))
377 goto err;
378 }
379 } else {
380 /* If not set length yet do it */
381 if (!ctx->len_set && !ccm_set_iv(ctx, len))
382 goto err;
383
384 if (ctx->enc) {
385 if (!hw->auth_encrypt(ctx, in, out, len, NULL, 0))
386 goto err;
387 ctx->tag_set = 1;
388 } else {
389 /* The tag must be set before actually decrypting data */
390 if (!ctx->tag_set)
391 goto err;
392
393 if (!hw->auth_decrypt(ctx, in, out, len, ctx->buf, ctx->m))
394 goto err;
395 /* Finished - reset flags so calling this method again will fail */
396 ctx->iv_set = 0;
397 ctx->tag_set = 0;
398 ctx->len_set = 0;
399 }
400 }
401 olen = len;
402finish:
403 rv = 1;
404err:
405 *padlen = olen;
406 return rv;
407}
408
409void ccm_initctx(PROV_CCM_CTX *ctx, size_t keybits, const PROV_CCM_HW *hw)
410{
411 ctx->keylen = keybits / 8;
412 ctx->key_set = 0;
413 ctx->iv_set = 0;
414 ctx->tag_set = 0;
415 ctx->len_set = 0;
416 ctx->l = 8;
417 ctx->m = 12;
418 ctx->tls_aad_len = UNINITIALISED_SIZET;
419 ctx->hw = hw;
420}
421
422