1/* Copyright (c) 2017, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15#include <openssl/aead.h>
16#include <openssl/cipher.h>
17#include <openssl/crypto.h>
18#include <openssl/err.h>
19#include <openssl/sha.h>
20
21#include "../fipsmodule/cipher/internal.h"
22
23
24#define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
25#define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
26
27struct aead_aes_ctr_hmac_sha256_ctx {
28 union {
29 double align;
30 AES_KEY ks;
31 } ks;
32 ctr128_f ctr;
33 block128_f block;
34 SHA256_CTX inner_init_state;
35 SHA256_CTX outer_init_state;
36};
37
38OPENSSL_STATIC_ASSERT(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
39 sizeof(struct aead_aes_ctr_hmac_sha256_ctx),
40 "AEAD state is too small");
41#if defined(__GNUC__) || defined(__clang__)
42OPENSSL_STATIC_ASSERT(alignof(union evp_aead_ctx_st_state) >=
43 alignof(struct aead_aes_ctr_hmac_sha256_ctx),
44 "AEAD state has insufficient alignment");
45#endif
46
47static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer,
48 const uint8_t hmac_key[32]) {
49 static const size_t hmac_key_len = 32;
50 uint8_t block[SHA256_CBLOCK];
51 OPENSSL_memcpy(block, hmac_key, hmac_key_len);
52 OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len);
53
54 unsigned i;
55 for (i = 0; i < hmac_key_len; i++) {
56 block[i] ^= 0x36;
57 }
58
59 SHA256_Init(out_inner);
60 SHA256_Update(out_inner, block, sizeof(block));
61
62 OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len);
63 for (i = 0; i < hmac_key_len; i++) {
64 block[i] ^= (0x36 ^ 0x5c);
65 }
66
67 SHA256_Init(out_outer);
68 SHA256_Update(out_outer, block, sizeof(block));
69}
70
71static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
72 size_t key_len, size_t tag_len) {
73 struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
74 (struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state;
75 static const size_t hmac_key_len = 32;
76
77 if (key_len < hmac_key_len) {
78 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
79 return 0; // EVP_AEAD_CTX_init should catch this.
80 }
81
82 const size_t aes_key_len = key_len - hmac_key_len;
83 if (aes_key_len != 16 && aes_key_len != 32) {
84 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
85 return 0; // EVP_AEAD_CTX_init should catch this.
86 }
87
88 if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
89 tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN;
90 }
91
92 if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) {
93 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
94 return 0;
95 }
96
97 aes_ctx->ctr =
98 aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len);
99 ctx->tag_len = tag_len;
100 hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state,
101 key + aes_key_len);
102
103 return 1;
104}
105
106static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {}
107
108static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
109 unsigned i;
110 uint8_t bytes[8];
111
112 for (i = 0; i < sizeof(bytes); i++) {
113 bytes[i] = value & 0xff;
114 value >>= 8;
115 }
116 SHA256_Update(sha256, bytes, sizeof(bytes));
117}
118
119static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
120 const SHA256_CTX *inner_init_state,
121 const SHA256_CTX *outer_init_state,
122 const uint8_t *ad, size_t ad_len,
123 const uint8_t *nonce, const uint8_t *ciphertext,
124 size_t ciphertext_len) {
125 SHA256_CTX sha256;
126 OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
127 hmac_update_uint64(&sha256, ad_len);
128 hmac_update_uint64(&sha256, ciphertext_len);
129 SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
130 SHA256_Update(&sha256, ad, ad_len);
131
132 // Pad with zeros to the end of the SHA-256 block.
133 const unsigned num_padding =
134 (SHA256_CBLOCK - ((sizeof(uint64_t)*2 +
135 EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) %
136 SHA256_CBLOCK)) %
137 SHA256_CBLOCK;
138 uint8_t padding[SHA256_CBLOCK];
139 OPENSSL_memset(padding, 0, num_padding);
140 SHA256_Update(&sha256, padding, num_padding);
141
142 SHA256_Update(&sha256, ciphertext, ciphertext_len);
143
144 uint8_t inner_digest[SHA256_DIGEST_LENGTH];
145 SHA256_Final(inner_digest, &sha256);
146
147 OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256));
148 SHA256_Update(&sha256, inner_digest, sizeof(inner_digest));
149 SHA256_Final(out, &sha256);
150}
151
152static void aead_aes_ctr_hmac_sha256_crypt(
153 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out,
154 const uint8_t *in, size_t len, const uint8_t *nonce) {
155 // Since the AEAD operation is one-shot, keeping a buffer of unused keystream
156 // bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it.
157 uint8_t partial_block_buffer[AES_BLOCK_SIZE];
158 unsigned partial_block_offset = 0;
159 OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
160
161 uint8_t counter[AES_BLOCK_SIZE];
162 OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
163 OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4);
164
165 if (aes_ctx->ctr) {
166 CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter,
167 partial_block_buffer, &partial_block_offset,
168 aes_ctx->ctr);
169 } else {
170 CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter,
171 partial_block_buffer, &partial_block_offset,
172 aes_ctx->block);
173 }
174}
175
176static int aead_aes_ctr_hmac_sha256_seal_scatter(
177 const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
178 size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
179 size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
180 size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
181 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
182 (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
183 const uint64_t in_len_64 = in_len;
184
185 if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
186 // This input is so large it would overflow the 32-bit block counter.
187 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
188 return 0;
189 }
190
191 if (max_out_tag_len < ctx->tag_len) {
192 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
193 return 0;
194 }
195
196 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
197 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
198 return 0;
199 }
200
201 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
202
203 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
204 hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
205 &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len);
206 OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len);
207 *out_tag_len = ctx->tag_len;
208
209 return 1;
210}
211
212static int aead_aes_ctr_hmac_sha256_open_gather(
213 const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce,
214 size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag,
215 size_t in_tag_len, const uint8_t *ad, size_t ad_len) {
216 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
217 (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
218
219 if (in_tag_len != ctx->tag_len) {
220 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
221 return 0;
222 }
223
224 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
225 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
226 return 0;
227 }
228
229 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
230 hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
231 &aes_ctx->outer_init_state, ad, ad_len, nonce, in,
232 in_len);
233 if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) {
234 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
235 return 0;
236 }
237
238 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
239
240 return 1;
241}
242
243static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
244 16 /* AES key */ + 32 /* HMAC key */,
245 12, // nonce length
246 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead
247 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length
248 0, // seal_scatter_supports_extra_in
249
250 aead_aes_ctr_hmac_sha256_init,
251 NULL /* init_with_direction */,
252 aead_aes_ctr_hmac_sha256_cleanup,
253 NULL /* open */,
254 aead_aes_ctr_hmac_sha256_seal_scatter,
255 aead_aes_ctr_hmac_sha256_open_gather,
256 NULL /* get_iv */,
257 NULL /* tag_len */,
258};
259
260static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
261 32 /* AES key */ + 32 /* HMAC key */,
262 12, // nonce length
263 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead
264 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length
265 0, // seal_scatter_supports_extra_in
266
267 aead_aes_ctr_hmac_sha256_init,
268 NULL /* init_with_direction */,
269 aead_aes_ctr_hmac_sha256_cleanup,
270 NULL /* open */,
271 aead_aes_ctr_hmac_sha256_seal_scatter,
272 aead_aes_ctr_hmac_sha256_open_gather,
273 NULL /* get_iv */,
274 NULL /* tag_len */,
275};
276
277const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) {
278 return &aead_aes_128_ctr_hmac_sha256;
279}
280
281const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) {
282 return &aead_aes_256_ctr_hmac_sha256;
283}
284