1 /* ====================================================================
2 * Copyright (c) 2010 The OpenSSL Project. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 *
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in
13 * the documentation and/or other materials provided with the
14 * distribution.
15 *
16 * 3. All advertising materials mentioning features or use of this
17 * software must display the following acknowledgment:
18 * "This product includes software developed by the OpenSSL Project
19 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
20 *
21 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
22 * endorse or promote products derived from this software without
23 * prior written permission. For written permission, please contact
24 * licensing@OpenSSL.org.
25 *
26 * 5. Products derived from this software may not be called "OpenSSL"
27 * nor may "OpenSSL" appear in their names without prior written
28 * permission of the OpenSSL Project.
29 *
30 * 6. Redistributions of any form whatsoever must retain the following
31 * acknowledgment:
32 * "This product includes software developed by the OpenSSL Project
33 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
34 *
35 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
36 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
38 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
39 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
41 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
42 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
44 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
45 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
46 * OF THE POSSIBILITY OF SUCH DAMAGE.
47 * ==================================================================== */
48
49 #include <openssl/cmac.h>
50
51 #include <assert.h>
52 #include <string.h>
53
54 #include <openssl/aes.h>
55 #include <openssl/cipher.h>
56 #include <openssl/mem.h>
57
58
59 struct cmac_ctx_st {
60 EVP_CIPHER_CTX cipher_ctx;
61 /* k1 and k2 are the CMAC subkeys. See
62 * https://tools.ietf.org/html/rfc4493#section-2.3 */
63 uint8_t k1[AES_BLOCK_SIZE];
64 uint8_t k2[AES_BLOCK_SIZE];
65 /* Last (possibly partial) scratch */
66 uint8_t block[AES_BLOCK_SIZE];
67 /* block_used contains the number of valid bytes in |block|. */
68 unsigned block_used;
69 };
70
CMAC_CTX_init(CMAC_CTX * ctx)71 static void CMAC_CTX_init(CMAC_CTX *ctx) {
72 EVP_CIPHER_CTX_init(&ctx->cipher_ctx);
73 }
74
CMAC_CTX_cleanup(CMAC_CTX * ctx)75 static void CMAC_CTX_cleanup(CMAC_CTX *ctx) {
76 EVP_CIPHER_CTX_cleanup(&ctx->cipher_ctx);
77 OPENSSL_cleanse(ctx->k1, sizeof(ctx->k1));
78 OPENSSL_cleanse(ctx->k2, sizeof(ctx->k2));
79 OPENSSL_cleanse(ctx->block, sizeof(ctx->block));
80 }
81
AES_CMAC(uint8_t out[16],const uint8_t * key,size_t key_len,const uint8_t * in,size_t in_len)82 int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
83 const uint8_t *in, size_t in_len) {
84 const EVP_CIPHER *cipher;
85 switch (key_len) {
86 case 16:
87 cipher = EVP_aes_128_cbc();
88 break;
89 case 32:
90 cipher = EVP_aes_256_cbc();
91 break;
92 default:
93 return 0;
94 }
95
96 size_t scratch_out_len;
97 CMAC_CTX ctx;
98 CMAC_CTX_init(&ctx);
99
100 const int ok = CMAC_Init(&ctx, key, key_len, cipher, NULL /* engine */) &&
101 CMAC_Update(&ctx, in, in_len) &&
102 CMAC_Final(&ctx, out, &scratch_out_len);
103
104 CMAC_CTX_cleanup(&ctx);
105 return ok;
106 }
107
CMAC_CTX_new(void)108 CMAC_CTX *CMAC_CTX_new(void) {
109 CMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
110 if (ctx != NULL) {
111 CMAC_CTX_init(ctx);
112 }
113 return ctx;
114 }
115
CMAC_CTX_free(CMAC_CTX * ctx)116 void CMAC_CTX_free(CMAC_CTX *ctx) {
117 if (ctx == NULL) {
118 return;
119 }
120
121 CMAC_CTX_cleanup(ctx);
122 OPENSSL_free(ctx);
123 }
124
125 /* binary_field_mul_x treats the 128 bits at |in| as an element of GF(2¹²⁸)
126 * with a hard-coded reduction polynomial and sets |out| as x times the
127 * input.
128 *
129 * See https://tools.ietf.org/html/rfc4493#section-2.3 */
binary_field_mul_x(uint8_t out[16],const uint8_t in[16])130 static void binary_field_mul_x(uint8_t out[16], const uint8_t in[16]) {
131 unsigned i;
132
133 /* Shift |in| to left, including carry. */
134 for (i = 0; i < 15; i++) {
135 out[i] = (in[i] << 1) | (in[i+1] >> 7);
136 }
137
138 /* If MSB set fixup with R. */
139 const uint8_t carry = in[0] >> 7;
140 out[i] = (in[i] << 1) ^ ((0 - carry) & 0x87);
141 }
142
143 static const uint8_t kZeroIV[AES_BLOCK_SIZE] = {0};
144
CMAC_Init(CMAC_CTX * ctx,const void * key,size_t key_len,const EVP_CIPHER * cipher,ENGINE * engine)145 int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
146 const EVP_CIPHER *cipher, ENGINE *engine) {
147 uint8_t scratch[AES_BLOCK_SIZE];
148
149 if (EVP_CIPHER_block_size(cipher) != AES_BLOCK_SIZE ||
150 EVP_CIPHER_key_length(cipher) != key_len ||
151 !EVP_EncryptInit_ex(&ctx->cipher_ctx, cipher, NULL, key, kZeroIV) ||
152 !EVP_Cipher(&ctx->cipher_ctx, scratch, kZeroIV, AES_BLOCK_SIZE) ||
153 /* Reset context again ready for first data. */
154 !EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV)) {
155 return 0;
156 }
157
158 binary_field_mul_x(ctx->k1, scratch);
159 binary_field_mul_x(ctx->k2, ctx->k1);
160 ctx->block_used = 0;
161
162 return 1;
163 }
164
CMAC_Reset(CMAC_CTX * ctx)165 int CMAC_Reset(CMAC_CTX *ctx) {
166 ctx->block_used = 0;
167 return EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV);
168 }
169
CMAC_Update(CMAC_CTX * ctx,const uint8_t * in,size_t in_len)170 int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len) {
171 uint8_t scratch[AES_BLOCK_SIZE];
172
173 if (ctx->block_used > 0) {
174 size_t todo = AES_BLOCK_SIZE - ctx->block_used;
175 if (in_len < todo) {
176 todo = in_len;
177 }
178
179 memcpy(ctx->block + ctx->block_used, in, todo);
180 in += todo;
181 in_len -= todo;
182 ctx->block_used += todo;
183
184 /* If |in_len| is zero then either |ctx->block_used| is less than
185 * |AES_BLOCK_SIZE|, in which case we can stop here, or |ctx->block_used|
186 * is exactly |AES_BLOCK_SIZE| but there's no more data to process. In the
187 * latter case we don't want to process this block now because it might be
188 * the last block and that block is treated specially. */
189 if (in_len == 0) {
190 return 1;
191 }
192
193 assert(ctx->block_used == AES_BLOCK_SIZE);
194
195 if (!EVP_Cipher(&ctx->cipher_ctx, scratch, ctx->block, AES_BLOCK_SIZE)) {
196 return 0;
197 }
198 }
199
200 /* Encrypt all but one of the remaining blocks. */
201 while (in_len > AES_BLOCK_SIZE) {
202 if (!EVP_Cipher(&ctx->cipher_ctx, scratch, in, AES_BLOCK_SIZE)) {
203 return 0;
204 }
205 in += AES_BLOCK_SIZE;
206 in_len -= AES_BLOCK_SIZE;
207 }
208
209 memcpy(ctx->block, in, in_len);
210 ctx->block_used = in_len;
211
212 return 1;
213 }
214
CMAC_Final(CMAC_CTX * ctx,uint8_t * out,size_t * out_len)215 int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len) {
216 *out_len = AES_BLOCK_SIZE;
217 if (out == NULL) {
218 return 1;
219 }
220
221 const uint8_t *mask = ctx->k1;
222
223 if (ctx->block_used != AES_BLOCK_SIZE) {
224 /* If the last block is incomplete, terminate it with a single 'one' bit
225 * followed by zeros. */
226 ctx->block[ctx->block_used] = 0x80;
227 memset(ctx->block + ctx->block_used + 1, 0,
228 AES_BLOCK_SIZE - (ctx->block_used + 1));
229
230 mask = ctx->k2;
231 }
232
233 unsigned i;
234 for (i = 0; i < AES_BLOCK_SIZE; i++) {
235 out[i] = ctx->block[i] ^ mask[i];
236 }
237
238 return EVP_Cipher(&ctx->cipher_ctx, out, out, AES_BLOCK_SIZE);
239 }
240