1 /* Copyright (c) 2015, Google Inc.
2  *
3  * Permission to use, copy, modify, and/or distribute this software for any
4  * purpose with or without fee is hereby granted, provided that the above
5  * copyright notice and this permission notice appear in all copies.
6  *
7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14 
15 #include <openssl/ssl.h>
16 
17 #include <assert.h>
18 #include <string.h>
19 
20 #include <openssl/aead.h>
21 #include <openssl/err.h>
22 #include <openssl/rand.h>
23 #include <openssl/type_check.h>
24 
25 #include "internal.h"
26 
27 
28 OPENSSL_COMPILE_ASSERT(EVP_AEAD_MAX_NONCE_LENGTH < 256,
29                        variable_nonce_len_doesnt_fit_in_uint8_t);
30 
SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,uint16_t version,const SSL_CIPHER * cipher,const uint8_t * enc_key,size_t enc_key_len,const uint8_t * mac_key,size_t mac_key_len,const uint8_t * fixed_iv,size_t fixed_iv_len)31 SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,
32                                uint16_t version, const SSL_CIPHER *cipher,
33                                const uint8_t *enc_key, size_t enc_key_len,
34                                const uint8_t *mac_key, size_t mac_key_len,
35                                const uint8_t *fixed_iv, size_t fixed_iv_len) {
36   const EVP_AEAD *aead;
37   size_t discard;
38   if (!ssl_cipher_get_evp_aead(&aead, &discard, &discard, cipher, version)) {
39     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
40     return 0;
41   }
42 
43   uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH];
44   if (mac_key_len > 0) {
45     /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher
46      * suites). */
47     if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) {
48       OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
49       return 0;
50     }
51     memcpy(merged_key, mac_key, mac_key_len);
52     memcpy(merged_key + mac_key_len, enc_key, enc_key_len);
53     memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv, fixed_iv_len);
54     enc_key = merged_key;
55     enc_key_len += mac_key_len;
56     enc_key_len += fixed_iv_len;
57   }
58 
59   SSL_AEAD_CTX *aead_ctx = (SSL_AEAD_CTX *)OPENSSL_malloc(sizeof(SSL_AEAD_CTX));
60   if (aead_ctx == NULL) {
61     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
62     return NULL;
63   }
64   memset(aead_ctx, 0, sizeof(SSL_AEAD_CTX));
65   aead_ctx->cipher = cipher;
66 
67   if (!EVP_AEAD_CTX_init_with_direction(
68           &aead_ctx->ctx, aead, enc_key, enc_key_len,
69           EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) {
70     OPENSSL_free(aead_ctx);
71     return NULL;
72   }
73 
74   assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH);
75   aead_ctx->variable_nonce_len = (uint8_t)EVP_AEAD_nonce_length(aead);
76   if (mac_key_len == 0) {
77     assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce));
78     memcpy(aead_ctx->fixed_nonce, fixed_iv, fixed_iv_len);
79     aead_ctx->fixed_nonce_len = fixed_iv_len;
80 
81     if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) {
82       /* The fixed nonce into the actual nonce (the sequence number). */
83       aead_ctx->xor_fixed_nonce = 1;
84       aead_ctx->variable_nonce_len = 8;
85     } else {
86       /* The fixed IV is prepended to the nonce. */
87       assert(fixed_iv_len <= aead_ctx->variable_nonce_len);
88       aead_ctx->variable_nonce_len -= fixed_iv_len;
89     }
90 
91     /* AES-GCM uses an explicit nonce. */
92     if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) {
93       aead_ctx->variable_nonce_included_in_record = 1;
94     }
95   } else {
96     aead_ctx->variable_nonce_included_in_record = 1;
97     aead_ctx->random_variable_nonce = 1;
98     aead_ctx->omit_length_in_ad = 1;
99     aead_ctx->omit_version_in_ad = (version == SSL3_VERSION);
100   }
101 
102   return aead_ctx;
103 }
104 
SSL_AEAD_CTX_free(SSL_AEAD_CTX * aead)105 void SSL_AEAD_CTX_free(SSL_AEAD_CTX *aead) {
106   if (aead == NULL) {
107     return;
108   }
109   EVP_AEAD_CTX_cleanup(&aead->ctx);
110   OPENSSL_free(aead);
111 }
112 
SSL_AEAD_CTX_explicit_nonce_len(SSL_AEAD_CTX * aead)113 size_t SSL_AEAD_CTX_explicit_nonce_len(SSL_AEAD_CTX *aead) {
114   if (aead != NULL && aead->variable_nonce_included_in_record) {
115     return aead->variable_nonce_len;
116   }
117   return 0;
118 }
119 
SSL_AEAD_CTX_max_overhead(SSL_AEAD_CTX * aead)120 size_t SSL_AEAD_CTX_max_overhead(SSL_AEAD_CTX *aead) {
121   if (aead == NULL) {
122     return 0;
123   }
124   return EVP_AEAD_max_overhead(aead->ctx.aead) +
125       SSL_AEAD_CTX_explicit_nonce_len(aead);
126 }
127 
128 /* ssl_aead_ctx_get_ad writes the additional data for |aead| into |out| and
129  * returns the number of bytes written. */
ssl_aead_ctx_get_ad(SSL_AEAD_CTX * aead,uint8_t out[13],uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],size_t plaintext_len)130 static size_t ssl_aead_ctx_get_ad(SSL_AEAD_CTX *aead, uint8_t out[13],
131                                   uint8_t type, uint16_t wire_version,
132                                   const uint8_t seqnum[8],
133                                   size_t plaintext_len) {
134   memcpy(out, seqnum, 8);
135   size_t len = 8;
136   out[len++] = type;
137   if (!aead->omit_version_in_ad) {
138     out[len++] = (uint8_t)(wire_version >> 8);
139     out[len++] = (uint8_t)wire_version;
140   }
141   if (!aead->omit_length_in_ad) {
142     out[len++] = (uint8_t)(plaintext_len >> 8);
143     out[len++] = (uint8_t)plaintext_len;
144   }
145   return len;
146 }
147 
SSL_AEAD_CTX_open(SSL_AEAD_CTX * aead,uint8_t * out,size_t * out_len,size_t max_out,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],const uint8_t * in,size_t in_len)148 int SSL_AEAD_CTX_open(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len,
149                       size_t max_out, uint8_t type, uint16_t wire_version,
150                       const uint8_t seqnum[8], const uint8_t *in,
151                       size_t in_len) {
152   if (aead == NULL) {
153     /* Handle the initial NULL cipher. */
154     if (in_len > max_out) {
155       OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
156       return 0;
157     }
158     memmove(out, in, in_len);
159     *out_len = in_len;
160     return 1;
161   }
162 
163   /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed
164    * overhead. Otherwise the parameter is unused. */
165   size_t plaintext_len = 0;
166   if (!aead->omit_length_in_ad) {
167     size_t overhead = SSL_AEAD_CTX_max_overhead(aead);
168     if (in_len < overhead) {
169       /* Publicly invalid. */
170       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
171       return 0;
172     }
173     plaintext_len = in_len - overhead;
174   }
175   uint8_t ad[13];
176   size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
177                                       plaintext_len);
178 
179   /* Assemble the nonce. */
180   uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
181   size_t nonce_len = 0;
182 
183   /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
184   if (aead->xor_fixed_nonce) {
185     nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
186     memset(nonce, 0, nonce_len);
187   } else {
188     memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
189     nonce_len += aead->fixed_nonce_len;
190   }
191 
192   /* Add the variable nonce. */
193   if (aead->variable_nonce_included_in_record) {
194     if (in_len < aead->variable_nonce_len) {
195       /* Publicly invalid. */
196       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
197       return 0;
198     }
199     memcpy(nonce + nonce_len, in, aead->variable_nonce_len);
200     in += aead->variable_nonce_len;
201     in_len -= aead->variable_nonce_len;
202   } else {
203     assert(aead->variable_nonce_len == 8);
204     memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
205   }
206   nonce_len += aead->variable_nonce_len;
207 
208   /* XOR the fixed nonce, if necessary. */
209   if (aead->xor_fixed_nonce) {
210     assert(nonce_len == aead->fixed_nonce_len);
211     size_t i;
212     for (i = 0; i < aead->fixed_nonce_len; i++) {
213       nonce[i] ^= aead->fixed_nonce[i];
214     }
215   }
216 
217   return EVP_AEAD_CTX_open(&aead->ctx, out, out_len, max_out, nonce, nonce_len,
218                            in, in_len, ad, ad_len);
219 }
220 
SSL_AEAD_CTX_seal(SSL_AEAD_CTX * aead,uint8_t * out,size_t * out_len,size_t max_out,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],const uint8_t * in,size_t in_len)221 int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len,
222                       size_t max_out, uint8_t type, uint16_t wire_version,
223                       const uint8_t seqnum[8], const uint8_t *in,
224                       size_t in_len) {
225   if (aead == NULL) {
226     /* Handle the initial NULL cipher. */
227     if (in_len > max_out) {
228       OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
229       return 0;
230     }
231     memmove(out, in, in_len);
232     *out_len = in_len;
233     return 1;
234   }
235 
236   uint8_t ad[13];
237   size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
238                                       in_len);
239 
240   /* Assemble the nonce. */
241   uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
242   size_t nonce_len = 0;
243 
244   /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
245   if (aead->xor_fixed_nonce) {
246     nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
247     memset(nonce, 0, nonce_len);
248   } else {
249     memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
250     nonce_len += aead->fixed_nonce_len;
251   }
252 
253   /* Select the variable nonce. */
254   if (aead->random_variable_nonce) {
255     assert(aead->variable_nonce_included_in_record);
256     if (!RAND_bytes(nonce + nonce_len, aead->variable_nonce_len)) {
257       return 0;
258     }
259   } else {
260     /* When sending we use the sequence number as the variable part of the
261      * nonce. */
262     assert(aead->variable_nonce_len == 8);
263     memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
264   }
265   nonce_len += aead->variable_nonce_len;
266 
267   /* Emit the variable nonce if included in the record. */
268   size_t extra_len = 0;
269   if (aead->variable_nonce_included_in_record) {
270     assert(!aead->xor_fixed_nonce);
271     if (max_out < aead->variable_nonce_len) {
272       OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
273       return 0;
274     }
275     if (out < in + in_len && in < out + aead->variable_nonce_len) {
276       OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
277       return 0;
278     }
279     memcpy(out, nonce + aead->fixed_nonce_len, aead->variable_nonce_len);
280     extra_len = aead->variable_nonce_len;
281     out += aead->variable_nonce_len;
282     max_out -= aead->variable_nonce_len;
283   }
284 
285   /* XOR the fixed nonce, if necessary. */
286   if (aead->xor_fixed_nonce) {
287     assert(nonce_len == aead->fixed_nonce_len);
288     size_t i;
289     for (i = 0; i < aead->fixed_nonce_len; i++) {
290       nonce[i] ^= aead->fixed_nonce[i];
291     }
292   }
293 
294   if (!EVP_AEAD_CTX_seal(&aead->ctx, out, out_len, max_out, nonce, nonce_len,
295                          in, in_len, ad, ad_len)) {
296     return 0;
297   }
298   *out_len += extra_len;
299   return 1;
300 }
301