1 /* ====================================================================
2 * Copyright (c) 2001-2011 The OpenSSL Project. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 *
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in
13 * the documentation and/or other materials provided with the
14 * distribution.
15 *
16 * 3. All advertising materials mentioning features or use of this
17 * software must display the following acknowledgment:
18 * "This product includes software developed by the OpenSSL Project
19 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
20 *
21 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
22 * endorse or promote products derived from this software without
23 * prior written permission. For written permission, please contact
24 * openssl-core@openssl.org.
25 *
26 * 5. Products derived from this software may not be called "OpenSSL"
27 * nor may "OpenSSL" appear in their names without prior written
28 * permission of the OpenSSL Project.
29 *
30 * 6. Redistributions of any form whatsoever must retain the following
31 * acknowledgment:
32 * "This product includes software developed by the OpenSSL Project
33 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
34 *
35 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
36 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
38 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
39 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
41 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
42 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
44 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
45 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
46 * OF THE POSSIBILITY OF SUCH DAMAGE.
47 * ==================================================================== */
48
49 #include <string.h>
50
51 #include <openssl/aead.h>
52 #include <openssl/aes.h>
53 #include <openssl/cipher.h>
54 #include <openssl/cpu.h>
55 #include <openssl/err.h>
56 #include <openssl/mem.h>
57 #include <openssl/nid.h>
58 #include <openssl/rand.h>
59 #include <openssl/sha.h>
60
61 #include "internal.h"
62 #include "../internal.h"
63 #include "../modes/internal.h"
64
65 #if defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
66 #include <openssl/arm_arch.h>
67 #endif
68
69
70 OPENSSL_MSVC_PRAGMA(warning(disable: 4702)) /* Unreachable code. */
71
72 typedef struct {
73 union {
74 double align;
75 AES_KEY ks;
76 } ks;
77 block128_f block;
78 union {
79 cbc128_f cbc;
80 ctr128_f ctr;
81 } stream;
82 } EVP_AES_KEY;
83
84 typedef struct {
85 union {
86 double align;
87 AES_KEY ks;
88 } ks; /* AES key schedule to use */
89 int key_set; /* Set if key initialised */
90 int iv_set; /* Set if an iv is set */
91 GCM128_CONTEXT gcm;
92 uint8_t *iv; /* Temporary IV store */
93 int ivlen; /* IV length */
94 int taglen;
95 int iv_gen; /* It is OK to generate IVs */
96 ctr128_f ctr;
97 } EVP_AES_GCM_CTX;
98
99 #if !defined(OPENSSL_NO_ASM) && \
100 (defined(OPENSSL_X86_64) || defined(OPENSSL_X86))
101 #define VPAES
vpaes_capable(void)102 static char vpaes_capable(void) {
103 return (OPENSSL_ia32cap_P[1] & (1 << (41 - 32))) != 0;
104 }
105
106 #if defined(OPENSSL_X86_64)
107 #define BSAES
bsaes_capable(void)108 static char bsaes_capable(void) {
109 return vpaes_capable();
110 }
111 #endif
112
113 #elif !defined(OPENSSL_NO_ASM) && \
114 (defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64))
115
116 #if defined(OPENSSL_ARM) && __ARM_MAX_ARCH__ >= 7
117 #define BSAES
bsaes_capable(void)118 static char bsaes_capable(void) {
119 return CRYPTO_is_NEON_capable();
120 }
121 #endif
122
123 #define HWAES
hwaes_capable(void)124 static int hwaes_capable(void) {
125 return CRYPTO_is_ARMv8_AES_capable();
126 }
127
128 #elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_PPC64LE)
129
130 #define HWAES
hwaes_capable(void)131 static int hwaes_capable(void) {
132 return CRYPTO_is_PPC64LE_vcrypto_capable();
133 }
134
135 #endif /* OPENSSL_PPC64LE */
136
137
138 #if defined(BSAES)
139 /* On platforms where BSAES gets defined (just above), then these functions are
140 * provided by asm. */
141 void bsaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
142 const AES_KEY *key, uint8_t ivec[16], int enc);
143 void bsaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
144 const AES_KEY *key, const uint8_t ivec[16]);
145 #else
bsaes_capable(void)146 static char bsaes_capable(void) {
147 return 0;
148 }
149
150 /* On other platforms, bsaes_capable() will always return false and so the
151 * following will never be called. */
bsaes_cbc_encrypt(const uint8_t * in,uint8_t * out,size_t length,const AES_KEY * key,uint8_t ivec[16],int enc)152 static void bsaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
153 const AES_KEY *key, uint8_t ivec[16], int enc) {
154 abort();
155 }
156
bsaes_ctr32_encrypt_blocks(const uint8_t * in,uint8_t * out,size_t len,const AES_KEY * key,const uint8_t ivec[16])157 static void bsaes_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
158 size_t len, const AES_KEY *key,
159 const uint8_t ivec[16]) {
160 abort();
161 }
162 #endif
163
164 #if defined(VPAES)
165 /* On platforms where VPAES gets defined (just above), then these functions are
166 * provided by asm. */
167 int vpaes_set_encrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
168 int vpaes_set_decrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
169
170 void vpaes_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
171 void vpaes_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
172
173 void vpaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
174 const AES_KEY *key, uint8_t *ivec, int enc);
175 #else
vpaes_capable(void)176 static char vpaes_capable(void) {
177 return 0;
178 }
179
180 /* On other platforms, vpaes_capable() will always return false and so the
181 * following will never be called. */
vpaes_set_encrypt_key(const uint8_t * userKey,int bits,AES_KEY * key)182 static int vpaes_set_encrypt_key(const uint8_t *userKey, int bits,
183 AES_KEY *key) {
184 abort();
185 }
vpaes_set_decrypt_key(const uint8_t * userKey,int bits,AES_KEY * key)186 static int vpaes_set_decrypt_key(const uint8_t *userKey, int bits,
187 AES_KEY *key) {
188 abort();
189 }
vpaes_encrypt(const uint8_t * in,uint8_t * out,const AES_KEY * key)190 static void vpaes_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
191 abort();
192 }
vpaes_decrypt(const uint8_t * in,uint8_t * out,const AES_KEY * key)193 static void vpaes_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
194 abort();
195 }
vpaes_cbc_encrypt(const uint8_t * in,uint8_t * out,size_t length,const AES_KEY * key,uint8_t * ivec,int enc)196 static void vpaes_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
197 const AES_KEY *key, uint8_t *ivec, int enc) {
198 abort();
199 }
200 #endif
201
202 #if defined(HWAES)
203 int aes_hw_set_encrypt_key(const uint8_t *user_key, const int bits,
204 AES_KEY *key);
205 int aes_hw_set_decrypt_key(const uint8_t *user_key, const int bits,
206 AES_KEY *key);
207 void aes_hw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
208 void aes_hw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
209 void aes_hw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
210 const AES_KEY *key, uint8_t *ivec, const int enc);
211 void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
212 const AES_KEY *key, const uint8_t ivec[16]);
213 #else
214 /* If HWAES isn't defined then we provide dummy functions for each of the hwaes
215 * functions. */
hwaes_capable(void)216 static int hwaes_capable(void) {
217 return 0;
218 }
219
aes_hw_set_encrypt_key(const uint8_t * user_key,int bits,AES_KEY * key)220 static int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits,
221 AES_KEY *key) {
222 abort();
223 }
224
aes_hw_set_decrypt_key(const uint8_t * user_key,int bits,AES_KEY * key)225 static int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits,
226 AES_KEY *key) {
227 abort();
228 }
229
aes_hw_encrypt(const uint8_t * in,uint8_t * out,const AES_KEY * key)230 static void aes_hw_encrypt(const uint8_t *in, uint8_t *out,
231 const AES_KEY *key) {
232 abort();
233 }
234
aes_hw_decrypt(const uint8_t * in,uint8_t * out,const AES_KEY * key)235 static void aes_hw_decrypt(const uint8_t *in, uint8_t *out,
236 const AES_KEY *key) {
237 abort();
238 }
239
aes_hw_cbc_encrypt(const uint8_t * in,uint8_t * out,size_t length,const AES_KEY * key,uint8_t * ivec,int enc)240 static void aes_hw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
241 const AES_KEY *key, uint8_t *ivec, int enc) {
242 abort();
243 }
244
aes_hw_ctr32_encrypt_blocks(const uint8_t * in,uint8_t * out,size_t len,const AES_KEY * key,const uint8_t ivec[16])245 static void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
246 size_t len, const AES_KEY *key,
247 const uint8_t ivec[16]) {
248 abort();
249 }
250 #endif
251
252 #if !defined(OPENSSL_NO_ASM) && \
253 (defined(OPENSSL_X86_64) || defined(OPENSSL_X86))
254 int aesni_set_encrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
255 int aesni_set_decrypt_key(const uint8_t *userKey, int bits, AES_KEY *key);
256
257 void aesni_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
258 void aesni_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
259
260 void aesni_ecb_encrypt(const uint8_t *in, uint8_t *out, size_t length,
261 const AES_KEY *key, int enc);
262 void aesni_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
263 const AES_KEY *key, uint8_t *ivec, int enc);
264
265 #else
266
267 /* On other platforms, aesni_capable() will always return false and so the
268 * following will never be called. */
aesni_encrypt(const uint8_t * in,uint8_t * out,const AES_KEY * key)269 static void aesni_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
270 abort();
271 }
aesni_set_encrypt_key(const uint8_t * userKey,int bits,AES_KEY * key)272 static int aesni_set_encrypt_key(const uint8_t *userKey, int bits,
273 AES_KEY *key) {
274 abort();
275 }
aesni_ctr32_encrypt_blocks(const uint8_t * in,uint8_t * out,size_t blocks,const void * key,const uint8_t * ivec)276 static void aesni_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
277 size_t blocks, const void *key,
278 const uint8_t *ivec) {
279 abort();
280 }
281
282 #endif
283
aes_init_key(EVP_CIPHER_CTX * ctx,const uint8_t * key,const uint8_t * iv,int enc)284 static int aes_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
285 const uint8_t *iv, int enc) {
286 int ret, mode;
287 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
288
289 mode = ctx->cipher->flags & EVP_CIPH_MODE_MASK;
290 if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE) && !enc) {
291 if (hwaes_capable()) {
292 ret = aes_hw_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
293 dat->block = (block128_f)aes_hw_decrypt;
294 dat->stream.cbc = NULL;
295 if (mode == EVP_CIPH_CBC_MODE) {
296 dat->stream.cbc = (cbc128_f)aes_hw_cbc_encrypt;
297 }
298 } else if (bsaes_capable() && mode == EVP_CIPH_CBC_MODE) {
299 ret = AES_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
300 dat->block = (block128_f)AES_decrypt;
301 dat->stream.cbc = (cbc128_f)bsaes_cbc_encrypt;
302 } else if (vpaes_capable()) {
303 ret = vpaes_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
304 dat->block = (block128_f)vpaes_decrypt;
305 dat->stream.cbc =
306 mode == EVP_CIPH_CBC_MODE ? (cbc128_f)vpaes_cbc_encrypt : NULL;
307 } else {
308 ret = AES_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
309 dat->block = (block128_f)AES_decrypt;
310 dat->stream.cbc =
311 mode == EVP_CIPH_CBC_MODE ? (cbc128_f)AES_cbc_encrypt : NULL;
312 }
313 } else if (hwaes_capable()) {
314 ret = aes_hw_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
315 dat->block = (block128_f)aes_hw_encrypt;
316 dat->stream.cbc = NULL;
317 if (mode == EVP_CIPH_CBC_MODE) {
318 dat->stream.cbc = (cbc128_f)aes_hw_cbc_encrypt;
319 } else if (mode == EVP_CIPH_CTR_MODE) {
320 dat->stream.ctr = (ctr128_f)aes_hw_ctr32_encrypt_blocks;
321 }
322 } else if (bsaes_capable() && mode == EVP_CIPH_CTR_MODE) {
323 ret = AES_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
324 dat->block = (block128_f)AES_encrypt;
325 dat->stream.ctr = (ctr128_f)bsaes_ctr32_encrypt_blocks;
326 } else if (vpaes_capable()) {
327 ret = vpaes_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
328 dat->block = (block128_f)vpaes_encrypt;
329 dat->stream.cbc =
330 mode == EVP_CIPH_CBC_MODE ? (cbc128_f)vpaes_cbc_encrypt : NULL;
331 } else {
332 ret = AES_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
333 dat->block = (block128_f)AES_encrypt;
334 dat->stream.cbc =
335 mode == EVP_CIPH_CBC_MODE ? (cbc128_f)AES_cbc_encrypt : NULL;
336 }
337
338 if (ret < 0) {
339 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_AES_KEY_SETUP_FAILED);
340 return 0;
341 }
342
343 return 1;
344 }
345
aes_cbc_cipher(EVP_CIPHER_CTX * ctx,uint8_t * out,const uint8_t * in,size_t len)346 static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
347 size_t len) {
348 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
349
350 if (dat->stream.cbc) {
351 (*dat->stream.cbc)(in, out, len, &dat->ks, ctx->iv, ctx->encrypt);
352 } else if (ctx->encrypt) {
353 CRYPTO_cbc128_encrypt(in, out, len, &dat->ks, ctx->iv, dat->block);
354 } else {
355 CRYPTO_cbc128_decrypt(in, out, len, &dat->ks, ctx->iv, dat->block);
356 }
357
358 return 1;
359 }
360
aes_ecb_cipher(EVP_CIPHER_CTX * ctx,uint8_t * out,const uint8_t * in,size_t len)361 static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
362 size_t len) {
363 size_t bl = ctx->cipher->block_size;
364 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
365
366 if (len < bl) {
367 return 1;
368 }
369
370 len -= bl;
371 for (size_t i = 0; i <= len; i += bl) {
372 (*dat->block)(in + i, out + i, &dat->ks);
373 }
374
375 return 1;
376 }
377
aes_ctr_cipher(EVP_CIPHER_CTX * ctx,uint8_t * out,const uint8_t * in,size_t len)378 static int aes_ctr_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
379 size_t len) {
380 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
381
382 if (dat->stream.ctr) {
383 CRYPTO_ctr128_encrypt_ctr32(in, out, len, &dat->ks, ctx->iv, ctx->buf,
384 &ctx->num, dat->stream.ctr);
385 } else {
386 CRYPTO_ctr128_encrypt(in, out, len, &dat->ks, ctx->iv, ctx->buf, &ctx->num,
387 dat->block);
388 }
389 return 1;
390 }
391
aes_ofb_cipher(EVP_CIPHER_CTX * ctx,uint8_t * out,const uint8_t * in,size_t len)392 static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
393 size_t len) {
394 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
395
396 CRYPTO_ofb128_encrypt(in, out, len, &dat->ks, ctx->iv, &ctx->num, dat->block);
397 return 1;
398 }
399
400 static char aesni_capable(void);
401
aes_ctr_set_key(AES_KEY * aes_key,GCM128_CONTEXT * gcm_ctx,block128_f * out_block,const uint8_t * key,size_t key_len)402 static ctr128_f aes_ctr_set_key(AES_KEY *aes_key, GCM128_CONTEXT *gcm_ctx,
403 block128_f *out_block, const uint8_t *key,
404 size_t key_len) {
405 if (aesni_capable()) {
406 aesni_set_encrypt_key(key, key_len * 8, aes_key);
407 if (gcm_ctx != NULL) {
408 CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f)aesni_encrypt);
409 }
410 if (out_block) {
411 *out_block = (block128_f) aesni_encrypt;
412 }
413 return (ctr128_f)aesni_ctr32_encrypt_blocks;
414 }
415
416 if (hwaes_capable()) {
417 aes_hw_set_encrypt_key(key, key_len * 8, aes_key);
418 if (gcm_ctx != NULL) {
419 CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f)aes_hw_encrypt);
420 }
421 if (out_block) {
422 *out_block = (block128_f) aes_hw_encrypt;
423 }
424 return (ctr128_f)aes_hw_ctr32_encrypt_blocks;
425 }
426
427 if (bsaes_capable()) {
428 AES_set_encrypt_key(key, key_len * 8, aes_key);
429 if (gcm_ctx != NULL) {
430 CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f)AES_encrypt);
431 }
432 if (out_block) {
433 *out_block = (block128_f) AES_encrypt;
434 }
435 return (ctr128_f)bsaes_ctr32_encrypt_blocks;
436 }
437
438 if (vpaes_capable()) {
439 vpaes_set_encrypt_key(key, key_len * 8, aes_key);
440 if (out_block) {
441 *out_block = (block128_f) vpaes_encrypt;
442 }
443 if (gcm_ctx != NULL) {
444 CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f)vpaes_encrypt);
445 }
446 return NULL;
447 }
448
449 AES_set_encrypt_key(key, key_len * 8, aes_key);
450 if (gcm_ctx != NULL) {
451 CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f)AES_encrypt);
452 }
453 if (out_block) {
454 *out_block = (block128_f) AES_encrypt;
455 }
456 return NULL;
457 }
458
aes_gcm_init_key(EVP_CIPHER_CTX * ctx,const uint8_t * key,const uint8_t * iv,int enc)459 static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
460 const uint8_t *iv, int enc) {
461 EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
462 if (!iv && !key) {
463 return 1;
464 }
465 if (key) {
466 gctx->ctr =
467 aes_ctr_set_key(&gctx->ks.ks, &gctx->gcm, NULL, key, ctx->key_len);
468 /* If we have an iv can set it directly, otherwise use saved IV. */
469 if (iv == NULL && gctx->iv_set) {
470 iv = gctx->iv;
471 }
472 if (iv) {
473 CRYPTO_gcm128_setiv(&gctx->gcm, &gctx->ks.ks, iv, gctx->ivlen);
474 gctx->iv_set = 1;
475 }
476 gctx->key_set = 1;
477 } else {
478 /* If key set use IV, otherwise copy */
479 if (gctx->key_set) {
480 CRYPTO_gcm128_setiv(&gctx->gcm, &gctx->ks.ks, iv, gctx->ivlen);
481 } else {
482 OPENSSL_memcpy(gctx->iv, iv, gctx->ivlen);
483 }
484 gctx->iv_set = 1;
485 gctx->iv_gen = 0;
486 }
487 return 1;
488 }
489
aes_gcm_cleanup(EVP_CIPHER_CTX * c)490 static void aes_gcm_cleanup(EVP_CIPHER_CTX *c) {
491 EVP_AES_GCM_CTX *gctx = c->cipher_data;
492 OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
493 if (gctx->iv != c->iv) {
494 OPENSSL_free(gctx->iv);
495 }
496 }
497
498 /* increment counter (64-bit int) by 1 */
ctr64_inc(uint8_t * counter)499 static void ctr64_inc(uint8_t *counter) {
500 int n = 8;
501 uint8_t c;
502
503 do {
504 --n;
505 c = counter[n];
506 ++c;
507 counter[n] = c;
508 if (c) {
509 return;
510 }
511 } while (n);
512 }
513
aes_gcm_ctrl(EVP_CIPHER_CTX * c,int type,int arg,void * ptr)514 static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) {
515 EVP_AES_GCM_CTX *gctx = c->cipher_data;
516 switch (type) {
517 case EVP_CTRL_INIT:
518 gctx->key_set = 0;
519 gctx->iv_set = 0;
520 gctx->ivlen = c->cipher->iv_len;
521 gctx->iv = c->iv;
522 gctx->taglen = -1;
523 gctx->iv_gen = 0;
524 return 1;
525
526 case EVP_CTRL_GCM_SET_IVLEN:
527 if (arg <= 0) {
528 return 0;
529 }
530
531 /* Allocate memory for IV if needed */
532 if (arg > EVP_MAX_IV_LENGTH && arg > gctx->ivlen) {
533 if (gctx->iv != c->iv) {
534 OPENSSL_free(gctx->iv);
535 }
536 gctx->iv = OPENSSL_malloc(arg);
537 if (!gctx->iv) {
538 return 0;
539 }
540 }
541 gctx->ivlen = arg;
542 return 1;
543
544 case EVP_CTRL_GCM_SET_TAG:
545 if (arg <= 0 || arg > 16 || c->encrypt) {
546 return 0;
547 }
548 OPENSSL_memcpy(c->buf, ptr, arg);
549 gctx->taglen = arg;
550 return 1;
551
552 case EVP_CTRL_GCM_GET_TAG:
553 if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0) {
554 return 0;
555 }
556 OPENSSL_memcpy(ptr, c->buf, arg);
557 return 1;
558
559 case EVP_CTRL_GCM_SET_IV_FIXED:
560 /* Special case: -1 length restores whole IV */
561 if (arg == -1) {
562 OPENSSL_memcpy(gctx->iv, ptr, gctx->ivlen);
563 gctx->iv_gen = 1;
564 return 1;
565 }
566 /* Fixed field must be at least 4 bytes and invocation field
567 * at least 8. */
568 if (arg < 4 || (gctx->ivlen - arg) < 8) {
569 return 0;
570 }
571 if (arg) {
572 OPENSSL_memcpy(gctx->iv, ptr, arg);
573 }
574 if (c->encrypt && !RAND_bytes(gctx->iv + arg, gctx->ivlen - arg)) {
575 return 0;
576 }
577 gctx->iv_gen = 1;
578 return 1;
579
580 case EVP_CTRL_GCM_IV_GEN:
581 if (gctx->iv_gen == 0 || gctx->key_set == 0) {
582 return 0;
583 }
584 CRYPTO_gcm128_setiv(&gctx->gcm, &gctx->ks.ks, gctx->iv, gctx->ivlen);
585 if (arg <= 0 || arg > gctx->ivlen) {
586 arg = gctx->ivlen;
587 }
588 OPENSSL_memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
589 /* Invocation field will be at least 8 bytes in size and
590 * so no need to check wrap around or increment more than
591 * last 8 bytes. */
592 ctr64_inc(gctx->iv + gctx->ivlen - 8);
593 gctx->iv_set = 1;
594 return 1;
595
596 case EVP_CTRL_GCM_SET_IV_INV:
597 if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt) {
598 return 0;
599 }
600 OPENSSL_memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
601 CRYPTO_gcm128_setiv(&gctx->gcm, &gctx->ks.ks, gctx->iv, gctx->ivlen);
602 gctx->iv_set = 1;
603 return 1;
604
605 case EVP_CTRL_COPY: {
606 EVP_CIPHER_CTX *out = ptr;
607 EVP_AES_GCM_CTX *gctx_out = out->cipher_data;
608 if (gctx->iv == c->iv) {
609 gctx_out->iv = out->iv;
610 } else {
611 gctx_out->iv = OPENSSL_malloc(gctx->ivlen);
612 if (!gctx_out->iv) {
613 return 0;
614 }
615 OPENSSL_memcpy(gctx_out->iv, gctx->iv, gctx->ivlen);
616 }
617 return 1;
618 }
619
620 default:
621 return -1;
622 }
623 }
624
aes_gcm_cipher(EVP_CIPHER_CTX * ctx,uint8_t * out,const uint8_t * in,size_t len)625 static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
626 size_t len) {
627 EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
628
629 /* If not set up, return error */
630 if (!gctx->key_set) {
631 return -1;
632 }
633 if (!gctx->iv_set) {
634 return -1;
635 }
636
637 if (in) {
638 if (out == NULL) {
639 if (!CRYPTO_gcm128_aad(&gctx->gcm, in, len)) {
640 return -1;
641 }
642 } else if (ctx->encrypt) {
643 if (gctx->ctr) {
644 if (!CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm, &gctx->ks.ks, in, out, len,
645 gctx->ctr)) {
646 return -1;
647 }
648 } else {
649 if (!CRYPTO_gcm128_encrypt(&gctx->gcm, &gctx->ks.ks, in, out, len)) {
650 return -1;
651 }
652 }
653 } else {
654 if (gctx->ctr) {
655 if (!CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm, &gctx->ks.ks, in, out, len,
656 gctx->ctr)) {
657 return -1;
658 }
659 } else {
660 if (!CRYPTO_gcm128_decrypt(&gctx->gcm, &gctx->ks.ks, in, out, len)) {
661 return -1;
662 }
663 }
664 }
665 return len;
666 } else {
667 if (!ctx->encrypt) {
668 if (gctx->taglen < 0 ||
669 !CRYPTO_gcm128_finish(&gctx->gcm, ctx->buf, gctx->taglen)) {
670 return -1;
671 }
672 gctx->iv_set = 0;
673 return 0;
674 }
675 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
676 gctx->taglen = 16;
677 /* Don't reuse the IV */
678 gctx->iv_set = 0;
679 return 0;
680 }
681 }
682
683 static const EVP_CIPHER aes_128_cbc = {
684 NID_aes_128_cbc, 16 /* block_size */, 16 /* key_size */,
685 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CBC_MODE,
686 NULL /* app_data */, aes_init_key, aes_cbc_cipher,
687 NULL /* cleanup */, NULL /* ctrl */};
688
689 static const EVP_CIPHER aes_128_ctr = {
690 NID_aes_128_ctr, 1 /* block_size */, 16 /* key_size */,
691 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CTR_MODE,
692 NULL /* app_data */, aes_init_key, aes_ctr_cipher,
693 NULL /* cleanup */, NULL /* ctrl */};
694
695 static const EVP_CIPHER aes_128_ecb = {
696 NID_aes_128_ecb, 16 /* block_size */, 16 /* key_size */,
697 0 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_ECB_MODE,
698 NULL /* app_data */, aes_init_key, aes_ecb_cipher,
699 NULL /* cleanup */, NULL /* ctrl */};
700
701 static const EVP_CIPHER aes_128_ofb = {
702 NID_aes_128_ofb128, 1 /* block_size */, 16 /* key_size */,
703 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_OFB_MODE,
704 NULL /* app_data */, aes_init_key, aes_ofb_cipher,
705 NULL /* cleanup */, NULL /* ctrl */};
706
707 static const EVP_CIPHER aes_128_gcm = {
708 NID_aes_128_gcm, 1 /* block_size */, 16 /* key_size */, 12 /* iv_len */,
709 sizeof(EVP_AES_GCM_CTX),
710 EVP_CIPH_GCM_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER |
711 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
712 EVP_CIPH_FLAG_AEAD_CIPHER,
713 NULL /* app_data */, aes_gcm_init_key, aes_gcm_cipher, aes_gcm_cleanup,
714 aes_gcm_ctrl};
715
716
717 static const EVP_CIPHER aes_192_cbc = {
718 NID_aes_192_cbc, 16 /* block_size */, 24 /* key_size */,
719 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CBC_MODE,
720 NULL /* app_data */, aes_init_key, aes_cbc_cipher,
721 NULL /* cleanup */, NULL /* ctrl */};
722
723 static const EVP_CIPHER aes_192_ctr = {
724 NID_aes_192_ctr, 1 /* block_size */, 24 /* key_size */,
725 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CTR_MODE,
726 NULL /* app_data */, aes_init_key, aes_ctr_cipher,
727 NULL /* cleanup */, NULL /* ctrl */};
728
729 static const EVP_CIPHER aes_192_ecb = {
730 NID_aes_192_ecb, 16 /* block_size */, 24 /* key_size */,
731 0 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_ECB_MODE,
732 NULL /* app_data */, aes_init_key, aes_ecb_cipher,
733 NULL /* cleanup */, NULL /* ctrl */};
734
735 static const EVP_CIPHER aes_192_gcm = {
736 NID_aes_192_gcm, 1 /* block_size */, 24 /* key_size */, 12 /* iv_len */,
737 sizeof(EVP_AES_GCM_CTX),
738 EVP_CIPH_GCM_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER |
739 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
740 EVP_CIPH_FLAG_AEAD_CIPHER,
741 NULL /* app_data */, aes_gcm_init_key, aes_gcm_cipher, aes_gcm_cleanup,
742 aes_gcm_ctrl};
743
744
745 static const EVP_CIPHER aes_256_cbc = {
746 NID_aes_256_cbc, 16 /* block_size */, 32 /* key_size */,
747 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CBC_MODE,
748 NULL /* app_data */, aes_init_key, aes_cbc_cipher,
749 NULL /* cleanup */, NULL /* ctrl */};
750
751 static const EVP_CIPHER aes_256_ctr = {
752 NID_aes_256_ctr, 1 /* block_size */, 32 /* key_size */,
753 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CTR_MODE,
754 NULL /* app_data */, aes_init_key, aes_ctr_cipher,
755 NULL /* cleanup */, NULL /* ctrl */};
756
757 static const EVP_CIPHER aes_256_ecb = {
758 NID_aes_256_ecb, 16 /* block_size */, 32 /* key_size */,
759 0 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_ECB_MODE,
760 NULL /* app_data */, aes_init_key, aes_ecb_cipher,
761 NULL /* cleanup */, NULL /* ctrl */};
762
763 static const EVP_CIPHER aes_256_ofb = {
764 NID_aes_256_ofb128, 1 /* block_size */, 32 /* key_size */,
765 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_OFB_MODE,
766 NULL /* app_data */, aes_init_key, aes_ofb_cipher,
767 NULL /* cleanup */, NULL /* ctrl */};
768
769 static const EVP_CIPHER aes_256_gcm = {
770 NID_aes_256_gcm, 1 /* block_size */, 32 /* key_size */, 12 /* iv_len */,
771 sizeof(EVP_AES_GCM_CTX),
772 EVP_CIPH_GCM_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER |
773 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
774 EVP_CIPH_FLAG_AEAD_CIPHER,
775 NULL /* app_data */, aes_gcm_init_key, aes_gcm_cipher, aes_gcm_cleanup,
776 aes_gcm_ctrl};
777
778 #if !defined(OPENSSL_NO_ASM) && \
779 (defined(OPENSSL_X86_64) || defined(OPENSSL_X86))
780
781 /* AES-NI section. */
782
aesni_capable(void)783 static char aesni_capable(void) {
784 return (OPENSSL_ia32cap_P[1] & (1 << (57 - 32))) != 0;
785 }
786
aesni_init_key(EVP_CIPHER_CTX * ctx,const uint8_t * key,const uint8_t * iv,int enc)787 static int aesni_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
788 const uint8_t *iv, int enc) {
789 int ret, mode;
790 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data;
791
792 mode = ctx->cipher->flags & EVP_CIPH_MODE_MASK;
793 if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE) && !enc) {
794 ret = aesni_set_decrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
795 dat->block = (block128_f)aesni_decrypt;
796 dat->stream.cbc =
797 mode == EVP_CIPH_CBC_MODE ? (cbc128_f)aesni_cbc_encrypt : NULL;
798 } else {
799 ret = aesni_set_encrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
800 dat->block = (block128_f)aesni_encrypt;
801 if (mode == EVP_CIPH_CBC_MODE) {
802 dat->stream.cbc = (cbc128_f)aesni_cbc_encrypt;
803 } else if (mode == EVP_CIPH_CTR_MODE) {
804 dat->stream.ctr = (ctr128_f)aesni_ctr32_encrypt_blocks;
805 } else {
806 dat->stream.cbc = NULL;
807 }
808 }
809
810 if (ret < 0) {
811 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_AES_KEY_SETUP_FAILED);
812 return 0;
813 }
814
815 return 1;
816 }
817
aesni_cbc_cipher(EVP_CIPHER_CTX * ctx,uint8_t * out,const uint8_t * in,size_t len)818 static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out,
819 const uint8_t *in, size_t len) {
820 aesni_cbc_encrypt(in, out, len, ctx->cipher_data, ctx->iv, ctx->encrypt);
821
822 return 1;
823 }
824
aesni_ecb_cipher(EVP_CIPHER_CTX * ctx,uint8_t * out,const uint8_t * in,size_t len)825 static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx, uint8_t *out,
826 const uint8_t *in, size_t len) {
827 size_t bl = ctx->cipher->block_size;
828
829 if (len < bl) {
830 return 1;
831 }
832
833 aesni_ecb_encrypt(in, out, len, ctx->cipher_data, ctx->encrypt);
834
835 return 1;
836 }
837
aesni_gcm_init_key(EVP_CIPHER_CTX * ctx,const uint8_t * key,const uint8_t * iv,int enc)838 static int aesni_gcm_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
839 const uint8_t *iv, int enc) {
840 EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
841 if (!iv && !key) {
842 return 1;
843 }
844 if (key) {
845 aesni_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
846 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)aesni_encrypt);
847 gctx->ctr = (ctr128_f)aesni_ctr32_encrypt_blocks;
848 /* If we have an iv can set it directly, otherwise use
849 * saved IV. */
850 if (iv == NULL && gctx->iv_set) {
851 iv = gctx->iv;
852 }
853 if (iv) {
854 CRYPTO_gcm128_setiv(&gctx->gcm, &gctx->ks.ks, iv, gctx->ivlen);
855 gctx->iv_set = 1;
856 }
857 gctx->key_set = 1;
858 } else {
859 /* If key set use IV, otherwise copy */
860 if (gctx->key_set) {
861 CRYPTO_gcm128_setiv(&gctx->gcm, &gctx->ks.ks, iv, gctx->ivlen);
862 } else {
863 OPENSSL_memcpy(gctx->iv, iv, gctx->ivlen);
864 }
865 gctx->iv_set = 1;
866 gctx->iv_gen = 0;
867 }
868 return 1;
869 }
870
871 static const EVP_CIPHER aesni_128_cbc = {
872 NID_aes_128_cbc, 16 /* block_size */, 16 /* key_size */,
873 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CBC_MODE,
874 NULL /* app_data */, aesni_init_key, aesni_cbc_cipher,
875 NULL /* cleanup */, NULL /* ctrl */};
876
877 static const EVP_CIPHER aesni_128_ctr = {
878 NID_aes_128_ctr, 1 /* block_size */, 16 /* key_size */,
879 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CTR_MODE,
880 NULL /* app_data */, aesni_init_key, aes_ctr_cipher,
881 NULL /* cleanup */, NULL /* ctrl */};
882
883 static const EVP_CIPHER aesni_128_ecb = {
884 NID_aes_128_ecb, 16 /* block_size */, 16 /* key_size */,
885 0 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_ECB_MODE,
886 NULL /* app_data */, aesni_init_key, aesni_ecb_cipher,
887 NULL /* cleanup */, NULL /* ctrl */};
888
889 static const EVP_CIPHER aesni_128_ofb = {
890 NID_aes_128_ofb128, 1 /* block_size */, 16 /* key_size */,
891 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_OFB_MODE,
892 NULL /* app_data */, aesni_init_key, aes_ofb_cipher,
893 NULL /* cleanup */, NULL /* ctrl */};
894
895 static const EVP_CIPHER aesni_128_gcm = {
896 NID_aes_128_gcm, 1 /* block_size */, 16 /* key_size */, 12 /* iv_len */,
897 sizeof(EVP_AES_GCM_CTX),
898 EVP_CIPH_GCM_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER |
899 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
900 EVP_CIPH_FLAG_AEAD_CIPHER,
901 NULL /* app_data */, aesni_gcm_init_key, aes_gcm_cipher, aes_gcm_cleanup,
902 aes_gcm_ctrl};
903
904
905 static const EVP_CIPHER aesni_192_cbc = {
906 NID_aes_192_cbc, 16 /* block_size */, 24 /* key_size */,
907 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CBC_MODE,
908 NULL /* app_data */, aesni_init_key, aesni_cbc_cipher,
909 NULL /* cleanup */, NULL /* ctrl */};
910
911 static const EVP_CIPHER aesni_192_ctr = {
912 NID_aes_192_ctr, 1 /* block_size */, 24 /* key_size */,
913 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CTR_MODE,
914 NULL /* app_data */, aesni_init_key, aes_ctr_cipher,
915 NULL /* cleanup */, NULL /* ctrl */};
916
917 static const EVP_CIPHER aesni_192_ecb = {
918 NID_aes_192_ecb, 16 /* block_size */, 24 /* key_size */,
919 0 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_ECB_MODE,
920 NULL /* app_data */, aesni_init_key, aesni_ecb_cipher,
921 NULL /* cleanup */, NULL /* ctrl */};
922
923 static const EVP_CIPHER aesni_192_gcm = {
924 NID_aes_192_gcm, 1 /* block_size */, 24 /* key_size */, 12 /* iv_len */,
925 sizeof(EVP_AES_GCM_CTX),
926 EVP_CIPH_GCM_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER |
927 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
928 EVP_CIPH_FLAG_AEAD_CIPHER,
929 NULL /* app_data */, aesni_gcm_init_key, aes_gcm_cipher, aes_gcm_cleanup,
930 aes_gcm_ctrl};
931
932
933 static const EVP_CIPHER aesni_256_cbc = {
934 NID_aes_256_cbc, 16 /* block_size */, 32 /* key_size */,
935 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CBC_MODE,
936 NULL /* app_data */, aesni_init_key, aesni_cbc_cipher,
937 NULL /* cleanup */, NULL /* ctrl */};
938
939 static const EVP_CIPHER aesni_256_ctr = {
940 NID_aes_256_ctr, 1 /* block_size */, 32 /* key_size */,
941 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_CTR_MODE,
942 NULL /* app_data */, aesni_init_key, aes_ctr_cipher,
943 NULL /* cleanup */, NULL /* ctrl */};
944
945 static const EVP_CIPHER aesni_256_ecb = {
946 NID_aes_256_ecb, 16 /* block_size */, 32 /* key_size */,
947 0 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_ECB_MODE,
948 NULL /* app_data */, aesni_init_key, aesni_ecb_cipher,
949 NULL /* cleanup */, NULL /* ctrl */};
950
951 static const EVP_CIPHER aesni_256_ofb = {
952 NID_aes_256_ofb128, 1 /* block_size */, 32 /* key_size */,
953 16 /* iv_len */, sizeof(EVP_AES_KEY), EVP_CIPH_OFB_MODE,
954 NULL /* app_data */, aesni_init_key, aes_ofb_cipher,
955 NULL /* cleanup */, NULL /* ctrl */};
956
957 static const EVP_CIPHER aesni_256_gcm = {
958 NID_aes_256_gcm, 1 /* block_size */, 32 /* key_size */, 12 /* iv_len */,
959 sizeof(EVP_AES_GCM_CTX),
960 EVP_CIPH_GCM_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER |
961 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT | EVP_CIPH_CUSTOM_COPY |
962 EVP_CIPH_FLAG_AEAD_CIPHER,
963 NULL /* app_data */, aesni_gcm_init_key, aes_gcm_cipher, aes_gcm_cleanup,
964 aes_gcm_ctrl};
965
966 #define EVP_CIPHER_FUNCTION(keybits, mode) \
967 const EVP_CIPHER *EVP_aes_##keybits##_##mode(void) { \
968 if (aesni_capable()) { \
969 return &aesni_##keybits##_##mode; \
970 } else { \
971 return &aes_##keybits##_##mode; \
972 } \
973 }
974
975 #else /* ^^^ OPENSSL_X86_64 || OPENSSL_X86 */
976
aesni_capable(void)977 static char aesni_capable(void) {
978 return 0;
979 }
980
981 #define EVP_CIPHER_FUNCTION(keybits, mode) \
982 const EVP_CIPHER *EVP_aes_##keybits##_##mode(void) { \
983 return &aes_##keybits##_##mode; \
984 }
985
986 #endif
987
988 EVP_CIPHER_FUNCTION(128, cbc)
989 EVP_CIPHER_FUNCTION(128, ctr)
990 EVP_CIPHER_FUNCTION(128, ecb)
991 EVP_CIPHER_FUNCTION(128, ofb)
992 EVP_CIPHER_FUNCTION(128, gcm)
993
994 EVP_CIPHER_FUNCTION(192, cbc)
995 EVP_CIPHER_FUNCTION(192, ctr)
996 EVP_CIPHER_FUNCTION(192, ecb)
997 EVP_CIPHER_FUNCTION(192, gcm)
998
999 EVP_CIPHER_FUNCTION(256, cbc)
1000 EVP_CIPHER_FUNCTION(256, ctr)
1001 EVP_CIPHER_FUNCTION(256, ecb)
1002 EVP_CIPHER_FUNCTION(256, ofb)
1003 EVP_CIPHER_FUNCTION(256, gcm)
1004
1005
1006 #define EVP_AEAD_AES_GCM_TAG_LEN 16
1007
1008 struct aead_aes_gcm_ctx {
1009 union {
1010 double align;
1011 AES_KEY ks;
1012 } ks;
1013 GCM128_CONTEXT gcm;
1014 ctr128_f ctr;
1015 uint8_t tag_len;
1016 };
1017
aead_aes_gcm_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len)1018 static int aead_aes_gcm_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
1019 size_t key_len, size_t tag_len) {
1020 struct aead_aes_gcm_ctx *gcm_ctx;
1021 const size_t key_bits = key_len * 8;
1022
1023 if (key_bits != 128 && key_bits != 256) {
1024 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
1025 return 0; /* EVP_AEAD_CTX_init should catch this. */
1026 }
1027
1028 if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
1029 tag_len = EVP_AEAD_AES_GCM_TAG_LEN;
1030 }
1031
1032 if (tag_len > EVP_AEAD_AES_GCM_TAG_LEN) {
1033 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
1034 return 0;
1035 }
1036
1037 gcm_ctx = OPENSSL_malloc(sizeof(struct aead_aes_gcm_ctx));
1038 if (gcm_ctx == NULL) {
1039 return 0;
1040 }
1041
1042 gcm_ctx->ctr =
1043 aes_ctr_set_key(&gcm_ctx->ks.ks, &gcm_ctx->gcm, NULL, key, key_len);
1044 gcm_ctx->tag_len = tag_len;
1045 ctx->aead_state = gcm_ctx;
1046
1047 return 1;
1048 }
1049
aead_aes_gcm_cleanup(EVP_AEAD_CTX * ctx)1050 static void aead_aes_gcm_cleanup(EVP_AEAD_CTX *ctx) {
1051 struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
1052 OPENSSL_cleanse(gcm_ctx, sizeof(struct aead_aes_gcm_ctx));
1053 OPENSSL_free(gcm_ctx);
1054 }
1055
aead_aes_gcm_seal(const EVP_AEAD_CTX * ctx,uint8_t * out,size_t * out_len,size_t max_out_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len)1056 static int aead_aes_gcm_seal(const EVP_AEAD_CTX *ctx, uint8_t *out,
1057 size_t *out_len, size_t max_out_len,
1058 const uint8_t *nonce, size_t nonce_len,
1059 const uint8_t *in, size_t in_len,
1060 const uint8_t *ad, size_t ad_len) {
1061 const struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
1062 GCM128_CONTEXT gcm;
1063
1064 if (in_len + gcm_ctx->tag_len < in_len) {
1065 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
1066 return 0;
1067 }
1068
1069 if (max_out_len < in_len + gcm_ctx->tag_len) {
1070 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
1071 return 0;
1072 }
1073
1074 const AES_KEY *key = &gcm_ctx->ks.ks;
1075
1076 OPENSSL_memcpy(&gcm, &gcm_ctx->gcm, sizeof(gcm));
1077 CRYPTO_gcm128_setiv(&gcm, key, nonce, nonce_len);
1078
1079 if (ad_len > 0 && !CRYPTO_gcm128_aad(&gcm, ad, ad_len)) {
1080 return 0;
1081 }
1082
1083 if (gcm_ctx->ctr) {
1084 if (!CRYPTO_gcm128_encrypt_ctr32(&gcm, key, in, out, in_len,
1085 gcm_ctx->ctr)) {
1086 return 0;
1087 }
1088 } else {
1089 if (!CRYPTO_gcm128_encrypt(&gcm, key, in, out, in_len)) {
1090 return 0;
1091 }
1092 }
1093
1094 CRYPTO_gcm128_tag(&gcm, out + in_len, gcm_ctx->tag_len);
1095 *out_len = in_len + gcm_ctx->tag_len;
1096 return 1;
1097 }
1098
aead_aes_gcm_open(const EVP_AEAD_CTX * ctx,uint8_t * out,size_t * out_len,size_t max_out_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len)1099 static int aead_aes_gcm_open(const EVP_AEAD_CTX *ctx, uint8_t *out,
1100 size_t *out_len, size_t max_out_len,
1101 const uint8_t *nonce, size_t nonce_len,
1102 const uint8_t *in, size_t in_len,
1103 const uint8_t *ad, size_t ad_len) {
1104 const struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
1105 uint8_t tag[EVP_AEAD_AES_GCM_TAG_LEN];
1106 size_t plaintext_len;
1107 GCM128_CONTEXT gcm;
1108
1109 if (in_len < gcm_ctx->tag_len) {
1110 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
1111 return 0;
1112 }
1113
1114 plaintext_len = in_len - gcm_ctx->tag_len;
1115
1116 if (max_out_len < plaintext_len) {
1117 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
1118 return 0;
1119 }
1120
1121 const AES_KEY *key = &gcm_ctx->ks.ks;
1122
1123 OPENSSL_memcpy(&gcm, &gcm_ctx->gcm, sizeof(gcm));
1124 CRYPTO_gcm128_setiv(&gcm, key, nonce, nonce_len);
1125
1126 if (!CRYPTO_gcm128_aad(&gcm, ad, ad_len)) {
1127 return 0;
1128 }
1129
1130 if (gcm_ctx->ctr) {
1131 if (!CRYPTO_gcm128_decrypt_ctr32(&gcm, key, in, out,
1132 in_len - gcm_ctx->tag_len, gcm_ctx->ctr)) {
1133 return 0;
1134 }
1135 } else {
1136 if (!CRYPTO_gcm128_decrypt(&gcm, key, in, out, in_len - gcm_ctx->tag_len)) {
1137 return 0;
1138 }
1139 }
1140
1141 CRYPTO_gcm128_tag(&gcm, tag, gcm_ctx->tag_len);
1142 if (CRYPTO_memcmp(tag, in + plaintext_len, gcm_ctx->tag_len) != 0) {
1143 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
1144 return 0;
1145 }
1146
1147 *out_len = plaintext_len;
1148 return 1;
1149 }
1150
1151 static const EVP_AEAD aead_aes_128_gcm = {
1152 16, /* key len */
1153 12, /* nonce len */
1154 EVP_AEAD_AES_GCM_TAG_LEN, /* overhead */
1155 EVP_AEAD_AES_GCM_TAG_LEN, /* max tag length */
1156 aead_aes_gcm_init,
1157 NULL, /* init_with_direction */
1158 aead_aes_gcm_cleanup,
1159 aead_aes_gcm_seal,
1160 aead_aes_gcm_open,
1161 NULL, /* get_iv */
1162 };
1163
1164 static const EVP_AEAD aead_aes_256_gcm = {
1165 32, /* key len */
1166 12, /* nonce len */
1167 EVP_AEAD_AES_GCM_TAG_LEN, /* overhead */
1168 EVP_AEAD_AES_GCM_TAG_LEN, /* max tag length */
1169 aead_aes_gcm_init,
1170 NULL, /* init_with_direction */
1171 aead_aes_gcm_cleanup,
1172 aead_aes_gcm_seal,
1173 aead_aes_gcm_open,
1174 NULL, /* get_iv */
1175 };
1176
EVP_aead_aes_128_gcm(void)1177 const EVP_AEAD *EVP_aead_aes_128_gcm(void) { return &aead_aes_128_gcm; }
1178
EVP_aead_aes_256_gcm(void)1179 const EVP_AEAD *EVP_aead_aes_256_gcm(void) { return &aead_aes_256_gcm; }
1180
1181
1182 #define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
1183 #define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
1184
1185 struct aead_aes_ctr_hmac_sha256_ctx {
1186 union {
1187 double align;
1188 AES_KEY ks;
1189 } ks;
1190 ctr128_f ctr;
1191 block128_f block;
1192 SHA256_CTX inner_init_state;
1193 SHA256_CTX outer_init_state;
1194 uint8_t tag_len;
1195 };
1196
hmac_init(SHA256_CTX * out_inner,SHA256_CTX * out_outer,const uint8_t hmac_key[32])1197 static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer,
1198 const uint8_t hmac_key[32]) {
1199 static const size_t hmac_key_len = 32;
1200 uint8_t block[SHA256_CBLOCK];
1201 OPENSSL_memcpy(block, hmac_key, hmac_key_len);
1202 OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len);
1203
1204 unsigned i;
1205 for (i = 0; i < hmac_key_len; i++) {
1206 block[i] ^= 0x36;
1207 }
1208
1209 SHA256_Init(out_inner);
1210 SHA256_Update(out_inner, block, sizeof(block));
1211
1212 OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len);
1213 for (i = 0; i < hmac_key_len; i++) {
1214 block[i] ^= (0x36 ^ 0x5c);
1215 }
1216
1217 SHA256_Init(out_outer);
1218 SHA256_Update(out_outer, block, sizeof(block));
1219 }
1220
aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len)1221 static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
1222 size_t key_len, size_t tag_len) {
1223 struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx;
1224 static const size_t hmac_key_len = 32;
1225
1226 if (key_len < hmac_key_len) {
1227 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
1228 return 0; /* EVP_AEAD_CTX_init should catch this. */
1229 }
1230
1231 const size_t aes_key_len = key_len - hmac_key_len;
1232 if (aes_key_len != 16 && aes_key_len != 32) {
1233 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
1234 return 0; /* EVP_AEAD_CTX_init should catch this. */
1235 }
1236
1237 if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
1238 tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN;
1239 }
1240
1241 if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) {
1242 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
1243 return 0;
1244 }
1245
1246 aes_ctx = OPENSSL_malloc(sizeof(struct aead_aes_ctr_hmac_sha256_ctx));
1247 if (aes_ctx == NULL) {
1248 OPENSSL_PUT_ERROR(CIPHER, ERR_R_MALLOC_FAILURE);
1249 return 0;
1250 }
1251
1252 aes_ctx->ctr =
1253 aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len);
1254 aes_ctx->tag_len = tag_len;
1255 hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state,
1256 key + aes_key_len);
1257
1258 ctx->aead_state = aes_ctx;
1259
1260 return 1;
1261 }
1262
aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX * ctx)1263 static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {
1264 struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
1265 OPENSSL_cleanse(aes_ctx, sizeof(struct aead_aes_ctr_hmac_sha256_ctx));
1266 OPENSSL_free(aes_ctx);
1267 }
1268
hmac_update_uint64(SHA256_CTX * sha256,uint64_t value)1269 static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
1270 unsigned i;
1271 uint8_t bytes[8];
1272
1273 for (i = 0; i < sizeof(bytes); i++) {
1274 bytes[i] = value & 0xff;
1275 value >>= 8;
1276 }
1277 SHA256_Update(sha256, bytes, sizeof(bytes));
1278 }
1279
hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],const SHA256_CTX * inner_init_state,const SHA256_CTX * outer_init_state,const uint8_t * ad,size_t ad_len,const uint8_t * nonce,const uint8_t * ciphertext,size_t ciphertext_len)1280 static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
1281 const SHA256_CTX *inner_init_state,
1282 const SHA256_CTX *outer_init_state,
1283 const uint8_t *ad, size_t ad_len,
1284 const uint8_t *nonce, const uint8_t *ciphertext,
1285 size_t ciphertext_len) {
1286 SHA256_CTX sha256;
1287 OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
1288 hmac_update_uint64(&sha256, ad_len);
1289 hmac_update_uint64(&sha256, ciphertext_len);
1290 SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
1291 SHA256_Update(&sha256, ad, ad_len);
1292
1293 /* Pad with zeros to the end of the SHA-256 block. */
1294 const unsigned num_padding =
1295 (SHA256_CBLOCK - ((sizeof(uint64_t)*2 +
1296 EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) %
1297 SHA256_CBLOCK)) %
1298 SHA256_CBLOCK;
1299 uint8_t padding[SHA256_CBLOCK];
1300 OPENSSL_memset(padding, 0, num_padding);
1301 SHA256_Update(&sha256, padding, num_padding);
1302
1303 SHA256_Update(&sha256, ciphertext, ciphertext_len);
1304
1305 uint8_t inner_digest[SHA256_DIGEST_LENGTH];
1306 SHA256_Final(inner_digest, &sha256);
1307
1308 OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256));
1309 SHA256_Update(&sha256, inner_digest, sizeof(inner_digest));
1310 SHA256_Final(out, &sha256);
1311 }
1312
aead_aes_ctr_hmac_sha256_crypt(const struct aead_aes_ctr_hmac_sha256_ctx * aes_ctx,uint8_t * out,const uint8_t * in,size_t len,const uint8_t * nonce)1313 static void aead_aes_ctr_hmac_sha256_crypt(
1314 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out,
1315 const uint8_t *in, size_t len, const uint8_t *nonce) {
1316 /* Since the AEAD operation is one-shot, keeping a buffer of unused keystream
1317 * bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it. */
1318 uint8_t partial_block_buffer[AES_BLOCK_SIZE];
1319 unsigned partial_block_offset = 0;
1320 OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
1321
1322 uint8_t counter[AES_BLOCK_SIZE];
1323 OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
1324 OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4);
1325
1326 if (aes_ctx->ctr) {
1327 CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter,
1328 partial_block_buffer, &partial_block_offset,
1329 aes_ctx->ctr);
1330 } else {
1331 CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter,
1332 partial_block_buffer, &partial_block_offset,
1333 aes_ctx->block);
1334 }
1335 }
1336
aead_aes_ctr_hmac_sha256_seal(const EVP_AEAD_CTX * ctx,uint8_t * out,size_t * out_len,size_t max_out_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len)1337 static int aead_aes_ctr_hmac_sha256_seal(const EVP_AEAD_CTX *ctx, uint8_t *out,
1338 size_t *out_len, size_t max_out_len,
1339 const uint8_t *nonce, size_t nonce_len,
1340 const uint8_t *in, size_t in_len,
1341 const uint8_t *ad, size_t ad_len) {
1342 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
1343 const uint64_t in_len_64 = in_len;
1344
1345 if (in_len + aes_ctx->tag_len < in_len ||
1346 /* This input is so large it would overflow the 32-bit block counter. */
1347 in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
1348 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
1349 return 0;
1350 }
1351
1352 if (max_out_len < in_len + aes_ctx->tag_len) {
1353 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
1354 return 0;
1355 }
1356
1357 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
1358 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
1359 return 0;
1360 }
1361
1362 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
1363
1364 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
1365 hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
1366 &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len);
1367 OPENSSL_memcpy(out + in_len, hmac_result, aes_ctx->tag_len);
1368 *out_len = in_len + aes_ctx->tag_len;
1369
1370 return 1;
1371 }
1372
aead_aes_ctr_hmac_sha256_open(const EVP_AEAD_CTX * ctx,uint8_t * out,size_t * out_len,size_t max_out_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len)1373 static int aead_aes_ctr_hmac_sha256_open(const EVP_AEAD_CTX *ctx, uint8_t *out,
1374 size_t *out_len, size_t max_out_len,
1375 const uint8_t *nonce, size_t nonce_len,
1376 const uint8_t *in, size_t in_len,
1377 const uint8_t *ad, size_t ad_len) {
1378 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
1379 size_t plaintext_len;
1380
1381 if (in_len < aes_ctx->tag_len) {
1382 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
1383 return 0;
1384 }
1385
1386 plaintext_len = in_len - aes_ctx->tag_len;
1387
1388 if (max_out_len < plaintext_len) {
1389 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
1390 return 0;
1391 }
1392
1393 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
1394 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
1395 return 0;
1396 }
1397
1398 uint8_t hmac_result[SHA256_DIGEST_LENGTH];
1399 hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
1400 &aes_ctx->outer_init_state, ad, ad_len, nonce, in,
1401 plaintext_len);
1402 if (CRYPTO_memcmp(hmac_result, in + plaintext_len, aes_ctx->tag_len) != 0) {
1403 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
1404 return 0;
1405 }
1406
1407 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, plaintext_len, nonce);
1408
1409 *out_len = plaintext_len;
1410 return 1;
1411 }
1412
1413 static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
1414 16 /* AES key */ + 32 /* HMAC key */,
1415 12, /* nonce length */
1416 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */
1417 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */
1418
1419 aead_aes_ctr_hmac_sha256_init,
1420 NULL /* init_with_direction */,
1421 aead_aes_ctr_hmac_sha256_cleanup,
1422 aead_aes_ctr_hmac_sha256_seal,
1423 aead_aes_ctr_hmac_sha256_open,
1424 NULL /* get_iv */,
1425 };
1426
1427 static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
1428 32 /* AES key */ + 32 /* HMAC key */,
1429 12, /* nonce length */
1430 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */
1431 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */
1432
1433 aead_aes_ctr_hmac_sha256_init,
1434 NULL /* init_with_direction */,
1435 aead_aes_ctr_hmac_sha256_cleanup,
1436 aead_aes_ctr_hmac_sha256_seal,
1437 aead_aes_ctr_hmac_sha256_open,
1438 NULL /* get_iv */,
1439 };
1440
EVP_aead_aes_128_ctr_hmac_sha256(void)1441 const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) {
1442 return &aead_aes_128_ctr_hmac_sha256;
1443 }
1444
EVP_aead_aes_256_ctr_hmac_sha256(void)1445 const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) {
1446 return &aead_aes_256_ctr_hmac_sha256;
1447 }
1448
1449 #if !defined(OPENSSL_SMALL)
1450
1451 #define EVP_AEAD_AES_GCM_SIV_NONCE_LEN 12
1452 #define EVP_AEAD_AES_GCM_SIV_TAG_LEN 16
1453
1454 struct aead_aes_gcm_siv_ctx {
1455 union {
1456 double align;
1457 AES_KEY ks;
1458 } ks;
1459 block128_f kgk_block;
1460 unsigned is_256:1;
1461 };
1462
aead_aes_gcm_siv_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len)1463 static int aead_aes_gcm_siv_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
1464 size_t key_len, size_t tag_len) {
1465 const size_t key_bits = key_len * 8;
1466
1467 if (key_bits != 128 && key_bits != 256) {
1468 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
1469 return 0; /* EVP_AEAD_CTX_init should catch this. */
1470 }
1471
1472 if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
1473 tag_len = EVP_AEAD_AES_GCM_SIV_TAG_LEN;
1474 }
1475
1476 if (tag_len != EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
1477 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
1478 return 0;
1479 }
1480
1481 struct aead_aes_gcm_siv_ctx *gcm_siv_ctx =
1482 OPENSSL_malloc(sizeof(struct aead_aes_gcm_siv_ctx));
1483 if (gcm_siv_ctx == NULL) {
1484 return 0;
1485 }
1486 OPENSSL_memset(gcm_siv_ctx, 0, sizeof(struct aead_aes_gcm_siv_ctx));
1487
1488 if (aesni_capable()) {
1489 aesni_set_encrypt_key(key, key_len * 8, &gcm_siv_ctx->ks.ks);
1490 gcm_siv_ctx->kgk_block = (block128_f)aesni_encrypt;
1491 } else if (hwaes_capable()) {
1492 aes_hw_set_encrypt_key(key, key_len * 8, &gcm_siv_ctx->ks.ks);
1493 gcm_siv_ctx->kgk_block = (block128_f)aes_hw_encrypt;
1494 } else if (vpaes_capable()) {
1495 vpaes_set_encrypt_key(key, key_len * 8, &gcm_siv_ctx->ks.ks);
1496 gcm_siv_ctx->kgk_block = (block128_f)vpaes_encrypt;
1497 } else {
1498 AES_set_encrypt_key(key, key_len * 8, &gcm_siv_ctx->ks.ks);
1499 gcm_siv_ctx->kgk_block = (block128_f)AES_encrypt;
1500 }
1501
1502 gcm_siv_ctx->is_256 = (key_len == 32);
1503 ctx->aead_state = gcm_siv_ctx;
1504
1505 return 1;
1506 }
1507
aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX * ctx)1508 static void aead_aes_gcm_siv_cleanup(EVP_AEAD_CTX *ctx) {
1509 struct aead_aes_gcm_siv_ctx *gcm_siv_ctx = ctx->aead_state;
1510 OPENSSL_cleanse(gcm_siv_ctx, sizeof(struct aead_aes_gcm_siv_ctx));
1511 OPENSSL_free(gcm_siv_ctx);
1512 }
1513
1514 /* gcm_siv_crypt encrypts (or decrypts—it's the same thing) |in_len| bytes from
1515 * |in| to |out|, using the block function |enc_block| with |key| in counter
1516 * mode, starting at |initial_counter|. This differs from the traditional
1517 * counter mode code in that the counter is handled little-endian, only the
1518 * first four bytes are used and the GCM-SIV tweak to the final byte is
1519 * applied. The |in| and |out| pointers may be equal but otherwise must not
1520 * alias. */
gcm_siv_crypt(uint8_t * out,const uint8_t * in,size_t in_len,const uint8_t initial_counter[AES_BLOCK_SIZE],block128_f enc_block,const AES_KEY * key)1521 static void gcm_siv_crypt(uint8_t *out, const uint8_t *in, size_t in_len,
1522 const uint8_t initial_counter[AES_BLOCK_SIZE],
1523 block128_f enc_block, const AES_KEY *key) {
1524 union {
1525 uint32_t w[4];
1526 uint8_t c[16];
1527 } counter;
1528
1529 OPENSSL_memcpy(counter.c, initial_counter, AES_BLOCK_SIZE);
1530 counter.c[15] |= 0x80;
1531
1532 for (size_t done = 0; done < in_len;) {
1533 uint8_t keystream[AES_BLOCK_SIZE];
1534 enc_block(counter.c, keystream, key);
1535 counter.w[0]++;
1536
1537 size_t todo = AES_BLOCK_SIZE;
1538 if (in_len - done < todo) {
1539 todo = in_len - done;
1540 }
1541
1542 for (size_t i = 0; i < todo; i++) {
1543 out[done + i] = keystream[i] ^ in[done + i];
1544 }
1545
1546 done += todo;
1547 }
1548 }
1549
1550 /* gcm_siv_polyval evaluates POLYVAL at |auth_key| on the given plaintext and
1551 * AD. The result is written to |out_tag|. */
gcm_siv_polyval(uint8_t out_tag[16],const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len,const uint8_t auth_key[16],const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN])1552 static void gcm_siv_polyval(
1553 uint8_t out_tag[16], const uint8_t *in, size_t in_len, const uint8_t *ad,
1554 size_t ad_len, const uint8_t auth_key[16],
1555 const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
1556 struct polyval_ctx polyval_ctx;
1557 CRYPTO_POLYVAL_init(&polyval_ctx, auth_key);
1558
1559 CRYPTO_POLYVAL_update_blocks(&polyval_ctx, ad, ad_len & ~15);
1560
1561 uint8_t scratch[16];
1562 if (ad_len & 15) {
1563 OPENSSL_memset(scratch, 0, sizeof(scratch));
1564 OPENSSL_memcpy(scratch, &ad[ad_len & ~15], ad_len & 15);
1565 CRYPTO_POLYVAL_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
1566 }
1567
1568 CRYPTO_POLYVAL_update_blocks(&polyval_ctx, in, in_len & ~15);
1569 if (in_len & 15) {
1570 OPENSSL_memset(scratch, 0, sizeof(scratch));
1571 OPENSSL_memcpy(scratch, &in[in_len & ~15], in_len & 15);
1572 CRYPTO_POLYVAL_update_blocks(&polyval_ctx, scratch, sizeof(scratch));
1573 }
1574
1575 union {
1576 uint8_t c[16];
1577 struct {
1578 uint64_t ad;
1579 uint64_t in;
1580 } bitlens;
1581 } length_block;
1582
1583 length_block.bitlens.ad = ad_len * 8;
1584 length_block.bitlens.in = in_len * 8;
1585 CRYPTO_POLYVAL_update_blocks(&polyval_ctx, length_block.c,
1586 sizeof(length_block));
1587
1588 CRYPTO_POLYVAL_finish(&polyval_ctx, out_tag);
1589 for (size_t i = 0; i < EVP_AEAD_AES_GCM_SIV_NONCE_LEN; i++) {
1590 out_tag[i] ^= nonce[i];
1591 }
1592 out_tag[15] &= 0x7f;
1593 }
1594
1595 /* gcm_siv_record_keys contains the keys used for a specific GCM-SIV record. */
1596 struct gcm_siv_record_keys {
1597 uint8_t auth_key[16];
1598 union {
1599 double align;
1600 AES_KEY ks;
1601 } enc_key;
1602 block128_f enc_block;
1603 };
1604
1605 /* gcm_siv_keys calculates the keys for a specific GCM-SIV record with the
1606 * given nonce and writes them to |*out_keys|. */
gcm_siv_keys(const struct aead_aes_gcm_siv_ctx * gcm_siv_ctx,struct gcm_siv_record_keys * out_keys,const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN])1607 static void gcm_siv_keys(
1608 const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx,
1609 struct gcm_siv_record_keys *out_keys,
1610 const uint8_t nonce[EVP_AEAD_AES_GCM_SIV_NONCE_LEN]) {
1611 const AES_KEY *const key = &gcm_siv_ctx->ks.ks;
1612 uint8_t key_material[(128 /* POLYVAL key */ + 256 /* max AES key */) / 8];
1613 const size_t blocks_needed = gcm_siv_ctx->is_256 ? 6 : 4;
1614
1615 uint8_t counter[AES_BLOCK_SIZE];
1616 OPENSSL_memset(counter, 0, AES_BLOCK_SIZE - EVP_AEAD_AES_GCM_SIV_NONCE_LEN);
1617 OPENSSL_memcpy(counter + AES_BLOCK_SIZE - EVP_AEAD_AES_GCM_SIV_NONCE_LEN,
1618 nonce, EVP_AEAD_AES_GCM_SIV_NONCE_LEN);
1619 for (size_t i = 0; i < blocks_needed; i++) {
1620 counter[0] = i;
1621
1622 uint8_t ciphertext[AES_BLOCK_SIZE];
1623 gcm_siv_ctx->kgk_block(counter, ciphertext, key);
1624 OPENSSL_memcpy(&key_material[i * 8], ciphertext, 8);
1625 }
1626
1627 OPENSSL_memcpy(out_keys->auth_key, key_material, 16);
1628 aes_ctr_set_key(&out_keys->enc_key.ks, NULL, &out_keys->enc_block,
1629 key_material + 16, gcm_siv_ctx->is_256 ? 32 : 16);
1630 }
1631
aead_aes_gcm_siv_seal(const EVP_AEAD_CTX * ctx,uint8_t * out,size_t * out_len,size_t max_out_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len)1632 static int aead_aes_gcm_siv_seal(const EVP_AEAD_CTX *ctx, uint8_t *out,
1633 size_t *out_len, size_t max_out_len,
1634 const uint8_t *nonce, size_t nonce_len,
1635 const uint8_t *in, size_t in_len,
1636 const uint8_t *ad, size_t ad_len) {
1637 const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx = ctx->aead_state;
1638 const uint64_t in_len_64 = in_len;
1639 const uint64_t ad_len_64 = ad_len;
1640
1641 if (in_len + EVP_AEAD_AES_GCM_SIV_TAG_LEN < in_len ||
1642 in_len_64 > (UINT64_C(1) << 36) ||
1643 ad_len_64 >= (UINT64_C(1) << 61)) {
1644 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
1645 return 0;
1646 }
1647
1648 if (max_out_len < in_len + EVP_AEAD_AES_GCM_SIV_TAG_LEN) {
1649 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
1650 return 0;
1651 }
1652
1653 if (nonce_len != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
1654 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
1655 return 0;
1656 }
1657
1658 struct gcm_siv_record_keys keys;
1659 gcm_siv_keys(gcm_siv_ctx, &keys, nonce);
1660
1661 uint8_t tag[16];
1662 gcm_siv_polyval(tag, in, in_len, ad, ad_len, keys.auth_key, nonce);
1663 keys.enc_block(tag, tag, &keys.enc_key.ks);
1664
1665 gcm_siv_crypt(out, in, in_len, tag, keys.enc_block, &keys.enc_key.ks);
1666
1667 OPENSSL_memcpy(&out[in_len], tag, EVP_AEAD_AES_GCM_SIV_TAG_LEN);
1668 *out_len = in_len + EVP_AEAD_AES_GCM_SIV_TAG_LEN;
1669
1670 return 1;
1671 }
1672
aead_aes_gcm_siv_open(const EVP_AEAD_CTX * ctx,uint8_t * out,size_t * out_len,size_t max_out_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * ad,size_t ad_len)1673 static int aead_aes_gcm_siv_open(const EVP_AEAD_CTX *ctx, uint8_t *out,
1674 size_t *out_len, size_t max_out_len,
1675 const uint8_t *nonce, size_t nonce_len,
1676 const uint8_t *in, size_t in_len,
1677 const uint8_t *ad, size_t ad_len) {
1678 const uint64_t ad_len_64 = ad_len;
1679 if (ad_len_64 >= (UINT64_C(1) << 61)) {
1680 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
1681 return 0;
1682 }
1683
1684 const uint64_t in_len_64 = in_len;
1685 if (in_len < EVP_AEAD_AES_GCM_SIV_TAG_LEN ||
1686 in_len_64 > (UINT64_C(1) << 36) + AES_BLOCK_SIZE) {
1687 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
1688 return 0;
1689 }
1690
1691 if (nonce_len != EVP_AEAD_AES_GCM_SIV_NONCE_LEN) {
1692 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
1693 return 0;
1694 }
1695
1696 const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx = ctx->aead_state;
1697 const size_t plaintext_len = in_len - EVP_AEAD_AES_GCM_SIV_TAG_LEN;
1698
1699 if (max_out_len < plaintext_len) {
1700 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
1701 return 0;
1702 }
1703
1704 struct gcm_siv_record_keys keys;
1705 gcm_siv_keys(gcm_siv_ctx, &keys, nonce);
1706
1707 gcm_siv_crypt(out, in, plaintext_len, &in[plaintext_len], keys.enc_block,
1708 &keys.enc_key.ks);
1709
1710 uint8_t expected_tag[EVP_AEAD_AES_GCM_SIV_TAG_LEN];
1711 gcm_siv_polyval(expected_tag, out, plaintext_len, ad, ad_len, keys.auth_key,
1712 nonce);
1713 keys.enc_block(expected_tag, expected_tag, &keys.enc_key.ks);
1714
1715 if (CRYPTO_memcmp(expected_tag, &in[plaintext_len], sizeof(expected_tag)) !=
1716 0) {
1717 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
1718 return 0;
1719 }
1720
1721 *out_len = plaintext_len;
1722 return 1;
1723 }
1724
1725 static const EVP_AEAD aead_aes_128_gcm_siv = {
1726 16, /* key length */
1727 EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
1728 EVP_AEAD_AES_GCM_SIV_TAG_LEN, /* overhead */
1729 EVP_AEAD_AES_GCM_SIV_TAG_LEN, /* max tag length */
1730
1731 aead_aes_gcm_siv_init,
1732 NULL /* init_with_direction */,
1733 aead_aes_gcm_siv_cleanup,
1734 aead_aes_gcm_siv_seal,
1735 aead_aes_gcm_siv_open,
1736 NULL /* get_iv */,
1737 };
1738
1739 static const EVP_AEAD aead_aes_256_gcm_siv = {
1740 32, /* key length */
1741 EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
1742 EVP_AEAD_AES_GCM_SIV_TAG_LEN, /* overhead */
1743 EVP_AEAD_AES_GCM_SIV_TAG_LEN, /* max tag length */
1744
1745 aead_aes_gcm_siv_init,
1746 NULL /* init_with_direction */,
1747 aead_aes_gcm_siv_cleanup,
1748 aead_aes_gcm_siv_seal,
1749 aead_aes_gcm_siv_open,
1750 NULL /* get_iv */,
1751 };
1752
EVP_aead_aes_128_gcm_siv(void)1753 const EVP_AEAD *EVP_aead_aes_128_gcm_siv(void) {
1754 return &aead_aes_128_gcm_siv;
1755 }
1756
EVP_aead_aes_256_gcm_siv(void)1757 const EVP_AEAD *EVP_aead_aes_256_gcm_siv(void) {
1758 return &aead_aes_256_gcm_siv;
1759 }
1760
1761 #endif /* !OPENSSL_SMALL */
1762
EVP_has_aes_hardware(void)1763 int EVP_has_aes_hardware(void) {
1764 #if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
1765 return aesni_capable() && crypto_gcm_clmul_enabled();
1766 #elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
1767 return hwaes_capable() && CRYPTO_is_ARMv8_PMULL_capable();
1768 #else
1769 return 0;
1770 #endif
1771 }
1772