1 /* Copyright (c) 2015, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/ssl.h>
16
17 #include <assert.h>
18 #include <string.h>
19
20 #include <openssl/aead.h>
21 #include <openssl/err.h>
22 #include <openssl/rand.h>
23 #include <openssl/type_check.h>
24
25 #include "../crypto/internal.h"
26 #include "internal.h"
27
28
SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,uint16_t version,const SSL_CIPHER * cipher,const uint8_t * enc_key,size_t enc_key_len,const uint8_t * mac_key,size_t mac_key_len,const uint8_t * fixed_iv,size_t fixed_iv_len)29 SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,
30 uint16_t version, const SSL_CIPHER *cipher,
31 const uint8_t *enc_key, size_t enc_key_len,
32 const uint8_t *mac_key, size_t mac_key_len,
33 const uint8_t *fixed_iv, size_t fixed_iv_len) {
34 const EVP_AEAD *aead;
35 size_t expected_mac_key_len, expected_fixed_iv_len;
36 if (!ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len,
37 &expected_fixed_iv_len, cipher, version) ||
38 /* Ensure the caller returned correct key sizes. */
39 expected_fixed_iv_len != fixed_iv_len ||
40 expected_mac_key_len != mac_key_len) {
41 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
42 return 0;
43 }
44
45 uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH];
46 if (mac_key_len > 0) {
47 /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher
48 * suites). */
49 if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) {
50 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
51 return 0;
52 }
53 OPENSSL_memcpy(merged_key, mac_key, mac_key_len);
54 OPENSSL_memcpy(merged_key + mac_key_len, enc_key, enc_key_len);
55 OPENSSL_memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv,
56 fixed_iv_len);
57 enc_key = merged_key;
58 enc_key_len += mac_key_len;
59 enc_key_len += fixed_iv_len;
60 }
61
62 SSL_AEAD_CTX *aead_ctx = OPENSSL_malloc(sizeof(SSL_AEAD_CTX));
63 if (aead_ctx == NULL) {
64 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
65 return NULL;
66 }
67 OPENSSL_memset(aead_ctx, 0, sizeof(SSL_AEAD_CTX));
68 aead_ctx->cipher = cipher;
69 aead_ctx->version = version;
70
71 if (!EVP_AEAD_CTX_init_with_direction(
72 &aead_ctx->ctx, aead, enc_key, enc_key_len,
73 EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) {
74 OPENSSL_free(aead_ctx);
75 return NULL;
76 }
77
78 assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH);
79 OPENSSL_COMPILE_ASSERT(EVP_AEAD_MAX_NONCE_LENGTH < 256,
80 variable_nonce_len_doesnt_fit_in_uint8_t);
81 aead_ctx->variable_nonce_len = (uint8_t)EVP_AEAD_nonce_length(aead);
82 if (mac_key_len == 0) {
83 assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce));
84 OPENSSL_memcpy(aead_ctx->fixed_nonce, fixed_iv, fixed_iv_len);
85 aead_ctx->fixed_nonce_len = fixed_iv_len;
86
87 if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) {
88 /* The fixed nonce into the actual nonce (the sequence number). */
89 aead_ctx->xor_fixed_nonce = 1;
90 aead_ctx->variable_nonce_len = 8;
91 } else {
92 /* The fixed IV is prepended to the nonce. */
93 assert(fixed_iv_len <= aead_ctx->variable_nonce_len);
94 aead_ctx->variable_nonce_len -= fixed_iv_len;
95 }
96
97 /* AES-GCM uses an explicit nonce. */
98 if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) {
99 aead_ctx->variable_nonce_included_in_record = 1;
100 }
101
102 /* The TLS 1.3 construction XORs the fixed nonce into the sequence number
103 * and omits the additional data. */
104 if (version >= TLS1_3_VERSION) {
105 aead_ctx->xor_fixed_nonce = 1;
106 aead_ctx->variable_nonce_len = 8;
107 aead_ctx->variable_nonce_included_in_record = 0;
108 aead_ctx->omit_ad = 1;
109 assert(fixed_iv_len >= aead_ctx->variable_nonce_len);
110 }
111 } else {
112 assert(version < TLS1_3_VERSION);
113 aead_ctx->variable_nonce_included_in_record = 1;
114 aead_ctx->random_variable_nonce = 1;
115 aead_ctx->omit_length_in_ad = 1;
116 aead_ctx->omit_version_in_ad = (version == SSL3_VERSION);
117 }
118
119 return aead_ctx;
120 }
121
SSL_AEAD_CTX_free(SSL_AEAD_CTX * aead)122 void SSL_AEAD_CTX_free(SSL_AEAD_CTX *aead) {
123 if (aead == NULL) {
124 return;
125 }
126 EVP_AEAD_CTX_cleanup(&aead->ctx);
127 OPENSSL_free(aead);
128 }
129
SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX * aead)130 size_t SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX *aead) {
131 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
132 aead = NULL;
133 #endif
134
135 if (aead != NULL && aead->variable_nonce_included_in_record) {
136 return aead->variable_nonce_len;
137 }
138 return 0;
139 }
140
SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX * aead)141 size_t SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX *aead) {
142 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
143 aead = NULL;
144 #endif
145
146 if (aead == NULL) {
147 return 0;
148 }
149 return EVP_AEAD_max_overhead(aead->ctx.aead) +
150 SSL_AEAD_CTX_explicit_nonce_len(aead);
151 }
152
153 /* ssl_aead_ctx_get_ad writes the additional data for |aead| into |out| and
154 * returns the number of bytes written. */
ssl_aead_ctx_get_ad(SSL_AEAD_CTX * aead,uint8_t out[13],uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],size_t plaintext_len)155 static size_t ssl_aead_ctx_get_ad(SSL_AEAD_CTX *aead, uint8_t out[13],
156 uint8_t type, uint16_t wire_version,
157 const uint8_t seqnum[8],
158 size_t plaintext_len) {
159 if (aead->omit_ad) {
160 return 0;
161 }
162
163 OPENSSL_memcpy(out, seqnum, 8);
164 size_t len = 8;
165 out[len++] = type;
166 if (!aead->omit_version_in_ad) {
167 out[len++] = (uint8_t)(wire_version >> 8);
168 out[len++] = (uint8_t)wire_version;
169 }
170 if (!aead->omit_length_in_ad) {
171 out[len++] = (uint8_t)(plaintext_len >> 8);
172 out[len++] = (uint8_t)plaintext_len;
173 }
174 return len;
175 }
176
SSL_AEAD_CTX_open(SSL_AEAD_CTX * aead,CBS * out,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],uint8_t * in,size_t in_len)177 int SSL_AEAD_CTX_open(SSL_AEAD_CTX *aead, CBS *out, uint8_t type,
178 uint16_t wire_version, const uint8_t seqnum[8],
179 uint8_t *in, size_t in_len) {
180 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
181 aead = NULL;
182 #endif
183
184 if (aead == NULL) {
185 /* Handle the initial NULL cipher. */
186 CBS_init(out, in, in_len);
187 return 1;
188 }
189
190 /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed
191 * overhead. Otherwise the parameter is unused. */
192 size_t plaintext_len = 0;
193 if (!aead->omit_length_in_ad) {
194 size_t overhead = SSL_AEAD_CTX_max_overhead(aead);
195 if (in_len < overhead) {
196 /* Publicly invalid. */
197 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
198 return 0;
199 }
200 plaintext_len = in_len - overhead;
201 }
202 uint8_t ad[13];
203 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
204 plaintext_len);
205
206 /* Assemble the nonce. */
207 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
208 size_t nonce_len = 0;
209
210 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
211 if (aead->xor_fixed_nonce) {
212 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
213 OPENSSL_memset(nonce, 0, nonce_len);
214 } else {
215 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
216 nonce_len += aead->fixed_nonce_len;
217 }
218
219 /* Add the variable nonce. */
220 if (aead->variable_nonce_included_in_record) {
221 if (in_len < aead->variable_nonce_len) {
222 /* Publicly invalid. */
223 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
224 return 0;
225 }
226 OPENSSL_memcpy(nonce + nonce_len, in, aead->variable_nonce_len);
227 in += aead->variable_nonce_len;
228 in_len -= aead->variable_nonce_len;
229 } else {
230 assert(aead->variable_nonce_len == 8);
231 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
232 }
233 nonce_len += aead->variable_nonce_len;
234
235 /* XOR the fixed nonce, if necessary. */
236 if (aead->xor_fixed_nonce) {
237 assert(nonce_len == aead->fixed_nonce_len);
238 for (size_t i = 0; i < aead->fixed_nonce_len; i++) {
239 nonce[i] ^= aead->fixed_nonce[i];
240 }
241 }
242
243 /* Decrypt in-place. */
244 size_t len;
245 if (!EVP_AEAD_CTX_open(&aead->ctx, in, &len, in_len, nonce, nonce_len,
246 in, in_len, ad, ad_len)) {
247 return 0;
248 }
249 CBS_init(out, in, len);
250 return 1;
251 }
252
SSL_AEAD_CTX_seal(SSL_AEAD_CTX * aead,uint8_t * out,size_t * out_len,size_t max_out,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],const uint8_t * in,size_t in_len)253 int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len,
254 size_t max_out, uint8_t type, uint16_t wire_version,
255 const uint8_t seqnum[8], const uint8_t *in,
256 size_t in_len) {
257 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
258 aead = NULL;
259 #endif
260
261 if (aead == NULL) {
262 /* Handle the initial NULL cipher. */
263 if (in_len > max_out) {
264 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
265 return 0;
266 }
267 OPENSSL_memmove(out, in, in_len);
268 *out_len = in_len;
269 return 1;
270 }
271
272 uint8_t ad[13];
273 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
274 in_len);
275
276 /* Assemble the nonce. */
277 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
278 size_t nonce_len = 0;
279
280 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
281 if (aead->xor_fixed_nonce) {
282 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
283 OPENSSL_memset(nonce, 0, nonce_len);
284 } else {
285 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
286 nonce_len += aead->fixed_nonce_len;
287 }
288
289 /* Select the variable nonce. */
290 if (aead->random_variable_nonce) {
291 assert(aead->variable_nonce_included_in_record);
292 if (!RAND_bytes(nonce + nonce_len, aead->variable_nonce_len)) {
293 return 0;
294 }
295 } else {
296 /* When sending we use the sequence number as the variable part of the
297 * nonce. */
298 assert(aead->variable_nonce_len == 8);
299 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
300 }
301 nonce_len += aead->variable_nonce_len;
302
303 /* Emit the variable nonce if included in the record. */
304 size_t extra_len = 0;
305 if (aead->variable_nonce_included_in_record) {
306 assert(!aead->xor_fixed_nonce);
307 if (max_out < aead->variable_nonce_len) {
308 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
309 return 0;
310 }
311 if (out < in + in_len && in < out + aead->variable_nonce_len) {
312 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
313 return 0;
314 }
315 OPENSSL_memcpy(out, nonce + aead->fixed_nonce_len,
316 aead->variable_nonce_len);
317 extra_len = aead->variable_nonce_len;
318 out += aead->variable_nonce_len;
319 max_out -= aead->variable_nonce_len;
320 }
321
322 /* XOR the fixed nonce, if necessary. */
323 if (aead->xor_fixed_nonce) {
324 assert(nonce_len == aead->fixed_nonce_len);
325 for (size_t i = 0; i < aead->fixed_nonce_len; i++) {
326 nonce[i] ^= aead->fixed_nonce[i];
327 }
328 }
329
330 if (!EVP_AEAD_CTX_seal(&aead->ctx, out, out_len, max_out, nonce, nonce_len,
331 in, in_len, ad, ad_len)) {
332 return 0;
333 }
334 *out_len += extra_len;
335 return 1;
336 }
337