1 /* Copyright (c) 2017, Google Inc.
2  *
3  * Permission to use, copy, modify, and/or distribute this software for any
4  * purpose with or without fee is hereby granted, provided that the above
5  * copyright notice and this permission notice appear in all copies.
6  *
7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14 
15 #include <openssl/aead.h>
16 #include <openssl/cipher.h>
17 #include <openssl/crypto.h>
18 #include <openssl/err.h>
19 #include <openssl/sha.h>
20 
21 #include "../fipsmodule/cipher/internal.h"
22 
23 
24 #define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
25 #define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
26 
27 struct aead_aes_ctr_hmac_sha256_ctx {
28   union {
29     double align;
30     AES_KEY ks;
31   } ks;
32   ctr128_f ctr;
33   block128_f block;
34   SHA256_CTX inner_init_state;
35   SHA256_CTX outer_init_state;
36 };
37 
hmac_init(SHA256_CTX * out_inner,SHA256_CTX * out_outer,const uint8_t hmac_key[32])38 static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer,
39                       const uint8_t hmac_key[32]) {
40   static const size_t hmac_key_len = 32;
41   uint8_t block[SHA256_CBLOCK];
42   OPENSSL_memcpy(block, hmac_key, hmac_key_len);
43   OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len);
44 
45   unsigned i;
46   for (i = 0; i < hmac_key_len; i++) {
47     block[i] ^= 0x36;
48   }
49 
50   SHA256_Init(out_inner);
51   SHA256_Update(out_inner, block, sizeof(block));
52 
53   OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len);
54   for (i = 0; i < hmac_key_len; i++) {
55     block[i] ^= (0x36 ^ 0x5c);
56   }
57 
58   SHA256_Init(out_outer);
59   SHA256_Update(out_outer, block, sizeof(block));
60 }
61 
aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX * ctx,const uint8_t * key,size_t key_len,size_t tag_len)62 static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
63                                          size_t key_len, size_t tag_len) {
64   struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx;
65   static const size_t hmac_key_len = 32;
66 
67   if (key_len < hmac_key_len) {
68     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
69     return 0;  // EVP_AEAD_CTX_init should catch this.
70   }
71 
72   const size_t aes_key_len = key_len - hmac_key_len;
73   if (aes_key_len != 16 && aes_key_len != 32) {
74     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
75     return 0;  // EVP_AEAD_CTX_init should catch this.
76   }
77 
78   if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
79     tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN;
80   }
81 
82   if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) {
83     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
84     return 0;
85   }
86 
87   aes_ctx = OPENSSL_malloc(sizeof(struct aead_aes_ctr_hmac_sha256_ctx));
88   if (aes_ctx == NULL) {
89     OPENSSL_PUT_ERROR(CIPHER, ERR_R_MALLOC_FAILURE);
90     return 0;
91   }
92 
93   aes_ctx->ctr =
94       aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len);
95   ctx->tag_len = tag_len;
96   hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state,
97             key + aes_key_len);
98 
99   ctx->aead_state = aes_ctx;
100 
101   return 1;
102 }
103 
aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX * ctx)104 static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {
105   OPENSSL_free(ctx->aead_state);
106 }
107 
hmac_update_uint64(SHA256_CTX * sha256,uint64_t value)108 static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
109   unsigned i;
110   uint8_t bytes[8];
111 
112   for (i = 0; i < sizeof(bytes); i++) {
113     bytes[i] = value & 0xff;
114     value >>= 8;
115   }
116   SHA256_Update(sha256, bytes, sizeof(bytes));
117 }
118 
hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],const SHA256_CTX * inner_init_state,const SHA256_CTX * outer_init_state,const uint8_t * ad,size_t ad_len,const uint8_t * nonce,const uint8_t * ciphertext,size_t ciphertext_len)119 static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
120                            const SHA256_CTX *inner_init_state,
121                            const SHA256_CTX *outer_init_state,
122                            const uint8_t *ad, size_t ad_len,
123                            const uint8_t *nonce, const uint8_t *ciphertext,
124                            size_t ciphertext_len) {
125   SHA256_CTX sha256;
126   OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
127   hmac_update_uint64(&sha256, ad_len);
128   hmac_update_uint64(&sha256, ciphertext_len);
129   SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
130   SHA256_Update(&sha256, ad, ad_len);
131 
132   // Pad with zeros to the end of the SHA-256 block.
133   const unsigned num_padding =
134       (SHA256_CBLOCK - ((sizeof(uint64_t)*2 +
135                          EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) %
136                         SHA256_CBLOCK)) %
137       SHA256_CBLOCK;
138   uint8_t padding[SHA256_CBLOCK];
139   OPENSSL_memset(padding, 0, num_padding);
140   SHA256_Update(&sha256, padding, num_padding);
141 
142   SHA256_Update(&sha256, ciphertext, ciphertext_len);
143 
144   uint8_t inner_digest[SHA256_DIGEST_LENGTH];
145   SHA256_Final(inner_digest, &sha256);
146 
147   OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256));
148   SHA256_Update(&sha256, inner_digest, sizeof(inner_digest));
149   SHA256_Final(out, &sha256);
150 }
151 
aead_aes_ctr_hmac_sha256_crypt(const struct aead_aes_ctr_hmac_sha256_ctx * aes_ctx,uint8_t * out,const uint8_t * in,size_t len,const uint8_t * nonce)152 static void aead_aes_ctr_hmac_sha256_crypt(
153     const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out,
154     const uint8_t *in, size_t len, const uint8_t *nonce) {
155   // Since the AEAD operation is one-shot, keeping a buffer of unused keystream
156   // bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it.
157   uint8_t partial_block_buffer[AES_BLOCK_SIZE];
158   unsigned partial_block_offset = 0;
159   OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
160 
161   uint8_t counter[AES_BLOCK_SIZE];
162   OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
163   OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4);
164 
165   if (aes_ctx->ctr) {
166     CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter,
167                                 partial_block_buffer, &partial_block_offset,
168                                 aes_ctx->ctr);
169   } else {
170     CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter,
171                           partial_block_buffer, &partial_block_offset,
172                           aes_ctx->block);
173   }
174 }
175 
aead_aes_ctr_hmac_sha256_seal_scatter(const EVP_AEAD_CTX * ctx,uint8_t * out,uint8_t * out_tag,size_t * out_tag_len,size_t max_out_tag_len,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * extra_in,size_t extra_in_len,const uint8_t * ad,size_t ad_len)176 static int aead_aes_ctr_hmac_sha256_seal_scatter(
177     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
178     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
179     size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
180     size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
181   const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
182   const uint64_t in_len_64 = in_len;
183 
184   if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
185      // This input is so large it would overflow the 32-bit block counter.
186     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
187     return 0;
188   }
189 
190   if (max_out_tag_len < ctx->tag_len) {
191     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
192     return 0;
193   }
194 
195   if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
196     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
197     return 0;
198   }
199 
200   aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
201 
202   uint8_t hmac_result[SHA256_DIGEST_LENGTH];
203   hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
204                  &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len);
205   OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len);
206   *out_tag_len = ctx->tag_len;
207 
208   return 1;
209 }
210 
aead_aes_ctr_hmac_sha256_open_gather(const EVP_AEAD_CTX * ctx,uint8_t * out,const uint8_t * nonce,size_t nonce_len,const uint8_t * in,size_t in_len,const uint8_t * in_tag,size_t in_tag_len,const uint8_t * ad,size_t ad_len)211 static int aead_aes_ctr_hmac_sha256_open_gather(
212     const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce,
213     size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag,
214     size_t in_tag_len, const uint8_t *ad, size_t ad_len) {
215   const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
216 
217   if (in_tag_len != ctx->tag_len) {
218     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
219     return 0;
220   }
221 
222   if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
223     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
224     return 0;
225   }
226 
227   uint8_t hmac_result[SHA256_DIGEST_LENGTH];
228   hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
229                  &aes_ctx->outer_init_state, ad, ad_len, nonce, in,
230                  in_len);
231   if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) {
232     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
233     return 0;
234   }
235 
236   aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
237 
238   return 1;
239 }
240 
241 static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
242     16 /* AES key */ + 32 /* HMAC key */,
243     12,                                    // nonce length
244     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
245     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
246     0,                                     // seal_scatter_supports_extra_in
247 
248     aead_aes_ctr_hmac_sha256_init,
249     NULL /* init_with_direction */,
250     aead_aes_ctr_hmac_sha256_cleanup,
251     NULL /* open */,
252     aead_aes_ctr_hmac_sha256_seal_scatter,
253     aead_aes_ctr_hmac_sha256_open_gather,
254     NULL /* get_iv */,
255     NULL /* tag_len */,
256 };
257 
258 static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
259     32 /* AES key */ + 32 /* HMAC key */,
260     12,                                    // nonce length
261     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
262     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
263     0,                                     // seal_scatter_supports_extra_in
264 
265     aead_aes_ctr_hmac_sha256_init,
266     NULL /* init_with_direction */,
267     aead_aes_ctr_hmac_sha256_cleanup,
268     NULL /* open */,
269     aead_aes_ctr_hmac_sha256_seal_scatter,
270     aead_aes_ctr_hmac_sha256_open_gather,
271     NULL /* get_iv */,
272     NULL /* tag_len */,
273 };
274 
EVP_aead_aes_128_ctr_hmac_sha256(void)275 const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) {
276   return &aead_aes_128_ctr_hmac_sha256;
277 }
278 
EVP_aead_aes_256_ctr_hmac_sha256(void)279 const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) {
280   return &aead_aes_256_ctr_hmac_sha256;
281 }
282