1 /* Copyright (c) 2017, Google Inc. 2 * 3 * Permission to use, copy, modify, and/or distribute this software for any 4 * purpose with or without fee is hereby granted, provided that the above 5 * copyright notice and this permission notice appear in all copies. 6 * 7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ 14 15 #include <openssl/aead.h> 16 #include <openssl/cipher.h> 17 #include <openssl/crypto.h> 18 #include <openssl/err.h> 19 #include <openssl/sha.h> 20 21 #include "../fipsmodule/cipher/internal.h" 22 23 24 #define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH 25 #define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12 26 27 struct aead_aes_ctr_hmac_sha256_ctx { 28 union { 29 double align; 30 AES_KEY ks; 31 } ks; 32 ctr128_f ctr; 33 block128_f block; 34 SHA256_CTX inner_init_state; 35 SHA256_CTX outer_init_state; 36 }; 37 38 OPENSSL_STATIC_ASSERT(sizeof(((EVP_AEAD_CTX *)NULL)->state) >= 39 sizeof(struct aead_aes_ctr_hmac_sha256_ctx), 40 "AEAD state is too small"); 41 #if defined(__GNUC__) || defined(__clang__) 42 OPENSSL_STATIC_ASSERT(alignof(union evp_aead_ctx_st_state) >= 43 alignof(struct aead_aes_ctr_hmac_sha256_ctx), 44 "AEAD state has insufficient alignment"); 45 #endif 46 47 static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer, 48 const uint8_t hmac_key[32]) { 49 static const size_t hmac_key_len = 32; 50 uint8_t block[SHA256_CBLOCK]; 51 OPENSSL_memcpy(block, hmac_key, hmac_key_len); 52 OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len); 53 54 unsigned i; 55 for (i = 0; i < hmac_key_len; i++) { 56 block[i] ^= 0x36; 57 } 58 59 SHA256_Init(out_inner); 60 SHA256_Update(out_inner, block, sizeof(block)); 61 62 OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len); 63 for (i = 0; i < hmac_key_len; i++) { 64 block[i] ^= (0x36 ^ 0x5c); 65 } 66 67 SHA256_Init(out_outer); 68 SHA256_Update(out_outer, block, sizeof(block)); 69 } 70 71 static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key, 72 size_t key_len, size_t tag_len) { 73 struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = 74 (struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state; 75 static const size_t hmac_key_len = 32; 76 77 if (key_len < hmac_key_len) { 78 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); 79 return 0; // EVP_AEAD_CTX_init should catch this. 80 } 81 82 const size_t aes_key_len = key_len - hmac_key_len; 83 if (aes_key_len != 16 && aes_key_len != 32) { 84 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); 85 return 0; // EVP_AEAD_CTX_init should catch this. 86 } 87 88 if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) { 89 tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN; 90 } 91 92 if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) { 93 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE); 94 return 0; 95 } 96 97 aes_ctx->ctr = 98 aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len); 99 ctx->tag_len = tag_len; 100 hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state, 101 key + aes_key_len); 102 103 return 1; 104 } 105 106 static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {} 107 108 static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) { 109 unsigned i; 110 uint8_t bytes[8]; 111 112 for (i = 0; i < sizeof(bytes); i++) { 113 bytes[i] = value & 0xff; 114 value >>= 8; 115 } 116 SHA256_Update(sha256, bytes, sizeof(bytes)); 117 } 118 119 static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH], 120 const SHA256_CTX *inner_init_state, 121 const SHA256_CTX *outer_init_state, 122 const uint8_t *ad, size_t ad_len, 123 const uint8_t *nonce, const uint8_t *ciphertext, 124 size_t ciphertext_len) { 125 SHA256_CTX sha256; 126 OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256)); 127 hmac_update_uint64(&sha256, ad_len); 128 hmac_update_uint64(&sha256, ciphertext_len); 129 SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN); 130 SHA256_Update(&sha256, ad, ad_len); 131 132 // Pad with zeros to the end of the SHA-256 block. 133 const unsigned num_padding = 134 (SHA256_CBLOCK - ((sizeof(uint64_t)*2 + 135 EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) % 136 SHA256_CBLOCK)) % 137 SHA256_CBLOCK; 138 uint8_t padding[SHA256_CBLOCK]; 139 OPENSSL_memset(padding, 0, num_padding); 140 SHA256_Update(&sha256, padding, num_padding); 141 142 SHA256_Update(&sha256, ciphertext, ciphertext_len); 143 144 uint8_t inner_digest[SHA256_DIGEST_LENGTH]; 145 SHA256_Final(inner_digest, &sha256); 146 147 OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256)); 148 SHA256_Update(&sha256, inner_digest, sizeof(inner_digest)); 149 SHA256_Final(out, &sha256); 150 } 151 152 static void aead_aes_ctr_hmac_sha256_crypt( 153 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out, 154 const uint8_t *in, size_t len, const uint8_t *nonce) { 155 // Since the AEAD operation is one-shot, keeping a buffer of unused keystream 156 // bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it. 157 uint8_t partial_block_buffer[AES_BLOCK_SIZE]; 158 unsigned partial_block_offset = 0; 159 OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer)); 160 161 uint8_t counter[AES_BLOCK_SIZE]; 162 OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN); 163 OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4); 164 165 if (aes_ctx->ctr) { 166 CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter, 167 partial_block_buffer, &partial_block_offset, 168 aes_ctx->ctr); 169 } else { 170 CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter, 171 partial_block_buffer, &partial_block_offset, 172 aes_ctx->block); 173 } 174 } 175 176 static int aead_aes_ctr_hmac_sha256_seal_scatter( 177 const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag, 178 size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce, 179 size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in, 180 size_t extra_in_len, const uint8_t *ad, size_t ad_len) { 181 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = 182 (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state; 183 const uint64_t in_len_64 = in_len; 184 185 if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) { 186 // This input is so large it would overflow the 32-bit block counter. 187 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE); 188 return 0; 189 } 190 191 if (max_out_tag_len < ctx->tag_len) { 192 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL); 193 return 0; 194 } 195 196 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) { 197 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE); 198 return 0; 199 } 200 201 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce); 202 203 uint8_t hmac_result[SHA256_DIGEST_LENGTH]; 204 hmac_calculate(hmac_result, &aes_ctx->inner_init_state, 205 &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len); 206 OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len); 207 *out_tag_len = ctx->tag_len; 208 209 return 1; 210 } 211 212 static int aead_aes_ctr_hmac_sha256_open_gather( 213 const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce, 214 size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag, 215 size_t in_tag_len, const uint8_t *ad, size_t ad_len) { 216 const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = 217 (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state; 218 219 if (in_tag_len != ctx->tag_len) { 220 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT); 221 return 0; 222 } 223 224 if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) { 225 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE); 226 return 0; 227 } 228 229 uint8_t hmac_result[SHA256_DIGEST_LENGTH]; 230 hmac_calculate(hmac_result, &aes_ctx->inner_init_state, 231 &aes_ctx->outer_init_state, ad, ad_len, nonce, in, 232 in_len); 233 if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) { 234 OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT); 235 return 0; 236 } 237 238 aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce); 239 240 return 1; 241 } 242 243 static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = { 244 16 /* AES key */ + 32 /* HMAC key */, 245 12, // nonce length 246 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead 247 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length 248 0, // seal_scatter_supports_extra_in 249 250 aead_aes_ctr_hmac_sha256_init, 251 NULL /* init_with_direction */, 252 aead_aes_ctr_hmac_sha256_cleanup, 253 NULL /* open */, 254 aead_aes_ctr_hmac_sha256_seal_scatter, 255 aead_aes_ctr_hmac_sha256_open_gather, 256 NULL /* get_iv */, 257 NULL /* tag_len */, 258 }; 259 260 static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = { 261 32 /* AES key */ + 32 /* HMAC key */, 262 12, // nonce length 263 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // overhead 264 EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, // max tag length 265 0, // seal_scatter_supports_extra_in 266 267 aead_aes_ctr_hmac_sha256_init, 268 NULL /* init_with_direction */, 269 aead_aes_ctr_hmac_sha256_cleanup, 270 NULL /* open */, 271 aead_aes_ctr_hmac_sha256_seal_scatter, 272 aead_aes_ctr_hmac_sha256_open_gather, 273 NULL /* get_iv */, 274 NULL /* tag_len */, 275 }; 276 277 const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) { 278 return &aead_aes_128_ctr_hmac_sha256; 279 } 280 281 const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) { 282 return &aead_aes_256_ctr_hmac_sha256; 283 } 284