1 /* Copyright (c) 2015, Google Inc. 2 * 3 * Permission to use, copy, modify, and/or distribute this software for any 4 * purpose with or without fee is hereby granted, provided that the above 5 * copyright notice and this permission notice appear in all copies. 6 * 7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ 14 15 #include <openssl/ssl.h> 16 17 #include <assert.h> 18 #include <string.h> 19 20 #include <openssl/aead.h> 21 #include <openssl/err.h> 22 #include <openssl/rand.h> 23 #include <openssl/type_check.h> 24 25 #include "../crypto/internal.h" 26 #include "internal.h" 27 28 29 SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction, 30 uint16_t version, const SSL_CIPHER *cipher, 31 const uint8_t *enc_key, size_t enc_key_len, 32 const uint8_t *mac_key, size_t mac_key_len, 33 const uint8_t *fixed_iv, size_t fixed_iv_len) { 34 const EVP_AEAD *aead; 35 size_t expected_mac_key_len, expected_fixed_iv_len; 36 if (!ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len, 37 &expected_fixed_iv_len, cipher, version) || 38 /* Ensure the caller returned correct key sizes. */ 39 expected_fixed_iv_len != fixed_iv_len || 40 expected_mac_key_len != mac_key_len) { 41 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); 42 return 0; 43 } 44 45 uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH]; 46 if (mac_key_len > 0) { 47 /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher 48 * suites). */ 49 if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) { 50 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); 51 return 0; 52 } 53 OPENSSL_memcpy(merged_key, mac_key, mac_key_len); 54 OPENSSL_memcpy(merged_key + mac_key_len, enc_key, enc_key_len); 55 OPENSSL_memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv, 56 fixed_iv_len); 57 enc_key = merged_key; 58 enc_key_len += mac_key_len; 59 enc_key_len += fixed_iv_len; 60 } 61 62 SSL_AEAD_CTX *aead_ctx = OPENSSL_malloc(sizeof(SSL_AEAD_CTX)); 63 if (aead_ctx == NULL) { 64 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); 65 return NULL; 66 } 67 OPENSSL_memset(aead_ctx, 0, sizeof(SSL_AEAD_CTX)); 68 aead_ctx->cipher = cipher; 69 aead_ctx->version = version; 70 71 if (!EVP_AEAD_CTX_init_with_direction( 72 &aead_ctx->ctx, aead, enc_key, enc_key_len, 73 EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) { 74 OPENSSL_free(aead_ctx); 75 return NULL; 76 } 77 78 assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH); 79 OPENSSL_COMPILE_ASSERT(EVP_AEAD_MAX_NONCE_LENGTH < 256, 80 variable_nonce_len_doesnt_fit_in_uint8_t); 81 aead_ctx->variable_nonce_len = (uint8_t)EVP_AEAD_nonce_length(aead); 82 if (mac_key_len == 0) { 83 assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce)); 84 OPENSSL_memcpy(aead_ctx->fixed_nonce, fixed_iv, fixed_iv_len); 85 aead_ctx->fixed_nonce_len = fixed_iv_len; 86 87 if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) { 88 /* The fixed nonce into the actual nonce (the sequence number). */ 89 aead_ctx->xor_fixed_nonce = 1; 90 aead_ctx->variable_nonce_len = 8; 91 } else { 92 /* The fixed IV is prepended to the nonce. */ 93 assert(fixed_iv_len <= aead_ctx->variable_nonce_len); 94 aead_ctx->variable_nonce_len -= fixed_iv_len; 95 } 96 97 /* AES-GCM uses an explicit nonce. */ 98 if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) { 99 aead_ctx->variable_nonce_included_in_record = 1; 100 } 101 102 /* The TLS 1.3 construction XORs the fixed nonce into the sequence number 103 * and omits the additional data. */ 104 if (version >= TLS1_3_VERSION) { 105 aead_ctx->xor_fixed_nonce = 1; 106 aead_ctx->variable_nonce_len = 8; 107 aead_ctx->variable_nonce_included_in_record = 0; 108 aead_ctx->omit_ad = 1; 109 assert(fixed_iv_len >= aead_ctx->variable_nonce_len); 110 } 111 } else { 112 assert(version < TLS1_3_VERSION); 113 aead_ctx->variable_nonce_included_in_record = 1; 114 aead_ctx->random_variable_nonce = 1; 115 aead_ctx->omit_length_in_ad = 1; 116 aead_ctx->omit_version_in_ad = (version == SSL3_VERSION); 117 } 118 119 return aead_ctx; 120 } 121 122 void SSL_AEAD_CTX_free(SSL_AEAD_CTX *aead) { 123 if (aead == NULL) { 124 return; 125 } 126 EVP_AEAD_CTX_cleanup(&aead->ctx); 127 OPENSSL_free(aead); 128 } 129 130 size_t SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX *aead) { 131 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 132 aead = NULL; 133 #endif 134 135 if (aead != NULL && aead->variable_nonce_included_in_record) { 136 return aead->variable_nonce_len; 137 } 138 return 0; 139 } 140 141 size_t SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX *aead) { 142 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 143 aead = NULL; 144 #endif 145 146 if (aead == NULL) { 147 return 0; 148 } 149 return EVP_AEAD_max_overhead(aead->ctx.aead) + 150 SSL_AEAD_CTX_explicit_nonce_len(aead); 151 } 152 153 /* ssl_aead_ctx_get_ad writes the additional data for |aead| into |out| and 154 * returns the number of bytes written. */ 155 static size_t ssl_aead_ctx_get_ad(SSL_AEAD_CTX *aead, uint8_t out[13], 156 uint8_t type, uint16_t wire_version, 157 const uint8_t seqnum[8], 158 size_t plaintext_len) { 159 if (aead->omit_ad) { 160 return 0; 161 } 162 163 OPENSSL_memcpy(out, seqnum, 8); 164 size_t len = 8; 165 out[len++] = type; 166 if (!aead->omit_version_in_ad) { 167 out[len++] = (uint8_t)(wire_version >> 8); 168 out[len++] = (uint8_t)wire_version; 169 } 170 if (!aead->omit_length_in_ad) { 171 out[len++] = (uint8_t)(plaintext_len >> 8); 172 out[len++] = (uint8_t)plaintext_len; 173 } 174 return len; 175 } 176 177 int SSL_AEAD_CTX_open(SSL_AEAD_CTX *aead, CBS *out, uint8_t type, 178 uint16_t wire_version, const uint8_t seqnum[8], 179 uint8_t *in, size_t in_len) { 180 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 181 aead = NULL; 182 #endif 183 184 if (aead == NULL) { 185 /* Handle the initial NULL cipher. */ 186 CBS_init(out, in, in_len); 187 return 1; 188 } 189 190 /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed 191 * overhead. Otherwise the parameter is unused. */ 192 size_t plaintext_len = 0; 193 if (!aead->omit_length_in_ad) { 194 size_t overhead = SSL_AEAD_CTX_max_overhead(aead); 195 if (in_len < overhead) { 196 /* Publicly invalid. */ 197 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); 198 return 0; 199 } 200 plaintext_len = in_len - overhead; 201 } 202 uint8_t ad[13]; 203 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum, 204 plaintext_len); 205 206 /* Assemble the nonce. */ 207 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; 208 size_t nonce_len = 0; 209 210 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */ 211 if (aead->xor_fixed_nonce) { 212 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len; 213 OPENSSL_memset(nonce, 0, nonce_len); 214 } else { 215 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len); 216 nonce_len += aead->fixed_nonce_len; 217 } 218 219 /* Add the variable nonce. */ 220 if (aead->variable_nonce_included_in_record) { 221 if (in_len < aead->variable_nonce_len) { 222 /* Publicly invalid. */ 223 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); 224 return 0; 225 } 226 OPENSSL_memcpy(nonce + nonce_len, in, aead->variable_nonce_len); 227 in += aead->variable_nonce_len; 228 in_len -= aead->variable_nonce_len; 229 } else { 230 assert(aead->variable_nonce_len == 8); 231 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len); 232 } 233 nonce_len += aead->variable_nonce_len; 234 235 /* XOR the fixed nonce, if necessary. */ 236 if (aead->xor_fixed_nonce) { 237 assert(nonce_len == aead->fixed_nonce_len); 238 for (size_t i = 0; i < aead->fixed_nonce_len; i++) { 239 nonce[i] ^= aead->fixed_nonce[i]; 240 } 241 } 242 243 /* Decrypt in-place. */ 244 size_t len; 245 if (!EVP_AEAD_CTX_open(&aead->ctx, in, &len, in_len, nonce, nonce_len, 246 in, in_len, ad, ad_len)) { 247 return 0; 248 } 249 CBS_init(out, in, len); 250 return 1; 251 } 252 253 int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len, 254 size_t max_out, uint8_t type, uint16_t wire_version, 255 const uint8_t seqnum[8], const uint8_t *in, 256 size_t in_len) { 257 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 258 aead = NULL; 259 #endif 260 261 if (aead == NULL) { 262 /* Handle the initial NULL cipher. */ 263 if (in_len > max_out) { 264 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); 265 return 0; 266 } 267 OPENSSL_memmove(out, in, in_len); 268 *out_len = in_len; 269 return 1; 270 } 271 272 uint8_t ad[13]; 273 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum, 274 in_len); 275 276 /* Assemble the nonce. */ 277 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; 278 size_t nonce_len = 0; 279 280 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */ 281 if (aead->xor_fixed_nonce) { 282 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len; 283 OPENSSL_memset(nonce, 0, nonce_len); 284 } else { 285 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len); 286 nonce_len += aead->fixed_nonce_len; 287 } 288 289 /* Select the variable nonce. */ 290 if (aead->random_variable_nonce) { 291 assert(aead->variable_nonce_included_in_record); 292 if (!RAND_bytes(nonce + nonce_len, aead->variable_nonce_len)) { 293 return 0; 294 } 295 } else { 296 /* When sending we use the sequence number as the variable part of the 297 * nonce. */ 298 assert(aead->variable_nonce_len == 8); 299 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len); 300 } 301 nonce_len += aead->variable_nonce_len; 302 303 /* Emit the variable nonce if included in the record. */ 304 size_t extra_len = 0; 305 if (aead->variable_nonce_included_in_record) { 306 assert(!aead->xor_fixed_nonce); 307 if (max_out < aead->variable_nonce_len) { 308 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); 309 return 0; 310 } 311 if (out < in + in_len && in < out + aead->variable_nonce_len) { 312 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); 313 return 0; 314 } 315 OPENSSL_memcpy(out, nonce + aead->fixed_nonce_len, 316 aead->variable_nonce_len); 317 extra_len = aead->variable_nonce_len; 318 out += aead->variable_nonce_len; 319 max_out -= aead->variable_nonce_len; 320 } 321 322 /* XOR the fixed nonce, if necessary. */ 323 if (aead->xor_fixed_nonce) { 324 assert(nonce_len == aead->fixed_nonce_len); 325 for (size_t i = 0; i < aead->fixed_nonce_len; i++) { 326 nonce[i] ^= aead->fixed_nonce[i]; 327 } 328 } 329 330 if (!EVP_AEAD_CTX_seal(&aead->ctx, out, out_len, max_out, nonce, nonce_len, 331 in, in_len, ad, ad_len)) { 332 return 0; 333 } 334 *out_len += extra_len; 335 return 1; 336 } 337
