1 /* Copyright (c) 2015, Google Inc. 2 * 3 * Permission to use, copy, modify, and/or distribute this software for any 4 * purpose with or without fee is hereby granted, provided that the above 5 * copyright notice and this permission notice appear in all copies. 6 * 7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ 14 15 #include <openssl/ssl.h> 16 17 #include <assert.h> 18 #include <string.h> 19 20 #include <openssl/aead.h> 21 #include <openssl/err.h> 22 #include <openssl/rand.h> 23 24 #include "../crypto/internal.h" 25 #include "internal.h" 26 27 28 SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction, 29 uint16_t version, int is_dtls, 30 const SSL_CIPHER *cipher, const uint8_t *enc_key, 31 size_t enc_key_len, const uint8_t *mac_key, 32 size_t mac_key_len, const uint8_t *fixed_iv, 33 size_t fixed_iv_len) { 34 const EVP_AEAD *aead; 35 size_t expected_mac_key_len, expected_fixed_iv_len; 36 if (!ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len, 37 &expected_fixed_iv_len, cipher, version, 38 is_dtls) || 39 /* Ensure the caller returned correct key sizes. */ 40 expected_fixed_iv_len != fixed_iv_len || 41 expected_mac_key_len != mac_key_len) { 42 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); 43 return 0; 44 } 45 46 uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH]; 47 if (mac_key_len > 0) { 48 /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher 49 * suites). */ 50 if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) { 51 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); 52 return 0; 53 } 54 OPENSSL_memcpy(merged_key, mac_key, mac_key_len); 55 OPENSSL_memcpy(merged_key + mac_key_len, enc_key, enc_key_len); 56 OPENSSL_memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv, 57 fixed_iv_len); 58 enc_key = merged_key; 59 enc_key_len += mac_key_len; 60 enc_key_len += fixed_iv_len; 61 } 62 63 SSL_AEAD_CTX *aead_ctx = (SSL_AEAD_CTX *)OPENSSL_malloc(sizeof(SSL_AEAD_CTX)); 64 if (aead_ctx == NULL) { 65 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); 66 return NULL; 67 } 68 OPENSSL_memset(aead_ctx, 0, sizeof(SSL_AEAD_CTX)); 69 aead_ctx->cipher = cipher; 70 aead_ctx->version = version; 71 72 if (!EVP_AEAD_CTX_init_with_direction( 73 &aead_ctx->ctx, aead, enc_key, enc_key_len, 74 EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) { 75 OPENSSL_free(aead_ctx); 76 return NULL; 77 } 78 79 assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH); 80 static_assert(EVP_AEAD_MAX_NONCE_LENGTH < 256, 81 "variable_nonce_len doesn't fit in uint8_t"); 82 aead_ctx->variable_nonce_len = (uint8_t)EVP_AEAD_nonce_length(aead); 83 if (mac_key_len == 0) { 84 assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce)); 85 OPENSSL_memcpy(aead_ctx->fixed_nonce, fixed_iv, fixed_iv_len); 86 aead_ctx->fixed_nonce_len = fixed_iv_len; 87 88 if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) { 89 /* The fixed nonce into the actual nonce (the sequence number). */ 90 aead_ctx->xor_fixed_nonce = 1; 91 aead_ctx->variable_nonce_len = 8; 92 } else { 93 /* The fixed IV is prepended to the nonce. */ 94 assert(fixed_iv_len <= aead_ctx->variable_nonce_len); 95 aead_ctx->variable_nonce_len -= fixed_iv_len; 96 } 97 98 /* AES-GCM uses an explicit nonce. */ 99 if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) { 100 aead_ctx->variable_nonce_included_in_record = 1; 101 } 102 103 /* The TLS 1.3 construction XORs the fixed nonce into the sequence number 104 * and omits the additional data. */ 105 if (version >= TLS1_3_VERSION) { 106 aead_ctx->xor_fixed_nonce = 1; 107 aead_ctx->variable_nonce_len = 8; 108 aead_ctx->variable_nonce_included_in_record = 0; 109 aead_ctx->omit_ad = 1; 110 assert(fixed_iv_len >= aead_ctx->variable_nonce_len); 111 } 112 } else { 113 assert(version < TLS1_3_VERSION); 114 aead_ctx->variable_nonce_included_in_record = 1; 115 aead_ctx->random_variable_nonce = 1; 116 aead_ctx->omit_length_in_ad = 1; 117 aead_ctx->omit_version_in_ad = (version == SSL3_VERSION); 118 } 119 120 return aead_ctx; 121 } 122 123 void SSL_AEAD_CTX_free(SSL_AEAD_CTX *aead) { 124 if (aead == NULL) { 125 return; 126 } 127 EVP_AEAD_CTX_cleanup(&aead->ctx); 128 OPENSSL_free(aead); 129 } 130 131 size_t SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX *aead) { 132 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 133 aead = NULL; 134 #endif 135 136 if (aead != NULL && aead->variable_nonce_included_in_record) { 137 return aead->variable_nonce_len; 138 } 139 return 0; 140 } 141 142 size_t SSL_AEAD_CTX_max_suffix_len(const SSL_AEAD_CTX *aead, 143 size_t extra_in_len) { 144 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 145 aead = NULL; 146 #endif 147 148 return extra_in_len + 149 (aead == NULL ? 0 : EVP_AEAD_max_overhead(aead->ctx.aead)); 150 } 151 152 size_t SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX *aead) { 153 return SSL_AEAD_CTX_explicit_nonce_len(aead) + 154 SSL_AEAD_CTX_max_suffix_len(aead, 0); 155 } 156 157 /* ssl_aead_ctx_get_ad writes the additional data for |aead| into |out| and 158 * returns the number of bytes written. */ 159 static size_t ssl_aead_ctx_get_ad(SSL_AEAD_CTX *aead, uint8_t out[13], 160 uint8_t type, uint16_t wire_version, 161 const uint8_t seqnum[8], 162 size_t plaintext_len) { 163 if (aead->omit_ad) { 164 return 0; 165 } 166 167 OPENSSL_memcpy(out, seqnum, 8); 168 size_t len = 8; 169 out[len++] = type; 170 if (!aead->omit_version_in_ad) { 171 out[len++] = (uint8_t)(wire_version >> 8); 172 out[len++] = (uint8_t)wire_version; 173 } 174 if (!aead->omit_length_in_ad) { 175 out[len++] = (uint8_t)(plaintext_len >> 8); 176 out[len++] = (uint8_t)plaintext_len; 177 } 178 return len; 179 } 180 181 int SSL_AEAD_CTX_open(SSL_AEAD_CTX *aead, CBS *out, uint8_t type, 182 uint16_t wire_version, const uint8_t seqnum[8], 183 uint8_t *in, size_t in_len) { 184 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 185 aead = NULL; 186 #endif 187 188 if (aead == NULL) { 189 /* Handle the initial NULL cipher. */ 190 CBS_init(out, in, in_len); 191 return 1; 192 } 193 194 /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed 195 * overhead. Otherwise the parameter is unused. */ 196 size_t plaintext_len = 0; 197 if (!aead->omit_length_in_ad) { 198 size_t overhead = SSL_AEAD_CTX_max_overhead(aead); 199 if (in_len < overhead) { 200 /* Publicly invalid. */ 201 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); 202 return 0; 203 } 204 plaintext_len = in_len - overhead; 205 } 206 uint8_t ad[13]; 207 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum, 208 plaintext_len); 209 210 /* Assemble the nonce. */ 211 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; 212 size_t nonce_len = 0; 213 214 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */ 215 if (aead->xor_fixed_nonce) { 216 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len; 217 OPENSSL_memset(nonce, 0, nonce_len); 218 } else { 219 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len); 220 nonce_len += aead->fixed_nonce_len; 221 } 222 223 /* Add the variable nonce. */ 224 if (aead->variable_nonce_included_in_record) { 225 if (in_len < aead->variable_nonce_len) { 226 /* Publicly invalid. */ 227 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); 228 return 0; 229 } 230 OPENSSL_memcpy(nonce + nonce_len, in, aead->variable_nonce_len); 231 in += aead->variable_nonce_len; 232 in_len -= aead->variable_nonce_len; 233 } else { 234 assert(aead->variable_nonce_len == 8); 235 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len); 236 } 237 nonce_len += aead->variable_nonce_len; 238 239 /* XOR the fixed nonce, if necessary. */ 240 if (aead->xor_fixed_nonce) { 241 assert(nonce_len == aead->fixed_nonce_len); 242 for (size_t i = 0; i < aead->fixed_nonce_len; i++) { 243 nonce[i] ^= aead->fixed_nonce[i]; 244 } 245 } 246 247 /* Decrypt in-place. */ 248 size_t len; 249 if (!EVP_AEAD_CTX_open(&aead->ctx, in, &len, in_len, nonce, nonce_len, 250 in, in_len, ad, ad_len)) { 251 return 0; 252 } 253 CBS_init(out, in, len); 254 return 1; 255 } 256 257 int SSL_AEAD_CTX_seal_scatter(SSL_AEAD_CTX *aead, uint8_t *out_prefix, 258 uint8_t *out, uint8_t *out_suffix, 259 size_t *out_suffix_len, size_t max_out_suffix_len, 260 uint8_t type, uint16_t wire_version, 261 const uint8_t seqnum[8], const uint8_t *in, 262 size_t in_len, const uint8_t *extra_in, 263 size_t extra_in_len) { 264 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 265 aead = NULL; 266 #endif 267 268 if ((in != out && buffers_alias(in, in_len, out, in_len)) || 269 buffers_alias(in, in_len, out_suffix, max_out_suffix_len)) { 270 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); 271 return 0; 272 } 273 if (extra_in_len > max_out_suffix_len) { 274 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); 275 return 0; 276 } 277 278 if (aead == NULL) { 279 /* Handle the initial NULL cipher. */ 280 OPENSSL_memmove(out, in, in_len); 281 OPENSSL_memmove(out_suffix, extra_in, extra_in_len); 282 *out_suffix_len = extra_in_len; 283 return 1; 284 } 285 286 uint8_t ad[13]; 287 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum, 288 in_len); 289 290 /* Assemble the nonce. */ 291 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; 292 size_t nonce_len = 0; 293 294 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */ 295 if (aead->xor_fixed_nonce) { 296 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len; 297 OPENSSL_memset(nonce, 0, nonce_len); 298 } else { 299 OPENSSL_memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len); 300 nonce_len += aead->fixed_nonce_len; 301 } 302 303 /* Select the variable nonce. */ 304 if (aead->random_variable_nonce) { 305 assert(aead->variable_nonce_included_in_record); 306 if (!RAND_bytes(nonce + nonce_len, aead->variable_nonce_len)) { 307 return 0; 308 } 309 } else { 310 /* When sending we use the sequence number as the variable part of the 311 * nonce. */ 312 assert(aead->variable_nonce_len == 8); 313 OPENSSL_memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len); 314 } 315 nonce_len += aead->variable_nonce_len; 316 317 /* Emit the variable nonce if included in the record. */ 318 if (aead->variable_nonce_included_in_record) { 319 assert(!aead->xor_fixed_nonce); 320 if (buffers_alias(in, in_len, out_prefix, aead->variable_nonce_len)) { 321 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); 322 return 0; 323 } 324 OPENSSL_memcpy(out_prefix, nonce + aead->fixed_nonce_len, 325 aead->variable_nonce_len); 326 } 327 328 /* XOR the fixed nonce, if necessary. */ 329 if (aead->xor_fixed_nonce) { 330 assert(nonce_len == aead->fixed_nonce_len); 331 for (size_t i = 0; i < aead->fixed_nonce_len; i++) { 332 nonce[i] ^= aead->fixed_nonce[i]; 333 } 334 } 335 336 return EVP_AEAD_CTX_seal_scatter(&aead->ctx, out, out_suffix, out_suffix_len, 337 max_out_suffix_len, nonce, nonce_len, in, 338 in_len, extra_in, extra_in_len, ad, ad_len); 339 } 340 341 int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len, 342 size_t max_out_len, uint8_t type, uint16_t wire_version, 343 const uint8_t seqnum[8], const uint8_t *in, 344 size_t in_len) { 345 size_t prefix_len = SSL_AEAD_CTX_explicit_nonce_len(aead); 346 if (in_len + prefix_len < in_len) { 347 OPENSSL_PUT_ERROR(CIPHER, SSL_R_RECORD_TOO_LARGE); 348 return 0; 349 } 350 if (in_len + prefix_len > max_out_len) { 351 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); 352 return 0; 353 } 354 355 size_t suffix_len; 356 if (!SSL_AEAD_CTX_seal_scatter(aead, out, out + prefix_len, 357 out + prefix_len + in_len, &suffix_len, 358 max_out_len - prefix_len - in_len, type, 359 wire_version, seqnum, in, in_len, 0, 0)) { 360 return 0; 361 } 362 assert(suffix_len <= SSL_AEAD_CTX_max_suffix_len(aead, 0)); 363 *out_len = prefix_len + in_len + suffix_len; 364 return 1; 365 } 366
