1/* Copyright (c) 2017, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15#include <openssl/aead.h>
16#include <openssl/cipher.h>
17#include <openssl/crypto.h>
18#include <openssl/err.h>
19#include <openssl/sha.h>
20
21#include "../fipsmodule/cipher/internal.h"
22
23
24#define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
25#define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
26
27struct aead_aes_ctr_hmac_sha256_ctx {
28  union {
29    double align;
30    AES_KEY ks;
31  } ks;
32  ctr128_f ctr;
33  block128_f block;
34  SHA256_CTX inner_init_state;
35  SHA256_CTX outer_init_state;
36};
37
38static void hmac_init(SHA256_CTX *out_inner, SHA256_CTX *out_outer,
39                      const uint8_t hmac_key[32]) {
40  static const size_t hmac_key_len = 32;
41  uint8_t block[SHA256_CBLOCK];
42  OPENSSL_memcpy(block, hmac_key, hmac_key_len);
43  OPENSSL_memset(block + hmac_key_len, 0x36, sizeof(block) - hmac_key_len);
44
45  unsigned i;
46  for (i = 0; i < hmac_key_len; i++) {
47    block[i] ^= 0x36;
48  }
49
50  SHA256_Init(out_inner);
51  SHA256_Update(out_inner, block, sizeof(block));
52
53  OPENSSL_memset(block + hmac_key_len, 0x5c, sizeof(block) - hmac_key_len);
54  for (i = 0; i < hmac_key_len; i++) {
55    block[i] ^= (0x36 ^ 0x5c);
56  }
57
58  SHA256_Init(out_outer);
59  SHA256_Update(out_outer, block, sizeof(block));
60}
61
62static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
63                                         size_t key_len, size_t tag_len) {
64  struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx;
65  static const size_t hmac_key_len = 32;
66
67  if (key_len < hmac_key_len) {
68    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
69    return 0;  // EVP_AEAD_CTX_init should catch this.
70  }
71
72  const size_t aes_key_len = key_len - hmac_key_len;
73  if (aes_key_len != 16 && aes_key_len != 32) {
74    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
75    return 0;  // EVP_AEAD_CTX_init should catch this.
76  }
77
78  if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) {
79    tag_len = EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN;
80  }
81
82  if (tag_len > EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN) {
83    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE);
84    return 0;
85  }
86
87  aes_ctx = OPENSSL_malloc(sizeof(struct aead_aes_ctr_hmac_sha256_ctx));
88  if (aes_ctx == NULL) {
89    OPENSSL_PUT_ERROR(CIPHER, ERR_R_MALLOC_FAILURE);
90    return 0;
91  }
92
93  aes_ctx->ctr =
94      aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len);
95  ctx->tag_len = tag_len;
96  hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state,
97            key + aes_key_len);
98
99  ctx->aead_state = aes_ctx;
100
101  return 1;
102}
103
104static void aead_aes_ctr_hmac_sha256_cleanup(EVP_AEAD_CTX *ctx) {
105  OPENSSL_free(ctx->aead_state);
106}
107
108static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
109  unsigned i;
110  uint8_t bytes[8];
111
112  for (i = 0; i < sizeof(bytes); i++) {
113    bytes[i] = value & 0xff;
114    value >>= 8;
115  }
116  SHA256_Update(sha256, bytes, sizeof(bytes));
117}
118
119static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
120                           const SHA256_CTX *inner_init_state,
121                           const SHA256_CTX *outer_init_state,
122                           const uint8_t *ad, size_t ad_len,
123                           const uint8_t *nonce, const uint8_t *ciphertext,
124                           size_t ciphertext_len) {
125  SHA256_CTX sha256;
126  OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
127  hmac_update_uint64(&sha256, ad_len);
128  hmac_update_uint64(&sha256, ciphertext_len);
129  SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
130  SHA256_Update(&sha256, ad, ad_len);
131
132  // Pad with zeros to the end of the SHA-256 block.
133  const unsigned num_padding =
134      (SHA256_CBLOCK - ((sizeof(uint64_t)*2 +
135                         EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) %
136                        SHA256_CBLOCK)) %
137      SHA256_CBLOCK;
138  uint8_t padding[SHA256_CBLOCK];
139  OPENSSL_memset(padding, 0, num_padding);
140  SHA256_Update(&sha256, padding, num_padding);
141
142  SHA256_Update(&sha256, ciphertext, ciphertext_len);
143
144  uint8_t inner_digest[SHA256_DIGEST_LENGTH];
145  SHA256_Final(inner_digest, &sha256);
146
147  OPENSSL_memcpy(&sha256, outer_init_state, sizeof(sha256));
148  SHA256_Update(&sha256, inner_digest, sizeof(inner_digest));
149  SHA256_Final(out, &sha256);
150}
151
152static void aead_aes_ctr_hmac_sha256_crypt(
153    const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out,
154    const uint8_t *in, size_t len, const uint8_t *nonce) {
155  // Since the AEAD operation is one-shot, keeping a buffer of unused keystream
156  // bytes is pointless. However, |CRYPTO_ctr128_encrypt| requires it.
157  uint8_t partial_block_buffer[AES_BLOCK_SIZE];
158  unsigned partial_block_offset = 0;
159  OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
160
161  uint8_t counter[AES_BLOCK_SIZE];
162  OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
163  OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4);
164
165  if (aes_ctx->ctr) {
166    CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter,
167                                partial_block_buffer, &partial_block_offset,
168                                aes_ctx->ctr);
169  } else {
170    CRYPTO_ctr128_encrypt(in, out, len, &aes_ctx->ks.ks, counter,
171                          partial_block_buffer, &partial_block_offset,
172                          aes_ctx->block);
173  }
174}
175
176static int aead_aes_ctr_hmac_sha256_seal_scatter(
177    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
178    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
179    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
180    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
181  const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
182  const uint64_t in_len_64 = in_len;
183
184  if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
185     // This input is so large it would overflow the 32-bit block counter.
186    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
187    return 0;
188  }
189
190  if (max_out_tag_len < ctx->tag_len) {
191    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
192    return 0;
193  }
194
195  if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
196    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
197    return 0;
198  }
199
200  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
201
202  uint8_t hmac_result[SHA256_DIGEST_LENGTH];
203  hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
204                 &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len);
205  OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len);
206  *out_tag_len = ctx->tag_len;
207
208  return 1;
209}
210
211static int aead_aes_ctr_hmac_sha256_open_gather(
212    const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce,
213    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag,
214    size_t in_tag_len, const uint8_t *ad, size_t ad_len) {
215  const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
216
217  if (in_tag_len != ctx->tag_len) {
218    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
219    return 0;
220  }
221
222  if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
223    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
224    return 0;
225  }
226
227  uint8_t hmac_result[SHA256_DIGEST_LENGTH];
228  hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
229                 &aes_ctx->outer_init_state, ad, ad_len, nonce, in,
230                 in_len);
231  if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) {
232    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
233    return 0;
234  }
235
236  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
237
238  return 1;
239}
240
241static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
242    16 /* AES key */ + 32 /* HMAC key */,
243    12,                                    // nonce length
244    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
245    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
246    0,                                     // seal_scatter_supports_extra_in
247
248    aead_aes_ctr_hmac_sha256_init,
249    NULL /* init_with_direction */,
250    aead_aes_ctr_hmac_sha256_cleanup,
251    NULL /* open */,
252    aead_aes_ctr_hmac_sha256_seal_scatter,
253    aead_aes_ctr_hmac_sha256_open_gather,
254    NULL /* get_iv */,
255    NULL /* tag_len */,
256};
257
258static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
259    32 /* AES key */ + 32 /* HMAC key */,
260    12,                                    // nonce length
261    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
262    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
263    0,                                     // seal_scatter_supports_extra_in
264
265    aead_aes_ctr_hmac_sha256_init,
266    NULL /* init_with_direction */,
267    aead_aes_ctr_hmac_sha256_cleanup,
268    NULL /* open */,
269    aead_aes_ctr_hmac_sha256_seal_scatter,
270    aead_aes_ctr_hmac_sha256_open_gather,
271    NULL /* get_iv */,
272    NULL /* tag_len */,
273};
274
275const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) {
276  return &aead_aes_128_ctr_hmac_sha256;
277}
278
279const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) {
280  return &aead_aes_256_ctr_hmac_sha256;
281}
282