e_aes.c revision 264331
1/* ==================================================================== 2 * Copyright (c) 2001-2011 The OpenSSL Project. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in 13 * the documentation and/or other materials provided with the 14 * distribution. 15 * 16 * 3. All advertising materials mentioning features or use of this 17 * software must display the following acknowledgment: 18 * "This product includes software developed by the OpenSSL Project 19 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 20 * 21 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 22 * endorse or promote products derived from this software without 23 * prior written permission. For written permission, please contact 24 * openssl-core@openssl.org. 25 * 26 * 5. Products derived from this software may not be called "OpenSSL" 27 * nor may "OpenSSL" appear in their names without prior written 28 * permission of the OpenSSL Project. 29 * 30 * 6. Redistributions of any form whatsoever must retain the following 31 * acknowledgment: 32 * "This product includes software developed by the OpenSSL Project 33 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 34 * 35 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 36 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 38 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 39 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 40 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 41 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 42 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 44 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 45 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 46 * OF THE POSSIBILITY OF SUCH DAMAGE. 47 * ==================================================================== 48 * 49 */ 50 51#include <openssl/opensslconf.h> 52#ifndef OPENSSL_NO_AES 53#include <openssl/evp.h> 54#include <openssl/err.h> 55#include <string.h> 56#include <assert.h> 57#include <openssl/aes.h> 58#include "evp_locl.h" 59#ifndef OPENSSL_FIPS 60#include "modes_lcl.h" 61#include <openssl/rand.h> 62 63typedef struct 64 { 65 AES_KEY ks; 66 block128_f block; 67 union { 68 cbc128_f cbc; 69 ctr128_f ctr; 70 } stream; 71 } EVP_AES_KEY; 72 73typedef struct 74 { 75 AES_KEY ks; /* AES key schedule to use */ 76 int key_set; /* Set if key initialised */ 77 int iv_set; /* Set if an iv is set */ 78 GCM128_CONTEXT gcm; 79 unsigned char *iv; /* Temporary IV store */ 80 int ivlen; /* IV length */ 81 int taglen; 82 int iv_gen; /* It is OK to generate IVs */ 83 int tls_aad_len; /* TLS AAD length */ 84 ctr128_f ctr; 85 } EVP_AES_GCM_CTX; 86 87typedef struct 88 { 89 AES_KEY ks1, ks2; /* AES key schedules to use */ 90 XTS128_CONTEXT xts; 91 void (*stream)(const unsigned char *in, 92 unsigned char *out, size_t length, 93 const AES_KEY *key1, const AES_KEY *key2, 94 const unsigned char iv[16]); 95 } EVP_AES_XTS_CTX; 96 97typedef struct 98 { 99 AES_KEY ks; /* AES key schedule to use */ 100 int key_set; /* Set if key initialised */ 101 int iv_set; /* Set if an iv is set */ 102 int tag_set; /* Set if tag is valid */ 103 int len_set; /* Set if message length set */ 104 int L, M; /* L and M parameters from RFC3610 */ 105 CCM128_CONTEXT ccm; 106 ccm128_f str; 107 } EVP_AES_CCM_CTX; 108 109#define MAXBITCHUNK ((size_t)1<<(sizeof(size_t)*8-4)) 110 111#ifdef VPAES_ASM 112int vpaes_set_encrypt_key(const unsigned char *userKey, int bits, 113 AES_KEY *key); 114int vpaes_set_decrypt_key(const unsigned char *userKey, int bits, 115 AES_KEY *key); 116 117void vpaes_encrypt(const unsigned char *in, unsigned char *out, 118 const AES_KEY *key); 119void vpaes_decrypt(const unsigned char *in, unsigned char *out, 120 const AES_KEY *key); 121 122void vpaes_cbc_encrypt(const unsigned char *in, 123 unsigned char *out, 124 size_t length, 125 const AES_KEY *key, 126 unsigned char *ivec, int enc); 127#endif 128#ifdef BSAES_ASM 129void bsaes_cbc_encrypt(const unsigned char *in, unsigned char *out, 130 size_t length, const AES_KEY *key, 131 unsigned char ivec[16], int enc); 132void bsaes_ctr32_encrypt_blocks(const unsigned char *in, unsigned char *out, 133 size_t len, const AES_KEY *key, 134 const unsigned char ivec[16]); 135void bsaes_xts_encrypt(const unsigned char *inp, unsigned char *out, 136 size_t len, const AES_KEY *key1, 137 const AES_KEY *key2, const unsigned char iv[16]); 138void bsaes_xts_decrypt(const unsigned char *inp, unsigned char *out, 139 size_t len, const AES_KEY *key1, 140 const AES_KEY *key2, const unsigned char iv[16]); 141#endif 142#ifdef AES_CTR_ASM 143void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out, 144 size_t blocks, const AES_KEY *key, 145 const unsigned char ivec[AES_BLOCK_SIZE]); 146#endif 147#ifdef AES_XTS_ASM 148void AES_xts_encrypt(const char *inp,char *out,size_t len, 149 const AES_KEY *key1, const AES_KEY *key2, 150 const unsigned char iv[16]); 151void AES_xts_decrypt(const char *inp,char *out,size_t len, 152 const AES_KEY *key1, const AES_KEY *key2, 153 const unsigned char iv[16]); 154#endif 155 156#if defined(AES_ASM) && !defined(I386_ONLY) && ( \ 157 ((defined(__i386) || defined(__i386__) || \ 158 defined(_M_IX86)) && defined(OPENSSL_IA32_SSE2))|| \ 159 defined(__x86_64) || defined(__x86_64__) || \ 160 defined(_M_AMD64) || defined(_M_X64) || \ 161 defined(__INTEL__) ) 162 163extern unsigned int OPENSSL_ia32cap_P[2]; 164 165#ifdef VPAES_ASM 166#define VPAES_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(41-32))) 167#endif 168#ifdef BSAES_ASM 169#define BSAES_CAPABLE VPAES_CAPABLE 170#endif 171/* 172 * AES-NI section 173 */ 174#define AESNI_CAPABLE (OPENSSL_ia32cap_P[1]&(1<<(57-32))) 175 176int aesni_set_encrypt_key(const unsigned char *userKey, int bits, 177 AES_KEY *key); 178int aesni_set_decrypt_key(const unsigned char *userKey, int bits, 179 AES_KEY *key); 180 181void aesni_encrypt(const unsigned char *in, unsigned char *out, 182 const AES_KEY *key); 183void aesni_decrypt(const unsigned char *in, unsigned char *out, 184 const AES_KEY *key); 185 186void aesni_ecb_encrypt(const unsigned char *in, 187 unsigned char *out, 188 size_t length, 189 const AES_KEY *key, 190 int enc); 191void aesni_cbc_encrypt(const unsigned char *in, 192 unsigned char *out, 193 size_t length, 194 const AES_KEY *key, 195 unsigned char *ivec, int enc); 196 197void aesni_ctr32_encrypt_blocks(const unsigned char *in, 198 unsigned char *out, 199 size_t blocks, 200 const void *key, 201 const unsigned char *ivec); 202 203void aesni_xts_encrypt(const unsigned char *in, 204 unsigned char *out, 205 size_t length, 206 const AES_KEY *key1, const AES_KEY *key2, 207 const unsigned char iv[16]); 208 209void aesni_xts_decrypt(const unsigned char *in, 210 unsigned char *out, 211 size_t length, 212 const AES_KEY *key1, const AES_KEY *key2, 213 const unsigned char iv[16]); 214 215void aesni_ccm64_encrypt_blocks (const unsigned char *in, 216 unsigned char *out, 217 size_t blocks, 218 const void *key, 219 const unsigned char ivec[16], 220 unsigned char cmac[16]); 221 222void aesni_ccm64_decrypt_blocks (const unsigned char *in, 223 unsigned char *out, 224 size_t blocks, 225 const void *key, 226 const unsigned char ivec[16], 227 unsigned char cmac[16]); 228 229static int aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 230 const unsigned char *iv, int enc) 231 { 232 int ret, mode; 233 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 234 235 mode = ctx->cipher->flags & EVP_CIPH_MODE; 236 if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE) 237 && !enc) 238 { 239 ret = aesni_set_decrypt_key(key, ctx->key_len*8, ctx->cipher_data); 240 dat->block = (block128_f)aesni_decrypt; 241 dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ? 242 (cbc128_f)aesni_cbc_encrypt : 243 NULL; 244 } 245 else { 246 ret = aesni_set_encrypt_key(key, ctx->key_len*8, ctx->cipher_data); 247 dat->block = (block128_f)aesni_encrypt; 248 if (mode==EVP_CIPH_CBC_MODE) 249 dat->stream.cbc = (cbc128_f)aesni_cbc_encrypt; 250 else if (mode==EVP_CIPH_CTR_MODE) 251 dat->stream.ctr = (ctr128_f)aesni_ctr32_encrypt_blocks; 252 else 253 dat->stream.cbc = NULL; 254 } 255 256 if(ret < 0) 257 { 258 EVPerr(EVP_F_AESNI_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED); 259 return 0; 260 } 261 262 return 1; 263 } 264 265static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 266 const unsigned char *in, size_t len) 267{ 268 aesni_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt); 269 270 return 1; 271} 272 273static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 274 const unsigned char *in, size_t len) 275{ 276 size_t bl = ctx->cipher->block_size; 277 278 if (len<bl) return 1; 279 280 aesni_ecb_encrypt(in,out,len,ctx->cipher_data,ctx->encrypt); 281 282 return 1; 283} 284 285#define aesni_ofb_cipher aes_ofb_cipher 286static int aesni_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 287 const unsigned char *in,size_t len); 288 289#define aesni_cfb_cipher aes_cfb_cipher 290static int aesni_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 291 const unsigned char *in,size_t len); 292 293#define aesni_cfb8_cipher aes_cfb8_cipher 294static int aesni_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 295 const unsigned char *in,size_t len); 296 297#define aesni_cfb1_cipher aes_cfb1_cipher 298static int aesni_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 299 const unsigned char *in,size_t len); 300 301#define aesni_ctr_cipher aes_ctr_cipher 302static int aesni_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 303 const unsigned char *in, size_t len); 304 305static int aesni_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 306 const unsigned char *iv, int enc) 307 { 308 EVP_AES_GCM_CTX *gctx = ctx->cipher_data; 309 if (!iv && !key) 310 return 1; 311 if (key) 312 { 313 aesni_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks); 314 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, 315 (block128_f)aesni_encrypt); 316 gctx->ctr = (ctr128_f)aesni_ctr32_encrypt_blocks; 317 /* If we have an iv can set it directly, otherwise use 318 * saved IV. 319 */ 320 if (iv == NULL && gctx->iv_set) 321 iv = gctx->iv; 322 if (iv) 323 { 324 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen); 325 gctx->iv_set = 1; 326 } 327 gctx->key_set = 1; 328 } 329 else 330 { 331 /* If key set use IV, otherwise copy */ 332 if (gctx->key_set) 333 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen); 334 else 335 memcpy(gctx->iv, iv, gctx->ivlen); 336 gctx->iv_set = 1; 337 gctx->iv_gen = 0; 338 } 339 return 1; 340 } 341 342#define aesni_gcm_cipher aes_gcm_cipher 343static int aesni_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 344 const unsigned char *in, size_t len); 345 346static int aesni_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 347 const unsigned char *iv, int enc) 348 { 349 EVP_AES_XTS_CTX *xctx = ctx->cipher_data; 350 if (!iv && !key) 351 return 1; 352 353 if (key) 354 { 355 /* key_len is two AES keys */ 356 if (enc) 357 { 358 aesni_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1); 359 xctx->xts.block1 = (block128_f)aesni_encrypt; 360 xctx->stream = aesni_xts_encrypt; 361 } 362 else 363 { 364 aesni_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1); 365 xctx->xts.block1 = (block128_f)aesni_decrypt; 366 xctx->stream = aesni_xts_decrypt; 367 } 368 369 aesni_set_encrypt_key(key + ctx->key_len/2, 370 ctx->key_len * 4, &xctx->ks2); 371 xctx->xts.block2 = (block128_f)aesni_encrypt; 372 373 xctx->xts.key1 = &xctx->ks1; 374 } 375 376 if (iv) 377 { 378 xctx->xts.key2 = &xctx->ks2; 379 memcpy(ctx->iv, iv, 16); 380 } 381 382 return 1; 383 } 384 385#define aesni_xts_cipher aes_xts_cipher 386static int aesni_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 387 const unsigned char *in, size_t len); 388 389static int aesni_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 390 const unsigned char *iv, int enc) 391 { 392 EVP_AES_CCM_CTX *cctx = ctx->cipher_data; 393 if (!iv && !key) 394 return 1; 395 if (key) 396 { 397 aesni_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks); 398 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L, 399 &cctx->ks, (block128_f)aesni_encrypt); 400 cctx->str = enc?(ccm128_f)aesni_ccm64_encrypt_blocks : 401 (ccm128_f)aesni_ccm64_decrypt_blocks; 402 cctx->key_set = 1; 403 } 404 if (iv) 405 { 406 memcpy(ctx->iv, iv, 15 - cctx->L); 407 cctx->iv_set = 1; 408 } 409 return 1; 410 } 411 412#define aesni_ccm_cipher aes_ccm_cipher 413static int aesni_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 414 const unsigned char *in, size_t len); 415 416#define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \ 417static const EVP_CIPHER aesni_##keylen##_##mode = { \ 418 nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \ 419 flags|EVP_CIPH_##MODE##_MODE, \ 420 aesni_init_key, \ 421 aesni_##mode##_cipher, \ 422 NULL, \ 423 sizeof(EVP_AES_KEY), \ 424 NULL,NULL,NULL,NULL }; \ 425static const EVP_CIPHER aes_##keylen##_##mode = { \ 426 nid##_##keylen##_##nmode,blocksize, \ 427 keylen/8,ivlen, \ 428 flags|EVP_CIPH_##MODE##_MODE, \ 429 aes_init_key, \ 430 aes_##mode##_cipher, \ 431 NULL, \ 432 sizeof(EVP_AES_KEY), \ 433 NULL,NULL,NULL,NULL }; \ 434const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \ 435{ return AESNI_CAPABLE?&aesni_##keylen##_##mode:&aes_##keylen##_##mode; } 436 437#define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \ 438static const EVP_CIPHER aesni_##keylen##_##mode = { \ 439 nid##_##keylen##_##mode,blocksize, \ 440 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \ 441 flags|EVP_CIPH_##MODE##_MODE, \ 442 aesni_##mode##_init_key, \ 443 aesni_##mode##_cipher, \ 444 aes_##mode##_cleanup, \ 445 sizeof(EVP_AES_##MODE##_CTX), \ 446 NULL,NULL,aes_##mode##_ctrl,NULL }; \ 447static const EVP_CIPHER aes_##keylen##_##mode = { \ 448 nid##_##keylen##_##mode,blocksize, \ 449 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \ 450 flags|EVP_CIPH_##MODE##_MODE, \ 451 aes_##mode##_init_key, \ 452 aes_##mode##_cipher, \ 453 aes_##mode##_cleanup, \ 454 sizeof(EVP_AES_##MODE##_CTX), \ 455 NULL,NULL,aes_##mode##_ctrl,NULL }; \ 456const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \ 457{ return AESNI_CAPABLE?&aesni_##keylen##_##mode:&aes_##keylen##_##mode; } 458 459#else 460 461#define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \ 462static const EVP_CIPHER aes_##keylen##_##mode = { \ 463 nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \ 464 flags|EVP_CIPH_##MODE##_MODE, \ 465 aes_init_key, \ 466 aes_##mode##_cipher, \ 467 NULL, \ 468 sizeof(EVP_AES_KEY), \ 469 NULL,NULL,NULL,NULL }; \ 470const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \ 471{ return &aes_##keylen##_##mode; } 472 473#define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \ 474static const EVP_CIPHER aes_##keylen##_##mode = { \ 475 nid##_##keylen##_##mode,blocksize, \ 476 (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \ 477 flags|EVP_CIPH_##MODE##_MODE, \ 478 aes_##mode##_init_key, \ 479 aes_##mode##_cipher, \ 480 aes_##mode##_cleanup, \ 481 sizeof(EVP_AES_##MODE##_CTX), \ 482 NULL,NULL,aes_##mode##_ctrl,NULL }; \ 483const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \ 484{ return &aes_##keylen##_##mode; } 485#endif 486 487#define BLOCK_CIPHER_generic_pack(nid,keylen,flags) \ 488 BLOCK_CIPHER_generic(nid,keylen,16,16,cbc,cbc,CBC,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \ 489 BLOCK_CIPHER_generic(nid,keylen,16,0,ecb,ecb,ECB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \ 490 BLOCK_CIPHER_generic(nid,keylen,1,16,ofb128,ofb,OFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \ 491 BLOCK_CIPHER_generic(nid,keylen,1,16,cfb128,cfb,CFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1) \ 492 BLOCK_CIPHER_generic(nid,keylen,1,16,cfb1,cfb1,CFB,flags) \ 493 BLOCK_CIPHER_generic(nid,keylen,1,16,cfb8,cfb8,CFB,flags) \ 494 BLOCK_CIPHER_generic(nid,keylen,1,16,ctr,ctr,CTR,flags) 495 496static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 497 const unsigned char *iv, int enc) 498 { 499 int ret, mode; 500 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 501 502 mode = ctx->cipher->flags & EVP_CIPH_MODE; 503 if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE) 504 && !enc) 505#ifdef BSAES_CAPABLE 506 if (BSAES_CAPABLE && mode==EVP_CIPH_CBC_MODE) 507 { 508 ret = AES_set_decrypt_key(key,ctx->key_len*8,&dat->ks); 509 dat->block = (block128_f)AES_decrypt; 510 dat->stream.cbc = (cbc128_f)bsaes_cbc_encrypt; 511 } 512 else 513#endif 514#ifdef VPAES_CAPABLE 515 if (VPAES_CAPABLE) 516 { 517 ret = vpaes_set_decrypt_key(key,ctx->key_len*8,&dat->ks); 518 dat->block = (block128_f)vpaes_decrypt; 519 dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ? 520 (cbc128_f)vpaes_cbc_encrypt : 521 NULL; 522 } 523 else 524#endif 525 { 526 ret = AES_set_decrypt_key(key,ctx->key_len*8,&dat->ks); 527 dat->block = (block128_f)AES_decrypt; 528 dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ? 529 (cbc128_f)AES_cbc_encrypt : 530 NULL; 531 } 532 else 533#ifdef BSAES_CAPABLE 534 if (BSAES_CAPABLE && mode==EVP_CIPH_CTR_MODE) 535 { 536 ret = AES_set_encrypt_key(key,ctx->key_len*8,&dat->ks); 537 dat->block = (block128_f)AES_encrypt; 538 dat->stream.ctr = (ctr128_f)bsaes_ctr32_encrypt_blocks; 539 } 540 else 541#endif 542#ifdef VPAES_CAPABLE 543 if (VPAES_CAPABLE) 544 { 545 ret = vpaes_set_encrypt_key(key,ctx->key_len*8,&dat->ks); 546 dat->block = (block128_f)vpaes_encrypt; 547 dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ? 548 (cbc128_f)vpaes_cbc_encrypt : 549 NULL; 550 } 551 else 552#endif 553 { 554 ret = AES_set_encrypt_key(key,ctx->key_len*8,&dat->ks); 555 dat->block = (block128_f)AES_encrypt; 556 dat->stream.cbc = mode==EVP_CIPH_CBC_MODE ? 557 (cbc128_f)AES_cbc_encrypt : 558 NULL; 559#ifdef AES_CTR_ASM 560 if (mode==EVP_CIPH_CTR_MODE) 561 dat->stream.ctr = (ctr128_f)AES_ctr32_encrypt; 562#endif 563 } 564 565 if(ret < 0) 566 { 567 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED); 568 return 0; 569 } 570 571 return 1; 572 } 573 574static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 575 const unsigned char *in, size_t len) 576{ 577 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 578 579 if (dat->stream.cbc) 580 (*dat->stream.cbc)(in,out,len,&dat->ks,ctx->iv,ctx->encrypt); 581 else if (ctx->encrypt) 582 CRYPTO_cbc128_encrypt(in,out,len,&dat->ks,ctx->iv,dat->block); 583 else 584 CRYPTO_cbc128_encrypt(in,out,len,&dat->ks,ctx->iv,dat->block); 585 586 return 1; 587} 588 589static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 590 const unsigned char *in, size_t len) 591{ 592 size_t bl = ctx->cipher->block_size; 593 size_t i; 594 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 595 596 if (len<bl) return 1; 597 598 for (i=0,len-=bl;i<=len;i+=bl) 599 (*dat->block)(in+i,out+i,&dat->ks); 600 601 return 1; 602} 603 604static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 605 const unsigned char *in,size_t len) 606{ 607 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 608 609 CRYPTO_ofb128_encrypt(in,out,len,&dat->ks, 610 ctx->iv,&ctx->num,dat->block); 611 return 1; 612} 613 614static int aes_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 615 const unsigned char *in,size_t len) 616{ 617 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 618 619 CRYPTO_cfb128_encrypt(in,out,len,&dat->ks, 620 ctx->iv,&ctx->num,ctx->encrypt,dat->block); 621 return 1; 622} 623 624static int aes_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 625 const unsigned char *in,size_t len) 626{ 627 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 628 629 CRYPTO_cfb128_8_encrypt(in,out,len,&dat->ks, 630 ctx->iv,&ctx->num,ctx->encrypt,dat->block); 631 return 1; 632} 633 634static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out, 635 const unsigned char *in,size_t len) 636{ 637 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 638 639 if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) { 640 CRYPTO_cfb128_1_encrypt(in,out,len,&dat->ks, 641 ctx->iv,&ctx->num,ctx->encrypt,dat->block); 642 return 1; 643 } 644 645 while (len>=MAXBITCHUNK) { 646 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,&dat->ks, 647 ctx->iv,&ctx->num,ctx->encrypt,dat->block); 648 len-=MAXBITCHUNK; 649 } 650 if (len) 651 CRYPTO_cfb128_1_encrypt(in,out,len*8,&dat->ks, 652 ctx->iv,&ctx->num,ctx->encrypt,dat->block); 653 654 return 1; 655} 656 657static int aes_ctr_cipher (EVP_CIPHER_CTX *ctx, unsigned char *out, 658 const unsigned char *in, size_t len) 659{ 660 unsigned int num = ctx->num; 661 EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 662 663 if (dat->stream.ctr) 664 CRYPTO_ctr128_encrypt_ctr32(in,out,len,&dat->ks, 665 ctx->iv,ctx->buf,&num,dat->stream.ctr); 666 else 667 CRYPTO_ctr128_encrypt(in,out,len,&dat->ks, 668 ctx->iv,ctx->buf,&num,dat->block); 669 ctx->num = (size_t)num; 670 return 1; 671} 672 673BLOCK_CIPHER_generic_pack(NID_aes,128,EVP_CIPH_FLAG_FIPS) 674BLOCK_CIPHER_generic_pack(NID_aes,192,EVP_CIPH_FLAG_FIPS) 675BLOCK_CIPHER_generic_pack(NID_aes,256,EVP_CIPH_FLAG_FIPS) 676 677static int aes_gcm_cleanup(EVP_CIPHER_CTX *c) 678 { 679 EVP_AES_GCM_CTX *gctx = c->cipher_data; 680 OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm)); 681 if (gctx->iv != c->iv) 682 OPENSSL_free(gctx->iv); 683 return 1; 684 } 685 686/* increment counter (64-bit int) by 1 */ 687static void ctr64_inc(unsigned char *counter) { 688 int n=8; 689 unsigned char c; 690 691 do { 692 --n; 693 c = counter[n]; 694 ++c; 695 counter[n] = c; 696 if (c) return; 697 } while (n); 698} 699 700static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) 701 { 702 EVP_AES_GCM_CTX *gctx = c->cipher_data; 703 switch (type) 704 { 705 case EVP_CTRL_INIT: 706 gctx->key_set = 0; 707 gctx->iv_set = 0; 708 gctx->ivlen = c->cipher->iv_len; 709 gctx->iv = c->iv; 710 gctx->taglen = -1; 711 gctx->iv_gen = 0; 712 gctx->tls_aad_len = -1; 713 return 1; 714 715 case EVP_CTRL_GCM_SET_IVLEN: 716 if (arg <= 0) 717 return 0; 718#ifdef OPENSSL_FIPS 719 if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) 720 && arg < 12) 721 return 0; 722#endif 723 /* Allocate memory for IV if needed */ 724 if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen)) 725 { 726 if (gctx->iv != c->iv) 727 OPENSSL_free(gctx->iv); 728 gctx->iv = OPENSSL_malloc(arg); 729 if (!gctx->iv) 730 return 0; 731 } 732 gctx->ivlen = arg; 733 return 1; 734 735 case EVP_CTRL_GCM_SET_TAG: 736 if (arg <= 0 || arg > 16 || c->encrypt) 737 return 0; 738 memcpy(c->buf, ptr, arg); 739 gctx->taglen = arg; 740 return 1; 741 742 case EVP_CTRL_GCM_GET_TAG: 743 if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0) 744 return 0; 745 memcpy(ptr, c->buf, arg); 746 return 1; 747 748 case EVP_CTRL_GCM_SET_IV_FIXED: 749 /* Special case: -1 length restores whole IV */ 750 if (arg == -1) 751 { 752 memcpy(gctx->iv, ptr, gctx->ivlen); 753 gctx->iv_gen = 1; 754 return 1; 755 } 756 /* Fixed field must be at least 4 bytes and invocation field 757 * at least 8. 758 */ 759 if ((arg < 4) || (gctx->ivlen - arg) < 8) 760 return 0; 761 if (arg) 762 memcpy(gctx->iv, ptr, arg); 763 if (c->encrypt && 764 RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) 765 return 0; 766 gctx->iv_gen = 1; 767 return 1; 768 769 case EVP_CTRL_GCM_IV_GEN: 770 if (gctx->iv_gen == 0 || gctx->key_set == 0) 771 return 0; 772 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen); 773 if (arg <= 0 || arg > gctx->ivlen) 774 arg = gctx->ivlen; 775 memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg); 776 /* Invocation field will be at least 8 bytes in size and 777 * so no need to check wrap around or increment more than 778 * last 8 bytes. 779 */ 780 ctr64_inc(gctx->iv + gctx->ivlen - 8); 781 gctx->iv_set = 1; 782 return 1; 783 784 case EVP_CTRL_GCM_SET_IV_INV: 785 if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt) 786 return 0; 787 memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg); 788 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen); 789 gctx->iv_set = 1; 790 return 1; 791 792 case EVP_CTRL_AEAD_TLS1_AAD: 793 /* Save the AAD for later use */ 794 if (arg != 13) 795 return 0; 796 memcpy(c->buf, ptr, arg); 797 gctx->tls_aad_len = arg; 798 { 799 unsigned int len=c->buf[arg-2]<<8|c->buf[arg-1]; 800 /* Correct length for explicit IV */ 801 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN; 802 /* If decrypting correct for tag too */ 803 if (!c->encrypt) 804 len -= EVP_GCM_TLS_TAG_LEN; 805 c->buf[arg-2] = len>>8; 806 c->buf[arg-1] = len & 0xff; 807 } 808 /* Extra padding: tag appended to record */ 809 return EVP_GCM_TLS_TAG_LEN; 810 811 default: 812 return -1; 813 814 } 815 } 816 817static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 818 const unsigned char *iv, int enc) 819 { 820 EVP_AES_GCM_CTX *gctx = ctx->cipher_data; 821 if (!iv && !key) 822 return 1; 823 if (key) 824 { do { 825#ifdef BSAES_CAPABLE 826 if (BSAES_CAPABLE) 827 { 828 AES_set_encrypt_key(key,ctx->key_len*8,&gctx->ks); 829 CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks, 830 (block128_f)AES_encrypt); 831 gctx->ctr = (ctr128_f)bsaes_ctr32_encrypt_blocks; 832 break; 833 } 834 else 835#endif 836#ifdef VPAES_CAPABLE 837 if (VPAES_CAPABLE) 838 { 839 vpaes_set_encrypt_key(key,ctx->key_len*8,&gctx->ks); 840 CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks, 841 (block128_f)vpaes_encrypt); 842 gctx->ctr = NULL; 843 break; 844 } 845 else 846#endif 847 (void)0; /* terminate potentially open 'else' */ 848 849 AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks); 850 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt); 851#ifdef AES_CTR_ASM 852 gctx->ctr = (ctr128_f)AES_ctr32_encrypt; 853#else 854 gctx->ctr = NULL; 855#endif 856 } while (0); 857 858 /* If we have an iv can set it directly, otherwise use 859 * saved IV. 860 */ 861 if (iv == NULL && gctx->iv_set) 862 iv = gctx->iv; 863 if (iv) 864 { 865 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen); 866 gctx->iv_set = 1; 867 } 868 gctx->key_set = 1; 869 } 870 else 871 { 872 /* If key set use IV, otherwise copy */ 873 if (gctx->key_set) 874 CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen); 875 else 876 memcpy(gctx->iv, iv, gctx->ivlen); 877 gctx->iv_set = 1; 878 gctx->iv_gen = 0; 879 } 880 return 1; 881 } 882 883/* Handle TLS GCM packet format. This consists of the last portion of the IV 884 * followed by the payload and finally the tag. On encrypt generate IV, 885 * encrypt payload and write the tag. On verify retrieve IV, decrypt payload 886 * and verify tag. 887 */ 888 889static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 890 const unsigned char *in, size_t len) 891 { 892 EVP_AES_GCM_CTX *gctx = ctx->cipher_data; 893 int rv = -1; 894 /* Encrypt/decrypt must be performed in place */ 895 if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN+EVP_GCM_TLS_TAG_LEN)) 896 return -1; 897 /* Set IV from start of buffer or generate IV and write to start 898 * of buffer. 899 */ 900 if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ? 901 EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV, 902 EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0) 903 goto err; 904 /* Use saved AAD */ 905 if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len)) 906 goto err; 907 /* Fix buffer and length to point to payload */ 908 in += EVP_GCM_TLS_EXPLICIT_IV_LEN; 909 out += EVP_GCM_TLS_EXPLICIT_IV_LEN; 910 len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN; 911 if (ctx->encrypt) 912 { 913 /* Encrypt payload */ 914 if (gctx->ctr) 915 { 916 if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm, 917 in, out, len, 918 gctx->ctr)) 919 goto err; 920 } 921 else { 922 if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len)) 923 goto err; 924 } 925 out += len; 926 /* Finally write tag */ 927 CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN); 928 rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN; 929 } 930 else 931 { 932 /* Decrypt */ 933 if (gctx->ctr) 934 { 935 if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm, 936 in, out, len, 937 gctx->ctr)) 938 goto err; 939 } 940 else { 941 if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len)) 942 goto err; 943 } 944 /* Retrieve tag */ 945 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 946 EVP_GCM_TLS_TAG_LEN); 947 /* If tag mismatch wipe buffer */ 948 if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) 949 { 950 OPENSSL_cleanse(out, len); 951 goto err; 952 } 953 rv = len; 954 } 955 956 err: 957 gctx->iv_set = 0; 958 gctx->tls_aad_len = -1; 959 return rv; 960 } 961 962static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 963 const unsigned char *in, size_t len) 964 { 965 EVP_AES_GCM_CTX *gctx = ctx->cipher_data; 966 /* If not set up, return error */ 967 if (!gctx->key_set) 968 return -1; 969 970 if (gctx->tls_aad_len >= 0) 971 return aes_gcm_tls_cipher(ctx, out, in, len); 972 973 if (!gctx->iv_set) 974 return -1; 975 if (in) 976 { 977 if (out == NULL) 978 { 979 if (CRYPTO_gcm128_aad(&gctx->gcm, in, len)) 980 return -1; 981 } 982 else if (ctx->encrypt) 983 { 984 if (gctx->ctr) 985 { 986 if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm, 987 in, out, len, 988 gctx->ctr)) 989 return -1; 990 } 991 else { 992 if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len)) 993 return -1; 994 } 995 } 996 else 997 { 998 if (gctx->ctr) 999 { 1000 if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm, 1001 in, out, len, 1002 gctx->ctr)) 1003 return -1; 1004 } 1005 else { 1006 if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len)) 1007 return -1; 1008 } 1009 } 1010 return len; 1011 } 1012 else 1013 { 1014 if (!ctx->encrypt) 1015 { 1016 if (gctx->taglen < 0) 1017 return -1; 1018 if (CRYPTO_gcm128_finish(&gctx->gcm, 1019 ctx->buf, gctx->taglen) != 0) 1020 return -1; 1021 gctx->iv_set = 0; 1022 return 0; 1023 } 1024 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16); 1025 gctx->taglen = 16; 1026 /* Don't reuse the IV */ 1027 gctx->iv_set = 0; 1028 return 0; 1029 } 1030 1031 } 1032 1033#define CUSTOM_FLAGS (EVP_CIPH_FLAG_DEFAULT_ASN1 \ 1034 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \ 1035 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT) 1036 1037BLOCK_CIPHER_custom(NID_aes,128,1,12,gcm,GCM, 1038 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS) 1039BLOCK_CIPHER_custom(NID_aes,192,1,12,gcm,GCM, 1040 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS) 1041BLOCK_CIPHER_custom(NID_aes,256,1,12,gcm,GCM, 1042 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS) 1043 1044static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) 1045 { 1046 EVP_AES_XTS_CTX *xctx = c->cipher_data; 1047 if (type != EVP_CTRL_INIT) 1048 return -1; 1049 /* key1 and key2 are used as an indicator both key and IV are set */ 1050 xctx->xts.key1 = NULL; 1051 xctx->xts.key2 = NULL; 1052 return 1; 1053 } 1054 1055static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 1056 const unsigned char *iv, int enc) 1057 { 1058 EVP_AES_XTS_CTX *xctx = ctx->cipher_data; 1059 if (!iv && !key) 1060 return 1; 1061 1062 if (key) do 1063 { 1064#ifdef AES_XTS_ASM 1065 xctx->stream = enc ? AES_xts_encrypt : AES_xts_decrypt; 1066#else 1067 xctx->stream = NULL; 1068#endif 1069 /* key_len is two AES keys */ 1070#ifdef BSAES_CAPABLE 1071 if (BSAES_CAPABLE) 1072 xctx->stream = enc ? bsaes_xts_encrypt : bsaes_xts_decrypt; 1073 else 1074#endif 1075#ifdef VPAES_CAPABLE 1076 if (VPAES_CAPABLE) 1077 { 1078 if (enc) 1079 { 1080 vpaes_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1); 1081 xctx->xts.block1 = (block128_f)vpaes_encrypt; 1082 } 1083 else 1084 { 1085 vpaes_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1); 1086 xctx->xts.block1 = (block128_f)vpaes_decrypt; 1087 } 1088 1089 vpaes_set_encrypt_key(key + ctx->key_len/2, 1090 ctx->key_len * 4, &xctx->ks2); 1091 xctx->xts.block2 = (block128_f)vpaes_encrypt; 1092 1093 xctx->xts.key1 = &xctx->ks1; 1094 break; 1095 } 1096 else 1097#endif 1098 (void)0; /* terminate potentially open 'else' */ 1099 1100 if (enc) 1101 { 1102 AES_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1); 1103 xctx->xts.block1 = (block128_f)AES_encrypt; 1104 } 1105 else 1106 { 1107 AES_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1); 1108 xctx->xts.block1 = (block128_f)AES_decrypt; 1109 } 1110 1111 AES_set_encrypt_key(key + ctx->key_len/2, 1112 ctx->key_len * 4, &xctx->ks2); 1113 xctx->xts.block2 = (block128_f)AES_encrypt; 1114 1115 xctx->xts.key1 = &xctx->ks1; 1116 } while (0); 1117 1118 if (iv) 1119 { 1120 xctx->xts.key2 = &xctx->ks2; 1121 memcpy(ctx->iv, iv, 16); 1122 } 1123 1124 return 1; 1125 } 1126 1127static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 1128 const unsigned char *in, size_t len) 1129 { 1130 EVP_AES_XTS_CTX *xctx = ctx->cipher_data; 1131 if (!xctx->xts.key1 || !xctx->xts.key2) 1132 return 0; 1133 if (!out || !in || len<AES_BLOCK_SIZE) 1134 return 0; 1135#ifdef OPENSSL_FIPS 1136 /* Requirement of SP800-38E */ 1137 if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) && 1138 (len > (1UL<<20)*16)) 1139 { 1140 EVPerr(EVP_F_AES_XTS_CIPHER, EVP_R_TOO_LARGE); 1141 return 0; 1142 } 1143#endif 1144 if (xctx->stream) 1145 (*xctx->stream)(in, out, len, 1146 xctx->xts.key1, xctx->xts.key2, ctx->iv); 1147 else if (CRYPTO_xts128_encrypt(&xctx->xts, ctx->iv, in, out, len, 1148 ctx->encrypt)) 1149 return 0; 1150 return 1; 1151 } 1152 1153#define aes_xts_cleanup NULL 1154 1155#define XTS_FLAGS (EVP_CIPH_FLAG_DEFAULT_ASN1 | EVP_CIPH_CUSTOM_IV \ 1156 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT) 1157 1158BLOCK_CIPHER_custom(NID_aes,128,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS) 1159BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS) 1160 1161static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) 1162 { 1163 EVP_AES_CCM_CTX *cctx = c->cipher_data; 1164 switch (type) 1165 { 1166 case EVP_CTRL_INIT: 1167 cctx->key_set = 0; 1168 cctx->iv_set = 0; 1169 cctx->L = 8; 1170 cctx->M = 12; 1171 cctx->tag_set = 0; 1172 cctx->len_set = 0; 1173 return 1; 1174 1175 case EVP_CTRL_CCM_SET_IVLEN: 1176 arg = 15 - arg; 1177 case EVP_CTRL_CCM_SET_L: 1178 if (arg < 2 || arg > 8) 1179 return 0; 1180 cctx->L = arg; 1181 return 1; 1182 1183 case EVP_CTRL_CCM_SET_TAG: 1184 if ((arg & 1) || arg < 4 || arg > 16) 1185 return 0; 1186 if ((c->encrypt && ptr) || (!c->encrypt && !ptr)) 1187 return 0; 1188 if (ptr) 1189 { 1190 cctx->tag_set = 1; 1191 memcpy(c->buf, ptr, arg); 1192 } 1193 cctx->M = arg; 1194 return 1; 1195 1196 case EVP_CTRL_CCM_GET_TAG: 1197 if (!c->encrypt || !cctx->tag_set) 1198 return 0; 1199 if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg)) 1200 return 0; 1201 cctx->tag_set = 0; 1202 cctx->iv_set = 0; 1203 cctx->len_set = 0; 1204 return 1; 1205 1206 default: 1207 return -1; 1208 1209 } 1210 } 1211 1212static int aes_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 1213 const unsigned char *iv, int enc) 1214 { 1215 EVP_AES_CCM_CTX *cctx = ctx->cipher_data; 1216 if (!iv && !key) 1217 return 1; 1218 if (key) do 1219 { 1220#ifdef VPAES_CAPABLE 1221 if (VPAES_CAPABLE) 1222 { 1223 vpaes_set_encrypt_key(key, ctx->key_len*8, &cctx->ks); 1224 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L, 1225 &cctx->ks, (block128_f)vpaes_encrypt); 1226 cctx->str = NULL; 1227 cctx->key_set = 1; 1228 break; 1229 } 1230#endif 1231 AES_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks); 1232 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L, 1233 &cctx->ks, (block128_f)AES_encrypt); 1234 cctx->str = NULL; 1235 cctx->key_set = 1; 1236 } while (0); 1237 if (iv) 1238 { 1239 memcpy(ctx->iv, iv, 15 - cctx->L); 1240 cctx->iv_set = 1; 1241 } 1242 return 1; 1243 } 1244 1245static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 1246 const unsigned char *in, size_t len) 1247 { 1248 EVP_AES_CCM_CTX *cctx = ctx->cipher_data; 1249 CCM128_CONTEXT *ccm = &cctx->ccm; 1250 /* If not set up, return error */ 1251 if (!cctx->iv_set && !cctx->key_set) 1252 return -1; 1253 if (!ctx->encrypt && !cctx->tag_set) 1254 return -1; 1255 if (!out) 1256 { 1257 if (!in) 1258 { 1259 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len)) 1260 return -1; 1261 cctx->len_set = 1; 1262 return len; 1263 } 1264 /* If have AAD need message length */ 1265 if (!cctx->len_set && len) 1266 return -1; 1267 CRYPTO_ccm128_aad(ccm, in, len); 1268 return len; 1269 } 1270 /* EVP_*Final() doesn't return any data */ 1271 if (!in) 1272 return 0; 1273 /* If not set length yet do it */ 1274 if (!cctx->len_set) 1275 { 1276 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len)) 1277 return -1; 1278 cctx->len_set = 1; 1279 } 1280 if (ctx->encrypt) 1281 { 1282 if (cctx->str ? CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len, 1283 cctx->str) : 1284 CRYPTO_ccm128_encrypt(ccm, in, out, len)) 1285 return -1; 1286 cctx->tag_set = 1; 1287 return len; 1288 } 1289 else 1290 { 1291 int rv = -1; 1292 if (cctx->str ? !CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len, 1293 cctx->str) : 1294 !CRYPTO_ccm128_decrypt(ccm, in, out, len)) 1295 { 1296 unsigned char tag[16]; 1297 if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) 1298 { 1299 if (!memcmp(tag, ctx->buf, cctx->M)) 1300 rv = len; 1301 } 1302 } 1303 if (rv == -1) 1304 OPENSSL_cleanse(out, len); 1305 cctx->iv_set = 0; 1306 cctx->tag_set = 0; 1307 cctx->len_set = 0; 1308 return rv; 1309 } 1310 1311 } 1312 1313#define aes_ccm_cleanup NULL 1314 1315BLOCK_CIPHER_custom(NID_aes,128,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS) 1316BLOCK_CIPHER_custom(NID_aes,192,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS) 1317BLOCK_CIPHER_custom(NID_aes,256,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS) 1318 1319#endif 1320#endif 1321