crypto/evp/e_aes.c

   1 /* ====================================================================
   2  * Copyright (c) 2001-2011 The OpenSSL Project.  All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  *
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  *
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in
  13  *    the documentation and/or other materials provided with the
  14  *    distribution.
  15  *
  16  * 3. All advertising materials mentioning features or use of this
  17  *    software must display the following acknowledgment:
  18  *    "This product includes software developed by the OpenSSL Project
  19  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  20  *
  21  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  22  *    endorse or promote products derived from this software without
  23  *    prior written permission. For written permission, please contact
  24  *    openssl-core@openssl.org.
  25  *
  26  * 5. Products derived from this software may not be called "OpenSSL"
  27  *    nor may "OpenSSL" appear in their names without prior written
  28  *    permission of the OpenSSL Project.
  29  *
  30  * 6. Redistributions of any form whatsoever must retain the following
  31  *    acknowledgment:
  32  *    "This product includes software developed by the OpenSSL Project
  33  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  36  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  38  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  39  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  40  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  41  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  42  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  44  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  45  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  46  * OF THE POSSIBILITY OF SUCH DAMAGE.
  47  * ====================================================================
  48  *
  49  */
  50
  51 #define OPENSSL_FIPSAPI
  52
  53 #include <openssl/opensslconf.h>
  54 #ifndef OPENSSL_NO_AES
  55 #include <openssl/evp.h>
  56 #include <openssl/err.h>
  57 #include <string.h>
  58 #include <assert.h>
  59 #include <openssl/aes.h>
  60 #include "evp_locl.h"
  61 #include "modes_lcl.h"
  62 #include <openssl/rand.h>
  63
  64 typedef struct
  65         {
  66         AES_KEY ks;
  67         } EVP_AES_KEY;
  68
  69 typedef struct
  70         {
  71         AES_KEY ks;             /* AES key schedule to use */
  72         int key_set;            /* Set if key initialised */
  73         int iv_set;             /* Set if an iv is set */
  74         GCM128_CONTEXT gcm;
  75         unsigned char *iv;      /* Temporary IV store */
  76         int ivlen;              /* IV length */
  77         int taglen;
  78         int iv_gen;             /* It is OK to generate IVs */
  79         } EVP_AES_GCM_CTX;
  80
  81 typedef struct
  82         {
  83         AES_KEY ks1, ks2;       /* AES key schedules to use */
  84         XTS128_CONTEXT xts;
  85         } EVP_AES_XTS_CTX;
  86
  87 typedef struct
  88         {
  89         AES_KEY ks;             /* AES key schedule to use */
  90         int key_set;            /* Set if key initialised */
  91         int iv_set;             /* Set if an iv is set */
  92         int tag_set;            /* Set if tag is valid */
  93         int len_set;            /* Set if message length set */
  94         int L, M;               /* L and M parameters from RFC3610 */
  95         CCM128_CONTEXT ccm;
  96         } EVP_AES_CCM_CTX;
  97
  98 #define MAXBITCHUNK     ((size_t)1<<(sizeof(size_t)*8-4))
  99
 100 #if     defined(AES_ASM) && !defined(I386_ONLY) &&      (  \
 101         ((defined(__i386)       || defined(__i386__)    || \
 102           defined(_M_IX86)) && defined(OPENSSL_IA32_SSE2))|| \
 103         defined(__x86_64)       || defined(__x86_64__)  || \
 104         defined(_M_AMD64)       || defined(_M_X64)      || \
 105         defined(__INTEL__)                              )
 106 /*
 107  * AES-NI section
 108  */
 109 extern unsigned int OPENSSL_ia32cap_P[2];
 110 #define AESNI_CAPABLE   (1<<(57-32))
 111
 112 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
 113                         AES_KEY *key);
 114 int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
 115                         AES_KEY *key);
 116
 117 void aesni_encrypt(const unsigned char *in, unsigned char *out,
 118                         const AES_KEY *key);
 119 void aesni_decrypt(const unsigned char *in, unsigned char *out,
 120                         const AES_KEY *key);
 121
 122 void aesni_ecb_encrypt(const unsigned char *in,
 123                         unsigned char *out,
 124                         size_t length,
 125                         const AES_KEY *key,
 126                         int enc);
 127 void aesni_cbc_encrypt(const unsigned char *in,
 128                         unsigned char *out,
 129                         size_t length,
 130                         const AES_KEY *key,
 131                         unsigned char *ivec, int enc);
 132
 133 void aesni_ctr32_encrypt_blocks(const unsigned char *in,
 134                         unsigned char *out,
 135                         size_t blocks,
 136                         const void *key,
 137                         const unsigned char *ivec);
 138
 139 void aesni_xts_encrypt(const unsigned char *in,
 140                         unsigned char *out,
 141                         size_t length,
 142                         const AES_KEY *key1, const AES_KEY *key2,
 143                         const unsigned char iv[16]);
 144
 145 void aesni_xts_decrypt(const unsigned char *in,
 146                         unsigned char *out,
 147                         size_t length,
 148                         const AES_KEY *key1, const AES_KEY *key2,
 149                         const unsigned char iv[16]);
 150
 151 void aesni_ccm64_encrypt_blocks (const unsigned char *in,
 152                         unsigned char *out,
 153                         size_t blocks,
 154                         const void *key,
 155                         const unsigned char ivec[16],
 156                         unsigned char cmac[16]);
 157
 158 void aesni_ccm64_decrypt_blocks (const unsigned char *in,
 159                         unsigned char *out,
 160                         size_t blocks,
 161                         const void *key,
 162                         const unsigned char ivec[16],
 163                         unsigned char cmac[16]);
 164
 165 static int aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 166                    const unsigned char *iv, int enc)
 167         {
 168         int ret;
 169
 170         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 171             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 172             && !enc)
 173                 ret = aesni_set_decrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 174         else
 175                 ret = aesni_set_encrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 176
 177         if(ret < 0)
 178                 {
 179                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 180                 return 0;
 181                 }
 182
 183         return 1;
 184         }
 185
 186 static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 187         const unsigned char *in, size_t len)
 188 {
 189         aesni_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 190
 191         return 1;
 192 }
 193
 194 static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 195         const unsigned char *in, size_t len)
 196 {
 197         size_t  bl = ctx->cipher->block_size;
 198
 199         if (len<bl)     return 1;
 200
 201         aesni_ecb_encrypt(in,out,len,ctx->cipher_data,ctx->encrypt);
 202
 203         return 1;
 204 }
 205
 206 static int aesni_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 207         const unsigned char *in,size_t len)
 208 {
 209         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 210                         ctx->iv,&ctx->num,
 211                         (block128_f)aesni_encrypt);
 212         return 1;
 213 }
 214
 215 static int aesni_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 216         const unsigned char *in,size_t len)
 217 {
 218         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 219                         ctx->iv,&ctx->num,ctx->encrypt,
 220                         (block128_f)aesni_encrypt);
 221         return 1;
 222 }
 223
 224 static int aesni_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 225         const unsigned char *in,size_t len)
 226 {
 227         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 228                         ctx->iv,&ctx->num,ctx->encrypt,
 229                         (block128_f)aesni_encrypt);
 230         return 1;
 231 }
 232
 233 static int aesni_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 234         const unsigned char *in,size_t len)
 235 {
 236         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 237                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 238                         ctx->iv,&ctx->num,ctx->encrypt,
 239                         (block128_f)aesni_encrypt);
 240                 return 1;
 241         }
 242
 243         while (len>=MAXBITCHUNK) {
 244                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 245                         ctx->iv,&ctx->num,ctx->encrypt,
 246                         (block128_f)aesni_encrypt);
 247                 len-=MAXBITCHUNK;
 248         }
 249         if (len)
 250                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 251                         ctx->iv,&ctx->num,ctx->encrypt,
 252                         (block128_f)aesni_encrypt);
 253
 254         return 1;
 255 }
 256
 257 static int aesni_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 258                 const unsigned char *in, size_t len)
 259 {
 260         unsigned int num;
 261         num = ctx->num;
 262
 263         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 264                         ctx->cipher_data,ctx->iv,ctx->buf,&num,
 265                         (ctr128_f)aesni_ctr32_encrypt_blocks);
 266
 267         ctx->num = (size_t)num;
 268         return 1;
 269 }
 270
 271 static int aesni_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 272                         const unsigned char *iv, int enc)
 273         {
 274         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 275         if (!iv && !key)
 276                 return 1;
 277         if (key)
 278                 {
 279                 aesni_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
 280                 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
 281                                 (block128_f)aesni_encrypt);
 282                 /* If we have an iv can set it directly, otherwise use
 283                  * saved IV.
 284                  */
 285                 if (iv == NULL && gctx->iv_set)
 286                         iv = gctx->iv;
 287                 if (iv)
 288                         {
 289                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 290                         gctx->iv_set = 1;
 291                         }
 292                 gctx->key_set = 1;
 293                 }
 294         else
 295                 {
 296                 /* If key set use IV, otherwise copy */
 297                 if (gctx->key_set)
 298                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 299                 else
 300                         memcpy(gctx->iv, iv, gctx->ivlen);
 301                 gctx->iv_set = 1;
 302                 gctx->iv_gen = 0;
 303                 }
 304         return 1;
 305         }
 306
 307 static int aesni_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 308                 const unsigned char *in, size_t len)
 309         {
 310         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 311         /* If not set up, return error */
 312         if (!gctx->iv_set && !gctx->key_set)
 313                 return -1;
 314         if (!ctx->encrypt && gctx->taglen < 0)
 315                 return -1;
 316         if (in)
 317                 {
 318                 if (out == NULL)
 319                         {
 320                         if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
 321                                 return -1;
 322                         }
 323                 else if (ctx->encrypt)
 324                         {
 325                         if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
 326                                         in, out, len,
 327                                         aesni_ctr32_encrypt_blocks))
 328                                 return -1;
 329                         }
 330                 else
 331                         {
 332                         if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,
 333                                         in, out, len,
 334                                         aesni_ctr32_encrypt_blocks))
 335                                 return -1;
 336                         }
 337                 return len;
 338                 }
 339         else
 340                 {
 341                 if (!ctx->encrypt)
 342                         {
 343                         if (CRYPTO_gcm128_finish(&gctx->gcm,
 344                                         ctx->buf, gctx->taglen) != 0)
 345                                 return -1;
 346                         gctx->iv_set = 0;
 347                         return 0;
 348                         }
 349                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
 350                 gctx->taglen = 16;
 351                 /* Don't reuse the IV */
 352                 gctx->iv_set = 0;
 353                 return 0;
 354                 }
 355
 356         }
 357
 358 static int aesni_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 359                         const unsigned char *iv, int enc)
 360         {
 361         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 362         if (!iv && !key)
 363                 return 1;
 364
 365         if (key)
 366                 {
 367                 /* key_len is two AES keys */
 368                 if (enc)
 369                         {
 370                         aesni_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 371                         xctx->xts.block1 = (block128_f)aesni_encrypt;
 372                         }
 373                 else
 374                         {
 375                         aesni_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 376                         xctx->xts.block1 = (block128_f)aesni_decrypt;
 377                         }
 378
 379                 aesni_set_encrypt_key(key + ctx->key_len/2,
 380                                                 ctx->key_len * 4, &xctx->ks2);
 381                 xctx->xts.block2 = (block128_f)aesni_encrypt;
 382
 383                 xctx->xts.key1 = &xctx->ks1;
 384                 }
 385
 386         if (iv)
 387                 {
 388                 xctx->xts.key2 = &xctx->ks2;
 389                 memcpy(ctx->iv, iv, 16);
 390                 }
 391
 392         return 1;
 393         }
 394
 395 static int aesni_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 396                 const unsigned char *in, size_t len)
 397         {
 398         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 399         if (!xctx->xts.key1 || !xctx->xts.key2)
 400                 return -1;
 401         if (!out || !in)
 402                 return -1;
 403 #ifdef OPENSSL_FIPS
 404         /* Requirement of SP800-38E */
 405         if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
 406                         (len > (1L<<20)*16))
 407                 {
 408                 EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);
 409                 return -1;
 410                 }
 411 #endif
 412         if (ctx->encrypt)
 413                 aesni_xts_encrypt(in, out, len,
 414                         xctx->xts.key1, xctx->xts.key2, ctx->iv);
 415         else
 416                 aesni_xts_decrypt(in, out, len,
 417                         xctx->xts.key1, xctx->xts.key2, ctx->iv);
 418
 419         return len;
 420         }
 421
 422 static int aesni_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 423                         const unsigned char *iv, int enc)
 424         {
 425         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
 426         if (!iv && !key)
 427                 return 1;
 428         if (key)
 429                 {
 430                 aesni_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
 431                 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
 432                                         &cctx->ks, (block128_f)aesni_encrypt);
 433                 cctx->key_set = 1;
 434                 }
 435         if (iv)
 436                 {
 437                 memcpy(ctx->iv, iv, 15 - cctx->L);
 438                 cctx->iv_set = 1;
 439                 }
 440         return 1;
 441         }
 442
 443 static int aesni_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 444                 const unsigned char *in, size_t len)
 445         {
 446         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
 447         CCM128_CONTEXT *ccm = &cctx->ccm;
 448         /* If not set up, return error */
 449         if (!cctx->iv_set && !cctx->key_set)
 450                 return -1;
 451         if (!ctx->encrypt && !cctx->tag_set)
 452                 return -1;
 453         if (!out)
 454                 {
 455                 if (!in)
 456                         {
 457                         if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))
 458                                 return -1;
 459                         cctx->len_set = 1;
 460                         return len;
 461                         }
 462                 /* If have AAD need message length */
 463                 if (!cctx->len_set && len)
 464                         return -1;
 465                 CRYPTO_ccm128_aad(ccm, in, len);
 466                 return len;
 467                 }
 468         /* EVP_*Final() doesn't return any data */
 469         if (!in)
 470                 return 0;
 471         /* If not set length yet do it */
 472         if (!cctx->len_set)
 473                 {
 474                 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
 475                         return -1;
 476                 cctx->len_set = 1;
 477                 }
 478         if (ctx->encrypt)
 479                 {
 480                 if (CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,
 481                                 aesni_ccm64_encrypt_blocks))
 482                         return -1;
 483                 cctx->tag_set = 1;
 484                 return len;
 485                 }
 486         else
 487                 {
 488                 int rv = -1;
 489                 if (!CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,
 490                                 aesni_ccm64_decrypt_blocks))
 491                         {
 492                         unsigned char tag[16];
 493                         if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
 494                                 {
 495                                 if (!memcmp(tag, ctx->buf, cctx->M))
 496                                         rv = len;
 497                                 }
 498                         }
 499                 if (rv == -1)
 500                         OPENSSL_cleanse(out, len);
 501                 cctx->iv_set = 0;
 502                 cctx->tag_set = 0;
 503                 cctx->len_set = 0;
 504                 return rv;
 505                 }
 506
 507         }
 508
 509 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 510 static const EVP_CIPHER aesni_##keylen##_##mode = { \
 511         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 512         flags|EVP_CIPH_##MODE##_MODE,   \
 513         aesni_init_key,                 \
 514         aesni_##mode##_cipher,          \
 515         NULL,                           \
 516         sizeof(EVP_AES_KEY),            \
 517         NULL,NULL,NULL,NULL }; \
 518 static const EVP_CIPHER aes_##keylen##_##mode = { \
 519         nid##_##keylen##_##nmode,blocksize,     \
 520         keylen/8,ivlen, \
 521         flags|EVP_CIPH_##MODE##_MODE,   \
 522         aes_init_key,                   \
 523         aes_##mode##_cipher,            \
 524         NULL,                           \
 525         sizeof(EVP_AES_KEY),            \
 526         NULL,NULL,NULL,NULL }; \
 527 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 528 { return (OPENSSL_ia32cap_P[1]&AESNI_CAPABLE)? \
 529   &aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
 530
 531 #define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
 532 static const EVP_CIPHER aesni_##keylen##_##mode = { \
 533         nid##_##keylen##_##mode,blocksize, \
 534         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 535         flags|EVP_CIPH_##MODE##_MODE,   \
 536         aesni_##mode##_init_key,        \
 537         aesni_##mode##_cipher,          \
 538         aes_##mode##_cleanup,           \
 539         sizeof(EVP_AES_##MODE##_CTX),   \
 540         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 541 static const EVP_CIPHER aes_##keylen##_##mode = { \
 542         nid##_##keylen##_##mode,blocksize, \
 543         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 544         flags|EVP_CIPH_##MODE##_MODE,   \
 545         aes_##mode##_init_key,          \
 546         aes_##mode##_cipher,            \
 547         aes_##mode##_cleanup,           \
 548         sizeof(EVP_AES_##MODE##_CTX),   \
 549         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 550 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 551 { return (OPENSSL_ia32cap_P[1]&AESNI_CAPABLE)? \
 552   &aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
 553
 554 #else
 555
 556 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 557 static const EVP_CIPHER aes_##keylen##_##mode = { \
 558         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 559         flags|EVP_CIPH_##MODE##_MODE,   \
 560         aes_init_key,                   \
 561         aes_##mode##_cipher,            \
 562         NULL,                           \
 563         sizeof(EVP_AES_KEY),            \
 564         NULL,NULL,NULL,NULL }; \
 565 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 566 { return &aes_##keylen##_##mode; }
 567
 568 #define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
 569 static const EVP_CIPHER aes_##keylen##_##mode = { \
 570         nid##_##keylen##_##mode,blocksize, \
 571         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 572         flags|EVP_CIPH_##MODE##_MODE,   \
 573         aes_##mode##_init_key,          \
 574         aes_##mode##_cipher,            \
 575         aes_##mode##_cleanup,           \
 576         sizeof(EVP_AES_##MODE##_CTX),   \
 577         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 578 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 579 { return &aes_##keylen##_##mode; }
 580 #endif
 581
 582 #define BLOCK_CIPHER_generic_pack(nid,keylen,flags)             \
 583         BLOCK_CIPHER_generic(nid,keylen,16,16,cbc,cbc,CBC,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)     \
 584         BLOCK_CIPHER_generic(nid,keylen,16,0,ecb,ecb,ECB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)      \
 585         BLOCK_CIPHER_generic(nid,keylen,1,16,ofb128,ofb,OFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 586         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb128,cfb,CFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 587         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb1,cfb1,CFB,flags)       \
 588         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb8,cfb8,CFB,flags)       \
 589         BLOCK_CIPHER_generic(nid,keylen,1,16,ctr,ctr,CTR,flags)
 590
 591 static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 592                    const unsigned char *iv, int enc)
 593         {
 594         int ret;
 595
 596         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 597             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 598             && !enc)
 599                 ret = AES_set_decrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 600         else
 601                 ret = AES_set_encrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 602
 603         if(ret < 0)
 604                 {
 605                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 606                 return 0;
 607                 }
 608
 609         return 1;
 610         }
 611
 612 static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 613         const unsigned char *in, size_t len)
 614 {
 615         AES_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 616
 617         return 1;
 618 }
 619
 620 static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 621         const unsigned char *in, size_t len)
 622 {
 623         size_t  bl = ctx->cipher->block_size;
 624         size_t  i;
 625
 626         if (len<bl)     return 1;
 627
 628         if (ctx->encrypt) {
 629                 for (i=0,len-=bl;i<=len;i+=bl)
 630                         AES_encrypt(in+i,out+i,ctx->cipher_data);
 631         } else {
 632                 for (i=0,len-=bl;i<=len;i+=bl)
 633                         AES_decrypt(in+i,out+i,ctx->cipher_data);
 634         }
 635
 636         return 1;
 637 }
 638
 639 static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 640         const unsigned char *in,size_t len)
 641 {
 642         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 643                         ctx->iv,&ctx->num,
 644                         (block128_f)AES_encrypt);
 645         return 1;
 646 }
 647
 648 static int aes_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 649         const unsigned char *in,size_t len)
 650 {
 651         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 652                         ctx->iv,&ctx->num,ctx->encrypt,
 653                         (block128_f)AES_encrypt);
 654         return 1;
 655 }
 656
 657 static int aes_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 658         const unsigned char *in,size_t len)
 659 {
 660         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 661                         ctx->iv,&ctx->num,ctx->encrypt,
 662                         (block128_f)AES_encrypt);
 663         return 1;
 664 }
 665
 666 static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 667         const unsigned char *in,size_t len)
 668 {
 669         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 670                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 671                         ctx->iv,&ctx->num,ctx->encrypt,
 672                         (block128_f)AES_encrypt);
 673                 return 1;
 674         }
 675
 676         while (len>=MAXBITCHUNK) {
 677                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 678                         ctx->iv,&ctx->num,ctx->encrypt,
 679                         (block128_f)AES_encrypt);
 680                 len-=MAXBITCHUNK;
 681         }
 682         if (len)
 683                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 684                         ctx->iv,&ctx->num,ctx->encrypt,
 685                         (block128_f)AES_encrypt);
 686
 687         return 1;
 688 }
 689
 690 static int aes_ctr_cipher (EVP_CIPHER_CTX *ctx, unsigned char *out,
 691                 const unsigned char *in, size_t len)
 692 {
 693         unsigned int num;
 694         num = ctx->num;
 695 #ifdef AES_CTR_ASM
 696         void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out,
 697                         size_t blocks, const AES_KEY *key,
 698                         const unsigned char ivec[AES_BLOCK_SIZE]);
 699
 700         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 701                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 702                 ctx->iv,ctx->buf,&num,(ctr128_f)AES_ctr32_encrypt);
 703 #else
 704         CRYPTO_ctr128_encrypt(in,out,len,
 705                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 706                 ctx->iv,ctx->buf,&num,(block128_f)AES_encrypt);
 707 #endif
 708         ctx->num = (size_t)num;
 709         return 1;
 710 }
 711
 712 BLOCK_CIPHER_generic_pack(NID_aes,128,EVP_CIPH_FLAG_FIPS)
 713 BLOCK_CIPHER_generic_pack(NID_aes,192,EVP_CIPH_FLAG_FIPS)
 714 BLOCK_CIPHER_generic_pack(NID_aes,256,EVP_CIPH_FLAG_FIPS)
 715
 716 static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
 717         {
 718         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 719         OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
 720         if (gctx->iv != c->iv)
 721                 OPENSSL_free(gctx->iv);
 722         return 1;
 723         }
 724
 725 /* increment counter (64-bit int) by 1 */
 726 static void ctr64_inc(unsigned char *counter) {
 727         int n=8;
 728         unsigned char  c;
 729
 730         do {
 731                 --n;
 732                 c = counter[n];
 733                 ++c;
 734                 counter[n] = c;
 735                 if (c) return;
 736         } while (n);
 737 }
 738
 739 static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
 740         {
 741         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 742         switch (type)
 743                 {
 744         case EVP_CTRL_INIT:
 745                 gctx->key_set = 0;
 746                 gctx->iv_set = 0;
 747                 gctx->ivlen = c->cipher->iv_len;
 748                 gctx->iv = c->iv;
 749                 gctx->taglen = -1;
 750                 gctx->iv_gen = 0;
 751                 return 1;
 752
 753         case EVP_CTRL_GCM_SET_IVLEN:
 754                 if (arg <= 0)
 755                         return 0;
 756 #ifdef OPENSSL_FIPS
 757                 if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
 758                                                  && arg < 12)
 759                         return 0;
 760 #endif
 761                 /* Allocate memory for IV if needed */
 762                 if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen))
 763                         {
 764                         if (gctx->iv != c->iv)
 765                                 OPENSSL_free(gctx->iv);
 766                         gctx->iv = OPENSSL_malloc(arg);
 767                         if (!gctx->iv)
 768                                 return 0;
 769                         }
 770                 gctx->ivlen = arg;
 771                 return 1;
 772
 773         case EVP_CTRL_GCM_SET_TAG:
 774                 if (arg <= 0 || arg > 16 || c->encrypt)
 775                         return 0;
 776                 memcpy(c->buf, ptr, arg);
 777                 gctx->taglen = arg;
 778                 return 1;
 779
 780         case EVP_CTRL_GCM_GET_TAG:
 781                 if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0)
 782                         return 0;
 783                 memcpy(ptr, c->buf, arg);
 784                 return 1;
 785
 786         case EVP_CTRL_GCM_SET_IV_FIXED:
 787                 /* Special case: -1 length restores whole IV */
 788                 if (arg == -1)
 789                         {
 790                         memcpy(gctx->iv, ptr, gctx->ivlen);
 791                         gctx->iv_gen = 1;
 792                         return 1;
 793                         }
 794                 /* Fixed field must be at least 4 bytes and invocation field
 795                  * at least 8.
 796                  */
 797                 if ((arg < 4) || (gctx->ivlen - arg) < 8)
 798                         return 0;
 799                 if (arg)
 800                         memcpy(gctx->iv, ptr, arg);
 801                 if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
 802                         return 0;
 803                 gctx->iv_gen = 1;
 804                 return 1;
 805
 806         case EVP_CTRL_GCM_IV_GEN:
 807                 if (gctx->iv_gen == 0 || gctx->key_set == 0)
 808                         return 0;
 809                 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
 810                 memcpy(ptr, gctx->iv, gctx->ivlen);
 811                 /* Invocation field will be at least 8 bytes in size and
 812                  * so no need to check wrap around or increment more than
 813                  * last 8 bytes.
 814                  */
 815                 ctr64_inc(gctx->iv + gctx->ivlen - 8);
 816                 gctx->iv_set = 1;
 817                 return 1;
 818
 819         default:
 820                 return -1;
 821
 822                 }
 823         }
 824
 825 static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 826                         const unsigned char *iv, int enc)
 827         {
 828         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 829         if (!iv && !key)
 830                 return 1;
 831         if (key)
 832                 {
 833                 AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
 834                 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
 835                 /* If we have an iv can set it directly, otherwise use
 836                  * saved IV.
 837                  */
 838                 if (iv == NULL && gctx->iv_set)
 839                         iv = gctx->iv;
 840                 if (iv)
 841                         {
 842                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 843                         gctx->iv_set = 1;
 844                         }
 845                 gctx->key_set = 1;
 846                 }
 847         else
 848                 {
 849                 /* If key set use IV, otherwise copy */
 850                 if (gctx->key_set)
 851                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 852                 else
 853                         memcpy(gctx->iv, iv, gctx->ivlen);
 854                 gctx->iv_set = 1;
 855                 gctx->iv_gen = 0;
 856                 }
 857         return 1;
 858         }
 859
 860 static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 861                 const unsigned char *in, size_t len)
 862         {
 863         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 864         /* If not set up, return error */
 865         if (!gctx->iv_set && !gctx->key_set)
 866                 return -1;
 867         if (!ctx->encrypt && gctx->taglen < 0)
 868                 return -1;
 869         if (in)
 870                 {
 871                 if (out == NULL)
 872                         {
 873                         if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
 874                                 return -1;
 875                         }
 876                 else if (ctx->encrypt)
 877                         {
 878                         if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
 879                                 return -1;
 880                         }
 881                 else
 882                         {
 883                         if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
 884                                 return -1;
 885                         }
 886                 return len;
 887                 }
 888         else
 889                 {
 890                 if (!ctx->encrypt)
 891                         {
 892                         if (CRYPTO_gcm128_finish(&gctx->gcm,
 893                                         ctx->buf, gctx->taglen) != 0)
 894                                 return -1;
 895                         gctx->iv_set = 0;
 896                         return 0;
 897                         }
 898                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
 899                 gctx->taglen = 16;
 900                 /* Don't reuse the IV */
 901                 gctx->iv_set = 0;
 902                 return 0;
 903                 }
 904
 905         }
 906
 907 #define CUSTOM_FLAGS    (EVP_CIPH_FLAG_DEFAULT_ASN1 \
 908                 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
 909                 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
 910
 911 BLOCK_CIPHER_custom(NID_aes,128,1,12,gcm,GCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
 912 BLOCK_CIPHER_custom(NID_aes,192,1,12,gcm,GCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
 913 BLOCK_CIPHER_custom(NID_aes,256,1,12,gcm,GCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
 914
 915 static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
 916         {
 917         EVP_AES_XTS_CTX *xctx = c->cipher_data;
 918         if (type != EVP_CTRL_INIT)
 919                 return -1;
 920         /* key1 and key2 are used as an indicator both key and IV are set */
 921         xctx->xts.key1 = NULL;
 922         xctx->xts.key2 = NULL;
 923         return 1;
 924         }
 925
 926 static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 927                         const unsigned char *iv, int enc)
 928         {
 929         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 930         if (!iv && !key)
 931                 return 1;
 932
 933         if (key)
 934                 {
 935                 /* key_len is two AES keys */
 936                 if (enc)
 937                         {
 938                         AES_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 939                         xctx->xts.block1 = (block128_f)AES_encrypt;
 940                         }
 941                 else
 942                         {
 943                         AES_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 944                         xctx->xts.block1 = (block128_f)AES_decrypt;
 945                         }
 946
 947                 AES_set_encrypt_key(key + ctx->key_len/2,
 948                                                 ctx->key_len * 4, &xctx->ks2);
 949                 xctx->xts.block2 = (block128_f)AES_encrypt;
 950
 951                 xctx->xts.key1 = &xctx->ks1;
 952                 }
 953
 954         if (iv)
 955                 {
 956                 xctx->xts.key2 = &xctx->ks2;
 957                 memcpy(ctx->iv, iv, 16);
 958                 }
 959
 960         return 1;
 961         }
 962
 963 static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 964                 const unsigned char *in, size_t len)
 965         {
 966         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 967         if (!xctx->xts.key1 || !xctx->xts.key2)
 968                 return -1;
 969         if (!out || !in)
 970                 return -1;
 971 #ifdef OPENSSL_FIPS
 972         /* Requirement of SP800-38E */
 973         if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
 974                         (len > (1L<<20)*16))
 975                 {
 976                 EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);
 977                 return -1;
 978                 }
 979 #endif
 980         if (CRYPTO_xts128_encrypt(&xctx->xts, ctx->iv, in, out, len,
 981                                                                 ctx->encrypt))
 982                 return -1;
 983         return len;
 984         }
 985
 986 #define aes_xts_cleanup NULL
 987
 988 BLOCK_CIPHER_custom(NID_aes,128,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
 989 BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
 990
 991 static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
 992         {
 993         EVP_AES_CCM_CTX *cctx = c->cipher_data;
 994         switch (type)
 995                 {
 996         case EVP_CTRL_INIT:
 997                 cctx->key_set = 0;
 998                 cctx->iv_set = 0;
 999                 cctx->L = 8;
1000                 cctx->M = 12;
1001                 cctx->tag_set = 0;
1002                 cctx->len_set = 0;
1003                 return 1;
1004
1005         case EVP_CTRL_CCM_SET_IVLEN:
1006                 arg = 15 - arg;
1007         case EVP_CTRL_CCM_SET_L:
1008                 if (arg < 2 || arg > 8)
1009                         return 0;
1010                 cctx->L = arg;
1011                 return 1;
1012
1013         case EVP_CTRL_CCM_SET_TAG:
1014                 if ((arg & 1) || arg < 4 || arg > 16)
1015                         return 0;
1016                 if ((c->encrypt && ptr) || (!c->encrypt && !ptr))
1017                         return 0;
1018                 if (ptr)
1019                         {
1020                         cctx->tag_set = 1;
1021                         memcpy(c->buf, ptr, arg);
1022                         }
1023                 cctx->M = arg;
1024                 return 1;
1025
1026         case EVP_CTRL_CCM_GET_TAG:
1027                 if (!c->encrypt || !cctx->tag_set)
1028                         return 0;
1029                 if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
1030                         return 0;
1031                 cctx->tag_set = 0;
1032                 cctx->iv_set = 0;
1033                 cctx->len_set = 0;
1034                 return 1;
1035
1036         default:
1037                 return -1;
1038
1039                 }
1040         }
1041
1042 static int aes_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
1043                         const unsigned char *iv, int enc)
1044         {
1045         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
1046         if (!iv && !key)
1047                 return 1;
1048         if (key)
1049                 {
1050                 AES_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
1051                 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
1052                                         &cctx->ks, (block128_f)AES_encrypt);
1053                 cctx->key_set = 1;
1054                 }
1055         if (iv)
1056                 {
1057                 memcpy(ctx->iv, iv, 15 - cctx->L);
1058                 cctx->iv_set = 1;
1059                 }
1060         return 1;
1061         }
1062
1063 static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1064                 const unsigned char *in, size_t len)
1065         {
1066         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
1067         CCM128_CONTEXT *ccm = &cctx->ccm;
1068         /* If not set up, return error */
1069         if (!cctx->iv_set && !cctx->key_set)
1070                 return -1;
1071         if (!ctx->encrypt && !cctx->tag_set)
1072                 return -1;
1073         if (!out)
1074                 {
1075                 if (!in)
1076                         {
1077                         if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))
1078                                 return -1;
1079                         cctx->len_set = 1;
1080                         return len;
1081                         }
1082                 /* If have AAD need message length */
1083                 if (!cctx->len_set && len)
1084                         return -1;
1085                 CRYPTO_ccm128_aad(ccm, in, len);
1086                 return len;
1087                 }
1088         /* EVP_*Final() doesn't return any data */
1089         if (!in)
1090                 return 0;
1091         /* If not set length yet do it */
1092         if (!cctx->len_set)
1093                 {
1094                 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
1095                         return -1;
1096                 cctx->len_set = 1;
1097                 }
1098         if (ctx->encrypt)
1099                 {
1100                 if (CRYPTO_ccm128_encrypt(ccm, in, out, len))
1101                         return -1;
1102                 cctx->tag_set = 1;
1103                 return len;
1104                 }
1105         else
1106                 {
1107                 int rv = -1;
1108                 if (!CRYPTO_ccm128_decrypt(ccm, in, out, len))
1109                         {
1110                         unsigned char tag[16];
1111                         if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
1112                                 {
1113                                 if (!memcmp(tag, ctx->buf, cctx->M))
1114                                         rv = len;
1115                                 }
1116                         }
1117                 if (rv == -1)
1118                         OPENSSL_cleanse(out, len);
1119                 cctx->iv_set = 0;
1120                 cctx->tag_set = 0;
1121                 cctx->len_set = 0;
1122                 return rv;
1123                 }
1124
1125         }
1126
1127 #define aes_ccm_cleanup NULL
1128
1129 BLOCK_CIPHER_custom(NID_aes,128,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1130 BLOCK_CIPHER_custom(NID_aes,192,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1131 BLOCK_CIPHER_custom(NID_aes,256,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1132
1133 #endif