crypto/evp/e_aes.c

   1 /* ====================================================================
   2  * Copyright (c) 2001-2011 The OpenSSL Project.  All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  *
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  *
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in
  13  *    the documentation and/or other materials provided with the
  14  *    distribution.
  15  *
  16  * 3. All advertising materials mentioning features or use of this
  17  *    software must display the following acknowledgment:
  18  *    "This product includes software developed by the OpenSSL Project
  19  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  20  *
  21  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  22  *    endorse or promote products derived from this software without
  23  *    prior written permission. For written permission, please contact
  24  *    openssl-core@openssl.org.
  25  *
  26  * 5. Products derived from this software may not be called "OpenSSL"
  27  *    nor may "OpenSSL" appear in their names without prior written
  28  *    permission of the OpenSSL Project.
  29  *
  30  * 6. Redistributions of any form whatsoever must retain the following
  31  *    acknowledgment:
  32  *    "This product includes software developed by the OpenSSL Project
  33  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  36  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  38  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  39  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  40  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  41  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  42  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  44  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  45  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  46  * OF THE POSSIBILITY OF SUCH DAMAGE.
  47  * ====================================================================
  48  *
  49  */
  50
  51 #include <openssl/opensslconf.h>
  52 #ifndef OPENSSL_NO_AES
  53 #include <openssl/evp.h>
  54 #include <openssl/err.h>
  55 #include <string.h>
  56 #include <assert.h>
  57 #include <openssl/aes.h>
  58 #include "evp_locl.h"
  59 #ifndef OPENSSL_FIPS
  60 #include "modes_lcl.h"
  61 #include <openssl/rand.h>
  62
  63 typedef struct
  64         {
  65         AES_KEY ks;
  66         } EVP_AES_KEY;
  67
  68 typedef struct
  69         {
  70         AES_KEY ks;             /* AES key schedule to use */
  71         int key_set;            /* Set if key initialised */
  72         int iv_set;             /* Set if an iv is set */
  73         GCM128_CONTEXT gcm;
  74         unsigned char *iv;      /* Temporary IV store */
  75         int ivlen;              /* IV length */
  76         int taglen;
  77         int iv_gen;             /* It is OK to generate IVs */
  78         int tls_aad_len;        /* TLS AAD length */
  79         } EVP_AES_GCM_CTX;
  80
  81 typedef struct
  82         {
  83         AES_KEY ks1, ks2;       /* AES key schedules to use */
  84         XTS128_CONTEXT xts;
  85         } EVP_AES_XTS_CTX;
  86
  87 typedef struct
  88         {
  89         AES_KEY ks;             /* AES key schedule to use */
  90         int key_set;            /* Set if key initialised */
  91         int iv_set;             /* Set if an iv is set */
  92         int tag_set;            /* Set if tag is valid */
  93         int len_set;            /* Set if message length set */
  94         int L, M;               /* L and M parameters from RFC3610 */
  95         CCM128_CONTEXT ccm;
  96         } EVP_AES_CCM_CTX;
  97
  98 #define MAXBITCHUNK     ((size_t)1<<(sizeof(size_t)*8-4))
  99
 100 #if     defined(AES_ASM) && !defined(I386_ONLY) &&      (  \
 101         ((defined(__i386)       || defined(__i386__)    || \
 102           defined(_M_IX86)) && defined(OPENSSL_IA32_SSE2))|| \
 103         defined(__x86_64)       || defined(__x86_64__)  || \
 104         defined(_M_AMD64)       || defined(_M_X64)      || \
 105         defined(__INTEL__)                              )
 106 /*
 107  * AES-NI section
 108  */
 109 extern unsigned int OPENSSL_ia32cap_P[2];
 110 #define AESNI_CAPABLE   (1<<(57-32))
 111
 112 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
 113                         AES_KEY *key);
 114 int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
 115                         AES_KEY *key);
 116
 117 void aesni_encrypt(const unsigned char *in, unsigned char *out,
 118                         const AES_KEY *key);
 119 void aesni_decrypt(const unsigned char *in, unsigned char *out,
 120                         const AES_KEY *key);
 121
 122 void aesni_ecb_encrypt(const unsigned char *in,
 123                         unsigned char *out,
 124                         size_t length,
 125                         const AES_KEY *key,
 126                         int enc);
 127 void aesni_cbc_encrypt(const unsigned char *in,
 128                         unsigned char *out,
 129                         size_t length,
 130                         const AES_KEY *key,
 131                         unsigned char *ivec, int enc);
 132
 133 void aesni_ctr32_encrypt_blocks(const unsigned char *in,
 134                         unsigned char *out,
 135                         size_t blocks,
 136                         const void *key,
 137                         const unsigned char *ivec);
 138
 139 void aesni_xts_encrypt(const unsigned char *in,
 140                         unsigned char *out,
 141                         size_t length,
 142                         const AES_KEY *key1, const AES_KEY *key2,
 143                         const unsigned char iv[16]);
 144
 145 void aesni_xts_decrypt(const unsigned char *in,
 146                         unsigned char *out,
 147                         size_t length,
 148                         const AES_KEY *key1, const AES_KEY *key2,
 149                         const unsigned char iv[16]);
 150
 151 void aesni_ccm64_encrypt_blocks (const unsigned char *in,
 152                         unsigned char *out,
 153                         size_t blocks,
 154                         const void *key,
 155                         const unsigned char ivec[16],
 156                         unsigned char cmac[16]);
 157
 158 void aesni_ccm64_decrypt_blocks (const unsigned char *in,
 159                         unsigned char *out,
 160                         size_t blocks,
 161                         const void *key,
 162                         const unsigned char ivec[16],
 163                         unsigned char cmac[16]);
 164
 165 static int aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 166                    const unsigned char *iv, int enc)
 167         {
 168         int ret;
 169
 170         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 171             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 172             && !enc)
 173                 ret = aesni_set_decrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 174         else
 175                 ret = aesni_set_encrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 176
 177         if(ret < 0)
 178                 {
 179                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 180                 return 0;
 181                 }
 182
 183         return 1;
 184         }
 185
 186 static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 187         const unsigned char *in, size_t len)
 188 {
 189         aesni_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 190
 191         return 1;
 192 }
 193
 194 static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 195         const unsigned char *in, size_t len)
 196 {
 197         size_t  bl = ctx->cipher->block_size;
 198
 199         if (len<bl)     return 1;
 200
 201         aesni_ecb_encrypt(in,out,len,ctx->cipher_data,ctx->encrypt);
 202
 203         return 1;
 204 }
 205
 206 static int aesni_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 207         const unsigned char *in,size_t len)
 208 {
 209         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 210                         ctx->iv,&ctx->num,
 211                         (block128_f)aesni_encrypt);
 212         return 1;
 213 }
 214
 215 static int aesni_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 216         const unsigned char *in,size_t len)
 217 {
 218         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 219                         ctx->iv,&ctx->num,ctx->encrypt,
 220                         (block128_f)aesni_encrypt);
 221         return 1;
 222 }
 223
 224 static int aesni_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 225         const unsigned char *in,size_t len)
 226 {
 227         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 228                         ctx->iv,&ctx->num,ctx->encrypt,
 229                         (block128_f)aesni_encrypt);
 230         return 1;
 231 }
 232
 233 static int aesni_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 234         const unsigned char *in,size_t len)
 235 {
 236         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 237                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 238                         ctx->iv,&ctx->num,ctx->encrypt,
 239                         (block128_f)aesni_encrypt);
 240                 return 1;
 241         }
 242
 243         while (len>=MAXBITCHUNK) {
 244                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 245                         ctx->iv,&ctx->num,ctx->encrypt,
 246                         (block128_f)aesni_encrypt);
 247                 len-=MAXBITCHUNK;
 248         }
 249         if (len)
 250                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 251                         ctx->iv,&ctx->num,ctx->encrypt,
 252                         (block128_f)aesni_encrypt);
 253
 254         return 1;
 255 }
 256
 257 static int aesni_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 258                 const unsigned char *in, size_t len)
 259 {
 260         unsigned int num;
 261         num = ctx->num;
 262
 263         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 264                         ctx->cipher_data,ctx->iv,ctx->buf,&num,
 265                         (ctr128_f)aesni_ctr32_encrypt_blocks);
 266
 267         ctx->num = (size_t)num;
 268         return 1;
 269 }
 270
 271 static int aesni_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 272                         const unsigned char *iv, int enc)
 273         {
 274         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 275         if (!iv && !key)
 276                 return 1;
 277         if (key)
 278                 {
 279                 aesni_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
 280                 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
 281                                 (block128_f)aesni_encrypt);
 282                 /* If we have an iv can set it directly, otherwise use
 283                  * saved IV.
 284                  */
 285                 if (iv == NULL && gctx->iv_set)
 286                         iv = gctx->iv;
 287                 if (iv)
 288                         {
 289                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 290                         gctx->iv_set = 1;
 291                         }
 292                 gctx->key_set = 1;
 293                 }
 294         else
 295                 {
 296                 /* If key set use IV, otherwise copy */
 297                 if (gctx->key_set)
 298                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 299                 else
 300                         memcpy(gctx->iv, iv, gctx->ivlen);
 301                 gctx->iv_set = 1;
 302                 gctx->iv_gen = 0;
 303                 }
 304         return 1;
 305         }
 306
 307 /* Handle TLS GCM packet format. This consists of the last portion of the IV
 308  * followed by the payload and finally the tag. On encrypt generate IV,
 309  * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
 310  * and verify tag.
 311  */
 312
 313 static int aesni_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 314                 const unsigned char *in, size_t len)
 315         {
 316         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 317         int rv = -1;
 318         /* Encrypt/decrypt must be performed in place */
 319         if (out != in)
 320                 return -1;
 321         /* Set IV from start of buffer or generate IV and write to start
 322          * of buffer.
 323          */
 324         if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ?
 325                                 EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,
 326                                 EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
 327                 goto err;
 328         /* Use saved AAD */
 329         if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))
 330                 goto err;
 331         /* Fix buffer and length to point to payload */
 332         in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 333         out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 334         len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 335         if (ctx->encrypt)
 336                 {
 337                 /* Encrypt payload */
 338                 if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm, in, out, len,
 339                                                 aesni_ctr32_encrypt_blocks))
 340                 out += len;
 341                 /* Finally write tag */
 342                 CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);
 343                 rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 344                 }
 345         else
 346                 {
 347                 /* Decrypt */
 348                 if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm, in, out, len,
 349                                                 aesni_ctr32_encrypt_blocks))
 350                         goto err;
 351                 /* Retrieve tag */
 352                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf,
 353                                         EVP_GCM_TLS_TAG_LEN);
 354                 /* If tag mismatch wipe buffer */
 355                 if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN))
 356                         {
 357                         OPENSSL_cleanse(out, len);
 358                         goto err;
 359                         }
 360                 rv = len;
 361                 }
 362
 363         err:
 364         gctx->iv_set = 0;
 365         gctx->tls_aad_len = -1;
 366         return rv;
 367         }
 368
 369 static int aesni_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 370                 const unsigned char *in, size_t len)
 371         {
 372         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 373         /* If not set up, return error */
 374         if (!gctx->key_set)
 375                 return -1;
 376
 377         if (gctx->tls_aad_len >= 0)
 378                 return aesni_gcm_tls_cipher(ctx, out, in, len);
 379
 380         if (!gctx->iv_set)
 381                 return -1;
 382         if (!ctx->encrypt && gctx->taglen < 0)
 383                 return -1;
 384         if (in)
 385                 {
 386                 if (out == NULL)
 387                         {
 388                         if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
 389                                 return -1;
 390                         }
 391                 else if (ctx->encrypt)
 392                         {
 393                         if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
 394                                         in, out, len,
 395                                         aesni_ctr32_encrypt_blocks))
 396                                 return -1;
 397                         }
 398                 else
 399                         {
 400                         if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,
 401                                         in, out, len,
 402                                         aesni_ctr32_encrypt_blocks))
 403                                 return -1;
 404                         }
 405                 return len;
 406                 }
 407         else
 408                 {
 409                 if (!ctx->encrypt)
 410                         {
 411                         if (CRYPTO_gcm128_finish(&gctx->gcm,
 412                                         ctx->buf, gctx->taglen) != 0)
 413                                 return -1;
 414                         gctx->iv_set = 0;
 415                         return 0;
 416                         }
 417                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
 418                 gctx->taglen = 16;
 419                 /* Don't reuse the IV */
 420                 gctx->iv_set = 0;
 421                 return 0;
 422                 }
 423
 424         }
 425
 426 static int aesni_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 427                         const unsigned char *iv, int enc)
 428         {
 429         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 430         if (!iv && !key)
 431                 return 1;
 432
 433         if (key)
 434                 {
 435                 /* key_len is two AES keys */
 436                 if (enc)
 437                         {
 438                         aesni_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 439                         xctx->xts.block1 = (block128_f)aesni_encrypt;
 440                         }
 441                 else
 442                         {
 443                         aesni_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 444                         xctx->xts.block1 = (block128_f)aesni_decrypt;
 445                         }
 446
 447                 aesni_set_encrypt_key(key + ctx->key_len/2,
 448                                                 ctx->key_len * 4, &xctx->ks2);
 449                 xctx->xts.block2 = (block128_f)aesni_encrypt;
 450
 451                 xctx->xts.key1 = &xctx->ks1;
 452                 }
 453
 454         if (iv)
 455                 {
 456                 xctx->xts.key2 = &xctx->ks2;
 457                 memcpy(ctx->iv, iv, 16);
 458                 }
 459
 460         return 1;
 461         }
 462
 463 static int aesni_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 464                 const unsigned char *in, size_t len)
 465         {
 466         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 467         if (!xctx->xts.key1 || !xctx->xts.key2)
 468                 return -1;
 469         if (!out || !in)
 470                 return -1;
 471 #ifdef OPENSSL_FIPS
 472         /* Requirement of SP800-38E */
 473         if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
 474                         (len > (1L<<20)*16))
 475                 {
 476                 EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);
 477                 return -1;
 478                 }
 479 #endif
 480         if (ctx->encrypt)
 481                 aesni_xts_encrypt(in, out, len,
 482                         xctx->xts.key1, xctx->xts.key2, ctx->iv);
 483         else
 484                 aesni_xts_decrypt(in, out, len,
 485                         xctx->xts.key1, xctx->xts.key2, ctx->iv);
 486
 487         return len;
 488         }
 489
 490 static int aesni_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 491                         const unsigned char *iv, int enc)
 492         {
 493         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
 494         if (!iv && !key)
 495                 return 1;
 496         if (key)
 497                 {
 498                 aesni_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
 499                 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
 500                                         &cctx->ks, (block128_f)aesni_encrypt);
 501                 cctx->key_set = 1;
 502                 }
 503         if (iv)
 504                 {
 505                 memcpy(ctx->iv, iv, 15 - cctx->L);
 506                 cctx->iv_set = 1;
 507                 }
 508         return 1;
 509         }
 510
 511 static int aesni_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 512                 const unsigned char *in, size_t len)
 513         {
 514         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
 515         CCM128_CONTEXT *ccm = &cctx->ccm;
 516         /* If not set up, return error */
 517         if (!cctx->iv_set && !cctx->key_set)
 518                 return -1;
 519         if (!ctx->encrypt && !cctx->tag_set)
 520                 return -1;
 521         if (!out)
 522                 {
 523                 if (!in)
 524                         {
 525                         if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))
 526                                 return -1;
 527                         cctx->len_set = 1;
 528                         return len;
 529                         }
 530                 /* If have AAD need message length */
 531                 if (!cctx->len_set && len)
 532                         return -1;
 533                 CRYPTO_ccm128_aad(ccm, in, len);
 534                 return len;
 535                 }
 536         /* EVP_*Final() doesn't return any data */
 537         if (!in)
 538                 return 0;
 539         /* If not set length yet do it */
 540         if (!cctx->len_set)
 541                 {
 542                 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
 543                         return -1;
 544                 cctx->len_set = 1;
 545                 }
 546         if (ctx->encrypt)
 547                 {
 548                 if (CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,
 549                                 aesni_ccm64_encrypt_blocks))
 550                         return -1;
 551                 cctx->tag_set = 1;
 552                 return len;
 553                 }
 554         else
 555                 {
 556                 int rv = -1;
 557                 if (!CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,
 558                                 aesni_ccm64_decrypt_blocks))
 559                         {
 560                         unsigned char tag[16];
 561                         if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
 562                                 {
 563                                 if (!memcmp(tag, ctx->buf, cctx->M))
 564                                         rv = len;
 565                                 }
 566                         }
 567                 if (rv == -1)
 568                         OPENSSL_cleanse(out, len);
 569                 cctx->iv_set = 0;
 570                 cctx->tag_set = 0;
 571                 cctx->len_set = 0;
 572                 return rv;
 573                 }
 574
 575         }
 576
 577 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 578 static const EVP_CIPHER aesni_##keylen##_##mode = { \
 579         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 580         flags|EVP_CIPH_##MODE##_MODE,   \
 581         aesni_init_key,                 \
 582         aesni_##mode##_cipher,          \
 583         NULL,                           \
 584         sizeof(EVP_AES_KEY),            \
 585         NULL,NULL,NULL,NULL }; \
 586 static const EVP_CIPHER aes_##keylen##_##mode = { \
 587         nid##_##keylen##_##nmode,blocksize,     \
 588         keylen/8,ivlen, \
 589         flags|EVP_CIPH_##MODE##_MODE,   \
 590         aes_init_key,                   \
 591         aes_##mode##_cipher,            \
 592         NULL,                           \
 593         sizeof(EVP_AES_KEY),            \
 594         NULL,NULL,NULL,NULL }; \
 595 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 596 { return (OPENSSL_ia32cap_P[1]&AESNI_CAPABLE)? \
 597   &aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
 598
 599 #define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
 600 static const EVP_CIPHER aesni_##keylen##_##mode = { \
 601         nid##_##keylen##_##mode,blocksize, \
 602         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 603         flags|EVP_CIPH_##MODE##_MODE,   \
 604         aesni_##mode##_init_key,        \
 605         aesni_##mode##_cipher,          \
 606         aes_##mode##_cleanup,           \
 607         sizeof(EVP_AES_##MODE##_CTX),   \
 608         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 609 static const EVP_CIPHER aes_##keylen##_##mode = { \
 610         nid##_##keylen##_##mode,blocksize, \
 611         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 612         flags|EVP_CIPH_##MODE##_MODE,   \
 613         aes_##mode##_init_key,          \
 614         aes_##mode##_cipher,            \
 615         aes_##mode##_cleanup,           \
 616         sizeof(EVP_AES_##MODE##_CTX),   \
 617         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 618 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 619 { return (OPENSSL_ia32cap_P[1]&AESNI_CAPABLE)? \
 620   &aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
 621
 622 #else
 623
 624 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 625 static const EVP_CIPHER aes_##keylen##_##mode = { \
 626         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 627         flags|EVP_CIPH_##MODE##_MODE,   \
 628         aes_init_key,                   \
 629         aes_##mode##_cipher,            \
 630         NULL,                           \
 631         sizeof(EVP_AES_KEY),            \
 632         NULL,NULL,NULL,NULL }; \
 633 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 634 { return &aes_##keylen##_##mode; }
 635
 636 #define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
 637 static const EVP_CIPHER aes_##keylen##_##mode = { \
 638         nid##_##keylen##_##mode,blocksize, \
 639         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 640         flags|EVP_CIPH_##MODE##_MODE,   \
 641         aes_##mode##_init_key,          \
 642         aes_##mode##_cipher,            \
 643         aes_##mode##_cleanup,           \
 644         sizeof(EVP_AES_##MODE##_CTX),   \
 645         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 646 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 647 { return &aes_##keylen##_##mode; }
 648 #endif
 649
 650 #define BLOCK_CIPHER_generic_pack(nid,keylen,flags)             \
 651         BLOCK_CIPHER_generic(nid,keylen,16,16,cbc,cbc,CBC,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)     \
 652         BLOCK_CIPHER_generic(nid,keylen,16,0,ecb,ecb,ECB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)      \
 653         BLOCK_CIPHER_generic(nid,keylen,1,16,ofb128,ofb,OFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 654         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb128,cfb,CFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 655         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb1,cfb1,CFB,flags)       \
 656         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb8,cfb8,CFB,flags)       \
 657         BLOCK_CIPHER_generic(nid,keylen,1,16,ctr,ctr,CTR,flags)
 658
 659 static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 660                    const unsigned char *iv, int enc)
 661         {
 662         int ret;
 663
 664         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 665             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 666             && !enc)
 667                 ret = AES_set_decrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 668         else
 669                 ret = AES_set_encrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 670
 671         if(ret < 0)
 672                 {
 673                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 674                 return 0;
 675                 }
 676
 677         return 1;
 678         }
 679
 680 static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 681         const unsigned char *in, size_t len)
 682 {
 683         AES_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 684
 685         return 1;
 686 }
 687
 688 static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 689         const unsigned char *in, size_t len)
 690 {
 691         size_t  bl = ctx->cipher->block_size;
 692         size_t  i;
 693
 694         if (len<bl)     return 1;
 695
 696         if (ctx->encrypt) {
 697                 for (i=0,len-=bl;i<=len;i+=bl)
 698                         AES_encrypt(in+i,out+i,ctx->cipher_data);
 699         } else {
 700                 for (i=0,len-=bl;i<=len;i+=bl)
 701                         AES_decrypt(in+i,out+i,ctx->cipher_data);
 702         }
 703
 704         return 1;
 705 }
 706
 707 static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 708         const unsigned char *in,size_t len)
 709 {
 710         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 711                         ctx->iv,&ctx->num,
 712                         (block128_f)AES_encrypt);
 713         return 1;
 714 }
 715
 716 static int aes_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 717         const unsigned char *in,size_t len)
 718 {
 719         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 720                         ctx->iv,&ctx->num,ctx->encrypt,
 721                         (block128_f)AES_encrypt);
 722         return 1;
 723 }
 724
 725 static int aes_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 726         const unsigned char *in,size_t len)
 727 {
 728         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 729                         ctx->iv,&ctx->num,ctx->encrypt,
 730                         (block128_f)AES_encrypt);
 731         return 1;
 732 }
 733
 734 static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 735         const unsigned char *in,size_t len)
 736 {
 737         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 738                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 739                         ctx->iv,&ctx->num,ctx->encrypt,
 740                         (block128_f)AES_encrypt);
 741                 return 1;
 742         }
 743
 744         while (len>=MAXBITCHUNK) {
 745                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 746                         ctx->iv,&ctx->num,ctx->encrypt,
 747                         (block128_f)AES_encrypt);
 748                 len-=MAXBITCHUNK;
 749         }
 750         if (len)
 751                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 752                         ctx->iv,&ctx->num,ctx->encrypt,
 753                         (block128_f)AES_encrypt);
 754
 755         return 1;
 756 }
 757
 758 static int aes_ctr_cipher (EVP_CIPHER_CTX *ctx, unsigned char *out,
 759                 const unsigned char *in, size_t len)
 760 {
 761         unsigned int num;
 762         num = ctx->num;
 763 #ifdef AES_CTR_ASM
 764         void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out,
 765                         size_t blocks, const AES_KEY *key,
 766                         const unsigned char ivec[AES_BLOCK_SIZE]);
 767
 768         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 769                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 770                 ctx->iv,ctx->buf,&num,(ctr128_f)AES_ctr32_encrypt);
 771 #else
 772         CRYPTO_ctr128_encrypt(in,out,len,
 773                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 774                 ctx->iv,ctx->buf,&num,(block128_f)AES_encrypt);
 775 #endif
 776         ctx->num = (size_t)num;
 777         return 1;
 778 }
 779
 780 BLOCK_CIPHER_generic_pack(NID_aes,128,EVP_CIPH_FLAG_FIPS)
 781 BLOCK_CIPHER_generic_pack(NID_aes,192,EVP_CIPH_FLAG_FIPS)
 782 BLOCK_CIPHER_generic_pack(NID_aes,256,EVP_CIPH_FLAG_FIPS)
 783
 784 static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
 785         {
 786         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 787         OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
 788         if (gctx->iv != c->iv)
 789                 OPENSSL_free(gctx->iv);
 790         return 1;
 791         }
 792
 793 /* increment counter (64-bit int) by 1 */
 794 static void ctr64_inc(unsigned char *counter) {
 795         int n=8;
 796         unsigned char  c;
 797
 798         do {
 799                 --n;
 800                 c = counter[n];
 801                 ++c;
 802                 counter[n] = c;
 803                 if (c) return;
 804         } while (n);
 805 }
 806
 807 static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
 808         {
 809         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 810         switch (type)
 811                 {
 812         case EVP_CTRL_INIT:
 813                 gctx->key_set = 0;
 814                 gctx->iv_set = 0;
 815                 gctx->ivlen = c->cipher->iv_len;
 816                 gctx->iv = c->iv;
 817                 gctx->taglen = -1;
 818                 gctx->iv_gen = 0;
 819                 gctx->tls_aad_len = -1;
 820                 return 1;
 821
 822         case EVP_CTRL_GCM_SET_IVLEN:
 823                 if (arg <= 0)
 824                         return 0;
 825 #ifdef OPENSSL_FIPS
 826                 if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
 827                                                  && arg < 12)
 828                         return 0;
 829 #endif
 830                 /* Allocate memory for IV if needed */
 831                 if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen))
 832                         {
 833                         if (gctx->iv != c->iv)
 834                                 OPENSSL_free(gctx->iv);
 835                         gctx->iv = OPENSSL_malloc(arg);
 836                         if (!gctx->iv)
 837                                 return 0;
 838                         }
 839                 gctx->ivlen = arg;
 840                 return 1;
 841
 842         case EVP_CTRL_GCM_SET_TAG:
 843                 if (arg <= 0 || arg > 16 || c->encrypt)
 844                         return 0;
 845                 memcpy(c->buf, ptr, arg);
 846                 gctx->taglen = arg;
 847                 return 1;
 848
 849         case EVP_CTRL_GCM_GET_TAG:
 850                 if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0)
 851                         return 0;
 852                 memcpy(ptr, c->buf, arg);
 853                 return 1;
 854
 855         case EVP_CTRL_GCM_SET_IV_FIXED:
 856                 /* Special case: -1 length restores whole IV */
 857                 if (arg == -1)
 858                         {
 859                         memcpy(gctx->iv, ptr, gctx->ivlen);
 860                         gctx->iv_gen = 1;
 861                         return 1;
 862                         }
 863                 /* Fixed field must be at least 4 bytes and invocation field
 864                  * at least 8.
 865                  */
 866                 if ((arg < 4) || (gctx->ivlen - arg) < 8)
 867                         return 0;
 868                 if (arg)
 869                         memcpy(gctx->iv, ptr, arg);
 870                 if (c->encrypt &&
 871                         RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
 872                         return 0;
 873                 gctx->iv_gen = 1;
 874                 return 1;
 875
 876         case EVP_CTRL_GCM_IV_GEN:
 877                 if (gctx->iv_gen == 0 || gctx->key_set == 0)
 878                         return 0;
 879                 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
 880                 if (arg <= 0 || arg > gctx->ivlen)
 881                         arg = gctx->ivlen;
 882                 memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
 883                 /* Invocation field will be at least 8 bytes in size and
 884                  * so no need to check wrap around or increment more than
 885                  * last 8 bytes.
 886                  */
 887                 ctr64_inc(gctx->iv + gctx->ivlen - 8);
 888                 gctx->iv_set = 1;
 889                 return 1;
 890
 891         case EVP_CTRL_GCM_SET_IV_INV:
 892                 if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt)
 893                         return 0;
 894                 memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
 895                 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
 896                 gctx->iv_set = 1;
 897                 return 1;
 898
 899         case EVP_CTRL_AEAD_TLS1_AAD:
 900                 /* Save the AAD for later use */
 901                 if (arg != 13)
 902                         return 0;
 903                 memcpy(c->buf, ptr, arg);
 904                 gctx->tls_aad_len = arg;
 905                         {
 906                         unsigned int len=c->buf[arg-2]<<8|c->buf[arg-1];
 907                         /* Correct length for explicit IV */
 908                         len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
 909                         /* If decrypting correct for tag too */
 910                         if (!c->encrypt)
 911                                 len -= EVP_GCM_TLS_TAG_LEN;
 912                         c->buf[arg-2] = len>>8;
 913                         c->buf[arg-1] = len & 0xff;
 914                         }
 915                 /* Extra padding: tag appended to record */
 916                 return EVP_GCM_TLS_TAG_LEN;
 917
 918         default:
 919                 return -1;
 920
 921                 }
 922         }
 923
 924 static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 925                         const unsigned char *iv, int enc)
 926         {
 927         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 928         if (!iv && !key)
 929                 return 1;
 930         if (key)
 931                 {
 932                 AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
 933                 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
 934                 /* If we have an iv can set it directly, otherwise use
 935                  * saved IV.
 936                  */
 937                 if (iv == NULL && gctx->iv_set)
 938                         iv = gctx->iv;
 939                 if (iv)
 940                         {
 941                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 942                         gctx->iv_set = 1;
 943                         }
 944                 gctx->key_set = 1;
 945                 }
 946         else
 947                 {
 948                 /* If key set use IV, otherwise copy */
 949                 if (gctx->key_set)
 950                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 951                 else
 952                         memcpy(gctx->iv, iv, gctx->ivlen);
 953                 gctx->iv_set = 1;
 954                 gctx->iv_gen = 0;
 955                 }
 956         return 1;
 957         }
 958
 959 /* Handle TLS GCM packet format. This consists of the last portion of the IV
 960  * followed by the payload and finally the tag. On encrypt generate IV,
 961  * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
 962  * and verify tag.
 963  */
 964
 965 static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 966                 const unsigned char *in, size_t len)
 967         {
 968         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 969         int rv = -1;
 970         /* Encrypt/decrypt must be performed in place */
 971         if (out != in)
 972                 return -1;
 973         /* Set IV from start of buffer or generate IV and write to start
 974          * of buffer.
 975          */
 976         if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ?
 977                                 EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,
 978                                 EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
 979                 goto err;
 980         /* Use saved AAD */
 981         if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))
 982                 goto err;
 983         /* Fix buffer and length to point to payload */
 984         in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 985         out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 986         len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 987         if (ctx->encrypt)
 988                 {
 989                 /* Encrypt payload */
 990                 if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
 991                         goto err;
 992                 out += len;
 993                 /* Finally write tag */
 994                 CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);
 995                 rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 996                 }
 997         else
 998                 {
 999                 /* Decrypt */
1000                 if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
1001                         goto err;
1002                 /* Retrieve tag */
1003                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf,
1004                                         EVP_GCM_TLS_TAG_LEN);
1005                 /* If tag mismatch wipe buffer */
1006                 if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN))
1007                         {
1008                         OPENSSL_cleanse(out, len);
1009                         goto err;
1010                         }
1011                 rv = len;
1012                 }
1013
1014         err:
1015         gctx->iv_set = 0;
1016         gctx->tls_aad_len = -1;
1017         return rv;
1018         }
1019
1020 static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1021                 const unsigned char *in, size_t len)
1022         {
1023         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
1024         /* If not set up, return error */
1025         if (!gctx->key_set)
1026                 return -1;
1027
1028         if (gctx->tls_aad_len >= 0)
1029                 return aes_gcm_tls_cipher(ctx, out, in, len);
1030
1031         if (!gctx->iv_set)
1032                 return -1;
1033         if (!ctx->encrypt && gctx->taglen < 0)
1034                 return -1;
1035         if (in)
1036                 {
1037                 if (out == NULL)
1038                         {
1039                         if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
1040                                 return -1;
1041                         }
1042                 else if (ctx->encrypt)
1043                         {
1044                         if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
1045                                 return -1;
1046                         }
1047                 else
1048                         {
1049                         if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
1050                                 return -1;
1051                         }
1052                 return len;
1053                 }
1054         else
1055                 {
1056                 if (!ctx->encrypt)
1057                         {
1058                         if (CRYPTO_gcm128_finish(&gctx->gcm,
1059                                         ctx->buf, gctx->taglen) != 0)
1060                                 return -1;
1061                         gctx->iv_set = 0;
1062                         return 0;
1063                         }
1064                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
1065                 gctx->taglen = 16;
1066                 /* Don't reuse the IV */
1067                 gctx->iv_set = 0;
1068                 return 0;
1069                 }
1070
1071         }
1072
1073 #define CUSTOM_FLAGS    (EVP_CIPH_FLAG_DEFAULT_ASN1 \
1074                 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
1075                 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
1076
1077 BLOCK_CIPHER_custom(NID_aes,128,1,12,gcm,GCM,
1078                 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
1079 BLOCK_CIPHER_custom(NID_aes,192,1,12,gcm,GCM,
1080                 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
1081 BLOCK_CIPHER_custom(NID_aes,256,1,12,gcm,GCM,
1082                 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
1083
1084 static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1085         {
1086         EVP_AES_XTS_CTX *xctx = c->cipher_data;
1087         if (type != EVP_CTRL_INIT)
1088                 return -1;
1089         /* key1 and key2 are used as an indicator both key and IV are set */
1090         xctx->xts.key1 = NULL;
1091         xctx->xts.key2 = NULL;
1092         return 1;
1093         }
1094
1095 static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
1096                         const unsigned char *iv, int enc)
1097         {
1098         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
1099         if (!iv && !key)
1100                 return 1;
1101
1102         if (key)
1103                 {
1104                 /* key_len is two AES keys */
1105                 if (enc)
1106                         {
1107                         AES_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
1108                         xctx->xts.block1 = (block128_f)AES_encrypt;
1109                         }
1110                 else
1111                         {
1112                         AES_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
1113                         xctx->xts.block1 = (block128_f)AES_decrypt;
1114                         }
1115
1116                 AES_set_encrypt_key(key + ctx->key_len/2,
1117                                                 ctx->key_len * 4, &xctx->ks2);
1118                 xctx->xts.block2 = (block128_f)AES_encrypt;
1119
1120                 xctx->xts.key1 = &xctx->ks1;
1121                 }
1122
1123         if (iv)
1124                 {
1125                 xctx->xts.key2 = &xctx->ks2;
1126                 memcpy(ctx->iv, iv, 16);
1127                 }
1128
1129         return 1;
1130         }
1131
1132 static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1133                 const unsigned char *in, size_t len)
1134         {
1135         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
1136         if (!xctx->xts.key1 || !xctx->xts.key2)
1137                 return -1;
1138         if (!out || !in)
1139                 return -1;
1140 #ifdef OPENSSL_FIPS
1141         /* Requirement of SP800-38E */
1142         if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
1143                         (len > (1L<<20)*16))
1144                 {
1145                 EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);
1146                 return -1;
1147                 }
1148 #endif
1149         if (CRYPTO_xts128_encrypt(&xctx->xts, ctx->iv, in, out, len,
1150                                                                 ctx->encrypt))
1151                 return -1;
1152         return len;
1153         }
1154
1155 #define aes_xts_cleanup NULL
1156
1157 BLOCK_CIPHER_custom(NID_aes,128,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1158 BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1159
1160 static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1161         {
1162         EVP_AES_CCM_CTX *cctx = c->cipher_data;
1163         switch (type)
1164                 {
1165         case EVP_CTRL_INIT:
1166                 cctx->key_set = 0;
1167                 cctx->iv_set = 0;
1168                 cctx->L = 8;
1169                 cctx->M = 12;
1170                 cctx->tag_set = 0;
1171                 cctx->len_set = 0;
1172                 return 1;
1173
1174         case EVP_CTRL_CCM_SET_IVLEN:
1175                 arg = 15 - arg;
1176         case EVP_CTRL_CCM_SET_L:
1177                 if (arg < 2 || arg > 8)
1178                         return 0;
1179                 cctx->L = arg;
1180                 return 1;
1181
1182         case EVP_CTRL_CCM_SET_TAG:
1183                 if ((arg & 1) || arg < 4 || arg > 16)
1184                         return 0;
1185                 if ((c->encrypt && ptr) || (!c->encrypt && !ptr))
1186                         return 0;
1187                 if (ptr)
1188                         {
1189                         cctx->tag_set = 1;
1190                         memcpy(c->buf, ptr, arg);
1191                         }
1192                 cctx->M = arg;
1193                 return 1;
1194
1195         case EVP_CTRL_CCM_GET_TAG:
1196                 if (!c->encrypt || !cctx->tag_set)
1197                         return 0;
1198                 if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
1199                         return 0;
1200                 cctx->tag_set = 0;
1201                 cctx->iv_set = 0;
1202                 cctx->len_set = 0;
1203                 return 1;
1204
1205         default:
1206                 return -1;
1207
1208                 }
1209         }
1210
1211 static int aes_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
1212                         const unsigned char *iv, int enc)
1213         {
1214         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
1215         if (!iv && !key)
1216                 return 1;
1217         if (key)
1218                 {
1219                 AES_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
1220                 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
1221                                         &cctx->ks, (block128_f)AES_encrypt);
1222                 cctx->key_set = 1;
1223                 }
1224         if (iv)
1225                 {
1226                 memcpy(ctx->iv, iv, 15 - cctx->L);
1227                 cctx->iv_set = 1;
1228                 }
1229         return 1;
1230         }
1231
1232 static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1233                 const unsigned char *in, size_t len)
1234         {
1235         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
1236         CCM128_CONTEXT *ccm = &cctx->ccm;
1237         /* If not set up, return error */
1238         if (!cctx->iv_set && !cctx->key_set)
1239                 return -1;
1240         if (!ctx->encrypt && !cctx->tag_set)
1241                 return -1;
1242         if (!out)
1243                 {
1244                 if (!in)
1245                         {
1246                         if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))
1247                                 return -1;
1248                         cctx->len_set = 1;
1249                         return len;
1250                         }
1251                 /* If have AAD need message length */
1252                 if (!cctx->len_set && len)
1253                         return -1;
1254                 CRYPTO_ccm128_aad(ccm, in, len);
1255                 return len;
1256                 }
1257         /* EVP_*Final() doesn't return any data */
1258         if (!in)
1259                 return 0;
1260         /* If not set length yet do it */
1261         if (!cctx->len_set)
1262                 {
1263                 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
1264                         return -1;
1265                 cctx->len_set = 1;
1266                 }
1267         if (ctx->encrypt)
1268                 {
1269                 if (CRYPTO_ccm128_encrypt(ccm, in, out, len))
1270                         return -1;
1271                 cctx->tag_set = 1;
1272                 return len;
1273                 }
1274         else
1275                 {
1276                 int rv = -1;
1277                 if (!CRYPTO_ccm128_decrypt(ccm, in, out, len))
1278                         {
1279                         unsigned char tag[16];
1280                         if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
1281                                 {
1282                                 if (!memcmp(tag, ctx->buf, cctx->M))
1283                                         rv = len;
1284                                 }
1285                         }
1286                 if (rv == -1)
1287                         OPENSSL_cleanse(out, len);
1288                 cctx->iv_set = 0;
1289                 cctx->tag_set = 0;
1290                 cctx->len_set = 0;
1291                 return rv;
1292                 }
1293
1294         }
1295
1296 #define aes_ccm_cleanup NULL
1297
1298 BLOCK_CIPHER_custom(NID_aes,128,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1299 BLOCK_CIPHER_custom(NID_aes,192,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1300 BLOCK_CIPHER_custom(NID_aes,256,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1301
1302 #endif
1303 #endif