crypto/evp/e_aes.c

   1 /* ====================================================================
   2  * Copyright (c) 2001-2011 The OpenSSL Project.  All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  *
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  *
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in
  13  *    the documentation and/or other materials provided with the
  14  *    distribution.
  15  *
  16  * 3. All advertising materials mentioning features or use of this
  17  *    software must display the following acknowledgment:
  18  *    "This product includes software developed by the OpenSSL Project
  19  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  20  *
  21  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  22  *    endorse or promote products derived from this software without
  23  *    prior written permission. For written permission, please contact
  24  *    openssl-core@openssl.org.
  25  *
  26  * 5. Products derived from this software may not be called "OpenSSL"
  27  *    nor may "OpenSSL" appear in their names without prior written
  28  *    permission of the OpenSSL Project.
  29  *
  30  * 6. Redistributions of any form whatsoever must retain the following
  31  *    acknowledgment:
  32  *    "This product includes software developed by the OpenSSL Project
  33  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  36  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  38  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  39  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  40  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  41  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  42  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  44  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  45  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  46  * OF THE POSSIBILITY OF SUCH DAMAGE.
  47  * ====================================================================
  48  *
  49  */
  50
  51 #include <openssl/opensslconf.h>
  52 #ifndef OPENSSL_NO_AES
  53 #include <openssl/evp.h>
  54 #include <openssl/err.h>
  55 #include <string.h>
  56 #include <assert.h>
  57 #include <openssl/aes.h>
  58 #include <openssl/rand.h>
  59 #include "modes_lcl.h"
  60 #include "evp_locl.h"
  61
  62 #ifndef OPENSSL_FIPS
  63
  64 typedef struct
  65         {
  66         AES_KEY ks;
  67         } EVP_AES_KEY;
  68
  69 typedef struct
  70         {
  71         AES_KEY ks;             /* AES key schedule to use */
  72         int key_set;            /* Set if key initialised */
  73         int iv_set;             /* Set if an iv is set */
  74         GCM128_CONTEXT gcm;
  75         unsigned char *iv;      /* Temporary IV store */
  76         int ivlen;              /* IV length */
  77         int taglen;
  78         int iv_gen;             /* It is OK to generate IVs */
  79         int tls_aad_len;        /* TLS AAD length */
  80         } EVP_AES_GCM_CTX;
  81
  82 #define MAXBITCHUNK     ((size_t)1<<(sizeof(size_t)*8-4))
  83
  84 #if     defined(AES_ASM) && !defined(I386_ONLY) &&      (  \
  85         ((defined(__i386)       || defined(__i386__)    || \
  86           defined(_M_IX86)) && defined(OPENSSL_IA32_SSE2))|| \
  87         defined(__x86_64)       || defined(__x86_64__)  || \
  88         defined(_M_AMD64)       || defined(_M_X64)      || \
  89         defined(__INTEL__)                              )
  90 /*
  91  * AES-NI section
  92  */
  93 extern unsigned int OPENSSL_ia32cap_P[2];
  94 #define AESNI_CAPABLE   (1<<(57-32))
  95
  96 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
  97                         AES_KEY *key);
  98 int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
  99                         AES_KEY *key);
 100
 101 void aesni_encrypt(const unsigned char *in, unsigned char *out,
 102                         const AES_KEY *key);
 103 void aesni_decrypt(const unsigned char *in, unsigned char *out,
 104                         const AES_KEY *key);
 105
 106 void aesni_ecb_encrypt(const unsigned char *in,
 107                         unsigned char *out,
 108                         size_t length,
 109                         const AES_KEY *key,
 110                         int enc);
 111 void aesni_cbc_encrypt(const unsigned char *in,
 112                         unsigned char *out,
 113                         size_t length,
 114                         const AES_KEY *key,
 115                         unsigned char *ivec, int enc);
 116
 117 void aesni_ctr32_encrypt_blocks(const unsigned char *in,
 118                         unsigned char *out,
 119                         size_t blocks,
 120                         const void *key,
 121                         const unsigned char *ivec);
 122
 123 static int aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 124                    const unsigned char *iv, int enc)
 125         {
 126         int ret;
 127
 128         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 129             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 130             && !enc)
 131                 ret = aesni_set_decrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 132         else
 133                 ret = aesni_set_encrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 134
 135         if(ret < 0)
 136                 {
 137                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 138                 return 0;
 139                 }
 140
 141         return 1;
 142         }
 143
 144 static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 145         const unsigned char *in, size_t len)
 146 {
 147         aesni_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 148
 149         return 1;
 150 }
 151
 152 static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 153         const unsigned char *in, size_t len)
 154 {
 155         size_t  bl = ctx->cipher->block_size;
 156
 157         if (len<bl)     return 1;
 158
 159         aesni_ecb_encrypt(in,out,len,ctx->cipher_data,ctx->encrypt);
 160
 161         return 1;
 162 }
 163
 164 static int aesni_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 165         const unsigned char *in,size_t len)
 166 {
 167         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 168                         ctx->iv,&ctx->num,
 169                         (block128_f)aesni_encrypt);
 170         return 1;
 171 }
 172
 173 static int aesni_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 174         const unsigned char *in,size_t len)
 175 {
 176         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 177                         ctx->iv,&ctx->num,ctx->encrypt,
 178                         (block128_f)aesni_encrypt);
 179         return 1;
 180 }
 181
 182 static int aesni_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 183         const unsigned char *in,size_t len)
 184 {
 185         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 186                         ctx->iv,&ctx->num,ctx->encrypt,
 187                         (block128_f)aesni_encrypt);
 188         return 1;
 189 }
 190
 191 static int aesni_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 192         const unsigned char *in,size_t len)
 193 {
 194         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 195                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 196                         ctx->iv,&ctx->num,ctx->encrypt,
 197                         (block128_f)aesni_encrypt);
 198                 return 1;
 199         }
 200
 201         while (len>=MAXBITCHUNK) {
 202                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 203                         ctx->iv,&ctx->num,ctx->encrypt,
 204                         (block128_f)aesni_encrypt);
 205                 len-=MAXBITCHUNK;
 206         }
 207         if (len)
 208                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 209                         ctx->iv,&ctx->num,ctx->encrypt,
 210                         (block128_f)aesni_encrypt);
 211
 212         return 1;
 213 }
 214
 215 static int aesni_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 216                 const unsigned char *in, size_t len)
 217 {
 218         unsigned int num;
 219         num = ctx->num;
 220
 221         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 222                         ctx->cipher_data,ctx->iv,ctx->buf,&num,
 223                         (ctr128_f)aesni_ctr32_encrypt_blocks);
 224
 225         ctx->num = (size_t)num;
 226         return 1;
 227 }
 228
 229 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 230 static const EVP_CIPHER aesni_##keylen##_##mode = { \
 231         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 232         flags|EVP_CIPH_##MODE##_MODE,   \
 233         aesni_init_key,                 \
 234         aesni_##mode##_cipher,          \
 235         NULL,                           \
 236         sizeof(EVP_AES_KEY),            \
 237         NULL,NULL,NULL,NULL }; \
 238 static const EVP_CIPHER aes_##keylen##_##mode = { \
 239         nid##_##keylen##_##nmode,blocksize,     \
 240         keylen/8,ivlen, \
 241         flags|EVP_CIPH_##MODE##_MODE,   \
 242         aes_init_key,                   \
 243         aes_##mode##_cipher,            \
 244         NULL,                           \
 245         sizeof(EVP_AES_KEY),            \
 246         NULL,NULL,NULL,NULL }; \
 247 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 248 { return (OPENSSL_ia32cap_P[1]&AESNI_CAPABLE)? \
 249   &aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
 250
 251 #else
 252
 253 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 254 static const EVP_CIPHER aes_##keylen##_##mode = { \
 255         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 256         flags|EVP_CIPH_##MODE##_MODE,   \
 257         aes_init_key,                   \
 258         aes_##mode##_cipher,            \
 259         NULL,                           \
 260         sizeof(EVP_AES_KEY),            \
 261         NULL,NULL,NULL,NULL }; \
 262 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 263 { return &aes_##keylen##_##mode; }
 264 #endif
 265
 266 #define BLOCK_CIPHER_generic_pack(nid,keylen,flags)             \
 267         BLOCK_CIPHER_generic(nid,keylen,16,16,cbc,cbc,CBC,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)     \
 268         BLOCK_CIPHER_generic(nid,keylen,16,0,ecb,ecb,ECB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)      \
 269         BLOCK_CIPHER_generic(nid,keylen,1,16,ofb128,ofb,OFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 270         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb128,cfb,CFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 271         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb1,cfb1,CFB,flags)       \
 272         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb8,cfb8,CFB,flags)       \
 273         BLOCK_CIPHER_generic(nid,keylen,1,16,ctr,ctr,CTR,flags)
 274
 275 static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 276                    const unsigned char *iv, int enc)
 277         {
 278         int ret;
 279
 280         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 281             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 282             && !enc)
 283                 ret = AES_set_decrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 284         else
 285                 ret = AES_set_encrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 286
 287         if(ret < 0)
 288                 {
 289                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 290                 return 0;
 291                 }
 292
 293         return 1;
 294         }
 295
 296 static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 297         const unsigned char *in, size_t len)
 298 {
 299         AES_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 300
 301         return 1;
 302 }
 303
 304 static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 305         const unsigned char *in, size_t len)
 306 {
 307         size_t  bl = ctx->cipher->block_size;
 308         size_t  i;
 309
 310         if (len<bl)     return 1;
 311
 312         if (ctx->encrypt) {
 313                 for (i=0,len-=bl;i<=len;i+=bl)
 314                         AES_encrypt(in+i,out+i,ctx->cipher_data);
 315         } else {
 316                 for (i=0,len-=bl;i<=len;i+=bl)
 317                         AES_decrypt(in+i,out+i,ctx->cipher_data);
 318         }
 319
 320         return 1;
 321 }
 322
 323 static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 324         const unsigned char *in,size_t len)
 325 {
 326         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 327                         ctx->iv,&ctx->num,
 328                         (block128_f)AES_encrypt);
 329         return 1;
 330 }
 331
 332 static int aes_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 333         const unsigned char *in,size_t len)
 334 {
 335         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 336                         ctx->iv,&ctx->num,ctx->encrypt,
 337                         (block128_f)AES_encrypt);
 338         return 1;
 339 }
 340
 341 static int aes_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 342         const unsigned char *in,size_t len)
 343 {
 344         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 345                         ctx->iv,&ctx->num,ctx->encrypt,
 346                         (block128_f)AES_encrypt);
 347         return 1;
 348 }
 349
 350 static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 351         const unsigned char *in,size_t len)
 352 {
 353         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 354                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 355                         ctx->iv,&ctx->num,ctx->encrypt,
 356                         (block128_f)AES_encrypt);
 357                 return 1;
 358         }
 359
 360         while (len>=MAXBITCHUNK) {
 361                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 362                         ctx->iv,&ctx->num,ctx->encrypt,
 363                         (block128_f)AES_encrypt);
 364                 len-=MAXBITCHUNK;
 365         }
 366         if (len)
 367                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 368                         ctx->iv,&ctx->num,ctx->encrypt,
 369                         (block128_f)AES_encrypt);
 370
 371         return 1;
 372 }
 373
 374 static int aes_ctr_cipher (EVP_CIPHER_CTX *ctx, unsigned char *out,
 375                 const unsigned char *in, size_t len)
 376 {
 377         unsigned int num;
 378         num = ctx->num;
 379 #ifdef AES_CTR_ASM
 380         void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out,
 381                         size_t blocks, const AES_KEY *key,
 382                         const unsigned char ivec[AES_BLOCK_SIZE]);
 383
 384         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 385                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 386                 ctx->iv,ctx->buf,&num,(ctr128_f)AES_ctr32_encrypt);
 387 #else
 388         CRYPTO_ctr128_encrypt(in,out,len,
 389                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 390                 ctx->iv,ctx->buf,&num,(block128_f)AES_encrypt);
 391 #endif
 392         ctx->num = (size_t)num;
 393         return 1;
 394 }
 395
 396 BLOCK_CIPHER_generic_pack(NID_aes,128,0)
 397 BLOCK_CIPHER_generic_pack(NID_aes,192,0)
 398 BLOCK_CIPHER_generic_pack(NID_aes,256,0)
 399
 400 static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
 401         {
 402         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 403         OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
 404         if (gctx->iv != c->iv)
 405                 OPENSSL_free(gctx->iv);
 406         return 1;
 407         }
 408
 409 /* increment counter (64-bit int) by 1 */
 410 static void ctr64_inc(unsigned char *counter) {
 411         int n=8;
 412         unsigned char  c;
 413
 414         do {
 415                 --n;
 416                 c = counter[n];
 417                 ++c;
 418                 counter[n] = c;
 419                 if (c) return;
 420         } while (n);
 421 }
 422
 423 static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
 424         {
 425         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 426         switch (type)
 427                 {
 428         case EVP_CTRL_INIT:
 429                 gctx->key_set = 0;
 430                 gctx->iv_set = 0;
 431                 gctx->ivlen = c->cipher->iv_len;
 432                 gctx->iv = c->iv;
 433                 gctx->taglen = -1;
 434                 gctx->iv_gen = 0;
 435                 gctx->tls_aad_len = -1;
 436                 return 1;
 437
 438         case EVP_CTRL_GCM_SET_IVLEN:
 439                 if (arg <= 0)
 440                         return 0;
 441 #ifdef OPENSSL_FIPS
 442                 if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
 443                                                  && arg < 12)
 444                         return 0;
 445 #endif
 446                 /* Allocate memory for IV if needed */
 447                 if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen))
 448                         {
 449                         if (gctx->iv != c->iv)
 450                                 OPENSSL_free(gctx->iv);
 451                         gctx->iv = OPENSSL_malloc(arg);
 452                         if (!gctx->iv)
 453                                 return 0;
 454                         }
 455                 gctx->ivlen = arg;
 456                 return 1;
 457
 458         case EVP_CTRL_GCM_SET_TAG:
 459                 if (arg <= 0 || arg > 16 || c->encrypt)
 460                         return 0;
 461                 memcpy(c->buf, ptr, arg);
 462                 gctx->taglen = arg;
 463                 return 1;
 464
 465         case EVP_CTRL_GCM_GET_TAG:
 466                 if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0)
 467                         return 0;
 468                 memcpy(ptr, c->buf, arg);
 469                 return 1;
 470
 471         case EVP_CTRL_GCM_SET_IV_FIXED:
 472                 /* Special case: -1 length restores whole IV */
 473                 if (arg == -1)
 474                         {
 475                         memcpy(gctx->iv, ptr, gctx->ivlen);
 476                         gctx->iv_gen = 1;
 477                         return 1;
 478                         }
 479                 /* Fixed field must be at least 4 bytes and invocation field
 480                  * at least 8.
 481                  */
 482                 if ((arg < 4) || (gctx->ivlen - arg) < 8)
 483                         return 0;
 484                 if (arg)
 485                         memcpy(gctx->iv, ptr, arg);
 486                 if (c->encrypt &&
 487                         RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
 488                         return 0;
 489                 gctx->iv_gen = 1;
 490                 return 1;
 491
 492         case EVP_CTRL_GCM_IV_GEN:
 493                 if (gctx->iv_gen == 0 || gctx->key_set == 0)
 494                         return 0;
 495                 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
 496                 if (arg <= 0 || arg > gctx->ivlen)
 497                         arg = gctx->ivlen;
 498                 memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
 499                 /* Invocation field will be at least 8 bytes in size and
 500                  * so no need to check wrap around or increment more than
 501                  * last 8 bytes.
 502                  */
 503                 ctr64_inc(gctx->iv + gctx->ivlen - 8);
 504                 gctx->iv_set = 1;
 505                 return 1;
 506
 507         case EVP_CTRL_GCM_SET_IV_INV:
 508                 if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt)
 509                         return 0;
 510                 memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
 511                 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
 512                 gctx->iv_set = 1;
 513                 return 1;
 514
 515         case EVP_CTRL_AEAD_TLS1_AAD:
 516                 /* Save the AAD for later use */
 517                 if (arg != 13)
 518                         return 0;
 519                 memcpy(c->buf, ptr, arg);
 520                 gctx->tls_aad_len = arg;
 521                         {
 522                         unsigned int len=c->buf[arg-2]<<8|c->buf[arg-1];
 523                         /* Correct length for explicit IV */
 524                         len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
 525                         /* If decrypting correct for tag too */
 526                         if (!c->encrypt)
 527                                 len -= EVP_GCM_TLS_TAG_LEN;
 528                         c->buf[arg-2] = len>>8;
 529                         c->buf[arg-1] = len & 0xff;
 530                         }
 531                 /* Extra padding: tag appended to record */
 532                 return EVP_GCM_TLS_TAG_LEN;
 533
 534         default:
 535                 return -1;
 536
 537                 }
 538         }
 539
 540 static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 541                         const unsigned char *iv, int enc)
 542         {
 543         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 544         if (!iv && !key)
 545                 return 1;
 546         if (key)
 547                 {
 548                 AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
 549                 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
 550                 /* If we have an iv can set it directly, otherwise use
 551                  * saved IV.
 552                  */
 553                 if (iv == NULL && gctx->iv_set)
 554                         iv = gctx->iv;
 555                 if (iv)
 556                         {
 557                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 558                         gctx->iv_set = 1;
 559                         }
 560                 gctx->key_set = 1;
 561                 }
 562         else
 563                 {
 564                 /* If key set use IV, otherwise copy */
 565                 if (gctx->key_set)
 566                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 567                 else
 568                         memcpy(gctx->iv, iv, gctx->ivlen);
 569                 gctx->iv_set = 1;
 570                 gctx->iv_gen = 0;
 571                 }
 572         return 1;
 573         }
 574
 575 /* Handle TLS GCM packet format. This consists of the last portion of the IV
 576  * followed by the payload and finally the tag. On encrypt generate IV,
 577  * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
 578  * and verify tag.
 579  */
 580
 581 static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 582                 const unsigned char *in, size_t len)
 583         {
 584         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 585         int rv = -1;
 586         /* Encrypt/decrypt must be performed in place */
 587         if (out != in)
 588                 return -1;
 589         /* Set IV from start of buffer or generate IV and write to start
 590          * of buffer.
 591          */
 592         if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ?
 593                                 EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,
 594                                 EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
 595                 goto err;
 596         /* Use saved AAD */
 597         if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))
 598                 goto err;
 599         /* Fix buffer and length to point to payload */
 600         in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 601         out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 602         len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 603         if (ctx->encrypt)
 604                 {
 605                 /* Encrypt payload */
 606                 if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
 607                         goto err;
 608                 out += len;
 609                 /* Finally write tag */
 610                 CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);
 611                 rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 612                 }
 613         else
 614                 {
 615                 /* Decrypt */
 616                 if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
 617                         goto err;
 618                 /* Retrieve tag */
 619                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf,
 620                                         EVP_GCM_TLS_TAG_LEN);
 621                 /* If tag mismatch wipe buffer */
 622                 if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN))
 623                         {
 624                         OPENSSL_cleanse(out, len);
 625                         goto err;
 626                         }
 627                 rv = len;
 628                 }
 629
 630         err:
 631         gctx->iv_set = 0;
 632         gctx->tls_aad_len = -1;
 633         return rv;
 634         }
 635
 636 static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 637                 const unsigned char *in, size_t len)
 638         {
 639         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 640         /* If not set up, return error */
 641         if (!gctx->key_set)
 642                 return -1;
 643
 644         if (gctx->tls_aad_len >= 0)
 645                 return aes_gcm_tls_cipher(ctx, out, in, len);
 646
 647         if (!gctx->iv_set)
 648                 return -1;
 649         if (!ctx->encrypt && gctx->taglen < 0)
 650                 return -1;
 651         if (in)
 652                 {
 653                 if (out == NULL)
 654                         {
 655                         if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
 656                                 return -1;
 657                         }
 658                 else if (ctx->encrypt)
 659                         {
 660                         if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
 661                                 return -1;
 662                         }
 663                 else
 664                         {
 665                         if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
 666                                 return -1;
 667                         }
 668                 return len;
 669                 }
 670         else
 671                 {
 672                 if (!ctx->encrypt)
 673                         {
 674                         if (CRYPTO_gcm128_finish(&gctx->gcm,
 675                                         ctx->buf, gctx->taglen) != 0)
 676                                 return -1;
 677                         gctx->iv_set = 0;
 678                         return 0;
 679                         }
 680                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
 681                 gctx->taglen = 16;
 682                 /* Don't reuse the IV */
 683                 gctx->iv_set = 0;
 684                 return 0;
 685                 }
 686
 687         }
 688
 689 #define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
 690 static const EVP_CIPHER aes_##keylen##_##mode = { \
 691         nid##_##keylen##_##mode,blocksize, \
 692         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 693         flags|EVP_CIPH_##MODE##_MODE,   \
 694         aes_##mode##_init_key,          \
 695         aes_##mode##_cipher,            \
 696         aes_##mode##_cleanup,           \
 697         sizeof(EVP_AES_##MODE##_CTX),   \
 698         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 699 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 700 { return &aes_##keylen##_##mode; }
 701
 702 #define CUSTOM_FLAGS    (EVP_CIPH_FLAG_DEFAULT_ASN1 \
 703                 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
 704                 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
 705
 706 BLOCK_CIPHER_custom(NID_aes,128,1,12,gcm,GCM,
 707                 EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
 708 BLOCK_CIPHER_custom(NID_aes,192,1,12,gcm,GCM,
 709                 EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
 710 BLOCK_CIPHER_custom(NID_aes,256,1,12,gcm,GCM,
 711                 EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
 712
 713 #endif
 714 #endif