X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=crypto%2Fevp%2Fe_aes.c;h=2d33837478417a2464098fc620e1e6279ecfed6e;hp=51a51a7bbe03e251b87f18e216204e9372e6cb5f;hb=62dc7ed67c00a81801c7a3a7d37e54b2b7b04106;hpb=591ccf586d048e2ca04dba82a439dbab8aded695 diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c index 51a51a7bbe..2d33837478 100644 --- a/crypto/evp/e_aes.c +++ b/crypto/evp/e_aes.c @@ -48,107 +48,736 @@ * */ +#define OPENSSL_FIPSAPI + +#include #ifndef OPENSSL_NO_AES #include #include #include #include -#include +#include +#include "evp_locl.h" +#include "modes_lcl.h" +#include -static int aes_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, +static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc); -static int aes_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, unsigned int inl); -static int aes_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, unsigned int inl); - -#define IMPLEMENT_AES_CIPHER(name, ciph_func, keylen, ivlen, mode) \ -static const EVP_CIPHER name##_cipher_st = \ - { \ - NID_##name, \ - 16,keylen,ivlen, \ - mode, \ - aes_init, \ - ciph_func, \ - NULL, \ - sizeof(RIJNDAEL_KEY), \ - EVP_CIPHER_set_asn1_iv, \ - EVP_CIPHER_get_asn1_iv, \ - NULL, \ - NULL \ - }; \ -const EVP_CIPHER * EVP_##name(void) \ - { \ - return &name##_cipher_st; \ - } -IMPLEMENT_AES_CIPHER(aes_128_ecb, aes_ecb, 16, 0, EVP_CIPH_ECB_MODE) -IMPLEMENT_AES_CIPHER(aes_192_ecb, aes_ecb, 24, 0, EVP_CIPH_ECB_MODE) -IMPLEMENT_AES_CIPHER(aes_256_ecb, aes_ecb, 32, 0, EVP_CIPH_ECB_MODE) +typedef struct + { + AES_KEY ks; + } EVP_AES_KEY; + +#define data(ctx) EVP_C_DATA(EVP_AES_KEY,ctx) + +IMPLEMENT_BLOCK_CIPHER(aes_128, ks, AES, EVP_AES_KEY, + NID_aes_128, 16, 16, 16, 128, + EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1, + aes_init_key, NULL, NULL, NULL, NULL) +IMPLEMENT_BLOCK_CIPHER(aes_192, ks, AES, EVP_AES_KEY, + NID_aes_192, 16, 24, 16, 128, + EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1, + aes_init_key, NULL, NULL, NULL, NULL) +IMPLEMENT_BLOCK_CIPHER(aes_256, ks, AES, EVP_AES_KEY, + NID_aes_256, 16, 32, 16, 128, + EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1, + aes_init_key, NULL, NULL, NULL, NULL) + +#define IMPLEMENT_AES_CFBR(ksize,cbits) IMPLEMENT_CFBR(aes,AES,EVP_AES_KEY,ks,ksize,cbits,16,EVP_CIPH_FLAG_FIPS) + +IMPLEMENT_AES_CFBR(128,1) +IMPLEMENT_AES_CFBR(192,1) +IMPLEMENT_AES_CFBR(256,1) + +IMPLEMENT_AES_CFBR(128,8) +IMPLEMENT_AES_CFBR(192,8) +IMPLEMENT_AES_CFBR(256,8) + +static int aes_counter (EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t len) +{ + unsigned int num; + num = ctx->num; +#ifdef AES_CTR_ASM + void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out, + size_t blocks, const AES_KEY *key, + const unsigned char ivec[AES_BLOCK_SIZE]); + + CRYPTO_ctr128_encrypt_ctr32(in,out,len, + &((EVP_AES_KEY *)ctx->cipher_data)->ks, + ctx->iv,ctx->buf,&num,(ctr128_f)AES_ctr32_encrypt); +#else + CRYPTO_ctr128_encrypt(in,out,len, + &((EVP_AES_KEY *)ctx->cipher_data)->ks, + ctx->iv,ctx->buf,&num,(block128_f)AES_encrypt); +#endif + ctx->num = (size_t)num; + return 1; +} + +static const EVP_CIPHER aes_128_ctr_cipher= + { + NID_aes_128_ctr,1,16,16, + EVP_CIPH_CTR_MODE|EVP_CIPH_FLAG_FIPS, + aes_init_key, + aes_counter, + NULL, + sizeof(EVP_AES_KEY), + NULL, + NULL, + NULL, + NULL + }; + +const EVP_CIPHER *EVP_aes_128_ctr (void) +{ return &aes_128_ctr_cipher; } + +static const EVP_CIPHER aes_192_ctr_cipher= + { + NID_aes_192_ctr,1,24,16, + EVP_CIPH_CTR_MODE|EVP_CIPH_FLAG_FIPS, + aes_init_key, + aes_counter, + NULL, + sizeof(EVP_AES_KEY), + NULL, + NULL, + NULL, + NULL + }; + +const EVP_CIPHER *EVP_aes_192_ctr (void) +{ return &aes_192_ctr_cipher; } + +static const EVP_CIPHER aes_256_ctr_cipher= + { + NID_aes_256_ctr,1,32,16, + EVP_CIPH_CTR_MODE|EVP_CIPH_FLAG_FIPS, + aes_init_key, + aes_counter, + NULL, + sizeof(EVP_AES_KEY), + NULL, + NULL, + NULL, + NULL + }; -IMPLEMENT_AES_CIPHER(aes_128_cbc, aes_cbc, 16, 16, EVP_CIPH_CBC_MODE) -IMPLEMENT_AES_CIPHER(aes_192_cbc, aes_cbc, 24, 16, EVP_CIPH_CBC_MODE) -IMPLEMENT_AES_CIPHER(aes_256_cbc, aes_cbc, 32, 16, EVP_CIPH_CBC_MODE) +const EVP_CIPHER *EVP_aes_256_ctr (void) +{ return &aes_256_ctr_cipher; } -static int aes_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, +static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc) { - RIJNDAEL_KEY *k=ctx->cipher_data; - if (enc) - k->rounds = rijndaelKeySetupEnc(k->rd_key, key, ctx->key_len * 8); + int ret; + + if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE + || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE) + && !enc) + ret=AES_set_decrypt_key(key, ctx->key_len * 8, ctx->cipher_data); else - k->rounds = rijndaelKeySetupDec(k->rd_key, key, ctx->key_len * 8); + ret=AES_set_encrypt_key(key, ctx->key_len * 8, ctx->cipher_data); + + if(ret < 0) + { + EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED); + return 0; + } return 1; } -static int aes_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, unsigned int inl) +typedef struct + { + /* AES key schedule to use */ + AES_KEY ks; + /* Set if key initialised */ + int key_set; + /* Set if an iv is set */ + int iv_set; + GCM128_CONTEXT gcm; + /* Temporary IV store */ + unsigned char *iv; + /* IV length */ + int ivlen; + int taglen; + /* It is OK to generate IVs */ + int iv_gen; + } EVP_AES_GCM_CTX; + +static int aes_gcm_cleanup(EVP_CIPHER_CTX *c) { - RIJNDAEL_KEY *k=ctx->cipher_data; - while(inl > 0) + EVP_AES_GCM_CTX *gctx = c->cipher_data; + OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm)); + if (gctx->iv != c->iv) + OPENSSL_free(gctx->iv); + return 1; + } + +/* increment counter (64-bit int) by 1 */ +static void ctr64_inc(unsigned char *counter) { + int n=8; + unsigned char c; + + do { + --n; + c = counter[n]; + ++c; + counter[n] = c; + if (c) return; + } while (n); +} + +static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) + { + EVP_AES_GCM_CTX *gctx = c->cipher_data; + switch (type) { - if(ctx->encrypt) - rijndaelEncrypt(k->rd_key,k->rounds, in, out); + case EVP_CTRL_INIT: + gctx->key_set = 0; + gctx->iv_set = 0; + gctx->ivlen = c->cipher->iv_len; + gctx->iv = c->iv; + gctx->taglen = -1; + gctx->iv_gen = 0; + return 1; + + case EVP_CTRL_GCM_SET_IVLEN: + if (arg <= 0) + return 0; +#ifdef OPENSSL_FIPS + if (FIPS_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) + && arg < 12) + return 0; +#endif + /* Allocate memory for IV if needed */ + if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen)) + { + if (gctx->iv != c->iv) + OPENSSL_free(gctx->iv); + gctx->iv = OPENSSL_malloc(arg); + if (!gctx->iv) + return 0; + } + gctx->ivlen = arg; + return 1; + + case EVP_CTRL_GCM_SET_TAG: + if (arg <= 0 || arg > 16 || c->encrypt) + return 0; + memcpy(c->buf, ptr, arg); + gctx->taglen = arg; + return 1; + + case EVP_CTRL_GCM_GET_TAG: + if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0) + return 0; + memcpy(ptr, c->buf, arg); + return 1; + + case EVP_CTRL_GCM_SET_IV_FIXED: + /* Special case: -1 length restores whole IV */ + if (arg == -1) + { + memcpy(gctx->iv, ptr, gctx->ivlen); + gctx->iv_gen = 1; + return 1; + } + /* Fixed field must be at least 4 bytes and invocation field + * at least 8. + */ + if ((arg < 4) || (gctx->ivlen - arg) < 8) + return 0; + if (arg) + memcpy(gctx->iv, ptr, arg); + if (RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0) + return 0; + gctx->iv_gen = 1; + return 1; + + case EVP_CTRL_GCM_IV_GEN: + if (gctx->iv_gen == 0 || gctx->key_set == 0) + return 0; + CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen); + memcpy(ptr, gctx->iv, gctx->ivlen); + /* Invocation field will be at least 8 bytes in size and + * so no need to check wrap around or increment more than + * last 8 bytes. + */ + ctr64_inc(gctx->iv + gctx->ivlen - 8); + gctx->iv_set = 1; + return 1; + + default: + return -1; + + } + } + +static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, + const unsigned char *iv, int enc) + { + EVP_AES_GCM_CTX *gctx = ctx->cipher_data; + if (!iv && !key) + return 1; + if (key) + { + AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks); + CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt); + /* If we have an iv can set it directly, otherwise use + * saved IV. + */ + if (iv == NULL && gctx->iv_set) + iv = gctx->iv; + if (iv) + { + CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen); + gctx->iv_set = 1; + } + gctx->key_set = 1; + } + else + { + /* If key set use IV, otherwise copy */ + if (gctx->key_set) + CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen); + else + memcpy(gctx->iv, iv, gctx->ivlen); + gctx->iv_set = 1; + gctx->iv_gen = 0; + } + return 1; + } + +static int aes_gcm(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t len) + { + EVP_AES_GCM_CTX *gctx = ctx->cipher_data; + /* If not set up, return error */ + if (!gctx->iv_set && !gctx->key_set) + return -1; + if (!ctx->encrypt && gctx->taglen < 0) + return -1; + if (in) + { + if (out == NULL) + { + if (CRYPTO_gcm128_aad(&gctx->gcm, in, len)) + return -1; + } + else if (ctx->encrypt) + { + if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len)) + return -1; + } else - rijndaelDecrypt(k->rd_key,k->rounds, in, out); - inl-=16; - in+=16; - out+=16; + { + if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len)) + return -1; + } + return len; } - assert(inl == 0); + else + { + if (!ctx->encrypt) + { + if (CRYPTO_gcm128_finish(&gctx->gcm, + ctx->buf, gctx->taglen) != 0) + return -1; + gctx->iv_set = 0; + return 0; + } + CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16); + gctx->taglen = 16; + /* Don't reuse the IV */ + gctx->iv_set = 0; + return 0; + } + + } + +static const EVP_CIPHER aes_128_gcm_cipher= + { + NID_aes_128_gcm,1,16,12, + EVP_CIPH_GCM_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_gcm_init_key, + aes_gcm, + aes_gcm_cleanup, + sizeof(EVP_AES_GCM_CTX), + NULL, + NULL, + aes_gcm_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_128_gcm (void) +{ return &aes_128_gcm_cipher; } +static const EVP_CIPHER aes_192_gcm_cipher= + { + NID_aes_128_gcm,1,24,12, + EVP_CIPH_GCM_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_gcm_init_key, + aes_gcm, + aes_gcm_cleanup, + sizeof(EVP_AES_GCM_CTX), + NULL, + NULL, + aes_gcm_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_192_gcm (void) +{ return &aes_192_gcm_cipher; } + +static const EVP_CIPHER aes_256_gcm_cipher= + { + NID_aes_128_gcm,1,32,12, + EVP_CIPH_GCM_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_gcm_init_key, + aes_gcm, + aes_gcm_cleanup, + sizeof(EVP_AES_GCM_CTX), + NULL, + NULL, + aes_gcm_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_256_gcm (void) +{ return &aes_256_gcm_cipher; } + +typedef struct + { + /* AES key schedules to use */ + AES_KEY ks1, ks2; + XTS128_CONTEXT xts; + } EVP_AES_XTS_CTX; + +static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) + { + EVP_AES_XTS_CTX *xctx = c->cipher_data; + if (type != EVP_CTRL_INIT) + return -1; + /* key1 and key2 are used as an indicator both key and IV are set */ + xctx->xts.key1 = NULL; + xctx->xts.key2 = NULL; return 1; } -static int aes_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, unsigned int inl) +static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, + const unsigned char *iv, int enc) { - int n; - unsigned char tmp[16]; - RIJNDAEL_KEY *k=ctx->cipher_data; - while(inl > 0) + EVP_AES_XTS_CTX *xctx = ctx->cipher_data; + if (!iv && !key) + return 1; + + if (key) { - if(ctx->encrypt) + /* key_len is two AES keys */ + if (ctx->encrypt) { - for(n=0 ; n < 16 ; n++) - tmp[n] = in[n] ^ ctx->iv[n]; - rijndaelEncrypt(k->rd_key,k->rounds, tmp, out); - memcpy(ctx->iv,out,16); + AES_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1); + xctx->xts.block1 = (block128_f)AES_encrypt; } else { - memcpy(tmp, in, 16); - rijndaelDecrypt(k->rd_key,k->rounds, in, out); - for(n=0 ; n < 16 ; n++) - out[n] ^= ctx->iv[n]; - memcpy(ctx->iv,tmp,16); + AES_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1); + xctx->xts.block1 = (block128_f)AES_decrypt; + } + + AES_set_encrypt_key(key + ctx->key_len/2, + ctx->key_len * 4, &xctx->ks2); + xctx->xts.block2 = (block128_f)AES_encrypt; + + xctx->xts.key1 = &xctx->ks1; + } + + if (iv) + { + xctx->xts.key2 = &xctx->ks2; + memcpy(ctx->iv, iv, 16); + } + + return 1; + } + +static int aes_xts(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t len) + { + EVP_AES_XTS_CTX *xctx = ctx->cipher_data; + if (!xctx->xts.key1 || !xctx->xts.key2) + return -1; + if (!out || !in) + return -1; +#ifdef OPENSSL_FIPS + /* Requirement of SP800-38E */ + if (FIPS_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) && + (len > (1L<<20)*16)) + { + EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE); + return -1; + } +#endif + if (CRYPTO_xts128_encrypt(&xctx->xts, ctx->iv, in, out, len, + ctx->encrypt)) + return -1; + return len; + } + +static const EVP_CIPHER aes_128_xts_cipher= + { + NID_aes_128_xts,16,32,16, + EVP_CIPH_XTS_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_xts_init_key, + aes_xts, + 0, + sizeof(EVP_AES_XTS_CTX), + NULL, + NULL, + aes_xts_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_128_xts (void) +{ return &aes_128_xts_cipher; } + +static const EVP_CIPHER aes_256_xts_cipher= + { + NID_aes_256_xts,16,64,16, + EVP_CIPH_XTS_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_xts_init_key, + aes_xts, + 0, + sizeof(EVP_AES_XTS_CTX), + NULL, + NULL, + aes_xts_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_256_xts (void) +{ return &aes_256_xts_cipher; } + +typedef struct + { + /* AES key schedule to use */ + AES_KEY ks; + /* Set if key initialised */ + int key_set; + /* Set if an iv is set */ + int iv_set; + /* Set if tag is valid */ + int tag_set; + /* Set if message length set */ + int len_set; + /* L and M parameters from RFC3610 */ + int L, M; + CCM128_CONTEXT ccm; + } EVP_AES_CCM_CTX; + +static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) + { + EVP_AES_CCM_CTX *cctx = c->cipher_data; + switch (type) + { + case EVP_CTRL_INIT: + cctx->key_set = 0; + cctx->iv_set = 0; + cctx->L = 8; + cctx->M = 12; + cctx->tag_set = 0; + cctx->len_set = 0; + return 1; + + case EVP_CTRL_CCM_SET_IVLEN: + arg = 15 - arg; + case EVP_CTRL_CCM_SET_L: + if (arg < 2 || arg > 8) + return 0; + cctx->L = arg; + return 1; + + case EVP_CTRL_CCM_SET_TAG: + if ((arg & 1) || arg < 4 || arg > 16) + return 0; + if ((c->encrypt && ptr) || (!c->encrypt && !ptr)) + return 0; + if (ptr) + { + cctx->tag_set = 1; + memcpy(c->buf, ptr, arg); } - inl-=16; - in+=16; - out+=16; + cctx->M = arg; + return 1; + + case EVP_CTRL_CCM_GET_TAG: + if (!c->encrypt || !cctx->tag_set) + return 0; + if(CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg)) + return 0; + cctx->tag_set = 0; + cctx->iv_set = 0; + cctx->len_set = 0; + return 1; + + default: + return -1; + + } + } + +static int aes_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, + const unsigned char *iv, int enc) + { + EVP_AES_CCM_CTX *cctx = ctx->cipher_data; + if (!iv && !key) + return 1; + if (key) + { + AES_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks); + CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L, + &cctx->ks, (block128_f)AES_encrypt); + cctx->key_set = 1; + } + if (iv) + { + memcpy(ctx->iv, iv, 15 - cctx->L); + cctx->iv_set = 1; } - assert(inl == 0); return 1; } + +static int aes_ccm(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t len) + { + EVP_AES_CCM_CTX *cctx = ctx->cipher_data; + CCM128_CONTEXT *ccm = &cctx->ccm; + /* If not set up, return error */ + if (!cctx->iv_set && !cctx->key_set) + return -1; + if (!ctx->encrypt && !cctx->tag_set) + return -1; + if (!out) + { + if (!in) + { + if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len)) + return -1; + cctx->len_set = 1; + return len; + } + /* If have AAD need message length */ + if (!cctx->len_set && len) + return -1; + CRYPTO_ccm128_aad(ccm, in, len); + return len; + } + /* EVP_*Final() doesn't return any data */ + if (!in) + return 0; + /* If not set length yet do it */ + if (!cctx->len_set) + { + if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len)) + return -1; + cctx->len_set = 1; + } + if (ctx->encrypt) + { + if (CRYPTO_ccm128_encrypt(ccm, in, out, len)) + return -1; + cctx->tag_set = 1; + return len; + } + else + { + int rv = -1; + if (!CRYPTO_ccm128_decrypt(ccm, in, out, len)) + { + unsigned char tag[16]; + if (!CRYPTO_ccm128_tag(ccm, tag, cctx->M)) + { + if (!memcmp(tag, ctx->buf, cctx->M)) + rv = len; + } + } + if (rv == -1) + OPENSSL_cleanse(out, len); + cctx->iv_set = 0; + cctx->tag_set = 0; + cctx->len_set = 0; + return rv; + } + + } + +static const EVP_CIPHER aes_128_ccm_cipher= + { + NID_aes_128_ccm,1,16,12, + EVP_CIPH_CCM_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_ccm_init_key, + aes_ccm, + 0, + sizeof(EVP_AES_CCM_CTX), + NULL, + NULL, + aes_ccm_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_128_ccm (void) +{ return &aes_128_ccm_cipher; } + +static const EVP_CIPHER aes_192_ccm_cipher= + { + NID_aes_128_ccm,1,24,12, + EVP_CIPH_CCM_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_ccm_init_key, + aes_ccm, + 0, + sizeof(EVP_AES_CCM_CTX), + NULL, + NULL, + aes_ccm_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_192_ccm (void) +{ return &aes_192_ccm_cipher; } + +static const EVP_CIPHER aes_256_ccm_cipher= + { + NID_aes_128_ccm,1,32,12, + EVP_CIPH_CCM_MODE|EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_DEFAULT_ASN1 + | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER + | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT, + aes_ccm_init_key, + aes_ccm, + 0, + sizeof(EVP_AES_CCM_CTX), + NULL, + NULL, + aes_ccm_ctrl, + NULL + }; + +const EVP_CIPHER *EVP_aes_256_ccm (void) +{ return &aes_256_ccm_cipher; } + #endif