Changeset View
Changeset View
Standalone View
Standalone View
head/contrib/bearssl/src/aead/ccm.c
Property | Old Value | New Value |
---|---|---|
svn:eol-style | null | native \ No newline at end of property |
svn:keywords | null | FreeBSD=%H \ No newline at end of property |
svn:mime-type | null | text/plain \ No newline at end of property |
/* | |||||
* Copyright (c) 2017 Thomas Pornin <pornin@bolet.org> | |||||
* | |||||
* Permission is hereby granted, free of charge, to any person obtaining | |||||
* a copy of this software and associated documentation files (the | |||||
* "Software"), to deal in the Software without restriction, including | |||||
* without limitation the rights to use, copy, modify, merge, publish, | |||||
* distribute, sublicense, and/or sell copies of the Software, and to | |||||
* permit persons to whom the Software is furnished to do so, subject to | |||||
* the following conditions: | |||||
* | |||||
* The above copyright notice and this permission notice shall be | |||||
* included in all copies or substantial portions of the Software. | |||||
* | |||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, | |||||
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF | |||||
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND | |||||
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS | |||||
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN | |||||
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN | |||||
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | |||||
* SOFTWARE. | |||||
*/ | |||||
#include "inner.h" | |||||
/* | |||||
* Implementation Notes | |||||
* ==================== | |||||
* | |||||
* The combined CTR + CBC-MAC functions can only handle full blocks, | |||||
* so some buffering is necessary. | |||||
* | |||||
* - 'ptr' contains a value from 0 to 15, which is the number of bytes | |||||
* accumulated in buf[] that still needs to be processed with the | |||||
* current CBC-MAC computation. | |||||
* | |||||
* - When processing the message itself, CTR encryption/decryption is | |||||
* also done at the same time. The first 'ptr' bytes of buf[] then | |||||
* contains the plaintext bytes, while the last '16 - ptr' bytes of | |||||
* buf[] are the remnants of the stream block, to be used against | |||||
* the next input bytes, when available. When 'ptr' is 0, the | |||||
* contents of buf[] are to be ignored. | |||||
* | |||||
* - The current counter and running CBC-MAC values are kept in 'ctr' | |||||
* and 'cbcmac', respectively. | |||||
*/ | |||||
/* see bearssl_block.h */ | |||||
void | |||||
br_ccm_init(br_ccm_context *ctx, const br_block_ctrcbc_class **bctx) | |||||
{ | |||||
ctx->bctx = bctx; | |||||
} | |||||
/* see bearssl_block.h */ | |||||
int | |||||
br_ccm_reset(br_ccm_context *ctx, const void *nonce, size_t nonce_len, | |||||
uint64_t aad_len, uint64_t data_len, size_t tag_len) | |||||
{ | |||||
unsigned char tmp[16]; | |||||
unsigned u, q; | |||||
if (nonce_len < 7 || nonce_len > 13) { | |||||
return 0; | |||||
} | |||||
if (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0) { | |||||
return 0; | |||||
} | |||||
q = 15 - (unsigned)nonce_len; | |||||
ctx->tag_len = tag_len; | |||||
/* | |||||
* Block B0, to start CBC-MAC. | |||||
*/ | |||||
tmp[0] = (aad_len > 0 ? 0x40 : 0x00) | |||||
| (((unsigned)tag_len - 2) << 2) | |||||
| (q - 1); | |||||
memcpy(tmp + 1, nonce, nonce_len); | |||||
for (u = 0; u < q; u ++) { | |||||
tmp[15 - u] = (unsigned char)data_len; | |||||
data_len >>= 8; | |||||
} | |||||
if (data_len != 0) { | |||||
/* | |||||
* If the data length was not entirely consumed in the | |||||
* loop above, then it exceeds the maximum limit of | |||||
* q bytes (when encoded). | |||||
*/ | |||||
return 0; | |||||
} | |||||
/* | |||||
* Start CBC-MAC. | |||||
*/ | |||||
memset(ctx->cbcmac, 0, sizeof ctx->cbcmac); | |||||
(*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac, tmp, sizeof tmp); | |||||
/* | |||||
* Assemble AAD length header. | |||||
*/ | |||||
if ((aad_len >> 32) != 0) { | |||||
ctx->buf[0] = 0xFF; | |||||
ctx->buf[1] = 0xFF; | |||||
br_enc64be(ctx->buf + 2, aad_len); | |||||
ctx->ptr = 10; | |||||
} else if (aad_len >= 0xFF00) { | |||||
ctx->buf[0] = 0xFF; | |||||
ctx->buf[1] = 0xFE; | |||||
br_enc32be(ctx->buf + 2, (uint32_t)aad_len); | |||||
ctx->ptr = 6; | |||||
} else if (aad_len > 0) { | |||||
br_enc16be(ctx->buf, (unsigned)aad_len); | |||||
ctx->ptr = 2; | |||||
} else { | |||||
ctx->ptr = 0; | |||||
} | |||||
/* | |||||
* Make initial counter value and compute tag mask. | |||||
*/ | |||||
ctx->ctr[0] = q - 1; | |||||
memcpy(ctx->ctr + 1, nonce, nonce_len); | |||||
memset(ctx->ctr + 1 + nonce_len, 0, q); | |||||
memset(ctx->tagmask, 0, sizeof ctx->tagmask); | |||||
(*ctx->bctx)->ctr(ctx->bctx, ctx->ctr, | |||||
ctx->tagmask, sizeof ctx->tagmask); | |||||
return 1; | |||||
} | |||||
/* see bearssl_block.h */ | |||||
void | |||||
br_ccm_aad_inject(br_ccm_context *ctx, const void *data, size_t len) | |||||
{ | |||||
const unsigned char *dbuf; | |||||
size_t ptr; | |||||
dbuf = data; | |||||
/* | |||||
* Complete partial block, if needed. | |||||
*/ | |||||
ptr = ctx->ptr; | |||||
if (ptr != 0) { | |||||
size_t clen; | |||||
clen = (sizeof ctx->buf) - ptr; | |||||
if (clen > len) { | |||||
memcpy(ctx->buf + ptr, dbuf, len); | |||||
ctx->ptr = ptr + len; | |||||
return; | |||||
} | |||||
memcpy(ctx->buf + ptr, dbuf, clen); | |||||
dbuf += clen; | |||||
len -= clen; | |||||
(*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac, | |||||
ctx->buf, sizeof ctx->buf); | |||||
} | |||||
/* | |||||
* Process complete blocks. | |||||
*/ | |||||
ptr = len & 15; | |||||
len -= ptr; | |||||
(*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac, dbuf, len); | |||||
dbuf += len; | |||||
/* | |||||
* Copy last partial block in the context buffer. | |||||
*/ | |||||
memcpy(ctx->buf, dbuf, ptr); | |||||
ctx->ptr = ptr; | |||||
} | |||||
/* see bearssl_block.h */ | |||||
void | |||||
br_ccm_flip(br_ccm_context *ctx) | |||||
{ | |||||
size_t ptr; | |||||
/* | |||||
* Complete AAD partial block with zeros, if necessary. | |||||
*/ | |||||
ptr = ctx->ptr; | |||||
if (ptr != 0) { | |||||
memset(ctx->buf + ptr, 0, (sizeof ctx->buf) - ptr); | |||||
(*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac, | |||||
ctx->buf, sizeof ctx->buf); | |||||
ctx->ptr = 0; | |||||
} | |||||
/* | |||||
* Counter was already set by br_ccm_reset(). | |||||
*/ | |||||
} | |||||
/* see bearssl_block.h */ | |||||
void | |||||
br_ccm_run(br_ccm_context *ctx, int encrypt, void *data, size_t len) | |||||
{ | |||||
unsigned char *dbuf; | |||||
size_t ptr; | |||||
dbuf = data; | |||||
/* | |||||
* Complete a partial block, if any: ctx->buf[] contains | |||||
* ctx->ptr plaintext bytes (already reported), and the other | |||||
* bytes are CTR stream output. | |||||
*/ | |||||
ptr = ctx->ptr; | |||||
if (ptr != 0) { | |||||
size_t clen; | |||||
size_t u; | |||||
clen = (sizeof ctx->buf) - ptr; | |||||
if (clen > len) { | |||||
clen = len; | |||||
} | |||||
if (encrypt) { | |||||
for (u = 0; u < clen; u ++) { | |||||
unsigned w, x; | |||||
w = ctx->buf[ptr + u]; | |||||
x = dbuf[u]; | |||||
ctx->buf[ptr + u] = x; | |||||
dbuf[u] = w ^ x; | |||||
} | |||||
} else { | |||||
for (u = 0; u < clen; u ++) { | |||||
unsigned w; | |||||
w = ctx->buf[ptr + u] ^ dbuf[u]; | |||||
dbuf[u] = w; | |||||
ctx->buf[ptr + u] = w; | |||||
} | |||||
} | |||||
dbuf += clen; | |||||
len -= clen; | |||||
ptr += clen; | |||||
if (ptr < sizeof ctx->buf) { | |||||
ctx->ptr = ptr; | |||||
return; | |||||
} | |||||
(*ctx->bctx)->mac(ctx->bctx, | |||||
ctx->cbcmac, ctx->buf, sizeof ctx->buf); | |||||
} | |||||
/* | |||||
* Process all complete blocks. Note that the ctrcbc API is for | |||||
* encrypt-then-MAC (CBC-MAC is computed over the encrypted | |||||
* blocks) while CCM uses MAC-and-encrypt (CBC-MAC is computed | |||||
* over the plaintext blocks). Therefore, we need to use the | |||||
* _decryption_ function for encryption, and the encryption | |||||
* function for decryption (this works because CTR encryption | |||||
* and decryption are identical, so the choice really is about | |||||
* computing the CBC-MAC before or after XORing with the CTR | |||||
* stream). | |||||
*/ | |||||
ptr = len & 15; | |||||
len -= ptr; | |||||
if (encrypt) { | |||||
(*ctx->bctx)->decrypt(ctx->bctx, ctx->ctr, ctx->cbcmac, | |||||
dbuf, len); | |||||
} else { | |||||
(*ctx->bctx)->encrypt(ctx->bctx, ctx->ctr, ctx->cbcmac, | |||||
dbuf, len); | |||||
} | |||||
dbuf += len; | |||||
/* | |||||
* If there is some remaining data, then we need to compute an | |||||
* extra block of CTR stream. | |||||
*/ | |||||
if (ptr != 0) { | |||||
size_t u; | |||||
memset(ctx->buf, 0, sizeof ctx->buf); | |||||
(*ctx->bctx)->ctr(ctx->bctx, ctx->ctr, | |||||
ctx->buf, sizeof ctx->buf); | |||||
if (encrypt) { | |||||
for (u = 0; u < ptr; u ++) { | |||||
unsigned w, x; | |||||
w = ctx->buf[u]; | |||||
x = dbuf[u]; | |||||
ctx->buf[u] = x; | |||||
dbuf[u] = w ^ x; | |||||
} | |||||
} else { | |||||
for (u = 0; u < ptr; u ++) { | |||||
unsigned w; | |||||
w = ctx->buf[u] ^ dbuf[u]; | |||||
dbuf[u] = w; | |||||
ctx->buf[u] = w; | |||||
} | |||||
} | |||||
} | |||||
ctx->ptr = ptr; | |||||
} | |||||
/* see bearssl_block.h */ | |||||
size_t | |||||
br_ccm_get_tag(br_ccm_context *ctx, void *tag) | |||||
{ | |||||
size_t ptr; | |||||
size_t u; | |||||
/* | |||||
* If there is some buffered data, then we need to pad it with | |||||
* zeros and finish up CBC-MAC. | |||||
*/ | |||||
ptr = ctx->ptr; | |||||
if (ptr != 0) { | |||||
memset(ctx->buf + ptr, 0, (sizeof ctx->buf) - ptr); | |||||
(*ctx->bctx)->mac(ctx->bctx, ctx->cbcmac, | |||||
ctx->buf, sizeof ctx->buf); | |||||
} | |||||
/* | |||||
* XOR the tag mask into the CBC-MAC output. | |||||
*/ | |||||
for (u = 0; u < ctx->tag_len; u ++) { | |||||
ctx->cbcmac[u] ^= ctx->tagmask[u]; | |||||
} | |||||
memcpy(tag, ctx->cbcmac, ctx->tag_len); | |||||
return ctx->tag_len; | |||||
} | |||||
/* see bearssl_block.h */ | |||||
uint32_t | |||||
br_ccm_check_tag(br_ccm_context *ctx, const void *tag) | |||||
{ | |||||
unsigned char tmp[16]; | |||||
size_t u, tag_len; | |||||
uint32_t z; | |||||
tag_len = br_ccm_get_tag(ctx, tmp); | |||||
z = 0; | |||||
for (u = 0; u < tag_len; u ++) { | |||||
z |= tmp[u] ^ ((const unsigned char *)tag)[u]; | |||||
} | |||||
return EQ0(z); | |||||
} |