Differential D28300 Diff 82760 cipher-chachapoly-libcrypto.c

Changeset View

Standalone View

cipher-chachapoly-libcrypto.c

This file was copied from cipher-chachapoly.c.

	/*			/*
	* Copyright (c) 2013 Damien Miller <djm@mindrot.org>			* Copyright (c) 2013 Damien Miller <djm@mindrot.org>
	*			*
	* Permission to use, copy, modify, and distribute this software for any			* Permission to use, copy, modify, and distribute this software for any
	* purpose with or without fee is hereby granted, provided that the above			* purpose with or without fee is hereby granted, provided that the above
	* copyright notice and this permission notice appear in all copies.			* copyright notice and this permission notice appear in all copies.
	*			*
	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES			* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF			* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR			* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES			* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN			* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF			* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.			* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	*/			*/

	/* $OpenBSD: cipher-chachapoly.c,v 1.8 2016/08/03 05:41:57 djm Exp $ */			/* $OpenBSD: cipher-chachapoly-libcrypto.c,v 1.1 2020/04/03 04:32:21 djm Exp $ */

	#include "includes.h"			#include "includes.h"
				#ifdef WITH_OPENSSL
				#include "openbsd-compat/openssl-compat.h"
				#endif

				#if defined(HAVE_EVP_CHACHA20) && !defined(HAVE_BROKEN_CHACHA20)

	#include <sys/types.h>			#include <sys/types.h>
	#include <stdarg.h> /* needed for log.h */			#include <stdarg.h> /* needed for log.h */
	#include <string.h>			#include <string.h>
	#include <stdio.h> /* needed for misc.h */			#include <stdio.h> /* needed for misc.h */

				#include <openssl/evp.h>

	#include "log.h"			#include "log.h"
	#include "sshbuf.h"			#include "sshbuf.h"
	#include "ssherr.h"			#include "ssherr.h"
	#include "cipher-chachapoly.h"			#include "cipher-chachapoly.h"

	int			struct chachapoly_ctx {
	chachapoly_init(struct chachapoly_ctx *ctx,			EVP_CIPHER_CTX main_evp, header_evp;
	const u_char *key, u_int keylen)			};

				struct chachapoly_ctx *
				chachapoly_new(const u_char *key, u_int keylen)
	{			{
				struct chachapoly_ctx *ctx;

	if (keylen != (32 + 32)) /* 2 x 256 bit keys */			if (keylen != (32 + 32)) /* 2 x 256 bit keys */
	return SSH_ERR_INVALID_ARGUMENT;			return NULL;
	chacha_keysetup(&ctx->main_ctx, key, 256);			if ((ctx = calloc(1, sizeof(*ctx))) == NULL)
	chacha_keysetup(&ctx->header_ctx, key + 32, 256);			return NULL;
	return 0;			if ((ctx->main_evp = EVP_CIPHER_CTX_new()) == NULL \|\|
				(ctx->header_evp = EVP_CIPHER_CTX_new()) == NULL)
				goto fail;
				if (!EVP_CipherInit(ctx->main_evp, EVP_chacha20(), key, NULL, 1))
				goto fail;
				if (!EVP_CipherInit(ctx->header_evp, EVP_chacha20(), key + 32, NULL, 1))
				goto fail;
				if (EVP_CIPHER_CTX_iv_length(ctx->header_evp) != 16)
				goto fail;
				return ctx;
				fail:
				chachapoly_free(ctx);
				return NULL;
	}			}

				void
				chachapoly_free(struct chachapoly_ctx *cpctx)
				{
				if (cpctx == NULL)
				return;
				EVP_CIPHER_CTX_free(cpctx->main_evp);
				EVP_CIPHER_CTX_free(cpctx->header_evp);
				freezero(cpctx, sizeof(*cpctx));
				}

	/*			/*
	* chachapoly_crypt() operates as following:			* chachapoly_crypt() operates as following:
	* En/decrypt with header key 'aadlen' bytes from 'src', storing result			* En/decrypt with header key 'aadlen' bytes from 'src', storing result
	* to 'dest'. The ciphertext here is treated as additional authenticated			* to 'dest'. The ciphertext here is treated as additional authenticated
	* data for MAC calculation.			* data for MAC calculation.
	* En/decrypt 'len' bytes at offset 'aadlen' from 'src' to 'dest'. Use			* En/decrypt 'len' bytes at offset 'aadlen' from 'src' to 'dest'. Use
	* POLY1305_TAGLEN bytes at offset 'len'+'aadlen' as the authentication			* POLY1305_TAGLEN bytes at offset 'len'+'aadlen' as the authentication
	* tag. This tag is written on encryption and verified on decryption.			* tag. This tag is written on encryption and verified on decryption.
	*/			*/
	int			int
	chachapoly_crypt(struct chachapoly_ctx ctx, u_int seqnr, u_char dest,			chachapoly_crypt(struct chachapoly_ctx ctx, u_int seqnr, u_char dest,
	const u_char *src, u_int len, u_int aadlen, u_int authlen, int do_encrypt)			const u_char *src, u_int len, u_int aadlen, u_int authlen, int do_encrypt)
	{			{
	u_char seqbuf[8];			u_char seqbuf[16]; /* layout: u64 counter \|\| u64 seqno */
	const u_char one[8] = { 1, 0, 0, 0, 0, 0, 0, 0 }; /* NB little-endian */
	u_char expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];
	int r = SSH_ERR_INTERNAL_ERROR;			int r = SSH_ERR_INTERNAL_ERROR;
				u_char expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];

	/*			/*
	* Run ChaCha20 once to generate the Poly1305 key. The IV is the			* Run ChaCha20 once to generate the Poly1305 key. The IV is the
	* packet sequence number.			* packet sequence number.
	*/			*/
				memset(seqbuf, 0, sizeof(seqbuf));
				POKE_U64(seqbuf + 8, seqnr);
	memset(poly_key, 0, sizeof(poly_key));			memset(poly_key, 0, sizeof(poly_key));
	POKE_U64(seqbuf, seqnr);			if (!EVP_CipherInit(ctx->main_evp, NULL, NULL, seqbuf, 1) \|\|
	chacha_ivsetup(&ctx->main_ctx, seqbuf, NULL);			EVP_Cipher(ctx->main_evp, poly_key,
	chacha_encrypt_bytes(&ctx->main_ctx,			poly_key, sizeof(poly_key)) < 0) {
	poly_key, poly_key, sizeof(poly_key));			r = SSH_ERR_LIBCRYPTO_ERROR;
				goto out;
				}

	/* If decrypting, check tag before anything else */			/* If decrypting, check tag before anything else */
	if (!do_encrypt) {			if (!do_encrypt) {
	const u_char *tag = src + aadlen + len;			const u_char *tag = src + aadlen + len;

	poly1305_auth(expected_tag, src, aadlen + len, poly_key);			poly1305_auth(expected_tag, src, aadlen + len, poly_key);
	if (timingsafe_bcmp(expected_tag, tag, POLY1305_TAGLEN) != 0) {			if (timingsafe_bcmp(expected_tag, tag, POLY1305_TAGLEN) != 0) {
	r = SSH_ERR_MAC_INVALID;			r = SSH_ERR_MAC_INVALID;
	goto out;			goto out;
	}			}
	}			}

	/* Crypt additional data */			/* Crypt additional data */
	if (aadlen) {			if (aadlen) {
	chacha_ivsetup(&ctx->header_ctx, seqbuf, NULL);			if (!EVP_CipherInit(ctx->header_evp, NULL, NULL, seqbuf, 1) \|\|
	chacha_encrypt_bytes(&ctx->header_ctx, src, dest, aadlen);			EVP_Cipher(ctx->header_evp, dest, src, aadlen) < 0) {
				r = SSH_ERR_LIBCRYPTO_ERROR;
				goto out;
	}			}
				}

	/* Set Chacha's block counter to 1 */			/* Set Chacha's block counter to 1 */
	chacha_ivsetup(&ctx->main_ctx, seqbuf, one);			seqbuf[0] = 1;
	chacha_encrypt_bytes(&ctx->main_ctx, src + aadlen,			if (!EVP_CipherInit(ctx->main_evp, NULL, NULL, seqbuf, 1) \|\|
	dest + aadlen, len);			EVP_Cipher(ctx->main_evp, dest + aadlen, src + aadlen, len) < 0) {
				r = SSH_ERR_LIBCRYPTO_ERROR;
				goto out;
				}

	/* If encrypting, calculate and append tag */			/* If encrypting, calculate and append tag */
	if (do_encrypt) {			if (do_encrypt) {
	poly1305_auth(dest + aadlen + len, dest, aadlen + len,			poly1305_auth(dest + aadlen + len, dest, aadlen + len,
	poly_key);			poly_key);
	}			}
	r = 0;			r = 0;
	out:			out:
	explicit_bzero(expected_tag, sizeof(expected_tag));			explicit_bzero(expected_tag, sizeof(expected_tag));
	explicit_bzero(seqbuf, sizeof(seqbuf));			explicit_bzero(seqbuf, sizeof(seqbuf));
	explicit_bzero(poly_key, sizeof(poly_key));			explicit_bzero(poly_key, sizeof(poly_key));
	return r;			return r;
	}			}

	/* Decrypt and extract the encrypted packet length */			/* Decrypt and extract the encrypted packet length */
	int			int
	chachapoly_get_length(struct chachapoly_ctx *ctx,			chachapoly_get_length(struct chachapoly_ctx *ctx,
	u_int plenp, u_int seqnr, const u_char cp, u_int len)			u_int plenp, u_int seqnr, const u_char cp, u_int len)
	{			{
	u_char buf[4], seqbuf[8];			u_char buf[4], seqbuf[16];

	if (len < 4)			if (len < 4)
	return SSH_ERR_MESSAGE_INCOMPLETE;			return SSH_ERR_MESSAGE_INCOMPLETE;
	POKE_U64(seqbuf, seqnr);			memset(seqbuf, 0, sizeof(seqbuf));
	chacha_ivsetup(&ctx->header_ctx, seqbuf, NULL);			POKE_U64(seqbuf + 8, seqnr);
	chacha_encrypt_bytes(&ctx->header_ctx, cp, buf, 4);			if (!EVP_CipherInit(ctx->header_evp, NULL, NULL, seqbuf, 0))
				return SSH_ERR_LIBCRYPTO_ERROR;
				if (EVP_Cipher(ctx->header_evp, buf, (u_char *)cp, sizeof(buf)) < 0)
				return SSH_ERR_LIBCRYPTO_ERROR;
	*plenp = PEEK_U32(buf);			*plenp = PEEK_U32(buf);
	return 0;			return 0;
	}			}
				#endif /* defined(HAVE_EVP_CHACHA20) && !defined(HAVE_BROKEN_CHACHA20) */