1 /*
2 * NIST SP800-38C compliant CCM implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 *
7 * This file is provided under the Apache License 2.0, or the
8 * GNU General Public License v2.0 or later.
9 *
10 * **********
11 * Apache License 2.0:
12 *
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
16 *
17 * http://www.apache.org/licenses/LICENSE-2.0
18 *
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
24 *
25 * **********
26 *
27 * **********
28 * GNU General Public License v2.0 or later:
29 *
30 * This program is free software; you can redistribute it and/or modify
31 * it under the terms of the GNU General Public License as published by
32 * the Free Software Foundation; either version 2 of the License, or
33 * (at your option) any later version.
34 *
35 * This program is distributed in the hope that it will be useful,
36 * but WITHOUT ANY WARRANTY; without even the implied warranty of
37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38 * GNU General Public License for more details.
39 *
40 * You should have received a copy of the GNU General Public License along
41 * with this program; if not, write to the Free Software Foundation, Inc.,
42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
43 *
44 * **********
45 */
46
47 /*
48 * Definition of CCM:
49 * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf
50 * RFC 3610 "Counter with CBC-MAC (CCM)"
51 *
52 * Related:
53 * RFC 5116 "An Interface and Algorithms for Authenticated Encryption"
54 */
55
56 #if !defined(MBEDTLS_CONFIG_FILE)
57 #include "mbedtls/config.h"
58 #else
59 #include MBEDTLS_CONFIG_FILE
60 #endif
61
62 #if defined(MBEDTLS_CCM_C)
63
64 #include "mbedtls/ccm.h"
65 #include "mbedtls/platform_util.h"
66
67 #include <string.h>
68
69 #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
70 #if defined(MBEDTLS_PLATFORM_C)
71 #include "mbedtls/platform.h"
72 #else
73 #include <stdio.h>
74 #define mbedtls_printf printf
75 #endif /* MBEDTLS_PLATFORM_C */
76 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
77
78 #if !defined(MBEDTLS_CCM_ALT)
79
80 #define CCM_VALIDATE_RET( cond ) \
81 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_CCM_BAD_INPUT )
82 #define CCM_VALIDATE( cond ) \
83 MBEDTLS_INTERNAL_VALIDATE( cond )
84
85 #define CCM_ENCRYPT 0
86 #define CCM_DECRYPT 1
87
88 /*
89 * Initialize context
90 */
mbedtls_ccm_init(mbedtls_ccm_context * ctx)91 void mbedtls_ccm_init( mbedtls_ccm_context *ctx )
92 {
93 CCM_VALIDATE( ctx != NULL );
94 memset( ctx, 0, sizeof( mbedtls_ccm_context ) );
95 }
96
mbedtls_ccm_setkey(mbedtls_ccm_context * ctx,mbedtls_cipher_id_t cipher,const unsigned char * key,unsigned int keybits)97 int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx,
98 mbedtls_cipher_id_t cipher,
99 const unsigned char *key,
100 unsigned int keybits )
101 {
102 int ret;
103 const mbedtls_cipher_info_t *cipher_info;
104
105 CCM_VALIDATE_RET( ctx != NULL );
106 CCM_VALIDATE_RET( key != NULL );
107
108 cipher_info = mbedtls_cipher_info_from_values( cipher, keybits, MBEDTLS_MODE_ECB );
109 if( cipher_info == NULL )
110 return( MBEDTLS_ERR_CCM_BAD_INPUT );
111
112 if( cipher_info->block_size != 16 )
113 return( MBEDTLS_ERR_CCM_BAD_INPUT );
114
115 mbedtls_cipher_free( &ctx->cipher_ctx );
116
117 if( ( ret = mbedtls_cipher_setup( &ctx->cipher_ctx, cipher_info ) ) != 0 )
118 return( ret );
119
120 if( ( ret = mbedtls_cipher_setkey( &ctx->cipher_ctx, key, keybits,
121 MBEDTLS_ENCRYPT ) ) != 0 )
122 {
123 return( ret );
124 }
125
126 return( 0 );
127 }
128
129 /*
130 * Free context
131 */
mbedtls_ccm_free(mbedtls_ccm_context * ctx)132 void mbedtls_ccm_free( mbedtls_ccm_context *ctx )
133 {
134 if( ctx == NULL )
135 return;
136 mbedtls_cipher_free( &ctx->cipher_ctx );
137 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_ccm_context ) );
138 }
139
140 /*
141 * Macros for common operations.
142 * Results in smaller compiled code than static inline functions.
143 */
144
145 /*
146 * Update the CBC-MAC state in y using a block in b
147 * (Always using b as the source helps the compiler optimise a bit better.)
148 */
149 #define UPDATE_CBC_MAC \
150 for( i = 0; i < 16; i++ ) \
151 y[i] ^= b[i]; \
152 \
153 if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, y, 16, y, &olen ) ) != 0 ) \
154 return( ret );
155
156 /*
157 * Encrypt or decrypt a partial block with CTR
158 * Warning: using b for temporary storage! src and dst must not be b!
159 * This avoids allocating one more 16 bytes buffer while allowing src == dst.
160 */
161 #define CTR_CRYPT( dst, src, len ) \
162 do \
163 { \
164 if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, ctr, \
165 16, b, &olen ) ) != 0 ) \
166 { \
167 return( ret ); \
168 } \
169 \
170 for( i = 0; i < (len); i++ ) \
171 (dst)[i] = (src)[i] ^ b[i]; \
172 } while( 0 )
173
174 /*
175 * Authenticated encryption or decryption
176 */
ccm_auth_crypt(mbedtls_ccm_context * ctx,int mode,size_t length,const unsigned char * iv,size_t iv_len,const unsigned char * add,size_t add_len,const unsigned char * input,unsigned char * output,unsigned char * tag,size_t tag_len)177 static int ccm_auth_crypt( mbedtls_ccm_context *ctx, int mode, size_t length,
178 const unsigned char *iv, size_t iv_len,
179 const unsigned char *add, size_t add_len,
180 const unsigned char *input, unsigned char *output,
181 unsigned char *tag, size_t tag_len )
182 {
183 int ret;
184 unsigned char i;
185 unsigned char q;
186 size_t len_left, olen;
187 unsigned char b[16];
188 unsigned char y[16];
189 unsigned char ctr[16];
190 const unsigned char *src;
191 unsigned char *dst;
192
193 /*
194 * Check length requirements: SP800-38C A.1
195 * Additional requirement: a < 2^16 - 2^8 to simplify the code.
196 * 'length' checked later (when writing it to the first block)
197 *
198 * Also, loosen the requirements to enable support for CCM* (IEEE 802.15.4).
199 */
200 if( tag_len == 2 || tag_len > 16 || tag_len % 2 != 0 )
201 return( MBEDTLS_ERR_CCM_BAD_INPUT );
202
203 /* Also implies q is within bounds */
204 if( iv_len < 7 || iv_len > 13 )
205 return( MBEDTLS_ERR_CCM_BAD_INPUT );
206
207 if( add_len > 0xFF00 )
208 return( MBEDTLS_ERR_CCM_BAD_INPUT );
209
210 q = 16 - 1 - (unsigned char) iv_len;
211
212 /*
213 * First block B_0:
214 * 0 .. 0 flags
215 * 1 .. iv_len nonce (aka iv)
216 * iv_len+1 .. 15 length
217 *
218 * With flags as (bits):
219 * 7 0
220 * 6 add present?
221 * 5 .. 3 (t - 2) / 2
222 * 2 .. 0 q - 1
223 */
224 b[0] = 0;
225 b[0] |= ( add_len > 0 ) << 6;
226 b[0] |= ( ( tag_len - 2 ) / 2 ) << 3;
227 b[0] |= q - 1;
228
229 memcpy( b + 1, iv, iv_len );
230
231 for( i = 0, len_left = length; i < q; i++, len_left >>= 8 )
232 b[15-i] = (unsigned char)( len_left & 0xFF );
233
234 if( len_left > 0 )
235 return( MBEDTLS_ERR_CCM_BAD_INPUT );
236
237
238 /* Start CBC-MAC with first block */
239 memset( y, 0, 16 );
240 UPDATE_CBC_MAC;
241
242 /*
243 * If there is additional data, update CBC-MAC with
244 * add_len, add, 0 (padding to a block boundary)
245 */
246 if( add_len > 0 )
247 {
248 size_t use_len;
249 len_left = add_len;
250 src = add;
251
252 memset( b, 0, 16 );
253 b[0] = (unsigned char)( ( add_len >> 8 ) & 0xFF );
254 b[1] = (unsigned char)( ( add_len ) & 0xFF );
255
256 use_len = len_left < 16 - 2 ? len_left : 16 - 2;
257 memcpy( b + 2, src, use_len );
258 len_left -= use_len;
259 src += use_len;
260
261 UPDATE_CBC_MAC;
262
263 while( len_left > 0 )
264 {
265 use_len = len_left > 16 ? 16 : len_left;
266
267 memset( b, 0, 16 );
268 memcpy( b, src, use_len );
269 UPDATE_CBC_MAC;
270
271 len_left -= use_len;
272 src += use_len;
273 }
274 }
275
276 /*
277 * Prepare counter block for encryption:
278 * 0 .. 0 flags
279 * 1 .. iv_len nonce (aka iv)
280 * iv_len+1 .. 15 counter (initially 1)
281 *
282 * With flags as (bits):
283 * 7 .. 3 0
284 * 2 .. 0 q - 1
285 */
286 ctr[0] = q - 1;
287 memcpy( ctr + 1, iv, iv_len );
288 memset( ctr + 1 + iv_len, 0, q );
289 ctr[15] = 1;
290
291 /*
292 * Authenticate and {en,de}crypt the message.
293 *
294 * The only difference between encryption and decryption is
295 * the respective order of authentication and {en,de}cryption.
296 */
297 len_left = length;
298 src = input;
299 dst = output;
300
301 while( len_left > 0 )
302 {
303 size_t use_len = len_left > 16 ? 16 : len_left;
304
305 if( mode == CCM_ENCRYPT )
306 {
307 memset( b, 0, 16 );
308 memcpy( b, src, use_len );
309 UPDATE_CBC_MAC;
310 }
311
312 CTR_CRYPT( dst, src, use_len );
313
314 if( mode == CCM_DECRYPT )
315 {
316 memset( b, 0, 16 );
317 memcpy( b, dst, use_len );
318 UPDATE_CBC_MAC;
319 }
320
321 dst += use_len;
322 src += use_len;
323 len_left -= use_len;
324
325 /*
326 * Increment counter.
327 * No need to check for overflow thanks to the length check above.
328 */
329 for( i = 0; i < q; i++ )
330 if( ++ctr[15-i] != 0 )
331 break;
332 }
333
334 /*
335 * Authentication: reset counter and crypt/mask internal tag
336 */
337 for( i = 0; i < q; i++ )
338 ctr[15-i] = 0;
339
340 CTR_CRYPT( y, y, 16 );
341 memcpy( tag, y, tag_len );
342
343 return( 0 );
344 }
345
346 /*
347 * Authenticated encryption
348 */
mbedtls_ccm_star_encrypt_and_tag(mbedtls_ccm_context * ctx,size_t length,const unsigned char * iv,size_t iv_len,const unsigned char * add,size_t add_len,const unsigned char * input,unsigned char * output,unsigned char * tag,size_t tag_len)349 int mbedtls_ccm_star_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
350 const unsigned char *iv, size_t iv_len,
351 const unsigned char *add, size_t add_len,
352 const unsigned char *input, unsigned char *output,
353 unsigned char *tag, size_t tag_len )
354 {
355 CCM_VALIDATE_RET( ctx != NULL );
356 CCM_VALIDATE_RET( iv != NULL );
357 CCM_VALIDATE_RET( add_len == 0 || add != NULL );
358 CCM_VALIDATE_RET( length == 0 || input != NULL );
359 CCM_VALIDATE_RET( length == 0 || output != NULL );
360 CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
361 return( ccm_auth_crypt( ctx, CCM_ENCRYPT, length, iv, iv_len,
362 add, add_len, input, output, tag, tag_len ) );
363 }
364
mbedtls_ccm_encrypt_and_tag(mbedtls_ccm_context * ctx,size_t length,const unsigned char * iv,size_t iv_len,const unsigned char * add,size_t add_len,const unsigned char * input,unsigned char * output,unsigned char * tag,size_t tag_len)365 int mbedtls_ccm_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
366 const unsigned char *iv, size_t iv_len,
367 const unsigned char *add, size_t add_len,
368 const unsigned char *input, unsigned char *output,
369 unsigned char *tag, size_t tag_len )
370 {
371 CCM_VALIDATE_RET( ctx != NULL );
372 CCM_VALIDATE_RET( iv != NULL );
373 CCM_VALIDATE_RET( add_len == 0 || add != NULL );
374 CCM_VALIDATE_RET( length == 0 || input != NULL );
375 CCM_VALIDATE_RET( length == 0 || output != NULL );
376 CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
377 if( tag_len == 0 )
378 return( MBEDTLS_ERR_CCM_BAD_INPUT );
379
380 return( mbedtls_ccm_star_encrypt_and_tag( ctx, length, iv, iv_len, add,
381 add_len, input, output, tag, tag_len ) );
382 }
383
384 /*
385 * Authenticated decryption
386 */
mbedtls_ccm_star_auth_decrypt(mbedtls_ccm_context * ctx,size_t length,const unsigned char * iv,size_t iv_len,const unsigned char * add,size_t add_len,const unsigned char * input,unsigned char * output,const unsigned char * tag,size_t tag_len)387 int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
388 const unsigned char *iv, size_t iv_len,
389 const unsigned char *add, size_t add_len,
390 const unsigned char *input, unsigned char *output,
391 const unsigned char *tag, size_t tag_len )
392 {
393 int ret;
394 unsigned char check_tag[16];
395 unsigned char i;
396 int diff;
397
398 CCM_VALIDATE_RET( ctx != NULL );
399 CCM_VALIDATE_RET( iv != NULL );
400 CCM_VALIDATE_RET( add_len == 0 || add != NULL );
401 CCM_VALIDATE_RET( length == 0 || input != NULL );
402 CCM_VALIDATE_RET( length == 0 || output != NULL );
403 CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
404
405 if( ( ret = ccm_auth_crypt( ctx, CCM_DECRYPT, length,
406 iv, iv_len, add, add_len,
407 input, output, check_tag, tag_len ) ) != 0 )
408 {
409 return( ret );
410 }
411
412 /* Check tag in "constant-time" */
413 for( diff = 0, i = 0; i < tag_len; i++ )
414 diff |= tag[i] ^ check_tag[i];
415
416 if( diff != 0 )
417 {
418 mbedtls_platform_zeroize( output, length );
419 return( MBEDTLS_ERR_CCM_AUTH_FAILED );
420 }
421
422 return( 0 );
423 }
424
mbedtls_ccm_auth_decrypt(mbedtls_ccm_context * ctx,size_t length,const unsigned char * iv,size_t iv_len,const unsigned char * add,size_t add_len,const unsigned char * input,unsigned char * output,const unsigned char * tag,size_t tag_len)425 int mbedtls_ccm_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
426 const unsigned char *iv, size_t iv_len,
427 const unsigned char *add, size_t add_len,
428 const unsigned char *input, unsigned char *output,
429 const unsigned char *tag, size_t tag_len )
430 {
431 CCM_VALIDATE_RET( ctx != NULL );
432 CCM_VALIDATE_RET( iv != NULL );
433 CCM_VALIDATE_RET( add_len == 0 || add != NULL );
434 CCM_VALIDATE_RET( length == 0 || input != NULL );
435 CCM_VALIDATE_RET( length == 0 || output != NULL );
436 CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
437
438 if( tag_len == 0 )
439 return( MBEDTLS_ERR_CCM_BAD_INPUT );
440
441 return( mbedtls_ccm_star_auth_decrypt( ctx, length, iv, iv_len, add,
442 add_len, input, output, tag, tag_len ) );
443 }
444 #endif /* !MBEDTLS_CCM_ALT */
445
446 #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
447 /*
448 * Examples 1 to 3 from SP800-38C Appendix C
449 */
450
451 #define NB_TESTS 3
452 #define CCM_SELFTEST_PT_MAX_LEN 24
453 #define CCM_SELFTEST_CT_MAX_LEN 32
454 /*
455 * The data is the same for all tests, only the used length changes
456 */
457 static const unsigned char key[] = {
458 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
459 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f
460 };
461
462 static const unsigned char iv[] = {
463 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
464 0x18, 0x19, 0x1a, 0x1b
465 };
466
467 static const unsigned char ad[] = {
468 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
469 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
470 0x10, 0x11, 0x12, 0x13
471 };
472
473 static const unsigned char msg[CCM_SELFTEST_PT_MAX_LEN] = {
474 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
475 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
476 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
477 };
478
479 static const size_t iv_len [NB_TESTS] = { 7, 8, 12 };
480 static const size_t add_len[NB_TESTS] = { 8, 16, 20 };
481 static const size_t msg_len[NB_TESTS] = { 4, 16, 24 };
482 static const size_t tag_len[NB_TESTS] = { 4, 6, 8 };
483
484 static const unsigned char res[NB_TESTS][CCM_SELFTEST_CT_MAX_LEN] = {
485 { 0x71, 0x62, 0x01, 0x5b, 0x4d, 0xac, 0x25, 0x5d },
486 { 0xd2, 0xa1, 0xf0, 0xe0, 0x51, 0xea, 0x5f, 0x62,
487 0x08, 0x1a, 0x77, 0x92, 0x07, 0x3d, 0x59, 0x3d,
488 0x1f, 0xc6, 0x4f, 0xbf, 0xac, 0xcd },
489 { 0xe3, 0xb2, 0x01, 0xa9, 0xf5, 0xb7, 0x1a, 0x7a,
490 0x9b, 0x1c, 0xea, 0xec, 0xcd, 0x97, 0xe7, 0x0b,
491 0x61, 0x76, 0xaa, 0xd9, 0xa4, 0x42, 0x8a, 0xa5,
492 0x48, 0x43, 0x92, 0xfb, 0xc1, 0xb0, 0x99, 0x51 }
493 };
494
mbedtls_ccm_self_test(int verbose)495 int mbedtls_ccm_self_test( int verbose )
496 {
497 mbedtls_ccm_context ctx;
498 /*
499 * Some hardware accelerators require the input and output buffers
500 * would be in RAM, because the flash is not accessible.
501 * Use buffers on the stack to hold the test vectors data.
502 */
503 unsigned char plaintext[CCM_SELFTEST_PT_MAX_LEN];
504 unsigned char ciphertext[CCM_SELFTEST_CT_MAX_LEN];
505 size_t i;
506 int ret;
507
508 mbedtls_ccm_init( &ctx );
509
510 if( mbedtls_ccm_setkey( &ctx, MBEDTLS_CIPHER_ID_AES, key, 8 * sizeof key ) != 0 )
511 {
512 if( verbose != 0 )
513 mbedtls_printf( " CCM: setup failed" );
514
515 return( 1 );
516 }
517
518 for( i = 0; i < NB_TESTS; i++ )
519 {
520 if( verbose != 0 )
521 mbedtls_printf( " CCM-AES #%u: ", (unsigned int) i + 1 );
522
523 memset( plaintext, 0, CCM_SELFTEST_PT_MAX_LEN );
524 memset( ciphertext, 0, CCM_SELFTEST_CT_MAX_LEN );
525 memcpy( plaintext, msg, msg_len[i] );
526
527 ret = mbedtls_ccm_encrypt_and_tag( &ctx, msg_len[i],
528 iv, iv_len[i], ad, add_len[i],
529 plaintext, ciphertext,
530 ciphertext + msg_len[i], tag_len[i] );
531
532 if( ret != 0 ||
533 memcmp( ciphertext, res[i], msg_len[i] + tag_len[i] ) != 0 )
534 {
535 if( verbose != 0 )
536 mbedtls_printf( "failed\n" );
537
538 return( 1 );
539 }
540 memset( plaintext, 0, CCM_SELFTEST_PT_MAX_LEN );
541
542 ret = mbedtls_ccm_auth_decrypt( &ctx, msg_len[i],
543 iv, iv_len[i], ad, add_len[i],
544 ciphertext, plaintext,
545 ciphertext + msg_len[i], tag_len[i] );
546
547 if( ret != 0 ||
548 memcmp( plaintext, msg, msg_len[i] ) != 0 )
549 {
550 if( verbose != 0 )
551 mbedtls_printf( "failed\n" );
552
553 return( 1 );
554 }
555
556 if( verbose != 0 )
557 mbedtls_printf( "passed\n" );
558 }
559
560 mbedtls_ccm_free( &ctx );
561
562 if( verbose != 0 )
563 mbedtls_printf( "\n" );
564
565 return( 0 );
566 }
567
568 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
569
570 #endif /* MBEDTLS_CCM_C */
571