1 /* Copyright (c) 2015, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/ssl.h>
16
17 #include <assert.h>
18 #include <string.h>
19
20 #include <openssl/aead.h>
21 #include <openssl/err.h>
22 #include <openssl/rand.h>
23 #include <openssl/type_check.h>
24
25 #include "internal.h"
26
27
28 OPENSSL_COMPILE_ASSERT(EVP_AEAD_MAX_NONCE_LENGTH < 256,
29 variable_nonce_len_doesnt_fit_in_uint8_t);
30
SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,uint16_t version,const SSL_CIPHER * cipher,const uint8_t * enc_key,size_t enc_key_len,const uint8_t * mac_key,size_t mac_key_len,const uint8_t * fixed_iv,size_t fixed_iv_len)31 SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,
32 uint16_t version, const SSL_CIPHER *cipher,
33 const uint8_t *enc_key, size_t enc_key_len,
34 const uint8_t *mac_key, size_t mac_key_len,
35 const uint8_t *fixed_iv, size_t fixed_iv_len) {
36 const EVP_AEAD *aead;
37 size_t discard;
38 if (!ssl_cipher_get_evp_aead(&aead, &discard, &discard, cipher, version)) {
39 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
40 return 0;
41 }
42
43 uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH];
44 if (mac_key_len > 0) {
45 /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher
46 * suites). */
47 if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) {
48 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
49 return 0;
50 }
51 memcpy(merged_key, mac_key, mac_key_len);
52 memcpy(merged_key + mac_key_len, enc_key, enc_key_len);
53 memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv, fixed_iv_len);
54 enc_key = merged_key;
55 enc_key_len += mac_key_len;
56 enc_key_len += fixed_iv_len;
57 }
58
59 SSL_AEAD_CTX *aead_ctx = OPENSSL_malloc(sizeof(SSL_AEAD_CTX));
60 if (aead_ctx == NULL) {
61 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
62 return NULL;
63 }
64 memset(aead_ctx, 0, sizeof(SSL_AEAD_CTX));
65 aead_ctx->cipher = cipher;
66
67 if (!EVP_AEAD_CTX_init_with_direction(
68 &aead_ctx->ctx, aead, enc_key, enc_key_len,
69 EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) {
70 OPENSSL_free(aead_ctx);
71 return NULL;
72 }
73
74 assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH);
75 aead_ctx->variable_nonce_len = (uint8_t)EVP_AEAD_nonce_length(aead);
76 if (mac_key_len == 0) {
77 assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce));
78 memcpy(aead_ctx->fixed_nonce, fixed_iv, fixed_iv_len);
79 aead_ctx->fixed_nonce_len = fixed_iv_len;
80
81 if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) {
82 /* The fixed nonce into the actual nonce (the sequence number). */
83 aead_ctx->xor_fixed_nonce = 1;
84 aead_ctx->variable_nonce_len = 8;
85 } else {
86 /* The fixed IV is prepended to the nonce. */
87 assert(fixed_iv_len <= aead_ctx->variable_nonce_len);
88 aead_ctx->variable_nonce_len -= fixed_iv_len;
89 }
90
91 /* AES-GCM uses an explicit nonce. */
92 if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) {
93 aead_ctx->variable_nonce_included_in_record = 1;
94 }
95
96 /* The TLS 1.3 construction XORs the fixed nonce into the sequence number
97 * and omits the additional data. */
98 if (version >= TLS1_3_VERSION) {
99 aead_ctx->xor_fixed_nonce = 1;
100 aead_ctx->variable_nonce_len = 8;
101 aead_ctx->variable_nonce_included_in_record = 0;
102 aead_ctx->omit_ad = 1;
103 assert(fixed_iv_len >= aead_ctx->variable_nonce_len);
104 }
105 } else {
106 assert(version < TLS1_3_VERSION);
107 aead_ctx->variable_nonce_included_in_record = 1;
108 aead_ctx->random_variable_nonce = 1;
109 aead_ctx->omit_length_in_ad = 1;
110 aead_ctx->omit_version_in_ad = (version == SSL3_VERSION);
111 }
112
113 return aead_ctx;
114 }
115
SSL_AEAD_CTX_free(SSL_AEAD_CTX * aead)116 void SSL_AEAD_CTX_free(SSL_AEAD_CTX *aead) {
117 if (aead == NULL) {
118 return;
119 }
120 EVP_AEAD_CTX_cleanup(&aead->ctx);
121 OPENSSL_free(aead);
122 }
123
SSL_AEAD_CTX_explicit_nonce_len(SSL_AEAD_CTX * aead)124 size_t SSL_AEAD_CTX_explicit_nonce_len(SSL_AEAD_CTX *aead) {
125 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
126 aead = NULL;
127 #endif
128
129 if (aead != NULL && aead->variable_nonce_included_in_record) {
130 return aead->variable_nonce_len;
131 }
132 return 0;
133 }
134
SSL_AEAD_CTX_max_overhead(SSL_AEAD_CTX * aead)135 size_t SSL_AEAD_CTX_max_overhead(SSL_AEAD_CTX *aead) {
136 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
137 aead = NULL;
138 #endif
139
140 if (aead == NULL) {
141 return 0;
142 }
143 return EVP_AEAD_max_overhead(aead->ctx.aead) +
144 SSL_AEAD_CTX_explicit_nonce_len(aead);
145 }
146
147 /* ssl_aead_ctx_get_ad writes the additional data for |aead| into |out| and
148 * returns the number of bytes written. */
ssl_aead_ctx_get_ad(SSL_AEAD_CTX * aead,uint8_t out[13],uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],size_t plaintext_len)149 static size_t ssl_aead_ctx_get_ad(SSL_AEAD_CTX *aead, uint8_t out[13],
150 uint8_t type, uint16_t wire_version,
151 const uint8_t seqnum[8],
152 size_t plaintext_len) {
153 if (aead->omit_ad) {
154 return 0;
155 }
156
157 memcpy(out, seqnum, 8);
158 size_t len = 8;
159 out[len++] = type;
160 if (!aead->omit_version_in_ad) {
161 out[len++] = (uint8_t)(wire_version >> 8);
162 out[len++] = (uint8_t)wire_version;
163 }
164 if (!aead->omit_length_in_ad) {
165 out[len++] = (uint8_t)(plaintext_len >> 8);
166 out[len++] = (uint8_t)plaintext_len;
167 }
168 return len;
169 }
170
SSL_AEAD_CTX_open(SSL_AEAD_CTX * aead,CBS * out,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],uint8_t * in,size_t in_len)171 int SSL_AEAD_CTX_open(SSL_AEAD_CTX *aead, CBS *out, uint8_t type,
172 uint16_t wire_version, const uint8_t seqnum[8],
173 uint8_t *in, size_t in_len) {
174 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
175 aead = NULL;
176 #endif
177
178 if (aead == NULL) {
179 /* Handle the initial NULL cipher. */
180 CBS_init(out, in, in_len);
181 return 1;
182 }
183
184 /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed
185 * overhead. Otherwise the parameter is unused. */
186 size_t plaintext_len = 0;
187 if (!aead->omit_length_in_ad) {
188 size_t overhead = SSL_AEAD_CTX_max_overhead(aead);
189 if (in_len < overhead) {
190 /* Publicly invalid. */
191 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
192 return 0;
193 }
194 plaintext_len = in_len - overhead;
195 }
196 uint8_t ad[13];
197 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
198 plaintext_len);
199
200 /* Assemble the nonce. */
201 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
202 size_t nonce_len = 0;
203
204 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
205 if (aead->xor_fixed_nonce) {
206 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
207 memset(nonce, 0, nonce_len);
208 } else {
209 memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
210 nonce_len += aead->fixed_nonce_len;
211 }
212
213 /* Add the variable nonce. */
214 if (aead->variable_nonce_included_in_record) {
215 if (in_len < aead->variable_nonce_len) {
216 /* Publicly invalid. */
217 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
218 return 0;
219 }
220 memcpy(nonce + nonce_len, in, aead->variable_nonce_len);
221 in += aead->variable_nonce_len;
222 in_len -= aead->variable_nonce_len;
223 } else {
224 assert(aead->variable_nonce_len == 8);
225 memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
226 }
227 nonce_len += aead->variable_nonce_len;
228
229 /* XOR the fixed nonce, if necessary. */
230 if (aead->xor_fixed_nonce) {
231 assert(nonce_len == aead->fixed_nonce_len);
232 size_t i;
233 for (i = 0; i < aead->fixed_nonce_len; i++) {
234 nonce[i] ^= aead->fixed_nonce[i];
235 }
236 }
237
238 /* Decrypt in-place. */
239 size_t len;
240 if (!EVP_AEAD_CTX_open(&aead->ctx, in, &len, in_len, nonce, nonce_len,
241 in, in_len, ad, ad_len)) {
242 return 0;
243 }
244 CBS_init(out, in, len);
245 return 1;
246 }
247
SSL_AEAD_CTX_seal(SSL_AEAD_CTX * aead,uint8_t * out,size_t * out_len,size_t max_out,uint8_t type,uint16_t wire_version,const uint8_t seqnum[8],const uint8_t * in,size_t in_len)248 int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *aead, uint8_t *out, size_t *out_len,
249 size_t max_out, uint8_t type, uint16_t wire_version,
250 const uint8_t seqnum[8], const uint8_t *in,
251 size_t in_len) {
252 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
253 aead = NULL;
254 #endif
255
256 if (aead == NULL) {
257 /* Handle the initial NULL cipher. */
258 if (in_len > max_out) {
259 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
260 return 0;
261 }
262 memmove(out, in, in_len);
263 *out_len = in_len;
264 return 1;
265 }
266
267 uint8_t ad[13];
268 size_t ad_len = ssl_aead_ctx_get_ad(aead, ad, type, wire_version, seqnum,
269 in_len);
270
271 /* Assemble the nonce. */
272 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
273 size_t nonce_len = 0;
274
275 /* Prepend the fixed nonce, or left-pad with zeros if XORing. */
276 if (aead->xor_fixed_nonce) {
277 nonce_len = aead->fixed_nonce_len - aead->variable_nonce_len;
278 memset(nonce, 0, nonce_len);
279 } else {
280 memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
281 nonce_len += aead->fixed_nonce_len;
282 }
283
284 /* Select the variable nonce. */
285 if (aead->random_variable_nonce) {
286 assert(aead->variable_nonce_included_in_record);
287 if (!RAND_bytes(nonce + nonce_len, aead->variable_nonce_len)) {
288 return 0;
289 }
290 } else {
291 /* When sending we use the sequence number as the variable part of the
292 * nonce. */
293 assert(aead->variable_nonce_len == 8);
294 memcpy(nonce + nonce_len, seqnum, aead->variable_nonce_len);
295 }
296 nonce_len += aead->variable_nonce_len;
297
298 /* Emit the variable nonce if included in the record. */
299 size_t extra_len = 0;
300 if (aead->variable_nonce_included_in_record) {
301 assert(!aead->xor_fixed_nonce);
302 if (max_out < aead->variable_nonce_len) {
303 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
304 return 0;
305 }
306 if (out < in + in_len && in < out + aead->variable_nonce_len) {
307 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
308 return 0;
309 }
310 memcpy(out, nonce + aead->fixed_nonce_len, aead->variable_nonce_len);
311 extra_len = aead->variable_nonce_len;
312 out += aead->variable_nonce_len;
313 max_out -= aead->variable_nonce_len;
314 }
315
316 /* XOR the fixed nonce, if necessary. */
317 if (aead->xor_fixed_nonce) {
318 assert(nonce_len == aead->fixed_nonce_len);
319 size_t i;
320 for (i = 0; i < aead->fixed_nonce_len; i++) {
321 nonce[i] ^= aead->fixed_nonce[i];
322 }
323 }
324
325 if (!EVP_AEAD_CTX_seal(&aead->ctx, out, out_len, max_out, nonce, nonce_len,
326 in, in_len, ad, ad_len)) {
327 return 0;
328 }
329 *out_len += extra_len;
330 return 1;
331 }
332