1 /* $OpenBSD: cmac.c,v 1.17 2023/12/15 13:45:05 tb Exp $ */ 2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 3 * project. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2010 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 */ 53 54 #include <stdio.h> 55 #include <stdlib.h> 56 #include <string.h> 57 58 #include <openssl/cmac.h> 59 60 #include "evp_local.h" 61 62 /* 63 * This implementation follows https://doi.org/10.6028/NIST.SP.800-38B 64 */ 65 66 /* 67 * CMAC context. k1 and k2 are the secret subkeys, computed as in section 6.1. 68 * The temporary block tbl is a scratch buffer that holds intermediate secrets. 69 */ 70 struct CMAC_CTX_st { 71 EVP_CIPHER_CTX cctx; 72 unsigned char k1[EVP_MAX_BLOCK_LENGTH]; 73 unsigned char k2[EVP_MAX_BLOCK_LENGTH]; 74 unsigned char tbl[EVP_MAX_BLOCK_LENGTH]; 75 unsigned char last_block[EVP_MAX_BLOCK_LENGTH]; 76 /* Bytes in last block. -1 means not initialized. */ 77 int nlast_block; 78 }; 79 80 /* 81 * SP 800-38B, section 6.1, steps 2 and 3: given the input key l, calculate 82 * the subkeys k1 and k2: shift l one bit to the left. If the most significant 83 * bit of l was 1, additionally xor the result with Rb to get kn. 84 * 85 * Step 2: calculate k1 with l being the intermediate block CIPH_K(0), 86 * Step 3: calculate k2 from l == k1. 87 * 88 * Per 5.3, Rb is the lexically first irreducible polynomial of degree b with 89 * the minimum number of non-zero terms. This gives R128 = (1 << 128) | 0x87 90 * and R64 = (1 << 64) | 0x1b for the only supported block sizes 128 and 64. 91 */ 92 static void 93 make_kn(unsigned char *kn, const unsigned char *l, int bl) 94 { 95 unsigned char mask, Rb; 96 int i; 97 98 /* Choose Rb according to the block size in bytes. */ 99 Rb = bl == 16 ? 0x87 : 0x1b; 100 101 /* Compute l << 1 up to last byte. */ 102 for (i = 0; i < bl - 1; i++) 103 kn[i] = (l[i] << 1) | (l[i + 1] >> 7); 104 105 /* Only xor with Rb if the MSB is one. */ 106 mask = 0 - (l[0] >> 7); 107 kn[bl - 1] = (l[bl - 1] << 1) ^ (Rb & mask); 108 } 109 110 CMAC_CTX * 111 CMAC_CTX_new(void) 112 { 113 CMAC_CTX *ctx; 114 115 ctx = malloc(sizeof(CMAC_CTX)); 116 if (!ctx) 117 return NULL; 118 EVP_CIPHER_CTX_init(&ctx->cctx); 119 ctx->nlast_block = -1; 120 return ctx; 121 } 122 LCRYPTO_ALIAS(CMAC_CTX_new); 123 124 void 125 CMAC_CTX_cleanup(CMAC_CTX *ctx) 126 { 127 EVP_CIPHER_CTX_cleanup(&ctx->cctx); 128 explicit_bzero(ctx->tbl, EVP_MAX_BLOCK_LENGTH); 129 explicit_bzero(ctx->k1, EVP_MAX_BLOCK_LENGTH); 130 explicit_bzero(ctx->k2, EVP_MAX_BLOCK_LENGTH); 131 explicit_bzero(ctx->last_block, EVP_MAX_BLOCK_LENGTH); 132 ctx->nlast_block = -1; 133 } 134 LCRYPTO_ALIAS(CMAC_CTX_cleanup); 135 136 EVP_CIPHER_CTX * 137 CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx) 138 { 139 return &ctx->cctx; 140 } 141 LCRYPTO_ALIAS(CMAC_CTX_get0_cipher_ctx); 142 143 void 144 CMAC_CTX_free(CMAC_CTX *ctx) 145 { 146 if (ctx == NULL) 147 return; 148 149 CMAC_CTX_cleanup(ctx); 150 free(ctx); 151 } 152 LCRYPTO_ALIAS(CMAC_CTX_free); 153 154 int 155 CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in) 156 { 157 int bl; 158 159 if (in->nlast_block == -1) 160 return 0; 161 if (!EVP_CIPHER_CTX_copy(&out->cctx, &in->cctx)) 162 return 0; 163 bl = EVP_CIPHER_CTX_block_size(&in->cctx); 164 memcpy(out->k1, in->k1, bl); 165 memcpy(out->k2, in->k2, bl); 166 memcpy(out->tbl, in->tbl, bl); 167 memcpy(out->last_block, in->last_block, bl); 168 out->nlast_block = in->nlast_block; 169 return 1; 170 } 171 LCRYPTO_ALIAS(CMAC_CTX_copy); 172 173 int 174 CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen, 175 const EVP_CIPHER *cipher, ENGINE *impl) 176 { 177 static unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH]; 178 int bl; 179 180 /* All zeros means restart */ 181 if (key == NULL && cipher == NULL && keylen == 0) { 182 /* Not initialised */ 183 if (ctx->nlast_block == -1) 184 return 0; 185 if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, NULL, zero_iv)) 186 return 0; 187 explicit_bzero(ctx->tbl, sizeof(ctx->tbl)); 188 ctx->nlast_block = 0; 189 return 1; 190 } 191 192 /* Initialise context. */ 193 if (cipher != NULL) { 194 /* 195 * Disallow ciphers for which EVP_Cipher() behaves differently. 196 * These are AEAD ciphers (or AES keywrap) for which the CMAC 197 * construction makes little sense. 198 */ 199 if ((cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) != 0) 200 return 0; 201 if (!EVP_EncryptInit_ex(&ctx->cctx, cipher, NULL, NULL, NULL)) 202 return 0; 203 } 204 205 /* Non-NULL key means initialisation is complete. */ 206 if (key != NULL) { 207 if (EVP_CIPHER_CTX_cipher(&ctx->cctx) == NULL) 208 return 0; 209 210 /* make_kn() only supports block sizes of 8 and 16 bytes. */ 211 bl = EVP_CIPHER_CTX_block_size(&ctx->cctx); 212 if (bl != 8 && bl != 16) 213 return 0; 214 215 /* 216 * Section 6.1, step 1: store the intermediate secret CIPH_K(0) 217 * in ctx->tbl. 218 */ 219 if (!EVP_CIPHER_CTX_set_key_length(&ctx->cctx, keylen)) 220 return 0; 221 if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, key, zero_iv)) 222 return 0; 223 if (!EVP_Cipher(&ctx->cctx, ctx->tbl, zero_iv, bl)) 224 return 0; 225 226 /* Section 6.1, step 2: compute k1 from intermediate secret. */ 227 make_kn(ctx->k1, ctx->tbl, bl); 228 /* Section 6.1, step 3: compute k2 from k1. */ 229 make_kn(ctx->k2, ctx->k1, bl); 230 231 /* Destroy intermediate secret and reset last block count. */ 232 explicit_bzero(ctx->tbl, sizeof(ctx->tbl)); 233 ctx->nlast_block = 0; 234 235 /* Reset context again to get ready for the first data block. */ 236 if (!EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, NULL, zero_iv)) 237 return 0; 238 } 239 240 return 1; 241 } 242 LCRYPTO_ALIAS(CMAC_Init); 243 244 int 245 CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen) 246 { 247 const unsigned char *data = in; 248 size_t bl; 249 250 if (ctx->nlast_block == -1) 251 return 0; 252 if (dlen == 0) 253 return 1; 254 bl = EVP_CIPHER_CTX_block_size(&ctx->cctx); 255 /* Copy into partial block if we need to */ 256 if (ctx->nlast_block > 0) { 257 size_t nleft; 258 259 nleft = bl - ctx->nlast_block; 260 if (dlen < nleft) 261 nleft = dlen; 262 memcpy(ctx->last_block + ctx->nlast_block, data, nleft); 263 dlen -= nleft; 264 ctx->nlast_block += nleft; 265 /* If no more to process return */ 266 if (dlen == 0) 267 return 1; 268 data += nleft; 269 /* Else not final block so encrypt it */ 270 if (!EVP_Cipher(&ctx->cctx, ctx->tbl, ctx->last_block, bl)) 271 return 0; 272 } 273 /* Encrypt all but one of the complete blocks left */ 274 while (dlen > bl) { 275 if (!EVP_Cipher(&ctx->cctx, ctx->tbl, data, bl)) 276 return 0; 277 dlen -= bl; 278 data += bl; 279 } 280 /* Copy any data left to last block buffer */ 281 memcpy(ctx->last_block, data, dlen); 282 ctx->nlast_block = dlen; 283 return 1; 284 } 285 LCRYPTO_ALIAS(CMAC_Update); 286 287 int 288 CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen) 289 { 290 int i, bl, lb; 291 292 if (ctx->nlast_block == -1) 293 return 0; 294 bl = EVP_CIPHER_CTX_block_size(&ctx->cctx); 295 *poutlen = (size_t)bl; 296 if (!out) 297 return 1; 298 lb = ctx->nlast_block; 299 /* Is last block complete? */ 300 if (lb == bl) { 301 for (i = 0; i < bl; i++) 302 out[i] = ctx->last_block[i] ^ ctx->k1[i]; 303 } else { 304 ctx->last_block[lb] = 0x80; 305 if (bl - lb > 1) 306 memset(ctx->last_block + lb + 1, 0, bl - lb - 1); 307 for (i = 0; i < bl; i++) 308 out[i] = ctx->last_block[i] ^ ctx->k2[i]; 309 } 310 if (!EVP_Cipher(&ctx->cctx, out, out, bl)) { 311 explicit_bzero(out, bl); 312 return 0; 313 } 314 return 1; 315 } 316 LCRYPTO_ALIAS(CMAC_Final); 317 318 int 319 CMAC_resume(CMAC_CTX *ctx) 320 { 321 if (ctx->nlast_block == -1) 322 return 0; 323 /* The buffer "tbl" containes the last fully encrypted block 324 * which is the last IV (or all zeroes if no last encrypted block). 325 * The last block has not been modified since CMAC_final(). 326 * So reinitialising using the last decrypted block will allow 327 * CMAC to continue after calling CMAC_Final(). 328 */ 329 return EVP_EncryptInit_ex(&ctx->cctx, NULL, NULL, NULL, ctx->tbl); 330 } 331 LCRYPTO_ALIAS(CMAC_resume); 332