A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

451 lines
14 KiB

  1. /*
  2. * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "internal/cryptlib.h"
  11. #ifndef OPENSSL_NO_CHACHA
  12. # include <openssl/evp.h>
  13. # include <openssl/objects.h>
  14. # include "evp_locl.h"
  15. # include "internal/evp_int.h"
  16. # include "internal/chacha.h"
  17. typedef struct {
  18. union {
  19. double align; /* this ensures even sizeof(EVP_CHACHA_KEY)%8==0 */
  20. unsigned int d[CHACHA_KEY_SIZE / 4];
  21. } key;
  22. unsigned int counter[CHACHA_CTR_SIZE / 4];
  23. unsigned char buf[CHACHA_BLK_SIZE];
  24. unsigned int partial_len;
  25. } EVP_CHACHA_KEY;
  26. #define data(ctx) ((EVP_CHACHA_KEY *)(ctx)->cipher_data)
  27. static int chacha_init_key(EVP_CIPHER_CTX *ctx,
  28. const unsigned char user_key[CHACHA_KEY_SIZE],
  29. const unsigned char iv[CHACHA_CTR_SIZE], int enc)
  30. {
  31. EVP_CHACHA_KEY *key = data(ctx);
  32. unsigned int i;
  33. if (user_key)
  34. for (i = 0; i < CHACHA_KEY_SIZE; i+=4) {
  35. key->key.d[i/4] = CHACHA_U8TOU32(user_key+i);
  36. }
  37. if (iv)
  38. for (i = 0; i < CHACHA_CTR_SIZE; i+=4) {
  39. key->counter[i/4] = CHACHA_U8TOU32(iv+i);
  40. }
  41. key->partial_len = 0;
  42. return 1;
  43. }
  44. static int chacha_cipher(EVP_CIPHER_CTX * ctx, unsigned char *out,
  45. const unsigned char *inp, size_t len)
  46. {
  47. EVP_CHACHA_KEY *key = data(ctx);
  48. unsigned int n, rem, ctr32;
  49. if ((n = key->partial_len)) {
  50. while (len && n < CHACHA_BLK_SIZE) {
  51. *out++ = *inp++ ^ key->buf[n++];
  52. len--;
  53. }
  54. key->partial_len = n;
  55. if (len == 0)
  56. return 1;
  57. if (n == CHACHA_BLK_SIZE) {
  58. key->partial_len = 0;
  59. key->counter[0]++;
  60. if (key->counter[0] == 0)
  61. key->counter[1]++;
  62. }
  63. }
  64. rem = (unsigned int)(len % CHACHA_BLK_SIZE);
  65. len -= rem;
  66. ctr32 = key->counter[0];
  67. while (len >= CHACHA_BLK_SIZE) {
  68. size_t blocks = len / CHACHA_BLK_SIZE;
  69. /*
  70. * 1<<28 is just a not-so-small yet not-so-large number...
  71. * Below condition is practically never met, but it has to
  72. * be checked for code correctness.
  73. */
  74. if (sizeof(size_t)>sizeof(unsigned int) && blocks>(1U<<28))
  75. blocks = (1U<<28);
  76. /*
  77. * As ChaCha20_ctr32 operates on 32-bit counter, caller
  78. * has to handle overflow. 'if' below detects the
  79. * overflow, which is then handled by limiting the
  80. * amount of blocks to the exact overflow point...
  81. */
  82. ctr32 += (unsigned int)blocks;
  83. if (ctr32 < blocks) {
  84. blocks -= ctr32;
  85. ctr32 = 0;
  86. }
  87. blocks *= CHACHA_BLK_SIZE;
  88. ChaCha20_ctr32(out, inp, blocks, key->key.d, key->counter);
  89. len -= blocks;
  90. inp += blocks;
  91. out += blocks;
  92. key->counter[0] = ctr32;
  93. if (ctr32 == 0) key->counter[1]++;
  94. }
  95. if (rem) {
  96. memset(key->buf, 0, sizeof(key->buf));
  97. ChaCha20_ctr32(key->buf, key->buf, CHACHA_BLK_SIZE,
  98. key->key.d, key->counter);
  99. for (n = 0; n < rem; n++)
  100. out[n] = inp[n] ^ key->buf[n];
  101. key->partial_len = rem;
  102. }
  103. return 1;
  104. }
  105. static const EVP_CIPHER chacha20 = {
  106. NID_chacha20,
  107. 1, /* block_size */
  108. CHACHA_KEY_SIZE, /* key_len */
  109. CHACHA_CTR_SIZE, /* iv_len, 128-bit counter in the context */
  110. 0, /* flags */
  111. chacha_init_key,
  112. chacha_cipher,
  113. NULL,
  114. sizeof(EVP_CHACHA_KEY),
  115. NULL,
  116. NULL,
  117. NULL,
  118. NULL
  119. };
  120. const EVP_CIPHER *EVP_chacha20(void)
  121. {
  122. return (&chacha20);
  123. }
  124. # ifndef OPENSSL_NO_POLY1305
  125. # include "internal/poly1305.h"
  126. typedef struct {
  127. EVP_CHACHA_KEY key;
  128. unsigned int nonce[12/4];
  129. unsigned char tag[POLY1305_BLOCK_SIZE];
  130. struct { uint64_t aad, text; } len;
  131. int aad, mac_inited, tag_len, nonce_len;
  132. size_t tls_payload_length;
  133. } EVP_CHACHA_AEAD_CTX;
  134. # define NO_TLS_PAYLOAD_LENGTH ((size_t)-1)
  135. # define aead_data(ctx) ((EVP_CHACHA_AEAD_CTX *)(ctx)->cipher_data)
  136. # define POLY1305_ctx(actx) ((POLY1305 *)(actx + 1))
  137. static int chacha20_poly1305_init_key(EVP_CIPHER_CTX *ctx,
  138. const unsigned char *inkey,
  139. const unsigned char *iv, int enc)
  140. {
  141. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  142. if (!inkey && !iv)
  143. return 1;
  144. actx->len.aad = 0;
  145. actx->len.text = 0;
  146. actx->aad = 0;
  147. actx->mac_inited = 0;
  148. actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  149. if (iv != NULL) {
  150. unsigned char temp[CHACHA_CTR_SIZE] = { 0 };
  151. /* pad on the left */
  152. if (actx->nonce_len <= CHACHA_CTR_SIZE)
  153. memcpy(temp + CHACHA_CTR_SIZE - actx->nonce_len, iv, actx->nonce_len);
  154. chacha_init_key(ctx, inkey, temp, enc);
  155. actx->nonce[0] = actx->key.counter[1];
  156. actx->nonce[1] = actx->key.counter[2];
  157. actx->nonce[2] = actx->key.counter[3];
  158. } else {
  159. chacha_init_key(ctx, inkey, NULL, enc);
  160. }
  161. return 1;
  162. }
  163. static int chacha20_poly1305_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
  164. const unsigned char *in, size_t len)
  165. {
  166. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  167. size_t rem, plen = actx->tls_payload_length;
  168. static const unsigned char zero[POLY1305_BLOCK_SIZE] = { 0 };
  169. if (!actx->mac_inited) {
  170. actx->key.counter[0] = 0;
  171. memset(actx->key.buf, 0, sizeof(actx->key.buf));
  172. ChaCha20_ctr32(actx->key.buf, actx->key.buf, CHACHA_BLK_SIZE,
  173. actx->key.key.d, actx->key.counter);
  174. Poly1305_Init(POLY1305_ctx(actx), actx->key.buf);
  175. actx->key.counter[0] = 1;
  176. actx->key.partial_len = 0;
  177. actx->len.aad = actx->len.text = 0;
  178. actx->mac_inited = 1;
  179. }
  180. if (in) { /* aad or text */
  181. if (out == NULL) { /* aad */
  182. Poly1305_Update(POLY1305_ctx(actx), in, len);
  183. actx->len.aad += len;
  184. actx->aad = 1;
  185. return len;
  186. } else { /* plain- or ciphertext */
  187. if (actx->aad) { /* wrap up aad */
  188. if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
  189. Poly1305_Update(POLY1305_ctx(actx), zero,
  190. POLY1305_BLOCK_SIZE - rem);
  191. actx->aad = 0;
  192. }
  193. actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  194. if (plen == NO_TLS_PAYLOAD_LENGTH)
  195. plen = len;
  196. else if (len != plen + POLY1305_BLOCK_SIZE)
  197. return -1;
  198. if (ctx->encrypt) { /* plaintext */
  199. chacha_cipher(ctx, out, in, plen);
  200. Poly1305_Update(POLY1305_ctx(actx), out, plen);
  201. in += plen;
  202. out += plen;
  203. actx->len.text += plen;
  204. } else { /* ciphertext */
  205. Poly1305_Update(POLY1305_ctx(actx), in, plen);
  206. chacha_cipher(ctx, out, in, plen);
  207. in += plen;
  208. out += plen;
  209. actx->len.text += plen;
  210. }
  211. }
  212. }
  213. if (in == NULL /* explicit final */
  214. || plen != len) { /* or tls mode */
  215. const union {
  216. long one;
  217. char little;
  218. } is_endian = { 1 };
  219. unsigned char temp[POLY1305_BLOCK_SIZE];
  220. if (actx->aad) { /* wrap up aad */
  221. if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
  222. Poly1305_Update(POLY1305_ctx(actx), zero,
  223. POLY1305_BLOCK_SIZE - rem);
  224. actx->aad = 0;
  225. }
  226. if ((rem = (size_t)actx->len.text % POLY1305_BLOCK_SIZE))
  227. Poly1305_Update(POLY1305_ctx(actx), zero,
  228. POLY1305_BLOCK_SIZE - rem);
  229. if (is_endian.little) {
  230. Poly1305_Update(POLY1305_ctx(actx),
  231. (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
  232. } else {
  233. temp[0] = (unsigned char)(actx->len.aad);
  234. temp[1] = (unsigned char)(actx->len.aad>>8);
  235. temp[2] = (unsigned char)(actx->len.aad>>16);
  236. temp[3] = (unsigned char)(actx->len.aad>>24);
  237. temp[4] = (unsigned char)(actx->len.aad>>32);
  238. temp[5] = (unsigned char)(actx->len.aad>>40);
  239. temp[6] = (unsigned char)(actx->len.aad>>48);
  240. temp[7] = (unsigned char)(actx->len.aad>>56);
  241. temp[8] = (unsigned char)(actx->len.text);
  242. temp[9] = (unsigned char)(actx->len.text>>8);
  243. temp[10] = (unsigned char)(actx->len.text>>16);
  244. temp[11] = (unsigned char)(actx->len.text>>24);
  245. temp[12] = (unsigned char)(actx->len.text>>32);
  246. temp[13] = (unsigned char)(actx->len.text>>40);
  247. temp[14] = (unsigned char)(actx->len.text>>48);
  248. temp[15] = (unsigned char)(actx->len.text>>56);
  249. Poly1305_Update(POLY1305_ctx(actx), temp, POLY1305_BLOCK_SIZE);
  250. }
  251. Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag
  252. : temp);
  253. actx->mac_inited = 0;
  254. if (in != NULL && len != plen) { /* tls mode */
  255. if (ctx->encrypt) {
  256. memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
  257. } else {
  258. if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
  259. memset(out, 0, plen);
  260. return -1;
  261. }
  262. }
  263. }
  264. else if (!ctx->encrypt) {
  265. if (CRYPTO_memcmp(temp, actx->tag, actx->tag_len))
  266. return -1;
  267. }
  268. }
  269. return len;
  270. }
  271. static int chacha20_poly1305_cleanup(EVP_CIPHER_CTX *ctx)
  272. {
  273. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  274. if (actx)
  275. OPENSSL_cleanse(ctx->cipher_data, sizeof(*ctx) + Poly1305_ctx_size());
  276. return 1;
  277. }
  278. static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
  279. void *ptr)
  280. {
  281. EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
  282. switch(type) {
  283. case EVP_CTRL_INIT:
  284. if (actx == NULL)
  285. actx = ctx->cipher_data
  286. = OPENSSL_zalloc(sizeof(*actx) + Poly1305_ctx_size());
  287. if (actx == NULL) {
  288. EVPerr(EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_INITIALIZATION_ERROR);
  289. return 0;
  290. }
  291. actx->len.aad = 0;
  292. actx->len.text = 0;
  293. actx->aad = 0;
  294. actx->mac_inited = 0;
  295. actx->tag_len = 0;
  296. actx->nonce_len = 12;
  297. actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
  298. return 1;
  299. case EVP_CTRL_COPY:
  300. if (actx) {
  301. if ((((EVP_CIPHER_CTX *)ptr)->cipher_data =
  302. OPENSSL_memdup(actx,sizeof(*actx) + Poly1305_ctx_size()))
  303. == NULL) {
  304. EVPerr(EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_COPY_ERROR);
  305. return 0;
  306. }
  307. }
  308. return 1;
  309. case EVP_CTRL_AEAD_SET_IVLEN:
  310. if (arg <= 0 || arg > CHACHA_CTR_SIZE)
  311. return 0;
  312. actx->nonce_len = arg;
  313. return 1;
  314. case EVP_CTRL_AEAD_SET_IV_FIXED:
  315. if (arg != 12)
  316. return 0;
  317. actx->nonce[0] = actx->key.counter[1]
  318. = CHACHA_U8TOU32((unsigned char *)ptr);
  319. actx->nonce[1] = actx->key.counter[2]
  320. = CHACHA_U8TOU32((unsigned char *)ptr+4);
  321. actx->nonce[2] = actx->key.counter[3]
  322. = CHACHA_U8TOU32((unsigned char *)ptr+8);
  323. return 1;
  324. case EVP_CTRL_AEAD_SET_TAG:
  325. if (arg <= 0 || arg > POLY1305_BLOCK_SIZE)
  326. return 0;
  327. if (ptr != NULL) {
  328. memcpy(actx->tag, ptr, arg);
  329. actx->tag_len = arg;
  330. }
  331. return 1;
  332. case EVP_CTRL_AEAD_GET_TAG:
  333. if (arg <= 0 || arg > POLY1305_BLOCK_SIZE || !ctx->encrypt)
  334. return 0;
  335. memcpy(ptr, actx->tag, arg);
  336. return 1;
  337. case EVP_CTRL_AEAD_TLS1_AAD:
  338. if (arg != EVP_AEAD_TLS1_AAD_LEN)
  339. return 0;
  340. {
  341. unsigned int len;
  342. unsigned char *aad = ptr, temp[POLY1305_BLOCK_SIZE];
  343. len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 |
  344. aad[EVP_AEAD_TLS1_AAD_LEN - 1];
  345. if (!ctx->encrypt) {
  346. len -= POLY1305_BLOCK_SIZE; /* discount attached tag */
  347. memcpy(temp, aad, EVP_AEAD_TLS1_AAD_LEN - 2);
  348. aad = temp;
  349. temp[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
  350. temp[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
  351. }
  352. actx->tls_payload_length = len;
  353. /*
  354. * merge record sequence number as per
  355. * draft-ietf-tls-chacha20-poly1305-03
  356. */
  357. actx->key.counter[1] = actx->nonce[0];
  358. actx->key.counter[2] = actx->nonce[1] ^ CHACHA_U8TOU32(aad);
  359. actx->key.counter[3] = actx->nonce[2] ^ CHACHA_U8TOU32(aad+4);
  360. actx->mac_inited = 0;
  361. chacha20_poly1305_cipher(ctx, NULL, aad, EVP_AEAD_TLS1_AAD_LEN);
  362. return POLY1305_BLOCK_SIZE; /* tag length */
  363. }
  364. case EVP_CTRL_AEAD_SET_MAC_KEY:
  365. /* no-op */
  366. return 1;
  367. default:
  368. return -1;
  369. }
  370. }
  371. static EVP_CIPHER chacha20_poly1305 = {
  372. NID_chacha20_poly1305,
  373. 1, /* block_size */
  374. CHACHA_KEY_SIZE, /* key_len */
  375. 12, /* iv_len, 96-bit nonce in the context */
  376. EVP_CIPH_FLAG_AEAD_CIPHER | EVP_CIPH_CUSTOM_IV |
  377. EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
  378. EVP_CIPH_CUSTOM_COPY | EVP_CIPH_FLAG_CUSTOM_CIPHER,
  379. chacha20_poly1305_init_key,
  380. chacha20_poly1305_cipher,
  381. chacha20_poly1305_cleanup,
  382. 0, /* 0 moves context-specific structure allocation to ctrl */
  383. NULL, /* set_asn1_parameters */
  384. NULL, /* get_asn1_parameters */
  385. chacha20_poly1305_ctrl,
  386. NULL /* app_data */
  387. };
  388. const EVP_CIPHER *EVP_chacha20_poly1305(void)
  389. {
  390. return(&chacha20_poly1305);
  391. }
  392. # endif
  393. #endif