1/*
2 * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License").  You may not use
5 * this file except in compliance with the License.  You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/* Dispatch functions for gcm mode */
11
12#include <openssl/rand.h>
13#include <openssl/proverr.h>
14#include "prov/ciphercommon.h"
15#include "prov/ciphercommon_gcm.h"
16#include "prov/providercommon.h"
17#include "prov/provider_ctx.h"
18
19static int gcm_tls_init(PROV_GCM_CTX *dat, unsigned char *aad, size_t aad_len);
20static int gcm_tls_iv_set_fixed(PROV_GCM_CTX *ctx, unsigned char *iv,
21                                size_t len);
22static int gcm_tls_cipher(PROV_GCM_CTX *ctx, unsigned char *out, size_t *padlen,
23                          const unsigned char *in, size_t len);
24static int gcm_cipher_internal(PROV_GCM_CTX *ctx, unsigned char *out,
25                               size_t *padlen, const unsigned char *in,
26                               size_t len);
27
28/*
29 * Called from EVP_CipherInit when there is currently no context via
30 * the new_ctx() function
31 */
32void ossl_gcm_initctx(void *provctx, PROV_GCM_CTX *ctx, size_t keybits,
33                      const PROV_GCM_HW *hw)
34{
35    ctx->pad = 1;
36    ctx->mode = EVP_CIPH_GCM_MODE;
37    ctx->taglen = UNINITIALISED_SIZET;
38    ctx->tls_aad_len = UNINITIALISED_SIZET;
39    ctx->ivlen = (EVP_GCM_TLS_FIXED_IV_LEN + EVP_GCM_TLS_EXPLICIT_IV_LEN);
40    ctx->keylen = keybits / 8;
41    ctx->hw = hw;
42    ctx->libctx = PROV_LIBCTX_OF(provctx);
43}
44
45/*
46 * Called by EVP_CipherInit via the _einit and _dinit functions
47 */
48static int gcm_init(void *vctx, const unsigned char *key, size_t keylen,
49                    const unsigned char *iv, size_t ivlen,
50                    const OSSL_PARAM params[], int enc)
51{
52    PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
53
54    if (!ossl_prov_is_running())
55        return 0;
56
57    ctx->enc = enc;
58
59    if (iv != NULL) {
60        if (ivlen == 0 || ivlen > sizeof(ctx->iv)) {
61            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
62            return 0;
63        }
64        ctx->ivlen = ivlen;
65        memcpy(ctx->iv, iv, ivlen);
66        ctx->iv_state = IV_STATE_BUFFERED;
67    }
68
69    if (key != NULL) {
70        if (keylen != ctx->keylen) {
71            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
72            return 0;
73        }
74        if (!ctx->hw->setkey(ctx, key, ctx->keylen))
75            return 0;
76        ctx->tls_enc_records = 0;
77    }
78    return ossl_gcm_set_ctx_params(ctx, params);
79}
80
81int ossl_gcm_einit(void *vctx, const unsigned char *key, size_t keylen,
82                   const unsigned char *iv, size_t ivlen,
83                   const OSSL_PARAM params[])
84{
85    return gcm_init(vctx, key, keylen, iv, ivlen, params, 1);
86}
87
88int ossl_gcm_dinit(void *vctx, const unsigned char *key, size_t keylen,
89                   const unsigned char *iv, size_t ivlen,
90                   const OSSL_PARAM params[])
91{
92    return gcm_init(vctx, key, keylen, iv, ivlen, params, 0);
93}
94
95/* increment counter (64-bit int) by 1 */
96static void ctr64_inc(unsigned char *counter)
97{
98    int n = 8;
99    unsigned char c;
100
101    do {
102        --n;
103        c = counter[n];
104        ++c;
105        counter[n] = c;
106        if (c > 0)
107            return;
108    } while (n > 0);
109}
110
111static int getivgen(PROV_GCM_CTX *ctx, unsigned char *out, size_t olen)
112{
113    if (!ctx->iv_gen
114        || !ctx->key_set
115        || !ctx->hw->setiv(ctx, ctx->iv, ctx->ivlen))
116        return 0;
117    if (olen == 0 || olen > ctx->ivlen)
118        olen = ctx->ivlen;
119    memcpy(out, ctx->iv + ctx->ivlen - olen, olen);
120    /*
121     * Invocation field will be at least 8 bytes in size and so no need
122     * to check wrap around or increment more than last 8 bytes.
123     */
124    ctr64_inc(ctx->iv + ctx->ivlen - 8);
125    ctx->iv_state = IV_STATE_COPIED;
126    return 1;
127}
128
129static int setivinv(PROV_GCM_CTX *ctx, unsigned char *in, size_t inl)
130{
131    if (!ctx->iv_gen
132        || !ctx->key_set
133        || ctx->enc)
134        return 0;
135
136    memcpy(ctx->iv + ctx->ivlen - inl, in, inl);
137    if (!ctx->hw->setiv(ctx, ctx->iv, ctx->ivlen))
138        return 0;
139    ctx->iv_state = IV_STATE_COPIED;
140    return 1;
141}
142
143int ossl_gcm_get_ctx_params(void *vctx, OSSL_PARAM params[])
144{
145    PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
146    OSSL_PARAM *p;
147    size_t sz;
148
149    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IVLEN);
150    if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->ivlen)) {
151        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
152        return 0;
153    }
154    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_KEYLEN);
155    if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->keylen)) {
156        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
157        return 0;
158    }
159    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAGLEN);
160    if (p != NULL) {
161        size_t taglen = (ctx->taglen != UNINITIALISED_SIZET) ? ctx->taglen :
162                         GCM_TAG_MAX_SIZE;
163
164        if (!OSSL_PARAM_set_size_t(p, taglen)) {
165            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
166            return 0;
167        }
168    }
169
170    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_IV);
171    if (p != NULL) {
172        if (ctx->iv_state == IV_STATE_UNINITIALISED)
173            return 0;
174        if (ctx->ivlen > p->data_size) {
175            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
176            return 0;
177        }
178        if (!OSSL_PARAM_set_octet_string(p, ctx->iv, ctx->ivlen)
179            && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, ctx->ivlen)) {
180            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
181            return 0;
182        }
183    }
184
185    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_UPDATED_IV);
186    if (p != NULL) {
187        if (ctx->iv_state == IV_STATE_UNINITIALISED)
188            return 0;
189        if (ctx->ivlen > p->data_size) {
190            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
191            return 0;
192        }
193        if (!OSSL_PARAM_set_octet_string(p, ctx->iv, ctx->ivlen)
194            && !OSSL_PARAM_set_octet_ptr(p, &ctx->iv, ctx->ivlen)) {
195            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
196            return 0;
197        }
198    }
199
200    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD);
201    if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->tls_aad_pad_sz)) {
202        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
203        return 0;
204    }
205    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TAG);
206    if (p != NULL) {
207        sz = p->data_size;
208        if (sz == 0
209            || sz > EVP_GCM_TLS_TAG_LEN
210            || !ctx->enc
211            || ctx->taglen == UNINITIALISED_SIZET) {
212            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG);
213            return 0;
214        }
215        if (!OSSL_PARAM_set_octet_string(p, ctx->buf, sz)) {
216            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_SET_PARAMETER);
217            return 0;
218        }
219    }
220    p = OSSL_PARAM_locate(params, OSSL_CIPHER_PARAM_AEAD_TLS1_GET_IV_GEN);
221    if (p != NULL) {
222        if (p->data == NULL
223            || p->data_type != OSSL_PARAM_OCTET_STRING
224            || !getivgen(ctx, p->data, p->data_size))
225            return 0;
226    }
227    return 1;
228}
229
230int ossl_gcm_set_ctx_params(void *vctx, const OSSL_PARAM params[])
231{
232    PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
233    const OSSL_PARAM *p;
234    size_t sz;
235    void *vp;
236
237    if (params == NULL)
238        return 1;
239
240    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TAG);
241    if (p != NULL) {
242        vp = ctx->buf;
243        if (!OSSL_PARAM_get_octet_string(p, &vp, EVP_GCM_TLS_TAG_LEN, &sz)) {
244            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
245            return 0;
246        }
247        if (sz == 0 || ctx->enc) {
248            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG);
249            return 0;
250        }
251        ctx->taglen = sz;
252    }
253
254    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_IVLEN);
255    if (p != NULL) {
256        if (!OSSL_PARAM_get_size_t(p, &sz)) {
257            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
258            return 0;
259        }
260        if (sz == 0 || sz > sizeof(ctx->iv)) {
261            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_IV_LENGTH);
262            return 0;
263        }
264        if (ctx->ivlen != sz) {
265            /* If the iv was already set or autogenerated, it is invalid. */
266            if (ctx->iv_state != IV_STATE_UNINITIALISED)
267                ctx->iv_state = IV_STATE_FINISHED;
268            ctx->ivlen = sz;
269        }
270    }
271
272    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_AAD);
273    if (p != NULL) {
274        if (p->data_type != OSSL_PARAM_OCTET_STRING) {
275            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
276            return 0;
277        }
278        sz = gcm_tls_init(ctx, p->data, p->data_size);
279        if (sz == 0) {
280            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_AAD);
281            return 0;
282        }
283        ctx->tls_aad_pad_sz = sz;
284    }
285
286    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED);
287    if (p != NULL) {
288        if (p->data_type != OSSL_PARAM_OCTET_STRING) {
289            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
290            return 0;
291        }
292        if (gcm_tls_iv_set_fixed(ctx, p->data, p->data_size) == 0) {
293            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
294            return 0;
295        }
296    }
297    p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_AEAD_TLS1_SET_IV_INV);
298    if (p != NULL) {
299        if (p->data == NULL
300            || p->data_type != OSSL_PARAM_OCTET_STRING
301            || !setivinv(ctx, p->data, p->data_size))
302            return 0;
303    }
304
305
306    return 1;
307}
308
309int ossl_gcm_stream_update(void *vctx, unsigned char *out, size_t *outl,
310                           size_t outsize, const unsigned char *in, size_t inl)
311{
312    PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
313
314    if (inl == 0) {
315        *outl = 0;
316        return 1;
317    }
318
319    if (outsize < inl) {
320        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
321        return 0;
322    }
323
324    if (gcm_cipher_internal(ctx, out, outl, in, inl) <= 0) {
325        ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
326        return 0;
327    }
328    return 1;
329}
330
331int ossl_gcm_stream_final(void *vctx, unsigned char *out, size_t *outl,
332                          size_t outsize)
333{
334    PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
335    int i;
336
337    if (!ossl_prov_is_running())
338        return 0;
339
340    i = gcm_cipher_internal(ctx, out, outl, NULL, 0);
341    if (i <= 0)
342        return 0;
343
344    *outl = 0;
345    return 1;
346}
347
348int ossl_gcm_cipher(void *vctx,
349                    unsigned char *out, size_t *outl, size_t outsize,
350                    const unsigned char *in, size_t inl)
351{
352    PROV_GCM_CTX *ctx = (PROV_GCM_CTX *)vctx;
353
354    if (!ossl_prov_is_running())
355        return 0;
356
357    if (outsize < inl) {
358        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
359        return 0;
360    }
361
362    if (gcm_cipher_internal(ctx, out, outl, in, inl) <= 0)
363        return 0;
364
365    *outl = inl;
366    return 1;
367}
368
369/*
370 * See SP800-38D (GCM) Section 8 "Uniqueness requirement on IVS and keys"
371 *
372 * See also 8.2.2 RBG-based construction.
373 * Random construction consists of a free field (which can be NULL) and a
374 * random field which will use a DRBG that can return at least 96 bits of
375 * entropy strength. (The DRBG must be seeded by the FIPS module).
376 */
377static int gcm_iv_generate(PROV_GCM_CTX *ctx, int offset)
378{
379    int sz = ctx->ivlen - offset;
380
381    /* Must be at least 96 bits */
382    if (sz <= 0 || ctx->ivlen < GCM_IV_DEFAULT_SIZE)
383        return 0;
384
385    /* Use DRBG to generate random iv */
386    if (RAND_bytes_ex(ctx->libctx, ctx->iv + offset, sz, 0) <= 0)
387        return 0;
388    ctx->iv_state = IV_STATE_BUFFERED;
389    ctx->iv_gen_rand = 1;
390    return 1;
391}
392
393static int gcm_cipher_internal(PROV_GCM_CTX *ctx, unsigned char *out,
394                               size_t *padlen, const unsigned char *in,
395                               size_t len)
396{
397    size_t olen = 0;
398    int rv = 0;
399    const PROV_GCM_HW *hw = ctx->hw;
400
401    if (ctx->tls_aad_len != UNINITIALISED_SIZET)
402        return gcm_tls_cipher(ctx, out, padlen, in, len);
403
404    if (!ctx->key_set || ctx->iv_state == IV_STATE_FINISHED)
405        goto err;
406
407    /*
408     * FIPS requires generation of AES-GCM IV's inside the FIPS module.
409     * The IV can still be set externally (the security policy will state that
410     * this is not FIPS compliant). There are some applications
411     * where setting the IV externally is the only option available.
412     */
413    if (ctx->iv_state == IV_STATE_UNINITIALISED) {
414        if (!ctx->enc || !gcm_iv_generate(ctx, 0))
415            goto err;
416    }
417
418    if (ctx->iv_state == IV_STATE_BUFFERED) {
419        if (!hw->setiv(ctx, ctx->iv, ctx->ivlen))
420            goto err;
421        ctx->iv_state = IV_STATE_COPIED;
422    }
423
424    if (in != NULL) {
425        /*  The input is AAD if out is NULL */
426        if (out == NULL) {
427            if (!hw->aadupdate(ctx, in, len))
428                goto err;
429        } else {
430            /* The input is ciphertext OR plaintext */
431            if (!hw->cipherupdate(ctx, in, len, out))
432                goto err;
433        }
434    } else {
435        /* The tag must be set before actually decrypting data */
436        if (!ctx->enc && ctx->taglen == UNINITIALISED_SIZET)
437            goto err;
438        if (!hw->cipherfinal(ctx, ctx->buf))
439            goto err;
440        ctx->iv_state = IV_STATE_FINISHED; /* Don't reuse the IV */
441        goto finish;
442    }
443    olen = len;
444finish:
445    rv = 1;
446err:
447    *padlen = olen;
448    return rv;
449}
450
451static int gcm_tls_init(PROV_GCM_CTX *dat, unsigned char *aad, size_t aad_len)
452{
453    unsigned char *buf;
454    size_t len;
455
456    if (!ossl_prov_is_running() || aad_len != EVP_AEAD_TLS1_AAD_LEN)
457       return 0;
458
459    /* Save the aad for later use. */
460    buf = dat->buf;
461    memcpy(buf, aad, aad_len);
462    dat->tls_aad_len = aad_len;
463
464    len = buf[aad_len - 2] << 8 | buf[aad_len - 1];
465    /* Correct length for explicit iv. */
466    if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
467        return 0;
468    len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
469
470    /* If decrypting correct for tag too. */
471    if (!dat->enc) {
472        if (len < EVP_GCM_TLS_TAG_LEN)
473            return 0;
474        len -= EVP_GCM_TLS_TAG_LEN;
475    }
476    buf[aad_len - 2] = (unsigned char)(len >> 8);
477    buf[aad_len - 1] = (unsigned char)(len & 0xff);
478    /* Extra padding: tag appended to record. */
479    return EVP_GCM_TLS_TAG_LEN;
480}
481
482static int gcm_tls_iv_set_fixed(PROV_GCM_CTX *ctx, unsigned char *iv,
483                                size_t len)
484{
485    /* Special case: -1 length restores whole IV */
486    if (len == (size_t)-1) {
487        memcpy(ctx->iv, iv, ctx->ivlen);
488        ctx->iv_gen = 1;
489        ctx->iv_state = IV_STATE_BUFFERED;
490        return 1;
491    }
492    /* Fixed field must be at least 4 bytes and invocation field at least 8 */
493    if ((len < EVP_GCM_TLS_FIXED_IV_LEN)
494        || (ctx->ivlen - (int)len) < EVP_GCM_TLS_EXPLICIT_IV_LEN)
495            return 0;
496    if (len > 0)
497        memcpy(ctx->iv, iv, len);
498    if (ctx->enc
499        && RAND_bytes_ex(ctx->libctx, ctx->iv + len, ctx->ivlen - len, 0) <= 0)
500            return 0;
501    ctx->iv_gen = 1;
502    ctx->iv_state = IV_STATE_BUFFERED;
503    return 1;
504}
505
506/*
507 * Handle TLS GCM packet format. This consists of the last portion of the IV
508 * followed by the payload and finally the tag. On encrypt generate IV,
509 * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
510 * and verify tag.
511 */
512static int gcm_tls_cipher(PROV_GCM_CTX *ctx, unsigned char *out, size_t *padlen,
513                          const unsigned char *in, size_t len)
514{
515    int rv = 0;
516    size_t arg = EVP_GCM_TLS_EXPLICIT_IV_LEN;
517    size_t plen = 0;
518    unsigned char *tag = NULL;
519
520    if (!ossl_prov_is_running() || !ctx->key_set)
521        goto err;
522
523    /* Encrypt/decrypt must be performed in place */
524    if (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
525        goto err;
526
527    /*
528     * Check for too many keys as per FIPS 140-2 IG A.5 "Key/IV Pair Uniqueness
529     * Requirements from SP 800-38D".  The requirements is for one party to the
530     * communication to fail after 2^64 - 1 keys.  We do this on the encrypting
531     * side only.
532     */
533    if (ctx->enc && ++ctx->tls_enc_records == 0) {
534        ERR_raise(ERR_LIB_PROV, PROV_R_TOO_MANY_RECORDS);
535        goto err;
536    }
537
538    /*
539     * Set IV from start of buffer or generate IV and write to start of
540     * buffer.
541     */
542    if (ctx->enc) {
543        if (!getivgen(ctx, out, arg))
544            goto err;
545    } else {
546        if (!setivinv(ctx, out, arg))
547            goto err;
548    }
549
550    /* Fix buffer and length to point to payload */
551    in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
552    out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
553    len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
554
555    tag = ctx->enc ? out + len : (unsigned char *)in + len;
556    if (!ctx->hw->oneshot(ctx, ctx->buf, ctx->tls_aad_len, in, len, out, tag,
557                          EVP_GCM_TLS_TAG_LEN)) {
558        if (!ctx->enc)
559            OPENSSL_cleanse(out, len);
560        goto err;
561    }
562    if (ctx->enc)
563        plen =  len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
564    else
565        plen = len;
566
567    rv = 1;
568err:
569    ctx->iv_state = IV_STATE_FINISHED;
570    ctx->tls_aad_len = UNINITIALISED_SIZET;
571    *padlen = plen;
572    return rv;
573}
574