kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add support for CMAC (RFC 4493).

Browse Source 
The interface for this is very similar to upstream, but the code is
quite different.

Support for “resuming” (i.e. calling |CMAC_Final| and then computing the
CMAC for an extension of the message) has been dropped. Also, calling
|CMAC_Init| with magic argument to reset it has been replaced with
|CMAC_Reset|.

Lastly, a one-shot function has been added because it can save an
allocation and that's what most callers actually appear to want to do.

Change-Id: I9345220218bdb16ebe6ca356928d7c6f055d83f6
Reviewed-on: https://boringssl-review.googlesource.com/4630
Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Adam Langley <agl@google.com>
This commit is contained in:
Adam Langley 2015-05-05 16:36:32 -07:00
parent ae5fdd9648
commit 0d107e183e
9 changed files with 493 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/CMakeLists.txt
View File

@ -128,6 +128,7 @@ add_subdirectory(ecdsa)
add_subdirectory(hmac)
# Level 3
add_subdirectory(cmac)
add_subdirectory(evp)
add_subdirectory(hkdf)
add_subdirectory(pem)
@ -183,6 +184,7 @@ add_library(
$<TARGET_OBJECTS:ecdh>
$<TARGET_OBJECTS:ecdsa>
$<TARGET_OBJECTS:hmac>
$<TARGET_OBJECTS:cmac>
$<TARGET_OBJECTS:evp>
$<TARGET_OBJECTS:hkdf>
$<TARGET_OBJECTS:pem>

17
crypto/cmac/CMakeLists.txt Normal file
View File

@ -0,0 +1,17 @@
include_directories(. .. ../../include)
add_library(
cmac
OBJECT
cmac.c
)
add_executable(
cmac_test
cmac_test.cc
)
target_link_libraries(cmac_test crypto)

239
crypto/cmac/cmac.c Normal file
View File

@ -0,0 +1,239 @@
/* ====================================================================
* Copyright (c) 2010 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ==================================================================== */
#include <openssl/cmac.h>
#include <assert.h>
#include <string.h>
#include <openssl/aes.h>
#include <openssl/cipher.h>
#include <openssl/mem.h>
struct cmac_ctx_st {
EVP_CIPHER_CTX cipher_ctx;
/* k1 and k2 are the CMAC subkeys. See
* https://tools.ietf.org/html/rfc4493#section-2.3 */
uint8_t k1[AES_BLOCK_SIZE];
uint8_t k2[AES_BLOCK_SIZE];
/* Last (possibly partial) scratch */
uint8_t block[AES_BLOCK_SIZE];
/* block_used contains the number of valid bytes in |block|. */
unsigned block_used;
};
static void CMAC_CTX_init(CMAC_CTX *ctx) {
EVP_CIPHER_CTX_init(&ctx->cipher_ctx);
}
static void CMAC_CTX_cleanup(CMAC_CTX *ctx) {
EVP_CIPHER_CTX_cleanup(&ctx->cipher_ctx);
OPENSSL_cleanse(ctx->k1, sizeof(ctx->k1));
OPENSSL_cleanse(ctx->k2, sizeof(ctx->k2));
OPENSSL_cleanse(ctx->block, sizeof(ctx->block));
}
int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
const uint8_t *in, size_t in_len) {
const EVP_CIPHER *cipher;
switch (key_len) {
case 16:
cipher = EVP_aes_128_cbc();
break;
case 32:
cipher = EVP_aes_256_cbc();
break;
default:
return 0;
}
size_t scratch_out_len;
CMAC_CTX ctx;
CMAC_CTX_init(&ctx);
const int ok = CMAC_Init(&ctx, key, key_len, cipher, NULL /* engine */) &&
CMAC_Update(&ctx, in, in_len) &&
CMAC_Final(&ctx, out, &scratch_out_len);
CMAC_CTX_cleanup(&ctx);
return ok;
}
CMAC_CTX *CMAC_CTX_new(void) {
CMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
if (ctx != NULL) {
CMAC_CTX_init(ctx);
}
return ctx;
}
void CMAC_CTX_free(CMAC_CTX *ctx) {
if (ctx == NULL) {
return;
}
CMAC_CTX_cleanup(ctx);
OPENSSL_free(ctx);
}
/* binary_field_mul_x treats the 128 bits at |in| as an element of GF(2¹²⁸)
* with a hard-coded reduction polynomial and sets |out| as x times the
* input.
*
* See https://tools.ietf.org/html/rfc4493#section-2.3 */
static void binary_field_mul_x(uint8_t out[16], const uint8_t in[16]) {
unsigned i;
/* Shift |in| to left, including carry. */
for (i = 0; i < 15; i++) {
out[i] = (in[i] << 1) | (in[i+1] >> 7);
}
/* If MSB set fixup with R. */
const uint8_t carry = in[0] >> 7;
out[i] = (in[i] << 1) ^ ((0 - carry) & 0x87);
}
static const uint8_t kZeroIV[AES_BLOCK_SIZE] = {0};
int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
const EVP_CIPHER *cipher, ENGINE *engine) {
uint8_t scratch[AES_BLOCK_SIZE];
if (EVP_CIPHER_block_size(cipher) != AES_BLOCK_SIZE ||
EVP_CIPHER_key_length(cipher) != key_len ||
!EVP_EncryptInit_ex(&ctx->cipher_ctx, cipher, NULL, key, kZeroIV) ||
!EVP_Cipher(&ctx->cipher_ctx, scratch, kZeroIV, AES_BLOCK_SIZE) ||
/* Reset context again ready for first data. */
!EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV)) {
return 0;
}
binary_field_mul_x(ctx->k1, scratch);
binary_field_mul_x(ctx->k2, ctx->k1);
ctx->block_used = 0;
return 1;
}
int CMAC_Reset(CMAC_CTX *ctx) {
ctx->block_used = 0;
return EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV);
}
int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len) {
uint8_t scratch[AES_BLOCK_SIZE];
if (ctx->block_used > 0) {
size_t todo = AES_BLOCK_SIZE - ctx->block_used;
if (in_len < todo) {
todo = in_len;
}
memcpy(ctx->block + ctx->block_used, in, todo);
in += todo;
in_len -= todo;
ctx->block_used += todo;
/* If |in_len| is zero then either |ctx->block_used| is less than
* |AES_BLOCK_SIZE|, in which case we can stop here, or |ctx->block_used|
* is exactly |AES_BLOCK_SIZE| but there's no more data to process. In the
* latter case we don't want to process this block now because it might be
* the last block and that block is treated specially. */
if (in_len == 0) {
return 1;
}
assert(ctx->block_used == AES_BLOCK_SIZE);
if (!EVP_Cipher(&ctx->cipher_ctx, scratch, ctx->block, AES_BLOCK_SIZE)) {
return 0;
}
}
/* Encrypt all but one of the remaining blocks. */
while (in_len > AES_BLOCK_SIZE) {
if (!EVP_Cipher(&ctx->cipher_ctx, scratch, in, AES_BLOCK_SIZE)) {
return 0;
}
in += AES_BLOCK_SIZE;
in_len -= AES_BLOCK_SIZE;
}
memcpy(ctx->block, in, in_len);
ctx->block_used = in_len;
return 1;
}
int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len) {
*out_len = AES_BLOCK_SIZE;
if (out == NULL) {
return 1;
}
const uint8_t *mask = ctx->k1;
if (ctx->block_used != AES_BLOCK_SIZE) {
/* If the last block is incomplete, terminate it with a single 'one' bit
* followed by zeros. */
ctx->block[ctx->block_used] = 0x80;
memset(ctx->block + ctx->block_used + 1, 0,
AES_BLOCK_SIZE - (ctx->block_used + 1));
mask = ctx->k2;
}
unsigned i;
for (i = 0; i < AES_BLOCK_SIZE; i++) {
out[i] = ctx->block[i] ^ mask[i];
}
return EVP_Cipher(&ctx->cipher_ctx, out, out, AES_BLOCK_SIZE);
}

154
crypto/cmac/cmac_test.cc Normal file
View File

@ -0,0 +1,154 @@
/* Copyright (c) 2015, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#include <stdio.h>
#include <algorithm>
#include <openssl/cmac.h>
#include "../test/scoped_types.h"
static void dump(const uint8_t *got, const uint8_t *expected, size_t len) {
ScopedBIO bio(BIO_new_fp(stderr, 0 /* don't close */));
BIO_puts(bio.get(), "\nGot:\n");
BIO_hexdump(bio.get(), got, len, 2 /* indent */);
BIO_puts(bio.get(), "Expected:\n");
BIO_hexdump(bio.get(), expected, len, 2 /* indent */);
BIO_flush(bio.get());
}
static int test(const char *name, const uint8_t *key, size_t key_len,
const uint8_t *msg, size_t msg_len, const uint8_t *expected) {
uint8_t out[16];
if (!AES_CMAC(out, key, key_len, msg, msg_len)) {
fprintf(stderr, "%s: AES_CMAC failed\n", name);
return 0;
}
if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
fprintf(stderr, "%s: CMAC result differs:\n", name);
dump(out, expected, sizeof(out));
return 0;
}
ScopedCMAC_CTX ctx(CMAC_CTX_new());
if (!CMAC_Init(ctx.get(), key, key_len, EVP_aes_128_cbc(), NULL)) {
fprintf(stderr, "%s: CMAC_Init failed.\n", name);
return 0;
}
for (unsigned chunk_size = 1; chunk_size <= msg_len; chunk_size++) {
if (!CMAC_Reset(ctx.get())) {
fprintf(stderr, "%s/%u: CMAC_Reset failed.\n", name, chunk_size);
return 0;
}
size_t done = 0;
while (done < msg_len) {
size_t todo = std::min(msg_len - done, static_cast<size_t>(chunk_size));
if (!CMAC_Update(ctx.get(), msg + done, todo)) {
fprintf(stderr, "%s/%u: CMAC_Update failed.\n", name, chunk_size);
return 0;
}
done += todo;
}
size_t out_len;
if (!CMAC_Final(ctx.get(), out, &out_len)) {
fprintf(stderr, "%s/%u: CMAC_Final failed.\n", name, chunk_size);
return 0;
}
if (out_len != sizeof(out)) {
fprintf(stderr, "%s/%u: incorrect out_len: %u.\n", name, chunk_size,
static_cast<unsigned>(out_len));
return 0;
}
if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
fprintf(stderr, "%s/%u: CMAC result differs:\n", name, chunk_size);
dump(out, expected, sizeof(out));
return 0;
}
}
return 1;
}
static int rfc_4493_test_vectors(void) {
static const uint8_t kKey[16] = {
0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c,
};
static const uint8_t kOut1[16] = {
0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46,
};
static const uint8_t kMsg2[] = {
0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
};
static const uint8_t kOut2[16] = {
0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c,
};
static const uint8_t kMsg3[] = {
0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
};
static const uint8_t kOut3[16] = {
0xdf, 0xa6, 0x67, 0x47, 0xde, 0x9a, 0xe6, 0x30,
0x30, 0xca, 0x32, 0x61, 0x14, 0x97, 0xc8, 0x27,
};
static const uint8_t kMsg4[] = {
0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10,
};
static const uint8_t kOut4[16] = {
0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe,
};
if (!test("RFC 4493 #1", kKey, sizeof(kKey), NULL, 0, kOut1) ||
!test("RFC 4493 #2", kKey, sizeof(kKey), kMsg2, sizeof(kMsg2), kOut2) ||
!test("RFC 4493 #3", kKey, sizeof(kKey), kMsg3, sizeof(kMsg3), kOut3) ||
!test("RFC 4493 #4", kKey, sizeof(kKey), kMsg4, sizeof(kMsg4), kOut4)) {
return 0;
}
return 1;
}
int main(int argc, char **argv) {
if (!rfc_4493_test_vectors()) {
return 1;
}
printf("PASS\n");
return 0;
}

2
crypto/test/scoped_types.h
View File

@ -19,6 +19,7 @@
#include <openssl/bio.h>
#include <openssl/bn.h>
#include <openssl/cmac.h>
#include <openssl/dh.h>
#include <openssl/ec.h>
#include <openssl/ec_key.h>
@ -76,6 +77,7 @@ using ScopedBIO = ScopedOpenSSLType<BIO, BIO_vfree>;
using ScopedBIGNUM = ScopedOpenSSLType<BIGNUM, BN_free>;
using ScopedBN_CTX = ScopedOpenSSLType<BN_CTX, BN_CTX_free>;
using ScopedBN_MONT_CTX = ScopedOpenSSLType<BN_MONT_CTX, BN_MONT_CTX_free>;
using ScopedCMAC_CTX = ScopedOpenSSLType<CMAC_CTX, CMAC_CTX_free>;
using ScopedDH = ScopedOpenSSLType<DH, DH_free>;
using ScopedECDSA_SIG = ScopedOpenSSLType<ECDSA_SIG, ECDSA_SIG_free>;
using ScopedEC_GROUP = ScopedOpenSSLType<EC_GROUP, EC_GROUP_free>;

1
include/openssl/base.h
View File

@ -177,6 +177,7 @@ typedef struct bn_mont_ctx_st BN_MONT_CTX;
typedef struct buf_mem_st BUF_MEM;
typedef struct cbb_st CBB;
typedef struct cbs_st CBS;
typedef struct cmac_ctx_st CMAC_CTX;
typedef struct conf_st CONF;
typedef struct conf_value_st CONF_VALUE;
typedef struct dh_method DH_METHOD;

76
include/openssl/cmac.h Normal file
View File

@ -0,0 +1,76 @@
/* Copyright (c) 2015, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#ifndef OPENSSL_HEADER_CMAC_H
#define OPENSSL_HEADER_CMAC_H
#include <openssl/base.h>
#if defined(__cplusplus)
extern "C" {
#endif
/* CMAC.
*
* CMAC is a MAC based on AES-CBC and defined in
* https://tools.ietf.org/html/rfc4493#section-2.3. */
/* One-shot functions. */
/* AES_CMAC calculates the 16-byte, CMAC authenticator of |in_len| bytes of
* |in| and writes it to |out|. The |key_len| may be 16 or 32 bytes to select
* between AES-128 and AES-256. It returns one on success or zero on error. */
OPENSSL_EXPORT int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
const uint8_t *in, size_t in_len);
/* Incremental interface. */
/* CMAC_CTX_new allocates a fresh |CMAC_CTX| and returns it, or NULL on
* error. */
OPENSSL_EXPORT CMAC_CTX *CMAC_CTX_new(void);
/* CMAC_CTX_free frees a |CMAC_CTX|. */
OPENSSL_EXPORT void CMAC_CTX_free(CMAC_CTX *ctx);
/* CMAC_Init configures |ctx| to use the given |key| and |cipher|. The CMAC RFC
* only specifies the use of AES-128 thus |key_len| should be 16 and |cipher|
* should be |EVP_aes_128_cbc()|. However, this implementation also supports
* AES-256 by setting |key_len| to 32 and |cipher| to |EVP_aes_256_cbc()|. The
* |engine| argument is ignored.
*
* It returns one on success or zero on error. */
OPENSSL_EXPORT int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
const EVP_CIPHER *cipher, ENGINE *engine);
/* CMAC_Reset resets |ctx| so that a fresh message can be authenticated. */
OPENSSL_EXPORT int CMAC_Reset(CMAC_CTX *ctx);
/* CMAC_Update processes |in_len| bytes of message from |in|. It returns one on
* success or zero on error. */
OPENSSL_EXPORT int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len);
/* CMAC_Final sets |*out_len| to 16 and, if |out| is not NULL, writes 16 bytes
* of authenticator to it. It returns one on success or zero on error. */
OPENSSL_EXPORT int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len);
#if defined(__cplusplus)
} /* extern C */
#endif
#endif /* OPENSSL_HEADER_CBC_H */

1
util/all_tests.go
View File

@ -65,6 +65,7 @@ var tests = []test{
{"crypto/cipher/aead_test", "aes-128-ctr-hmac-sha256", "crypto/cipher/test/aes_128_ctr_hmac_sha256.txt"},
{"crypto/cipher/aead_test", "aes-256-ctr-hmac-sha256", "crypto/cipher/test/aes_256_ctr_hmac_sha256.txt"},
{"crypto/cipher/cipher_test", "crypto/cipher/test/cipher_test.txt"},
{"crypto/cmac/cmac_test"},
{"crypto/constant_time_test"},
{"crypto/dh/dh_test"},
{"crypto/digest/digest_test"},

1
util/doc.config
View File

@ -24,6 +24,7 @@
"Headers": [
"include/openssl/aes.h",
"include/openssl/bn.h",
"include/openssl/cmac.h",
"include/openssl/des.h",
"include/openssl/dh.h",
"include/openssl/dsa.h",