cipher.c 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917
  1. /**
  2. * \file cipher.c
  3. *
  4. * \brief Generic cipher wrapper for mbed TLS
  5. *
  6. * \author Adriaan de Jong <dejong@fox-it.com>
  7. *
  8. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  9. * SPDX-License-Identifier: Apache-2.0
  10. *
  11. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  12. * not use this file except in compliance with the License.
  13. * You may obtain a copy of the License at
  14. *
  15. * http://www.apache.org/licenses/LICENSE-2.0
  16. *
  17. * Unless required by applicable law or agreed to in writing, software
  18. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  19. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20. * See the License for the specific language governing permissions and
  21. * limitations under the License.
  22. *
  23. * This file is part of mbed TLS (https://tls.mbed.org)
  24. */
  25. #if !defined(MBEDTLS_CONFIG_FILE)
  26. #include "mbedtls/config.h"
  27. #else
  28. #include MBEDTLS_CONFIG_FILE
  29. #endif
  30. #if defined(MBEDTLS_CIPHER_C)
  31. #include "mbedtls/cipher.h"
  32. #include "mbedtls/cipher_internal.h"
  33. #include <stdlib.h>
  34. #include <string.h>
  35. #if defined(MBEDTLS_GCM_C)
  36. #include "mbedtls/gcm.h"
  37. #endif
  38. #if defined(MBEDTLS_CCM_C)
  39. #include "mbedtls/ccm.h"
  40. #endif
  41. #if defined(MBEDTLS_CMAC_C)
  42. #include "mbedtls/cmac.h"
  43. #endif
  44. #if defined(MBEDTLS_PLATFORM_C)
  45. #include "mbedtls/platform.h"
  46. #else
  47. #define mbedtls_calloc calloc
  48. #define mbedtls_free free
  49. #endif
  50. #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
  51. #define MBEDTLS_CIPHER_MODE_STREAM
  52. #endif
  53. /* Implementation that should never be optimized out by the compiler */
  54. static void mbedtls_zeroize( void *v, size_t n ) {
  55. volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
  56. }
  57. static int supported_init = 0;
  58. const int *mbedtls_cipher_list( void )
  59. {
  60. const mbedtls_cipher_definition_t *def;
  61. int *type;
  62. if( ! supported_init )
  63. {
  64. def = mbedtls_cipher_definitions;
  65. type = mbedtls_cipher_supported;
  66. while( def->type != 0 )
  67. *type++ = (*def++).type;
  68. *type = 0;
  69. supported_init = 1;
  70. }
  71. return( mbedtls_cipher_supported );
  72. }
  73. const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( const mbedtls_cipher_type_t cipher_type )
  74. {
  75. const mbedtls_cipher_definition_t *def;
  76. for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
  77. if( def->type == cipher_type )
  78. return( def->info );
  79. return( NULL );
  80. }
  81. const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( const char *cipher_name )
  82. {
  83. const mbedtls_cipher_definition_t *def;
  84. if( NULL == cipher_name )
  85. return( NULL );
  86. for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
  87. if( ! strcmp( def->info->name, cipher_name ) )
  88. return( def->info );
  89. return( NULL );
  90. }
  91. const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( const mbedtls_cipher_id_t cipher_id,
  92. int key_bitlen,
  93. const mbedtls_cipher_mode_t mode )
  94. {
  95. const mbedtls_cipher_definition_t *def;
  96. for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
  97. if( def->info->base->cipher == cipher_id &&
  98. def->info->key_bitlen == (unsigned) key_bitlen &&
  99. def->info->mode == mode )
  100. return( def->info );
  101. return( NULL );
  102. }
  103. void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx )
  104. {
  105. memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
  106. }
  107. void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx )
  108. {
  109. if( ctx == NULL )
  110. return;
  111. #if defined(MBEDTLS_CMAC_C)
  112. if( ctx->cmac_ctx )
  113. {
  114. mbedtls_zeroize( ctx->cmac_ctx, sizeof( mbedtls_cmac_context_t ) );
  115. mbedtls_free( ctx->cmac_ctx );
  116. }
  117. #endif
  118. if( ctx->cipher_ctx )
  119. ctx->cipher_info->base->ctx_free_func( ctx->cipher_ctx );
  120. mbedtls_zeroize( ctx, sizeof(mbedtls_cipher_context_t) );
  121. }
  122. int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx, const mbedtls_cipher_info_t *cipher_info )
  123. {
  124. if( NULL == cipher_info || NULL == ctx )
  125. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  126. memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
  127. if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) )
  128. return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
  129. ctx->cipher_info = cipher_info;
  130. #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
  131. /*
  132. * Ignore possible errors caused by a cipher mode that doesn't use padding
  133. */
  134. #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
  135. (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_PKCS7 );
  136. #else
  137. (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_NONE );
  138. #endif
  139. #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
  140. return( 0 );
  141. }
  142. int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx, const unsigned char *key,
  143. int key_bitlen, const mbedtls_operation_t operation )
  144. {
  145. if( NULL == ctx || NULL == ctx->cipher_info )
  146. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  147. if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN ) == 0 &&
  148. (int) ctx->cipher_info->key_bitlen != key_bitlen )
  149. {
  150. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  151. }
  152. ctx->key_bitlen = key_bitlen;
  153. ctx->operation = operation;
  154. /*
  155. * For CFB and CTR mode always use the encryption key schedule
  156. */
  157. if( MBEDTLS_ENCRYPT == operation ||
  158. MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
  159. MBEDTLS_MODE_CTR == ctx->cipher_info->mode )
  160. {
  161. return ctx->cipher_info->base->setkey_enc_func( ctx->cipher_ctx, key,
  162. ctx->key_bitlen );
  163. }
  164. if( MBEDTLS_DECRYPT == operation )
  165. return ctx->cipher_info->base->setkey_dec_func( ctx->cipher_ctx, key,
  166. ctx->key_bitlen );
  167. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  168. }
  169. int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
  170. const unsigned char *iv, size_t iv_len )
  171. {
  172. size_t actual_iv_size;
  173. if( NULL == ctx || NULL == ctx->cipher_info || NULL == iv )
  174. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  175. /* avoid buffer overflow in ctx->iv */
  176. if( iv_len > MBEDTLS_MAX_IV_LENGTH )
  177. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  178. if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN ) != 0 )
  179. actual_iv_size = iv_len;
  180. else
  181. {
  182. actual_iv_size = ctx->cipher_info->iv_size;
  183. /* avoid reading past the end of input buffer */
  184. if( actual_iv_size > iv_len )
  185. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  186. }
  187. memcpy( ctx->iv, iv, actual_iv_size );
  188. ctx->iv_size = actual_iv_size;
  189. return( 0 );
  190. }
  191. int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx )
  192. {
  193. if( NULL == ctx || NULL == ctx->cipher_info )
  194. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  195. ctx->unprocessed_len = 0;
  196. return( 0 );
  197. }
  198. #if defined(MBEDTLS_GCM_C)
  199. int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
  200. const unsigned char *ad, size_t ad_len )
  201. {
  202. if( NULL == ctx || NULL == ctx->cipher_info )
  203. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  204. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  205. {
  206. return mbedtls_gcm_starts( (mbedtls_gcm_context *) ctx->cipher_ctx, ctx->operation,
  207. ctx->iv, ctx->iv_size, ad, ad_len );
  208. }
  209. return( 0 );
  210. }
  211. #endif /* MBEDTLS_GCM_C */
  212. int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input,
  213. size_t ilen, unsigned char *output, size_t *olen )
  214. {
  215. int ret;
  216. size_t block_size = 0;
  217. if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
  218. {
  219. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  220. }
  221. *olen = 0;
  222. block_size = mbedtls_cipher_get_block_size( ctx );
  223. if( ctx->cipher_info->mode == MBEDTLS_MODE_ECB )
  224. {
  225. if( ilen != block_size )
  226. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  227. *olen = ilen;
  228. if( 0 != ( ret = ctx->cipher_info->base->ecb_func( ctx->cipher_ctx,
  229. ctx->operation, input, output ) ) )
  230. {
  231. return( ret );
  232. }
  233. return( 0 );
  234. }
  235. #if defined(MBEDTLS_GCM_C)
  236. if( ctx->cipher_info->mode == MBEDTLS_MODE_GCM )
  237. {
  238. *olen = ilen;
  239. return mbedtls_gcm_update( (mbedtls_gcm_context *) ctx->cipher_ctx, ilen, input,
  240. output );
  241. }
  242. #endif
  243. if ( 0 == block_size )
  244. {
  245. return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT;
  246. }
  247. if( input == output &&
  248. ( ctx->unprocessed_len != 0 || ilen % block_size ) )
  249. {
  250. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  251. }
  252. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  253. if( ctx->cipher_info->mode == MBEDTLS_MODE_CBC )
  254. {
  255. size_t copy_len = 0;
  256. /*
  257. * If there is not enough data for a full block, cache it.
  258. */
  259. if( ( ctx->operation == MBEDTLS_DECRYPT &&
  260. ilen <= block_size - ctx->unprocessed_len ) ||
  261. ( ctx->operation == MBEDTLS_ENCRYPT &&
  262. ilen < block_size - ctx->unprocessed_len ) )
  263. {
  264. memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
  265. ilen );
  266. ctx->unprocessed_len += ilen;
  267. return( 0 );
  268. }
  269. /*
  270. * Process cached data first
  271. */
  272. if( 0 != ctx->unprocessed_len )
  273. {
  274. copy_len = block_size - ctx->unprocessed_len;
  275. memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
  276. copy_len );
  277. if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
  278. ctx->operation, block_size, ctx->iv,
  279. ctx->unprocessed_data, output ) ) )
  280. {
  281. return( ret );
  282. }
  283. *olen += block_size;
  284. output += block_size;
  285. ctx->unprocessed_len = 0;
  286. input += copy_len;
  287. ilen -= copy_len;
  288. }
  289. /*
  290. * Cache final, incomplete block
  291. */
  292. if( 0 != ilen )
  293. {
  294. if( 0 == block_size )
  295. {
  296. return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT;
  297. }
  298. copy_len = ilen % block_size;
  299. if( copy_len == 0 && ctx->operation == MBEDTLS_DECRYPT )
  300. copy_len = block_size;
  301. memcpy( ctx->unprocessed_data, &( input[ilen - copy_len] ),
  302. copy_len );
  303. ctx->unprocessed_len += copy_len;
  304. ilen -= copy_len;
  305. }
  306. /*
  307. * Process remaining full blocks
  308. */
  309. if( ilen )
  310. {
  311. if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
  312. ctx->operation, ilen, ctx->iv, input, output ) ) )
  313. {
  314. return( ret );
  315. }
  316. *olen += ilen;
  317. }
  318. return( 0 );
  319. }
  320. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  321. #if defined(MBEDTLS_CIPHER_MODE_CFB)
  322. if( ctx->cipher_info->mode == MBEDTLS_MODE_CFB )
  323. {
  324. if( 0 != ( ret = ctx->cipher_info->base->cfb_func( ctx->cipher_ctx,
  325. ctx->operation, ilen, &ctx->unprocessed_len, ctx->iv,
  326. input, output ) ) )
  327. {
  328. return( ret );
  329. }
  330. *olen = ilen;
  331. return( 0 );
  332. }
  333. #endif /* MBEDTLS_CIPHER_MODE_CFB */
  334. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  335. if( ctx->cipher_info->mode == MBEDTLS_MODE_CTR )
  336. {
  337. if( 0 != ( ret = ctx->cipher_info->base->ctr_func( ctx->cipher_ctx,
  338. ilen, &ctx->unprocessed_len, ctx->iv,
  339. ctx->unprocessed_data, input, output ) ) )
  340. {
  341. return( ret );
  342. }
  343. *olen = ilen;
  344. return( 0 );
  345. }
  346. #endif /* MBEDTLS_CIPHER_MODE_CTR */
  347. #if defined(MBEDTLS_CIPHER_MODE_STREAM)
  348. if( ctx->cipher_info->mode == MBEDTLS_MODE_STREAM )
  349. {
  350. if( 0 != ( ret = ctx->cipher_info->base->stream_func( ctx->cipher_ctx,
  351. ilen, input, output ) ) )
  352. {
  353. return( ret );
  354. }
  355. *olen = ilen;
  356. return( 0 );
  357. }
  358. #endif /* MBEDTLS_CIPHER_MODE_STREAM */
  359. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  360. }
  361. #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
  362. #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
  363. /*
  364. * PKCS7 (and PKCS5) padding: fill with ll bytes, with ll = padding_len
  365. */
  366. static void add_pkcs_padding( unsigned char *output, size_t output_len,
  367. size_t data_len )
  368. {
  369. size_t padding_len = output_len - data_len;
  370. unsigned char i;
  371. for( i = 0; i < padding_len; i++ )
  372. output[data_len + i] = (unsigned char) padding_len;
  373. }
  374. static int get_pkcs_padding( unsigned char *input, size_t input_len,
  375. size_t *data_len )
  376. {
  377. size_t i, pad_idx;
  378. unsigned char padding_len, bad = 0;
  379. if( NULL == input || NULL == data_len )
  380. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  381. padding_len = input[input_len - 1];
  382. *data_len = input_len - padding_len;
  383. /* Avoid logical || since it results in a branch */
  384. bad |= padding_len > input_len;
  385. bad |= padding_len == 0;
  386. /* The number of bytes checked must be independent of padding_len,
  387. * so pick input_len, which is usually 8 or 16 (one block) */
  388. pad_idx = input_len - padding_len;
  389. for( i = 0; i < input_len; i++ )
  390. bad |= ( input[i] ^ padding_len ) * ( i >= pad_idx );
  391. return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
  392. }
  393. #endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */
  394. #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
  395. /*
  396. * One and zeros padding: fill with 80 00 ... 00
  397. */
  398. static void add_one_and_zeros_padding( unsigned char *output,
  399. size_t output_len, size_t data_len )
  400. {
  401. size_t padding_len = output_len - data_len;
  402. unsigned char i = 0;
  403. output[data_len] = 0x80;
  404. for( i = 1; i < padding_len; i++ )
  405. output[data_len + i] = 0x00;
  406. }
  407. static int get_one_and_zeros_padding( unsigned char *input, size_t input_len,
  408. size_t *data_len )
  409. {
  410. size_t i;
  411. unsigned char done = 0, prev_done, bad;
  412. if( NULL == input || NULL == data_len )
  413. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  414. bad = 0xFF;
  415. *data_len = 0;
  416. for( i = input_len; i > 0; i-- )
  417. {
  418. prev_done = done;
  419. done |= ( input[i-1] != 0 );
  420. *data_len |= ( i - 1 ) * ( done != prev_done );
  421. bad &= ( input[i-1] ^ 0x80 ) | ( done == prev_done );
  422. }
  423. return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
  424. }
  425. #endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */
  426. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
  427. /*
  428. * Zeros and len padding: fill with 00 ... 00 ll, where ll is padding length
  429. */
  430. static void add_zeros_and_len_padding( unsigned char *output,
  431. size_t output_len, size_t data_len )
  432. {
  433. size_t padding_len = output_len - data_len;
  434. unsigned char i = 0;
  435. for( i = 1; i < padding_len; i++ )
  436. output[data_len + i - 1] = 0x00;
  437. output[output_len - 1] = (unsigned char) padding_len;
  438. }
  439. static int get_zeros_and_len_padding( unsigned char *input, size_t input_len,
  440. size_t *data_len )
  441. {
  442. size_t i, pad_idx;
  443. unsigned char padding_len, bad = 0;
  444. if( NULL == input || NULL == data_len )
  445. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  446. padding_len = input[input_len - 1];
  447. *data_len = input_len - padding_len;
  448. /* Avoid logical || since it results in a branch */
  449. bad |= padding_len > input_len;
  450. bad |= padding_len == 0;
  451. /* The number of bytes checked must be independent of padding_len */
  452. pad_idx = input_len - padding_len;
  453. for( i = 0; i < input_len - 1; i++ )
  454. bad |= input[i] * ( i >= pad_idx );
  455. return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
  456. }
  457. #endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */
  458. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
  459. /*
  460. * Zero padding: fill with 00 ... 00
  461. */
  462. static void add_zeros_padding( unsigned char *output,
  463. size_t output_len, size_t data_len )
  464. {
  465. size_t i;
  466. for( i = data_len; i < output_len; i++ )
  467. output[i] = 0x00;
  468. }
  469. static int get_zeros_padding( unsigned char *input, size_t input_len,
  470. size_t *data_len )
  471. {
  472. size_t i;
  473. unsigned char done = 0, prev_done;
  474. if( NULL == input || NULL == data_len )
  475. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  476. *data_len = 0;
  477. for( i = input_len; i > 0; i-- )
  478. {
  479. prev_done = done;
  480. done |= ( input[i-1] != 0 );
  481. *data_len |= i * ( done != prev_done );
  482. }
  483. return( 0 );
  484. }
  485. #endif /* MBEDTLS_CIPHER_PADDING_ZEROS */
  486. /*
  487. * No padding: don't pad :)
  488. *
  489. * There is no add_padding function (check for NULL in mbedtls_cipher_finish)
  490. * but a trivial get_padding function
  491. */
  492. static int get_no_padding( unsigned char *input, size_t input_len,
  493. size_t *data_len )
  494. {
  495. if( NULL == input || NULL == data_len )
  496. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  497. *data_len = input_len;
  498. return( 0 );
  499. }
  500. #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
  501. int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
  502. unsigned char *output, size_t *olen )
  503. {
  504. if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
  505. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  506. *olen = 0;
  507. if( MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
  508. MBEDTLS_MODE_CTR == ctx->cipher_info->mode ||
  509. MBEDTLS_MODE_GCM == ctx->cipher_info->mode ||
  510. MBEDTLS_MODE_STREAM == ctx->cipher_info->mode )
  511. {
  512. return( 0 );
  513. }
  514. if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode )
  515. {
  516. if( ctx->unprocessed_len != 0 )
  517. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  518. return( 0 );
  519. }
  520. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  521. if( MBEDTLS_MODE_CBC == ctx->cipher_info->mode )
  522. {
  523. int ret = 0;
  524. if( MBEDTLS_ENCRYPT == ctx->operation )
  525. {
  526. /* check for 'no padding' mode */
  527. if( NULL == ctx->add_padding )
  528. {
  529. if( 0 != ctx->unprocessed_len )
  530. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  531. return( 0 );
  532. }
  533. ctx->add_padding( ctx->unprocessed_data, mbedtls_cipher_get_iv_size( ctx ),
  534. ctx->unprocessed_len );
  535. }
  536. else if( mbedtls_cipher_get_block_size( ctx ) != ctx->unprocessed_len )
  537. {
  538. /*
  539. * For decrypt operations, expect a full block,
  540. * or an empty block if no padding
  541. */
  542. if( NULL == ctx->add_padding && 0 == ctx->unprocessed_len )
  543. return( 0 );
  544. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  545. }
  546. /* cipher block */
  547. if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
  548. ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv,
  549. ctx->unprocessed_data, output ) ) )
  550. {
  551. return( ret );
  552. }
  553. /* Set output size for decryption */
  554. if( MBEDTLS_DECRYPT == ctx->operation )
  555. return ctx->get_padding( output, mbedtls_cipher_get_block_size( ctx ),
  556. olen );
  557. /* Set output size for encryption */
  558. *olen = mbedtls_cipher_get_block_size( ctx );
  559. return( 0 );
  560. }
  561. #else
  562. ((void) output);
  563. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  564. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  565. }
  566. #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
  567. int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx, mbedtls_cipher_padding_t mode )
  568. {
  569. if( NULL == ctx ||
  570. MBEDTLS_MODE_CBC != ctx->cipher_info->mode )
  571. {
  572. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  573. }
  574. switch( mode )
  575. {
  576. #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
  577. case MBEDTLS_PADDING_PKCS7:
  578. ctx->add_padding = add_pkcs_padding;
  579. ctx->get_padding = get_pkcs_padding;
  580. break;
  581. #endif
  582. #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
  583. case MBEDTLS_PADDING_ONE_AND_ZEROS:
  584. ctx->add_padding = add_one_and_zeros_padding;
  585. ctx->get_padding = get_one_and_zeros_padding;
  586. break;
  587. #endif
  588. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
  589. case MBEDTLS_PADDING_ZEROS_AND_LEN:
  590. ctx->add_padding = add_zeros_and_len_padding;
  591. ctx->get_padding = get_zeros_and_len_padding;
  592. break;
  593. #endif
  594. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
  595. case MBEDTLS_PADDING_ZEROS:
  596. ctx->add_padding = add_zeros_padding;
  597. ctx->get_padding = get_zeros_padding;
  598. break;
  599. #endif
  600. case MBEDTLS_PADDING_NONE:
  601. ctx->add_padding = NULL;
  602. ctx->get_padding = get_no_padding;
  603. break;
  604. default:
  605. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  606. }
  607. return( 0 );
  608. }
  609. #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
  610. #if defined(MBEDTLS_GCM_C)
  611. int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
  612. unsigned char *tag, size_t tag_len )
  613. {
  614. if( NULL == ctx || NULL == ctx->cipher_info || NULL == tag )
  615. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  616. if( MBEDTLS_ENCRYPT != ctx->operation )
  617. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  618. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  619. return mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx, tag, tag_len );
  620. return( 0 );
  621. }
  622. int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
  623. const unsigned char *tag, size_t tag_len )
  624. {
  625. int ret;
  626. if( NULL == ctx || NULL == ctx->cipher_info ||
  627. MBEDTLS_DECRYPT != ctx->operation )
  628. {
  629. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  630. }
  631. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  632. {
  633. unsigned char check_tag[16];
  634. size_t i;
  635. int diff;
  636. if( tag_len > sizeof( check_tag ) )
  637. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  638. if( 0 != ( ret = mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx,
  639. check_tag, tag_len ) ) )
  640. {
  641. return( ret );
  642. }
  643. /* Check the tag in "constant-time" */
  644. for( diff = 0, i = 0; i < tag_len; i++ )
  645. diff |= tag[i] ^ check_tag[i];
  646. if( diff != 0 )
  647. return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
  648. return( 0 );
  649. }
  650. return( 0 );
  651. }
  652. #endif /* MBEDTLS_GCM_C */
  653. /*
  654. * Packet-oriented wrapper for non-AEAD modes
  655. */
  656. int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx,
  657. const unsigned char *iv, size_t iv_len,
  658. const unsigned char *input, size_t ilen,
  659. unsigned char *output, size_t *olen )
  660. {
  661. int ret;
  662. size_t finish_olen;
  663. if( ( ret = mbedtls_cipher_set_iv( ctx, iv, iv_len ) ) != 0 )
  664. return( ret );
  665. if( ( ret = mbedtls_cipher_reset( ctx ) ) != 0 )
  666. return( ret );
  667. if( ( ret = mbedtls_cipher_update( ctx, input, ilen, output, olen ) ) != 0 )
  668. return( ret );
  669. if( ( ret = mbedtls_cipher_finish( ctx, output + *olen, &finish_olen ) ) != 0 )
  670. return( ret );
  671. *olen += finish_olen;
  672. return( 0 );
  673. }
  674. #if defined(MBEDTLS_CIPHER_MODE_AEAD)
  675. /*
  676. * Packet-oriented encryption for AEAD modes
  677. */
  678. int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx,
  679. const unsigned char *iv, size_t iv_len,
  680. const unsigned char *ad, size_t ad_len,
  681. const unsigned char *input, size_t ilen,
  682. unsigned char *output, size_t *olen,
  683. unsigned char *tag, size_t tag_len )
  684. {
  685. #if defined(MBEDTLS_GCM_C)
  686. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  687. {
  688. *olen = ilen;
  689. return( mbedtls_gcm_crypt_and_tag( ctx->cipher_ctx, MBEDTLS_GCM_ENCRYPT, ilen,
  690. iv, iv_len, ad, ad_len, input, output,
  691. tag_len, tag ) );
  692. }
  693. #endif /* MBEDTLS_GCM_C */
  694. #if defined(MBEDTLS_CCM_C)
  695. if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
  696. {
  697. *olen = ilen;
  698. return( mbedtls_ccm_encrypt_and_tag( ctx->cipher_ctx, ilen,
  699. iv, iv_len, ad, ad_len, input, output,
  700. tag, tag_len ) );
  701. }
  702. #endif /* MBEDTLS_CCM_C */
  703. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  704. }
  705. /*
  706. * Packet-oriented decryption for AEAD modes
  707. */
  708. int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx,
  709. const unsigned char *iv, size_t iv_len,
  710. const unsigned char *ad, size_t ad_len,
  711. const unsigned char *input, size_t ilen,
  712. unsigned char *output, size_t *olen,
  713. const unsigned char *tag, size_t tag_len )
  714. {
  715. #if defined(MBEDTLS_GCM_C)
  716. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  717. {
  718. int ret;
  719. *olen = ilen;
  720. ret = mbedtls_gcm_auth_decrypt( ctx->cipher_ctx, ilen,
  721. iv, iv_len, ad, ad_len,
  722. tag, tag_len, input, output );
  723. if( ret == MBEDTLS_ERR_GCM_AUTH_FAILED )
  724. ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
  725. return( ret );
  726. }
  727. #endif /* MBEDTLS_GCM_C */
  728. #if defined(MBEDTLS_CCM_C)
  729. if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
  730. {
  731. int ret;
  732. *olen = ilen;
  733. ret = mbedtls_ccm_auth_decrypt( ctx->cipher_ctx, ilen,
  734. iv, iv_len, ad, ad_len,
  735. input, output, tag, tag_len );
  736. if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED )
  737. ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
  738. return( ret );
  739. }
  740. #endif /* MBEDTLS_CCM_C */
  741. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  742. }
  743. #endif /* MBEDTLS_CIPHER_MODE_AEAD */
  744. #endif /* MBEDTLS_CIPHER_C */