cipher.c 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929
  1. /**
  2. * \file cipher.c
  3. *
  4. * \brief Generic cipher wrapper for mbed TLS
  5. *
  6. * \author Adriaan de Jong <dejong@fox-it.com>
  7. *
  8. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  9. * SPDX-License-Identifier: Apache-2.0
  10. *
  11. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  12. * not use this file except in compliance with the License.
  13. * You may obtain a copy of the License at
  14. *
  15. * http://www.apache.org/licenses/LICENSE-2.0
  16. *
  17. * Unless required by applicable law or agreed to in writing, software
  18. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  19. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20. * See the License for the specific language governing permissions and
  21. * limitations under the License.
  22. *
  23. * This file is part of mbed TLS (https://tls.mbed.org)
  24. */
  25. #if !defined(MBEDTLS_CONFIG_FILE)
  26. #include "mbedtls/config.h"
  27. #else
  28. #include MBEDTLS_CONFIG_FILE
  29. #endif
  30. #if defined(MBEDTLS_CIPHER_C)
  31. #include "mbedtls/cipher.h"
  32. #include "mbedtls/cipher_internal.h"
  33. #include <stdlib.h>
  34. #include <string.h>
  35. #if defined(MBEDTLS_GCM_C)
  36. #include "mbedtls/gcm.h"
  37. #endif
  38. #if defined(MBEDTLS_CCM_C)
  39. #include "mbedtls/ccm.h"
  40. #endif
  41. #if defined(MBEDTLS_CMAC_C)
  42. #include "mbedtls/cmac.h"
  43. #endif
  44. #if defined(MBEDTLS_PLATFORM_C)
  45. #include "mbedtls/platform.h"
  46. #else
  47. #define mbedtls_calloc calloc
  48. #define mbedtls_free free
  49. #endif
  50. /* Implementation that should never be optimized out by the compiler */
  51. static void mbedtls_zeroize( void *v, size_t n ) {
  52. volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
  53. }
  54. static int supported_init = 0;
  55. const int *mbedtls_cipher_list( void )
  56. {
  57. const mbedtls_cipher_definition_t *def;
  58. int *type;
  59. if( ! supported_init )
  60. {
  61. def = mbedtls_cipher_definitions;
  62. type = mbedtls_cipher_supported;
  63. while( def->type != 0 )
  64. *type++ = (*def++).type;
  65. *type = 0;
  66. supported_init = 1;
  67. }
  68. return( mbedtls_cipher_supported );
  69. }
  70. const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( const mbedtls_cipher_type_t cipher_type )
  71. {
  72. const mbedtls_cipher_definition_t *def;
  73. for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
  74. if( def->type == cipher_type )
  75. return( def->info );
  76. return( NULL );
  77. }
  78. const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( const char *cipher_name )
  79. {
  80. const mbedtls_cipher_definition_t *def;
  81. if( NULL == cipher_name )
  82. return( NULL );
  83. for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
  84. if( ! strcmp( def->info->name, cipher_name ) )
  85. return( def->info );
  86. return( NULL );
  87. }
  88. const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( const mbedtls_cipher_id_t cipher_id,
  89. int key_bitlen,
  90. const mbedtls_cipher_mode_t mode )
  91. {
  92. const mbedtls_cipher_definition_t *def;
  93. for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
  94. if( def->info->base->cipher == cipher_id &&
  95. def->info->key_bitlen == (unsigned) key_bitlen &&
  96. def->info->mode == mode )
  97. return( def->info );
  98. return( NULL );
  99. }
  100. void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx )
  101. {
  102. memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
  103. }
  104. void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx )
  105. {
  106. if( ctx == NULL )
  107. return;
  108. #if defined(MBEDTLS_CMAC_C)
  109. if( ctx->cmac_ctx )
  110. {
  111. mbedtls_zeroize( ctx->cmac_ctx, sizeof( mbedtls_cmac_context_t ) );
  112. mbedtls_free( ctx->cmac_ctx );
  113. }
  114. #endif
  115. if( ctx->cipher_ctx )
  116. ctx->cipher_info->base->ctx_free_func( ctx->cipher_ctx );
  117. mbedtls_zeroize( ctx, sizeof(mbedtls_cipher_context_t) );
  118. }
  119. int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx, const mbedtls_cipher_info_t *cipher_info )
  120. {
  121. if( NULL == cipher_info || NULL == ctx )
  122. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  123. memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
  124. if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) )
  125. return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
  126. ctx->cipher_info = cipher_info;
  127. #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
  128. /*
  129. * Ignore possible errors caused by a cipher mode that doesn't use padding
  130. */
  131. #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
  132. (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_PKCS7 );
  133. #else
  134. (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_NONE );
  135. #endif
  136. #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
  137. return( 0 );
  138. }
  139. int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx, const unsigned char *key,
  140. int key_bitlen, const mbedtls_operation_t operation )
  141. {
  142. if( NULL == ctx || NULL == ctx->cipher_info )
  143. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  144. if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN ) == 0 &&
  145. (int) ctx->cipher_info->key_bitlen != key_bitlen )
  146. {
  147. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  148. }
  149. ctx->key_bitlen = key_bitlen;
  150. ctx->operation = operation;
  151. /*
  152. * For CFB and CTR mode always use the encryption key schedule
  153. */
  154. if( MBEDTLS_ENCRYPT == operation ||
  155. MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
  156. MBEDTLS_MODE_CTR == ctx->cipher_info->mode )
  157. {
  158. return ctx->cipher_info->base->setkey_enc_func( ctx->cipher_ctx, key,
  159. ctx->key_bitlen );
  160. }
  161. if( MBEDTLS_DECRYPT == operation )
  162. return ctx->cipher_info->base->setkey_dec_func( ctx->cipher_ctx, key,
  163. ctx->key_bitlen );
  164. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  165. }
  166. int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
  167. const unsigned char *iv, size_t iv_len )
  168. {
  169. size_t actual_iv_size;
  170. if( NULL == ctx || NULL == ctx->cipher_info )
  171. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  172. else if( NULL == iv && iv_len != 0 )
  173. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  174. if( NULL == iv && iv_len == 0 )
  175. ctx->iv_size = 0;
  176. /* avoid buffer overflow in ctx->iv */
  177. if( iv_len > MBEDTLS_MAX_IV_LENGTH )
  178. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  179. if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN ) != 0 )
  180. actual_iv_size = iv_len;
  181. else
  182. {
  183. actual_iv_size = ctx->cipher_info->iv_size;
  184. /* avoid reading past the end of input buffer */
  185. if( actual_iv_size > iv_len )
  186. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  187. }
  188. if ( actual_iv_size != 0 )
  189. {
  190. memcpy( ctx->iv, iv, actual_iv_size );
  191. ctx->iv_size = actual_iv_size;
  192. }
  193. return( 0 );
  194. }
  195. int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx )
  196. {
  197. if( NULL == ctx || NULL == ctx->cipher_info )
  198. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  199. ctx->unprocessed_len = 0;
  200. return( 0 );
  201. }
  202. #if defined(MBEDTLS_GCM_C)
  203. int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
  204. const unsigned char *ad, size_t ad_len )
  205. {
  206. if( NULL == ctx || NULL == ctx->cipher_info )
  207. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  208. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  209. {
  210. return mbedtls_gcm_starts( (mbedtls_gcm_context *) ctx->cipher_ctx, ctx->operation,
  211. ctx->iv, ctx->iv_size, ad, ad_len );
  212. }
  213. return( 0 );
  214. }
  215. #endif /* MBEDTLS_GCM_C */
  216. int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input,
  217. size_t ilen, unsigned char *output, size_t *olen )
  218. {
  219. int ret;
  220. size_t block_size = 0;
  221. if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
  222. {
  223. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  224. }
  225. *olen = 0;
  226. block_size = mbedtls_cipher_get_block_size( ctx );
  227. if( ctx->cipher_info->mode == MBEDTLS_MODE_ECB )
  228. {
  229. if( ilen != block_size )
  230. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  231. *olen = ilen;
  232. if( 0 != ( ret = ctx->cipher_info->base->ecb_func( ctx->cipher_ctx,
  233. ctx->operation, input, output ) ) )
  234. {
  235. return( ret );
  236. }
  237. return( 0 );
  238. }
  239. #if defined(MBEDTLS_GCM_C)
  240. if( ctx->cipher_info->mode == MBEDTLS_MODE_GCM )
  241. {
  242. *olen = ilen;
  243. return mbedtls_gcm_update( (mbedtls_gcm_context *) ctx->cipher_ctx, ilen, input,
  244. output );
  245. }
  246. #endif
  247. if ( 0 == block_size )
  248. {
  249. return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT;
  250. }
  251. if( input == output &&
  252. ( ctx->unprocessed_len != 0 || ilen % block_size ) )
  253. {
  254. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  255. }
  256. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  257. if( ctx->cipher_info->mode == MBEDTLS_MODE_CBC )
  258. {
  259. size_t copy_len = 0;
  260. /*
  261. * If there is not enough data for a full block, cache it.
  262. */
  263. if( ( ctx->operation == MBEDTLS_DECRYPT && NULL != ctx->add_padding &&
  264. ilen <= block_size - ctx->unprocessed_len ) ||
  265. ( ctx->operation == MBEDTLS_DECRYPT && NULL == ctx->add_padding &&
  266. ilen < block_size - ctx->unprocessed_len ) ||
  267. ( ctx->operation == MBEDTLS_ENCRYPT &&
  268. ilen < block_size - ctx->unprocessed_len ) )
  269. {
  270. memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
  271. ilen );
  272. ctx->unprocessed_len += ilen;
  273. return( 0 );
  274. }
  275. /*
  276. * Process cached data first
  277. */
  278. if( 0 != ctx->unprocessed_len )
  279. {
  280. copy_len = block_size - ctx->unprocessed_len;
  281. memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
  282. copy_len );
  283. if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
  284. ctx->operation, block_size, ctx->iv,
  285. ctx->unprocessed_data, output ) ) )
  286. {
  287. return( ret );
  288. }
  289. *olen += block_size;
  290. output += block_size;
  291. ctx->unprocessed_len = 0;
  292. input += copy_len;
  293. ilen -= copy_len;
  294. }
  295. /*
  296. * Cache final, incomplete block
  297. */
  298. if( 0 != ilen )
  299. {
  300. if( 0 == block_size )
  301. {
  302. return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT;
  303. }
  304. /* Encryption: only cache partial blocks
  305. * Decryption w/ padding: always keep at least one whole block
  306. * Decryption w/o padding: only cache partial blocks
  307. */
  308. copy_len = ilen % block_size;
  309. if( copy_len == 0 &&
  310. ctx->operation == MBEDTLS_DECRYPT &&
  311. NULL != ctx->add_padding)
  312. {
  313. copy_len = block_size;
  314. }
  315. memcpy( ctx->unprocessed_data, &( input[ilen - copy_len] ),
  316. copy_len );
  317. ctx->unprocessed_len += copy_len;
  318. ilen -= copy_len;
  319. }
  320. /*
  321. * Process remaining full blocks
  322. */
  323. if( ilen )
  324. {
  325. if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
  326. ctx->operation, ilen, ctx->iv, input, output ) ) )
  327. {
  328. return( ret );
  329. }
  330. *olen += ilen;
  331. }
  332. return( 0 );
  333. }
  334. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  335. #if defined(MBEDTLS_CIPHER_MODE_CFB)
  336. if( ctx->cipher_info->mode == MBEDTLS_MODE_CFB )
  337. {
  338. if( 0 != ( ret = ctx->cipher_info->base->cfb_func( ctx->cipher_ctx,
  339. ctx->operation, ilen, &ctx->unprocessed_len, ctx->iv,
  340. input, output ) ) )
  341. {
  342. return( ret );
  343. }
  344. *olen = ilen;
  345. return( 0 );
  346. }
  347. #endif /* MBEDTLS_CIPHER_MODE_CFB */
  348. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  349. if( ctx->cipher_info->mode == MBEDTLS_MODE_CTR )
  350. {
  351. if( 0 != ( ret = ctx->cipher_info->base->ctr_func( ctx->cipher_ctx,
  352. ilen, &ctx->unprocessed_len, ctx->iv,
  353. ctx->unprocessed_data, input, output ) ) )
  354. {
  355. return( ret );
  356. }
  357. *olen = ilen;
  358. return( 0 );
  359. }
  360. #endif /* MBEDTLS_CIPHER_MODE_CTR */
  361. #if defined(MBEDTLS_CIPHER_MODE_STREAM)
  362. if( ctx->cipher_info->mode == MBEDTLS_MODE_STREAM )
  363. {
  364. if( 0 != ( ret = ctx->cipher_info->base->stream_func( ctx->cipher_ctx,
  365. ilen, input, output ) ) )
  366. {
  367. return( ret );
  368. }
  369. *olen = ilen;
  370. return( 0 );
  371. }
  372. #endif /* MBEDTLS_CIPHER_MODE_STREAM */
  373. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  374. }
  375. #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
  376. #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
  377. /*
  378. * PKCS7 (and PKCS5) padding: fill with ll bytes, with ll = padding_len
  379. */
  380. static void add_pkcs_padding( unsigned char *output, size_t output_len,
  381. size_t data_len )
  382. {
  383. size_t padding_len = output_len - data_len;
  384. unsigned char i;
  385. for( i = 0; i < padding_len; i++ )
  386. output[data_len + i] = (unsigned char) padding_len;
  387. }
  388. static int get_pkcs_padding( unsigned char *input, size_t input_len,
  389. size_t *data_len )
  390. {
  391. size_t i, pad_idx;
  392. unsigned char padding_len, bad = 0;
  393. if( NULL == input || NULL == data_len )
  394. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  395. padding_len = input[input_len - 1];
  396. *data_len = input_len - padding_len;
  397. /* Avoid logical || since it results in a branch */
  398. bad |= padding_len > input_len;
  399. bad |= padding_len == 0;
  400. /* The number of bytes checked must be independent of padding_len,
  401. * so pick input_len, which is usually 8 or 16 (one block) */
  402. pad_idx = input_len - padding_len;
  403. for( i = 0; i < input_len; i++ )
  404. bad |= ( input[i] ^ padding_len ) * ( i >= pad_idx );
  405. return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
  406. }
  407. #endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */
  408. #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
  409. /*
  410. * One and zeros padding: fill with 80 00 ... 00
  411. */
  412. static void add_one_and_zeros_padding( unsigned char *output,
  413. size_t output_len, size_t data_len )
  414. {
  415. size_t padding_len = output_len - data_len;
  416. unsigned char i = 0;
  417. output[data_len] = 0x80;
  418. for( i = 1; i < padding_len; i++ )
  419. output[data_len + i] = 0x00;
  420. }
  421. static int get_one_and_zeros_padding( unsigned char *input, size_t input_len,
  422. size_t *data_len )
  423. {
  424. size_t i;
  425. unsigned char done = 0, prev_done, bad;
  426. if( NULL == input || NULL == data_len )
  427. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  428. bad = 0x80;
  429. *data_len = 0;
  430. for( i = input_len; i > 0; i-- )
  431. {
  432. prev_done = done;
  433. done |= ( input[i - 1] != 0 );
  434. *data_len |= ( i - 1 ) * ( done != prev_done );
  435. bad ^= input[i - 1] * ( done != prev_done );
  436. }
  437. return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
  438. }
  439. #endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */
  440. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
  441. /*
  442. * Zeros and len padding: fill with 00 ... 00 ll, where ll is padding length
  443. */
  444. static void add_zeros_and_len_padding( unsigned char *output,
  445. size_t output_len, size_t data_len )
  446. {
  447. size_t padding_len = output_len - data_len;
  448. unsigned char i = 0;
  449. for( i = 1; i < padding_len; i++ )
  450. output[data_len + i - 1] = 0x00;
  451. output[output_len - 1] = (unsigned char) padding_len;
  452. }
  453. static int get_zeros_and_len_padding( unsigned char *input, size_t input_len,
  454. size_t *data_len )
  455. {
  456. size_t i, pad_idx;
  457. unsigned char padding_len, bad = 0;
  458. if( NULL == input || NULL == data_len )
  459. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  460. padding_len = input[input_len - 1];
  461. *data_len = input_len - padding_len;
  462. /* Avoid logical || since it results in a branch */
  463. bad |= padding_len > input_len;
  464. bad |= padding_len == 0;
  465. /* The number of bytes checked must be independent of padding_len */
  466. pad_idx = input_len - padding_len;
  467. for( i = 0; i < input_len - 1; i++ )
  468. bad |= input[i] * ( i >= pad_idx );
  469. return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
  470. }
  471. #endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */
  472. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
  473. /*
  474. * Zero padding: fill with 00 ... 00
  475. */
  476. static void add_zeros_padding( unsigned char *output,
  477. size_t output_len, size_t data_len )
  478. {
  479. size_t i;
  480. for( i = data_len; i < output_len; i++ )
  481. output[i] = 0x00;
  482. }
  483. static int get_zeros_padding( unsigned char *input, size_t input_len,
  484. size_t *data_len )
  485. {
  486. size_t i;
  487. unsigned char done = 0, prev_done;
  488. if( NULL == input || NULL == data_len )
  489. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  490. *data_len = 0;
  491. for( i = input_len; i > 0; i-- )
  492. {
  493. prev_done = done;
  494. done |= ( input[i-1] != 0 );
  495. *data_len |= i * ( done != prev_done );
  496. }
  497. return( 0 );
  498. }
  499. #endif /* MBEDTLS_CIPHER_PADDING_ZEROS */
  500. /*
  501. * No padding: don't pad :)
  502. *
  503. * There is no add_padding function (check for NULL in mbedtls_cipher_finish)
  504. * but a trivial get_padding function
  505. */
  506. static int get_no_padding( unsigned char *input, size_t input_len,
  507. size_t *data_len )
  508. {
  509. if( NULL == input || NULL == data_len )
  510. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  511. *data_len = input_len;
  512. return( 0 );
  513. }
  514. #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
  515. int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
  516. unsigned char *output, size_t *olen )
  517. {
  518. if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
  519. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  520. *olen = 0;
  521. if( MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
  522. MBEDTLS_MODE_CTR == ctx->cipher_info->mode ||
  523. MBEDTLS_MODE_GCM == ctx->cipher_info->mode ||
  524. MBEDTLS_MODE_STREAM == ctx->cipher_info->mode )
  525. {
  526. return( 0 );
  527. }
  528. if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode )
  529. {
  530. if( ctx->unprocessed_len != 0 )
  531. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  532. return( 0 );
  533. }
  534. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  535. if( MBEDTLS_MODE_CBC == ctx->cipher_info->mode )
  536. {
  537. int ret = 0;
  538. if( MBEDTLS_ENCRYPT == ctx->operation )
  539. {
  540. /* check for 'no padding' mode */
  541. if( NULL == ctx->add_padding )
  542. {
  543. if( 0 != ctx->unprocessed_len )
  544. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  545. return( 0 );
  546. }
  547. ctx->add_padding( ctx->unprocessed_data, mbedtls_cipher_get_iv_size( ctx ),
  548. ctx->unprocessed_len );
  549. }
  550. else if( mbedtls_cipher_get_block_size( ctx ) != ctx->unprocessed_len )
  551. {
  552. /*
  553. * For decrypt operations, expect a full block,
  554. * or an empty block if no padding
  555. */
  556. if( NULL == ctx->add_padding && 0 == ctx->unprocessed_len )
  557. return( 0 );
  558. return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
  559. }
  560. /* cipher block */
  561. if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
  562. ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv,
  563. ctx->unprocessed_data, output ) ) )
  564. {
  565. return( ret );
  566. }
  567. /* Set output size for decryption */
  568. if( MBEDTLS_DECRYPT == ctx->operation )
  569. return ctx->get_padding( output, mbedtls_cipher_get_block_size( ctx ),
  570. olen );
  571. /* Set output size for encryption */
  572. *olen = mbedtls_cipher_get_block_size( ctx );
  573. return( 0 );
  574. }
  575. #else
  576. ((void) output);
  577. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  578. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  579. }
  580. #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
  581. int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx, mbedtls_cipher_padding_t mode )
  582. {
  583. if( NULL == ctx ||
  584. MBEDTLS_MODE_CBC != ctx->cipher_info->mode )
  585. {
  586. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  587. }
  588. switch( mode )
  589. {
  590. #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
  591. case MBEDTLS_PADDING_PKCS7:
  592. ctx->add_padding = add_pkcs_padding;
  593. ctx->get_padding = get_pkcs_padding;
  594. break;
  595. #endif
  596. #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
  597. case MBEDTLS_PADDING_ONE_AND_ZEROS:
  598. ctx->add_padding = add_one_and_zeros_padding;
  599. ctx->get_padding = get_one_and_zeros_padding;
  600. break;
  601. #endif
  602. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
  603. case MBEDTLS_PADDING_ZEROS_AND_LEN:
  604. ctx->add_padding = add_zeros_and_len_padding;
  605. ctx->get_padding = get_zeros_and_len_padding;
  606. break;
  607. #endif
  608. #if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
  609. case MBEDTLS_PADDING_ZEROS:
  610. ctx->add_padding = add_zeros_padding;
  611. ctx->get_padding = get_zeros_padding;
  612. break;
  613. #endif
  614. case MBEDTLS_PADDING_NONE:
  615. ctx->add_padding = NULL;
  616. ctx->get_padding = get_no_padding;
  617. break;
  618. default:
  619. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  620. }
  621. return( 0 );
  622. }
  623. #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
  624. #if defined(MBEDTLS_GCM_C)
  625. int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
  626. unsigned char *tag, size_t tag_len )
  627. {
  628. if( NULL == ctx || NULL == ctx->cipher_info || NULL == tag )
  629. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  630. if( MBEDTLS_ENCRYPT != ctx->operation )
  631. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  632. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  633. return mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx, tag, tag_len );
  634. return( 0 );
  635. }
  636. int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
  637. const unsigned char *tag, size_t tag_len )
  638. {
  639. int ret;
  640. if( NULL == ctx || NULL == ctx->cipher_info ||
  641. MBEDTLS_DECRYPT != ctx->operation )
  642. {
  643. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  644. }
  645. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  646. {
  647. unsigned char check_tag[16];
  648. size_t i;
  649. int diff;
  650. if( tag_len > sizeof( check_tag ) )
  651. return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
  652. if( 0 != ( ret = mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx,
  653. check_tag, tag_len ) ) )
  654. {
  655. return( ret );
  656. }
  657. /* Check the tag in "constant-time" */
  658. for( diff = 0, i = 0; i < tag_len; i++ )
  659. diff |= tag[i] ^ check_tag[i];
  660. if( diff != 0 )
  661. return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
  662. return( 0 );
  663. }
  664. return( 0 );
  665. }
  666. #endif /* MBEDTLS_GCM_C */
  667. /*
  668. * Packet-oriented wrapper for non-AEAD modes
  669. */
  670. int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx,
  671. const unsigned char *iv, size_t iv_len,
  672. const unsigned char *input, size_t ilen,
  673. unsigned char *output, size_t *olen )
  674. {
  675. int ret;
  676. size_t finish_olen;
  677. if( ( ret = mbedtls_cipher_set_iv( ctx, iv, iv_len ) ) != 0 )
  678. return( ret );
  679. if( ( ret = mbedtls_cipher_reset( ctx ) ) != 0 )
  680. return( ret );
  681. if( ( ret = mbedtls_cipher_update( ctx, input, ilen, output, olen ) ) != 0 )
  682. return( ret );
  683. if( ( ret = mbedtls_cipher_finish( ctx, output + *olen, &finish_olen ) ) != 0 )
  684. return( ret );
  685. *olen += finish_olen;
  686. return( 0 );
  687. }
  688. #if defined(MBEDTLS_CIPHER_MODE_AEAD)
  689. /*
  690. * Packet-oriented encryption for AEAD modes
  691. */
  692. int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx,
  693. const unsigned char *iv, size_t iv_len,
  694. const unsigned char *ad, size_t ad_len,
  695. const unsigned char *input, size_t ilen,
  696. unsigned char *output, size_t *olen,
  697. unsigned char *tag, size_t tag_len )
  698. {
  699. #if defined(MBEDTLS_GCM_C)
  700. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  701. {
  702. *olen = ilen;
  703. return( mbedtls_gcm_crypt_and_tag( ctx->cipher_ctx, MBEDTLS_GCM_ENCRYPT, ilen,
  704. iv, iv_len, ad, ad_len, input, output,
  705. tag_len, tag ) );
  706. }
  707. #endif /* MBEDTLS_GCM_C */
  708. #if defined(MBEDTLS_CCM_C)
  709. if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
  710. {
  711. *olen = ilen;
  712. return( mbedtls_ccm_encrypt_and_tag( ctx->cipher_ctx, ilen,
  713. iv, iv_len, ad, ad_len, input, output,
  714. tag, tag_len ) );
  715. }
  716. #endif /* MBEDTLS_CCM_C */
  717. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  718. }
  719. /*
  720. * Packet-oriented decryption for AEAD modes
  721. */
  722. int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx,
  723. const unsigned char *iv, size_t iv_len,
  724. const unsigned char *ad, size_t ad_len,
  725. const unsigned char *input, size_t ilen,
  726. unsigned char *output, size_t *olen,
  727. const unsigned char *tag, size_t tag_len )
  728. {
  729. #if defined(MBEDTLS_GCM_C)
  730. if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
  731. {
  732. int ret;
  733. *olen = ilen;
  734. ret = mbedtls_gcm_auth_decrypt( ctx->cipher_ctx, ilen,
  735. iv, iv_len, ad, ad_len,
  736. tag, tag_len, input, output );
  737. if( ret == MBEDTLS_ERR_GCM_AUTH_FAILED )
  738. ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
  739. return( ret );
  740. }
  741. #endif /* MBEDTLS_GCM_C */
  742. #if defined(MBEDTLS_CCM_C)
  743. if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
  744. {
  745. int ret;
  746. *olen = ilen;
  747. ret = mbedtls_ccm_auth_decrypt( ctx->cipher_ctx, ilen,
  748. iv, iv_len, ad, ad_len,
  749. input, output, tag, tag_len );
  750. if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED )
  751. ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
  752. return( ret );
  753. }
  754. #endif /* MBEDTLS_CCM_C */
  755. return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
  756. }
  757. #endif /* MBEDTLS_CIPHER_MODE_AEAD */
  758. #endif /* MBEDTLS_CIPHER_C */