ccm.h 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310
  1. /**
  2. * \file ccm.h
  3. *
  4. * \brief This file provides an API for the CCM authenticated encryption
  5. * mode for block ciphers.
  6. *
  7. * CCM combines Counter mode encryption with CBC-MAC authentication
  8. * for 128-bit block ciphers.
  9. *
  10. * Input to CCM includes the following elements:
  11. * <ul><li>Payload - data that is both authenticated and encrypted.</li>
  12. * <li>Associated data (Adata) - data that is authenticated but not
  13. * encrypted, For example, a header.</li>
  14. * <li>Nonce - A unique value that is assigned to the payload and the
  15. * associated data.</li></ul>
  16. *
  17. * Definition of CCM:
  18. * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf
  19. * RFC 3610 "Counter with CBC-MAC (CCM)"
  20. *
  21. * Related:
  22. * RFC 5116 "An Interface and Algorithms for Authenticated Encryption"
  23. *
  24. * Definition of CCM*:
  25. * IEEE 802.15.4 - IEEE Standard for Local and metropolitan area networks
  26. * Integer representation is fixed most-significant-octet-first order and
  27. * the representation of octets is most-significant-bit-first order. This is
  28. * consistent with RFC 3610.
  29. */
  30. /*
  31. * Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
  32. * SPDX-License-Identifier: Apache-2.0
  33. *
  34. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  35. * not use this file except in compliance with the License.
  36. * You may obtain a copy of the License at
  37. *
  38. * http://www.apache.org/licenses/LICENSE-2.0
  39. *
  40. * Unless required by applicable law or agreed to in writing, software
  41. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  42. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  43. * See the License for the specific language governing permissions and
  44. * limitations under the License.
  45. *
  46. * This file is part of Mbed TLS (https://tls.mbed.org)
  47. */
  48. #ifndef MBEDTLS_CCM_H
  49. #define MBEDTLS_CCM_H
  50. #if !defined(MBEDTLS_CONFIG_FILE)
  51. #include "config.h"
  52. #else
  53. #include MBEDTLS_CONFIG_FILE
  54. #endif
  55. #include "cipher.h"
  56. #define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D /**< Bad input parameters to the function. */
  57. #define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F /**< Authenticated decryption failed. */
  58. /* MBEDTLS_ERR_CCM_HW_ACCEL_FAILED is deprecated and should not be used. */
  59. #define MBEDTLS_ERR_CCM_HW_ACCEL_FAILED -0x0011 /**< CCM hardware accelerator failed. */
  60. #ifdef __cplusplus
  61. extern "C" {
  62. #endif
  63. #if !defined(MBEDTLS_CCM_ALT)
  64. // Regular implementation
  65. //
  66. /**
  67. * \brief The CCM context-type definition. The CCM context is passed
  68. * to the APIs called.
  69. */
  70. typedef struct mbedtls_ccm_context
  71. {
  72. mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */
  73. }
  74. mbedtls_ccm_context;
  75. #else /* MBEDTLS_CCM_ALT */
  76. #include "ccm_alt.h"
  77. #endif /* MBEDTLS_CCM_ALT */
  78. /**
  79. * \brief This function initializes the specified CCM context,
  80. * to make references valid, and prepare the context
  81. * for mbedtls_ccm_setkey() or mbedtls_ccm_free().
  82. *
  83. * \param ctx The CCM context to initialize. This must not be \c NULL.
  84. */
  85. void mbedtls_ccm_init( mbedtls_ccm_context *ctx );
  86. /**
  87. * \brief This function initializes the CCM context set in the
  88. * \p ctx parameter and sets the encryption key.
  89. *
  90. * \param ctx The CCM context to initialize. This must be an initialized
  91. * context.
  92. * \param cipher The 128-bit block cipher to use.
  93. * \param key The encryption key. This must not be \c NULL.
  94. * \param keybits The key size in bits. This must be acceptable by the cipher.
  95. *
  96. * \return \c 0 on success.
  97. * \return A CCM or cipher-specific error code on failure.
  98. */
  99. int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx,
  100. mbedtls_cipher_id_t cipher,
  101. const unsigned char *key,
  102. unsigned int keybits );
  103. /**
  104. * \brief This function releases and clears the specified CCM context
  105. * and underlying cipher sub-context.
  106. *
  107. * \param ctx The CCM context to clear. If this is \c NULL, the function
  108. * has no effect. Otherwise, this must be initialized.
  109. */
  110. void mbedtls_ccm_free( mbedtls_ccm_context *ctx );
  111. /**
  112. * \brief This function encrypts a buffer using CCM.
  113. *
  114. * \note The tag is written to a separate buffer. To concatenate
  115. * the \p tag with the \p output, as done in <em>RFC-3610:
  116. * Counter with CBC-MAC (CCM)</em>, use
  117. * \p tag = \p output + \p length, and make sure that the
  118. * output buffer is at least \p length + \p tag_len wide.
  119. *
  120. * \param ctx The CCM context to use for encryption. This must be
  121. * initialized and bound to a key.
  122. * \param length The length of the input data in Bytes.
  123. * \param iv The initialization vector (nonce). This must be a readable
  124. * buffer of at least \p iv_len Bytes.
  125. * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12,
  126. * or 13. The length L of the message length field is
  127. * 15 - \p iv_len.
  128. * \param add The additional data field. If \p add_len is greater than
  129. * zero, \p add must be a readable buffer of at least that
  130. * length.
  131. * \param add_len The length of additional data in Bytes.
  132. * This must be less than `2^16 - 2^8`.
  133. * \param input The buffer holding the input data. If \p length is greater
  134. * than zero, \p input must be a readable buffer of at least
  135. * that length.
  136. * \param output The buffer holding the output data. If \p length is greater
  137. * than zero, \p output must be a writable buffer of at least
  138. * that length.
  139. * \param tag The buffer holding the authentication field. This must be a
  140. * readable buffer of at least \p tag_len Bytes.
  141. * \param tag_len The length of the authentication field to generate in Bytes:
  142. * 4, 6, 8, 10, 12, 14 or 16.
  143. *
  144. * \return \c 0 on success.
  145. * \return A CCM or cipher-specific error code on failure.
  146. */
  147. int mbedtls_ccm_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
  148. const unsigned char *iv, size_t iv_len,
  149. const unsigned char *add, size_t add_len,
  150. const unsigned char *input, unsigned char *output,
  151. unsigned char *tag, size_t tag_len );
  152. /**
  153. * \brief This function encrypts a buffer using CCM*.
  154. *
  155. * \note The tag is written to a separate buffer. To concatenate
  156. * the \p tag with the \p output, as done in <em>RFC-3610:
  157. * Counter with CBC-MAC (CCM)</em>, use
  158. * \p tag = \p output + \p length, and make sure that the
  159. * output buffer is at least \p length + \p tag_len wide.
  160. *
  161. * \note When using this function in a variable tag length context,
  162. * the tag length has to be encoded into the \p iv passed to
  163. * this function.
  164. *
  165. * \param ctx The CCM context to use for encryption. This must be
  166. * initialized and bound to a key.
  167. * \param length The length of the input data in Bytes.
  168. * \param iv The initialization vector (nonce). This must be a readable
  169. * buffer of at least \p iv_len Bytes.
  170. * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12,
  171. * or 13. The length L of the message length field is
  172. * 15 - \p iv_len.
  173. * \param add The additional data field. This must be a readable buffer of
  174. * at least \p add_len Bytes.
  175. * \param add_len The length of additional data in Bytes.
  176. * This must be less than 2^16 - 2^8.
  177. * \param input The buffer holding the input data. If \p length is greater
  178. * than zero, \p input must be a readable buffer of at least
  179. * that length.
  180. * \param output The buffer holding the output data. If \p length is greater
  181. * than zero, \p output must be a writable buffer of at least
  182. * that length.
  183. * \param tag The buffer holding the authentication field. This must be a
  184. * readable buffer of at least \p tag_len Bytes.
  185. * \param tag_len The length of the authentication field to generate in Bytes:
  186. * 0, 4, 6, 8, 10, 12, 14 or 16.
  187. *
  188. * \warning Passing \c 0 as \p tag_len means that the message is no
  189. * longer authenticated.
  190. *
  191. * \return \c 0 on success.
  192. * \return A CCM or cipher-specific error code on failure.
  193. */
  194. int mbedtls_ccm_star_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
  195. const unsigned char *iv, size_t iv_len,
  196. const unsigned char *add, size_t add_len,
  197. const unsigned char *input, unsigned char *output,
  198. unsigned char *tag, size_t tag_len );
  199. /**
  200. * \brief This function performs a CCM authenticated decryption of a
  201. * buffer.
  202. *
  203. * \param ctx The CCM context to use for decryption. This must be
  204. * initialized and bound to a key.
  205. * \param length The length of the input data in Bytes.
  206. * \param iv The initialization vector (nonce). This must be a readable
  207. * buffer of at least \p iv_len Bytes.
  208. * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12,
  209. * or 13. The length L of the message length field is
  210. * 15 - \p iv_len.
  211. * \param add The additional data field. This must be a readable buffer
  212. * of at least that \p add_len Bytes..
  213. * \param add_len The length of additional data in Bytes.
  214. * This must be less than 2^16 - 2^8.
  215. * \param input The buffer holding the input data. If \p length is greater
  216. * than zero, \p input must be a readable buffer of at least
  217. * that length.
  218. * \param output The buffer holding the output data. If \p length is greater
  219. * than zero, \p output must be a writable buffer of at least
  220. * that length.
  221. * \param tag The buffer holding the authentication field. This must be a
  222. * readable buffer of at least \p tag_len Bytes.
  223. * \param tag_len The length of the authentication field to generate in Bytes:
  224. * 4, 6, 8, 10, 12, 14 or 16.
  225. *
  226. * \return \c 0 on success. This indicates that the message is authentic.
  227. * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match.
  228. * \return A cipher-specific error code on calculation failure.
  229. */
  230. int mbedtls_ccm_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
  231. const unsigned char *iv, size_t iv_len,
  232. const unsigned char *add, size_t add_len,
  233. const unsigned char *input, unsigned char *output,
  234. const unsigned char *tag, size_t tag_len );
  235. /**
  236. * \brief This function performs a CCM* authenticated decryption of a
  237. * buffer.
  238. *
  239. * \note When using this function in a variable tag length context,
  240. * the tag length has to be decoded from \p iv and passed to
  241. * this function as \p tag_len. (\p tag needs to be adjusted
  242. * accordingly.)
  243. *
  244. * \param ctx The CCM context to use for decryption. This must be
  245. * initialized and bound to a key.
  246. * \param length The length of the input data in Bytes.
  247. * \param iv The initialization vector (nonce). This must be a readable
  248. * buffer of at least \p iv_len Bytes.
  249. * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12,
  250. * or 13. The length L of the message length field is
  251. * 15 - \p iv_len.
  252. * \param add The additional data field. This must be a readable buffer of
  253. * at least that \p add_len Bytes.
  254. * \param add_len The length of additional data in Bytes.
  255. * This must be less than 2^16 - 2^8.
  256. * \param input The buffer holding the input data. If \p length is greater
  257. * than zero, \p input must be a readable buffer of at least
  258. * that length.
  259. * \param output The buffer holding the output data. If \p length is greater
  260. * than zero, \p output must be a writable buffer of at least
  261. * that length.
  262. * \param tag The buffer holding the authentication field. This must be a
  263. * readable buffer of at least \p tag_len Bytes.
  264. * \param tag_len The length of the authentication field in Bytes.
  265. * 0, 4, 6, 8, 10, 12, 14 or 16.
  266. *
  267. * \warning Passing \c 0 as \p tag_len means that the message is nos
  268. * longer authenticated.
  269. *
  270. * \return \c 0 on success.
  271. * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match.
  272. * \return A cipher-specific error code on calculation failure.
  273. */
  274. int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
  275. const unsigned char *iv, size_t iv_len,
  276. const unsigned char *add, size_t add_len,
  277. const unsigned char *input, unsigned char *output,
  278. const unsigned char *tag, size_t tag_len );
  279. #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
  280. /**
  281. * \brief The CCM checkup routine.
  282. *
  283. * \return \c 0 on success.
  284. * \return \c 1 on failure.
  285. */
  286. int mbedtls_ccm_self_test( int verbose );
  287. #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
  288. #ifdef __cplusplus
  289. }
  290. #endif
  291. #endif /* MBEDTLS_CCM_H */