Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 1 | /** |
| 2 | * \file cipher.c |
Paul Bakker | 7dc4c44 | 2014-02-01 22:50:26 +0100 | [diff] [blame] | 3 | * |
Manuel Pégourié-Gonnard | b4fe3cb | 2015-01-22 16:11:05 +0000 | [diff] [blame] | 4 | * \brief Generic cipher wrapper for mbed TLS |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 5 | * |
| 6 | * \author Adriaan de Jong <dejong@fox-it.com> |
| 7 | * |
Manuel Pégourié-Gonnard | 6fb8187 | 2015-07-27 11:11:48 +0200 | [diff] [blame] | 8 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 9 | * SPDX-License-Identifier: Apache-2.0 |
| 10 | * |
| 11 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 12 | * not use this file except in compliance with the License. |
| 13 | * You may obtain a copy of the License at |
| 14 | * |
| 15 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 16 | * |
| 17 | * Unless required by applicable law or agreed to in writing, software |
| 18 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 19 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 20 | * See the License for the specific language governing permissions and |
| 21 | * limitations under the License. |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 22 | * |
Manuel Pégourié-Gonnard | fe44643 | 2015-03-06 13:17:10 +0000 | [diff] [blame] | 23 | * This file is part of mbed TLS (https://tls.mbed.org) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 24 | */ |
| 25 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 26 | #if !defined(MBEDTLS_CONFIG_FILE) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 27 | #include "mbedtls/config.h" |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 28 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 29 | #include MBEDTLS_CONFIG_FILE |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 30 | #endif |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 31 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 32 | #if defined(MBEDTLS_CIPHER_C) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 33 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 34 | #include "mbedtls/cipher.h" |
Manuel Pégourié-Gonnard | 50518f4 | 2015-05-26 11:04:15 +0200 | [diff] [blame] | 35 | #include "mbedtls/cipher_internal.h" |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 36 | #include "mbedtls/platform_util.h" |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 37 | |
Rich Evans | 00ab470 | 2015-02-06 13:43:58 +0000 | [diff] [blame] | 38 | #include <stdlib.h> |
| 39 | #include <string.h> |
| 40 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 41 | #if defined(MBEDTLS_CHACHAPOLY_C) |
| 42 | #include "mbedtls/chachapoly.h" |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 43 | #endif |
| 44 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 45 | #if defined(MBEDTLS_GCM_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 46 | #include "mbedtls/gcm.h" |
Manuel Pégourié-Gonnard | 07f8fa5 | 2013-08-30 18:34:08 +0200 | [diff] [blame] | 47 | #endif |
| 48 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 49 | #if defined(MBEDTLS_CCM_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 50 | #include "mbedtls/ccm.h" |
Manuel Pégourié-Gonnard | 4193695 | 2014-05-13 13:18:17 +0200 | [diff] [blame] | 51 | #endif |
| 52 | |
Daniel King | bd92062 | 2016-05-15 19:56:20 -0300 | [diff] [blame] | 53 | #if defined(MBEDTLS_CHACHA20_C) |
| 54 | #include "mbedtls/chacha20.h" |
| 55 | #endif |
| 56 | |
Simon Butcher | 327398a | 2016-10-05 14:09:11 +0100 | [diff] [blame] | 57 | #if defined(MBEDTLS_CMAC_C) |
| 58 | #include "mbedtls/cmac.h" |
| 59 | #endif |
| 60 | |
Hanno Becker | 4ccfc40 | 2018-11-09 16:10:57 +0000 | [diff] [blame] | 61 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 62 | #include "psa/crypto.h" |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 63 | #include "mbedtls/psa_util.h" |
Hanno Becker | 4ccfc40 | 2018-11-09 16:10:57 +0000 | [diff] [blame] | 64 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 65 | |
Simon Butcher | 327398a | 2016-10-05 14:09:11 +0100 | [diff] [blame] | 66 | #if defined(MBEDTLS_PLATFORM_C) |
| 67 | #include "mbedtls/platform.h" |
| 68 | #else |
| 69 | #define mbedtls_calloc calloc |
| 70 | #define mbedtls_free free |
| 71 | #endif |
| 72 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 73 | #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 74 | /* Compare the contents of two buffers in constant time. |
| 75 | * Returns 0 if the contents are bitwise identical, otherwise returns |
Daniel King | 16b04ce | 2016-05-18 13:38:22 -0300 | [diff] [blame] | 76 | * a non-zero value. |
| 77 | * This is currently only used by GCM and ChaCha20+Poly1305. |
| 78 | */ |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 79 | static int mbedtls_constant_time_memcmp( const void *v1, const void *v2, |
| 80 | size_t len ) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 81 | { |
| 82 | const unsigned char *p1 = (const unsigned char*) v1; |
| 83 | const unsigned char *p2 = (const unsigned char*) v2; |
| 84 | size_t i; |
| 85 | unsigned char diff; |
| 86 | |
| 87 | for( diff = 0, i = 0; i < len; i++ ) |
| 88 | diff |= p1[i] ^ p2[i]; |
| 89 | |
| 90 | return (int)diff; |
| 91 | } |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 92 | #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 93 | |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 94 | static int supported_init = 0; |
Paul Bakker | 72f6266 | 2011-01-16 21:27:44 +0000 | [diff] [blame] | 95 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 96 | const int *mbedtls_cipher_list( void ) |
Paul Bakker | 72f6266 | 2011-01-16 21:27:44 +0000 | [diff] [blame] | 97 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 98 | const mbedtls_cipher_definition_t *def; |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 99 | int *type; |
| 100 | |
| 101 | if( ! supported_init ) |
| 102 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 103 | def = mbedtls_cipher_definitions; |
| 104 | type = mbedtls_cipher_supported; |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 105 | |
| 106 | while( def->type != 0 ) |
| 107 | *type++ = (*def++).type; |
| 108 | |
| 109 | *type = 0; |
| 110 | |
| 111 | supported_init = 1; |
| 112 | } |
| 113 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 114 | return( mbedtls_cipher_supported ); |
Paul Bakker | 72f6266 | 2011-01-16 21:27:44 +0000 | [diff] [blame] | 115 | } |
| 116 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 117 | const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( |
| 118 | const mbedtls_cipher_type_t cipher_type ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 119 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 120 | const mbedtls_cipher_definition_t *def; |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 121 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 122 | for( def = mbedtls_cipher_definitions; def->info != NULL; def++ ) |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 123 | if( def->type == cipher_type ) |
| 124 | return( def->info ); |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 125 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 126 | return( NULL ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 127 | } |
| 128 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 129 | const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( |
| 130 | const char *cipher_name ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 131 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 132 | const mbedtls_cipher_definition_t *def; |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 133 | |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 134 | if( NULL == cipher_name ) |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 135 | return( NULL ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 136 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 137 | for( def = mbedtls_cipher_definitions; def->info != NULL; def++ ) |
Manuel Pégourié-Gonnard | cb46fd8 | 2015-05-28 17:06:07 +0200 | [diff] [blame] | 138 | if( ! strcmp( def->info->name, cipher_name ) ) |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 139 | return( def->info ); |
Paul Bakker | fab5c82 | 2012-02-06 16:45:10 +0000 | [diff] [blame] | 140 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 141 | return( NULL ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 142 | } |
| 143 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 144 | const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( |
| 145 | const mbedtls_cipher_id_t cipher_id, |
| 146 | int key_bitlen, |
| 147 | const mbedtls_cipher_mode_t mode ) |
Paul Bakker | f46b695 | 2013-09-09 00:08:26 +0200 | [diff] [blame] | 148 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 149 | const mbedtls_cipher_definition_t *def; |
Paul Bakker | f46b695 | 2013-09-09 00:08:26 +0200 | [diff] [blame] | 150 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 151 | for( def = mbedtls_cipher_definitions; def->info != NULL; def++ ) |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 152 | if( def->info->base->cipher == cipher_id && |
Manuel Pégourié-Gonnard | 898e0aa | 2015-06-18 15:28:12 +0200 | [diff] [blame] | 153 | def->info->key_bitlen == (unsigned) key_bitlen && |
Manuel Pégourié-Gonnard | dace82f | 2013-09-18 15:12:07 +0200 | [diff] [blame] | 154 | def->info->mode == mode ) |
| 155 | return( def->info ); |
Paul Bakker | f46b695 | 2013-09-09 00:08:26 +0200 | [diff] [blame] | 156 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 157 | return( NULL ); |
Paul Bakker | f46b695 | 2013-09-09 00:08:26 +0200 | [diff] [blame] | 158 | } |
| 159 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 160 | void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx ) |
Paul Bakker | 84bbeb5 | 2014-07-01 14:53:22 +0200 | [diff] [blame] | 161 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 162 | memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) ); |
Paul Bakker | 84bbeb5 | 2014-07-01 14:53:22 +0200 | [diff] [blame] | 163 | } |
| 164 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 165 | void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx ) |
Paul Bakker | 84bbeb5 | 2014-07-01 14:53:22 +0200 | [diff] [blame] | 166 | { |
| 167 | if( ctx == NULL ) |
| 168 | return; |
| 169 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 170 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 171 | if( ctx->psa_enabled == 1 ) |
| 172 | { |
Hanno Becker | 6118e43 | 2018-11-09 16:47:20 +0000 | [diff] [blame] | 173 | if( ctx->cipher_ctx != NULL ) |
| 174 | { |
| 175 | mbedtls_cipher_context_psa * const cipher_psa = |
| 176 | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
| 177 | |
| 178 | if( cipher_psa->slot_state == 1 ) |
| 179 | { |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 180 | /* xxx_free() doesn't allow to return failures. */ |
| 181 | (void) psa_destroy_key( cipher_psa->slot ); |
Hanno Becker | 6118e43 | 2018-11-09 16:47:20 +0000 | [diff] [blame] | 182 | } |
| 183 | |
| 184 | mbedtls_platform_zeroize( cipher_psa, sizeof( *cipher_psa ) ); |
| 185 | mbedtls_free( cipher_psa ); |
| 186 | } |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 187 | |
| 188 | mbedtls_platform_zeroize( ctx, sizeof(mbedtls_cipher_context_t) ); |
| 189 | return; |
| 190 | } |
| 191 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 192 | |
Simon Butcher | 327398a | 2016-10-05 14:09:11 +0100 | [diff] [blame] | 193 | #if defined(MBEDTLS_CMAC_C) |
| 194 | if( ctx->cmac_ctx ) |
| 195 | { |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 196 | mbedtls_platform_zeroize( ctx->cmac_ctx, |
| 197 | sizeof( mbedtls_cmac_context_t ) ); |
Simon Butcher | 327398a | 2016-10-05 14:09:11 +0100 | [diff] [blame] | 198 | mbedtls_free( ctx->cmac_ctx ); |
| 199 | } |
| 200 | #endif |
| 201 | |
Paul Bakker | 84bbeb5 | 2014-07-01 14:53:22 +0200 | [diff] [blame] | 202 | if( ctx->cipher_ctx ) |
| 203 | ctx->cipher_info->base->ctx_free_func( ctx->cipher_ctx ); |
| 204 | |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 205 | mbedtls_platform_zeroize( ctx, sizeof(mbedtls_cipher_context_t) ); |
Paul Bakker | 84bbeb5 | 2014-07-01 14:53:22 +0200 | [diff] [blame] | 206 | } |
| 207 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 208 | int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx, |
| 209 | const mbedtls_cipher_info_t *cipher_info ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 210 | { |
| 211 | if( NULL == cipher_info || NULL == ctx ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 212 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 213 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 214 | memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 215 | |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 216 | if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 217 | return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 218 | |
| 219 | ctx->cipher_info = cipher_info; |
| 220 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 221 | #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 222 | /* |
| 223 | * Ignore possible errors caused by a cipher mode that doesn't use padding |
| 224 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 225 | #if defined(MBEDTLS_CIPHER_PADDING_PKCS7) |
| 226 | (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_PKCS7 ); |
Paul Bakker | 48e93c8 | 2013-08-14 12:21:18 +0200 | [diff] [blame] | 227 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 228 | (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_NONE ); |
Paul Bakker | 48e93c8 | 2013-08-14 12:21:18 +0200 | [diff] [blame] | 229 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 230 | #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 231 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 232 | return( 0 ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 233 | } |
| 234 | |
Hanno Becker | 4ccfc40 | 2018-11-09 16:10:57 +0000 | [diff] [blame] | 235 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 236 | int mbedtls_cipher_setup_psa( mbedtls_cipher_context_t *ctx, |
Hanno Becker | 20120b3 | 2018-11-12 16:26:27 +0000 | [diff] [blame] | 237 | const mbedtls_cipher_info_t *cipher_info, |
| 238 | size_t taglen ) |
Hanno Becker | 4ccfc40 | 2018-11-09 16:10:57 +0000 | [diff] [blame] | 239 | { |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 240 | psa_algorithm_t alg; |
| 241 | mbedtls_cipher_context_psa *cipher_psa; |
| 242 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 243 | if( NULL == cipher_info || NULL == ctx ) |
| 244 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 245 | |
Hanno Becker | 4ee7e76 | 2018-11-17 22:00:38 +0000 | [diff] [blame^] | 246 | /* Check that the underlying cipher mode and cipher type are |
| 247 | * supported by the underlying PSA Crypto implementation. */ |
Hanno Becker | 20120b3 | 2018-11-12 16:26:27 +0000 | [diff] [blame] | 248 | alg = mbedtls_psa_translate_cipher_mode( cipher_info->mode, taglen ); |
Hanno Becker | 4ee7e76 | 2018-11-17 22:00:38 +0000 | [diff] [blame^] | 249 | if( alg == 0 ) |
| 250 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 251 | if( mbedtls_psa_translate_cipher_type( cipher_info->type ) == 0 ) |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 252 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
Hanno Becker | 6118e43 | 2018-11-09 16:47:20 +0000 | [diff] [blame] | 253 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 254 | memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) ); |
| 255 | |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 256 | cipher_psa = mbedtls_calloc( 1, sizeof(mbedtls_cipher_context_psa ) ); |
| 257 | if( cipher_psa == NULL ) |
| 258 | return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED ); |
| 259 | cipher_psa->alg = alg; |
| 260 | ctx->cipher_ctx = cipher_psa; |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 261 | ctx->cipher_info = cipher_info; |
| 262 | ctx->psa_enabled = 1; |
| 263 | return( 0 ); |
Hanno Becker | 4ccfc40 | 2018-11-09 16:10:57 +0000 | [diff] [blame] | 264 | } |
| 265 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 266 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 267 | int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx, |
| 268 | const unsigned char *key, |
| 269 | int key_bitlen, |
| 270 | const mbedtls_operation_t operation ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 271 | { |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 272 | if( NULL == ctx || NULL == ctx->cipher_info || |
| 273 | NULL == ctx->cipher_ctx ) |
| 274 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 275 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 276 | } |
| 277 | |
| 278 | if( operation != MBEDTLS_DECRYPT && |
| 279 | operation != MBEDTLS_ENCRYPT ) |
| 280 | { |
| 281 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 282 | } |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 283 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 284 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 285 | if( ctx->psa_enabled == 1 ) |
| 286 | { |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 287 | mbedtls_cipher_context_psa * const cipher_psa = |
| 288 | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
| 289 | |
| 290 | size_t const key_bytelen = ( (size_t) key_bitlen + 7 ) / 8; |
| 291 | |
| 292 | psa_status_t status; |
| 293 | psa_key_type_t key_type; |
| 294 | psa_key_usage_t key_usage; |
| 295 | psa_key_policy_t key_policy; |
| 296 | |
| 297 | /* PSA Crypto API only accepts byte-aligned keys. */ |
| 298 | if( key_bitlen % 8 != 0 ) |
| 299 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 300 | |
| 301 | /* Don't allow keys to be set multiple times. */ |
| 302 | if( cipher_psa->slot_state != 0 ) |
| 303 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 304 | |
| 305 | /* Find a fresh key slot to use. */ |
| 306 | status = mbedtls_psa_get_free_key_slot( &cipher_psa->slot ); |
| 307 | if( status != PSA_SUCCESS ) |
| 308 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 309 | cipher_psa->slot_state = 1; /* Indicate that we own the key slot. */ |
| 310 | |
| 311 | /* From that point on, the responsibility for destroying the |
| 312 | * key slot is on mbedtls_cipher_free(). This includes the case |
| 313 | * where the policy setup or key import below fail, as |
| 314 | * mbedtls_cipher_free() needs to be called in any case. */ |
| 315 | |
| 316 | /* Setup policy for the new key slot. */ |
| 317 | psa_key_policy_init( &key_policy ); |
Hanno Becker | a395d8f | 2018-11-12 13:33:16 +0000 | [diff] [blame] | 318 | |
| 319 | /* Mbed TLS' cipher layer doesn't enforce the mode of operation |
| 320 | * (encrypt vs. decrypt): it is possible to setup a key for encryption |
| 321 | * and use it for AEAD decryption. Until tests relying on this |
| 322 | * are changed, allow any usage in PSA. */ |
| 323 | /* key_usage = mbedtls_psa_translate_cipher_operation( operation ); */ |
| 324 | key_usage = PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT; |
Hanno Becker | edda8b8 | 2018-11-12 11:59:30 +0000 | [diff] [blame] | 325 | psa_key_policy_set_usage( &key_policy, key_usage, cipher_psa->alg ); |
| 326 | status = psa_set_key_policy( cipher_psa->slot, &key_policy ); |
| 327 | if( status != PSA_SUCCESS ) |
| 328 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 329 | |
| 330 | /* Populate new key slot. */ |
| 331 | key_type = mbedtls_psa_translate_cipher_type( |
| 332 | ctx->cipher_info->type ); |
| 333 | if( key_type == 0 ) |
| 334 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 335 | status = psa_import_key( cipher_psa->slot, |
| 336 | key_type, key, key_bytelen ); |
| 337 | if( status != PSA_SUCCESS ) |
| 338 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 339 | |
| 340 | ctx->key_bitlen = key_bitlen; |
| 341 | ctx->operation = operation; |
| 342 | return( 0 ); |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 343 | } |
| 344 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 345 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 346 | if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN ) == 0 && |
Manuel Pégourié-Gonnard | 898e0aa | 2015-06-18 15:28:12 +0200 | [diff] [blame] | 347 | (int) ctx->cipher_info->key_bitlen != key_bitlen ) |
Manuel Pégourié-Gonnard | 398c57b | 2014-06-23 12:10:59 +0200 | [diff] [blame] | 348 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 349 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 398c57b | 2014-06-23 12:10:59 +0200 | [diff] [blame] | 350 | } |
Manuel Pégourié-Gonnard | dd0f57f | 2013-09-16 11:47:43 +0200 | [diff] [blame] | 351 | |
Manuel Pégourié-Gonnard | 898e0aa | 2015-06-18 15:28:12 +0200 | [diff] [blame] | 352 | ctx->key_bitlen = key_bitlen; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 353 | ctx->operation = operation; |
| 354 | |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 355 | /* |
Simon Butcher | 8c0fd1e | 2018-04-22 22:58:07 +0100 | [diff] [blame] | 356 | * For OFB, CFB and CTR mode always use the encryption key schedule |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 357 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 358 | if( MBEDTLS_ENCRYPT == operation || |
| 359 | MBEDTLS_MODE_CFB == ctx->cipher_info->mode || |
Simon Butcher | 8c0fd1e | 2018-04-22 22:58:07 +0100 | [diff] [blame] | 360 | MBEDTLS_MODE_OFB == ctx->cipher_info->mode || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 361 | MBEDTLS_MODE_CTR == ctx->cipher_info->mode ) |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 362 | { |
| 363 | return ctx->cipher_info->base->setkey_enc_func( ctx->cipher_ctx, key, |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 364 | ctx->key_bitlen ); |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 365 | } |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 366 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 367 | if( MBEDTLS_DECRYPT == operation ) |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 368 | return ctx->cipher_info->base->setkey_dec_func( ctx->cipher_ctx, key, |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 369 | ctx->key_bitlen ); |
| 370 | |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 371 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 372 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 373 | } |
| 374 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 375 | int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | 9c853b9 | 2013-09-03 13:04:44 +0200 | [diff] [blame] | 376 | const unsigned char *iv, size_t iv_len ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 377 | { |
Manuel Pégourié-Gonnard | a235b5b | 2013-09-03 13:25:52 +0200 | [diff] [blame] | 378 | size_t actual_iv_size; |
Ron Eldor | 4e64e0b | 2017-09-25 18:22:32 +0300 | [diff] [blame] | 379 | if( NULL == ctx || NULL == ctx->cipher_info ) |
| 380 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 381 | else if( NULL == iv && iv_len != 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 382 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 383 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 384 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 385 | if( ctx->psa_enabled == 1 ) |
| 386 | { |
| 387 | /* While PSA Crypto has an API for multipart |
| 388 | * operations, we currently don't make it |
| 389 | * accessible through the cipher layer. */ |
| 390 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 391 | } |
| 392 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 393 | |
Ron Eldor | bb4bbbb | 2017-10-01 17:04:54 +0300 | [diff] [blame] | 394 | if( NULL == iv && iv_len == 0 ) |
| 395 | ctx->iv_size = 0; |
| 396 | |
Manuel Pégourié-Gonnard | e0dca4a | 2013-10-24 16:54:25 +0200 | [diff] [blame] | 397 | /* avoid buffer overflow in ctx->iv */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 398 | if( iv_len > MBEDTLS_MAX_IV_LENGTH ) |
| 399 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
Manuel Pégourié-Gonnard | e0dca4a | 2013-10-24 16:54:25 +0200 | [diff] [blame] | 400 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 401 | if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN ) != 0 ) |
Manuel Pégourié-Gonnard | a235b5b | 2013-09-03 13:25:52 +0200 | [diff] [blame] | 402 | actual_iv_size = iv_len; |
| 403 | else |
Manuel Pégourié-Gonnard | e0dca4a | 2013-10-24 16:54:25 +0200 | [diff] [blame] | 404 | { |
Manuel Pégourié-Gonnard | a235b5b | 2013-09-03 13:25:52 +0200 | [diff] [blame] | 405 | actual_iv_size = ctx->cipher_info->iv_size; |
Manuel Pégourié-Gonnard | 9c853b9 | 2013-09-03 13:04:44 +0200 | [diff] [blame] | 406 | |
Manuel Pégourié-Gonnard | e0dca4a | 2013-10-24 16:54:25 +0200 | [diff] [blame] | 407 | /* avoid reading past the end of input buffer */ |
| 408 | if( actual_iv_size > iv_len ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 409 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | e0dca4a | 2013-10-24 16:54:25 +0200 | [diff] [blame] | 410 | } |
| 411 | |
Daniel King | bd92062 | 2016-05-15 19:56:20 -0300 | [diff] [blame] | 412 | #if defined(MBEDTLS_CHACHA20_C) |
| 413 | if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20 ) |
| 414 | { |
| 415 | if ( 0 != mbedtls_chacha20_starts( (mbedtls_chacha20_context*)ctx->cipher_ctx, |
| 416 | iv, |
| 417 | 0U ) ) /* Initial counter value */ |
| 418 | { |
| 419 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 420 | } |
| 421 | } |
| 422 | #endif |
| 423 | |
Ron Eldor | bb4bbbb | 2017-10-01 17:04:54 +0300 | [diff] [blame] | 424 | if ( actual_iv_size != 0 ) |
Ron Eldor | 4e64e0b | 2017-09-25 18:22:32 +0300 | [diff] [blame] | 425 | { |
| 426 | memcpy( ctx->iv, iv, actual_iv_size ); |
| 427 | ctx->iv_size = actual_iv_size; |
| 428 | } |
Manuel Pégourié-Gonnard | 9c853b9 | 2013-09-03 13:04:44 +0200 | [diff] [blame] | 429 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 430 | return( 0 ); |
Manuel Pégourié-Gonnard | 9c853b9 | 2013-09-03 13:04:44 +0200 | [diff] [blame] | 431 | } |
| 432 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 433 | int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx ) |
Manuel Pégourié-Gonnard | 9c853b9 | 2013-09-03 13:04:44 +0200 | [diff] [blame] | 434 | { |
Manuel Pégourié-Gonnard | 2adc40c | 2013-09-03 13:54:12 +0200 | [diff] [blame] | 435 | if( NULL == ctx || NULL == ctx->cipher_info ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 436 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 2adc40c | 2013-09-03 13:54:12 +0200 | [diff] [blame] | 437 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 438 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 439 | if( ctx->psa_enabled == 1 ) |
| 440 | { |
| 441 | /* We don't support resetting PSA-based |
| 442 | * cipher contexts, yet. */ |
| 443 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 444 | } |
| 445 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 446 | |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 447 | ctx->unprocessed_len = 0; |
| 448 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 449 | return( 0 ); |
Manuel Pégourié-Gonnard | 2adc40c | 2013-09-03 13:54:12 +0200 | [diff] [blame] | 450 | } |
| 451 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 452 | #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 453 | int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | 2adc40c | 2013-09-03 13:54:12 +0200 | [diff] [blame] | 454 | const unsigned char *ad, size_t ad_len ) |
| 455 | { |
| 456 | if( NULL == ctx || NULL == ctx->cipher_info ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 457 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 2adc40c | 2013-09-03 13:54:12 +0200 | [diff] [blame] | 458 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 459 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 460 | if( ctx->psa_enabled == 1 ) |
| 461 | { |
| 462 | /* While PSA Crypto has an API for multipart |
| 463 | * operations, we currently don't make it |
| 464 | * accessible through the cipher layer. */ |
| 465 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 466 | } |
| 467 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 468 | |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 469 | #if defined(MBEDTLS_GCM_C) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 470 | if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode ) |
Manuel Pégourié-Gonnard | 07f8fa5 | 2013-08-30 18:34:08 +0200 | [diff] [blame] | 471 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 472 | return mbedtls_gcm_starts( (mbedtls_gcm_context *) ctx->cipher_ctx, ctx->operation, |
Manuel Pégourié-Gonnard | 9c853b9 | 2013-09-03 13:04:44 +0200 | [diff] [blame] | 473 | ctx->iv, ctx->iv_size, ad, ad_len ); |
Manuel Pégourié-Gonnard | 07f8fa5 | 2013-08-30 18:34:08 +0200 | [diff] [blame] | 474 | } |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 475 | #endif |
| 476 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 477 | #if defined(MBEDTLS_CHACHAPOLY_C) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 478 | if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) |
| 479 | { |
| 480 | int result; |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 481 | mbedtls_chachapoly_mode_t mode; |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 482 | |
| 483 | mode = ( ctx->operation == MBEDTLS_ENCRYPT ) |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 484 | ? MBEDTLS_CHACHAPOLY_ENCRYPT |
| 485 | : MBEDTLS_CHACHAPOLY_DECRYPT; |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 486 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 487 | result = mbedtls_chachapoly_starts( (mbedtls_chachapoly_context*) ctx->cipher_ctx, |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 488 | ctx->iv, |
| 489 | mode ); |
| 490 | if ( result != 0 ) |
| 491 | return( result ); |
| 492 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 493 | return mbedtls_chachapoly_update_aad( (mbedtls_chachapoly_context*) ctx->cipher_ctx, |
Manuel Pégourié-Gonnard | 5ef92d3 | 2018-05-09 09:34:25 +0200 | [diff] [blame] | 494 | ad, ad_len ); |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 495 | } |
| 496 | #endif |
Manuel Pégourié-Gonnard | 07f8fa5 | 2013-08-30 18:34:08 +0200 | [diff] [blame] | 497 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 498 | return( 0 ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 499 | } |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 500 | #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 501 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 502 | int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input, |
Paul Bakker | b9e4e2c | 2014-05-01 14:18:25 +0200 | [diff] [blame] | 503 | size_t ilen, unsigned char *output, size_t *olen ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 504 | { |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 505 | int ret; |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 506 | size_t block_size = 0; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 507 | |
Paul Bakker | 68884e3 | 2013-01-07 18:20:04 +0100 | [diff] [blame] | 508 | if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen ) |
Paul Bakker | a885d68 | 2011-01-20 16:35:05 +0000 | [diff] [blame] | 509 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 510 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Paul Bakker | a885d68 | 2011-01-20 16:35:05 +0000 | [diff] [blame] | 511 | } |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 512 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 513 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 514 | if( ctx->psa_enabled == 1 ) |
| 515 | { |
| 516 | /* While PSA Crypto has an API for multipart |
| 517 | * operations, we currently don't make it |
| 518 | * accessible through the cipher layer. */ |
| 519 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 520 | } |
| 521 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 522 | |
Paul Bakker | 6c21276 | 2013-12-16 15:24:50 +0100 | [diff] [blame] | 523 | *olen = 0; |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 524 | block_size = mbedtls_cipher_get_block_size( ctx ); |
Paul Bakker | 6c21276 | 2013-12-16 15:24:50 +0100 | [diff] [blame] | 525 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 526 | if( ctx->cipher_info->mode == MBEDTLS_MODE_ECB ) |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 527 | { |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 528 | if( ilen != block_size ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 529 | return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ); |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 530 | |
| 531 | *olen = ilen; |
| 532 | |
| 533 | if( 0 != ( ret = ctx->cipher_info->base->ecb_func( ctx->cipher_ctx, |
| 534 | ctx->operation, input, output ) ) ) |
| 535 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 536 | return( ret ); |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 537 | } |
| 538 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 539 | return( 0 ); |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 540 | } |
| 541 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 542 | #if defined(MBEDTLS_GCM_C) |
| 543 | if( ctx->cipher_info->mode == MBEDTLS_MODE_GCM ) |
Manuel Pégourié-Gonnard | b8bd593 | 2013-09-05 13:38:15 +0200 | [diff] [blame] | 544 | { |
| 545 | *olen = ilen; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 546 | return mbedtls_gcm_update( (mbedtls_gcm_context *) ctx->cipher_ctx, ilen, input, |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 547 | output ); |
Manuel Pégourié-Gonnard | b8bd593 | 2013-09-05 13:38:15 +0200 | [diff] [blame] | 548 | } |
| 549 | #endif |
| 550 | |
Manuel Pégourié-Gonnard | 32902e6 | 2018-05-10 12:30:19 +0200 | [diff] [blame] | 551 | #if defined(MBEDTLS_CHACHAPOLY_C) |
| 552 | if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20_POLY1305 ) |
| 553 | { |
| 554 | *olen = ilen; |
| 555 | return mbedtls_chachapoly_update( (mbedtls_chachapoly_context*) ctx->cipher_ctx, |
| 556 | ilen, input, output ); |
| 557 | } |
| 558 | #endif |
| 559 | |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 560 | if ( 0 == block_size ) |
| 561 | { |
| 562 | return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT; |
| 563 | } |
| 564 | |
Paul Bakker | 68884e3 | 2013-01-07 18:20:04 +0100 | [diff] [blame] | 565 | if( input == output && |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 566 | ( ctx->unprocessed_len != 0 || ilen % block_size ) ) |
Paul Bakker | 68884e3 | 2013-01-07 18:20:04 +0100 | [diff] [blame] | 567 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 568 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Paul Bakker | 68884e3 | 2013-01-07 18:20:04 +0100 | [diff] [blame] | 569 | } |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 570 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 571 | #if defined(MBEDTLS_CIPHER_MODE_CBC) |
| 572 | if( ctx->cipher_info->mode == MBEDTLS_MODE_CBC ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 573 | { |
Manuel Pégourié-Gonnard | 989ed38 | 2013-09-13 14:41:45 +0200 | [diff] [blame] | 574 | size_t copy_len = 0; |
| 575 | |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 576 | /* |
| 577 | * If there is not enough data for a full block, cache it. |
| 578 | */ |
Andy Leiserson | 79e7789 | 2017-04-28 20:01:49 -0700 | [diff] [blame] | 579 | if( ( ctx->operation == MBEDTLS_DECRYPT && NULL != ctx->add_padding && |
Andres Amaya Garcia | 6a54336 | 2017-01-17 23:04:22 +0000 | [diff] [blame] | 580 | ilen <= block_size - ctx->unprocessed_len ) || |
Andy Leiserson | 79e7789 | 2017-04-28 20:01:49 -0700 | [diff] [blame] | 581 | ( ctx->operation == MBEDTLS_DECRYPT && NULL == ctx->add_padding && |
| 582 | ilen < block_size - ctx->unprocessed_len ) || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 583 | ( ctx->operation == MBEDTLS_ENCRYPT && |
Andres Amaya Garcia | 6a54336 | 2017-01-17 23:04:22 +0000 | [diff] [blame] | 584 | ilen < block_size - ctx->unprocessed_len ) ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 585 | { |
| 586 | memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input, |
| 587 | ilen ); |
| 588 | |
| 589 | ctx->unprocessed_len += ilen; |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 590 | return( 0 ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 591 | } |
| 592 | |
| 593 | /* |
| 594 | * Process cached data first |
| 595 | */ |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 596 | if( 0 != ctx->unprocessed_len ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 597 | { |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 598 | copy_len = block_size - ctx->unprocessed_len; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 599 | |
| 600 | memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input, |
| 601 | copy_len ); |
| 602 | |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 603 | if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx, |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 604 | ctx->operation, block_size, ctx->iv, |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 605 | ctx->unprocessed_data, output ) ) ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 606 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 607 | return( ret ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 608 | } |
| 609 | |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 610 | *olen += block_size; |
| 611 | output += block_size; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 612 | ctx->unprocessed_len = 0; |
| 613 | |
| 614 | input += copy_len; |
| 615 | ilen -= copy_len; |
| 616 | } |
| 617 | |
| 618 | /* |
| 619 | * Cache final, incomplete block |
| 620 | */ |
| 621 | if( 0 != ilen ) |
| 622 | { |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 623 | if( 0 == block_size ) |
| 624 | { |
| 625 | return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT; |
| 626 | } |
| 627 | |
Andy Leiserson | 79e7789 | 2017-04-28 20:01:49 -0700 | [diff] [blame] | 628 | /* Encryption: only cache partial blocks |
| 629 | * Decryption w/ padding: always keep at least one whole block |
| 630 | * Decryption w/o padding: only cache partial blocks |
| 631 | */ |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 632 | copy_len = ilen % block_size; |
Andy Leiserson | 79e7789 | 2017-04-28 20:01:49 -0700 | [diff] [blame] | 633 | if( copy_len == 0 && |
| 634 | ctx->operation == MBEDTLS_DECRYPT && |
| 635 | NULL != ctx->add_padding) |
| 636 | { |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 637 | copy_len = block_size; |
Andy Leiserson | 79e7789 | 2017-04-28 20:01:49 -0700 | [diff] [blame] | 638 | } |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 639 | |
| 640 | memcpy( ctx->unprocessed_data, &( input[ilen - copy_len] ), |
| 641 | copy_len ); |
| 642 | |
| 643 | ctx->unprocessed_len += copy_len; |
| 644 | ilen -= copy_len; |
| 645 | } |
| 646 | |
| 647 | /* |
| 648 | * Process remaining full blocks |
| 649 | */ |
| 650 | if( ilen ) |
| 651 | { |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 652 | if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx, |
| 653 | ctx->operation, ilen, ctx->iv, input, output ) ) ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 654 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 655 | return( ret ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 656 | } |
Manuel Pégourié-Gonnard | 07f8fa5 | 2013-08-30 18:34:08 +0200 | [diff] [blame] | 657 | |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 658 | *olen += ilen; |
| 659 | } |
| 660 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 661 | return( 0 ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 662 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 663 | #endif /* MBEDTLS_CIPHER_MODE_CBC */ |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 664 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 665 | #if defined(MBEDTLS_CIPHER_MODE_CFB) |
| 666 | if( ctx->cipher_info->mode == MBEDTLS_MODE_CFB ) |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 667 | { |
Paul Bakker | 6132d0a | 2012-07-04 17:10:40 +0000 | [diff] [blame] | 668 | if( 0 != ( ret = ctx->cipher_info->base->cfb_func( ctx->cipher_ctx, |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 669 | ctx->operation, ilen, &ctx->unprocessed_len, ctx->iv, |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 670 | input, output ) ) ) |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 671 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 672 | return( ret ); |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 673 | } |
| 674 | |
| 675 | *olen = ilen; |
| 676 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 677 | return( 0 ); |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 678 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 679 | #endif /* MBEDTLS_CIPHER_MODE_CFB */ |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 680 | |
Simon Butcher | 8c0fd1e | 2018-04-22 22:58:07 +0100 | [diff] [blame] | 681 | #if defined(MBEDTLS_CIPHER_MODE_OFB) |
| 682 | if( ctx->cipher_info->mode == MBEDTLS_MODE_OFB ) |
| 683 | { |
| 684 | if( 0 != ( ret = ctx->cipher_info->base->ofb_func( ctx->cipher_ctx, |
| 685 | ilen, &ctx->unprocessed_len, ctx->iv, input, output ) ) ) |
| 686 | { |
| 687 | return( ret ); |
| 688 | } |
| 689 | |
| 690 | *olen = ilen; |
| 691 | |
| 692 | return( 0 ); |
| 693 | } |
| 694 | #endif /* MBEDTLS_CIPHER_MODE_OFB */ |
| 695 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 696 | #if defined(MBEDTLS_CIPHER_MODE_CTR) |
| 697 | if( ctx->cipher_info->mode == MBEDTLS_MODE_CTR ) |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 698 | { |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 699 | if( 0 != ( ret = ctx->cipher_info->base->ctr_func( ctx->cipher_ctx, |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 700 | ilen, &ctx->unprocessed_len, ctx->iv, |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 701 | ctx->unprocessed_data, input, output ) ) ) |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 702 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 703 | return( ret ); |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 704 | } |
| 705 | |
| 706 | *olen = ilen; |
| 707 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 708 | return( 0 ); |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 709 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 710 | #endif /* MBEDTLS_CIPHER_MODE_CTR */ |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 711 | |
Jaeden Amero | c653990 | 2018-04-30 17:17:41 +0100 | [diff] [blame] | 712 | #if defined(MBEDTLS_CIPHER_MODE_XTS) |
| 713 | if( ctx->cipher_info->mode == MBEDTLS_MODE_XTS ) |
| 714 | { |
| 715 | if( ctx->unprocessed_len > 0 ) { |
| 716 | /* We can only process an entire data unit at a time. */ |
| 717 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 718 | } |
| 719 | |
| 720 | ret = ctx->cipher_info->base->xts_func( ctx->cipher_ctx, |
| 721 | ctx->operation, ilen, ctx->iv, input, output ); |
| 722 | if( ret != 0 ) |
| 723 | { |
| 724 | return( ret ); |
| 725 | } |
| 726 | |
| 727 | *olen = ilen; |
| 728 | |
| 729 | return( 0 ); |
| 730 | } |
| 731 | #endif /* MBEDTLS_CIPHER_MODE_XTS */ |
| 732 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 733 | #if defined(MBEDTLS_CIPHER_MODE_STREAM) |
| 734 | if( ctx->cipher_info->mode == MBEDTLS_MODE_STREAM ) |
Manuel Pégourié-Gonnard | 37e230c | 2013-08-28 13:50:42 +0200 | [diff] [blame] | 735 | { |
| 736 | if( 0 != ( ret = ctx->cipher_info->base->stream_func( ctx->cipher_ctx, |
| 737 | ilen, input, output ) ) ) |
| 738 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 739 | return( ret ); |
Manuel Pégourié-Gonnard | 37e230c | 2013-08-28 13:50:42 +0200 | [diff] [blame] | 740 | } |
| 741 | |
| 742 | *olen = ilen; |
| 743 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 744 | return( 0 ); |
Manuel Pégourié-Gonnard | 37e230c | 2013-08-28 13:50:42 +0200 | [diff] [blame] | 745 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 746 | #endif /* MBEDTLS_CIPHER_MODE_STREAM */ |
Manuel Pégourié-Gonnard | 37e230c | 2013-08-28 13:50:42 +0200 | [diff] [blame] | 747 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 748 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 749 | } |
| 750 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 751 | #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) |
| 752 | #if defined(MBEDTLS_CIPHER_PADDING_PKCS7) |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 753 | /* |
| 754 | * PKCS7 (and PKCS5) padding: fill with ll bytes, with ll = padding_len |
| 755 | */ |
Paul Bakker | 23986e5 | 2011-04-24 08:57:21 +0000 | [diff] [blame] | 756 | static void add_pkcs_padding( unsigned char *output, size_t output_len, |
| 757 | size_t data_len ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 758 | { |
Paul Bakker | 23986e5 | 2011-04-24 08:57:21 +0000 | [diff] [blame] | 759 | size_t padding_len = output_len - data_len; |
Manuel Pégourié-Gonnard | f8ab069 | 2013-10-27 17:21:14 +0100 | [diff] [blame] | 760 | unsigned char i; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 761 | |
| 762 | for( i = 0; i < padding_len; i++ ) |
Paul Bakker | 23986e5 | 2011-04-24 08:57:21 +0000 | [diff] [blame] | 763 | output[data_len + i] = (unsigned char) padding_len; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 764 | } |
| 765 | |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 766 | static int get_pkcs_padding( unsigned char *input, size_t input_len, |
| 767 | size_t *data_len ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 768 | { |
Manuel Pégourié-Gonnard | f8ab069 | 2013-10-27 17:21:14 +0100 | [diff] [blame] | 769 | size_t i, pad_idx; |
| 770 | unsigned char padding_len, bad = 0; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 771 | |
Paul Bakker | a885d68 | 2011-01-20 16:35:05 +0000 | [diff] [blame] | 772 | if( NULL == input || NULL == data_len ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 773 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 774 | |
| 775 | padding_len = input[input_len - 1]; |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 776 | *data_len = input_len - padding_len; |
| 777 | |
Manuel Pégourié-Gonnard | f8ab069 | 2013-10-27 17:21:14 +0100 | [diff] [blame] | 778 | /* Avoid logical || since it results in a branch */ |
| 779 | bad |= padding_len > input_len; |
| 780 | bad |= padding_len == 0; |
| 781 | |
| 782 | /* The number of bytes checked must be independent of padding_len, |
| 783 | * so pick input_len, which is usually 8 or 16 (one block) */ |
| 784 | pad_idx = input_len - padding_len; |
| 785 | for( i = 0; i < input_len; i++ ) |
| 786 | bad |= ( input[i] ^ padding_len ) * ( i >= pad_idx ); |
| 787 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 788 | return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 789 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 790 | #endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */ |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 791 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 792 | #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS) |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 793 | /* |
| 794 | * One and zeros padding: fill with 80 00 ... 00 |
| 795 | */ |
| 796 | static void add_one_and_zeros_padding( unsigned char *output, |
| 797 | size_t output_len, size_t data_len ) |
| 798 | { |
| 799 | size_t padding_len = output_len - data_len; |
| 800 | unsigned char i = 0; |
| 801 | |
| 802 | output[data_len] = 0x80; |
| 803 | for( i = 1; i < padding_len; i++ ) |
| 804 | output[data_len + i] = 0x00; |
| 805 | } |
| 806 | |
| 807 | static int get_one_and_zeros_padding( unsigned char *input, size_t input_len, |
| 808 | size_t *data_len ) |
| 809 | { |
Manuel Pégourié-Gonnard | 6c32990 | 2013-10-27 18:25:03 +0100 | [diff] [blame] | 810 | size_t i; |
| 811 | unsigned char done = 0, prev_done, bad; |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 812 | |
| 813 | if( NULL == input || NULL == data_len ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 814 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 815 | |
Micha Kraus | ba8316f | 2017-12-23 23:40:08 +0100 | [diff] [blame] | 816 | bad = 0x80; |
Manuel Pégourié-Gonnard | 6c32990 | 2013-10-27 18:25:03 +0100 | [diff] [blame] | 817 | *data_len = 0; |
| 818 | for( i = input_len; i > 0; i-- ) |
| 819 | { |
| 820 | prev_done = done; |
Micha Kraus | ba8316f | 2017-12-23 23:40:08 +0100 | [diff] [blame] | 821 | done |= ( input[i - 1] != 0 ); |
Manuel Pégourié-Gonnard | 6c32990 | 2013-10-27 18:25:03 +0100 | [diff] [blame] | 822 | *data_len |= ( i - 1 ) * ( done != prev_done ); |
Micha Kraus | ba8316f | 2017-12-23 23:40:08 +0100 | [diff] [blame] | 823 | bad ^= input[i - 1] * ( done != prev_done ); |
Manuel Pégourié-Gonnard | 6c32990 | 2013-10-27 18:25:03 +0100 | [diff] [blame] | 824 | } |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 825 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 826 | return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) ); |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 827 | |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 828 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 829 | #endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */ |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 830 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 831 | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN) |
Manuel Pégourié-Gonnard | 8d4291b | 2013-07-26 14:55:18 +0200 | [diff] [blame] | 832 | /* |
| 833 | * Zeros and len padding: fill with 00 ... 00 ll, where ll is padding length |
| 834 | */ |
| 835 | static void add_zeros_and_len_padding( unsigned char *output, |
| 836 | size_t output_len, size_t data_len ) |
| 837 | { |
| 838 | size_t padding_len = output_len - data_len; |
| 839 | unsigned char i = 0; |
| 840 | |
| 841 | for( i = 1; i < padding_len; i++ ) |
| 842 | output[data_len + i - 1] = 0x00; |
| 843 | output[output_len - 1] = (unsigned char) padding_len; |
| 844 | } |
| 845 | |
| 846 | static int get_zeros_and_len_padding( unsigned char *input, size_t input_len, |
| 847 | size_t *data_len ) |
| 848 | { |
Manuel Pégourié-Gonnard | d17df51 | 2013-10-27 17:32:43 +0100 | [diff] [blame] | 849 | size_t i, pad_idx; |
| 850 | unsigned char padding_len, bad = 0; |
Manuel Pégourié-Gonnard | 8d4291b | 2013-07-26 14:55:18 +0200 | [diff] [blame] | 851 | |
| 852 | if( NULL == input || NULL == data_len ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 853 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 8d4291b | 2013-07-26 14:55:18 +0200 | [diff] [blame] | 854 | |
| 855 | padding_len = input[input_len - 1]; |
Manuel Pégourié-Gonnard | 8d4291b | 2013-07-26 14:55:18 +0200 | [diff] [blame] | 856 | *data_len = input_len - padding_len; |
| 857 | |
Manuel Pégourié-Gonnard | d17df51 | 2013-10-27 17:32:43 +0100 | [diff] [blame] | 858 | /* Avoid logical || since it results in a branch */ |
| 859 | bad |= padding_len > input_len; |
| 860 | bad |= padding_len == 0; |
| 861 | |
| 862 | /* The number of bytes checked must be independent of padding_len */ |
| 863 | pad_idx = input_len - padding_len; |
| 864 | for( i = 0; i < input_len - 1; i++ ) |
| 865 | bad |= input[i] * ( i >= pad_idx ); |
| 866 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 867 | return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) ); |
Manuel Pégourié-Gonnard | 8d4291b | 2013-07-26 14:55:18 +0200 | [diff] [blame] | 868 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 869 | #endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */ |
Manuel Pégourié-Gonnard | 8d4291b | 2013-07-26 14:55:18 +0200 | [diff] [blame] | 870 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 871 | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS) |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 872 | /* |
| 873 | * Zero padding: fill with 00 ... 00 |
| 874 | */ |
| 875 | static void add_zeros_padding( unsigned char *output, |
| 876 | size_t output_len, size_t data_len ) |
| 877 | { |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 878 | size_t i; |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 879 | |
| 880 | for( i = data_len; i < output_len; i++ ) |
| 881 | output[i] = 0x00; |
| 882 | } |
| 883 | |
| 884 | static int get_zeros_padding( unsigned char *input, size_t input_len, |
| 885 | size_t *data_len ) |
| 886 | { |
Manuel Pégourié-Gonnard | e68bf17 | 2013-10-27 18:26:39 +0100 | [diff] [blame] | 887 | size_t i; |
| 888 | unsigned char done = 0, prev_done; |
| 889 | |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 890 | if( NULL == input || NULL == data_len ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 891 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 892 | |
Manuel Pégourié-Gonnard | e68bf17 | 2013-10-27 18:26:39 +0100 | [diff] [blame] | 893 | *data_len = 0; |
| 894 | for( i = input_len; i > 0; i-- ) |
| 895 | { |
| 896 | prev_done = done; |
| 897 | done |= ( input[i-1] != 0 ); |
| 898 | *data_len |= i * ( done != prev_done ); |
| 899 | } |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 900 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 901 | return( 0 ); |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 902 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 903 | #endif /* MBEDTLS_CIPHER_PADDING_ZEROS */ |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 904 | |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 905 | /* |
| 906 | * No padding: don't pad :) |
| 907 | * |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 908 | * There is no add_padding function (check for NULL in mbedtls_cipher_finish) |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 909 | * but a trivial get_padding function |
| 910 | */ |
| 911 | static int get_no_padding( unsigned char *input, size_t input_len, |
| 912 | size_t *data_len ) |
| 913 | { |
| 914 | if( NULL == input || NULL == data_len ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 915 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 916 | |
| 917 | *data_len = input_len; |
| 918 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 919 | return( 0 ); |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 920 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 921 | #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 922 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 923 | int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 924 | unsigned char *output, size_t *olen ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 925 | { |
| 926 | if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 927 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 928 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 929 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 930 | if( ctx->psa_enabled == 1 ) |
| 931 | { |
| 932 | /* While PSA Crypto has an API for multipart |
| 933 | * operations, we currently don't make it |
| 934 | * accessible through the cipher layer. */ |
| 935 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 936 | } |
| 937 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 938 | |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 939 | *olen = 0; |
| 940 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 941 | if( MBEDTLS_MODE_CFB == ctx->cipher_info->mode || |
Simon Butcher | 8c0fd1e | 2018-04-22 22:58:07 +0100 | [diff] [blame] | 942 | MBEDTLS_MODE_OFB == ctx->cipher_info->mode || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 943 | MBEDTLS_MODE_CTR == ctx->cipher_info->mode || |
| 944 | MBEDTLS_MODE_GCM == ctx->cipher_info->mode || |
Jaeden Amero | c653990 | 2018-04-30 17:17:41 +0100 | [diff] [blame] | 945 | MBEDTLS_MODE_XTS == ctx->cipher_info->mode || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 946 | MBEDTLS_MODE_STREAM == ctx->cipher_info->mode ) |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 947 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 948 | return( 0 ); |
Paul Bakker | 343a870 | 2011-06-09 14:27:58 +0000 | [diff] [blame] | 949 | } |
| 950 | |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 951 | if ( ( MBEDTLS_CIPHER_CHACHA20 == ctx->cipher_info->type ) || |
| 952 | ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) ) |
Daniel King | bd92062 | 2016-05-15 19:56:20 -0300 | [diff] [blame] | 953 | { |
| 954 | return( 0 ); |
| 955 | } |
| 956 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 957 | if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode ) |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 958 | { |
| 959 | if( ctx->unprocessed_len != 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 960 | return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ); |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 961 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 962 | return( 0 ); |
Paul Bakker | 5e0efa7 | 2013-09-08 23:04:04 +0200 | [diff] [blame] | 963 | } |
| 964 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 965 | #if defined(MBEDTLS_CIPHER_MODE_CBC) |
| 966 | if( MBEDTLS_MODE_CBC == ctx->cipher_info->mode ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 967 | { |
Manuel Pégourié-Gonnard | 989ed38 | 2013-09-13 14:41:45 +0200 | [diff] [blame] | 968 | int ret = 0; |
| 969 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 970 | if( MBEDTLS_ENCRYPT == ctx->operation ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 971 | { |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 972 | /* check for 'no padding' mode */ |
| 973 | if( NULL == ctx->add_padding ) |
| 974 | { |
| 975 | if( 0 != ctx->unprocessed_len ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 976 | return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ); |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 977 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 978 | return( 0 ); |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 979 | } |
| 980 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 981 | ctx->add_padding( ctx->unprocessed_data, mbedtls_cipher_get_iv_size( ctx ), |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 982 | ctx->unprocessed_len ); |
| 983 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 984 | else if( mbedtls_cipher_get_block_size( ctx ) != ctx->unprocessed_len ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 985 | { |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 986 | /* |
| 987 | * For decrypt operations, expect a full block, |
| 988 | * or an empty block if no padding |
| 989 | */ |
| 990 | if( NULL == ctx->add_padding && 0 == ctx->unprocessed_len ) |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 991 | return( 0 ); |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 992 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 993 | return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 994 | } |
| 995 | |
| 996 | /* cipher block */ |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 997 | if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx, |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 998 | ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv, |
Paul Bakker | ff61a78 | 2011-06-09 15:42:02 +0000 | [diff] [blame] | 999 | ctx->unprocessed_data, output ) ) ) |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 1000 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 1001 | return( ret ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 1002 | } |
| 1003 | |
| 1004 | /* Set output size for decryption */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1005 | if( MBEDTLS_DECRYPT == ctx->operation ) |
| 1006 | return ctx->get_padding( output, mbedtls_cipher_get_block_size( ctx ), |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1007 | olen ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 1008 | |
| 1009 | /* Set output size for encryption */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1010 | *olen = mbedtls_cipher_get_block_size( ctx ); |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 1011 | return( 0 ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 1012 | } |
Manuel Pégourié-Gonnard | 989ed38 | 2013-09-13 14:41:45 +0200 | [diff] [blame] | 1013 | #else |
| 1014 | ((void) output); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1015 | #endif /* MBEDTLS_CIPHER_MODE_CBC */ |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 1016 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1017 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
Paul Bakker | 8123e9d | 2011-01-06 15:37:30 +0000 | [diff] [blame] | 1018 | } |
| 1019 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1020 | #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1021 | int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx, |
| 1022 | mbedtls_cipher_padding_t mode ) |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1023 | { |
| 1024 | if( NULL == ctx || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1025 | MBEDTLS_MODE_CBC != ctx->cipher_info->mode ) |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1026 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1027 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1028 | } |
| 1029 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1030 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1031 | if( ctx->psa_enabled == 1 ) |
| 1032 | { |
| 1033 | /* While PSA Crypto knows about CBC padding |
| 1034 | * schemes, we currently don't make them |
| 1035 | * accessible through the cipher layer. */ |
| 1036 | if( mode != MBEDTLS_PADDING_NONE ) |
| 1037 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 1038 | |
| 1039 | return( 0 ); |
| 1040 | } |
| 1041 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1042 | |
Paul Bakker | 1a45d91 | 2013-08-14 12:04:26 +0200 | [diff] [blame] | 1043 | switch( mode ) |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1044 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1045 | #if defined(MBEDTLS_CIPHER_PADDING_PKCS7) |
| 1046 | case MBEDTLS_PADDING_PKCS7: |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1047 | ctx->add_padding = add_pkcs_padding; |
| 1048 | ctx->get_padding = get_pkcs_padding; |
Paul Bakker | 1a45d91 | 2013-08-14 12:04:26 +0200 | [diff] [blame] | 1049 | break; |
Paul Bakker | 48e93c8 | 2013-08-14 12:21:18 +0200 | [diff] [blame] | 1050 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1051 | #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS) |
| 1052 | case MBEDTLS_PADDING_ONE_AND_ZEROS: |
Manuel Pégourié-Gonnard | 679f9e9 | 2013-07-26 12:46:02 +0200 | [diff] [blame] | 1053 | ctx->add_padding = add_one_and_zeros_padding; |
| 1054 | ctx->get_padding = get_one_and_zeros_padding; |
Paul Bakker | 1a45d91 | 2013-08-14 12:04:26 +0200 | [diff] [blame] | 1055 | break; |
Paul Bakker | 48e93c8 | 2013-08-14 12:21:18 +0200 | [diff] [blame] | 1056 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1057 | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN) |
| 1058 | case MBEDTLS_PADDING_ZEROS_AND_LEN: |
Manuel Pégourié-Gonnard | 8d4291b | 2013-07-26 14:55:18 +0200 | [diff] [blame] | 1059 | ctx->add_padding = add_zeros_and_len_padding; |
| 1060 | ctx->get_padding = get_zeros_and_len_padding; |
Paul Bakker | 1a45d91 | 2013-08-14 12:04:26 +0200 | [diff] [blame] | 1061 | break; |
Paul Bakker | 48e93c8 | 2013-08-14 12:21:18 +0200 | [diff] [blame] | 1062 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1063 | #if defined(MBEDTLS_CIPHER_PADDING_ZEROS) |
| 1064 | case MBEDTLS_PADDING_ZEROS: |
Manuel Pégourié-Gonnard | 0e7d2c0 | 2013-07-26 16:05:14 +0200 | [diff] [blame] | 1065 | ctx->add_padding = add_zeros_padding; |
| 1066 | ctx->get_padding = get_zeros_padding; |
Paul Bakker | 1a45d91 | 2013-08-14 12:04:26 +0200 | [diff] [blame] | 1067 | break; |
Paul Bakker | 48e93c8 | 2013-08-14 12:21:18 +0200 | [diff] [blame] | 1068 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1069 | case MBEDTLS_PADDING_NONE: |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 1070 | ctx->add_padding = NULL; |
| 1071 | ctx->get_padding = get_no_padding; |
Paul Bakker | 1a45d91 | 2013-08-14 12:04:26 +0200 | [diff] [blame] | 1072 | break; |
| 1073 | |
| 1074 | default: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1075 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
Manuel Pégourié-Gonnard | ebdc413 | 2013-07-26 16:50:44 +0200 | [diff] [blame] | 1076 | } |
| 1077 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 1078 | return( 0 ); |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1079 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1080 | #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ |
Manuel Pégourié-Gonnard | ac56a1a | 2013-07-25 12:31:10 +0200 | [diff] [blame] | 1081 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1082 | #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1083 | int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1084 | unsigned char *tag, size_t tag_len ) |
| 1085 | { |
| 1086 | if( NULL == ctx || NULL == ctx->cipher_info || NULL == tag ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1087 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1088 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1089 | if( MBEDTLS_ENCRYPT != ctx->operation ) |
| 1090 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1091 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1092 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1093 | if( ctx->psa_enabled == 1 ) |
| 1094 | { |
| 1095 | /* While PSA Crypto has an API for multipart |
| 1096 | * operations, we currently don't make it |
| 1097 | * accessible through the cipher layer. */ |
| 1098 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 1099 | |
| 1100 | return( 0 ); |
| 1101 | } |
| 1102 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1103 | |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1104 | #if defined(MBEDTLS_GCM_C) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1105 | if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode ) |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1106 | return( mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx, |
| 1107 | tag, tag_len ) ); |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1108 | #endif |
| 1109 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1110 | #if defined(MBEDTLS_CHACHAPOLY_C) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1111 | if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) |
| 1112 | { |
| 1113 | /* Don't allow truncated MAC for Poly1305 */ |
| 1114 | if ( tag_len != 16U ) |
| 1115 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 1116 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1117 | return( mbedtls_chachapoly_finish( |
| 1118 | (mbedtls_chachapoly_context*) ctx->cipher_ctx, tag ) ); |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1119 | } |
| 1120 | #endif |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1121 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 1122 | return( 0 ); |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1123 | } |
Paul Bakker | 9af723c | 2014-05-01 13:03:14 +0200 | [diff] [blame] | 1124 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1125 | int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1126 | const unsigned char *tag, size_t tag_len ) |
| 1127 | { |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1128 | unsigned char check_tag[16]; |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1129 | int ret; |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1130 | |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1131 | if( NULL == ctx || NULL == ctx->cipher_info || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1132 | MBEDTLS_DECRYPT != ctx->operation ) |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1133 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1134 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1135 | } |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1136 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1137 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1138 | if( ctx->psa_enabled == 1 ) |
| 1139 | { |
| 1140 | /* While PSA Crypto has an API for multipart |
| 1141 | * operations, we currently don't make it |
| 1142 | * accessible through the cipher layer. */ |
| 1143 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 1144 | } |
| 1145 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1146 | |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1147 | #if defined(MBEDTLS_GCM_C) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1148 | if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode ) |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1149 | { |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1150 | if( tag_len > sizeof( check_tag ) ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1151 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1152 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1153 | if( 0 != ( ret = mbedtls_gcm_finish( |
| 1154 | (mbedtls_gcm_context *) ctx->cipher_ctx, |
| 1155 | check_tag, tag_len ) ) ) |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 1156 | { |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1157 | return( ret ); |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 1158 | } |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1159 | |
| 1160 | /* Check the tag in "constant-time" */ |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1161 | if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1162 | return( MBEDTLS_ERR_CIPHER_AUTH_FAILED ); |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1163 | |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1164 | return( 0 ); |
Manuel Pégourié-Gonnard | 43a4780 | 2013-09-03 16:35:53 +0200 | [diff] [blame] | 1165 | } |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1166 | #endif /* MBEDTLS_GCM_C */ |
| 1167 | |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1168 | #if defined(MBEDTLS_CHACHAPOLY_C) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1169 | if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) |
| 1170 | { |
| 1171 | /* Don't allow truncated MAC for Poly1305 */ |
| 1172 | if ( tag_len != sizeof( check_tag ) ) |
| 1173 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 1174 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1175 | ret = mbedtls_chachapoly_finish( |
| 1176 | (mbedtls_chachapoly_context*) ctx->cipher_ctx, check_tag ); |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1177 | if ( ret != 0 ) |
| 1178 | { |
| 1179 | return( ret ); |
| 1180 | } |
| 1181 | |
| 1182 | /* Check the tag in "constant-time" */ |
| 1183 | if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 ) |
| 1184 | return( MBEDTLS_ERR_CIPHER_AUTH_FAILED ); |
| 1185 | |
| 1186 | return( 0 ); |
| 1187 | } |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1188 | #endif /* MBEDTLS_CHACHAPOLY_C */ |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1189 | |
| 1190 | return( 0 ); |
| 1191 | } |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1192 | #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ |
Manuel Pégourié-Gonnard | aa9ffc5 | 2013-09-03 16:19:22 +0200 | [diff] [blame] | 1193 | |
Manuel Pégourié-Gonnard | 3c1d150 | 2014-05-12 13:46:08 +0200 | [diff] [blame] | 1194 | /* |
| 1195 | * Packet-oriented wrapper for non-AEAD modes |
| 1196 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1197 | int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | 3c1d150 | 2014-05-12 13:46:08 +0200 | [diff] [blame] | 1198 | const unsigned char *iv, size_t iv_len, |
| 1199 | const unsigned char *input, size_t ilen, |
| 1200 | unsigned char *output, size_t *olen ) |
| 1201 | { |
| 1202 | int ret; |
| 1203 | size_t finish_olen; |
| 1204 | |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1205 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1206 | if( ctx->psa_enabled == 1 ) |
| 1207 | { |
Hanno Becker | 55e2e3d | 2018-11-12 12:36:17 +0000 | [diff] [blame] | 1208 | /* As in the non-PSA case, we don't check that |
| 1209 | * a key has been set. If not, the key slot will |
| 1210 | * still be in its default state of 0, which is |
| 1211 | * guaranteed to be invalid, hence the PSA-call |
| 1212 | * below will gracefully fail. */ |
| 1213 | mbedtls_cipher_context_psa * const cipher_psa = |
| 1214 | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
| 1215 | |
| 1216 | psa_status_t status; |
| 1217 | psa_cipher_operation_t cipher_op; |
| 1218 | size_t part_len; |
| 1219 | |
| 1220 | if( ctx->operation == MBEDTLS_DECRYPT ) |
| 1221 | { |
| 1222 | status = psa_cipher_decrypt_setup( &cipher_op, |
| 1223 | cipher_psa->slot, |
| 1224 | cipher_psa->alg ); |
| 1225 | } |
| 1226 | else if( ctx->operation == MBEDTLS_ENCRYPT ) |
| 1227 | { |
| 1228 | status = psa_cipher_encrypt_setup( &cipher_op, |
| 1229 | cipher_psa->slot, |
| 1230 | cipher_psa->alg ); |
| 1231 | } |
| 1232 | else |
| 1233 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 1234 | |
| 1235 | /* In the following, we can immediately return on an error, |
| 1236 | * because the PSA Crypto API guarantees that cipher operations |
| 1237 | * are terminated by unsuccessful calls to psa_cipher_update(), |
| 1238 | * and by any call to psa_cipher_finish(). */ |
| 1239 | if( status != PSA_SUCCESS ) |
| 1240 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 1241 | |
| 1242 | status = psa_cipher_set_iv( &cipher_op, iv, iv_len ); |
| 1243 | if( status != PSA_SUCCESS ) |
| 1244 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 1245 | |
| 1246 | status = psa_cipher_update( &cipher_op, |
| 1247 | input, ilen, |
| 1248 | output, ilen, olen ); |
| 1249 | if( status != PSA_SUCCESS ) |
| 1250 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 1251 | |
| 1252 | status = psa_cipher_finish( &cipher_op, |
| 1253 | output + *olen, ilen - *olen, |
| 1254 | &part_len ); |
| 1255 | if( status != PSA_SUCCESS ) |
| 1256 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 1257 | |
| 1258 | *olen += part_len; |
| 1259 | return( 0 ); |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1260 | } |
| 1261 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1262 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1263 | if( ( ret = mbedtls_cipher_set_iv( ctx, iv, iv_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | 3c1d150 | 2014-05-12 13:46:08 +0200 | [diff] [blame] | 1264 | return( ret ); |
| 1265 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1266 | if( ( ret = mbedtls_cipher_reset( ctx ) ) != 0 ) |
Manuel Pégourié-Gonnard | 3c1d150 | 2014-05-12 13:46:08 +0200 | [diff] [blame] | 1267 | return( ret ); |
| 1268 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1269 | if( ( ret = mbedtls_cipher_update( ctx, input, ilen, |
| 1270 | output, olen ) ) != 0 ) |
Manuel Pégourié-Gonnard | 3c1d150 | 2014-05-12 13:46:08 +0200 | [diff] [blame] | 1271 | return( ret ); |
| 1272 | |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1273 | if( ( ret = mbedtls_cipher_finish( ctx, output + *olen, |
| 1274 | &finish_olen ) ) != 0 ) |
Manuel Pégourié-Gonnard | 3c1d150 | 2014-05-12 13:46:08 +0200 | [diff] [blame] | 1275 | return( ret ); |
| 1276 | |
| 1277 | *olen += finish_olen; |
| 1278 | |
| 1279 | return( 0 ); |
| 1280 | } |
| 1281 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1282 | #if defined(MBEDTLS_CIPHER_MODE_AEAD) |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1283 | /* |
| 1284 | * Packet-oriented encryption for AEAD modes |
| 1285 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1286 | int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1287 | const unsigned char *iv, size_t iv_len, |
| 1288 | const unsigned char *ad, size_t ad_len, |
| 1289 | const unsigned char *input, size_t ilen, |
| 1290 | unsigned char *output, size_t *olen, |
| 1291 | unsigned char *tag, size_t tag_len ) |
| 1292 | { |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1293 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1294 | if( ctx->psa_enabled == 1 ) |
| 1295 | { |
Hanno Becker | fe73ade | 2018-11-12 16:26:46 +0000 | [diff] [blame] | 1296 | /* As in the non-PSA case, we don't check that |
| 1297 | * a key has been set. If not, the key slot will |
| 1298 | * still be in its default state of 0, which is |
| 1299 | * guaranteed to be invalid, hence the PSA-call |
| 1300 | * below will gracefully fail. */ |
| 1301 | mbedtls_cipher_context_psa * const cipher_psa = |
| 1302 | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
| 1303 | |
| 1304 | psa_status_t status; |
| 1305 | |
| 1306 | /* PSA Crypto API always writes the authentication tag |
| 1307 | * at the end of the encrypted message. */ |
| 1308 | if( tag != output + ilen ) |
| 1309 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 1310 | |
| 1311 | status = psa_aead_encrypt( cipher_psa->slot, |
| 1312 | cipher_psa->alg, |
| 1313 | iv, iv_len, |
| 1314 | ad, ad_len, |
| 1315 | input, ilen, |
| 1316 | output, ilen + tag_len, olen ); |
| 1317 | if( status != PSA_SUCCESS ) |
| 1318 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 1319 | |
| 1320 | *olen -= tag_len; |
| 1321 | return( 0 ); |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1322 | } |
| 1323 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1324 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1325 | #if defined(MBEDTLS_GCM_C) |
| 1326 | if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode ) |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1327 | { |
| 1328 | *olen = ilen; |
Hanno Becker | 18597cd | 2018-11-09 16:36:33 +0000 | [diff] [blame] | 1329 | return( mbedtls_gcm_crypt_and_tag( ctx->cipher_ctx, MBEDTLS_GCM_ENCRYPT, |
| 1330 | ilen, iv, iv_len, ad, ad_len, |
| 1331 | input, output, tag_len, tag ) ); |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1332 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1333 | #endif /* MBEDTLS_GCM_C */ |
| 1334 | #if defined(MBEDTLS_CCM_C) |
| 1335 | if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode ) |
Manuel Pégourié-Gonnard | 4193695 | 2014-05-13 13:18:17 +0200 | [diff] [blame] | 1336 | { |
| 1337 | *olen = ilen; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1338 | return( mbedtls_ccm_encrypt_and_tag( ctx->cipher_ctx, ilen, |
Manuel Pégourié-Gonnard | 4193695 | 2014-05-13 13:18:17 +0200 | [diff] [blame] | 1339 | iv, iv_len, ad, ad_len, input, output, |
| 1340 | tag, tag_len ) ); |
| 1341 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1342 | #endif /* MBEDTLS_CCM_C */ |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1343 | #if defined(MBEDTLS_CHACHAPOLY_C) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1344 | if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) |
| 1345 | { |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1346 | /* ChachaPoly has fixed length nonce and MAC (tag) */ |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1347 | if ( ( iv_len != ctx->cipher_info->iv_size ) || |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1348 | ( tag_len != 16U ) ) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1349 | { |
| 1350 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 1351 | } |
| 1352 | |
| 1353 | *olen = ilen; |
Manuel Pégourié-Gonnard | 3dc62a0 | 2018-06-04 12:18:19 +0200 | [diff] [blame] | 1354 | return( mbedtls_chachapoly_encrypt_and_tag( ctx->cipher_ctx, |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1355 | ilen, iv, ad, ad_len, input, output, tag ) ); |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1356 | } |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1357 | #endif /* MBEDTLS_CHACHAPOLY_C */ |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1358 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1359 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1360 | } |
| 1361 | |
| 1362 | /* |
| 1363 | * Packet-oriented decryption for AEAD modes |
| 1364 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1365 | int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx, |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1366 | const unsigned char *iv, size_t iv_len, |
| 1367 | const unsigned char *ad, size_t ad_len, |
| 1368 | const unsigned char *input, size_t ilen, |
| 1369 | unsigned char *output, size_t *olen, |
| 1370 | const unsigned char *tag, size_t tag_len ) |
| 1371 | { |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1372 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1373 | if( ctx->psa_enabled == 1 ) |
| 1374 | { |
Hanno Becker | fe73ade | 2018-11-12 16:26:46 +0000 | [diff] [blame] | 1375 | /* As in the non-PSA case, we don't check that |
| 1376 | * a key has been set. If not, the key slot will |
| 1377 | * still be in its default state of 0, which is |
| 1378 | * guaranteed to be invalid, hence the PSA-call |
| 1379 | * below will gracefully fail. */ |
| 1380 | mbedtls_cipher_context_psa * const cipher_psa = |
| 1381 | (mbedtls_cipher_context_psa *) ctx->cipher_ctx; |
| 1382 | |
| 1383 | psa_status_t status; |
| 1384 | |
| 1385 | /* PSA Crypto API always writes the authentication tag |
| 1386 | * at the end of the encrypted message. */ |
| 1387 | if( tag != input + ilen ) |
| 1388 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
| 1389 | |
| 1390 | status = psa_aead_decrypt( cipher_psa->slot, |
| 1391 | cipher_psa->alg, |
| 1392 | iv, iv_len, |
| 1393 | ad, ad_len, |
| 1394 | input, ilen + tag_len, |
| 1395 | output, ilen, olen ); |
| 1396 | if( status == PSA_ERROR_INVALID_SIGNATURE ) |
| 1397 | return( MBEDTLS_ERR_CIPHER_AUTH_FAILED ); |
| 1398 | else if( status != PSA_SUCCESS ) |
| 1399 | return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED ); |
| 1400 | |
| 1401 | return( 0 ); |
Hanno Becker | ce1ddee | 2018-11-09 16:20:29 +0000 | [diff] [blame] | 1402 | } |
| 1403 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1404 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1405 | #if defined(MBEDTLS_GCM_C) |
| 1406 | if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode ) |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1407 | { |
| 1408 | int ret; |
| 1409 | |
| 1410 | *olen = ilen; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1411 | ret = mbedtls_gcm_auth_decrypt( ctx->cipher_ctx, ilen, |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1412 | iv, iv_len, ad, ad_len, |
| 1413 | tag, tag_len, input, output ); |
| 1414 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1415 | if( ret == MBEDTLS_ERR_GCM_AUTH_FAILED ) |
| 1416 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1417 | |
| 1418 | return( ret ); |
| 1419 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1420 | #endif /* MBEDTLS_GCM_C */ |
| 1421 | #if defined(MBEDTLS_CCM_C) |
| 1422 | if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode ) |
Manuel Pégourié-Gonnard | 4193695 | 2014-05-13 13:18:17 +0200 | [diff] [blame] | 1423 | { |
| 1424 | int ret; |
| 1425 | |
| 1426 | *olen = ilen; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1427 | ret = mbedtls_ccm_auth_decrypt( ctx->cipher_ctx, ilen, |
Manuel Pégourié-Gonnard | 4193695 | 2014-05-13 13:18:17 +0200 | [diff] [blame] | 1428 | iv, iv_len, ad, ad_len, |
| 1429 | input, output, tag, tag_len ); |
| 1430 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1431 | if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED ) |
| 1432 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
Manuel Pégourié-Gonnard | 4193695 | 2014-05-13 13:18:17 +0200 | [diff] [blame] | 1433 | |
| 1434 | return( ret ); |
| 1435 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1436 | #endif /* MBEDTLS_CCM_C */ |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1437 | #if defined(MBEDTLS_CHACHAPOLY_C) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1438 | if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) |
| 1439 | { |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1440 | int ret; |
| 1441 | |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1442 | /* ChachaPoly has fixed length nonce and MAC (tag) */ |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1443 | if ( ( iv_len != ctx->cipher_info->iv_size ) || |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1444 | ( tag_len != 16U ) ) |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1445 | { |
| 1446 | return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ); |
| 1447 | } |
| 1448 | |
| 1449 | *olen = ilen; |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1450 | ret = mbedtls_chachapoly_auth_decrypt( ctx->cipher_ctx, ilen, |
| 1451 | iv, ad, ad_len, tag, input, output ); |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1452 | |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1453 | if( ret == MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED ) |
| 1454 | ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED; |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1455 | |
Manuel Pégourié-Gonnard | fe725de | 2018-05-08 09:38:09 +0200 | [diff] [blame] | 1456 | return( ret ); |
Daniel King | 8fe4701 | 2016-05-17 20:33:28 -0300 | [diff] [blame] | 1457 | } |
Manuel Pégourié-Gonnard | dca3a5d | 2018-05-07 10:43:27 +0200 | [diff] [blame] | 1458 | #endif /* MBEDTLS_CHACHAPOLY_C */ |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1459 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1460 | return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ); |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1461 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1462 | #endif /* MBEDTLS_CIPHER_MODE_AEAD */ |
Manuel Pégourié-Gonnard | 4562ffe | 2014-05-13 12:19:29 +0200 | [diff] [blame] | 1463 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1464 | #endif /* MBEDTLS_CIPHER_C */ |