blob: 6b137d7bf91783c07d020615dfa1bb6d0f8f5247 [file] [log] [blame]
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02001/*
2 * NIST SP800-38C compliant CCM implementation
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02006 */
7
8/*
9 * Definition of CCM:
10 * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf
11 * RFC 3610 "Counter with CBC-MAC (CCM)"
12 *
13 * Related:
14 * RFC 5116 "An Interface and Algorithms for Authenticated Encryption"
15 */
16
Gilles Peskinedb09ef62020-06-03 01:43:33 +020017#include "common.h"
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +020018
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020019#if defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +020020
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000021#include "mbedtls/ccm.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050022#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000023#include "mbedtls/error.h"
Dave Rodgmand26a3d62023-09-11 18:25:16 +010024#include "mbedtls/constant_time.h"
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +020025
Valerio Setti9b7a8b22023-11-16 08:24:51 +010026#if !defined(MBEDTLS_CIPHER_C)
27#include "block_cipher_internal.h"
28#endif
29
Rich Evans00ab4702015-02-06 13:43:58 +000030#include <string.h>
31
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020032#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000033#include "mbedtls/platform.h"
Rich Evans00ab4702015-02-06 13:43:58 +000034#else
Mateusz Starzyk22f7a352021-07-28 15:08:47 +020035#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
Rich Evans00ab4702015-02-06 13:43:58 +000036#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020037#define mbedtls_printf printf
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020038#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
Mateusz Starzyk22f7a352021-07-28 15:08:47 +020039#endif /* MBEDTLS_PLATFORM_C */
Rich Evans00ab4702015-02-06 13:43:58 +000040
Steven Cooreman222e2ff2017-04-04 11:37:15 +020041#if !defined(MBEDTLS_CCM_ALT)
42
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +020043
Manuel Pégourié-Gonnard9fe0d132014-05-06 12:12:45 +020044/*
45 * Initialize context
46 */
Gilles Peskine449bd832023-01-11 14:50:10 +010047void mbedtls_ccm_init(mbedtls_ccm_context *ctx)
Manuel Pégourié-Gonnard6963ff02015-04-28 18:02:54 +020048{
Gilles Peskine449bd832023-01-11 14:50:10 +010049 memset(ctx, 0, sizeof(mbedtls_ccm_context));
Manuel Pégourié-Gonnard6963ff02015-04-28 18:02:54 +020050}
51
Gilles Peskine449bd832023-01-11 14:50:10 +010052int mbedtls_ccm_setkey(mbedtls_ccm_context *ctx,
53 mbedtls_cipher_id_t cipher,
54 const unsigned char *key,
55 unsigned int keybits)
Manuel Pégourié-Gonnard9fe0d132014-05-06 12:12:45 +020056{
Janos Follath24eed8d2019-11-22 13:21:35 +000057 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Valerio Setti9b7a8b22023-11-16 08:24:51 +010058
59#if defined(MBEDTLS_CIPHER_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020060 const mbedtls_cipher_info_t *cipher_info;
Manuel Pégourié-Gonnard9fe0d132014-05-06 12:12:45 +020061
Gilles Peskine449bd832023-01-11 14:50:10 +010062 cipher_info = mbedtls_cipher_info_from_values(cipher, keybits,
63 MBEDTLS_MODE_ECB);
64 if (cipher_info == NULL) {
65 return MBEDTLS_ERR_CCM_BAD_INPUT;
Manuel Pégourié-Gonnard9fe0d132014-05-06 12:12:45 +020066 }
67
Dave Rodgman85a88132023-06-24 11:41:50 +010068 if (mbedtls_cipher_info_get_block_size(cipher_info) != 16) {
Gilles Peskine449bd832023-01-11 14:50:10 +010069 return MBEDTLS_ERR_CCM_BAD_INPUT;
70 }
71
72 mbedtls_cipher_free(&ctx->cipher_ctx);
73
74 if ((ret = mbedtls_cipher_setup(&ctx->cipher_ctx, cipher_info)) != 0) {
75 return ret;
76 }
77
78 if ((ret = mbedtls_cipher_setkey(&ctx->cipher_ctx, key, keybits,
79 MBEDTLS_ENCRYPT)) != 0) {
80 return ret;
81 }
Valerio Setti9b7a8b22023-11-16 08:24:51 +010082#else
83 mbedtls_block_cipher_free(&ctx->block_cipher_ctx);
84
85 if ((ret = mbedtls_block_cipher_setup(&ctx->block_cipher_ctx, cipher)) != 0) {
86 return MBEDTLS_ERR_CCM_BAD_INPUT;
87 }
88
89 if ((ret = mbedtls_block_cipher_setkey(&ctx->block_cipher_ctx, key, keybits)) != 0) {
90 return MBEDTLS_ERR_CCM_BAD_INPUT;
91 }
92#endif
Gilles Peskine449bd832023-01-11 14:50:10 +010093
Dave Rodgman69928db2023-12-14 12:09:18 +000094 return ret;
Manuel Pégourié-Gonnard9fe0d132014-05-06 12:12:45 +020095}
96
97/*
98 * Free context
99 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100100void mbedtls_ccm_free(mbedtls_ccm_context *ctx)
Manuel Pégourié-Gonnard9fe0d132014-05-06 12:12:45 +0200101{
Gilles Peskine449bd832023-01-11 14:50:10 +0100102 if (ctx == NULL) {
k-stachowiakfd42d532018-12-11 14:37:51 +0100103 return;
Gilles Peskine449bd832023-01-11 14:50:10 +0100104 }
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100105#if defined(MBEDTLS_CIPHER_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100106 mbedtls_cipher_free(&ctx->cipher_ctx);
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100107#else
108 mbedtls_block_cipher_free(&ctx->block_cipher_ctx);
109#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100110 mbedtls_platform_zeroize(ctx, sizeof(mbedtls_ccm_context));
Manuel Pégourié-Gonnard9fe0d132014-05-06 12:12:45 +0200111}
112
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200113#define CCM_STATE__CLEAR 0
Mateusz Starzyka9cbdfb2021-07-27 13:49:54 +0200114#define CCM_STATE__STARTED (1 << 0)
bootstrap-prime6dbbf442022-05-17 19:30:44 -0400115#define CCM_STATE__LENGTHS_SET (1 << 1)
Mateusz Starzyk62d22f92021-08-09 15:53:41 +0200116#define CCM_STATE__AUTH_DATA_STARTED (1 << 2)
117#define CCM_STATE__AUTH_DATA_FINISHED (1 << 3)
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200118#define CCM_STATE__ERROR (1 << 4)
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200119
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200120/*
121 * Encrypt or decrypt a partial block with CTR
122 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100123static int mbedtls_ccm_crypt(mbedtls_ccm_context *ctx,
124 size_t offset, size_t use_len,
125 const unsigned char *input,
126 unsigned char *output)
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200127{
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200128 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100129 unsigned char tmp_buf[16] = { 0 };
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200130
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100131#if defined(MBEDTLS_CIPHER_C)
132 size_t olen = 0;
Valerio Settid0eebc12023-11-20 15:17:53 +0100133 ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->ctr, 16, tmp_buf, &olen);
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100134#else
Valerio Settid0eebc12023-11-20 15:17:53 +0100135 ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->ctr, tmp_buf);
136#endif
137 if (ret != 0) {
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100138 ctx->state |= CCM_STATE__ERROR;
139 mbedtls_platform_zeroize(tmp_buf, sizeof(tmp_buf));
140 return ret;
141 }
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200142
Gilles Peskine449bd832023-01-11 14:50:10 +0100143 mbedtls_xor(output, input, tmp_buf + offset, use_len);
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200144
Mateusz Starzykc52220d2021-07-27 13:54:55 +0200145 mbedtls_platform_zeroize(tmp_buf, sizeof(tmp_buf));
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200146 return ret;
147}
148
Gilles Peskine449bd832023-01-11 14:50:10 +0100149static void mbedtls_ccm_clear_state(mbedtls_ccm_context *ctx)
150{
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200151 ctx->state = CCM_STATE__CLEAR;
Gilles Peskine449bd832023-01-11 14:50:10 +0100152 memset(ctx->y, 0, 16);
153 memset(ctx->ctr, 0, 16);
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200154}
155
Mateusz Starzykca9dc8d2021-07-27 14:03:53 +0200156static int ccm_calculate_first_block_if_ready(mbedtls_ccm_context *ctx)
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200157{
Janos Follath24eed8d2019-11-22 13:21:35 +0000158 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200159 unsigned char i;
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100160 size_t len_left;
161#if defined(MBEDTLS_CIPHER_C)
162 size_t olen;
163#endif
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200164
Tom Cosgrove1797b052022-12-04 17:19:59 +0000165 /* length calculation can be done only after both
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200166 * mbedtls_ccm_starts() and mbedtls_ccm_set_lengths() have been executed
167 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100168 if (!(ctx->state & CCM_STATE__STARTED) || !(ctx->state & CCM_STATE__LENGTHS_SET)) {
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200169 return 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200171
Mateusz Starzykbb2ced32021-10-13 13:37:30 +0200172 /* CCM expects non-empty tag.
173 * CCM* allows empty tag. For CCM* without tag, ignore plaintext length.
174 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100175 if (ctx->tag_len == 0) {
176 if (ctx->mode == MBEDTLS_CCM_STAR_ENCRYPT || ctx->mode == MBEDTLS_CCM_STAR_DECRYPT) {
Mateusz Starzykbb2ced32021-10-13 13:37:30 +0200177 ctx->plaintext_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100178 } else {
179 return MBEDTLS_ERR_CCM_BAD_INPUT;
Mateusz Starzykbb2ced32021-10-13 13:37:30 +0200180 }
181 }
Mateusz Starzyk05e92d62021-07-09 12:44:07 +0200182
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200183 /*
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200184 * First block:
Mateusz Starzykeb2ca962021-07-06 12:45:11 +0200185 * 0 .. 0 flags
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200186 * 1 .. iv_len nonce (aka iv) - set by: mbedtls_ccm_starts()
Mateusz Starzykeb2ca962021-07-06 12:45:11 +0200187 * iv_len+1 .. 15 length
188 *
189 * With flags as (bits):
190 * 7 0
191 * 6 add present?
192 * 5 .. 3 (t - 2) / 2
193 * 2 .. 0 q - 1
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200194 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100195 ctx->y[0] |= (ctx->add_len > 0) << 6;
196 ctx->y[0] |= ((ctx->tag_len - 2) / 2) << 3;
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200197 ctx->y[0] |= ctx->q - 1;
Mateusz Starzykeb2ca962021-07-06 12:45:11 +0200198
Gilles Peskine449bd832023-01-11 14:50:10 +0100199 for (i = 0, len_left = ctx->plaintext_len; i < ctx->q; i++, len_left >>= 8) {
200 ctx->y[15-i] = MBEDTLS_BYTE_0(len_left);
201 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200202
Gilles Peskine449bd832023-01-11 14:50:10 +0100203 if (len_left > 0) {
Mateusz Starzyk88c4d622021-07-05 17:09:16 +0200204 ctx->state |= CCM_STATE__ERROR;
Gilles Peskine449bd832023-01-11 14:50:10 +0100205 return MBEDTLS_ERR_CCM_BAD_INPUT;
Mateusz Starzyk88c4d622021-07-05 17:09:16 +0200206 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200207
208 /* Start CBC-MAC with first block*/
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100209#if defined(MBEDTLS_CIPHER_C)
Valerio Settid0eebc12023-11-20 15:17:53 +0100210 ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->y, 16, ctx->y, &olen);
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100211#else
Valerio Settid0eebc12023-11-20 15:17:53 +0100212 ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->y, ctx->y);
213#endif
214 if (ret != 0) {
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100215 ctx->state |= CCM_STATE__ERROR;
216 return ret;
217 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200218
Gilles Peskine449bd832023-01-11 14:50:10 +0100219 return 0;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200220}
221
Gilles Peskine449bd832023-01-11 14:50:10 +0100222int mbedtls_ccm_starts(mbedtls_ccm_context *ctx,
223 int mode,
224 const unsigned char *iv,
225 size_t iv_len)
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200226{
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200227 /* Also implies q is within bounds */
Gilles Peskine449bd832023-01-11 14:50:10 +0100228 if (iv_len < 7 || iv_len > 13) {
229 return MBEDTLS_ERR_CCM_BAD_INPUT;
230 }
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200231
Mateusz Starzyk89d469c2021-06-22 16:24:28 +0200232 ctx->mode = mode;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200233 ctx->q = 16 - 1 - (unsigned char) iv_len;
234
235 /*
236 * Prepare counter block for encryption:
237 * 0 .. 0 flags
238 * 1 .. iv_len nonce (aka iv)
239 * iv_len+1 .. 15 counter (initially 1)
240 *
241 * With flags as (bits):
242 * 7 .. 3 0
243 * 2 .. 0 q - 1
244 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100245 memset(ctx->ctr, 0, 16);
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200246 ctx->ctr[0] = ctx->q - 1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100247 memcpy(ctx->ctr + 1, iv, iv_len);
248 memset(ctx->ctr + 1 + iv_len, 0, ctx->q);
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200249 ctx->ctr[15] = 1;
250
251 /*
Mateusz Starzykca9dc8d2021-07-27 14:03:53 +0200252 * See ccm_calculate_first_block_if_ready() for block layout description
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200253 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100254 memcpy(ctx->y + 1, iv, iv_len);
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200255
256 ctx->state |= CCM_STATE__STARTED;
Mateusz Starzykca9dc8d2021-07-27 14:03:53 +0200257 return ccm_calculate_first_block_if_ready(ctx);
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200258}
259
Gilles Peskine449bd832023-01-11 14:50:10 +0100260int mbedtls_ccm_set_lengths(mbedtls_ccm_context *ctx,
261 size_t total_ad_len,
262 size_t plaintext_len,
263 size_t tag_len)
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200264{
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200265 /*
266 * Check length requirements: SP800-38C A.1
267 * Additional requirement: a < 2^16 - 2^8 to simplify the code.
268 * 'length' checked later (when writing it to the first block)
Janos Follath997e85c2018-05-29 11:33:45 +0100269 *
270 * Also, loosen the requirements to enable support for CCM* (IEEE 802.15.4).
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200271 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100272 if (tag_len == 2 || tag_len > 16 || tag_len % 2 != 0) {
273 return MBEDTLS_ERR_CCM_BAD_INPUT;
274 }
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200275
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 if (total_ad_len >= 0xFF00) {
277 return MBEDTLS_ERR_CCM_BAD_INPUT;
278 }
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200279
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200280 ctx->plaintext_len = plaintext_len;
Mateusz Starzykeb2ca962021-07-06 12:45:11 +0200281 ctx->add_len = total_ad_len;
282 ctx->tag_len = tag_len;
283 ctx->processed = 0;
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200284
bootstrap-prime6dbbf442022-05-17 19:30:44 -0400285 ctx->state |= CCM_STATE__LENGTHS_SET;
Mateusz Starzykca9dc8d2021-07-27 14:03:53 +0200286 return ccm_calculate_first_block_if_ready(ctx);
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200287}
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200288
Gilles Peskine449bd832023-01-11 14:50:10 +0100289int mbedtls_ccm_update_ad(mbedtls_ccm_context *ctx,
290 const unsigned char *add,
291 size_t add_len)
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200292{
293 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100294 size_t use_len, offset;
295#if defined(MBEDTLS_CIPHER_C)
296 size_t olen;
297#endif
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200298
Gilles Peskine449bd832023-01-11 14:50:10 +0100299 if (ctx->state & CCM_STATE__ERROR) {
Mateusz Starzyk64f0b5f2021-09-02 11:50:38 +0200300 return MBEDTLS_ERR_CCM_BAD_INPUT;
Mateusz Starzyk2d5652a2021-07-27 16:07:54 +0200301 }
302
Gilles Peskine449bd832023-01-11 14:50:10 +0100303 if (add_len > 0) {
304 if (ctx->state & CCM_STATE__AUTH_DATA_FINISHED) {
Mateusz Starzyk7251eda2021-09-01 13:26:44 +0200305 return MBEDTLS_ERR_CCM_BAD_INPUT;
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200306 }
307
Gilles Peskine449bd832023-01-11 14:50:10 +0100308 if (!(ctx->state & CCM_STATE__AUTH_DATA_STARTED)) {
309 if (add_len > ctx->add_len) {
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200310 return MBEDTLS_ERR_CCM_BAD_INPUT;
311 }
312
Gilles Peskine449bd832023-01-11 14:50:10 +0100313 ctx->y[0] ^= (unsigned char) ((ctx->add_len >> 8) & 0xFF);
314 ctx->y[1] ^= (unsigned char) ((ctx->add_len) & 0xFF);
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200315
Mateusz Starzyk62d22f92021-08-09 15:53:41 +0200316 ctx->state |= CCM_STATE__AUTH_DATA_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100317 } else if (ctx->processed + add_len > ctx->add_len) {
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200318 return MBEDTLS_ERR_CCM_BAD_INPUT;
319 }
Mateusz Starzyk33392452021-07-06 15:38:35 +0200320
Gilles Peskine449bd832023-01-11 14:50:10 +0100321 while (add_len > 0) {
Mateusz Starzyk62d22f92021-08-09 15:53:41 +0200322 offset = (ctx->processed + 2) % 16; /* account for y[0] and y[1]
323 * holding total auth data length */
Mateusz Starzyk33392452021-07-06 15:38:35 +0200324 use_len = 16 - offset;
325
Gilles Peskine449bd832023-01-11 14:50:10 +0100326 if (use_len > add_len) {
Mateusz Starzyk33392452021-07-06 15:38:35 +0200327 use_len = add_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100328 }
Mateusz Starzyk33392452021-07-06 15:38:35 +0200329
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 mbedtls_xor(ctx->y + offset, ctx->y + offset, add, use_len);
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200331
Mateusz Starzyk33392452021-07-06 15:38:35 +0200332 ctx->processed += use_len;
333 add_len -= use_len;
334 add += use_len;
335
Gilles Peskine449bd832023-01-11 14:50:10 +0100336 if (use_len + offset == 16 || ctx->processed == ctx->add_len) {
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100337#if defined(MBEDTLS_CIPHER_C)
338 ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->y, 16, ctx->y, &olen);
339#else
340 ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->y, ctx->y);
341#endif
342 if (ret != 0) {
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200343 ctx->state |= CCM_STATE__ERROR;
Gilles Peskine449bd832023-01-11 14:50:10 +0100344 return ret;
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200345 }
Mateusz Starzyk33392452021-07-06 15:38:35 +0200346 }
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200347 }
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200348
Gilles Peskine449bd832023-01-11 14:50:10 +0100349 if (ctx->processed == ctx->add_len) {
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200350 ctx->state |= CCM_STATE__AUTH_DATA_FINISHED;
351 ctx->processed = 0; // prepare for mbedtls_ccm_update()
352 }
353 }
Mateusz Starzyk33392452021-07-06 15:38:35 +0200354
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 return 0;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200356}
357
Gilles Peskine449bd832023-01-11 14:50:10 +0100358int mbedtls_ccm_update(mbedtls_ccm_context *ctx,
359 const unsigned char *input, size_t input_len,
360 unsigned char *output, size_t output_size,
361 size_t *output_len)
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200362{
Mateusz Starzykb73c3ec2021-08-09 15:55:38 +0200363 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200364 unsigned char i;
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100365 size_t use_len, offset;
366#if defined(MBEDTLS_CIPHER_C)
367 size_t olen;
368#endif
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200369
Mateusz Starzykf3378502021-08-09 11:32:11 +0200370 unsigned char local_output[16];
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200371
Gilles Peskine449bd832023-01-11 14:50:10 +0100372 if (ctx->state & CCM_STATE__ERROR) {
Mateusz Starzyk64f0b5f2021-09-02 11:50:38 +0200373 return MBEDTLS_ERR_CCM_BAD_INPUT;
Mateusz Starzyk2d5652a2021-07-27 16:07:54 +0200374 }
375
Mateusz Starzykbb2ced32021-10-13 13:37:30 +0200376 /* Check against plaintext length only if performing operation with
377 * authentication
378 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100379 if (ctx->tag_len != 0 && ctx->processed + input_len > ctx->plaintext_len) {
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200380 return MBEDTLS_ERR_CCM_BAD_INPUT;
381 }
382
Gilles Peskine449bd832023-01-11 14:50:10 +0100383 if (output_size < input_len) {
384 return MBEDTLS_ERR_CCM_BAD_INPUT;
385 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200386 *output_len = input_len;
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200387
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200388 ret = 0;
389
Gilles Peskine449bd832023-01-11 14:50:10 +0100390 while (input_len > 0) {
Mateusz Starzyk6a15bcf2021-07-07 13:41:30 +0200391 offset = ctx->processed % 16;
392
393 use_len = 16 - offset;
394
Gilles Peskine449bd832023-01-11 14:50:10 +0100395 if (use_len > input_len) {
Mateusz Starzyk6a15bcf2021-07-07 13:41:30 +0200396 use_len = input_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100397 }
Mateusz Starzyk6a15bcf2021-07-07 13:41:30 +0200398
399 ctx->processed += use_len;
Mateusz Starzyk6a15bcf2021-07-07 13:41:30 +0200400
Gilles Peskine449bd832023-01-11 14:50:10 +0100401 if (ctx->mode == MBEDTLS_CCM_ENCRYPT || \
402 ctx->mode == MBEDTLS_CCM_STAR_ENCRYPT) {
403 mbedtls_xor(ctx->y + offset, ctx->y + offset, input, use_len);
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200404
Gilles Peskine449bd832023-01-11 14:50:10 +0100405 if (use_len + offset == 16 || ctx->processed == ctx->plaintext_len) {
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100406#if defined(MBEDTLS_CIPHER_C)
407 ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->y, 16, ctx->y, &olen);
408#else
409 ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->y, ctx->y);
410#endif
411 if (ret != 0) {
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200412 ctx->state |= CCM_STATE__ERROR;
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200413 goto exit;
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200414 }
Mateusz Starzyk20bac2f2021-07-12 14:52:44 +0200415 }
Mateusz Starzyk663055f2021-07-12 19:13:52 +0200416
Gilles Peskine449bd832023-01-11 14:50:10 +0100417 ret = mbedtls_ccm_crypt(ctx, offset, use_len, input, output);
418 if (ret != 0) {
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200419 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100420 }
Mateusz Starzyk20bac2f2021-07-12 14:52:44 +0200421 }
422
Gilles Peskine449bd832023-01-11 14:50:10 +0100423 if (ctx->mode == MBEDTLS_CCM_DECRYPT || \
424 ctx->mode == MBEDTLS_CCM_STAR_DECRYPT) {
Mateusz Starzyk2f175492021-08-09 16:05:14 +0200425 /* Since output may be in shared memory, we cannot be sure that
426 * it will contain what we wrote to it. Therefore, we should avoid using
427 * it as input to any operations.
428 * Write decrypted data to local_output to avoid using output variable as
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200429 * input in the XOR operation for Y.
430 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100431 ret = mbedtls_ccm_crypt(ctx, offset, use_len, input, local_output);
432 if (ret != 0) {
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200433 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100434 }
Mateusz Starzyk20bac2f2021-07-12 14:52:44 +0200435
Gilles Peskine449bd832023-01-11 14:50:10 +0100436 mbedtls_xor(ctx->y + offset, ctx->y + offset, local_output, use_len);
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200437
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 memcpy(output, local_output, use_len);
Mateusz Starzyk20bac2f2021-07-12 14:52:44 +0200439
Gilles Peskine449bd832023-01-11 14:50:10 +0100440 if (use_len + offset == 16 || ctx->processed == ctx->plaintext_len) {
Valerio Setti9b7a8b22023-11-16 08:24:51 +0100441#if defined(MBEDTLS_CIPHER_C)
442 ret = mbedtls_cipher_update(&ctx->cipher_ctx, ctx->y, 16, ctx->y, &olen);
443#else
444 ret = mbedtls_block_cipher_encrypt(&ctx->block_cipher_ctx, ctx->y, ctx->y);
445#endif
446 if (ret != 0) {
Mateusz Starzyk20bac2f2021-07-12 14:52:44 +0200447 ctx->state |= CCM_STATE__ERROR;
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200448 goto exit;
Mateusz Starzyk20bac2f2021-07-12 14:52:44 +0200449 }
450 }
451 }
452
Gilles Peskine449bd832023-01-11 14:50:10 +0100453 if (use_len + offset == 16 || ctx->processed == ctx->plaintext_len) {
454 for (i = 0; i < ctx->q; i++) {
455 if (++(ctx->ctr)[15-i] != 0) {
456 break;
457 }
458 }
Mateusz Starzyk6a15bcf2021-07-07 13:41:30 +0200459 }
Mateusz Starzyk20bac2f2021-07-12 14:52:44 +0200460
461 input_len -= use_len;
462 input += use_len;
463 output += use_len;
Mateusz Starzyk6a15bcf2021-07-07 13:41:30 +0200464 }
465
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200466exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100467 mbedtls_platform_zeroize(local_output, 16);
Mateusz Starzyk22f7a352021-07-28 15:08:47 +0200468
469 return ret;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200470}
471
Gilles Peskine449bd832023-01-11 14:50:10 +0100472int mbedtls_ccm_finish(mbedtls_ccm_context *ctx,
473 unsigned char *tag, size_t tag_len)
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200474{
Mateusz Starzykb73c3ec2021-08-09 15:55:38 +0200475 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200476 unsigned char i;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200477
Gilles Peskine449bd832023-01-11 14:50:10 +0100478 if (ctx->state & CCM_STATE__ERROR) {
Mateusz Starzyk4f2dd8a2021-08-09 15:37:47 +0200479 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Mateusz Starzyk2d5652a2021-07-27 16:07:54 +0200480 }
481
Gilles Peskine449bd832023-01-11 14:50:10 +0100482 if (ctx->add_len > 0 && !(ctx->state & CCM_STATE__AUTH_DATA_FINISHED)) {
Mateusz Starzyk7251eda2021-09-01 13:26:44 +0200483 return MBEDTLS_ERR_CCM_BAD_INPUT;
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200484 }
485
Gilles Peskine449bd832023-01-11 14:50:10 +0100486 if (ctx->plaintext_len > 0 && ctx->processed != ctx->plaintext_len) {
Mateusz Starzyk7251eda2021-09-01 13:26:44 +0200487 return MBEDTLS_ERR_CCM_BAD_INPUT;
Mateusz Starzyk36d3b892021-07-28 14:14:58 +0200488 }
489
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200490 /*
Manuel Pégourié-Gonnardaed60652014-05-07 13:14:42 +0200491 * Authentication: reset counter and crypt/mask internal tag
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200492 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100493 for (i = 0; i < ctx->q; i++) {
Mateusz Starzyk89d469c2021-06-22 16:24:28 +0200494 ctx->ctr[15-i] = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100495 }
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200496
Gilles Peskine449bd832023-01-11 14:50:10 +0100497 ret = mbedtls_ccm_crypt(ctx, 0, 16, ctx->y, ctx->y);
498 if (ret != 0) {
Mateusz Starzyk2ad7d8e2021-07-07 11:05:45 +0200499 return ret;
Gilles Peskine449bd832023-01-11 14:50:10 +0100500 }
501 if (tag != NULL) {
502 memcpy(tag, ctx->y, tag_len);
503 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200504 mbedtls_ccm_clear_state(ctx);
505
Gilles Peskine449bd832023-01-11 14:50:10 +0100506 return 0;
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200507}
508
509/*
510 * Authenticated encryption or decryption
511 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100512static int ccm_auth_crypt(mbedtls_ccm_context *ctx, int mode, size_t length,
513 const unsigned char *iv, size_t iv_len,
514 const unsigned char *add, size_t add_len,
515 const unsigned char *input, unsigned char *output,
516 unsigned char *tag, size_t tag_len)
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200517{
518 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
519 size_t olen;
520
Gilles Peskine449bd832023-01-11 14:50:10 +0100521 if ((ret = mbedtls_ccm_starts(ctx, mode, iv, iv_len)) != 0) {
522 return ret;
523 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200524
Gilles Peskine449bd832023-01-11 14:50:10 +0100525 if ((ret = mbedtls_ccm_set_lengths(ctx, add_len, length, tag_len)) != 0) {
526 return ret;
527 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200528
Gilles Peskine449bd832023-01-11 14:50:10 +0100529 if ((ret = mbedtls_ccm_update_ad(ctx, add, add_len)) != 0) {
530 return ret;
531 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200532
Gilles Peskine449bd832023-01-11 14:50:10 +0100533 if ((ret = mbedtls_ccm_update(ctx, input, length,
534 output, length, &olen)) != 0) {
535 return ret;
536 }
Mateusz Starzyk793692c2021-06-22 20:34:20 +0200537
Gilles Peskine449bd832023-01-11 14:50:10 +0100538 if ((ret = mbedtls_ccm_finish(ctx, tag, tag_len)) != 0) {
539 return ret;
540 }
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200541
Gilles Peskine449bd832023-01-11 14:50:10 +0100542 return 0;
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200543}
544
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200545/*
546 * Authenticated encryption
547 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100548int mbedtls_ccm_star_encrypt_and_tag(mbedtls_ccm_context *ctx, size_t length,
549 const unsigned char *iv, size_t iv_len,
550 const unsigned char *add, size_t add_len,
551 const unsigned char *input, unsigned char *output,
552 unsigned char *tag, size_t tag_len)
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200553{
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 return ccm_auth_crypt(ctx, MBEDTLS_CCM_STAR_ENCRYPT, length, iv, iv_len,
555 add, add_len, input, output, tag, tag_len);
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200556}
557
Gilles Peskine449bd832023-01-11 14:50:10 +0100558int mbedtls_ccm_encrypt_and_tag(mbedtls_ccm_context *ctx, size_t length,
559 const unsigned char *iv, size_t iv_len,
560 const unsigned char *add, size_t add_len,
561 const unsigned char *input, unsigned char *output,
562 unsigned char *tag, size_t tag_len)
Janos Follathb5734a22018-05-14 14:31:49 +0100563{
Gilles Peskine449bd832023-01-11 14:50:10 +0100564 return ccm_auth_crypt(ctx, MBEDTLS_CCM_ENCRYPT, length, iv, iv_len,
565 add, add_len, input, output, tag, tag_len);
Mateusz Starzyk05e92d62021-07-09 12:44:07 +0200566}
Janos Follathb5734a22018-05-14 14:31:49 +0100567
Mateusz Starzykeb395c02021-07-28 15:10:54 +0200568/*
569 * Authenticated decryption
570 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100571static int mbedtls_ccm_compare_tags(const unsigned char *tag1,
572 const unsigned char *tag2,
573 size_t tag_len)
Mateusz Starzyk05e92d62021-07-09 12:44:07 +0200574{
Mateusz Starzyk05e92d62021-07-09 12:44:07 +0200575 /* Check tag in "constant-time" */
Dave Rodgmand26a3d62023-09-11 18:25:16 +0100576 int diff = mbedtls_ct_memcmp(tag1, tag2, tag_len);
Mateusz Starzyk05e92d62021-07-09 12:44:07 +0200577
Gilles Peskine449bd832023-01-11 14:50:10 +0100578 if (diff != 0) {
579 return MBEDTLS_ERR_CCM_AUTH_FAILED;
580 }
581
582 return 0;
Janos Follathb5734a22018-05-14 14:31:49 +0100583}
584
Gilles Peskine449bd832023-01-11 14:50:10 +0100585static int ccm_auth_decrypt(mbedtls_ccm_context *ctx, int mode, size_t length,
586 const unsigned char *iv, size_t iv_len,
587 const unsigned char *add, size_t add_len,
588 const unsigned char *input, unsigned char *output,
589 const unsigned char *tag, size_t tag_len)
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200590{
Janos Follath24eed8d2019-11-22 13:21:35 +0000591 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200592 unsigned char check_tag[16];
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200593
Gilles Peskine449bd832023-01-11 14:50:10 +0100594 if ((ret = ccm_auth_crypt(ctx, mode, length,
595 iv, iv_len, add, add_len,
596 input, output, check_tag, tag_len)) != 0) {
597 return ret;
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200598 }
599
Gilles Peskine449bd832023-01-11 14:50:10 +0100600 if ((ret = mbedtls_ccm_compare_tags(tag, check_tag, tag_len)) != 0) {
601 mbedtls_platform_zeroize(output, length);
602 return ret;
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200603 }
604
Gilles Peskine449bd832023-01-11 14:50:10 +0100605 return 0;
Manuel Pégourié-Gonnard00232332014-05-06 15:56:07 +0200606}
607
Gilles Peskine449bd832023-01-11 14:50:10 +0100608int mbedtls_ccm_star_auth_decrypt(mbedtls_ccm_context *ctx, size_t length,
609 const unsigned char *iv, size_t iv_len,
610 const unsigned char *add, size_t add_len,
611 const unsigned char *input, unsigned char *output,
612 const unsigned char *tag, size_t tag_len)
Mateusz Starzyk1bda9452021-07-28 15:21:46 +0200613{
Gilles Peskine449bd832023-01-11 14:50:10 +0100614 return ccm_auth_decrypt(ctx, MBEDTLS_CCM_STAR_DECRYPT, length,
615 iv, iv_len, add, add_len,
616 input, output, tag, tag_len);
Mateusz Starzyk1bda9452021-07-28 15:21:46 +0200617}
618
Gilles Peskine449bd832023-01-11 14:50:10 +0100619int mbedtls_ccm_auth_decrypt(mbedtls_ccm_context *ctx, size_t length,
620 const unsigned char *iv, size_t iv_len,
621 const unsigned char *add, size_t add_len,
622 const unsigned char *input, unsigned char *output,
623 const unsigned char *tag, size_t tag_len)
Janos Follathb5734a22018-05-14 14:31:49 +0100624{
Gilles Peskine449bd832023-01-11 14:50:10 +0100625 return ccm_auth_decrypt(ctx, MBEDTLS_CCM_DECRYPT, length,
626 iv, iv_len, add, add_len,
627 input, output, tag, tag_len);
Janos Follathb5734a22018-05-14 14:31:49 +0100628}
Steven Cooreman222e2ff2017-04-04 11:37:15 +0200629#endif /* !MBEDTLS_CCM_ALT */
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +0200630
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200631#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200632/*
633 * Examples 1 to 3 from SP800-38C Appendix C
634 */
635
636#define NB_TESTS 3
Ron Eldor1b9b2172018-04-26 14:15:01 +0300637#define CCM_SELFTEST_PT_MAX_LEN 24
638#define CCM_SELFTEST_CT_MAX_LEN 32
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200639/*
640 * The data is the same for all tests, only the used length changes
641 */
Michał Janiszewskic79e92b2018-10-31 20:43:05 +0100642static const unsigned char key_test_data[] = {
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200643 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
644 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f
645};
646
Michał Janiszewskic79e92b2018-10-31 20:43:05 +0100647static const unsigned char iv_test_data[] = {
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200648 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
649 0x18, 0x19, 0x1a, 0x1b
650};
651
Michał Janiszewskic79e92b2018-10-31 20:43:05 +0100652static const unsigned char ad_test_data[] = {
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200653 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
654 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
655 0x10, 0x11, 0x12, 0x13
656};
657
Michał Janiszewskic79e92b2018-10-31 20:43:05 +0100658static const unsigned char msg_test_data[CCM_SELFTEST_PT_MAX_LEN] = {
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200659 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
660 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
661 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
662};
663
Gilles Peskine449bd832023-01-11 14:50:10 +0100664static const size_t iv_len_test_data[NB_TESTS] = { 7, 8, 12 };
Michał Janiszewski9aeea932018-10-30 23:00:15 +0100665static const size_t add_len_test_data[NB_TESTS] = { 8, 16, 20 };
666static const size_t msg_len_test_data[NB_TESTS] = { 4, 16, 24 };
667static const size_t tag_len_test_data[NB_TESTS] = { 4, 6, 8 };
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200668
Michał Janiszewskic79e92b2018-10-31 20:43:05 +0100669static const unsigned char res_test_data[NB_TESTS][CCM_SELFTEST_CT_MAX_LEN] = {
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200670 { 0x71, 0x62, 0x01, 0x5b, 0x4d, 0xac, 0x25, 0x5d },
671 { 0xd2, 0xa1, 0xf0, 0xe0, 0x51, 0xea, 0x5f, 0x62,
672 0x08, 0x1a, 0x77, 0x92, 0x07, 0x3d, 0x59, 0x3d,
673 0x1f, 0xc6, 0x4f, 0xbf, 0xac, 0xcd },
674 { 0xe3, 0xb2, 0x01, 0xa9, 0xf5, 0xb7, 0x1a, 0x7a,
675 0x9b, 0x1c, 0xea, 0xec, 0xcd, 0x97, 0xe7, 0x0b,
676 0x61, 0x76, 0xaa, 0xd9, 0xa4, 0x42, 0x8a, 0xa5,
677 0x48, 0x43, 0x92, 0xfb, 0xc1, 0xb0, 0x99, 0x51 }
678};
679
Gilles Peskine449bd832023-01-11 14:50:10 +0100680int mbedtls_ccm_self_test(int verbose)
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +0200681{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200682 mbedtls_ccm_context ctx;
Ron Eldor1b9b2172018-04-26 14:15:01 +0300683 /*
684 * Some hardware accelerators require the input and output buffers
685 * would be in RAM, because the flash is not accessible.
686 * Use buffers on the stack to hold the test vectors data.
687 */
688 unsigned char plaintext[CCM_SELFTEST_PT_MAX_LEN];
689 unsigned char ciphertext[CCM_SELFTEST_CT_MAX_LEN];
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200690 size_t i;
Janos Follath24eed8d2019-11-22 13:21:35 +0000691 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200692
Gilles Peskine449bd832023-01-11 14:50:10 +0100693 mbedtls_ccm_init(&ctx);
Manuel Pégourié-Gonnard6963ff02015-04-28 18:02:54 +0200694
Gilles Peskine449bd832023-01-11 14:50:10 +0100695 if (mbedtls_ccm_setkey(&ctx, MBEDTLS_CIPHER_ID_AES, key_test_data,
Dave Rodgman6dd757a2023-02-02 12:40:50 +0000696 8 * sizeof(key_test_data)) != 0) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100697 if (verbose != 0) {
698 mbedtls_printf(" CCM: setup failed");
Manuel Pégourié-Gonnardce77d552014-05-06 18:06:52 +0200699 }
700
Gilles Peskine449bd832023-01-11 14:50:10 +0100701 return 1;
Manuel Pégourié-Gonnard637eb3d2014-05-06 12:13:09 +0200702 }
703
Gilles Peskine449bd832023-01-11 14:50:10 +0100704 for (i = 0; i < NB_TESTS; i++) {
705 if (verbose != 0) {
706 mbedtls_printf(" CCM-AES #%u: ", (unsigned int) i + 1);
707 }
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +0200708
Gilles Peskine449bd832023-01-11 14:50:10 +0100709 memset(plaintext, 0, CCM_SELFTEST_PT_MAX_LEN);
710 memset(ciphertext, 0, CCM_SELFTEST_CT_MAX_LEN);
711 memcpy(plaintext, msg_test_data, msg_len_test_data[i]);
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +0200712
Gilles Peskine449bd832023-01-11 14:50:10 +0100713 ret = mbedtls_ccm_encrypt_and_tag(&ctx, msg_len_test_data[i],
714 iv_test_data, iv_len_test_data[i],
715 ad_test_data, add_len_test_data[i],
716 plaintext, ciphertext,
717 ciphertext + msg_len_test_data[i],
718 tag_len_test_data[i]);
719
720 if (ret != 0 ||
721 memcmp(ciphertext, res_test_data[i],
722 msg_len_test_data[i] + tag_len_test_data[i]) != 0) {
723 if (verbose != 0) {
724 mbedtls_printf("failed\n");
725 }
726
727 return 1;
728 }
729 memset(plaintext, 0, CCM_SELFTEST_PT_MAX_LEN);
730
731 ret = mbedtls_ccm_auth_decrypt(&ctx, msg_len_test_data[i],
732 iv_test_data, iv_len_test_data[i],
733 ad_test_data, add_len_test_data[i],
734 ciphertext, plaintext,
735 ciphertext + msg_len_test_data[i],
736 tag_len_test_data[i]);
737
738 if (ret != 0 ||
739 memcmp(plaintext, msg_test_data, msg_len_test_data[i]) != 0) {
740 if (verbose != 0) {
741 mbedtls_printf("failed\n");
742 }
743
744 return 1;
745 }
746
747 if (verbose != 0) {
748 mbedtls_printf("passed\n");
749 }
750 }
751
752 mbedtls_ccm_free(&ctx);
753
754 if (verbose != 0) {
755 mbedtls_printf("\n");
756 }
757
758 return 0;
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +0200759}
760
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200761#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +0200762
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200763#endif /* MBEDTLS_CCM_C */