1 // Copyright 2015 The BoringSSL Authors
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <openssl/ssl.h>
16
17 #include <assert.h>
18 #include <string.h>
19
20 #include <openssl/aead.h>
21 #include <openssl/err.h>
22 #include <openssl/rand.h>
23
24 #include "../crypto/internal.h"
25 #include "internal.h"
26
27
28 BSSL_NAMESPACE_BEGIN
29
SSLAEADContext(const SSL_CIPHER * cipher_arg)30 SSLAEADContext::SSLAEADContext(const SSL_CIPHER *cipher_arg)
31 : cipher_(cipher_arg),
32 variable_nonce_included_in_record_(false),
33 random_variable_nonce_(false),
34 xor_fixed_nonce_(false),
35 omit_length_in_ad_(false),
36 ad_is_header_(false) {}
37
~SSLAEADContext()38 SSLAEADContext::~SSLAEADContext() {}
39
CreateNullCipher()40 UniquePtr<SSLAEADContext> SSLAEADContext::CreateNullCipher() {
41 return MakeUnique<SSLAEADContext>(/*cipher=*/nullptr);
42 }
43
Create(enum evp_aead_direction_t direction,uint16_t version,const SSL_CIPHER * cipher,Span<const uint8_t> enc_key,Span<const uint8_t> mac_key,Span<const uint8_t> fixed_iv)44 UniquePtr<SSLAEADContext> SSLAEADContext::Create(
45 enum evp_aead_direction_t direction, uint16_t version,
46 const SSL_CIPHER *cipher, Span<const uint8_t> enc_key,
47 Span<const uint8_t> mac_key, Span<const uint8_t> fixed_iv) {
48 const EVP_AEAD *aead;
49 uint16_t protocol_version;
50 size_t expected_mac_key_len, expected_fixed_iv_len;
51 if (!ssl_protocol_version_from_wire(&protocol_version, version) ||
52 !ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len,
53 &expected_fixed_iv_len, cipher,
54 protocol_version) ||
55 // Ensure the caller returned correct key sizes.
56 expected_fixed_iv_len != fixed_iv.size() ||
57 expected_mac_key_len != mac_key.size()) {
58 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
59 return nullptr;
60 }
61
62 UniquePtr<SSLAEADContext> aead_ctx = MakeUnique<SSLAEADContext>(cipher);
63 if (!aead_ctx) {
64 return nullptr;
65 }
66
67 uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH];
68 assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH);
69 static_assert(EVP_AEAD_MAX_NONCE_LENGTH < 256,
70 "variable_nonce_len doesn't fit in uint8_t");
71 aead_ctx->variable_nonce_len_ = (uint8_t)EVP_AEAD_nonce_length(aead);
72 if (mac_key.empty()) {
73 // This is an actual AEAD.
74 aead_ctx->fixed_nonce_.CopyFrom(fixed_iv);
75
76 if (protocol_version >= TLS1_3_VERSION ||
77 cipher->algorithm_enc & SSL_CHACHA20POLY1305) {
78 // TLS 1.3, and TLS 1.2 ChaCha20-Poly1305, XOR the fixed IV with the
79 // sequence number to form the nonce.
80 aead_ctx->xor_fixed_nonce_ = true;
81 aead_ctx->variable_nonce_len_ = 8;
82 assert(fixed_iv.size() >= aead_ctx->variable_nonce_len_);
83 } else {
84 // TLS 1.2 AES-GCM prepends the fixed IV to an explicit nonce.
85 assert(fixed_iv.size() <= aead_ctx->variable_nonce_len_);
86 assert(cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM));
87 aead_ctx->variable_nonce_len_ -= fixed_iv.size();
88 aead_ctx->variable_nonce_included_in_record_ = true;
89 }
90
91 // Starting TLS 1.3, the AAD is the whole record header.
92 if (protocol_version >= TLS1_3_VERSION) {
93 aead_ctx->ad_is_header_ = true;
94 }
95 } else {
96 // This is a CBC cipher suite that implements the |EVP_AEAD| interface. The
97 // |EVP_AEAD| takes the MAC key, encryption key, and fixed IV concatenated
98 // as its input key.
99 assert(protocol_version < TLS1_3_VERSION);
100 BSSL_CHECK(mac_key.size() + enc_key.size() + fixed_iv.size() <=
101 sizeof(merged_key));
102 OPENSSL_memcpy(merged_key, mac_key.data(), mac_key.size());
103 OPENSSL_memcpy(merged_key + mac_key.size(), enc_key.data(), enc_key.size());
104 OPENSSL_memcpy(merged_key + mac_key.size() + enc_key.size(),
105 fixed_iv.data(), fixed_iv.size());
106 enc_key =
107 Span(merged_key, enc_key.size() + mac_key.size() + fixed_iv.size());
108
109 // The |EVP_AEAD|'s per-encryption nonce, if any, is actually the CBC IV. It
110 // must be generated randomly and prepended to the record.
111 aead_ctx->variable_nonce_included_in_record_ = true;
112 aead_ctx->random_variable_nonce_ = true;
113 aead_ctx->omit_length_in_ad_ = true;
114 }
115
116 if (!EVP_AEAD_CTX_init_with_direction(
117 aead_ctx->ctx_.get(), aead, enc_key.data(), enc_key.size(),
118 EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) {
119 return nullptr;
120 }
121
122 return aead_ctx;
123 }
124
CreatePlaceholderForQUIC(const SSL_CIPHER * cipher)125 UniquePtr<SSLAEADContext> SSLAEADContext::CreatePlaceholderForQUIC(
126 const SSL_CIPHER *cipher) {
127 return MakeUnique<SSLAEADContext>(cipher);
128 }
129
ExplicitNonceLen() const130 size_t SSLAEADContext::ExplicitNonceLen() const {
131 if (!CRYPTO_fuzzer_mode_enabled() && variable_nonce_included_in_record_) {
132 return variable_nonce_len_;
133 }
134 return 0;
135 }
136
SuffixLen(size_t * out_suffix_len,const size_t in_len,const size_t extra_in_len) const137 bool SSLAEADContext::SuffixLen(size_t *out_suffix_len, const size_t in_len,
138 const size_t extra_in_len) const {
139 if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) {
140 *out_suffix_len = extra_in_len;
141 return true;
142 }
143 return !!EVP_AEAD_CTX_tag_len(ctx_.get(), out_suffix_len, in_len,
144 extra_in_len);
145 }
146
CiphertextLen(size_t * out_len,const size_t in_len,const size_t extra_in_len) const147 bool SSLAEADContext::CiphertextLen(size_t *out_len, const size_t in_len,
148 const size_t extra_in_len) const {
149 size_t len;
150 if (!SuffixLen(&len, in_len, extra_in_len)) {
151 return false;
152 }
153 len += ExplicitNonceLen();
154 len += in_len;
155 if (len < in_len || len >= 0xffff) {
156 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
157 return false;
158 }
159 *out_len = len;
160 return true;
161 }
162
MaxOverhead() const163 size_t SSLAEADContext::MaxOverhead() const {
164 return ExplicitNonceLen() +
165 (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()
166 ? 0
167 : EVP_AEAD_max_overhead(EVP_AEAD_CTX_aead(ctx_.get())));
168 }
169
MaxSealInputLen(size_t max_out) const170 size_t SSLAEADContext::MaxSealInputLen(size_t max_out) const {
171 size_t explicit_nonce_len = ExplicitNonceLen();
172 if (max_out <= explicit_nonce_len) {
173 return 0;
174 }
175 max_out -= explicit_nonce_len;
176 if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) {
177 return max_out;
178 }
179 // TODO(crbug.com/42290602): This should be part of |EVP_AEAD_CTX|.
180 size_t overhead = EVP_AEAD_max_overhead(EVP_AEAD_CTX_aead(ctx_.get()));
181 if (SSL_CIPHER_is_block_cipher(cipher())) {
182 size_t block_size;
183 switch (cipher()->algorithm_enc) {
184 case SSL_AES128:
185 case SSL_AES256:
186 block_size = 16;
187 break;
188 case SSL_3DES:
189 block_size = 8;
190 break;
191 default:
192 abort();
193 }
194
195 // The output for a CBC cipher is always a whole number of blocks. Round the
196 // remaining capacity down.
197 max_out &= ~(block_size - 1);
198 // The maximum overhead is a full block of padding and the MAC, but the
199 // minimum overhead is one byte of padding, once we know the output is
200 // rounded down.
201 assert(overhead > block_size);
202 overhead -= block_size - 1;
203 }
204 return max_out <= overhead ? 0 : max_out - overhead;
205 }
206
GetAdditionalData(uint8_t storage[13],uint8_t type,uint16_t record_version,uint64_t seqnum,size_t plaintext_len,Span<const uint8_t> header)207 Span<const uint8_t> SSLAEADContext::GetAdditionalData(
208 uint8_t storage[13], uint8_t type, uint16_t record_version, uint64_t seqnum,
209 size_t plaintext_len, Span<const uint8_t> header) {
210 if (ad_is_header_) {
211 return header;
212 }
213
214 CRYPTO_store_u64_be(storage, seqnum);
215 size_t len = 8;
216 storage[len++] = type;
217 storage[len++] = static_cast<uint8_t>((record_version >> 8));
218 storage[len++] = static_cast<uint8_t>(record_version);
219 if (!omit_length_in_ad_) {
220 storage[len++] = static_cast<uint8_t>((plaintext_len >> 8));
221 storage[len++] = static_cast<uint8_t>(plaintext_len);
222 }
223 return Span(storage, len);
224 }
225
Open(Span<uint8_t> * out,uint8_t type,uint16_t record_version,uint64_t seqnum,Span<const uint8_t> header,Span<uint8_t> in)226 bool SSLAEADContext::Open(Span<uint8_t> *out, uint8_t type,
227 uint16_t record_version, uint64_t seqnum,
228 Span<const uint8_t> header, Span<uint8_t> in) {
229 if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) {
230 // Handle the initial NULL cipher.
231 *out = in;
232 return true;
233 }
234
235 // TLS 1.2 AEADs include the length in the AD and are assumed to have fixed
236 // overhead. Otherwise the parameter is unused.
237 size_t plaintext_len = 0;
238 if (!omit_length_in_ad_) {
239 size_t overhead = MaxOverhead();
240 if (in.size() < overhead) {
241 // Publicly invalid.
242 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
243 return false;
244 }
245 plaintext_len = in.size() - overhead;
246 }
247
248 uint8_t ad_storage[13];
249 Span<const uint8_t> ad = GetAdditionalData(ad_storage, type, record_version,
250 seqnum, plaintext_len, header);
251
252 // Assemble the nonce.
253 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
254 size_t nonce_len = 0;
255
256 // Prepend the fixed nonce, or left-pad with zeros if XORing.
257 if (xor_fixed_nonce_) {
258 nonce_len = fixed_nonce_.size() - variable_nonce_len_;
259 OPENSSL_memset(nonce, 0, nonce_len);
260 } else {
261 OPENSSL_memcpy(nonce, fixed_nonce_.data(), fixed_nonce_.size());
262 nonce_len += fixed_nonce_.size();
263 }
264
265 // Add the variable nonce.
266 if (variable_nonce_included_in_record_) {
267 if (in.size() < variable_nonce_len_) {
268 // Publicly invalid.
269 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH);
270 return false;
271 }
272 OPENSSL_memcpy(nonce + nonce_len, in.data(), variable_nonce_len_);
273 in = in.subspan(variable_nonce_len_);
274 } else {
275 assert(variable_nonce_len_ == 8);
276 CRYPTO_store_u64_be(nonce + nonce_len, seqnum);
277 }
278 nonce_len += variable_nonce_len_;
279
280 // XOR the fixed nonce, if necessary.
281 if (xor_fixed_nonce_) {
282 assert(nonce_len == fixed_nonce_.size());
283 for (size_t i = 0; i < fixed_nonce_.size(); i++) {
284 nonce[i] ^= fixed_nonce_[i];
285 }
286 }
287
288 // Decrypt in-place.
289 size_t len;
290 if (!EVP_AEAD_CTX_open(ctx_.get(), in.data(), &len, in.size(), nonce,
291 nonce_len, in.data(), in.size(), ad.data(),
292 ad.size())) {
293 return false;
294 }
295 *out = in.subspan(0, len);
296 return true;
297 }
298
SealScatter(uint8_t * out_prefix,uint8_t * out,uint8_t * out_suffix,uint8_t type,uint16_t record_version,uint64_t seqnum,Span<const uint8_t> header,const uint8_t * in,size_t in_len,const uint8_t * extra_in,size_t extra_in_len)299 bool SSLAEADContext::SealScatter(uint8_t *out_prefix, uint8_t *out,
300 uint8_t *out_suffix, uint8_t type,
301 uint16_t record_version, uint64_t seqnum,
302 Span<const uint8_t> header, const uint8_t *in,
303 size_t in_len, const uint8_t *extra_in,
304 size_t extra_in_len) {
305 const size_t prefix_len = ExplicitNonceLen();
306 size_t suffix_len;
307 if (!SuffixLen(&suffix_len, in_len, extra_in_len)) {
308 OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE);
309 return false;
310 }
311 if ((in != out && buffers_alias(in, in_len, out, in_len)) ||
312 buffers_alias(in, in_len, out_prefix, prefix_len) ||
313 buffers_alias(in, in_len, out_suffix, suffix_len)) {
314 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
315 return false;
316 }
317
318 if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) {
319 // Handle the initial NULL cipher.
320 OPENSSL_memmove(out, in, in_len);
321 OPENSSL_memmove(out_suffix, extra_in, extra_in_len);
322 return true;
323 }
324
325 uint8_t ad_storage[13];
326 Span<const uint8_t> ad = GetAdditionalData(ad_storage, type, record_version,
327 seqnum, in_len, header);
328
329 // Assemble the nonce.
330 uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
331 size_t nonce_len = 0;
332
333 // Prepend the fixed nonce, or left-pad with zeros if XORing.
334 if (xor_fixed_nonce_) {
335 nonce_len = fixed_nonce_.size() - variable_nonce_len_;
336 OPENSSL_memset(nonce, 0, nonce_len);
337 } else {
338 OPENSSL_memcpy(nonce, fixed_nonce_.data(), fixed_nonce_.size());
339 nonce_len += fixed_nonce_.size();
340 }
341
342 // Select the variable nonce.
343 if (random_variable_nonce_) {
344 assert(variable_nonce_included_in_record_);
345 if (!RAND_bytes(nonce + nonce_len, variable_nonce_len_)) {
346 return false;
347 }
348 } else {
349 // When sending we use the sequence number as the variable part of the
350 // nonce.
351 assert(variable_nonce_len_ == 8);
352 CRYPTO_store_u64_be(nonce + nonce_len, seqnum);
353 }
354 nonce_len += variable_nonce_len_;
355
356 // Emit the variable nonce if included in the record.
357 if (variable_nonce_included_in_record_) {
358 assert(!xor_fixed_nonce_);
359 if (buffers_alias(in, in_len, out_prefix, variable_nonce_len_)) {
360 OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
361 return false;
362 }
363 OPENSSL_memcpy(out_prefix, nonce + fixed_nonce_.size(),
364 variable_nonce_len_);
365 }
366
367 // XOR the fixed nonce, if necessary.
368 if (xor_fixed_nonce_) {
369 assert(nonce_len == fixed_nonce_.size());
370 for (size_t i = 0; i < fixed_nonce_.size(); i++) {
371 nonce[i] ^= fixed_nonce_[i];
372 }
373 }
374
375 size_t written_suffix_len;
376 bool result = !!EVP_AEAD_CTX_seal_scatter(
377 ctx_.get(), out, out_suffix, &written_suffix_len, suffix_len, nonce,
378 nonce_len, in, in_len, extra_in, extra_in_len, ad.data(), ad.size());
379 assert(!result || written_suffix_len == suffix_len);
380 return result;
381 }
382
Seal(uint8_t * out,size_t * out_len,size_t max_out_len,uint8_t type,uint16_t record_version,uint64_t seqnum,Span<const uint8_t> header,const uint8_t * in,size_t in_len)383 bool SSLAEADContext::Seal(uint8_t *out, size_t *out_len, size_t max_out_len,
384 uint8_t type, uint16_t record_version,
385 uint64_t seqnum, Span<const uint8_t> header,
386 const uint8_t *in, size_t in_len) {
387 const size_t prefix_len = ExplicitNonceLen();
388 size_t suffix_len;
389 if (!SuffixLen(&suffix_len, in_len, 0)) {
390 OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE);
391 return false;
392 }
393 if (in_len + prefix_len < in_len ||
394 in_len + prefix_len + suffix_len < in_len + prefix_len) {
395 OPENSSL_PUT_ERROR(CIPHER, SSL_R_RECORD_TOO_LARGE);
396 return false;
397 }
398 if (in_len + prefix_len + suffix_len > max_out_len) {
399 OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
400 return false;
401 }
402
403 if (!SealScatter(out, out + prefix_len, out + prefix_len + in_len, type,
404 record_version, seqnum, header, in, in_len, 0, 0)) {
405 return false;
406 }
407 *out_len = prefix_len + in_len + suffix_len;
408 return true;
409 }
410
GetIV(const uint8_t ** out_iv,size_t * out_iv_len) const411 bool SSLAEADContext::GetIV(const uint8_t **out_iv, size_t *out_iv_len) const {
412 return !is_null_cipher() &&
413 EVP_AEAD_CTX_get_iv(ctx_.get(), out_iv, out_iv_len);
414 }
415
416 BSSL_NAMESPACE_END
417