1 /*
2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /*
11 * DES and SHA-1 low level APIs are deprecated for public use, but still ok for
12 * internal use.
13 */
14 #include "internal/deprecated.h"
15
16 #include <openssl/sha.h>
17 #include <openssl/rand.h>
18 #include <openssl/proverr.h>
19 #include "cipher_tdes_default.h"
20 #include "crypto/evp.h"
21 #include "crypto/sha.h"
22 #include "prov/implementations.h"
23 #include "prov/providercommon.h"
24
25 #define TDES_WRAP_FLAGS PROV_CIPHER_FLAG_CUSTOM_IV | PROV_CIPHER_FLAG_RAND_KEY
26
27 static OSSL_FUNC_cipher_update_fn tdes_wrap_update;
28 static OSSL_FUNC_cipher_cipher_fn tdes_wrap_cipher;
29
30 static const unsigned char wrap_iv[8] = {
31 0x4a, 0xdd, 0xa2, 0x2c, 0x79, 0xe8, 0x21, 0x05
32 };
33
des_ede3_unwrap(PROV_CIPHER_CTX * ctx,unsigned char * out,const unsigned char * in,size_t inl)34 static int des_ede3_unwrap(PROV_CIPHER_CTX *ctx, unsigned char *out,
35 const unsigned char *in, size_t inl)
36 {
37 unsigned char icv[8], iv[TDES_IVLEN], sha1tmp[SHA_DIGEST_LENGTH];
38 int rv = -1;
39
40 if (inl < 24)
41 return -1;
42 if (out == NULL)
43 return (int)(inl - 16);
44
45 memcpy(ctx->iv, wrap_iv, 8);
46 /* Decrypt first block which will end up as icv */
47 ctx->hw->cipher(ctx, icv, in, 8);
48 /* Decrypt central blocks */
49 /*
50 * If decrypting in place move whole output along a block so the next
51 * des_ede_cbc_cipher is in place.
52 */
53 if (out == in) {
54 memmove(out, out + 8, inl - 8);
55 in -= 8;
56 }
57 ctx->hw->cipher(ctx, out, in + 8, inl - 16);
58 /* Decrypt final block which will be IV */
59 ctx->hw->cipher(ctx, iv, in + inl - 8, 8);
60 /* Reverse order of everything */
61 BUF_reverse(icv, NULL, 8);
62 BUF_reverse(out, NULL, inl - 16);
63 BUF_reverse(ctx->iv, iv, 8);
64 /* Decrypt again using new IV */
65 ctx->hw->cipher(ctx, out, out, inl - 16);
66 ctx->hw->cipher(ctx, icv, icv, 8);
67 if (ossl_sha1(out, inl - 16, sha1tmp) /* Work out hash of first portion */
68 && CRYPTO_memcmp(sha1tmp, icv, 8) == 0)
69 rv = (int)(inl - 16);
70 OPENSSL_cleanse(icv, 8);
71 OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH);
72 OPENSSL_cleanse(iv, 8);
73 OPENSSL_cleanse(ctx->iv, sizeof(ctx->iv));
74 if (rv == -1)
75 OPENSSL_cleanse(out, inl - 16);
76
77 return rv;
78 }
79
des_ede3_wrap(PROV_CIPHER_CTX * ctx,unsigned char * out,const unsigned char * in,size_t inl)80 static int des_ede3_wrap(PROV_CIPHER_CTX *ctx, unsigned char *out,
81 const unsigned char *in, size_t inl)
82 {
83 unsigned char sha1tmp[SHA_DIGEST_LENGTH];
84 size_t ivlen = TDES_IVLEN;
85 size_t icvlen = TDES_IVLEN;
86 size_t len = inl + ivlen + icvlen;
87
88 if (len > INT_MAX)
89 return 0;
90 if (out == NULL)
91 return (int)len;
92
93 /* Copy input to output buffer + 8 so we have space for IV */
94 memmove(out + ivlen, in, inl);
95 /* Work out ICV */
96 if (!ossl_sha1(in, inl, sha1tmp))
97 return 0;
98 memcpy(out + inl + ivlen, sha1tmp, icvlen);
99 OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH);
100 /* Generate random IV */
101 if (RAND_bytes_ex(ctx->libctx, ctx->iv, ivlen, 0) <= 0)
102 return 0;
103 memcpy(out, ctx->iv, ivlen);
104 /* Encrypt everything after IV in place */
105 ctx->hw->cipher(ctx, out + ivlen, out + ivlen, inl + ivlen);
106 BUF_reverse(out, NULL, len);
107 memcpy(ctx->iv, wrap_iv, ivlen);
108 ctx->hw->cipher(ctx, out, out, len);
109 return (int)len;
110 }
111
tdes_wrap_cipher_internal(PROV_CIPHER_CTX * ctx,unsigned char * out,const unsigned char * in,size_t inl)112 static int tdes_wrap_cipher_internal(PROV_CIPHER_CTX *ctx, unsigned char *out,
113 const unsigned char *in, size_t inl)
114 {
115 /*
116 * Sanity check input length: we typically only wrap keys so EVP_MAXCHUNK
117 * is more than will ever be needed. Also input length must be a multiple
118 * of 8 bits.
119 */
120 if (inl >= EVP_MAXCHUNK || inl % 8)
121 return -1;
122 if (ctx->enc)
123 return des_ede3_wrap(ctx, out, in, inl);
124 else
125 return des_ede3_unwrap(ctx, out, in, inl);
126 }
127
tdes_wrap_cipher(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)128 static int tdes_wrap_cipher(void *vctx,
129 unsigned char *out, size_t *outl, size_t outsize,
130 const unsigned char *in, size_t inl)
131 {
132 PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx;
133 int ret;
134
135 *outl = 0;
136 if (!ossl_prov_is_running())
137 return 0;
138
139 if (outsize < inl) {
140 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
141 return 0;
142 }
143
144 ret = tdes_wrap_cipher_internal(ctx, out, in, inl);
145 if (ret <= 0)
146 return 0;
147
148 *outl = ret;
149 return 1;
150 }
151
tdes_wrap_update(void * vctx,unsigned char * out,size_t * outl,size_t outsize,const unsigned char * in,size_t inl)152 static int tdes_wrap_update(void *vctx, unsigned char *out, size_t *outl,
153 size_t outsize, const unsigned char *in,
154 size_t inl)
155 {
156 *outl = 0;
157 if (inl == 0)
158 return 1;
159 if (outsize < inl) {
160 ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
161 return 0;
162 }
163
164 if (!tdes_wrap_cipher(vctx, out, outl, outsize, in, inl)) {
165 ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED);
166 return 0;
167 }
168 return 1;
169 }
170
171
172 # define IMPLEMENT_WRAP_CIPHER(flags, kbits, blkbits, ivbits) \
173 static OSSL_FUNC_cipher_newctx_fn tdes_wrap_newctx; \
174 static void *tdes_wrap_newctx(void *provctx) \
175 { \
176 return ossl_tdes_newctx(provctx, EVP_CIPH_WRAP_MODE, kbits, blkbits, \
177 ivbits, flags, \
178 ossl_prov_cipher_hw_tdes_wrap_cbc()); \
179 } \
180 static OSSL_FUNC_cipher_get_params_fn tdes_wrap_get_params; \
181 static int tdes_wrap_get_params(OSSL_PARAM params[]) \
182 { \
183 return ossl_cipher_generic_get_params(params, EVP_CIPH_WRAP_MODE, flags, \
184 kbits, blkbits, ivbits); \
185 } \
186 const OSSL_DISPATCH ossl_tdes_wrap_cbc_functions[] = \
187 { \
188 { OSSL_FUNC_CIPHER_ENCRYPT_INIT, (void (*)(void)) ossl_tdes_einit }, \
189 { OSSL_FUNC_CIPHER_DECRYPT_INIT, (void (*)(void)) ossl_tdes_dinit }, \
190 { OSSL_FUNC_CIPHER_CIPHER, (void (*)(void))tdes_wrap_cipher }, \
191 { OSSL_FUNC_CIPHER_NEWCTX, (void (*)(void))tdes_wrap_newctx }, \
192 { OSSL_FUNC_CIPHER_FREECTX, (void (*)(void))ossl_tdes_freectx }, \
193 { OSSL_FUNC_CIPHER_UPDATE, (void (*)(void))tdes_wrap_update }, \
194 { OSSL_FUNC_CIPHER_FINAL, \
195 (void (*)(void))ossl_cipher_generic_stream_final }, \
196 { OSSL_FUNC_CIPHER_GET_PARAMS, (void (*)(void))tdes_wrap_get_params }, \
197 { OSSL_FUNC_CIPHER_GETTABLE_PARAMS, \
198 (void (*)(void))ossl_cipher_generic_gettable_params }, \
199 { OSSL_FUNC_CIPHER_GET_CTX_PARAMS, \
200 (void (*)(void))ossl_tdes_get_ctx_params }, \
201 { OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \
202 (void (*)(void))ossl_tdes_gettable_ctx_params }, \
203 { OSSL_FUNC_CIPHER_SET_CTX_PARAMS, \
204 (void (*)(void))ossl_cipher_generic_set_ctx_params }, \
205 { OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \
206 (void (*)(void))ossl_cipher_generic_settable_ctx_params }, \
207 OSSL_DISPATCH_END \
208 }
209
210 /* ossl_tdes_wrap_cbc_functions */
211 IMPLEMENT_WRAP_CIPHER(TDES_WRAP_FLAGS, 64*3, 64, 0);
212