2 * Copyright (C) 2018 vt@altlinux.org. All Rights Reserved.
3 * Copyright (c) 2010 The OpenSSL Project. All rights reserved.
5 * Contents licensed under the terms of the OpenSSL license
6 * See https://www.openssl.org/source/license.html for details
9 #include <openssl/cmac.h>
10 #include <openssl/conf.h>
11 #include <openssl/err.h>
12 #include <openssl/evp.h>
14 #include "e_gost_err.h"
16 #include "gost_grasshopper_defines.h"
17 #include "gost_grasshopper_cipher.h"
19 #define ACPKM_T_MAX (GRASSHOPPER_KEY_SIZE + GRASSHOPPER_BLOCK_SIZE)
21 * CMAC code from crypto/cmac/cmac.c with ACPKM tweaks
23 struct CMAC_ACPKM_CTX_st {
24 /* Cipher context to use */
26 /* CTR-ACPKM cipher */
28 unsigned char km[ACPKM_T_MAX]; /* Key material */
30 unsigned char tbl[EVP_MAX_BLOCK_LENGTH];
31 /* Last (possibly partial) block */
32 unsigned char last_block[EVP_MAX_BLOCK_LENGTH];
33 /* Number of bytes in last block: -1 means context not initialised */
35 unsigned int section_size; /* N */
36 unsigned int num; /* processed bytes until section_size */
38 typedef struct CMAC_ACPKM_CTX_st CMAC_ACPKM_CTX;
40 static unsigned char zero_iv[ACPKM_T_MAX];
42 /* Make temporary keys K1 and K2 */
44 static void make_kn(unsigned char *k1, unsigned char *l, int bl)
47 /* Shift block to left, including carry */
48 for (i = 0; i < bl; i++) {
50 if (i < bl - 1 && l[i + 1] & 0x80)
53 /* If MSB set fixup with R */
55 k1[bl - 1] ^= bl == 16 ? 0x87 : 0x1b;
58 static CMAC_ACPKM_CTX *CMAC_ACPKM_CTX_new(void)
61 ctx = OPENSSL_malloc(sizeof(CMAC_ACPKM_CTX));
64 ctx->cctx = EVP_CIPHER_CTX_new();
65 if (ctx->cctx == NULL) {
69 ctx->actx = EVP_CIPHER_CTX_new();
70 if (ctx->actx == NULL) {
74 ctx->nlast_block = -1;
76 ctx->section_size = 4096; /* recommended value for Kuznyechik */
80 static void CMAC_ACPKM_CTX_cleanup(CMAC_ACPKM_CTX *ctx)
82 EVP_CIPHER_CTX_cleanup(ctx->cctx);
83 EVP_CIPHER_CTX_cleanup(ctx->actx);
84 OPENSSL_cleanse(ctx->tbl, EVP_MAX_BLOCK_LENGTH);
85 OPENSSL_cleanse(ctx->km, ACPKM_T_MAX);
86 OPENSSL_cleanse(ctx->last_block, EVP_MAX_BLOCK_LENGTH);
87 ctx->nlast_block = -1;
90 static void CMAC_ACPKM_CTX_free(CMAC_ACPKM_CTX *ctx)
94 CMAC_ACPKM_CTX_cleanup(ctx);
95 EVP_CIPHER_CTX_free(ctx->cctx);
96 EVP_CIPHER_CTX_free(ctx->actx);
100 int CMAC_ACPKM_CTX_copy(CMAC_ACPKM_CTX *out, const CMAC_ACPKM_CTX *in)
103 if (in->nlast_block == -1)
105 if (!EVP_CIPHER_CTX_copy(out->cctx, in->cctx))
107 if (!EVP_CIPHER_CTX_copy(out->actx, in->actx))
109 bl = EVP_CIPHER_CTX_block_size(in->cctx);
110 memcpy(out->km, in->km, ACPKM_T_MAX);
111 memcpy(out->tbl, in->tbl, bl);
112 memcpy(out->last_block, in->last_block, bl);
113 out->nlast_block = in->nlast_block;
114 out->section_size = in->section_size;
119 static int CMAC_ACPKM_Init(CMAC_ACPKM_CTX *ctx, const void *key, size_t keylen,
120 const EVP_CIPHER *cipher, ENGINE *impl)
122 /* All zeros means restart */
123 if (!key && !cipher && !impl && keylen == 0) {
124 /* Not initialised */
125 if (ctx->nlast_block == -1)
127 if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, NULL, zero_iv))
129 memset(ctx->tbl, 0, EVP_CIPHER_CTX_block_size(ctx->cctx));
130 ctx->nlast_block = 0;
131 /* No restart for ACPKM */
134 /* Initialise context */
136 const EVP_CIPHER *acpkm;
138 if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
140 switch (EVP_CIPHER_nid(cipher)) {
141 case NID_grasshopper_cbc:
142 acpkm = cipher_gost_grasshopper_ctracpkm();
147 if (!EVP_EncryptInit_ex(ctx->actx, acpkm, impl, NULL, NULL))
150 /* Non-NULL key means initialisation is complete */
152 unsigned char acpkm_iv[EVP_MAX_BLOCK_LENGTH];
153 int block_size, key_len;
155 /* Initialize CTR for ACPKM-Master */
156 if (!EVP_CIPHER_CTX_cipher(ctx->actx))
158 /* block size of ACPKM cipher could be 1, but,
159 * cbc cipher is same with correct block_size */
160 block_size = EVP_CIPHER_CTX_block_size(ctx->cctx);
161 /* Wide IV = 1^{n/2} || 0,
162 * where a^r denotes the string that consists of r 'a' bits */
163 memset(acpkm_iv, 0xff, block_size / 2);
164 memset(acpkm_iv + block_size / 2, 0, block_size / 2);
165 if (!EVP_EncryptInit_ex(ctx->actx, NULL, NULL, key, acpkm_iv))
167 /* EVP_CIPHER key_len may be different from EVP_CIPHER_CTX key_len */
168 key_len = EVP_CIPHER_key_length(EVP_CIPHER_CTX_cipher(ctx->actx));
170 /* Generate first key material (K^1 || K^1_1) */
171 if (!EVP_Cipher(ctx->actx, ctx->km, zero_iv, key_len + block_size))
174 /* Initialize cbc for CMAC */
175 if (!EVP_CIPHER_CTX_cipher(ctx->cctx) ||
176 !EVP_CIPHER_CTX_set_key_length(ctx->cctx, key_len))
178 /* set CBC key to K^1 */
179 if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, ctx->km, zero_iv))
181 ctx->nlast_block = 0;
186 /* Encrypt zeros with master key
187 * to generate T*-sized key material */
188 static int CMAC_ACPKM_Master(CMAC_ACPKM_CTX *ctx)
190 return EVP_Cipher(ctx->actx, ctx->km, zero_iv,
191 EVP_CIPHER_key_length(EVP_CIPHER_CTX_cipher(ctx->actx)) +
192 EVP_CIPHER_CTX_block_size(ctx->cctx));
195 static int CMAC_ACPKM_Mesh(CMAC_ACPKM_CTX *ctx)
197 if (ctx->num < ctx->section_size)
200 if (!CMAC_ACPKM_Master(ctx))
202 /* Restart cbc with new key */
203 if (!EVP_EncryptInit_ex(ctx->cctx, NULL, NULL, ctx->km,
204 EVP_CIPHER_CTX_iv(ctx->cctx)))
209 static int CMAC_ACPKM_Update(CMAC_ACPKM_CTX *ctx, const void *in, size_t dlen)
211 const unsigned char *data = in;
213 if (ctx->nlast_block == -1)
217 bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
218 /* Copy into partial block if we need to */
219 if (ctx->nlast_block > 0) {
221 nleft = bl - ctx->nlast_block;
224 memcpy(ctx->last_block + ctx->nlast_block, data, nleft);
226 ctx->nlast_block += nleft;
227 /* If no more to process return */
231 /* Else not final block so encrypt it */
232 if (!CMAC_ACPKM_Mesh(ctx))
234 if (!EVP_Cipher(ctx->cctx, ctx->tbl, ctx->last_block, bl))
238 /* Encrypt all but one of the complete blocks left */
240 if (!CMAC_ACPKM_Mesh(ctx))
242 if (!EVP_Cipher(ctx->cctx, ctx->tbl, data, bl))
248 /* Copy any data left to last block buffer */
249 memcpy(ctx->last_block, data, dlen);
250 ctx->nlast_block = dlen;
255 static int CMAC_ACPKM_Final(CMAC_ACPKM_CTX *ctx, unsigned char *out,
258 int i, bl, lb, key_len;
259 unsigned char *k1, k2[EVP_MAX_BLOCK_LENGTH];
260 if (ctx->nlast_block == -1)
262 bl = EVP_CIPHER_CTX_block_size(ctx->cctx);
263 *poutlen = (size_t) bl;
266 lb = ctx->nlast_block;
268 if (!CMAC_ACPKM_Mesh(ctx))
270 key_len = EVP_CIPHER_key_length(EVP_CIPHER_CTX_cipher(ctx->actx));
272 k1 = ctx->km + key_len;
273 make_kn(k2, ctx->km + key_len, bl);
275 /* Is last block complete? */
277 for (i = 0; i < bl; i++)
278 out[i] = ctx->last_block[i] ^ k1[i];
280 ctx->last_block[lb] = 0x80;
282 memset(ctx->last_block + lb + 1, 0, bl - lb - 1);
283 for (i = 0; i < bl; i++)
284 out[i] = ctx->last_block[i] ^ k2[i];
286 OPENSSL_cleanse(k1, bl);
287 OPENSSL_cleanse(k2, bl);
288 OPENSSL_cleanse(ctx->km, ACPKM_T_MAX);
289 if (!EVP_Cipher(ctx->cctx, out, out, bl)) {
290 OPENSSL_cleanse(out, bl);
297 * End of CMAC code from crypto/cmac/cmac.c with ACPKM tweaks
300 typedef struct omac_acpkm_ctx {
301 CMAC_ACPKM_CTX *cmac_ctx;
307 #define MAX_GOST_OMAC_ACPKM_SIZE 16
309 static int omac_acpkm_init(EVP_MD_CTX *ctx, int cipher_nid)
311 OMAC_ACPKM_CTX *c = EVP_MD_CTX_md_data(ctx);
312 memset(c, 0, sizeof(OMAC_ACPKM_CTX));
313 c->cipher_nid = cipher_nid;
316 switch (cipher_nid) {
317 case NID_grasshopper_cbc:
325 static int grasshopper_omac_acpkm_init(EVP_MD_CTX *ctx)
327 return omac_acpkm_init(ctx, NID_grasshopper_cbc);
330 static int omac_acpkm_imit_update(EVP_MD_CTX *ctx, const void *data,
333 OMAC_ACPKM_CTX *c = EVP_MD_CTX_md_data(ctx);
335 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_UPDATE, GOST_R_MAC_KEY_NOT_SET);
339 return CMAC_ACPKM_Update(c->cmac_ctx, data, count);
342 int omac_acpkm_imit_final(EVP_MD_CTX *ctx, unsigned char *md)
344 OMAC_ACPKM_CTX *c = EVP_MD_CTX_md_data(ctx);
345 unsigned char mac[MAX_GOST_OMAC_ACPKM_SIZE];
346 size_t mac_size = sizeof(mac);
349 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_FINAL, GOST_R_MAC_KEY_NOT_SET);
353 CMAC_ACPKM_Final(c->cmac_ctx, mac, &mac_size);
355 memcpy(md, mac, c->dgst_size);
359 int omac_acpkm_imit_copy(EVP_MD_CTX *to, const EVP_MD_CTX *from)
361 OMAC_ACPKM_CTX *c_to = EVP_MD_CTX_md_data(to);
362 const OMAC_ACPKM_CTX *c_from = EVP_MD_CTX_md_data(from);
364 if (c_from && c_to) {
365 c_to->dgst_size = c_from->dgst_size;
366 c_to->cipher_nid = c_from->cipher_nid;
367 c_to->key_set = c_from->key_set;
371 if (!c_from->cmac_ctx) {
372 if (c_to->cmac_ctx) {
373 CMAC_ACPKM_CTX_free(c_to->cmac_ctx);
374 c_to->cmac_ctx = NULL;
378 if (c_to->cmac_ctx == c_from->cmac_ctx) {
379 c_to->cmac_ctx = CMAC_ACPKM_CTX_new();
381 return CMAC_ACPKM_CTX_copy(c_to->cmac_ctx, c_from->cmac_ctx);
384 /* Clean up imit ctx */
385 int omac_acpkm_imit_cleanup(EVP_MD_CTX *ctx)
387 OMAC_ACPKM_CTX *c = EVP_MD_CTX_md_data(ctx);
390 CMAC_ACPKM_CTX_free(c->cmac_ctx);
391 memset(EVP_MD_CTX_md_data(ctx), 0, sizeof(OMAC_ACPKM_CTX));
396 static int omac_acpkm_key(OMAC_ACPKM_CTX *c, const EVP_CIPHER *cipher,
397 const unsigned char *key, size_t key_size)
401 c->cmac_ctx = CMAC_ACPKM_CTX_new();
402 if (c->cmac_ctx == NULL) {
403 GOSTerr(GOST_F_OMAC_ACPKM_KEY, ERR_R_MALLOC_FAILURE);
407 ret = CMAC_ACPKM_Init(c->cmac_ctx, key, key_size, cipher, NULL);
414 int omac_acpkm_imit_ctrl(EVP_MD_CTX *ctx, int type, int arg, void *ptr)
417 case EVP_MD_CTRL_KEY_LEN:
418 *((unsigned int *)(ptr)) = 32;
420 case EVP_MD_CTRL_SET_KEY:
422 OMAC_ACPKM_CTX *c = EVP_MD_CTX_md_data(ctx);
423 const EVP_MD *md = EVP_MD_CTX_md(ctx);
424 const EVP_CIPHER *cipher = NULL;
426 if (c->cipher_nid == NID_undef) {
427 switch (EVP_MD_nid(md)) {
428 case NID_grasshopper_mac:
429 case NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac:
430 c->cipher_nid = NID_grasshopper_cbc;
434 cipher = EVP_get_cipherbynid(c->cipher_nid);
435 if (cipher == NULL) {
436 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_CTRL, GOST_R_CIPHER_NOT_FOUND);
438 if (EVP_MD_meth_get_init(EVP_MD_CTX_md(ctx)) (ctx) <= 0) {
439 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_CTRL, GOST_R_MAC_KEY_NOT_SET);
442 EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NO_INIT);
444 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_CTRL, GOST_R_BAD_ORDER);
448 struct gost_mac_key *key = (struct gost_mac_key *)ptr;
449 return omac_acpkm_key(c, cipher, key->key, 32);
450 } else if (arg == 32) {
451 return omac_acpkm_key(c, cipher, ptr, 32);
453 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_CTRL, GOST_R_INVALID_MAC_KEY_SIZE);
456 case EVP_CTRL_KEY_MESH:
458 OMAC_ACPKM_CTX *c = EVP_MD_CTX_md_data(ctx);
459 if (!arg || (arg % EVP_MD_block_size(EVP_MD_CTX_md(ctx))))
461 c->cmac_ctx->section_size = arg;
462 if (ptr && *(int *)ptr) {
463 /* Set parameter T */
464 if (!EVP_CIPHER_CTX_ctrl(c->cmac_ctx->actx, EVP_CTRL_KEY_MESH, *(int *)ptr, NULL))
469 case EVP_MD_CTRL_XOF_LEN: /* Supported in OpenSSL */
471 OMAC_ACPKM_CTX *c = EVP_MD_CTX_md_data(ctx);
472 switch (c->cipher_nid) {
473 case NID_grasshopper_cbc:
474 if (arg < 1 || arg > 16) {
475 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_CTRL, GOST_R_INVALID_MAC_SIZE);
481 if (arg < 1 || arg > 8) {
482 GOSTerr(GOST_F_OMAC_ACPKM_IMIT_CTRL, GOST_R_INVALID_MAC_SIZE);
498 static EVP_MD *_hidden_grasshopper_omac_acpkm_md = NULL;
500 EVP_MD *grasshopper_omac_acpkm(void)
502 if (_hidden_grasshopper_omac_acpkm_md == NULL) {
506 EVP_MD_meth_new(NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac,
508 || !EVP_MD_meth_set_result_size(md, MAX_GOST_OMAC_ACPKM_SIZE)
509 || !EVP_MD_meth_set_input_blocksize(md, GRASSHOPPER_BLOCK_SIZE)
510 || !EVP_MD_meth_set_app_datasize(md, sizeof(OMAC_ACPKM_CTX))
511 || !EVP_MD_meth_set_flags(md, EVP_MD_FLAG_XOF)
512 || !EVP_MD_meth_set_init(md, grasshopper_omac_acpkm_init)
513 || !EVP_MD_meth_set_update(md, omac_acpkm_imit_update)
514 || !EVP_MD_meth_set_final(md, omac_acpkm_imit_final)
515 || !EVP_MD_meth_set_copy(md, omac_acpkm_imit_copy)
516 || !EVP_MD_meth_set_cleanup(md, omac_acpkm_imit_cleanup)
517 || !EVP_MD_meth_set_ctrl(md, omac_acpkm_imit_ctrl)) {
518 EVP_MD_meth_free(md);
521 _hidden_grasshopper_omac_acpkm_md = md;
523 return _hidden_grasshopper_omac_acpkm_md;
526 void grasshopper_omac_acpkm_destroy(void)
528 EVP_MD_meth_free(_hidden_grasshopper_omac_acpkm_md);
529 _hidden_grasshopper_omac_acpkm_md = NULL;