X-Git-Url: http://wagner.pp.ru/gitweb/?a=blobdiff_plain;f=gost_grasshopper_cipher.c;h=9cef0c5f02fa1a596177385d32531c230e98e46a;hb=1a2714eb8f2c526517a01c90bb02ccd0e22f4c08;hp=2818e8636bc9669a196d84a75104ed1769448d86;hpb=0097737ac987e4cfa4de161202da6f4f93c7a5d0;p=openssl-gost%2Fengine.git diff --git a/gost_grasshopper_cipher.c b/gost_grasshopper_cipher.c index 2818e86..9cef0c5 100644 --- a/gost_grasshopper_cipher.c +++ b/gost_grasshopper_cipher.c @@ -3,14 +3,11 @@ * This file is distributed under the same license as OpenSSL */ -#if defined(__cplusplus) -extern "C" { -#endif - #include "gost_grasshopper_cipher.h" #include "gost_grasshopper_defines.h" #include "gost_grasshopper_math.h" #include "gost_grasshopper_core.h" +#include "gost_gost2015.h" #include #include @@ -27,21 +24,15 @@ enum GRASSHOPPER_CIPHER_TYPE { GRASSHOPPER_CIPHER_CFB, GRASSHOPPER_CIPHER_CTR, GRASSHOPPER_CIPHER_CTRACPKM, + GRASSHOPPER_CIPHER_CTRACPKMOMAC, }; -static EVP_CIPHER *gost_grasshopper_ciphers[6] = { - [GRASSHOPPER_CIPHER_ECB] = NULL, - [GRASSHOPPER_CIPHER_CBC] = NULL, - [GRASSHOPPER_CIPHER_OFB] = NULL, - [GRASSHOPPER_CIPHER_CFB] = NULL, - [GRASSHOPPER_CIPHER_CTR] = NULL, - [GRASSHOPPER_CIPHER_CTRACPKM] = NULL, +static EVP_CIPHER *gost_grasshopper_ciphers[7] = { + NULL, NULL, NULL, NULL, NULL, NULL, NULL }; static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c); -static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c); +gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c); struct GRASSHOPPER_CIPHER_PARAMS { int nid; @@ -52,73 +43,87 @@ struct GRASSHOPPER_CIPHER_PARAMS { int ctx_size; int iv_size; bool padding; + int extra_flags; }; -static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[6] = { - [GRASSHOPPER_CIPHER_ECB] = { - NID_grasshopper_ecb, - gost_grasshopper_cipher_init_ecb, - gost_grasshopper_cipher_do_ecb, - NULL, - 16, - sizeof(gost_grasshopper_cipher_ctx), - 0, - true} - , - [GRASSHOPPER_CIPHER_CBC] = { - NID_grasshopper_cbc, - gost_grasshopper_cipher_init_cbc, - gost_grasshopper_cipher_do_cbc, - NULL, - 16, - sizeof(gost_grasshopper_cipher_ctx), - 16, - true} - , - [GRASSHOPPER_CIPHER_OFB] = { - NID_grasshopper_ofb, - gost_grasshopper_cipher_init_ofb, - gost_grasshopper_cipher_do_ofb, - gost_grasshopper_cipher_destroy_ofb, - 1, - sizeof(gost_grasshopper_cipher_ctx_ofb), - 16, - false} - , - [GRASSHOPPER_CIPHER_CFB] = { - NID_grasshopper_cfb, - gost_grasshopper_cipher_init_cfb, - gost_grasshopper_cipher_do_cfb, - NULL, - 1, - sizeof(gost_grasshopper_cipher_ctx), - 16, - false} - , - [GRASSHOPPER_CIPHER_CTR] = { - NID_grasshopper_ctr, - gost_grasshopper_cipher_init_ctr, - gost_grasshopper_cipher_do_ctr, - gost_grasshopper_cipher_destroy_ctr, - 1, - sizeof(gost_grasshopper_cipher_ctx_ctr), - /* IV size is set to match full block, to make it responsibility of - * user to assign correct values (IV || 0), and to make naive context - * copy possible (for software such as openssh) */ - 16, - false} - , - [GRASSHOPPER_CIPHER_CTRACPKM] = { - NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm, - gost_grasshopper_cipher_init_ctracpkm, - gost_grasshopper_cipher_do_ctracpkm, - gost_grasshopper_cipher_destroy_ctr, - 1, - sizeof - (gost_grasshopper_cipher_ctx_ctr), - 16, - false} - , +static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[7] = { + { + NID_grasshopper_ecb, + gost_grasshopper_cipher_init_ecb, + gost_grasshopper_cipher_do_ecb, + NULL, + 16, + sizeof(gost_grasshopper_cipher_ctx), + 0, + true, + 0 + }, + { + NID_grasshopper_cbc, + gost_grasshopper_cipher_init_cbc, + gost_grasshopper_cipher_do_cbc, + NULL, + 16, + sizeof(gost_grasshopper_cipher_ctx), + 16, + true, + 0 + }, + { + NID_grasshopper_ofb, + gost_grasshopper_cipher_init_ofb, + gost_grasshopper_cipher_do_ofb, + NULL, + 1, + sizeof(gost_grasshopper_cipher_ctx), + 16, + false, + 0 + }, + { + NID_grasshopper_cfb, + gost_grasshopper_cipher_init_cfb, + gost_grasshopper_cipher_do_cfb, + NULL, + 1, + sizeof(gost_grasshopper_cipher_ctx), + 16, + false, + 0 + }, + { + NID_grasshopper_ctr, + gost_grasshopper_cipher_init_ctr, + gost_grasshopper_cipher_do_ctr, + gost_grasshopper_cipher_destroy_ctr, + 1, + sizeof(gost_grasshopper_cipher_ctx_ctr), + 8, + false, + 0 + }, + { + NID_kuznyechik_ctr_acpkm, + gost_grasshopper_cipher_init_ctracpkm, + gost_grasshopper_cipher_do_ctracpkm, + gost_grasshopper_cipher_destroy_ctr, + 1, + sizeof(gost_grasshopper_cipher_ctx_ctr), + 8, + false, + 0 + }, + { + NID_kuznyechik_ctr_acpkm_omac, + gost_grasshopper_cipher_init_ctracpkm_omac, + gost_grasshopper_cipher_do_ctracpkm_omac, + gost_grasshopper_cipher_destroy_ctr, + 1, + sizeof(gost_grasshopper_cipher_ctx_ctr), + 8, + false, + EVP_CIPH_FLAG_CUSTOM_CIPHER|EVP_CIPH_FLAG_CIPHER_WITH_MAC|EVP_CIPH_CUSTOM_COPY + }, }; /* first 256 bit of D from draft-irtf-cfrg-re-keying-12 */ @@ -129,14 +134,14 @@ static const unsigned char ACPKM_D_2018[] = { 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 256 bit */ }; -static void acpkm_next(gost_grasshopper_cipher_ctx * c) { +static void acpkm_next(gost_grasshopper_cipher_ctx * c) +{ unsigned char newkey[GRASSHOPPER_KEY_SIZE]; const int J = GRASSHOPPER_KEY_SIZE / GRASSHOPPER_BLOCK_SIZE; int n; for (n = 0; n < J; n++) { - const unsigned char *D_n = - &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE]; + const unsigned char *D_n = &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE]; grasshopper_encrypt_block(&c->encrypt_round_keys, (grasshopper_w128_t *) D_n, @@ -149,23 +154,37 @@ static void acpkm_next(gost_grasshopper_cipher_ctx * c) { /* Set 256 bit key into context */ GRASSHOPPER_INLINE void - gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, - const uint8_t *k) { +gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) +{ int i; for (i = 0; i < 2; i++) { grasshopper_copy128(&c->key.k.k[i], (const grasshopper_w128_t *)(k + i * 16)); } + grasshopper_set_encrypt_key(&c->encrypt_round_keys, &c->key); grasshopper_set_decrypt_key(&c->decrypt_round_keys, &c->key); } +/* Set master 256-bit key to be used in TLSTREE calculation into context */ +GRASSHOPPER_INLINE void +gost_grasshopper_master_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) +{ + int i; + for (i = 0; i < 2; i++) { + grasshopper_copy128(&c->master_key.k.k[i], + (const grasshopper_w128_t *)(k + i * 16)); + } +} + /* Cleans up key from context */ GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) { +gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) +{ int i; for (i = 0; i < 2; i++) { grasshopper_zero128(&c->key.k.k[i]); + grasshopper_zero128(&c->master_key.k.k[i]); } for (i = 0; i < GRASSHOPPER_ROUND_KEYS_COUNT; i++) { grasshopper_zero128(&c->encrypt_round_keys.k[i]); @@ -177,33 +196,30 @@ GRASSHOPPER_INLINE void } static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c) { - gost_grasshopper_cipher_ctx_ofb *ctx = - (gost_grasshopper_cipher_ctx_ofb *) c; - - grasshopper_zero128(&ctx->buffer1); -} - -static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c) { +gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c) +{ gost_grasshopper_cipher_ctx_ctr *ctx = (gost_grasshopper_cipher_ctx_ctr *) c; + if (ctx->omac_ctx) + EVP_MD_CTX_free(ctx->omac_ctx); + grasshopper_zero128(&ctx->partial_buffer); } int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) { + const unsigned char *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); if (EVP_CIPHER_CTX_get_app_data(ctx) == NULL) { - EVP_CIPHER_CTX_set_app_data(ctx, - EVP_CIPHER_CTX_get_cipher_data(ctx)); + EVP_CIPHER_CTX_set_app_data(ctx, EVP_CIPHER_CTX_get_cipher_data(ctx)); } if (key != NULL) { gost_grasshopper_cipher_key(c, key); + gost_grasshopper_master_key(c, key); } if (iv != NULL) { @@ -219,58 +235,47 @@ int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, return 1; } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_ECB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_CBC; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx_ofb *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); - - c->c.type = GRASSHOPPER_CIPHER_OFB; - - grasshopper_zero128(&c->buffer1); - +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + c->type = GRASSHOPPER_CIPHER_OFB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_CFB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->c.type = GRASSHOPPER_CIPHER_CTR; EVP_CIPHER_CTX_set_num(ctx, 0); @@ -281,14 +286,11 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, } GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX - *ctx, - const unsigned - char *key, - const unsigned - char *iv, - int enc) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); + *ctx, const unsigned + char *key, const unsigned + char *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); /* NB: setting type makes EVP do_cipher callback useless */ c->c.type = GRASSHOPPER_CIPHER_CTRACPKM; @@ -298,10 +300,59 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX return gost_grasshopper_cipher_init(ctx, key, iv, enc); } +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm_omac(EVP_CIPHER_CTX + *ctx, const unsigned + char *key, const unsigned + char *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + + /* NB: setting type makes EVP do_cipher callback useless */ + c->c.type = GRASSHOPPER_CIPHER_CTRACPKMOMAC; + EVP_CIPHER_CTX_set_num(ctx, 0); + c->section_size = 4096; + + if (key) { + unsigned char keys[64]; + const EVP_MD *md = EVP_get_digestbynid(NID_kuznyechik_mac); + EVP_PKEY *mac_key; + + if (md == NULL) + return 0; + + if (enc) { + if (RAND_bytes(c->kdf_seed, 8) != 1) + return 0; + } + + if (gost_kdftree2012_256(keys, 64, key, 32, (const unsigned char *)"kdf tree", 8, c->kdf_seed, 8, 1) <= 0) + return 0; + + c->omac_ctx = EVP_MD_CTX_new(); + mac_key = EVP_PKEY_new_mac_key(NID_kuznyechik_mac, NULL, keys+32, 32); + + if (mac_key == NULL || c->omac_ctx == NULL) { + EVP_PKEY_free(mac_key); + return 0; + } + + if (EVP_DigestInit_ex(c->omac_ctx, md, NULL) <= 0 || + EVP_DigestSignInit(c->omac_ctx, NULL, md, NULL, mac_key) <= 0) { + EVP_PKEY_free(mac_key); + return 0; + } + EVP_PKEY_free(mac_key); + + return gost_grasshopper_cipher_init(ctx, keys, iv, enc); + } + return gost_grasshopper_cipher_init(ctx, key, iv, enc); +} + GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, - size_t inl) { + size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; @@ -310,7 +361,8 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX *ctx, } int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { + const unsigned char *in, size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); @@ -339,15 +391,14 @@ int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, } int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { + const unsigned char *in, size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); const unsigned char *current_in = in; unsigned char *current_out = out; - grasshopper_w128_t *currentInputBlock; - grasshopper_w128_t *currentOutputBlock; size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; size_t i; grasshopper_w128_t *currentBlock; @@ -357,30 +408,34 @@ int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, for (i = 0; i < blocks; i++, current_in += GRASSHOPPER_BLOCK_SIZE, current_out += GRASSHOPPER_BLOCK_SIZE) { - currentInputBlock = (grasshopper_w128_t *) current_in; - currentOutputBlock = (grasshopper_w128_t *) current_out; + grasshopper_w128_t *currentInputBlock = (grasshopper_w128_t *) current_in; + grasshopper_w128_t *currentOutputBlock = (grasshopper_w128_t *) current_out; if (encrypting) { grasshopper_append128(currentBlock, currentInputBlock); grasshopper_encrypt_block(&c->encrypt_round_keys, currentBlock, currentOutputBlock, &c->buffer); grasshopper_copy128(currentBlock, currentOutputBlock); } else { + grasshopper_w128_t tmp; + + grasshopper_copy128(&tmp, currentInputBlock); grasshopper_decrypt_block(&c->decrypt_round_keys, currentInputBlock, currentOutputBlock, &c->buffer); grasshopper_append128(currentOutputBlock, currentBlock); - grasshopper_copy128(currentBlock, currentInputBlock); + grasshopper_copy128(currentBlock, &tmp); } } return 1; } -void inc_counter(unsigned char *counter, size_t counter_bytes) { - unsigned char c; +void inc_counter(unsigned char *counter, size_t counter_bytes) +{ unsigned int n = counter_bytes; do { + unsigned char c; --n; c = counter[n]; ++c; @@ -391,14 +446,15 @@ void inc_counter(unsigned char *counter, size_t counter_bytes) { } /* increment counter (128-bit int) by 1 */ -static void ctr128_inc(unsigned char *counter) { +static void ctr128_inc(unsigned char *counter) +{ inc_counter(counter, 16); } int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx_ctr *c = - (gost_grasshopper_cipher_ctx_ctr *) + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ctr *c = (gost_grasshopper_cipher_ctx_ctr *) EVP_CIPHER_CTX_get_cipher_data(ctx); unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); const unsigned char *current_in = in; @@ -408,6 +464,9 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, unsigned int n = EVP_CIPHER_CTX_num(ctx); size_t lasted; size_t i; + size_t blocks; + grasshopper_w128_t *iv_buffer; + grasshopper_w128_t tmp; while (n && inl) { *(current_out++) = *(current_in++) ^ c->partial_buffer.b[n]; @@ -415,17 +474,18 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, n = (n + 1) % GRASSHOPPER_BLOCK_SIZE; } EVP_CIPHER_CTX_set_num(ctx, n); - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; + blocks = inl / GRASSHOPPER_BLOCK_SIZE; - grasshopper_w128_t *iv_buffer = (grasshopper_w128_t *) iv; + iv_buffer = (grasshopper_w128_t *) iv; // full parts for (i = 0; i < blocks; i++) { currentInputBlock = (grasshopper_w128_t *) current_in; currentOutputBlock = (grasshopper_w128_t *) current_out; grasshopper_encrypt_block(&c->c.encrypt_round_keys, iv_buffer, - currentOutputBlock, &c->c.buffer); - grasshopper_append128(currentOutputBlock, currentInputBlock); + &c->partial_buffer, &c->c.buffer); + grasshopper_plus128(&tmp, &c->partial_buffer, currentInputBlock); + grasshopper_copy128(currentOutputBlock, &tmp); ctr128_inc(iv_buffer->b); current_in += GRASSHOPPER_BLOCK_SIZE; current_out += GRASSHOPPER_BLOCK_SIZE; @@ -451,7 +511,8 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, #define GRASSHOPPER_BLOCK_MASK (GRASSHOPPER_BLOCK_SIZE - 1) static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr * - ctx, unsigned int *num) { + ctx, unsigned int *num) +{ if (!ctx->section_size || (*num < ctx->section_size)) return; acpkm_next(&ctx->c); @@ -462,29 +523,31 @@ static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr * * this function works exactly like plain ctr */ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, - size_t inl) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); unsigned int num = EVP_CIPHER_CTX_num(ctx); + size_t blocks, i, lasted; + grasshopper_w128_t tmp; while ((num & GRASSHOPPER_BLOCK_MASK) && inl) { *out++ = *in++ ^ c->partial_buffer.b[num & GRASSHOPPER_BLOCK_MASK]; --inl; num++; } - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; - size_t i; + blocks = inl / GRASSHOPPER_BLOCK_SIZE; // full parts for (i = 0; i < blocks; i++) { apply_acpkm_grasshopper(c, &num); grasshopper_encrypt_block(&c->c.encrypt_round_keys, (grasshopper_w128_t *) iv, - (grasshopper_w128_t *) out, &c->c.buffer); - grasshopper_append128((grasshopper_w128_t *) out, - (grasshopper_w128_t *) in); + (grasshopper_w128_t *) & c->partial_buffer, + &c->c.buffer); + grasshopper_plus128(&tmp, &c->partial_buffer, + (grasshopper_w128_t *) in); + grasshopper_copy128((grasshopper_w128_t *) out, &tmp); ctr128_inc(iv); in += GRASSHOPPER_BLOCK_SIZE; out += GRASSHOPPER_BLOCK_SIZE; @@ -492,7 +555,7 @@ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, } // last part - size_t lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; + lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; if (lasted > 0) { apply_acpkm_grasshopper(c, &num); grasshopper_encrypt_block(&c->c.encrypt_round_keys, @@ -505,25 +568,49 @@ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, } EVP_CIPHER_CTX_set_num(ctx, num); - return 1; + return inl; } +int gost_grasshopper_cipher_do_ctracpkm_omac(EVP_CIPHER_CTX *ctx, + unsigned char *out, + const unsigned char *in, size_t inl) +{ + int result; + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + /* As in and out can be the same pointer, process unencrypted here */ + if (EVP_CIPHER_CTX_encrypting(ctx)) + EVP_DigestSignUpdate(c->omac_ctx, in, inl); + + if (in == NULL && inl == 0) { /* Final call */ + return gost2015_final_call(ctx, c->omac_ctx, KUZNYECHIK_MAC_MAX_SIZE, c->tag, gost_grasshopper_cipher_do_ctracpkm); + } + + result = gost_grasshopper_cipher_do_ctracpkm(ctx, out, in, inl); + + /* As in and out can be the same pointer, process decrypted here */ + if (!EVP_CIPHER_CTX_encrypting(ctx)) + EVP_DigestSignUpdate(c->omac_ctx, out, inl); + + return result; +} /* * Fixed 128-bit IV implementation make shift regiser redundant. */ -static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx_ofb * ctx, +static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx * ctx, grasshopper_w128_t * iv, - grasshopper_w128_t * buf) { - memcpy(&ctx->buffer1, iv, 16); - grasshopper_encrypt_block(&ctx->c.encrypt_round_keys, &ctx->buffer1, - buf, &ctx->c.buffer); + grasshopper_w128_t * buf) +{ + grasshopper_w128_t tmp; + memcpy(&tmp, iv, 16); + grasshopper_encrypt_block(&ctx->encrypt_round_keys, &tmp, + buf, &ctx->buffer); memcpy(iv, buf, 16); } int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx_ofb *c = - (gost_grasshopper_cipher_ctx_ofb *) + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); const unsigned char *in_ptr = in; unsigned char *out_ptr = out; @@ -585,7 +672,8 @@ int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, } int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { + const unsigned char *in, size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); const unsigned char *in_ptr = in; @@ -610,8 +698,7 @@ int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, } } if (j == GRASSHOPPER_BLOCK_SIZE) { - memcpy(iv, buf + GRASSHOPPER_BLOCK_SIZE, - GRASSHOPPER_BLOCK_SIZE); + memcpy(iv, buf + GRASSHOPPER_BLOCK_SIZE, GRASSHOPPER_BLOCK_SIZE); EVP_CIPHER_CTX_set_num(ctx, 0); } else { EVP_CIPHER_CTX_set_num(ctx, (int)j); @@ -670,14 +757,16 @@ int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, return 1; } -int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) { +int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) +{ + struct GRASSHOPPER_CIPHER_PARAMS *params; gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); if (!c) return 1; - struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; + params = &gost_cipher_params[c->type]; gost_grasshopper_cipher_destroy(c); if (params->destroy_cipher != NULL) { @@ -689,48 +778,52 @@ int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) { return 1; } -int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, - ASN1_TYPE *params) { - int len = 0; - unsigned char *buf = NULL; - ASN1_OCTET_STRING *os = NULL; - - os = ASN1_OCTET_STRING_new(); +int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, ASN1_TYPE *params) +{ + if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CTR_MODE) { + gost_grasshopper_cipher_ctx_ctr *ctr = EVP_CIPHER_CTX_get_cipher_data(ctx); - if (!os || !ASN1_OCTET_STRING_set(os, buf, len)) { - OPENSSL_free(buf); - GOSTerr(GOST_F_GOST_GRASSHOPPER_SET_ASN1_PARAMETERS, - ERR_R_MALLOC_FAILURE); - return 0; - } - OPENSSL_free(buf); + /* CMS implies 256kb section_size */ + ctr->section_size = 256*1024; - ASN1_TYPE_set(params, V_ASN1_SEQUENCE, os); - return 1; + return gost2015_set_asn1_params(params, EVP_CIPHER_CTX_original_iv(ctx), 8, + ctr->kdf_seed); + } + return 0; } GRASSHOPPER_INLINE int gost_grasshopper_get_asn1_parameters(EVP_CIPHER_CTX - *ctx, - ASN1_TYPE - *params) { - int ret = -1; - - if (ASN1_TYPE_get(params) != V_ASN1_SEQUENCE) { - return ret; - } - - return 1; + *ctx, ASN1_TYPE + *params) +{ + if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CTR_MODE) { + gost_grasshopper_cipher_ctx_ctr *ctr = EVP_CIPHER_CTX_get_cipher_data(ctx); + + int iv_len = 16; + unsigned char iv[16]; + + if (gost2015_get_asn1_params(params, 16, iv, 8, ctr->kdf_seed) == 0) { + return 0; + } + + memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, iv_len); + memcpy((unsigned char *)EVP_CIPHER_CTX_original_iv(ctx), iv, iv_len); + + /* CMS implies 256kb section_size */ + ctr->section_size = 256*1024; + return 1; + } + return 0; } int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr) { + void *ptr) +{ switch (type) { case EVP_CTRL_RAND_KEY:{ - if (RAND_bytes - ((unsigned char *)ptr, - EVP_CIPHER_CTX_key_length(ctx)) <= 0) { - GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, - GOST_R_RNG_ERROR); + if (RAND_priv_bytes + ((unsigned char *)ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_RNG_ERROR); return -1; } break; @@ -738,12 +831,140 @@ int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, case EVP_CTRL_KEY_MESH:{ gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - if (c->c.type != GRASSHOPPER_CIPHER_CTRACPKM || !arg + if ((c->c.type != GRASSHOPPER_CIPHER_CTRACPKM && + c->c.type != GRASSHOPPER_CIPHER_CTRACPKMOMAC) + || (arg == 0) || (arg % GRASSHOPPER_BLOCK_SIZE)) return -1; c->section_size = arg; break; } +#ifdef EVP_CTRL_TLS1_2_TLSTREE + case EVP_CTRL_TLS1_2_TLSTREE: + { + unsigned char newkey[32]; + int mode = EVP_CIPHER_CTX_mode(ctx); + static const unsigned char zeroseq[8]; + gost_grasshopper_cipher_ctx_ctr *ctr_ctx = NULL; + gost_grasshopper_cipher_ctx *c = NULL; + + unsigned char adjusted_iv[16]; + unsigned char seq[8]; + int j, carry; + if (mode != EVP_CIPH_CTR_MODE) + return -1; + + ctr_ctx = (gost_grasshopper_cipher_ctx_ctr *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + c = &(ctr_ctx->c); + + memcpy(seq, ptr, 8); + if (EVP_CIPHER_CTX_encrypting(ctx)) { + /* + * OpenSSL increments seq after mac calculation. + * As we have Mac-Then-Encrypt, we need decrement it here on encryption + * to derive the key correctly. + * */ + if (memcmp(seq, zeroseq, 8) != 0) + { + for(j=7; j>=0; j--) + { + if (seq[j] != 0) {seq[j]--; break;} + else seq[j] = 0xFF; + } + } + } + if (gost_tlstree(NID_grasshopper_cbc, c->master_key.k.b, newkey, + (const unsigned char *)seq) > 0) { + memset(adjusted_iv, 0, 16); + memcpy(adjusted_iv, EVP_CIPHER_CTX_original_iv(ctx), 8); + for(j=7,carry=0; j>=0; j--) + { + int adj_byte = adjusted_iv[j]+seq[j]+carry; + carry = (adj_byte > 255) ? 1 : 0; + adjusted_iv[j] = adj_byte & 0xFF; + } + EVP_CIPHER_CTX_set_num(ctx, 0); + memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), adjusted_iv, 16); + + gost_grasshopper_cipher_key(c, newkey); + return 1; + } + } + return -1; +#endif +#if 0 + case EVP_CTRL_AEAD_GET_TAG: + case EVP_CTRL_AEAD_SET_TAG: + { + int taglen = arg; + unsigned char *tag = ptr; + + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + if (c->c.type != GRASSHOPPER_CIPHER_MGM) + return -1; + + if (taglen > KUZNYECHIK_MAC_MAX_SIZE) { + CRYPTOCOMerr(CRYPTOCOM_F_GOST_GRASSHOPPER_CIPHER_CTL, + CRYPTOCOM_R_INVALID_TAG_LENGTH); + return -1; + } + + if (type == EVP_CTRL_AEAD_GET_TAG) + memcpy(tag, c->final_tag, taglen); + else + memcpy(c->final_tag, tag, taglen); + + return 1; + } +#endif + case EVP_CTRL_PROCESS_UNPROTECTED: + { + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + ASN1_OBJECT *cmsmacobj = NULL; + if (c->c.type != GRASSHOPPER_CIPHER_CTRACPKMOMAC) + return -1; + cmsmacobj = OBJ_txt2obj(OID_GOST_CMS_MAC, 1); + if (cmsmacobj == NULL) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, ERR_R_MALLOC_FAILURE); + return -1; + } + if (arg == 0) /*Decrypting*/ { + STACK_OF(X509_ATTRIBUTE) *x = ptr; + ASN1_OCTET_STRING *osExpectedMac = X509at_get0_data_by_OBJ(x, + cmsmacobj, -3, V_ASN1_OCTET_STRING); + ASN1_OBJECT_free(cmsmacobj); + + if (ptr == NULL || osExpectedMac ==NULL || osExpectedMac->length != KUZNYECHIK_MAC_MAX_SIZE) + return -1; + + memcpy(c->tag, osExpectedMac->data, osExpectedMac->length); + return 1; + } else { + STACK_OF(X509_ATTRIBUTE) *x = ptr; + return (X509at_add1_attr_by_OBJ(&x, cmsmacobj, + V_ASN1_OCTET_STRING, c->tag, KUZNYECHIK_MAC_MAX_SIZE) == NULL) ? -1 : 1; + } + } + return 1; + case EVP_CTRL_COPY: { + EVP_CIPHER_CTX *out = ptr; + + gost_grasshopper_cipher_ctx_ctr *out_cctx = EVP_CIPHER_CTX_get_cipher_data(out); + gost_grasshopper_cipher_ctx_ctr *in_cctx = EVP_CIPHER_CTX_get_cipher_data(ctx); + + if (in_cctx->c.type != GRASSHOPPER_CIPHER_CTRACPKMOMAC) + return -1; + + if (in_cctx->omac_ctx == out_cctx->omac_ctx) { + out_cctx->omac_ctx = EVP_MD_CTX_new(); + if (out_cctx->omac_ctx == NULL) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, ERR_R_MALLOC_FAILURE); + return -1; + } + } + return EVP_MD_CTX_copy(out_cctx->omac_ctx, in_cctx->omac_ctx); + } default: GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_UNSUPPORTED_CIPHER_CTL_COMMAND); @@ -753,61 +974,62 @@ int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, } GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_create(int - cipher_type, - int - block_size) { + cipher_type, int + block_size) +{ return EVP_CIPHER_meth_new(cipher_type, block_size /* block_size */ , GRASSHOPPER_KEY_SIZE /* key_size */ ); } const int cipher_gost_grasshopper_setup(EVP_CIPHER *cipher, uint8_t mode, - int iv_size, bool padding) { + int iv_size, bool padding, int extra_flags) +{ + unsigned long flags = (unsigned long)(mode + | ((!padding) ? EVP_CIPH_NO_PADDING : 0) + | ((iv_size > 0) ? EVP_CIPH_CUSTOM_IV : 0) + | EVP_CIPH_RAND_KEY | EVP_CIPH_ALWAYS_CALL_INIT + | extra_flags); + return EVP_CIPHER_meth_set_iv_length(cipher, iv_size) - && EVP_CIPHER_meth_set_flags(cipher, - (unsigned long)(mode | - ((!padding) ? - EVP_CIPH_NO_PADDING : - 0) | ((iv_size > - 0) ? - EVP_CIPH_CUSTOM_IV - : 0) | - EVP_CIPH_RAND_KEY | - EVP_CIPH_ALWAYS_CALL_INIT) - ) - && EVP_CIPHER_meth_set_cleanup(cipher, - gost_grasshopper_cipher_cleanup) + && EVP_CIPHER_meth_set_flags(cipher, flags) + && EVP_CIPHER_meth_set_cleanup(cipher, gost_grasshopper_cipher_cleanup) && EVP_CIPHER_meth_set_set_asn1_params(cipher, gost_grasshopper_set_asn1_parameters) && EVP_CIPHER_meth_set_get_asn1_params(cipher, gost_grasshopper_get_asn1_parameters) && EVP_CIPHER_meth_set_ctrl(cipher, gost_grasshopper_cipher_ctl) - && EVP_CIPHER_meth_set_do_cipher(cipher, - gost_grasshopper_cipher_do); + && EVP_CIPHER_meth_set_do_cipher(cipher, gost_grasshopper_cipher_do); } const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper(uint8_t mode, - uint8_t num) { + uint8_t num) +{ EVP_CIPHER **cipher; struct GRASSHOPPER_CIPHER_PARAMS *params; cipher = &gost_grasshopper_ciphers[num]; if (*cipher == NULL) { + grasshopper_init_cipher_func init_cipher; + int nid, block_size, ctx_size, iv_size, extra_flags; + bool padding; + params = &gost_cipher_params[num]; - int nid = params->nid; - grasshopper_init_cipher_func init_cipher = params->init_cipher; - int block_size = params->block_size; - int ctx_size = params->ctx_size; - int iv_size = params->iv_size; - bool padding = params->padding; + nid = params->nid; + init_cipher = params->init_cipher; + block_size = params->block_size; + ctx_size = params->ctx_size; + iv_size = params->iv_size; + padding = params->padding; + extra_flags = params->extra_flags; *cipher = cipher_gost_grasshopper_create(nid, block_size); if (*cipher == NULL) { return NULL; } - if (!cipher_gost_grasshopper_setup(*cipher, mode, iv_size, padding) + if (!cipher_gost_grasshopper_setup(*cipher, mode, iv_size, padding, extra_flags) || !EVP_CIPHER_meth_set_init(*cipher, init_cipher) || !EVP_CIPHER_meth_set_impl_ctx_size(*cipher, ctx_size)) { EVP_CIPHER_meth_free(*cipher); @@ -818,37 +1040,45 @@ const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper(uint8_t mode, return *cipher; } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ecb() { - return cipher_gost_grasshopper(EVP_CIPH_ECB_MODE, - GRASSHOPPER_CIPHER_ECB); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ecb() +{ + return cipher_gost_grasshopper(EVP_CIPH_ECB_MODE, GRASSHOPPER_CIPHER_ECB); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cbc() { - return cipher_gost_grasshopper(EVP_CIPH_CBC_MODE, - GRASSHOPPER_CIPHER_CBC); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cbc() +{ + return cipher_gost_grasshopper(EVP_CIPH_CBC_MODE, GRASSHOPPER_CIPHER_CBC); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ofb() { - return cipher_gost_grasshopper(EVP_CIPH_OFB_MODE, - GRASSHOPPER_CIPHER_OFB); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ofb() +{ + return cipher_gost_grasshopper(EVP_CIPH_OFB_MODE, GRASSHOPPER_CIPHER_OFB); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cfb() { - return cipher_gost_grasshopper(EVP_CIPH_CFB_MODE, - GRASSHOPPER_CIPHER_CFB); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cfb() +{ + return cipher_gost_grasshopper(EVP_CIPH_CFB_MODE, GRASSHOPPER_CIPHER_CFB); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctr() { - return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, - GRASSHOPPER_CIPHER_CTR); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctr() +{ + return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTR); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() { +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() +{ return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTRACPKM); } -void cipher_gost_grasshopper_destroy(void) { +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm_omac() +{ + return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, + GRASSHOPPER_CIPHER_CTRACPKMOMAC); +} + +void cipher_gost_grasshopper_destroy(void) +{ EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB]); gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB] = NULL; EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC]); @@ -859,11 +1089,8 @@ void cipher_gost_grasshopper_destroy(void) { gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB] = NULL; EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR]); gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers - [GRASSHOPPER_CIPHER_CTRACPKM]); + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM]); gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM] = NULL; + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKMOMAC]); + gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKMOMAC] = NULL; } - -#if defined(__cplusplus) -} -#endif