crypto/evp/e_aes.c

   1 /* ====================================================================
   2  * Copyright (c) 2001-2011 The OpenSSL Project.  All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  *
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  *
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in
  13  *    the documentation and/or other materials provided with the
  14  *    distribution.
  15  *
  16  * 3. All advertising materials mentioning features or use of this
  17  *    software must display the following acknowledgment:
  18  *    "This product includes software developed by the OpenSSL Project
  19  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  20  *
  21  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  22  *    endorse or promote products derived from this software without
  23  *    prior written permission. For written permission, please contact
  24  *    openssl-core@openssl.org.
  25  *
  26  * 5. Products derived from this software may not be called "OpenSSL"
  27  *    nor may "OpenSSL" appear in their names without prior written
  28  *    permission of the OpenSSL Project.
  29  *
  30  * 6. Redistributions of any form whatsoever must retain the following
  31  *    acknowledgment:
  32  *    "This product includes software developed by the OpenSSL Project
  33  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  36  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  38  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  39  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  40  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  41  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  42  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  44  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  45  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  46  * OF THE POSSIBILITY OF SUCH DAMAGE.
  47  * ====================================================================
  48  *
  49  */
  50
  51 #include <openssl/opensslconf.h>
  52 #ifndef OPENSSL_NO_AES
  53 #include <openssl/evp.h>
  54 #include <openssl/err.h>
  55 #include <string.h>
  56 #include <assert.h>
  57 #include <openssl/aes.h>
  58 #include "evp_locl.h"
  59 #ifndef OPENSSL_FIPS
  60 #include "modes_lcl.h"
  61 #include <openssl/rand.h>
  62
  63 typedef struct
  64         {
  65         AES_KEY ks;
  66         } EVP_AES_KEY;
  67
  68 typedef struct
  69         {
  70         AES_KEY ks;             /* AES key schedule to use */
  71         int key_set;            /* Set if key initialised */
  72         int iv_set;             /* Set if an iv is set */
  73         GCM128_CONTEXT gcm;
  74         unsigned char *iv;      /* Temporary IV store */
  75         int ivlen;              /* IV length */
  76         int taglen;
  77         int iv_gen;             /* It is OK to generate IVs */
  78         int tls_aad_len;        /* TLS AAD length */
  79         } EVP_AES_GCM_CTX;
  80
  81 typedef struct
  82         {
  83         AES_KEY ks1, ks2;       /* AES key schedules to use */
  84         XTS128_CONTEXT xts;
  85         } EVP_AES_XTS_CTX;
  86
  87 typedef struct
  88         {
  89         AES_KEY ks;             /* AES key schedule to use */
  90         int key_set;            /* Set if key initialised */
  91         int iv_set;             /* Set if an iv is set */
  92         int tag_set;            /* Set if tag is valid */
  93         int len_set;            /* Set if message length set */
  94         int L, M;               /* L and M parameters from RFC3610 */
  95         CCM128_CONTEXT ccm;
  96         } EVP_AES_CCM_CTX;
  97
  98 #define MAXBITCHUNK     ((size_t)1<<(sizeof(size_t)*8-4))
  99
 100 #if     defined(AES_ASM) && !defined(I386_ONLY) &&      (  \
 101         ((defined(__i386)       || defined(__i386__)    || \
 102           defined(_M_IX86)) && defined(OPENSSL_IA32_SSE2))|| \
 103         defined(__x86_64)       || defined(__x86_64__)  || \
 104         defined(_M_AMD64)       || defined(_M_X64)      || \
 105         defined(__INTEL__)                              )
 106 /*
 107  * AES-NI section
 108  */
 109 extern unsigned int OPENSSL_ia32cap_P[2];
 110 #define AESNI_CAPABLE   (1<<(57-32))
 111
 112 int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
 113                         AES_KEY *key);
 114 int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
 115                         AES_KEY *key);
 116
 117 void aesni_encrypt(const unsigned char *in, unsigned char *out,
 118                         const AES_KEY *key);
 119 void aesni_decrypt(const unsigned char *in, unsigned char *out,
 120                         const AES_KEY *key);
 121
 122 void aesni_ecb_encrypt(const unsigned char *in,
 123                         unsigned char *out,
 124                         size_t length,
 125                         const AES_KEY *key,
 126                         int enc);
 127 void aesni_cbc_encrypt(const unsigned char *in,
 128                         unsigned char *out,
 129                         size_t length,
 130                         const AES_KEY *key,
 131                         unsigned char *ivec, int enc);
 132
 133 void aesni_ctr32_encrypt_blocks(const unsigned char *in,
 134                         unsigned char *out,
 135                         size_t blocks,
 136                         const void *key,
 137                         const unsigned char *ivec);
 138
 139 void aesni_xts_encrypt(const unsigned char *in,
 140                         unsigned char *out,
 141                         size_t length,
 142                         const AES_KEY *key1, const AES_KEY *key2,
 143                         const unsigned char iv[16]);
 144
 145 void aesni_xts_decrypt(const unsigned char *in,
 146                         unsigned char *out,
 147                         size_t length,
 148                         const AES_KEY *key1, const AES_KEY *key2,
 149                         const unsigned char iv[16]);
 150
 151 void aesni_ccm64_encrypt_blocks (const unsigned char *in,
 152                         unsigned char *out,
 153                         size_t blocks,
 154                         const void *key,
 155                         const unsigned char ivec[16],
 156                         unsigned char cmac[16]);
 157
 158 void aesni_ccm64_decrypt_blocks (const unsigned char *in,
 159                         unsigned char *out,
 160                         size_t blocks,
 161                         const void *key,
 162                         const unsigned char ivec[16],
 163                         unsigned char cmac[16]);
 164
 165 static int aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 166                    const unsigned char *iv, int enc)
 167         {
 168         int ret;
 169
 170         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 171             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 172             && !enc)
 173                 ret = aesni_set_decrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 174         else
 175                 ret = aesni_set_encrypt_key(key, ctx->key_len*8, ctx->cipher_data);
 176
 177         if(ret < 0)
 178                 {
 179                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 180                 return 0;
 181                 }
 182
 183         return 1;
 184         }
 185
 186 static int aesni_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 187         const unsigned char *in, size_t len)
 188 {
 189         aesni_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 190
 191         return 1;
 192 }
 193
 194 static int aesni_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 195         const unsigned char *in, size_t len)
 196 {
 197         size_t  bl = ctx->cipher->block_size;
 198
 199         if (len<bl)     return 1;
 200
 201         aesni_ecb_encrypt(in,out,len,ctx->cipher_data,ctx->encrypt);
 202
 203         return 1;
 204 }
 205
 206 static int aesni_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 207         const unsigned char *in,size_t len)
 208 {
 209         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 210                         ctx->iv,&ctx->num,
 211                         (block128_f)aesni_encrypt);
 212         return 1;
 213 }
 214
 215 static int aesni_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 216         const unsigned char *in,size_t len)
 217 {
 218         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 219                         ctx->iv,&ctx->num,ctx->encrypt,
 220                         (block128_f)aesni_encrypt);
 221         return 1;
 222 }
 223
 224 static int aesni_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 225         const unsigned char *in,size_t len)
 226 {
 227         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 228                         ctx->iv,&ctx->num,ctx->encrypt,
 229                         (block128_f)aesni_encrypt);
 230         return 1;
 231 }
 232
 233 static int aesni_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 234         const unsigned char *in,size_t len)
 235 {
 236         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 237                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 238                         ctx->iv,&ctx->num,ctx->encrypt,
 239                         (block128_f)aesni_encrypt);
 240                 return 1;
 241         }
 242
 243         while (len>=MAXBITCHUNK) {
 244                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 245                         ctx->iv,&ctx->num,ctx->encrypt,
 246                         (block128_f)aesni_encrypt);
 247                 len-=MAXBITCHUNK;
 248         }
 249         if (len)
 250                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 251                         ctx->iv,&ctx->num,ctx->encrypt,
 252                         (block128_f)aesni_encrypt);
 253
 254         return 1;
 255 }
 256
 257 static int aesni_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 258                 const unsigned char *in, size_t len)
 259 {
 260         unsigned int num;
 261         num = ctx->num;
 262
 263         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 264                         ctx->cipher_data,ctx->iv,ctx->buf,&num,
 265                         (ctr128_f)aesni_ctr32_encrypt_blocks);
 266
 267         ctx->num = (size_t)num;
 268         return 1;
 269 }
 270
 271 static int aesni_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 272                         const unsigned char *iv, int enc)
 273         {
 274         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 275         if (!iv && !key)
 276                 return 1;
 277         if (key)
 278                 {
 279                 aesni_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
 280                 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
 281                                 (block128_f)aesni_encrypt);
 282                 /* If we have an iv can set it directly, otherwise use
 283                  * saved IV.
 284                  */
 285                 if (iv == NULL && gctx->iv_set)
 286                         iv = gctx->iv;
 287                 if (iv)
 288                         {
 289                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 290                         gctx->iv_set = 1;
 291                         }
 292                 gctx->key_set = 1;
 293                 }
 294         else
 295                 {
 296                 /* If key set use IV, otherwise copy */
 297                 if (gctx->key_set)
 298                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 299                 else
 300                         memcpy(gctx->iv, iv, gctx->ivlen);
 301                 gctx->iv_set = 1;
 302                 gctx->iv_gen = 0;
 303                 }
 304         return 1;
 305         }
 306
 307 static int aesni_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 308                 const unsigned char *in, size_t len)
 309         {
 310         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 311         /* If not set up, return error */
 312         if (!gctx->iv_set && !gctx->key_set)
 313                 return -1;
 314         if (!ctx->encrypt && gctx->taglen < 0)
 315                 return -1;
 316         if (in)
 317                 {
 318                 if (out == NULL)
 319                         {
 320                         if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
 321                                 return -1;
 322                         }
 323                 else if (ctx->encrypt)
 324                         {
 325                         if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
 326                                         in, out, len,
 327                                         aesni_ctr32_encrypt_blocks))
 328                                 return -1;
 329                         }
 330                 else
 331                         {
 332                         if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,
 333                                         in, out, len,
 334                                         aesni_ctr32_encrypt_blocks))
 335                                 return -1;
 336                         }
 337                 return len;
 338                 }
 339         else
 340                 {
 341                 if (!ctx->encrypt)
 342                         {
 343                         if (CRYPTO_gcm128_finish(&gctx->gcm,
 344                                         ctx->buf, gctx->taglen) != 0)
 345                                 return -1;
 346                         gctx->iv_set = 0;
 347                         return 0;
 348                         }
 349                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
 350                 gctx->taglen = 16;
 351                 /* Don't reuse the IV */
 352                 gctx->iv_set = 0;
 353                 return 0;
 354                 }
 355
 356         }
 357
 358 static int aesni_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 359                         const unsigned char *iv, int enc)
 360         {
 361         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 362         if (!iv && !key)
 363                 return 1;
 364
 365         if (key)
 366                 {
 367                 /* key_len is two AES keys */
 368                 if (enc)
 369                         {
 370                         aesni_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 371                         xctx->xts.block1 = (block128_f)aesni_encrypt;
 372                         }
 373                 else
 374                         {
 375                         aesni_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
 376                         xctx->xts.block1 = (block128_f)aesni_decrypt;
 377                         }
 378
 379                 aesni_set_encrypt_key(key + ctx->key_len/2,
 380                                                 ctx->key_len * 4, &xctx->ks2);
 381                 xctx->xts.block2 = (block128_f)aesni_encrypt;
 382
 383                 xctx->xts.key1 = &xctx->ks1;
 384                 }
 385
 386         if (iv)
 387                 {
 388                 xctx->xts.key2 = &xctx->ks2;
 389                 memcpy(ctx->iv, iv, 16);
 390                 }
 391
 392         return 1;
 393         }
 394
 395 static int aesni_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 396                 const unsigned char *in, size_t len)
 397         {
 398         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
 399         if (!xctx->xts.key1 || !xctx->xts.key2)
 400                 return -1;
 401         if (!out || !in)
 402                 return -1;
 403 #ifdef OPENSSL_FIPS
 404         /* Requirement of SP800-38E */
 405         if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
 406                         (len > (1L<<20)*16))
 407                 {
 408                 EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);
 409                 return -1;
 410                 }
 411 #endif
 412         if (ctx->encrypt)
 413                 aesni_xts_encrypt(in, out, len,
 414                         xctx->xts.key1, xctx->xts.key2, ctx->iv);
 415         else
 416                 aesni_xts_decrypt(in, out, len,
 417                         xctx->xts.key1, xctx->xts.key2, ctx->iv);
 418
 419         return len;
 420         }
 421
 422 static int aesni_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 423                         const unsigned char *iv, int enc)
 424         {
 425         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
 426         if (!iv && !key)
 427                 return 1;
 428         if (key)
 429                 {
 430                 aesni_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
 431                 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
 432                                         &cctx->ks, (block128_f)aesni_encrypt);
 433                 cctx->key_set = 1;
 434                 }
 435         if (iv)
 436                 {
 437                 memcpy(ctx->iv, iv, 15 - cctx->L);
 438                 cctx->iv_set = 1;
 439                 }
 440         return 1;
 441         }
 442
 443 static int aesni_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 444                 const unsigned char *in, size_t len)
 445         {
 446         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
 447         CCM128_CONTEXT *ccm = &cctx->ccm;
 448         /* If not set up, return error */
 449         if (!cctx->iv_set && !cctx->key_set)
 450                 return -1;
 451         if (!ctx->encrypt && !cctx->tag_set)
 452                 return -1;
 453         if (!out)
 454                 {
 455                 if (!in)
 456                         {
 457                         if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))
 458                                 return -1;
 459                         cctx->len_set = 1;
 460                         return len;
 461                         }
 462                 /* If have AAD need message length */
 463                 if (!cctx->len_set && len)
 464                         return -1;
 465                 CRYPTO_ccm128_aad(ccm, in, len);
 466                 return len;
 467                 }
 468         /* EVP_*Final() doesn't return any data */
 469         if (!in)
 470                 return 0;
 471         /* If not set length yet do it */
 472         if (!cctx->len_set)
 473                 {
 474                 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
 475                         return -1;
 476                 cctx->len_set = 1;
 477                 }
 478         if (ctx->encrypt)
 479                 {
 480                 if (CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,
 481                                 aesni_ccm64_encrypt_blocks))
 482                         return -1;
 483                 cctx->tag_set = 1;
 484                 return len;
 485                 }
 486         else
 487                 {
 488                 int rv = -1;
 489                 if (!CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,
 490                                 aesni_ccm64_decrypt_blocks))
 491                         {
 492                         unsigned char tag[16];
 493                         if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
 494                                 {
 495                                 if (!memcmp(tag, ctx->buf, cctx->M))
 496                                         rv = len;
 497                                 }
 498                         }
 499                 if (rv == -1)
 500                         OPENSSL_cleanse(out, len);
 501                 cctx->iv_set = 0;
 502                 cctx->tag_set = 0;
 503                 cctx->len_set = 0;
 504                 return rv;
 505                 }
 506
 507         }
 508
 509 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 510 static const EVP_CIPHER aesni_##keylen##_##mode = { \
 511         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 512         flags|EVP_CIPH_##MODE##_MODE,   \
 513         aesni_init_key,                 \
 514         aesni_##mode##_cipher,          \
 515         NULL,                           \
 516         sizeof(EVP_AES_KEY),            \
 517         NULL,NULL,NULL,NULL }; \
 518 static const EVP_CIPHER aes_##keylen##_##mode = { \
 519         nid##_##keylen##_##nmode,blocksize,     \
 520         keylen/8,ivlen, \
 521         flags|EVP_CIPH_##MODE##_MODE,   \
 522         aes_init_key,                   \
 523         aes_##mode##_cipher,            \
 524         NULL,                           \
 525         sizeof(EVP_AES_KEY),            \
 526         NULL,NULL,NULL,NULL }; \
 527 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 528 { return (OPENSSL_ia32cap_P[1]&AESNI_CAPABLE)? \
 529   &aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
 530
 531 #define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
 532 static const EVP_CIPHER aesni_##keylen##_##mode = { \
 533         nid##_##keylen##_##mode,blocksize, \
 534         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 535         flags|EVP_CIPH_##MODE##_MODE,   \
 536         aesni_##mode##_init_key,        \
 537         aesni_##mode##_cipher,          \
 538         aes_##mode##_cleanup,           \
 539         sizeof(EVP_AES_##MODE##_CTX),   \
 540         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 541 static const EVP_CIPHER aes_##keylen##_##mode = { \
 542         nid##_##keylen##_##mode,blocksize, \
 543         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 544         flags|EVP_CIPH_##MODE##_MODE,   \
 545         aes_##mode##_init_key,          \
 546         aes_##mode##_cipher,            \
 547         aes_##mode##_cleanup,           \
 548         sizeof(EVP_AES_##MODE##_CTX),   \
 549         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 550 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 551 { return (OPENSSL_ia32cap_P[1]&AESNI_CAPABLE)? \
 552   &aesni_##keylen##_##mode:&aes_##keylen##_##mode; }
 553
 554 #else
 555
 556 #define BLOCK_CIPHER_generic(nid,keylen,blocksize,ivlen,nmode,mode,MODE,flags) \
 557 static const EVP_CIPHER aes_##keylen##_##mode = { \
 558         nid##_##keylen##_##nmode,blocksize,keylen/8,ivlen, \
 559         flags|EVP_CIPH_##MODE##_MODE,   \
 560         aes_init_key,                   \
 561         aes_##mode##_cipher,            \
 562         NULL,                           \
 563         sizeof(EVP_AES_KEY),            \
 564         NULL,NULL,NULL,NULL }; \
 565 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 566 { return &aes_##keylen##_##mode; }
 567
 568 #define BLOCK_CIPHER_custom(nid,keylen,blocksize,ivlen,mode,MODE,flags) \
 569 static const EVP_CIPHER aes_##keylen##_##mode = { \
 570         nid##_##keylen##_##mode,blocksize, \
 571         (EVP_CIPH_##MODE##_MODE==EVP_CIPH_XTS_MODE?2:1)*keylen/8, ivlen, \
 572         flags|EVP_CIPH_##MODE##_MODE,   \
 573         aes_##mode##_init_key,          \
 574         aes_##mode##_cipher,            \
 575         aes_##mode##_cleanup,           \
 576         sizeof(EVP_AES_##MODE##_CTX),   \
 577         NULL,NULL,aes_##mode##_ctrl,NULL }; \
 578 const EVP_CIPHER *EVP_aes_##keylen##_##mode(void) \
 579 { return &aes_##keylen##_##mode; }
 580 #endif
 581
 582 #define BLOCK_CIPHER_generic_pack(nid,keylen,flags)             \
 583         BLOCK_CIPHER_generic(nid,keylen,16,16,cbc,cbc,CBC,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)     \
 584         BLOCK_CIPHER_generic(nid,keylen,16,0,ecb,ecb,ECB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)      \
 585         BLOCK_CIPHER_generic(nid,keylen,1,16,ofb128,ofb,OFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 586         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb128,cfb,CFB,flags|EVP_CIPH_FLAG_DEFAULT_ASN1)   \
 587         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb1,cfb1,CFB,flags)       \
 588         BLOCK_CIPHER_generic(nid,keylen,1,16,cfb8,cfb8,CFB,flags)       \
 589         BLOCK_CIPHER_generic(nid,keylen,1,16,ctr,ctr,CTR,flags)
 590
 591 static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 592                    const unsigned char *iv, int enc)
 593         {
 594         int ret;
 595
 596         if (((ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_ECB_MODE
 597             || (ctx->cipher->flags & EVP_CIPH_MODE) == EVP_CIPH_CBC_MODE)
 598             && !enc)
 599                 ret = AES_set_decrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 600         else
 601                 ret = AES_set_encrypt_key(key, ctx->key_len * 8, ctx->cipher_data);
 602
 603         if(ret < 0)
 604                 {
 605                 EVPerr(EVP_F_AES_INIT_KEY,EVP_R_AES_KEY_SETUP_FAILED);
 606                 return 0;
 607                 }
 608
 609         return 1;
 610         }
 611
 612 static int aes_cbc_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 613         const unsigned char *in, size_t len)
 614 {
 615         AES_cbc_encrypt(in,out,len,ctx->cipher_data,ctx->iv,ctx->encrypt);
 616
 617         return 1;
 618 }
 619
 620 static int aes_ecb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 621         const unsigned char *in, size_t len)
 622 {
 623         size_t  bl = ctx->cipher->block_size;
 624         size_t  i;
 625
 626         if (len<bl)     return 1;
 627
 628         if (ctx->encrypt) {
 629                 for (i=0,len-=bl;i<=len;i+=bl)
 630                         AES_encrypt(in+i,out+i,ctx->cipher_data);
 631         } else {
 632                 for (i=0,len-=bl;i<=len;i+=bl)
 633                         AES_decrypt(in+i,out+i,ctx->cipher_data);
 634         }
 635
 636         return 1;
 637 }
 638
 639 static int aes_ofb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 640         const unsigned char *in,size_t len)
 641 {
 642         CRYPTO_ofb128_encrypt(in,out,len,ctx->cipher_data,
 643                         ctx->iv,&ctx->num,
 644                         (block128_f)AES_encrypt);
 645         return 1;
 646 }
 647
 648 static int aes_cfb_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 649         const unsigned char *in,size_t len)
 650 {
 651         CRYPTO_cfb128_encrypt(in,out,len,ctx->cipher_data,
 652                         ctx->iv,&ctx->num,ctx->encrypt,
 653                         (block128_f)AES_encrypt);
 654         return 1;
 655 }
 656
 657 static int aes_cfb8_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 658         const unsigned char *in,size_t len)
 659 {
 660         CRYPTO_cfb128_8_encrypt(in,out,len,ctx->cipher_data,
 661                         ctx->iv,&ctx->num,ctx->encrypt,
 662                         (block128_f)AES_encrypt);
 663         return 1;
 664 }
 665
 666 static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx,unsigned char *out,
 667         const unsigned char *in,size_t len)
 668 {
 669         if (ctx->flags&EVP_CIPH_FLAG_LENGTH_BITS) {
 670                 CRYPTO_cfb128_1_encrypt(in,out,len,ctx->cipher_data,
 671                         ctx->iv,&ctx->num,ctx->encrypt,
 672                         (block128_f)AES_encrypt);
 673                 return 1;
 674         }
 675
 676         while (len>=MAXBITCHUNK) {
 677                 CRYPTO_cfb128_1_encrypt(in,out,MAXBITCHUNK*8,ctx->cipher_data,
 678                         ctx->iv,&ctx->num,ctx->encrypt,
 679                         (block128_f)AES_encrypt);
 680                 len-=MAXBITCHUNK;
 681         }
 682         if (len)
 683                 CRYPTO_cfb128_1_encrypt(in,out,len*8,ctx->cipher_data,
 684                         ctx->iv,&ctx->num,ctx->encrypt,
 685                         (block128_f)AES_encrypt);
 686
 687         return 1;
 688 }
 689
 690 static int aes_ctr_cipher (EVP_CIPHER_CTX *ctx, unsigned char *out,
 691                 const unsigned char *in, size_t len)
 692 {
 693         unsigned int num;
 694         num = ctx->num;
 695 #ifdef AES_CTR_ASM
 696         void AES_ctr32_encrypt(const unsigned char *in, unsigned char *out,
 697                         size_t blocks, const AES_KEY *key,
 698                         const unsigned char ivec[AES_BLOCK_SIZE]);
 699
 700         CRYPTO_ctr128_encrypt_ctr32(in,out,len,
 701                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 702                 ctx->iv,ctx->buf,&num,(ctr128_f)AES_ctr32_encrypt);
 703 #else
 704         CRYPTO_ctr128_encrypt(in,out,len,
 705                 &((EVP_AES_KEY *)ctx->cipher_data)->ks,
 706                 ctx->iv,ctx->buf,&num,(block128_f)AES_encrypt);
 707 #endif
 708         ctx->num = (size_t)num;
 709         return 1;
 710 }
 711
 712 BLOCK_CIPHER_generic_pack(NID_aes,128,EVP_CIPH_FLAG_FIPS)
 713 BLOCK_CIPHER_generic_pack(NID_aes,192,EVP_CIPH_FLAG_FIPS)
 714 BLOCK_CIPHER_generic_pack(NID_aes,256,EVP_CIPH_FLAG_FIPS)
 715
 716 static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
 717         {
 718         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 719         OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
 720         if (gctx->iv != c->iv)
 721                 OPENSSL_free(gctx->iv);
 722         return 1;
 723         }
 724
 725 /* increment counter (64-bit int) by 1 */
 726 static void ctr64_inc(unsigned char *counter) {
 727         int n=8;
 728         unsigned char  c;
 729
 730         do {
 731                 --n;
 732                 c = counter[n];
 733                 ++c;
 734                 counter[n] = c;
 735                 if (c) return;
 736         } while (n);
 737 }
 738
 739 static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
 740         {
 741         EVP_AES_GCM_CTX *gctx = c->cipher_data;
 742         switch (type)
 743                 {
 744         case EVP_CTRL_INIT:
 745                 gctx->key_set = 0;
 746                 gctx->iv_set = 0;
 747                 gctx->ivlen = c->cipher->iv_len;
 748                 gctx->iv = c->iv;
 749                 gctx->taglen = -1;
 750                 gctx->iv_gen = 0;
 751                 gctx->tls_aad_len = -1;
 752                 return 1;
 753
 754         case EVP_CTRL_GCM_SET_IVLEN:
 755                 if (arg <= 0)
 756                         return 0;
 757 #ifdef OPENSSL_FIPS
 758                 if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
 759                                                  && arg < 12)
 760                         return 0;
 761 #endif
 762                 /* Allocate memory for IV if needed */
 763                 if ((arg > EVP_MAX_IV_LENGTH) && (arg > gctx->ivlen))
 764                         {
 765                         if (gctx->iv != c->iv)
 766                                 OPENSSL_free(gctx->iv);
 767                         gctx->iv = OPENSSL_malloc(arg);
 768                         if (!gctx->iv)
 769                                 return 0;
 770                         }
 771                 gctx->ivlen = arg;
 772                 return 1;
 773
 774         case EVP_CTRL_GCM_SET_TAG:
 775                 if (arg <= 0 || arg > 16 || c->encrypt)
 776                         return 0;
 777                 memcpy(c->buf, ptr, arg);
 778                 gctx->taglen = arg;
 779                 return 1;
 780
 781         case EVP_CTRL_GCM_GET_TAG:
 782                 if (arg <= 0 || arg > 16 || !c->encrypt || gctx->taglen < 0)
 783                         return 0;
 784                 memcpy(ptr, c->buf, arg);
 785                 return 1;
 786
 787         case EVP_CTRL_GCM_SET_IV_FIXED:
 788                 /* Special case: -1 length restores whole IV */
 789                 if (arg == -1)
 790                         {
 791                         memcpy(gctx->iv, ptr, gctx->ivlen);
 792                         gctx->iv_gen = 1;
 793                         return 1;
 794                         }
 795                 /* Fixed field must be at least 4 bytes and invocation field
 796                  * at least 8.
 797                  */
 798                 if ((arg < 4) || (gctx->ivlen - arg) < 8)
 799                         return 0;
 800                 if (arg)
 801                         memcpy(gctx->iv, ptr, arg);
 802                 if (c->encrypt &&
 803                         RAND_bytes(gctx->iv + arg, gctx->ivlen - arg) <= 0)
 804                         return 0;
 805                 gctx->iv_gen = 1;
 806                 return 1;
 807
 808         case EVP_CTRL_GCM_IV_GEN:
 809                 if (gctx->iv_gen == 0 || gctx->key_set == 0)
 810                         return 0;
 811                 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
 812                 if (arg <= 0 || arg > gctx->ivlen)
 813                         arg = gctx->ivlen;
 814                 memcpy(ptr, gctx->iv + gctx->ivlen - arg, arg);
 815                 /* Invocation field will be at least 8 bytes in size and
 816                  * so no need to check wrap around or increment more than
 817                  * last 8 bytes.
 818                  */
 819                 ctr64_inc(gctx->iv + gctx->ivlen - 8);
 820                 gctx->iv_set = 1;
 821                 return 1;
 822
 823         case EVP_CTRL_GCM_SET_IV_INV:
 824                 if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt)
 825                         return 0;
 826                 memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
 827                 CRYPTO_gcm128_setiv(&gctx->gcm, gctx->iv, gctx->ivlen);
 828                 gctx->iv_set = 1;
 829                 return 1;
 830
 831         case EVP_CTRL_AEAD_TLS1_AAD:
 832                 /* Save the AAD for later use */
 833                 if (arg != 13)
 834                         return 0;
 835                 memcpy(c->buf, ptr, arg);
 836                 gctx->tls_aad_len = arg;
 837                         {
 838                         unsigned int len=c->buf[arg-2]<<8|c->buf[arg-1];
 839                         /* Correct length for explicit IV */
 840                         len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
 841                         /* If decrypting correct for tag too */
 842                         if (!c->encrypt)
 843                                 len -= EVP_GCM_TLS_TAG_LEN;
 844                         c->buf[arg-2] = len>>8;
 845                         c->buf[arg-1] = len & 0xff;
 846                         }
 847                 /* Extra padding: tag appended to record */
 848                 return EVP_GCM_TLS_TAG_LEN;
 849
 850         default:
 851                 return -1;
 852
 853                 }
 854         }
 855
 856 static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 857                         const unsigned char *iv, int enc)
 858         {
 859         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 860         if (!iv && !key)
 861                 return 1;
 862         if (key)
 863                 {
 864                 AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
 865                 CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
 866                 /* If we have an iv can set it directly, otherwise use
 867                  * saved IV.
 868                  */
 869                 if (iv == NULL && gctx->iv_set)
 870                         iv = gctx->iv;
 871                 if (iv)
 872                         {
 873                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 874                         gctx->iv_set = 1;
 875                         }
 876                 gctx->key_set = 1;
 877                 }
 878         else
 879                 {
 880                 /* If key set use IV, otherwise copy */
 881                 if (gctx->key_set)
 882                         CRYPTO_gcm128_setiv(&gctx->gcm, iv, gctx->ivlen);
 883                 else
 884                         memcpy(gctx->iv, iv, gctx->ivlen);
 885                 gctx->iv_set = 1;
 886                 gctx->iv_gen = 0;
 887                 }
 888         return 1;
 889         }
 890
 891 /* Handle TLS GCM packet format. This consists of the last portion of the IV
 892  * followed by the payload and finally the tag. On encrypt generate IV,
 893  * encrypt payload and write the tag. On verify retrieve IV, decrypt payload
 894  * and verify tag.
 895  */
 896
 897 static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 898                 const unsigned char *in, size_t len)
 899         {
 900         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 901         int rv = -1;
 902         /* Encrypt/decrypt must be performed in place */
 903         if (out != in)
 904                 return -1;
 905         /* Set IV from start of buffer or generate IV and write to start
 906          * of buffer.
 907          */
 908         if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ?
 909                                 EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,
 910                                 EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
 911                 goto err;
 912         /* Use saved AAD */
 913         if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))
 914                 goto err;
 915         /* Fix buffer and length to point to payload */
 916         in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 917         out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
 918         len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 919         if (ctx->encrypt)
 920                 {
 921                 /* Encrypt payload */
 922                 if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
 923                         goto err;
 924                 out += len;
 925                 /* Finally write tag */
 926                 CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);
 927                 rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
 928                 }
 929         else
 930                 {
 931                 /* Decrypt */
 932                 if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
 933                         goto err;
 934                 /* Retrieve tag */
 935                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf,
 936                                         EVP_GCM_TLS_TAG_LEN);
 937                 /* If tag mismatch wipe buffer */
 938                 if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN))
 939                         {
 940                         OPENSSL_cleanse(out, len);
 941                         goto err;
 942                         }
 943                 rv = len;
 944                 }
 945
 946         err:
 947         gctx->iv_set = 0;
 948         gctx->tls_aad_len = -1;
 949         return rv;
 950         }
 951
 952 static int aes_gcm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 953                 const unsigned char *in, size_t len)
 954         {
 955         EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
 956         /* If not set up, return error */
 957         if (!gctx->key_set)
 958                 return -1;
 959
 960         if (gctx->tls_aad_len >= 0)
 961                 return aes_gcm_tls_cipher(ctx, out, in, len);
 962
 963         if (!gctx->iv_set)
 964                 return -1;
 965         if (!ctx->encrypt && gctx->taglen < 0)
 966                 return -1;
 967         if (in)
 968                 {
 969                 if (out == NULL)
 970                         {
 971                         if (CRYPTO_gcm128_aad(&gctx->gcm, in, len))
 972                                 return -1;
 973                         }
 974                 else if (ctx->encrypt)
 975                         {
 976                         if (CRYPTO_gcm128_encrypt(&gctx->gcm, in, out, len))
 977                                 return -1;
 978                         }
 979                 else
 980                         {
 981                         if (CRYPTO_gcm128_decrypt(&gctx->gcm, in, out, len))
 982                                 return -1;
 983                         }
 984                 return len;
 985                 }
 986         else
 987                 {
 988                 if (!ctx->encrypt)
 989                         {
 990                         if (CRYPTO_gcm128_finish(&gctx->gcm,
 991                                         ctx->buf, gctx->taglen) != 0)
 992                                 return -1;
 993                         gctx->iv_set = 0;
 994                         return 0;
 995                         }
 996                 CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, 16);
 997                 gctx->taglen = 16;
 998                 /* Don't reuse the IV */
 999                 gctx->iv_set = 0;
1000                 return 0;
1001                 }
1002
1003         }
1004
1005 #define CUSTOM_FLAGS    (EVP_CIPH_FLAG_DEFAULT_ASN1 \
1006                 | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER \
1007                 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT)
1008
1009 BLOCK_CIPHER_custom(NID_aes,128,1,12,gcm,GCM,
1010                 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
1011 BLOCK_CIPHER_custom(NID_aes,192,1,12,gcm,GCM,
1012                 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
1013 BLOCK_CIPHER_custom(NID_aes,256,1,12,gcm,GCM,
1014                 EVP_CIPH_FLAG_FIPS|EVP_CIPH_FLAG_AEAD_CIPHER|CUSTOM_FLAGS)
1015
1016 static int aes_xts_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1017         {
1018         EVP_AES_XTS_CTX *xctx = c->cipher_data;
1019         if (type != EVP_CTRL_INIT)
1020                 return -1;
1021         /* key1 and key2 are used as an indicator both key and IV are set */
1022         xctx->xts.key1 = NULL;
1023         xctx->xts.key2 = NULL;
1024         return 1;
1025         }
1026
1027 static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
1028                         const unsigned char *iv, int enc)
1029         {
1030         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
1031         if (!iv && !key)
1032                 return 1;
1033
1034         if (key)
1035                 {
1036                 /* key_len is two AES keys */
1037                 if (enc)
1038                         {
1039                         AES_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
1040                         xctx->xts.block1 = (block128_f)AES_encrypt;
1041                         }
1042                 else
1043                         {
1044                         AES_set_decrypt_key(key, ctx->key_len * 4, &xctx->ks1);
1045                         xctx->xts.block1 = (block128_f)AES_decrypt;
1046                         }
1047
1048                 AES_set_encrypt_key(key + ctx->key_len/2,
1049                                                 ctx->key_len * 4, &xctx->ks2);
1050                 xctx->xts.block2 = (block128_f)AES_encrypt;
1051
1052                 xctx->xts.key1 = &xctx->ks1;
1053                 }
1054
1055         if (iv)
1056                 {
1057                 xctx->xts.key2 = &xctx->ks2;
1058                 memcpy(ctx->iv, iv, 16);
1059                 }
1060
1061         return 1;
1062         }
1063
1064 static int aes_xts_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1065                 const unsigned char *in, size_t len)
1066         {
1067         EVP_AES_XTS_CTX *xctx = ctx->cipher_data;
1068         if (!xctx->xts.key1 || !xctx->xts.key2)
1069                 return -1;
1070         if (!out || !in)
1071                 return -1;
1072 #ifdef OPENSSL_FIPS
1073         /* Requirement of SP800-38E */
1074         if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
1075                         (len > (1L<<20)*16))
1076                 {
1077                 EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);
1078                 return -1;
1079                 }
1080 #endif
1081         if (CRYPTO_xts128_encrypt(&xctx->xts, ctx->iv, in, out, len,
1082                                                                 ctx->encrypt))
1083                 return -1;
1084         return len;
1085         }
1086
1087 #define aes_xts_cleanup NULL
1088
1089 BLOCK_CIPHER_custom(NID_aes,128,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1090 BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1091
1092 static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1093         {
1094         EVP_AES_CCM_CTX *cctx = c->cipher_data;
1095         switch (type)
1096                 {
1097         case EVP_CTRL_INIT:
1098                 cctx->key_set = 0;
1099                 cctx->iv_set = 0;
1100                 cctx->L = 8;
1101                 cctx->M = 12;
1102                 cctx->tag_set = 0;
1103                 cctx->len_set = 0;
1104                 return 1;
1105
1106         case EVP_CTRL_CCM_SET_IVLEN:
1107                 arg = 15 - arg;
1108         case EVP_CTRL_CCM_SET_L:
1109                 if (arg < 2 || arg > 8)
1110                         return 0;
1111                 cctx->L = arg;
1112                 return 1;
1113
1114         case EVP_CTRL_CCM_SET_TAG:
1115                 if ((arg & 1) || arg < 4 || arg > 16)
1116                         return 0;
1117                 if ((c->encrypt && ptr) || (!c->encrypt && !ptr))
1118                         return 0;
1119                 if (ptr)
1120                         {
1121                         cctx->tag_set = 1;
1122                         memcpy(c->buf, ptr, arg);
1123                         }
1124                 cctx->M = arg;
1125                 return 1;
1126
1127         case EVP_CTRL_CCM_GET_TAG:
1128                 if (!c->encrypt || !cctx->tag_set)
1129                         return 0;
1130                 if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
1131                         return 0;
1132                 cctx->tag_set = 0;
1133                 cctx->iv_set = 0;
1134                 cctx->len_set = 0;
1135                 return 1;
1136
1137         default:
1138                 return -1;
1139
1140                 }
1141         }
1142
1143 static int aes_ccm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
1144                         const unsigned char *iv, int enc)
1145         {
1146         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
1147         if (!iv && !key)
1148                 return 1;
1149         if (key)
1150                 {
1151                 AES_set_encrypt_key(key, ctx->key_len * 8, &cctx->ks);
1152                 CRYPTO_ccm128_init(&cctx->ccm, cctx->M, cctx->L,
1153                                         &cctx->ks, (block128_f)AES_encrypt);
1154                 cctx->key_set = 1;
1155                 }
1156         if (iv)
1157                 {
1158                 memcpy(ctx->iv, iv, 15 - cctx->L);
1159                 cctx->iv_set = 1;
1160                 }
1161         return 1;
1162         }
1163
1164 static int aes_ccm_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1165                 const unsigned char *in, size_t len)
1166         {
1167         EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
1168         CCM128_CONTEXT *ccm = &cctx->ccm;
1169         /* If not set up, return error */
1170         if (!cctx->iv_set && !cctx->key_set)
1171                 return -1;
1172         if (!ctx->encrypt && !cctx->tag_set)
1173                 return -1;
1174         if (!out)
1175                 {
1176                 if (!in)
1177                         {
1178                         if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))
1179                                 return -1;
1180                         cctx->len_set = 1;
1181                         return len;
1182                         }
1183                 /* If have AAD need message length */
1184                 if (!cctx->len_set && len)
1185                         return -1;
1186                 CRYPTO_ccm128_aad(ccm, in, len);
1187                 return len;
1188                 }
1189         /* EVP_*Final() doesn't return any data */
1190         if (!in)
1191                 return 0;
1192         /* If not set length yet do it */
1193         if (!cctx->len_set)
1194                 {
1195                 if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
1196                         return -1;
1197                 cctx->len_set = 1;
1198                 }
1199         if (ctx->encrypt)
1200                 {
1201                 if (CRYPTO_ccm128_encrypt(ccm, in, out, len))
1202                         return -1;
1203                 cctx->tag_set = 1;
1204                 return len;
1205                 }
1206         else
1207                 {
1208                 int rv = -1;
1209                 if (!CRYPTO_ccm128_decrypt(ccm, in, out, len))
1210                         {
1211                         unsigned char tag[16];
1212                         if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
1213                                 {
1214                                 if (!memcmp(tag, ctx->buf, cctx->M))
1215                                         rv = len;
1216                                 }
1217                         }
1218                 if (rv == -1)
1219                         OPENSSL_cleanse(out, len);
1220                 cctx->iv_set = 0;
1221                 cctx->tag_set = 0;
1222                 cctx->len_set = 0;
1223                 return rv;
1224                 }
1225
1226         }
1227
1228 #define aes_ccm_cleanup NULL
1229
1230 BLOCK_CIPHER_custom(NID_aes,128,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1231 BLOCK_CIPHER_custom(NID_aes,192,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1232 BLOCK_CIPHER_custom(NID_aes,256,1,12,ccm,CCM,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
1233
1234 #endif
1235 #endif