Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (c) 2021 Yubico AB. All rights reserved. |
3 | | * Use of this source code is governed by a BSD-style |
4 | | * license that can be found in the LICENSE file. |
5 | | * SPDX-License-Identifier: BSD-2-Clause |
6 | | */ |
7 | | |
8 | | #include "fido.h" |
9 | | |
10 | | static int |
11 | | aes256_cbc(const fido_blob_t *key, const u_char *iv, const fido_blob_t *in, |
12 | | fido_blob_t *out, int encrypt) |
13 | 5.33k | { |
14 | 5.33k | EVP_CIPHER_CTX *ctx = NULL; |
15 | 5.33k | const EVP_CIPHER *cipher; |
16 | 5.33k | int ok = -1; |
17 | | |
18 | 5.33k | memset(out, 0, sizeof(*out)); |
19 | | |
20 | 5.33k | if (key->len != 32) { |
21 | 0 | fido_log_debug("%s: invalid key len %zu", __func__, key->len); |
22 | 0 | goto fail; |
23 | 0 | } |
24 | 5.33k | if (in->len > UINT_MAX || in->len % 16 || in->len == 0) { |
25 | 129 | fido_log_debug("%s: invalid input len %zu", __func__, in->len); |
26 | 129 | goto fail; |
27 | 129 | } |
28 | 5.20k | out->len = in->len; |
29 | 5.20k | if ((out->ptr = calloc(1, out->len)) == NULL) { |
30 | 18 | fido_log_debug("%s: calloc", __func__); |
31 | 18 | goto fail; |
32 | 18 | } |
33 | 5.18k | if ((ctx = EVP_CIPHER_CTX_new()) == NULL || |
34 | 5.18k | (cipher = EVP_aes_256_cbc()) == NULL) { |
35 | 31 | fido_log_debug("%s: EVP_CIPHER_CTX_new", __func__); |
36 | 31 | goto fail; |
37 | 31 | } |
38 | 5.15k | if (EVP_CipherInit(ctx, cipher, key->ptr, iv, encrypt) == 0 || |
39 | 5.15k | EVP_Cipher(ctx, out->ptr, in->ptr, (u_int)out->len) < 0) { |
40 | 43 | fido_log_debug("%s: EVP_Cipher", __func__); |
41 | 43 | goto fail; |
42 | 43 | } |
43 | | |
44 | 5.11k | ok = 0; |
45 | 5.33k | fail: |
46 | 5.33k | if (ctx != NULL) |
47 | 5.16k | EVP_CIPHER_CTX_free(ctx); |
48 | 5.33k | if (ok < 0) |
49 | 221 | fido_blob_reset(out); |
50 | | |
51 | 5.33k | return ok; |
52 | 5.11k | } |
53 | | |
54 | | static int |
55 | | aes256_cbc_proto1(const fido_blob_t *key, const fido_blob_t *in, |
56 | | fido_blob_t *out, int encrypt) |
57 | 4.82k | { |
58 | 4.82k | u_char iv[16]; |
59 | | |
60 | 4.82k | memset(&iv, 0, sizeof(iv)); |
61 | | |
62 | 4.82k | return aes256_cbc(key, iv, in, out, encrypt); |
63 | 4.82k | } |
64 | | |
65 | | static int |
66 | | aes256_cbc_fips(const fido_blob_t *secret, const fido_blob_t *in, |
67 | | fido_blob_t *out, int encrypt) |
68 | 555 | { |
69 | 555 | fido_blob_t key, cin, cout; |
70 | 555 | u_char iv[16]; |
71 | | |
72 | 555 | memset(out, 0, sizeof(*out)); |
73 | | |
74 | 555 | if (secret->len != 64) { |
75 | 0 | fido_log_debug("%s: invalid secret len %zu", __func__, |
76 | 0 | secret->len); |
77 | 0 | return -1; |
78 | 0 | } |
79 | 555 | if (in->len < sizeof(iv)) { |
80 | 29 | fido_log_debug("%s: invalid input len %zu", __func__, in->len); |
81 | 29 | return -1; |
82 | 29 | } |
83 | 526 | if (encrypt) { |
84 | 466 | if (fido_get_random(iv, sizeof(iv)) < 0) { |
85 | 14 | fido_log_debug("%s: fido_get_random", __func__); |
86 | 14 | return -1; |
87 | 14 | } |
88 | 452 | cin = *in; |
89 | 452 | } else { |
90 | 60 | memcpy(iv, in->ptr, sizeof(iv)); |
91 | 60 | cin.ptr = in->ptr + sizeof(iv); |
92 | 60 | cin.len = in->len - sizeof(iv); |
93 | 60 | } |
94 | 512 | key.ptr = secret->ptr + 32; |
95 | 512 | key.len = secret->len - 32; |
96 | 512 | if (aes256_cbc(&key, iv, &cin, &cout, encrypt) < 0) |
97 | 64 | return -1; |
98 | 448 | if (encrypt) { |
99 | 423 | if (cout.len > SIZE_MAX - sizeof(iv) || |
100 | 423 | (out->ptr = calloc(1, sizeof(iv) + cout.len)) == NULL) { |
101 | 11 | fido_blob_reset(&cout); |
102 | 11 | return -1; |
103 | 11 | } |
104 | 412 | out->len = sizeof(iv) + cout.len; |
105 | 412 | memcpy(out->ptr, iv, sizeof(iv)); |
106 | 412 | memcpy(out->ptr + sizeof(iv), cout.ptr, cout.len); |
107 | 412 | fido_blob_reset(&cout); |
108 | 412 | } else |
109 | 25 | *out = cout; |
110 | | |
111 | 437 | return 0; |
112 | 448 | } |
113 | | |
114 | | static int |
115 | | aes256_gcm(const fido_blob_t *key, const fido_blob_t *nonce, |
116 | | const fido_blob_t *aad, const fido_blob_t *in, fido_blob_t *out, |
117 | | int encrypt) |
118 | 1.23k | { |
119 | 1.23k | EVP_CIPHER_CTX *ctx = NULL; |
120 | 1.23k | const EVP_CIPHER *cipher; |
121 | 1.23k | size_t textlen; |
122 | 1.23k | int ok = -1; |
123 | | |
124 | 1.23k | memset(out, 0, sizeof(*out)); |
125 | | |
126 | 1.23k | if (nonce->len != 12 || key->len != 32 || aad->len > UINT_MAX) { |
127 | 0 | fido_log_debug("%s: invalid params %zu, %zu, %zu", __func__, |
128 | 0 | nonce->len, key->len, aad->len); |
129 | 0 | goto fail; |
130 | 0 | } |
131 | 1.23k | if (in->len > UINT_MAX || in->len > SIZE_MAX - 16 || in->len < 16) { |
132 | 129 | fido_log_debug("%s: invalid input len %zu", __func__, in->len); |
133 | 129 | goto fail; |
134 | 129 | } |
135 | | /* add tag to (on encrypt) or trim tag from the output (on decrypt) */ |
136 | 1.10k | out->len = encrypt ? in->len + 16 : in->len - 16; |
137 | 1.10k | if ((out->ptr = calloc(1, out->len)) == NULL) { |
138 | 6 | fido_log_debug("%s: calloc", __func__); |
139 | 6 | goto fail; |
140 | 6 | } |
141 | 1.10k | if ((ctx = EVP_CIPHER_CTX_new()) == NULL || |
142 | 1.10k | (cipher = EVP_aes_256_gcm()) == NULL) { |
143 | 14 | fido_log_debug("%s: EVP_CIPHER_CTX_new", __func__); |
144 | 14 | goto fail; |
145 | 14 | } |
146 | 1.08k | if (EVP_CipherInit(ctx, cipher, key->ptr, nonce->ptr, encrypt) == 0) { |
147 | 6 | fido_log_debug("%s: EVP_CipherInit", __func__); |
148 | 6 | goto fail; |
149 | 6 | } |
150 | | |
151 | 1.08k | if (encrypt) |
152 | 479 | textlen = in->len; |
153 | 603 | else { |
154 | 603 | textlen = in->len - 16; |
155 | | /* point openssl at the mac tag */ |
156 | 603 | if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, |
157 | 603 | in->ptr + in->len - 16) == 0) { |
158 | 8 | fido_log_debug("%s: EVP_CIPHER_CTX_ctrl", __func__); |
159 | 8 | goto fail; |
160 | 8 | } |
161 | 603 | } |
162 | | /* the last EVP_Cipher() will either compute or verify the mac tag */ |
163 | 1.07k | if (EVP_Cipher(ctx, NULL, aad->ptr, (u_int)aad->len) < 0 || |
164 | 1.07k | EVP_Cipher(ctx, out->ptr, in->ptr, (u_int)textlen) < 0 || |
165 | 1.07k | EVP_Cipher(ctx, NULL, NULL, 0) < 0) { |
166 | 278 | fido_log_debug("%s: EVP_Cipher", __func__); |
167 | 278 | goto fail; |
168 | 278 | } |
169 | 796 | if (encrypt) { |
170 | | /* append the mac tag */ |
171 | 475 | if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, |
172 | 475 | out->ptr + out->len - 16) == 0) { |
173 | 2 | fido_log_debug("%s: EVP_CIPHER_CTX_ctrl", __func__); |
174 | 2 | goto fail; |
175 | 2 | } |
176 | 475 | } |
177 | | |
178 | 794 | ok = 0; |
179 | 1.23k | fail: |
180 | 1.23k | if (ctx != NULL) |
181 | 1.09k | EVP_CIPHER_CTX_free(ctx); |
182 | 1.23k | if (ok < 0) |
183 | 443 | fido_blob_reset(out); |
184 | | |
185 | 1.23k | return ok; |
186 | 794 | } |
187 | | |
188 | | int |
189 | | aes256_cbc_enc(const fido_dev_t *dev, const fido_blob_t *secret, |
190 | | const fido_blob_t *in, fido_blob_t *out) |
191 | 3.16k | { |
192 | 3.16k | return fido_dev_get_pin_protocol(dev) == 2 ? aes256_cbc_fips(secret, |
193 | 2.70k | in, out, 1) : aes256_cbc_proto1(secret, in, out, 1); |
194 | 3.16k | } |
195 | | |
196 | | int |
197 | | aes256_cbc_dec(const fido_dev_t *dev, const fido_blob_t *secret, |
198 | | const fido_blob_t *in, fido_blob_t *out) |
199 | 2.20k | { |
200 | 2.20k | return fido_dev_get_pin_protocol(dev) == 2 ? aes256_cbc_fips(secret, |
201 | 2.11k | in, out, 0) : aes256_cbc_proto1(secret, in, out, 0); |
202 | 2.20k | } |
203 | | |
204 | | int |
205 | | aes256_gcm_enc(const fido_blob_t *key, const fido_blob_t *nonce, |
206 | | const fido_blob_t *aad, const fido_blob_t *in, fido_blob_t *out) |
207 | 615 | { |
208 | 615 | return aes256_gcm(key, nonce, aad, in, out, 1); |
209 | 615 | } |
210 | | |
211 | | int |
212 | | aes256_gcm_dec(const fido_blob_t *key, const fido_blob_t *nonce, |
213 | | const fido_blob_t *aad, const fido_blob_t *in, fido_blob_t *out) |
214 | 622 | { |
215 | 622 | return aes256_gcm(key, nonce, aad, in, out, 0); |
216 | 622 | } |