blob: 7a012f9eb1ff240cad2ae4bf716eedafb8c4e5fd [file] [log] [blame]
Paul Bakker8123e9d2011-01-06 15:37:30 +00001/**
2 * \file cipher.c
Paul Bakker7dc4c442014-02-01 22:50:26 +01003 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00004 * \brief Generic cipher wrapper for mbed TLS
Paul Bakker8123e9d2011-01-06 15:37:30 +00005 *
6 * \author Adriaan de Jong <dejong@fox-it.com>
7 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02008 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02009 * SPDX-License-Identifier: Apache-2.0
10 *
11 * Licensed under the Apache License, Version 2.0 (the "License"); you may
12 * not use this file except in compliance with the License.
13 * You may obtain a copy of the License at
14 *
15 * http://www.apache.org/licenses/LICENSE-2.0
16 *
17 * Unless required by applicable law or agreed to in writing, software
18 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
19 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20 * See the License for the specific language governing permissions and
21 * limitations under the License.
Paul Bakker8123e9d2011-01-06 15:37:30 +000022 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000023 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker8123e9d2011-01-06 15:37:30 +000024 */
25
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000027#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020028#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020029#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020030#endif
Paul Bakker8123e9d2011-01-06 15:37:30 +000031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020032#if defined(MBEDTLS_CIPHER_C)
Paul Bakker8123e9d2011-01-06 15:37:30 +000033
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000034#include "mbedtls/cipher.h"
Manuel Pégourié-Gonnard50518f42015-05-26 11:04:15 +020035#include "mbedtls/cipher_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050036#include "mbedtls/platform_util.h"
Paul Bakker8123e9d2011-01-06 15:37:30 +000037
Rich Evans00ab4702015-02-06 13:43:58 +000038#include <stdlib.h>
39#include <string.h>
40
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +020041#if defined(MBEDTLS_CHACHAPOLY_C)
42#include "mbedtls/chachapoly.h"
Daniel King8fe47012016-05-17 20:33:28 -030043#endif
44
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020045#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/gcm.h"
Manuel Pégourié-Gonnard07f8fa52013-08-30 18:34:08 +020047#endif
48
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000050#include "mbedtls/ccm.h"
Manuel Pégourié-Gonnard41936952014-05-13 13:18:17 +020051#endif
52
Daniel Kingbd920622016-05-15 19:56:20 -030053#if defined(MBEDTLS_CHACHA20_C)
54#include "mbedtls/chacha20.h"
55#endif
56
Simon Butcher327398a2016-10-05 14:09:11 +010057#if defined(MBEDTLS_CMAC_C)
58#include "mbedtls/cmac.h"
59#endif
60
61#if defined(MBEDTLS_PLATFORM_C)
62#include "mbedtls/platform.h"
63#else
64#define mbedtls_calloc calloc
65#define mbedtls_free free
66#endif
67
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +020068#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
Daniel King8fe47012016-05-17 20:33:28 -030069/* Compare the contents of two buffers in constant time.
70 * Returns 0 if the contents are bitwise identical, otherwise returns
Daniel King16b04ce2016-05-18 13:38:22 -030071 * a non-zero value.
72 * This is currently only used by GCM and ChaCha20+Poly1305.
73 */
Hanno Becker18597cd2018-11-09 16:36:33 +000074static int mbedtls_constant_time_memcmp( const void *v1, const void *v2,
75 size_t len )
Daniel King8fe47012016-05-17 20:33:28 -030076{
77 const unsigned char *p1 = (const unsigned char*) v1;
78 const unsigned char *p2 = (const unsigned char*) v2;
79 size_t i;
80 unsigned char diff;
81
82 for( diff = 0, i = 0; i < len; i++ )
83 diff |= p1[i] ^ p2[i];
84
85 return (int)diff;
86}
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +020087#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
Daniel King8fe47012016-05-17 20:33:28 -030088
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +020089static int supported_init = 0;
Paul Bakker72f62662011-01-16 21:27:44 +000090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020091const int *mbedtls_cipher_list( void )
Paul Bakker72f62662011-01-16 21:27:44 +000092{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020093 const mbedtls_cipher_definition_t *def;
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +020094 int *type;
95
96 if( ! supported_init )
97 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098 def = mbedtls_cipher_definitions;
99 type = mbedtls_cipher_supported;
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +0200100
101 while( def->type != 0 )
102 *type++ = (*def++).type;
103
104 *type = 0;
105
106 supported_init = 1;
107 }
108
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200109 return( mbedtls_cipher_supported );
Paul Bakker72f62662011-01-16 21:27:44 +0000110}
111
Hanno Becker18597cd2018-11-09 16:36:33 +0000112const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type(
113 const mbedtls_cipher_type_t cipher_type )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000114{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200115 const mbedtls_cipher_definition_t *def;
Paul Bakker5e0efa72013-09-08 23:04:04 +0200116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200117 for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +0200118 if( def->type == cipher_type )
119 return( def->info );
Paul Bakker343a8702011-06-09 14:27:58 +0000120
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200121 return( NULL );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000122}
123
Hanno Becker18597cd2018-11-09 16:36:33 +0000124const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string(
125 const char *cipher_name )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000126{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200127 const mbedtls_cipher_definition_t *def;
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +0200128
Paul Bakker8123e9d2011-01-06 15:37:30 +0000129 if( NULL == cipher_name )
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200130 return( NULL );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200132 for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
Manuel Pégourié-Gonnardcb46fd82015-05-28 17:06:07 +0200133 if( ! strcmp( def->info->name, cipher_name ) )
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +0200134 return( def->info );
Paul Bakkerfab5c822012-02-06 16:45:10 +0000135
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200136 return( NULL );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000137}
138
Hanno Becker18597cd2018-11-09 16:36:33 +0000139const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values(
140 const mbedtls_cipher_id_t cipher_id,
141 int key_bitlen,
142 const mbedtls_cipher_mode_t mode )
Paul Bakkerf46b6952013-09-09 00:08:26 +0200143{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200144 const mbedtls_cipher_definition_t *def;
Paul Bakkerf46b6952013-09-09 00:08:26 +0200145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200146 for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +0200147 if( def->info->base->cipher == cipher_id &&
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +0200148 def->info->key_bitlen == (unsigned) key_bitlen &&
Manuel Pégourié-Gonnarddace82f2013-09-18 15:12:07 +0200149 def->info->mode == mode )
150 return( def->info );
Paul Bakkerf46b6952013-09-09 00:08:26 +0200151
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200152 return( NULL );
Paul Bakkerf46b6952013-09-09 00:08:26 +0200153}
154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200155void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx )
Paul Bakker84bbeb52014-07-01 14:53:22 +0200156{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200157 memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200158}
159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200160void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx )
Paul Bakker84bbeb52014-07-01 14:53:22 +0200161{
162 if( ctx == NULL )
163 return;
164
Simon Butcher327398a2016-10-05 14:09:11 +0100165#if defined(MBEDTLS_CMAC_C)
166 if( ctx->cmac_ctx )
167 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500168 mbedtls_platform_zeroize( ctx->cmac_ctx,
169 sizeof( mbedtls_cmac_context_t ) );
Simon Butcher327398a2016-10-05 14:09:11 +0100170 mbedtls_free( ctx->cmac_ctx );
171 }
172#endif
173
Paul Bakker84bbeb52014-07-01 14:53:22 +0200174 if( ctx->cipher_ctx )
175 ctx->cipher_info->base->ctx_free_func( ctx->cipher_ctx );
176
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500177 mbedtls_platform_zeroize( ctx, sizeof(mbedtls_cipher_context_t) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200178}
179
Hanno Becker18597cd2018-11-09 16:36:33 +0000180int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx,
181 const mbedtls_cipher_info_t *cipher_info )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000182{
183 if( NULL == cipher_info || NULL == ctx )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200186 memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000187
Paul Bakker343a8702011-06-09 14:27:58 +0000188 if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200189 return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000190
191 ctx->cipher_info = cipher_info;
192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200193#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200194 /*
195 * Ignore possible errors caused by a cipher mode that doesn't use padding
196 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200197#if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
198 (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_PKCS7 );
Paul Bakker48e93c82013-08-14 12:21:18 +0200199#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200200 (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_NONE );
Paul Bakker48e93c82013-08-14 12:21:18 +0200201#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200202#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200203
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200204 return( 0 );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000205}
206
Hanno Becker18597cd2018-11-09 16:36:33 +0000207int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx,
208 const unsigned char *key,
209 int key_bitlen,
210 const mbedtls_operation_t operation )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000211{
212 if( NULL == ctx || NULL == ctx->cipher_info )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200213 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200215 if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN ) == 0 &&
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +0200216 (int) ctx->cipher_info->key_bitlen != key_bitlen )
Manuel Pégourié-Gonnard398c57b2014-06-23 12:10:59 +0200217 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200218 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard398c57b2014-06-23 12:10:59 +0200219 }
Manuel Pégourié-Gonnarddd0f57f2013-09-16 11:47:43 +0200220
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +0200221 ctx->key_bitlen = key_bitlen;
Paul Bakker8123e9d2011-01-06 15:37:30 +0000222 ctx->operation = operation;
223
Paul Bakker343a8702011-06-09 14:27:58 +0000224 /*
Simon Butcher8c0fd1e2018-04-22 22:58:07 +0100225 * For OFB, CFB and CTR mode always use the encryption key schedule
Paul Bakker343a8702011-06-09 14:27:58 +0000226 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227 if( MBEDTLS_ENCRYPT == operation ||
228 MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
Simon Butcher8c0fd1e2018-04-22 22:58:07 +0100229 MBEDTLS_MODE_OFB == ctx->cipher_info->mode ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200230 MBEDTLS_MODE_CTR == ctx->cipher_info->mode )
Paul Bakker343a8702011-06-09 14:27:58 +0000231 {
232 return ctx->cipher_info->base->setkey_enc_func( ctx->cipher_ctx, key,
Hanno Becker18597cd2018-11-09 16:36:33 +0000233 ctx->key_bitlen );
Paul Bakker343a8702011-06-09 14:27:58 +0000234 }
Paul Bakker8123e9d2011-01-06 15:37:30 +0000235
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200236 if( MBEDTLS_DECRYPT == operation )
Paul Bakker343a8702011-06-09 14:27:58 +0000237 return ctx->cipher_info->base->setkey_dec_func( ctx->cipher_ctx, key,
Hanno Becker18597cd2018-11-09 16:36:33 +0000238 ctx->key_bitlen );
239
Paul Bakker8123e9d2011-01-06 15:37:30 +0000240
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200241 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000242}
243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnard9c853b92013-09-03 13:04:44 +0200245 const unsigned char *iv, size_t iv_len )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000246{
Manuel Pégourié-Gonnarda235b5b2013-09-03 13:25:52 +0200247 size_t actual_iv_size;
Ron Eldor4e64e0b2017-09-25 18:22:32 +0300248 if( NULL == ctx || NULL == ctx->cipher_info )
249 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
250 else if( NULL == iv && iv_len != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200251 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000252
Ron Eldorbb4bbbb2017-10-01 17:04:54 +0300253 if( NULL == iv && iv_len == 0 )
254 ctx->iv_size = 0;
255
Manuel Pégourié-Gonnarde0dca4a2013-10-24 16:54:25 +0200256 /* avoid buffer overflow in ctx->iv */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200257 if( iv_len > MBEDTLS_MAX_IV_LENGTH )
258 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarde0dca4a2013-10-24 16:54:25 +0200259
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200260 if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN ) != 0 )
Manuel Pégourié-Gonnarda235b5b2013-09-03 13:25:52 +0200261 actual_iv_size = iv_len;
262 else
Manuel Pégourié-Gonnarde0dca4a2013-10-24 16:54:25 +0200263 {
Manuel Pégourié-Gonnarda235b5b2013-09-03 13:25:52 +0200264 actual_iv_size = ctx->cipher_info->iv_size;
Manuel Pégourié-Gonnard9c853b92013-09-03 13:04:44 +0200265
Manuel Pégourié-Gonnarde0dca4a2013-10-24 16:54:25 +0200266 /* avoid reading past the end of input buffer */
267 if( actual_iv_size > iv_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200268 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde0dca4a2013-10-24 16:54:25 +0200269 }
270
Daniel Kingbd920622016-05-15 19:56:20 -0300271#if defined(MBEDTLS_CHACHA20_C)
272 if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20 )
273 {
274 if ( 0 != mbedtls_chacha20_starts( (mbedtls_chacha20_context*)ctx->cipher_ctx,
275 iv,
276 0U ) ) /* Initial counter value */
277 {
278 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
279 }
280 }
281#endif
282
Ron Eldorbb4bbbb2017-10-01 17:04:54 +0300283 if ( actual_iv_size != 0 )
Ron Eldor4e64e0b2017-09-25 18:22:32 +0300284 {
285 memcpy( ctx->iv, iv, actual_iv_size );
286 ctx->iv_size = actual_iv_size;
287 }
Manuel Pégourié-Gonnard9c853b92013-09-03 13:04:44 +0200288
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200289 return( 0 );
Manuel Pégourié-Gonnard9c853b92013-09-03 13:04:44 +0200290}
291
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200292int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx )
Manuel Pégourié-Gonnard9c853b92013-09-03 13:04:44 +0200293{
Manuel Pégourié-Gonnard2adc40c2013-09-03 13:54:12 +0200294 if( NULL == ctx || NULL == ctx->cipher_info )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200295 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard2adc40c2013-09-03 13:54:12 +0200296
Paul Bakker8123e9d2011-01-06 15:37:30 +0000297 ctx->unprocessed_len = 0;
298
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200299 return( 0 );
Manuel Pégourié-Gonnard2adc40c2013-09-03 13:54:12 +0200300}
301
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200302#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200303int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnard2adc40c2013-09-03 13:54:12 +0200304 const unsigned char *ad, size_t ad_len )
305{
306 if( NULL == ctx || NULL == ctx->cipher_info )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200307 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard2adc40c2013-09-03 13:54:12 +0200308
Daniel King8fe47012016-05-17 20:33:28 -0300309#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200310 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
Manuel Pégourié-Gonnard07f8fa52013-08-30 18:34:08 +0200311 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200312 return mbedtls_gcm_starts( (mbedtls_gcm_context *) ctx->cipher_ctx, ctx->operation,
Manuel Pégourié-Gonnard9c853b92013-09-03 13:04:44 +0200313 ctx->iv, ctx->iv_size, ad, ad_len );
Manuel Pégourié-Gonnard07f8fa52013-08-30 18:34:08 +0200314 }
Daniel King8fe47012016-05-17 20:33:28 -0300315#endif
316
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200317#if defined(MBEDTLS_CHACHAPOLY_C)
Daniel King8fe47012016-05-17 20:33:28 -0300318 if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
319 {
320 int result;
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200321 mbedtls_chachapoly_mode_t mode;
Daniel King8fe47012016-05-17 20:33:28 -0300322
323 mode = ( ctx->operation == MBEDTLS_ENCRYPT )
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200324 ? MBEDTLS_CHACHAPOLY_ENCRYPT
325 : MBEDTLS_CHACHAPOLY_DECRYPT;
Daniel King8fe47012016-05-17 20:33:28 -0300326
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200327 result = mbedtls_chachapoly_starts( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
Daniel King8fe47012016-05-17 20:33:28 -0300328 ctx->iv,
329 mode );
330 if ( result != 0 )
331 return( result );
332
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200333 return mbedtls_chachapoly_update_aad( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
Manuel Pégourié-Gonnard5ef92d32018-05-09 09:34:25 +0200334 ad, ad_len );
Daniel King8fe47012016-05-17 20:33:28 -0300335 }
336#endif
Manuel Pégourié-Gonnard07f8fa52013-08-30 18:34:08 +0200337
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200338 return( 0 );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000339}
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200340#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
Paul Bakker8123e9d2011-01-06 15:37:30 +0000341
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200342int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200343 size_t ilen, unsigned char *output, size_t *olen )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000344{
Paul Bakkerff61a782011-06-09 15:42:02 +0000345 int ret;
Janos Follath98e28a72016-05-31 14:03:54 +0100346 size_t block_size = 0;
Paul Bakker8123e9d2011-01-06 15:37:30 +0000347
Paul Bakker68884e32013-01-07 18:20:04 +0100348 if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
Paul Bakkera885d682011-01-20 16:35:05 +0000349 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200350 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakkera885d682011-01-20 16:35:05 +0000351 }
Paul Bakker8123e9d2011-01-06 15:37:30 +0000352
Paul Bakker6c212762013-12-16 15:24:50 +0100353 *olen = 0;
Janos Follath98e28a72016-05-31 14:03:54 +0100354 block_size = mbedtls_cipher_get_block_size( ctx );
Paul Bakker6c212762013-12-16 15:24:50 +0100355
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200356 if( ctx->cipher_info->mode == MBEDTLS_MODE_ECB )
Paul Bakker5e0efa72013-09-08 23:04:04 +0200357 {
Janos Follath98e28a72016-05-31 14:03:54 +0100358 if( ilen != block_size )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
Paul Bakker5e0efa72013-09-08 23:04:04 +0200360
361 *olen = ilen;
362
363 if( 0 != ( ret = ctx->cipher_info->base->ecb_func( ctx->cipher_ctx,
364 ctx->operation, input, output ) ) )
365 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200366 return( ret );
Paul Bakker5e0efa72013-09-08 23:04:04 +0200367 }
368
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200369 return( 0 );
Paul Bakker5e0efa72013-09-08 23:04:04 +0200370 }
371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200372#if defined(MBEDTLS_GCM_C)
373 if( ctx->cipher_info->mode == MBEDTLS_MODE_GCM )
Manuel Pégourié-Gonnardb8bd5932013-09-05 13:38:15 +0200374 {
375 *olen = ilen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200376 return mbedtls_gcm_update( (mbedtls_gcm_context *) ctx->cipher_ctx, ilen, input,
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200377 output );
Manuel Pégourié-Gonnardb8bd5932013-09-05 13:38:15 +0200378 }
379#endif
380
Manuel Pégourié-Gonnard32902e62018-05-10 12:30:19 +0200381#if defined(MBEDTLS_CHACHAPOLY_C)
382 if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20_POLY1305 )
383 {
384 *olen = ilen;
385 return mbedtls_chachapoly_update( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
386 ilen, input, output );
387 }
388#endif
389
Janos Follath98e28a72016-05-31 14:03:54 +0100390 if ( 0 == block_size )
391 {
392 return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT;
393 }
394
Paul Bakker68884e32013-01-07 18:20:04 +0100395 if( input == output &&
Janos Follath98e28a72016-05-31 14:03:54 +0100396 ( ctx->unprocessed_len != 0 || ilen % block_size ) )
Paul Bakker68884e32013-01-07 18:20:04 +0100397 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200398 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100399 }
Paul Bakker8123e9d2011-01-06 15:37:30 +0000400
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200401#if defined(MBEDTLS_CIPHER_MODE_CBC)
402 if( ctx->cipher_info->mode == MBEDTLS_MODE_CBC )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000403 {
Manuel Pégourié-Gonnard989ed382013-09-13 14:41:45 +0200404 size_t copy_len = 0;
405
Paul Bakker8123e9d2011-01-06 15:37:30 +0000406 /*
407 * If there is not enough data for a full block, cache it.
408 */
Andy Leiserson79e77892017-04-28 20:01:49 -0700409 if( ( ctx->operation == MBEDTLS_DECRYPT && NULL != ctx->add_padding &&
Andres Amaya Garcia6a543362017-01-17 23:04:22 +0000410 ilen <= block_size - ctx->unprocessed_len ) ||
Andy Leiserson79e77892017-04-28 20:01:49 -0700411 ( ctx->operation == MBEDTLS_DECRYPT && NULL == ctx->add_padding &&
412 ilen < block_size - ctx->unprocessed_len ) ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200413 ( ctx->operation == MBEDTLS_ENCRYPT &&
Andres Amaya Garcia6a543362017-01-17 23:04:22 +0000414 ilen < block_size - ctx->unprocessed_len ) )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000415 {
416 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
417 ilen );
418
419 ctx->unprocessed_len += ilen;
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200420 return( 0 );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000421 }
422
423 /*
424 * Process cached data first
425 */
Janos Follath98e28a72016-05-31 14:03:54 +0100426 if( 0 != ctx->unprocessed_len )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000427 {
Janos Follath98e28a72016-05-31 14:03:54 +0100428 copy_len = block_size - ctx->unprocessed_len;
Paul Bakker8123e9d2011-01-06 15:37:30 +0000429
430 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
431 copy_len );
432
Paul Bakkerff61a782011-06-09 15:42:02 +0000433 if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
Janos Follath98e28a72016-05-31 14:03:54 +0100434 ctx->operation, block_size, ctx->iv,
Paul Bakkerff61a782011-06-09 15:42:02 +0000435 ctx->unprocessed_data, output ) ) )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000436 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200437 return( ret );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000438 }
439
Janos Follath98e28a72016-05-31 14:03:54 +0100440 *olen += block_size;
441 output += block_size;
Paul Bakker8123e9d2011-01-06 15:37:30 +0000442 ctx->unprocessed_len = 0;
443
444 input += copy_len;
445 ilen -= copy_len;
446 }
447
448 /*
449 * Cache final, incomplete block
450 */
451 if( 0 != ilen )
452 {
Janos Follath98e28a72016-05-31 14:03:54 +0100453 if( 0 == block_size )
454 {
455 return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT;
456 }
457
Andy Leiserson79e77892017-04-28 20:01:49 -0700458 /* Encryption: only cache partial blocks
459 * Decryption w/ padding: always keep at least one whole block
460 * Decryption w/o padding: only cache partial blocks
461 */
Janos Follath98e28a72016-05-31 14:03:54 +0100462 copy_len = ilen % block_size;
Andy Leiserson79e77892017-04-28 20:01:49 -0700463 if( copy_len == 0 &&
464 ctx->operation == MBEDTLS_DECRYPT &&
465 NULL != ctx->add_padding)
466 {
Janos Follath98e28a72016-05-31 14:03:54 +0100467 copy_len = block_size;
Andy Leiserson79e77892017-04-28 20:01:49 -0700468 }
Paul Bakker8123e9d2011-01-06 15:37:30 +0000469
470 memcpy( ctx->unprocessed_data, &( input[ilen - copy_len] ),
471 copy_len );
472
473 ctx->unprocessed_len += copy_len;
474 ilen -= copy_len;
475 }
476
477 /*
478 * Process remaining full blocks
479 */
480 if( ilen )
481 {
Paul Bakkerff61a782011-06-09 15:42:02 +0000482 if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
483 ctx->operation, ilen, ctx->iv, input, output ) ) )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000484 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200485 return( ret );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000486 }
Manuel Pégourié-Gonnard07f8fa52013-08-30 18:34:08 +0200487
Paul Bakker8123e9d2011-01-06 15:37:30 +0000488 *olen += ilen;
489 }
490
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200491 return( 0 );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000492 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200493#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker8123e9d2011-01-06 15:37:30 +0000494
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200495#if defined(MBEDTLS_CIPHER_MODE_CFB)
496 if( ctx->cipher_info->mode == MBEDTLS_MODE_CFB )
Paul Bakker343a8702011-06-09 14:27:58 +0000497 {
Paul Bakker6132d0a2012-07-04 17:10:40 +0000498 if( 0 != ( ret = ctx->cipher_info->base->cfb_func( ctx->cipher_ctx,
Paul Bakker343a8702011-06-09 14:27:58 +0000499 ctx->operation, ilen, &ctx->unprocessed_len, ctx->iv,
Paul Bakkerff61a782011-06-09 15:42:02 +0000500 input, output ) ) )
Paul Bakker343a8702011-06-09 14:27:58 +0000501 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200502 return( ret );
Paul Bakker343a8702011-06-09 14:27:58 +0000503 }
504
505 *olen = ilen;
506
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200507 return( 0 );
Paul Bakker343a8702011-06-09 14:27:58 +0000508 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200509#endif /* MBEDTLS_CIPHER_MODE_CFB */
Paul Bakker343a8702011-06-09 14:27:58 +0000510
Simon Butcher8c0fd1e2018-04-22 22:58:07 +0100511#if defined(MBEDTLS_CIPHER_MODE_OFB)
512 if( ctx->cipher_info->mode == MBEDTLS_MODE_OFB )
513 {
514 if( 0 != ( ret = ctx->cipher_info->base->ofb_func( ctx->cipher_ctx,
515 ilen, &ctx->unprocessed_len, ctx->iv, input, output ) ) )
516 {
517 return( ret );
518 }
519
520 *olen = ilen;
521
522 return( 0 );
523 }
524#endif /* MBEDTLS_CIPHER_MODE_OFB */
525
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200526#if defined(MBEDTLS_CIPHER_MODE_CTR)
527 if( ctx->cipher_info->mode == MBEDTLS_MODE_CTR )
Paul Bakker343a8702011-06-09 14:27:58 +0000528 {
Paul Bakkerff61a782011-06-09 15:42:02 +0000529 if( 0 != ( ret = ctx->cipher_info->base->ctr_func( ctx->cipher_ctx,
Paul Bakker343a8702011-06-09 14:27:58 +0000530 ilen, &ctx->unprocessed_len, ctx->iv,
Paul Bakkerff61a782011-06-09 15:42:02 +0000531 ctx->unprocessed_data, input, output ) ) )
Paul Bakker343a8702011-06-09 14:27:58 +0000532 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200533 return( ret );
Paul Bakker343a8702011-06-09 14:27:58 +0000534 }
535
536 *olen = ilen;
537
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200538 return( 0 );
Paul Bakker343a8702011-06-09 14:27:58 +0000539 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200540#endif /* MBEDTLS_CIPHER_MODE_CTR */
Paul Bakker343a8702011-06-09 14:27:58 +0000541
Jaeden Ameroc6539902018-04-30 17:17:41 +0100542#if defined(MBEDTLS_CIPHER_MODE_XTS)
543 if( ctx->cipher_info->mode == MBEDTLS_MODE_XTS )
544 {
545 if( ctx->unprocessed_len > 0 ) {
546 /* We can only process an entire data unit at a time. */
547 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
548 }
549
550 ret = ctx->cipher_info->base->xts_func( ctx->cipher_ctx,
551 ctx->operation, ilen, ctx->iv, input, output );
552 if( ret != 0 )
553 {
554 return( ret );
555 }
556
557 *olen = ilen;
558
559 return( 0 );
560 }
561#endif /* MBEDTLS_CIPHER_MODE_XTS */
562
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200563#if defined(MBEDTLS_CIPHER_MODE_STREAM)
564 if( ctx->cipher_info->mode == MBEDTLS_MODE_STREAM )
Manuel Pégourié-Gonnard37e230c2013-08-28 13:50:42 +0200565 {
566 if( 0 != ( ret = ctx->cipher_info->base->stream_func( ctx->cipher_ctx,
567 ilen, input, output ) ) )
568 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200569 return( ret );
Manuel Pégourié-Gonnard37e230c2013-08-28 13:50:42 +0200570 }
571
572 *olen = ilen;
573
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200574 return( 0 );
Manuel Pégourié-Gonnard37e230c2013-08-28 13:50:42 +0200575 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200576#endif /* MBEDTLS_CIPHER_MODE_STREAM */
Manuel Pégourié-Gonnard37e230c2013-08-28 13:50:42 +0200577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200578 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000579}
580
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200581#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
582#if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200583/*
584 * PKCS7 (and PKCS5) padding: fill with ll bytes, with ll = padding_len
585 */
Paul Bakker23986e52011-04-24 08:57:21 +0000586static void add_pkcs_padding( unsigned char *output, size_t output_len,
587 size_t data_len )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000588{
Paul Bakker23986e52011-04-24 08:57:21 +0000589 size_t padding_len = output_len - data_len;
Manuel Pégourié-Gonnardf8ab0692013-10-27 17:21:14 +0100590 unsigned char i;
Paul Bakker8123e9d2011-01-06 15:37:30 +0000591
592 for( i = 0; i < padding_len; i++ )
Paul Bakker23986e52011-04-24 08:57:21 +0000593 output[data_len + i] = (unsigned char) padding_len;
Paul Bakker8123e9d2011-01-06 15:37:30 +0000594}
595
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200596static int get_pkcs_padding( unsigned char *input, size_t input_len,
597 size_t *data_len )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000598{
Manuel Pégourié-Gonnardf8ab0692013-10-27 17:21:14 +0100599 size_t i, pad_idx;
600 unsigned char padding_len, bad = 0;
Paul Bakker8123e9d2011-01-06 15:37:30 +0000601
Paul Bakkera885d682011-01-20 16:35:05 +0000602 if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200603 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000604
605 padding_len = input[input_len - 1];
Paul Bakker8123e9d2011-01-06 15:37:30 +0000606 *data_len = input_len - padding_len;
607
Manuel Pégourié-Gonnardf8ab0692013-10-27 17:21:14 +0100608 /* Avoid logical || since it results in a branch */
609 bad |= padding_len > input_len;
610 bad |= padding_len == 0;
611
612 /* The number of bytes checked must be independent of padding_len,
613 * so pick input_len, which is usually 8 or 16 (one block) */
614 pad_idx = input_len - padding_len;
615 for( i = 0; i < input_len; i++ )
616 bad |= ( input[i] ^ padding_len ) * ( i >= pad_idx );
617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200618 return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000619}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200620#endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */
Paul Bakker8123e9d2011-01-06 15:37:30 +0000621
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200622#if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200623/*
624 * One and zeros padding: fill with 80 00 ... 00
625 */
626static void add_one_and_zeros_padding( unsigned char *output,
627 size_t output_len, size_t data_len )
628{
629 size_t padding_len = output_len - data_len;
630 unsigned char i = 0;
631
632 output[data_len] = 0x80;
633 for( i = 1; i < padding_len; i++ )
634 output[data_len + i] = 0x00;
635}
636
637static int get_one_and_zeros_padding( unsigned char *input, size_t input_len,
638 size_t *data_len )
639{
Manuel Pégourié-Gonnard6c329902013-10-27 18:25:03 +0100640 size_t i;
641 unsigned char done = 0, prev_done, bad;
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200642
643 if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200644 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200645
Micha Krausba8316f2017-12-23 23:40:08 +0100646 bad = 0x80;
Manuel Pégourié-Gonnard6c329902013-10-27 18:25:03 +0100647 *data_len = 0;
648 for( i = input_len; i > 0; i-- )
649 {
650 prev_done = done;
Micha Krausba8316f2017-12-23 23:40:08 +0100651 done |= ( input[i - 1] != 0 );
Manuel Pégourié-Gonnard6c329902013-10-27 18:25:03 +0100652 *data_len |= ( i - 1 ) * ( done != prev_done );
Micha Krausba8316f2017-12-23 23:40:08 +0100653 bad ^= input[i - 1] * ( done != prev_done );
Manuel Pégourié-Gonnard6c329902013-10-27 18:25:03 +0100654 }
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200655
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200656 return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200657
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200658}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200659#endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200660
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200661#if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
Manuel Pégourié-Gonnard8d4291b2013-07-26 14:55:18 +0200662/*
663 * Zeros and len padding: fill with 00 ... 00 ll, where ll is padding length
664 */
665static void add_zeros_and_len_padding( unsigned char *output,
666 size_t output_len, size_t data_len )
667{
668 size_t padding_len = output_len - data_len;
669 unsigned char i = 0;
670
671 for( i = 1; i < padding_len; i++ )
672 output[data_len + i - 1] = 0x00;
673 output[output_len - 1] = (unsigned char) padding_len;
674}
675
676static int get_zeros_and_len_padding( unsigned char *input, size_t input_len,
677 size_t *data_len )
678{
Manuel Pégourié-Gonnardd17df512013-10-27 17:32:43 +0100679 size_t i, pad_idx;
680 unsigned char padding_len, bad = 0;
Manuel Pégourié-Gonnard8d4291b2013-07-26 14:55:18 +0200681
682 if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200683 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8d4291b2013-07-26 14:55:18 +0200684
685 padding_len = input[input_len - 1];
Manuel Pégourié-Gonnard8d4291b2013-07-26 14:55:18 +0200686 *data_len = input_len - padding_len;
687
Manuel Pégourié-Gonnardd17df512013-10-27 17:32:43 +0100688 /* Avoid logical || since it results in a branch */
689 bad |= padding_len > input_len;
690 bad |= padding_len == 0;
691
692 /* The number of bytes checked must be independent of padding_len */
693 pad_idx = input_len - padding_len;
694 for( i = 0; i < input_len - 1; i++ )
695 bad |= input[i] * ( i >= pad_idx );
696
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200697 return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
Manuel Pégourié-Gonnard8d4291b2013-07-26 14:55:18 +0200698}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200699#endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */
Manuel Pégourié-Gonnard8d4291b2013-07-26 14:55:18 +0200700
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200701#if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200702/*
703 * Zero padding: fill with 00 ... 00
704 */
705static void add_zeros_padding( unsigned char *output,
706 size_t output_len, size_t data_len )
707{
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200708 size_t i;
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200709
710 for( i = data_len; i < output_len; i++ )
711 output[i] = 0x00;
712}
713
714static int get_zeros_padding( unsigned char *input, size_t input_len,
715 size_t *data_len )
716{
Manuel Pégourié-Gonnarde68bf172013-10-27 18:26:39 +0100717 size_t i;
718 unsigned char done = 0, prev_done;
719
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200720 if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200721 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200722
Manuel Pégourié-Gonnarde68bf172013-10-27 18:26:39 +0100723 *data_len = 0;
724 for( i = input_len; i > 0; i-- )
725 {
726 prev_done = done;
727 done |= ( input[i-1] != 0 );
728 *data_len |= i * ( done != prev_done );
729 }
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200730
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200731 return( 0 );
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200732}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200733#endif /* MBEDTLS_CIPHER_PADDING_ZEROS */
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200734
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200735/*
736 * No padding: don't pad :)
737 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200738 * There is no add_padding function (check for NULL in mbedtls_cipher_finish)
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200739 * but a trivial get_padding function
740 */
741static int get_no_padding( unsigned char *input, size_t input_len,
742 size_t *data_len )
743{
744 if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200745 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200746
747 *data_len = input_len;
748
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200749 return( 0 );
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200750}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200751#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200752
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200753int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200754 unsigned char *output, size_t *olen )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000755{
756 if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200757 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000758
759 *olen = 0;
760
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200761 if( MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
Simon Butcher8c0fd1e2018-04-22 22:58:07 +0100762 MBEDTLS_MODE_OFB == ctx->cipher_info->mode ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200763 MBEDTLS_MODE_CTR == ctx->cipher_info->mode ||
764 MBEDTLS_MODE_GCM == ctx->cipher_info->mode ||
Jaeden Ameroc6539902018-04-30 17:17:41 +0100765 MBEDTLS_MODE_XTS == ctx->cipher_info->mode ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200766 MBEDTLS_MODE_STREAM == ctx->cipher_info->mode )
Paul Bakker343a8702011-06-09 14:27:58 +0000767 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200768 return( 0 );
Paul Bakker343a8702011-06-09 14:27:58 +0000769 }
770
Daniel King8fe47012016-05-17 20:33:28 -0300771 if ( ( MBEDTLS_CIPHER_CHACHA20 == ctx->cipher_info->type ) ||
772 ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) )
Daniel Kingbd920622016-05-15 19:56:20 -0300773 {
774 return( 0 );
775 }
776
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200777 if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode )
Paul Bakker5e0efa72013-09-08 23:04:04 +0200778 {
779 if( ctx->unprocessed_len != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200780 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
Paul Bakker5e0efa72013-09-08 23:04:04 +0200781
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200782 return( 0 );
Paul Bakker5e0efa72013-09-08 23:04:04 +0200783 }
784
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200785#if defined(MBEDTLS_CIPHER_MODE_CBC)
786 if( MBEDTLS_MODE_CBC == ctx->cipher_info->mode )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000787 {
Manuel Pégourié-Gonnard989ed382013-09-13 14:41:45 +0200788 int ret = 0;
789
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200790 if( MBEDTLS_ENCRYPT == ctx->operation )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000791 {
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200792 /* check for 'no padding' mode */
793 if( NULL == ctx->add_padding )
794 {
795 if( 0 != ctx->unprocessed_len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200796 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200797
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200798 return( 0 );
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200799 }
800
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200801 ctx->add_padding( ctx->unprocessed_data, mbedtls_cipher_get_iv_size( ctx ),
Paul Bakker8123e9d2011-01-06 15:37:30 +0000802 ctx->unprocessed_len );
803 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200804 else if( mbedtls_cipher_get_block_size( ctx ) != ctx->unprocessed_len )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000805 {
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200806 /*
807 * For decrypt operations, expect a full block,
808 * or an empty block if no padding
809 */
810 if( NULL == ctx->add_padding && 0 == ctx->unprocessed_len )
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200811 return( 0 );
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200812
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200813 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000814 }
815
816 /* cipher block */
Paul Bakkerff61a782011-06-09 15:42:02 +0000817 if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200818 ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv,
Paul Bakkerff61a782011-06-09 15:42:02 +0000819 ctx->unprocessed_data, output ) ) )
Paul Bakker8123e9d2011-01-06 15:37:30 +0000820 {
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200821 return( ret );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000822 }
823
824 /* Set output size for decryption */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200825 if( MBEDTLS_DECRYPT == ctx->operation )
826 return ctx->get_padding( output, mbedtls_cipher_get_block_size( ctx ),
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200827 olen );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000828
829 /* Set output size for encryption */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200830 *olen = mbedtls_cipher_get_block_size( ctx );
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200831 return( 0 );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000832 }
Manuel Pégourié-Gonnard989ed382013-09-13 14:41:45 +0200833#else
834 ((void) output);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200835#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker8123e9d2011-01-06 15:37:30 +0000836
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200837 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
Paul Bakker8123e9d2011-01-06 15:37:30 +0000838}
839
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200840#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Hanno Becker18597cd2018-11-09 16:36:33 +0000841int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx,
842 mbedtls_cipher_padding_t mode )
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200843{
844 if( NULL == ctx ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200845 MBEDTLS_MODE_CBC != ctx->cipher_info->mode )
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200846 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200847 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200848 }
849
Paul Bakker1a45d912013-08-14 12:04:26 +0200850 switch( mode )
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200851 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200852#if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
853 case MBEDTLS_PADDING_PKCS7:
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200854 ctx->add_padding = add_pkcs_padding;
855 ctx->get_padding = get_pkcs_padding;
Paul Bakker1a45d912013-08-14 12:04:26 +0200856 break;
Paul Bakker48e93c82013-08-14 12:21:18 +0200857#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200858#if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
859 case MBEDTLS_PADDING_ONE_AND_ZEROS:
Manuel Pégourié-Gonnard679f9e92013-07-26 12:46:02 +0200860 ctx->add_padding = add_one_and_zeros_padding;
861 ctx->get_padding = get_one_and_zeros_padding;
Paul Bakker1a45d912013-08-14 12:04:26 +0200862 break;
Paul Bakker48e93c82013-08-14 12:21:18 +0200863#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200864#if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
865 case MBEDTLS_PADDING_ZEROS_AND_LEN:
Manuel Pégourié-Gonnard8d4291b2013-07-26 14:55:18 +0200866 ctx->add_padding = add_zeros_and_len_padding;
867 ctx->get_padding = get_zeros_and_len_padding;
Paul Bakker1a45d912013-08-14 12:04:26 +0200868 break;
Paul Bakker48e93c82013-08-14 12:21:18 +0200869#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200870#if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
871 case MBEDTLS_PADDING_ZEROS:
Manuel Pégourié-Gonnard0e7d2c02013-07-26 16:05:14 +0200872 ctx->add_padding = add_zeros_padding;
873 ctx->get_padding = get_zeros_padding;
Paul Bakker1a45d912013-08-14 12:04:26 +0200874 break;
Paul Bakker48e93c82013-08-14 12:21:18 +0200875#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200876 case MBEDTLS_PADDING_NONE:
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200877 ctx->add_padding = NULL;
878 ctx->get_padding = get_no_padding;
Paul Bakker1a45d912013-08-14 12:04:26 +0200879 break;
880
881 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200882 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnardebdc4132013-07-26 16:50:44 +0200883 }
884
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200885 return( 0 );
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200886}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200887#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
Manuel Pégourié-Gonnardac56a1a2013-07-25 12:31:10 +0200888
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200889#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200890int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200891 unsigned char *tag, size_t tag_len )
892{
893 if( NULL == ctx || NULL == ctx->cipher_info || NULL == tag )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200894 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200895
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200896 if( MBEDTLS_ENCRYPT != ctx->operation )
897 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200898
Daniel King8fe47012016-05-17 20:33:28 -0300899#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200900 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
Hanno Becker18597cd2018-11-09 16:36:33 +0000901 return( mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx,
902 tag, tag_len ) );
Daniel King8fe47012016-05-17 20:33:28 -0300903#endif
904
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200905#if defined(MBEDTLS_CHACHAPOLY_C)
Daniel King8fe47012016-05-17 20:33:28 -0300906 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
907 {
908 /* Don't allow truncated MAC for Poly1305 */
909 if ( tag_len != 16U )
910 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
911
Hanno Becker18597cd2018-11-09 16:36:33 +0000912 return( mbedtls_chachapoly_finish(
913 (mbedtls_chachapoly_context*) ctx->cipher_ctx, tag ) );
Daniel King8fe47012016-05-17 20:33:28 -0300914 }
915#endif
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200916
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200917 return( 0 );
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200918}
Paul Bakker9af723c2014-05-01 13:03:14 +0200919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200920int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200921 const unsigned char *tag, size_t tag_len )
922{
Daniel King8fe47012016-05-17 20:33:28 -0300923 unsigned char check_tag[16];
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200924 int ret;
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200925
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200926 if( NULL == ctx || NULL == ctx->cipher_info ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200927 MBEDTLS_DECRYPT != ctx->operation )
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200928 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200929 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200930 }
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200931
Daniel King8fe47012016-05-17 20:33:28 -0300932#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200933 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200934 {
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200935 if( tag_len > sizeof( check_tag ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200936 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200937
Hanno Becker18597cd2018-11-09 16:36:33 +0000938 if( 0 != ( ret = mbedtls_gcm_finish(
939 (mbedtls_gcm_context *) ctx->cipher_ctx,
940 check_tag, tag_len ) ) )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200941 {
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200942 return( ret );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200943 }
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200944
945 /* Check the tag in "constant-time" */
Daniel King8fe47012016-05-17 20:33:28 -0300946 if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200947 return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200948
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200949 return( 0 );
Manuel Pégourié-Gonnard43a47802013-09-03 16:35:53 +0200950 }
Daniel King8fe47012016-05-17 20:33:28 -0300951#endif /* MBEDTLS_GCM_C */
952
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200953#if defined(MBEDTLS_CHACHAPOLY_C)
Daniel King8fe47012016-05-17 20:33:28 -0300954 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
955 {
956 /* Don't allow truncated MAC for Poly1305 */
957 if ( tag_len != sizeof( check_tag ) )
958 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
959
Hanno Becker18597cd2018-11-09 16:36:33 +0000960 ret = mbedtls_chachapoly_finish(
961 (mbedtls_chachapoly_context*) ctx->cipher_ctx, check_tag );
Daniel King8fe47012016-05-17 20:33:28 -0300962 if ( ret != 0 )
963 {
964 return( ret );
965 }
966
967 /* Check the tag in "constant-time" */
968 if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
969 return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
970
971 return( 0 );
972 }
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200973#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200974
975 return( 0 );
976}
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +0200977#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnardaa9ffc52013-09-03 16:19:22 +0200978
Manuel Pégourié-Gonnard3c1d1502014-05-12 13:46:08 +0200979/*
980 * Packet-oriented wrapper for non-AEAD modes
981 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200982int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnard3c1d1502014-05-12 13:46:08 +0200983 const unsigned char *iv, size_t iv_len,
984 const unsigned char *input, size_t ilen,
985 unsigned char *output, size_t *olen )
986{
987 int ret;
988 size_t finish_olen;
989
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200990 if( ( ret = mbedtls_cipher_set_iv( ctx, iv, iv_len ) ) != 0 )
Manuel Pégourié-Gonnard3c1d1502014-05-12 13:46:08 +0200991 return( ret );
992
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200993 if( ( ret = mbedtls_cipher_reset( ctx ) ) != 0 )
Manuel Pégourié-Gonnard3c1d1502014-05-12 13:46:08 +0200994 return( ret );
995
Hanno Becker18597cd2018-11-09 16:36:33 +0000996 if( ( ret = mbedtls_cipher_update( ctx, input, ilen,
997 output, olen ) ) != 0 )
Manuel Pégourié-Gonnard3c1d1502014-05-12 13:46:08 +0200998 return( ret );
999
Hanno Becker18597cd2018-11-09 16:36:33 +00001000 if( ( ret = mbedtls_cipher_finish( ctx, output + *olen,
1001 &finish_olen ) ) != 0 )
Manuel Pégourié-Gonnard3c1d1502014-05-12 13:46:08 +02001002 return( ret );
1003
1004 *olen += finish_olen;
1005
1006 return( 0 );
1007}
1008
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001009#if defined(MBEDTLS_CIPHER_MODE_AEAD)
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001010/*
1011 * Packet-oriented encryption for AEAD modes
1012 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001013int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001014 const unsigned char *iv, size_t iv_len,
1015 const unsigned char *ad, size_t ad_len,
1016 const unsigned char *input, size_t ilen,
1017 unsigned char *output, size_t *olen,
1018 unsigned char *tag, size_t tag_len )
1019{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001020#if defined(MBEDTLS_GCM_C)
1021 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001022 {
1023 *olen = ilen;
Hanno Becker18597cd2018-11-09 16:36:33 +00001024 return( mbedtls_gcm_crypt_and_tag( ctx->cipher_ctx, MBEDTLS_GCM_ENCRYPT,
1025 ilen, iv, iv_len, ad, ad_len,
1026 input, output, tag_len, tag ) );
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001027 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001028#endif /* MBEDTLS_GCM_C */
1029#if defined(MBEDTLS_CCM_C)
1030 if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
Manuel Pégourié-Gonnard41936952014-05-13 13:18:17 +02001031 {
1032 *olen = ilen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001033 return( mbedtls_ccm_encrypt_and_tag( ctx->cipher_ctx, ilen,
Manuel Pégourié-Gonnard41936952014-05-13 13:18:17 +02001034 iv, iv_len, ad, ad_len, input, output,
1035 tag, tag_len ) );
1036 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001037#endif /* MBEDTLS_CCM_C */
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +02001038#if defined(MBEDTLS_CHACHAPOLY_C)
Daniel King8fe47012016-05-17 20:33:28 -03001039 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
1040 {
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001041 /* ChachaPoly has fixed length nonce and MAC (tag) */
Daniel King8fe47012016-05-17 20:33:28 -03001042 if ( ( iv_len != ctx->cipher_info->iv_size ) ||
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001043 ( tag_len != 16U ) )
Daniel King8fe47012016-05-17 20:33:28 -03001044 {
1045 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
1046 }
1047
1048 *olen = ilen;
Manuel Pégourié-Gonnard3dc62a02018-06-04 12:18:19 +02001049 return( mbedtls_chachapoly_encrypt_and_tag( ctx->cipher_ctx,
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001050 ilen, iv, ad, ad_len, input, output, tag ) );
Daniel King8fe47012016-05-17 20:33:28 -03001051 }
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +02001052#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001055}
1056
1057/*
1058 * Packet-oriented decryption for AEAD modes
1059 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx,
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001061 const unsigned char *iv, size_t iv_len,
1062 const unsigned char *ad, size_t ad_len,
1063 const unsigned char *input, size_t ilen,
1064 unsigned char *output, size_t *olen,
1065 const unsigned char *tag, size_t tag_len )
1066{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067#if defined(MBEDTLS_GCM_C)
1068 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001069 {
1070 int ret;
1071
1072 *olen = ilen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001073 ret = mbedtls_gcm_auth_decrypt( ctx->cipher_ctx, ilen,
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001074 iv, iv_len, ad, ad_len,
1075 tag, tag_len, input, output );
1076
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001077 if( ret == MBEDTLS_ERR_GCM_AUTH_FAILED )
1078 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001079
1080 return( ret );
1081 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001082#endif /* MBEDTLS_GCM_C */
1083#if defined(MBEDTLS_CCM_C)
1084 if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
Manuel Pégourié-Gonnard41936952014-05-13 13:18:17 +02001085 {
1086 int ret;
1087
1088 *olen = ilen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001089 ret = mbedtls_ccm_auth_decrypt( ctx->cipher_ctx, ilen,
Manuel Pégourié-Gonnard41936952014-05-13 13:18:17 +02001090 iv, iv_len, ad, ad_len,
1091 input, output, tag, tag_len );
1092
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001093 if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED )
1094 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
Manuel Pégourié-Gonnard41936952014-05-13 13:18:17 +02001095
1096 return( ret );
1097 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001098#endif /* MBEDTLS_CCM_C */
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +02001099#if defined(MBEDTLS_CHACHAPOLY_C)
Daniel King8fe47012016-05-17 20:33:28 -03001100 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
1101 {
Daniel King8fe47012016-05-17 20:33:28 -03001102 int ret;
1103
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001104 /* ChachaPoly has fixed length nonce and MAC (tag) */
Daniel King8fe47012016-05-17 20:33:28 -03001105 if ( ( iv_len != ctx->cipher_info->iv_size ) ||
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001106 ( tag_len != 16U ) )
Daniel King8fe47012016-05-17 20:33:28 -03001107 {
1108 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
1109 }
1110
1111 *olen = ilen;
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001112 ret = mbedtls_chachapoly_auth_decrypt( ctx->cipher_ctx, ilen,
1113 iv, ad, ad_len, tag, input, output );
Daniel King8fe47012016-05-17 20:33:28 -03001114
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001115 if( ret == MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED )
1116 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
Daniel King8fe47012016-05-17 20:33:28 -03001117
Manuel Pégourié-Gonnardfe725de2018-05-08 09:38:09 +02001118 return( ret );
Daniel King8fe47012016-05-17 20:33:28 -03001119 }
Manuel Pégourié-Gonnarddca3a5d2018-05-07 10:43:27 +02001120#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001121
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001122 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001123}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001124#endif /* MBEDTLS_CIPHER_MODE_AEAD */
Manuel Pégourié-Gonnard4562ffe2014-05-13 12:19:29 +02001125
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001126#endif /* MBEDTLS_CIPHER_C */