cryptosoft: Fix support for variable tag lengths in AES-CCM.

The tag length is included as one of the values in the flags byte of
block 0 passed to CBC_MAC, so merely copying the first N bytes is
insufficient.

To avoid adding more sideband data to the CBC MAC software context,
pull the generation of block 0, the AAD length, and AAD padding out of
cbc_mac.c and into cryptosoft.c.  This matches how GCM/GMAC are
handled where the length block is constructed in cryptosoft.c and
passed as an input to the Update callback.  As a result, the CBC MAC
Update() routine is now much simpler and simply performs the
XOR-and-encrypt step on each input block.

While here, avoid a copy to the staging block in the Update routine
when one or more full blocks are passed as input to the Update
callback.

Reviewed by:	sef
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D32120

3 files changed, 119 insertions, 168 deletions

diff --git a/sys/opencrypto/cbc_mac.c b/sys/opencrypto/cbc_mac.c
index 40afae5373bf..9a030cd54173 100644
--- a/sys/opencrypto/cbc_mac.c
+++ b/sys/opencrypto/cbc_mac.c
@@ -75,85 +75,23 @@ AES_CBC_MAC_Setkey(void *vctx, const uint8_t *key, u_int klen)
 
 /*
  * This is called to set the nonce, aka IV.
- * Before this call, the authDataLength and cryptDataLength fields
- * MUST have been set.  Sadly, there's no way to return an error.
  *
- * The CBC-MAC algorithm requires that the first block contain the
- * nonce, as well as information about the sizes and lengths involved.
+ * Note that the caller is responsible for constructing b0 as well
+ * as the length and padding around the AAD and passing that data
+ * to _Update.
  */
 void
 AES_CBC_MAC_Reinit(void *vctx, const uint8_t *nonce, u_int nonceLen)
 {
 	struct aes_cbc_mac_ctx *ctx = vctx;
-	uint8_t b0[CCM_CBC_BLOCK_LEN];
-	uint8_t *bp = b0, flags = 0;
-	uint8_t L = 0;
-	uint64_t dataLength = ctx->cryptDataLength;
-
-	KASSERT(nonceLen >= 7 && nonceLen <= 13,
-	    ("nonceLen must be between 7 and 13 bytes"));
 
 	ctx->nonce = nonce;
 	ctx->nonceLength = nonceLen;
-	
-	ctx->authDataCount = 0;
+
 	ctx->blockIndex = 0;
-	explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
-	
-	/*
-	 * Need to determine the L field value.  This is the number of
-	 * bytes needed to specify the length of the message; the length
-	 * is whatever is left in the 16 bytes after specifying flags and
-	 * the nonce.
-	 */
-	L = 15 - nonceLen;
-	
-	flags = ((ctx->authDataLength > 0) << 6) +
-	    (((AES_CBC_MAC_HASH_LEN - 2) / 2) << 3) +
-	    L - 1;
-	/*
-	 * Now we need to set up the first block, which has flags, nonce,
-	 * and the message length.
-	 */
-	b0[0] = flags;
-	bcopy(nonce, b0 + 1, nonceLen);
-	bp = b0 + 1 + nonceLen;
 
-	/* Need to copy L' [aka L-1] bytes of cryptDataLength */
-	for (uint8_t *dst = b0 + sizeof(b0) - 1; dst >= bp; dst--) {
-		*dst = dataLength;
-		dataLength >>= 8;
-	}
-	/* Now need to encrypt b0 */
-	rijndaelEncrypt(ctx->keysched, ctx->rounds, b0, ctx->block);
-	/* If there is auth data, we need to set up the staging block */
-	if (ctx->authDataLength) {
-		size_t addLength;
-		if (ctx->authDataLength < ((1<<16) - (1<<8))) {
-			uint16_t sizeVal = htobe16(ctx->authDataLength);
-			bcopy(&sizeVal, ctx->staging_block, sizeof(sizeVal));
-			addLength = sizeof(sizeVal);
-		} else if (ctx->authDataLength < (1ULL<<32)) {
-			uint32_t sizeVal = htobe32(ctx->authDataLength);
-			ctx->staging_block[0] = 0xff;
-			ctx->staging_block[1] = 0xfe;
-			bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
-			addLength = 2 + sizeof(sizeVal);
-		} else {
-			uint64_t sizeVal = htobe64(ctx->authDataLength);
-			ctx->staging_block[0] = 0xff;
-			ctx->staging_block[1] = 0xff;
-			bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal));
-			addLength = 2 + sizeof(sizeVal);
-		}
-		ctx->blockIndex = addLength;
-		/*
-		 * The length descriptor goes into the AAD buffer, so we
-		 * need to account for it.
-		 */
-		ctx->authDataLength += addLength;
-		ctx->authDataCount = addLength;
-	}
+	/* XOR b0 with all 0's on first call to _Update. */
+	memset(ctx->block, 0, CCM_CBC_BLOCK_LEN);
 }
 
 int
@@ -167,85 +105,35 @@ AES_CBC_MAC_Update(void *vctx, const void *vdata, u_int length)
 	data = vdata;
 
 	/*
-	 * This will be called in one of two phases:
-	 * (1)  Applying authentication data, or
-	 * (2)  Applying the payload data.
-	 *
-	 * Because CBC-MAC puts the authentication data size before the
-	 * data, subsequent calls won't be block-size-aligned.  Which
-	 * complicates things a fair bit.
-	 *
-	 * The payload data doesn't have that problem.
+	 * _Update can be called with non-aligned update lengths.  Use
+	 * the staging block when necessary.
 	 */
-				
-	if (ctx->authDataCount < ctx->authDataLength) {
-		/*
-		 * We need to process data as authentication data.
-		 * Since we may be out of sync, we may also need
-		 * to pad out the staging block.
-		 */
-		const uint8_t *ptr = data;
-		while (length > 0) {
-
-			copy_amt = MIN(length,
-			    sizeof(ctx->staging_block) - ctx->blockIndex);
-
-			bcopy(ptr, ctx->staging_block + ctx->blockIndex,
-			    copy_amt);
-			ptr += copy_amt;
-			length -= copy_amt;
-			ctx->authDataCount += copy_amt;
-			ctx->blockIndex += copy_amt;
-			ctx->blockIndex %= sizeof(ctx->staging_block);
+	while (length != 0) {
+		uint8_t *ptr;
 
-			if (ctx->blockIndex == 0 ||
-			    ctx->authDataCount == ctx->authDataLength) {
-				/*
-				 * We're done with this block, so we
-				 * xor staging_block with block, and then
-				 * encrypt it.
-				 */
-				xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
-				bzero(ctx->staging_block, sizeof(ctx->staging_block));
-				ctx->blockIndex = 0;
-				if (ctx->authDataCount >= ctx->authDataLength)
-					break;
-			}
-		}
 		/*
-		 * We'd like to be able to check length == 0 and return
-		 * here, but the way OCF calls us, length is always
-		 * blksize (16, in this case).  So we have to count on
-		 * the fact that OCF calls us separately for the AAD and
-		 * for the real data.
+		 * If there is no partial block and the length is at
+		 * least a full block, encrypt the full block without
+		 * copying to the staging block.
 		 */
-		return (0);
-	}
-	/*
-	 * If we're here, then we're encoding payload data.
-	 * This is marginally easier, except that _Update can
-	 * be called with non-aligned update lengths. As a result,
-	 * we still need to use the staging block.
-	 */
-	KASSERT((length + ctx->cryptDataCount) <= ctx->cryptDataLength,
-	    ("More encryption data than allowed"));
+		if (ctx->blockIndex == 0 && length >= CCM_CBC_BLOCK_LEN) {
+			xor_and_encrypt(ctx, data, ctx->block);
+			length -= CCM_CBC_BLOCK_LEN;
+			data += CCM_CBC_BLOCK_LEN;
+			continue;
+		}
 
-	while (length) {
-		uint8_t *ptr;
-		
 		copy_amt = MIN(sizeof(ctx->staging_block) - ctx->blockIndex,
 		    length);
 		ptr = ctx->staging_block + ctx->blockIndex;
 		bcopy(data, ptr, copy_amt);
 		data += copy_amt;
 		ctx->blockIndex += copy_amt;
-		ctx->cryptDataCount += copy_amt;
 		length -= copy_amt;
 		if (ctx->blockIndex == sizeof(ctx->staging_block)) {
 			/* We've got a full block */
 			xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
 			ctx->blockIndex = 0;
-			bzero(ctx->staging_block, sizeof(ctx->staging_block));
 		}
 	}
 	return (0);
@@ -264,11 +152,12 @@ AES_CBC_MAC_Final(uint8_t *buf, void *vctx)
 	 * left over to encrypt.
 	 */
 	if (ctx->blockIndex != 0) {
+		memset(ctx->staging_block + ctx->blockIndex, 0,
+		    CCM_CBC_BLOCK_LEN - ctx->blockIndex);
 		xor_and_encrypt(ctx, ctx->staging_block, ctx->block);
-		ctx->cryptDataCount += ctx->blockIndex;
-		ctx->blockIndex = 0;
-		explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
 	}
+	explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block));
+
 	bzero(s0, sizeof(s0));
 	s0[0] = (15 - ctx->nonceLength) - 1;
 	bcopy(ctx->nonce, s0 + 1, ctx->nonceLength);
diff --git a/sys/opencrypto/cbc_mac.h b/sys/opencrypto/cbc_mac.h
index 51833a212f6c..50694e5d4b44 100644
--- a/sys/opencrypto/cbc_mac.h
+++ b/sys/opencrypto/cbc_mac.h
@@ -46,13 +46,11 @@
  * the encryption one is similar.
  */
 struct aes_cbc_mac_ctx {
-	uint64_t	authDataLength, authDataCount;
-	uint64_t	cryptDataLength, cryptDataCount;
-	int		blockIndex;
 	uint8_t		staging_block[CCM_CBC_BLOCK_LEN];
 	uint8_t		block[CCM_CBC_BLOCK_LEN];
-	const uint8_t	*nonce;
+	int		blockIndex;
 	int		nonceLength;	/* This one is in bytes, not bits! */
+	const uint8_t	*nonce;
 	/* AES state data */
 	int		rounds;
 	uint32_t	keysched[4*(RIJNDAEL_MAXNR+1)];
diff --git a/sys/opencrypto/cryptosoft.c b/sys/opencrypto/cryptosoft.c
index ae71f0d6c096..e51bade8a3f8 100644
--- a/sys/opencrypto/cryptosoft.c
+++ b/sys/opencrypto/cryptosoft.c
@@ -636,16 +636,69 @@ out:
 	return (error);
 }
 
+static void
+build_ccm_b0(const char *nonce, u_int nonce_length, u_int aad_length,
+    u_int data_length, u_int tag_length, uint8_t *b0)
+{
+	uint8_t *bp;
+	uint8_t flags, L;
+
+	KASSERT(nonce_length >= 7 && nonce_length <= 13,
+	    ("nonce_length must be between 7 and 13 bytes"));
+
+	/*
+	 * Need to determine the L field value.  This is the number of
+	 * bytes needed to specify the length of the message; the length
+	 * is whatever is left in the 16 bytes after specifying flags and
+	 * the nonce.
+	 */
+	L = 15 - nonce_length;
+
+	flags = ((aad_length > 0) << 6) +
+	    (((tag_length - 2) / 2) << 3) +
+	    L - 1;
+
+	/*
+	 * Now we need to set up the first block, which has flags, nonce,
+	 * and the message length.
+	 */
+	b0[0] = flags;
+	memcpy(b0 + 1, nonce, nonce_length);
+	bp = b0 + 1 + nonce_length;
+
+	/* Need to copy L' [aka L-1] bytes of data_length */
+	for (uint8_t *dst = b0 + CCM_CBC_BLOCK_LEN - 1; dst >= bp; dst--) {
+		*dst = data_length;
+		data_length >>= 8;
+	}
+}
+
+/* NB: OCF only supports AAD lengths < 2^32. */
+static int
+build_ccm_aad_length(u_int aad_length, uint8_t *blk)
+{
+	if (aad_length < ((1 << 16) - (1 << 8))) {
+		be16enc(blk, aad_length);
+		return (sizeof(uint16_t));
+	} else {
+		blk[0] = 0xff;
+		blk[1] = 0xfe;
+		be32enc(blk + 2, aad_length);
+		return (2 + sizeof(uint32_t));
+	}
+}
+
 static int
 swcr_ccm_cbc_mac(struct swcr_session *ses, struct cryptop *crp)
 {
-	u_char tag[AES_CBC_MAC_HASH_LEN];
 	u_char iv[AES_BLOCK_LEN];
+	u_char blk[CCM_CBC_BLOCK_LEN];
+	u_char tag[AES_CBC_MAC_HASH_LEN];
 	union authctx ctx;
 	const struct crypto_session_params *csp;
 	struct swcr_auth *swa;
 	const struct auth_hash *axf;
-	int error, ivlen;
+	int error, ivlen, len;
 
 	csp = crypto_get_params(crp->crp_session);
 	swa = &ses->swcr_auth;
@@ -657,25 +710,24 @@ swcr_ccm_cbc_mac(struct swcr_session *ses, struct cryptop *crp)
 	ivlen = csp->csp_ivlen;
 	crypto_read_iv(crp, iv);
 
-	/*
-	 * AES CCM-CBC-MAC needs to know the length of both the auth
-	 * data and payload data before doing the auth computation.
-	 */
-	ctx.aes_cbc_mac_ctx.authDataLength = crp->crp_payload_length;
-	ctx.aes_cbc_mac_ctx.cryptDataLength = 0;
+	/* Supply MAC with IV */
+	axf->Reinit(&ctx, crp->crp_iv, ivlen);
 
-	axf->Reinit(&ctx, iv, ivlen);
-	if (crp->crp_aad != NULL)
-		error = axf->Update(&ctx, crp->crp_aad, crp->crp_aad_length);
-	else
-		error = crypto_apply(crp, crp->crp_payload_start,
-		    crp->crp_payload_length, axf->Update, &ctx);
-	if (error)
-		return (error);
+	/* Supply MAC with b0. */
+	build_ccm_b0(crp->crp_iv, ivlen, crp->crp_payload_length, 0,
+	    swa->sw_mlen, blk);
+	axf->Update(&ctx, blk, CCM_CBC_BLOCK_LEN);
+
+	len = build_ccm_aad_length(crp->crp_payload_length, blk);
+	axf->Update(&ctx, blk, len);
+
+	crypto_apply(crp, crp->crp_payload_start, crp->crp_payload_length,
+	    axf->Update, &ctx);
 
 	/* Finalize MAC */
 	axf->Final(tag, &ctx);
 
+	error = 0;
 	if (crp->crp_op & CRYPTO_OP_VERIFY_DIGEST) {
 		u_char tag2[AES_CBC_MAC_HASH_LEN];
 
@@ -689,6 +741,7 @@ swcr_ccm_cbc_mac(struct swcr_session *ses, struct cryptop *crp)
 		crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
 	}
 	explicit_bzero(tag, sizeof(tag));
+	explicit_bzero(blk, sizeof(blk));
 	explicit_bzero(iv, sizeof(iv));
 	return (error);
 }
@@ -733,24 +786,35 @@ swcr_ccm(struct swcr_session *ses, struct cryptop *crp)
 
 	ivlen = csp->csp_ivlen;
 
-	/*
-	 * AES CCM-CBC-MAC needs to know the length of both the auth
-	 * data and payload data before doing the auth computation.
-	 */
-	ctx.aes_cbc_mac_ctx.authDataLength = crp->crp_aad_length;
-	ctx.aes_cbc_mac_ctx.cryptDataLength = crp->crp_payload_length;
-
 	/* Supply MAC with IV */
 	axf->Reinit(&ctx, crp->crp_iv, ivlen);
 
+	/* Supply MAC with b0. */
+	_Static_assert(sizeof(blkbuf) >= CCM_CBC_BLOCK_LEN,
+	    "blkbuf too small for b0");
+	build_ccm_b0(crp->crp_iv, ivlen, crp->crp_aad_length,
+	    crp->crp_payload_length, swa->sw_mlen, blk);
+	axf->Update(&ctx, blk, CCM_CBC_BLOCK_LEN);
+
 	/* Supply MAC with AAD */
-	if (crp->crp_aad != NULL)
-		error = axf->Update(&ctx, crp->crp_aad, crp->crp_aad_length);
-	else
-		error = crypto_apply(crp, crp->crp_aad_start,
-		    crp->crp_aad_length, axf->Update, &ctx);
-	if (error)
-		return (error);
+	if (crp->crp_aad_length != 0) {
+		len = build_ccm_aad_length(crp->crp_aad_length, blk);
+		axf->Update(&ctx, blk, len);
+		if (crp->crp_aad != NULL)
+			axf->Update(&ctx, crp->crp_aad,
+			    crp->crp_aad_length);
+		else
+			crypto_apply(crp, crp->crp_aad_start,
+			    crp->crp_aad_length, axf->Update, &ctx);
+
+		/* Pad the AAD (including length field) to a full block. */
+		len = (len + crp->crp_aad_length) % CCM_CBC_BLOCK_LEN;
+		if (len != 0) {
+			len = CCM_CBC_BLOCK_LEN - len;
+			memset(blk, 0, CCM_CBC_BLOCK_LEN);
+			axf->Update(&ctx, blk, len);
+		}
+	}
 
 	if (crp->crp_cipher_key != NULL)
 		exf->setkey(swe->sw_kschedule, crp->crp_cipher_key,