From 4361c4eb6e3620e68d005c1671fdbf60b1fe83c6 Mon Sep 17 00:00:00 2001 From: John Baldwin Date: Wed, 6 Oct 2021 14:08:48 -0700 Subject: cryptosoft: Fix support for variable tag lengths in AES-CCM. The tag length is included as one of the values in the flags byte of block 0 passed to CBC_MAC, so merely copying the first N bytes is insufficient. To avoid adding more sideband data to the CBC MAC software context, pull the generation of block 0, the AAD length, and AAD padding out of cbc_mac.c and into cryptosoft.c. This matches how GCM/GMAC are handled where the length block is constructed in cryptosoft.c and passed as an input to the Update callback. As a result, the CBC MAC Update() routine is now much simpler and simply performs the XOR-and-encrypt step on each input block. While here, avoid a copy to the staging block in the Update routine when one or more full blocks are passed as input to the Update callback. Reviewed by: sef Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D32120 --- sys/opencrypto/cbc_mac.c | 157 +++++++---------------------------------------- 1 file changed, 23 insertions(+), 134 deletions(-) (limited to 'sys/opencrypto/cbc_mac.c') diff --git a/sys/opencrypto/cbc_mac.c b/sys/opencrypto/cbc_mac.c index 40afae5373bf..9a030cd54173 100644 --- a/sys/opencrypto/cbc_mac.c +++ b/sys/opencrypto/cbc_mac.c @@ -75,85 +75,23 @@ AES_CBC_MAC_Setkey(void *vctx, const uint8_t *key, u_int klen) /* * This is called to set the nonce, aka IV. - * Before this call, the authDataLength and cryptDataLength fields - * MUST have been set. Sadly, there's no way to return an error. * - * The CBC-MAC algorithm requires that the first block contain the - * nonce, as well as information about the sizes and lengths involved. + * Note that the caller is responsible for constructing b0 as well + * as the length and padding around the AAD and passing that data + * to _Update. */ void AES_CBC_MAC_Reinit(void *vctx, const uint8_t *nonce, u_int nonceLen) { struct aes_cbc_mac_ctx *ctx = vctx; - uint8_t b0[CCM_CBC_BLOCK_LEN]; - uint8_t *bp = b0, flags = 0; - uint8_t L = 0; - uint64_t dataLength = ctx->cryptDataLength; - - KASSERT(nonceLen >= 7 && nonceLen <= 13, - ("nonceLen must be between 7 and 13 bytes")); ctx->nonce = nonce; ctx->nonceLength = nonceLen; - - ctx->authDataCount = 0; + ctx->blockIndex = 0; - explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block)); - - /* - * Need to determine the L field value. This is the number of - * bytes needed to specify the length of the message; the length - * is whatever is left in the 16 bytes after specifying flags and - * the nonce. - */ - L = 15 - nonceLen; - - flags = ((ctx->authDataLength > 0) << 6) + - (((AES_CBC_MAC_HASH_LEN - 2) / 2) << 3) + - L - 1; - /* - * Now we need to set up the first block, which has flags, nonce, - * and the message length. - */ - b0[0] = flags; - bcopy(nonce, b0 + 1, nonceLen); - bp = b0 + 1 + nonceLen; - /* Need to copy L' [aka L-1] bytes of cryptDataLength */ - for (uint8_t *dst = b0 + sizeof(b0) - 1; dst >= bp; dst--) { - *dst = dataLength; - dataLength >>= 8; - } - /* Now need to encrypt b0 */ - rijndaelEncrypt(ctx->keysched, ctx->rounds, b0, ctx->block); - /* If there is auth data, we need to set up the staging block */ - if (ctx->authDataLength) { - size_t addLength; - if (ctx->authDataLength < ((1<<16) - (1<<8))) { - uint16_t sizeVal = htobe16(ctx->authDataLength); - bcopy(&sizeVal, ctx->staging_block, sizeof(sizeVal)); - addLength = sizeof(sizeVal); - } else if (ctx->authDataLength < (1ULL<<32)) { - uint32_t sizeVal = htobe32(ctx->authDataLength); - ctx->staging_block[0] = 0xff; - ctx->staging_block[1] = 0xfe; - bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal)); - addLength = 2 + sizeof(sizeVal); - } else { - uint64_t sizeVal = htobe64(ctx->authDataLength); - ctx->staging_block[0] = 0xff; - ctx->staging_block[1] = 0xff; - bcopy(&sizeVal, ctx->staging_block+2, sizeof(sizeVal)); - addLength = 2 + sizeof(sizeVal); - } - ctx->blockIndex = addLength; - /* - * The length descriptor goes into the AAD buffer, so we - * need to account for it. - */ - ctx->authDataLength += addLength; - ctx->authDataCount = addLength; - } + /* XOR b0 with all 0's on first call to _Update. */ + memset(ctx->block, 0, CCM_CBC_BLOCK_LEN); } int @@ -167,85 +105,35 @@ AES_CBC_MAC_Update(void *vctx, const void *vdata, u_int length) data = vdata; /* - * This will be called in one of two phases: - * (1) Applying authentication data, or - * (2) Applying the payload data. - * - * Because CBC-MAC puts the authentication data size before the - * data, subsequent calls won't be block-size-aligned. Which - * complicates things a fair bit. - * - * The payload data doesn't have that problem. + * _Update can be called with non-aligned update lengths. Use + * the staging block when necessary. */ - - if (ctx->authDataCount < ctx->authDataLength) { - /* - * We need to process data as authentication data. - * Since we may be out of sync, we may also need - * to pad out the staging block. - */ - const uint8_t *ptr = data; - while (length > 0) { - - copy_amt = MIN(length, - sizeof(ctx->staging_block) - ctx->blockIndex); - - bcopy(ptr, ctx->staging_block + ctx->blockIndex, - copy_amt); - ptr += copy_amt; - length -= copy_amt; - ctx->authDataCount += copy_amt; - ctx->blockIndex += copy_amt; - ctx->blockIndex %= sizeof(ctx->staging_block); + while (length != 0) { + uint8_t *ptr; - if (ctx->blockIndex == 0 || - ctx->authDataCount == ctx->authDataLength) { - /* - * We're done with this block, so we - * xor staging_block with block, and then - * encrypt it. - */ - xor_and_encrypt(ctx, ctx->staging_block, ctx->block); - bzero(ctx->staging_block, sizeof(ctx->staging_block)); - ctx->blockIndex = 0; - if (ctx->authDataCount >= ctx->authDataLength) - break; - } - } /* - * We'd like to be able to check length == 0 and return - * here, but the way OCF calls us, length is always - * blksize (16, in this case). So we have to count on - * the fact that OCF calls us separately for the AAD and - * for the real data. + * If there is no partial block and the length is at + * least a full block, encrypt the full block without + * copying to the staging block. */ - return (0); - } - /* - * If we're here, then we're encoding payload data. - * This is marginally easier, except that _Update can - * be called with non-aligned update lengths. As a result, - * we still need to use the staging block. - */ - KASSERT((length + ctx->cryptDataCount) <= ctx->cryptDataLength, - ("More encryption data than allowed")); + if (ctx->blockIndex == 0 && length >= CCM_CBC_BLOCK_LEN) { + xor_and_encrypt(ctx, data, ctx->block); + length -= CCM_CBC_BLOCK_LEN; + data += CCM_CBC_BLOCK_LEN; + continue; + } - while (length) { - uint8_t *ptr; - copy_amt = MIN(sizeof(ctx->staging_block) - ctx->blockIndex, length); ptr = ctx->staging_block + ctx->blockIndex; bcopy(data, ptr, copy_amt); data += copy_amt; ctx->blockIndex += copy_amt; - ctx->cryptDataCount += copy_amt; length -= copy_amt; if (ctx->blockIndex == sizeof(ctx->staging_block)) { /* We've got a full block */ xor_and_encrypt(ctx, ctx->staging_block, ctx->block); ctx->blockIndex = 0; - bzero(ctx->staging_block, sizeof(ctx->staging_block)); } } return (0); @@ -264,11 +152,12 @@ AES_CBC_MAC_Final(uint8_t *buf, void *vctx) * left over to encrypt. */ if (ctx->blockIndex != 0) { + memset(ctx->staging_block + ctx->blockIndex, 0, + CCM_CBC_BLOCK_LEN - ctx->blockIndex); xor_and_encrypt(ctx, ctx->staging_block, ctx->block); - ctx->cryptDataCount += ctx->blockIndex; - ctx->blockIndex = 0; - explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block)); } + explicit_bzero(ctx->staging_block, sizeof(ctx->staging_block)); + bzero(s0, sizeof(s0)); s0[0] = (15 - ctx->nonceLength) - 1; bcopy(ctx->nonce, s0 + 1, ctx->nonceLength); -- cgit v1.2.3