ccm.c

00001 /*
00002  *  NIST SP800-38C compliant CCM implementation
00003  *
00004  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
00005  *  SPDX-License-Identifier: Apache-2.0
00006  *
00007  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
00008  *  not use this file except in compliance with the License.
00009  *  You may obtain a copy of the License at
00010  *
00011  *  http://www.apache.org/licenses/LICENSE-2.0
00012  *
00013  *  Unless required by applicable law or agreed to in writing, software
00014  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
00015  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
00016  *  See the License for the specific language governing permissions and
00017  *  limitations under the License.
00018  *
00019  *  This file is part of mbed TLS (https://tls.mbed.org)
00020  */
00021 
00022 /*
00023  * Definition of CCM:
00024  * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf
00025  * RFC 3610 "Counter with CBC-MAC (CCM)"
00026  *
00027  * Related:
00028  * RFC 5116 "An Interface and Algorithms for Authenticated Encryption"
00029  */
00030 
00031 #if !defined(MBEDTLS_CONFIG_FILE)
00032 #include "mbedtls/config.h"
00033 #else
00034 #include MBEDTLS_CONFIG_FILE
00035 #endif
00036 
00037 #if defined(MBEDTLS_CCM_C)
00038 
00039 #include "mbedtls/ccm.h"
00040 #include "mbedtls/platform_util.h"
00041 
00042 #include <string.h>
00043 
00044 #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
00045 #if defined(MBEDTLS_PLATFORM_C)
00046 #include "mbedtls/platform.h"
00047 #else
00048 #include <stdio.h>
00049 #define mbedtls_printf printf
00050 #endif /* MBEDTLS_PLATFORM_C */
00051 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
00052 
00053 #if !defined(MBEDTLS_CCM_ALT)
00054 
00055 #define CCM_VALIDATE_RET( cond ) \
00056     MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_CCM_BAD_INPUT )
00057 #define CCM_VALIDATE( cond ) \
00058     MBEDTLS_INTERNAL_VALIDATE( cond )
00059 
00060 #define CCM_ENCRYPT 0
00061 #define CCM_DECRYPT 1
00062 
00063 /*
00064  * Initialize context
00065  */
00066 void mbedtls_ccm_init( mbedtls_ccm_context *ctx )
00067 {
00068     CCM_VALIDATE( ctx != NULL );
00069     memset( ctx, 0, sizeof( mbedtls_ccm_context ) );
00070 }
00071 
00072 int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx,
00073                         mbedtls_cipher_id_t cipher,
00074                         const unsigned char *key,
00075                         unsigned int keybits )
00076 {
00077     int ret;
00078     const mbedtls_cipher_info_t *cipher_info;
00079 
00080     CCM_VALIDATE_RET( ctx != NULL );
00081     CCM_VALIDATE_RET( key != NULL );
00082 
00083     cipher_info = mbedtls_cipher_info_from_values( cipher, keybits,
00084                                                    MBEDTLS_MODE_ECB );
00085     if( cipher_info == NULL )
00086         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00087 
00088     if( cipher_info->block_size != 16 )
00089         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00090 
00091     mbedtls_cipher_free( &ctx->cipher_ctx  );
00092 
00093     if( ( ret = mbedtls_cipher_setup( &ctx->cipher_ctx , cipher_info ) ) != 0 )
00094         return( ret );
00095 
00096     if( ( ret = mbedtls_cipher_setkey( &ctx->cipher_ctx , key, keybits,
00097                                MBEDTLS_ENCRYPT ) ) != 0 )
00098     {
00099         return( ret );
00100     }
00101 
00102     return( 0 );
00103 }
00104 
00105 /*
00106  * Free context
00107  */
00108 void mbedtls_ccm_free( mbedtls_ccm_context *ctx )
00109 {
00110     if( ctx == NULL )
00111         return;
00112     mbedtls_cipher_free( &ctx->cipher_ctx  );
00113     mbedtls_platform_zeroize( ctx, sizeof( mbedtls_ccm_context ) );
00114 }
00115 
00116 /*
00117  * Macros for common operations.
00118  * Results in smaller compiled code than static inline functions.
00119  */
00120 
00121 /*
00122  * Update the CBC-MAC state in y using a block in b
00123  * (Always using b as the source helps the compiler optimise a bit better.)
00124  */
00125 #define UPDATE_CBC_MAC                                                      \
00126     for( i = 0; i < 16; i++ )                                               \
00127         y[i] ^= b[i];                                                       \
00128                                                                             \
00129     if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, y, 16, y, &olen ) ) != 0 ) \
00130         return( ret );
00131 
00132 /*
00133  * Encrypt or decrypt a partial block with CTR
00134  * Warning: using b for temporary storage! src and dst must not be b!
00135  * This avoids allocating one more 16 bytes buffer while allowing src == dst.
00136  */
00137 #define CTR_CRYPT( dst, src, len  )                                            \
00138     do                                                                  \
00139     {                                                                   \
00140         if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, ctr,       \
00141                                            16, b, &olen ) ) != 0 )      \
00142         {                                                               \
00143             return( ret );                                              \
00144         }                                                               \
00145                                                                         \
00146         for( i = 0; i < (len); i++ )                                    \
00147             (dst)[i] = (src)[i] ^ b[i];                                 \
00148     } while( 0 )
00149 
00150 /*
00151  * Authenticated encryption or decryption
00152  */
00153 static int ccm_auth_crypt( mbedtls_ccm_context *ctx, int mode, size_t length,
00154                            const unsigned char *iv, size_t iv_len,
00155                            const unsigned char *add, size_t add_len,
00156                            const unsigned char *input, unsigned char *output,
00157                            unsigned char *tag, size_t tag_len )
00158 {
00159     int ret;
00160     unsigned char i;
00161     unsigned char q;
00162     size_t len_left, olen;
00163     unsigned char b[16];
00164     unsigned char y[16];
00165     unsigned char ctr[16];
00166     const unsigned char *src;
00167     unsigned char *dst;
00168 
00169     /*
00170      * Check length requirements: SP800-38C A.1
00171      * Additional requirement: a < 2^16 - 2^8 to simplify the code.
00172      * 'length' checked later (when writing it to the first block)
00173      *
00174      * Also, loosen the requirements to enable support for CCM* (IEEE 802.15.4).
00175      */
00176     if( tag_len == 2 || tag_len > 16 || tag_len % 2 != 0 )
00177         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00178 
00179     /* Also implies q is within bounds */
00180     if( iv_len < 7 || iv_len > 13 )
00181         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00182 
00183     if( add_len > 0xFF00 )
00184         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00185 
00186     q = 16 - 1 - (unsigned char) iv_len;
00187 
00188     /*
00189      * First block B_0:
00190      * 0        .. 0        flags
00191      * 1        .. iv_len   nonce (aka iv)
00192      * iv_len+1 .. 15       length
00193      *
00194      * With flags as (bits):
00195      * 7        0
00196      * 6        add present?
00197      * 5 .. 3   (t - 2) / 2
00198      * 2 .. 0   q - 1
00199      */
00200     b[0] = 0;
00201     b[0] |= ( add_len > 0 ) << 6;
00202     b[0] |= ( ( tag_len - 2 ) / 2 ) << 3;
00203     b[0] |= q - 1;
00204 
00205     memcpy( b + 1, iv, iv_len );
00206 
00207     for( i = 0, len_left = length; i < q; i++, len_left >>= 8 )
00208         b[15-i] = (unsigned char)( len_left & 0xFF );
00209 
00210     if( len_left > 0 )
00211         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00212 
00213 
00214     /* Start CBC-MAC with first block */
00215     memset( y, 0, 16 );
00216     UPDATE_CBC_MAC;
00217 
00218     /*
00219      * If there is additional data, update CBC-MAC with
00220      * add_len, add, 0 (padding to a block boundary)
00221      */
00222     if( add_len > 0 )
00223     {
00224         size_t use_len;
00225         len_left = add_len;
00226         src = add;
00227 
00228         memset( b, 0, 16 );
00229         b[0] = (unsigned char)( ( add_len >> 8 ) & 0xFF );
00230         b[1] = (unsigned char)( ( add_len      ) & 0xFF );
00231 
00232         use_len = len_left < 16 - 2 ? len_left : 16 - 2;
00233         memcpy( b + 2, src, use_len );
00234         len_left -= use_len;
00235         src += use_len;
00236 
00237         UPDATE_CBC_MAC;
00238 
00239         while( len_left > 0 )
00240         {
00241             use_len = len_left > 16 ? 16 : len_left;
00242 
00243             memset( b, 0, 16 );
00244             memcpy( b, src, use_len );
00245             UPDATE_CBC_MAC;
00246 
00247             len_left -= use_len;
00248             src += use_len;
00249         }
00250     }
00251 
00252     /*
00253      * Prepare counter block for encryption:
00254      * 0        .. 0        flags
00255      * 1        .. iv_len   nonce (aka iv)
00256      * iv_len+1 .. 15       counter (initially 1)
00257      *
00258      * With flags as (bits):
00259      * 7 .. 3   0
00260      * 2 .. 0   q - 1
00261      */
00262     ctr[0] = q - 1;
00263     memcpy( ctr + 1, iv, iv_len );
00264     memset( ctr + 1 + iv_len, 0, q );
00265     ctr[15] = 1;
00266 
00267     /*
00268      * Authenticate and {en,de}crypt the message.
00269      *
00270      * The only difference between encryption and decryption is
00271      * the respective order of authentication and {en,de}cryption.
00272      */
00273     len_left = length;
00274     src = input;
00275     dst = output;
00276 
00277     while( len_left > 0 )
00278     {
00279         size_t use_len = len_left > 16 ? 16 : len_left;
00280 
00281         if( mode == CCM_ENCRYPT )
00282         {
00283             memset( b, 0, 16 );
00284             memcpy( b, src, use_len );
00285             UPDATE_CBC_MAC;
00286         }
00287 
00288         CTR_CRYPT( dst, src, use_len );
00289 
00290         if( mode == CCM_DECRYPT )
00291         {
00292             memset( b, 0, 16 );
00293             memcpy( b, dst, use_len );
00294             UPDATE_CBC_MAC;
00295         }
00296 
00297         dst += use_len;
00298         src += use_len;
00299         len_left -= use_len;
00300 
00301         /*
00302          * Increment counter.
00303          * No need to check for overflow thanks to the length check above.
00304          */
00305         for( i = 0; i < q; i++ )
00306             if( ++ctr[15-i] != 0 )
00307                 break;
00308     }
00309 
00310     /*
00311      * Authentication: reset counter and crypt/mask internal tag
00312      */
00313     for( i = 0; i < q; i++ )
00314         ctr[15-i] = 0;
00315 
00316     CTR_CRYPT( y, y, 16 );
00317     memcpy( tag, y, tag_len );
00318 
00319     return( 0 );
00320 }
00321 
00322 /*
00323  * Authenticated encryption
00324  */
00325 int mbedtls_ccm_star_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
00326                          const unsigned char *iv, size_t iv_len,
00327                          const unsigned char *add, size_t add_len,
00328                          const unsigned char *input, unsigned char *output,
00329                          unsigned char *tag, size_t tag_len )
00330 {
00331     CCM_VALIDATE_RET( ctx != NULL );
00332     CCM_VALIDATE_RET( iv != NULL );
00333     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
00334     CCM_VALIDATE_RET( length == 0 || input != NULL );
00335     CCM_VALIDATE_RET( length == 0 || output != NULL );
00336     CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
00337     return( ccm_auth_crypt( ctx, CCM_ENCRYPT, length, iv, iv_len,
00338                             add, add_len, input, output, tag, tag_len ) );
00339 }
00340 
00341 int mbedtls_ccm_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
00342                          const unsigned char *iv, size_t iv_len,
00343                          const unsigned char *add, size_t add_len,
00344                          const unsigned char *input, unsigned char *output,
00345                          unsigned char *tag, size_t tag_len )
00346 {
00347     CCM_VALIDATE_RET( ctx != NULL );
00348     CCM_VALIDATE_RET( iv != NULL );
00349     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
00350     CCM_VALIDATE_RET( length == 0 || input != NULL );
00351     CCM_VALIDATE_RET( length == 0 || output != NULL );
00352     CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
00353     if( tag_len == 0 )
00354         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00355 
00356     return( mbedtls_ccm_star_encrypt_and_tag( ctx, length, iv, iv_len, add,
00357                 add_len, input, output, tag, tag_len ) );
00358 }
00359 
00360 /*
00361  * Authenticated decryption
00362  */
00363 int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
00364                       const unsigned char *iv, size_t iv_len,
00365                       const unsigned char *add, size_t add_len,
00366                       const unsigned char *input, unsigned char *output,
00367                       const unsigned char *tag, size_t tag_len )
00368 {
00369     int ret;
00370     unsigned char check_tag[16];
00371     unsigned char i;
00372     int diff;
00373 
00374     CCM_VALIDATE_RET( ctx != NULL );
00375     CCM_VALIDATE_RET( iv != NULL );
00376     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
00377     CCM_VALIDATE_RET( length == 0 || input != NULL );
00378     CCM_VALIDATE_RET( length == 0 || output != NULL );
00379     CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
00380 
00381     if( ( ret = ccm_auth_crypt( ctx, CCM_DECRYPT, length,
00382                                 iv, iv_len, add, add_len,
00383                                 input, output, check_tag, tag_len ) ) != 0 )
00384     {
00385         return( ret );
00386     }
00387 
00388     /* Check tag in "constant-time" */
00389     for( diff = 0, i = 0; i < tag_len; i++ )
00390         diff |= tag[i] ^ check_tag[i];
00391 
00392     if( diff != 0 )
00393     {
00394         mbedtls_platform_zeroize( output, length );
00395         return( MBEDTLS_ERR_CCM_AUTH_FAILED );
00396     }
00397 
00398     return( 0 );
00399 }
00400 
00401 int mbedtls_ccm_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
00402                       const unsigned char *iv, size_t iv_len,
00403                       const unsigned char *add, size_t add_len,
00404                       const unsigned char *input, unsigned char *output,
00405                       const unsigned char *tag, size_t tag_len )
00406 {
00407     CCM_VALIDATE_RET( ctx != NULL );
00408     CCM_VALIDATE_RET( iv != NULL );
00409     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
00410     CCM_VALIDATE_RET( length == 0 || input != NULL );
00411     CCM_VALIDATE_RET( length == 0 || output != NULL );
00412     CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
00413 
00414     if( tag_len == 0 )
00415         return( MBEDTLS_ERR_CCM_BAD_INPUT );
00416 
00417     return( mbedtls_ccm_star_auth_decrypt( ctx, length, iv, iv_len, add,
00418                 add_len, input, output, tag, tag_len ) );
00419 }
00420 #endif /* !MBEDTLS_CCM_ALT */
00421 
00422 #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
00423 /*
00424  * Examples 1 to 3 from SP800-38C Appendix C
00425  */
00426 
00427 #define NB_TESTS 3
00428 #define CCM_SELFTEST_PT_MAX_LEN 24
00429 #define CCM_SELFTEST_CT_MAX_LEN 32
00430 /*
00431  * The data is the same for all tests, only the used length changes
00432  */
00433 static const unsigned char key_test_data[] = {
00434     0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
00435     0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f
00436 };
00437 
00438 static const unsigned char iv_test_data[] = {
00439     0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
00440     0x18, 0x19, 0x1a, 0x1b
00441 };
00442 
00443 static const unsigned char ad_test_data[] = {
00444     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
00445     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
00446     0x10, 0x11, 0x12, 0x13
00447 };
00448 
00449 static const unsigned char msg_test_data[CCM_SELFTEST_PT_MAX_LEN] = {
00450     0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
00451     0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
00452     0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
00453 };
00454 
00455 static const size_t iv_len_test_data [NB_TESTS] = { 7, 8,  12 };
00456 static const size_t add_len_test_data[NB_TESTS] = { 8, 16, 20 };
00457 static const size_t msg_len_test_data[NB_TESTS] = { 4, 16, 24 };
00458 static const size_t tag_len_test_data[NB_TESTS] = { 4, 6,  8  };
00459 
00460 static const unsigned char res_test_data[NB_TESTS][CCM_SELFTEST_CT_MAX_LEN] = {
00461     {   0x71, 0x62, 0x01, 0x5b, 0x4d, 0xac, 0x25, 0x5d },
00462     {   0xd2, 0xa1, 0xf0, 0xe0, 0x51, 0xea, 0x5f, 0x62,
00463         0x08, 0x1a, 0x77, 0x92, 0x07, 0x3d, 0x59, 0x3d,
00464         0x1f, 0xc6, 0x4f, 0xbf, 0xac, 0xcd },
00465     {   0xe3, 0xb2, 0x01, 0xa9, 0xf5, 0xb7, 0x1a, 0x7a,
00466         0x9b, 0x1c, 0xea, 0xec, 0xcd, 0x97, 0xe7, 0x0b,
00467         0x61, 0x76, 0xaa, 0xd9, 0xa4, 0x42, 0x8a, 0xa5,
00468         0x48, 0x43, 0x92, 0xfb, 0xc1, 0xb0, 0x99, 0x51 }
00469 };
00470 
00471 int mbedtls_ccm_self_test( int verbose )
00472 {
00473     mbedtls_ccm_context ctx;
00474     /*
00475      * Some hardware accelerators require the input and output buffers
00476      * would be in RAM, because the flash is not accessible.
00477      * Use buffers on the stack to hold the test vectors data.
00478      */
00479     unsigned char plaintext[CCM_SELFTEST_PT_MAX_LEN];
00480     unsigned char ciphertext[CCM_SELFTEST_CT_MAX_LEN];
00481     size_t i;
00482     int ret;
00483 
00484     mbedtls_ccm_init( &ctx );
00485 
00486     if( mbedtls_ccm_setkey( &ctx, MBEDTLS_CIPHER_ID_AES, key_test_data,
00487                             8 * sizeof key_test_data ) != 0 )
00488     {
00489         if( verbose != 0 )
00490             mbedtls_printf( "  CCM: setup failed" );
00491 
00492         return( 1 );
00493     }
00494 
00495     for( i = 0; i < NB_TESTS; i++ )
00496     {
00497         if( verbose != 0 )
00498             mbedtls_printf( "  CCM-AES #%u: ", (unsigned int) i + 1 );
00499 
00500         memset( plaintext, 0, CCM_SELFTEST_PT_MAX_LEN );
00501         memset( ciphertext, 0, CCM_SELFTEST_CT_MAX_LEN );
00502         memcpy( plaintext, msg_test_data, msg_len_test_data[i] );
00503 
00504         ret = mbedtls_ccm_encrypt_and_tag( &ctx, msg_len_test_data[i],
00505                                            iv_test_data, iv_len_test_data[i],
00506                                            ad_test_data, add_len_test_data[i],
00507                                            plaintext, ciphertext,
00508                                            ciphertext + msg_len_test_data[i],
00509                                            tag_len_test_data[i] );
00510 
00511         if( ret != 0 ||
00512             memcmp( ciphertext, res_test_data[i],
00513                     msg_len_test_data[i] + tag_len_test_data[i] ) != 0 )
00514         {
00515             if( verbose != 0 )
00516                 mbedtls_printf( "failed\n" );
00517 
00518             return( 1 );
00519         }
00520         memset( plaintext, 0, CCM_SELFTEST_PT_MAX_LEN );
00521 
00522         ret = mbedtls_ccm_auth_decrypt( &ctx, msg_len_test_data[i],
00523                                         iv_test_data, iv_len_test_data[i],
00524                                         ad_test_data, add_len_test_data[i],
00525                                         ciphertext, plaintext,
00526                                         ciphertext + msg_len_test_data[i],
00527                                         tag_len_test_data[i] );
00528 
00529         if( ret != 0 ||
00530             memcmp( plaintext, msg_test_data, msg_len_test_data[i] ) != 0 )
00531         {
00532             if( verbose != 0 )
00533                 mbedtls_printf( "failed\n" );
00534 
00535             return( 1 );
00536         }
00537 
00538         if( verbose != 0 )
00539             mbedtls_printf( "passed\n" );
00540     }
00541 
00542     mbedtls_ccm_free( &ctx );
00543 
00544     if( verbose != 0 )
00545         mbedtls_printf( "\n" );
00546 
00547     return( 0 );
00548 }
00549 
00550 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
00551 
00552 #endif /* MBEDTLS_CCM_C */