AEAD support. (444b1d41) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

crypto/evp/Makefile

+4 −2

Original line number	Diff line number	Diff line
		@@ -29,7 +29,8 @@ LIBSRC= encode.c digest.c evp_enc.c evp_key.c evp_acnf.c evp_cnf.c \
		c_all.c c_allc.c c_alld.c evp_lib.c bio_ok.c \
		evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c \
		e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c \
		e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c e_rc4_hmac_md5.c
		e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c e_rc4_hmac_md5.c \
		evp_aead.c

		LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o evp_cnf.o \
		e_des.o e_bf.o e_idea.o e_des3.o e_camellia.o\
		@@ -42,7 +43,8 @@ LIBOBJ= encode.o digest.o evp_enc.o evp_key.o evp_acnf.o evp_cnf.o \
		c_all.o c_allc.o c_alld.o evp_lib.o bio_ok.o \
		evp_pkey.o evp_pbe.o p5_crpt.o p5_crpt2.o \
		e_old.o pmeth_lib.o pmeth_fn.o pmeth_gn.o m_sigver.o \
		e_aes_cbc_hmac_sha1.o e_aes_cbc_hmac_sha256.o e_rc4_hmac_md5.o
		e_aes_cbc_hmac_sha1.o e_aes_cbc_hmac_sha256.o e_rc4_hmac_md5.o \
		evp_aead.o

		SRC= $(LIBSRC)

crypto/evp/e_aes.c

+211 −21

Original line number	Diff line number	Diff line
		@@ -1227,47 +1227,48 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX c, int type, int arg, void ptr)
		}
		}

		static int aes_gcm_init_key(EVP_CIPHER_CTX ctx, const unsigned char key,
		const unsigned char *iv, int enc)
		static ctr128_f aes_gcm_set_key(AES_KEY aes_key, GCM128_CONTEXT gcm_ctx,
		const unsigned char *key, size_t key_len)
		{
		EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
		if (!iv && !key)
		return 1;
		if (key)
		{ do {
		#ifdef BSAES_CAPABLE
		if (BSAES_CAPABLE)
		{
		AES_set_encrypt_key(key,ctx->key_len*8,&gctx->ks.ks);
		CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks,
		AES_set_encrypt_key(key,key_len*8,aes_key);
		CRYPTO_gcm128_init(gcm_ctx,aes_key,
		(block128_f)AES_encrypt);
		gctx->ctr = (ctr128_f)bsaes_ctr32_encrypt_blocks;
		break;
		return (ctr128_f)bsaes_ctr32_encrypt_blocks;
		}
		else
		#endif
		#ifdef VPAES_CAPABLE
		if (VPAES_CAPABLE)
		{
		vpaes_set_encrypt_key(key,ctx->key_len*8,&gctx->ks.ks);
		CRYPTO_gcm128_init(&gctx->gcm,&gctx->ks,
		vpaes_set_encrypt_key(key,key_len*8,aes_key);
		CRYPTO_gcm128_init(gcm_ctx,aes_key,
		(block128_f)vpaes_encrypt);
		gctx->ctr = NULL;
		break;
		return NULL;
		}
		else
		#endif
		(void)0; /* terminate potentially open 'else' */

		AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
		CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
		AES_set_encrypt_key(key, key_len*8, aes_key);
		CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f)AES_encrypt);
		#ifdef AES_CTR_ASM
		gctx->ctr = (ctr128_f)AES_ctr32_encrypt;
		return (ctr128_f)AES_ctr32_encrypt;
		#else
		gctx->ctr = NULL;
		return NULL;
		#endif
		} while (0);
		}

		static int aes_gcm_init_key(EVP_CIPHER_CTX ctx, const unsigned char key,
		const unsigned char *iv, int enc)
		{
		EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
		if (!iv && !key)
		return 1;
		if (key)
		{
		gctx->ctr = aes_gcm_set_key(&gctx->ks.ks, &gctx->gcm, key, ctx->key_len);
		/* If we have an iv can set it directly, otherwise use
		* saved IV.
		*/
		@@ -1977,4 +1978,193 @@ const EVP_CIPHER *EVP_aes_256_wrap(void)
		return &aes_256_wrap;
		}

		#define EVP_AEAD_AES_GCM_TAG_LEN 16

		struct aead_aes_gcm_ctx {
		union { double align; AES_KEY ks; } ks;
		GCM128_CONTEXT gcm;
		ctr128_f ctr;
		unsigned char tag_len;
		};

		static int aead_aes_gcm_init(EVP_AEAD_CTX *ctx,
		const unsigned char *key, size_t key_len, size_t tag_len)
		{
		struct aead_aes_gcm_ctx *gcm_ctx;
		const size_t key_bits = key_len * 8;

		if (key_bits != 128 && key_bits != 256)
		{
		EVPerr(EVP_F_AEAD_AES_GCM_INIT, EVP_R_BAD_KEY_LENGTH);
		return 0; /* EVP_AEAD_CTX_init should catch this. */
		}

		if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH)
		tag_len = EVP_AEAD_AES_GCM_TAG_LEN;

		if (tag_len > EVP_AEAD_AES_GCM_TAG_LEN)
		{
		EVPerr(EVP_F_AEAD_AES_GCM_INIT, EVP_R_TAG_TOO_LARGE);
		return 0;
		}

		gcm_ctx = OPENSSL_malloc(sizeof(struct aead_aes_gcm_ctx));
		if (gcm_ctx == NULL)
		return 0;

		#ifdef AESNI_CAPABLE
		if (AESNI_CAPABLE)
		{
		aesni_set_encrypt_key(key, key_bits, &gcm_ctx->ks.ks);
		CRYPTO_gcm128_init(&gcm_ctx->gcm, &gcm_ctx->ks.ks,
		(block128_f)aesni_encrypt);
		gcm_ctx->ctr = (ctr128_f) aesni_ctr32_encrypt_blocks;
		}
		else
		#endif
		{
		gcm_ctx->ctr = aes_gcm_set_key(&gcm_ctx->ks.ks, &gcm_ctx->gcm,
		key, key_len);
		}
		gcm_ctx->tag_len = tag_len;
		ctx->aead_state = gcm_ctx;

		return 1;
		}

		static void aead_aes_gcm_cleanup(EVP_AEAD_CTX *ctx)
		{
		struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
		OPENSSL_free(gcm_ctx);
		}

		static ssize_t aead_aes_gcm_seal(const EVP_AEAD_CTX *ctx,
		unsigned char *out, size_t max_out_len,
		const unsigned char *nonce, size_t nonce_len,
		const unsigned char *in, size_t in_len,
		const unsigned char *ad, size_t ad_len)
		{
		size_t bulk = 0;
		const struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
		GCM128_CONTEXT gcm;

		if (max_out_len < in_len + gcm_ctx->tag_len)
		{
		EVPerr(EVP_F_AEAD_AES_GCM_SEAL, EVP_R_BUFFER_TOO_SMALL);
		return -1;
		}

		memcpy(&gcm, &gcm_ctx->gcm, sizeof(gcm));
		CRYPTO_gcm128_setiv(&gcm, nonce, nonce_len);

		if (ad_len > 0 && CRYPTO_gcm128_aad(&gcm, ad, ad_len))
		return -1;

		if (gcm_ctx->ctr)
		{
		if (CRYPTO_gcm128_encrypt_ctr32(&gcm, in + bulk, out + bulk,
		in_len - bulk, gcm_ctx->ctr))
		return -1;
		}
		else
		{
		if (CRYPTO_gcm128_encrypt(&gcm, in + bulk, out + bulk,
		in_len - bulk))
		return -1;
		}

		CRYPTO_gcm128_tag(&gcm, out + in_len, gcm_ctx->tag_len);
		return in_len + gcm_ctx->tag_len;
		}

		static ssize_t aead_aes_gcm_open(const EVP_AEAD_CTX *ctx,
		unsigned char *out, size_t max_out_len,
		const unsigned char *nonce, size_t nonce_len,
		const unsigned char *in, size_t in_len,
		const unsigned char *ad, size_t ad_len)
		{
		size_t bulk = 0;
		const struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
		unsigned char tag[EVP_AEAD_AES_GCM_TAG_LEN];
		size_t out_len;
		GCM128_CONTEXT gcm;

		if (in_len < gcm_ctx->tag_len)
		{
		EVPerr(EVP_F_AEAD_AES_GCM_OPEN, EVP_R_BAD_DECRYPT);
		return -1;
		}

		out_len = in_len - gcm_ctx->tag_len;

		if (max_out_len < out_len)
		{
		EVPerr(EVP_F_AEAD_AES_GCM_OPEN, EVP_R_BUFFER_TOO_SMALL);
		return -1;
		}

		memcpy(&gcm, &gcm_ctx->gcm, sizeof(gcm));
		CRYPTO_gcm128_setiv(&gcm, nonce, nonce_len);

		if (CRYPTO_gcm128_aad(&gcm, ad, ad_len))
		return -1;

		if (gcm_ctx->ctr)
		{
		if (CRYPTO_gcm128_decrypt_ctr32(&gcm, in + bulk, out + bulk,
		in_len-bulk-gcm_ctx->tag_len,
		gcm_ctx->ctr))
		return -1;
		}
		else
		{
		if (CRYPTO_gcm128_decrypt(&gcm, in + bulk, out + bulk,
		in_len - bulk - gcm_ctx->tag_len))
		return -1;
		}

		CRYPTO_gcm128_tag(&gcm, tag, gcm_ctx->tag_len);
		if (CRYPTO_memcmp(tag, in + out_len, gcm_ctx->tag_len) != 0)
		{
		EVPerr(EVP_F_AEAD_AES_GCM_OPEN, EVP_R_BAD_DECRYPT);
		return -1;
		}

		return out_len;
		}

		static const EVP_AEAD aead_aes_128_gcm = {
		16, /* key len */
		12, /* nonce len */
		EVP_AEAD_AES_GCM_TAG_LEN, /* overhead */
		EVP_AEAD_AES_GCM_TAG_LEN, /* max tag length */

		aead_aes_gcm_init,
		aead_aes_gcm_cleanup,
		aead_aes_gcm_seal,
		aead_aes_gcm_open,
		};

		static const EVP_AEAD aead_aes_256_gcm = {
		32, /* key len */
		12, /* nonce len */
		EVP_AEAD_AES_GCM_TAG_LEN, /* overhead */
		EVP_AEAD_AES_GCM_TAG_LEN, /* max tag length */

		aead_aes_gcm_init,
		aead_aes_gcm_cleanup,
		aead_aes_gcm_seal,
		aead_aes_gcm_open,
		};

		const EVP_AEAD *EVP_aead_aes_128_gcm()
		{
		return &aead_aes_128_gcm;
		}

		const EVP_AEAD *EVP_aead_aes_256_gcm()
		{
		return &aead_aes_256_gcm;
		}

		#endif

crypto/evp/evp.h

+115 −0

Original line number	Diff line number	Diff line
		@@ -1266,6 +1266,111 @@ void EVP_PKEY_meth_set_ctrl(EVP_PKEY_METHOD *pmeth,
		int (ctrl_str)(EVP_PKEY_CTX ctx,
		const char type, const char value));

		/* Authenticated Encryption with Additional Data.
		*
		* AEAD couples confidentiality and integrity in a single primtive. AEAD
		* algorithms take a key and then can seal and open individual messages. Each
		* message has a unique, per-message nonce and, optionally, additional data
		* which is authenticated but not included in the output. */

		struct evp_aead_st;
		typedef struct evp_aead_st EVP_AEAD;

		#ifndef OPENSSL_NO_AES
		/* EVP_aes_128_gcm is AES-128 in Galois Counter Mode. */
		const EVP_AEAD *EVP_aead_aes_128_gcm(void);
		/* EVP_aes_256_gcm is AES-256 in Galois Counter Mode. */
		const EVP_AEAD *EVP_aead_aes_256_gcm(void);
		#endif

		/* EVP_AEAD_key_length returns the length, in bytes, of the keys used by
		* \|aead\|. */
		size_t EVP_AEAD_key_length(const EVP_AEAD *aead);

		/* EVP_AEAD_nonce_length returns the length, in bytes, of the per-message nonce
		* for \|aead\|. */
		size_t EVP_AEAD_nonce_length(const EVP_AEAD *aead);

		/* EVP_AEAD_max_overhead returns the maximum number of additional bytes added
		* by the act of sealing data with \|aead\|. */
		size_t EVP_AEAD_max_overhead(const EVP_AEAD *aead);

		/* EVP_AEAD_max_tag_len returns the maximum tag length when using \|aead\|. This
		* is the largest value that can be passed as \|tag_len\| to
		* \|EVP_AEAD_CTX_init\|. */
		size_t EVP_AEAD_max_tag_len(const EVP_AEAD *aead);

		/* An EVP_AEAD_CTX represents an AEAD algorithm configured with a specific key
		* and message-independent IV. */
		typedef struct evp_aead_ctx_st {
		const EVP_AEAD *aead;
		/* aead_state is an opaque pointer to whatever state the AEAD needs to
		* maintain. */
		void *aead_state;
		} EVP_AEAD_CTX;

		#define EVP_AEAD_DEFAULT_TAG_LENGTH 0

		/* EVP_AEAD_init initializes \|ctx\| for the given AEAD algorithm from \|impl\|.
		* The \|impl\| argument may be NULL to choose the default implementation.
		* Authentication tags may be truncated by passing a size as \|tag_len\|. A
		* \|tag_len\| of zero indicates the default tag length and this is defined as
		* EVP_AEAD_DEFAULT_TAG_LENGTH for readability.
		* Returns 1 on success. Otherwise returns 0 and pushes to the error stack. */
		int EVP_AEAD_CTX_init(EVP_AEAD_CTX ctx, const EVP_AEAD aead,
		const unsigned char *key, size_t key_len,
		size_t tag_len, ENGINE *impl);

		/* EVP_AEAD_CTX_cleanup frees any data allocated by \|ctx\|. */
		void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx);

		/* EVP_AEAD_CTX_seal encrypts and authenticates \|in_len\| bytes from \|in\| and
		* authenticates \|ad_len\| bytes from \|ad\| and writes the result to \|out\|,
		* returning the number of bytes written, or -1 on error.
		*
		* This function may be called (with the same EVP_AEAD_CTX) concurrently with
		* itself or EVP_AEAD_CTX_open.
		*
		* At most \|max_out_len\| bytes are written to \|out\| and, in order to ensure
		* success, \|max_out_len\| should be \|in_len\| plus the result of
		* EVP_AEAD_overhead.
		*
		* The length of \|nonce\|, \|nonce_len\|, must be equal to the result of
		* EVP_AEAD_nonce_length for this AEAD.
		*
		* EVP_AEAD_CTX_seal never results in a partial output. If \|max_out_len\| is
		* insufficient, -1 will be returned.
		*
		* If \|in\| and \|out\| alias then \|out\| must be <= \|in\|. */
		ssize_t EVP_AEAD_CTX_seal(const EVP_AEAD_CTX *ctx,
		unsigned char *out, size_t max_out_len,
		const unsigned char *nonce, size_t nonce_len,
		const unsigned char *in, size_t in_len,
		const unsigned char *ad, size_t ad_len);

		/* EVP_AEAD_CTX_open authenticates \|in_len\| bytes from \|in\| and \|ad_len\| bytes
		* from \|ad\| and decrypts at most \|in_len\| bytes into \|out\|. It returns the
		* number of bytes written, or -1 on error.
		*
		* This function may be called (with the same EVP_AEAD_CTX) concurrently with
		* itself or EVP_AEAD_CTX_seal.
		*
		* At most \|in_len\| bytes are written to \|out\|. In order to ensure success,
		* \|max_out_len\| should be at least \|in_len\|.
		*
		* The length of \|nonce\|, \|nonce_len\|, must be equal to the result of
		* EVP_AEAD_nonce_length for this AEAD.
		*
		* EVP_AEAD_CTX_open never results in a partial output. If \|max_out_len\| is
		* insufficient, -1 will be returned.
		*
		* If \|in\| and \|out\| alias then \|out\| must be <= \|in\|. */
		ssize_t EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx,
		unsigned char *out, size_t max_out_len,
		const unsigned char *nonce, size_t nonce_len,
		const unsigned char *in, size_t in_len,
		const unsigned char *ad, size_t ad_len);

		void EVP_add_alg_module(void);

		/* BEGIN ERROR CODES */
		@@ -1277,6 +1382,11 @@ void ERR_load_EVP_strings(void);
		/* Error codes for the EVP functions. */

		/* Function codes. */
		#define EVP_F_AEAD_AES_GCM_INIT 187
		#define EVP_F_AEAD_AES_GCM_OPEN 188
		#define EVP_F_AEAD_AES_GCM_SEAL 189
		#define EVP_F_AEAD_CTX_OPEN 185
		#define EVP_F_AEAD_CTX_SEAL 186
		#define EVP_F_AESNI_INIT_KEY 165
		#define EVP_F_AESNI_XTS_CIPHER 176
		#define EVP_F_AES_INIT_KEY 133
		@@ -1293,6 +1403,9 @@ void ERR_load_EVP_strings(void);
		#define EVP_F_DSA_PKEY2PKCS8 135
		#define EVP_F_ECDSA_PKEY2PKCS8 129
		#define EVP_F_ECKEY_PKEY2PKCS8 132
		#define EVP_F_EVP_AEAD_CTX_INIT 180
		#define EVP_F_EVP_AEAD_CTX_OPEN 190
		#define EVP_F_EVP_AEAD_CTX_SEAL 191
		#define EVP_F_EVP_CIPHERINIT_EX 123
		#define EVP_F_EVP_CIPHER_CTX_COPY 163
		#define EVP_F_EVP_CIPHER_CTX_CTRL 124
		@@ -1408,10 +1521,12 @@ void ERR_load_EVP_strings(void);
		#define EVP_R_NO_VERIFY_FUNCTION_CONFIGURED 105
		#define EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 150
		#define EVP_R_OPERATON_NOT_INITIALIZED 151
		#define EVP_R_OUTPUT_ALIASES_INPUT 172
		#define EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE 117
		#define EVP_R_PRIVATE_KEY_DECODE_ERROR 145
		#define EVP_R_PRIVATE_KEY_ENCODE_ERROR 146
		#define EVP_R_PUBLIC_KEY_NOT_RSA 106
		#define EVP_R_TAG_TOO_LARGE 171
		#define EVP_R_TOO_LARGE 164
		#define EVP_R_UNKNOWN_CIPHER 160
		#define EVP_R_UNKNOWN_DIGEST 161

crypto/evp/evp_aead.c

0 → 100644

+192 −0

Original line number	Diff line number	Diff line
		/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
		* All rights reserved.
		*
		* This package is an SSL implementation written
		* by Eric Young (eay@cryptsoft.com).
		* The implementation was written so as to conform with Netscapes SSL.
		*
		* This library is free for commercial and non-commercial use as long as
		* the following conditions are aheared to. The following conditions
		* apply to all code found in this distribution, be it the RC4, RSA,
		* lhash, DES, etc., code; not just the SSL code. The SSL documentation
		* included with this distribution is covered by the same copyright terms
		* except that the holder is Tim Hudson (tjh@cryptsoft.com).
		*
		* Copyright remains Eric Young's, and as such any Copyright notices in
		* the code are not to be removed.
		* If this package is used in a product, Eric Young should be given attribution
		* as the author of the parts of the library used.
		* This can be in the form of a textual message at program startup or
		* in documentation (online or textual) provided with the package.
		*
		* Redistribution and use in source and binary forms, with or without
		* modification, are permitted provided that the following conditions
		* are met:
		* 1. Redistributions of source code must retain the copyright
		* notice, this list of conditions and the following disclaimer.
		* 2. Redistributions in binary form must reproduce the above copyright
		* notice, this list of conditions and the following disclaimer in the
		* documentation and/or other materials provided with the distribution.
		* 3. All advertising materials mentioning features or use of this software
		* must display the following acknowledgement:
		* "This product includes cryptographic software written by
		* Eric Young (eay@cryptsoft.com)"
		* The word 'cryptographic' can be left out if the rouines from the library
		* being used are not cryptographic related :-).
		* 4. If you include any Windows specific code (or a derivative thereof) from
		* the apps directory (application code) you must include an acknowledgement:
		* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
		*
		* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
		* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
		* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
		* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
		* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
		* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
		* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
		* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
		* SUCH DAMAGE.
		*
		* The licence and distribution terms for any publically available version or
		* derivative of this code cannot be changed. i.e. this code cannot simply be
		* copied and put under another distribution licence
		* [including the GNU Public Licence.]
		*/

		#include <limits.h>
		#include <string.h>

		#include <openssl/evp.h>
		#include <openssl/err.h>

		#include "evp_locl.h"

		size_t EVP_AEAD_key_length(const EVP_AEAD *aead)
		{
		return aead->key_len;
		}

		size_t EVP_AEAD_nonce_length(const EVP_AEAD *aead)
		{
		return aead->nonce_len;
		}

		size_t EVP_AEAD_max_overhead(const EVP_AEAD *aead)
		{
		return aead->overhead;
		}

		size_t EVP_AEAD_max_tag_len(const EVP_AEAD *aead)
		{
		return aead->max_tag_len;
		}

		int EVP_AEAD_CTX_init(EVP_AEAD_CTX ctx, const EVP_AEAD aead,
		const unsigned char *key, size_t key_len,
		size_t tag_len, ENGINE *impl)
		{
		ctx->aead = aead;
		if (key_len != aead->key_len)
		{
		EVPerr(EVP_F_EVP_AEAD_CTX_INIT,EVP_R_UNSUPPORTED_KEY_SIZE);
		return 0;
		}
		return aead->init(ctx, key, key_len, tag_len);
		}

		void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx)
		{
		if (ctx->aead == NULL)
		return;
		ctx->aead->cleanup(ctx);
		ctx->aead = NULL;
		}

		/* check_alias returns 0 if \|out\| points within the buffer determined by \|in\|
		* and \|in_len\| and 1 otherwise.
		*
		* When processing, there's only an issue if \|out\| points within in[:in_len]
		* and isn't equal to \|in\|. If that's the case then writing the output will
		* stomp input that hasn't been read yet.
		*
		* This function checks for that case. */
		static int check_alias(const unsigned char *in, size_t in_len,
		const unsigned char *out)
		{
		if (out <= in)
		return 1;
		if (in + in_len < out)
		return 1;
		return 0;
		}

		ssize_t EVP_AEAD_CTX_seal(const EVP_AEAD_CTX *ctx,
		unsigned char *out, size_t max_out_len,
		const unsigned char *nonce, size_t nonce_len,
		const unsigned char *in, size_t in_len,
		const unsigned char *ad, size_t ad_len)
		{
		size_t possible_out_len = in_len + ctx->aead->overhead;
		ssize_t r;

		if (possible_out_len < in_len /* overflow */ \|\|
		possible_out_len > SSIZE_MAX /* return value cannot be
		represented */)
		{
		EVPerr(EVP_F_EVP_AEAD_CTX_SEAL, EVP_R_TOO_LARGE);
		goto error;
		}

		if (!check_alias(in, in_len, out))
		{
		EVPerr(EVP_F_EVP_AEAD_CTX_SEAL, EVP_R_OUTPUT_ALIASES_INPUT);
		goto error;
		}

		r = ctx->aead->seal(ctx, out, max_out_len, nonce, nonce_len,
		in, in_len, ad, ad_len);
		if (r >= 0)
		return r;

		error:
		/* In the event of an error, clear the output buffer so that a caller
		* that doesn't check the return value doesn't send raw data. */
		memset(out, 0, max_out_len);
		return -1;
		}

		ssize_t EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx,
		unsigned char *out, size_t max_out_len,
		const unsigned char *nonce, size_t nonce_len,
		const unsigned char *in, size_t in_len,
		const unsigned char *ad, size_t ad_len)
		{
		ssize_t r;

		if (in_len > SSIZE_MAX)
		{
		EVPerr(EVP_F_EVP_AEAD_CTX_OPEN, EVP_R_TOO_LARGE);
		goto error; /* may not be able to represent return value. */
		}

		if (!check_alias(in, in_len, out))
		{
		EVPerr(EVP_F_EVP_AEAD_CTX_OPEN, EVP_R_OUTPUT_ALIASES_INPUT);
		goto error;
		}

		r = ctx->aead->open(ctx, out, max_out_len, nonce, nonce_len,
		in, in_len, ad, ad_len);

		if (r >= 0)
		return r;

		error:
		/* In the event of an error, clear the output buffer so that a caller
		* that doesn't check the return value doesn't try and process bad
		* data. */
		memset(out, 0, max_out_len);
		return -1;
		}

crypto/evp/evp_err.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -70,6 +70,11 @@

		static ERR_STRING_DATA EVP_str_functs[]=
		{
		{ERR_FUNC(EVP_F_AEAD_AES_GCM_INIT), "AEAD_AES_GCM_INIT"},
		{ERR_FUNC(EVP_F_AEAD_AES_GCM_OPEN), "AEAD_AES_GCM_OPEN"},
		{ERR_FUNC(EVP_F_AEAD_AES_GCM_SEAL), "AEAD_AES_GCM_SEAL"},
		{ERR_FUNC(EVP_F_AEAD_CTX_OPEN), "AEAD_CTX_OPEN"},
		{ERR_FUNC(EVP_F_AEAD_CTX_SEAL), "AEAD_CTX_SEAL"},
		{ERR_FUNC(EVP_F_AESNI_INIT_KEY), "AESNI_INIT_KEY"},
		{ERR_FUNC(EVP_F_AESNI_XTS_CIPHER), "AESNI_XTS_CIPHER"},
		{ERR_FUNC(EVP_F_AES_INIT_KEY), "AES_INIT_KEY"},
		@@ -86,6 +91,9 @@ static ERR_STRING_DATA EVP_str_functs[]=
		{ERR_FUNC(EVP_F_DSA_PKEY2PKCS8), "DSA_PKEY2PKCS8"},
		{ERR_FUNC(EVP_F_ECDSA_PKEY2PKCS8), "ECDSA_PKEY2PKCS8"},
		{ERR_FUNC(EVP_F_ECKEY_PKEY2PKCS8), "ECKEY_PKEY2PKCS8"},
		{ERR_FUNC(EVP_F_EVP_AEAD_CTX_INIT), "EVP_AEAD_CTX_init"},
		{ERR_FUNC(EVP_F_EVP_AEAD_CTX_OPEN), "EVP_AEAD_CTX_open"},
		{ERR_FUNC(EVP_F_EVP_AEAD_CTX_SEAL), "EVP_AEAD_CTX_seal"},
		{ERR_FUNC(EVP_F_EVP_CIPHERINIT_EX), "EVP_CipherInit_ex"},
		{ERR_FUNC(EVP_F_EVP_CIPHER_CTX_COPY), "EVP_CIPHER_CTX_copy"},
		{ERR_FUNC(EVP_F_EVP_CIPHER_CTX_CTRL), "EVP_CIPHER_CTX_ctrl"},
		@@ -204,10 +212,12 @@ static ERR_STRING_DATA EVP_str_reasons[]=
		{ERR_REASON(EVP_R_NO_VERIFY_FUNCTION_CONFIGURED),"no verify function configured"},
		{ERR_REASON(EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE),"operation not supported for this keytype"},
		{ERR_REASON(EVP_R_OPERATON_NOT_INITIALIZED),"operaton not initialized"},
		{ERR_REASON(EVP_R_OUTPUT_ALIASES_INPUT) ,"output aliases input"},
		{ERR_REASON(EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE),"pkcs8 unknown broken type"},
		{ERR_REASON(EVP_R_PRIVATE_KEY_DECODE_ERROR),"private key decode error"},
		{ERR_REASON(EVP_R_PRIVATE_KEY_ENCODE_ERROR),"private key encode error"},
		{ERR_REASON(EVP_R_PUBLIC_KEY_NOT_RSA) ,"public key not rsa"},
		{ERR_REASON(EVP_R_TAG_TOO_LARGE) ,"tag too large"},
		{ERR_REASON(EVP_R_TOO_LARGE) ,"too large"},
		{ERR_REASON(EVP_R_UNKNOWN_CIPHER) ,"unknown cipher"},
		{ERR_REASON(EVP_R_UNKNOWN_DIGEST) ,"unknown digest"},