xref: /src/crypto/openssl/providers/implementations/ciphers/cipher_chacha20_poly1305_hw.c (revision f25b8c9fb4f58cf61adb47d7570abe7caa6d385d) 
1 /*
2  * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 /* chacha20_poly1305 cipher implementation */
11 
12 #include "internal/endian.h"
13 #include "cipher_chacha20_poly1305.h"
14 
chacha_poly1305_tls_init(PROV_CIPHER_CTX * bctx,unsigned char * aad,size_t alen)15 static int chacha_poly1305_tls_init(PROV_CIPHER_CTX *bctx,
16     unsigned char *aad, size_t alen)
17 {
18     unsigned int len;
19     PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
20 
21     if (alen != EVP_AEAD_TLS1_AAD_LEN)
22         return 0;
23 
24     memcpy(ctx->tls_aad, aad, EVP_AEAD_TLS1_AAD_LEN);
25     len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 | aad[EVP_AEAD_TLS1_AAD_LEN - 1];
26     aad = ctx->tls_aad;
27     if (!bctx->enc) {
28         if (len < POLY1305_BLOCK_SIZE)
29             return 0;
30         len -= POLY1305_BLOCK_SIZE; /* discount attached tag */
31         aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
32         aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
33     }
34     ctx->tls_payload_length = len;
35 
36     /* merge record sequence number as per RFC7905 */
37     ctx->chacha.counter[1] = ctx->nonce[0];
38     ctx->chacha.counter[2] = ctx->nonce[1] ^ CHACHA_U8TOU32(aad);
39     ctx->chacha.counter[3] = ctx->nonce[2] ^ CHACHA_U8TOU32(aad + 4);
40     ctx->mac_inited = 0;
41 
42     return POLY1305_BLOCK_SIZE; /* tag length */
43 }
44 
chacha_poly1305_tls_iv_set_fixed(PROV_CIPHER_CTX * bctx,unsigned char * fixed,size_t flen)45 static int chacha_poly1305_tls_iv_set_fixed(PROV_CIPHER_CTX *bctx,
46     unsigned char *fixed, size_t flen)
47 {
48     PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
49 
50     if (flen != CHACHA20_POLY1305_IVLEN)
51         return 0;
52     ctx->nonce[0] = ctx->chacha.counter[1] = CHACHA_U8TOU32(fixed);
53     ctx->nonce[1] = ctx->chacha.counter[2] = CHACHA_U8TOU32(fixed + 4);
54     ctx->nonce[2] = ctx->chacha.counter[3] = CHACHA_U8TOU32(fixed + 8);
55     return 1;
56 }
57 
chacha20_poly1305_initkey(PROV_CIPHER_CTX * bctx,const unsigned char * key,size_t keylen)58 static int chacha20_poly1305_initkey(PROV_CIPHER_CTX *bctx,
59     const unsigned char *key, size_t keylen)
60 {
61     PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
62 
63     ctx->len.aad = 0;
64     ctx->len.text = 0;
65     ctx->aad = 0;
66     ctx->mac_inited = 0;
67     ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
68 
69     if (bctx->enc)
70         return ossl_chacha20_einit(&ctx->chacha, key, keylen, NULL, 0, NULL);
71     else
72         return ossl_chacha20_dinit(&ctx->chacha, key, keylen, NULL, 0, NULL);
73 }
74 
chacha20_poly1305_initiv(PROV_CIPHER_CTX * bctx)75 static int chacha20_poly1305_initiv(PROV_CIPHER_CTX *bctx)
76 {
77     PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
78     unsigned char tempiv[CHACHA_CTR_SIZE] = { 0 };
79     int ret = 1;
80     size_t noncelen = CHACHA20_POLY1305_IVLEN;
81 
82     ctx->len.aad = 0;
83     ctx->len.text = 0;
84     ctx->aad = 0;
85     ctx->mac_inited = 0;
86     ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
87 
88     /* pad on the left */
89     memcpy(tempiv + CHACHA_CTR_SIZE - noncelen, bctx->oiv,
90         noncelen);
91 
92     if (bctx->enc)
93         ret = ossl_chacha20_einit(&ctx->chacha, NULL, 0,
94             tempiv, sizeof(tempiv), NULL);
95     else
96         ret = ossl_chacha20_dinit(&ctx->chacha, NULL, 0,
97             tempiv, sizeof(tempiv), NULL);
98     ctx->nonce[0] = ctx->chacha.counter[1];
99     ctx->nonce[1] = ctx->chacha.counter[2];
100     ctx->nonce[2] = ctx->chacha.counter[3];
101     bctx->iv_set = 1;
102     return ret;
103 }
104 
105 #if !defined(OPENSSL_SMALL_FOOTPRINT)
106 
107 #if defined(POLY1305_ASM) && (defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64))
108 #define XOR128_HELPERS
109 void *xor128_encrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
110 void *xor128_decrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
111 static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 };
112 #else
113 static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
114 #endif
115 
chacha20_poly1305_tls_cipher(PROV_CIPHER_CTX * bctx,unsigned char * out,size_t * out_padlen,const unsigned char * in,size_t len)116 static int chacha20_poly1305_tls_cipher(PROV_CIPHER_CTX *bctx,
117     unsigned char *out,
118     size_t *out_padlen,
119     const unsigned char *in, size_t len)
120 {
121     PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
122     POLY1305 *poly = &ctx->poly1305;
123     size_t tail, tohash_len, buf_len, plen = ctx->tls_payload_length;
124     unsigned char *buf, *tohash, *ctr, storage[sizeof(zero) + 32];
125 
126     DECLARE_IS_ENDIAN;
127 
128     buf = storage + ((0 - (size_t)storage) & 15); /* align */
129     ctr = buf + CHACHA_BLK_SIZE;
130     tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;
131 
132 #ifdef XOR128_HELPERS
133     if (plen <= 3 * CHACHA_BLK_SIZE) {
134         ctx->chacha.counter[0] = 0;
135         buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE);
136         ChaCha20_ctr32(buf, zero, buf_len, ctx->chacha.key.d, ctx->chacha.counter);
137         Poly1305_Init(poly, buf);
138         ctx->chacha.partial_len = 0;
139         memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
140         tohash_len = POLY1305_BLOCK_SIZE;
141         ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
142         ctx->len.text = plen;
143 
144         if (plen) {
145             if (bctx->enc)
146                 ctr = xor128_encrypt_n_pad(out, in, ctr, plen);
147             else
148                 ctr = xor128_decrypt_n_pad(out, in, ctr, plen);
149 
150             in += plen;
151             out += plen;
152             tohash_len = (size_t)(ctr - tohash);
153         }
154     }
155 #else
156     if (plen <= CHACHA_BLK_SIZE) {
157         size_t i;
158 
159         ctx->chacha.counter[0] = 0;
160         ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE),
161             ctx->chacha.key.d, ctx->chacha.counter);
162         Poly1305_Init(poly, buf);
163         ctx->chacha.partial_len = 0;
164         memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
165         tohash_len = POLY1305_BLOCK_SIZE;
166         ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
167         ctx->len.text = plen;
168 
169         if (bctx->enc) {
170             for (i = 0; i < plen; i++)
171                 out[i] = ctr[i] ^= in[i];
172         } else {
173             for (i = 0; i < plen; i++) {
174                 unsigned char c = in[i];
175 
176                 out[i] = ctr[i] ^ c;
177                 ctr[i] = c;
178             }
179         }
180 
181         in += i;
182         out += i;
183 
184         tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
185         memset(ctr + i, 0, tail);
186         ctr += i + tail;
187         tohash_len += i + tail;
188     }
189 #endif
190     else {
191         ctx->chacha.counter[0] = 0;
192         ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE),
193             ctx->chacha.key.d, ctx->chacha.counter);
194         Poly1305_Init(poly, buf);
195         ctx->chacha.counter[0] = 1;
196         ctx->chacha.partial_len = 0;
197         Poly1305_Update(poly, ctx->tls_aad, POLY1305_BLOCK_SIZE);
198         tohash = ctr;
199         tohash_len = 0;
200         ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
201         ctx->len.text = plen;
202 
203         if (bctx->enc) {
204             ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
205             Poly1305_Update(poly, out, plen);
206         } else {
207             Poly1305_Update(poly, in, plen);
208             ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
209         }
210 
211         in += plen;
212         out += plen;
213         tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
214         Poly1305_Update(poly, zero, tail);
215     }
216 
217     if (IS_LITTLE_ENDIAN) {
218         memcpy(ctr, (unsigned char *)&ctx->len, POLY1305_BLOCK_SIZE);
219     } else {
220         ctr[0] = (unsigned char)(ctx->len.aad);
221         ctr[1] = (unsigned char)(ctx->len.aad >> 8);
222         ctr[2] = (unsigned char)(ctx->len.aad >> 16);
223         ctr[3] = (unsigned char)(ctx->len.aad >> 24);
224         ctr[4] = (unsigned char)(ctx->len.aad >> 32);
225         ctr[5] = (unsigned char)(ctx->len.aad >> 40);
226         ctr[6] = (unsigned char)(ctx->len.aad >> 48);
227         ctr[7] = (unsigned char)(ctx->len.aad >> 56);
228 
229         ctr[8] = (unsigned char)(ctx->len.text);
230         ctr[9] = (unsigned char)(ctx->len.text >> 8);
231         ctr[10] = (unsigned char)(ctx->len.text >> 16);
232         ctr[11] = (unsigned char)(ctx->len.text >> 24);
233         ctr[12] = (unsigned char)(ctx->len.text >> 32);
234         ctr[13] = (unsigned char)(ctx->len.text >> 40);
235         ctr[14] = (unsigned char)(ctx->len.text >> 48);
236         ctr[15] = (unsigned char)(ctx->len.text >> 56);
237     }
238     tohash_len += POLY1305_BLOCK_SIZE;
239 
240     Poly1305_Update(poly, tohash, tohash_len);
241     OPENSSL_cleanse(buf, buf_len);
242     Poly1305_Final(poly, bctx->enc ? ctx->tag : tohash);
243 
244     ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
245 
246     if (bctx->enc) {
247         memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
248     } else {
249         if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
250             if (len > POLY1305_BLOCK_SIZE)
251                 memset(out - (len - POLY1305_BLOCK_SIZE), 0,
252                     len - POLY1305_BLOCK_SIZE);
253             return 0;
254         }
255         /* Strip the tag */
256         len -= POLY1305_BLOCK_SIZE;
257     }
258 
259     *out_padlen = len;
260     return 1;
261 }
262 #else
263 static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 };
264 #endif /* OPENSSL_SMALL_FOOTPRINT */
265 
chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX * bctx,unsigned char * out,size_t * outl,const unsigned char * in,size_t inl)266 static int chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX *bctx,
267     unsigned char *out, size_t *outl,
268     const unsigned char *in, size_t inl)
269 {
270     PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
271     POLY1305 *poly = &ctx->poly1305;
272     size_t rem, plen = ctx->tls_payload_length;
273     size_t olen = 0;
274     int rv = 0;
275 
276     DECLARE_IS_ENDIAN;
277 
278     if (!ctx->mac_inited) {
279         if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL) {
280             if (inl != plen + POLY1305_BLOCK_SIZE)
281                 return 0;
282 #if !defined(OPENSSL_SMALL_FOOTPRINT)
283             return chacha20_poly1305_tls_cipher(bctx, out, outl, in, inl);
284 #endif
285         }
286 
287         ctx->chacha.counter[0] = 0;
288         ChaCha20_ctr32(ctx->chacha.buf, zero, CHACHA_BLK_SIZE,
289             ctx->chacha.key.d, ctx->chacha.counter);
290         Poly1305_Init(poly, ctx->chacha.buf);
291         ctx->chacha.counter[0] = 1;
292         ctx->chacha.partial_len = 0;
293         ctx->len.aad = ctx->len.text = 0;
294         ctx->mac_inited = 1;
295         if (plen != NO_TLS_PAYLOAD_LENGTH) {
296             Poly1305_Update(poly, ctx->tls_aad, EVP_AEAD_TLS1_AAD_LEN);
297             ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
298             ctx->aad = 1;
299         }
300     }
301 
302     if (in != NULL) { /* aad or text */
303         if (out == NULL) { /* aad */
304             Poly1305_Update(poly, in, inl);
305             ctx->len.aad += inl;
306             ctx->aad = 1;
307             goto finish;
308         } else { /* plain- or ciphertext */
309             if (ctx->aad) { /* wrap up aad */
310                 if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
311                     Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
312                 ctx->aad = 0;
313             }
314 
315             ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
316             if (plen == NO_TLS_PAYLOAD_LENGTH)
317                 plen = inl;
318             else if (inl != plen + POLY1305_BLOCK_SIZE)
319                 goto err;
320 
321             if (bctx->enc) { /* plaintext */
322                 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
323                 Poly1305_Update(poly, out, plen);
324                 in += plen;
325                 out += plen;
326                 ctx->len.text += plen;
327             } else { /* ciphertext */
328                 Poly1305_Update(poly, in, plen);
329                 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
330                 in += plen;
331                 out += plen;
332                 ctx->len.text += plen;
333             }
334         }
335     }
336     /* explicit final, or tls mode */
337     if (in == NULL || inl != plen) {
338 
339         unsigned char temp[POLY1305_BLOCK_SIZE];
340 
341         if (ctx->aad) { /* wrap up aad */
342             if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
343                 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
344             ctx->aad = 0;
345         }
346 
347         if ((rem = (size_t)ctx->len.text % POLY1305_BLOCK_SIZE))
348             Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
349 
350         if (IS_LITTLE_ENDIAN) {
351             Poly1305_Update(poly, (unsigned char *)&ctx->len,
352                 POLY1305_BLOCK_SIZE);
353         } else {
354             temp[0] = (unsigned char)(ctx->len.aad);
355             temp[1] = (unsigned char)(ctx->len.aad >> 8);
356             temp[2] = (unsigned char)(ctx->len.aad >> 16);
357             temp[3] = (unsigned char)(ctx->len.aad >> 24);
358             temp[4] = (unsigned char)(ctx->len.aad >> 32);
359             temp[5] = (unsigned char)(ctx->len.aad >> 40);
360             temp[6] = (unsigned char)(ctx->len.aad >> 48);
361             temp[7] = (unsigned char)(ctx->len.aad >> 56);
362             temp[8] = (unsigned char)(ctx->len.text);
363             temp[9] = (unsigned char)(ctx->len.text >> 8);
364             temp[10] = (unsigned char)(ctx->len.text >> 16);
365             temp[11] = (unsigned char)(ctx->len.text >> 24);
366             temp[12] = (unsigned char)(ctx->len.text >> 32);
367             temp[13] = (unsigned char)(ctx->len.text >> 40);
368             temp[14] = (unsigned char)(ctx->len.text >> 48);
369             temp[15] = (unsigned char)(ctx->len.text >> 56);
370             Poly1305_Update(poly, temp, POLY1305_BLOCK_SIZE);
371         }
372         Poly1305_Final(poly, bctx->enc ? ctx->tag : temp);
373         ctx->mac_inited = 0;
374 
375         if (in != NULL && inl != plen) {
376             if (bctx->enc) {
377                 memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
378             } else {
379                 if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
380                     memset(out - plen, 0, plen);
381                     goto err;
382                 }
383                 /* Strip the tag */
384                 inl -= POLY1305_BLOCK_SIZE;
385             }
386         } else if (!bctx->enc) {
387             if (CRYPTO_memcmp(temp, ctx->tag, ctx->tag_len))
388                 goto err;
389         }
390     }
391 finish:
392     olen = inl;
393     rv = 1;
394 err:
395     *outl = olen;
396     return rv;
397 }
398 
399 static const PROV_CIPHER_HW_CHACHA20_POLY1305 chacha20poly1305_hw = {
400     { chacha20_poly1305_initkey, NULL },
401     chacha20_poly1305_aead_cipher,
402     chacha20_poly1305_initiv,
403     chacha_poly1305_tls_init,
404     chacha_poly1305_tls_iv_set_fixed
405 };
406 
ossl_prov_cipher_hw_chacha20_poly1305(size_t keybits)407 const PROV_CIPHER_HW *ossl_prov_cipher_hw_chacha20_poly1305(size_t keybits)
408 {
409     return (PROV_CIPHER_HW *)&chacha20poly1305_hw;
410 }
411