cipher.c 25.3 KB
Newer Older
1 2
/**
 * \file cipher.c
3
 *
4
 * \brief Generic cipher wrapper for mbed TLS
5 6 7
 *
 * \author Adriaan de Jong <dejong@fox-it.com>
 *
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
8
 *  Copyright (C) 2006-2014, ARM Limited, All Rights Reserved
9
 *
10
 *  This file is part of mbed TLS (https://tls.mbed.org)
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License along
 *  with this program; if not, write to the Free Software Foundation, Inc.,
 *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
27
#if !defined(MBEDTLS_CONFIG_FILE)
28
#include "mbedtls/config.h"
29
#else
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
30
#include MBEDTLS_CONFIG_FILE
31
#endif
32

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
33
#if defined(MBEDTLS_CIPHER_C)
34

35
#include "mbedtls/cipher.h"
36
#include "mbedtls/cipher_internal.h"
37

38 39 40
#include <stdlib.h>
#include <string.h>

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
41
#if defined(MBEDTLS_GCM_C)
42
#include "mbedtls/gcm.h"
43 44
#endif

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
45
#if defined(MBEDTLS_CCM_C)
46
#include "mbedtls/ccm.h"
47 48
#endif

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
49 50
#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
#define MBEDTLS_CIPHER_MODE_STREAM
51 52
#endif

53
/* Implementation that should never be optimized out by the compiler */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
54
static void mbedtls_zeroize( void *v, size_t n ) {
55 56 57
    volatile unsigned char *p = v; while( n-- ) *p++ = 0;
}

58
static int supported_init = 0;
59

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
60
const int *mbedtls_cipher_list( void )
61
{
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
62
    const mbedtls_cipher_definition_t *def;
63
    int *type;
64

65 66
    if( ! supported_init )
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
67 68
        def = mbedtls_cipher_definitions;
        type = mbedtls_cipher_supported;
69

70 71
        while( def->type != 0 )
            *type++ = (*def++).type;
72

73
        *type = 0;
74

75 76
        supported_init = 1;
    }
77

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
78
    return( mbedtls_cipher_supported );
79 80
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
81
const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( const mbedtls_cipher_type_t cipher_type )
82
{
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
83
    const mbedtls_cipher_definition_t *def;
84

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
85
    for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
86 87
        if( def->type == cipher_type )
            return( def->info );
88

89
    return( NULL );
90 91
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
92
const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( const char *cipher_name )
93
{
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
94
    const mbedtls_cipher_definition_t *def;
95

96
    if( NULL == cipher_name )
97
        return( NULL );
98

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
99
    for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
100
        if( !  strcmp( def->info->name, cipher_name ) )
101
            return( def->info );
102

103
    return( NULL );
104 105
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
106
const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( const mbedtls_cipher_id_t cipher_id,
107
                                              int key_bitlen,
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
108
                                              const mbedtls_cipher_mode_t mode )
109
{
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
110
    const mbedtls_cipher_definition_t *def;
111

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
112
    for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
113
        if( def->info->base->cipher == cipher_id &&
114
            def->info->key_bitlen == (unsigned) key_bitlen &&
115 116
            def->info->mode == mode )
            return( def->info );
117

118
    return( NULL );
119 120
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
121
void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx )
122
{
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
123
    memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
124 125
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
126
void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx )
127 128 129 130 131 132 133
{
    if( ctx == NULL )
        return;

    if( ctx->cipher_ctx )
        ctx->cipher_info->base->ctx_free_func( ctx->cipher_ctx );

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
134
    mbedtls_zeroize( ctx, sizeof(mbedtls_cipher_context_t) );
135 136
}

137
int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx, const mbedtls_cipher_info_t *cipher_info )
138 139
{
    if( NULL == cipher_info || NULL == ctx )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
140
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
141

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
142
    memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
143

144
    if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
145
        return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
146 147 148

    ctx->cipher_info = cipher_info;

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
149
#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
150 151 152
    /*
     * Ignore possible errors caused by a cipher mode that doesn't use padding
     */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
153 154
#if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
    (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_PKCS7 );
155
#else
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
156
    (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_NONE );
157
#endif
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
158
#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
159

160
    return( 0 );
161 162
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
163
int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx, const unsigned char *key,
164
        int key_bitlen, const mbedtls_operation_t operation )
165 166
{
    if( NULL == ctx || NULL == ctx->cipher_info )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
167
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
168

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
169
    if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN ) == 0 &&
170
        (int) ctx->cipher_info->key_bitlen != key_bitlen )
171
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
172
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
173
    }
174

175
    ctx->key_bitlen = key_bitlen;
176 177
    ctx->operation = operation;

178
    /*
179
     * For CFB and CTR mode always use the encryption key schedule
180
     */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
181 182 183
    if( MBEDTLS_ENCRYPT == operation ||
        MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
        MBEDTLS_MODE_CTR == ctx->cipher_info->mode )
184 185
    {
        return ctx->cipher_info->base->setkey_enc_func( ctx->cipher_ctx, key,
186
                ctx->key_bitlen );
187
    }
188

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
189
    if( MBEDTLS_DECRYPT == operation )
190
        return ctx->cipher_info->base->setkey_dec_func( ctx->cipher_ctx, key,
191
                ctx->key_bitlen );
192

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
193
    return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
194 195
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
196
int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
197
                   const unsigned char *iv, size_t iv_len )
198
{
199
    size_t actual_iv_size;
200

201
    if( NULL == ctx || NULL == ctx->cipher_info || NULL == iv )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
202
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
203

204
    /* avoid buffer overflow in ctx->iv */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
205 206
    if( iv_len > MBEDTLS_MAX_IV_LENGTH )
        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
207

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
208
    if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN ) != 0 )
209 210
        actual_iv_size = iv_len;
    else
211
    {
212
        actual_iv_size = ctx->cipher_info->iv_size;
213

214 215
        /* avoid reading past the end of input buffer */
        if( actual_iv_size > iv_len )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
216
            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
217 218
    }

219 220
    memcpy( ctx->iv, iv, actual_iv_size );
    ctx->iv_size = actual_iv_size;
221

222
    return( 0 );
223 224
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
225
int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx )
226
{
227
    if( NULL == ctx || NULL == ctx->cipher_info )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
228
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
229

230 231
    ctx->unprocessed_len = 0;

232
    return( 0 );
233 234
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
235 236
#if defined(MBEDTLS_GCM_C)
int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
237 238 239
                      const unsigned char *ad, size_t ad_len )
{
    if( NULL == ctx || NULL == ctx->cipher_info )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
240
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
241

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
242
    if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
243
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
244
        return mbedtls_gcm_starts( (mbedtls_gcm_context *) ctx->cipher_ctx, ctx->operation,
245
                           ctx->iv, ctx->iv_size, ad, ad_len );
246 247
    }

248
    return( 0 );
249
}
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
250
#endif /* MBEDTLS_GCM_C */
251

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
252
int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input,
253
                   size_t ilen, unsigned char *output, size_t *olen )
254
{
255
    int ret;
256

257
    if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
258
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
259
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
260
    }
261

262 263
    *olen = 0;

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
264
    if( ctx->cipher_info->mode == MBEDTLS_MODE_ECB )
265
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
266 267
        if( ilen != mbedtls_cipher_get_block_size( ctx ) )
            return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
268 269 270 271 272 273

        *olen = ilen;

        if( 0 != ( ret = ctx->cipher_info->base->ecb_func( ctx->cipher_ctx,
                    ctx->operation, input, output ) ) )
        {
274
            return( ret );
275 276
        }

277
        return( 0 );
278 279
    }

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
280 281
#if defined(MBEDTLS_GCM_C)
    if( ctx->cipher_info->mode == MBEDTLS_MODE_GCM )
282 283
    {
        *olen = ilen;
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
284
        return mbedtls_gcm_update( (mbedtls_gcm_context *) ctx->cipher_ctx, ilen, input,
285
                           output );
286 287 288
    }
#endif

289
    if( input == output &&
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
290
       ( ctx->unprocessed_len != 0 || ilen % mbedtls_cipher_get_block_size( ctx ) ) )
291
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
292
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
293
    }
294

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
295 296
#if defined(MBEDTLS_CIPHER_MODE_CBC)
    if( ctx->cipher_info->mode == MBEDTLS_MODE_CBC )
297
    {
298 299
        size_t copy_len = 0;

300 301 302
        /*
         * If there is not enough data for a full block, cache it.
         */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
303 304 305 306
        if( ( ctx->operation == MBEDTLS_DECRYPT &&
                ilen + ctx->unprocessed_len <= mbedtls_cipher_get_block_size( ctx ) ) ||
             ( ctx->operation == MBEDTLS_ENCRYPT &&
                ilen + ctx->unprocessed_len < mbedtls_cipher_get_block_size( ctx ) ) )
307 308 309 310 311
        {
            memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
                    ilen );

            ctx->unprocessed_len += ilen;
312
            return( 0 );
313 314 315 316 317 318 319
        }

        /*
         * Process cached data first
         */
        if( ctx->unprocessed_len != 0 )
        {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
320
            copy_len = mbedtls_cipher_get_block_size( ctx ) - ctx->unprocessed_len;
321 322 323 324

            memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
                    copy_len );

325
            if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
326
                    ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv,
327
                    ctx->unprocessed_data, output ) ) )
328
            {
329
                return( ret );
330 331
            }

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
332 333
            *olen += mbedtls_cipher_get_block_size( ctx );
            output += mbedtls_cipher_get_block_size( ctx );
334 335 336 337 338 339 340 341 342 343 344
            ctx->unprocessed_len = 0;

            input += copy_len;
            ilen -= copy_len;
        }

        /*
         * Cache final, incomplete block
         */
        if( 0 != ilen )
        {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
345 346 347
            copy_len = ilen % mbedtls_cipher_get_block_size( ctx );
            if( copy_len == 0 && ctx->operation == MBEDTLS_DECRYPT )
                copy_len = mbedtls_cipher_get_block_size( ctx );
348 349 350 351 352 353 354 355 356 357 358 359 360

            memcpy( ctx->unprocessed_data, &( input[ilen - copy_len] ),
                    copy_len );

            ctx->unprocessed_len += copy_len;
            ilen -= copy_len;
        }

        /*
         * Process remaining full blocks
         */
        if( ilen )
        {
361 362
            if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
                    ctx->operation, ilen, ctx->iv, input, output ) ) )
363
            {
364
                return( ret );
365
            }
366

367 368 369
            *olen += ilen;
        }

370
        return( 0 );
371
    }
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
372
#endif /* MBEDTLS_CIPHER_MODE_CBC */
373

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
374 375
#if defined(MBEDTLS_CIPHER_MODE_CFB)
    if( ctx->cipher_info->mode == MBEDTLS_MODE_CFB )
376
    {
377
        if( 0 != ( ret = ctx->cipher_info->base->cfb_func( ctx->cipher_ctx,
378
                ctx->operation, ilen, &ctx->unprocessed_len, ctx->iv,
379
                input, output ) ) )
380
        {
381
            return( ret );
382 383 384 385
        }

        *olen = ilen;

386
        return( 0 );
387
    }
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
388
#endif /* MBEDTLS_CIPHER_MODE_CFB */
389

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
390 391
#if defined(MBEDTLS_CIPHER_MODE_CTR)
    if( ctx->cipher_info->mode == MBEDTLS_MODE_CTR )
392
    {
393
        if( 0 != ( ret = ctx->cipher_info->base->ctr_func( ctx->cipher_ctx,
394
                ilen, &ctx->unprocessed_len, ctx->iv,
395
                ctx->unprocessed_data, input, output ) ) )
396
        {
397
            return( ret );
398 399 400 401
        }

        *olen = ilen;

402
        return( 0 );
403
    }
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
404
#endif /* MBEDTLS_CIPHER_MODE_CTR */
405

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
406 407
#if defined(MBEDTLS_CIPHER_MODE_STREAM)
    if( ctx->cipher_info->mode == MBEDTLS_MODE_STREAM )
408 409 410 411
    {
        if( 0 != ( ret = ctx->cipher_info->base->stream_func( ctx->cipher_ctx,
                                                    ilen, input, output ) ) )
        {
412
            return( ret );
413 414 415 416
        }

        *olen = ilen;

417
        return( 0 );
418
    }
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
419
#endif /* MBEDTLS_CIPHER_MODE_STREAM */
420

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
421
    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
422 423
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
424 425
#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
#if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
426 427 428
/*
 * PKCS7 (and PKCS5) padding: fill with ll bytes, with ll = padding_len
 */
429 430
static void add_pkcs_padding( unsigned char *output, size_t output_len,
        size_t data_len )
431
{
432
    size_t padding_len = output_len - data_len;
433
    unsigned char i;
434 435

    for( i = 0; i < padding_len; i++ )
436
        output[data_len + i] = (unsigned char) padding_len;
437 438
}

439 440
static int get_pkcs_padding( unsigned char *input, size_t input_len,
        size_t *data_len )
441
{
442 443
    size_t i, pad_idx;
    unsigned char padding_len, bad = 0;
444

445
    if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
446
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
447 448

    padding_len = input[input_len - 1];
449
    *data_len = input_len - padding_len;
450

451 452 453
    /* Avoid logical || since it results in a branch */
    bad |= padding_len > input_len;
    bad |= padding_len == 0;
454

455 456 457 458 459
    /* The number of bytes checked must be independent of padding_len,
     * so pick input_len, which is usually 8 or 16 (one block) */
    pad_idx = input_len - padding_len;
    for( i = 0; i < input_len; i++ )
        bad |= ( input[i] ^ padding_len ) * ( i >= pad_idx );
460

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
461
    return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
462
}
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
463
#endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */
464

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
465
#if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482
/*
 * One and zeros padding: fill with 80 00 ... 00
 */
static void add_one_and_zeros_padding( unsigned char *output,
                                       size_t output_len, size_t data_len )
{
    size_t padding_len = output_len - data_len;
    unsigned char i = 0;

    output[data_len] = 0x80;
    for( i = 1; i < padding_len; i++ )
        output[data_len + i] = 0x00;
}

static int get_one_and_zeros_padding( unsigned char *input, size_t input_len,
                                      size_t *data_len )
{
483 484
    size_t i;
    unsigned char done = 0, prev_done, bad;
485 486

    if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
487
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
488

489 490 491 492 493 494 495 496 497
    bad = 0xFF;
    *data_len = 0;
    for( i = input_len; i > 0; i-- )
    {
        prev_done = done;
        done |= ( input[i-1] != 0 );
        *data_len |= ( i - 1 ) * ( done != prev_done );
        bad &= ( input[i-1] ^ 0x80 ) | ( done == prev_done );
    }
498

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
499
    return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
500 501

}
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
502
#endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */
503

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
504
#if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521
/*
 * Zeros and len padding: fill with 00 ... 00 ll, where ll is padding length
 */
static void add_zeros_and_len_padding( unsigned char *output,
                                       size_t output_len, size_t data_len )
{
    size_t padding_len = output_len - data_len;
    unsigned char i = 0;

    for( i = 1; i < padding_len; i++ )
        output[data_len + i - 1] = 0x00;
    output[output_len - 1] = (unsigned char) padding_len;
}

static int get_zeros_and_len_padding( unsigned char *input, size_t input_len,
                                      size_t *data_len )
{
522 523
    size_t i, pad_idx;
    unsigned char padding_len, bad = 0;
524 525

    if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
526
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
527 528

    padding_len = input[input_len - 1];
529
    *data_len = input_len - padding_len;
530

531 532 533
    /* Avoid logical || since it results in a branch */
    bad |= padding_len > input_len;
    bad |= padding_len == 0;
534

535 536 537 538
    /* The number of bytes checked must be independent of padding_len */
    pad_idx = input_len - padding_len;
    for( i = 0; i < input_len - 1; i++ )
        bad |= input[i] * ( i >= pad_idx );
539

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
540
    return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
541
}
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
542
#endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */
543

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
544
#if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
545 546 547 548 549 550
/*
 * Zero padding: fill with 00 ... 00
 */
static void add_zeros_padding( unsigned char *output,
                               size_t output_len, size_t data_len )
{
551
    size_t i;
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
552 553 554 555 556 557 558 559

    for( i = data_len; i < output_len; i++ )
        output[i] = 0x00;
}

static int get_zeros_padding( unsigned char *input, size_t input_len,
                              size_t *data_len )
{
560 561 562
    size_t i;
    unsigned char done = 0, prev_done;

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
563
    if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
564
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
565

566 567 568 569 570 571 572
    *data_len = 0;
    for( i = input_len; i > 0; i-- )
    {
        prev_done = done;
        done |= ( input[i-1] != 0 );
        *data_len |= i * ( done != prev_done );
    }
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
573

574
    return( 0 );
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
575
}
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
576
#endif /* MBEDTLS_CIPHER_PADDING_ZEROS */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
577

578 579 580
/*
 * No padding: don't pad :)
 *
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
581
 * There is no add_padding function (check for NULL in mbedtls_cipher_finish)
582 583 584 585 586 587
 * but a trivial get_padding function
 */
static int get_no_padding( unsigned char *input, size_t input_len,
                              size_t *data_len )
{
    if( NULL == input || NULL == data_len )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
588
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
589 590 591

    *data_len = input_len;

592
    return( 0 );
593
}
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
594
#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
595

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
596
int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
597
                   unsigned char *output, size_t *olen )
598 599
{
    if( NULL == ctx || NULL == ctx->cipher_info || NULL == olen )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
600
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
601 602 603

    *olen = 0;

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
604 605 606 607
    if( MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
        MBEDTLS_MODE_CTR == ctx->cipher_info->mode ||
        MBEDTLS_MODE_GCM == ctx->cipher_info->mode ||
        MBEDTLS_MODE_STREAM == ctx->cipher_info->mode )
608
    {
609
        return( 0 );
610 611
    }

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
612
    if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode )
613 614
    {
        if( ctx->unprocessed_len != 0 )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
615
            return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
616

617
        return( 0 );
618 619
    }

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
620 621
#if defined(MBEDTLS_CIPHER_MODE_CBC)
    if( MBEDTLS_MODE_CBC == ctx->cipher_info->mode )
622
    {
623 624
        int ret = 0;

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
625
        if( MBEDTLS_ENCRYPT == ctx->operation )
626
        {
627 628 629 630
            /* check for 'no padding' mode */
            if( NULL == ctx->add_padding )
            {
                if( 0 != ctx->unprocessed_len )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
631
                    return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
632

633
                return( 0 );
634 635
            }

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
636
            ctx->add_padding( ctx->unprocessed_data, mbedtls_cipher_get_iv_size( ctx ),
637 638
                    ctx->unprocessed_len );
        }
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
639
        else if( mbedtls_cipher_get_block_size( ctx ) != ctx->unprocessed_len )
640
        {
641 642 643 644 645
            /*
             * For decrypt operations, expect a full block,
             * or an empty block if no padding
             */
            if( NULL == ctx->add_padding && 0 == ctx->unprocessed_len )
646
                return( 0 );
647

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
648
            return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
649 650 651
        }

        /* cipher block */
652
        if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
653
                ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv,
654
                ctx->unprocessed_data, output ) ) )
655
        {
656
            return( ret );
657 658 659
        }

        /* Set output size for decryption */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
660 661
        if( MBEDTLS_DECRYPT == ctx->operation )
            return ctx->get_padding( output, mbedtls_cipher_get_block_size( ctx ),
662
                                     olen );
663 664

        /* Set output size for encryption */
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
665
        *olen = mbedtls_cipher_get_block_size( ctx );
666
        return( 0 );
667
    }
668 669
#else
    ((void) output);
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
670
#endif /* MBEDTLS_CIPHER_MODE_CBC */
671

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
672
    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
673 674
}

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
675 676
#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx, mbedtls_cipher_padding_t mode )
677 678
{
    if( NULL == ctx ||
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
679
        MBEDTLS_MODE_CBC != ctx->cipher_info->mode )
680
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
681
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
682 683
    }

684
    switch( mode )
685
    {
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
686 687
#if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
    case MBEDTLS_PADDING_PKCS7:
688 689
        ctx->add_padding = add_pkcs_padding;
        ctx->get_padding = get_pkcs_padding;
690
        break;
691
#endif
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
692 693
#if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
    case MBEDTLS_PADDING_ONE_AND_ZEROS:
694 695
        ctx->add_padding = add_one_and_zeros_padding;
        ctx->get_padding = get_one_and_zeros_padding;
696
        break;
697
#endif
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
698 699
#if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
    case MBEDTLS_PADDING_ZEROS_AND_LEN:
700 701
        ctx->add_padding = add_zeros_and_len_padding;
        ctx->get_padding = get_zeros_and_len_padding;
702
        break;
703
#endif
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
704 705
#if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
    case MBEDTLS_PADDING_ZEROS:
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
706 707
        ctx->add_padding = add_zeros_padding;
        ctx->get_padding = get_zeros_padding;
708
        break;
709
#endif
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
710
    case MBEDTLS_PADDING_NONE:
711 712
        ctx->add_padding = NULL;
        ctx->get_padding = get_no_padding;
713 714 715
        break;

    default:
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
716
        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
717 718
    }

719
    return( 0 );
720
}
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
721
#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
722

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
723 724
#if defined(MBEDTLS_GCM_C)
int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
725 726 727
                      unsigned char *tag, size_t tag_len )
{
    if( NULL == ctx || NULL == ctx->cipher_info || NULL == tag )
Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
728
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
729

Manuel Pégourié-Gonnard's avatar
Manuel Pégourié-Gonnard committed
730 731
    if( MBEDTLS_ENCRYPT != ctx->operation )
        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
732