Line data Source code
1 : /* ssl/s3_cbc.c */
2 : /* ====================================================================
3 : * Copyright (c) 2012 The OpenSSL Project. All rights reserved.
4 : *
5 : * Redistribution and use in source and binary forms, with or without
6 : * modification, are permitted provided that the following conditions
7 : * are met:
8 : *
9 : * 1. Redistributions of source code must retain the above copyright
10 : * notice, this list of conditions and the following disclaimer.
11 : *
12 : * 2. Redistributions in binary form must reproduce the above copyright
13 : * notice, this list of conditions and the following disclaimer in
14 : * the documentation and/or other materials provided with the
15 : * distribution.
16 : *
17 : * 3. All advertising materials mentioning features or use of this
18 : * software must display the following acknowledgment:
19 : * "This product includes software developed by the OpenSSL Project
20 : * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
21 : *
22 : * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 : * endorse or promote products derived from this software without
24 : * prior written permission. For written permission, please contact
25 : * openssl-core@openssl.org.
26 : *
27 : * 5. Products derived from this software may not be called "OpenSSL"
28 : * nor may "OpenSSL" appear in their names without prior written
29 : * permission of the OpenSSL Project.
30 : *
31 : * 6. Redistributions of any form whatsoever must retain the following
32 : * acknowledgment:
33 : * "This product includes software developed by the OpenSSL Project
34 : * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
35 : *
36 : * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 : * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 : * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 : * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 : * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 : * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 : * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 : * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 : * OF THE POSSIBILITY OF SUCH DAMAGE.
48 : * ====================================================================
49 : *
50 : * This product includes cryptographic software written by Eric Young
51 : * (eay@cryptsoft.com). This product includes software written by Tim
52 : * Hudson (tjh@cryptsoft.com).
53 : *
54 : */
55 :
56 : #include "../crypto/constant_time_locl.h"
57 : #include "ssl_locl.h"
58 :
59 : #include <openssl/md5.h>
60 : #include <openssl/sha.h>
61 :
62 : /*
63 : * MAX_HASH_BIT_COUNT_BYTES is the maximum number of bytes in the hash's
64 : * length field. (SHA-384/512 have 128-bit length.)
65 : */
66 : #define MAX_HASH_BIT_COUNT_BYTES 16
67 :
68 : /*
69 : * MAX_HASH_BLOCK_SIZE is the maximum hash block size that we'll support.
70 : * Currently SHA-384/512 has a 128-byte block size and that's the largest
71 : * supported by TLS.)
72 : */
73 : #define MAX_HASH_BLOCK_SIZE 128
74 :
75 : /*-
76 : * ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
77 : * record in |rec| by updating |rec->length| in constant time.
78 : *
79 : * block_size: the block size of the cipher used to encrypt the record.
80 : * returns:
81 : * 0: (in non-constant time) if the record is publicly invalid.
82 : * 1: if the padding was valid
83 : * -1: otherwise.
84 : */
85 0 : int ssl3_cbc_remove_padding(const SSL *s,
86 : SSL3_RECORD *rec,
87 : unsigned block_size, unsigned mac_size)
88 : {
89 : unsigned padding_length, good;
90 0 : const unsigned overhead = 1 /* padding length byte */ + mac_size;
91 :
92 : /*
93 : * These lengths are all public so we can test them in non-constant time.
94 : */
95 0 : if (overhead > rec->length)
96 : return 0;
97 :
98 0 : padding_length = rec->data[rec->length - 1];
99 0 : good = constant_time_ge(rec->length, padding_length + overhead);
100 : /* SSLv3 requires that the padding is minimal. */
101 0 : good &= constant_time_ge(block_size, padding_length + 1);
102 0 : padding_length = good & (padding_length + 1);
103 0 : rec->length -= padding_length;
104 0 : rec->type |= padding_length << 8; /* kludge: pass padding length */
105 0 : return constant_time_select_int(good, 1, -1);
106 : }
107 :
108 : /*-
109 : * tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
110 : * record in |rec| in constant time and returns 1 if the padding is valid and
111 : * -1 otherwise. It also removes any explicit IV from the start of the record
112 : * without leaking any timing about whether there was enough space after the
113 : * padding was removed.
114 : *
115 : * block_size: the block size of the cipher used to encrypt the record.
116 : * returns:
117 : * 0: (in non-constant time) if the record is publicly invalid.
118 : * 1: if the padding was valid
119 : * -1: otherwise.
120 : */
121 0 : int tls1_cbc_remove_padding(const SSL *s,
122 : SSL3_RECORD *rec,
123 : unsigned block_size, unsigned mac_size)
124 : {
125 : unsigned padding_length, good, to_check, i;
126 0 : const unsigned overhead = 1 /* padding length byte */ + mac_size;
127 : /* Check if version requires explicit IV */
128 0 : if (SSL_USE_EXPLICIT_IV(s)) {
129 : /*
130 : * These lengths are all public so we can test them in non-constant
131 : * time.
132 : */
133 0 : if (overhead + block_size > rec->length)
134 : return 0;
135 : /* We can now safely skip explicit IV */
136 0 : rec->data += block_size;
137 0 : rec->input += block_size;
138 0 : rec->length -= block_size;
139 0 : } else if (overhead > rec->length)
140 : return 0;
141 :
142 0 : padding_length = rec->data[rec->length - 1];
143 :
144 : /*
145 : * NB: if compression is in operation the first packet may not be of even
146 : * length so the padding bug check cannot be performed. This bug
147 : * workaround has been around since SSLeay so hopefully it is either
148 : * fixed now or no buggy implementation supports compression [steve]
149 : */
150 0 : if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
151 : /* First packet is even in size, so check */
152 0 : if ((CRYPTO_memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
153 0 : !(padding_length & 1)) {
154 0 : s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
155 : }
156 0 : if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) && padding_length > 0) {
157 0 : padding_length--;
158 : }
159 : }
160 :
161 0 : if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
162 : /* padding is already verified */
163 0 : rec->length -= padding_length + 1;
164 0 : return 1;
165 : }
166 :
167 0 : good = constant_time_ge(rec->length, overhead + padding_length);
168 : /*
169 : * The padding consists of a length byte at the end of the record and
170 : * then that many bytes of padding, all with the same value as the length
171 : * byte. Thus, with the length byte included, there are i+1 bytes of
172 : * padding. We can't check just |padding_length+1| bytes because that
173 : * leaks decrypted information. Therefore we always have to check the
174 : * maximum amount of padding possible. (Again, the length of the record
175 : * is public information so we can use it.)
176 : */
177 : to_check = 255; /* maximum amount of padding. */
178 0 : if (to_check > rec->length - 1)
179 : to_check = rec->length - 1;
180 :
181 0 : for (i = 0; i < to_check; i++) {
182 : unsigned char mask = constant_time_ge_8(padding_length, i);
183 0 : unsigned char b = rec->data[rec->length - 1 - i];
184 : /*
185 : * The final |padding_length+1| bytes should all have the value
186 : * |padding_length|. Therefore the XOR should be zero.
187 : */
188 0 : good &= ~(mask & (padding_length ^ b));
189 : }
190 :
191 : /*
192 : * If any of the final |padding_length+1| bytes had the wrong value, one
193 : * or more of the lower eight bits of |good| will be cleared.
194 : */
195 0 : good = constant_time_eq(0xff, good & 0xff);
196 0 : padding_length = good & (padding_length + 1);
197 0 : rec->length -= padding_length;
198 0 : rec->type |= padding_length << 8; /* kludge: pass padding length */
199 :
200 0 : return constant_time_select_int(good, 1, -1);
201 : }
202 :
203 : /*-
204 : * ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
205 : * constant time (independent of the concrete value of rec->length, which may
206 : * vary within a 256-byte window).
207 : *
208 : * ssl3_cbc_remove_padding or tls1_cbc_remove_padding must be called prior to
209 : * this function.
210 : *
211 : * On entry:
212 : * rec->orig_len >= md_size
213 : * md_size <= EVP_MAX_MD_SIZE
214 : *
215 : * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
216 : * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
217 : * a single or pair of cache-lines, then the variable memory accesses don't
218 : * actually affect the timing. CPUs with smaller cache-lines [if any] are
219 : * not multi-core and are not considered vulnerable to cache-timing attacks.
220 : */
221 : #define CBC_MAC_ROTATE_IN_PLACE
222 :
223 0 : void ssl3_cbc_copy_mac(unsigned char *out,
224 : const SSL3_RECORD *rec,
225 : unsigned md_size, unsigned orig_len)
226 : {
227 : #if defined(CBC_MAC_ROTATE_IN_PLACE)
228 : unsigned char rotated_mac_buf[64 + EVP_MAX_MD_SIZE];
229 : unsigned char *rotated_mac;
230 : #else
231 : unsigned char rotated_mac[EVP_MAX_MD_SIZE];
232 : #endif
233 :
234 : /*
235 : * mac_end is the index of |rec->data| just after the end of the MAC.
236 : */
237 0 : unsigned mac_end = rec->length;
238 0 : unsigned mac_start = mac_end - md_size;
239 : /*
240 : * scan_start contains the number of bytes that we can ignore because the
241 : * MAC's position can only vary by 255 bytes.
242 : */
243 : unsigned scan_start = 0;
244 : unsigned i, j;
245 : unsigned div_spoiler;
246 : unsigned rotate_offset;
247 :
248 0 : OPENSSL_assert(orig_len >= md_size);
249 0 : OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
250 :
251 : #if defined(CBC_MAC_ROTATE_IN_PLACE)
252 0 : rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
253 : #endif
254 :
255 : /* This information is public so it's safe to branch based on it. */
256 0 : if (orig_len > md_size + 255 + 1)
257 0 : scan_start = orig_len - (md_size + 255 + 1);
258 : /*
259 : * div_spoiler contains a multiple of md_size that is used to cause the
260 : * modulo operation to be constant time. Without this, the time varies
261 : * based on the amount of padding when running on Intel chips at least.
262 : * The aim of right-shifting md_size is so that the compiler doesn't
263 : * figure out that it can remove div_spoiler as that would require it to
264 : * prove that md_size is always even, which I hope is beyond it.
265 : */
266 0 : div_spoiler = md_size >> 1;
267 0 : div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
268 0 : rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
269 :
270 0 : memset(rotated_mac, 0, md_size);
271 0 : for (i = scan_start, j = 0; i < orig_len; i++) {
272 : unsigned char mac_started = constant_time_ge_8(i, mac_start);
273 : unsigned char mac_ended = constant_time_ge_8(i, mac_end);
274 0 : unsigned char b = rec->data[i];
275 0 : rotated_mac[j++] |= b & mac_started & ~mac_ended;
276 0 : j &= constant_time_lt(j, md_size);
277 : }
278 :
279 : /* Now rotate the MAC */
280 : #if defined(CBC_MAC_ROTATE_IN_PLACE)
281 : j = 0;
282 0 : for (i = 0; i < md_size; i++) {
283 : /* in case cache-line is 32 bytes, touch second line */
284 0 : ((volatile unsigned char *)rotated_mac)[rotate_offset ^ 32];
285 0 : out[j++] = rotated_mac[rotate_offset++];
286 0 : rotate_offset &= constant_time_lt(rotate_offset, md_size);
287 : }
288 : #else
289 : memset(out, 0, md_size);
290 : rotate_offset = md_size - rotate_offset;
291 : rotate_offset &= constant_time_lt(rotate_offset, md_size);
292 : for (i = 0; i < md_size; i++) {
293 : for (j = 0; j < md_size; j++)
294 : out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
295 : rotate_offset++;
296 : rotate_offset &= constant_time_lt(rotate_offset, md_size);
297 : }
298 : #endif
299 0 : }
300 :
301 : /*
302 : * u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in
303 : * little-endian order. The value of p is advanced by four.
304 : */
305 : #define u32toLE(n, p) \
306 : (*((p)++)=(unsigned char)(n), \
307 : *((p)++)=(unsigned char)(n>>8), \
308 : *((p)++)=(unsigned char)(n>>16), \
309 : *((p)++)=(unsigned char)(n>>24))
310 :
311 : /*
312 : * These functions serialize the state of a hash and thus perform the
313 : * standard "final" operation without adding the padding and length that such
314 : * a function typically does.
315 : */
316 0 : static void tls1_md5_final_raw(void *ctx, unsigned char *md_out)
317 : {
318 : MD5_CTX *md5 = ctx;
319 0 : u32toLE(md5->A, md_out);
320 0 : u32toLE(md5->B, md_out);
321 0 : u32toLE(md5->C, md_out);
322 0 : u32toLE(md5->D, md_out);
323 0 : }
324 :
325 0 : static void tls1_sha1_final_raw(void *ctx, unsigned char *md_out)
326 : {
327 : SHA_CTX *sha1 = ctx;
328 0 : l2n(sha1->h0, md_out);
329 0 : l2n(sha1->h1, md_out);
330 0 : l2n(sha1->h2, md_out);
331 0 : l2n(sha1->h3, md_out);
332 0 : l2n(sha1->h4, md_out);
333 0 : }
334 :
335 : #define LARGEST_DIGEST_CTX SHA_CTX
336 :
337 : #ifndef OPENSSL_NO_SHA256
338 0 : static void tls1_sha256_final_raw(void *ctx, unsigned char *md_out)
339 : {
340 : SHA256_CTX *sha256 = ctx;
341 : unsigned i;
342 :
343 0 : for (i = 0; i < 8; i++) {
344 0 : l2n(sha256->h[i], md_out);
345 : }
346 0 : }
347 :
348 : # undef LARGEST_DIGEST_CTX
349 : # define LARGEST_DIGEST_CTX SHA256_CTX
350 : #endif
351 :
352 : #ifndef OPENSSL_NO_SHA512
353 0 : static void tls1_sha512_final_raw(void *ctx, unsigned char *md_out)
354 : {
355 : SHA512_CTX *sha512 = ctx;
356 : unsigned i;
357 :
358 0 : for (i = 0; i < 8; i++) {
359 0 : l2n8(sha512->h[i], md_out);
360 : }
361 0 : }
362 :
363 : # undef LARGEST_DIGEST_CTX
364 : # define LARGEST_DIGEST_CTX SHA512_CTX
365 : #endif
366 :
367 : /*
368 : * ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
369 : * which ssl3_cbc_digest_record supports.
370 : */
371 0 : char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
372 : {
373 : #ifdef OPENSSL_FIPS
374 : if (FIPS_mode())
375 : return 0;
376 : #endif
377 0 : switch (EVP_MD_CTX_type(ctx)) {
378 : case NID_md5:
379 : case NID_sha1:
380 : #ifndef OPENSSL_NO_SHA256
381 : case NID_sha224:
382 : case NID_sha256:
383 : #endif
384 : #ifndef OPENSSL_NO_SHA512
385 : case NID_sha384:
386 : case NID_sha512:
387 : #endif
388 : return 1;
389 : default:
390 0 : return 0;
391 : }
392 : }
393 :
394 : /*-
395 : * ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
396 : * record.
397 : *
398 : * ctx: the EVP_MD_CTX from which we take the hash function.
399 : * ssl3_cbc_record_digest_supported must return true for this EVP_MD_CTX.
400 : * md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written.
401 : * md_out_size: if non-NULL, the number of output bytes is written here.
402 : * header: the 13-byte, TLS record header.
403 : * data: the record data itself, less any preceeding explicit IV.
404 : * data_plus_mac_size: the secret, reported length of the data and MAC
405 : * once the padding has been removed.
406 : * data_plus_mac_plus_padding_size: the public length of the whole
407 : * record, including padding.
408 : * is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS.
409 : *
410 : * On entry: by virtue of having been through one of the remove_padding
411 : * functions, above, we know that data_plus_mac_size is large enough to contain
412 : * a padding byte and MAC. (If the padding was invalid, it might contain the
413 : * padding too. )
414 : */
415 0 : void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
416 : unsigned char *md_out,
417 : size_t *md_out_size,
418 : const unsigned char header[13],
419 : const unsigned char *data,
420 : size_t data_plus_mac_size,
421 : size_t data_plus_mac_plus_padding_size,
422 : const unsigned char *mac_secret,
423 : unsigned mac_secret_length, char is_sslv3)
424 : {
425 : union {
426 : double align;
427 : unsigned char c[sizeof(LARGEST_DIGEST_CTX)];
428 : } md_state;
429 : void (*md_final_raw) (void *ctx, unsigned char *md_out);
430 : void (*md_transform) (void *ctx, const unsigned char *block);
431 : unsigned md_size, md_block_size = 64;
432 : unsigned sslv3_pad_length = 40, header_length, variance_blocks,
433 : len, max_mac_bytes, num_blocks,
434 : num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
435 : unsigned int bits; /* at most 18 bits */
436 : unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
437 : /* hmac_pad is the masked HMAC key. */
438 : unsigned char hmac_pad[MAX_HASH_BLOCK_SIZE];
439 : unsigned char first_block[MAX_HASH_BLOCK_SIZE];
440 : unsigned char mac_out[EVP_MAX_MD_SIZE];
441 : unsigned i, j, md_out_size_u;
442 : EVP_MD_CTX md_ctx;
443 : /*
444 : * mdLengthSize is the number of bytes in the length field that
445 : * terminates * the hash.
446 : */
447 : unsigned md_length_size = 8;
448 : char length_is_big_endian = 1;
449 :
450 : /*
451 : * This is a, hopefully redundant, check that allows us to forget about
452 : * many possible overflows later in this function.
453 : */
454 0 : OPENSSL_assert(data_plus_mac_plus_padding_size < 1024 * 1024);
455 :
456 0 : switch (EVP_MD_CTX_type(ctx)) {
457 : case NID_md5:
458 0 : MD5_Init((MD5_CTX *)md_state.c);
459 : md_final_raw = tls1_md5_final_raw;
460 : md_transform =
461 : (void (*)(void *ctx, const unsigned char *block))MD5_Transform;
462 : md_size = 16;
463 : sslv3_pad_length = 48;
464 : length_is_big_endian = 0;
465 0 : break;
466 : case NID_sha1:
467 0 : SHA1_Init((SHA_CTX *)md_state.c);
468 : md_final_raw = tls1_sha1_final_raw;
469 : md_transform =
470 : (void (*)(void *ctx, const unsigned char *block))SHA1_Transform;
471 : md_size = 20;
472 0 : break;
473 : #ifndef OPENSSL_NO_SHA256
474 : case NID_sha224:
475 0 : SHA224_Init((SHA256_CTX *)md_state.c);
476 : md_final_raw = tls1_sha256_final_raw;
477 : md_transform =
478 : (void (*)(void *ctx, const unsigned char *block))SHA256_Transform;
479 : md_size = 224 / 8;
480 0 : break;
481 : case NID_sha256:
482 0 : SHA256_Init((SHA256_CTX *)md_state.c);
483 : md_final_raw = tls1_sha256_final_raw;
484 : md_transform =
485 : (void (*)(void *ctx, const unsigned char *block))SHA256_Transform;
486 : md_size = 32;
487 0 : break;
488 : #endif
489 : #ifndef OPENSSL_NO_SHA512
490 : case NID_sha384:
491 0 : SHA384_Init((SHA512_CTX *)md_state.c);
492 : md_final_raw = tls1_sha512_final_raw;
493 : md_transform =
494 : (void (*)(void *ctx, const unsigned char *block))SHA512_Transform;
495 : md_size = 384 / 8;
496 : md_block_size = 128;
497 : md_length_size = 16;
498 0 : break;
499 : case NID_sha512:
500 0 : SHA512_Init((SHA512_CTX *)md_state.c);
501 : md_final_raw = tls1_sha512_final_raw;
502 : md_transform =
503 : (void (*)(void *ctx, const unsigned char *block))SHA512_Transform;
504 : md_size = 64;
505 : md_block_size = 128;
506 : md_length_size = 16;
507 0 : break;
508 : #endif
509 : default:
510 : /*
511 : * ssl3_cbc_record_digest_supported should have been called first to
512 : * check that the hash function is supported.
513 : */
514 0 : OPENSSL_assert(0);
515 0 : if (md_out_size)
516 0 : *md_out_size = -1;
517 0 : return;
518 : }
519 :
520 0 : OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
521 0 : OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
522 0 : OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
523 :
524 : header_length = 13;
525 0 : if (is_sslv3) {
526 0 : header_length = mac_secret_length + sslv3_pad_length + 8 /* sequence
527 : * number */ +
528 : 1 /* record type */ +
529 : 2 /* record length */ ;
530 : }
531 :
532 : /*
533 : * variance_blocks is the number of blocks of the hash that we have to
534 : * calculate in constant time because they could be altered by the
535 : * padding value. In SSLv3, the padding must be minimal so the end of
536 : * the plaintext varies by, at most, 15+20 = 35 bytes. (We conservatively
537 : * assume that the MAC size varies from 0..20 bytes.) In case the 9 bytes
538 : * of hash termination (0x80 + 64-bit length) don't fit in the final
539 : * block, we say that the final two blocks can vary based on the padding.
540 : * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not
541 : * required to be minimal. Therefore we say that the final six blocks can
542 : * vary based on the padding. Later in the function, if the message is
543 : * short and there obviously cannot be this many blocks then
544 : * variance_blocks can be reduced.
545 : */
546 0 : variance_blocks = is_sslv3 ? 2 : 6;
547 : /*
548 : * From now on we're dealing with the MAC, which conceptually has 13
549 : * bytes of `header' before the start of the data (TLS) or 71/75 bytes
550 : * (SSLv3)
551 : */
552 0 : len = data_plus_mac_plus_padding_size + header_length;
553 : /*
554 : * max_mac_bytes contains the maximum bytes of bytes in the MAC,
555 : * including * |header|, assuming that there's no padding.
556 : */
557 0 : max_mac_bytes = len - md_size - 1;
558 : /* num_blocks is the maximum number of hash blocks. */
559 0 : num_blocks =
560 0 : (max_mac_bytes + 1 + md_length_size + md_block_size -
561 : 1) / md_block_size;
562 : /*
563 : * In order to calculate the MAC in constant time we have to handle the
564 : * final blocks specially because the padding value could cause the end
565 : * to appear somewhere in the final |variance_blocks| blocks and we can't
566 : * leak where. However, |num_starting_blocks| worth of data can be hashed
567 : * right away because no padding value can affect whether they are
568 : * plaintext.
569 : */
570 : num_starting_blocks = 0;
571 : /*
572 : * k is the starting byte offset into the conceptual header||data where
573 : * we start processing.
574 : */
575 : k = 0;
576 : /*
577 : * mac_end_offset is the index just past the end of the data to be MACed.
578 : */
579 0 : mac_end_offset = data_plus_mac_size + header_length - md_size;
580 : /*
581 : * c is the index of the 0x80 byte in the final hash block that contains
582 : * application data.
583 : */
584 0 : c = mac_end_offset % md_block_size;
585 : /*
586 : * index_a is the hash block number that contains the 0x80 terminating
587 : * value.
588 : */
589 0 : index_a = mac_end_offset / md_block_size;
590 : /*
591 : * index_b is the hash block number that contains the 64-bit hash length,
592 : * in bits.
593 : */
594 0 : index_b = (mac_end_offset + md_length_size) / md_block_size;
595 : /*
596 : * bits is the hash-length in bits. It includes the additional hash block
597 : * for the masked HMAC key, or whole of |header| in the case of SSLv3.
598 : */
599 :
600 : /*
601 : * For SSLv3, if we're going to have any starting blocks then we need at
602 : * least two because the header is larger than a single block.
603 : */
604 0 : if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0)) {
605 0 : num_starting_blocks = num_blocks - variance_blocks;
606 0 : k = md_block_size * num_starting_blocks;
607 : }
608 :
609 0 : bits = 8 * mac_end_offset;
610 0 : if (!is_sslv3) {
611 : /*
612 : * Compute the initial HMAC block. For SSLv3, the padding and secret
613 : * bytes are included in |header| because they take more than a
614 : * single block.
615 : */
616 0 : bits += 8 * md_block_size;
617 0 : memset(hmac_pad, 0, md_block_size);
618 0 : OPENSSL_assert(mac_secret_length <= sizeof(hmac_pad));
619 0 : memcpy(hmac_pad, mac_secret, mac_secret_length);
620 0 : for (i = 0; i < md_block_size; i++)
621 0 : hmac_pad[i] ^= 0x36;
622 :
623 0 : md_transform(md_state.c, hmac_pad);
624 : }
625 :
626 0 : if (length_is_big_endian) {
627 0 : memset(length_bytes, 0, md_length_size - 4);
628 0 : length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24);
629 0 : length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16);
630 0 : length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8);
631 0 : length_bytes[md_length_size - 1] = (unsigned char)bits;
632 : } else {
633 0 : memset(length_bytes, 0, md_length_size);
634 0 : length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24);
635 0 : length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16);
636 0 : length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8);
637 0 : length_bytes[md_length_size - 8] = (unsigned char)bits;
638 : }
639 :
640 0 : if (k > 0) {
641 0 : if (is_sslv3) {
642 : unsigned overhang;
643 :
644 : /*
645 : * The SSLv3 header is larger than a single block. overhang is
646 : * the number of bytes beyond a single block that the header
647 : * consumes: either 7 bytes (SHA1) or 11 bytes (MD5). There are no
648 : * ciphersuites in SSLv3 that are not SHA1 or MD5 based and
649 : * therefore we can be confident that the header_length will be
650 : * greater than |md_block_size|. However we add a sanity check just
651 : * in case
652 : */
653 0 : if (header_length <= md_block_size) {
654 : /* Should never happen */
655 : return;
656 : }
657 0 : overhang = header_length - md_block_size;
658 0 : md_transform(md_state.c, header);
659 0 : memcpy(first_block, header + md_block_size, overhang);
660 0 : memcpy(first_block + overhang, data, md_block_size - overhang);
661 0 : md_transform(md_state.c, first_block);
662 0 : for (i = 1; i < k / md_block_size - 1; i++)
663 0 : md_transform(md_state.c, data + md_block_size * i - overhang);
664 : } else {
665 : /* k is a multiple of md_block_size. */
666 : memcpy(first_block, header, 13);
667 0 : memcpy(first_block + 13, data, md_block_size - 13);
668 0 : md_transform(md_state.c, first_block);
669 0 : for (i = 1; i < k / md_block_size; i++)
670 0 : md_transform(md_state.c, data + md_block_size * i - 13);
671 : }
672 : }
673 :
674 : memset(mac_out, 0, sizeof(mac_out));
675 :
676 : /*
677 : * We now process the final hash blocks. For each block, we construct it
678 : * in constant time. If the |i==index_a| then we'll include the 0x80
679 : * bytes and zero pad etc. For each block we selectively copy it, in
680 : * constant time, to |mac_out|.
681 : */
682 0 : for (i = num_starting_blocks; i <= num_starting_blocks + variance_blocks;
683 0 : i++) {
684 : unsigned char block[MAX_HASH_BLOCK_SIZE];
685 : unsigned char is_block_a = constant_time_eq_8(i, index_a);
686 : unsigned char is_block_b = constant_time_eq_8(i, index_b);
687 0 : for (j = 0; j < md_block_size; j++) {
688 : unsigned char b = 0, is_past_c, is_past_cp1;
689 0 : if (k < header_length)
690 0 : b = header[k];
691 0 : else if (k < data_plus_mac_plus_padding_size + header_length)
692 0 : b = data[k - header_length];
693 0 : k++;
694 :
695 0 : is_past_c = is_block_a & constant_time_ge_8(j, c);
696 0 : is_past_cp1 = is_block_a & constant_time_ge_8(j, c + 1);
697 : /*
698 : * If this is the block containing the end of the application
699 : * data, and we are at the offset for the 0x80 value, then
700 : * overwrite b with 0x80.
701 : */
702 : b = constant_time_select_8(is_past_c, 0x80, b);
703 : /*
704 : * If this the the block containing the end of the application
705 : * data and we're past the 0x80 value then just write zero.
706 : */
707 0 : b = b & ~is_past_cp1;
708 : /*
709 : * If this is index_b (the final block), but not index_a (the end
710 : * of the data), then the 64-bit length didn't fit into index_a
711 : * and we're having to add an extra block of zeros.
712 : */
713 0 : b &= ~is_block_b | is_block_a;
714 :
715 : /*
716 : * The final bytes of one of the blocks contains the length.
717 : */
718 0 : if (j >= md_block_size - md_length_size) {
719 : /* If this is index_b, write a length byte. */
720 : b = constant_time_select_8(is_block_b,
721 0 : length_bytes[j -
722 0 : (md_block_size -
723 : md_length_size)], b);
724 : }
725 0 : block[j] = b;
726 : }
727 :
728 0 : md_transform(md_state.c, block);
729 0 : md_final_raw(md_state.c, block);
730 : /* If this is index_b, copy the hash value to |mac_out|. */
731 0 : for (j = 0; j < md_size; j++)
732 0 : mac_out[j] |= block[j] & is_block_b;
733 : }
734 :
735 0 : EVP_MD_CTX_init(&md_ctx);
736 0 : EVP_DigestInit_ex(&md_ctx, ctx->digest, NULL /* engine */ );
737 0 : if (is_sslv3) {
738 : /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
739 0 : memset(hmac_pad, 0x5c, sslv3_pad_length);
740 :
741 0 : EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length);
742 0 : EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length);
743 0 : EVP_DigestUpdate(&md_ctx, mac_out, md_size);
744 : } else {
745 : /* Complete the HMAC in the standard manner. */
746 0 : for (i = 0; i < md_block_size; i++)
747 0 : hmac_pad[i] ^= 0x6a;
748 :
749 0 : EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
750 0 : EVP_DigestUpdate(&md_ctx, mac_out, md_size);
751 : }
752 0 : EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
753 0 : if (md_out_size)
754 0 : *md_out_size = md_out_size_u;
755 0 : EVP_MD_CTX_cleanup(&md_ctx);
756 : }
757 :
758 : #ifdef OPENSSL_FIPS
759 :
760 : /*
761 : * Due to the need to use EVP in FIPS mode we can't reimplement digests but
762 : * we can ensure the number of blocks processed is equal for all cases by
763 : * digesting additional data.
764 : */
765 :
766 : void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
767 : EVP_MD_CTX *mac_ctx, const unsigned char *data,
768 : size_t data_len, size_t orig_len)
769 : {
770 : size_t block_size, digest_pad, blocks_data, blocks_orig;
771 : if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
772 : return;
773 : block_size = EVP_MD_CTX_block_size(mac_ctx);
774 : /*-
775 : * We are in FIPS mode if we get this far so we know we have only SHA*
776 : * digests and TLS to deal with.
777 : * Minimum digest padding length is 17 for SHA384/SHA512 and 9
778 : * otherwise.
779 : * Additional header is 13 bytes. To get the number of digest blocks
780 : * processed round up the amount of data plus padding to the nearest
781 : * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
782 : * So we have:
783 : * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
784 : * equivalently:
785 : * blocks = (payload_len + digest_pad + 12)/block_size + 1
786 : * HMAC adds a constant overhead.
787 : * We're ultimately only interested in differences so this becomes
788 : * blocks = (payload_len + 29)/128
789 : * for SHA384/SHA512 and
790 : * blocks = (payload_len + 21)/64
791 : * otherwise.
792 : */
793 : digest_pad = block_size == 64 ? 21 : 29;
794 : blocks_orig = (orig_len + digest_pad) / block_size;
795 : blocks_data = (data_len + digest_pad) / block_size;
796 : /*
797 : * MAC enough blocks to make up the difference between the original and
798 : * actual lengths plus one extra block to ensure this is never a no op.
799 : * The "data" pointer should always have enough space to perform this
800 : * operation as it is large enough for a maximum length TLS buffer.
801 : */
802 : EVP_DigestSignUpdate(mac_ctx, data,
803 : (blocks_orig - blocks_data + 1) * block_size);
804 : }
805 : #endif
|
