michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: #ifdef FREEBL_NO_DEPEND
michael@0: #include "stubs.h"
michael@0: #endif
michael@0: #include "blapit.h"
michael@0: #include "blapii.h"
michael@0: #include "cts.h"
michael@0: #include "secerr.h"
michael@0: 
michael@0: struct CTSContextStr {
michael@0:     freeblCipherFunc cipher;
michael@0:     void *context;
michael@0:     /* iv stores the last ciphertext block of the previous message.
michael@0:      * Only used by decrypt. */
michael@0:     unsigned char iv[MAX_BLOCK_SIZE];
michael@0: };
michael@0: 
michael@0: CTSContext *
michael@0: CTS_CreateContext(void *context, freeblCipherFunc cipher,
michael@0: 		  const unsigned char *iv, unsigned int blocksize)
michael@0: {
michael@0:     CTSContext  *cts;
michael@0: 
michael@0:     if (blocksize > MAX_BLOCK_SIZE) {
michael@0: 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0: 	return NULL;
michael@0:     }
michael@0:     cts = PORT_ZNew(CTSContext);
michael@0:     if (cts == NULL) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     PORT_Memcpy(cts->iv, iv, blocksize);
michael@0:     cts->cipher = cipher;
michael@0:     cts->context = context;
michael@0:     return cts;
michael@0: }
michael@0: 
michael@0: void
michael@0: CTS_DestroyContext(CTSContext *cts, PRBool freeit)
michael@0: {
michael@0:     if (freeit) {
michael@0: 	PORT_Free(cts);
michael@0:     }
michael@0: }
michael@0: 	
michael@0: /*
michael@0:  * See addemdum to NIST SP 800-38A
michael@0:  * Generically handle cipher text stealing. Basically this is doing CBC
michael@0:  * operations except someone can pass us a partial block.
michael@0:  *
michael@0:  *  Output Order:
michael@0:  *  CS-1:  C1||C2||C3..Cn-1(could be partial)||Cn   (NIST)
michael@0:  *  CS-2: pad == 0 C1||C2||C3...Cn-1(is full)||Cn   (Schneier)
michael@0:  *  CS-2: pad != 0 C1||C2||C3...Cn||Cn-1(is partial)(Schneier)
michael@0:  *  CS-3: C1||C2||C3...Cn||Cn-1(could be partial)   (Kerberos)
michael@0:  *
michael@0:  * The characteristics of these three options:
michael@0:  *  - NIST & Schneier (CS-1 & CS-2) are identical to CBC if there are no
michael@0:  * partial blocks on input.
michael@0:  *  - Scheier and Kerberos (CS-2 and CS-3) have no embedded partial blocks,
michael@0:  * which make decoding easier.
michael@0:  *  - NIST & Kerberos (CS-1 and CS-3) have consistent block order independent
michael@0:  * of padding.
michael@0:  *
michael@0:  * PKCS #11 did not specify which version to implement, but points to the NIST
michael@0:  * spec, so this code implements CTS-CS-1 from NIST.
michael@0:  *
michael@0:  * To convert the returned buffer to:
michael@0:  *   CS-2 (Schneier): do
michael@0:  *       unsigned char tmp[MAX_BLOCK_SIZE];
michael@0:  *       pad = *outlen % blocksize;
michael@0:  *       if (pad) {
michael@0:  *          memcpy(tmp, outbuf+*outlen-blocksize, blocksize);
michael@0:  *          memcpy(outbuf+*outlen-pad,outbuf+*outlen-blocksize-pad, pad);
michael@0:  *	    memcpy(outbuf+*outlen-blocksize-pad, tmp, blocksize);
michael@0:  *       }
michael@0:  *   CS-3 (Kerberos): do
michael@0:  *       unsigned char tmp[MAX_BLOCK_SIZE];
michael@0:  *       pad = *outlen % blocksize;
michael@0:  *       if (pad == 0) {
michael@0:  *           pad = blocksize;
michael@0:  *       }
michael@0:  *       memcpy(tmp, outbuf+*outlen-blocksize, blocksize);
michael@0:  *       memcpy(outbuf+*outlen-pad,outbuf+*outlen-blocksize-pad, pad);
michael@0:  *	 memcpy(outbuf+*outlen-blocksize-pad, tmp, blocksize);
michael@0:  */
michael@0: SECStatus
michael@0: CTS_EncryptUpdate(CTSContext *cts, unsigned char *outbuf,
michael@0: 		unsigned int *outlen, unsigned int maxout,
michael@0: 		const unsigned char *inbuf, unsigned int inlen,
michael@0: 		unsigned int blocksize)
michael@0: {
michael@0:     unsigned char lastBlock[MAX_BLOCK_SIZE];
michael@0:     unsigned int tmp;
michael@0:     int fullblocks;
michael@0:     int written;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     if (inlen < blocksize) {
michael@0: 	PORT_SetError(SEC_ERROR_INPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     if (maxout < inlen) {
michael@0: 	*outlen = inlen;
michael@0: 	PORT_SetError(SEC_ERROR_OUTPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     fullblocks = (inlen/blocksize)*blocksize;
michael@0:     rv = (*cts->cipher)(cts->context, outbuf, outlen, maxout, inbuf,
michael@0: 	 fullblocks, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     *outlen = fullblocks; /* AES low level doesn't set outlen */
michael@0:     inbuf += fullblocks;
michael@0:     inlen -= fullblocks;
michael@0:     if (inlen == 0) {
michael@0: 	return SECSuccess;
michael@0:     }
michael@0:     written = *outlen - (blocksize - inlen);
michael@0:     outbuf += written;
michael@0:     maxout -= written;
michael@0: 
michael@0:     /*
michael@0:      * here's the CTS magic, we pad our final block with zeros,
michael@0:      * then do a CBC encrypt. CBC will xor our plain text with
michael@0:      * the previous block (Cn-1), capturing part of that block (Cn-1**) as it
michael@0:      * xors with the zero pad. We then write this full block, overwritting
michael@0:      * (Cn-1**) in our buffer. This allows us to have input data == output
michael@0:      * data since Cn contains enough information to reconver Cn-1** when
michael@0:      * we decrypt (at the cost of some complexity as you can see in decrypt
michael@0:      * below */
michael@0:     PORT_Memcpy(lastBlock, inbuf, inlen);
michael@0:     PORT_Memset(lastBlock + inlen, 0, blocksize - inlen);
michael@0:     rv = (*cts->cipher)(cts->context, outbuf, &tmp, maxout, lastBlock,
michael@0: 			blocksize, blocksize);
michael@0:     PORT_Memset(lastBlock, 0, blocksize);
michael@0:     if (rv == SECSuccess) {
michael@0: 	*outlen = written + blocksize;
michael@0:     }
michael@0:     return rv;
michael@0: }
michael@0: 
michael@0: 
michael@0: #define XOR_BLOCK(x,y,count) for(i=0; i < count; i++) x[i] = x[i] ^ y[i]
michael@0: 
michael@0: /*
michael@0:  * See addemdum to NIST SP 800-38A
michael@0:  * Decrypt, Expect CS-1: input. See the comment on the encrypt side
michael@0:  * to understand what CS-2 and CS-3 mean.
michael@0:  *
michael@0:  * To convert the input buffer to CS-1 from ...
michael@0:  *   CS-2 (Schneier): do
michael@0:  *       unsigned char tmp[MAX_BLOCK_SIZE];
michael@0:  *       pad = inlen % blocksize;
michael@0:  *       if (pad) {
michael@0:  *          memcpy(tmp, inbuf+inlen-blocksize-pad, blocksize);
michael@0:  *          memcpy(inbuf+inlen-blocksize-pad,inbuf+inlen-pad, pad);
michael@0:  *	    memcpy(inbuf+inlen-blocksize, tmp, blocksize);
michael@0:  *       }
michael@0:  *   CS-3 (Kerberos): do
michael@0:  *       unsigned char tmp[MAX_BLOCK_SIZE];
michael@0:  *       pad = inlen % blocksize;
michael@0:  *       if (pad == 0) {
michael@0:  *           pad = blocksize;
michael@0:  *       }
michael@0:  *       memcpy(tmp, inbuf+inlen-blocksize-pad, blocksize);
michael@0:  *       memcpy(inbuf+inlen-blocksize-pad,inbuf+inlen-pad, pad);
michael@0:  *	 memcpy(inbuf+inlen-blocksize, tmp, blocksize);
michael@0:  */
michael@0: SECStatus
michael@0: CTS_DecryptUpdate(CTSContext *cts, unsigned char *outbuf,
michael@0: 		unsigned int *outlen, unsigned int maxout,
michael@0: 		const unsigned char *inbuf, unsigned int inlen,
michael@0: 		unsigned int blocksize)
michael@0: {
michael@0:     unsigned char *Pn;
michael@0:     unsigned char Cn_2[MAX_BLOCK_SIZE]; /* block Cn-2 */
michael@0:     unsigned char Cn_1[MAX_BLOCK_SIZE]; /* block Cn-1 */
michael@0:     unsigned char Cn[MAX_BLOCK_SIZE];   /* block Cn   */
michael@0:     unsigned char lastBlock[MAX_BLOCK_SIZE];
michael@0:     const unsigned char *tmp;
michael@0:     unsigned int tmpLen;
michael@0:     int fullblocks, pad;
michael@0:     unsigned int i;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     if (inlen < blocksize) {
michael@0: 	PORT_SetError(SEC_ERROR_INPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     if (maxout < inlen) {
michael@0: 	*outlen = inlen;
michael@0: 	PORT_SetError(SEC_ERROR_OUTPUT_LEN);
michael@0: 	return SECFailure;
michael@0:     }
michael@0: 
michael@0:     fullblocks = (inlen/blocksize)*blocksize;
michael@0: 
michael@0:     /* even though we expect the input to be CS-1, CS-2 is easier to parse,
michael@0:      * so convert to CS-2 immediately. NOTE: this is the same code as in
michael@0:      * the comment for encrypt. NOTE2: since we can't modify inbuf unless
michael@0:      * inbuf and outbuf overlap, just copy inbuf to outbuf and modify it there
michael@0:      */
michael@0:     pad = inlen - fullblocks;
michael@0:     if (pad != 0) {
michael@0: 	if (inbuf != outbuf) {
michael@0: 	    memcpy(outbuf, inbuf, inlen);
michael@0: 	    /* keep the names so we logically know how we are using the
michael@0: 	     * buffers */
michael@0: 	    inbuf = outbuf;
michael@0: 	}
michael@0: 	memcpy(lastBlock, inbuf+inlen-blocksize, blocksize);
michael@0: 	/* we know inbuf == outbuf now, inbuf is declared const and can't
michael@0: 	 * be the target, so use outbuf for the target here */
michael@0: 	memcpy(outbuf+inlen-pad, inbuf+inlen-blocksize-pad, pad);
michael@0: 	memcpy(outbuf+inlen-blocksize-pad, lastBlock, blocksize);
michael@0:     }
michael@0:     /* save the previous to last block so we can undo the misordered
michael@0:      * chaining */
michael@0:     tmp =  (fullblocks < blocksize*2) ? cts->iv :
michael@0: 			inbuf+fullblocks-blocksize*2;
michael@0:     PORT_Memcpy(Cn_2, tmp, blocksize);
michael@0:     PORT_Memcpy(Cn, inbuf+fullblocks-blocksize, blocksize);
michael@0:     rv = (*cts->cipher)(cts->context, outbuf, outlen, maxout, inbuf,
michael@0: 	 fullblocks, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     *outlen = fullblocks; /* AES low level doesn't set outlen */
michael@0:     inbuf += fullblocks;
michael@0:     inlen -= fullblocks;
michael@0:     if (inlen == 0) {
michael@0: 	return SECSuccess;
michael@0:     }
michael@0:     outbuf += fullblocks;
michael@0:     maxout -= fullblocks;
michael@0: 
michael@0:     /* recover the stolen text */
michael@0:     PORT_Memset(lastBlock, 0, blocksize);
michael@0:     PORT_Memcpy(lastBlock, inbuf, inlen);
michael@0:     PORT_Memcpy(Cn_1, inbuf, inlen);
michael@0:     Pn = outbuf-blocksize;
michael@0:     /* inbuf points to Cn-1* in the input buffer */
michael@0:     /* NOTE: below there are 2 sections marked "make up for the out of order
michael@0:      * cbc decryption". You may ask, what is going on here.
michael@0:      *   Short answer: CBC automatically xors the plain text with the previous
michael@0:      * encrypted block. We are decrypting the last 2 blocks out of order, so
michael@0:      * we have to 'back out' the decrypt xor and 'add back' the encrypt xor.
michael@0:      *   Long answer: When we encrypted, we encrypted as follows:
michael@0:      *       Pn-2, Pn-1, (Pn || 0), but on decryption we can't
michael@0:      *  decrypt Cn-1 until we decrypt Cn because part of Cn-1 is stored in
michael@0:      *  Cn (see below).  So above we decrypted all the full blocks:
michael@0:      *       Cn-2, Cn,
michael@0:      *  to get:
michael@0:      *       Pn-2, Pn, Except that Pn is not yet corect. On encrypt, we
michael@0:      *  xor'd Pn || 0  with Cn-1, but on decrypt we xor'd it with Cn-2
michael@0:      *  To recover Pn, we xor the block with Cn-1* || 0 (in last block) and
michael@0:      *  Cn-2 to get Pn || Cn-1**. Pn can then be written to the output buffer
michael@0:      *  and we can now reunite Cn-1. With the full Cn-1 we can decrypt it,
michael@0:      *  but now decrypt is going to xor the decrypted data with Cn instead of
michael@0:      *  Cn-2. xoring Cn and Cn-2 restores the original Pn-1 and we can now
michael@0:      *  write that oout to the buffer */
michael@0: 
michael@0:     /* make up for the out of order CBC decryption */
michael@0:     XOR_BLOCK(lastBlock, Cn_2, blocksize);
michael@0:     XOR_BLOCK(lastBlock, Pn, blocksize);
michael@0:     /* last buf now has Pn || Cn-1**, copy out Pn */
michael@0:     PORT_Memcpy(outbuf, lastBlock, inlen);
michael@0:     *outlen += inlen;
michael@0:     /* copy Cn-1* into last buf to recover Cn-1 */
michael@0:     PORT_Memcpy(lastBlock, Cn_1, inlen);
michael@0:     /* note: because Cn and Cn-1 were out of order, our pointer to Pn also
michael@0:      * points to where Pn-1 needs to reside. From here on out read Pn in
michael@0:      * the code as really Pn-1. */
michael@0:     rv = (*cts->cipher)(cts->context, Pn, &tmpLen, blocksize, lastBlock,
michael@0: 	 blocksize, blocksize);
michael@0:     if (rv != SECSuccess) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     /* make up for the out of order CBC decryption */
michael@0:     XOR_BLOCK(Pn, Cn_2, blocksize);
michael@0:     XOR_BLOCK(Pn, Cn, blocksize);
michael@0:     /* reset iv to Cn  */
michael@0:     PORT_Memcpy(cts->iv, Cn, blocksize);
michael@0:     /* This makes Cn the last block for the next decrypt operation, which
michael@0:      * matches the encrypt. We don't care about the contexts of last block,
michael@0:      * only the side effect of setting the internal IV */
michael@0:     (void) (*cts->cipher)(cts->context, lastBlock, &tmpLen, blocksize, Cn,
michael@0: 		blocksize, blocksize);
michael@0:     /* clear last block. At this point last block contains Pn xor Cn_1 xor
michael@0:      * Cn_2, both of with an attacker would know, so we need to clear this
michael@0:      * buffer out */
michael@0:     PORT_Memset(lastBlock, 0, blocksize);
michael@0:     /* Cn, Cn_1, and Cn_2 have encrypted data, so no need to clear them */
michael@0:     return SECSuccess;
michael@0: }