ccm.c

//
// CCM.c    implementation of the CCM block cipher mode
//
// Copyright (c) Microsoft Corporation. Licensed under the MIT license.
//

#include "precomp.h"

#define CCM_MIN_NONCE_SIZE  (7)
#define CCM_MAX_NONCE_SIZE  (13)
#define CCM_MIN_TAG_SIZE    (4)
#define CCM_MAX_TAG_SIZE    (16)

#define CCM_MAX_COUNTER_SIZE    (SYMCRYPT_CCM_BLOCK_SIZE - 1 - CCM_MIN_NONCE_SIZE)

#define AUTHDATA_16BIT_LIMIT    ((1<<16) - (1<<8))
#define AUTHDATA_32BIT_LIMIT    (1ull << 32)

// Compile time BOOL statically determines if we need to check cbAuthData < AUTHDATA_32BIT_LIMIT
// Used to suppress MSVC C4127 and clang Wtautological-constant-out-of-range-compare on 32b platforms
const BOOL fcbAuthDataLt32bitLimitStatic = SIZE_T_MAX < AUTHDATA_32BIT_LIMIT;

#define CCM_BLOCK_MOD_MASK      (SYMCRYPT_CCM_BLOCK_SIZE - 1)
#define CCM_BLOCK_ROUND_MASK    (~CCM_BLOCK_MOD_MASK)

SYMCRYPT_ERROR
SYMCRYPT_CALL
SymCryptCcmValidateParameters(
    _In_    PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,
    _In_    SIZE_T                  cbNonce,
    _In_    SIZE_T                  cbAssociatedData,
    _In_    UINT64                  cbData,
    _In_    SIZE_T                  cbTag
   )
{
    SIZE_T cbCounter;

    UNREFERENCED_PARAMETER( cbAssociatedData );

    if( pBlockCipher->blockSize != SYMCRYPT_CCM_BLOCK_SIZE )
    {
        return SYMCRYPT_WRONG_BLOCK_SIZE;
    }

    //
    // Test against limits in SP800-38C appendix A
    //
    if( cbNonce < CCM_MIN_NONCE_SIZE || cbNonce > CCM_MAX_NONCE_SIZE )
    {
        return SYMCRYPT_WRONG_NONCE_SIZE;
    }

    //
    // cbAssociatedData is limited to <2^64
    // We don't test for this. None of our platforms has a SIZE_T that is
    // large enough to violate this condition. And the test
    // is of a form that the compiler cannot optimize away.
    //

    //
    // The counter block consists of a single flag byte, the nonce, and the counter field.
    //
    cbCounter = SYMCRYPT_CCM_BLOCK_SIZE - cbNonce - 1;

    //
    // per SP800-38C cbData is limited to 2^{8*cbCounter}
    // There is no way to do this test in a single comparison.
    // We don't have to worry about side-channels in the && because
    // cbCounter depends only on the length of the nonce, and we do not
    // try to hide any lengths.
    //
    if( cbCounter < sizeof( UINT64 ) &&
        cbData >= ((UINT64)1 << (8*cbCounter)) )
    {
        return SYMCRYPT_WRONG_DATA_SIZE;
    }

    if( cbTag < CCM_MIN_TAG_SIZE ||
        cbTag > CCM_MAX_TAG_SIZE ||
        (cbTag & 1) == 1        // valid tag lengths are [4, 6, 8, ..., 16]
        )
    {
        return SYMCRYPT_WRONG_TAG_SIZE;
    }

    return SYMCRYPT_NO_ERROR;
}



VOID
SYMCRYPT_CALL
SymCryptCcmEncryptDecryptPart(
    _Inout_                     PSYMCRYPT_CCM_STATE pState,
    _In_reads_( cbData )        PCBYTE              pbSrc,
    _Out_writes_( cbData )      PBYTE               pbDst,
                                SIZE_T              cbData )

{
    SIZE_T  cbToDo = cbData;
    SIZE_T  bytesToProcess;

    //
    // Use any left-over key stream
    //
    while( (pState->bytesProcessed & CCM_BLOCK_MOD_MASK) != 0 && cbToDo > 0 )
    {
        *pbDst = *pbSrc ^ pState->keystreamBlock[ pState->bytesProcessed & CCM_BLOCK_MOD_MASK ];
        pbDst++;
        pbSrc++;
        cbToDo--;
        pState->bytesProcessed++;
    }

    //
    // Bulk process the main part of the input and output
    //
    if( cbToDo >= SYMCRYPT_CCM_BLOCK_SIZE )
    {
        bytesToProcess = cbToDo & CCM_BLOCK_ROUND_MASK;
        SYMCRYPT_ASSERT( bytesToProcess <= cbToDo );

        SYMCRYPT_ASSERT( pState->pBlockCipher->blockSize == SYMCRYPT_CCM_BLOCK_SIZE );
        SymCryptCtrMsb64(   pState->pBlockCipher,
                            pState->pExpandedKey,
                            &pState->counterBlock[0],
                            pbSrc,
                            pbDst,
                            bytesToProcess );
        pbSrc += bytesToProcess;
        pbDst += bytesToProcess;
        pState->bytesProcessed += bytesToProcess;
        cbToDo -= bytesToProcess;
    }

    if( cbToDo > 0 )
    {
        //
        // Encrypt an all-zero key stream block to get the key stream.
        //
        SymCryptWipeKnownSize( &pState->keystreamBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );

        SYMCRYPT_ASSERT( pState->pBlockCipher->blockSize == SYMCRYPT_CCM_BLOCK_SIZE );
        SymCryptCtrMsb64(   pState->pBlockCipher,
                            pState->pExpandedKey,
                            &pState->counterBlock[0],
                            &pState->keystreamBlock[0],
                            &pState->keystreamBlock[0],
                            SYMCRYPT_CCM_BLOCK_SIZE );
        while( cbToDo > 0 )
        {
            *pbDst = *pbSrc ^ pState->keystreamBlock[ pState->bytesProcessed & CCM_BLOCK_MOD_MASK ];
            pbDst++;
            pbSrc++;
            cbToDo--;
            pState->bytesProcessed++;
        }
    }
}


VOID
SYMCRYPT_CALL
SymCryptCcmAddMacData(
    _Inout_                 PSYMCRYPT_CCM_STATE pState,
    _In_reads_( cbData )    PCBYTE              pbData,
                            SIZE_T              cbData )
{
    SIZE_T bytesToProcess;
    if( pState->bytesInMacBlock > 0 )
    {
        bytesToProcess = SYMCRYPT_MIN( cbData, SYMCRYPT_CCM_BLOCK_SIZE - pState->bytesInMacBlock );
        SymCryptXorBytes( &pState->macBlock[pState->bytesInMacBlock], pbData, &pState->macBlock[pState->bytesInMacBlock], bytesToProcess );
        pbData += bytesToProcess;
        cbData -= bytesToProcess;
        pState->bytesInMacBlock += bytesToProcess;

        if( pState->bytesInMacBlock == SYMCRYPT_CCM_BLOCK_SIZE )
        {
            pState->pBlockCipher->encryptFunc( pState->pExpandedKey, &pState->macBlock[0], &pState->macBlock[0] );
            pState->bytesInMacBlock = 0;
        }
    }

    if( cbData >= SYMCRYPT_CCM_BLOCK_SIZE )
    {
        bytesToProcess = cbData & CCM_BLOCK_ROUND_MASK;
        SYMCRYPT_ASSERT( pState->pBlockCipher->blockSize == SYMCRYPT_CCM_BLOCK_SIZE );

        SymCryptCbcMac( pState->pBlockCipher,
                        pState->pExpandedKey,
                        &pState->macBlock[0],
                        pbData,
                        bytesToProcess );

        pbData += bytesToProcess;
        cbData -= bytesToProcess;
    }

    if( cbData > 0 )
    {
        SymCryptXorBytes( &pState->macBlock[0], pbData, &pState->macBlock[0], cbData );
        pState->bytesInMacBlock = cbData;
    }
}

VOID
SYMCRYPT_CALL
SymCryptCcmPadMacData( _Inout_ PSYMCRYPT_CCM_STATE  pState )
{
    //
    // Pad the MAC data with zeroes until we hit the block size.
    // The data is xorred into macBlock, so we don't have to update that.
    // All we do is apply the block cipher if there was any data remaining in the macBlock.
    //
    if( pState->bytesInMacBlock > 0 )
    {
        pState->pBlockCipher->encryptFunc( pState->pExpandedKey, &pState->macBlock[0], &pState->macBlock[0] );
        pState->bytesInMacBlock = 0;
    }
}


SYMCRYPT_NOINLINE
VOID
SYMCRYPT_CALL
SymCryptCcmEncrypt(
    _In_                            PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,
    _In_                            PCVOID                  pExpandedKey,
    _In_reads_( cbNonce )           PCBYTE                  pbNonce,
                                    SIZE_T                  cbNonce,
    _In_reads_opt_( cbAuthData )    PCBYTE                  pbAuthData,
                                    SIZE_T                  cbAuthData,
    _In_reads_( cbData )            PCBYTE                  pbSrc,
    _Out_writes_( cbData )          PBYTE                   pbDst,
                                    SIZE_T                  cbData,
    _Out_writes_( cbTag )           PBYTE                   pbTag,
                                    SIZE_T                  cbTag )
{
    SYMCRYPT_CCM_STATE  state;

    SymCryptCcmInit(    &state,
                        pBlockCipher,
                        pExpandedKey,
                        pbNonce, cbNonce,
                        pbAuthData, cbAuthData,
                        cbData, cbTag );

    SymCryptCcmEncryptPart( &state, pbSrc, pbDst, cbData );

    SymCryptCcmEncryptFinal( &state, pbTag, cbTag );
}

SYMCRYPT_NOINLINE
SYMCRYPT_ERROR
SYMCRYPT_CALL
SymCryptCcmDecrypt(
    _In_                            PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,
    _In_                            PCVOID                  pExpandedKey,
    _In_reads_( cbNonce )           PCBYTE                  pbNonce,
                                    SIZE_T                  cbNonce,
    _In_reads_opt_( cbAuthData )    PCBYTE                  pbAuthData,
                                    SIZE_T                  cbAuthData,
    _In_reads_( cbData )            PCBYTE                  pbSrc,
    _Out_writes_( cbData )          PBYTE                   pbDst,
                                    SIZE_T                  cbData,
    _In_reads_( cbTag )             PCBYTE                  pbTag,
                                    SIZE_T                  cbTag )
{
    SYMCRYPT_CCM_STATE  state;
    SYMCRYPT_ERROR      status;

    SymCryptCcmInit(    &state,
                        pBlockCipher,
                        pExpandedKey,
                        pbNonce, cbNonce,
                        pbAuthData, cbAuthData,
                        cbData, cbTag );


    SymCryptCcmDecryptPart( &state, pbSrc, pbDst, cbData );

    status = SymCryptCcmDecryptFinal( &state, pbTag, cbTag );

    //
    // If we failed for any reason we wipe our output buffer to avoid returning
    // decrypted but unauthenticated data.
    //
    if( status != SYMCRYPT_NO_ERROR )
    {
        SymCryptWipe( pbDst, cbData );
    }

    return status;
}

SYMCRYPT_NOINLINE
VOID
SYMCRYPT_CALL
SymCryptCcmInit(
    _Out_                           PSYMCRYPT_CCM_STATE     pState,
    _In_                            PCSYMCRYPT_BLOCKCIPHER  pBlockCipher,
    _In_                            PCVOID                  pExpandedKey,
    _In_reads_( cbNonce )           PCBYTE                  pbNonce,
                                    SIZE_T                  cbNonce,
    _In_reads_opt_( cbAuthData )    PCBYTE                  pbAuthData,
                                    SIZE_T                  cbAuthData,
                                    UINT64                  cbData,
                                    SIZE_T                  cbTag )
{
    BYTE            flags;
    BYTE            tmpBuf[ SYMCRYPT_CCM_BLOCK_SIZE ];
    SIZE_T          cbCounter;

    SYMCRYPT_SET_MAGIC( pState );

    //
    // Validate parameters in checked builds
    //
    SYMCRYPT_ASSERT( SymCryptCcmValidateParameters( pBlockCipher, cbNonce, cbAuthData, cbData, cbTag ) == SYMCRYPT_NO_ERROR );


    //
    // compute # bytes in the counter field
    // We limit cbNonce to 15 so that cbCounter + cbNonce = 15 will always hold
    // This is much cheaper than full parameter validation, and it is enough to
    // avoid any buffer overflows.
    //
    cbNonce &= SYMCRYPT_CCM_BLOCK_SIZE - 1;
    cbCounter = SYMCRYPT_CCM_BLOCK_SIZE - 1 - cbNonce;

    pState->pBlockCipher = pBlockCipher;
    pState->pExpandedKey = pExpandedKey;
    pState->cbNonce = cbNonce;
    pState->cbData = cbData;
    pState->cbTag = cbTag;
    pState->cbCounter = cbCounter;
    pState->bytesProcessed = 0;
    pState->bytesInMacBlock = 0;

    //
    // Build the initial blocks for authentication and en/decryption
    //
    // Per Sp800-38c the flag byte is made up of four fields:
    // Bits 0-2 are cbCounter - 1
    // Bits 3-5 are (cbTag-2)/2
    // Bit 6 is 1 if cbAuthData > 0
    // Bit 7 is reserved and set to 0.
    flags = (BYTE) (pState->cbCounter - 1);
    flags |= ((cbTag-2)/2) << 3;
    if( cbAuthData > 0 )
    {
        //
        // No side-channel concerns with this if statements as we don't try to hide the
        // data length or presence of authdata.
        //
        flags |= (1 << 6);
    }


    //
    // The MAC starting block consists of three fields:
    // the flag byte, the nonce, and cbData encoded into cbCounter bytes.
    //
    pState->macBlock[0] = flags;
    memcpy( &pState->macBlock[1], pbNonce, cbNonce );
    SYMCRYPT_STORE_MSBFIRST64( &tmpBuf[0], cbData );
    memcpy( &pState->macBlock[1+cbNonce], &tmpBuf[ 8 - cbCounter ], cbCounter );

    //
    // The counter block is similar in layout, but with two changes:
    // Bits 3-7 of the flag bytes are set to 0.
    // The counter field is set to one (first counter value used for data encryption).
    // Wiping the whole block first is probably faster, as the size is known and the
    // block is aligned.
    // We also copy the nonce from the mac block to follow the read-once rule.
    //
    SymCryptWipeKnownSize( &pState->counterBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );
    pState->counterBlock[0] = (BYTE)(flags & 0x7);
    memcpy( &pState->counterBlock[1], &pState->macBlock[1], cbNonce );
    pState->counterBlock[ SYMCRYPT_CCM_BLOCK_SIZE - 1] = 1;

    //
    // Encrypt the current MAC block; our CBC convention is to do the encryption
    // as soon as we have enough data.
    //
    pBlockCipher->encryptFunc( pExpandedKey, &pState->macBlock[0], &pState->macBlock[0] );

    //
    // Next we process the associated data
    // See the CCM specs for the details
    //
    if( cbAuthData <= 0 )
    {
        //
        // cbAuthData == 0, nothing needs to be done.
        //
    } else if( cbAuthData < AUTHDATA_16BIT_LIMIT )
    {
        //
        // 16-bit length encoding.
        //
        SYMCRYPT_STORE_MSBFIRST16( &tmpBuf[0], (UINT16) cbAuthData );
        SymCryptCcmAddMacData( pState, &tmpBuf[0], 2 );
    } else if( fcbAuthDataLt32bitLimitStatic || cbAuthData < AUTHDATA_32BIT_LIMIT )
    {
        //
        // 32-bit length
        //
        tmpBuf[0] = 0xff;
        tmpBuf[1] = 0xfe;       // Magic prefix as per SP 800-38c
        SYMCRYPT_STORE_MSBFIRST32( &tmpBuf[2], (UINT32) cbAuthData );
        SymCryptCcmAddMacData( pState, &tmpBuf[0], 2 + sizeof( UINT32 ) );
    } else
    {
        //
        // 64-bit length
        //
        tmpBuf[0] = 0xff;
        tmpBuf[1] = 0xff;       // Magic prefix as per SP 800-38c
        SYMCRYPT_STORE_MSBFIRST64( &tmpBuf[2], cbAuthData );
        SymCryptCcmAddMacData( pState, &tmpBuf[0], 2 + sizeof( UINT64 ) );
    }

    SymCryptCcmAddMacData( pState, pbAuthData, cbAuthData );
    SymCryptCcmPadMacData( pState );        // Pad MAC data with zeroes until the next block size boundary

}

SYMCRYPT_NOINLINE
VOID
SYMCRYPT_CALL
SymCryptCcmEncryptPart(
    _Inout_                   PSYMCRYPT_CCM_STATE pState,
    _In_reads_( cbData )      PCBYTE              pbSrc,
    _Out_writes_( cbData )    PBYTE               pbDst,
                              SIZE_T              cbData )
{
    UINT64 bytesProcessedAfterThisCall;

    SYMCRYPT_CHECK_MAGIC( pState );

    bytesProcessedAfterThisCall = cbData + pState->bytesProcessed;

    SYMCRYPT_ASSERT( bytesProcessedAfterThisCall >= cbData &&
                     bytesProcessedAfterThisCall <= pState->cbData );

    //
    // We are violating the read-once implementation rule here. We read the data twice:
    // once for MACing and once for encryption.
    // In this particular situation this is safe to do.
    // We consider the read for the MAC operation as reading the 'real' value.
    // The encryption code reads the data, but all it does is XOR the key stream into
    // it. (CCM encryption uses CTR mode for the encryption part.)
    // We don't care if the attacker modifies the data before the encryption.
    // We are revealing the key stream anyway (from the plaintext and ciphertext) and
    // the exact byte value that we xor the key stream into is irrelevant.
    //
    SymCryptCcmAddMacData( pState, pbSrc, cbData );

    SymCryptCcmEncryptDecryptPart( pState, pbSrc, pbDst, cbData );

}

SYMCRYPT_NOINLINE
VOID
SYMCRYPT_CALL
SymCryptCcmEncryptFinal(
    _Inout_                 PSYMCRYPT_CCM_STATE pState,
    _Out_writes_( cbTag )   PBYTE               pbTag,
                            SIZE_T              cbTag )
{
    //
    // Check invariants in checked builds
    //
    SYMCRYPT_CHECK_MAGIC( pState );

    SYMCRYPT_ASSERT( cbTag  == pState->cbTag && pState->bytesProcessed == pState->cbData );


    SymCryptCcmPadMacData( pState );

    //
    // Set the counter value to zero to get the counter value that encrypts the tag,
    // and then encrypt the tag.
    // We reset bytesProcessed so that the partial encrypt/decrypt function will do the right thing
    //
    SymCryptWipe( &pState->counterBlock[1 + pState->cbNonce], pState->cbCounter );

    pState->bytesProcessed = 0;

    SymCryptCcmEncryptDecryptPart( pState, &pState->macBlock[0], &pState->macBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );

    memcpy( pbTag, &pState->macBlock[0], cbTag );

    SymCryptWipeKnownSize( pState, sizeof( *pState ) );
    SYMCRYPT_ASSERT( pState->bytesInMacBlock == 0 );
}

SYMCRYPT_NOINLINE
VOID
SYMCRYPT_CALL
SymCryptCcmDecryptPart(
    _Inout_                 PSYMCRYPT_CCM_STATE pState,
    _In_reads_( cbData )    PCBYTE              pbSrc,
    _Out_writes_( cbData )  PBYTE               pbDst,
                            SIZE_T              cbData )
{
    UINT64 bytesProcessedAfterThisCall;

    SYMCRYPT_CHECK_MAGIC( pState );

    bytesProcessedAfterThisCall = cbData + pState->bytesProcessed;

    SYMCRYPT_ASSERT( bytesProcessedAfterThisCall >= cbData &&
                     bytesProcessedAfterThisCall <= pState->cbData );


    //
    // We are violating the read-once/write-once implementation rule here.
    // We write the decrypted data and then read it back for the authentication function.
    // In this particular situation this is safe to do.
    //
    // Anyone who can access the memory space that contains the source and destination of this
    // function can recover the key stream used for this (key,nonce) combination.
    // We can think of the decryption function as merely exposing the key stream, and then the
    // caller picking the ciphertext (and by implication the plaintext) to be authenticated.
    // Thus the data we read during authentication is the 'real' plaintext, and the
    // decryption function merely made the key stream available.
    //
    // Note that this would not safe in general, it is only safe because CTR mode decryption already
    // reveals the key stream.
    //
    SymCryptCcmEncryptDecryptPart( pState, pbSrc, pbDst, cbData );
    SymCryptCcmAddMacData( pState, pbDst, cbData );

}

SYMCRYPT_NOINLINE
SYMCRYPT_ERROR
SYMCRYPT_CALL
SymCryptCcmDecryptFinal(
    _Inout_             PSYMCRYPT_CCM_STATE pState,
    _In_reads_( cbTag ) PCBYTE              pbTag,
                        SIZE_T              cbTag )
{
    SYMCRYPT_ERROR status;

    //
    // Check invariants in checked builds
    //
    SYMCRYPT_CHECK_MAGIC( pState );

    SYMCRYPT_ASSERT( cbTag  == pState->cbTag && pState->bytesProcessed == pState->cbData );

    SymCryptCcmPadMacData( pState );

    //
    // Set the counter value to zero to get the counter value that encrypts the tag,
    // and then encrypt the tag
    // We reset bytesProcessed so that the partial encrypt/decrypt function will do the right thing
    //
    SymCryptWipe( &pState->counterBlock[1 + pState->cbNonce], pState->cbCounter );

    pState->bytesProcessed = 0;

    SymCryptCcmEncryptDecryptPart( pState, &pState->macBlock[0], &pState->macBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );

    if( !SymCryptEqual( pbTag, &pState->macBlock[0], cbTag ) )
    {
        status = SYMCRYPT_AUTHENTICATION_FAILURE;
    }
    else
    {
        status = SYMCRYPT_NO_ERROR;
    }

    SymCryptWipeKnownSize( pState, sizeof( *pState ) );
    SYMCRYPT_ASSERT( pState->bytesInMacBlock == 0 );

    return status;
}


static const BYTE SymCryptCcmSelftestResult[3 + SYMCRYPT_AES_BLOCK_SIZE ] =
{
    0x42, 0xd7, 0xda,
    0x3d, 0x9e, 0x95, 0x82, 0x29, 0x3c, 0x10, 0x9c, 0xa3, 0x39, 0x31, 0x3f, 0x18, 0xf3, 0x10, 0xf6
};

VOID
SYMCRYPT_CALL
SymCryptCcmSelftest(void)
{
    BYTE    buf[ 3 + SYMCRYPT_AES_BLOCK_SIZE ];
    SYMCRYPT_AES_EXPANDED_KEY key;
    SYMCRYPT_ERROR err;

    if( SymCryptAesExpandKey( &key, SymCryptTestKey32, 16 ) != SYMCRYPT_NO_ERROR )
    {
        SymCryptFatal( 'ccm0' );
    }

    SymCryptCcmEncrypt( SymCryptAesBlockCipher,
                        &key,
                        &SymCryptTestKey32[16], 12,
                        NULL, 0,
                        &SymCryptTestMsg3[0], buf, 3,
                        &buf[3], SYMCRYPT_AES_BLOCK_SIZE );

    SymCryptInjectError( buf, sizeof( buf ) );
    if( memcmp( buf, SymCryptCcmSelftestResult, sizeof( buf ) ) != 0 )
    {
        SymCryptFatal( 'ccm1' );
    }

    // inject error into the ciphertext or tag
    SymCryptInjectError( buf, sizeof( buf ) );

    err = SymCryptCcmDecrypt(   SymCryptAesBlockCipher,
                                &key,
                                &SymCryptTestKey32[16], 12,
                                NULL, 0,
                                buf, buf, 3,
                                &buf[3], SYMCRYPT_AES_BLOCK_SIZE );

    SymCryptInjectError( buf, 3 );

    if( err != SYMCRYPT_NO_ERROR || memcmp( buf, SymCryptTestMsg3, 3 ) != 0 )
    {
        SymCryptFatal( 'ccm2' );
    }

}