1 /* 2 * Copyright 2012-2016 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "internal/constant_time_locl.h" 11 #include "ssl_locl.h" 12 13 #include <openssl/md5.h> 14 #include <openssl/sha.h> 15 16 /* 17 * MAX_HASH_BIT_COUNT_BYTES is the maximum number of bytes in the hash's 18 * length field. (SHA-384/512 have 128-bit length.) 19 */ 20 #define MAX_HASH_BIT_COUNT_BYTES 16 21 22 /* 23 * MAX_HASH_BLOCK_SIZE is the maximum hash block size that we'll support. 24 * Currently SHA-384/512 has a 128-byte block size and that's the largest 25 * supported by TLS.) 26 */ 27 #define MAX_HASH_BLOCK_SIZE 128 28 29 /* 30 * u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in 31 * little-endian order. The value of p is advanced by four. 32 */ 33 #define u32toLE(n, p) \ 34 (*((p)++)=(unsigned char)(n), \ 35 *((p)++)=(unsigned char)(n>>8), \ 36 *((p)++)=(unsigned char)(n>>16), \ 37 *((p)++)=(unsigned char)(n>>24)) 38 39 /* 40 * These functions serialize the state of a hash and thus perform the 41 * standard "final" operation without adding the padding and length that such 42 * a function typically does. 43 */ 44 static void tls1_md5_final_raw(void *ctx, unsigned char *md_out) 45 { 46 MD5_CTX *md5 = ctx; 47 u32toLE(md5->A, md_out); 48 u32toLE(md5->B, md_out); 49 u32toLE(md5->C, md_out); 50 u32toLE(md5->D, md_out); 51 } 52 53 static void tls1_sha1_final_raw(void *ctx, unsigned char *md_out) 54 { 55 SHA_CTX *sha1 = ctx; 56 l2n(sha1->h0, md_out); 57 l2n(sha1->h1, md_out); 58 l2n(sha1->h2, md_out); 59 l2n(sha1->h3, md_out); 60 l2n(sha1->h4, md_out); 61 } 62 63 static void tls1_sha256_final_raw(void *ctx, unsigned char *md_out) 64 { 65 SHA256_CTX *sha256 = ctx; 66 unsigned i; 67 68 for (i = 0; i < 8; i++) { 69 l2n(sha256->h[i], md_out); 70 } 71 } 72 73 static void tls1_sha512_final_raw(void *ctx, unsigned char *md_out) 74 { 75 SHA512_CTX *sha512 = ctx; 76 unsigned i; 77 78 for (i = 0; i < 8; i++) { 79 l2n8(sha512->h[i], md_out); 80 } 81 } 82 83 #undef LARGEST_DIGEST_CTX 84 #define LARGEST_DIGEST_CTX SHA512_CTX 85 86 /* 87 * ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function 88 * which ssl3_cbc_digest_record supports. 89 */ 90 char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx) 91 { 92 if (FIPS_mode()) 93 return 0; 94 switch (EVP_MD_CTX_type(ctx)) { 95 case NID_md5: 96 case NID_sha1: 97 case NID_sha224: 98 case NID_sha256: 99 case NID_sha384: 100 case NID_sha512: 101 return 1; 102 default: 103 return 0; 104 } 105 } 106 107 /*- 108 * ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS 109 * record. 110 * 111 * ctx: the EVP_MD_CTX from which we take the hash function. 112 * ssl3_cbc_record_digest_supported must return true for this EVP_MD_CTX. 113 * md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written. 114 * md_out_size: if non-NULL, the number of output bytes is written here. 115 * header: the 13-byte, TLS record header. 116 * data: the record data itself, less any preceding explicit IV. 117 * data_plus_mac_size: the secret, reported length of the data and MAC 118 * once the padding has been removed. 119 * data_plus_mac_plus_padding_size: the public length of the whole 120 * record, including padding. 121 * is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS. 122 * 123 * On entry: by virtue of having been through one of the remove_padding 124 * functions, above, we know that data_plus_mac_size is large enough to contain 125 * a padding byte and MAC. (If the padding was invalid, it might contain the 126 * padding too. ) 127 * Returns 1 on success or 0 on error 128 */ 129 int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, 130 unsigned char *md_out, 131 size_t *md_out_size, 132 const unsigned char header[13], 133 const unsigned char *data, 134 size_t data_plus_mac_size, 135 size_t data_plus_mac_plus_padding_size, 136 const unsigned char *mac_secret, 137 unsigned mac_secret_length, char is_sslv3) 138 { 139 union { 140 double align; 141 unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; 142 } md_state; 143 void (*md_final_raw) (void *ctx, unsigned char *md_out); 144 void (*md_transform) (void *ctx, const unsigned char *block); 145 unsigned md_size, md_block_size = 64; 146 unsigned sslv3_pad_length = 40, header_length, variance_blocks, 147 len, max_mac_bytes, num_blocks, 148 num_starting_blocks, k, mac_end_offset, c, index_a, index_b; 149 unsigned int bits; /* at most 18 bits */ 150 unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES]; 151 /* hmac_pad is the masked HMAC key. */ 152 unsigned char hmac_pad[MAX_HASH_BLOCK_SIZE]; 153 unsigned char first_block[MAX_HASH_BLOCK_SIZE]; 154 unsigned char mac_out[EVP_MAX_MD_SIZE]; 155 unsigned i, j, md_out_size_u; 156 EVP_MD_CTX *md_ctx = NULL; 157 /* 158 * mdLengthSize is the number of bytes in the length field that 159 * terminates * the hash. 160 */ 161 unsigned md_length_size = 8; 162 char length_is_big_endian = 1; 163 int ret; 164 165 /* 166 * This is a, hopefully redundant, check that allows us to forget about 167 * many possible overflows later in this function. 168 */ 169 OPENSSL_assert(data_plus_mac_plus_padding_size < 1024 * 1024); 170 171 switch (EVP_MD_CTX_type(ctx)) { 172 case NID_md5: 173 if (MD5_Init((MD5_CTX *)md_state.c) <= 0) 174 return 0; 175 md_final_raw = tls1_md5_final_raw; 176 md_transform = 177 (void (*)(void *ctx, const unsigned char *block))MD5_Transform; 178 md_size = 16; 179 sslv3_pad_length = 48; 180 length_is_big_endian = 0; 181 break; 182 case NID_sha1: 183 if (SHA1_Init((SHA_CTX *)md_state.c) <= 0) 184 return 0; 185 md_final_raw = tls1_sha1_final_raw; 186 md_transform = 187 (void (*)(void *ctx, const unsigned char *block))SHA1_Transform; 188 md_size = 20; 189 break; 190 case NID_sha224: 191 if (SHA224_Init((SHA256_CTX *)md_state.c) <= 0) 192 return 0; 193 md_final_raw = tls1_sha256_final_raw; 194 md_transform = 195 (void (*)(void *ctx, const unsigned char *block))SHA256_Transform; 196 md_size = 224 / 8; 197 break; 198 case NID_sha256: 199 if (SHA256_Init((SHA256_CTX *)md_state.c) <= 0) 200 return 0; 201 md_final_raw = tls1_sha256_final_raw; 202 md_transform = 203 (void (*)(void *ctx, const unsigned char *block))SHA256_Transform; 204 md_size = 32; 205 break; 206 case NID_sha384: 207 if (SHA384_Init((SHA512_CTX *)md_state.c) <= 0) 208 return 0; 209 md_final_raw = tls1_sha512_final_raw; 210 md_transform = 211 (void (*)(void *ctx, const unsigned char *block))SHA512_Transform; 212 md_size = 384 / 8; 213 md_block_size = 128; 214 md_length_size = 16; 215 break; 216 case NID_sha512: 217 if (SHA512_Init((SHA512_CTX *)md_state.c) <= 0) 218 return 0; 219 md_final_raw = tls1_sha512_final_raw; 220 md_transform = 221 (void (*)(void *ctx, const unsigned char *block))SHA512_Transform; 222 md_size = 64; 223 md_block_size = 128; 224 md_length_size = 16; 225 break; 226 default: 227 /* 228 * ssl3_cbc_record_digest_supported should have been called first to 229 * check that the hash function is supported. 230 */ 231 OPENSSL_assert(0); 232 if (md_out_size) 233 *md_out_size = 0; 234 return 0; 235 } 236 237 OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES); 238 OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE); 239 OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE); 240 241 header_length = 13; 242 if (is_sslv3) { 243 header_length = mac_secret_length + sslv3_pad_length + 8 /* sequence 244 * number */ + 245 1 /* record type */ + 246 2 /* record length */ ; 247 } 248 249 /* 250 * variance_blocks is the number of blocks of the hash that we have to 251 * calculate in constant time because they could be altered by the 252 * padding value. In SSLv3, the padding must be minimal so the end of 253 * the plaintext varies by, at most, 15+20 = 35 bytes. (We conservatively 254 * assume that the MAC size varies from 0..20 bytes.) In case the 9 bytes 255 * of hash termination (0x80 + 64-bit length) don't fit in the final 256 * block, we say that the final two blocks can vary based on the padding. 257 * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not 258 * required to be minimal. Therefore we say that the final six blocks can 259 * vary based on the padding. Later in the function, if the message is 260 * short and there obviously cannot be this many blocks then 261 * variance_blocks can be reduced. 262 */ 263 variance_blocks = is_sslv3 ? 2 : 6; 264 /* 265 * From now on we're dealing with the MAC, which conceptually has 13 266 * bytes of `header' before the start of the data (TLS) or 71/75 bytes 267 * (SSLv3) 268 */ 269 len = data_plus_mac_plus_padding_size + header_length; 270 /* 271 * max_mac_bytes contains the maximum bytes of bytes in the MAC, 272 * including * |header|, assuming that there's no padding. 273 */ 274 max_mac_bytes = len - md_size - 1; 275 /* num_blocks is the maximum number of hash blocks. */ 276 num_blocks = 277 (max_mac_bytes + 1 + md_length_size + md_block_size - 278 1) / md_block_size; 279 /* 280 * In order to calculate the MAC in constant time we have to handle the 281 * final blocks specially because the padding value could cause the end 282 * to appear somewhere in the final |variance_blocks| blocks and we can't 283 * leak where. However, |num_starting_blocks| worth of data can be hashed 284 * right away because no padding value can affect whether they are 285 * plaintext. 286 */ 287 num_starting_blocks = 0; 288 /* 289 * k is the starting byte offset into the conceptual header||data where 290 * we start processing. 291 */ 292 k = 0; 293 /* 294 * mac_end_offset is the index just past the end of the data to be MACed. 295 */ 296 mac_end_offset = data_plus_mac_size + header_length - md_size; 297 /* 298 * c is the index of the 0x80 byte in the final hash block that contains 299 * application data. 300 */ 301 c = mac_end_offset % md_block_size; 302 /* 303 * index_a is the hash block number that contains the 0x80 terminating 304 * value. 305 */ 306 index_a = mac_end_offset / md_block_size; 307 /* 308 * index_b is the hash block number that contains the 64-bit hash length, 309 * in bits. 310 */ 311 index_b = (mac_end_offset + md_length_size) / md_block_size; 312 /* 313 * bits is the hash-length in bits. It includes the additional hash block 314 * for the masked HMAC key, or whole of |header| in the case of SSLv3. 315 */ 316 317 /* 318 * For SSLv3, if we're going to have any starting blocks then we need at 319 * least two because the header is larger than a single block. 320 */ 321 if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0)) { 322 num_starting_blocks = num_blocks - variance_blocks; 323 k = md_block_size * num_starting_blocks; 324 } 325 326 bits = 8 * mac_end_offset; 327 if (!is_sslv3) { 328 /* 329 * Compute the initial HMAC block. For SSLv3, the padding and secret 330 * bytes are included in |header| because they take more than a 331 * single block. 332 */ 333 bits += 8 * md_block_size; 334 memset(hmac_pad, 0, md_block_size); 335 OPENSSL_assert(mac_secret_length <= sizeof(hmac_pad)); 336 memcpy(hmac_pad, mac_secret, mac_secret_length); 337 for (i = 0; i < md_block_size; i++) 338 hmac_pad[i] ^= 0x36; 339 340 md_transform(md_state.c, hmac_pad); 341 } 342 343 if (length_is_big_endian) { 344 memset(length_bytes, 0, md_length_size - 4); 345 length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24); 346 length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16); 347 length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8); 348 length_bytes[md_length_size - 1] = (unsigned char)bits; 349 } else { 350 memset(length_bytes, 0, md_length_size); 351 length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24); 352 length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16); 353 length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8); 354 length_bytes[md_length_size - 8] = (unsigned char)bits; 355 } 356 357 if (k > 0) { 358 if (is_sslv3) { 359 unsigned overhang; 360 361 /* 362 * The SSLv3 header is larger than a single block. overhang is 363 * the number of bytes beyond a single block that the header 364 * consumes: either 7 bytes (SHA1) or 11 bytes (MD5). There are no 365 * ciphersuites in SSLv3 that are not SHA1 or MD5 based and 366 * therefore we can be confident that the header_length will be 367 * greater than |md_block_size|. However we add a sanity check just 368 * in case 369 */ 370 if (header_length <= md_block_size) { 371 /* Should never happen */ 372 return 0; 373 } 374 overhang = header_length - md_block_size; 375 md_transform(md_state.c, header); 376 memcpy(first_block, header + md_block_size, overhang); 377 memcpy(first_block + overhang, data, md_block_size - overhang); 378 md_transform(md_state.c, first_block); 379 for (i = 1; i < k / md_block_size - 1; i++) 380 md_transform(md_state.c, data + md_block_size * i - overhang); 381 } else { 382 /* k is a multiple of md_block_size. */ 383 memcpy(first_block, header, 13); 384 memcpy(first_block + 13, data, md_block_size - 13); 385 md_transform(md_state.c, first_block); 386 for (i = 1; i < k / md_block_size; i++) 387 md_transform(md_state.c, data + md_block_size * i - 13); 388 } 389 } 390 391 memset(mac_out, 0, sizeof(mac_out)); 392 393 /* 394 * We now process the final hash blocks. For each block, we construct it 395 * in constant time. If the |i==index_a| then we'll include the 0x80 396 * bytes and zero pad etc. For each block we selectively copy it, in 397 * constant time, to |mac_out|. 398 */ 399 for (i = num_starting_blocks; i <= num_starting_blocks + variance_blocks; 400 i++) { 401 unsigned char block[MAX_HASH_BLOCK_SIZE]; 402 unsigned char is_block_a = constant_time_eq_8(i, index_a); 403 unsigned char is_block_b = constant_time_eq_8(i, index_b); 404 for (j = 0; j < md_block_size; j++) { 405 unsigned char b = 0, is_past_c, is_past_cp1; 406 if (k < header_length) 407 b = header[k]; 408 else if (k < data_plus_mac_plus_padding_size + header_length) 409 b = data[k - header_length]; 410 k++; 411 412 is_past_c = is_block_a & constant_time_ge_8(j, c); 413 is_past_cp1 = is_block_a & constant_time_ge_8(j, c + 1); 414 /* 415 * If this is the block containing the end of the application 416 * data, and we are at the offset for the 0x80 value, then 417 * overwrite b with 0x80. 418 */ 419 b = constant_time_select_8(is_past_c, 0x80, b); 420 /* 421 * If this the the block containing the end of the application 422 * data and we're past the 0x80 value then just write zero. 423 */ 424 b = b & ~is_past_cp1; 425 /* 426 * If this is index_b (the final block), but not index_a (the end 427 * of the data), then the 64-bit length didn't fit into index_a 428 * and we're having to add an extra block of zeros. 429 */ 430 b &= ~is_block_b | is_block_a; 431 432 /* 433 * The final bytes of one of the blocks contains the length. 434 */ 435 if (j >= md_block_size - md_length_size) { 436 /* If this is index_b, write a length byte. */ 437 b = constant_time_select_8(is_block_b, 438 length_bytes[j - 439 (md_block_size - 440 md_length_size)], b); 441 } 442 block[j] = b; 443 } 444 445 md_transform(md_state.c, block); 446 md_final_raw(md_state.c, block); 447 /* If this is index_b, copy the hash value to |mac_out|. */ 448 for (j = 0; j < md_size; j++) 449 mac_out[j] |= block[j] & is_block_b; 450 } 451 452 md_ctx = EVP_MD_CTX_new(); 453 if (md_ctx == NULL) 454 goto err; 455 if (EVP_DigestInit_ex(md_ctx, EVP_MD_CTX_md(ctx), NULL /* engine */ ) <= 0) 456 goto err; 457 if (is_sslv3) { 458 /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */ 459 memset(hmac_pad, 0x5c, sslv3_pad_length); 460 461 if (EVP_DigestUpdate(md_ctx, mac_secret, mac_secret_length) <= 0 462 || EVP_DigestUpdate(md_ctx, hmac_pad, sslv3_pad_length) <= 0 463 || EVP_DigestUpdate(md_ctx, mac_out, md_size) <= 0) 464 goto err; 465 } else { 466 /* Complete the HMAC in the standard manner. */ 467 for (i = 0; i < md_block_size; i++) 468 hmac_pad[i] ^= 0x6a; 469 470 if (EVP_DigestUpdate(md_ctx, hmac_pad, md_block_size) <= 0 471 || EVP_DigestUpdate(md_ctx, mac_out, md_size) <= 0) 472 goto err; 473 } 474 ret = EVP_DigestFinal(md_ctx, md_out, &md_out_size_u); 475 if (ret && md_out_size) 476 *md_out_size = md_out_size_u; 477 EVP_MD_CTX_free(md_ctx); 478 479 return 1; 480 err: 481 EVP_MD_CTX_free(md_ctx); 482 return 0; 483 } 484 485 /* 486 * Due to the need to use EVP in FIPS mode we can't reimplement digests but 487 * we can ensure the number of blocks processed is equal for all cases by 488 * digesting additional data. 489 */ 490 491 int tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx, 492 EVP_MD_CTX *mac_ctx, const unsigned char *data, 493 size_t data_len, size_t orig_len) 494 { 495 size_t block_size, digest_pad, blocks_data, blocks_orig; 496 if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE) 497 return 1; 498 block_size = EVP_MD_CTX_block_size(mac_ctx); 499 /*- 500 * We are in FIPS mode if we get this far so we know we have only SHA* 501 * digests and TLS to deal with. 502 * Minimum digest padding length is 17 for SHA384/SHA512 and 9 503 * otherwise. 504 * Additional header is 13 bytes. To get the number of digest blocks 505 * processed round up the amount of data plus padding to the nearest 506 * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise. 507 * So we have: 508 * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size 509 * equivalently: 510 * blocks = (payload_len + digest_pad + 12)/block_size + 1 511 * HMAC adds a constant overhead. 512 * We're ultimately only interested in differences so this becomes 513 * blocks = (payload_len + 29)/128 514 * for SHA384/SHA512 and 515 * blocks = (payload_len + 21)/64 516 * otherwise. 517 */ 518 digest_pad = block_size == 64 ? 21 : 29; 519 blocks_orig = (orig_len + digest_pad) / block_size; 520 blocks_data = (data_len + digest_pad) / block_size; 521 /* 522 * MAC enough blocks to make up the difference between the original and 523 * actual lengths plus one extra block to ensure this is never a no op. 524 * The "data" pointer should always have enough space to perform this 525 * operation as it is large enough for a maximum length TLS buffer. 526 */ 527 return EVP_DigestSignUpdate(mac_ctx, data, 528 (blocks_orig - blocks_data + 1) * block_size); 529 } 530