X-Git-Url: http://www.wagner.pp.ru/gitweb/?a=blobdiff_plain;f=gost_grasshopper_cipher.c;h=ef06e2d3f68dabdbba79c320913421a8c5a5bb2a;hb=HEAD;hp=21d503814e2c037d55e51eef5c8a7c711f70bbbb;hpb=ad49fa11916e86b4f28d561e288b44895787e240;p=openssl-gost%2Fengine.git diff --git a/gost_grasshopper_cipher.c b/gost_grasshopper_cipher.c index 21d5038..ef06e2d 100644 --- a/gost_grasshopper_cipher.c +++ b/gost_grasshopper_cipher.c @@ -1,5 +1,6 @@ /* * Maxim Tishkov 2016 + * Copyright (c) 2020 Vitaly Chikunov * This file is distributed under the same license as OpenSSL */ @@ -7,6 +8,7 @@ #include "gost_grasshopper_defines.h" #include "gost_grasshopper_math.h" #include "gost_grasshopper_core.h" +#include "gost_gost2015.h" #include #include @@ -23,97 +25,130 @@ enum GRASSHOPPER_CIPHER_TYPE { GRASSHOPPER_CIPHER_CFB, GRASSHOPPER_CIPHER_CTR, GRASSHOPPER_CIPHER_CTRACPKM, + GRASSHOPPER_CIPHER_CTRACPKMOMAC, + GRASSHOPPER_CIPHER_MGM, }; -static EVP_CIPHER *gost_grasshopper_ciphers[6] = { - [GRASSHOPPER_CIPHER_ECB] = NULL, - [GRASSHOPPER_CIPHER_CBC] = NULL, - [GRASSHOPPER_CIPHER_OFB] = NULL, - [GRASSHOPPER_CIPHER_CFB] = NULL, - [GRASSHOPPER_CIPHER_CTR] = NULL, - [GRASSHOPPER_CIPHER_CTRACPKM] = NULL, +static GOST_cipher grasshopper_template_cipher = { + .block_size = GRASSHOPPER_BLOCK_SIZE, + .key_len = GRASSHOPPER_KEY_SIZE, + .flags = EVP_CIPH_RAND_KEY | + EVP_CIPH_ALWAYS_CALL_INIT, + .cleanup = gost_grasshopper_cipher_cleanup, + .ctx_size = sizeof(gost_grasshopper_cipher_ctx), + .set_asn1_parameters = gost_grasshopper_set_asn1_parameters, + .get_asn1_parameters = gost_grasshopper_get_asn1_parameters, + .ctrl = gost_grasshopper_cipher_ctl, }; -static GRASSHOPPER_INLINE void -gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c); -static GRASSHOPPER_INLINE void -gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c); - -struct GRASSHOPPER_CIPHER_PARAMS { - int nid; - grasshopper_init_cipher_func init_cipher; - grasshopper_do_cipher_func do_cipher; - grasshopper_destroy_cipher_func destroy_cipher; - int block_size; - int ctx_size; - int iv_size; - bool padding; +GOST_cipher grasshopper_ecb_cipher = { + .nid = NID_grasshopper_ecb, + .template = &grasshopper_template_cipher, + .flags = EVP_CIPH_ECB_MODE, + .init = gost_grasshopper_cipher_init_ecb, + .do_cipher = gost_grasshopper_cipher_do_ecb, +}; + +GOST_cipher grasshopper_cbc_cipher = { + .nid = NID_grasshopper_cbc, + .template = &grasshopper_template_cipher, + .iv_len = 16, + .flags = EVP_CIPH_CBC_MODE | + EVP_CIPH_CUSTOM_IV, + .init = gost_grasshopper_cipher_init_cbc, + .do_cipher = gost_grasshopper_cipher_do_cbc, +}; + +GOST_cipher grasshopper_ofb_cipher = { + .nid = NID_grasshopper_ofb, + .template = &grasshopper_template_cipher, + .block_size = 1, + .iv_len = 16, + .flags = EVP_CIPH_OFB_MODE | + EVP_CIPH_NO_PADDING | + EVP_CIPH_CUSTOM_IV, + .init = gost_grasshopper_cipher_init_ofb, + .do_cipher = gost_grasshopper_cipher_do_ofb, +}; + +GOST_cipher grasshopper_cfb_cipher = { + .nid = NID_grasshopper_cfb, + .template = &grasshopper_template_cipher, + .block_size = 1, + .iv_len = 16, + .flags = EVP_CIPH_CFB_MODE | + EVP_CIPH_NO_PADDING | + EVP_CIPH_CUSTOM_IV, + .init = gost_grasshopper_cipher_init_cfb, + .do_cipher = gost_grasshopper_cipher_do_cfb, +}; + +GOST_cipher grasshopper_ctr_cipher = { + .nid = NID_grasshopper_ctr, + .template = &grasshopper_template_cipher, + .block_size = 1, + .iv_len = 8, + .flags = EVP_CIPH_CTR_MODE | + EVP_CIPH_NO_PADDING | + EVP_CIPH_CUSTOM_IV, + .init = gost_grasshopper_cipher_init_ctr, + .do_cipher = gost_grasshopper_cipher_do_ctr, + .ctx_size = sizeof(gost_grasshopper_cipher_ctx_ctr), +}; + +GOST_cipher grasshopper_ctr_acpkm_cipher = { + .nid = NID_kuznyechik_ctr_acpkm, + .template = &grasshopper_template_cipher, + .block_size = 1, + .iv_len = 8, + .flags = EVP_CIPH_CTR_MODE | + EVP_CIPH_NO_PADDING | + EVP_CIPH_CUSTOM_IV, + .init = gost_grasshopper_cipher_init_ctracpkm, + .do_cipher = gost_grasshopper_cipher_do_ctracpkm, + .ctx_size = sizeof(gost_grasshopper_cipher_ctx_ctr), +}; + +GOST_cipher grasshopper_ctr_acpkm_omac_cipher = { + .nid = NID_kuznyechik_ctr_acpkm_omac, + .template = &grasshopper_template_cipher, + .block_size = 1, + .iv_len = 8, + .flags = EVP_CIPH_CTR_MODE | + EVP_CIPH_NO_PADDING | + EVP_CIPH_CUSTOM_IV | + EVP_CIPH_FLAG_CUSTOM_CIPHER | + EVP_CIPH_FLAG_CIPHER_WITH_MAC | + EVP_CIPH_CUSTOM_COPY, + .init = gost_grasshopper_cipher_init_ctracpkm_omac, + .do_cipher = gost_grasshopper_cipher_do_ctracpkm_omac, + .ctx_size = sizeof(gost_grasshopper_cipher_ctx_ctr), }; -static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[6] = { - [GRASSHOPPER_CIPHER_ECB] = { - NID_grasshopper_ecb, - gost_grasshopper_cipher_init_ecb, - gost_grasshopper_cipher_do_ecb, - NULL, - 16, - sizeof(gost_grasshopper_cipher_ctx), - 0, - true} - , - [GRASSHOPPER_CIPHER_CBC] = { - NID_grasshopper_cbc, - gost_grasshopper_cipher_init_cbc, - gost_grasshopper_cipher_do_cbc, - NULL, - 16, - sizeof(gost_grasshopper_cipher_ctx), - 16, - true} - , - [GRASSHOPPER_CIPHER_OFB] = { - NID_grasshopper_ofb, - gost_grasshopper_cipher_init_ofb, - gost_grasshopper_cipher_do_ofb, - gost_grasshopper_cipher_destroy_ofb, - 1, - sizeof(gost_grasshopper_cipher_ctx_ofb), - 16, - false} - , - [GRASSHOPPER_CIPHER_CFB] = { - NID_grasshopper_cfb, - gost_grasshopper_cipher_init_cfb, - gost_grasshopper_cipher_do_cfb, - NULL, - 1, - sizeof(gost_grasshopper_cipher_ctx), - 16, - false} - , - [GRASSHOPPER_CIPHER_CTR] = { - NID_grasshopper_ctr, - gost_grasshopper_cipher_init_ctr, - gost_grasshopper_cipher_do_ctr, - gost_grasshopper_cipher_destroy_ctr, - 1, - sizeof(gost_grasshopper_cipher_ctx_ctr), - /* IV size is set to match full block, to make it responsibility of - * user to assign correct values (IV || 0), and to make naive context - * copy possible (for software such as openssh) */ - 16, - false} - , - [GRASSHOPPER_CIPHER_CTRACPKM] = { - NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm, - gost_grasshopper_cipher_init_ctracpkm, - gost_grasshopper_cipher_do_ctracpkm, - gost_grasshopper_cipher_destroy_ctr, - 1, - sizeof(gost_grasshopper_cipher_ctx_ctr), - 16, - false} - , +GOST_cipher grasshopper_mgm_cipher = { + .nid = NID_undef, + .template = &grasshopper_template_cipher, + .block_size = 1, + .iv_len = 16, + .flags = EVP_CIPH_NO_PADDING | + EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER | + EVP_CIPH_CTRL_INIT | EVP_CIPH_FLAG_AEAD_CIPHER, + .cleanup = gost_grasshopper_mgm_cleanup, + .ctrl = gost_grasshopper_mgm_ctrl, + .init = gost_grasshopper_cipher_init_mgm, + .do_cipher = gost_grasshopper_cipher_do_mgm, + .ctx_size = sizeof(gost_mgm_ctx) +}; + +static void kuznyechik_NID_callback (int nid) +{ + grasshopper_mgm_cipher.nid = nid; +} + +GOST_NID_JOB kuznyechik_mgm_NID = { + .sn = SN_kuznyechik_mgm, + .ln = SN_kuznyechik_mgm, + .callback = kuznyechik_NID_callback, }; /* first 256 bit of D from draft-irtf-cfrg-re-keying-12 */ @@ -143,7 +178,7 @@ static void acpkm_next(gost_grasshopper_cipher_ctx * c) } /* Set 256 bit key into context */ -GRASSHOPPER_INLINE void +static GRASSHOPPER_INLINE void gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) { int i; @@ -157,7 +192,7 @@ gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) } /* Set master 256-bit key to be used in TLSTREE calculation into context */ -GRASSHOPPER_INLINE void +static GRASSHOPPER_INLINE void gost_grasshopper_master_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) { int i; @@ -168,7 +203,7 @@ gost_grasshopper_master_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) } /* Cleans up key from context */ -GRASSHOPPER_INLINE void +static GRASSHOPPER_INLINE void gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) { int i; @@ -185,25 +220,19 @@ gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) grasshopper_zero128(&c->buffer); } -static GRASSHOPPER_INLINE void -gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c) -{ - gost_grasshopper_cipher_ctx_ofb *ctx = - (gost_grasshopper_cipher_ctx_ofb *) c; - - grasshopper_zero128(&ctx->buffer1); -} - static GRASSHOPPER_INLINE void gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c) { gost_grasshopper_cipher_ctx_ctr *ctx = (gost_grasshopper_cipher_ctx_ctr *) c; + if (ctx->omac_ctx) + EVP_MD_CTX_free(ctx->omac_ctx); + grasshopper_zero128(&ctx->partial_buffer); } -int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, +static int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc) { @@ -211,6 +240,11 @@ int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, if (EVP_CIPHER_CTX_get_app_data(ctx) == NULL) { EVP_CIPHER_CTX_set_app_data(ctx, EVP_CIPHER_CTX_get_cipher_data(ctx)); + if (enc && c->type == GRASSHOPPER_CIPHER_CTRACPKM) { + gost_grasshopper_cipher_ctx_ctr *ctr = EVP_CIPHER_CTX_get_cipher_data(ctx); + if (init_zero_kdf_seed(ctr->kdf_seed) == 0) + return -1; + } } if (key != NULL) { @@ -231,49 +265,50 @@ int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, return 1; } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, const unsigned char - *key, const unsigned char - *iv, int enc) +static GRASSHOPPER_INLINE int +gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) { gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_ECB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, const unsigned char - *key, const unsigned char - *iv, int enc) +static GRASSHOPPER_INLINE int +gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) { gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_CBC; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, const unsigned char - *key, const unsigned char - *iv, int enc) +static GRASSHOPPER_INLINE +int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) { - gost_grasshopper_cipher_ctx_ofb *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - - c->c.type = GRASSHOPPER_CIPHER_OFB; - - grasshopper_zero128(&c->buffer1); - + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + c->type = GRASSHOPPER_CIPHER_OFB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, const unsigned char - *key, const unsigned char - *iv, int enc) +static GRASSHOPPER_INLINE int +gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) { gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_CFB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, const unsigned char - *key, const unsigned char - *iv, int enc) +static GRASSHOPPER_INLINE int +gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) { gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -285,10 +320,11 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, con return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX - *ctx, const unsigned - char *key, const unsigned - char *iv, int enc) +static GRASSHOPPER_INLINE int +gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX + *ctx, const unsigned + char *key, const unsigned + char *iv, int enc) { gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -300,20 +336,180 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, - size_t inl) +static GRASSHOPPER_INLINE int +gost_grasshopper_cipher_init_ctracpkm_omac(EVP_CIPHER_CTX + *ctx, const unsigned + char *key, const unsigned + char *iv, int enc) { - gost_grasshopper_cipher_ctx *c = - (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); - struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + + /* NB: setting type makes EVP do_cipher callback useless */ + c->c.type = GRASSHOPPER_CIPHER_CTRACPKMOMAC; + EVP_CIPHER_CTX_set_num(ctx, 0); + c->section_size = 4096; + + if (key) { + unsigned char cipher_key[32]; + c->omac_ctx = EVP_MD_CTX_new(); - return params->do_cipher(ctx, out, in, inl); + if (c->omac_ctx == NULL) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_INIT_CTRACPKM_OMAC, ERR_R_MALLOC_FAILURE); + return 0; + } + + if (gost2015_acpkm_omac_init(NID_kuznyechik_mac, enc, key, + c->omac_ctx, cipher_key, c->kdf_seed) != 1) { + EVP_MD_CTX_free(c->omac_ctx); + c->omac_ctx = NULL; + return 0; + } + + return gost_grasshopper_cipher_init(ctx, cipher_key, iv, enc); + } + + return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) +// TODO: const *in, const *c +void gost_grasshopper_encrypt_wrap(unsigned char *in, unsigned char *out, + gost_grasshopper_cipher_ctx *c) { + grasshopper_encrypt_block(&c->encrypt_round_keys, + (grasshopper_w128_t *) in, + (grasshopper_w128_t *) out, + &c->buffer); +} + + + +/* ----------------------------------------------------------------------------------------------- */ +/*! Функция реализует операцию умножения двух элементов конечного поля \f$ \mathbb F_{2^{128}}\f$, + порожденного неприводимым многочленом + \f$ f(x) = x^{128} + x^7 + x^2 + x + 1 \in \mathbb F_2[x]\f$. Для умножения используется + простейшая реализация, основанная на приведении по модулю после каждого шага алгоритма. */ +/* ----------------------------------------------------------------------------------------------- */ +static void gf128_mul_uint64 (uint64_t *result, uint64_t *arg1, uint64_t *arg2) +{ + int i = 0; + register uint64_t t, X0, X1; + uint64_t Z0 = 0, Z1 = 0; + +#ifdef L_ENDIAN + X0 = BSWAP64(*(arg1 + 1)); + X1 = BSWAP64(*arg1); +#else + X0 = *(arg1 + 1); + X1 = *arg1; +#endif + + //first 64 bits of arg1 +#ifdef L_ENDIAN + t = BSWAP64(*(arg2 + 1)); +#else + t = *(arg2 + 1); +#endif + + for (i = 0; i < 64; i++) { + if (t & 0x1) { + Z0 ^= X0; + Z1 ^= X1; + } + t >>= 1; + if (X1 & 0x8000000000000000) { + X1 <<= 1; + X1 ^= X0>>63; + X0 <<= 1; + X0 ^= 0x87; + } + else { + X1 <<= 1; + X1 ^= X0>>63; + X0 <<= 1; + } + } + + //second 64 bits of arg2 +#ifdef L_ENDIAN + t = BSWAP64(*arg2); +#else + t = *arg2; +#endif + + for (i = 0; i < 63; i++) { + if (t & 0x1) { + Z0 ^= X0; + Z1 ^= X1; + } + t >>= 1; + if (X1 & 0x8000000000000000) { + X1 <<= 1; + X1 ^= X0>>63; + X0 <<= 1; + X0 ^= 0x87; + } + else { + X1 <<= 1; + X1 ^= X0>>63; + X0 <<= 1; + } + } + + if (t & 0x1) { + Z0 ^= X0; + Z1 ^= X1; + } + +#ifdef L_ENDIAN + result[0] = BSWAP64(Z1); + result[1] = BSWAP64(Z0); +#else + result[0] = Z1; + result[1] = Z0; +#endif +} + +static GRASSHOPPER_INLINE int +gost_grasshopper_cipher_init_mgm(EVP_CIPHER_CTX *ctx, const unsigned char *key, + const unsigned char *iv, int enc) +{ + gost_mgm_ctx *mctx = + (gost_mgm_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); + int bl; + + if (!iv && !key) + return 1; + if (key) { + bl = EVP_CIPHER_CTX_iv_length(ctx); + gost_grasshopper_cipher_key(&mctx->ks.gh_ks, key); + gost_mgm128_init(&mctx->mgm, &mctx->ks, + (block128_f) gost_grasshopper_encrypt_wrap, gf128_mul_uint64, bl); + + /* + * If we have an iv can set it directly, otherwise use saved IV. + */ + if (iv == NULL && mctx->iv_set) + iv = mctx->iv; + if (iv) { + if (gost_mgm128_setiv(&mctx->mgm, iv, mctx->ivlen) != 1) + return 0; + mctx->iv_set = 1; + } + mctx->key_set = 1; + } else { + /* If key set use IV, otherwise copy */ + if (mctx->key_set) { + if (gost_mgm128_setiv(&mctx->mgm, iv, mctx->ivlen) != 1) + return 0; + } + else + memcpy(mctx->iv, iv, mctx->ivlen); + mctx->iv_set = 1; + } + return 1; +} + +static int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) { gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -342,8 +538,8 @@ int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, return 1; } -int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) +static int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) { gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -351,8 +547,6 @@ int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); const unsigned char *current_in = in; unsigned char *current_out = out; - grasshopper_w128_t *currentInputBlock; - grasshopper_w128_t *currentOutputBlock; size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; size_t i; grasshopper_w128_t *currentBlock; @@ -362,8 +556,8 @@ int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, for (i = 0; i < blocks; i++, current_in += GRASSHOPPER_BLOCK_SIZE, current_out += GRASSHOPPER_BLOCK_SIZE) { - currentInputBlock = (grasshopper_w128_t *) current_in; - currentOutputBlock = (grasshopper_w128_t *) current_out; + grasshopper_w128_t *currentInputBlock = (grasshopper_w128_t *) current_in; + grasshopper_w128_t *currentOutputBlock = (grasshopper_w128_t *) current_out; if (encrypting) { grasshopper_append128(currentBlock, currentInputBlock); grasshopper_encrypt_block(&c->encrypt_round_keys, currentBlock, @@ -386,10 +580,10 @@ int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, void inc_counter(unsigned char *counter, size_t counter_bytes) { - unsigned char c; unsigned int n = counter_bytes; do { + unsigned char c; --n; c = counter[n]; ++c; @@ -405,8 +599,8 @@ static void ctr128_inc(unsigned char *counter) inc_counter(counter, 16); } -int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) +static int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) { gost_grasshopper_cipher_ctx_ctr *c = (gost_grasshopper_cipher_ctx_ctr *) EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -416,19 +610,21 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, grasshopper_w128_t *currentInputBlock; grasshopper_w128_t *currentOutputBlock; unsigned int n = EVP_CIPHER_CTX_num(ctx); - size_t lasted; + size_t lasted = inl; size_t i; + size_t blocks; + grasshopper_w128_t *iv_buffer; + grasshopper_w128_t tmp; - while (n && inl) { + while (n && lasted) { *(current_out++) = *(current_in++) ^ c->partial_buffer.b[n]; - --inl; + --lasted; n = (n + 1) % GRASSHOPPER_BLOCK_SIZE; } EVP_CIPHER_CTX_set_num(ctx, n); - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; + blocks = lasted / GRASSHOPPER_BLOCK_SIZE; - grasshopper_w128_t *iv_buffer = (grasshopper_w128_t *) iv; - grasshopper_w128_t tmp; + iv_buffer = (grasshopper_w128_t *) iv; // full parts for (i = 0; i < blocks; i++) { @@ -441,10 +637,9 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, ctr128_inc(iv_buffer->b); current_in += GRASSHOPPER_BLOCK_SIZE; current_out += GRASSHOPPER_BLOCK_SIZE; + lasted -= GRASSHOPPER_BLOCK_SIZE; } - // last part - lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; if (lasted > 0) { currentInputBlock = (grasshopper_w128_t *) current_in; currentOutputBlock = (grasshopper_w128_t *) current_out; @@ -458,7 +653,7 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, ctr128_inc(iv_buffer->b); } - return 1; + return inl; } #define GRASSHOPPER_BLOCK_MASK (GRASSHOPPER_BLOCK_SIZE - 1) @@ -473,22 +668,23 @@ static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr * /* If meshing is not configured via ctrl (setting section_size) * this function works exactly like plain ctr */ -int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, - unsigned char *out, - const unsigned char *in, size_t inl) +static int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, + unsigned char *out, + const unsigned char *in, + size_t inl) { gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); unsigned int num = EVP_CIPHER_CTX_num(ctx); + size_t blocks, i, lasted = inl; + grasshopper_w128_t tmp; - while ((num & GRASSHOPPER_BLOCK_MASK) && inl) { + while ((num & GRASSHOPPER_BLOCK_MASK) && lasted) { *out++ = *in++ ^ c->partial_buffer.b[num & GRASSHOPPER_BLOCK_MASK]; - --inl; + --lasted; num++; } - size_t blocks = inl / GRASSHOPPER_BLOCK_SIZE; - size_t i; - grasshopper_w128_t tmp; + blocks = lasted / GRASSHOPPER_BLOCK_SIZE; // full parts for (i = 0; i < blocks; i++) { @@ -504,10 +700,10 @@ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, in += GRASSHOPPER_BLOCK_SIZE; out += GRASSHOPPER_BLOCK_SIZE; num += GRASSHOPPER_BLOCK_SIZE; + lasted -= GRASSHOPPER_BLOCK_SIZE; } // last part - size_t lasted = inl - blocks * GRASSHOPPER_BLOCK_SIZE; if (lasted > 0) { apply_acpkm_grasshopper(c, &num); grasshopper_encrypt_block(&c->c.encrypt_round_keys, @@ -520,26 +716,108 @@ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, } EVP_CIPHER_CTX_set_num(ctx, num); - return 1; + return inl; +} + +static int gost_grasshopper_cipher_do_ctracpkm_omac(EVP_CIPHER_CTX *ctx, + unsigned char *out, + const unsigned char *in, + size_t inl) +{ + int result; + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + /* As in and out can be the same pointer, process unencrypted here */ + if (EVP_CIPHER_CTX_encrypting(ctx)) + EVP_DigestSignUpdate(c->omac_ctx, in, inl); + + if (in == NULL && inl == 0) { /* Final call */ + return gost2015_final_call(ctx, c->omac_ctx, KUZNYECHIK_MAC_MAX_SIZE, c->tag, gost_grasshopper_cipher_do_ctracpkm); + } + + if (in == NULL) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_DO_CTRACPKM_OMAC, ERR_R_EVP_LIB); + return -1; + } + result = gost_grasshopper_cipher_do_ctracpkm(ctx, out, in, inl); + + /* As in and out can be the same pointer, process decrypted here */ + if (!EVP_CIPHER_CTX_encrypting(ctx)) + EVP_DigestSignUpdate(c->omac_ctx, out, inl); + + return result; +} + + + +static int gost_grasshopper_cipher_do_mgm(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t len) +{ + gost_mgm_ctx *mctx = + (gost_mgm_ctx *)EVP_CIPHER_CTX_get_cipher_data(ctx); + int enc = EVP_CIPHER_CTX_encrypting(ctx); + + /* If not set up, return error */ + if (!mctx->key_set) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_DO_MGM, + GOST_R_BAD_ORDER); + return -1; + } + + if (!mctx->iv_set) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_DO_MGM, + GOST_R_BAD_ORDER); + return -1; + } + if (in) { + if (out == NULL) { + if (gost_mgm128_aad(&mctx->mgm, in, len)) + return -1; + } else if (enc) { + if (gost_mgm128_encrypt(&mctx->mgm, in, out, len)) + return -1; + } else { + if (gost_mgm128_decrypt(&mctx->mgm, in, out, len)) + return -1; + } + return len; + } else { + if (!enc) { + if (mctx->taglen < 0) + return -1; + if (gost_mgm128_finish(&mctx->mgm, + EVP_CIPHER_CTX_buf_noconst(ctx), + mctx->taglen) != 0) + return -1; + mctx->iv_set = 0; + return 0; + } + gost_mgm128_tag(&mctx->mgm, EVP_CIPHER_CTX_buf_noconst(ctx), 16); + mctx->taglen = 16; + /* Don't reuse the IV */ + mctx->iv_set = 0; + return 0; + } + } /* * Fixed 128-bit IV implementation make shift regiser redundant. */ -static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx_ofb * ctx, +static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx * ctx, grasshopper_w128_t * iv, grasshopper_w128_t * buf) { - memcpy(&ctx->buffer1, iv, 16); - grasshopper_encrypt_block(&ctx->c.encrypt_round_keys, &ctx->buffer1, - buf, &ctx->c.buffer); + grasshopper_w128_t tmp; + memcpy(&tmp, iv, 16); + grasshopper_encrypt_block(&ctx->encrypt_round_keys, &tmp, + buf, &ctx->buffer); memcpy(iv, buf, 16); } -int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) +static int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx_ofb *c = (gost_grasshopper_cipher_ctx_ofb *) + gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); const unsigned char *in_ptr = in; unsigned char *out_ptr = out; @@ -600,8 +878,8 @@ int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, return 1; } -int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) +static int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl) { gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -686,7 +964,7 @@ int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, return 1; } -int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) +static int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) { gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -694,57 +972,129 @@ int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) if (!c) return 1; - struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; - - gost_grasshopper_cipher_destroy(c); - if (params->destroy_cipher != NULL) { - params->destroy_cipher(c); - } + if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CTR_MODE) + gost_grasshopper_cipher_destroy_ctr(c); EVP_CIPHER_CTX_set_app_data(ctx, NULL); return 1; } -int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, ASN1_TYPE *params) +static int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, ASN1_TYPE *params) { - int len = 0; - unsigned char *buf = NULL; - ASN1_OCTET_STRING *os = NULL; + if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CTR_MODE) { + gost_grasshopper_cipher_ctx_ctr *ctr = EVP_CIPHER_CTX_get_cipher_data(ctx); - os = ASN1_OCTET_STRING_new(); + /* CMS implies 256kb section_size */ + ctr->section_size = 256*1024; - if (!os || !ASN1_OCTET_STRING_set(os, buf, len)) { - OPENSSL_free(buf); - GOSTerr(GOST_F_GOST_GRASSHOPPER_SET_ASN1_PARAMETERS, - ERR_R_MALLOC_FAILURE); - return 0; + return gost2015_set_asn1_params(params, + EVP_CIPHER_CTX_original_iv(ctx), 8, ctr->kdf_seed); } - OPENSSL_free(buf); - - ASN1_TYPE_set(params, V_ASN1_SEQUENCE, os); - return 1; + return 0; } -GRASSHOPPER_INLINE int gost_grasshopper_get_asn1_parameters(EVP_CIPHER_CTX - *ctx, ASN1_TYPE - *params) +static GRASSHOPPER_INLINE int +gost_grasshopper_get_asn1_parameters(EVP_CIPHER_CTX *ctx, ASN1_TYPE *params) { - int ret = -1; + if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CTR_MODE) { + gost_grasshopper_cipher_ctx_ctr *ctr = EVP_CIPHER_CTX_get_cipher_data(ctx); - if (ASN1_TYPE_get(params) != V_ASN1_SEQUENCE) { - return ret; + int iv_len = 16; + unsigned char iv[16]; + + if (gost2015_get_asn1_params(params, 16, iv, 8, ctr->kdf_seed) == 0) { + return 0; + } + + memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, iv_len); + memcpy((unsigned char *)EVP_CIPHER_CTX_original_iv(ctx), iv, iv_len); + + /* CMS implies 256kb section_size */ + ctr->section_size = 256*1024; + return 1; } + return 0; +} +static int gost_grasshopper_mgm_cleanup(EVP_CIPHER_CTX *c) +{ + gost_mgm_ctx *mctx = + (gost_mgm_ctx *)EVP_CIPHER_CTX_get_cipher_data(c); + if (mctx == NULL) + return 0; + gost_grasshopper_cipher_destroy(&mctx->ks.gh_ks); + OPENSSL_cleanse(&mctx->mgm, sizeof(mctx->mgm)); + if (mctx->iv != EVP_CIPHER_CTX_iv_noconst(c)) + OPENSSL_free(mctx->iv); return 1; } -int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr) +static int gost_grasshopper_mgm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) +{ + gost_mgm_ctx *mctx = + (gost_mgm_ctx *)EVP_CIPHER_CTX_get_cipher_data(c); + unsigned char *buf, *iv; + int ivlen, enc; + + switch (type) { + case EVP_CTRL_INIT: + ivlen = EVP_CIPHER_iv_length(EVP_CIPHER_CTX_cipher(c)); + iv = EVP_CIPHER_CTX_iv_noconst(c); + mctx->key_set = 0; + mctx->iv_set = 0; + mctx->ivlen = ivlen; + mctx->iv = iv; + mctx->taglen = -1; + return 1; + + case EVP_CTRL_GET_IVLEN: + *(int *)ptr = mctx->ivlen; + return 1; + + case EVP_CTRL_AEAD_SET_IVLEN: + if (arg <= 0) + return 0; + if ((arg > EVP_MAX_IV_LENGTH) && (arg > mctx->ivlen)) { + // TODO: Allocate memory for IV or set error + return 0; + } + mctx->ivlen = arg; + return 1; + + case EVP_CTRL_AEAD_SET_TAG: + buf = EVP_CIPHER_CTX_buf_noconst(c); + enc = EVP_CIPHER_CTX_encrypting(c); + if (arg <= 0 || arg != 16 || enc) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_MGM_CTRL, + GOST_R_INVALID_TAG_LENGTH); + return 0; + } + memcpy(buf, ptr, arg); + mctx->taglen = arg; + return 1; + + case EVP_CTRL_AEAD_GET_TAG: + buf = EVP_CIPHER_CTX_buf_noconst(c); + enc = EVP_CIPHER_CTX_encrypting(c); + if (arg <= 0 || arg > 16 || !enc || mctx->taglen < 0) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_MGM_CTRL, + GOST_R_INVALID_TAG_LENGTH); + return 0; + } + memcpy(ptr, buf, arg); + return 1; + + default: + return -1; + } +} + +static int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) { switch (type) { case EVP_CTRL_RAND_KEY:{ - if (RAND_bytes + if (RAND_priv_bytes ((unsigned char *)ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0) { GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_RNG_ERROR); return -1; @@ -754,152 +1104,128 @@ int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, case EVP_CTRL_KEY_MESH:{ gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); - if (c->c.type != GRASSHOPPER_CIPHER_CTRACPKM || !arg - || (arg % GRASSHOPPER_BLOCK_SIZE)) + if ((c->c.type != GRASSHOPPER_CIPHER_CTRACPKM && + c->c.type != GRASSHOPPER_CIPHER_CTRACPKMOMAC) + || (arg == 0) + || (arg % GRASSHOPPER_BLOCK_SIZE)) return -1; c->section_size = arg; break; } -#ifdef EVP_CTRL_TLS1_2_TLSTREE - case EVP_CTRL_TLS1_2_TLSTREE: + case EVP_CTRL_TLSTREE: { - unsigned char newkey[32]; - int mode = EVP_CIPHER_CTX_mode(ctx); - gost_grasshopper_cipher_ctx_ctr *ctr_ctx = NULL; - gost_grasshopper_cipher_ctx *c = NULL; - - if (mode != EVP_CIPH_CTR_MODE) - return -1; - - ctr_ctx = (gost_grasshopper_cipher_ctx_ctr *) - EVP_CIPHER_CTX_get_cipher_data(ctx); - c = &(ctr_ctx->c); - - if (gost_tlstree(NID_grasshopper_cbc, c->master_key.k.b, newkey, - (const unsigned char *)ptr) > 0) { - gost_grasshopper_cipher_key(c, newkey); - return 1; + unsigned char newkey[32]; + int mode = EVP_CIPHER_CTX_mode(ctx); + gost_grasshopper_cipher_ctx_ctr *ctr_ctx = NULL; + gost_grasshopper_cipher_ctx *c = NULL; + + unsigned char adjusted_iv[16]; + unsigned char seq[8]; + int j, carry, decrement_arg; + if (mode != EVP_CIPH_CTR_MODE) + return -1; + + ctr_ctx = (gost_grasshopper_cipher_ctx_ctr *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + c = &(ctr_ctx->c); + + /* + * 'arg' parameter indicates what we should do with sequence value. + * + * When function called, seq is incremented after MAC calculation. + * In ETM mode, we use seq 'as is' in the ctrl-function (arg = 0) + * Otherwise we have to decrease it in the implementation (arg = 1). + */ + memcpy(seq, ptr, 8); + decrement_arg = arg; + if (!decrement_sequence(seq, decrement_arg)) + { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_CTRL_CALL_FAILED); + return -1; + } + + if (gost_tlstree(NID_grasshopper_cbc, c->master_key.k.b, newkey, + (const unsigned char *)seq) > 0) { + memset(adjusted_iv, 0, 16); + memcpy(adjusted_iv, EVP_CIPHER_CTX_original_iv(ctx), 8); + for(j=7,carry=0; j>=0; j--) + { + int adj_byte = adjusted_iv[j]+seq[j]+carry; + carry = (adj_byte > 255) ? 1 : 0; + adjusted_iv[j] = adj_byte & 0xFF; } + EVP_CIPHER_CTX_set_num(ctx, 0); + memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), adjusted_iv, 16); + + gost_grasshopper_cipher_key(c, newkey); + return 1; + } } return -1; -#endif - default: - GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, - GOST_R_UNSUPPORTED_CIPHER_CTL_COMMAND); - return -1; - } - return 1; -} - -GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_create(int - cipher_type, int - block_size) -{ - return EVP_CIPHER_meth_new(cipher_type, block_size /* block_size */ , - GRASSHOPPER_KEY_SIZE /* key_size */ ); -} - -const int cipher_gost_grasshopper_setup(EVP_CIPHER *cipher, uint8_t mode, - int iv_size, bool padding) -{ - return EVP_CIPHER_meth_set_iv_length(cipher, iv_size) - && EVP_CIPHER_meth_set_flags(cipher, - (unsigned long)(mode | - ((!padding) ? - EVP_CIPH_NO_PADDING : - 0) | ((iv_size > - 0) ? - EVP_CIPH_CUSTOM_IV - : 0) | - EVP_CIPH_RAND_KEY | - EVP_CIPH_ALWAYS_CALL_INIT) - ) - && EVP_CIPHER_meth_set_cleanup(cipher, gost_grasshopper_cipher_cleanup) - && EVP_CIPHER_meth_set_set_asn1_params(cipher, - gost_grasshopper_set_asn1_parameters) - && EVP_CIPHER_meth_set_get_asn1_params(cipher, - gost_grasshopper_get_asn1_parameters) - && EVP_CIPHER_meth_set_ctrl(cipher, gost_grasshopper_cipher_ctl) - && EVP_CIPHER_meth_set_do_cipher(cipher, gost_grasshopper_cipher_do); -} - -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper(uint8_t mode, - uint8_t num) -{ - EVP_CIPHER **cipher; - struct GRASSHOPPER_CIPHER_PARAMS *params; - - cipher = &gost_grasshopper_ciphers[num]; +#if 0 + case EVP_CTRL_AEAD_GET_TAG: + case EVP_CTRL_AEAD_SET_TAG: + { + int taglen = arg; + unsigned char *tag = ptr; - if (*cipher == NULL) { - params = &gost_cipher_params[num]; + gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); + if (c->c.type != GRASSHOPPER_CIPHER_MGM) + return -1; - int nid = params->nid; - grasshopper_init_cipher_func init_cipher = params->init_cipher; - int block_size = params->block_size; - int ctx_size = params->ctx_size; - int iv_size = params->iv_size; - bool padding = params->padding; + if (taglen > KUZNYECHIK_MAC_MAX_SIZE) { + CRYPTOCOMerr(CRYPTOCOM_F_GOST_GRASSHOPPER_CIPHER_CTL, + CRYPTOCOM_R_INVALID_TAG_LENGTH); + return -1; + } - *cipher = cipher_gost_grasshopper_create(nid, block_size); - if (*cipher == NULL) { - return NULL; - } + if (type == EVP_CTRL_AEAD_GET_TAG) + memcpy(tag, c->final_tag, taglen); + else + memcpy(c->final_tag, tag, taglen); - if (!cipher_gost_grasshopper_setup(*cipher, mode, iv_size, padding) - || !EVP_CIPHER_meth_set_init(*cipher, init_cipher) - || !EVP_CIPHER_meth_set_impl_ctx_size(*cipher, ctx_size)) { - EVP_CIPHER_meth_free(*cipher); - *cipher = NULL; + return 1; } - } - - return *cipher; -} +#endif + case EVP_CTRL_PROCESS_UNPROTECTED: + { + STACK_OF(X509_ATTRIBUTE) *x = ptr; + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ecb() -{ - return cipher_gost_grasshopper(EVP_CIPH_ECB_MODE, GRASSHOPPER_CIPHER_ECB); -} + if (c->c.type != GRASSHOPPER_CIPHER_CTRACPKMOMAC) + return -1; -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cbc() -{ - return cipher_gost_grasshopper(EVP_CIPH_CBC_MODE, GRASSHOPPER_CIPHER_CBC); -} + return gost2015_process_unprotected_attributes(x, arg, KUZNYECHIK_MAC_MAX_SIZE, c->tag); + } + case EVP_CTRL_COPY: { + EVP_CIPHER_CTX *out = ptr; -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ofb() -{ - return cipher_gost_grasshopper(EVP_CIPH_OFB_MODE, GRASSHOPPER_CIPHER_OFB); -} + gost_grasshopper_cipher_ctx_ctr *out_cctx = EVP_CIPHER_CTX_get_cipher_data(out); + gost_grasshopper_cipher_ctx_ctr *in_cctx = EVP_CIPHER_CTX_get_cipher_data(ctx); -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cfb() -{ - return cipher_gost_grasshopper(EVP_CIPH_CFB_MODE, GRASSHOPPER_CIPHER_CFB); -} + if (in_cctx->c.type != GRASSHOPPER_CIPHER_CTRACPKMOMAC) + return -1; -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctr() -{ - return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTR); -} - -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() -{ - return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, - GRASSHOPPER_CIPHER_CTRACPKM); + if (in_cctx->omac_ctx == out_cctx->omac_ctx) { + out_cctx->omac_ctx = EVP_MD_CTX_new(); + if (out_cctx->omac_ctx == NULL) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, ERR_R_MALLOC_FAILURE); + return -1; + } + } + return EVP_MD_CTX_copy(out_cctx->omac_ctx, in_cctx->omac_ctx); + } + default: + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, + GOST_R_UNSUPPORTED_CIPHER_CTL_COMMAND); + return -1; + } + return 1; } -void cipher_gost_grasshopper_destroy(void) +/* Called directly by CMAC_ACPKM_Init() */ +const EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() { - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_OFB]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_OFB] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM]); - gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM] = NULL; + return GOST_init_cipher(&grasshopper_ctr_acpkm_cipher); } +/* vim: set expandtab cinoptions=\:0,l1,t0,g0,(0 sw=4 : */