From: Dmitry Belyavskiy Date: Thu, 20 Sep 2018 08:09:35 +0000 (+0300) Subject: Merge pull request #86 from vt-alt/curves X-Git-Tag: v3.0.0~334^2 X-Git-Url: http://www.wagner.pp.ru/gitweb/?a=commitdiff_plain;h=4c04300b7523a9e270a719dd66ac7136e899811d;hp=6f998d67ed9ae2ae579cf6d970e4c3692d531b6e;p=openssl-gost%2Fengine.git Merge pull request #86 from vt-alt/curves Test to validate curve parameters --- diff --git a/gost_grasshopper_cipher.c b/gost_grasshopper_cipher.c index a045a92..21d5038 100644 --- a/gost_grasshopper_cipher.c +++ b/gost_grasshopper_cipher.c @@ -3,10 +3,6 @@ * This file is distributed under the same license as OpenSSL */ -#if defined(__cplusplus) -extern "C" { -#endif - #include "gost_grasshopper_cipher.h" #include "gost_grasshopper_defines.h" #include "gost_grasshopper_math.h" @@ -39,9 +35,9 @@ static EVP_CIPHER *gost_grasshopper_ciphers[6] = { }; static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c); +gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c); static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c); +gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c); struct GRASSHOPPER_CIPHER_PARAMS { int nid; @@ -114,8 +110,7 @@ static struct GRASSHOPPER_CIPHER_PARAMS gost_cipher_params[6] = { gost_grasshopper_cipher_do_ctracpkm, gost_grasshopper_cipher_destroy_ctr, 1, - sizeof - (gost_grasshopper_cipher_ctx_ctr), + sizeof(gost_grasshopper_cipher_ctx_ctr), 16, false} , @@ -129,14 +124,14 @@ static const unsigned char ACPKM_D_2018[] = { 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 256 bit */ }; -static void acpkm_next(gost_grasshopper_cipher_ctx * c) { +static void acpkm_next(gost_grasshopper_cipher_ctx * c) +{ unsigned char newkey[GRASSHOPPER_KEY_SIZE]; const int J = GRASSHOPPER_KEY_SIZE / GRASSHOPPER_BLOCK_SIZE; int n; for (n = 0; n < J; n++) { - const unsigned char *D_n = - &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE]; + const unsigned char *D_n = &ACPKM_D_2018[n * GRASSHOPPER_BLOCK_SIZE]; grasshopper_encrypt_block(&c->encrypt_round_keys, (grasshopper_w128_t *) D_n, @@ -149,23 +144,37 @@ static void acpkm_next(gost_grasshopper_cipher_ctx * c) { /* Set 256 bit key into context */ GRASSHOPPER_INLINE void - gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, - const uint8_t *k) { +gost_grasshopper_cipher_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) +{ int i; for (i = 0; i < 2; i++) { grasshopper_copy128(&c->key.k.k[i], (const grasshopper_w128_t *)(k + i * 16)); } + grasshopper_set_encrypt_key(&c->encrypt_round_keys, &c->key); grasshopper_set_decrypt_key(&c->decrypt_round_keys, &c->key); } +/* Set master 256-bit key to be used in TLSTREE calculation into context */ +GRASSHOPPER_INLINE void +gost_grasshopper_master_key(gost_grasshopper_cipher_ctx * c, const uint8_t *k) +{ + int i; + for (i = 0; i < 2; i++) { + grasshopper_copy128(&c->master_key.k.k[i], + (const grasshopper_w128_t *)(k + i * 16)); + } +} + /* Cleans up key from context */ GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) { +gost_grasshopper_cipher_destroy(gost_grasshopper_cipher_ctx * c) +{ int i; for (i = 0; i < 2; i++) { grasshopper_zero128(&c->key.k.k[i]); + grasshopper_zero128(&c->master_key.k.k[i]); } for (i = 0; i < GRASSHOPPER_ROUND_KEYS_COUNT; i++) { grasshopper_zero128(&c->encrypt_round_keys.k[i]); @@ -177,7 +186,8 @@ GRASSHOPPER_INLINE void } static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c) { +gost_grasshopper_cipher_destroy_ofb(gost_grasshopper_cipher_ctx * c) +{ gost_grasshopper_cipher_ctx_ofb *ctx = (gost_grasshopper_cipher_ctx_ofb *) c; @@ -185,7 +195,8 @@ static GRASSHOPPER_INLINE void } static GRASSHOPPER_INLINE void - gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c) { +gost_grasshopper_cipher_destroy_ctr(gost_grasshopper_cipher_ctx * c) +{ gost_grasshopper_cipher_ctx_ctr *ctx = (gost_grasshopper_cipher_ctx_ctr *) c; @@ -194,16 +205,17 @@ static GRASSHOPPER_INLINE void int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) { + const unsigned char *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); if (EVP_CIPHER_CTX_get_app_data(ctx) == NULL) { - EVP_CIPHER_CTX_set_app_data(ctx, - EVP_CIPHER_CTX_get_cipher_data(ctx)); + EVP_CIPHER_CTX_set_app_data(ctx, EVP_CIPHER_CTX_get_cipher_data(ctx)); } if (key != NULL) { gost_grasshopper_cipher_key(c, key); + gost_grasshopper_master_key(c, key); } if (iv != NULL) { @@ -219,33 +231,29 @@ int gost_grasshopper_cipher_init(EVP_CIPHER_CTX *ctx, return 1; } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ecb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_ECB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cbc(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_CBC; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx_ofb *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ofb *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->c.type = GRASSHOPPER_CIPHER_OFB; @@ -254,23 +262,20 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ofb(EVP_CIPHER_CTX *ctx, return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_cfb(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ gost_grasshopper_cipher_ctx *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->type = GRASSHOPPER_CIPHER_CFB; return gost_grasshopper_cipher_init(ctx, key, iv, enc); } -GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, - const unsigned char - *key, - const unsigned char - *iv, int enc) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); +GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, const unsigned char + *key, const unsigned char + *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); c->c.type = GRASSHOPPER_CIPHER_CTR; EVP_CIPHER_CTX_set_num(ctx, 0); @@ -281,14 +286,11 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctr(EVP_CIPHER_CTX *ctx, } GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX - *ctx, - const unsigned - char *key, - const unsigned - char *iv, - int enc) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); + *ctx, const unsigned + char *key, const unsigned + char *iv, int enc) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); /* NB: setting type makes EVP do_cipher callback useless */ c->c.type = GRASSHOPPER_CIPHER_CTRACPKM; @@ -301,7 +303,8 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_init_ctracpkm(EVP_CIPHER_CTX GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, - size_t inl) { + size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); struct GRASSHOPPER_CIPHER_PARAMS *params = &gost_cipher_params[c->type]; @@ -310,7 +313,8 @@ GRASSHOPPER_INLINE int gost_grasshopper_cipher_do(EVP_CIPHER_CTX *ctx, } int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { + const unsigned char *in, size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); bool encrypting = (bool) EVP_CIPHER_CTX_encrypting(ctx); @@ -339,7 +343,8 @@ int gost_grasshopper_cipher_do_ecb(EVP_CIPHER_CTX *ctx, unsigned char *out, } int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { + const unsigned char *in, size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); @@ -379,7 +384,8 @@ int gost_grasshopper_cipher_do_cbc(EVP_CIPHER_CTX *ctx, unsigned char *out, return 1; } -void inc_counter(unsigned char *counter, size_t counter_bytes) { +void inc_counter(unsigned char *counter, size_t counter_bytes) +{ unsigned char c; unsigned int n = counter_bytes; @@ -394,14 +400,15 @@ void inc_counter(unsigned char *counter, size_t counter_bytes) { } /* increment counter (128-bit int) by 1 */ -static void ctr128_inc(unsigned char *counter) { +static void ctr128_inc(unsigned char *counter) +{ inc_counter(counter, 16); } int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx_ctr *c = - (gost_grasshopper_cipher_ctx_ctr *) + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ctr *c = (gost_grasshopper_cipher_ctx_ctr *) EVP_CIPHER_CTX_get_cipher_data(ctx); unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); const unsigned char *current_in = in; @@ -456,7 +463,8 @@ int gost_grasshopper_cipher_do_ctr(EVP_CIPHER_CTX *ctx, unsigned char *out, #define GRASSHOPPER_BLOCK_MASK (GRASSHOPPER_BLOCK_SIZE - 1) static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr * - ctx, unsigned int *num) { + ctx, unsigned int *num) +{ if (!ctx->section_size || (*num < ctx->section_size)) return; acpkm_next(&ctx->c); @@ -467,10 +475,9 @@ static inline void apply_acpkm_grasshopper(gost_grasshopper_cipher_ctx_ctr * * this function works exactly like plain ctr */ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, - size_t inl) { - gost_grasshopper_cipher_ctx_ctr *c = - EVP_CIPHER_CTX_get_cipher_data(ctx); + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ctr *c = EVP_CIPHER_CTX_get_cipher_data(ctx); unsigned char *iv = EVP_CIPHER_CTX_iv_noconst(ctx); unsigned int num = EVP_CIPHER_CTX_num(ctx); @@ -488,8 +495,10 @@ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, apply_acpkm_grasshopper(c, &num); grasshopper_encrypt_block(&c->c.encrypt_round_keys, (grasshopper_w128_t *) iv, - (grasshopper_w128_t *) &c->partial_buffer, &c->c.buffer); - grasshopper_plus128(&tmp, &c->partial_buffer, (grasshopper_w128_t *) in); + (grasshopper_w128_t *) & c->partial_buffer, + &c->c.buffer); + grasshopper_plus128(&tmp, &c->partial_buffer, + (grasshopper_w128_t *) in); grasshopper_copy128((grasshopper_w128_t *) out, &tmp); ctr128_inc(iv); in += GRASSHOPPER_BLOCK_SIZE; @@ -519,7 +528,8 @@ int gost_grasshopper_cipher_do_ctracpkm(EVP_CIPHER_CTX *ctx, */ static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx_ofb * ctx, grasshopper_w128_t * iv, - grasshopper_w128_t * buf) { + grasshopper_w128_t * buf) +{ memcpy(&ctx->buffer1, iv, 16); grasshopper_encrypt_block(&ctx->c.encrypt_round_keys, &ctx->buffer1, buf, &ctx->c.buffer); @@ -527,9 +537,9 @@ static void gost_grasshopper_cnt_next(gost_grasshopper_cipher_ctx_ofb * ctx, } int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { - gost_grasshopper_cipher_ctx_ofb *c = - (gost_grasshopper_cipher_ctx_ofb *) + const unsigned char *in, size_t inl) +{ + gost_grasshopper_cipher_ctx_ofb *c = (gost_grasshopper_cipher_ctx_ofb *) EVP_CIPHER_CTX_get_cipher_data(ctx); const unsigned char *in_ptr = in; unsigned char *out_ptr = out; @@ -591,7 +601,8 @@ int gost_grasshopper_cipher_do_ofb(EVP_CIPHER_CTX *ctx, unsigned char *out, } int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) { + const unsigned char *in, size_t inl) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); const unsigned char *in_ptr = in; @@ -616,8 +627,7 @@ int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, } } if (j == GRASSHOPPER_BLOCK_SIZE) { - memcpy(iv, buf + GRASSHOPPER_BLOCK_SIZE, - GRASSHOPPER_BLOCK_SIZE); + memcpy(iv, buf + GRASSHOPPER_BLOCK_SIZE, GRASSHOPPER_BLOCK_SIZE); EVP_CIPHER_CTX_set_num(ctx, 0); } else { EVP_CIPHER_CTX_set_num(ctx, (int)j); @@ -676,7 +686,8 @@ int gost_grasshopper_cipher_do_cfb(EVP_CIPHER_CTX *ctx, unsigned char *out, return 1; } -int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) { +int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) +{ gost_grasshopper_cipher_ctx *c = (gost_grasshopper_cipher_ctx *) EVP_CIPHER_CTX_get_cipher_data(ctx); @@ -695,8 +706,8 @@ int gost_grasshopper_cipher_cleanup(EVP_CIPHER_CTX *ctx) { return 1; } -int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, - ASN1_TYPE *params) { +int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, ASN1_TYPE *params) +{ int len = 0; unsigned char *buf = NULL; ASN1_OCTET_STRING *os = NULL; @@ -716,9 +727,9 @@ int gost_grasshopper_set_asn1_parameters(EVP_CIPHER_CTX *ctx, } GRASSHOPPER_INLINE int gost_grasshopper_get_asn1_parameters(EVP_CIPHER_CTX - *ctx, - ASN1_TYPE - *params) { + *ctx, ASN1_TYPE + *params) +{ int ret = -1; if (ASN1_TYPE_get(params) != V_ASN1_SEQUENCE) { @@ -729,14 +740,13 @@ GRASSHOPPER_INLINE int gost_grasshopper_get_asn1_parameters(EVP_CIPHER_CTX } int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, - void *ptr) { + void *ptr) +{ switch (type) { case EVP_CTRL_RAND_KEY:{ if (RAND_bytes - ((unsigned char *)ptr, - EVP_CIPHER_CTX_key_length(ctx)) <= 0) { - GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, - GOST_R_RNG_ERROR); + ((unsigned char *)ptr, EVP_CIPHER_CTX_key_length(ctx)) <= 0) { + GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_RNG_ERROR); return -1; } break; @@ -750,6 +760,29 @@ int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, c->section_size = arg; break; } +#ifdef EVP_CTRL_TLS1_2_TLSTREE + case EVP_CTRL_TLS1_2_TLSTREE: + { + unsigned char newkey[32]; + int mode = EVP_CIPHER_CTX_mode(ctx); + gost_grasshopper_cipher_ctx_ctr *ctr_ctx = NULL; + gost_grasshopper_cipher_ctx *c = NULL; + + if (mode != EVP_CIPH_CTR_MODE) + return -1; + + ctr_ctx = (gost_grasshopper_cipher_ctx_ctr *) + EVP_CIPHER_CTX_get_cipher_data(ctx); + c = &(ctr_ctx->c); + + if (gost_tlstree(NID_grasshopper_cbc, c->master_key.k.b, newkey, + (const unsigned char *)ptr) > 0) { + gost_grasshopper_cipher_key(c, newkey); + return 1; + } + } + return -1; +#endif default: GOSTerr(GOST_F_GOST_GRASSHOPPER_CIPHER_CTL, GOST_R_UNSUPPORTED_CIPHER_CTL_COMMAND); @@ -759,15 +792,16 @@ int gost_grasshopper_cipher_ctl(EVP_CIPHER_CTX *ctx, int type, int arg, } GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_create(int - cipher_type, - int - block_size) { + cipher_type, int + block_size) +{ return EVP_CIPHER_meth_new(cipher_type, block_size /* block_size */ , GRASSHOPPER_KEY_SIZE /* key_size */ ); } const int cipher_gost_grasshopper_setup(EVP_CIPHER *cipher, uint8_t mode, - int iv_size, bool padding) { + int iv_size, bool padding) +{ return EVP_CIPHER_meth_set_iv_length(cipher, iv_size) && EVP_CIPHER_meth_set_flags(cipher, (unsigned long)(mode | @@ -780,19 +814,18 @@ const int cipher_gost_grasshopper_setup(EVP_CIPHER *cipher, uint8_t mode, EVP_CIPH_RAND_KEY | EVP_CIPH_ALWAYS_CALL_INIT) ) - && EVP_CIPHER_meth_set_cleanup(cipher, - gost_grasshopper_cipher_cleanup) + && EVP_CIPHER_meth_set_cleanup(cipher, gost_grasshopper_cipher_cleanup) && EVP_CIPHER_meth_set_set_asn1_params(cipher, gost_grasshopper_set_asn1_parameters) && EVP_CIPHER_meth_set_get_asn1_params(cipher, gost_grasshopper_get_asn1_parameters) && EVP_CIPHER_meth_set_ctrl(cipher, gost_grasshopper_cipher_ctl) - && EVP_CIPHER_meth_set_do_cipher(cipher, - gost_grasshopper_cipher_do); + && EVP_CIPHER_meth_set_do_cipher(cipher, gost_grasshopper_cipher_do); } const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper(uint8_t mode, - uint8_t num) { + uint8_t num) +{ EVP_CIPHER **cipher; struct GRASSHOPPER_CIPHER_PARAMS *params; @@ -824,37 +857,39 @@ const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper(uint8_t mode, return *cipher; } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ecb() { - return cipher_gost_grasshopper(EVP_CIPH_ECB_MODE, - GRASSHOPPER_CIPHER_ECB); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ecb() +{ + return cipher_gost_grasshopper(EVP_CIPH_ECB_MODE, GRASSHOPPER_CIPHER_ECB); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cbc() { - return cipher_gost_grasshopper(EVP_CIPH_CBC_MODE, - GRASSHOPPER_CIPHER_CBC); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cbc() +{ + return cipher_gost_grasshopper(EVP_CIPH_CBC_MODE, GRASSHOPPER_CIPHER_CBC); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ofb() { - return cipher_gost_grasshopper(EVP_CIPH_OFB_MODE, - GRASSHOPPER_CIPHER_OFB); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ofb() +{ + return cipher_gost_grasshopper(EVP_CIPH_OFB_MODE, GRASSHOPPER_CIPHER_OFB); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cfb() { - return cipher_gost_grasshopper(EVP_CIPH_CFB_MODE, - GRASSHOPPER_CIPHER_CFB); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_cfb() +{ + return cipher_gost_grasshopper(EVP_CIPH_CFB_MODE, GRASSHOPPER_CIPHER_CFB); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctr() { - return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, - GRASSHOPPER_CIPHER_CTR); +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctr() +{ + return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTR); } -const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() { +const GRASSHOPPER_INLINE EVP_CIPHER *cipher_gost_grasshopper_ctracpkm() +{ return cipher_gost_grasshopper(EVP_CIPH_CTR_MODE, GRASSHOPPER_CIPHER_CTRACPKM); } -void cipher_gost_grasshopper_destroy(void) { +void cipher_gost_grasshopper_destroy(void) +{ EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB]); gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_ECB] = NULL; EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CBC]); @@ -865,11 +900,6 @@ void cipher_gost_grasshopper_destroy(void) { gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CFB] = NULL; EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR]); gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTR] = NULL; - EVP_CIPHER_meth_free(gost_grasshopper_ciphers - [GRASSHOPPER_CIPHER_CTRACPKM]); + EVP_CIPHER_meth_free(gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM]); gost_grasshopper_ciphers[GRASSHOPPER_CIPHER_CTRACPKM] = NULL; } - -#if defined(__cplusplus) -} -#endif diff --git a/gost_grasshopper_cipher.h b/gost_grasshopper_cipher.h index cc67795..31dc021 100644 --- a/gost_grasshopper_cipher.h +++ b/gost_grasshopper_cipher.h @@ -18,6 +18,7 @@ extern "C" { // because of buffers typedef struct { uint8_t type; + grasshopper_key_t master_key; grasshopper_key_t key; grasshopper_round_keys_t encrypt_round_keys; grasshopper_round_keys_t decrypt_round_keys; diff --git a/gost_keyexpimp.c b/gost_keyexpimp.c index ebd1fa1..62dd4ae 100644 --- a/gost_keyexpimp.c +++ b/gost_keyexpimp.c @@ -222,6 +222,55 @@ int gost_kdftree2012_256(unsigned char *keyout, size_t keyout_len, return 1; } +int gost_tlstree(int cipher_nid, const unsigned char *in, unsigned char *out, + const unsigned char *tlsseq) +{ +#ifndef L_ENDIAN + uint64_t gh_c1 = 0xFFFFFFFF00000000, gh_c2 = 0xFFFFFFFFFFF80000, + gh_c3 = 0xFFFFFFFFFFFFFFC0; + uint64_t mg_c1 = 0xFFFFFFC000000000, mg_c2 = 0xFFFFFFFFFE000000, + mg_c3 = 0xFFFFFFFFFFFFF000; +#else + uint64_t gh_c1 = 0x00000000FFFFFFFF, gh_c2 = 0x0000F8FFFFFFFFFF, + gh_c3 = 0xC0FFFFFFFFFFFFFF; + uint64_t mg_c1 = 0x00000000C0FFFFFF, mg_c2 = 0x000000FEFFFFFFFF, + mg_c3 = 0x00F0FFFFFFFFFFFF; +#endif + uint64_t c1, c2, c3; + uint64_t seed1, seed2, seed3; + uint64_t seq; + unsigned char ko1[32], ko2[32]; + + switch (cipher_nid) { + case NID_magma_cbc: + c1 = mg_c1; + c2 = mg_c2; + c3 = mg_c3; + break; + case NID_grasshopper_cbc: + c1 = gh_c1; + c2 = gh_c2; + c3 = gh_c3; + break; + default: + return 0; + } + memcpy(&seq, tlsseq, 8); + seed1 = seq & c1; + seed2 = seq & c2; + seed3 = seq & c3; + + if (gost_kdftree2012_256(ko1, 32, in, 32, (const unsigned char *)"level1", 6, + (const unsigned char *)&seed1, 8, 1) <= 0 + || gost_kdftree2012_256(ko2, 32, ko1, 32, (const unsigned char *)"level2", 6, + (const unsigned char *)&seed2, 8, 1) <= 0 + || gost_kdftree2012_256(out, 32, ko2, 32, (const unsigned char *)"level3", 6, + (const unsigned char *)&seed3, 8, 1) <= 0) + return 0; + + return 1; +} + #ifdef ENABLE_UNIT_TESTS # include # include @@ -294,14 +343,30 @@ int main(void) 0xF4, 0x3F, 0x9E, 0x6D, 0xC5, 0x15, 0x31, 0xF9 }; + const unsigned char tlstree_gh_etalon[] = { + 0x50, 0x76, 0x42, 0xd9, 0x58, 0xc5, 0x20, 0xc6, + 0xd7, 0xee, 0xf5, 0xca, 0x8a, 0x53, 0x16, 0xd4, + 0xf3, 0x4b, 0x85, 0x5d, 0x2d, 0xd4, 0xbc, 0xbf, + 0x4e, 0x5b, 0xf0, 0xff, 0x64, 0x1a, 0x19, 0xff, + }; + unsigned char buf[32 + 16]; int ret = 0; int outlen = 40; unsigned char kdf_result[64]; + unsigned char kroot[32]; + unsigned char tlsseq[8]; + unsigned char out[32]; + OpenSSL_add_all_algorithms(); memset(buf, 0, sizeof(buf)); + memset(kroot, 0xFF, 32); + memset(tlsseq, 0, 8); + tlsseq[7] = 63; + memset(out, 0, 32); + ret = gost_kexp15(shared_key, 32, NID_magma_ctr, magma_key, NID_magma_mac, mac_magma_key, magma_iv, 4, buf, &outlen); @@ -339,6 +404,16 @@ int main(void) } } + ret = gost_tlstree(NID_grasshopper_cbc, kroot, out, tlsseq); + if (ret <= 0) + ERR_print_errors_fp(stderr); + else { + hexdump(stdout, "Gost TLSTREE - grasshopper", out, 32); + if (memcmp(out, tlstree_gh_etalon, 32) != 0) { + fprintf(stdout, "ERROR! test failed\n"); + } + } + return 0; } diff --git a/gost_lcl.h b/gost_lcl.h index cc1672c..0c51fa1 100644 --- a/gost_lcl.h +++ b/gost_lcl.h @@ -272,6 +272,9 @@ int gost_kdftree2012_256(unsigned char *keyout, size_t keyout_len, const unsigned char *label, size_t label_len, const unsigned char *seed, size_t seed_len, const size_t representation); + +int gost_tlstree(int cipher_nid, const unsigned char* inkey, + unsigned char *outkey, const unsigned char *tlsseq); /* KExp/KImp */ int gost_kexp15(const unsigned char *shared_key, const int shared_len, int cipher_nid, const unsigned char *cipher_key, diff --git a/gost_omac.c b/gost_omac.c index daf5750..0cbd45d 100644 --- a/gost_omac.c +++ b/gost_omac.c @@ -14,6 +14,19 @@ typedef struct omac_ctx { size_t dgst_size; int cipher_nid; int key_set; +/* + * Here begins stuff related to TLSTREE processing + * We MUST store the original key to derive TLSTREE keys from it + * and TLS seq no. + * */ + unsigned char key[32]; +/* + * TODO + * TLSTREE intermediate values should be recalculated only when + * C_i & (seq_no+1) != C_i & (seq_no) + * so somewhen we will store C_i & (seq_no) in this structure + * to avoid redundant hash calculations. + * */ } OMAC_CTX; #define MAX_GOST_OMAC_SIZE 16 @@ -27,11 +40,11 @@ static int omac_init(EVP_MD_CTX *ctx, int cipher_nid) switch (cipher_nid) { case NID_magma_cbc: - c->dgst_size = 4; + c->dgst_size = 8; break; case NID_grasshopper_cbc: - c->dgst_size = 8; + c->dgst_size = 16; break; } @@ -85,6 +98,7 @@ int omac_imit_copy(EVP_MD_CTX *to, const EVP_MD_CTX *from) c_to->dgst_size = c_from->dgst_size; c_to->cipher_nid = c_from->cipher_nid; c_to->key_set = c_from->key_set; + memcpy(c_to->key, c_from->key, 32); } else { return 0; } @@ -142,6 +156,7 @@ int omac_imit_ctrl(EVP_MD_CTX *ctx, int type, int arg, void *ptr) OMAC_CTX *c = EVP_MD_CTX_md_data(ctx); const EVP_MD *md = EVP_MD_CTX_md(ctx); const EVP_CIPHER *cipher = NULL; + int ret = 0; if (c->cipher_nid == NID_undef) { switch (EVP_MD_nid(md)) { @@ -173,10 +188,15 @@ int omac_imit_ctrl(EVP_MD_CTX *ctx, int type, int arg, void *ptr) if (arg == 0) { struct gost_mac_key *key = (struct gost_mac_key *)ptr; - return omac_key(c, cipher, key->key, 32); - + ret = omac_key(c, cipher, key->key, 32); + if (ret > 0) + memcpy(c->key, key->key, 32); + return ret; } else if (arg == 32) { - return omac_key(c, cipher, ptr, 32); + ret = omac_key(c, cipher, ptr, 32); + if (ret > 0) + memcpy(c->key, ptr, 32); + return ret; } GOSTerr(GOST_F_OMAC_IMIT_CTRL, GOST_R_INVALID_MAC_KEY_SIZE); return 0; @@ -204,7 +224,22 @@ int omac_imit_ctrl(EVP_MD_CTX *ctx, int type, int arg, void *ptr) } return 1; } - +#ifdef EVP_MD_CTRL_TLSTREE + case EVP_MD_CTRL_TLSTREE: + { + OMAC_CTX *c = EVP_MD_CTX_md_data(ctx); + if (c->key_set) { + unsigned char diversed_key[32]; + return gost_tlstree(c->cipher_nid, c->key, diversed_key, + (const unsigned char *)ptr) ? + omac_key(c, EVP_get_cipherbynid(c->cipher_nid), + diversed_key, 32) : 0; + } + GOSTerr(GOST_F_OMAC_IMIT_CTRL, GOST_R_BAD_ORDER); + return 0; + } + return 0; +#endif default: return 0; } @@ -218,7 +253,7 @@ EVP_MD *magma_omac(void) EVP_MD *md; if ((md = EVP_MD_meth_new(NID_magma_mac, NID_undef)) == NULL - || !EVP_MD_meth_set_result_size(md, 4) + || !EVP_MD_meth_set_result_size(md, 8) || !EVP_MD_meth_set_input_blocksize(md, 8) || !EVP_MD_meth_set_app_datasize(md, sizeof(OMAC_CTX)) || !EVP_MD_meth_set_flags(md, 0) @@ -250,7 +285,7 @@ EVP_MD *grasshopper_omac(void) EVP_MD *md; if ((md = EVP_MD_meth_new(NID_grasshopper_mac, NID_undef)) == NULL - || !EVP_MD_meth_set_result_size(md, 8) + || !EVP_MD_meth_set_result_size(md, 16) || !EVP_MD_meth_set_input_blocksize(md, 8) || !EVP_MD_meth_set_app_datasize(md, sizeof(OMAC_CTX)) || !EVP_MD_meth_set_flags(md, 0) diff --git a/test_context.c b/test_context.c index ba54784..72e1057 100644 --- a/test_context.c +++ b/test_context.c @@ -134,16 +134,16 @@ int main(int argc, char **argv) { int ret = 0; - test_contexts(cipher_gost_grasshopper_ecb(), 1, "grasshopper ecb", 0); - test_contexts(cipher_gost_grasshopper_ecb(), 0, "grasshopper ecb", 0); - test_contexts(cipher_gost_grasshopper_cbc(), 1, "grasshopper cbc", 0); - test_contexts(cipher_gost_grasshopper_cbc(), 0, "grasshopper cbc", 0); - test_contexts(cipher_gost_grasshopper_ctr(), 1, "grasshopper ctr", 0); - test_contexts(cipher_gost_grasshopper_ctr(), 0, "grasshopper ctr", 0); - test_contexts(cipher_gost_grasshopper_ofb(), 1, "grasshopper ofb", 0); - test_contexts(cipher_gost_grasshopper_ofb(), 0, "grasshopper ofb", 0); - test_contexts(cipher_gost_grasshopper_ctracpkm(), 1, "grasshopper ctracpkm", 256 / 8); - test_contexts(cipher_gost_grasshopper_ctracpkm(), 0, "grasshopper ctracpkm", 256 / 8); + ret |= test_contexts(cipher_gost_grasshopper_ecb(), 1, "grasshopper ecb", 0); + ret |= test_contexts(cipher_gost_grasshopper_ecb(), 0, "grasshopper ecb", 0); + ret |= test_contexts(cipher_gost_grasshopper_cbc(), 1, "grasshopper cbc", 0); + ret |= test_contexts(cipher_gost_grasshopper_cbc(), 0, "grasshopper cbc", 0); + ret |= test_contexts(cipher_gost_grasshopper_ctr(), 1, "grasshopper ctr", 0); + ret |= test_contexts(cipher_gost_grasshopper_ctr(), 0, "grasshopper ctr", 0); + ret |= test_contexts(cipher_gost_grasshopper_ofb(), 1, "grasshopper ofb", 0); + ret |= test_contexts(cipher_gost_grasshopper_ofb(), 0, "grasshopper ofb", 0); + ret |= test_contexts(cipher_gost_grasshopper_ctracpkm(), 1, "grasshopper ctracpkm", 256 / 8); + ret |= test_contexts(cipher_gost_grasshopper_ctracpkm(), 0, "grasshopper ctracpkm", 256 / 8); if (ret) printf(cDRED "= Some tests FAILED!\n" cNORM);