diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/accelerated/aarch64/aes-ccm-aarch64.c | 39 | ||||
| -rw-r--r-- | lib/accelerated/x86/aes-ccm-x86-aesni.c | 39 | ||||
| -rw-r--r-- | lib/nettle/cipher.c | 55 |
3 files changed, 133 insertions, 0 deletions
diff --git a/lib/accelerated/aarch64/aes-ccm-aarch64.c b/lib/accelerated/aarch64/aes-ccm-aarch64.c index a2ba259e99..b415d4ddfb 100644 --- a/lib/accelerated/aarch64/aes-ccm-aarch64.c +++ b/lib/accelerated/aarch64/aes-ccm-aarch64.c @@ -36,6 +36,7 @@ #include <byteswap.h> #include <nettle/ccm.h> #include <aes-aarch64.h> +#include <fips.h> typedef struct ccm_aarch64_aes_ctx { AES_KEY key; @@ -103,6 +104,25 @@ aes_ccm_aead_encrypt(void *_ctx, if (unlikely(encr_size < plain_size + tag_size)) return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER); + /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32 + * and 128. + */ + switch (tag_size) { + case 4: case 6: + /* SP800-38C B.2 says Tlen smaller than 64 should not be used + * under sufficient restriction. We simply allow those for now. + */ + FALLTHROUGH; + case 8: case 10: case 12: case 14: case 16: + break; + default: + if (_gnutls_fips_mode_enabled()) { + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR); + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + } + break; + } + ccm_encrypt_message(&ctx->key, aarch64_aes_encrypt, nonce_size, nonce, auth_size, auth, @@ -129,6 +149,25 @@ aes_ccm_aead_decrypt(void *_ctx, if (unlikely(plain_size < encr_size - tag_size)) return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER); + /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32 + * and 128. + */ + switch (tag_size) { + case 4: case 6: + /* SP800-38C B.2 says Tlen smaller than 64 should not be used + * under sufficient restriction. We simply allow those for now. + */ + FALLTHROUGH; + case 8: case 10: case 12: case 14: case 16: + break; + default: + if (_gnutls_fips_mode_enabled()) { + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR); + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + } + break; + } + ret = ccm_decrypt_message(&ctx->key, aarch64_aes_encrypt, nonce_size, nonce, auth_size, auth, diff --git a/lib/accelerated/x86/aes-ccm-x86-aesni.c b/lib/accelerated/x86/aes-ccm-x86-aesni.c index 701c0f992a..9ebbdd7b2a 100644 --- a/lib/accelerated/x86/aes-ccm-x86-aesni.c +++ b/lib/accelerated/x86/aes-ccm-x86-aesni.c @@ -37,6 +37,7 @@ #include <byteswap.h> #include <nettle/ccm.h> #include <aes-x86.h> +#include <fips.h> typedef struct ccm_x86_aes_ctx { AES_KEY key; @@ -95,6 +96,25 @@ aes_ccm_aead_encrypt(void *_ctx, if (unlikely(encr_size < plain_size + tag_size)) return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER); + /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32 + * and 128. + */ + switch (tag_size) { + case 4: case 6: + /* SP800-38C B.2 says Tlen smaller than 64 should not be used + * under sufficient restriction. We simply allow those for now. + */ + FALLTHROUGH; + case 8: case 10: case 12: case 14: case 16: + break; + default: + if (_gnutls_fips_mode_enabled()) { + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR); + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + } + break; + } + ccm_encrypt_message(&ctx->key, x86_aes_encrypt, nonce_size, nonce, auth_size, auth, @@ -121,6 +141,25 @@ aes_ccm_aead_decrypt(void *_ctx, if (unlikely(plain_size < encr_size - tag_size)) return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER); + /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32 + * and 128. + */ + switch (tag_size) { + case 4: case 6: + /* SP800-38C B.2 says Tlen smaller than 64 should not be used + * under sufficient restriction. We simply allow those for now. + */ + FALLTHROUGH; + case 8: case 10: case 12: case 14: case 16: + break; + default: + if (_gnutls_fips_mode_enabled()) { + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR); + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + } + break; + } + ret = ccm_decrypt_message(&ctx->key, x86_aes_encrypt, nonce_size, nonce, auth_size, auth, diff --git a/lib/nettle/cipher.c b/lib/nettle/cipher.c index 9c2ce19e7e..8c23d11252 100644 --- a/lib/nettle/cipher.c +++ b/lib/nettle/cipher.c @@ -1253,6 +1253,34 @@ wrap_nettle_cipher_aead_encrypt(void *_ctx, ctx->cipher->tag(ctx->ctx_ptr, tag_size, ((uint8_t*)encr) + plain_size); } else { /* CCM-style cipher */ + + switch (ctx->cipher->algo) { + case GNUTLS_CIPHER_AES_128_CCM: + case GNUTLS_CIPHER_AES_256_CCM: + /* SP800-38C A.1 says Tlen must be a multiple of 16 + * between 32 and 128. + */ + switch (tag_size) { + case 4: case 6: + /* SP800-38C B.2 says Tlen smaller than 64 + * should not be used under sufficient + * restriction. We simply allow those for now. + */ + FALLTHROUGH; + case 8: case 10: case 12: case 14: case 16: + break; + default: + if (_gnutls_fips_mode_enabled()) { + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR); + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + } + break; + } + break; + default: + break; + } + ctx->cipher->aead_encrypt(ctx, nonce_size, nonce, auth_size, auth, @@ -1302,6 +1330,33 @@ wrap_nettle_cipher_aead_decrypt(void *_ctx, if (unlikely(plain_size < encr_size)) return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER); + switch (ctx->cipher->algo) { + case GNUTLS_CIPHER_AES_128_CCM: + case GNUTLS_CIPHER_AES_256_CCM: + /* SP800-38C A.1 says Tlen must be a multiple of 16 + * between 32 and 128. + */ + switch (tag_size) { + case 4: case 6: + /* SP800-38C B.2 says Tlen smaller than 64 + * should not be used under sufficient + * restriction. We simply allow those for now. + */ + FALLTHROUGH; + case 8: case 10: case 12: case 14: case 16: + break; + default: + if (_gnutls_fips_mode_enabled()) { + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR); + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + } + break; + } + break; + default: + break; + } + ret = ctx->cipher->aead_decrypt(ctx, nonce_size, nonce, auth_size, auth, |