1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "quiche/quic/core/crypto/aead_base_encrypter.h"
6
7 #include "absl/base/macros.h"
8 #include "absl/strings/string_view.h"
9 #include "openssl/crypto.h"
10 #include "openssl/err.h"
11 #include "openssl/evp.h"
12 #include "quiche/quic/core/quic_utils.h"
13 #include "quiche/quic/platform/api/quic_bug_tracker.h"
14 #include "quiche/quic/platform/api/quic_logging.h"
15 #include "quiche/common/quiche_crypto_logging.h"
16
17 namespace quic {
18 using ::quiche::DLogOpenSslErrors;
19 namespace {
20
InitAndCall(const EVP_AEAD * (* aead_getter)())21 const EVP_AEAD* InitAndCall(const EVP_AEAD* (*aead_getter)()) {
22 // Ensure BoringSSL is initialized before calling |aead_getter|. In Chromium,
23 // the static initializer is disabled.
24 CRYPTO_library_init();
25 return aead_getter();
26 }
27
28 } // namespace
29
AeadBaseEncrypter(const EVP_AEAD * (* aead_getter)(),size_t key_size,size_t auth_tag_size,size_t nonce_size,bool use_ietf_nonce_construction)30 AeadBaseEncrypter::AeadBaseEncrypter(const EVP_AEAD* (*aead_getter)(),
31 size_t key_size, size_t auth_tag_size,
32 size_t nonce_size,
33 bool use_ietf_nonce_construction)
34 : aead_alg_(InitAndCall(aead_getter)),
35 key_size_(key_size),
36 auth_tag_size_(auth_tag_size),
37 nonce_size_(nonce_size),
38 use_ietf_nonce_construction_(use_ietf_nonce_construction) {
39 QUICHE_DCHECK_LE(key_size_, sizeof(key_));
40 QUICHE_DCHECK_LE(nonce_size_, sizeof(iv_));
41 QUICHE_DCHECK_GE(kMaxNonceSize, nonce_size_);
42 }
43
~AeadBaseEncrypter()44 AeadBaseEncrypter::~AeadBaseEncrypter() {}
45
SetKey(absl::string_view key)46 bool AeadBaseEncrypter::SetKey(absl::string_view key) {
47 QUICHE_DCHECK_EQ(key.size(), key_size_);
48 if (key.size() != key_size_) {
49 return false;
50 }
51 memcpy(key_, key.data(), key.size());
52
53 EVP_AEAD_CTX_cleanup(ctx_.get());
54
55 if (!EVP_AEAD_CTX_init(ctx_.get(), aead_alg_, key_, key_size_, auth_tag_size_,
56 nullptr)) {
57 DLogOpenSslErrors();
58 return false;
59 }
60
61 return true;
62 }
63
SetNoncePrefix(absl::string_view nonce_prefix)64 bool AeadBaseEncrypter::SetNoncePrefix(absl::string_view nonce_prefix) {
65 if (use_ietf_nonce_construction_) {
66 QUIC_BUG(quic_bug_10634_1)
67 << "Attempted to set nonce prefix on IETF QUIC crypter";
68 return false;
69 }
70 QUICHE_DCHECK_EQ(nonce_prefix.size(), nonce_size_ - sizeof(QuicPacketNumber));
71 if (nonce_prefix.size() != nonce_size_ - sizeof(QuicPacketNumber)) {
72 return false;
73 }
74 memcpy(iv_, nonce_prefix.data(), nonce_prefix.size());
75 return true;
76 }
77
SetIV(absl::string_view iv)78 bool AeadBaseEncrypter::SetIV(absl::string_view iv) {
79 if (!use_ietf_nonce_construction_) {
80 QUIC_BUG(quic_bug_10634_2) << "Attempted to set IV on Google QUIC crypter";
81 return false;
82 }
83 QUICHE_DCHECK_EQ(iv.size(), nonce_size_);
84 if (iv.size() != nonce_size_) {
85 return false;
86 }
87 memcpy(iv_, iv.data(), iv.size());
88 return true;
89 }
90
Encrypt(absl::string_view nonce,absl::string_view associated_data,absl::string_view plaintext,unsigned char * output)91 bool AeadBaseEncrypter::Encrypt(absl::string_view nonce,
92 absl::string_view associated_data,
93 absl::string_view plaintext,
94 unsigned char* output) {
95 QUICHE_DCHECK_EQ(nonce.size(), nonce_size_);
96
97 size_t ciphertext_len;
98 if (!EVP_AEAD_CTX_seal(
99 ctx_.get(), output, &ciphertext_len,
100 plaintext.size() + auth_tag_size_,
101 reinterpret_cast<const uint8_t*>(nonce.data()), nonce.size(),
102 reinterpret_cast<const uint8_t*>(plaintext.data()), plaintext.size(),
103 reinterpret_cast<const uint8_t*>(associated_data.data()),
104 associated_data.size())) {
105 DLogOpenSslErrors();
106 return false;
107 }
108
109 return true;
110 }
111
EncryptPacket(uint64_t packet_number,absl::string_view associated_data,absl::string_view plaintext,char * output,size_t * output_length,size_t max_output_length)112 bool AeadBaseEncrypter::EncryptPacket(uint64_t packet_number,
113 absl::string_view associated_data,
114 absl::string_view plaintext, char* output,
115 size_t* output_length,
116 size_t max_output_length) {
117 size_t ciphertext_size = GetCiphertextSize(plaintext.length());
118 if (max_output_length < ciphertext_size) {
119 return false;
120 }
121 // TODO(ianswett): Introduce a check to ensure that we don't encrypt with the
122 // same packet number twice.
123 alignas(4) char nonce_buffer[kMaxNonceSize];
124 memcpy(nonce_buffer, iv_, nonce_size_);
125 size_t prefix_len = nonce_size_ - sizeof(packet_number);
126 if (use_ietf_nonce_construction_) {
127 for (size_t i = 0; i < sizeof(packet_number); ++i) {
128 nonce_buffer[prefix_len + i] ^=
129 (packet_number >> ((sizeof(packet_number) - i - 1) * 8)) & 0xff;
130 }
131 } else {
132 memcpy(nonce_buffer + prefix_len, &packet_number, sizeof(packet_number));
133 }
134
135 if (!Encrypt(absl::string_view(nonce_buffer, nonce_size_), associated_data,
136 plaintext, reinterpret_cast<unsigned char*>(output))) {
137 return false;
138 }
139 *output_length = ciphertext_size;
140 return true;
141 }
142
GetKeySize() const143 size_t AeadBaseEncrypter::GetKeySize() const { return key_size_; }
144
GetNoncePrefixSize() const145 size_t AeadBaseEncrypter::GetNoncePrefixSize() const {
146 return nonce_size_ - sizeof(QuicPacketNumber);
147 }
148
GetIVSize() const149 size_t AeadBaseEncrypter::GetIVSize() const { return nonce_size_; }
150
GetMaxPlaintextSize(size_t ciphertext_size) const151 size_t AeadBaseEncrypter::GetMaxPlaintextSize(size_t ciphertext_size) const {
152 return ciphertext_size - std::min(ciphertext_size, auth_tag_size_);
153 }
154
GetCiphertextSize(size_t plaintext_size) const155 size_t AeadBaseEncrypter::GetCiphertextSize(size_t plaintext_size) const {
156 return plaintext_size + auth_tag_size_;
157 }
158
GetKey() const159 absl::string_view AeadBaseEncrypter::GetKey() const {
160 return absl::string_view(reinterpret_cast<const char*>(key_), key_size_);
161 }
162
GetNoncePrefix() const163 absl::string_view AeadBaseEncrypter::GetNoncePrefix() const {
164 return absl::string_view(reinterpret_cast<const char*>(iv_),
165 GetNoncePrefixSize());
166 }
167
168 } // namespace quic
169