1 // Copyright 2017 Google Inc.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ///////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/subtle/aes_ctr_boringssl.h"
18
19 #include <memory>
20 #include <string>
21 #include <utility>
22
23 #include "absl/memory/memory.h"
24 #include "absl/status/status.h"
25 #include "openssl/evp.h"
26 #include "tink/internal/aes_util.h"
27 #include "tink/internal/ssl_unique_ptr.h"
28 #include "tink/internal/util.h"
29 #include "tink/subtle/random.h"
30 #include "tink/subtle/subtle_util.h"
31 #include "tink/util/status.h"
32
33 namespace crypto {
34 namespace tink {
35 namespace subtle {
36
New(util::SecretData key,int iv_size)37 util::StatusOr<std::unique_ptr<IndCpaCipher>> AesCtrBoringSsl::New(
38 util::SecretData key, int iv_size) {
39 auto status = internal::CheckFipsCompatibility<AesCtrBoringSsl>();
40 if (!status.ok()) return status;
41
42 util::StatusOr<const EVP_CIPHER*> cipher =
43 internal::GetAesCtrCipherForKeySize(key.size());
44 if (!cipher.ok()) {
45 return cipher.status();
46 }
47
48 if (iv_size < kMinIvSizeInBytes || iv_size > kBlockSize) {
49 return util::Status(absl::StatusCode::kInvalidArgument, "invalid iv size");
50 }
51 return {
52 absl::WrapUnique(new AesCtrBoringSsl(std::move(key), iv_size, *cipher))};
53 }
54
Encrypt(absl::string_view plaintext) const55 util::StatusOr<std::string> AesCtrBoringSsl::Encrypt(
56 absl::string_view plaintext) const {
57 // BoringSSL expects a non-null pointer for plaintext, regardless of whether
58 // the size is 0.
59 plaintext = internal::EnsureStringNonNull(plaintext);
60
61 internal::SslUniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
62 if (ctx.get() == nullptr) {
63 return util::Status(absl::StatusCode::kInternal,
64 "could not initialize EVP_CIPHER_CTX");
65 }
66 std::string ciphertext = Random::GetRandomBytes(iv_size_);
67 // OpenSSL expects that the IV must be a full block. We pad with zeros.
68 std::string iv_block = ciphertext;
69 // Note that kBlockSize >= iv_size_ is checked in the factory method.
70 // We explicitly add the '\0' argument to stress that we need to initialize
71 // the new memory.
72 iv_block.resize(kBlockSize, '\0');
73
74 int ret =
75 EVP_EncryptInit_ex(ctx.get(), cipher_, nullptr /* engine */, key_.data(),
76 reinterpret_cast<const uint8_t*>(&iv_block[0]));
77 if (ret != 1) {
78 return util::Status(absl::StatusCode::kInternal,
79 "could not initialize ctx");
80 }
81 ResizeStringUninitialized(&ciphertext, iv_size_ + plaintext.size());
82 int len;
83 ret = EVP_EncryptUpdate(
84 ctx.get(), reinterpret_cast<uint8_t*>(&ciphertext[iv_size_]), &len,
85 reinterpret_cast<const uint8_t*>(plaintext.data()), plaintext.size());
86 if (ret != 1) {
87 return util::Status(absl::StatusCode::kInternal, "encryption failed");
88 }
89 if (len != plaintext.size()) {
90 return util::Status(absl::StatusCode::kInternal,
91 "incorrect ciphertext size");
92 }
93 return ciphertext;
94 }
95
Decrypt(absl::string_view ciphertext) const96 util::StatusOr<std::string> AesCtrBoringSsl::Decrypt(
97 absl::string_view ciphertext) const {
98 if (ciphertext.size() < iv_size_) {
99 return util::Status(absl::StatusCode::kInvalidArgument,
100 "ciphertext too short");
101 }
102
103 internal::SslUniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
104 if (ctx.get() == nullptr) {
105 return util::Status(absl::StatusCode::kInternal,
106 "could not initialize EVP_CIPHER_CTX");
107 }
108
109 // Initialise key and IV
110 std::string iv_block = std::string(ciphertext.substr(0, iv_size_));
111 iv_block.resize(kBlockSize, '\0');
112 int ret = EVP_DecryptInit_ex(ctx.get(), cipher_, nullptr /* engine */,
113 reinterpret_cast<const uint8_t*>(key_.data()),
114 reinterpret_cast<const uint8_t*>(&iv_block[0]));
115 if (ret != 1) {
116 return util::Status(absl::StatusCode::kInternal,
117 "could not initialize key or iv");
118 }
119
120 size_t plaintext_size = ciphertext.size() - iv_size_;
121 std::string plaintext;
122 ResizeStringUninitialized(&plaintext, plaintext_size);
123 size_t read = iv_size_;
124 int len;
125 ret = EVP_DecryptUpdate(
126 ctx.get(), reinterpret_cast<uint8_t*>(&plaintext[0]), &len,
127 reinterpret_cast<const uint8_t*>(&ciphertext.data()[read]),
128 plaintext_size);
129 if (ret != 1) {
130 return util::Status(absl::StatusCode::kInternal, "decryption failed");
131 }
132
133 if (len != plaintext_size) {
134 return util::Status(absl::StatusCode::kInternal,
135 "incorrect plaintext size");
136 }
137 return plaintext;
138 }
139
140 } // namespace subtle
141 } // namespace tink
142 } // namespace crypto
143