From 9c4e0807e25bbb5e92c0372080542256f332ca04 Mon Sep 17 00:00:00 2001 From: Eric Blankenhorn Date: Tue, 28 Jan 2020 21:46:04 -0600 Subject: [PATCH] Adding EVP_aes_###_xts tests (not complete) --- src/ssl.c | 56 ++++++++++++++++++++++++++++++++++++++++- wolfcrypt/src/evp.c | 11 ++++++++ wolfcrypt/test/test.c | 19 ++++++++++++++ wolfssl/openssl/evp.h | 2 ++ wolfssl/wolfcrypt/aes.h | 5 +++- 5 files changed, 91 insertions(+), 2 deletions(-) diff --git a/src/ssl.c b/src/ssl.c index 05b617d0a..5c192e84e 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -17524,7 +17524,61 @@ int wolfSSL_EVP_MD_type(const WOLFSSL_EVP_MD *md) } } #endif /* WOLFSSL_AES_256 */ - #endif /* HAVE_AES_CBC */ + #endif /* HAVE_AES_OFB */ + #ifdef WOLFSSL_AES_XTS + #ifdef WOLFSSL_AES_128 + if (ctx->cipherType == AES_128_XTS_TYPE || + (type && XSTRNCMP(type, EVP_AES_128_XTS, EVP_AES_SIZE) == 0)) { + WOLFSSL_MSG("EVP_AES_128_XTS"); + ctx->cipherType = AES_128_XTS_TYPE; + ctx->flags &= ~WOLFSSL_EVP_CIPH_MODE; + ctx->flags |= WOLFSSL_EVP_CIPH_XTS_MODE; + ctx->keyLen = 16; + ctx->block_size = 1; + if (enc == 0 || enc == 1) + ctx->enc = enc ? 1 : 0; + if (key) { + ret = AesSetKey_ex(&ctx->cipher.aes, key, ctx->keyLen, iv, + AES_ENCRYPTION, 0); + if (ret != 0) + return ret; + } + if (iv && key == NULL) { + ret = wc_AesSetIV(&ctx->cipher.aes, iv); + if (ret != 0) + return ret; + } + } + #endif /* WOLFSSL_AES_128 */ + #ifdef WOLFSSL_AES_256 + if (ctx->cipherType == AES_256_XTS_TYPE || + (type && XSTRNCMP(type, EVP_AES_256_XTS, EVP_AES_SIZE) == 0)) { + WOLFSSL_MSG("EVP_AES_256_XTS"); + ctx->cipherType = AES_256_XTS_TYPE; + ctx->flags &= ~WOLFSSL_EVP_CIPH_MODE; + ctx->flags |= WOLFSSL_EVP_CIPH_XTS_MODE; + ctx->keyLen = 32; + ctx->block_size = 1; + if (enc == 0 || enc == 1) + ctx->enc = enc ? 1 : 0; + if (key) { + ret = AesSetKey_ex(&ctx->cipher.aes, key, ctx->keyLen, iv, + AES_ENCRYPTION, 0); + if (ret != 0){ + WOLFSSL_MSG("AesSetKey() failed"); + return ret; + } + } + if (iv && key == NULL) { + ret = wc_AesSetIV(&ctx->cipher.aes, iv); + if (ret != 0){ + WOLFSSL_MSG("wc_AesSetIV() failed"); + return ret; + } + } + } + #endif /* WOLFSSL_AES_256 */ + #endif /* HAVE_AES_XTS */ #endif /* NO_AES */ #ifndef NO_DES3 diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c index 0d411e15c..9111fc5e3 100644 --- a/wolfcrypt/src/evp.c +++ b/wolfcrypt/src/evp.c @@ -357,6 +357,17 @@ static int evpCipherBlock(WOLFSSL_EVP_CIPHER_CTX *ctx, ret = wc_AesOfbDecrypt(&ctx->cipher.aes, out, in, inl); break; #endif +#if defined(WOLFSSL_AES_XTS) + case AES_128_XTS_TYPE: + case AES_256_XTS_TYPE: + if (ctx->enc) + ret = wc_AesXtsEncrypt(&ctx->cipher.xts, out, in, inl, + ctx->cipher.tweak, ctx->cipher.tweakSz); + else + ret = wc_AesXtsDecrypt(&ctx->cipher.xts, out, in, inl, + ctx->cipher.tweak, ctx->cipher.tweakSz); + break; +#endif #endif /* !NO_AES */ #ifndef NO_DES3 case DES_CBC_TYPE: diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 7eacde33d..e0655e27e 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -6444,6 +6444,16 @@ static int aes_xts_128_test(void) if (wc_AesXtsSetKey(&aes, k2, sizeof(k2), AES_ENCRYPTION, HEAP_HINT, devId) != 0) return -4900; + +#if 0 /* Enable after passes */ +//#ifdef OPENSSL_EXTRA + ret = EVP_test(EVP_aes_128_xts(), k2, i2, p2, sizeof(p2), c2, sizeof(c2)); + if (ret != 0) { + printf("EVP_aes_128_xts failed!\n"); + return ret; + } +#endif + ret = wc_AesXtsEncrypt(&aes, buf, p2, sizeof(p2), i2, sizeof(i2)); #if defined(WOLFSSL_ASYNC_CRYPT) ret = wc_AsyncWait(ret, &aes.aes.asyncDev, WC_ASYNC_FLAG_NONE); @@ -6612,6 +6622,15 @@ static int aes_xts_256_test(void) 0xc3, 0xea, 0xd8, 0x10, 0xe9, 0xc0, 0xaf, 0x92 }; +#if 0 /* Enable after passes */ +//#ifdef OPENSSL_EXTRA + ret = EVP_test(EVP_aes_256_xts(), k2, i2, p2, sizeof(p2), c2, sizeof(c2)); + if (ret != 0) { + printf("EVP_aes_256_xts failed\n"); + return ret; + } +#endif + XMEMSET(buf, 0, sizeof(buf)); if (wc_AesXtsSetKey(&aes, k2, sizeof(k2), AES_ENCRYPTION, HEAP_HINT, devId) != 0) diff --git a/wolfssl/openssl/evp.h b/wolfssl/openssl/evp.h index b87d9b84b..5c344922e 100644 --- a/wolfssl/openssl/evp.h +++ b/wolfssl/openssl/evp.h @@ -590,6 +590,7 @@ WOLFSSL_API int wolfSSL_PKCS5_PBKDF2_HMAC(const char *pass, int passlen, #define EVP_CIPH_CTR_MODE WOLFSSL_EVP_CIPH_CTR_MODE #define EVP_CIPH_GCM_MODE WOLFSSL_EVP_CIPH_GCM_MODE #define EVP_CIPH_CCM_MODE WOLFSSL_EVP_CIPH_CCM_MODE +#define EVP_CIPH_XTS_MODE WOLFSSL_EVP_CIPH_XTS_MODE #define WOLFSSL_EVP_CIPH_MODE 0x0007 #define WOLFSSL_EVP_CIPH_STREAM_CIPHER 0x0 @@ -600,6 +601,7 @@ WOLFSSL_API int wolfSSL_PKCS5_PBKDF2_HMAC(const char *pass, int passlen, #define WOLFSSL_EVP_CIPH_CTR_MODE 0x5 #define WOLFSSL_EVP_CIPH_GCM_MODE 0x6 #define WOLFSSL_EVP_CIPH_CCM_MODE 0x7 +#define WOLFSSL_EVP_CIPH_XTS_MODE 0x10 #define WOLFSSL_EVP_CIPH_NO_PADDING 0x100 #define EVP_CIPH_VARIABLE_LENGTH 0x200 #define WOLFSSL_EVP_CIPH_TYPE_INIT 0xff diff --git a/wolfssl/wolfcrypt/aes.h b/wolfssl/wolfcrypt/aes.h index 6204f5889..91aae2c09 100644 --- a/wolfssl/wolfcrypt/aes.h +++ b/wolfssl/wolfcrypt/aes.h @@ -136,6 +136,9 @@ enum { #ifdef WOLFSSL_AES_OFB AES_OFB_MODE = 2, #endif +#ifdef WOLFSSL_AES_XTS + AES_XTS_MODE = 3, +#endif #ifdef HAVE_PKCS11 AES_MAX_ID_LEN = 32, @@ -186,7 +189,7 @@ struct Aes { WC_ASYNC_DEV asyncDev; #endif /* WOLFSSL_ASYNC_CRYPT */ #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \ - defined(WOLFSSL_AES_OFB) + defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) word32 left; /* unused bytes left from last call */ #endif #ifdef WOLFSSL_XILINX_CRYPT