From 231c488ddfc1809b66f8f25d99844029d195fc69 Mon Sep 17 00:00:00 2001 From: Jacob Barthelmeh Date: Mon, 20 Apr 2020 13:44:41 -0600 Subject: [PATCH 1/4] check on tag length for AES-CCM --- wolfcrypt/src/aes.c | 24 ++++++++++++++++++++++++ wolfcrypt/test/test.c | 12 ++++++++++++ 2 files changed, 36 insertions(+) diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index 4b5b437ca..d1f7dda1c 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -6996,6 +6996,14 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, || authTag == NULL || nonceSz < 7 || nonceSz > 13) return BAD_FUNC_ARG; + /* sanity check on tag size */ + if (authTagSz != 4 && authTagSz != 6 && authTagSz != 8 && + authTagSz != 10 && authTagSz != 12 && authTagSz != 14 && + authTagSz != 16) { + WOLFSSL_MSG("Bad auth tag size AES-CCM"); + return BAD_FUNC_ARG; + } + key = (byte*)aes->key; status = wc_AesGetKeySize(aes, &keySize); @@ -7184,6 +7192,14 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, authTagSz > AES_BLOCK_SIZE) return BAD_FUNC_ARG; + /* sanity check on tag size */ + if (authTagSz != 4 && authTagSz != 6 && authTagSz != 8 && + authTagSz != 10 && authTagSz != 12 && authTagSz != 14 && + authTagSz != 16) { + WOLFSSL_MSG("Bad auth tag size AES-CCM"); + return BAD_FUNC_ARG; + } + XMEMSET(A, 0, sizeof(A)); XMEMCPY(B+1, nonce, nonceSz); lenSz = AES_BLOCK_SIZE - 1 - (byte)nonceSz; @@ -7280,6 +7296,14 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, authTagSz > AES_BLOCK_SIZE) return BAD_FUNC_ARG; + /* sanity check on tag size */ + if (authTagSz != 4 && authTagSz != 6 && authTagSz != 8 && + authTagSz != 10 && authTagSz != 12 && authTagSz != 14 && + authTagSz != 16) { + WOLFSSL_MSG("Bad auth tag size AES-CCM"); + return BAD_FUNC_ARG; + } + o = out; oSz = inSz; XMEMCPY(B+1, nonce, nonceSz); diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index b30576db8..b96c245a4 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -9157,6 +9157,18 @@ int aesccm_test(void) return -6313; #endif + /* test fail on invalid IV sizes */ + result = wc_AesCcmSetKey(&enc, k, sizeof(k)); + if (result != 0) + return -6314; + + /* AES-CCM encrypt and decrypt both use AES encrypt internally */ + result = wc_AesCcmEncrypt(&enc, c2, p, sizeof(c2), iv, sizeof(iv), + t2, 1, a, sizeof(a)); + if (result == 0) { + return -6315; + } + return 0; } #endif /* HAVE_AESCCM WOLFSSL_AES_128 */ From c85a53c63190fa2e14766b7a8c8a28f0a9bb9e73 Mon Sep 17 00:00:00 2001 From: Jacob Barthelmeh Date: Mon, 27 Apr 2020 15:36:53 -0600 Subject: [PATCH 2/4] add macro guard for fips and selftest builds --- wolfcrypt/test/test.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index b96c245a4..76b9468d9 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -9157,6 +9157,7 @@ int aesccm_test(void) return -6313; #endif +#if !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) /* test fail on invalid IV sizes */ result = wc_AesCcmSetKey(&enc, k, sizeof(k)); if (result != 0) @@ -9168,6 +9169,7 @@ int aesccm_test(void) if (result == 0) { return -6315; } +#endif return 0; } From b73e52f33ffeb173c9968d42c3dbea8393dfe65f Mon Sep 17 00:00:00 2001 From: Jacob Barthelmeh Date: Tue, 28 Apr 2020 14:46:06 -0600 Subject: [PATCH 3/4] move AES-CCM tag check into a local function --- wolfcrypt/src/aes.c | 26 +++++++++++++++++--------- wolfcrypt/src/port/arm/armv8-aes.c | 4 ++++ wolfcrypt/src/port/caam/caam_aes.c | 4 ++++ wolfssl/wolfcrypt/aes.h | 1 + 4 files changed, 26 insertions(+), 9 deletions(-) diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index d1f7dda1c..4fbf3ef15 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -6970,6 +6970,21 @@ int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz) return wc_AesSetKey(aes, key, keySz, NULL, AES_ENCRYPTION); } + +/* Checks if the tag size is an accepted value based on RFC 3610 section 2 + * returns 0 if tag size is ok + */ +int wc_AesCcmCheckTagSize(int sz) +{ + /* values here are from RFC 3610 section 2 */ + if (sz != 4 && sz != 6 && sz != 8 && sz != 10 && sz != 12 && sz != 14 + && sz != 16) { + WOLFSSL_MSG("Bad auth tag size AES-CCM"); + return BAD_FUNC_ARG; + } + return 0; +} + #ifdef WOLFSSL_ARMASM /* implementation located in wolfcrypt/src/port/arm/armv8-aes.c */ @@ -6996,11 +7011,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, || authTag == NULL || nonceSz < 7 || nonceSz > 13) return BAD_FUNC_ARG; - /* sanity check on tag size */ - if (authTagSz != 4 && authTagSz != 6 && authTagSz != 8 && - authTagSz != 10 && authTagSz != 12 && authTagSz != 14 && - authTagSz != 16) { - WOLFSSL_MSG("Bad auth tag size AES-CCM"); + if (wc_AesCcmCheckTagSize(authTagSz) != 0) { return BAD_FUNC_ARG; } @@ -7193,10 +7204,7 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, return BAD_FUNC_ARG; /* sanity check on tag size */ - if (authTagSz != 4 && authTagSz != 6 && authTagSz != 8 && - authTagSz != 10 && authTagSz != 12 && authTagSz != 14 && - authTagSz != 16) { - WOLFSSL_MSG("Bad auth tag size AES-CCM"); + if (wc_AesCcmCheckTagSize(authTagSz) != 0) { return BAD_FUNC_ARG; } diff --git a/wolfcrypt/src/port/arm/armv8-aes.c b/wolfcrypt/src/port/arm/armv8-aes.c index d0f8a9c5c..ad5cfa873 100644 --- a/wolfcrypt/src/port/arm/armv8-aes.c +++ b/wolfcrypt/src/port/arm/armv8-aes.c @@ -4438,6 +4438,10 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, || authTag == NULL || nonceSz < 7 || nonceSz > 13) return BAD_FUNC_ARG; + if (wc_AesCcmCheckTagSize(authTagSz) != 0) { + return BAD_FUNC_ARG; + } + XMEMCPY(B+1, nonce, nonceSz); lenSz = AES_BLOCK_SIZE - 1 - (byte)nonceSz; B[0] = (authInSz > 0 ? 64 : 0) diff --git a/wolfcrypt/src/port/caam/caam_aes.c b/wolfcrypt/src/port/caam/caam_aes.c index e00214df3..dad970ccc 100644 --- a/wolfcrypt/src/port/caam/caam_aes.c +++ b/wolfcrypt/src/port/caam/caam_aes.c @@ -497,6 +497,10 @@ int wc_AesCcmEncrypt(Aes* aes, byte* out, authTagSz > AES_BLOCK_SIZE) return BAD_FUNC_ARG; + if (wc_AesCcmCheckTagSize(authTagSz) != 0) { + return BAD_FUNC_ARG; + } + if (wc_AesGetKeySize(aes, &keySz) != 0) { return BAD_FUNC_ARG; } diff --git a/wolfssl/wolfcrypt/aes.h b/wolfssl/wolfcrypt/aes.h index 858291849..15d3ee601 100644 --- a/wolfssl/wolfcrypt/aes.h +++ b/wolfssl/wolfcrypt/aes.h @@ -369,6 +369,7 @@ WOLFSSL_API int wc_AesEcbDecrypt(Aes* aes, byte* out, word32 cSz, byte* s, word32 sSz); #endif /* HAVE_AESGCM */ #ifdef HAVE_AESCCM + WOLFSSL_LOCAL int wc_AesCcmCheckTagSize(int sz); WOLFSSL_API int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz); WOLFSSL_API int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, From 505fbed4df1cd6500415df0059acb136eb6c220f Mon Sep 17 00:00:00 2001 From: Jacob Barthelmeh Date: Wed, 29 Apr 2020 15:15:54 -0600 Subject: [PATCH 4/4] fix AES-CCM tag size check on decryption --- wolfcrypt/src/aes.c | 5 +---- wolfcrypt/src/port/arm/armv8-aes.c | 4 ++++ wolfcrypt/src/port/caam/caam_aes.c | 4 ++++ 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index 4fbf3ef15..165382b06 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -7305,10 +7305,7 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, return BAD_FUNC_ARG; /* sanity check on tag size */ - if (authTagSz != 4 && authTagSz != 6 && authTagSz != 8 && - authTagSz != 10 && authTagSz != 12 && authTagSz != 14 && - authTagSz != 16) { - WOLFSSL_MSG("Bad auth tag size AES-CCM"); + if (wc_AesCcmCheckTagSize(authTagSz) != 0) { return BAD_FUNC_ARG; } diff --git a/wolfcrypt/src/port/arm/armv8-aes.c b/wolfcrypt/src/port/arm/armv8-aes.c index ad5cfa873..8999a6f74 100644 --- a/wolfcrypt/src/port/arm/armv8-aes.c +++ b/wolfcrypt/src/port/arm/armv8-aes.c @@ -4510,6 +4510,10 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, || authTag == NULL || nonceSz < 7 || nonceSz > 13) return BAD_FUNC_ARG; + if (wc_AesCcmCheckTagSize(authTagSz) != 0) { + return BAD_FUNC_ARG; + } + o = out; oSz = inSz; XMEMCPY(B+1, nonce, nonceSz); diff --git a/wolfcrypt/src/port/caam/caam_aes.c b/wolfcrypt/src/port/caam/caam_aes.c index dad970ccc..c83e6c931 100644 --- a/wolfcrypt/src/port/caam/caam_aes.c +++ b/wolfcrypt/src/port/caam/caam_aes.c @@ -580,6 +580,10 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, authTagSz > AES_BLOCK_SIZE) return BAD_FUNC_ARG; + if (wc_AesCcmCheckTagSize(authTagSz) != 0) { + return BAD_FUNC_ARG; + } + if (wc_AesGetKeySize(aes, &keySz) != 0) { return BAD_FUNC_ARG; }