sgx_aes_gcm.cpp 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235
  1. /*
  2. * Copyright (C) 2011-2017 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. #include "sgx_tcrypto.h"
  32. #include "ippcp.h"
  33. #include "stdlib.h"
  34. #include "string.h"
  35. /* Rijndael AES-GCM
  36. * Parameters:
  37. * Return: sgx_status_t - SGX_SUCCESS or failure as defined sgx_error.h
  38. * Inputs: sgx_aes_gcm_128bit_key_t *p_key - Pointer to key used in encryption/decryption operation
  39. * uint8_t *p_src - Pointer to input stream to be encrypted/decrypted
  40. * uint32_t src_len - Length of input stream to be encrypted/decrypted
  41. * uint8_t *p_iv - Pointer to initialization vector to use
  42. * uint32_t iv_len - Length of initialization vector
  43. * uint8_t *p_aad - Pointer to input stream of additional authentication data
  44. * uint32_t aad_len - Length of additional authentication data stream
  45. * sgx_aes_gcm_128bit_tag_t *p_in_mac - Pointer to expected MAC in decryption process
  46. * Output: uint8_t *p_dst - Pointer to cipher text. Size of buffer should be >= src_len.
  47. * sgx_aes_gcm_128bit_tag_t *p_out_mac - Pointer to MAC generated from encryption process
  48. * NOTE: Wrapper is responsible for confirming decryption tag matches encryption tag */
  49. sgx_status_t sgx_rijndael128GCM_encrypt(const sgx_aes_gcm_128bit_key_t *p_key, const uint8_t *p_src, uint32_t src_len,
  50. uint8_t *p_dst, const uint8_t *p_iv, uint32_t iv_len, const uint8_t *p_aad, uint32_t aad_len,
  51. sgx_aes_gcm_128bit_tag_t *p_out_mac)
  52. {
  53. IppStatus error_code = ippStsNoErr;
  54. IppsAES_GCMState* pState = NULL;
  55. int ippStateSize = 0;
  56. if ((p_key == NULL) || ((src_len > 0) && (p_dst == NULL)) || ((src_len > 0) && (p_src == NULL))
  57. || (p_out_mac == NULL) || (iv_len != SGX_AESGCM_IV_SIZE) || ((aad_len > 0) && (p_aad == NULL))
  58. || (p_iv == NULL) || ((p_src == NULL) && (p_aad == NULL)))
  59. {
  60. return SGX_ERROR_INVALID_PARAMETER;
  61. }
  62. error_code = ippsAES_GCMGetSize(&ippStateSize);
  63. if (error_code != ippStsNoErr)
  64. {
  65. return SGX_ERROR_UNEXPECTED;
  66. }
  67. pState = (IppsAES_GCMState*)malloc(ippStateSize);
  68. if (pState == NULL)
  69. {
  70. return SGX_ERROR_OUT_OF_MEMORY;
  71. }
  72. error_code = ippsAES_GCMInit((const Ipp8u *)p_key, SGX_AESGCM_KEY_SIZE, pState, ippStateSize);
  73. if (error_code != ippStsNoErr)
  74. {
  75. // Clear temp State before free.
  76. memset_s(pState, ippStateSize, 0, ippStateSize);
  77. free(pState);
  78. switch (error_code)
  79. {
  80. case ippStsMemAllocErr: return SGX_ERROR_OUT_OF_MEMORY;
  81. case ippStsNullPtrErr:
  82. case ippStsLengthErr: return SGX_ERROR_INVALID_PARAMETER;
  83. default: return SGX_ERROR_UNEXPECTED;
  84. }
  85. }
  86. error_code = ippsAES_GCMStart(p_iv, SGX_AESGCM_IV_SIZE, p_aad, aad_len, pState);
  87. if (error_code != ippStsNoErr)
  88. {
  89. // Clear temp State before free.
  90. memset_s(pState, ippStateSize, 0, ippStateSize);
  91. free(pState);
  92. switch (error_code)
  93. {
  94. case ippStsNullPtrErr:
  95. case ippStsLengthErr: return SGX_ERROR_INVALID_PARAMETER;
  96. default: return SGX_ERROR_UNEXPECTED;
  97. }
  98. }
  99. if (src_len > 0) {
  100. error_code = ippsAES_GCMEncrypt(p_src, p_dst, src_len, pState);
  101. if (error_code != ippStsNoErr)
  102. {
  103. // Clear temp State before free.
  104. memset_s(pState, ippStateSize, 0, ippStateSize);
  105. free(pState);
  106. switch (error_code)
  107. {
  108. case ippStsNullPtrErr: return SGX_ERROR_INVALID_PARAMETER;
  109. default: return SGX_ERROR_UNEXPECTED;
  110. }
  111. }
  112. }
  113. error_code = ippsAES_GCMGetTag((Ipp8u *)p_out_mac, SGX_AESGCM_MAC_SIZE, pState);
  114. if (error_code != ippStsNoErr)
  115. {
  116. // Clear temp State before free.
  117. memset_s(p_dst, src_len, 0, src_len);
  118. memset_s(pState, ippStateSize, 0, ippStateSize);
  119. free(pState);
  120. switch (error_code)
  121. {
  122. case ippStsNullPtrErr:
  123. case ippStsLengthErr: return SGX_ERROR_INVALID_PARAMETER;
  124. default: return SGX_ERROR_UNEXPECTED;
  125. }
  126. }
  127. // Clear temp State before free.
  128. memset_s(pState, ippStateSize, 0, ippStateSize);
  129. free(pState);
  130. return SGX_SUCCESS;
  131. }
  132. sgx_status_t sgx_rijndael128GCM_decrypt(const sgx_aes_gcm_128bit_key_t *p_key, const uint8_t *p_src,
  133. uint32_t src_len, uint8_t *p_dst, const uint8_t *p_iv, uint32_t iv_len,
  134. const uint8_t *p_aad, uint32_t aad_len, const sgx_aes_gcm_128bit_tag_t *p_in_mac)
  135. {
  136. IppStatus error_code = ippStsNoErr;
  137. uint8_t l_tag[SGX_AESGCM_MAC_SIZE];
  138. IppsAES_GCMState* pState = NULL;
  139. int ippStateSize = 0;
  140. if ((p_key == NULL) || ((src_len > 0) && (p_dst == NULL)) || ((src_len > 0) && (p_src == NULL))
  141. || (p_in_mac == NULL) || (iv_len != SGX_AESGCM_IV_SIZE) || ((aad_len > 0) && (p_aad == NULL))
  142. || (p_iv == NULL) || ((p_src == NULL) && (p_aad == NULL)))
  143. {
  144. return SGX_ERROR_INVALID_PARAMETER;
  145. }
  146. // Autenthication Tag returned by Decrypt to be compared with Tag created during seal
  147. memset(&l_tag, 0, SGX_AESGCM_MAC_SIZE);
  148. error_code = ippsAES_GCMGetSize(&ippStateSize);
  149. if (error_code != ippStsNoErr)
  150. {
  151. return SGX_ERROR_UNEXPECTED;
  152. }
  153. pState = (IppsAES_GCMState*)malloc(ippStateSize);
  154. if (pState == NULL)
  155. {
  156. return SGX_ERROR_OUT_OF_MEMORY;
  157. }
  158. error_code = ippsAES_GCMInit((const Ipp8u *)p_key, SGX_AESGCM_KEY_SIZE, pState, ippStateSize);
  159. if (error_code != ippStsNoErr)
  160. {
  161. // Clear temp State before free.
  162. memset_s(pState, ippStateSize, 0, ippStateSize);
  163. free(pState);
  164. switch (error_code)
  165. {
  166. case ippStsMemAllocErr: return SGX_ERROR_OUT_OF_MEMORY;
  167. case ippStsNullPtrErr:
  168. case ippStsLengthErr: return SGX_ERROR_INVALID_PARAMETER;
  169. default: return SGX_ERROR_UNEXPECTED;
  170. }
  171. }
  172. error_code = ippsAES_GCMStart(p_iv, SGX_AESGCM_IV_SIZE, p_aad, aad_len, pState);
  173. if (error_code != ippStsNoErr)
  174. {
  175. // Clear temp State before free.
  176. memset_s(pState, ippStateSize, 0, ippStateSize);
  177. free(pState);
  178. switch (error_code)
  179. {
  180. case ippStsNullPtrErr:
  181. case ippStsLengthErr: return SGX_ERROR_INVALID_PARAMETER;
  182. default: return SGX_ERROR_UNEXPECTED;
  183. }
  184. }
  185. if (src_len > 0) {
  186. error_code = ippsAES_GCMDecrypt(p_src, p_dst, src_len, pState);
  187. if (error_code != ippStsNoErr)
  188. {
  189. // Clear temp State before free.
  190. memset_s(pState, ippStateSize, 0, ippStateSize);
  191. free(pState);
  192. switch (error_code)
  193. {
  194. case ippStsNullPtrErr: return SGX_ERROR_INVALID_PARAMETER;
  195. default: return SGX_ERROR_UNEXPECTED;
  196. }
  197. }
  198. }
  199. error_code = ippsAES_GCMGetTag((Ipp8u *)l_tag, SGX_AESGCM_MAC_SIZE, pState);
  200. if (error_code != ippStsNoErr)
  201. {
  202. // Clear temp State before free.
  203. memset_s(p_dst, src_len, 0, src_len);
  204. memset_s(pState, ippStateSize, 0, ippStateSize);
  205. free(pState);
  206. switch (error_code)
  207. {
  208. case ippStsNullPtrErr:
  209. case ippStsLengthErr: return SGX_ERROR_INVALID_PARAMETER;
  210. default: return SGX_ERROR_UNEXPECTED;
  211. }
  212. }
  213. // Clear temp State before free.
  214. memset_s(pState, ippStateSize, 0, ippStateSize);
  215. free(pState);
  216. // Verify current data tag = data tag generated when sealing the data blob
  217. if (consttime_memequal(p_in_mac, &l_tag, SGX_AESGCM_MAC_SIZE) == 0)
  218. {
  219. memset_s(p_dst, src_len, 0, src_len);
  220. memset_s(&l_tag, SGX_AESGCM_MAC_SIZE, 0, SGX_AESGCM_MAC_SIZE);
  221. return SGX_ERROR_MAC_MISMATCH;
  222. }
  223. memset_s(&l_tag, SGX_AESGCM_MAC_SIZE, 0, SGX_AESGCM_MAC_SIZE);
  224. return SGX_SUCCESS;
  225. }