ccm.c File Reference

#include "precomp.h"

Include dependency graph for ccm.c:

Go to the source code of this file.

Macros
#define	CCM_MIN_NONCE_SIZE   (7)
#define	CCM_MAX_NONCE_SIZE   (13)
#define	CCM_MIN_TAG_SIZE   (4)
#define	CCM_MAX_TAG_SIZE   (16)
#define	CCM_MAX_COUNTER_SIZE   (SYMCRYPT_CCM_BLOCK_SIZE - 1 - CCM_MIN_NONCE_SIZE)
#define	AUTHDATA_16BIT_LIMIT   ((1<<16) - (1<<8))
#define	AUTHDATA_32BIT_LIMIT   (1ull << 32)
#define	CCM_BLOCK_MOD_MASK   (SYMCRYPT_CCM_BLOCK_SIZE - 1)
#define	CCM_BLOCK_ROUND_MASK   (~CCM_BLOCK_MOD_MASK)

Functions
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptCcmValidateParameters (_In_ PCSYMCRYPT_BLOCKCIPHER pBlockCipher, _In_ SIZE_T cbNonce, _In_ SIZE_T cbAssociatedData, _In_ UINT64 cbData, _In_ SIZE_T cbTag)
VOID SYMCRYPT_CALL	SymCryptCcmEncryptDecryptPart (_Inout_ PSYMCRYPT_CCM_STATE pState, _In_reads_(cbData) PCBYTE pbSrc, _Out_writes_(cbData) PBYTE pbDst, SIZE_T cbData)
VOID SYMCRYPT_CALL	SymCryptCcmAddMacData (_Inout_ PSYMCRYPT_CCM_STATE pState, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData)
VOID SYMCRYPT_CALL	SymCryptCcmPadMacData (_Inout_ PSYMCRYPT_CCM_STATE pState)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptCcmEncrypt (_In_ PCSYMCRYPT_BLOCKCIPHER pBlockCipher, _In_ PCVOID pExpandedKey, _In_reads_(cbNonce) PCBYTE pbNonce, SIZE_T cbNonce, _In_reads_opt_(cbAuthData) PCBYTE pbAuthData, SIZE_T cbAuthData, _In_reads_(cbData) PCBYTE pbSrc, _Out_writes_(cbData) PBYTE pbDst, SIZE_T cbData, _Out_writes_(cbTag) PBYTE pbTag, SIZE_T cbTag)
SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptCcmDecrypt (_In_ PCSYMCRYPT_BLOCKCIPHER pBlockCipher, _In_ PCVOID pExpandedKey, _In_reads_(cbNonce) PCBYTE pbNonce, SIZE_T cbNonce, _In_reads_opt_(cbAuthData) PCBYTE pbAuthData, SIZE_T cbAuthData, _In_reads_(cbData) PCBYTE pbSrc, _Out_writes_(cbData) PBYTE pbDst, SIZE_T cbData, _In_reads_(cbTag) PCBYTE pbTag, SIZE_T cbTag)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptCcmInit (_Out_ PSYMCRYPT_CCM_STATE pState, _In_ PCSYMCRYPT_BLOCKCIPHER pBlockCipher, _In_ PCVOID pExpandedKey, _In_reads_(cbNonce) PCBYTE pbNonce, SIZE_T cbNonce, _In_reads_opt_(cbAuthData) PCBYTE pbAuthData, SIZE_T cbAuthData, UINT64 cbData, SIZE_T cbTag)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptCcmEncryptPart (_Inout_ PSYMCRYPT_CCM_STATE pState, _In_reads_(cbData) PCBYTE pbSrc, _Out_writes_(cbData) PBYTE pbDst, SIZE_T cbData)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptCcmEncryptFinal (_Inout_ PSYMCRYPT_CCM_STATE pState, _Out_writes_(cbTag) PBYTE pbTag, SIZE_T cbTag)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptCcmDecryptPart (_Inout_ PSYMCRYPT_CCM_STATE pState, _In_reads_(cbData) PCBYTE pbSrc, _Out_writes_(cbData) PBYTE pbDst, SIZE_T cbData)
SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptCcmDecryptFinal (_Inout_ PSYMCRYPT_CCM_STATE pState, _In_reads_(cbTag) PCBYTE pbTag, SIZE_T cbTag)
VOID SYMCRYPT_CALL	SymCryptCcmSelftest (void)

Variables
const BOOL	fcbAuthDataLt32bitLimitStatic = SIZE_T_MAX < AUTHDATA_32BIT_LIMIT
static const BYTE	SymCryptCcmSelftestResult [3+SYMCRYPT_AES_BLOCK_SIZE]

Macro Definition Documentation

AUTHDATA_16BIT_LIMIT

#define AUTHDATA_16BIT_LIMIT   ((1<<16) - (1<<8))

Definition at line 16 of file ccm.c.

AUTHDATA_32BIT_LIMIT

#define AUTHDATA_32BIT_LIMIT   (1ull << 32)

Definition at line 17 of file ccm.c.

CCM_BLOCK_MOD_MASK

#define CCM_BLOCK_MOD_MASK   (SYMCRYPT_CCM_BLOCK_SIZE - 1)

Definition at line 23 of file ccm.c.

CCM_BLOCK_ROUND_MASK

#define CCM_BLOCK_ROUND_MASK   (~CCM_BLOCK_MOD_MASK)

Definition at line 24 of file ccm.c.

CCM_MAX_COUNTER_SIZE

#define CCM_MAX_COUNTER_SIZE   (SYMCRYPT_CCM_BLOCK_SIZE - 1 - CCM_MIN_NONCE_SIZE)

Definition at line 14 of file ccm.c.

CCM_MAX_NONCE_SIZE

#define CCM_MAX_NONCE_SIZE   (13)

Definition at line 10 of file ccm.c.

CCM_MAX_TAG_SIZE

#define CCM_MAX_TAG_SIZE   (16)

Definition at line 12 of file ccm.c.

CCM_MIN_NONCE_SIZE

#define CCM_MIN_NONCE_SIZE   (7)

Definition at line 9 of file ccm.c.

CCM_MIN_TAG_SIZE

#define CCM_MIN_TAG_SIZE   (4)

Definition at line 11 of file ccm.c.

Function Documentation

SymCryptCcmAddMacData()

VOID SYMCRYPT_CALL SymCryptCcmAddMacData	(	_Inout_ PSYMCRYPT_CCM_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData
	)

Definition at line 164 of file ccm.c.

{
    SIZE_T bytesToProcess;
    if( pState->bytesInMacBlock > 0 )
    {
        bytesToProcess = SYMCRYPT_MIN( cbData, SYMCRYPT_CCM_BLOCK_SIZE - pState->bytesInMacBlock );
        SymCryptXorBytes( &pState->macBlock[pState->bytesInMacBlock], pbData, &pState->macBlock[pState->bytesInMacBlock], bytesToProcess );
        pbData += bytesToProcess;
        cbData -= bytesToProcess;
        pState->bytesInMacBlock += bytesToProcess;
 
        if( pState->bytesInMacBlock == SYMCRYPT_CCM_BLOCK_SIZE )
        {
            pState->pBlockCipher->encryptFunc( pState->pExpandedKey, &pState->macBlock[0], &pState->macBlock[0] );
            pState->bytesInMacBlock = 0;
        }
    }
 
    if( cbData >= SYMCRYPT_CCM_BLOCK_SIZE )
    {
        bytesToProcess = cbData & CCM_BLOCK_ROUND_MASK;
        SYMCRYPT_ASSERT( pState->pBlockCipher->blockSize == SYMCRYPT_CCM_BLOCK_SIZE );
 
        SymCryptCbcMac( pState->pBlockCipher,
                        pState->pExpandedKey,
                        &pState->macBlock[0],
                        pbData,
                        bytesToProcess );
 
        pbData += bytesToProcess;
        cbData -= bytesToProcess;
    }
 
    if( cbData > 0 )
    {
        SymCryptXorBytes( &pState->macBlock[0], pbData, &pState->macBlock[0], cbData );
        pState->bytesInMacBlock = cbData;
    }
}

Referenced by SymCryptCcmDecryptPart(), SymCryptCcmEncryptPart(), and SymCryptCcmInit().

SymCryptCcmDecrypt()

SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptCcmDecrypt	(	_In_ PCSYMCRYPT_BLOCKCIPHER	pBlockCipher,
		_In_ PCVOID	pExpandedKey,
		_In_reads_(cbNonce) PCBYTE	pbNonce,
		SIZE_T	cbNonce,
		_In_reads_opt_(cbAuthData) PCBYTE	pbAuthData,
		SIZE_T	cbAuthData,
		_In_reads_(cbData) PCBYTE	pbSrc,
		_Out_writes_(cbData) PBYTE	pbDst,
		SIZE_T	cbData,
		_In_reads_(cbTag) PCBYTE	pbTag,
		SIZE_T	cbTag
	)

Definition at line 257 of file ccm.c.

{
    SYMCRYPT_CCM_STATE  state;
    SYMCRYPT_ERROR      status;
 
    SymCryptCcmInit(    &state,
                        pBlockCipher,
                        pExpandedKey,
                        pbNonce, cbNonce,
                        pbAuthData, cbAuthData,
                        cbData, cbTag );
 
 
    SymCryptCcmDecryptPart( &state, pbSrc, pbDst, cbData );
 
    status = SymCryptCcmDecryptFinal( &state, pbTag, cbTag );
 
    //
    // If we failed for any reason we wipe our output buffer to avoid returning
    // decrypted but unauthenticated data.
    //
    if( status != SYMCRYPT_NO_ERROR )
    {
        SymCryptWipe( pbDst, cbData );
    }
 
    return status;
}

Referenced by SymCryptCcmSelftest().

SymCryptCcmDecryptFinal()

SYMCRYPT_NOINLINE SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptCcmDecryptFinal	(	_Inout_ PSYMCRYPT_CCM_STATE	pState,
		_In_reads_(cbTag) PCBYTE	pbTag,
		SIZE_T	cbTag
	)

Definition at line 542 of file ccm.c.

{
    SYMCRYPT_ERROR status;
 
    //
    // Check invariants in checked builds
    //
    SYMCRYPT_CHECK_MAGIC( pState );
 
    SYMCRYPT_ASSERT( cbTag  == pState->cbTag && pState->bytesProcessed == pState->cbData );
 
    SymCryptCcmPadMacData( pState );
 
    //
    // Set the counter value to zero to get the counter value that encrypts the tag,
    // and then encrypt the tag
    // We reset bytesProcessed so that the partial encrypt/decrypt function will do the right thing
    //
    SymCryptWipe( &pState->counterBlock[1 + pState->cbNonce], pState->cbCounter );
 
    pState->bytesProcessed = 0;
 
    SymCryptCcmEncryptDecryptPart( pState, &pState->macBlock[0], &pState->macBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );
 
    if( !SymCryptEqual( pbTag, &pState->macBlock[0], cbTag ) )
    {
        status = SYMCRYPT_AUTHENTICATION_FAILURE;
    }
    else
    {
        status = SYMCRYPT_NO_ERROR;
    }
 
    SymCryptWipeKnownSize( pState, sizeof( *pState ) );
    SYMCRYPT_ASSERT( pState->bytesInMacBlock == 0 );
 
    return status;
}

Referenced by SymCryptCcmDecrypt().

SymCryptCcmDecryptPart()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptCcmDecryptPart	(	_Inout_ PSYMCRYPT_CCM_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbSrc,
		_Out_writes_(cbData) PBYTE	pbDst,
		SIZE_T	cbData
	)

Definition at line 503 of file ccm.c.

{
    UINT64 bytesProcessedAfterThisCall;
 
    SYMCRYPT_CHECK_MAGIC( pState );
 
    bytesProcessedAfterThisCall = cbData + pState->bytesProcessed;
 
    SYMCRYPT_ASSERT( bytesProcessedAfterThisCall >= cbData &&
                     bytesProcessedAfterThisCall <= pState->cbData );
 
 
    //
    // We are violating the read-once/write-once implementation rule here.
    // We write the decrypted data and then read it back for the authentication function.
    // In this particular situation this is safe to do.
    //
    // Anyone who can access the memory space that contains the source and destination of this
    // function can recover the key stream used for this (key,nonce) combination.
    // We can think of the decryption function as merely exposing the key stream, and then the
    // caller picking the ciphertext (and by implication the plaintext) to be authenticated.
    // Thus the data we read during authentication is the 'real' plaintext, and the
    // decryption function merely made the key stream available.
    //
    // Note that this would not safe in general, it is only safe because CTR mode decryption already
    // reveals the key stream.
    //
    SymCryptCcmEncryptDecryptPart( pState, pbSrc, pbDst, cbData );
    SymCryptCcmAddMacData( pState, pbDst, cbData );
 
}

Referenced by SymCryptCcmDecrypt().

SymCryptCcmEncrypt()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptCcmEncrypt	(	_In_ PCSYMCRYPT_BLOCKCIPHER	pBlockCipher,
		_In_ PCVOID	pExpandedKey,
		_In_reads_(cbNonce) PCBYTE	pbNonce,
		SIZE_T	cbNonce,
		_In_reads_opt_(cbAuthData) PCBYTE	pbAuthData,
		SIZE_T	cbAuthData,
		_In_reads_(cbData) PCBYTE	pbSrc,
		_Out_writes_(cbData) PBYTE	pbDst,
		SIZE_T	cbData,
		_Out_writes_(cbTag) PBYTE	pbTag,
		SIZE_T	cbTag
	)

Definition at line 227 of file ccm.c.

{
    SYMCRYPT_CCM_STATE  state;
 
    SymCryptCcmInit(    &state,
                        pBlockCipher,
                        pExpandedKey,
                        pbNonce, cbNonce,
                        pbAuthData, cbAuthData,
                        cbData, cbTag );
 
    SymCryptCcmEncryptPart( &state, pbSrc, pbDst, cbData );
 
    SymCryptCcmEncryptFinal( &state, pbTag, cbTag );
}

Referenced by SymCryptCcmSelftest().

SymCryptCcmEncryptDecryptPart()

VOID SYMCRYPT_CALL SymCryptCcmEncryptDecryptPart	(	_Inout_ PSYMCRYPT_CCM_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbSrc,
		_Out_writes_(cbData) PBYTE	pbDst,
		SIZE_T	cbData
	)

Definition at line 93 of file ccm.c.

{
    SIZE_T  cbToDo = cbData;
    SIZE_T  bytesToProcess;
 
    //
    // Use any left-over key stream
    //
    while( (pState->bytesProcessed & CCM_BLOCK_MOD_MASK) != 0 && cbToDo > 0 )
    {
        *pbDst = *pbSrc ^ pState->keystreamBlock[ pState->bytesProcessed & CCM_BLOCK_MOD_MASK ];
        pbDst++;
        pbSrc++;
        cbToDo--;
        pState->bytesProcessed++;
    }
 
    //
    // Bulk process the main part of the input and output
    //
    if( cbToDo >= SYMCRYPT_CCM_BLOCK_SIZE )
    {
        bytesToProcess = cbToDo & CCM_BLOCK_ROUND_MASK;
        SYMCRYPT_ASSERT( bytesToProcess <= cbToDo );
 
        SYMCRYPT_ASSERT( pState->pBlockCipher->blockSize == SYMCRYPT_CCM_BLOCK_SIZE );
        SymCryptCtrMsb64(   pState->pBlockCipher,
                            pState->pExpandedKey,
                            &pState->counterBlock[0],
                            pbSrc,
                            pbDst,
                            bytesToProcess );
        pbSrc += bytesToProcess;
        pbDst += bytesToProcess;
        pState->bytesProcessed += bytesToProcess;
        cbToDo -= bytesToProcess;
    }
 
    if( cbToDo > 0 )
    {
        //
        // Encrypt an all-zero key stream block to get the key stream.
        //
        SymCryptWipeKnownSize( &pState->keystreamBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );
 
        SYMCRYPT_ASSERT( pState->pBlockCipher->blockSize == SYMCRYPT_CCM_BLOCK_SIZE );
        SymCryptCtrMsb64(   pState->pBlockCipher,
                            pState->pExpandedKey,
                            &pState->counterBlock[0],
                            &pState->keystreamBlock[0],
                            &pState->keystreamBlock[0],
                            SYMCRYPT_CCM_BLOCK_SIZE );
        while( cbToDo > 0 )
        {
            *pbDst = *pbSrc ^ pState->keystreamBlock[ pState->bytesProcessed & CCM_BLOCK_MOD_MASK ];
            pbDst++;
            pbSrc++;
            cbToDo--;
            pState->bytesProcessed++;
        }
    }
}

Referenced by SymCryptCcmDecryptFinal(), SymCryptCcmDecryptPart(), SymCryptCcmEncryptFinal(), and SymCryptCcmEncryptPart().

SymCryptCcmEncryptFinal()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptCcmEncryptFinal	(	_Inout_ PSYMCRYPT_CCM_STATE	pState,
		_Out_writes_(cbTag) PBYTE	pbTag,
		SIZE_T	cbTag
	)

Definition at line 468 of file ccm.c.

{
    //
    // Check invariants in checked builds
    //
    SYMCRYPT_CHECK_MAGIC( pState );
 
    SYMCRYPT_ASSERT( cbTag  == pState->cbTag && pState->bytesProcessed == pState->cbData );
 
 
    SymCryptCcmPadMacData( pState );
 
    //
    // Set the counter value to zero to get the counter value that encrypts the tag,
    // and then encrypt the tag.
    // We reset bytesProcessed so that the partial encrypt/decrypt function will do the right thing
    //
    SymCryptWipe( &pState->counterBlock[1 + pState->cbNonce], pState->cbCounter );
 
    pState->bytesProcessed = 0;
 
    SymCryptCcmEncryptDecryptPart( pState, &pState->macBlock[0], &pState->macBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );
 
    memcpy( pbTag, &pState->macBlock[0], cbTag );
 
    SymCryptWipeKnownSize( pState, sizeof( *pState ) );
    SYMCRYPT_ASSERT( pState->bytesInMacBlock == 0 );
}

Referenced by SymCryptCcmEncrypt().

SymCryptCcmEncryptPart()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptCcmEncryptPart	(	_Inout_ PSYMCRYPT_CCM_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbSrc,
		_Out_writes_(cbData) PBYTE	pbDst,
		SIZE_T	cbData
	)

Definition at line 433 of file ccm.c.

{
    UINT64 bytesProcessedAfterThisCall;
 
    SYMCRYPT_CHECK_MAGIC( pState );
 
    bytesProcessedAfterThisCall = cbData + pState->bytesProcessed;
 
    SYMCRYPT_ASSERT( bytesProcessedAfterThisCall >= cbData &&
                     bytesProcessedAfterThisCall <= pState->cbData );
 
    //
    // We are violating the read-once implementation rule here. We read the data twice:
    // once for MACing and once for encryption.
    // In this particular situation this is safe to do.
    // We consider the read for the MAC operation as reading the 'real' value.
    // The encryption code reads the data, but all it does is XOR the key stream into
    // it. (CCM encryption uses CTR mode for the encryption part.)
    // We don't care if the attacker modifies the data before the encryption.
    // We are revealing the key stream anyway (from the plaintext and ciphertext) and
    // the exact byte value that we xor the key stream into is irrelevant.
    //
    SymCryptCcmAddMacData( pState, pbSrc, cbData );
 
    SymCryptCcmEncryptDecryptPart( pState, pbSrc, pbDst, cbData );
 
}

Referenced by SymCryptCcmEncrypt().

SymCryptCcmInit()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptCcmInit	(	_Out_ PSYMCRYPT_CCM_STATE	pState,
		_In_ PCSYMCRYPT_BLOCKCIPHER	pBlockCipher,
		_In_ PCVOID	pExpandedKey,
		_In_reads_(cbNonce) PCBYTE	pbNonce,
		SIZE_T	cbNonce,
		_In_reads_opt_(cbAuthData) PCBYTE	pbAuthData,
		SIZE_T	cbAuthData,
		UINT64	cbData,
		SIZE_T	cbTag
	)

Definition at line 300 of file ccm.c.

{
    BYTE            flags;
    BYTE            tmpBuf[ SYMCRYPT_CCM_BLOCK_SIZE ];
    SIZE_T          cbCounter;
 
    SYMCRYPT_SET_MAGIC( pState );
 
    //
    // Validate parameters in checked builds
    //
    SYMCRYPT_ASSERT( SymCryptCcmValidateParameters( pBlockCipher, cbNonce, cbAuthData, cbData, cbTag ) == SYMCRYPT_NO_ERROR );
 
 
    //
    // compute # bytes in the counter field
    // We limit cbNonce to 15 so that cbCounter + cbNonce = 15 will always hold
    // This is much cheaper than full parameter validation, and it is enough to
    // avoid any buffer overflows.
    //
    cbNonce &= SYMCRYPT_CCM_BLOCK_SIZE - 1;
    cbCounter = SYMCRYPT_CCM_BLOCK_SIZE - 1 - cbNonce;
 
    pState->pBlockCipher = pBlockCipher;
    pState->pExpandedKey = pExpandedKey;
    pState->cbNonce = cbNonce;
    pState->cbData = cbData;
    pState->cbTag = cbTag;
    pState->cbCounter = cbCounter;
    pState->bytesProcessed = 0;
    pState->bytesInMacBlock = 0;
 
    //
    // Build the initial blocks for authentication and en/decryption
    //
    // Per Sp800-38c the flag byte is made up of four fields:
    // Bits 0-2 are cbCounter - 1
    // Bits 3-5 are (cbTag-2)/2
    // Bit 6 is 1 if cbAuthData > 0
    // Bit 7 is reserved and set to 0.
    flags = (BYTE) (pState->cbCounter - 1);
    flags |= ((cbTag-2)/2) << 3;
    if( cbAuthData > 0 )
    {
        //
        // No side-channel concerns with this if statements as we don't try to hide the
        // data length or presence of authdata.
        //
        flags |= (1 << 6);
    }
 
 
    //
    // The MAC starting block consists of three fields:
    // the flag byte, the nonce, and cbData encoded into cbCounter bytes.
    //
    pState->macBlock[0] = flags;
    memcpy( &pState->macBlock[1], pbNonce, cbNonce );
    SYMCRYPT_STORE_MSBFIRST64( &tmpBuf[0], cbData );
    memcpy( &pState->macBlock[1+cbNonce], &tmpBuf[ 8 - cbCounter ], cbCounter );
 
    //
    // The counter block is similar in layout, but with two changes:
    // Bits 3-7 of the flag bytes are set to 0.
    // The counter field is set to one (first counter value used for data encryption).
    // Wiping the whole block first is probably faster, as the size is known and the
    // block is aligned.
    // We also copy the nonce from the mac block to follow the read-once rule.
    //
    SymCryptWipeKnownSize( &pState->counterBlock[0], SYMCRYPT_CCM_BLOCK_SIZE );
    pState->counterBlock[0] = (BYTE)(flags & 0x7);
    memcpy( &pState->counterBlock[1], &pState->macBlock[1], cbNonce );
    pState->counterBlock[ SYMCRYPT_CCM_BLOCK_SIZE - 1] = 1;
 
    //
    // Encrypt the current MAC block; our CBC convention is to do the encryption
    // as soon as we have enough data.
    //
    pBlockCipher->encryptFunc( pExpandedKey, &pState->macBlock[0], &pState->macBlock[0] );
 
    //
    // Next we process the associated data
    // See the CCM specs for the details
    //
    if( cbAuthData <= 0 )
    {
        //
        // cbAuthData == 0, nothing needs to be done.
        //
    } else if( cbAuthData < AUTHDATA_16BIT_LIMIT )
    {
        //
        // 16-bit length encoding.
        //
        SYMCRYPT_STORE_MSBFIRST16( &tmpBuf[0], (UINT16) cbAuthData );
        SymCryptCcmAddMacData( pState, &tmpBuf[0], 2 );
    } else if( fcbAuthDataLt32bitLimitStatic || cbAuthData < AUTHDATA_32BIT_LIMIT )
    {
        //
        // 32-bit length
        //
        tmpBuf[0] = 0xff;
        tmpBuf[1] = 0xfe;       // Magic prefix as per SP 800-38c
        SYMCRYPT_STORE_MSBFIRST32( &tmpBuf[2], (UINT32) cbAuthData );
        SymCryptCcmAddMacData( pState, &tmpBuf[0], 2 + sizeof( UINT32 ) );
    } else
    {
        //
        // 64-bit length
        //
        tmpBuf[0] = 0xff;
        tmpBuf[1] = 0xff;       // Magic prefix as per SP 800-38c
        SYMCRYPT_STORE_MSBFIRST64( &tmpBuf[2], cbAuthData );
        SymCryptCcmAddMacData( pState, &tmpBuf[0], 2 + sizeof( UINT64 ) );
    }
 
    SymCryptCcmAddMacData( pState, pbAuthData, cbAuthData );
    SymCryptCcmPadMacData( pState );        // Pad MAC data with zeroes until the next block size boundary
 
}

Referenced by SymCryptCcmDecrypt(), and SymCryptCcmEncrypt().

SymCryptCcmPadMacData()

VOID SYMCRYPT_CALL SymCryptCcmPadMacData

(

_Inout_ PSYMCRYPT_CCM_STATE

pState

)

Definition at line 209 of file ccm.c.

{
    //
    // Pad the MAC data with zeroes until we hit the block size.
    // The data is xorred into macBlock, so we don't have to update that.
    // All we do is apply the block cipher if there was any data remaining in the macBlock.
    //
    if( pState->bytesInMacBlock > 0 )
    {
        pState->pBlockCipher->encryptFunc( pState->pExpandedKey, &pState->macBlock[0], &pState->macBlock[0] );
        pState->bytesInMacBlock = 0;
    }
}

Referenced by SymCryptCcmDecryptFinal(), SymCryptCcmEncryptFinal(), and SymCryptCcmInit().

SymCryptCcmSelftest()

VOID SYMCRYPT_CALL SymCryptCcmSelftest

(

void

)

Definition at line 593 of file ccm.c.

{
    BYTE    buf[ 3 + SYMCRYPT_AES_BLOCK_SIZE ];
    SYMCRYPT_AES_EXPANDED_KEY key;
    SYMCRYPT_ERROR err;
 
    if( SymCryptAesExpandKey( &key, SymCryptTestKey32, 16 ) != SYMCRYPT_NO_ERROR )
    {
        SymCryptFatal( 'ccm0' );
    }
 
    SymCryptCcmEncrypt( SymCryptAesBlockCipher,
                        &key,
                        &SymCryptTestKey32[16], 12,
                        NULL, 0,
                        &SymCryptTestMsg3[0], buf, 3,
                        &buf[3], SYMCRYPT_AES_BLOCK_SIZE );
 
    SymCryptInjectError( buf, sizeof( buf ) );
    if( memcmp( buf, SymCryptCcmSelftestResult, sizeof( buf ) ) != 0 )
    {
        SymCryptFatal( 'ccm1' );
    }
 
    // inject error into the ciphertext or tag
    SymCryptInjectError( buf, sizeof( buf ) );
 
    err = SymCryptCcmDecrypt(   SymCryptAesBlockCipher,
                                &key,
                                &SymCryptTestKey32[16], 12,
                                NULL, 0,
                                buf, buf, 3,
                                &buf[3], SYMCRYPT_AES_BLOCK_SIZE );
 
    SymCryptInjectError( buf, 3 );
 
    if( err != SYMCRYPT_NO_ERROR || memcmp( buf, SymCryptTestMsg3, 3 ) != 0 )
    {
        SymCryptFatal( 'ccm2' );
    }
 
}

SymCryptCcmValidateParameters()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptCcmValidateParameters	(	_In_ PCSYMCRYPT_BLOCKCIPHER	pBlockCipher,
		_In_ SIZE_T	cbNonce,
		_In_ SIZE_T	cbAssociatedData,
		_In_ UINT64	cbData,
		_In_ SIZE_T	cbTag
	)

Definition at line 28 of file ccm.c.

{
    SIZE_T cbCounter;
 
    UNREFERENCED_PARAMETER( cbAssociatedData );
 
    if( pBlockCipher->blockSize != SYMCRYPT_CCM_BLOCK_SIZE )
    {
        return SYMCRYPT_WRONG_BLOCK_SIZE;
    }
 
    //
    // Test against limits in SP800-38C appendix A
    //
    if( cbNonce < CCM_MIN_NONCE_SIZE || cbNonce > CCM_MAX_NONCE_SIZE )
    {
        return SYMCRYPT_WRONG_NONCE_SIZE;
    }
 
    //
    // cbAssociatedData is limited to <2^64
    // We don't test for this. None of our platforms has a SIZE_T that is
    // large enough to violate this condition. And the test
    // is of a form that the compiler cannot optimize away.
    //
 
    //
    // The counter block consists of a single flag byte, the nonce, and the counter field.
    //
    cbCounter = SYMCRYPT_CCM_BLOCK_SIZE - cbNonce - 1;
 
    //
    // per SP800-38C cbData is limited to 2^{8*cbCounter}
    // There is no way to do this test in a single comparison.
    // We don't have to worry about side-channels in the && because
    // cbCounter depends only on the length of the nonce, and we do not
    // try to hide any lengths.
    //
    if( cbCounter < sizeof( UINT64 ) &&
        cbData >= ((UINT64)1 << (8*cbCounter)) )
    {
        return SYMCRYPT_WRONG_DATA_SIZE;
    }
 
    if( cbTag < CCM_MIN_TAG_SIZE ||
        cbTag > CCM_MAX_TAG_SIZE ||
        (cbTag & 1) == 1        // valid tag lengths are [4, 6, 8, ..., 16]
        )
    {
        return SYMCRYPT_WRONG_TAG_SIZE;
    }
 
    return SYMCRYPT_NO_ERROR;
}

Referenced by SymCryptCcmInit().

Variable Documentation

fcbAuthDataLt32bitLimitStatic

const BOOL fcbAuthDataLt32bitLimitStatic = SIZE_T_MAX < AUTHDATA_32BIT_LIMIT

Definition at line 21 of file ccm.c.

Referenced by SymCryptCcmInit().

SymCryptCcmSelftestResult

const BYTE SymCryptCcmSelftestResult[3+SYMCRYPT_AES_BLOCK_SIZE]

static

Initial value:

=
{
    0x42, 0xd7, 0xda,
    0x3d, 0x9e, 0x95, 0x82, 0x29, 0x3c, 0x10, 0x9c, 0xa3, 0x39, 0x31, 0x3f, 0x18, 0xf3, 0x10, 0xf6
}

Definition at line 585 of file ccm.c.

Referenced by SymCryptCcmSelftest().