EIC code displayed by LXR |
|
|
|
|||
File indexing completed on 2025-08-27 09:37:29
0001 /** 0002 * \file ccm.h 0003 * 0004 * \brief This file provides an API for the CCM authenticated encryption 0005 * mode for block ciphers. 0006 * 0007 * CCM combines Counter mode encryption with CBC-MAC authentication 0008 * for 128-bit block ciphers. 0009 * 0010 * Input to CCM includes the following elements: 0011 * <ul><li>Payload - data that is both authenticated and encrypted.</li> 0012 * <li>Associated data (Adata) - data that is authenticated but not 0013 * encrypted, For example, a header.</li> 0014 * <li>Nonce - A unique value that is assigned to the payload and the 0015 * associated data.</li></ul> 0016 * 0017 * Definition of CCM: 0018 * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf 0019 * RFC 3610 "Counter with CBC-MAC (CCM)" 0020 * 0021 * Related: 0022 * RFC 5116 "An Interface and Algorithms for Authenticated Encryption" 0023 * 0024 * Definition of CCM*: 0025 * IEEE 802.15.4 - IEEE Standard for Local and metropolitan area networks 0026 * Integer representation is fixed most-significant-octet-first order and 0027 * the representation of octets is most-significant-bit-first order. This is 0028 * consistent with RFC 3610. 0029 */ 0030 /* 0031 * Copyright The Mbed TLS Contributors 0032 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 0033 */ 0034 0035 #ifndef MBEDTLS_CCM_H 0036 #define MBEDTLS_CCM_H 0037 #include "mbedtls/private_access.h" 0038 0039 #include "mbedtls/build_info.h" 0040 0041 #include "mbedtls/cipher.h" 0042 0043 #if defined(MBEDTLS_BLOCK_CIPHER_C) 0044 #include "mbedtls/block_cipher.h" 0045 #endif 0046 0047 #define MBEDTLS_CCM_DECRYPT 0 0048 #define MBEDTLS_CCM_ENCRYPT 1 0049 #define MBEDTLS_CCM_STAR_DECRYPT 2 0050 #define MBEDTLS_CCM_STAR_ENCRYPT 3 0051 0052 /** Bad input parameters to the function. */ 0053 #define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D 0054 /** Authenticated decryption failed. */ 0055 #define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F 0056 0057 #ifdef __cplusplus 0058 extern "C" { 0059 #endif 0060 0061 #if !defined(MBEDTLS_CCM_ALT) 0062 // Regular implementation 0063 // 0064 0065 /** 0066 * \brief The CCM context-type definition. The CCM context is passed 0067 * to the APIs called. 0068 */ 0069 typedef struct mbedtls_ccm_context { 0070 unsigned char MBEDTLS_PRIVATE(y)[16]; /*!< The Y working buffer */ 0071 unsigned char MBEDTLS_PRIVATE(ctr)[16]; /*!< The counter buffer */ 0072 size_t MBEDTLS_PRIVATE(plaintext_len); /*!< Total plaintext length */ 0073 size_t MBEDTLS_PRIVATE(add_len); /*!< Total authentication data length */ 0074 size_t MBEDTLS_PRIVATE(tag_len); /*!< Total tag length */ 0075 size_t MBEDTLS_PRIVATE(processed); /*!< Track how many bytes of input data 0076 were processed (chunked input). 0077 Used independently for both auth data 0078 and plaintext/ciphertext. 0079 This variable is set to zero after 0080 auth data input is finished. */ 0081 unsigned int MBEDTLS_PRIVATE(q); /*!< The Q working value */ 0082 unsigned int MBEDTLS_PRIVATE(mode); /*!< The operation to perform: 0083 #MBEDTLS_CCM_ENCRYPT or 0084 #MBEDTLS_CCM_DECRYPT or 0085 #MBEDTLS_CCM_STAR_ENCRYPT or 0086 #MBEDTLS_CCM_STAR_DECRYPT. */ 0087 #if defined(MBEDTLS_BLOCK_CIPHER_C) 0088 mbedtls_block_cipher_context_t MBEDTLS_PRIVATE(block_cipher_ctx); /*!< The cipher context used. */ 0089 #else 0090 mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher_ctx); /*!< The cipher context used. */ 0091 #endif 0092 int MBEDTLS_PRIVATE(state); /*!< Working value holding context's 0093 state. Used for chunked data input */ 0094 } 0095 mbedtls_ccm_context; 0096 0097 #else /* MBEDTLS_CCM_ALT */ 0098 #include "ccm_alt.h" 0099 #endif /* MBEDTLS_CCM_ALT */ 0100 0101 /** 0102 * \brief This function initializes the specified CCM context, 0103 * to make references valid, and prepare the context 0104 * for mbedtls_ccm_setkey() or mbedtls_ccm_free(). 0105 * 0106 * \param ctx The CCM context to initialize. This must not be \c NULL. 0107 */ 0108 void mbedtls_ccm_init(mbedtls_ccm_context *ctx); 0109 0110 /** 0111 * \brief This function initializes the CCM context set in the 0112 * \p ctx parameter and sets the encryption key. 0113 * 0114 * \param ctx The CCM context to initialize. This must be an initialized 0115 * context. 0116 * \param cipher The 128-bit block cipher to use. 0117 * \param key The encryption key. This must not be \c NULL. 0118 * \param keybits The key size in bits. This must be acceptable by the cipher. 0119 * 0120 * \return \c 0 on success. 0121 * \return A CCM or cipher-specific error code on failure. 0122 */ 0123 int mbedtls_ccm_setkey(mbedtls_ccm_context *ctx, 0124 mbedtls_cipher_id_t cipher, 0125 const unsigned char *key, 0126 unsigned int keybits); 0127 0128 /** 0129 * \brief This function releases and clears the specified CCM context 0130 * and underlying cipher sub-context. 0131 * 0132 * \param ctx The CCM context to clear. If this is \c NULL, the function 0133 * has no effect. Otherwise, this must be initialized. 0134 */ 0135 void mbedtls_ccm_free(mbedtls_ccm_context *ctx); 0136 0137 /** 0138 * \brief This function encrypts a buffer using CCM. 0139 * 0140 * \note The tag is written to a separate buffer. To concatenate 0141 * the \p tag with the \p output, as done in <em>RFC-3610: 0142 * Counter with CBC-MAC (CCM)</em>, use 0143 * \p tag = \p output + \p length, and make sure that the 0144 * output buffer is at least \p length + \p tag_len wide. 0145 * 0146 * \param ctx The CCM context to use for encryption. This must be 0147 * initialized and bound to a key. 0148 * \param length The length of the input data in Bytes. 0149 * \param iv The initialization vector (nonce). This must be a readable 0150 * buffer of at least \p iv_len Bytes. 0151 * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, 0152 * or 13. The length L of the message length field is 0153 * 15 - \p iv_len. 0154 * \param ad The additional data field. If \p ad_len is greater than 0155 * zero, \p ad must be a readable buffer of at least that 0156 * length. 0157 * \param ad_len The length of additional data in Bytes. 0158 * This must be less than `2^16 - 2^8`. 0159 * \param input The buffer holding the input data. If \p length is greater 0160 * than zero, \p input must be a readable buffer of at least 0161 * that length. 0162 * \param output The buffer holding the output data. If \p length is greater 0163 * than zero, \p output must be a writable buffer of at least 0164 * that length. 0165 * \param tag The buffer holding the authentication field. This must be a 0166 * writable buffer of at least \p tag_len Bytes. 0167 * \param tag_len The length of the authentication field to generate in Bytes: 0168 * 4, 6, 8, 10, 12, 14 or 16. 0169 * 0170 * \return \c 0 on success. 0171 * \return A CCM or cipher-specific error code on failure. 0172 */ 0173 int mbedtls_ccm_encrypt_and_tag(mbedtls_ccm_context *ctx, size_t length, 0174 const unsigned char *iv, size_t iv_len, 0175 const unsigned char *ad, size_t ad_len, 0176 const unsigned char *input, unsigned char *output, 0177 unsigned char *tag, size_t tag_len); 0178 0179 /** 0180 * \brief This function encrypts a buffer using CCM*. 0181 * 0182 * \note The tag is written to a separate buffer. To concatenate 0183 * the \p tag with the \p output, as done in <em>RFC-3610: 0184 * Counter with CBC-MAC (CCM)</em>, use 0185 * \p tag = \p output + \p length, and make sure that the 0186 * output buffer is at least \p length + \p tag_len wide. 0187 * 0188 * \note When using this function in a variable tag length context, 0189 * the tag length has to be encoded into the \p iv passed to 0190 * this function. 0191 * 0192 * \param ctx The CCM context to use for encryption. This must be 0193 * initialized and bound to a key. 0194 * \param length The length of the input data in Bytes. 0195 * For tag length = 0, input length is ignored. 0196 * \param iv The initialization vector (nonce). This must be a readable 0197 * buffer of at least \p iv_len Bytes. 0198 * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, 0199 * or 13. The length L of the message length field is 0200 * 15 - \p iv_len. 0201 * \param ad The additional data field. This must be a readable buffer of 0202 * at least \p ad_len Bytes. 0203 * \param ad_len The length of additional data in Bytes. 0204 * This must be less than 2^16 - 2^8. 0205 * \param input The buffer holding the input data. If \p length is greater 0206 * than zero, \p input must be a readable buffer of at least 0207 * that length. 0208 * \param output The buffer holding the output data. If \p length is greater 0209 * than zero, \p output must be a writable buffer of at least 0210 * that length. 0211 * \param tag The buffer holding the authentication field. This must be a 0212 * writable buffer of at least \p tag_len Bytes. 0213 * \param tag_len The length of the authentication field to generate in Bytes: 0214 * 0, 4, 6, 8, 10, 12, 14 or 16. 0215 * 0216 * \warning Passing \c 0 as \p tag_len means that the message is no 0217 * longer authenticated. 0218 * 0219 * \return \c 0 on success. 0220 * \return A CCM or cipher-specific error code on failure. 0221 */ 0222 int mbedtls_ccm_star_encrypt_and_tag(mbedtls_ccm_context *ctx, size_t length, 0223 const unsigned char *iv, size_t iv_len, 0224 const unsigned char *ad, size_t ad_len, 0225 const unsigned char *input, unsigned char *output, 0226 unsigned char *tag, size_t tag_len); 0227 0228 /** 0229 * \brief This function performs a CCM authenticated decryption of a 0230 * buffer. 0231 * 0232 * \param ctx The CCM context to use for decryption. This must be 0233 * initialized and bound to a key. 0234 * \param length The length of the input data in Bytes. 0235 * \param iv The initialization vector (nonce). This must be a readable 0236 * buffer of at least \p iv_len Bytes. 0237 * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, 0238 * or 13. The length L of the message length field is 0239 * 15 - \p iv_len. 0240 * \param ad The additional data field. This must be a readable buffer 0241 * of at least that \p ad_len Bytes.. 0242 * \param ad_len The length of additional data in Bytes. 0243 * This must be less than 2^16 - 2^8. 0244 * \param input The buffer holding the input data. If \p length is greater 0245 * than zero, \p input must be a readable buffer of at least 0246 * that length. 0247 * \param output The buffer holding the output data. If \p length is greater 0248 * than zero, \p output must be a writable buffer of at least 0249 * that length. 0250 * \param tag The buffer holding the authentication field. This must be a 0251 * readable buffer of at least \p tag_len Bytes. 0252 * \param tag_len The length of the authentication field to generate in Bytes: 0253 * 4, 6, 8, 10, 12, 14 or 16. 0254 * 0255 * \return \c 0 on success. This indicates that the message is authentic. 0256 * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. 0257 * \return A cipher-specific error code on calculation failure. 0258 */ 0259 int mbedtls_ccm_auth_decrypt(mbedtls_ccm_context *ctx, size_t length, 0260 const unsigned char *iv, size_t iv_len, 0261 const unsigned char *ad, size_t ad_len, 0262 const unsigned char *input, unsigned char *output, 0263 const unsigned char *tag, size_t tag_len); 0264 0265 /** 0266 * \brief This function performs a CCM* authenticated decryption of a 0267 * buffer. 0268 * 0269 * \note When using this function in a variable tag length context, 0270 * the tag length has to be decoded from \p iv and passed to 0271 * this function as \p tag_len. (\p tag needs to be adjusted 0272 * accordingly.) 0273 * 0274 * \param ctx The CCM context to use for decryption. This must be 0275 * initialized and bound to a key. 0276 * \param length The length of the input data in Bytes. 0277 * For tag length = 0, input length is ignored. 0278 * \param iv The initialization vector (nonce). This must be a readable 0279 * buffer of at least \p iv_len Bytes. 0280 * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, 0281 * or 13. The length L of the message length field is 0282 * 15 - \p iv_len. 0283 * \param ad The additional data field. This must be a readable buffer of 0284 * at least that \p ad_len Bytes. 0285 * \param ad_len The length of additional data in Bytes. 0286 * This must be less than 2^16 - 2^8. 0287 * \param input The buffer holding the input data. If \p length is greater 0288 * than zero, \p input must be a readable buffer of at least 0289 * that length. 0290 * \param output The buffer holding the output data. If \p length is greater 0291 * than zero, \p output must be a writable buffer of at least 0292 * that length. 0293 * \param tag The buffer holding the authentication field. This must be a 0294 * readable buffer of at least \p tag_len Bytes. 0295 * \param tag_len The length of the authentication field in Bytes. 0296 * 0, 4, 6, 8, 10, 12, 14 or 16. 0297 * 0298 * \warning Passing \c 0 as \p tag_len means that the message is nos 0299 * longer authenticated. 0300 * 0301 * \return \c 0 on success. 0302 * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. 0303 * \return A cipher-specific error code on calculation failure. 0304 */ 0305 int mbedtls_ccm_star_auth_decrypt(mbedtls_ccm_context *ctx, size_t length, 0306 const unsigned char *iv, size_t iv_len, 0307 const unsigned char *ad, size_t ad_len, 0308 const unsigned char *input, unsigned char *output, 0309 const unsigned char *tag, size_t tag_len); 0310 0311 /** 0312 * \brief This function starts a CCM encryption or decryption 0313 * operation. 0314 * 0315 * This function and mbedtls_ccm_set_lengths() must be called 0316 * before calling mbedtls_ccm_update_ad() or 0317 * mbedtls_ccm_update(). This function can be called before 0318 * or after mbedtls_ccm_set_lengths(). 0319 * 0320 * \note This function is not implemented in Mbed TLS yet. 0321 * 0322 * \param ctx The CCM context. This must be initialized. 0323 * \param mode The operation to perform: #MBEDTLS_CCM_ENCRYPT or 0324 * #MBEDTLS_CCM_DECRYPT or #MBEDTLS_CCM_STAR_ENCRYPT or 0325 * #MBEDTLS_CCM_STAR_DECRYPT. 0326 * \param iv The initialization vector. This must be a readable buffer 0327 * of at least \p iv_len Bytes. 0328 * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, 0329 * or 13. The length L of the message length field is 0330 * 15 - \p iv_len. 0331 * 0332 * \return \c 0 on success. 0333 * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: 0334 * \p ctx is in an invalid state, 0335 * \p mode is invalid, 0336 * \p iv_len is invalid (lower than \c 7 or greater than 0337 * \c 13). 0338 */ 0339 int mbedtls_ccm_starts(mbedtls_ccm_context *ctx, 0340 int mode, 0341 const unsigned char *iv, 0342 size_t iv_len); 0343 0344 /** 0345 * \brief This function declares the lengths of the message 0346 * and additional data for a CCM encryption or decryption 0347 * operation. 0348 * 0349 * This function and mbedtls_ccm_starts() must be called 0350 * before calling mbedtls_ccm_update_ad() or 0351 * mbedtls_ccm_update(). This function can be called before 0352 * or after mbedtls_ccm_starts(). 0353 * 0354 * \note This function is not implemented in Mbed TLS yet. 0355 * 0356 * \param ctx The CCM context. This must be initialized. 0357 * \param total_ad_len The total length of additional data in bytes. 0358 * This must be less than `2^16 - 2^8`. 0359 * \param plaintext_len The length in bytes of the plaintext to encrypt or 0360 * result of the decryption (thus not encompassing the 0361 * additional data that are not encrypted). 0362 * \param tag_len The length of the tag to generate in Bytes: 0363 * 4, 6, 8, 10, 12, 14 or 16. 0364 * For CCM*, zero is also valid. 0365 * 0366 * \return \c 0 on success. 0367 * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: 0368 * \p ctx is in an invalid state, 0369 * \p total_ad_len is greater than \c 0xFF00. 0370 */ 0371 int mbedtls_ccm_set_lengths(mbedtls_ccm_context *ctx, 0372 size_t total_ad_len, 0373 size_t plaintext_len, 0374 size_t tag_len); 0375 0376 /** 0377 * \brief This function feeds an input buffer as associated data 0378 * (authenticated but not encrypted data) in a CCM 0379 * encryption or decryption operation. 0380 * 0381 * You may call this function zero, one or more times 0382 * to pass successive parts of the additional data. The 0383 * lengths \p ad_len of the data parts should eventually add 0384 * up exactly to the total length of additional data 0385 * \c total_ad_len passed to mbedtls_ccm_set_lengths(). You 0386 * may not call this function after calling 0387 * mbedtls_ccm_update(). 0388 * 0389 * \note This function is not implemented in Mbed TLS yet. 0390 * 0391 * \param ctx The CCM context. This must have been started with 0392 * mbedtls_ccm_starts(), the lengths of the message and 0393 * additional data must have been declared with 0394 * mbedtls_ccm_set_lengths() and this must not have yet 0395 * received any input with mbedtls_ccm_update(). 0396 * \param ad The buffer holding the additional data, or \c NULL 0397 * if \p ad_len is \c 0. 0398 * \param ad_len The length of the additional data. If \c 0, 0399 * \p ad may be \c NULL. 0400 * 0401 * \return \c 0 on success. 0402 * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: 0403 * \p ctx is in an invalid state, 0404 * total input length too long. 0405 */ 0406 int mbedtls_ccm_update_ad(mbedtls_ccm_context *ctx, 0407 const unsigned char *ad, 0408 size_t ad_len); 0409 0410 /** 0411 * \brief This function feeds an input buffer into an ongoing CCM 0412 * encryption or decryption operation. 0413 * 0414 * You may call this function zero, one or more times 0415 * to pass successive parts of the input: the plaintext to 0416 * encrypt, or the ciphertext (not including the tag) to 0417 * decrypt. After the last part of the input, call 0418 * mbedtls_ccm_finish(). The lengths \p input_len of the 0419 * data parts should eventually add up exactly to the 0420 * plaintext length \c plaintext_len passed to 0421 * mbedtls_ccm_set_lengths(). 0422 * 0423 * This function may produce output in one of the following 0424 * ways: 0425 * - Immediate output: the output length is always equal 0426 * to the input length. 0427 * - Buffered output: except for the last part of input data, 0428 * the output consists of a whole number of 16-byte blocks. 0429 * If the total input length so far (not including 0430 * associated data) is 16 \* *B* + *A* with *A* < 16 then 0431 * the total output length is 16 \* *B*. 0432 * For the last part of input data, the output length is 0433 * equal to the input length plus the number of bytes (*A*) 0434 * buffered in the previous call to the function (if any). 0435 * The function uses the plaintext length 0436 * \c plaintext_len passed to mbedtls_ccm_set_lengths() 0437 * to detect the last part of input data. 0438 * 0439 * In particular: 0440 * - It is always correct to call this function with 0441 * \p output_size >= \p input_len + 15. 0442 * - If \p input_len is a multiple of 16 for all the calls 0443 * to this function during an operation (not necessary for 0444 * the last one) then it is correct to use \p output_size 0445 * =\p input_len. 0446 * 0447 * \note This function is not implemented in Mbed TLS yet. 0448 * 0449 * \param ctx The CCM context. This must have been started with 0450 * mbedtls_ccm_starts() and the lengths of the message and 0451 * additional data must have been declared with 0452 * mbedtls_ccm_set_lengths(). 0453 * \param input The buffer holding the input data. If \p input_len 0454 * is greater than zero, this must be a readable buffer 0455 * of at least \p input_len bytes. 0456 * \param input_len The length of the input data in bytes. 0457 * \param output The buffer for the output data. If \p output_size 0458 * is greater than zero, this must be a writable buffer of 0459 * at least \p output_size bytes. 0460 * \param output_size The size of the output buffer in bytes. 0461 * See the function description regarding the output size. 0462 * \param output_len On success, \p *output_len contains the actual 0463 * length of the output written in \p output. 0464 * On failure, the content of \p *output_len is 0465 * unspecified. 0466 * 0467 * \return \c 0 on success. 0468 * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: 0469 * \p ctx is in an invalid state, 0470 * total input length too long, 0471 * or \p output_size too small. 0472 */ 0473 int mbedtls_ccm_update(mbedtls_ccm_context *ctx, 0474 const unsigned char *input, size_t input_len, 0475 unsigned char *output, size_t output_size, 0476 size_t *output_len); 0477 0478 /** 0479 * \brief This function finishes the CCM operation and generates 0480 * the authentication tag. 0481 * 0482 * It wraps up the CCM stream, and generates the 0483 * tag. The tag can have a maximum length of 16 Bytes. 0484 * 0485 * \note This function is not implemented in Mbed TLS yet. 0486 * 0487 * \param ctx The CCM context. This must have been started with 0488 * mbedtls_ccm_starts() and the lengths of the message and 0489 * additional data must have been declared with 0490 * mbedtls_ccm_set_lengths(). 0491 * \param tag The buffer for holding the tag. If \p tag_len is greater 0492 * than zero, this must be a writable buffer of at least \p 0493 * tag_len Bytes. 0494 * \param tag_len The length of the tag. Must match the tag length passed to 0495 * mbedtls_ccm_set_lengths() function. 0496 * 0497 * \return \c 0 on success. 0498 * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: 0499 * \p ctx is in an invalid state, 0500 * invalid value of \p tag_len, 0501 * the total amount of additional data passed to 0502 * mbedtls_ccm_update_ad() was lower than the total length of 0503 * additional data \c total_ad_len passed to 0504 * mbedtls_ccm_set_lengths(), 0505 * the total amount of input data passed to 0506 * mbedtls_ccm_update() was lower than the plaintext length 0507 * \c plaintext_len passed to mbedtls_ccm_set_lengths(). 0508 */ 0509 int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, 0510 unsigned char *tag, size_t tag_len); 0511 0512 #if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_CCM_GCM_CAN_AES) 0513 /** 0514 * \brief The CCM checkup routine. 0515 * 0516 * \return \c 0 on success. 0517 * \return \c 1 on failure. 0518 */ 0519 int mbedtls_ccm_self_test(int verbose); 0520 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ 0521 0522 #ifdef __cplusplus 0523 } 0524 #endif 0525 0526 #endif /* MBEDTLS_CCM_H */
| [ Source navigation ] | [ Diff markup ] | [ Identifier search ] | [ general search ] |
|
This page was automatically generated by the 2.3.7 LXR engine. The LXR team |
|