Skip to content

Commit 9db008a

Browse files
ColtonWilleyColtonWilley
authored
Merge pull request #368 from padelsbach/wp-finding-181
Fix aead set random IV
2 parents 8931620 + 5d994f9 commit 9db008a

File tree

6 files changed

+169
-9
lines changed

6 files changed

+169
-9
lines changed

‎debian/install-wolfprov.sh‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -195,8 +195,14 @@ main() {
195195
work_dir=$(mktemp -d)
196196
printf "Working directory: $work_dir\n"
197197
pushd $work_dir 2>&1 > /dev/null
198-
cp -r $REPO_ROOT .
199-
cd $(basename $REPO_ROOT)
198+
repo_name=$(basename "$REPO_ROOT")
199+
if git clone --depth 1 "file://$REPO_ROOT" "$repo_name"; then
200+
:
201+
else
202+
echo "Shallow clone failed, falling back to local clone"
203+
git clone "$REPO_ROOT" "$repo_name"
204+
fi
205+
cd "$repo_name"
200206

201207
wolfprov_build $fips_mode $debug_mode
202208
if [ $no_install -eq 0 ]; then
@@ -218,4 +224,3 @@ main() {
218224

219225
# Run main function with all arguments
220226
main "$@"
221-

‎scripts/test-wp-cs.sh‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -284,9 +284,9 @@ openssl version -a || true
284284
if [ "${AM_BWRAPPED-}" != "yes" ]; then
285285
# Perform the build only if not in the bubble
286286
printf "Cleaning up previous builds\n"
287-
${SCRIPT_DIR}/build-wolfprovider.sh --clean --distclean
287+
${SCRIPT_DIR}/build-wolfprovider.sh --clean --distclean || exit 1
288288
printf "Building wolfProvider\n"
289-
${SCRIPT_DIR}/build-wolfprovider.sh
289+
${SCRIPT_DIR}/build-wolfprovider.sh || exit 1
290290

291291
printf "OPENSSL_BIN: $OPENSSL_BIN\n"
292292
$OPENSSL_BIN version -a || true
@@ -321,4 +321,3 @@ else
321321
printf "$FAIL tests failed.\n"
322322
exit 1
323323
fi
324-

‎src/wp_aes_aead.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -666,8 +666,8 @@ static int wp_aead_set_ctx_params(wp_AeadCtx* ctx, const OSSL_PARAM params[])
666666
ok = wp_aead_set_param_tls1_iv_fixed(ctx, params);
667667
}
668668
else if (ok && (ctx->mode == EVP_CIPH_GCM_MODE) &&
669-
(XMEMCMP(params->key, OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED,
670-
sizeof(OSSL_CIPHER_PARAM_AEAD_TLS1_IV_FIXED)) == 0)) {
669+
(XMEMCMP(params->key, OSSL_CIPHER_PARAM_AEAD_TLS1_SET_IV_INV,
670+
sizeof(OSSL_CIPHER_PARAM_AEAD_TLS1_SET_IV_INV)) == 0)) {
671671
ok = wp_aead_set_param_tls1_iv_rand(ctx, params);
672672
}
673673

@@ -925,7 +925,7 @@ static int wp_aesgcm_set_rand_iv(wp_AeadCtx *ctx, unsigned char *in,
925925
XMEMCPY(ctx->origIv, ctx->iv, ctx->ivLen);
926926
#endif
927927
XMEMCPY(ctx->iv + ctx->ivLen - inLen, in, inLen);
928-
ctx->ivState = IV_STATE_COPIED;
928+
ctx->ivState = IV_STATE_BUFFERED;
929929
}
930930

931931
WOLFPROV_LEAVE(WP_LOG_COMP_AES, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok);

‎test/test_aestag.c‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,6 +1042,160 @@ int test_aes128_gcm_tls(void *data)
10421042
EVP_GCM_TLS_FIXED_IV_LEN, 0);
10431043
}
10441044

1045+
/******************************************************************************/
1046+
1047+
/* Test that OSSL_CIPHER_PARAM_AEAD_TLS1_SET_IV_INV correctly sets the
1048+
* explicit/random portion of the IV on the decrypt side via the OSSL_PARAM
1049+
* interface. This exercises the fix in wp_aead_set_ctx_params where the
1050+
* parameter key comparison was corrected from AEAD_TLS1_IV_FIXED to
1051+
* AEAD_TLS1_SET_IV_INV. */
1052+
static int test_aes_gcm_set_iv_inv_dec(const EVP_CIPHER *cipher,
1053+
unsigned char *key, unsigned char *iv, int ivFixedLen, int ivLen,
1054+
unsigned char *aad, unsigned char *msg, int len,
1055+
unsigned char *enc, unsigned char *tag, unsigned char *dec)
1056+
{
1057+
int err;
1058+
EVP_CIPHER_CTX *ctx;
1059+
int decLen;
1060+
unsigned int tagLen = 16;
1061+
OSSL_PARAM params[2];
1062+
1063+
err = (ctx = EVP_CIPHER_CTX_new()) == NULL;
1064+
/* Init decrypt with key. */
1065+
if (err == 0) {
1066+
err = EVP_DecryptInit(ctx, cipher, key, NULL) != 1;
1067+
}
1068+
/* Set the fixed IV portion - this also sets ivGen. */
1069+
if (err == 0) {
1070+
err = EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IV_FIXED,
1071+
ivFixedLen, iv) != 1;
1072+
}
1073+
/* Use OSSL_PARAM AEAD_TLS1_SET_IV_INV to set the explicit/random part
1074+
* of the IV from the encrypt side. This is the code path fixed by the
1075+
* commit. */
1076+
if (err == 0) {
1077+
params[0] = OSSL_PARAM_construct_octet_string(
1078+
OSSL_CIPHER_PARAM_AEAD_TLS1_SET_IV_INV,
1079+
(void *)(iv + ivFixedLen), ivLen - ivFixedLen);
1080+
params[1] = OSSL_PARAM_construct_end();
1081+
err = EVP_CIPHER_CTX_set_params(ctx, params) != 1;
1082+
}
1083+
/* Set tag for verification. */
1084+
if (err == 0) {
1085+
err = EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tagLen,
1086+
(void *)tag) != 1;
1087+
}
1088+
/* AAD. */
1089+
if (err == 0) {
1090+
err = EVP_DecryptUpdate(ctx, NULL, &decLen, aad,
1091+
(int)strlen((char *)aad)) != 1;
1092+
}
1093+
/* Decrypt. */
1094+
if (err == 0) {
1095+
err = EVP_DecryptUpdate(ctx, dec, &decLen, enc, len) != 1;
1096+
}
1097+
if (err == 0) {
1098+
err = EVP_DecryptFinal_ex(ctx, dec + decLen, &decLen) != 1;
1099+
}
1100+
if (err == 0 && dec != NULL && msg != NULL) {
1101+
PRINT_BUFFER("Decrypted", dec, len);
1102+
if (memcmp(dec, msg, len) != 0) {
1103+
err = 1;
1104+
}
1105+
}
1106+
1107+
EVP_CIPHER_CTX_free(ctx);
1108+
return err;
1109+
}
1110+
1111+
static int test_aes_gcm_set_iv_inv(void *data, const char *cipher,
1112+
int keyLen, int ivFixedLen, int ivLen)
1113+
{
1114+
int err = 0;
1115+
unsigned char msg[] = "Test pattern";
1116+
unsigned char key[32];
1117+
unsigned char iv[12];
1118+
unsigned char aad[] = "AAD";
1119+
unsigned char enc[sizeof(msg)];
1120+
unsigned char tag[AES_BLOCK_SIZE];
1121+
unsigned char dec[sizeof(msg)];
1122+
EVP_CIPHER* ocipher;
1123+
EVP_CIPHER* wcipher;
1124+
1125+
(void)data;
1126+
1127+
ocipher = EVP_CIPHER_fetch(osslLibCtx, cipher, "");
1128+
wcipher = EVP_CIPHER_fetch(wpLibCtx, cipher, "");
1129+
1130+
if (RAND_bytes(key, keyLen) == 0) {
1131+
err = 1;
1132+
}
1133+
if (err == 0) {
1134+
if (RAND_bytes(iv, sizeof(iv)) == 0) {
1135+
err = 1;
1136+
}
1137+
}
1138+
1139+
if (err == 0) {
1140+
PRINT_BUFFER("Key", key, keyLen);
1141+
PRINT_BUFFER("IV", iv, ivLen);
1142+
PRINT_BUFFER("Message", msg, sizeof(msg));
1143+
}
1144+
1145+
/* Encrypt with OpenSSL using fixed IV, decrypt with wolfProvider
1146+
* using OSSL_PARAM SET_IV_INV. */
1147+
if (err == 0) {
1148+
PRINT_MSG("Encrypt with OpenSSL (fixed IV)");
1149+
err = test_aes_tag_fixed_enc(ocipher, key, iv, ivFixedLen, ivLen,
1150+
aad, msg, sizeof(msg), enc, tag);
1151+
}
1152+
if (err == 0) {
1153+
PRINT_MSG("Decrypt with wolfprovider (SET_IV_INV via OSSL_PARAM)");
1154+
err = test_aes_gcm_set_iv_inv_dec(wcipher, key, iv, ivFixedLen, ivLen,
1155+
aad, msg, sizeof(msg), enc, tag,
1156+
dec);
1157+
}
1158+
1159+
/* Encrypt with wolfProvider using fixed IV, decrypt with wolfProvider
1160+
* using OSSL_PARAM SET_IV_INV. */
1161+
if (err == 0) {
1162+
PRINT_MSG("Encrypt with wolfprovider (fixed IV)");
1163+
err = test_aes_tag_fixed_enc(wcipher, key, iv, ivFixedLen, ivLen,
1164+
aad, msg, sizeof(msg), enc, tag);
1165+
}
1166+
if (err == 0) {
1167+
PRINT_MSG("Decrypt with wolfprovider (SET_IV_INV via OSSL_PARAM)");
1168+
err = test_aes_gcm_set_iv_inv_dec(wcipher, key, iv, ivFixedLen, ivLen,
1169+
aad, msg, sizeof(msg), enc, tag,
1170+
dec);
1171+
}
1172+
1173+
/* Encrypt with wolfProvider using fixed IV, decrypt with OpenSSL
1174+
* using OSSL_PARAM SET_IV_INV. */
1175+
if (err == 0) {
1176+
PRINT_MSG("Encrypt with wolfprovider (fixed IV)");
1177+
err = test_aes_tag_fixed_enc(wcipher, key, iv, ivFixedLen, ivLen,
1178+
aad, msg, sizeof(msg), enc, tag);
1179+
}
1180+
if (err == 0) {
1181+
PRINT_MSG("Decrypt with OpenSSL (SET_IV_INV via OSSL_PARAM)");
1182+
err = test_aes_gcm_set_iv_inv_dec(ocipher, key, iv, ivFixedLen, ivLen,
1183+
aad, msg, sizeof(msg), enc, tag,
1184+
dec);
1185+
}
1186+
1187+
EVP_CIPHER_free(wcipher);
1188+
EVP_CIPHER_free(ocipher);
1189+
1190+
return err;
1191+
}
1192+
1193+
int test_aes128_gcm_set_iv_inv(void *data)
1194+
{
1195+
return test_aes_gcm_set_iv_inv(data, "AES-128-GCM", 16,
1196+
EVP_GCM_TLS_FIXED_IV_LEN, 12);
1197+
}
1198+
10451199
#endif /* WP_HAVE_AESGCM */
10461200

10471201
/******************************************************************************/

‎test/unit.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,7 @@ TEST_CASE test_case[] = {
267267
TEST_DECL(test_aes256_gcm, NULL),
268268
TEST_DECL(test_aes128_gcm_fixed, NULL),
269269
TEST_DECL(test_aes128_gcm_tls, NULL),
270+
TEST_DECL(test_aes128_gcm_set_iv_inv, NULL),
270271
#endif
271272
#ifdef WP_HAVE_AESCCM
272273
TEST_DECL(test_aes128_ccm, NULL),

‎test/unit.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ int test_aes192_gcm(void *data);
194194
int test_aes256_gcm(void *data);
195195
int test_aes128_gcm_fixed(void *data);
196196
int test_aes128_gcm_tls(void *data);
197+
int test_aes128_gcm_set_iv_inv(void *data);
197198

198199
#endif /* WP_HAVE_AESGCM */
199200

0 commit comments

Comments
 (0)