hpke.c@ 105970

Last change on this file since 105970 was 105970, checked in by vboxsync, 7 months ago
openssl-3.3.1: Fix scm errors, mostly properties. bugref:10757
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 49.1 KB

Line
1	/*
2	* Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	/* An OpenSSL-based HPKE implementation of RFC9180 */
11
12	#include <string.h>
13	#include <openssl/rand.h>
14	#include <openssl/kdf.h>
15	#include <openssl/core_names.h>
16	#include <openssl/hpke.h>
17	#include <openssl/sha.h>
18	#include <openssl/evp.h>
19	#include <openssl/err.h>
20	#include "internal/hpke_util.h"
21	#include "internal/nelem.h"
22	#include "internal/common.h"
23
24	/* default buffer size for keys and internal buffers we use */
25	#define OSSL_HPKE_MAXSIZE 512
26
27	/* Define HPKE labels from RFC9180 in hex for EBCDIC compatibility */
28	/* "HPKE" - "suite_id" label for section 5.1 */
29	static const char OSSL_HPKE_SEC51LABEL[] = "\x48\x50\x4b\x45";
30	/* "psk_id_hash" - in key_schedule_context */
31	static const char OSSL_HPKE_PSKIDHASH_LABEL[] = "\x70\x73\x6b\x5f\x69\x64\x5f\x68\x61\x73\x68";
32	/* "info_hash" - in key_schedule_context */
33	static const char OSSL_HPKE_INFOHASH_LABEL[] = "\x69\x6e\x66\x6f\x5f\x68\x61\x73\x68";
34	/* "base_nonce" - base nonce calc label */
35	static const char OSSL_HPKE_NONCE_LABEL[] = "\x62\x61\x73\x65\x5f\x6e\x6f\x6e\x63\x65";
36	/* "exp" - internal exporter secret generation label */
37	static const char OSSL_HPKE_EXP_LABEL[] = "\x65\x78\x70";
38	/* "sec" - external label for exporting secret */
39	static const char OSSL_HPKE_EXP_SEC_LABEL[] = "\x73\x65\x63";
40	/* "key" - label for use when generating key from shared secret */
41	static const char OSSL_HPKE_KEY_LABEL[] = "\x6b\x65\x79";
42	/* "secret" - for generating shared secret */
43	static const char OSSL_HPKE_SECRET_LABEL[] = "\x73\x65\x63\x72\x65\x74";
44
45	/**
46	* @brief sender or receiver context
47	*/
48	struct ossl_hpke_ctx_st
49	{
50	OSSL_LIB_CTX libctx; / library context */
51	char propq; / properties */
52	int mode; /* HPKE mode */
53	OSSL_HPKE_SUITE suite; /* suite */
54	const OSSL_HPKE_KEM_INFO *kem_info;
55	const OSSL_HPKE_KDF_INFO *kdf_info;
56	const OSSL_HPKE_AEAD_INFO *aead_info;
57	EVP_CIPHER *aead_ciph;
58	int role; /* sender(0) or receiver(1) */
59	uint64_t seq; /* aead sequence number */
60	unsigned char shared_secret; / KEM output, zz */
61	size_t shared_secretlen;
62	unsigned char key; / final aead key */
63	size_t keylen;
64	unsigned char nonce; / aead base nonce */
65	size_t noncelen;
66	unsigned char exportersec; / exporter secret */
67	size_t exporterseclen;
68	char pskid; / PSK stuff */
69	unsigned char *psk;
70	size_t psklen;
71	EVP_PKEY authpriv; / sender's authentication private key */
72	unsigned char authpub; / auth public key */
73	size_t authpublen;
74	unsigned char ikme; / IKM for sender deterministic key gen */
75	size_t ikmelen;
76	};
77
78	/**
79	* @brief check if KEM uses NIST curve or not
80	* @param kem_id is the externally supplied kem_id
81	* @return 1 for NIST curves, 0 for other
82	*/
83	static int hpke_kem_id_nist_curve(uint16_t kem_id)
84	{
85	const OSSL_HPKE_KEM_INFO *kem_info;
86
87	kem_info = ossl_HPKE_KEM_INFO_find_id(kem_id);
88	return kem_info != NULL && kem_info->groupname != NULL;
89	}
90
91	/**
92	* @brief wrapper to import NIST curve public key as easily as x25519/x448
93	* @param libctx is the context to use
94	* @param propq is a properties string
95	* @param gname is the curve groupname
96	* @param buf is the binary buffer with the (uncompressed) public value
97	* @param buflen is the length of the private key buffer
98	* @return a working EVP_PKEY * or NULL
99	*
100	* Note that this could be a useful function to make public in
101	* future, but would likely require a name change.
102	*/
103	static EVP_PKEY evp_pkey_new_raw_nist_public_key(OSSL_LIB_CTX libctx,
104	const char *propq,
105	const char *gname,
106	const unsigned char *buf,
107	size_t buflen)
108	{
109	OSSL_PARAM params[2];
110	EVP_PKEY *ret = NULL;
111	EVP_PKEY_CTX *cctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", propq);
112
113	params[0] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
114	(char *)gname, 0);
115	params[1] = OSSL_PARAM_construct_end();
116	if (cctx == NULL
117	\|\| EVP_PKEY_paramgen_init(cctx) <= 0
118	\|\| EVP_PKEY_CTX_set_params(cctx, params) <= 0
119	\|\| EVP_PKEY_paramgen(cctx, &ret) <= 0
120	\|\| EVP_PKEY_set1_encoded_public_key(ret, buf, buflen) != 1) {
121	EVP_PKEY_CTX_free(cctx);
122	EVP_PKEY_free(ret);
123	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
124	return NULL;
125	}
126	EVP_PKEY_CTX_free(cctx);
127	return ret;
128	}
129
130	/**
131	* @brief do the AEAD decryption
132	* @param hctx is the context to use
133	* @param iv is the initialisation vector
134	* @param aad is the additional authenticated data
135	* @param aadlen is the length of the aad
136	* @param ct is the ciphertext buffer
137	* @param ctlen is the ciphertext length (including tag).
138	* @param pt is the output buffer
139	* @param ptlen input/output, better be big enough on input, exact on output
140	* @return 1 on success, 0 otherwise
141	*/
142	static int hpke_aead_dec(OSSL_HPKE_CTX hctx, const unsigned char iv,
143	const unsigned char *aad, size_t aadlen,
144	const unsigned char *ct, size_t ctlen,
145	unsigned char pt, size_t ptlen)
146	{
147	int erv = 0;
148	EVP_CIPHER_CTX *ctx = NULL;
149	int len = 0;
150	size_t taglen;
151
152	taglen = hctx->aead_info->taglen;
153	if (ctlen <= taglen \|\| *ptlen < ctlen - taglen) {
154	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
155	return 0;
156	}
157	/* Create and initialise the context */
158	if ((ctx = EVP_CIPHER_CTX_new()) == NULL)
159	return 0;
160	/* Initialise the decryption operation. */
161	if (EVP_DecryptInit_ex(ctx, hctx->aead_ciph, NULL, NULL, NULL) != 1) {
162	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
163	goto err;
164	}
165	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
166	hctx->noncelen, NULL) != 1) {
167	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
168	goto err;
169	}
170	/* Initialise key and IV */
171	if (EVP_DecryptInit_ex(ctx, NULL, NULL, hctx->key, iv) != 1) {
172	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
173	goto err;
174	}
175	/* Provide AAD. */
176	if (aadlen != 0 && aad != NULL) {
177	if (EVP_DecryptUpdate(ctx, NULL, &len, aad, aadlen) != 1) {
178	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
179	goto err;
180	}
181	}
182	if (EVP_DecryptUpdate(ctx, pt, &len, ct, ctlen - taglen) != 1) {
183	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
184	goto err;
185	}
186	*ptlen = len;
187	if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
188	taglen, (void *)(ct + ctlen - taglen))) {
189	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
190	goto err;
191	}
192	/* Finalise decryption. */
193	if (EVP_DecryptFinal_ex(ctx, pt + len, &len) <= 0) {
194	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
195	goto err;
196	}
197	erv = 1;
198
199	err:
200	if (erv != 1)
201	OPENSSL_cleanse(pt, *ptlen);
202	EVP_CIPHER_CTX_free(ctx);
203	return erv;
204	}
205
206	/**
207	* @brief do AEAD encryption as per the RFC
208	* @param hctx is the context to use
209	* @param iv is the initialisation vector
210	* @param aad is the additional authenticated data
211	* @param aadlen is the length of the aad
212	* @param pt is the plaintext buffer
213	* @param ptlen is the length of pt
214	* @param ct is the output buffer
215	* @param ctlen input/output, needs space for tag on input, exact on output
216	* @return 1 for success, 0 otherwise
217	*/
218	static int hpke_aead_enc(OSSL_HPKE_CTX hctx, const unsigned char iv,
219	const unsigned char *aad, size_t aadlen,
220	const unsigned char *pt, size_t ptlen,
221	unsigned char ct, size_t ctlen)
222	{
223	int erv = 0;
224	EVP_CIPHER_CTX *ctx = NULL;
225	int len;
226	size_t taglen = 0;
227	unsigned char tag[EVP_MAX_AEAD_TAG_LENGTH];
228
229	taglen = hctx->aead_info->taglen;
230	if (ctlen <= taglen \|\| ptlen > ctlen - taglen) {
231	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
232	return 0;
233	}
234	if (!ossl_assert(taglen <= sizeof(tag))) {
235	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
236	return 0;
237	}
238	/* Create and initialise the context */
239	if ((ctx = EVP_CIPHER_CTX_new()) == NULL)
240	return 0;
241	/* Initialise the encryption operation. */
242	if (EVP_EncryptInit_ex(ctx, hctx->aead_ciph, NULL, NULL, NULL) != 1) {
243	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
244	goto err;
245	}
246	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
247	hctx->noncelen, NULL) != 1) {
248	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
249	goto err;
250	}
251	/* Initialise key and IV */
252	if (EVP_EncryptInit_ex(ctx, NULL, NULL, hctx->key, iv) != 1) {
253	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
254	goto err;
255	}
256	/* Provide any AAD data. */
257	if (aadlen != 0 && aad != NULL) {
258	if (EVP_EncryptUpdate(ctx, NULL, &len, aad, aadlen) != 1) {
259	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
260	goto err;
261	}
262	}
263	if (EVP_EncryptUpdate(ctx, ct, &len, pt, ptlen) != 1) {
264	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
265	goto err;
266	}
267	*ctlen = len;
268	/* Finalise the encryption. */
269	if (EVP_EncryptFinal_ex(ctx, ct + len, &len) != 1) {
270	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
271	goto err;
272	}
273	*ctlen += len;
274	/* Get tag. Not a duplicate so needs to be added to the ciphertext */
275	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag) != 1) {
276	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
277	goto err;
278	}
279	memcpy(ct + *ctlen, tag, taglen);
280	*ctlen += taglen;
281	erv = 1;
282
283	err:
284	if (erv != 1)
285	OPENSSL_cleanse(ct, *ctlen);
286	EVP_CIPHER_CTX_free(ctx);
287	return erv;
288	}
289
290	/**
291	* @brief check mode is in-range and supported
292	* @param mode is the caller's chosen mode
293	* @return 1 for good mode, 0 otherwise
294	*/
295	static int hpke_mode_check(unsigned int mode)
296	{
297	switch (mode) {
298	case OSSL_HPKE_MODE_BASE:
299	case OSSL_HPKE_MODE_PSK:
300	case OSSL_HPKE_MODE_AUTH:
301	case OSSL_HPKE_MODE_PSKAUTH:
302	break;
303	default:
304	return 0;
305	}
306	return 1;
307	}
308
309	/**
310	* @brief check if a suite is supported locally
311	* @param suite is the suite to check
312	* @return 1 for good, 0 otherwise
313	*/
314	static int hpke_suite_check(OSSL_HPKE_SUITE suite,
315	const OSSL_HPKE_KEM_INFO **kem_info,
316	const OSSL_HPKE_KDF_INFO **kdf_info,
317	const OSSL_HPKE_AEAD_INFO **aead_info)
318	{
319	const OSSL_HPKE_KEM_INFO *kem_info_;
320	const OSSL_HPKE_KDF_INFO *kdf_info_;
321	const OSSL_HPKE_AEAD_INFO *aead_info_;
322
323	/* check KEM, KDF and AEAD are supported here */
324	if ((kem_info_ = ossl_HPKE_KEM_INFO_find_id(suite.kem_id)) == NULL)
325	return 0;
326	if ((kdf_info_ = ossl_HPKE_KDF_INFO_find_id(suite.kdf_id)) == NULL)
327	return 0;
328	if ((aead_info_ = ossl_HPKE_AEAD_INFO_find_id(suite.aead_id)) == NULL)
329	return 0;
330
331	if (kem_info != NULL)
332	*kem_info = kem_info_;
333	if (kdf_info != NULL)
334	*kdf_info = kdf_info_;
335	if (aead_info != NULL)
336	*aead_info = aead_info_;
337
338	return 1;
339	}
340
341	/*
342	* @brief randomly pick a suite
343	* @param libctx is the context to use
344	* @param propq is a properties string
345	* @param suite is the result
346	* @return 1 for success, 0 otherwise
347	*/
348	static int hpke_random_suite(OSSL_LIB_CTX *libctx,
349	const char *propq,
350	OSSL_HPKE_SUITE *suite)
351	{
352	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
353	const OSSL_HPKE_KDF_INFO *kdf_info = NULL;
354	const OSSL_HPKE_AEAD_INFO *aead_info = NULL;
355
356	/* random kem, kdf and aead */
357	kem_info = ossl_HPKE_KEM_INFO_find_random(libctx);
358	if (kem_info == NULL)
359	return 0;
360	suite->kem_id = kem_info->kem_id;
361	kdf_info = ossl_HPKE_KDF_INFO_find_random(libctx);
362	if (kdf_info == NULL)
363	return 0;
364	suite->kdf_id = kdf_info->kdf_id;
365	aead_info = ossl_HPKE_AEAD_INFO_find_random(libctx);
366	if (aead_info == NULL)
367	return 0;
368	suite->aead_id = aead_info->aead_id;
369	return 1;
370	}
371
372	/*
373	* @brief tell the caller how big the ciphertext will be
374	*
375	* AEAD algorithms add a tag for data authentication.
376	* Those are almost always, but not always, 16 octets
377	* long, and who knows what will be true in the future.
378	* So this function allows a caller to find out how
379	* much data expansion they will see with a given suite.
380	*
381	* "enc" is the name used in RFC9180 for the encapsulated
382	* public value of the sender, who calls OSSL_HPKE_seal(),
383	* that is sent to the recipient, who calls OSSL_HPKE_open().
384	*
385	* @param suite is the suite to be used
386	* @param enclen points to what will be enc length
387	* @param clearlen is the length of plaintext
388	* @param cipherlen points to what will be ciphertext length (including tag)
389	* @return 1 for success, 0 otherwise
390	*/
391	static int hpke_expansion(OSSL_HPKE_SUITE suite,
392	size_t *enclen,
393	size_t clearlen,
394	size_t *cipherlen)
395	{
396	const OSSL_HPKE_AEAD_INFO *aead_info = NULL;
397	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
398
399	if (cipherlen == NULL \|\| enclen == NULL) {
400	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
401	return 0;
402	}
403	if (hpke_suite_check(suite, &kem_info, NULL, &aead_info) != 1) {
404	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
405	return 0;
406	}
407	*cipherlen = clearlen + aead_info->taglen;
408	*enclen = kem_info->Nenc;
409	return 1;
410	}
411
412	/*
413	* @brief expand and XOR the 64-bit unsigned seq with (nonce) buffer
414	* @param ctx is the HPKE context
415	* @param buf is the buffer for the XOR'd seq and nonce
416	* @param blen is the size of buf
417	* @return 0 for error, otherwise blen
418	*/
419	static size_t hpke_seqnonce2buf(OSSL_HPKE_CTX *ctx,
420	unsigned char *buf, size_t blen)
421	{
422	size_t i;
423	uint64_t seq_copy;
424
425	if (ctx == NULL \|\| blen < sizeof(seq_copy) \|\| blen != ctx->noncelen)
426	return 0;
427	seq_copy = ctx->seq;
428	memset(buf, 0, blen);
429	for (i = 0; i < sizeof(seq_copy); i++) {
430	buf[blen - i - 1] = seq_copy & 0xff;
431	seq_copy >>= 8;
432	}
433	for (i = 0; i < blen; i++)
434	buf[i] ^= ctx->nonce[i];
435	return blen;
436	}
437
438	/*
439	* @brief call the underlying KEM to encap
440	* @param ctx is the OSSL_HPKE_CTX
441	* @param enc is a buffer for the sender's ephemeral public value
442	* @param enclen is the size of enc on input, number of octets used on output
443	* @param pub is the recipient's public value
444	* @param publen is the length of pub
445	* @return 1 for success, 0 for error
446	*/
447	static int hpke_encap(OSSL_HPKE_CTX ctx, unsigned char enc, size_t *enclen,
448	const unsigned char *pub, size_t publen)
449	{
450	int erv = 0;
451	OSSL_PARAM params[3], *p = params;
452	size_t lsslen = 0, lenclen = 0;
453	EVP_PKEY_CTX *pctx = NULL;
454	EVP_PKEY *pkR = NULL;
455	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
456
457	if (ctx == NULL \|\| enc == NULL \|\| enclen == NULL \|\| *enclen == 0
458	\|\| pub == NULL \|\| publen == 0) {
459	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
460	return 0;
461	}
462	if (ctx->shared_secret != NULL) {
463	/* only run the KEM once per OSSL_HPKE_CTX */
464	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
465	return 0;
466	}
467	kem_info = ossl_HPKE_KEM_INFO_find_id(ctx->suite.kem_id);
468	if (kem_info == NULL) {
469	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
470	return 0;
471	}
472	if (hpke_kem_id_nist_curve(ctx->suite.kem_id) == 1) {
473	pkR = evp_pkey_new_raw_nist_public_key(ctx->libctx, ctx->propq,
474	kem_info->groupname,
475	pub, publen);
476	} else {
477	pkR = EVP_PKEY_new_raw_public_key_ex(ctx->libctx,
478	kem_info->keytype,
479	ctx->propq, pub, publen);
480	}
481	if (pkR == NULL) {
482	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
483	goto err;
484	}
485	pctx = EVP_PKEY_CTX_new_from_pkey(ctx->libctx, pkR, ctx->propq);
486	if (pctx == NULL) {
487	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
488	goto err;
489	}
490	*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KEM_PARAM_OPERATION,
491	OSSL_KEM_PARAM_OPERATION_DHKEM,
492	0);
493	if (ctx->ikme != NULL) {
494	*p++ = OSSL_PARAM_construct_octet_string(OSSL_KEM_PARAM_IKME,
495	ctx->ikme, ctx->ikmelen);
496	}
497	*p = OSSL_PARAM_construct_end();
498	if (ctx->mode == OSSL_HPKE_MODE_AUTH
499	\|\| ctx->mode == OSSL_HPKE_MODE_PSKAUTH) {
500	if (EVP_PKEY_auth_encapsulate_init(pctx, ctx->authpriv,
501	params) != 1) {
502	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
503	goto err;
504	}
505	} else {
506	if (EVP_PKEY_encapsulate_init(pctx, params) != 1) {
507	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
508	goto err;
509	}
510	}
511	lenclen = *enclen;
512	if (EVP_PKEY_encapsulate(pctx, NULL, &lenclen, NULL, &lsslen) != 1) {
513	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
514	goto err;
515	}
516	if (lenclen > *enclen) {
517	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
518	goto err;
519	}
520	ctx->shared_secret = OPENSSL_malloc(lsslen);
521	if (ctx->shared_secret == NULL)
522	goto err;
523	ctx->shared_secretlen = lsslen;
524	if (EVP_PKEY_encapsulate(pctx, enc, enclen, ctx->shared_secret,
525	&ctx->shared_secretlen) != 1) {
526	ctx->shared_secretlen = 0;
527	OPENSSL_free(ctx->shared_secret);
528	ctx->shared_secret = NULL;
529	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
530	goto err;
531	}
532	erv = 1;
533
534	err:
535	EVP_PKEY_CTX_free(pctx);
536	EVP_PKEY_free(pkR);
537	return erv;
538	}
539
540	/*
541	* @brief call the underlying KEM to decap
542	* @param ctx is the OSSL_HPKE_CTX
543	* @param enc is a buffer for the sender's ephemeral public value
544	* @param enclen is the length of enc
545	* @param priv is the recipient's private value
546	* @return 1 for success, 0 for error
547	*/
548	static int hpke_decap(OSSL_HPKE_CTX *ctx,
549	const unsigned char *enc, size_t enclen,
550	EVP_PKEY *priv)
551	{
552	int erv = 0;
553	EVP_PKEY_CTX *pctx = NULL;
554	EVP_PKEY *spub = NULL;
555	OSSL_PARAM params[2], *p = params;
556	size_t lsslen = 0;
557
558	if (ctx == NULL \|\| enc == NULL \|\| enclen == 0 \|\| priv == NULL) {
559	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
560	return 0;
561	}
562	if (ctx->shared_secret != NULL) {
563	/* only run the KEM once per OSSL_HPKE_CTX */
564	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
565	return 0;
566	}
567	pctx = EVP_PKEY_CTX_new_from_pkey(ctx->libctx, priv, ctx->propq);
568	if (pctx == NULL) {
569	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
570	goto err;
571	}
572	*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KEM_PARAM_OPERATION,
573	OSSL_KEM_PARAM_OPERATION_DHKEM,
574	0);
575	*p = OSSL_PARAM_construct_end();
576	if (ctx->mode == OSSL_HPKE_MODE_AUTH
577	\|\| ctx->mode == OSSL_HPKE_MODE_PSKAUTH) {
578	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
579
580	kem_info = ossl_HPKE_KEM_INFO_find_id(ctx->suite.kem_id);
581	if (kem_info == NULL) {
582	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
583	goto err;
584	}
585	if (hpke_kem_id_nist_curve(ctx->suite.kem_id) == 1) {
586	spub = evp_pkey_new_raw_nist_public_key(ctx->libctx, ctx->propq,
587	kem_info->groupname,
588	ctx->authpub,
589	ctx->authpublen);
590	} else {
591	spub = EVP_PKEY_new_raw_public_key_ex(ctx->libctx,
592	kem_info->keytype,
593	ctx->propq,
594	ctx->authpub,
595	ctx->authpublen);
596	}
597	if (spub == NULL) {
598	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
599	goto err;
600	}
601	if (EVP_PKEY_auth_decapsulate_init(pctx, spub, params) != 1) {
602	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
603	goto err;
604	}
605	} else {
606	if (EVP_PKEY_decapsulate_init(pctx, params) != 1) {
607	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
608	goto err;
609	}
610	}
611	if (EVP_PKEY_decapsulate(pctx, NULL, &lsslen, enc, enclen) != 1) {
612	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
613	goto err;
614	}
615	ctx->shared_secret = OPENSSL_malloc(lsslen);
616	if (ctx->shared_secret == NULL)
617	goto err;
618	if (EVP_PKEY_decapsulate(pctx, ctx->shared_secret, &lsslen,
619	enc, enclen) != 1) {
620	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
621	goto err;
622	}
623	ctx->shared_secretlen = lsslen;
624	erv = 1;
625
626	err:
627	EVP_PKEY_CTX_free(pctx);
628	EVP_PKEY_free(spub);
629	if (erv == 0) {
630	OPENSSL_free(ctx->shared_secret);
631	ctx->shared_secret = NULL;
632	ctx->shared_secretlen = 0;
633	}
634	return erv;
635	}
636
637	/*
638	* @brief do "middle" of HPKE, between KEM and AEAD
639	* @param ctx is the OSSL_HPKE_CTX
640	* @param info is a buffer for the added binding information
641	* @param infolen is the length of info
642	* @return 0 for error, 1 for success
643	*
644	* This does all the HPKE extracts and expands as defined in RFC9180
645	* section 5.1, (badly termed there as a "key schedule") and sets the
646	* ctx fields for the shared_secret, nonce, key and exporter_secret
647	*/
648	static int hpke_do_middle(OSSL_HPKE_CTX *ctx,
649	const unsigned char *info, size_t infolen)
650	{
651	int erv = 0;
652	size_t ks_contextlen = OSSL_HPKE_MAXSIZE;
653	unsigned char ks_context[OSSL_HPKE_MAXSIZE];
654	size_t halflen = 0;
655	size_t pskidlen = 0;
656	const OSSL_HPKE_AEAD_INFO *aead_info = NULL;
657	const OSSL_HPKE_KDF_INFO *kdf_info = NULL;
658	size_t secretlen = OSSL_HPKE_MAXSIZE;
659	unsigned char secret[OSSL_HPKE_MAXSIZE];
660	EVP_KDF_CTX *kctx = NULL;
661	unsigned char suitebuf[6];
662	const char *mdname = NULL;
663
664	/* only let this be done once */
665	if (ctx->exportersec != NULL) {
666	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
667	return 0;
668	}
669	if (ossl_HPKE_KEM_INFO_find_id(ctx->suite.kem_id) == NULL) {
670	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
671	return 0;
672	}
673	aead_info = ossl_HPKE_AEAD_INFO_find_id(ctx->suite.aead_id);
674	if (aead_info == NULL) {
675	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
676	return 0;
677	}
678	kdf_info = ossl_HPKE_KDF_INFO_find_id(ctx->suite.kdf_id);
679	if (kdf_info == NULL) {
680	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
681	return 0;
682	}
683	mdname = kdf_info->mdname;
684	/* create key schedule context */
685	memset(ks_context, 0, sizeof(ks_context));
686	ks_context[0] = (unsigned char)(ctx->mode % 256);
687	ks_contextlen--; /* remaining space */
688	halflen = kdf_info->Nh;
689	if ((2 * halflen) > ks_contextlen) {
690	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
691	return 0;
692	}
693	/* check a psk was set if in that mode */
694	if (ctx->mode == OSSL_HPKE_MODE_PSK
695	\|\| ctx->mode == OSSL_HPKE_MODE_PSKAUTH) {
696	if (ctx->psk == NULL \|\| ctx->psklen == 0 \|\| ctx->pskid == NULL) {
697	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
698	return 0;
699	}
700	}
701	kctx = ossl_kdf_ctx_create("HKDF", mdname, ctx->libctx, ctx->propq);
702	if (kctx == NULL) {
703	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
704	return 0;
705	}
706	pskidlen = (ctx->psk == NULL ? 0 : strlen(ctx->pskid));
707	/* full suite details as per RFC9180 sec 5.1 */
708	suitebuf[0] = ctx->suite.kem_id / 256;
709	suitebuf[1] = ctx->suite.kem_id % 256;
710	suitebuf[2] = ctx->suite.kdf_id / 256;
711	suitebuf[3] = ctx->suite.kdf_id % 256;
712	suitebuf[4] = ctx->suite.aead_id / 256;
713	suitebuf[5] = ctx->suite.aead_id % 256;
714	/* Extract and Expand variously... */
715	if (ossl_hpke_labeled_extract(kctx, ks_context + 1, halflen,
716	NULL, 0, OSSL_HPKE_SEC51LABEL,
717	suitebuf, sizeof(suitebuf),
718	OSSL_HPKE_PSKIDHASH_LABEL,
719	(unsigned char *)ctx->pskid, pskidlen) != 1) {
720	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
721	goto err;
722	}
723	if (ossl_hpke_labeled_extract(kctx, ks_context + 1 + halflen, halflen,
724	NULL, 0, OSSL_HPKE_SEC51LABEL,
725	suitebuf, sizeof(suitebuf),
726	OSSL_HPKE_INFOHASH_LABEL,
727	(unsigned char *)info, infolen) != 1) {
728	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
729	goto err;
730	}
731	ks_contextlen = 1 + 2 * halflen;
732	secretlen = kdf_info->Nh;
733	if (secretlen > OSSL_HPKE_MAXSIZE) {
734	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
735	goto err;
736	}
737	if (ossl_hpke_labeled_extract(kctx, secret, secretlen,
738	ctx->shared_secret, ctx->shared_secretlen,
739	OSSL_HPKE_SEC51LABEL,
740	suitebuf, sizeof(suitebuf),
741	OSSL_HPKE_SECRET_LABEL,
742	ctx->psk, ctx->psklen) != 1) {
743	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
744	goto err;
745	}
746	if (ctx->suite.aead_id != OSSL_HPKE_AEAD_ID_EXPORTONLY) {
747	/* we only need nonce/key for non export AEADs */
748	ctx->noncelen = aead_info->Nn;
749	ctx->nonce = OPENSSL_malloc(ctx->noncelen);
750	if (ctx->nonce == NULL)
751	goto err;
752	if (ossl_hpke_labeled_expand(kctx, ctx->nonce, ctx->noncelen,
753	secret, secretlen, OSSL_HPKE_SEC51LABEL,
754	suitebuf, sizeof(suitebuf),
755	OSSL_HPKE_NONCE_LABEL,
756	ks_context, ks_contextlen) != 1) {
757	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
758	goto err;
759	}
760	ctx->keylen = aead_info->Nk;
761	ctx->key = OPENSSL_malloc(ctx->keylen);
762	if (ctx->key == NULL)
763	goto err;
764	if (ossl_hpke_labeled_expand(kctx, ctx->key, ctx->keylen,
765	secret, secretlen, OSSL_HPKE_SEC51LABEL,
766	suitebuf, sizeof(suitebuf),
767	OSSL_HPKE_KEY_LABEL,
768	ks_context, ks_contextlen) != 1) {
769	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
770	goto err;
771	}
772	}
773	ctx->exporterseclen = kdf_info->Nh;
774	ctx->exportersec = OPENSSL_malloc(ctx->exporterseclen);
775	if (ctx->exportersec == NULL)
776	goto err;
777	if (ossl_hpke_labeled_expand(kctx, ctx->exportersec, ctx->exporterseclen,
778	secret, secretlen, OSSL_HPKE_SEC51LABEL,
779	suitebuf, sizeof(suitebuf),
780	OSSL_HPKE_EXP_LABEL,
781	ks_context, ks_contextlen) != 1) {
782	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
783	goto err;
784	}
785	erv = 1;
786
787	err:
788	OPENSSL_cleanse(ks_context, OSSL_HPKE_MAXSIZE);
789	OPENSSL_cleanse(secret, OSSL_HPKE_MAXSIZE);
790	EVP_KDF_CTX_free(kctx);
791	return erv;
792	}
793
794	/*
795	* externally visible functions from below here, API documentation is
796	* in doc/man3/OSSL_HPKE_CTX_new.pod to avoid duplication
797	*/
798
799	OSSL_HPKE_CTX *OSSL_HPKE_CTX_new(int mode, OSSL_HPKE_SUITE suite, int role,
800	OSSL_LIB_CTX libctx, const char propq)
801	{
802	OSSL_HPKE_CTX *ctx = NULL;
803	const OSSL_HPKE_KEM_INFO *kem_info;
804	const OSSL_HPKE_KDF_INFO *kdf_info;
805	const OSSL_HPKE_AEAD_INFO *aead_info;
806
807	if (hpke_mode_check(mode) != 1) {
808	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
809	return NULL;
810	}
811	if (hpke_suite_check(suite, &kem_info, &kdf_info, &aead_info) != 1) {
812	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
813	return NULL;
814	}
815	if (role != OSSL_HPKE_ROLE_SENDER && role != OSSL_HPKE_ROLE_RECEIVER) {
816	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
817	return 0;
818	}
819	ctx = OPENSSL_zalloc(sizeof(*ctx));
820	if (ctx == NULL)
821	return NULL;
822	ctx->libctx = libctx;
823	if (propq != NULL) {
824	ctx->propq = OPENSSL_strdup(propq);
825	if (ctx->propq == NULL)
826	goto err;
827	}
828	if (suite.aead_id != OSSL_HPKE_AEAD_ID_EXPORTONLY) {
829	ctx->aead_ciph = EVP_CIPHER_fetch(libctx, aead_info->name, propq);
830	if (ctx->aead_ciph == NULL) {
831	ERR_raise(ERR_LIB_CRYPTO, ERR_R_FETCH_FAILED);
832	goto err;
833	}
834	}
835	ctx->role = role;
836	ctx->mode = mode;
837	ctx->suite = suite;
838	ctx->kem_info = kem_info;
839	ctx->kdf_info = kdf_info;
840	ctx->aead_info = aead_info;
841	return ctx;
842
843	err:
844	EVP_CIPHER_free(ctx->aead_ciph);
845	OPENSSL_free(ctx);
846	return NULL;
847	}
848
849	void OSSL_HPKE_CTX_free(OSSL_HPKE_CTX *ctx)
850	{
851	if (ctx == NULL)
852	return;
853	EVP_CIPHER_free(ctx->aead_ciph);
854	OPENSSL_free(ctx->propq);
855	OPENSSL_clear_free(ctx->exportersec, ctx->exporterseclen);
856	OPENSSL_free(ctx->pskid);
857	OPENSSL_clear_free(ctx->psk, ctx->psklen);
858	OPENSSL_clear_free(ctx->key, ctx->keylen);
859	OPENSSL_clear_free(ctx->nonce, ctx->noncelen);
860	OPENSSL_clear_free(ctx->shared_secret, ctx->shared_secretlen);
861	OPENSSL_clear_free(ctx->ikme, ctx->ikmelen);
862	EVP_PKEY_free(ctx->authpriv);
863	OPENSSL_free(ctx->authpub);
864
865	OPENSSL_free(ctx);
866	return;
867	}
868
869	int OSSL_HPKE_CTX_set1_psk(OSSL_HPKE_CTX *ctx,
870	const char *pskid,
871	const unsigned char *psk, size_t psklen)
872	{
873	if (ctx == NULL \|\| pskid == NULL \|\| psk == NULL \|\| psklen == 0) {
874	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
875	return 0;
876	}
877	if (psklen > OSSL_HPKE_MAX_PARMLEN) {
878	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
879	return 0;
880	}
881	if (psklen < OSSL_HPKE_MIN_PSKLEN) {
882	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
883	return 0;
884	}
885	if (strlen(pskid) > OSSL_HPKE_MAX_PARMLEN) {
886	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
887	return 0;
888	}
889	if (strlen(pskid) == 0) {
890	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
891	return 0;
892	}
893	if (ctx->mode != OSSL_HPKE_MODE_PSK
894	&& ctx->mode != OSSL_HPKE_MODE_PSKAUTH) {
895	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
896	return 0;
897	}
898	/* free previous values if any */
899	OPENSSL_clear_free(ctx->psk, ctx->psklen);
900	ctx->psk = OPENSSL_memdup(psk, psklen);
901	if (ctx->psk == NULL)
902	return 0;
903	ctx->psklen = psklen;
904	OPENSSL_free(ctx->pskid);
905	ctx->pskid = OPENSSL_strdup(pskid);
906	if (ctx->pskid == NULL) {
907	OPENSSL_clear_free(ctx->psk, ctx->psklen);
908	ctx->psk = NULL;
909	ctx->psklen = 0;
910	return 0;
911	}
912	return 1;
913	}
914
915	int OSSL_HPKE_CTX_set1_ikme(OSSL_HPKE_CTX *ctx,
916	const unsigned char *ikme, size_t ikmelen)
917	{
918	if (ctx == NULL \|\| ikme == NULL) {
919	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
920	return 0;
921	}
922	if (ikmelen == 0 \|\| ikmelen > OSSL_HPKE_MAX_PARMLEN) {
923	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
924	return 0;
925	}
926	if (ctx->role != OSSL_HPKE_ROLE_SENDER) {
927	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
928	return 0;
929	}
930	OPENSSL_clear_free(ctx->ikme, ctx->ikmelen);
931	ctx->ikme = OPENSSL_memdup(ikme, ikmelen);
932	if (ctx->ikme == NULL)
933	return 0;
934	ctx->ikmelen = ikmelen;
935	return 1;
936	}
937
938	int OSSL_HPKE_CTX_set1_authpriv(OSSL_HPKE_CTX ctx, EVP_PKEY priv)
939	{
940	if (ctx == NULL \|\| priv == NULL) {
941	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
942	return 0;
943	}
944	if (ctx->mode != OSSL_HPKE_MODE_AUTH
945	&& ctx->mode != OSSL_HPKE_MODE_PSKAUTH) {
946	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
947	return 0;
948	}
949	if (ctx->role != OSSL_HPKE_ROLE_SENDER) {
950	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
951	return 0;
952	}
953	EVP_PKEY_free(ctx->authpriv);
954	ctx->authpriv = EVP_PKEY_dup(priv);
955	if (ctx->authpriv == NULL)
956	return 0;
957	return 1;
958	}
959
960	int OSSL_HPKE_CTX_set1_authpub(OSSL_HPKE_CTX *ctx,
961	const unsigned char *pub, size_t publen)
962	{
963	int erv = 0;
964	EVP_PKEY *pubp = NULL;
965	unsigned char *lpub = NULL;
966	size_t lpublen = 0;
967	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
968
969	if (ctx == NULL \|\| pub == NULL \|\| publen == 0) {
970	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
971	return 0;
972	}
973	if (ctx->mode != OSSL_HPKE_MODE_AUTH
974	&& ctx->mode != OSSL_HPKE_MODE_PSKAUTH) {
975	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
976	return 0;
977	}
978	if (ctx->role != OSSL_HPKE_ROLE_RECEIVER) {
979	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
980	return 0;
981	}
982	/* check the value seems like a good public key for this kem */
983	kem_info = ossl_HPKE_KEM_INFO_find_id(ctx->suite.kem_id);
984	if (kem_info == NULL)
985	return 0;
986	if (hpke_kem_id_nist_curve(ctx->suite.kem_id) == 1) {
987	pubp = evp_pkey_new_raw_nist_public_key(ctx->libctx, ctx->propq,
988	kem_info->groupname,
989	pub, publen);
990	} else {
991	pubp = EVP_PKEY_new_raw_public_key_ex(ctx->libctx,
992	kem_info->keytype,
993	ctx->propq,
994	pub, publen);
995	}
996	if (pubp == NULL) {
997	/* can happen based on external input - buffer value may be garbage */
998	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
999	goto err;
1000	}
1001	/*
1002	* extract out the public key in encoded form so we
1003	* should be fine even if given compressed form
1004	*/
1005	lpub = OPENSSL_malloc(OSSL_HPKE_MAXSIZE);
1006	if (lpub == NULL)
1007	goto err;
1008	if (EVP_PKEY_get_octet_string_param(pubp,
1009	OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1010	lpub, OSSL_HPKE_MAXSIZE, &lpublen)
1011	!= 1) {
1012	OPENSSL_free(lpub);
1013	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1014	goto err;
1015	}
1016	/* free up old value */
1017	OPENSSL_free(ctx->authpub);
1018	ctx->authpub = lpub;
1019	ctx->authpublen = lpublen;
1020	erv = 1;
1021
1022	err:
1023	EVP_PKEY_free(pubp);
1024	return erv;
1025	}
1026
1027	int OSSL_HPKE_CTX_get_seq(OSSL_HPKE_CTX ctx, uint64_t seq)
1028	{
1029	if (ctx == NULL \|\| seq == NULL) {
1030	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
1031	return 0;
1032	}
1033	*seq = ctx->seq;
1034	return 1;
1035	}
1036
1037	int OSSL_HPKE_CTX_set_seq(OSSL_HPKE_CTX *ctx, uint64_t seq)
1038	{
1039	if (ctx == NULL) {
1040	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
1041	return 0;
1042	}
1043	/*
1044	* We disallow senders from doing this as it's dangerous
1045	* Receivers are ok to use this, as no harm should ensue
1046	* if they go wrong.
1047	*/
1048	if (ctx->role == OSSL_HPKE_ROLE_SENDER) {
1049	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1050	return 0;
1051	}
1052	ctx->seq = seq;
1053	return 1;
1054	}
1055
1056	int OSSL_HPKE_encap(OSSL_HPKE_CTX *ctx,
1057	unsigned char enc, size_t enclen,
1058	const unsigned char *pub, size_t publen,
1059	const unsigned char *info, size_t infolen)
1060	{
1061	int erv = 1;
1062	size_t minenc = 0;
1063
1064	if (ctx == NULL \|\| enc == NULL \|\| enclen == NULL \|\| *enclen == 0
1065	\|\| pub == NULL \|\| publen == 0) {
1066	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1067	return 0;
1068	}
1069	if (ctx->role != OSSL_HPKE_ROLE_SENDER) {
1070	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1071	return 0;
1072	}
1073	if (infolen > OSSL_HPKE_MAX_INFOLEN) {
1074	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1075	return 0;
1076	}
1077	if (infolen > 0 && info == NULL) {
1078	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1079	return 0;
1080	}
1081	minenc = OSSL_HPKE_get_public_encap_size(ctx->suite);
1082	if (minenc == 0 \|\| minenc > *enclen) {
1083	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1084	return 0;
1085	}
1086	if (ctx->shared_secret != NULL) {
1087	/* only allow one encap per OSSL_HPKE_CTX */
1088	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1089	return 0;
1090	}
1091	if (hpke_encap(ctx, enc, enclen, pub, publen) != 1) {
1092	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1093	return 0;
1094	}
1095	/*
1096	* note that the info is not part of the context as it
1097	* only needs to be used once here so doesn't need to
1098	* be stored
1099	*/
1100	erv = hpke_do_middle(ctx, info, infolen);
1101	return erv;
1102	}
1103
1104	int OSSL_HPKE_decap(OSSL_HPKE_CTX *ctx,
1105	const unsigned char *enc, size_t enclen,
1106	EVP_PKEY *recippriv,
1107	const unsigned char *info, size_t infolen)
1108	{
1109	int erv = 1;
1110	size_t minenc = 0;
1111
1112	if (ctx == NULL \|\| enc == NULL \|\| enclen == 0 \|\| recippriv == NULL) {
1113	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1114	return 0;
1115	}
1116	if (ctx->role != OSSL_HPKE_ROLE_RECEIVER) {
1117	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1118	return 0;
1119	}
1120	if (infolen > OSSL_HPKE_MAX_INFOLEN) {
1121	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1122	return 0;
1123	}
1124	if (infolen > 0 && info == NULL) {
1125	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1126	return 0;
1127	}
1128	minenc = OSSL_HPKE_get_public_encap_size(ctx->suite);
1129	if (minenc == 0 \|\| minenc > enclen) {
1130	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1131	return 0;
1132	}
1133	if (ctx->shared_secret != NULL) {
1134	/* only allow one encap per OSSL_HPKE_CTX */
1135	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1136	return 0;
1137	}
1138	erv = hpke_decap(ctx, enc, enclen, recippriv);
1139	if (erv != 1) {
1140	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1141	return 0;
1142	}
1143	/*
1144	* note that the info is not part of the context as it
1145	* only needs to be used once here so doesn't need to
1146	* be stored
1147	*/
1148	erv = hpke_do_middle(ctx, info, infolen);
1149	return erv;
1150	}
1151
1152	int OSSL_HPKE_seal(OSSL_HPKE_CTX *ctx,
1153	unsigned char ct, size_t ctlen,
1154	const unsigned char *aad, size_t aadlen,
1155	const unsigned char *pt, size_t ptlen)
1156	{
1157	unsigned char seqbuf[OSSL_HPKE_MAX_NONCELEN];
1158	size_t seqlen = 0;
1159
1160	if (ctx == NULL \|\| ct == NULL \|\| ctlen == NULL \|\| *ctlen == 0
1161	\|\| pt == NULL \|\| ptlen == 0) {
1162	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1163	return 0;
1164	}
1165	if (ctx->role != OSSL_HPKE_ROLE_SENDER) {
1166	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1167	return 0;
1168	}
1169	if ((ctx->seq + 1) == 0) { /* wrap around imminent !!! */
1170	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1171	return 0;
1172	}
1173	if (ctx->key == NULL \|\| ctx->nonce == NULL) {
1174	/* need to have done an encap first, info can be NULL */
1175	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1176	return 0;
1177	}
1178	seqlen = hpke_seqnonce2buf(ctx, seqbuf, sizeof(seqbuf));
1179	if (seqlen == 0) {
1180	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1181	return 0;
1182	}
1183	if (hpke_aead_enc(ctx, seqbuf, aad, aadlen, pt, ptlen, ct, ctlen) != 1) {
1184	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1185	OPENSSL_cleanse(seqbuf, sizeof(seqbuf));
1186	return 0;
1187	} else {
1188	ctx->seq++;
1189	}
1190	OPENSSL_cleanse(seqbuf, sizeof(seqbuf));
1191	return 1;
1192	}
1193
1194	int OSSL_HPKE_open(OSSL_HPKE_CTX *ctx,
1195	unsigned char pt, size_t ptlen,
1196	const unsigned char *aad, size_t aadlen,
1197	const unsigned char *ct, size_t ctlen)
1198	{
1199	unsigned char seqbuf[OSSL_HPKE_MAX_NONCELEN];
1200	size_t seqlen = 0;
1201
1202	if (ctx == NULL \|\| pt == NULL \|\| ptlen == NULL \|\| *ptlen == 0
1203	\|\| ct == NULL \|\| ctlen == 0) {
1204	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1205	return 0;
1206	}
1207	if (ctx->role != OSSL_HPKE_ROLE_RECEIVER) {
1208	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1209	return 0;
1210	}
1211	if ((ctx->seq + 1) == 0) { /* wrap around imminent !!! */
1212	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1213	return 0;
1214	}
1215	if (ctx->key == NULL \|\| ctx->nonce == NULL) {
1216	/* need to have done an encap first, info can be NULL */
1217	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1218	return 0;
1219	}
1220	seqlen = hpke_seqnonce2buf(ctx, seqbuf, sizeof(seqbuf));
1221	if (seqlen == 0) {
1222	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1223	return 0;
1224	}
1225	if (hpke_aead_dec(ctx, seqbuf, aad, aadlen, ct, ctlen, pt, ptlen) != 1) {
1226	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1227	OPENSSL_cleanse(seqbuf, sizeof(seqbuf));
1228	return 0;
1229	}
1230	ctx->seq++;
1231	OPENSSL_cleanse(seqbuf, sizeof(seqbuf));
1232	return 1;
1233	}
1234
1235	int OSSL_HPKE_export(OSSL_HPKE_CTX *ctx,
1236	unsigned char *secret, size_t secretlen,
1237	const unsigned char *label, size_t labellen)
1238	{
1239	int erv = 0;
1240	EVP_KDF_CTX *kctx = NULL;
1241	unsigned char suitebuf[6];
1242	const char *mdname = NULL;
1243	const OSSL_HPKE_KDF_INFO *kdf_info = NULL;
1244
1245	if (ctx == NULL \|\| secret == NULL \|\| secretlen == 0) {
1246	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1247	return 0;
1248	}
1249	if (labellen > OSSL_HPKE_MAX_PARMLEN) {
1250	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1251	return 0;
1252	}
1253	if (labellen > 0 && label == NULL) {
1254	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1255	return 0;
1256	}
1257	if (ctx->exportersec == NULL) {
1258	ERR_raise(ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1259	return 0;
1260	}
1261	kdf_info = ossl_HPKE_KDF_INFO_find_id(ctx->suite.kdf_id);
1262	if (kdf_info == NULL) {
1263	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1264	return 0;
1265	}
1266	mdname = kdf_info->mdname;
1267	kctx = ossl_kdf_ctx_create("HKDF", mdname, ctx->libctx, ctx->propq);
1268	if (kctx == NULL) {
1269	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1270	return 0;
1271	}
1272	/* full suiteid as per RFC9180 sec 5.3 */
1273	suitebuf[0] = ctx->suite.kem_id / 256;
1274	suitebuf[1] = ctx->suite.kem_id % 256;
1275	suitebuf[2] = ctx->suite.kdf_id / 256;
1276	suitebuf[3] = ctx->suite.kdf_id % 256;
1277	suitebuf[4] = ctx->suite.aead_id / 256;
1278	suitebuf[5] = ctx->suite.aead_id % 256;
1279	erv = ossl_hpke_labeled_expand(kctx, secret, secretlen,
1280	ctx->exportersec, ctx->exporterseclen,
1281	OSSL_HPKE_SEC51LABEL,
1282	suitebuf, sizeof(suitebuf),
1283	OSSL_HPKE_EXP_SEC_LABEL,
1284	label, labellen);
1285	EVP_KDF_CTX_free(kctx);
1286	if (erv != 1)
1287	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1288	return erv;
1289	}
1290
1291	int OSSL_HPKE_keygen(OSSL_HPKE_SUITE suite,
1292	unsigned char pub, size_t publen, EVP_PKEY **priv,
1293	const unsigned char *ikm, size_t ikmlen,
1294	OSSL_LIB_CTX libctx, const char propq)
1295	{
1296	int erv = 0; /* Our error return value - 1 is success */
1297	EVP_PKEY_CTX *pctx = NULL;
1298	EVP_PKEY *skR = NULL;
1299	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
1300	OSSL_PARAM params[3], *p = params;
1301
1302	if (pub == NULL \|\| publen == NULL \|\| *publen == 0 \|\| priv == NULL) {
1303	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1304	return 0;
1305	}
1306	if (hpke_suite_check(suite, &kem_info, NULL, NULL) != 1) {
1307	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1308	return 0;
1309	}
1310	if ((ikmlen > 0 && ikm == NULL)
1311	\|\| (ikmlen == 0 && ikm != NULL)
1312	\|\| ikmlen > OSSL_HPKE_MAX_PARMLEN) {
1313	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1314	return 0;
1315	}
1316
1317	if (hpke_kem_id_nist_curve(suite.kem_id) == 1) {
1318	*p++ = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
1319	(char *)kem_info->groupname, 0);
1320	pctx = EVP_PKEY_CTX_new_from_name(libctx, "EC", propq);
1321	} else {
1322	pctx = EVP_PKEY_CTX_new_from_name(libctx, kem_info->keytype, propq);
1323	}
1324	if (pctx == NULL
1325	\|\| EVP_PKEY_keygen_init(pctx) <= 0) {
1326	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1327	goto err;
1328	}
1329	if (ikm != NULL)
1330	*p++ = OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_DHKEM_IKM,
1331	(char *)ikm, ikmlen);
1332	*p = OSSL_PARAM_construct_end();
1333	if (EVP_PKEY_CTX_set_params(pctx, params) <= 0) {
1334	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1335	goto err;
1336	}
1337	if (EVP_PKEY_generate(pctx, &skR) <= 0) {
1338	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1339	goto err;
1340	}
1341	EVP_PKEY_CTX_free(pctx);
1342	pctx = NULL;
1343	if (EVP_PKEY_get_octet_string_param(skR, OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
1344	pub, *publen, publen) != 1) {
1345	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1346	goto err;
1347	}
1348	*priv = skR;
1349	erv = 1;
1350
1351	err:
1352	if (erv != 1)
1353	EVP_PKEY_free(skR);
1354	EVP_PKEY_CTX_free(pctx);
1355	return erv;
1356	}
1357
1358	int OSSL_HPKE_suite_check(OSSL_HPKE_SUITE suite)
1359	{
1360	return hpke_suite_check(suite, NULL, NULL, NULL);
1361	}
1362
1363	int OSSL_HPKE_get_grease_value(const OSSL_HPKE_SUITE *suite_in,
1364	OSSL_HPKE_SUITE *suite,
1365	unsigned char enc, size_t enclen,
1366	unsigned char *ct, size_t ctlen,
1367	OSSL_LIB_CTX libctx, const char propq)
1368	{
1369	OSSL_HPKE_SUITE chosen;
1370	size_t plen = 0;
1371	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
1372	const OSSL_HPKE_AEAD_INFO *aead_info = NULL;
1373	EVP_PKEY *fakepriv = NULL;
1374
1375	if (enc == NULL \|\| enclen == 0
1376	\|\| ct == NULL \|\| ctlen == 0 \|\| suite == NULL) {
1377	ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT);
1378	return 0;
1379	}
1380	if (suite_in == NULL) {
1381	/* choose a random suite */
1382	if (hpke_random_suite(libctx, propq, &chosen) != 1) {
1383	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1384	goto err;
1385	}
1386	} else {
1387	chosen = *suite_in;
1388	}
1389	if (hpke_suite_check(chosen, &kem_info, NULL, &aead_info) != 1) {
1390	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1391	goto err;
1392	}
1393	*suite = chosen;
1394	/* make sure room for tag and one plaintext octet */
1395	if (aead_info->taglen >= ctlen) {
1396	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1397	goto err;
1398	}
1399	/* publen */
1400	plen = kem_info->Npk;
1401	if (plen > *enclen) {
1402	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1403	goto err;
1404	}
1405	/*
1406	* In order for our enc to look good for sure, we generate and then
1407	* delete a real key for that curve - bit OTT but it ensures we do
1408	* get the encoding right (e.g. 0x04 as 1st octet for NIST curves in
1409	* uncompressed form) and that the value really does map to a point on
1410	* the relevant curve.
1411	*/
1412	if (OSSL_HPKE_keygen(chosen, enc, enclen, &fakepriv, NULL, 0,
1413	libctx, propq) != 1) {
1414	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1415	goto err;
1416	}
1417	EVP_PKEY_free(fakepriv);
1418	if (RAND_bytes_ex(libctx, ct, ctlen, 0) <= 0) {
1419	ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
1420	goto err;
1421	}
1422	return 1;
1423	err:
1424	return 0;
1425	}
1426
1427	int OSSL_HPKE_str2suite(const char str, OSSL_HPKE_SUITE suite)
1428	{
1429	return ossl_hpke_str2suite(str, suite);
1430	}
1431
1432	size_t OSSL_HPKE_get_ciphertext_size(OSSL_HPKE_SUITE suite, size_t clearlen)
1433	{
1434	size_t enclen = 0;
1435	size_t cipherlen = 0;
1436
1437	if (hpke_expansion(suite, &enclen, clearlen, &cipherlen) != 1)
1438	return 0;
1439	return cipherlen;
1440	}
1441
1442	size_t OSSL_HPKE_get_public_encap_size(OSSL_HPKE_SUITE suite)
1443	{
1444	size_t enclen = 0;
1445	size_t cipherlen = 0;
1446	size_t clearlen = 16;
1447
1448	if (hpke_expansion(suite, &enclen, clearlen, &cipherlen) != 1)
1449	return 0;
1450	return enclen;
1451	}
1452
1453	size_t OSSL_HPKE_get_recommended_ikmelen(OSSL_HPKE_SUITE suite)
1454	{
1455	const OSSL_HPKE_KEM_INFO *kem_info = NULL;
1456
1457	if (hpke_suite_check(suite, &kem_info, NULL, NULL) != 1)
1458	return 0;
1459	if (kem_info == NULL)
1460	return 0;
1461
1462	return kem_info->Nsk;
1463	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.3.1/crypto/hpke/hpke.c@ 105970

Download in other formats: