Codebase list openssl / 86258d4
Add EVP demo for Poly1305 demonstrating Poly1305-AES Fixes #14122. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17796) (cherry picked from commit 3dafeacef8d7bf82e462cc52659681108db42e43) Hugo Landau authored 2 years ago Pauli committed 2 years ago
3 changed file(s) with 233 addition(s) and 0 deletion(s). Raw diff Collapse all Expand all
+1
-0
demos/README.txt less more
2626
2727 mac:
2828 gmac.c Demonstration of GMAC message authentication
29 poly1305.c Demonstration of Poly1305-AES message authentication
2930
3031 pkey:
3132 EVP_PKEY_EC_keygen.c Generate an EC key.
+23
-0
demos/mac/Makefile less more
0 # Quick instruction:
1 # To build against an OpenSSL built in the source tree, do this:
2 #
3 # make OPENSSL_INCS_LOCATION=-I../../include OPENSSL_LIBS_LOCATION=-L../..
4 #
5 # To run the demos when linked with a shared library (default):
6 #
7 # LD_LIBRARY_PATH=../.. ./gmac
8 # LD_LIBRARY_PATH=../.. ./poly1305
9
10 CFLAGS = $(OPENSSL_INCS_LOCATION) -Wall
11 LDFLAGS = $(OPENSSL_LIBS_LOCATION) -lssl -lcrypto
12
13 all: gmac poly1305
14
15 gmac: gmac.o
16 poly1305: poly1305.o
17
18 gmac poly1305:
19 $(CC) $(CFLAGS) -o $@ $< $(LDFLAGS)
20
21 clean:
22 $(RM) gmac poly1305 *.o
+209
-0
demos/mac/poly1305.c less more
0 /*
1 * Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
2 *
3 * Licensed under the Apache License 2.0 (the "License"). You may not use
4 * this file except in compliance with the License. You can obtain a copy
5 * in the file LICENSE in the source distribution or at
6 * https://www.openssl.org/source/license.html
7 */
8
9 #include <stdio.h>
10 #include <stdlib.h>
11 #include <string.h>
12 #include <openssl/core_names.h>
13 #include <openssl/evp.h>
14 #include <openssl/params.h>
15 #include <openssl/err.h>
16
17 /*
18 * This is a demonstration of how to compute Poly1305-AES using the OpenSSL
19 * Poly1305 and AES providers and the EVP API.
20 *
21 * Please note that:
22 *
23 * - Poly1305 must never be used alone and must be used in conjunction with
24 * another primitive which processes the input nonce to be secure;
25 *
26 * - you must never pass a nonce to the Poly1305 primitive directly;
27 *
28 * - Poly1305 exhibits catastrophic failure (that is, can be broken) if a
29 * nonce is ever reused for a given key.
30 *
31 * If you are looking for a general purpose MAC, you should consider using a
32 * different MAC and looking at one of the other examples, unless you have a
33 * good familiarity with the details and caveats of Poly1305.
34 *
35 * This example uses AES, as described in the original paper, "The Poly1305-AES
36 * message authentication code":
37 * https://cr.yp.to/mac/poly1305-20050329.pdf
38 *
39 * The test vectors below are from that paper.
40 */
41
42 /*
43 * Hard coding the key into an application is very bad.
44 * It is done here solely for educational purposes.
45 * These are the "r" and "k" inputs to Poly1305-AES.
46 */
47 static const unsigned char test_r[] = {
48 0x85, 0x1f, 0xc4, 0x0c, 0x34, 0x67, 0xac, 0x0b,
49 0xe0, 0x5c, 0xc2, 0x04, 0x04, 0xf3, 0xf7, 0x00
50 };
51
52 static const unsigned char test_k[] = {
53 0xec, 0x07, 0x4c, 0x83, 0x55, 0x80, 0x74, 0x17,
54 0x01, 0x42, 0x5b, 0x62, 0x32, 0x35, 0xad, 0xd6
55 };
56
57 /*
58 * Hard coding a nonce must not be done under any circumstances and is done here
59 * purely for demonstration purposes. Please note that Poly1305 exhibits
60 * catastrophic failure (that is, can be broken) if a nonce is ever reused for a
61 * given key.
62 */
63 static const unsigned char test_n[] = {
64 0xfb, 0x44, 0x73, 0x50, 0xc4, 0xe8, 0x68, 0xc5,
65 0x2a, 0xc3, 0x27, 0x5c, 0xf9, 0xd4, 0x32, 0x7e
66 };
67
68 /* Input message. */
69 static const unsigned char test_m[] = {
70 0xf3, 0xf6
71 };
72
73 static const unsigned char expected_output[] = {
74 0xf4, 0xc6, 0x33, 0xc3, 0x04, 0x4f, 0xc1, 0x45,
75 0xf8, 0x4f, 0x33, 0x5c, 0xb8, 0x19, 0x53, 0xde
76 };
77
78 /*
79 * A property query used for selecting the POLY1305 implementation.
80 */
81 static char *propq = NULL;
82
83 int main(int argc, char **argv)
84 {
85 int rv = EXIT_FAILURE;
86 EVP_CIPHER *aes = NULL;
87 EVP_CIPHER_CTX *aesctx = NULL;
88 EVP_MAC *mac = NULL;
89 EVP_MAC_CTX *mctx = NULL;
90 unsigned char composite_key[32];
91 unsigned char out[16];
92 OSSL_LIB_CTX *library_context = NULL;
93 size_t out_len = 0;
94 int aes_len = 0;
95
96 library_context = OSSL_LIB_CTX_new();
97 if (library_context == NULL) {
98 fprintf(stderr, "OSSL_LIB_CTX_new() returned NULL\n");
99 goto end;
100 }
101
102 /* Fetch the Poly1305 implementation */
103 mac = EVP_MAC_fetch(library_context, "POLY1305", propq);
104 if (mac == NULL) {
105 fprintf(stderr, "EVP_MAC_fetch() returned NULL\n");
106 goto end;
107 }
108
109 /* Create a context for the Poly1305 operation */
110 mctx = EVP_MAC_CTX_new(mac);
111 if (mctx == NULL) {
112 fprintf(stderr, "EVP_MAC_CTX_new() returned NULL\n");
113 goto end;
114 }
115
116 /* Fetch the AES implementation */
117 aes = EVP_CIPHER_fetch(library_context, "AES-128-ECB", propq);
118 if (aes == NULL) {
119 fprintf(stderr, "EVP_CIPHER_fetch() returned NULL\n");
120 goto end;
121 }
122
123 /* Create a context for AES */
124 aesctx = EVP_CIPHER_CTX_new();
125 if (aesctx == NULL) {
126 fprintf(stderr, "EVP_CIPHER_CTX_new() returned NULL\n");
127 goto end;
128 }
129
130 /* Initialize the AES cipher with the 128-bit key k */
131 if (!EVP_EncryptInit_ex(aesctx, aes, NULL, test_k, NULL)) {
132 fprintf(stderr, "EVP_EncryptInit_ex() failed\n");
133 goto end;
134 }
135
136 /*
137 * Disable padding for the AES cipher. We do not strictly need to do this as
138 * we are encrypting a single block and thus there are no alignment or
139 * padding concerns, but this ensures that the operation below fails if
140 * padding would be required for some reason, which in this circumstance
141 * would indicate an implementation bug.
142 */
143 if (!EVP_CIPHER_CTX_set_padding(aesctx, 0)) {
144 fprintf(stderr, "EVP_CIPHER_CTX_set_padding() failed\n");
145 goto end;
146 }
147
148 /*
149 * Computes the value AES_k(n) which we need for our Poly1305-AES
150 * computation below.
151 */
152 if (!EVP_EncryptUpdate(aesctx, composite_key + 16, &aes_len,
153 test_n, sizeof(test_n))) {
154 fprintf(stderr, "EVP_EncryptUpdate() failed\n");
155 goto end;
156 }
157
158 /*
159 * The Poly1305 provider expects the key r to be passed as the first 16
160 * bytes of the "key" and the processed nonce (that is, AES_k(n)) to be
161 * passed as the second 16 bytes of the "key". We already put the processed
162 * nonce in the correct place above, so copy r into place.
163 */
164 memcpy(composite_key, test_r, 16);
165
166 /* Initialise the Poly1305 operation */
167 if (!EVP_MAC_init(mctx, composite_key, sizeof(composite_key), NULL)) {
168 fprintf(stderr, "EVP_MAC_init() failed\n");
169 goto end;
170 }
171
172 /* Make one or more calls to process the data to be authenticated */
173 if (!EVP_MAC_update(mctx, test_m, sizeof(test_m))) {
174 fprintf(stderr, "EVP_MAC_update() failed\n");
175 goto end;
176 }
177
178 /* Make one call to the final to get the MAC */
179 if (!EVP_MAC_final(mctx, out, &out_len, sizeof(out))) {
180 fprintf(stderr, "EVP_MAC_final() failed\n");
181 goto end;
182 }
183
184 printf("Generated MAC:\n");
185 BIO_dump_indent_fp(stdout, out, out_len, 2);
186 putchar('\n');
187
188 if (out_len != sizeof(expected_output)) {
189 fprintf(stderr, "Generated MAC has an unexpected length\n");
190 goto end;
191 }
192
193 if (CRYPTO_memcmp(expected_output, out, sizeof(expected_output)) != 0) {
194 fprintf(stderr, "Generated MAC does not match expected value\n");
195 goto end;
196 }
197
198 rv = EXIT_SUCCESS;
199 end:
200 EVP_CIPHER_CTX_free(aesctx);
201 EVP_CIPHER_free(aes);
202 EVP_MAC_CTX_free(mctx);
203 EVP_MAC_free(mac);
204 OSSL_LIB_CTX_free(library_context);
205 if (rv != EXIT_SUCCESS)
206 ERR_print_errors_fp(stderr);
207 return rv;
208 }