external/boringssl: bump revision.

This change bumps the BoringSSL revision to the current tip-of-tree.

Change-Id: I91d5bf467e16e8d86cb19a4de873985f524e5faa

3 files changed, 410 insertions, 0 deletions

diff --git a/src/crypto/cmac/CMakeLists.txt b/src/crypto/cmac/CMakeLists.txt
new file mode 100644
index 0000000..8ebd80c
--- /dev/null
+++ b/src/crypto/cmac/CMakeLists.txt
@@ -0,0 +1,17 @@
+include_directories(. .. ../../include)
+
+add_library(
+  cmac
+
+  OBJECT
+
+  cmac.c
+)
+
+add_executable(
+  cmac_test
+
+  cmac_test.cc
+)
+
+target_link_libraries(cmac_test crypto)
diff --git a/src/crypto/cmac/cmac.c b/src/crypto/cmac/cmac.c
new file mode 100644
index 0000000..fa4c3c4
--- /dev/null
+++ b/src/crypto/cmac/cmac.c
@@ -0,0 +1,239 @@
+/* ====================================================================
+ * Copyright (c) 2010 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ==================================================================== */
+
+#include <openssl/cmac.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/aes.h>
+#include <openssl/cipher.h>
+#include <openssl/mem.h>
+
+
+struct cmac_ctx_st {
+  EVP_CIPHER_CTX cipher_ctx;
+  /* k1 and k2 are the CMAC subkeys. See
+   * https://tools.ietf.org/html/rfc4493#section-2.3 */
+  uint8_t k1[AES_BLOCK_SIZE];
+  uint8_t k2[AES_BLOCK_SIZE];
+  /* Last (possibly partial) scratch */
+  uint8_t block[AES_BLOCK_SIZE];
+  /* block_used contains the number of valid bytes in |block|. */
+  unsigned block_used;
+};
+
+static void CMAC_CTX_init(CMAC_CTX *ctx) {
+  EVP_CIPHER_CTX_init(&ctx->cipher_ctx);
+}
+
+static void CMAC_CTX_cleanup(CMAC_CTX *ctx) {
+  EVP_CIPHER_CTX_cleanup(&ctx->cipher_ctx);
+  OPENSSL_cleanse(ctx->k1, sizeof(ctx->k1));
+  OPENSSL_cleanse(ctx->k2, sizeof(ctx->k2));
+  OPENSSL_cleanse(ctx->block, sizeof(ctx->block));
+}
+
+int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
+             const uint8_t *in, size_t in_len) {
+  const EVP_CIPHER *cipher;
+  switch (key_len) {
+    case 16:
+      cipher = EVP_aes_128_cbc();
+      break;
+    case 32:
+      cipher = EVP_aes_256_cbc();
+      break;
+    default:
+      return 0;
+  }
+
+  size_t scratch_out_len;
+  CMAC_CTX ctx;
+  CMAC_CTX_init(&ctx);
+
+  const int ok = CMAC_Init(&ctx, key, key_len, cipher, NULL /* engine */) &&
+                 CMAC_Update(&ctx, in, in_len) &&
+                 CMAC_Final(&ctx, out, &scratch_out_len);
+
+  CMAC_CTX_cleanup(&ctx);
+  return ok;
+}
+
+CMAC_CTX *CMAC_CTX_new(void) {
+  CMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
+  if (ctx != NULL) {
+    CMAC_CTX_init(ctx);
+  }
+  return ctx;
+}
+
+void CMAC_CTX_free(CMAC_CTX *ctx) {
+  if (ctx == NULL) {
+    return;
+  }
+
+  CMAC_CTX_cleanup(ctx);
+  OPENSSL_free(ctx);
+}
+
+/* binary_field_mul_x treats the 128 bits at |in| as an element of GF(2¹²⁸)
+ * with a hard-coded reduction polynomial and sets |out| as x times the
+ * input.
+ *
+ * See https://tools.ietf.org/html/rfc4493#section-2.3 */
+static void binary_field_mul_x(uint8_t out[16], const uint8_t in[16]) {
+  unsigned i;
+
+  /* Shift |in| to left, including carry. */
+  for (i = 0; i < 15; i++) {
+    out[i] = (in[i] << 1) | (in[i+1] >> 7);
+  }
+
+  /* If MSB set fixup with R. */
+  const uint8_t carry = in[0] >> 7;
+  out[i] = (in[i] << 1) ^ ((0 - carry) & 0x87);
+}
+
+static const uint8_t kZeroIV[AES_BLOCK_SIZE] = {0};
+
+int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
+              const EVP_CIPHER *cipher, ENGINE *engine) {
+  uint8_t scratch[AES_BLOCK_SIZE];
+
+  if (EVP_CIPHER_block_size(cipher) != AES_BLOCK_SIZE ||
+      EVP_CIPHER_key_length(cipher) != key_len ||
+      !EVP_EncryptInit_ex(&ctx->cipher_ctx, cipher, NULL, key, kZeroIV) ||
+      !EVP_Cipher(&ctx->cipher_ctx, scratch, kZeroIV, AES_BLOCK_SIZE) ||
+      /* Reset context again ready for first data. */
+      !EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV)) {
+    return 0;
+  }
+
+  binary_field_mul_x(ctx->k1, scratch);
+  binary_field_mul_x(ctx->k2, ctx->k1);
+  ctx->block_used = 0;
+
+  return 1;
+}
+
+int CMAC_Reset(CMAC_CTX *ctx) {
+  ctx->block_used = 0;
+  return EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV);
+}
+
+int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len) {
+  uint8_t scratch[AES_BLOCK_SIZE];
+
+  if (ctx->block_used > 0) {
+    size_t todo = AES_BLOCK_SIZE - ctx->block_used;
+    if (in_len < todo) {
+      todo = in_len;
+    }
+
+    memcpy(ctx->block + ctx->block_used, in, todo);
+    in += todo;
+    in_len -= todo;
+    ctx->block_used += todo;
+
+    /* If |in_len| is zero then either |ctx->block_used| is less than
+     * |AES_BLOCK_SIZE|, in which case we can stop here, or |ctx->block_used|
+     * is exactly |AES_BLOCK_SIZE| but there's no more data to process. In the
+     * latter case we don't want to process this block now because it might be
+     * the last block and that block is treated specially. */
+    if (in_len == 0) {
+      return 1;
+    }
+
+    assert(ctx->block_used == AES_BLOCK_SIZE);
+
+    if (!EVP_Cipher(&ctx->cipher_ctx, scratch, ctx->block, AES_BLOCK_SIZE)) {
+      return 0;
+    }
+  }
+
+  /* Encrypt all but one of the remaining blocks. */
+  while (in_len > AES_BLOCK_SIZE) {
+    if (!EVP_Cipher(&ctx->cipher_ctx, scratch, in, AES_BLOCK_SIZE)) {
+      return 0;
+    }
+    in += AES_BLOCK_SIZE;
+    in_len -= AES_BLOCK_SIZE;
+  }
+
+  memcpy(ctx->block, in, in_len);
+  ctx->block_used = in_len;
+
+  return 1;
+}
+
+int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len) {
+  *out_len = AES_BLOCK_SIZE;
+  if (out == NULL) {
+    return 1;
+  }
+
+  const uint8_t *mask = ctx->k1;
+
+  if (ctx->block_used != AES_BLOCK_SIZE) {
+    /* If the last block is incomplete, terminate it with a single 'one' bit
+     * followed by zeros. */
+    ctx->block[ctx->block_used] = 0x80;
+    memset(ctx->block + ctx->block_used + 1, 0,
+           AES_BLOCK_SIZE - (ctx->block_used + 1));
+
+    mask = ctx->k2;
+  }
+
+  unsigned i;
+  for (i = 0; i < AES_BLOCK_SIZE; i++) {
+    out[i] = ctx->block[i] ^ mask[i];
+  }
+
+  return EVP_Cipher(&ctx->cipher_ctx, out, out, AES_BLOCK_SIZE);
+}
diff --git a/src/crypto/cmac/cmac_test.cc b/src/crypto/cmac/cmac_test.cc
new file mode 100644
index 0000000..0f06860
--- /dev/null
+++ b/src/crypto/cmac/cmac_test.cc
@@ -0,0 +1,154 @@
+/* Copyright (c) 2015, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <stdio.h>
+
+#include <algorithm>
+
+#include <openssl/cmac.h>
+
+#include "../test/scoped_types.h"
+
+
+static void dump(const uint8_t *got, const uint8_t *expected, size_t len) {
+  ScopedBIO bio(BIO_new_fp(stderr, 0 /* don't close */));
+
+  BIO_puts(bio.get(), "\nGot:\n");
+  BIO_hexdump(bio.get(), got, len, 2 /* indent */);
+  BIO_puts(bio.get(), "Expected:\n");
+  BIO_hexdump(bio.get(), expected, len, 2 /* indent */);
+  BIO_flush(bio.get());
+}
+
+static int test(const char *name, const uint8_t *key, size_t key_len,
+                const uint8_t *msg, size_t msg_len, const uint8_t *expected) {
+  uint8_t out[16];
+
+  if (!AES_CMAC(out, key, key_len, msg, msg_len)) {
+    fprintf(stderr, "%s: AES_CMAC failed\n", name);
+    return 0;
+  }
+
+  if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
+    fprintf(stderr, "%s: CMAC result differs:\n", name);
+    dump(out, expected, sizeof(out));
+    return 0;
+  }
+
+  ScopedCMAC_CTX ctx(CMAC_CTX_new());
+  if (!CMAC_Init(ctx.get(), key, key_len, EVP_aes_128_cbc(), NULL)) {
+    fprintf(stderr, "%s: CMAC_Init failed.\n", name);
+    return 0;
+  }
+
+  for (unsigned chunk_size = 1; chunk_size <= msg_len; chunk_size++) {
+    if (!CMAC_Reset(ctx.get())) {
+      fprintf(stderr, "%s/%u: CMAC_Reset failed.\n", name, chunk_size);
+      return 0;
+    }
+
+    size_t done = 0;
+    while (done < msg_len) {
+      size_t todo = std::min(msg_len - done, static_cast<size_t>(chunk_size));
+      if (!CMAC_Update(ctx.get(), msg + done, todo)) {
+        fprintf(stderr, "%s/%u: CMAC_Update failed.\n", name, chunk_size);
+        return 0;
+      }
+
+      done += todo;
+    }
+
+    size_t out_len;
+    if (!CMAC_Final(ctx.get(), out, &out_len)) {
+      fprintf(stderr, "%s/%u: CMAC_Final failed.\n", name, chunk_size);
+      return 0;
+    }
+
+    if (out_len != sizeof(out)) {
+      fprintf(stderr, "%s/%u: incorrect out_len: %u.\n", name, chunk_size,
+              static_cast<unsigned>(out_len));
+      return 0;
+    }
+
+    if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
+      fprintf(stderr, "%s/%u: CMAC result differs:\n", name, chunk_size);
+      dump(out, expected, sizeof(out));
+      return 0;
+    }
+  }
+
+  return 1;
+}
+
+static int rfc_4493_test_vectors(void) {
+  static const uint8_t kKey[16] = {
+      0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
+      0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c,
+  };
+  static const uint8_t kOut1[16] = {
+      0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
+      0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46,
+  };
+  static const uint8_t kMsg2[] = {
+      0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+      0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+  };
+  static const uint8_t kOut2[16] = {
+      0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
+      0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c,
+  };
+  static const uint8_t kMsg3[] = {
+      0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+      0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+      0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
+      0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
+      0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
+  };
+  static const uint8_t kOut3[16] = {
+      0xdf, 0xa6, 0x67, 0x47, 0xde, 0x9a, 0xe6, 0x30,
+      0x30, 0xca, 0x32, 0x61, 0x14, 0x97, 0xc8, 0x27,
+  };
+  static const uint8_t kMsg4[] = {
+      0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+      0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+      0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
+      0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
+      0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
+      0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
+      0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
+      0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10,
+  };
+  static const uint8_t kOut4[16] = {
+      0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
+      0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe,
+  };
+
+  if (!test("RFC 4493 #1", kKey, sizeof(kKey), NULL, 0, kOut1) ||
+      !test("RFC 4493 #2", kKey, sizeof(kKey), kMsg2, sizeof(kMsg2), kOut2) ||
+      !test("RFC 4493 #3", kKey, sizeof(kKey), kMsg3, sizeof(kMsg3), kOut3) ||
+      !test("RFC 4493 #4", kKey, sizeof(kKey), kMsg4, sizeof(kMsg4), kOut4)) {
+    return 0;
+  }
+
+  return 1;
+}
+
+int main(int argc, char **argv) {
+  if (!rfc_4493_test_vectors()) {
+    return 1;
+  }
+
+  printf("PASS\n");
+  return 0;
+}