/*

 * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.

 * Copyright 2019 Red Hat, Inc.

 *

 * Licensed under the Apache License 2.0 (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

/*

 * This implements https://csrc.nist.gov/publications/detail/sp/800-108/final

 * section 5.1 ("counter mode") and section 5.2 ("feedback mode") in both HMAC

 * and CMAC.  That document does not name the KDFs it defines; the name is

 * derived from

 * https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Key-Derivation

 *

 * Note that section 5.3 ("double-pipeline mode") is not implemented, though

 * it would be possible to do so in the future.

 *

 * These versions all assume the counter is used.  It would be relatively

 * straightforward to expose a configuration handle should the need arise.

 *

 * Variable names attempt to match those of SP800-108.

 */

#include <stdarg.h>

#include <stdlib.h>

#include <string.h>

#include <openssl/evp.h>

#include <openssl/hmac.h>

#include <openssl/cmac.h>

#include <openssl/kdf.h>

#include "internal/numbers.h"

#include "internal/cryptlib.h"

#include "crypto/evp.h"

#include "kdf_local.h"

#include "e_os.h"

#ifdef MIN

# undef MIN

#endif

#define MIN(a, b) ((a) < (b)) ? (a) : (b)

typedef struct {

    int mac_type;

    union {

        HMAC_CTX *hmac;

        CMAC_CTX *cmac;

    } m;

} MAC_CTX;

/* Our context structure. */

struct evp_kdf_impl_st {

    int mode;

    MAC_CTX *ctx_init;

    const EVP_CIPHER *cipher;

    const EVP_MD *md;

    /* Names are lowercased versions of those found in SP800-108. */

    unsigned char *ki;

    size_t ki_len;

    unsigned char *label;

    size_t label_len;

    unsigned char *context;

    size_t context_len;

    unsigned char *iv;

    size_t iv_len;

};

static MAC_CTX *EVP_MAC_CTX_new(int mac_type)

{

    MAC_CTX *ctx;

    ctx = OPENSSL_zalloc(sizeof(*ctx));

    if (ctx == NULL)

        return NULL;

    ctx->mac_type = mac_type;

    if (mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

        if ((ctx->m.hmac = HMAC_CTX_new()) == NULL)

            goto err;

    } else {

        if ((ctx->m.cmac = CMAC_CTX_new()) == NULL)

            goto err;

    }

    return ctx;

err:

    OPENSSL_free(ctx);

    return NULL;

}

static void EVP_MAC_CTX_free(MAC_CTX *ctx)

{

    if (ctx == NULL)

        return;

    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC)

        HMAC_CTX_free(ctx->m.hmac);

    else

        CMAC_CTX_free(ctx->m.cmac);

    OPENSSL_free(ctx);

}

static MAC_CTX *EVP_MAC_CTX_dup(MAC_CTX *sctx)

{

    MAC_CTX *ctx;

    ctx = OPENSSL_zalloc(sizeof(*sctx));

    if (ctx == NULL)

        return NULL;

    ctx->mac_type = sctx->mac_type;

    if (sctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

        if ((ctx->m.hmac = HMAC_CTX_new()) == NULL

            || HMAC_CTX_copy(ctx->m.hmac, sctx->m.hmac) <= 0)

            goto err;

    } else {

        if ((ctx->m.cmac = CMAC_CTX_new()) == NULL

            || CMAC_CTX_copy(ctx->m.cmac, sctx->m.cmac) <= 0)

            goto err;

    }

    return ctx;

err:

    EVP_MAC_CTX_free(ctx);

    return NULL;

}

static size_t EVP_MAC_size(MAC_CTX *ctx)

{

    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

        const EVP_MD *md;

        if (ctx->m.hmac == NULL)

            return 0;

        if ((md = HMAC_CTX_get_md(ctx->m.hmac)) == NULL)

            return 0;

        return (size_t)EVP_MD_size(md);

    } else {

        const EVP_CIPHER_CTX *cctx;

        if (ctx->m.cmac == NULL)

            return 0;

        if ((cctx = CMAC_CTX_get0_cipher_ctx(ctx->m.cmac)) == NULL)

            return 0;

        return EVP_CIPHER_CTX_block_size(cctx);

    }

}

static int EVP_MAC_update(MAC_CTX *ctx, const unsigned char *data,

                          size_t datalen)

{

    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC)

        return HMAC_Update(ctx->m.hmac, data, datalen);

    else

        return CMAC_Update(ctx->m.cmac, data, datalen);

}

static int EVP_MAC_final(MAC_CTX *ctx, unsigned char *out,

                         size_t *outl, size_t outsize)

{

    if (outsize != EVP_MAC_size(ctx))

        /* we do not cope with anything else */

        return 0;

    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

        unsigned int intsize = (unsigned int)outsize;

        int ret;

        ret = HMAC_Final(ctx->m.hmac, out, &intsize);

        if (outl != NULL)

            *outl = intsize;

        return ret;

    } else {

        size_t size = outsize;

        int ret;

        ret = CMAC_Final(ctx->m.cmac, out, &size);

        if (outl != NULL)

            *outl = size;

        return ret;

    }

}

static int evp_mac_init(MAC_CTX *ctx, const EVP_MD *md,

                        const EVP_CIPHER *cipher, unsigned char *key, size_t keylen)

{

    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

        if (md == NULL)

            return 0;

        return HMAC_Init_ex(ctx->m.hmac, key, (int)keylen, md, NULL);

    } else {

        if (cipher == NULL)

            return 0;

        return CMAC_Init(ctx->m.cmac, key, keylen, cipher, NULL);

    }

}

static void kbkdf_reset(EVP_KDF_IMPL *ctx);

/* Not all platforms have htobe32(). */

static uint32_t be32(uint32_t host)

{

    uint32_t big = 0;

    const union {

        long one;

        char little;

    } is_endian = { 1 };

    if (!is_endian.little)

        return host;

    big |= (host & 0xff000000) >> 24;

    big |= (host & 0x00ff0000) >> 8;

    big |= (host & 0x0000ff00) << 8;

    big |= (host & 0x000000ff) << 24;

    return big;

}

static EVP_KDF_IMPL *kbkdf_new(void)

{

    EVP_KDF_IMPL *ctx;

    ctx = OPENSSL_zalloc(sizeof(*ctx));

    if (ctx == NULL) {

        KDFerr(KDF_F_KBKDF_NEW, ERR_R_MALLOC_FAILURE);

        return NULL;

    }

    return ctx;

}

static void kbkdf_free(EVP_KDF_IMPL *ctx)

{

    kbkdf_reset(ctx);

    OPENSSL_free(ctx);

}

static void kbkdf_reset(EVP_KDF_IMPL *ctx)

{

    EVP_MAC_CTX_free(ctx->ctx_init);

    OPENSSL_clear_free(ctx->context, ctx->context_len);

    OPENSSL_clear_free(ctx->label, ctx->label_len);

    OPENSSL_clear_free(ctx->ki, ctx->ki_len);

    OPENSSL_clear_free(ctx->iv, ctx->iv_len);

    memset(ctx, 0, sizeof(*ctx));

}

/* SP800-108 section 5.1 or section 5.2 depending on mode. */

static int derive(MAC_CTX *ctx_init, int mode, unsigned char *iv,

                  size_t iv_len, unsigned char *label, size_t label_len,

                  unsigned char *context, size_t context_len,

                  unsigned char *k_i, size_t h, uint32_t l, unsigned char *ko,

                  size_t ko_len)

{

    int ret = 0;

    MAC_CTX *ctx = NULL;

    size_t written = 0, to_write, k_i_len = iv_len;

    const unsigned char zero = 0;

    uint32_t counter, i;

    /* Setup K(0) for feedback mode. */

    if (iv_len > 0)

        memcpy(k_i, iv, iv_len);

    for (counter = 1; written < ko_len; counter++) {

        i = be32(counter);

        ctx = EVP_MAC_CTX_dup(ctx_init);

        if (ctx == NULL)

            goto done;

        /* Perform feedback, if appropriate. */

        if (mode == EVP_KDF_KB_MODE_FEEDBACK && !EVP_MAC_update(ctx, k_i, k_i_len))

            goto done;

        if (!EVP_MAC_update(ctx, (unsigned char *)&i, 4)

            || !EVP_MAC_update(ctx, label, label_len)

            || !EVP_MAC_update(ctx, &zero, 1)

            || !EVP_MAC_update(ctx, context, context_len)

            || !EVP_MAC_update(ctx, (unsigned char *)&l, 4)

            || !EVP_MAC_final(ctx, k_i, NULL, h))

            goto done;

        to_write = ko_len - written;

        memcpy(ko + written, k_i, MIN(to_write, h));

        written += h;

        k_i_len = h;

        EVP_MAC_CTX_free(ctx);

        ctx = NULL;

    }

    ret = 1;

done:

    EVP_MAC_CTX_free(ctx);

    return ret;

}

static int kbkdf_derive(EVP_KDF_IMPL *ctx, unsigned char *key, size_t keylen)

{

    int ret = 0;

    unsigned char *k_i = NULL;

    uint32_t l = be32(keylen * 8);

    size_t h = 0;

    /* label, context, and iv are permitted to be empty.  Check everything

     * else. */

    if (ctx->ctx_init == NULL

        || evp_mac_init(ctx->ctx_init, ctx->md, ctx->cipher, ctx->ki, ctx->ki_len) <= 0) {

        if (ctx->ki_len == 0 || ctx->ki == NULL) {

            KDFerr(KDF_F_KBKDF_DERIVE, KDF_R_MISSING_KEY);

            return 0;

        }

        /* Could either be missing MAC or missing message digest or missing

         * cipher - arbitrarily, I pick this one. */

        KDFerr(KDF_F_KBKDF_DERIVE, KDF_R_MISSING_PARAMETER);

        return 0;

    }

    h = EVP_MAC_size(ctx->ctx_init);

    if (h == 0)

        goto done;

    if (ctx->iv_len != 0 && ctx->iv_len != h) {

        KDFerr(KDF_F_KBKDF_DERIVE, KDF_R_INVALID_SEED_LENGTH);

        goto done;

    }

    k_i = OPENSSL_zalloc(h);

    if (k_i == NULL)

        goto done;

    ret = derive(ctx->ctx_init, ctx->mode, ctx->iv, ctx->iv_len, ctx->label,

                 ctx->label_len, ctx->context, ctx->context_len, k_i, h, l,

                 key, keylen);

done:

    if (ret != 1)

        OPENSSL_cleanse(key, keylen);

    OPENSSL_clear_free(k_i, h);

    return ret;

}

static size_t kbkdf_size(EVP_KDF_IMPL *ctx)

{

    return UINT32_MAX/8;

}

static int kbkdf_parse_buffer_arg(unsigned char **dst, size_t *dst_len,

                                       va_list args)

{

    const unsigned char *p;

    size_t len;

    p = va_arg(args, const unsigned char *);

    len = va_arg(args, size_t);

    OPENSSL_clear_free(*dst, *dst_len);

    if (len == 0) {

        *dst = NULL;

        *dst_len = 0;

        return 1;

    }

    *dst = OPENSSL_memdup(p, len);

    if (*dst == NULL)

        return 0;

    *dst_len = len;

    return 1;

}

static int kbkdf_ctrl(EVP_KDF_IMPL *ctx, int cmd, va_list args)

{

    int t;

    switch (cmd) {

    case EVP_KDF_CTRL_SET_MD:

        ctx->md = va_arg(args, const EVP_MD *);

        if (ctx->md == NULL)

            return 0;

        return 1;

    case EVP_KDF_CTRL_SET_CIPHER:

        ctx->cipher = va_arg(args, const EVP_CIPHER *);

        if (ctx->cipher == NULL)

            return 0;

        return 1;

    case EVP_KDF_CTRL_SET_KEY:

        return kbkdf_parse_buffer_arg(&ctx->ki,

                                      &ctx->ki_len, args);

    case EVP_KDF_CTRL_SET_SALT:

        return kbkdf_parse_buffer_arg(&ctx->label,

                                           &ctx->label_len, args);

    case EVP_KDF_CTRL_SET_KB_INFO:

        return kbkdf_parse_buffer_arg(&ctx->context,

                                           &ctx->context_len, args);

    case EVP_KDF_CTRL_SET_KB_SEED:

        return kbkdf_parse_buffer_arg(&ctx->iv,

                                           &ctx->iv_len, args);

    case EVP_KDF_CTRL_SET_KB_MODE:

        t = va_arg(args, int);

        if (t != EVP_KDF_KB_MODE_COUNTER && t != EVP_KDF_KB_MODE_FEEDBACK ) {

            KDFerr(KDF_F_KBKDF_CTRL, KDF_R_VALUE_ERROR);

            return 0;

        }

        ctx->mode = t;

        return 1;

    case EVP_KDF_CTRL_SET_KB_MAC_TYPE:

        t = va_arg(args, int);

        if (t != EVP_KDF_KB_MAC_TYPE_HMAC && t != EVP_KDF_KB_MAC_TYPE_CMAC ) {

            KDFerr(KDF_F_KBKDF_CTRL, KDF_R_VALUE_ERROR);

            return 0;

        }

        if (ctx->ctx_init != NULL) {

            EVP_MAC_CTX_free(ctx->ctx_init);

        }

        ctx->ctx_init = EVP_MAC_CTX_new(t);

        if (ctx->ctx_init == NULL) {

            KDFerr(KDF_F_KBKDF_CTRL, ERR_R_MALLOC_FAILURE);

            return 0;

        }

        return 1;

    default:

        return -2;

    }

}

static int kbkdf_ctrl_str(EVP_KDF_IMPL *ctx, const char *type,

                               const char *value)

{

    if (value == NULL) {

        KDFerr(KDF_F_KDF_SSHKDF_CTRL_STR, KDF_R_VALUE_MISSING);

        return 0;

    }

    if (strcmp(type, "digest") == 0)

        return kdf_md2ctrl(ctx, kbkdf_ctrl, EVP_KDF_CTRL_SET_MD, value);

    /* alias, for historical reasons */

    if (strcmp(type, "md") == 0)

        return kdf_md2ctrl(ctx, kbkdf_ctrl, EVP_KDF_CTRL_SET_MD, value);

    if (strcmp(type, "cipher") == 0)

        return kdf_cipher2ctrl(ctx, kbkdf_ctrl, EVP_KDF_CTRL_SET_CIPHER, value);

    if (strcmp(type, "key") == 0)

        return kdf_str2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_KEY, value);

    if (strcmp(type, "hexkey") == 0)

        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_KEY, value);

    if (strcmp(type, "salt") == 0)

        return kdf_str2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_SALT, value);

    if (strcmp(type, "hexsalt") == 0)

        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_SALT, value);

    if (strcmp(type, "info") == 0)

        return kdf_str2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_KB_INFO, value);

    if (strcmp(type, "hexinfo") == 0)

        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_KB_INFO, value);

    if (strcmp(type, "seed") == 0)

        return kdf_str2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_KB_SEED, value);

    if (strcmp(type, "hexseed") == 0)

        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

                            EVP_KDF_CTRL_SET_KB_SEED, value);

    if (strcmp(type, "mode") == 0) {

        int mode;

        if (strcasecmp(value, "counter") == 0) {

            mode = EVP_KDF_KB_MODE_COUNTER;

        } else if (strcasecmp(value, "feedback") == 0) {

            mode = EVP_KDF_KB_MODE_FEEDBACK;

        } else {

            KDFerr(KDF_F_KBKDF_CTRL_STR, KDF_R_VALUE_ERROR);

            return 0;

        }

        return call_ctrl(kbkdf_ctrl, ctx, EVP_KDF_CTRL_SET_KB_MODE,

                         mode);

    }

    if (strcmp(type, "mac_type") == 0) {

        int mac_type;

        if (strcasecmp(value, "hmac") == 0) {

            mac_type = EVP_KDF_KB_MAC_TYPE_HMAC;

        } else if (strcasecmp(value, "cmac") == 0) {

            mac_type = EVP_KDF_KB_MAC_TYPE_CMAC;

        } else {

            KDFerr(KDF_F_KBKDF_CTRL_STR, KDF_R_VALUE_ERROR);

            return 0;

        }

        return call_ctrl(kbkdf_ctrl, ctx, EVP_KDF_CTRL_SET_KB_MAC_TYPE,

                         mac_type);

    }

    KDFerr(KDF_F_KBKDF_CTRL_STR, KDF_R_UNKNOWN_PARAMETER_TYPE);

    return -2;

}

const EVP_KDF_METHOD kb_kdf_meth = {

    EVP_KDF_KB,

    kbkdf_new,

    kbkdf_free,

    kbkdf_reset,

    kbkdf_ctrl,

    kbkdf_ctrl_str,

    kbkdf_size,

    kbkdf_derive,

};