fizz::OpenSSLEVPCipher< EVPImpl > Class Template Reference

#include <OpenSSLEVPCipher.h>

Inheritance diagram for fizz::OpenSSLEVPCipher< EVPImpl >:

Public Member Functions
	OpenSSLEVPCipher ()
	~OpenSSLEVPCipher () override=default
	OpenSSLEVPCipher (OpenSSLEVPCipher &&other)=default
OpenSSLEVPCipher &	operator= (OpenSSLEVPCipher &&other)=default
void	setKey (TrafficKey trafficKey) override
size_t	keyLength () const override
size_t	ivLength () const override
std::unique_ptr< folly::IOBuf >	encrypt (std::unique_ptr< folly::IOBuf > &&plaintext, const folly::IOBuf *associatedData, uint64_t seqNum) const override
folly::Optional< std::unique_ptr< folly::IOBuf > >	tryDecrypt (std::unique_ptr< folly::IOBuf > &&ciphertext, const folly::IOBuf *associatedData, uint64_t seqNum) const override
size_t	getCipherOverhead () const override
void	setEncryptedBufferHeadroom (size_t headroom) override
Public Member Functions inherited from fizz::Aead
virtual	~Aead ()=default
virtual std::unique_ptr< folly::IOBuf >	decrypt (std::unique_ptr< folly::IOBuf > &&ciphertext, const folly::IOBuf *associatedData, uint64_t seqNum) const

Private Member Functions
std::array< uint8_t, EVPImpl::kIVLength >	createIV (uint64_t seqNum) const

Private Attributes
TrafficKey	trafficKey_
size_t	headroom_ {5}
folly::ssl::EvpCipherCtxUniquePtr	encryptCtx_
folly::ssl::EvpCipherCtxUniquePtr	decryptCtx_

Detailed Description

template<typename EVPImpl>
class fizz::OpenSSLEVPCipher< EVPImpl >

Aead implementation using an OpenSSL EvpCipher.

The template struct requires the following parameters:

• Cipher: function returning EVP_CIPHER*
• kKeyLength: length of key required
• kIvLength: length of iv required
• kTagLength: authentication tag length
• kOperatesInBlocks: if the cipher outputs data in chunks vs. streaming 1:1 with the input
• kRequiresPresetTagLen: if the cipher requires setting the tag length explicitly

Definition at line 39 of file OpenSSLEVPCipher.h.

Constructor & Destructor Documentation

template<typename EVPImpl >

fizz::OpenSSLEVPCipher< EVPImpl >::OpenSSLEVPCipher

(

)

Definition at line 30 of file OpenSSLEVPCipher-inl.h.

                                            {
  encryptCtx_.reset(EVP_CIPHER_CTX_new());
  if (encryptCtx_ == nullptr) {
    throw std::runtime_error("Unable to allocate an EVP_CIPHER_CTX object");
  }
  decryptCtx_.reset(EVP_CIPHER_CTX_new());
  if (decryptCtx_ == nullptr) {
    throw std::runtime_error("Unable to allocate an EVP_CIPHER_CTX object");
  }
  if (EVP_EncryptInit_ex(
          encryptCtx_.get(), EVPImpl::Cipher(), nullptr, nullptr, nullptr) !=
      1) {
    throw std::runtime_error("Init error");
  }
  if (EVP_CIPHER_CTX_ctrl(
          encryptCtx_.get(),
          EVP_CTRL_GCM_SET_IVLEN,
          EVPImpl::kIVLength,
          nullptr) != 1) {
    throw std::runtime_error("Error setting iv length");
  }
  if (EVP_DecryptInit_ex(
          decryptCtx_.get(), EVPImpl::Cipher(), nullptr, nullptr, nullptr) !=
      1) {
    throw std::runtime_error("Init error");
  }
  if (EVP_CIPHER_CTX_ctrl(
          decryptCtx_.get(),
          EVP_CTRL_GCM_SET_IVLEN,
          EVPImpl::kIVLength,
          nullptr) != 1) {
    throw std::runtime_error("Error setting iv length");
  }

  if (EVPImpl::kRequiresPresetTagLen) {
    if (EVP_CIPHER_CTX_ctrl(
            encryptCtx_.get(),
            EVP_CTRL_GCM_SET_TAG,
            EVPImpl::kTagLength,
            nullptr) != 1) {
      throw std::runtime_error("Error setting enc tag length");
    }

    if (EVP_CIPHER_CTX_ctrl(
            decryptCtx_.get(),
            EVP_CTRL_GCM_SET_TAG,
            EVPImpl::kTagLength,
            nullptr) != 1) {
      throw std::runtime_error("Error setting dec tag length");
    }
  }
}

template<typename EVPImpl >

fizz::OpenSSLEVPCipher< EVPImpl >::~OpenSSLEVPCipher ( )

overridedefault

template<typename EVPImpl >

fizz::OpenSSLEVPCipher< EVPImpl >::OpenSSLEVPCipher ( OpenSSLEVPCipher< EVPImpl > &&  other )

default

Member Function Documentation

template<typename EVPImpl >

std::array< uint8_t, EVPImpl::kIVLength > fizz::OpenSSLEVPCipher< EVPImpl >::createIV ( uint64_t  seqNum ) const

private

Definition at line 153 of file OpenSSLEVPCipher-inl.h.

References folly::Endian::big(), folly::range(), uint64_t, and fizz::XOR().

Referenced by fizz::OpenSSLEVPCipher< EVPImpl >::setEncryptedBufferHeadroom().

                           {
  std::array<uint8_t, EVPImpl::kIVLength> iv;
  uint64_t bigEndianSeqNum = folly::Endian::big(seqNum);
  const size_t prefixLength = EVPImpl::kIVLength - sizeof(uint64_t);
  memset(iv.data(), 0, prefixLength);
  memcpy(iv.data() + prefixLength, &bigEndianSeqNum, 8);
  XOR(trafficKey_.iv->coalesce(), folly::range(iv));
  return iv;
}

template<typename EVPImpl >

std::unique_ptr< folly::IOBuf > fizz::OpenSSLEVPCipher< EVPImpl >::encrypt ( std::unique_ptr< folly::IOBuf > &&  plaintext, const folly::IOBuf *  associatedData, uint64_t  seqNum  ) const

overridevirtual

Encrypts plaintext. Will throw on error.

Implements fizz::Aead.

Definition at line 113 of file OpenSSLEVPCipher-inl.h.

References fizz::detail::evpEncrypt(), and folly::gen::move.

Referenced by fizz::OpenSSLEVPCipher< EVPImpl >::ivLength().

                           {
  auto iv = createIV(seqNum);
  return detail::evpEncrypt(
      std::move(plaintext),
      associatedData,
      iv,
      EVPImpl::kTagLength,
      EVPImpl::kOperatesInBlocks,
      headroom_,
      encryptCtx_.get());
}

template<typename EVPImpl >

size_t fizz::OpenSSLEVPCipher< EVPImpl >::getCipherOverhead ( ) const

overridevirtual

Returns the number of bytes the aead will add to the plaintext (size of ciphertext - size of plaintext).

Implements fizz::Aead.

Definition at line 148 of file OpenSSLEVPCipher-inl.h.

Referenced by fizz::OpenSSLEVPCipher< EVPImpl >::ivLength().

                                                          {
  return EVPImpl::kTagLength;
}

template<typename EVPImpl >

size_t fizz::OpenSSLEVPCipher< EVPImpl >::ivLength ( ) const

inlineoverridevirtual

Returns the number of iv bytes needed by this aead.

Implements fizz::Aead.

Definition at line 55 of file OpenSSLEVPCipher.h.

References fizz::OpenSSLEVPCipher< EVPImpl >::encrypt(), fizz::OpenSSLEVPCipher< EVPImpl >::getCipherOverhead(), fizz::OpenSSLEVPCipher< EVPImpl >::tryDecrypt(), and uint64_t.

                                   {
    return EVPImpl::kIVLength;
  }

template<typename EVPImpl >

size_t fizz::OpenSSLEVPCipher< EVPImpl >::keyLength ( ) const

inlineoverridevirtual

Returns the number of key bytes needed by this aead.

Implements fizz::Aead.

Definition at line 51 of file OpenSSLEVPCipher.h.

                                    {
    return EVPImpl::kKeyLength;
  }

template<typename EVPImpl >

OpenSSLEVPCipher& fizz::OpenSSLEVPCipher< EVPImpl >::operator= ( OpenSSLEVPCipher< EVPImpl > &&  other )

default

template<typename EVPImpl >

void fizz::OpenSSLEVPCipher< EVPImpl >::setEncryptedBufferHeadroom ( size_t  headroom )

inlineoverridevirtual

Set a hint to the AEAD about how much space to try to leave as headroom for ciphertexts returned from encrypt. Implementations may or may not honor this.

Implements fizz::Aead.

Definition at line 75 of file OpenSSLEVPCipher.h.

References fizz::OpenSSLEVPCipher< EVPImpl >::createIV(), fizz::OpenSSLEVPCipher< EVPImpl >::headroom_, and uint64_t.

                                                            {
    headroom_ = headroom;
  }

template<typename EVPImpl >

void fizz::OpenSSLEVPCipher< EVPImpl >::setKey ( TrafficKey  key )

overridevirtual

Sets the key and iv for this aead. The length of the key and iv must match keyLength() and ivLength().

Implements fizz::Aead.

Definition at line 84 of file OpenSSLEVPCipher-inl.h.

References fizz::TrafficKey::iv, fizz::TrafficKey::key, and folly::gen::move.

                                                            {
  trafficKey.key->coalesce();
  trafficKey.iv->coalesce();
  if (trafficKey.key->length() != EVPImpl::kKeyLength) {
    throw std::runtime_error("Invalid key");
  }
  if (trafficKey.iv->length() != EVPImpl::kIVLength) {
    throw std::runtime_error("Invalid IV");
  }
  trafficKey_ = std::move(trafficKey);
  if (EVP_EncryptInit_ex(
          encryptCtx_.get(),
          nullptr,
          nullptr,
          trafficKey_.key->data(),
          nullptr) != 1) {
    throw std::runtime_error("Error setting encrypt key");
  }
  if (EVP_DecryptInit_ex(
          decryptCtx_.get(),
          nullptr,
          nullptr,
          trafficKey_.key->data(),
          nullptr) != 1) {
    throw std::runtime_error("Error setting decrypt key");
  }
}

template<typename EVPImpl >

folly::Optional< std::unique_ptr< folly::IOBuf > > fizz::OpenSSLEVPCipher< EVPImpl >::tryDecrypt ( std::unique_ptr< folly::IOBuf > &&  ciphertext, const folly::IOBuf *  associatedData, uint64_t  seqNum  ) const

overridevirtual

Decrypt ciphertext. Will return none if the ciphertext does not decrypt successfully. May still throw from errors unrelated to ciphertext.

Implements fizz::Aead.

Definition at line 130 of file OpenSSLEVPCipher-inl.h.

References fizz::detail::evpDecrypt(), and folly::gen::move.

Referenced by fizz::OpenSSLEVPCipher< EVPImpl >::ivLength().

                           {
  auto iv = createIV(seqNum);
  // buffer to copy the tag into when we decrypt
  std::array<uint8_t, EVPImpl::kTagLength> tagData;
  folly::MutableByteRange tagOut{tagData};
  return detail::evpDecrypt(
      std::move(ciphertext),
      associatedData,
      iv,
      tagOut,
      EVPImpl::kOperatesInBlocks,
      decryptCtx_.get());
}

Member Data Documentation

template<typename EVPImpl >

folly::ssl::EvpCipherCtxUniquePtr fizz::OpenSSLEVPCipher< EVPImpl >::decryptCtx_

private

Definition at line 86 of file OpenSSLEVPCipher.h.

template<typename EVPImpl >

folly::ssl::EvpCipherCtxUniquePtr fizz::OpenSSLEVPCipher< EVPImpl >::encryptCtx_

private

Definition at line 85 of file OpenSSLEVPCipher.h.

template<typename EVPImpl >

size_t fizz::OpenSSLEVPCipher< EVPImpl >::headroom_ {5}

private

Definition at line 83 of file OpenSSLEVPCipher.h.

Referenced by fizz::OpenSSLEVPCipher< EVPImpl >::setEncryptedBufferHeadroom().

template<typename EVPImpl >

TrafficKey fizz::OpenSSLEVPCipher< EVPImpl >::trafficKey_

private

Definition at line 82 of file OpenSSLEVPCipher.h.

---

The documentation for this class was generated from the following files:

• proxygen/fizz/fizz/crypto/aead/OpenSSLEVPCipher.h
• proxygen/fizz/fizz/crypto/aead/OpenSSLEVPCipher-inl.h