cmac: take a NULL key in init as a restart with the cached key

- wp_cmac_set_key() takes key as NULL to mean the cached key is
  kept: the length and expKeySize checks and the cleanse/copy of
  macCtx->key are conditioned on key being non-NULL, and a NULL
  key with no cached key returns failure.
- wp_cmac_init() calls wp_cmac_set_key() with restart set
  whenever a key is passed in or one is already cached.
- The doxygen for the key parameter of both functions covers the
  NULL case.
- test_cmac_reinit drives one EVP_MAC_CTX through init, update
  and final rounds with no key argument and through an init
  mid-stream, comparing the MACs with OpenSSL; it is declared in
  unit.h and registered in unit.c.

Issue: F-11550

Author: yosuke-wolfssl

src/wp_cmac.c

@@ -104,7 +104,7 @@ static void wp_cmac_free(wp_CmacCtx* macCtx)
  * Allocates space for the key in the wolfSSL CMAC object.
  *
  * @param [in, out] macCtx   CMAC context object.
- * @param [in]      key      Key data to set.
+ * @param [in]      key      Key data to set. NULL keeps the cached key.
  * @param [in]      keyLen   Length of key data in bytes.
  * @param [in]      restart  Restart CMAC calculation.
  * @return  1 on success.
@@ -117,18 +117,24 @@ static int wp_cmac_set_key(wp_CmacCtx* macCtx, const unsigned char* key,
 
     WOLFPROV_ENTER(WP_LOG_COMP_MAC, "wp_cmac_set_key");
 
-    if (keyLen > AES_256_KEY_SIZE) {
+    if ((key == NULL) && (macCtx->keyLen == 0)) {
         ok = 0;
     }
-    if (ok && (macCtx->expKeySize != 0) && (keyLen != macCtx->expKeySize)) {
+    if (ok && (key != NULL) && (keyLen > AES_256_KEY_SIZE)) {
+        ok = 0;
+    }
+    if (ok && (key != NULL) && (macCtx->expKeySize != 0) &&
+            (keyLen != macCtx->expKeySize)) {
         ok = 0;
     }
     if (ok) {
-        if (macCtx->keyLen > 0) {
-            OPENSSL_cleanse(macCtx->key, macCtx->keyLen);
+        if (key != NULL) {
+            if (macCtx->keyLen > 0) {
+                OPENSSL_cleanse(macCtx->key, macCtx->keyLen);
+            }
+            macCtx->keyLen = keyLen;
+            XMEMCPY(macCtx->key, key, keyLen);
         }
-        macCtx->keyLen = keyLen;
-        XMEMCPY(macCtx->key, key, keyLen);
 
         if (restart) {
         #if LIBWOLFSSL_VERSION_HEX >= 0x05000000
@@ -190,7 +196,8 @@ static wp_CmacCtx* wp_cmac_dup(wp_CmacCtx* src)
  * Initializes an CMAC context object with a key and parameters.
  *
  * @param [in, out] macCtx  CMAC context object to initialize.
- * @param [in]      key     Key data to set.
+ * @param [in]      key     Key data to set. NULL restarts with the cached
+ *                          key, if one is set.
  * @param [in]      keyLen  Length of key data in bytes.
  * @param [in]      params  Extra parameters to set.
  * @return  1 on success.
@@ -211,7 +218,8 @@ static int wp_cmac_init(wp_CmacCtx* macCtx, const unsigned char* key,
     }
     if (ok) {
         macCtx->size = AES_BLOCK_SIZE;
-        if ((key != NULL) && (!wp_cmac_set_key(macCtx, key, keyLen, 1))) {
+        if (((key != NULL) || (macCtx->keyLen > 0)) &&
+                (!wp_cmac_set_key(macCtx, key, keyLen, 1))) {
             ok = 0;
         }
     }

test/test_cmac.c

@@ -358,6 +358,142 @@ int test_cmac_multi_update(void *data)
     return err;
 }
 
+/**
+ * Test that one CMAC context can be reset by calling EVP_MAC_init() with no
+ * key, both after EVP_MAC_final() and mid-stream, reusing the cached key.
+ */
+static int test_cmac_reinit_helper(OSSL_LIB_CTX *libCtx, unsigned char *macA,
+    unsigned char *macB)
+{
+    int err;
+    EVP_MAC *emac = NULL;
+    EVP_MAC_CTX *ctx = NULL;
+    OSSL_PARAM params[3];
+    char cipher[] = "AES-256-CBC";
+    unsigned char key[32] = {
+        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+    };
+    unsigned char msgA[32];
+    unsigned char msgB[21];
+    unsigned char macC[AES_BLOCK_SIZE];
+    unsigned char macD[AES_BLOCK_SIZE];
+    size_t macASz = AES_BLOCK_SIZE;
+    size_t macBSz = AES_BLOCK_SIZE;
+    size_t macCSz = sizeof(macC);
+    size_t macDSz = sizeof(macD);
+
+    memset(msgA, 0x41, sizeof(msgA));
+    memset(msgB, 0x5a, sizeof(msgB));
+
+    params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_CIPHER,
+        cipher, 0);
+    params[1] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
+        (void *)key, sizeof(key));
+    params[2] = OSSL_PARAM_construct_end();
+
+    err = (emac = EVP_MAC_fetch(libCtx, "CMAC", NULL)) == NULL;
+    if (err == 0) {
+        err = (ctx = EVP_MAC_CTX_new(emac)) == NULL;
+    }
+    if (err == 0) {
+        err = EVP_MAC_CTX_set_params(ctx, params) != 1;
+    }
+
+    /* First round with installed key by EVP_MAC_CTX_set_params() above. */
+    if (err == 0) {
+        err = EVP_MAC_init(ctx, NULL, 0, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_update(ctx, msgA, sizeof(msgA)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_final(ctx, macA, &macASz, AES_BLOCK_SIZE) != 1;
+    }
+
+    /* Reset after final and MAC a different message with the cached key. */
+    if (err == 0) {
+        err = EVP_MAC_init(ctx, NULL, 0, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_update(ctx, msgB, sizeof(msgB)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_final(ctx, macB, &macBSz, AES_BLOCK_SIZE) != 1;
+    }
+
+    /* The first message must produce the first MAC again. */
+    if (err == 0) {
+        err = EVP_MAC_init(ctx, NULL, 0, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_update(ctx, msgA, sizeof(msgA)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_final(ctx, macC, &macCSz, sizeof(macC)) != 1;
+    }
+    if ((err == 0) && ((macCSz != macASz) ||
+            (memcmp(macC, macA, macASz) != 0))) {
+        PRINT_ERR_MSG("CMAC after reset doesn't match the first MAC");
+        err = 1;
+    }
+
+    /* A reset mid-stream must discard the data buffered so far. */
+    if (err == 0) {
+        err = EVP_MAC_init(ctx, NULL, 0, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_update(ctx, msgA, sizeof(msgA)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_init(ctx, NULL, 0, NULL) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_update(ctx, msgB, sizeof(msgB)) != 1;
+    }
+    if (err == 0) {
+        err = EVP_MAC_final(ctx, macD, &macDSz, sizeof(macD)) != 1;
+    }
+    if ((err == 0) && ((macDSz != macBSz) ||
+            (memcmp(macD, macB, macBSz) != 0))) {
+        PRINT_ERR_MSG("CMAC after mid-stream reset covers stale data");
+        err = 1;
+    }
+
+    EVP_MAC_CTX_free(ctx);
+    EVP_MAC_free(emac);
+    return err;
+}
+
+int test_cmac_reinit(void *data)
+{
+    int err;
+    unsigned char osslMacA[AES_BLOCK_SIZE];
+    unsigned char osslMacB[AES_BLOCK_SIZE];
+    unsigned char wpMacA[AES_BLOCK_SIZE];
+    unsigned char wpMacB[AES_BLOCK_SIZE];
+
+    (void)data;
+
+    PRINT_MSG("CMAC context reset with OpenSSL");
+    err = test_cmac_reinit_helper(osslLibCtx, osslMacA, osslMacB);
+    if (err == 0) {
+        PRINT_MSG("CMAC context reset with wolfProvider");
+        err = test_cmac_reinit_helper(wpLibCtx, wpMacA, wpMacB);
+    }
+    if ((err == 0) && (memcmp(osslMacA, wpMacA, AES_BLOCK_SIZE) != 0)) {
+        PRINT_ERR_MSG("First CMAC doesn't match OpenSSL");
+        err = 1;
+    }
+    if ((err == 0) && (memcmp(osslMacB, wpMacB, AES_BLOCK_SIZE) != 0)) {
+        PRINT_ERR_MSG("CMAC after reset doesn't match OpenSSL");
+        err = 1;
+    }
+    return err;
+}
+
 int test_cmac_dup(void *data)
 {
     int ret = 0;

test/unit.c

@@ -225,6 +225,7 @@ TEST_CASE test_case[] = {
 #ifdef WP_HAVE_CMAC
     TEST_DECL(test_cmac_create, &flags),
     TEST_DECL(test_cmac_multi_update, &flags),
+    TEST_DECL(test_cmac_reinit, &flags),
     TEST_DECL(test_cmac_dup, &flags),
     TEST_DECL(test_cmac_size_query, &flags),
 #endif

test/unit.h

@@ -164,6 +164,7 @@ int test_mac_sig_dup(void *data);
 #ifdef WP_HAVE_CMAC
 int test_cmac_create(void *data);
 int test_cmac_multi_update(void *data);
+int test_cmac_reinit(void *data);
 int test_cmac_dup(void *data);
 int test_cmac_size_query(void *data);
 #endif /* WP_HAVE_CMAC */