Support AES-GCM-SIV on BoringSSL (#12294)

pyca · Jan 19, 2025 · 2fe2b5a · 2fe2b5a
1 parent 9343b49
commit 2fe2b5a
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 1 deletion.
diff --git a/src/rust/cryptography-openssl/src/aead.rs b/src/rust/cryptography-openssl/src/aead.rs
@@ -7,6 +7,8 @@ use foreign_types_shared::{ForeignType, ForeignTypeRef};
 
 pub enum AeadType {
     ChaCha20Poly1305,
+    Aes128GcmSiv,
+    Aes256GcmSiv,
 }
 
 foreign_types::foreign_type! {
@@ -27,6 +29,10 @@ impl AeadCtx {
         let aead = match aead {
             // SAFETY: No preconditions.
             AeadType::ChaCha20Poly1305 => unsafe { ffi::EVP_aead_chacha20_poly1305() },
+            // SAFETY: No preconditions.
+            AeadType::Aes128GcmSiv => unsafe { ffi::EVP_aead_aes_128_gcm_siv() },
+            // SAFETY: No preconditions.
+            AeadType::Aes256GcmSiv => unsafe { ffi::EVP_aead_aes_256_gcm_siv() },
         };
 
         // SAFETY: We're passing a valid key and aead.

diff --git a/src/rust/src/backend/aead.rs b/src/rust/src/backend/aead.rs
@@ -1051,6 +1051,9 @@ impl AesOcb3 {
     name = "AESGCMSIV"
 )]
 struct AesGcmSiv {
+    #[cfg(CRYPTOGRAPHY_IS_BORINGSSL)]
+    ctx: EvpAead,
+    #[cfg(not(CRYPTOGRAPHY_IS_BORINGSSL))]
     ctx: EvpCipherAead,
 }
 
@@ -1072,7 +1075,22 @@ impl AesGcmSiv {
         };
 
         cfg_if::cfg_if! {
-            if #[cfg(not(CRYPTOGRAPHY_OPENSSL_320_OR_GREATER))] {
+            if #[cfg(CRYPTOGRAPHY_IS_BORINGSSL)] {
+                let _ = cipher_name;
+                let aead_type = match key.as_bytes().len() {
+                    16 => cryptography_openssl::aead::AeadType::Aes128GcmSiv,
+                    32 => cryptography_openssl::aead::AeadType::Aes256GcmSiv,
+                    _ => return Err(CryptographyError::from(
+                        exceptions::UnsupportedAlgorithm::new_err((
+                            "Only 128-bit and 256-bit keys are supported for AES-GCM-SIV with BoringSSL",
+                            exceptions::Reasons::UNSUPPORTED_CIPHER,
+                        )),
+                    ))
+                };
+                Ok(AesGcmSiv {
+                    ctx: EvpAead::new(aead_type, key.as_bytes(), 16)?,
+                })
+            } else if #[cfg(not(CRYPTOGRAPHY_OPENSSL_320_OR_GREATER))] {
                 let _ = cipher_name;
                 Err(CryptographyError::from(
                     exceptions::UnsupportedAlgorithm::new_err((

diff --git a/tests/hazmat/primitives/test_aead.py b/tests/hazmat/primitives/test_aead.py
@@ -11,6 +11,7 @@
 import pytest
 
 from cryptography.exceptions import InvalidTag, UnsupportedAlgorithm, _Reasons
+from cryptography.hazmat.bindings._rust import openssl as rust_openssl
 from cryptography.hazmat.primitives.ciphers.aead import (
     AESCCM,
     AESGCM,
@@ -919,6 +920,12 @@ def test_vectors(self, backend, subtests):
                 ct = binascii.unhexlify(vector["ciphertext"])
                 tag = binascii.unhexlify(vector["tag"])
                 pt = binascii.unhexlify(vector.get("plaintext", b""))
+
+                # BoringSSL only supports AES-GCM-SIV with 128- and 256-bit
+                # keys
+                if len(key) == 24 and rust_openssl.CRYPTOGRAPHY_IS_BORINGSSL:
+                    continue
+
                 aesgcmsiv = AESGCMSIV(key)
                 computed_ct = aesgcmsiv.encrypt(nonce, pt, aad)
                 assert computed_ct[:-16] == ct
@@ -941,6 +948,12 @@ def test_vectors_invalid(self, backend, subtests):
                 nonce = binascii.unhexlify(vector["iv"])
                 aad = binascii.unhexlify(vector.get("aad", b""))
                 ct = binascii.unhexlify(vector["ciphertext"])
+
+                # BoringSSL only supports AES-GCM-SIV with 128- and 256-bit
+                # keys
+                if len(key) == 24 and rust_openssl.CRYPTOGRAPHY_IS_BORINGSSL:
+                    continue
+
                 aesgcmsiv = AESGCMSIV(key)
                 with pytest.raises(InvalidTag):
                     badkey = AESGCMSIV(AESGCMSIV.generate_key(256))
@@ -974,6 +987,10 @@ def test_bad_key(self, backend):
         with pytest.raises(ValueError):
             AESGCMSIV(b"0" * 31)
 
+        if rust_openssl.CRYPTOGRAPHY_IS_BORINGSSL:
+            with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_CIPHER):
+                AESGCMSIV(b"0" * 24)
+
     def test_bad_generate_key(self, backend):
         with pytest.raises(TypeError):
             AESGCMSIV.generate_key(object())  # type:ignore[arg-type]