tpm2: Use EVP API for DES in some cases

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

src/tpm2/crypto/openssl/CryptSym.c

@@ -494,18 +494,26 @@ static void TDES_CTR(const BYTE *key,            // IN
                      INT16       blockSize       // IN
                      )
 {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     tpmCryptKeySchedule_t   keySchedule;
+#endif
     int                     i;
     BYTE                    tmp[MAX_SYM_BLOCK_SIZE];
     BYTE                   *pT;
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
     TDES_set_encrypt_key(key, keySizeInBits,
                          (tpmKeyScheduleTDES *)&keySchedule.tdes);
+#endif
 
     for(; dSize > 0; dSize -= blockSize)
 	{
 	    // Encrypt the current value of the IV(counter)
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
 	    TDES_encrypt(iv, tmp, (tpmKeyScheduleTDES *)&keySchedule.tdes);
+#else
+	    TDES_crypt(key, keySizeInBits, iv, tmp, TRUE);
+#endif
 	    //increment the counter (counter is big-endian so start at end)
 	    for(i = blockSize - 1; i >= 0; i--)
 		if((iv[i] += 1) != 0)

src/tpm2/crypto/openssl/Helpers.c

@@ -366,6 +366,40 @@ TPM_RC DoEVPGetIV(
 
 #endif // USE_OPENSSL_FUNCTIONS_SYMMETRIC
 
+TPM_RC
+DoEVPCryptOneBlock(
+                   EVP_CIPHER_CTX      *ctx,        // IN: optional context
+                   const EVP_CIPHER    *evp_cipher, // IN: EVP_CIPHER to use
+                   const BYTE          *key,        // IN: key whose size is suitable for evpfn
+                   const BYTE          *in,         // IN: input block
+                   int                  inl,        // IN: size of input block in bytes
+                   BYTE                *out,        // OUT: output block; must be different memory than in
+                   BOOL                 encrypt     // IN: encrypto (TRUE) or decrypt (FALSE)
+                   )
+{
+    EVP_CIPHER_CTX *l_ctx = NULL;
+    TPM_RC          retVal = 0;
+    int             outlen1 = 0;
+    int             outlen2 = 0;
+
+    l_ctx = ctx ? ctx : EVP_CIPHER_CTX_new();
+    if (!l_ctx)
+        ERROR_RETURN(TPM_RC_MEMORY);
+
+    if (EVP_CipherInit(l_ctx, evp_cipher, key, NULL, encrypt) != 1 ||
+	EVP_CIPHER_CTX_set_padding(l_ctx, 0) != 1 ||
+	EVP_CipherUpdate(l_ctx, out, &outlen1, in, inl) != 1 ||
+	EVP_CipherFinal_ex(l_ctx, out + outlen1, &outlen2) != 1 ||
+	outlen1 + outlen2 != inl)
+        ERROR_RETURN(TPM_RC_FAILURE);
+
+ Exit:
+    if (!ctx)
+        EVP_CIPHER_CTX_free(l_ctx);
+
+    return retVal;
+}
+
 #if USE_OPENSSL_FUNCTIONS_EC
 BOOL
 OpenSSLEccGetPrivate(

src/tpm2/crypto/openssl/Helpers_fp.h

@@ -87,6 +87,17 @@ TPM_RC DoEVPGetIV(
 
 #endif
 
+TPM_RC
+DoEVPCryptOneBlock(
+                   EVP_CIPHER_CTX      *ctx,        // IN: optional context
+                   const EVP_CIPHER    *evp_cipher, // IN: crypto function
+                   const BYTE          *key,        // IN: key whose size is suitable for evpfn
+                   const BYTE          *in,         // IN: input block
+                   int                  inl,        // IN: size of input block in bytes
+                   BYTE                *out,        // OUT: output block; must be different memory than in
+                   BOOL                 encrypt     // IN: encrypto (TRUE) or decrypt (FALSE)
+                   );
+
 #if USE_OPENSSL_FUNCTIONS_EC
 BOOL OpenSSLEccGetPrivate(
                           bigNum             dOut,   // OUT: the qualified random value

src/tpm2/crypto/openssl/TpmToOsslDesSupport.c

@@ -65,6 +65,7 @@
    library. */
 /* B.2.3.1.2. Defines and Includes */
 #include "Tpm.h"
+#include "Helpers_fp.h"  // libtpms added
 #if (defined SYM_LIB_OSSL) && ALG_TDES
 /*     B.2.3.1.3. Functions */
 /* B.2.3.1.3.1. TDES_set_encyrpt_key() */
@@ -101,6 +102,7 @@ void TDES_encrypt(
 		     &ks[0], &ks[1], &ks[2],
 		     DES_ENCRYPT);
 }
+
 #if !USE_OPENSSL_FUNCTIONS_SYMMETRIC
 /* B.2.3.1.3.3. TDES_decrypt() */
 /* As with TDES_encypt() this function bridges between the TPM single schedule model and the
@@ -116,4 +118,29 @@ void TDES_decrypt(
 		     DES_DECRYPT);
 }
 #endif // !USE_OPENSSL_FUNCTIONS_SYMMETRIC
+
+#if OPENSSL_VERSION_NUMBER > 0x30000000L
+
+void TDES_crypt(
+		const BYTE       *key,
+		UINT16            keySizeInBits,
+		const BYTE       *in,
+		BYTE             *out,
+		BOOL              encrypt
+		)
+{
+    static const EVP_CIPHER *evp_cipher_cached = NULL;
+
+    if (!evp_cipher_cached) {
+        evp_cipher_cached = EVP_des_ede3_ecb();
+        pAssert(evp_cipher_cached);
+    }
+
+    if (DoEVPCryptOneBlock(NULL, evp_cipher_cached, key, in, sizeof(DES_cblock),
+			   out, encrypt))
+	pAssert(false)
+}
+
+#endif // OPENSSL_VERSION_NUMBER
+
 #endif // SYM_LIB_OSSL

src/tpm2/crypto/openssl/TpmToOsslDesSupport_fp.h

@@ -79,5 +79,16 @@ void TDES_decrypt(
 		  tpmKeyScheduleTDES   *ks
 		  );
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+void TDES_crypt(
+		const BYTE       *key,
+		UINT16            keySizeInBits,
+		const BYTE       *in,
+		BYTE             *out,
+		BOOL              encrypt
+		);
+
+#endif
 
 #endif