Skip to content

Add AES-CCM #883

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mhochsto wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Add AES-CCM #883

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d1138f4
chery picked aes ccm relevant commit & applied minor patches. Ref: ml…
antoinelochet Jun 10, 2026
d47a250
openssl version hint
mhochsto Jun 11, 2026
32895e9
Update OSX-NOTES.md
mhochsto Jun 11, 2026
8bd13c0
Fix CCM parameter validation (CK_CCM_PARAMS) for ulMACLen and ulDataLen.
pataya Jun 17, 2026
e286033
loop bound on WITH_BOTAN to match array size
pataya Jun 17, 2026
1929e2f
removed ambiguous doc on openssl version
pataya Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion OSX-NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,6 @@ Now we need to install some dependencies

openssl, sqlite, and libtool are pre-installed on the system. The versions downloaded
by brew are stored in an alternative location under /usr/local

@bukka bukka Jun 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be removed

The only brew warning of note is for libtool:

==> Caveats
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ Minimum required versions:

- Botan 2.0.0
- OpenSSL 1.0.0
**OpenSSL 3.6+ required for AES-CCM** [ref issue #22773](https://github.com/openssl/openssl/issues/22773)

@bukka bukka Jun 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we don't specify here minimum for other features like PQC so this shouldn't be here either.

@antoinelochet antoinelochet Jul 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And OpenSSL 3.6 is not required. This feature was developed long before OpenSSL 3.6.


If you are using Botan, use at least version 2.6.0. This will improve
the performance when doing public key operations.
Expand Down
66 changes: 66 additions & 0 deletions src/lib/SoftHSM.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -810,6 +810,7 @@ void SoftHSM::prepareSupportedMechanisms(std::map<std::string, CK_MECHANISM_TYPE
t["CKM_AES_CBC_PAD"] = CKM_AES_CBC_PAD;
t["CKM_AES_CTR"] = CKM_AES_CTR;
t["CKM_AES_GCM"] = CKM_AES_GCM;
t["CKM_AES_CCM"] = CKM_AES_CCM;
t["CKM_AES_KEY_WRAP"] = CKM_AES_KEY_WRAP;
#ifdef HAVE_AES_KEY_WRAP_PAD
t["CKM_AES_KEY_WRAP_PAD"] = CKM_AES_KEY_WRAP_PAD;
Expand Down Expand Up @@ -1218,6 +1219,7 @@ CK_RV SoftHSM::C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type, CK_
case CKM_AES_ECB:
case CKM_AES_CTR:
case CKM_AES_GCM:
case CKM_AES_CCM:
pInfo->ulMinKeySize = 16;
pInfo->ulMaxKeySize = 32;
pInfo->flags |= CKF_ENCRYPT | CKF_DECRYPT;
Expand Down Expand Up @@ -2226,6 +2228,7 @@ static bool isSymMechanism(CK_MECHANISM_PTR pMechanism)
case CKM_AES_CBC_PAD:
case CKM_AES_CTR:
case CKM_AES_GCM:
case CKM_AES_CCM:
return true;
default:
return false;
Expand Down Expand Up @@ -2287,6 +2290,7 @@ CK_RV SoftHSM::SymEncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
size_t counterBits = 0;
ByteString aad;
size_t tagBytes = 0;
size_t msgLenBytes = 0;
switch(pMechanism->mechanism) {
#ifndef WITH_FIPS
case CKM_DES_ECB:
Expand Down Expand Up @@ -2445,6 +2449,40 @@ CK_RV SoftHSM::SymEncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
}
tagBytes = tagBytes / 8;
break;
case CKM_AES_CCM:
if (keyType != CKK_AES)
return CKR_KEY_TYPE_INCONSISTENT;
algo = SymAlgo::AES;
mode = SymMode::CCM;
if (pMechanism->pParameter == NULL_PTR ||
pMechanism->ulParameterLen != sizeof(CK_CCM_PARAMS))
{
DEBUG_MSG("CCM mode requires parameters");
return CKR_ARGUMENTS_BAD;
}
if (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen < 7 || CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen > 13) {
DEBUG_MSG("Invalid ulNonceLen value, is %#5d should be 7 ≤ ulNonceLen ≤ 13.", CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
return CKR_ARGUMENTS_BAD;
}
iv.resize(CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
memcpy(&iv[0], CK_CCM_PARAMS_PTR(pMechanism->pParameter)->nonce, CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
aad.resize(CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen);
if (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen > 0)
memcpy(&aad[0], CK_CCM_PARAMS_PTR(pMechanism->pParameter)->aad, CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen);
Comment on lines +2467 to +2471

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Validate nested CCM pointers before copying.

Line 2468 and Line 3258 copy nonce, and Line 2471/Line 3261 copy aad, but CK_CCM_PARAMS is caller-supplied. A null nonce or non-empty null aad will crash the process instead of returning a PKCS#11 error.

Proposed fix 
+			if (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->nonce == NULL_PTR ||
+			    (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen > 0 &&
+			     CK_CCM_PARAMS_PTR(pMechanism->pParameter)->aad == NULL_PTR))
+			{
+				DEBUG_MSG("Invalid CCM nonce/AAD pointer");
+				return CKR_ARGUMENTS_BAD;
+			}
 			iv.resize(CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
 			memcpy(&iv[0], CK_CCM_PARAMS_PTR(pMechanism->pParameter)->nonce, CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
 			aad.resize(CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen);

Apply the same check in both CKM_AES_CCM encrypt and decrypt initialization blocks.

Also applies to: 3257-3261

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/SoftHSM.cpp` around lines 2467 - 2471, The code copies data from
caller-supplied CCM parameters (nonce and aad pointers) without validating them
first, which will crash if they are null. Before the memcpy operations for nonce
on line 2468 and aad on line 2471, add null pointer checks to validate that
nonce is not null before copying it to iv, and validate that aad is not null
before copying it (this check can extend the existing ulAADLen > 0 condition).
Apply the same null pointer validation checks in the decrypt initialization
block that handles CKM_AES_CCM around lines 3257-3261 where similar memcpy
operations occur for the same CCM parameters. If either pointer is null when it
should be valid, return an appropriate PKCS#11 error code instead of allowing
the crash.

tagBytes = CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulMACLen;
counterBits = CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulDataLen;
msgLenBytes = 15 - CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen;
if (msgLenBytes < 8 && counterBits >= (1ULL << (8 * msgLenBytes)))
{
DEBUG_MSG("ulDataLen %lu exceeds CCM limit for msgLenBytes=%zu", counterBits, msgLenBytes);
return CKR_ARGUMENTS_BAD;
}
if (tagBytes != 4 && tagBytes != 6 && tagBytes != 8 && tagBytes != 10 && tagBytes != 12 && tagBytes != 14 && tagBytes != 16)
{
DEBUG_MSG("Invalid ulMACLen value, is %#5d should be 4, 6, 8, 10, 12, 14, or 16", tagBytes);
return CKR_ARGUMENTS_BAD;
}
Comment thread
bukka marked this conversation as resolved.
break;
default:
return CKR_MECHANISM_INVALID;
}
Expand Down Expand Up @@ -3201,6 +3239,34 @@ CK_RV SoftHSM::SymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
}
tagBytes = tagBytes / 8;
break;
case CKM_AES_CCM:
if (keyType != CKK_AES)
return CKR_KEY_TYPE_INCONSISTENT;
algo = SymAlgo::AES;
mode = SymMode::CCM;
if (pMechanism->pParameter == NULL_PTR ||
pMechanism->ulParameterLen != sizeof(CK_CCM_PARAMS))
{
DEBUG_MSG("CCM mode requires parameters");
return CKR_ARGUMENTS_BAD;
}
if (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen < 7 && CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen > 13) {

@bukka bukka Jul 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen < 7 && CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen > 13) {
if (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen < 7 || CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen > 13) {

@bukka bukka Jul 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like there are more issues - you need to fix in a similar way like the encrypt path...

DEBUG_MSG("Invalid ulNonceLen value, is %#5d should be 7 ≤ ulNonceLen ≤ 13.", CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
return CKR_ARGUMENTS_BAD;
}
iv.resize(CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
memcpy(&iv[0], CK_CCM_PARAMS_PTR(pMechanism->pParameter)->nonce, CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulNonceLen);
aad.resize(CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen);
if (CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen > 0)
memcpy(&aad[0], CK_CCM_PARAMS_PTR(pMechanism->pParameter)->aad, CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulAADLen);
tagBytes = CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulMACLen;
counterBits = CK_CCM_PARAMS_PTR(pMechanism->pParameter)->ulDataLen;
if (tagBytes != 16 && tagBytes != 14 && tagBytes != 12 && tagBytes != 10 && tagBytes != 8)
{
DEBUG_MSG("Invalid ulDataLen value, is %#5d should be 16, 14, 12, 10 or 8", tagBytes);

@bukka bukka Jul 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks also wrong.

return CKR_ARGUMENTS_BAD;
}
break;
default:
return CKR_MECHANISM_INVALID;
}
Expand Down
11 changes: 11 additions & 0 deletions src/lib/crypto/BotanAES.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,17 @@ std::string BotanAES::getCipher() const
break;
case SymMode::GCM:
return algo + "/GCM(" + std::to_string(currentTagBytes) + ")";
case SymMode::CCM:
{
int preL = std::to_string(currentCounterBits).length();

@bukka bukka Jul 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How counter bits are related to L?

int L;
if (preL < 2) {
L = 2;
} else {
L = preL;
}
return algo + "/CCM(" + std::to_string(currentTagBytes) + "," + std::to_string(L) + ")";
}
default:
ERROR_MSG("Invalid AES cipher mode %i", currentCipherMode);

Expand Down
24 changes: 19 additions & 5 deletions src/lib/crypto/BotanSymmetricAlgorithm.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,14 +94,15 @@ BotanSymmetricAlgorithm::~BotanSymmetricAlgorithm()
// Encryption functions
bool BotanSymmetricAlgorithm::encryptInit(const SymmetricKey* key, const SymMode::Type mode /* = SymMode:CBC */, const ByteString& IV /* = ByteString()*/, bool padding /* = true */, size_t counterBits /* = 0 */, const ByteString& aad /* = ByteString() */, size_t tagBytes /* = 0 */)
{

// Call the superclass initialiser
if (!SymmetricAlgorithm::encryptInit(key, mode, IV, padding, counterBits, aad, tagBytes))
{
return false;
}

// Check the IV
if (mode != SymMode::GCM && (IV.size() > 0) && (IV.size() != getBlockSize()))
if ((mode != SymMode::GCM && mode != SymMode::CCM) && (IV.size() > 0) && (IV.size() != getBlockSize()))
{
ERROR_MSG("Invalid IV size (%d bytes, expected %d bytes)", IV.size(), getBlockSize());

Expand Down Expand Up @@ -188,7 +189,7 @@ bool BotanSymmetricAlgorithm::encryptInit(const SymmetricKey* key, const SymMode
cipher->set_key(botanKey);
cryption = new Botan::Pipe(cipher);
}
else if (mode == SymMode::GCM)
else if (mode == SymMode::GCM || mode == SymMode::CCM)
{
Botan::AEAD_Mode* aead = Botan::get_aead(cipherName, Botan::ENCRYPTION);
aead->set_key(botanKey);
Expand Down Expand Up @@ -336,7 +337,7 @@ bool BotanSymmetricAlgorithm::decryptInit(const SymmetricKey* key, const SymMode
}

// Check the IV
if (mode != SymMode::GCM && (IV.size() > 0) && (IV.size() != getBlockSize()))
if ((mode != SymMode::GCM && mode != SymMode::CCM) && (IV.size() > 0) && (IV.size() != getBlockSize()))
{
ERROR_MSG("Invalid IV size (%d bytes, expected %d bytes)", IV.size(), getBlockSize());

Expand Down Expand Up @@ -434,6 +435,19 @@ bool BotanSymmetricAlgorithm::decryptInit(const SymmetricKey* key, const SymMode
filter->set_iv(botanIV);
cryption = new Botan::Pipe(filter);
}
else if (mode == SymMode::CCM)
{
Botan::AEAD_Mode* aead = Botan::get_aead(cipherName, Botan::DECRYPTION);
aead->set_key(botanKey);
if (aad.size() > 0) {
aead->set_associated_data(aad.const_byte_str(), aad.size());
}

Botan::InitializationVector botanIV = Botan::InitializationVector(IV.const_byte_str(), IV.size());
Botan::Keyed_Filter* filter = new Botan::Cipher_Mode_Filter(aead);
filter->set_iv(botanIV);
cryption = new Botan::Pipe(filter);
}
else
{
Botan::InitializationVector botanIV = Botan::InitializationVector(IV.const_byte_str(), IV.size());
Expand Down Expand Up @@ -468,7 +482,7 @@ bool BotanSymmetricAlgorithm::decryptUpdate(const ByteString& encryptedData, Byt
}

// AEAD ciphers should not return decrypted data until final is called
if (currentCipherMode == SymMode::GCM)
if (currentCipherMode == SymMode::GCM || currentCipherMode == SymMode::CCM)
{
data.resize(0);
return true;
Expand Down Expand Up @@ -541,7 +555,7 @@ bool BotanSymmetricAlgorithm::decryptFinal(ByteString& data)
return false;
}

if (mode == SymMode::GCM)
if (mode == SymMode::GCM || mode == SymMode::CCM)
{
// Write data
try
Expand Down
12 changes: 12 additions & 0 deletions src/lib/crypto/OSSLAES.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,6 +262,18 @@ const EVP_CIPHER* OSSLAES::getCipher() const
return EVP_aes_256_gcm();
};
}
else if (currentCipherMode == SymMode::CCM)
{
switch(currentKey->getBitLen())
{
case 128:
return EVP_aes_128_ccm();
case 192:
return EVP_aes_192_ccm();
case 256:
return EVP_aes_256_ccm();
};
}

ERROR_MSG("Invalid AES cipher mode %i", currentCipherMode);

Expand Down
Loading
Loading