Document length requirements on low-level DES APIs

CBC only works for inputs that are a multiple of the block length, so
these APIs do not accept all buffer sizes.

These are low-level, infallible functions, so mostly all we can do is
say this is a caller obligation. I've just added debug asserts for now.
(Possibly we could do release checks, but it would make sense to treat
AES and DES the same here, and the AES one matters a bit more
perf-wise.)

Change-Id: I3af3e91079d2fbf13012c571158a5339adab5159
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/90448
Commit-Queue: Lily Chen <chlily@google.com>
Reviewed-by: Lily Chen <chlily@google.com>
Auto-Submit: David Benjamin <davidben@google.com>

crypto/des/des.cc

diff --git a/crypto/des/des.cc b/crypto/des/des.cc
index 84b817b..4620b8c 100644
--- a/crypto/des/des.cc
+++ b/crypto/des/des.cc
@@ -14,6 +14,7 @@
 
 #include <openssl/des.h>
 
+#include <assert.h>
 #include <stdlib.h>
 
 #include "internal.h"
@@ -619,6 +620,7 @@
   uint32_t tout0, tout1, xor0, xor1;
   uint32_t tin[2];
   unsigned char *iv;
+  assert(len % 8 == 0);
 
   iv = ivec;
 
@@ -727,6 +729,7 @@
   uint32_t tout0, tout1, xor0, xor1;
   uint32_t tin[2];
   uint8_t *iv;
+  assert(len % 8 == 0);
 
   iv = ivec;
 

crypto/fipsmodule/aes/mode_wrappers.cc.inc

diff --git a/crypto/fipsmodule/aes/mode_wrappers.cc.inc b/crypto/fipsmodule/aes/mode_wrappers.cc.inc
index 8fdcc5d..34f14b0 100644
--- a/crypto/fipsmodule/aes/mode_wrappers.cc.inc
+++ b/crypto/fipsmodule/aes/mode_wrappers.cc.inc
@@ -67,6 +67,7 @@
 
 void AES_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                      const AES_KEY *key, uint8_t *ivec, const int enc) {
+  assert(len % AES_BLOCK_SIZE == 0);
   if (hwaes_capable()) {
     aes_hw_cbc_encrypt(in, out, len, key, ivec, enc);
   } else if (!vpaes_capable()) {

include/openssl/des.h

diff --git a/include/openssl/des.h b/include/openssl/des.h
index 9dbcb8e..1c9f5f3 100644
--- a/include/openssl/des.h
+++ b/include/openssl/des.h
@@ -65,7 +65,7 @@
                                     int is_encrypt);
 
 // DES_ncbc_encrypt encrypts (or decrypts, if |enc| is |DES_DECRYPT|) |len|
-// bytes from |in| to |out| with DES in CBC mode.
+// bytes from |in| to |out| with DES in CBC mode. |len| must be a multiple of 8.
 OPENSSL_EXPORT void DES_ncbc_encrypt(const uint8_t *in, uint8_t *out,
                                      size_t len,
                                      const DES_key_schedule *schedule,
@@ -82,7 +82,8 @@
 
 // DES_ede3_cbc_encrypt encrypts (or decrypts, if |enc| is |DES_DECRYPT|) |len|
 // bytes from |in| to |out| with 3DES in CBC mode. 3DES uses three keys, thus
-// the function takes three different |DES_key_schedule|s.
+// the function takes three different |DES_key_schedule|s. |len| must be a
+// multiple of 8.
 OPENSSL_EXPORT void DES_ede3_cbc_encrypt(const uint8_t *in, uint8_t *out,
                                          size_t len,
                                          const DES_key_schedule *ks1,
@@ -93,7 +94,7 @@
 // DES_ede2_cbc_encrypt encrypts (or decrypts, if |enc| is |DES_DECRYPT|) |len|
 // bytes from |in| to |out| with 3DES in CBC mode. With this keying option, the
 // first and third 3DES keys are identical. Thus, this function takes only two
-// different |DES_key_schedule|s.
+// different |DES_key_schedule|s. |len| must be a multiple of 8.
 OPENSSL_EXPORT void DES_ede2_cbc_encrypt(const uint8_t *in, uint8_t *out,
                                          size_t len,
                                          const DES_key_schedule *ks1,