Add support for CMAC (RFC 4493).
The interface for this is very similar to upstream, but the code is
quite different.
Support for “resuming” (i.e. calling |CMAC_Final| and then computing the
CMAC for an extension of the message) has been dropped. Also, calling
|CMAC_Init| with magic argument to reset it has been replaced with
|CMAC_Reset|.
Lastly, a one-shot function has been added because it can save an
allocation and that's what most callers actually appear to want to do.
Change-Id: I9345220218bdb16ebe6ca356928d7c6f055d83f6
Reviewed-on: https://boringssl-review.googlesource.com/4630
Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 3af298e..06cbd44 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -128,6 +128,7 @@
add_subdirectory(hmac)
# Level 3
+add_subdirectory(cmac)
add_subdirectory(evp)
add_subdirectory(hkdf)
add_subdirectory(pem)
@@ -183,6 +184,7 @@
$<TARGET_OBJECTS:ecdh>
$<TARGET_OBJECTS:ecdsa>
$<TARGET_OBJECTS:hmac>
+ $<TARGET_OBJECTS:cmac>
$<TARGET_OBJECTS:evp>
$<TARGET_OBJECTS:hkdf>
$<TARGET_OBJECTS:pem>
diff --git a/crypto/cmac/CMakeLists.txt b/crypto/cmac/CMakeLists.txt
new file mode 100644
index 0000000..8ebd80c
--- /dev/null
+++ b/crypto/cmac/CMakeLists.txt
@@ -0,0 +1,17 @@
+include_directories(. .. ../../include)
+
+add_library(
+ cmac
+
+ OBJECT
+
+ cmac.c
+)
+
+add_executable(
+ cmac_test
+
+ cmac_test.cc
+)
+
+target_link_libraries(cmac_test crypto)
diff --git a/crypto/cmac/cmac.c b/crypto/cmac/cmac.c
new file mode 100644
index 0000000..fa4c3c4
--- /dev/null
+++ b/crypto/cmac/cmac.c
@@ -0,0 +1,239 @@
+/* ====================================================================
+ * Copyright (c) 2010 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ==================================================================== */
+
+#include <openssl/cmac.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/aes.h>
+#include <openssl/cipher.h>
+#include <openssl/mem.h>
+
+
+struct cmac_ctx_st {
+ EVP_CIPHER_CTX cipher_ctx;
+ /* k1 and k2 are the CMAC subkeys. See
+ * https://tools.ietf.org/html/rfc4493#section-2.3 */
+ uint8_t k1[AES_BLOCK_SIZE];
+ uint8_t k2[AES_BLOCK_SIZE];
+ /* Last (possibly partial) scratch */
+ uint8_t block[AES_BLOCK_SIZE];
+ /* block_used contains the number of valid bytes in |block|. */
+ unsigned block_used;
+};
+
+static void CMAC_CTX_init(CMAC_CTX *ctx) {
+ EVP_CIPHER_CTX_init(&ctx->cipher_ctx);
+}
+
+static void CMAC_CTX_cleanup(CMAC_CTX *ctx) {
+ EVP_CIPHER_CTX_cleanup(&ctx->cipher_ctx);
+ OPENSSL_cleanse(ctx->k1, sizeof(ctx->k1));
+ OPENSSL_cleanse(ctx->k2, sizeof(ctx->k2));
+ OPENSSL_cleanse(ctx->block, sizeof(ctx->block));
+}
+
+int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
+ const uint8_t *in, size_t in_len) {
+ const EVP_CIPHER *cipher;
+ switch (key_len) {
+ case 16:
+ cipher = EVP_aes_128_cbc();
+ break;
+ case 32:
+ cipher = EVP_aes_256_cbc();
+ break;
+ default:
+ return 0;
+ }
+
+ size_t scratch_out_len;
+ CMAC_CTX ctx;
+ CMAC_CTX_init(&ctx);
+
+ const int ok = CMAC_Init(&ctx, key, key_len, cipher, NULL /* engine */) &&
+ CMAC_Update(&ctx, in, in_len) &&
+ CMAC_Final(&ctx, out, &scratch_out_len);
+
+ CMAC_CTX_cleanup(&ctx);
+ return ok;
+}
+
+CMAC_CTX *CMAC_CTX_new(void) {
+ CMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
+ if (ctx != NULL) {
+ CMAC_CTX_init(ctx);
+ }
+ return ctx;
+}
+
+void CMAC_CTX_free(CMAC_CTX *ctx) {
+ if (ctx == NULL) {
+ return;
+ }
+
+ CMAC_CTX_cleanup(ctx);
+ OPENSSL_free(ctx);
+}
+
+/* binary_field_mul_x treats the 128 bits at |in| as an element of GF(2¹²⁸)
+ * with a hard-coded reduction polynomial and sets |out| as x times the
+ * input.
+ *
+ * See https://tools.ietf.org/html/rfc4493#section-2.3 */
+static void binary_field_mul_x(uint8_t out[16], const uint8_t in[16]) {
+ unsigned i;
+
+ /* Shift |in| to left, including carry. */
+ for (i = 0; i < 15; i++) {
+ out[i] = (in[i] << 1) | (in[i+1] >> 7);
+ }
+
+ /* If MSB set fixup with R. */
+ const uint8_t carry = in[0] >> 7;
+ out[i] = (in[i] << 1) ^ ((0 - carry) & 0x87);
+}
+
+static const uint8_t kZeroIV[AES_BLOCK_SIZE] = {0};
+
+int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
+ const EVP_CIPHER *cipher, ENGINE *engine) {
+ uint8_t scratch[AES_BLOCK_SIZE];
+
+ if (EVP_CIPHER_block_size(cipher) != AES_BLOCK_SIZE ||
+ EVP_CIPHER_key_length(cipher) != key_len ||
+ !EVP_EncryptInit_ex(&ctx->cipher_ctx, cipher, NULL, key, kZeroIV) ||
+ !EVP_Cipher(&ctx->cipher_ctx, scratch, kZeroIV, AES_BLOCK_SIZE) ||
+ /* Reset context again ready for first data. */
+ !EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV)) {
+ return 0;
+ }
+
+ binary_field_mul_x(ctx->k1, scratch);
+ binary_field_mul_x(ctx->k2, ctx->k1);
+ ctx->block_used = 0;
+
+ return 1;
+}
+
+int CMAC_Reset(CMAC_CTX *ctx) {
+ ctx->block_used = 0;
+ return EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV);
+}
+
+int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len) {
+ uint8_t scratch[AES_BLOCK_SIZE];
+
+ if (ctx->block_used > 0) {
+ size_t todo = AES_BLOCK_SIZE - ctx->block_used;
+ if (in_len < todo) {
+ todo = in_len;
+ }
+
+ memcpy(ctx->block + ctx->block_used, in, todo);
+ in += todo;
+ in_len -= todo;
+ ctx->block_used += todo;
+
+ /* If |in_len| is zero then either |ctx->block_used| is less than
+ * |AES_BLOCK_SIZE|, in which case we can stop here, or |ctx->block_used|
+ * is exactly |AES_BLOCK_SIZE| but there's no more data to process. In the
+ * latter case we don't want to process this block now because it might be
+ * the last block and that block is treated specially. */
+ if (in_len == 0) {
+ return 1;
+ }
+
+ assert(ctx->block_used == AES_BLOCK_SIZE);
+
+ if (!EVP_Cipher(&ctx->cipher_ctx, scratch, ctx->block, AES_BLOCK_SIZE)) {
+ return 0;
+ }
+ }
+
+ /* Encrypt all but one of the remaining blocks. */
+ while (in_len > AES_BLOCK_SIZE) {
+ if (!EVP_Cipher(&ctx->cipher_ctx, scratch, in, AES_BLOCK_SIZE)) {
+ return 0;
+ }
+ in += AES_BLOCK_SIZE;
+ in_len -= AES_BLOCK_SIZE;
+ }
+
+ memcpy(ctx->block, in, in_len);
+ ctx->block_used = in_len;
+
+ return 1;
+}
+
+int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len) {
+ *out_len = AES_BLOCK_SIZE;
+ if (out == NULL) {
+ return 1;
+ }
+
+ const uint8_t *mask = ctx->k1;
+
+ if (ctx->block_used != AES_BLOCK_SIZE) {
+ /* If the last block is incomplete, terminate it with a single 'one' bit
+ * followed by zeros. */
+ ctx->block[ctx->block_used] = 0x80;
+ memset(ctx->block + ctx->block_used + 1, 0,
+ AES_BLOCK_SIZE - (ctx->block_used + 1));
+
+ mask = ctx->k2;
+ }
+
+ unsigned i;
+ for (i = 0; i < AES_BLOCK_SIZE; i++) {
+ out[i] = ctx->block[i] ^ mask[i];
+ }
+
+ return EVP_Cipher(&ctx->cipher_ctx, out, out, AES_BLOCK_SIZE);
+}
diff --git a/crypto/cmac/cmac_test.cc b/crypto/cmac/cmac_test.cc
new file mode 100644
index 0000000..0f06860
--- /dev/null
+++ b/crypto/cmac/cmac_test.cc
@@ -0,0 +1,154 @@
+/* Copyright (c) 2015, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <stdio.h>
+
+#include <algorithm>
+
+#include <openssl/cmac.h>
+
+#include "../test/scoped_types.h"
+
+
+static void dump(const uint8_t *got, const uint8_t *expected, size_t len) {
+ ScopedBIO bio(BIO_new_fp(stderr, 0 /* don't close */));
+
+ BIO_puts(bio.get(), "\nGot:\n");
+ BIO_hexdump(bio.get(), got, len, 2 /* indent */);
+ BIO_puts(bio.get(), "Expected:\n");
+ BIO_hexdump(bio.get(), expected, len, 2 /* indent */);
+ BIO_flush(bio.get());
+}
+
+static int test(const char *name, const uint8_t *key, size_t key_len,
+ const uint8_t *msg, size_t msg_len, const uint8_t *expected) {
+ uint8_t out[16];
+
+ if (!AES_CMAC(out, key, key_len, msg, msg_len)) {
+ fprintf(stderr, "%s: AES_CMAC failed\n", name);
+ return 0;
+ }
+
+ if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
+ fprintf(stderr, "%s: CMAC result differs:\n", name);
+ dump(out, expected, sizeof(out));
+ return 0;
+ }
+
+ ScopedCMAC_CTX ctx(CMAC_CTX_new());
+ if (!CMAC_Init(ctx.get(), key, key_len, EVP_aes_128_cbc(), NULL)) {
+ fprintf(stderr, "%s: CMAC_Init failed.\n", name);
+ return 0;
+ }
+
+ for (unsigned chunk_size = 1; chunk_size <= msg_len; chunk_size++) {
+ if (!CMAC_Reset(ctx.get())) {
+ fprintf(stderr, "%s/%u: CMAC_Reset failed.\n", name, chunk_size);
+ return 0;
+ }
+
+ size_t done = 0;
+ while (done < msg_len) {
+ size_t todo = std::min(msg_len - done, static_cast<size_t>(chunk_size));
+ if (!CMAC_Update(ctx.get(), msg + done, todo)) {
+ fprintf(stderr, "%s/%u: CMAC_Update failed.\n", name, chunk_size);
+ return 0;
+ }
+
+ done += todo;
+ }
+
+ size_t out_len;
+ if (!CMAC_Final(ctx.get(), out, &out_len)) {
+ fprintf(stderr, "%s/%u: CMAC_Final failed.\n", name, chunk_size);
+ return 0;
+ }
+
+ if (out_len != sizeof(out)) {
+ fprintf(stderr, "%s/%u: incorrect out_len: %u.\n", name, chunk_size,
+ static_cast<unsigned>(out_len));
+ return 0;
+ }
+
+ if (CRYPTO_memcmp(out, expected, sizeof(out)) != 0) {
+ fprintf(stderr, "%s/%u: CMAC result differs:\n", name, chunk_size);
+ dump(out, expected, sizeof(out));
+ return 0;
+ }
+ }
+
+ return 1;
+}
+
+static int rfc_4493_test_vectors(void) {
+ static const uint8_t kKey[16] = {
+ 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
+ 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c,
+ };
+ static const uint8_t kOut1[16] = {
+ 0xbb, 0x1d, 0x69, 0x29, 0xe9, 0x59, 0x37, 0x28,
+ 0x7f, 0xa3, 0x7d, 0x12, 0x9b, 0x75, 0x67, 0x46,
+ };
+ static const uint8_t kMsg2[] = {
+ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+ 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+ };
+ static const uint8_t kOut2[16] = {
+ 0x07, 0x0a, 0x16, 0xb4, 0x6b, 0x4d, 0x41, 0x44,
+ 0xf7, 0x9b, 0xdd, 0x9d, 0xd0, 0x4a, 0x28, 0x7c,
+ };
+ static const uint8_t kMsg3[] = {
+ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+ 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+ 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
+ 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
+ 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
+ };
+ static const uint8_t kOut3[16] = {
+ 0xdf, 0xa6, 0x67, 0x47, 0xde, 0x9a, 0xe6, 0x30,
+ 0x30, 0xca, 0x32, 0x61, 0x14, 0x97, 0xc8, 0x27,
+ };
+ static const uint8_t kMsg4[] = {
+ 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96,
+ 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a,
+ 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c,
+ 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51,
+ 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11,
+ 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef,
+ 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17,
+ 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10,
+ };
+ static const uint8_t kOut4[16] = {
+ 0x51, 0xf0, 0xbe, 0xbf, 0x7e, 0x3b, 0x9d, 0x92,
+ 0xfc, 0x49, 0x74, 0x17, 0x79, 0x36, 0x3c, 0xfe,
+ };
+
+ if (!test("RFC 4493 #1", kKey, sizeof(kKey), NULL, 0, kOut1) ||
+ !test("RFC 4493 #2", kKey, sizeof(kKey), kMsg2, sizeof(kMsg2), kOut2) ||
+ !test("RFC 4493 #3", kKey, sizeof(kKey), kMsg3, sizeof(kMsg3), kOut3) ||
+ !test("RFC 4493 #4", kKey, sizeof(kKey), kMsg4, sizeof(kMsg4), kOut4)) {
+ return 0;
+ }
+
+ return 1;
+}
+
+int main(int argc, char **argv) {
+ if (!rfc_4493_test_vectors()) {
+ return 1;
+ }
+
+ printf("PASS\n");
+ return 0;
+}
diff --git a/crypto/test/scoped_types.h b/crypto/test/scoped_types.h
index bdb3ca7..697dfbf 100644
--- a/crypto/test/scoped_types.h
+++ b/crypto/test/scoped_types.h
@@ -19,6 +19,7 @@
#include <openssl/bio.h>
#include <openssl/bn.h>
+#include <openssl/cmac.h>
#include <openssl/dh.h>
#include <openssl/ec.h>
#include <openssl/ec_key.h>
@@ -76,6 +77,7 @@
using ScopedBIGNUM = ScopedOpenSSLType<BIGNUM, BN_free>;
using ScopedBN_CTX = ScopedOpenSSLType<BN_CTX, BN_CTX_free>;
using ScopedBN_MONT_CTX = ScopedOpenSSLType<BN_MONT_CTX, BN_MONT_CTX_free>;
+using ScopedCMAC_CTX = ScopedOpenSSLType<CMAC_CTX, CMAC_CTX_free>;
using ScopedDH = ScopedOpenSSLType<DH, DH_free>;
using ScopedECDSA_SIG = ScopedOpenSSLType<ECDSA_SIG, ECDSA_SIG_free>;
using ScopedEC_GROUP = ScopedOpenSSLType<EC_GROUP, EC_GROUP_free>;
diff --git a/include/openssl/base.h b/include/openssl/base.h
index 796562b..b9c60fb 100644
--- a/include/openssl/base.h
+++ b/include/openssl/base.h
@@ -177,6 +177,7 @@
typedef struct buf_mem_st BUF_MEM;
typedef struct cbb_st CBB;
typedef struct cbs_st CBS;
+typedef struct cmac_ctx_st CMAC_CTX;
typedef struct conf_st CONF;
typedef struct conf_value_st CONF_VALUE;
typedef struct dh_method DH_METHOD;
diff --git a/include/openssl/cmac.h b/include/openssl/cmac.h
new file mode 100644
index 0000000..183f41b
--- /dev/null
+++ b/include/openssl/cmac.h
@@ -0,0 +1,76 @@
+/* Copyright (c) 2015, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CMAC_H
+#define OPENSSL_HEADER_CMAC_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+/* CMAC.
+ *
+ * CMAC is a MAC based on AES-CBC and defined in
+ * https://tools.ietf.org/html/rfc4493#section-2.3. */
+
+
+/* One-shot functions. */
+
+/* AES_CMAC calculates the 16-byte, CMAC authenticator of |in_len| bytes of
+ * |in| and writes it to |out|. The |key_len| may be 16 or 32 bytes to select
+ * between AES-128 and AES-256. It returns one on success or zero on error. */
+OPENSSL_EXPORT int AES_CMAC(uint8_t out[16], const uint8_t *key, size_t key_len,
+ const uint8_t *in, size_t in_len);
+
+
+/* Incremental interface. */
+
+/* CMAC_CTX_new allocates a fresh |CMAC_CTX| and returns it, or NULL on
+ * error. */
+OPENSSL_EXPORT CMAC_CTX *CMAC_CTX_new(void);
+
+/* CMAC_CTX_free frees a |CMAC_CTX|. */
+OPENSSL_EXPORT void CMAC_CTX_free(CMAC_CTX *ctx);
+
+/* CMAC_Init configures |ctx| to use the given |key| and |cipher|. The CMAC RFC
+ * only specifies the use of AES-128 thus |key_len| should be 16 and |cipher|
+ * should be |EVP_aes_128_cbc()|. However, this implementation also supports
+ * AES-256 by setting |key_len| to 32 and |cipher| to |EVP_aes_256_cbc()|. The
+ * |engine| argument is ignored.
+ *
+ * It returns one on success or zero on error. */
+OPENSSL_EXPORT int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
+ const EVP_CIPHER *cipher, ENGINE *engine);
+
+
+/* CMAC_Reset resets |ctx| so that a fresh message can be authenticated. */
+OPENSSL_EXPORT int CMAC_Reset(CMAC_CTX *ctx);
+
+/* CMAC_Update processes |in_len| bytes of message from |in|. It returns one on
+ * success or zero on error. */
+OPENSSL_EXPORT int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len);
+
+/* CMAC_Final sets |*out_len| to 16 and, if |out| is not NULL, writes 16 bytes
+ * of authenticator to it. It returns one on success or zero on error. */
+OPENSSL_EXPORT int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len);
+
+
+#if defined(__cplusplus)
+} /* extern C */
+#endif
+
+#endif /* OPENSSL_HEADER_CBC_H */
diff --git a/util/all_tests.go b/util/all_tests.go
index 785e423..3cd5798 100644
--- a/util/all_tests.go
+++ b/util/all_tests.go
@@ -65,6 +65,7 @@
{"crypto/cipher/aead_test", "aes-128-ctr-hmac-sha256", "crypto/cipher/test/aes_128_ctr_hmac_sha256.txt"},
{"crypto/cipher/aead_test", "aes-256-ctr-hmac-sha256", "crypto/cipher/test/aes_256_ctr_hmac_sha256.txt"},
{"crypto/cipher/cipher_test", "crypto/cipher/test/cipher_test.txt"},
+ {"crypto/cmac/cmac_test"},
{"crypto/constant_time_test"},
{"crypto/dh/dh_test"},
{"crypto/digest/digest_test"},
diff --git a/util/doc.config b/util/doc.config
index d8fbfb7..a427e04 100644
--- a/util/doc.config
+++ b/util/doc.config
@@ -24,6 +24,7 @@
"Headers": [
"include/openssl/aes.h",
"include/openssl/bn.h",
+ "include/openssl/cmac.h",
"include/openssl/des.h",
"include/openssl/dh.h",
"include/openssl/dsa.h",
