Commit | Line | Data |
---|---|---|
64470f1b RS |
1 | /* LRW: as defined by Cyril Guyot in |
2 | * http://grouper.ieee.org/groups/1619/email/pdf00017.pdf | |
3 | * | |
4 | * Copyright (c) 2006 Rik Snel <rsnel@cube.dyndns.org> | |
5 | * | |
6 | * Based om ecb.c | |
7 | * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au> | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or modify it | |
10 | * under the terms of the GNU General Public License as published by the Free | |
11 | * Software Foundation; either version 2 of the License, or (at your option) | |
12 | * any later version. | |
13 | */ | |
14 | /* This implementation is checked against the test vectors in the above | |
15 | * document and by a test vector provided by Ken Buchanan at | |
16 | * http://www.mail-archive.com/stds-p1619@listserv.ieee.org/msg00173.html | |
17 | * | |
18 | * The test vectors are included in the testing module tcrypt.[ch] */ | |
19 | #include <crypto/algapi.h> | |
20 | #include <linux/err.h> | |
21 | #include <linux/init.h> | |
22 | #include <linux/kernel.h> | |
23 | #include <linux/module.h> | |
24 | #include <linux/scatterlist.h> | |
25 | #include <linux/slab.h> | |
26 | ||
27 | #include <crypto/b128ops.h> | |
28 | #include <crypto/gf128mul.h> | |
29 | ||
4660720d JK |
30 | #define LRW_BLOCK_SIZE 16 |
31 | ||
64470f1b RS |
32 | struct priv { |
33 | struct crypto_cipher *child; | |
34 | /* optimizes multiplying a random (non incrementing, as at the | |
35 | * start of a new sector) value with key2, we could also have | |
36 | * used 4k optimization tables or no optimization at all. In the | |
37 | * latter case we would have to store key2 here */ | |
38 | struct gf128mul_64k *table; | |
39 | /* stores: | |
40 | * key2*{ 0,0,...0,0,0,0,1 }, key2*{ 0,0,...0,0,0,1,1 }, | |
41 | * key2*{ 0,0,...0,0,1,1,1 }, key2*{ 0,0,...0,1,1,1,1 } | |
42 | * key2*{ 0,0,...1,1,1,1,1 }, etc | |
43 | * needed for optimized multiplication of incrementing values | |
44 | * with key2 */ | |
45 | be128 mulinc[128]; | |
46 | }; | |
47 | ||
48 | static inline void setbit128_bbe(void *b, int bit) | |
49 | { | |
8eb2dfac HX |
50 | __set_bit(bit ^ (0x80 - |
51 | #ifdef __BIG_ENDIAN | |
52 | BITS_PER_LONG | |
53 | #else | |
54 | BITS_PER_BYTE | |
55 | #endif | |
56 | ), b); | |
64470f1b RS |
57 | } |
58 | ||
59 | static int setkey(struct crypto_tfm *parent, const u8 *key, | |
60 | unsigned int keylen) | |
61 | { | |
62 | struct priv *ctx = crypto_tfm_ctx(parent); | |
63 | struct crypto_cipher *child = ctx->child; | |
64 | int err, i; | |
65 | be128 tmp = { 0 }; | |
4660720d | 66 | int bsize = LRW_BLOCK_SIZE; |
64470f1b RS |
67 | |
68 | crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK); | |
69 | crypto_cipher_set_flags(child, crypto_tfm_get_flags(parent) & | |
70 | CRYPTO_TFM_REQ_MASK); | |
71 | if ((err = crypto_cipher_setkey(child, key, keylen - bsize))) | |
72 | return err; | |
73 | crypto_tfm_set_flags(parent, crypto_cipher_get_flags(child) & | |
74 | CRYPTO_TFM_RES_MASK); | |
75 | ||
76 | if (ctx->table) | |
77 | gf128mul_free_64k(ctx->table); | |
78 | ||
79 | /* initialize multiplication table for Key2 */ | |
80 | ctx->table = gf128mul_init_64k_bbe((be128 *)(key + keylen - bsize)); | |
81 | if (!ctx->table) | |
82 | return -ENOMEM; | |
83 | ||
84 | /* initialize optimization table */ | |
85 | for (i = 0; i < 128; i++) { | |
86 | setbit128_bbe(&tmp, i); | |
87 | ctx->mulinc[i] = tmp; | |
88 | gf128mul_64k_bbe(&ctx->mulinc[i], ctx->table); | |
89 | } | |
90 | ||
91 | return 0; | |
92 | } | |
93 | ||
94 | struct sinfo { | |
95 | be128 t; | |
96 | struct crypto_tfm *tfm; | |
97 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *); | |
98 | }; | |
99 | ||
100 | static inline void inc(be128 *iv) | |
101 | { | |
fd4609a8 MS |
102 | be64_add_cpu(&iv->b, 1); |
103 | if (!iv->b) | |
104 | be64_add_cpu(&iv->a, 1); | |
64470f1b RS |
105 | } |
106 | ||
9ebed9d1 | 107 | static inline void lrw_round(struct sinfo *s, void *dst, const void *src) |
64470f1b RS |
108 | { |
109 | be128_xor(dst, &s->t, src); /* PP <- T xor P */ | |
110 | s->fn(s->tfm, dst, dst); /* CC <- E(Key2,PP) */ | |
111 | be128_xor(dst, dst, &s->t); /* C <- T xor CC */ | |
112 | } | |
113 | ||
114 | /* this returns the number of consequative 1 bits starting | |
115 | * from the right, get_index128(00 00 00 00 00 00 ... 00 00 10 FB) = 2 */ | |
116 | static inline int get_index128(be128 *block) | |
117 | { | |
118 | int x; | |
119 | __be32 *p = (__be32 *) block; | |
120 | ||
121 | for (p += 3, x = 0; x < 128; p--, x += 32) { | |
122 | u32 val = be32_to_cpup(p); | |
123 | ||
124 | if (!~val) | |
125 | continue; | |
126 | ||
127 | return x + ffz(val); | |
128 | } | |
129 | ||
130 | return x; | |
131 | } | |
132 | ||
133 | static int crypt(struct blkcipher_desc *d, | |
134 | struct blkcipher_walk *w, struct priv *ctx, | |
135 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *)) | |
136 | { | |
137 | int err; | |
138 | unsigned int avail; | |
4660720d | 139 | const int bs = LRW_BLOCK_SIZE; |
64470f1b RS |
140 | struct sinfo s = { |
141 | .tfm = crypto_cipher_tfm(ctx->child), | |
142 | .fn = fn | |
143 | }; | |
144 | be128 *iv; | |
145 | u8 *wsrc; | |
146 | u8 *wdst; | |
147 | ||
148 | err = blkcipher_walk_virt(d, w); | |
149 | if (!(avail = w->nbytes)) | |
150 | return err; | |
151 | ||
152 | wsrc = w->src.virt.addr; | |
153 | wdst = w->dst.virt.addr; | |
154 | ||
155 | /* calculate first value of T */ | |
156 | iv = (be128 *)w->iv; | |
157 | s.t = *iv; | |
158 | ||
159 | /* T <- I*Key2 */ | |
160 | gf128mul_64k_bbe(&s.t, ctx->table); | |
161 | ||
162 | goto first; | |
163 | ||
164 | for (;;) { | |
165 | do { | |
166 | /* T <- I*Key2, using the optimization | |
167 | * discussed in the specification */ | |
168 | be128_xor(&s.t, &s.t, &ctx->mulinc[get_index128(iv)]); | |
169 | inc(iv); | |
170 | ||
171 | first: | |
9ebed9d1 | 172 | lrw_round(&s, wdst, wsrc); |
64470f1b RS |
173 | |
174 | wsrc += bs; | |
175 | wdst += bs; | |
176 | } while ((avail -= bs) >= bs); | |
177 | ||
178 | err = blkcipher_walk_done(d, w, avail); | |
179 | if (!(avail = w->nbytes)) | |
180 | break; | |
181 | ||
182 | wsrc = w->src.virt.addr; | |
183 | wdst = w->dst.virt.addr; | |
184 | } | |
185 | ||
186 | return err; | |
187 | } | |
188 | ||
189 | static int encrypt(struct blkcipher_desc *desc, struct scatterlist *dst, | |
190 | struct scatterlist *src, unsigned int nbytes) | |
191 | { | |
192 | struct priv *ctx = crypto_blkcipher_ctx(desc->tfm); | |
193 | struct blkcipher_walk w; | |
194 | ||
195 | blkcipher_walk_init(&w, dst, src, nbytes); | |
196 | return crypt(desc, &w, ctx, | |
197 | crypto_cipher_alg(ctx->child)->cia_encrypt); | |
198 | } | |
199 | ||
200 | static int decrypt(struct blkcipher_desc *desc, struct scatterlist *dst, | |
201 | struct scatterlist *src, unsigned int nbytes) | |
202 | { | |
203 | struct priv *ctx = crypto_blkcipher_ctx(desc->tfm); | |
204 | struct blkcipher_walk w; | |
205 | ||
206 | blkcipher_walk_init(&w, dst, src, nbytes); | |
207 | return crypt(desc, &w, ctx, | |
208 | crypto_cipher_alg(ctx->child)->cia_decrypt); | |
209 | } | |
210 | ||
211 | static int init_tfm(struct crypto_tfm *tfm) | |
212 | { | |
2e306ee0 | 213 | struct crypto_cipher *cipher; |
64470f1b RS |
214 | struct crypto_instance *inst = (void *)tfm->__crt_alg; |
215 | struct crypto_spawn *spawn = crypto_instance_ctx(inst); | |
216 | struct priv *ctx = crypto_tfm_ctx(tfm); | |
217 | u32 *flags = &tfm->crt_flags; | |
218 | ||
2e306ee0 HX |
219 | cipher = crypto_spawn_cipher(spawn); |
220 | if (IS_ERR(cipher)) | |
221 | return PTR_ERR(cipher); | |
64470f1b | 222 | |
4660720d | 223 | if (crypto_cipher_blocksize(cipher) != LRW_BLOCK_SIZE) { |
64470f1b | 224 | *flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN; |
b884f8b9 | 225 | crypto_free_cipher(cipher); |
64470f1b RS |
226 | return -EINVAL; |
227 | } | |
228 | ||
2e306ee0 | 229 | ctx->child = cipher; |
64470f1b RS |
230 | return 0; |
231 | } | |
232 | ||
233 | static void exit_tfm(struct crypto_tfm *tfm) | |
234 | { | |
235 | struct priv *ctx = crypto_tfm_ctx(tfm); | |
236 | if (ctx->table) | |
237 | gf128mul_free_64k(ctx->table); | |
238 | crypto_free_cipher(ctx->child); | |
239 | } | |
240 | ||
ebc610e5 | 241 | static struct crypto_instance *alloc(struct rtattr **tb) |
64470f1b RS |
242 | { |
243 | struct crypto_instance *inst; | |
244 | struct crypto_alg *alg; | |
ebc610e5 HX |
245 | int err; |
246 | ||
247 | err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_BLKCIPHER); | |
248 | if (err) | |
249 | return ERR_PTR(err); | |
64470f1b | 250 | |
ebc610e5 HX |
251 | alg = crypto_get_attr_alg(tb, CRYPTO_ALG_TYPE_CIPHER, |
252 | CRYPTO_ALG_TYPE_MASK); | |
64470f1b | 253 | if (IS_ERR(alg)) |
e231c2ee | 254 | return ERR_CAST(alg); |
64470f1b RS |
255 | |
256 | inst = crypto_alloc_instance("lrw", alg); | |
257 | if (IS_ERR(inst)) | |
258 | goto out_put_alg; | |
259 | ||
260 | inst->alg.cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER; | |
261 | inst->alg.cra_priority = alg->cra_priority; | |
262 | inst->alg.cra_blocksize = alg->cra_blocksize; | |
263 | ||
264 | if (alg->cra_alignmask < 7) inst->alg.cra_alignmask = 7; | |
265 | else inst->alg.cra_alignmask = alg->cra_alignmask; | |
266 | inst->alg.cra_type = &crypto_blkcipher_type; | |
267 | ||
268 | if (!(alg->cra_blocksize % 4)) | |
269 | inst->alg.cra_alignmask |= 3; | |
270 | inst->alg.cra_blkcipher.ivsize = alg->cra_blocksize; | |
271 | inst->alg.cra_blkcipher.min_keysize = | |
272 | alg->cra_cipher.cia_min_keysize + alg->cra_blocksize; | |
273 | inst->alg.cra_blkcipher.max_keysize = | |
274 | alg->cra_cipher.cia_max_keysize + alg->cra_blocksize; | |
275 | ||
276 | inst->alg.cra_ctxsize = sizeof(struct priv); | |
277 | ||
278 | inst->alg.cra_init = init_tfm; | |
279 | inst->alg.cra_exit = exit_tfm; | |
280 | ||
281 | inst->alg.cra_blkcipher.setkey = setkey; | |
282 | inst->alg.cra_blkcipher.encrypt = encrypt; | |
283 | inst->alg.cra_blkcipher.decrypt = decrypt; | |
284 | ||
285 | out_put_alg: | |
286 | crypto_mod_put(alg); | |
287 | return inst; | |
288 | } | |
289 | ||
290 | static void free(struct crypto_instance *inst) | |
291 | { | |
292 | crypto_drop_spawn(crypto_instance_ctx(inst)); | |
293 | kfree(inst); | |
294 | } | |
295 | ||
296 | static struct crypto_template crypto_tmpl = { | |
297 | .name = "lrw", | |
298 | .alloc = alloc, | |
299 | .free = free, | |
300 | .module = THIS_MODULE, | |
301 | }; | |
302 | ||
303 | static int __init crypto_module_init(void) | |
304 | { | |
305 | return crypto_register_template(&crypto_tmpl); | |
306 | } | |
307 | ||
308 | static void __exit crypto_module_exit(void) | |
309 | { | |
310 | crypto_unregister_template(&crypto_tmpl); | |
311 | } | |
312 | ||
313 | module_init(crypto_module_init); | |
314 | module_exit(crypto_module_exit); | |
315 | ||
316 | MODULE_LICENSE("GPL"); | |
317 | MODULE_DESCRIPTION("LRW block cipher mode"); |