Commit | Line | Data |
---|---|---|
f19f5111 RS |
1 | /* XTS: as defined in IEEE1619/D16 |
2 | * http://grouper.ieee.org/groups/1619/email/pdf00086.pdf | |
3 | * (sector sizes which are not a multiple of 16 bytes are, | |
4 | * however currently unsupported) | |
5 | * | |
6 | * Copyright (c) 2007 Rik Snel <rsnel@cube.dyndns.org> | |
7 | * | |
8 | * Based om ecb.c | |
9 | * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au> | |
10 | * | |
11 | * This program is free software; you can redistribute it and/or modify it | |
12 | * under the terms of the GNU General Public License as published by the Free | |
13 | * Software Foundation; either version 2 of the License, or (at your option) | |
14 | * any later version. | |
15 | */ | |
16 | #include <crypto/algapi.h> | |
17 | #include <linux/err.h> | |
18 | #include <linux/init.h> | |
19 | #include <linux/kernel.h> | |
20 | #include <linux/module.h> | |
21 | #include <linux/scatterlist.h> | |
22 | #include <linux/slab.h> | |
23 | ||
24 | #include <crypto/b128ops.h> | |
25 | #include <crypto/gf128mul.h> | |
26 | ||
f9d2691f JK |
27 | #define XTS_BLOCK_SIZE 16 |
28 | ||
f19f5111 RS |
29 | struct priv { |
30 | struct crypto_cipher *child; | |
31 | struct crypto_cipher *tweak; | |
32 | }; | |
33 | ||
34 | static int setkey(struct crypto_tfm *parent, const u8 *key, | |
35 | unsigned int keylen) | |
36 | { | |
37 | struct priv *ctx = crypto_tfm_ctx(parent); | |
38 | struct crypto_cipher *child = ctx->tweak; | |
39 | u32 *flags = &parent->crt_flags; | |
40 | int err; | |
41 | ||
42 | /* key consists of keys of equal size concatenated, therefore | |
43 | * the length must be even */ | |
44 | if (keylen % 2) { | |
45 | /* tell the user why there was an error */ | |
46 | *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN; | |
47 | return -EINVAL; | |
48 | } | |
49 | ||
25985edc | 50 | /* we need two cipher instances: one to compute the initial 'tweak' |
f19f5111 RS |
51 | * by encrypting the IV (usually the 'plain' iv) and the other |
52 | * one to encrypt and decrypt the data */ | |
53 | ||
54 | /* tweak cipher, uses Key2 i.e. the second half of *key */ | |
55 | crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK); | |
56 | crypto_cipher_set_flags(child, crypto_tfm_get_flags(parent) & | |
57 | CRYPTO_TFM_REQ_MASK); | |
58 | err = crypto_cipher_setkey(child, key + keylen/2, keylen/2); | |
59 | if (err) | |
60 | return err; | |
61 | ||
62 | crypto_tfm_set_flags(parent, crypto_cipher_get_flags(child) & | |
63 | CRYPTO_TFM_RES_MASK); | |
64 | ||
65 | child = ctx->child; | |
66 | ||
67 | /* data cipher, uses Key1 i.e. the first half of *key */ | |
68 | crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK); | |
69 | crypto_cipher_set_flags(child, crypto_tfm_get_flags(parent) & | |
70 | CRYPTO_TFM_REQ_MASK); | |
71 | err = crypto_cipher_setkey(child, key, keylen/2); | |
72 | if (err) | |
73 | return err; | |
74 | ||
75 | crypto_tfm_set_flags(parent, crypto_cipher_get_flags(child) & | |
76 | CRYPTO_TFM_RES_MASK); | |
77 | ||
78 | return 0; | |
79 | } | |
80 | ||
81 | struct sinfo { | |
6212f2c7 | 82 | be128 *t; |
f19f5111 RS |
83 | struct crypto_tfm *tfm; |
84 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *); | |
85 | }; | |
86 | ||
87 | static inline void xts_round(struct sinfo *s, void *dst, const void *src) | |
88 | { | |
6212f2c7 | 89 | be128_xor(dst, s->t, src); /* PP <- T xor P */ |
f19f5111 | 90 | s->fn(s->tfm, dst, dst); /* CC <- E(Key1,PP) */ |
6212f2c7 | 91 | be128_xor(dst, dst, s->t); /* C <- T xor CC */ |
f19f5111 RS |
92 | } |
93 | ||
94 | static int crypt(struct blkcipher_desc *d, | |
95 | struct blkcipher_walk *w, struct priv *ctx, | |
96 | void (*tw)(struct crypto_tfm *, u8 *, const u8 *), | |
97 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *)) | |
98 | { | |
99 | int err; | |
100 | unsigned int avail; | |
f9d2691f | 101 | const int bs = XTS_BLOCK_SIZE; |
f19f5111 RS |
102 | struct sinfo s = { |
103 | .tfm = crypto_cipher_tfm(ctx->child), | |
104 | .fn = fn | |
105 | }; | |
f19f5111 RS |
106 | u8 *wsrc; |
107 | u8 *wdst; | |
108 | ||
109 | err = blkcipher_walk_virt(d, w); | |
110 | if (!w->nbytes) | |
111 | return err; | |
112 | ||
6212f2c7 | 113 | s.t = (be128 *)w->iv; |
f19f5111 RS |
114 | avail = w->nbytes; |
115 | ||
116 | wsrc = w->src.virt.addr; | |
117 | wdst = w->dst.virt.addr; | |
118 | ||
119 | /* calculate first value of T */ | |
6212f2c7 | 120 | tw(crypto_cipher_tfm(ctx->tweak), w->iv, w->iv); |
f19f5111 RS |
121 | |
122 | goto first; | |
123 | ||
124 | for (;;) { | |
125 | do { | |
6212f2c7 | 126 | gf128mul_x_ble(s.t, s.t); |
f19f5111 RS |
127 | |
128 | first: | |
129 | xts_round(&s, wdst, wsrc); | |
130 | ||
131 | wsrc += bs; | |
132 | wdst += bs; | |
133 | } while ((avail -= bs) >= bs); | |
134 | ||
135 | err = blkcipher_walk_done(d, w, avail); | |
136 | if (!w->nbytes) | |
137 | break; | |
138 | ||
139 | avail = w->nbytes; | |
140 | ||
141 | wsrc = w->src.virt.addr; | |
142 | wdst = w->dst.virt.addr; | |
143 | } | |
144 | ||
145 | return err; | |
146 | } | |
147 | ||
148 | static int encrypt(struct blkcipher_desc *desc, struct scatterlist *dst, | |
149 | struct scatterlist *src, unsigned int nbytes) | |
150 | { | |
151 | struct priv *ctx = crypto_blkcipher_ctx(desc->tfm); | |
152 | struct blkcipher_walk w; | |
153 | ||
154 | blkcipher_walk_init(&w, dst, src, nbytes); | |
155 | return crypt(desc, &w, ctx, crypto_cipher_alg(ctx->tweak)->cia_encrypt, | |
156 | crypto_cipher_alg(ctx->child)->cia_encrypt); | |
157 | } | |
158 | ||
159 | static int decrypt(struct blkcipher_desc *desc, struct scatterlist *dst, | |
160 | struct scatterlist *src, unsigned int nbytes) | |
161 | { | |
162 | struct priv *ctx = crypto_blkcipher_ctx(desc->tfm); | |
163 | struct blkcipher_walk w; | |
164 | ||
165 | blkcipher_walk_init(&w, dst, src, nbytes); | |
166 | return crypt(desc, &w, ctx, crypto_cipher_alg(ctx->tweak)->cia_encrypt, | |
167 | crypto_cipher_alg(ctx->child)->cia_decrypt); | |
168 | } | |
169 | ||
170 | static int init_tfm(struct crypto_tfm *tfm) | |
171 | { | |
172 | struct crypto_cipher *cipher; | |
173 | struct crypto_instance *inst = (void *)tfm->__crt_alg; | |
174 | struct crypto_spawn *spawn = crypto_instance_ctx(inst); | |
175 | struct priv *ctx = crypto_tfm_ctx(tfm); | |
176 | u32 *flags = &tfm->crt_flags; | |
177 | ||
178 | cipher = crypto_spawn_cipher(spawn); | |
179 | if (IS_ERR(cipher)) | |
180 | return PTR_ERR(cipher); | |
181 | ||
f9d2691f | 182 | if (crypto_cipher_blocksize(cipher) != XTS_BLOCK_SIZE) { |
f19f5111 RS |
183 | *flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN; |
184 | crypto_free_cipher(cipher); | |
185 | return -EINVAL; | |
186 | } | |
187 | ||
188 | ctx->child = cipher; | |
189 | ||
190 | cipher = crypto_spawn_cipher(spawn); | |
191 | if (IS_ERR(cipher)) { | |
192 | crypto_free_cipher(ctx->child); | |
193 | return PTR_ERR(cipher); | |
194 | } | |
195 | ||
196 | /* this check isn't really needed, leave it here just in case */ | |
f9d2691f | 197 | if (crypto_cipher_blocksize(cipher) != XTS_BLOCK_SIZE) { |
f19f5111 RS |
198 | crypto_free_cipher(cipher); |
199 | crypto_free_cipher(ctx->child); | |
200 | *flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN; | |
201 | return -EINVAL; | |
202 | } | |
203 | ||
204 | ctx->tweak = cipher; | |
205 | ||
206 | return 0; | |
207 | } | |
208 | ||
209 | static void exit_tfm(struct crypto_tfm *tfm) | |
210 | { | |
211 | struct priv *ctx = crypto_tfm_ctx(tfm); | |
212 | crypto_free_cipher(ctx->child); | |
213 | crypto_free_cipher(ctx->tweak); | |
214 | } | |
215 | ||
216 | static struct crypto_instance *alloc(struct rtattr **tb) | |
217 | { | |
218 | struct crypto_instance *inst; | |
219 | struct crypto_alg *alg; | |
220 | int err; | |
221 | ||
222 | err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_BLKCIPHER); | |
223 | if (err) | |
224 | return ERR_PTR(err); | |
225 | ||
226 | alg = crypto_get_attr_alg(tb, CRYPTO_ALG_TYPE_CIPHER, | |
227 | CRYPTO_ALG_TYPE_MASK); | |
228 | if (IS_ERR(alg)) | |
8db05078 | 229 | return ERR_CAST(alg); |
f19f5111 RS |
230 | |
231 | inst = crypto_alloc_instance("xts", alg); | |
232 | if (IS_ERR(inst)) | |
233 | goto out_put_alg; | |
234 | ||
235 | inst->alg.cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER; | |
236 | inst->alg.cra_priority = alg->cra_priority; | |
237 | inst->alg.cra_blocksize = alg->cra_blocksize; | |
238 | ||
239 | if (alg->cra_alignmask < 7) | |
240 | inst->alg.cra_alignmask = 7; | |
241 | else | |
242 | inst->alg.cra_alignmask = alg->cra_alignmask; | |
243 | ||
244 | inst->alg.cra_type = &crypto_blkcipher_type; | |
245 | ||
246 | inst->alg.cra_blkcipher.ivsize = alg->cra_blocksize; | |
247 | inst->alg.cra_blkcipher.min_keysize = | |
248 | 2 * alg->cra_cipher.cia_min_keysize; | |
249 | inst->alg.cra_blkcipher.max_keysize = | |
250 | 2 * alg->cra_cipher.cia_max_keysize; | |
251 | ||
252 | inst->alg.cra_ctxsize = sizeof(struct priv); | |
253 | ||
254 | inst->alg.cra_init = init_tfm; | |
255 | inst->alg.cra_exit = exit_tfm; | |
256 | ||
257 | inst->alg.cra_blkcipher.setkey = setkey; | |
258 | inst->alg.cra_blkcipher.encrypt = encrypt; | |
259 | inst->alg.cra_blkcipher.decrypt = decrypt; | |
260 | ||
261 | out_put_alg: | |
262 | crypto_mod_put(alg); | |
263 | return inst; | |
264 | } | |
265 | ||
266 | static void free(struct crypto_instance *inst) | |
267 | { | |
268 | crypto_drop_spawn(crypto_instance_ctx(inst)); | |
269 | kfree(inst); | |
270 | } | |
271 | ||
272 | static struct crypto_template crypto_tmpl = { | |
273 | .name = "xts", | |
274 | .alloc = alloc, | |
275 | .free = free, | |
276 | .module = THIS_MODULE, | |
277 | }; | |
278 | ||
279 | static int __init crypto_module_init(void) | |
280 | { | |
281 | return crypto_register_template(&crypto_tmpl); | |
282 | } | |
283 | ||
284 | static void __exit crypto_module_exit(void) | |
285 | { | |
286 | crypto_unregister_template(&crypto_tmpl); | |
287 | } | |
288 | ||
289 | module_init(crypto_module_init); | |
290 | module_exit(crypto_module_exit); | |
291 | ||
292 | MODULE_LICENSE("GPL"); | |
293 | MODULE_DESCRIPTION("XTS block cipher mode"); |