2 * echainiv: Encrypted Chain IV Generator
4 * This generator generates an IV based on a sequence number by xoring it
5 * with a salt and then encrypting it with the same key as used to encrypt
6 * the plain text. This algorithm requires that the block size be equal
7 * to the IV size. It is mainly useful for CBC.
9 * This generator can only be used by algorithms where authentication
10 * is performed after encryption (i.e., authenc).
12 * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the Free
16 * Software Foundation; either version 2 of the License, or (at your option)
21 #include <crypto/internal/aead.h>
22 #include <crypto/null.h>
23 #include <crypto/rng.h>
24 #include <crypto/scatterwalk.h>
25 #include <linux/err.h>
26 #include <linux/init.h>
27 #include <linux/kernel.h>
29 #include <linux/module.h>
30 #include <linux/percpu.h>
31 #include <linux/spinlock.h>
32 #include <linux/string.h>
34 #define MAX_IV_SIZE 16
36 struct echainiv_request_ctx
{
37 struct scatterlist src
[2];
38 struct scatterlist dst
[2];
39 struct scatterlist ivbuf
[2];
40 struct scatterlist
*ivsg
;
41 struct aead_givcrypt_request subreq
;
45 struct crypto_aead
*child
;
47 struct crypto_blkcipher
*null
;
48 u8 salt
[] __attribute__ ((aligned(__alignof__(u32
))));
51 static DEFINE_PER_CPU(u32
[MAX_IV_SIZE
/ sizeof(u32
)], echainiv_iv
);
53 static int echainiv_setkey(struct crypto_aead
*tfm
,
54 const u8
*key
, unsigned int keylen
)
56 struct echainiv_ctx
*ctx
= crypto_aead_ctx(tfm
);
58 return crypto_aead_setkey(ctx
->child
, key
, keylen
);
61 static int echainiv_setauthsize(struct crypto_aead
*tfm
,
62 unsigned int authsize
)
64 struct echainiv_ctx
*ctx
= crypto_aead_ctx(tfm
);
66 return crypto_aead_setauthsize(ctx
->child
, authsize
);
69 /* We don't care if we get preempted and read/write IVs from the next CPU. */
70 static void echainiv_read_iv(u8
*dst
, unsigned size
)
73 u32 __percpu
*b
= echainiv_iv
;
75 for (; size
>= 4; size
-= 4) {
76 *a
++ = this_cpu_read(*b
);
81 static void echainiv_write_iv(const u8
*src
, unsigned size
)
83 const u32
*a
= (const u32
*)src
;
84 u32 __percpu
*b
= echainiv_iv
;
86 for (; size
>= 4; size
-= 4) {
87 this_cpu_write(*b
, *a
);
93 static void echainiv_encrypt_compat_complete2(struct aead_request
*req
,
96 struct echainiv_request_ctx
*rctx
= aead_request_ctx(req
);
97 struct aead_givcrypt_request
*subreq
= &rctx
->subreq
;
98 struct crypto_aead
*geniv
;
100 if (err
== -EINPROGRESS
)
106 geniv
= crypto_aead_reqtfm(req
);
107 scatterwalk_map_and_copy(subreq
->giv
, rctx
->ivsg
, 0,
108 crypto_aead_ivsize(geniv
), 1);
114 static void echainiv_encrypt_compat_complete(
115 struct crypto_async_request
*base
, int err
)
117 struct aead_request
*req
= base
->data
;
119 echainiv_encrypt_compat_complete2(req
, err
);
120 aead_request_complete(req
, err
);
123 static void echainiv_encrypt_complete2(struct aead_request
*req
, int err
)
125 struct aead_request
*subreq
= aead_request_ctx(req
);
126 struct crypto_aead
*geniv
;
129 if (err
== -EINPROGRESS
)
135 geniv
= crypto_aead_reqtfm(req
);
136 ivsize
= crypto_aead_ivsize(geniv
);
138 echainiv_write_iv(subreq
->iv
, ivsize
);
140 if (req
->iv
!= subreq
->iv
)
141 memcpy(req
->iv
, subreq
->iv
, ivsize
);
144 if (req
->iv
!= subreq
->iv
)
148 static void echainiv_encrypt_complete(struct crypto_async_request
*base
,
151 struct aead_request
*req
= base
->data
;
153 echainiv_encrypt_complete2(req
, err
);
154 aead_request_complete(req
, err
);
157 static int echainiv_encrypt_compat(struct aead_request
*req
)
159 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
160 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
161 struct echainiv_request_ctx
*rctx
= aead_request_ctx(req
);
162 struct aead_givcrypt_request
*subreq
= &rctx
->subreq
;
163 unsigned int ivsize
= crypto_aead_ivsize(geniv
);
164 crypto_completion_t
compl;
170 if (req
->cryptlen
< ivsize
)
173 compl = req
->base
.complete
;
174 data
= req
->base
.data
;
176 rctx
->ivsg
= scatterwalk_ffwd(rctx
->ivbuf
, req
->dst
, req
->assoclen
);
177 info
= PageHighMem(sg_page(rctx
->ivsg
)) ? NULL
: sg_virt(rctx
->ivsg
);
180 info
= kmalloc(ivsize
, req
->base
.flags
&
181 CRYPTO_TFM_REQ_MAY_SLEEP
? GFP_KERNEL
:
186 compl = echainiv_encrypt_compat_complete
;
190 memcpy(&seq
, req
->iv
+ ivsize
- sizeof(seq
), sizeof(seq
));
192 aead_givcrypt_set_tfm(subreq
, ctx
->child
);
193 aead_givcrypt_set_callback(subreq
, req
->base
.flags
,
194 req
->base
.complete
, req
->base
.data
);
195 aead_givcrypt_set_crypt(subreq
,
196 scatterwalk_ffwd(rctx
->src
, req
->src
,
197 req
->assoclen
+ ivsize
),
198 scatterwalk_ffwd(rctx
->dst
, rctx
->ivsg
,
200 req
->cryptlen
- ivsize
, req
->iv
);
201 aead_givcrypt_set_assoc(subreq
, req
->src
, req
->assoclen
);
202 aead_givcrypt_set_giv(subreq
, info
, be64_to_cpu(seq
));
204 err
= crypto_aead_givencrypt(subreq
);
205 if (unlikely(PageHighMem(sg_page(rctx
->ivsg
))))
206 echainiv_encrypt_compat_complete2(req
, err
);
210 static int echainiv_encrypt(struct aead_request
*req
)
212 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
213 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
214 struct aead_request
*subreq
= aead_request_ctx(req
);
215 crypto_completion_t
compl;
218 unsigned int ivsize
= crypto_aead_ivsize(geniv
);
221 if (req
->cryptlen
< ivsize
)
224 aead_request_set_tfm(subreq
, ctx
->child
);
226 compl = echainiv_encrypt_complete
;
230 if (req
->src
!= req
->dst
) {
231 struct scatterlist src
[2];
232 struct scatterlist dst
[2];
233 struct blkcipher_desc desc
= {
237 err
= crypto_blkcipher_encrypt(
239 scatterwalk_ffwd(dst
, req
->dst
,
240 req
->assoclen
+ ivsize
),
241 scatterwalk_ffwd(src
, req
->src
,
242 req
->assoclen
+ ivsize
),
243 req
->cryptlen
- ivsize
);
248 if (unlikely(!IS_ALIGNED((unsigned long)info
,
249 crypto_aead_alignmask(geniv
) + 1))) {
250 info
= kmalloc(ivsize
, req
->base
.flags
&
251 CRYPTO_TFM_REQ_MAY_SLEEP
? GFP_KERNEL
:
256 memcpy(info
, req
->iv
, ivsize
);
259 aead_request_set_callback(subreq
, req
->base
.flags
, compl, data
);
260 aead_request_set_crypt(subreq
, req
->dst
, req
->dst
,
261 req
->cryptlen
- ivsize
, info
);
262 aead_request_set_ad(subreq
, req
->assoclen
+ ivsize
);
264 crypto_xor(info
, ctx
->salt
, ivsize
);
265 scatterwalk_map_and_copy(info
, req
->dst
, req
->assoclen
, ivsize
, 1);
266 echainiv_read_iv(info
, ivsize
);
268 err
= crypto_aead_encrypt(subreq
);
269 echainiv_encrypt_complete2(req
, err
);
273 static int echainiv_decrypt_compat(struct aead_request
*req
)
275 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
276 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
277 struct echainiv_request_ctx
*rctx
= aead_request_ctx(req
);
278 struct aead_request
*subreq
= &rctx
->subreq
.areq
;
279 crypto_completion_t
compl;
281 unsigned int ivsize
= crypto_aead_ivsize(geniv
);
283 if (req
->cryptlen
< ivsize
+ crypto_aead_authsize(geniv
))
286 aead_request_set_tfm(subreq
, ctx
->child
);
288 compl = req
->base
.complete
;
289 data
= req
->base
.data
;
291 aead_request_set_callback(subreq
, req
->base
.flags
, compl, data
);
292 aead_request_set_crypt(subreq
,
293 scatterwalk_ffwd(rctx
->src
, req
->src
,
294 req
->assoclen
+ ivsize
),
295 scatterwalk_ffwd(rctx
->dst
, req
->dst
,
296 req
->assoclen
+ ivsize
),
297 req
->cryptlen
- ivsize
, req
->iv
);
298 aead_request_set_assoc(subreq
, req
->src
, req
->assoclen
);
300 scatterwalk_map_and_copy(req
->iv
, req
->src
, req
->assoclen
, ivsize
, 0);
302 return crypto_aead_decrypt(subreq
);
305 static int echainiv_decrypt(struct aead_request
*req
)
307 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
308 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
309 struct aead_request
*subreq
= aead_request_ctx(req
);
310 crypto_completion_t
compl;
312 unsigned int ivsize
= crypto_aead_ivsize(geniv
);
314 if (req
->cryptlen
< ivsize
+ crypto_aead_authsize(geniv
))
317 aead_request_set_tfm(subreq
, ctx
->child
);
319 compl = req
->base
.complete
;
320 data
= req
->base
.data
;
322 aead_request_set_callback(subreq
, req
->base
.flags
, compl, data
);
323 aead_request_set_crypt(subreq
, req
->src
, req
->dst
,
324 req
->cryptlen
- ivsize
, req
->iv
);
325 aead_request_set_ad(subreq
, req
->assoclen
+ ivsize
);
327 scatterwalk_map_and_copy(req
->iv
, req
->src
, req
->assoclen
, ivsize
, 0);
328 if (req
->src
!= req
->dst
)
329 scatterwalk_map_and_copy(req
->iv
, req
->dst
,
330 req
->assoclen
, ivsize
, 1);
332 return crypto_aead_decrypt(subreq
);
335 static int echainiv_encrypt_compat_first(struct aead_request
*req
)
337 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
338 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
341 spin_lock_bh(&ctx
->lock
);
342 if (geniv
->encrypt
!= echainiv_encrypt_compat_first
)
345 geniv
->encrypt
= echainiv_encrypt_compat
;
346 err
= crypto_rng_get_bytes(crypto_default_rng
, ctx
->salt
,
347 crypto_aead_ivsize(geniv
));
350 spin_unlock_bh(&ctx
->lock
);
355 return echainiv_encrypt_compat(req
);
358 static int echainiv_encrypt_first(struct aead_request
*req
)
360 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
361 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
364 spin_lock_bh(&ctx
->lock
);
365 if (geniv
->encrypt
!= echainiv_encrypt_first
)
368 geniv
->encrypt
= echainiv_encrypt
;
369 err
= crypto_rng_get_bytes(crypto_default_rng
, ctx
->salt
,
370 crypto_aead_ivsize(geniv
));
373 spin_unlock_bh(&ctx
->lock
);
378 return echainiv_encrypt(req
);
381 static int echainiv_compat_init(struct crypto_tfm
*tfm
)
383 struct crypto_aead
*geniv
= __crypto_aead_cast(tfm
);
384 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
387 spin_lock_init(&ctx
->lock
);
389 crypto_aead_set_reqsize(geniv
, sizeof(struct echainiv_request_ctx
));
391 err
= aead_geniv_init(tfm
);
393 ctx
->child
= geniv
->child
;
394 geniv
->child
= geniv
;
399 static int echainiv_init(struct crypto_tfm
*tfm
)
401 struct crypto_aead
*geniv
= __crypto_aead_cast(tfm
);
402 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
405 spin_lock_init(&ctx
->lock
);
407 crypto_aead_set_reqsize(geniv
, sizeof(struct aead_request
));
409 ctx
->null
= crypto_get_default_null_skcipher();
410 err
= PTR_ERR(ctx
->null
);
411 if (IS_ERR(ctx
->null
))
414 err
= aead_geniv_init(tfm
);
418 ctx
->child
= geniv
->child
;
419 geniv
->child
= geniv
;
425 crypto_put_default_null_skcipher();
429 static void echainiv_compat_exit(struct crypto_tfm
*tfm
)
431 struct echainiv_ctx
*ctx
= crypto_tfm_ctx(tfm
);
433 crypto_free_aead(ctx
->child
);
436 static void echainiv_exit(struct crypto_tfm
*tfm
)
438 struct echainiv_ctx
*ctx
= crypto_tfm_ctx(tfm
);
440 crypto_free_aead(ctx
->child
);
441 crypto_put_default_null_skcipher();
444 static int echainiv_aead_create(struct crypto_template
*tmpl
,
447 struct aead_instance
*inst
;
448 struct crypto_aead_spawn
*spawn
;
449 struct aead_alg
*alg
;
452 inst
= aead_geniv_alloc(tmpl
, tb
, 0, 0);
455 return PTR_ERR(inst
);
458 if (inst
->alg
.ivsize
< sizeof(u64
) ||
459 inst
->alg
.ivsize
& (sizeof(u32
) - 1) ||
460 inst
->alg
.ivsize
> MAX_IV_SIZE
)
463 spawn
= aead_instance_ctx(inst
);
464 alg
= crypto_spawn_aead_alg(spawn
);
466 inst
->alg
.setkey
= echainiv_setkey
;
467 inst
->alg
.setauthsize
= echainiv_setauthsize
;
468 inst
->alg
.encrypt
= echainiv_encrypt_first
;
469 inst
->alg
.decrypt
= echainiv_decrypt
;
471 inst
->alg
.base
.cra_init
= echainiv_init
;
472 inst
->alg
.base
.cra_exit
= echainiv_exit
;
474 inst
->alg
.base
.cra_alignmask
|= __alignof__(u32
) - 1;
475 inst
->alg
.base
.cra_ctxsize
= sizeof(struct echainiv_ctx
);
476 inst
->alg
.base
.cra_ctxsize
+= inst
->alg
.base
.cra_aead
.ivsize
;
478 if (alg
->base
.cra_aead
.encrypt
) {
479 inst
->alg
.encrypt
= echainiv_encrypt_compat_first
;
480 inst
->alg
.decrypt
= echainiv_decrypt_compat
;
482 inst
->alg
.base
.cra_init
= echainiv_compat_init
;
483 inst
->alg
.base
.cra_exit
= echainiv_compat_exit
;
486 err
= aead_register_instance(tmpl
, inst
);
494 aead_geniv_free(inst
);
498 static int echainiv_create(struct crypto_template
*tmpl
, struct rtattr
**tb
)
502 err
= crypto_get_default_rng();
506 err
= echainiv_aead_create(tmpl
, tb
);
514 crypto_put_default_rng();
518 static void echainiv_free(struct crypto_instance
*inst
)
520 aead_geniv_free(aead_instance(inst
));
521 crypto_put_default_rng();
524 static struct crypto_template echainiv_tmpl
= {
526 .create
= echainiv_create
,
527 .free
= echainiv_free
,
528 .module
= THIS_MODULE
,
531 static int __init
echainiv_module_init(void)
533 return crypto_register_template(&echainiv_tmpl
);
536 static void __exit
echainiv_module_exit(void)
538 crypto_unregister_template(&echainiv_tmpl
);
541 module_init(echainiv_module_init
);
542 module_exit(echainiv_module_exit
);
544 MODULE_LICENSE("GPL");
545 MODULE_DESCRIPTION("Encrypted Chain IV Generator");
546 MODULE_ALIAS_CRYPTO("echainiv");