2 * echainiv: Encrypted Chain IV Generator
4 * This generator generates an IV based on a sequence number by xoring it
5 * with a salt and then encrypting it with the same key as used to encrypt
6 * the plain text. This algorithm requires that the block size be equal
7 * to the IV size. It is mainly useful for CBC.
9 * This generator can only be used by algorithms where authentication
10 * is performed after encryption (i.e., authenc).
12 * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the Free
16 * Software Foundation; either version 2 of the License, or (at your option)
21 #include <crypto/internal/aead.h>
22 #include <crypto/null.h>
23 #include <crypto/rng.h>
24 #include <crypto/scatterwalk.h>
25 #include <linux/err.h>
26 #include <linux/init.h>
27 #include <linux/kernel.h>
29 #include <linux/module.h>
30 #include <linux/percpu.h>
31 #include <linux/spinlock.h>
32 #include <linux/string.h>
34 #define MAX_IV_SIZE 16
36 struct echainiv_request_ctx
{
37 struct scatterlist src
[2];
38 struct scatterlist dst
[2];
39 struct scatterlist ivbuf
[2];
40 struct scatterlist
*ivsg
;
41 struct aead_givcrypt_request subreq
;
45 struct crypto_aead
*child
;
47 struct crypto_blkcipher
*null
;
48 u8 salt
[] __attribute__ ((aligned(__alignof__(u32
))));
51 static DEFINE_PER_CPU(u32
[MAX_IV_SIZE
/ sizeof(u32
)], echainiv_iv
);
53 static int echainiv_setkey(struct crypto_aead
*tfm
,
54 const u8
*key
, unsigned int keylen
)
56 struct echainiv_ctx
*ctx
= crypto_aead_ctx(tfm
);
58 return crypto_aead_setkey(ctx
->child
, key
, keylen
);
61 static int echainiv_setauthsize(struct crypto_aead
*tfm
,
62 unsigned int authsize
)
64 struct echainiv_ctx
*ctx
= crypto_aead_ctx(tfm
);
66 return crypto_aead_setauthsize(ctx
->child
, authsize
);
69 /* We don't care if we get preempted and read/write IVs from the next CPU. */
70 static void echainiv_read_iv(u8
*dst
, unsigned size
)
73 u32 __percpu
*b
= echainiv_iv
;
75 for (; size
>= 4; size
-= 4) {
76 *a
++ = this_cpu_read(*b
);
81 static void echainiv_write_iv(const u8
*src
, unsigned size
)
83 const u32
*a
= (const u32
*)src
;
84 u32 __percpu
*b
= echainiv_iv
;
86 for (; size
>= 4; size
-= 4) {
87 this_cpu_write(*b
, *a
);
93 static void echainiv_encrypt_compat_complete2(struct aead_request
*req
,
96 struct echainiv_request_ctx
*rctx
= aead_request_ctx(req
);
97 struct aead_givcrypt_request
*subreq
= &rctx
->subreq
;
98 struct crypto_aead
*geniv
;
100 if (err
== -EINPROGRESS
)
106 geniv
= crypto_aead_reqtfm(req
);
107 scatterwalk_map_and_copy(subreq
->giv
, rctx
->ivsg
, 0,
108 crypto_aead_ivsize(geniv
), 1);
114 static void echainiv_encrypt_compat_complete(
115 struct crypto_async_request
*base
, int err
)
117 struct aead_request
*req
= base
->data
;
119 echainiv_encrypt_compat_complete2(req
, err
);
120 aead_request_complete(req
, err
);
123 static void echainiv_encrypt_complete2(struct aead_request
*req
, int err
)
125 struct aead_request
*subreq
= aead_request_ctx(req
);
126 struct crypto_aead
*geniv
;
129 if (err
== -EINPROGRESS
)
135 geniv
= crypto_aead_reqtfm(req
);
136 ivsize
= crypto_aead_ivsize(geniv
);
138 echainiv_write_iv(subreq
->iv
, ivsize
);
140 if (req
->iv
!= subreq
->iv
)
141 memcpy(req
->iv
, subreq
->iv
, ivsize
);
144 if (req
->iv
!= subreq
->iv
)
148 static void echainiv_encrypt_complete(struct crypto_async_request
*base
,
151 struct aead_request
*req
= base
->data
;
153 echainiv_encrypt_complete2(req
, err
);
154 aead_request_complete(req
, err
);
157 static int echainiv_encrypt_compat(struct aead_request
*req
)
159 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
160 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
161 struct echainiv_request_ctx
*rctx
= aead_request_ctx(req
);
162 struct aead_givcrypt_request
*subreq
= &rctx
->subreq
;
163 unsigned int ivsize
= crypto_aead_ivsize(geniv
);
164 crypto_completion_t
compl;
170 compl = req
->base
.complete
;
171 data
= req
->base
.data
;
173 rctx
->ivsg
= scatterwalk_ffwd(rctx
->ivbuf
, req
->dst
, req
->assoclen
);
174 info
= PageHighMem(sg_page(rctx
->ivsg
)) ? NULL
: sg_virt(rctx
->ivsg
);
177 info
= kmalloc(ivsize
, req
->base
.flags
&
178 CRYPTO_TFM_REQ_MAY_SLEEP
? GFP_KERNEL
:
183 compl = echainiv_encrypt_compat_complete
;
187 memcpy(&seq
, req
->iv
+ ivsize
- sizeof(seq
), sizeof(seq
));
189 aead_givcrypt_set_tfm(subreq
, ctx
->child
);
190 aead_givcrypt_set_callback(subreq
, req
->base
.flags
,
191 req
->base
.complete
, req
->base
.data
);
192 aead_givcrypt_set_crypt(subreq
,
193 scatterwalk_ffwd(rctx
->src
, req
->src
,
194 req
->assoclen
+ ivsize
),
195 scatterwalk_ffwd(rctx
->dst
, rctx
->ivsg
,
197 req
->cryptlen
- ivsize
, req
->iv
);
198 aead_givcrypt_set_assoc(subreq
, req
->src
, req
->assoclen
);
199 aead_givcrypt_set_giv(subreq
, info
, be64_to_cpu(seq
));
201 err
= crypto_aead_givencrypt(subreq
);
202 if (unlikely(PageHighMem(sg_page(rctx
->ivsg
))))
203 echainiv_encrypt_compat_complete2(req
, err
);
207 static int echainiv_encrypt(struct aead_request
*req
)
209 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
210 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
211 struct aead_request
*subreq
= aead_request_ctx(req
);
212 crypto_completion_t
compl;
218 aead_request_set_tfm(subreq
, ctx
->child
);
220 compl = echainiv_encrypt_complete
;
224 ivsize
= crypto_aead_ivsize(geniv
);
226 if (req
->src
!= req
->dst
) {
227 struct scatterlist src
[2];
228 struct scatterlist dst
[2];
229 struct blkcipher_desc desc
= {
233 err
= crypto_blkcipher_encrypt(
235 scatterwalk_ffwd(dst
, req
->dst
,
236 req
->assoclen
+ ivsize
),
237 scatterwalk_ffwd(src
, req
->src
,
238 req
->assoclen
+ ivsize
),
239 req
->cryptlen
- ivsize
);
244 if (unlikely(!IS_ALIGNED((unsigned long)info
,
245 crypto_aead_alignmask(geniv
) + 1))) {
246 info
= kmalloc(ivsize
, req
->base
.flags
&
247 CRYPTO_TFM_REQ_MAY_SLEEP
? GFP_KERNEL
:
252 memcpy(info
, req
->iv
, ivsize
);
255 aead_request_set_callback(subreq
, req
->base
.flags
, compl, data
);
256 aead_request_set_crypt(subreq
, req
->dst
, req
->dst
,
257 req
->cryptlen
- ivsize
, info
);
258 aead_request_set_ad(subreq
, req
->assoclen
+ ivsize
, 0);
260 crypto_xor(info
, ctx
->salt
, ivsize
);
261 scatterwalk_map_and_copy(info
, req
->dst
, req
->assoclen
, ivsize
, 1);
262 echainiv_read_iv(info
, ivsize
);
264 err
= crypto_aead_encrypt(subreq
);
265 echainiv_encrypt_complete2(req
, err
);
269 static int echainiv_decrypt_compat(struct aead_request
*req
)
271 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
272 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
273 struct aead_request
*subreq
= aead_request_ctx(req
);
274 crypto_completion_t
compl;
278 aead_request_set_tfm(subreq
, ctx
->child
);
280 compl = req
->base
.complete
;
281 data
= req
->base
.data
;
283 ivsize
= crypto_aead_ivsize(geniv
);
285 aead_request_set_callback(subreq
, req
->base
.flags
, compl, data
);
286 aead_request_set_crypt(subreq
, req
->src
, req
->dst
,
287 req
->cryptlen
- ivsize
, req
->iv
);
288 aead_request_set_ad(subreq
, req
->assoclen
, ivsize
);
290 scatterwalk_map_and_copy(req
->iv
, req
->src
, req
->assoclen
, ivsize
, 0);
292 return crypto_aead_decrypt(subreq
);
295 static int echainiv_decrypt(struct aead_request
*req
)
297 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
298 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
299 struct aead_request
*subreq
= aead_request_ctx(req
);
300 crypto_completion_t
compl;
304 aead_request_set_tfm(subreq
, ctx
->child
);
306 compl = req
->base
.complete
;
307 data
= req
->base
.data
;
309 ivsize
= crypto_aead_ivsize(geniv
);
311 aead_request_set_callback(subreq
, req
->base
.flags
, compl, data
);
312 aead_request_set_crypt(subreq
, req
->src
, req
->dst
,
313 req
->cryptlen
- ivsize
, req
->iv
);
314 aead_request_set_ad(subreq
, req
->assoclen
+ ivsize
, 0);
316 scatterwalk_map_and_copy(req
->iv
, req
->src
, req
->assoclen
, ivsize
, 0);
317 if (req
->src
!= req
->dst
)
318 scatterwalk_map_and_copy(req
->iv
, req
->dst
,
319 req
->assoclen
, ivsize
, 1);
321 return crypto_aead_decrypt(subreq
);
324 static int echainiv_encrypt_compat_first(struct aead_request
*req
)
326 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
327 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
330 spin_lock_bh(&ctx
->lock
);
331 if (geniv
->encrypt
!= echainiv_encrypt_compat_first
)
334 geniv
->encrypt
= echainiv_encrypt_compat
;
335 err
= crypto_rng_get_bytes(crypto_default_rng
, ctx
->salt
,
336 crypto_aead_ivsize(geniv
));
339 spin_unlock_bh(&ctx
->lock
);
344 return echainiv_encrypt_compat(req
);
347 static int echainiv_encrypt_first(struct aead_request
*req
)
349 struct crypto_aead
*geniv
= crypto_aead_reqtfm(req
);
350 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
353 spin_lock_bh(&ctx
->lock
);
354 if (geniv
->encrypt
!= echainiv_encrypt_first
)
357 geniv
->encrypt
= echainiv_encrypt
;
358 err
= crypto_rng_get_bytes(crypto_default_rng
, ctx
->salt
,
359 crypto_aead_ivsize(geniv
));
362 spin_unlock_bh(&ctx
->lock
);
367 return echainiv_encrypt(req
);
370 static int echainiv_compat_init(struct crypto_tfm
*tfm
)
372 struct crypto_aead
*geniv
= __crypto_aead_cast(tfm
);
373 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
376 spin_lock_init(&ctx
->lock
);
378 crypto_aead_set_reqsize(geniv
, sizeof(struct echainiv_request_ctx
));
380 err
= aead_geniv_init(tfm
);
382 ctx
->child
= geniv
->child
;
383 geniv
->child
= geniv
;
388 static int echainiv_init(struct crypto_tfm
*tfm
)
390 struct crypto_aead
*geniv
= __crypto_aead_cast(tfm
);
391 struct echainiv_ctx
*ctx
= crypto_aead_ctx(geniv
);
394 spin_lock_init(&ctx
->lock
);
396 crypto_aead_set_reqsize(geniv
, sizeof(struct aead_request
));
398 ctx
->null
= crypto_get_default_null_skcipher();
399 err
= PTR_ERR(ctx
->null
);
400 if (IS_ERR(ctx
->null
))
403 err
= aead_geniv_init(tfm
);
407 ctx
->child
= geniv
->child
;
408 geniv
->child
= geniv
;
414 crypto_put_default_null_skcipher();
418 static void echainiv_compat_exit(struct crypto_tfm
*tfm
)
420 struct echainiv_ctx
*ctx
= crypto_tfm_ctx(tfm
);
422 crypto_free_aead(ctx
->child
);
425 static void echainiv_exit(struct crypto_tfm
*tfm
)
427 struct echainiv_ctx
*ctx
= crypto_tfm_ctx(tfm
);
429 crypto_free_aead(ctx
->child
);
430 crypto_put_default_null_skcipher();
433 static struct crypto_template echainiv_tmpl
;
435 static struct crypto_instance
*echainiv_aead_alloc(struct rtattr
**tb
)
437 struct aead_instance
*inst
;
438 struct crypto_aead_spawn
*spawn
;
439 struct aead_alg
*alg
;
441 inst
= aead_geniv_alloc(&echainiv_tmpl
, tb
, 0, 0);
446 if (inst
->alg
.ivsize
< sizeof(u64
) ||
447 inst
->alg
.ivsize
& (sizeof(u32
) - 1) ||
448 inst
->alg
.ivsize
> MAX_IV_SIZE
) {
449 aead_geniv_free(inst
);
450 inst
= ERR_PTR(-EINVAL
);
454 spawn
= aead_instance_ctx(inst
);
455 alg
= crypto_spawn_aead_alg(spawn
);
457 inst
->alg
.setkey
= echainiv_setkey
;
458 inst
->alg
.setauthsize
= echainiv_setauthsize
;
459 inst
->alg
.encrypt
= echainiv_encrypt_first
;
460 inst
->alg
.decrypt
= echainiv_decrypt
;
462 inst
->alg
.base
.cra_init
= echainiv_init
;
463 inst
->alg
.base
.cra_exit
= echainiv_exit
;
465 inst
->alg
.base
.cra_alignmask
|= __alignof__(u32
) - 1;
466 inst
->alg
.base
.cra_ctxsize
= sizeof(struct echainiv_ctx
);
467 inst
->alg
.base
.cra_ctxsize
+= inst
->alg
.base
.cra_aead
.ivsize
;
469 if (alg
->base
.cra_aead
.encrypt
) {
470 inst
->alg
.encrypt
= echainiv_encrypt_compat_first
;
471 inst
->alg
.decrypt
= echainiv_decrypt_compat
;
473 inst
->alg
.base
.cra_init
= echainiv_compat_init
;
474 inst
->alg
.base
.cra_exit
= echainiv_compat_exit
;
478 return aead_crypto_instance(inst
);
481 static struct crypto_instance
*echainiv_alloc(struct rtattr
**tb
)
483 struct crypto_instance
*inst
;
486 err
= crypto_get_default_rng();
490 inst
= echainiv_aead_alloc(tb
);
499 crypto_put_default_rng();
503 static void echainiv_free(struct crypto_instance
*inst
)
505 aead_geniv_free(aead_instance(inst
));
506 crypto_put_default_rng();
509 static struct crypto_template echainiv_tmpl
= {
511 .alloc
= echainiv_alloc
,
512 .free
= echainiv_free
,
513 .module
= THIS_MODULE
,
516 static int __init
echainiv_module_init(void)
518 return crypto_register_template(&echainiv_tmpl
);
521 static void __exit
echainiv_module_exit(void)
523 crypto_unregister_template(&echainiv_tmpl
);
526 module_init(echainiv_module_init
);
527 module_exit(echainiv_module_exit
);
529 MODULE_LICENSE("GPL");
530 MODULE_DESCRIPTION("Encrypted Chain IV Generator");
531 MODULE_ALIAS_CRYPTO("echainiv");