1 /* LRW: as defined by Cyril Guyot in
2 * http://grouper.ieee.org/groups/1619/email/pdf00017.pdf
4 * Copyright (c) 2006 Rik Snel <rsnel@cube.dyndns.org>
7 * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
9 * This program is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by the Free
11 * Software Foundation; either version 2 of the License, or (at your option)
14 /* This implementation is checked against the test vectors in the above
15 * document and by a test vector provided by Ken Buchanan at
16 * http://www.mail-archive.com/stds-p1619@listserv.ieee.org/msg00173.html
18 * The test vectors are included in the testing module tcrypt.[ch] */
19 #include <crypto/algapi.h>
20 #include <linux/err.h>
21 #include <linux/init.h>
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/scatterlist.h>
25 #include <linux/slab.h>
27 #include <crypto/b128ops.h>
28 #include <crypto/gf128mul.h>
30 #define LRW_BLOCK_SIZE 16
32 struct lrw_table_ctx
{
33 /* optimizes multiplying a random (non incrementing, as at the
34 * start of a new sector) value with key2, we could also have
35 * used 4k optimization tables or no optimization at all. In the
36 * latter case we would have to store key2 here */
37 struct gf128mul_64k
*table
;
39 * key2*{ 0,0,...0,0,0,0,1 }, key2*{ 0,0,...0,0,0,1,1 },
40 * key2*{ 0,0,...0,0,1,1,1 }, key2*{ 0,0,...0,1,1,1,1 }
41 * key2*{ 0,0,...1,1,1,1,1 }, etc
42 * needed for optimized multiplication of incrementing values
48 struct crypto_cipher
*child
;
49 struct lrw_table_ctx table
;
52 static inline void setbit128_bbe(void *b
, int bit
)
54 __set_bit(bit
^ (0x80 -
63 static int lrw_init_table(struct lrw_table_ctx
*ctx
, const u8
*tweak
)
69 gf128mul_free_64k(ctx
->table
);
71 /* initialize multiplication table for Key2 */
72 ctx
->table
= gf128mul_init_64k_bbe((be128
*)tweak
);
76 /* initialize optimization table */
77 for (i
= 0; i
< 128; i
++) {
78 setbit128_bbe(&tmp
, i
);
80 gf128mul_64k_bbe(&ctx
->mulinc
[i
], ctx
->table
);
86 static void lrw_free_table(struct lrw_table_ctx
*ctx
)
89 gf128mul_free_64k(ctx
->table
);
92 static int setkey(struct crypto_tfm
*parent
, const u8
*key
,
95 struct priv
*ctx
= crypto_tfm_ctx(parent
);
96 struct crypto_cipher
*child
= ctx
->child
;
97 int err
, bsize
= LRW_BLOCK_SIZE
;
98 const u8
*tweak
= key
+ keylen
- bsize
;
100 crypto_cipher_clear_flags(child
, CRYPTO_TFM_REQ_MASK
);
101 crypto_cipher_set_flags(child
, crypto_tfm_get_flags(parent
) &
102 CRYPTO_TFM_REQ_MASK
);
103 err
= crypto_cipher_setkey(child
, key
, keylen
- bsize
);
106 crypto_tfm_set_flags(parent
, crypto_cipher_get_flags(child
) &
107 CRYPTO_TFM_RES_MASK
);
109 return lrw_init_table(&ctx
->table
, tweak
);
114 struct crypto_tfm
*tfm
;
115 void (*fn
)(struct crypto_tfm
*, u8
*, const u8
*);
118 static inline void inc(be128
*iv
)
120 be64_add_cpu(&iv
->b
, 1);
122 be64_add_cpu(&iv
->a
, 1);
125 static inline void lrw_round(struct sinfo
*s
, void *dst
, const void *src
)
127 be128_xor(dst
, &s
->t
, src
); /* PP <- T xor P */
128 s
->fn(s
->tfm
, dst
, dst
); /* CC <- E(Key2,PP) */
129 be128_xor(dst
, dst
, &s
->t
); /* C <- T xor CC */
132 /* this returns the number of consequative 1 bits starting
133 * from the right, get_index128(00 00 00 00 00 00 ... 00 00 10 FB) = 2 */
134 static inline int get_index128(be128
*block
)
137 __be32
*p
= (__be32
*) block
;
139 for (p
+= 3, x
= 0; x
< 128; p
--, x
+= 32) {
140 u32 val
= be32_to_cpup(p
);
151 static int crypt(struct blkcipher_desc
*d
,
152 struct blkcipher_walk
*w
, struct priv
*ctx
,
153 void (*fn
)(struct crypto_tfm
*, u8
*, const u8
*))
157 const int bs
= LRW_BLOCK_SIZE
;
159 .tfm
= crypto_cipher_tfm(ctx
->child
),
166 err
= blkcipher_walk_virt(d
, w
);
167 if (!(avail
= w
->nbytes
))
170 wsrc
= w
->src
.virt
.addr
;
171 wdst
= w
->dst
.virt
.addr
;
173 /* calculate first value of T */
178 gf128mul_64k_bbe(&s
.t
, ctx
->table
.table
);
184 /* T <- I*Key2, using the optimization
185 * discussed in the specification */
186 be128_xor(&s
.t
, &s
.t
,
187 &ctx
->table
.mulinc
[get_index128(iv
)]);
191 lrw_round(&s
, wdst
, wsrc
);
195 } while ((avail
-= bs
) >= bs
);
197 err
= blkcipher_walk_done(d
, w
, avail
);
198 if (!(avail
= w
->nbytes
))
201 wsrc
= w
->src
.virt
.addr
;
202 wdst
= w
->dst
.virt
.addr
;
208 static int encrypt(struct blkcipher_desc
*desc
, struct scatterlist
*dst
,
209 struct scatterlist
*src
, unsigned int nbytes
)
211 struct priv
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
212 struct blkcipher_walk w
;
214 blkcipher_walk_init(&w
, dst
, src
, nbytes
);
215 return crypt(desc
, &w
, ctx
,
216 crypto_cipher_alg(ctx
->child
)->cia_encrypt
);
219 static int decrypt(struct blkcipher_desc
*desc
, struct scatterlist
*dst
,
220 struct scatterlist
*src
, unsigned int nbytes
)
222 struct priv
*ctx
= crypto_blkcipher_ctx(desc
->tfm
);
223 struct blkcipher_walk w
;
225 blkcipher_walk_init(&w
, dst
, src
, nbytes
);
226 return crypt(desc
, &w
, ctx
,
227 crypto_cipher_alg(ctx
->child
)->cia_decrypt
);
230 static int init_tfm(struct crypto_tfm
*tfm
)
232 struct crypto_cipher
*cipher
;
233 struct crypto_instance
*inst
= (void *)tfm
->__crt_alg
;
234 struct crypto_spawn
*spawn
= crypto_instance_ctx(inst
);
235 struct priv
*ctx
= crypto_tfm_ctx(tfm
);
236 u32
*flags
= &tfm
->crt_flags
;
238 cipher
= crypto_spawn_cipher(spawn
);
240 return PTR_ERR(cipher
);
242 if (crypto_cipher_blocksize(cipher
) != LRW_BLOCK_SIZE
) {
243 *flags
|= CRYPTO_TFM_RES_BAD_BLOCK_LEN
;
244 crypto_free_cipher(cipher
);
252 static void exit_tfm(struct crypto_tfm
*tfm
)
254 struct priv
*ctx
= crypto_tfm_ctx(tfm
);
256 lrw_free_table(&ctx
->table
);
257 crypto_free_cipher(ctx
->child
);
260 static struct crypto_instance
*alloc(struct rtattr
**tb
)
262 struct crypto_instance
*inst
;
263 struct crypto_alg
*alg
;
266 err
= crypto_check_attr_type(tb
, CRYPTO_ALG_TYPE_BLKCIPHER
);
270 alg
= crypto_get_attr_alg(tb
, CRYPTO_ALG_TYPE_CIPHER
,
271 CRYPTO_ALG_TYPE_MASK
);
273 return ERR_CAST(alg
);
275 inst
= crypto_alloc_instance("lrw", alg
);
279 inst
->alg
.cra_flags
= CRYPTO_ALG_TYPE_BLKCIPHER
;
280 inst
->alg
.cra_priority
= alg
->cra_priority
;
281 inst
->alg
.cra_blocksize
= alg
->cra_blocksize
;
283 if (alg
->cra_alignmask
< 7) inst
->alg
.cra_alignmask
= 7;
284 else inst
->alg
.cra_alignmask
= alg
->cra_alignmask
;
285 inst
->alg
.cra_type
= &crypto_blkcipher_type
;
287 if (!(alg
->cra_blocksize
% 4))
288 inst
->alg
.cra_alignmask
|= 3;
289 inst
->alg
.cra_blkcipher
.ivsize
= alg
->cra_blocksize
;
290 inst
->alg
.cra_blkcipher
.min_keysize
=
291 alg
->cra_cipher
.cia_min_keysize
+ alg
->cra_blocksize
;
292 inst
->alg
.cra_blkcipher
.max_keysize
=
293 alg
->cra_cipher
.cia_max_keysize
+ alg
->cra_blocksize
;
295 inst
->alg
.cra_ctxsize
= sizeof(struct priv
);
297 inst
->alg
.cra_init
= init_tfm
;
298 inst
->alg
.cra_exit
= exit_tfm
;
300 inst
->alg
.cra_blkcipher
.setkey
= setkey
;
301 inst
->alg
.cra_blkcipher
.encrypt
= encrypt
;
302 inst
->alg
.cra_blkcipher
.decrypt
= decrypt
;
309 static void free(struct crypto_instance
*inst
)
311 crypto_drop_spawn(crypto_instance_ctx(inst
));
315 static struct crypto_template crypto_tmpl
= {
319 .module
= THIS_MODULE
,
322 static int __init
crypto_module_init(void)
324 return crypto_register_template(&crypto_tmpl
);
327 static void __exit
crypto_module_exit(void)
329 crypto_unregister_template(&crypto_tmpl
);
332 module_init(crypto_module_init
);
333 module_exit(crypto_module_exit
);
335 MODULE_LICENSE("GPL");
336 MODULE_DESCRIPTION("LRW block cipher mode");