[linux-2.6-block.git] / crypto / ghash-generic.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * GHASH: digest algorithm for GCM (Galois/Counter Mode).
 *
 * Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
 * Copyright (c) 2009 Intel Corp.
 *   Author: Huang Ying <ying.huang@intel.com>
 *
 * The algorithm implementation is copied from gcm.c.
 */

#include <crypto/algapi.h>
#include <crypto/gf128mul.h>
#include <crypto/ghash.h>
#include <crypto/internal/hash.h>
#include <linux/crypto.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>

static int ghash_init(struct shash_desc *desc)
{
	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);

	memset(dctx, 0, sizeof(*dctx));

	return 0;
}

static int ghash_setkey(struct crypto_shash *tfm,
			const u8 *key, unsigned int keylen)
{
	struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
	be128 k;

	if (keylen != GHASH_BLOCK_SIZE) {
		crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
		return -EINVAL;
	}

	if (ctx->gf128)
		gf128mul_free_4k(ctx->gf128);

	BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE);
	memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */
	ctx->gf128 = gf128mul_init_4k_lle(&k);
	memzero_explicit(&k, GHASH_BLOCK_SIZE);

	if (!ctx->gf128)
		return -ENOMEM;

	return 0;
}

static int ghash_update(struct shash_desc *desc,
			 const u8 *src, unsigned int srclen)
{
	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
	u8 *dst = dctx->buffer;

	if (dctx->bytes) {
		int n = min(srclen, dctx->bytes);
		u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes);

		dctx->bytes -= n;
		srclen -= n;

		while (n--)
			*pos++ ^= *src++;

		if (!dctx->bytes)
			gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	}

	while (srclen >= GHASH_BLOCK_SIZE) {
		crypto_xor(dst, src, GHASH_BLOCK_SIZE);
		gf128mul_4k_lle((be128 *)dst, ctx->gf128);
		src += GHASH_BLOCK_SIZE;
		srclen -= GHASH_BLOCK_SIZE;
	}

	if (srclen) {
		dctx->bytes = GHASH_BLOCK_SIZE - srclen;
		while (srclen--)
			*dst++ ^= *src++;
	}

	return 0;
}

static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
{
	u8 *dst = dctx->buffer;

	if (dctx->bytes) {
		u8 *tmp = dst + (GHASH_BLOCK_SIZE - dctx->bytes);

		while (dctx->bytes--)
			*tmp++ ^= 0;

		gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	}

	dctx->bytes = 0;
}

static int ghash_final(struct shash_desc *desc, u8 *dst)
{
	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
	u8 *buf = dctx->buffer;

	ghash_flush(ctx, dctx);
	memcpy(dst, buf, GHASH_BLOCK_SIZE);

	return 0;
}

static void ghash_exit_tfm(struct crypto_tfm *tfm)
{
	struct ghash_ctx *ctx = crypto_tfm_ctx(tfm);
	if (ctx->gf128)
		gf128mul_free_4k(ctx->gf128);
}

static struct shash_alg ghash_alg = {
	.digestsize	= GHASH_DIGEST_SIZE,
	.init		= ghash_init,
	.update		= ghash_update,
	.final		= ghash_final,
	.setkey		= ghash_setkey,
	.descsize	= sizeof(struct ghash_desc_ctx),
	.base		= {
		.cra_name		= "ghash",
		.cra_driver_name	= "ghash-generic",
		.cra_priority		= 100,
		.cra_blocksize		= GHASH_BLOCK_SIZE,
		.cra_ctxsize		= sizeof(struct ghash_ctx),
		.cra_module		= THIS_MODULE,
		.cra_exit		= ghash_exit_tfm,
	},
};

static int __init ghash_mod_init(void)
{
	return crypto_register_shash(&ghash_alg);
}

static void __exit ghash_mod_exit(void)
{
	crypto_unregister_shash(&ghash_alg);
}

subsys_initcall(ghash_mod_init);
module_exit(ghash_mod_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("GHASH Message Digest Algorithm");
MODULE_ALIAS_CRYPTO("ghash");
MODULE_ALIAS_CRYPTO("ghash-generic");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
2cdc6899 HY	2	/*
	3	* GHASH: digest algorithm for GCM (Galois/Counter Mode).
	4	*
	5	* Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
	6	* Copyright (c) 2009 Intel Corp.
	7	* Author: Huang Ying <ying.huang@intel.com>
	8	*
	9	* The algorithm implementation is copied from gcm.c.
2cdc6899 HY	10	*/
	11
	12	#include <crypto/algapi.h>
	13	#include <crypto/gf128mul.h>
a397ba82	14	#include <crypto/ghash.h>
2cdc6899 HY	15	#include <crypto/internal/hash.h>
	16	#include <linux/crypto.h>
	17	#include <linux/init.h>
	18	#include <linux/kernel.h>
	19	#include <linux/module.h>
	20
2cdc6899 HY	21	static int ghash_init(struct shash_desc *desc)
	22	{
	23	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
	24
	25	memset(dctx, 0, sizeof(*dctx));
	26
	27	return 0;
	28	}
	29
	30	static int ghash_setkey(struct crypto_shash *tfm,
	31	const u8 *key, unsigned int keylen)
	32	{
	33	struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
5c6bc4df	34	be128 k;
2cdc6899 HY	35
	36	if (keylen != GHASH_BLOCK_SIZE) {
	37	crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
	38	return -EINVAL;
	39	}
	40
	41	if (ctx->gf128)
	42	gf128mul_free_4k(ctx->gf128);
5c6bc4df EB	43
	44	BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE);
	45	memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */
	46	ctx->gf128 = gf128mul_init_4k_lle(&k);
	47	memzero_explicit(&k, GHASH_BLOCK_SIZE);
	48
2cdc6899 HY	49	if (!ctx->gf128)
	50	return -ENOMEM;
	51
	52	return 0;
	53	}
	54
	55	static int ghash_update(struct shash_desc *desc,
	56	const u8 *src, unsigned int srclen)
	57	{
	58	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
	59	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
	60	u8 *dst = dctx->buffer;
	61
	62	if (dctx->bytes) {
	63	int n = min(srclen, dctx->bytes);
	64	u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
	65
	66	dctx->bytes -= n;
	67	srclen -= n;
	68
	69	while (n--)
	70	pos++ ^= src++;
	71
	72	if (!dctx->bytes)
	73	gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	74	}
	75
	76	while (srclen >= GHASH_BLOCK_SIZE) {
	77	crypto_xor(dst, src, GHASH_BLOCK_SIZE);
	78	gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	79	src += GHASH_BLOCK_SIZE;
	80	srclen -= GHASH_BLOCK_SIZE;
	81	}
	82
	83	if (srclen) {
	84	dctx->bytes = GHASH_BLOCK_SIZE - srclen;
	85	while (srclen--)
	86	dst++ ^= src++;
	87	}
	88
	89	return 0;
	90	}
	91
	92	static void ghash_flush(struct ghash_ctx ctx, struct ghash_desc_ctx dctx)
	93	{
	94	u8 *dst = dctx->buffer;
	95
	96	if (dctx->bytes) {
	97	u8 *tmp = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
	98
	99	while (dctx->bytes--)
	100	*tmp++ ^= 0;
	101
	102	gf128mul_4k_lle((be128 *)dst, ctx->gf128);
	103	}
	104
	105	dctx->bytes = 0;
	106	}
	107
	108	static int ghash_final(struct shash_desc desc, u8 dst)
	109	{
	110	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
	111	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
	112	u8 *buf = dctx->buffer;
113
114	ghash_flush(ctx, dctx);
115	memcpy(dst, buf, GHASH_BLOCK_SIZE);
116
117	return 0;
118	}
119
120	static void ghash_exit_tfm(struct crypto_tfm *tfm)
121	{
122	struct ghash_ctx *ctx = crypto_tfm_ctx(tfm);
123	if (ctx->gf128)
124	gf128mul_free_4k(ctx->gf128);
125	}
126
127	static struct shash_alg ghash_alg = {
128	.digestsize = GHASH_DIGEST_SIZE,
129	.init = ghash_init,
130	.update = ghash_update,
131	.final = ghash_final,
132	.setkey = ghash_setkey,
133	.descsize = sizeof(struct ghash_desc_ctx),
134	.base = {
135	.cra_name = "ghash",
136	.cra_driver_name = "ghash-generic",
137	.cra_priority = 100,
2cdc6899 HY	138	.cra_blocksize = GHASH_BLOCK_SIZE,
	139	.cra_ctxsize = sizeof(struct ghash_ctx),
	140	.cra_module = THIS_MODULE,
2cdc6899 HY	141	.cra_exit = ghash_exit_tfm,
	142	},
	143	};
	144
	145	static int __init ghash_mod_init(void)
	146	{
	147	return crypto_register_shash(&ghash_alg);
	148	}
	149
	150	static void __exit ghash_mod_exit(void)
	151	{
	152	crypto_unregister_shash(&ghash_alg);
	153	}
	154
c4741b23	155	subsys_initcall(ghash_mod_init);
2cdc6899 HY	156	module_exit(ghash_mod_exit);
	157
	158	MODULE_LICENSE("GPL");
	159	MODULE_DESCRIPTION("GHASH Message Digest Algorithm");
5d26a105	160	MODULE_ALIAS_CRYPTO("ghash");
3e14dcf7	161	MODULE_ALIAS_CRYPTO("ghash-generic");