Commit | Line | Data |
---|---|---|
23e353c8 JL |
1 | /* |
2 | * CTR: Counter mode | |
3 | * | |
4 | * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify it | |
7 | * under the terms of the GNU General Public License as published by the Free | |
8 | * Software Foundation; either version 2 of the License, or (at your option) | |
9 | * any later version. | |
10 | * | |
11 | */ | |
12 | ||
13 | #include <crypto/algapi.h> | |
5311f248 | 14 | #include <crypto/ctr.h> |
69d3150c | 15 | #include <crypto/internal/skcipher.h> |
23e353c8 JL |
16 | #include <linux/err.h> |
17 | #include <linux/init.h> | |
18 | #include <linux/kernel.h> | |
19 | #include <linux/module.h> | |
23e353c8 JL |
20 | #include <linux/slab.h> |
21 | ||
5311f248 | 22 | struct crypto_rfc3686_ctx { |
b2b39c2f | 23 | struct crypto_skcipher *child; |
5311f248 | 24 | u8 nonce[CTR_RFC3686_NONCE_SIZE]; |
23e353c8 JL |
25 | }; |
26 | ||
69d3150c JK |
27 | struct crypto_rfc3686_req_ctx { |
28 | u8 iv[CTR_RFC3686_BLOCK_SIZE]; | |
b2b39c2f | 29 | struct skcipher_request subreq CRYPTO_MINALIGN_ATTR; |
69d3150c JK |
30 | }; |
31 | ||
11f14630 | 32 | static void crypto_ctr_crypt_final(struct skcipher_walk *walk, |
5311f248 | 33 | struct crypto_cipher *tfm) |
0971eb0d HX |
34 | { |
35 | unsigned int bsize = crypto_cipher_blocksize(tfm); | |
5311f248 HX |
36 | unsigned long alignmask = crypto_cipher_alignmask(tfm); |
37 | u8 *ctrblk = walk->iv; | |
6650c4de | 38 | u8 tmp[MAX_CIPHER_BLOCKSIZE + MAX_CIPHER_ALIGNMASK]; |
5311f248 | 39 | u8 *keystream = PTR_ALIGN(tmp + 0, alignmask + 1); |
0971eb0d HX |
40 | u8 *src = walk->src.virt.addr; |
41 | u8 *dst = walk->dst.virt.addr; | |
42 | unsigned int nbytes = walk->nbytes; | |
43 | ||
44 | crypto_cipher_encrypt_one(tfm, keystream, ctrblk); | |
45fe93df | 45 | crypto_xor_cpy(dst, keystream, src, nbytes); |
5311f248 HX |
46 | |
47 | crypto_inc(ctrblk, bsize); | |
0971eb0d HX |
48 | } |
49 | ||
11f14630 | 50 | static int crypto_ctr_crypt_segment(struct skcipher_walk *walk, |
5311f248 | 51 | struct crypto_cipher *tfm) |
23e353c8 JL |
52 | { |
53 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *) = | |
54 | crypto_cipher_alg(tfm)->cia_encrypt; | |
55 | unsigned int bsize = crypto_cipher_blocksize(tfm); | |
5311f248 | 56 | u8 *ctrblk = walk->iv; |
23e353c8 JL |
57 | u8 *src = walk->src.virt.addr; |
58 | u8 *dst = walk->dst.virt.addr; | |
59 | unsigned int nbytes = walk->nbytes; | |
60 | ||
61 | do { | |
62 | /* create keystream */ | |
0971eb0d HX |
63 | fn(crypto_cipher_tfm(tfm), dst, ctrblk); |
64 | crypto_xor(dst, src, bsize); | |
23e353c8 JL |
65 | |
66 | /* increment counter in counterblock */ | |
5311f248 | 67 | crypto_inc(ctrblk, bsize); |
23e353c8 | 68 | |
23e353c8 JL |
69 | src += bsize; |
70 | dst += bsize; | |
0971eb0d | 71 | } while ((nbytes -= bsize) >= bsize); |
23e353c8 | 72 | |
0971eb0d | 73 | return nbytes; |
23e353c8 JL |
74 | } |
75 | ||
11f14630 | 76 | static int crypto_ctr_crypt_inplace(struct skcipher_walk *walk, |
5311f248 | 77 | struct crypto_cipher *tfm) |
23e353c8 JL |
78 | { |
79 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *) = | |
80 | crypto_cipher_alg(tfm)->cia_encrypt; | |
81 | unsigned int bsize = crypto_cipher_blocksize(tfm); | |
5311f248 | 82 | unsigned long alignmask = crypto_cipher_alignmask(tfm); |
23e353c8 | 83 | unsigned int nbytes = walk->nbytes; |
5311f248 | 84 | u8 *ctrblk = walk->iv; |
23e353c8 | 85 | u8 *src = walk->src.virt.addr; |
6650c4de | 86 | u8 tmp[MAX_CIPHER_BLOCKSIZE + MAX_CIPHER_ALIGNMASK]; |
5311f248 | 87 | u8 *keystream = PTR_ALIGN(tmp + 0, alignmask + 1); |
23e353c8 JL |
88 | |
89 | do { | |
90 | /* create keystream */ | |
91 | fn(crypto_cipher_tfm(tfm), keystream, ctrblk); | |
0971eb0d | 92 | crypto_xor(src, keystream, bsize); |
23e353c8 JL |
93 | |
94 | /* increment counter in counterblock */ | |
5311f248 | 95 | crypto_inc(ctrblk, bsize); |
23e353c8 | 96 | |
23e353c8 | 97 | src += bsize; |
0971eb0d | 98 | } while ((nbytes -= bsize) >= bsize); |
23e353c8 | 99 | |
0971eb0d | 100 | return nbytes; |
23e353c8 JL |
101 | } |
102 | ||
11f14630 | 103 | static int crypto_ctr_crypt(struct skcipher_request *req) |
23e353c8 | 104 | { |
11f14630 EB |
105 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
106 | struct crypto_cipher *cipher = skcipher_cipher_simple(tfm); | |
107 | const unsigned int bsize = crypto_cipher_blocksize(cipher); | |
108 | struct skcipher_walk walk; | |
109 | unsigned int nbytes; | |
23e353c8 JL |
110 | int err; |
111 | ||
11f14630 | 112 | err = skcipher_walk_virt(&walk, req, false); |
23e353c8 | 113 | |
0971eb0d | 114 | while (walk.nbytes >= bsize) { |
23e353c8 | 115 | if (walk.src.virt.addr == walk.dst.virt.addr) |
11f14630 | 116 | nbytes = crypto_ctr_crypt_inplace(&walk, cipher); |
23e353c8 | 117 | else |
11f14630 | 118 | nbytes = crypto_ctr_crypt_segment(&walk, cipher); |
23e353c8 | 119 | |
11f14630 | 120 | err = skcipher_walk_done(&walk, nbytes); |
23e353c8 | 121 | } |
0971eb0d HX |
122 | |
123 | if (walk.nbytes) { | |
11f14630 EB |
124 | crypto_ctr_crypt_final(&walk, cipher); |
125 | err = skcipher_walk_done(&walk, 0); | |
0971eb0d HX |
126 | } |
127 | ||
23e353c8 JL |
128 | return err; |
129 | } | |
130 | ||
11f14630 | 131 | static int crypto_ctr_create(struct crypto_template *tmpl, struct rtattr **tb) |
23e353c8 | 132 | { |
11f14630 | 133 | struct skcipher_instance *inst; |
23e353c8 | 134 | struct crypto_alg *alg; |
23e353c8 JL |
135 | int err; |
136 | ||
11f14630 EB |
137 | inst = skcipher_alloc_instance_simple(tmpl, tb, &alg); |
138 | if (IS_ERR(inst)) | |
139 | return PTR_ERR(inst); | |
23e353c8 | 140 | |
5311f248 | 141 | /* Block size must be >= 4 bytes. */ |
23e353c8 | 142 | err = -EINVAL; |
5311f248 | 143 | if (alg->cra_blocksize < 4) |
11f14630 | 144 | goto out_free_inst; |
23e353c8 | 145 | |
3f8214ea | 146 | /* If this is false we'd fail the alignment of crypto_inc. */ |
5311f248 | 147 | if (alg->cra_blocksize % 4) |
11f14630 | 148 | goto out_free_inst; |
23e353c8 | 149 | |
11f14630 EB |
150 | /* CTR mode is a stream cipher. */ |
151 | inst->alg.base.cra_blocksize = 1; | |
23e353c8 | 152 | |
11f14630 EB |
153 | /* |
154 | * To simplify the implementation, configure the skcipher walk to only | |
155 | * give a partial block at the very end, never earlier. | |
156 | */ | |
157 | inst->alg.chunksize = alg->cra_blocksize; | |
23e353c8 | 158 | |
11f14630 EB |
159 | inst->alg.encrypt = crypto_ctr_crypt; |
160 | inst->alg.decrypt = crypto_ctr_crypt; | |
23e353c8 | 161 | |
11f14630 EB |
162 | err = skcipher_register_instance(tmpl, inst); |
163 | if (err) | |
164 | goto out_free_inst; | |
165 | goto out_put_alg; | |
5311f248 | 166 | |
11f14630 EB |
167 | out_free_inst: |
168 | inst->free(inst); | |
5311f248 | 169 | out_put_alg: |
11f14630 EB |
170 | crypto_mod_put(alg); |
171 | return err; | |
23e353c8 JL |
172 | } |
173 | ||
b2b39c2f | 174 | static int crypto_rfc3686_setkey(struct crypto_skcipher *parent, |
69d3150c | 175 | const u8 *key, unsigned int keylen) |
5311f248 | 176 | { |
b2b39c2f HX |
177 | struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(parent); |
178 | struct crypto_skcipher *child = ctx->child; | |
5311f248 HX |
179 | int err; |
180 | ||
181 | /* the nonce is stored in bytes at end of key */ | |
182 | if (keylen < CTR_RFC3686_NONCE_SIZE) | |
183 | return -EINVAL; | |
184 | ||
185 | memcpy(ctx->nonce, key + (keylen - CTR_RFC3686_NONCE_SIZE), | |
186 | CTR_RFC3686_NONCE_SIZE); | |
187 | ||
188 | keylen -= CTR_RFC3686_NONCE_SIZE; | |
189 | ||
b2b39c2f HX |
190 | crypto_skcipher_clear_flags(child, CRYPTO_TFM_REQ_MASK); |
191 | crypto_skcipher_set_flags(child, crypto_skcipher_get_flags(parent) & | |
192 | CRYPTO_TFM_REQ_MASK); | |
193 | err = crypto_skcipher_setkey(child, key, keylen); | |
194 | crypto_skcipher_set_flags(parent, crypto_skcipher_get_flags(child) & | |
195 | CRYPTO_TFM_RES_MASK); | |
5311f248 HX |
196 | |
197 | return err; | |
198 | } | |
199 | ||
b2b39c2f | 200 | static int crypto_rfc3686_crypt(struct skcipher_request *req) |
5311f248 | 201 | { |
b2b39c2f HX |
202 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); |
203 | struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(tfm); | |
204 | struct crypto_skcipher *child = ctx->child; | |
205 | unsigned long align = crypto_skcipher_alignmask(tfm); | |
69d3150c | 206 | struct crypto_rfc3686_req_ctx *rctx = |
b2b39c2f HX |
207 | (void *)PTR_ALIGN((u8 *)skcipher_request_ctx(req), align + 1); |
208 | struct skcipher_request *subreq = &rctx->subreq; | |
69d3150c | 209 | u8 *iv = rctx->iv; |
5311f248 HX |
210 | |
211 | /* set up counter block */ | |
212 | memcpy(iv, ctx->nonce, CTR_RFC3686_NONCE_SIZE); | |
b2b39c2f | 213 | memcpy(iv + CTR_RFC3686_NONCE_SIZE, req->iv, CTR_RFC3686_IV_SIZE); |
5311f248 HX |
214 | |
215 | /* initialize counter portion of counter block */ | |
216 | *(__be32 *)(iv + CTR_RFC3686_NONCE_SIZE + CTR_RFC3686_IV_SIZE) = | |
217 | cpu_to_be32(1); | |
218 | ||
b2b39c2f HX |
219 | skcipher_request_set_tfm(subreq, child); |
220 | skcipher_request_set_callback(subreq, req->base.flags, | |
221 | req->base.complete, req->base.data); | |
222 | skcipher_request_set_crypt(subreq, req->src, req->dst, | |
223 | req->cryptlen, iv); | |
5311f248 | 224 | |
b2b39c2f | 225 | return crypto_skcipher_encrypt(subreq); |
5311f248 HX |
226 | } |
227 | ||
b2b39c2f | 228 | static int crypto_rfc3686_init_tfm(struct crypto_skcipher *tfm) |
5311f248 | 229 | { |
b2b39c2f HX |
230 | struct skcipher_instance *inst = skcipher_alg_instance(tfm); |
231 | struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst); | |
232 | struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(tfm); | |
233 | struct crypto_skcipher *cipher; | |
69d3150c | 234 | unsigned long align; |
b2b39c2f | 235 | unsigned int reqsize; |
5311f248 | 236 | |
60425a8b | 237 | cipher = crypto_spawn_skcipher(spawn); |
5311f248 HX |
238 | if (IS_ERR(cipher)) |
239 | return PTR_ERR(cipher); | |
240 | ||
241 | ctx->child = cipher; | |
242 | ||
b2b39c2f | 243 | align = crypto_skcipher_alignmask(tfm); |
69d3150c | 244 | align &= ~(crypto_tfm_ctx_alignment() - 1); |
b2b39c2f HX |
245 | reqsize = align + sizeof(struct crypto_rfc3686_req_ctx) + |
246 | crypto_skcipher_reqsize(cipher); | |
247 | crypto_skcipher_set_reqsize(tfm, reqsize); | |
69d3150c | 248 | |
5311f248 HX |
249 | return 0; |
250 | } | |
251 | ||
b2b39c2f | 252 | static void crypto_rfc3686_exit_tfm(struct crypto_skcipher *tfm) |
5311f248 | 253 | { |
b2b39c2f HX |
254 | struct crypto_rfc3686_ctx *ctx = crypto_skcipher_ctx(tfm); |
255 | ||
256 | crypto_free_skcipher(ctx->child); | |
257 | } | |
5311f248 | 258 | |
b2b39c2f HX |
259 | static void crypto_rfc3686_free(struct skcipher_instance *inst) |
260 | { | |
261 | struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst); | |
262 | ||
263 | crypto_drop_skcipher(spawn); | |
264 | kfree(inst); | |
5311f248 HX |
265 | } |
266 | ||
b2b39c2f HX |
267 | static int crypto_rfc3686_create(struct crypto_template *tmpl, |
268 | struct rtattr **tb) | |
5311f248 | 269 | { |
69d3150c | 270 | struct crypto_attr_type *algt; |
b2b39c2f HX |
271 | struct skcipher_instance *inst; |
272 | struct skcipher_alg *alg; | |
69d3150c JK |
273 | struct crypto_skcipher_spawn *spawn; |
274 | const char *cipher_name; | |
d2c2a85c MC |
275 | u32 mask; |
276 | ||
5311f248 HX |
277 | int err; |
278 | ||
69d3150c | 279 | algt = crypto_get_attr_type(tb); |
69d3150c | 280 | if (IS_ERR(algt)) |
b2b39c2f | 281 | return PTR_ERR(algt); |
5311f248 | 282 | |
b2b39c2f HX |
283 | if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask) |
284 | return -EINVAL; | |
69d3150c JK |
285 | |
286 | cipher_name = crypto_attr_alg_name(tb[1]); | |
69d3150c | 287 | if (IS_ERR(cipher_name)) |
b2b39c2f | 288 | return PTR_ERR(cipher_name); |
5311f248 | 289 | |
69d3150c JK |
290 | inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL); |
291 | if (!inst) | |
b2b39c2f | 292 | return -ENOMEM; |
69d3150c | 293 | |
d2c2a85c MC |
294 | mask = crypto_requires_sync(algt->type, algt->mask) | |
295 | crypto_requires_off(algt->type, algt->mask, | |
296 | CRYPTO_ALG_NEED_FALLBACK); | |
297 | ||
b2b39c2f | 298 | spawn = skcipher_instance_ctx(inst); |
69d3150c | 299 | |
b2b39c2f | 300 | crypto_set_skcipher_spawn(spawn, skcipher_crypto_instance(inst)); |
d2c2a85c | 301 | err = crypto_grab_skcipher(spawn, cipher_name, 0, mask); |
69d3150c JK |
302 | if (err) |
303 | goto err_free_inst; | |
304 | ||
b2b39c2f | 305 | alg = crypto_spawn_skcipher_alg(spawn); |
69d3150c | 306 | |
5311f248 HX |
307 | /* We only support 16-byte blocks. */ |
308 | err = -EINVAL; | |
b2b39c2f | 309 | if (crypto_skcipher_alg_ivsize(alg) != CTR_RFC3686_BLOCK_SIZE) |
69d3150c | 310 | goto err_drop_spawn; |
5311f248 HX |
311 | |
312 | /* Not a stream cipher? */ | |
b2b39c2f | 313 | if (alg->base.cra_blocksize != 1) |
69d3150c | 314 | goto err_drop_spawn; |
5311f248 | 315 | |
69d3150c | 316 | err = -ENAMETOOLONG; |
b2b39c2f HX |
317 | if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, |
318 | "rfc3686(%s)", alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME) | |
69d3150c | 319 | goto err_drop_spawn; |
b2b39c2f HX |
320 | if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, |
321 | "rfc3686(%s)", alg->base.cra_driver_name) >= | |
322 | CRYPTO_MAX_ALG_NAME) | |
69d3150c | 323 | goto err_drop_spawn; |
5311f248 | 324 | |
b2b39c2f HX |
325 | inst->alg.base.cra_priority = alg->base.cra_priority; |
326 | inst->alg.base.cra_blocksize = 1; | |
327 | inst->alg.base.cra_alignmask = alg->base.cra_alignmask; | |
5311f248 | 328 | |
b2b39c2f | 329 | inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC; |
69d3150c | 330 | |
b2b39c2f HX |
331 | inst->alg.ivsize = CTR_RFC3686_IV_SIZE; |
332 | inst->alg.chunksize = crypto_skcipher_alg_chunksize(alg); | |
333 | inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(alg) + | |
334 | CTR_RFC3686_NONCE_SIZE; | |
335 | inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(alg) + | |
336 | CTR_RFC3686_NONCE_SIZE; | |
5311f248 | 337 | |
b2b39c2f HX |
338 | inst->alg.setkey = crypto_rfc3686_setkey; |
339 | inst->alg.encrypt = crypto_rfc3686_crypt; | |
340 | inst->alg.decrypt = crypto_rfc3686_crypt; | |
69d3150c | 341 | |
b2b39c2f | 342 | inst->alg.base.cra_ctxsize = sizeof(struct crypto_rfc3686_ctx); |
0a270321 | 343 | |
b2b39c2f HX |
344 | inst->alg.init = crypto_rfc3686_init_tfm; |
345 | inst->alg.exit = crypto_rfc3686_exit_tfm; | |
5311f248 | 346 | |
b2b39c2f | 347 | inst->free = crypto_rfc3686_free; |
5311f248 | 348 | |
b2b39c2f HX |
349 | err = skcipher_register_instance(tmpl, inst); |
350 | if (err) | |
351 | goto err_drop_spawn; | |
352 | ||
353 | out: | |
354 | return err; | |
5311f248 | 355 | |
69d3150c JK |
356 | err_drop_spawn: |
357 | crypto_drop_skcipher(spawn); | |
358 | err_free_inst: | |
359 | kfree(inst); | |
b2b39c2f | 360 | goto out; |
5311f248 HX |
361 | } |
362 | ||
9f8ef365 XW |
363 | static struct crypto_template crypto_ctr_tmpls[] = { |
364 | { | |
365 | .name = "ctr", | |
366 | .create = crypto_ctr_create, | |
367 | .module = THIS_MODULE, | |
368 | }, { | |
369 | .name = "rfc3686", | |
370 | .create = crypto_rfc3686_create, | |
371 | .module = THIS_MODULE, | |
372 | }, | |
5311f248 HX |
373 | }; |
374 | ||
23e353c8 JL |
375 | static int __init crypto_ctr_module_init(void) |
376 | { | |
9f8ef365 XW |
377 | return crypto_register_templates(crypto_ctr_tmpls, |
378 | ARRAY_SIZE(crypto_ctr_tmpls)); | |
23e353c8 JL |
379 | } |
380 | ||
381 | static void __exit crypto_ctr_module_exit(void) | |
382 | { | |
9f8ef365 XW |
383 | crypto_unregister_templates(crypto_ctr_tmpls, |
384 | ARRAY_SIZE(crypto_ctr_tmpls)); | |
23e353c8 JL |
385 | } |
386 | ||
c4741b23 | 387 | subsys_initcall(crypto_ctr_module_init); |
23e353c8 JL |
388 | module_exit(crypto_ctr_module_exit); |
389 | ||
390 | MODULE_LICENSE("GPL"); | |
11f14630 | 391 | MODULE_DESCRIPTION("CTR block cipher mode of operation"); |
5d26a105 | 392 | MODULE_ALIAS_CRYPTO("rfc3686"); |
4943ba16 | 393 | MODULE_ALIAS_CRYPTO("ctr"); |