Commit | Line | Data |
---|---|---|
76cb9521 KC |
1 | /* |
2 | * CTS: Cipher Text Stealing mode | |
3 | * | |
4 | * COPYRIGHT (c) 2008 | |
5 | * The Regents of the University of Michigan | |
6 | * ALL RIGHTS RESERVED | |
7 | * | |
8 | * Permission is granted to use, copy, create derivative works | |
9 | * and redistribute this software and such derivative works | |
10 | * for any purpose, so long as the name of The University of | |
11 | * Michigan is not used in any advertising or publicity | |
12 | * pertaining to the use of distribution of this software | |
13 | * without specific, written prior authorization. If the | |
14 | * above copyright notice or any other identification of the | |
15 | * University of Michigan is included in any copy of any | |
16 | * portion of this software, then the disclaimer below must | |
17 | * also be included. | |
18 | * | |
19 | * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION | |
20 | * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY | |
21 | * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF | |
22 | * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING | |
23 | * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF | |
24 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE | |
25 | * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE | |
26 | * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR | |
27 | * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING | |
28 | * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN | |
29 | * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF | |
30 | * SUCH DAMAGES. | |
31 | */ | |
32 | ||
33 | /* Derived from various: | |
34 | * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au> | |
35 | */ | |
36 | ||
37 | /* | |
38 | * This is the Cipher Text Stealing mode as described by | |
39 | * Section 8 of rfc2040 and referenced by rfc3962. | |
40 | * rfc3962 includes errata information in its Appendix A. | |
41 | */ | |
42 | ||
0605c41c | 43 | #include <crypto/internal/skcipher.h> |
76cb9521 KC |
44 | #include <linux/err.h> |
45 | #include <linux/init.h> | |
46 | #include <linux/kernel.h> | |
47 | #include <linux/log2.h> | |
48 | #include <linux/module.h> | |
49 | #include <linux/scatterlist.h> | |
50 | #include <crypto/scatterwalk.h> | |
51 | #include <linux/slab.h> | |
d8c34b94 | 52 | #include <linux/compiler.h> |
76cb9521 KC |
53 | |
54 | struct crypto_cts_ctx { | |
0605c41c | 55 | struct crypto_skcipher *child; |
76cb9521 KC |
56 | }; |
57 | ||
0605c41c HX |
58 | struct crypto_cts_reqctx { |
59 | struct scatterlist sg[2]; | |
60 | unsigned offset; | |
61 | struct skcipher_request subreq; | |
62 | }; | |
63 | ||
64 | static inline u8 *crypto_cts_reqctx_space(struct skcipher_request *req) | |
76cb9521 | 65 | { |
0605c41c HX |
66 | struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req); |
67 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
68 | struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm); | |
69 | struct crypto_skcipher *child = ctx->child; | |
76cb9521 | 70 | |
0605c41c HX |
71 | return PTR_ALIGN((u8 *)(rctx + 1) + crypto_skcipher_reqsize(child), |
72 | crypto_skcipher_alignmask(tfm) + 1); | |
76cb9521 KC |
73 | } |
74 | ||
0605c41c HX |
75 | static int crypto_cts_setkey(struct crypto_skcipher *parent, const u8 *key, |
76 | unsigned int keylen) | |
76cb9521 | 77 | { |
0605c41c HX |
78 | struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(parent); |
79 | struct crypto_skcipher *child = ctx->child; | |
76cb9521 KC |
80 | int err; |
81 | ||
0605c41c HX |
82 | crypto_skcipher_clear_flags(child, CRYPTO_TFM_REQ_MASK); |
83 | crypto_skcipher_set_flags(child, crypto_skcipher_get_flags(parent) & | |
84 | CRYPTO_TFM_REQ_MASK); | |
85 | err = crypto_skcipher_setkey(child, key, keylen); | |
86 | crypto_skcipher_set_flags(parent, crypto_skcipher_get_flags(child) & | |
87 | CRYPTO_TFM_RES_MASK); | |
88 | return err; | |
89 | } | |
76cb9521 | 90 | |
0605c41c HX |
91 | static void cts_cbc_crypt_done(struct crypto_async_request *areq, int err) |
92 | { | |
93 | struct skcipher_request *req = areq->data; | |
c4913c7b | 94 | |
0605c41c HX |
95 | if (err == -EINPROGRESS) |
96 | return; | |
76cb9521 | 97 | |
0605c41c HX |
98 | skcipher_request_complete(req, err); |
99 | } | |
76cb9521 | 100 | |
0605c41c HX |
101 | static int cts_cbc_encrypt(struct skcipher_request *req) |
102 | { | |
103 | struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req); | |
104 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
105 | struct skcipher_request *subreq = &rctx->subreq; | |
106 | int bsize = crypto_skcipher_blocksize(tfm); | |
d8c34b94 | 107 | u8 d[bsize * 2] __aligned(__alignof__(u32)); |
0605c41c HX |
108 | struct scatterlist *sg; |
109 | unsigned int offset; | |
110 | int lastn; | |
111 | ||
112 | offset = rctx->offset; | |
113 | lastn = req->cryptlen - offset; | |
114 | ||
115 | sg = scatterwalk_ffwd(rctx->sg, req->dst, offset - bsize); | |
116 | scatterwalk_map_and_copy(d + bsize, sg, 0, bsize, 0); | |
117 | ||
118 | memset(d, 0, bsize); | |
119 | scatterwalk_map_and_copy(d, req->src, offset, lastn, 0); | |
120 | ||
121 | scatterwalk_map_and_copy(d, sg, 0, bsize + lastn, 1); | |
122 | memzero_explicit(d, sizeof(d)); | |
123 | ||
124 | skcipher_request_set_callback(subreq, req->base.flags & | |
125 | CRYPTO_TFM_REQ_MAY_BACKLOG, | |
126 | cts_cbc_crypt_done, req); | |
127 | skcipher_request_set_crypt(subreq, sg, sg, bsize, req->iv); | |
128 | return crypto_skcipher_encrypt(subreq); | |
129 | } | |
76cb9521 | 130 | |
0605c41c HX |
131 | static void crypto_cts_encrypt_done(struct crypto_async_request *areq, int err) |
132 | { | |
133 | struct skcipher_request *req = areq->data; | |
76cb9521 | 134 | |
0605c41c HX |
135 | if (err) |
136 | goto out; | |
76cb9521 | 137 | |
0605c41c HX |
138 | err = cts_cbc_encrypt(req); |
139 | if (err == -EINPROGRESS || | |
140 | (err == -EBUSY && req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) | |
141 | return; | |
76cb9521 | 142 | |
0605c41c HX |
143 | out: |
144 | skcipher_request_complete(req, err); | |
145 | } | |
76cb9521 | 146 | |
0605c41c HX |
147 | static int crypto_cts_encrypt(struct skcipher_request *req) |
148 | { | |
149 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
150 | struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req); | |
151 | struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm); | |
152 | struct skcipher_request *subreq = &rctx->subreq; | |
153 | int bsize = crypto_skcipher_blocksize(tfm); | |
154 | unsigned int nbytes = req->cryptlen; | |
155 | int cbc_blocks = (nbytes + bsize - 1) / bsize - 1; | |
156 | unsigned int offset; | |
157 | ||
158 | skcipher_request_set_tfm(subreq, ctx->child); | |
159 | ||
160 | if (cbc_blocks <= 0) { | |
161 | skcipher_request_set_callback(subreq, req->base.flags, | |
162 | req->base.complete, | |
163 | req->base.data); | |
164 | skcipher_request_set_crypt(subreq, req->src, req->dst, nbytes, | |
165 | req->iv); | |
166 | return crypto_skcipher_encrypt(subreq); | |
167 | } | |
76cb9521 | 168 | |
0605c41c HX |
169 | offset = cbc_blocks * bsize; |
170 | rctx->offset = offset; | |
76cb9521 | 171 | |
0605c41c HX |
172 | skcipher_request_set_callback(subreq, req->base.flags, |
173 | crypto_cts_encrypt_done, req); | |
174 | skcipher_request_set_crypt(subreq, req->src, req->dst, | |
175 | offset, req->iv); | |
76cb9521 | 176 | |
0605c41c HX |
177 | return crypto_skcipher_encrypt(subreq) ?: |
178 | cts_cbc_encrypt(req); | |
76cb9521 KC |
179 | } |
180 | ||
0605c41c | 181 | static int cts_cbc_decrypt(struct skcipher_request *req) |
76cb9521 | 182 | { |
0605c41c HX |
183 | struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req); |
184 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
185 | struct skcipher_request *subreq = &rctx->subreq; | |
186 | int bsize = crypto_skcipher_blocksize(tfm); | |
d8c34b94 | 187 | u8 d[bsize * 2] __aligned(__alignof__(u32)); |
0605c41c HX |
188 | struct scatterlist *sg; |
189 | unsigned int offset; | |
190 | u8 *space; | |
191 | int lastn; | |
192 | ||
193 | offset = rctx->offset; | |
194 | lastn = req->cryptlen - offset; | |
195 | ||
196 | sg = scatterwalk_ffwd(rctx->sg, req->dst, offset - bsize); | |
197 | ||
198 | /* 1. Decrypt Cn-1 (s) to create Dn */ | |
199 | scatterwalk_map_and_copy(d + bsize, sg, 0, bsize, 0); | |
200 | space = crypto_cts_reqctx_space(req); | |
201 | crypto_xor(d + bsize, space, bsize); | |
202 | /* 2. Pad Cn with zeros at the end to create C of length BB */ | |
203 | memset(d, 0, bsize); | |
204 | scatterwalk_map_and_copy(d, req->src, offset, lastn, 0); | |
205 | /* 3. Exclusive-or Dn with C to create Xn */ | |
206 | /* 4. Select the first Ln bytes of Xn to create Pn */ | |
207 | crypto_xor(d + bsize, d, lastn); | |
208 | ||
209 | /* 5. Append the tail (BB - Ln) bytes of Xn to Cn to create En */ | |
210 | memcpy(d + lastn, d + bsize + lastn, bsize - lastn); | |
211 | /* 6. Decrypt En to create Pn-1 */ | |
76cb9521 | 212 | |
0605c41c HX |
213 | scatterwalk_map_and_copy(d, sg, 0, bsize + lastn, 1); |
214 | memzero_explicit(d, sizeof(d)); | |
76cb9521 | 215 | |
0605c41c HX |
216 | skcipher_request_set_callback(subreq, req->base.flags & |
217 | CRYPTO_TFM_REQ_MAY_BACKLOG, | |
218 | cts_cbc_crypt_done, req); | |
219 | ||
220 | skcipher_request_set_crypt(subreq, sg, sg, bsize, space); | |
221 | return crypto_skcipher_decrypt(subreq); | |
76cb9521 KC |
222 | } |
223 | ||
0605c41c | 224 | static void crypto_cts_decrypt_done(struct crypto_async_request *areq, int err) |
76cb9521 | 225 | { |
0605c41c | 226 | struct skcipher_request *req = areq->data; |
76cb9521 | 227 | |
0605c41c HX |
228 | if (err) |
229 | goto out; | |
c4913c7b | 230 | |
0605c41c HX |
231 | err = cts_cbc_decrypt(req); |
232 | if (err == -EINPROGRESS || | |
233 | (err == -EBUSY && req->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) | |
234 | return; | |
76cb9521 | 235 | |
0605c41c HX |
236 | out: |
237 | skcipher_request_complete(req, err); | |
238 | } | |
76cb9521 | 239 | |
0605c41c HX |
240 | static int crypto_cts_decrypt(struct skcipher_request *req) |
241 | { | |
242 | struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); | |
243 | struct crypto_cts_reqctx *rctx = skcipher_request_ctx(req); | |
244 | struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm); | |
245 | struct skcipher_request *subreq = &rctx->subreq; | |
246 | int bsize = crypto_skcipher_blocksize(tfm); | |
247 | unsigned int nbytes = req->cryptlen; | |
248 | int cbc_blocks = (nbytes + bsize - 1) / bsize - 1; | |
249 | unsigned int offset; | |
250 | u8 *space; | |
251 | ||
252 | skcipher_request_set_tfm(subreq, ctx->child); | |
253 | ||
254 | if (cbc_blocks <= 0) { | |
255 | skcipher_request_set_callback(subreq, req->base.flags, | |
256 | req->base.complete, | |
257 | req->base.data); | |
258 | skcipher_request_set_crypt(subreq, req->src, req->dst, nbytes, | |
259 | req->iv); | |
260 | return crypto_skcipher_decrypt(subreq); | |
261 | } | |
7185ad26 | 262 | |
0605c41c HX |
263 | skcipher_request_set_callback(subreq, req->base.flags, |
264 | crypto_cts_decrypt_done, req); | |
76cb9521 | 265 | |
0605c41c | 266 | space = crypto_cts_reqctx_space(req); |
76cb9521 | 267 | |
0605c41c HX |
268 | offset = cbc_blocks * bsize; |
269 | rctx->offset = offset; | |
76cb9521 | 270 | |
0605c41c HX |
271 | if (cbc_blocks <= 1) |
272 | memcpy(space, req->iv, bsize); | |
273 | else | |
274 | scatterwalk_map_and_copy(space, req->src, offset - 2 * bsize, | |
275 | bsize, 0); | |
76cb9521 | 276 | |
0605c41c HX |
277 | skcipher_request_set_crypt(subreq, req->src, req->dst, |
278 | offset, req->iv); | |
76cb9521 | 279 | |
0605c41c HX |
280 | return crypto_skcipher_decrypt(subreq) ?: |
281 | cts_cbc_decrypt(req); | |
76cb9521 KC |
282 | } |
283 | ||
0605c41c | 284 | static int crypto_cts_init_tfm(struct crypto_skcipher *tfm) |
76cb9521 | 285 | { |
0605c41c HX |
286 | struct skcipher_instance *inst = skcipher_alg_instance(tfm); |
287 | struct crypto_skcipher_spawn *spawn = skcipher_instance_ctx(inst); | |
288 | struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm); | |
289 | struct crypto_skcipher *cipher; | |
290 | unsigned reqsize; | |
291 | unsigned bsize; | |
292 | unsigned align; | |
293 | ||
60425a8b | 294 | cipher = crypto_spawn_skcipher(spawn); |
76cb9521 KC |
295 | if (IS_ERR(cipher)) |
296 | return PTR_ERR(cipher); | |
297 | ||
298 | ctx->child = cipher; | |
0605c41c HX |
299 | |
300 | align = crypto_skcipher_alignmask(tfm); | |
301 | bsize = crypto_skcipher_blocksize(cipher); | |
302 | reqsize = ALIGN(sizeof(struct crypto_cts_reqctx) + | |
303 | crypto_skcipher_reqsize(cipher), | |
304 | crypto_tfm_ctx_alignment()) + | |
305 | (align & ~(crypto_tfm_ctx_alignment() - 1)) + bsize; | |
306 | ||
307 | crypto_skcipher_set_reqsize(tfm, reqsize); | |
308 | ||
76cb9521 KC |
309 | return 0; |
310 | } | |
311 | ||
0605c41c | 312 | static void crypto_cts_exit_tfm(struct crypto_skcipher *tfm) |
76cb9521 | 313 | { |
0605c41c HX |
314 | struct crypto_cts_ctx *ctx = crypto_skcipher_ctx(tfm); |
315 | ||
316 | crypto_free_skcipher(ctx->child); | |
76cb9521 KC |
317 | } |
318 | ||
0605c41c | 319 | static void crypto_cts_free(struct skcipher_instance *inst) |
76cb9521 | 320 | { |
0605c41c HX |
321 | crypto_drop_skcipher(skcipher_instance_ctx(inst)); |
322 | kfree(inst); | |
323 | } | |
324 | ||
325 | static int crypto_cts_create(struct crypto_template *tmpl, struct rtattr **tb) | |
326 | { | |
327 | struct crypto_skcipher_spawn *spawn; | |
328 | struct skcipher_instance *inst; | |
329 | struct crypto_attr_type *algt; | |
330 | struct skcipher_alg *alg; | |
331 | const char *cipher_name; | |
76cb9521 KC |
332 | int err; |
333 | ||
0605c41c HX |
334 | algt = crypto_get_attr_type(tb); |
335 | if (IS_ERR(algt)) | |
336 | return PTR_ERR(algt); | |
337 | ||
338 | if ((algt->type ^ CRYPTO_ALG_TYPE_SKCIPHER) & algt->mask) | |
339 | return -EINVAL; | |
340 | ||
341 | cipher_name = crypto_attr_alg_name(tb[1]); | |
342 | if (IS_ERR(cipher_name)) | |
343 | return PTR_ERR(cipher_name); | |
344 | ||
345 | inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL); | |
346 | if (!inst) | |
347 | return -ENOMEM; | |
348 | ||
349 | spawn = skcipher_instance_ctx(inst); | |
350 | ||
351 | crypto_set_skcipher_spawn(spawn, skcipher_crypto_instance(inst)); | |
a35528ec EB |
352 | err = crypto_grab_skcipher(spawn, cipher_name, 0, |
353 | crypto_requires_sync(algt->type, | |
354 | algt->mask)); | |
76cb9521 | 355 | if (err) |
0605c41c | 356 | goto err_free_inst; |
76cb9521 | 357 | |
0605c41c | 358 | alg = crypto_spawn_skcipher_alg(spawn); |
76cb9521 | 359 | |
0605c41c HX |
360 | err = -EINVAL; |
361 | if (crypto_skcipher_alg_ivsize(alg) != alg->base.cra_blocksize) | |
362 | goto err_drop_spawn; | |
76cb9521 | 363 | |
0605c41c HX |
364 | if (strncmp(alg->base.cra_name, "cbc(", 4)) |
365 | goto err_drop_spawn; | |
988dc017 | 366 | |
0605c41c HX |
367 | err = crypto_inst_setname(skcipher_crypto_instance(inst), "cts", |
368 | &alg->base); | |
369 | if (err) | |
370 | goto err_drop_spawn; | |
76cb9521 | 371 | |
0605c41c HX |
372 | inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC; |
373 | inst->alg.base.cra_priority = alg->base.cra_priority; | |
374 | inst->alg.base.cra_blocksize = alg->base.cra_blocksize; | |
375 | inst->alg.base.cra_alignmask = alg->base.cra_alignmask; | |
76cb9521 | 376 | |
0605c41c HX |
377 | inst->alg.ivsize = alg->base.cra_blocksize; |
378 | inst->alg.chunksize = crypto_skcipher_alg_chunksize(alg); | |
379 | inst->alg.min_keysize = crypto_skcipher_alg_min_keysize(alg); | |
380 | inst->alg.max_keysize = crypto_skcipher_alg_max_keysize(alg); | |
76cb9521 | 381 | |
0605c41c | 382 | inst->alg.base.cra_ctxsize = sizeof(struct crypto_cts_ctx); |
76cb9521 | 383 | |
0605c41c HX |
384 | inst->alg.init = crypto_cts_init_tfm; |
385 | inst->alg.exit = crypto_cts_exit_tfm; | |
76cb9521 | 386 | |
0605c41c HX |
387 | inst->alg.setkey = crypto_cts_setkey; |
388 | inst->alg.encrypt = crypto_cts_encrypt; | |
389 | inst->alg.decrypt = crypto_cts_decrypt; | |
76cb9521 | 390 | |
0605c41c | 391 | inst->free = crypto_cts_free; |
76cb9521 | 392 | |
0605c41c HX |
393 | err = skcipher_register_instance(tmpl, inst); |
394 | if (err) | |
395 | goto err_drop_spawn; | |
396 | ||
397 | out: | |
398 | return err; | |
399 | ||
400 | err_drop_spawn: | |
401 | crypto_drop_skcipher(spawn); | |
402 | err_free_inst: | |
76cb9521 | 403 | kfree(inst); |
0605c41c | 404 | goto out; |
76cb9521 KC |
405 | } |
406 | ||
407 | static struct crypto_template crypto_cts_tmpl = { | |
408 | .name = "cts", | |
0605c41c | 409 | .create = crypto_cts_create, |
76cb9521 KC |
410 | .module = THIS_MODULE, |
411 | }; | |
412 | ||
413 | static int __init crypto_cts_module_init(void) | |
414 | { | |
415 | return crypto_register_template(&crypto_cts_tmpl); | |
416 | } | |
417 | ||
418 | static void __exit crypto_cts_module_exit(void) | |
419 | { | |
420 | crypto_unregister_template(&crypto_cts_tmpl); | |
421 | } | |
422 | ||
423 | module_init(crypto_cts_module_init); | |
424 | module_exit(crypto_cts_module_exit); | |
425 | ||
426 | MODULE_LICENSE("Dual BSD/GPL"); | |
427 | MODULE_DESCRIPTION("CTS-CBC CipherText Stealing for CBC"); | |
4943ba16 | 428 | MODULE_ALIAS_CRYPTO("cts"); |