Commit | Line | Data |
---|---|---|
64470f1b RS |
1 | /* LRW: as defined by Cyril Guyot in |
2 | * http://grouper.ieee.org/groups/1619/email/pdf00017.pdf | |
3 | * | |
4 | * Copyright (c) 2006 Rik Snel <rsnel@cube.dyndns.org> | |
5 | * | |
6 | * Based om ecb.c | |
7 | * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au> | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or modify it | |
10 | * under the terms of the GNU General Public License as published by the Free | |
11 | * Software Foundation; either version 2 of the License, or (at your option) | |
12 | * any later version. | |
13 | */ | |
14 | /* This implementation is checked against the test vectors in the above | |
15 | * document and by a test vector provided by Ken Buchanan at | |
16 | * http://www.mail-archive.com/stds-p1619@listserv.ieee.org/msg00173.html | |
17 | * | |
18 | * The test vectors are included in the testing module tcrypt.[ch] */ | |
19 | #include <crypto/algapi.h> | |
20 | #include <linux/err.h> | |
21 | #include <linux/init.h> | |
22 | #include <linux/kernel.h> | |
23 | #include <linux/module.h> | |
24 | #include <linux/scatterlist.h> | |
25 | #include <linux/slab.h> | |
26 | ||
27 | #include <crypto/b128ops.h> | |
28 | #include <crypto/gf128mul.h> | |
29 | ||
4660720d JK |
30 | #define LRW_BLOCK_SIZE 16 |
31 | ||
171c0204 | 32 | struct lrw_table_ctx { |
64470f1b RS |
33 | /* optimizes multiplying a random (non incrementing, as at the |
34 | * start of a new sector) value with key2, we could also have | |
35 | * used 4k optimization tables or no optimization at all. In the | |
36 | * latter case we would have to store key2 here */ | |
37 | struct gf128mul_64k *table; | |
38 | /* stores: | |
39 | * key2*{ 0,0,...0,0,0,0,1 }, key2*{ 0,0,...0,0,0,1,1 }, | |
40 | * key2*{ 0,0,...0,0,1,1,1 }, key2*{ 0,0,...0,1,1,1,1 } | |
41 | * key2*{ 0,0,...1,1,1,1,1 }, etc | |
42 | * needed for optimized multiplication of incrementing values | |
43 | * with key2 */ | |
44 | be128 mulinc[128]; | |
45 | }; | |
46 | ||
171c0204 JK |
47 | struct priv { |
48 | struct crypto_cipher *child; | |
49 | struct lrw_table_ctx table; | |
50 | }; | |
51 | ||
64470f1b RS |
52 | static inline void setbit128_bbe(void *b, int bit) |
53 | { | |
8eb2dfac HX |
54 | __set_bit(bit ^ (0x80 - |
55 | #ifdef __BIG_ENDIAN | |
56 | BITS_PER_LONG | |
57 | #else | |
58 | BITS_PER_BYTE | |
59 | #endif | |
60 | ), b); | |
64470f1b RS |
61 | } |
62 | ||
171c0204 | 63 | static int lrw_init_table(struct lrw_table_ctx *ctx, const u8 *tweak) |
64470f1b | 64 | { |
64470f1b | 65 | be128 tmp = { 0 }; |
171c0204 | 66 | int i; |
64470f1b RS |
67 | |
68 | if (ctx->table) | |
69 | gf128mul_free_64k(ctx->table); | |
70 | ||
71 | /* initialize multiplication table for Key2 */ | |
171c0204 | 72 | ctx->table = gf128mul_init_64k_bbe((be128 *)tweak); |
64470f1b RS |
73 | if (!ctx->table) |
74 | return -ENOMEM; | |
75 | ||
76 | /* initialize optimization table */ | |
77 | for (i = 0; i < 128; i++) { | |
78 | setbit128_bbe(&tmp, i); | |
79 | ctx->mulinc[i] = tmp; | |
80 | gf128mul_64k_bbe(&ctx->mulinc[i], ctx->table); | |
81 | } | |
82 | ||
83 | return 0; | |
84 | } | |
85 | ||
171c0204 JK |
86 | static void lrw_free_table(struct lrw_table_ctx *ctx) |
87 | { | |
88 | if (ctx->table) | |
89 | gf128mul_free_64k(ctx->table); | |
90 | } | |
91 | ||
92 | static int setkey(struct crypto_tfm *parent, const u8 *key, | |
93 | unsigned int keylen) | |
94 | { | |
95 | struct priv *ctx = crypto_tfm_ctx(parent); | |
96 | struct crypto_cipher *child = ctx->child; | |
97 | int err, bsize = LRW_BLOCK_SIZE; | |
98 | const u8 *tweak = key + keylen - bsize; | |
99 | ||
100 | crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK); | |
101 | crypto_cipher_set_flags(child, crypto_tfm_get_flags(parent) & | |
102 | CRYPTO_TFM_REQ_MASK); | |
103 | err = crypto_cipher_setkey(child, key, keylen - bsize); | |
104 | if (err) | |
105 | return err; | |
106 | crypto_tfm_set_flags(parent, crypto_cipher_get_flags(child) & | |
107 | CRYPTO_TFM_RES_MASK); | |
108 | ||
109 | return lrw_init_table(&ctx->table, tweak); | |
110 | } | |
111 | ||
64470f1b RS |
112 | struct sinfo { |
113 | be128 t; | |
114 | struct crypto_tfm *tfm; | |
115 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *); | |
116 | }; | |
117 | ||
118 | static inline void inc(be128 *iv) | |
119 | { | |
fd4609a8 MS |
120 | be64_add_cpu(&iv->b, 1); |
121 | if (!iv->b) | |
122 | be64_add_cpu(&iv->a, 1); | |
64470f1b RS |
123 | } |
124 | ||
9ebed9d1 | 125 | static inline void lrw_round(struct sinfo *s, void *dst, const void *src) |
64470f1b RS |
126 | { |
127 | be128_xor(dst, &s->t, src); /* PP <- T xor P */ | |
128 | s->fn(s->tfm, dst, dst); /* CC <- E(Key2,PP) */ | |
129 | be128_xor(dst, dst, &s->t); /* C <- T xor CC */ | |
130 | } | |
131 | ||
132 | /* this returns the number of consequative 1 bits starting | |
133 | * from the right, get_index128(00 00 00 00 00 00 ... 00 00 10 FB) = 2 */ | |
134 | static inline int get_index128(be128 *block) | |
135 | { | |
136 | int x; | |
137 | __be32 *p = (__be32 *) block; | |
138 | ||
139 | for (p += 3, x = 0; x < 128; p--, x += 32) { | |
140 | u32 val = be32_to_cpup(p); | |
141 | ||
142 | if (!~val) | |
143 | continue; | |
144 | ||
145 | return x + ffz(val); | |
146 | } | |
147 | ||
148 | return x; | |
149 | } | |
150 | ||
151 | static int crypt(struct blkcipher_desc *d, | |
152 | struct blkcipher_walk *w, struct priv *ctx, | |
153 | void (*fn)(struct crypto_tfm *, u8 *, const u8 *)) | |
154 | { | |
155 | int err; | |
156 | unsigned int avail; | |
4660720d | 157 | const int bs = LRW_BLOCK_SIZE; |
64470f1b RS |
158 | struct sinfo s = { |
159 | .tfm = crypto_cipher_tfm(ctx->child), | |
160 | .fn = fn | |
161 | }; | |
162 | be128 *iv; | |
163 | u8 *wsrc; | |
164 | u8 *wdst; | |
165 | ||
166 | err = blkcipher_walk_virt(d, w); | |
167 | if (!(avail = w->nbytes)) | |
168 | return err; | |
169 | ||
170 | wsrc = w->src.virt.addr; | |
171 | wdst = w->dst.virt.addr; | |
172 | ||
173 | /* calculate first value of T */ | |
174 | iv = (be128 *)w->iv; | |
175 | s.t = *iv; | |
176 | ||
177 | /* T <- I*Key2 */ | |
171c0204 | 178 | gf128mul_64k_bbe(&s.t, ctx->table.table); |
64470f1b RS |
179 | |
180 | goto first; | |
181 | ||
182 | for (;;) { | |
183 | do { | |
184 | /* T <- I*Key2, using the optimization | |
185 | * discussed in the specification */ | |
171c0204 JK |
186 | be128_xor(&s.t, &s.t, |
187 | &ctx->table.mulinc[get_index128(iv)]); | |
64470f1b RS |
188 | inc(iv); |
189 | ||
190 | first: | |
9ebed9d1 | 191 | lrw_round(&s, wdst, wsrc); |
64470f1b RS |
192 | |
193 | wsrc += bs; | |
194 | wdst += bs; | |
195 | } while ((avail -= bs) >= bs); | |
196 | ||
197 | err = blkcipher_walk_done(d, w, avail); | |
198 | if (!(avail = w->nbytes)) | |
199 | break; | |
200 | ||
201 | wsrc = w->src.virt.addr; | |
202 | wdst = w->dst.virt.addr; | |
203 | } | |
204 | ||
205 | return err; | |
206 | } | |
207 | ||
208 | static int encrypt(struct blkcipher_desc *desc, struct scatterlist *dst, | |
209 | struct scatterlist *src, unsigned int nbytes) | |
210 | { | |
211 | struct priv *ctx = crypto_blkcipher_ctx(desc->tfm); | |
212 | struct blkcipher_walk w; | |
213 | ||
214 | blkcipher_walk_init(&w, dst, src, nbytes); | |
215 | return crypt(desc, &w, ctx, | |
216 | crypto_cipher_alg(ctx->child)->cia_encrypt); | |
217 | } | |
218 | ||
219 | static int decrypt(struct blkcipher_desc *desc, struct scatterlist *dst, | |
220 | struct scatterlist *src, unsigned int nbytes) | |
221 | { | |
222 | struct priv *ctx = crypto_blkcipher_ctx(desc->tfm); | |
223 | struct blkcipher_walk w; | |
224 | ||
225 | blkcipher_walk_init(&w, dst, src, nbytes); | |
226 | return crypt(desc, &w, ctx, | |
227 | crypto_cipher_alg(ctx->child)->cia_decrypt); | |
228 | } | |
229 | ||
230 | static int init_tfm(struct crypto_tfm *tfm) | |
231 | { | |
2e306ee0 | 232 | struct crypto_cipher *cipher; |
64470f1b RS |
233 | struct crypto_instance *inst = (void *)tfm->__crt_alg; |
234 | struct crypto_spawn *spawn = crypto_instance_ctx(inst); | |
235 | struct priv *ctx = crypto_tfm_ctx(tfm); | |
236 | u32 *flags = &tfm->crt_flags; | |
237 | ||
2e306ee0 HX |
238 | cipher = crypto_spawn_cipher(spawn); |
239 | if (IS_ERR(cipher)) | |
240 | return PTR_ERR(cipher); | |
64470f1b | 241 | |
4660720d | 242 | if (crypto_cipher_blocksize(cipher) != LRW_BLOCK_SIZE) { |
64470f1b | 243 | *flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN; |
b884f8b9 | 244 | crypto_free_cipher(cipher); |
64470f1b RS |
245 | return -EINVAL; |
246 | } | |
247 | ||
2e306ee0 | 248 | ctx->child = cipher; |
64470f1b RS |
249 | return 0; |
250 | } | |
251 | ||
252 | static void exit_tfm(struct crypto_tfm *tfm) | |
253 | { | |
254 | struct priv *ctx = crypto_tfm_ctx(tfm); | |
171c0204 JK |
255 | |
256 | lrw_free_table(&ctx->table); | |
64470f1b RS |
257 | crypto_free_cipher(ctx->child); |
258 | } | |
259 | ||
ebc610e5 | 260 | static struct crypto_instance *alloc(struct rtattr **tb) |
64470f1b RS |
261 | { |
262 | struct crypto_instance *inst; | |
263 | struct crypto_alg *alg; | |
ebc610e5 HX |
264 | int err; |
265 | ||
266 | err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_BLKCIPHER); | |
267 | if (err) | |
268 | return ERR_PTR(err); | |
64470f1b | 269 | |
ebc610e5 HX |
270 | alg = crypto_get_attr_alg(tb, CRYPTO_ALG_TYPE_CIPHER, |
271 | CRYPTO_ALG_TYPE_MASK); | |
64470f1b | 272 | if (IS_ERR(alg)) |
e231c2ee | 273 | return ERR_CAST(alg); |
64470f1b RS |
274 | |
275 | inst = crypto_alloc_instance("lrw", alg); | |
276 | if (IS_ERR(inst)) | |
277 | goto out_put_alg; | |
278 | ||
279 | inst->alg.cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER; | |
280 | inst->alg.cra_priority = alg->cra_priority; | |
281 | inst->alg.cra_blocksize = alg->cra_blocksize; | |
282 | ||
283 | if (alg->cra_alignmask < 7) inst->alg.cra_alignmask = 7; | |
284 | else inst->alg.cra_alignmask = alg->cra_alignmask; | |
285 | inst->alg.cra_type = &crypto_blkcipher_type; | |
286 | ||
287 | if (!(alg->cra_blocksize % 4)) | |
288 | inst->alg.cra_alignmask |= 3; | |
289 | inst->alg.cra_blkcipher.ivsize = alg->cra_blocksize; | |
290 | inst->alg.cra_blkcipher.min_keysize = | |
291 | alg->cra_cipher.cia_min_keysize + alg->cra_blocksize; | |
292 | inst->alg.cra_blkcipher.max_keysize = | |
293 | alg->cra_cipher.cia_max_keysize + alg->cra_blocksize; | |
294 | ||
295 | inst->alg.cra_ctxsize = sizeof(struct priv); | |
296 | ||
297 | inst->alg.cra_init = init_tfm; | |
298 | inst->alg.cra_exit = exit_tfm; | |
299 | ||
300 | inst->alg.cra_blkcipher.setkey = setkey; | |
301 | inst->alg.cra_blkcipher.encrypt = encrypt; | |
302 | inst->alg.cra_blkcipher.decrypt = decrypt; | |
303 | ||
304 | out_put_alg: | |
305 | crypto_mod_put(alg); | |
306 | return inst; | |
307 | } | |
308 | ||
309 | static void free(struct crypto_instance *inst) | |
310 | { | |
311 | crypto_drop_spawn(crypto_instance_ctx(inst)); | |
312 | kfree(inst); | |
313 | } | |
314 | ||
315 | static struct crypto_template crypto_tmpl = { | |
316 | .name = "lrw", | |
317 | .alloc = alloc, | |
318 | .free = free, | |
319 | .module = THIS_MODULE, | |
320 | }; | |
321 | ||
322 | static int __init crypto_module_init(void) | |
323 | { | |
324 | return crypto_register_template(&crypto_tmpl); | |
325 | } | |
326 | ||
327 | static void __exit crypto_module_exit(void) | |
328 | { | |
329 | crypto_unregister_template(&crypto_tmpl); | |
330 | } | |
331 | ||
332 | module_init(crypto_module_init); | |
333 | module_exit(crypto_module_exit); | |
334 | ||
335 | MODULE_LICENSE("GPL"); | |
336 | MODULE_DESCRIPTION("LRW block cipher mode"); |