[linux-2.6-block.git] / crypto / poly1305_generic.c

/*
 * Poly1305 authenticator algorithm, RFC7539
 *
 * Copyright (C) 2015 Martin Willi
 *
 * Based on public domain code by Andrew Moon and Daniel J. Bernstein.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 */

#include <crypto/algapi.h>
#include <crypto/internal/hash.h>
#include <crypto/internal/poly1305.h>
#include <linux/crypto.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <asm/unaligned.h>

int crypto_poly1305_init(struct shash_desc *desc)
{
	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);

	poly1305_core_init(&dctx->h);
	dctx->buflen = 0;
	dctx->rset = 0;
	dctx->sset = false;

	return 0;
}
EXPORT_SYMBOL_GPL(crypto_poly1305_init);

static void poly1305_blocks(struct poly1305_desc_ctx *dctx, const u8 *src,
			    unsigned int srclen)
{
	unsigned int datalen;

	if (unlikely(!dctx->sset)) {
		datalen = crypto_poly1305_setdesckey(dctx, src, srclen);
		src += srclen - datalen;
		srclen = datalen;
	}

	poly1305_core_blocks(&dctx->h, dctx->r, src,
			     srclen / POLY1305_BLOCK_SIZE, 1);
}

int crypto_poly1305_update(struct shash_desc *desc,
			   const u8 *src, unsigned int srclen)
{
	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
	unsigned int bytes;

	if (unlikely(dctx->buflen)) {
		bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen);
		memcpy(dctx->buf + dctx->buflen, src, bytes);
		src += bytes;
		srclen -= bytes;
		dctx->buflen += bytes;

		if (dctx->buflen == POLY1305_BLOCK_SIZE) {
			poly1305_blocks(dctx, dctx->buf,
					POLY1305_BLOCK_SIZE);
			dctx->buflen = 0;
		}
	}

	if (likely(srclen >= POLY1305_BLOCK_SIZE)) {
		poly1305_blocks(dctx, src, srclen);
		src += srclen - (srclen % POLY1305_BLOCK_SIZE);
		srclen %= POLY1305_BLOCK_SIZE;
	}

	if (unlikely(srclen)) {
		dctx->buflen = srclen;
		memcpy(dctx->buf, src, srclen);
	}

	return 0;
}
EXPORT_SYMBOL_GPL(crypto_poly1305_update);

int crypto_poly1305_final(struct shash_desc *desc, u8 *dst)
{
	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
	__le32 digest[4];
	u64 f = 0;

	if (unlikely(!dctx->sset))
		return -ENOKEY;

	if (unlikely(dctx->buflen)) {
		dctx->buf[dctx->buflen++] = 1;
		memset(dctx->buf + dctx->buflen, 0,
		       POLY1305_BLOCK_SIZE - dctx->buflen);
		poly1305_core_blocks(&dctx->h, dctx->r, dctx->buf, 1, 0);
	}

	poly1305_core_emit(&dctx->h, digest);

	/* mac = (h + s) % (2^128) */
	f = (f >> 32) + le32_to_cpu(digest[0]) + dctx->s[0];
	put_unaligned_le32(f, dst + 0);
	f = (f >> 32) + le32_to_cpu(digest[1]) + dctx->s[1];
	put_unaligned_le32(f, dst + 4);
	f = (f >> 32) + le32_to_cpu(digest[2]) + dctx->s[2];
	put_unaligned_le32(f, dst + 8);
	f = (f >> 32) + le32_to_cpu(digest[3]) + dctx->s[3];
	put_unaligned_le32(f, dst + 12);

	return 0;
}
EXPORT_SYMBOL_GPL(crypto_poly1305_final);

static struct shash_alg poly1305_alg = {
	.digestsize	= POLY1305_DIGEST_SIZE,
	.init		= crypto_poly1305_init,
	.update		= crypto_poly1305_update,
	.final		= crypto_poly1305_final,
	.descsize	= sizeof(struct poly1305_desc_ctx),
	.base		= {
		.cra_name		= "poly1305",
		.cra_driver_name	= "poly1305-generic",
		.cra_priority		= 100,
		.cra_blocksize		= POLY1305_BLOCK_SIZE,
		.cra_module		= THIS_MODULE,
	},
};

static int __init poly1305_mod_init(void)
{
	return crypto_register_shash(&poly1305_alg);
}

static void __exit poly1305_mod_exit(void)
{
	crypto_unregister_shash(&poly1305_alg);
}

subsys_initcall(poly1305_mod_init);
module_exit(poly1305_mod_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Martin Willi <martin@strongswan.org>");
MODULE_DESCRIPTION("Poly1305 authenticator");
MODULE_ALIAS_CRYPTO("poly1305");
MODULE_ALIAS_CRYPTO("poly1305-generic");
Commit	Line	Data
f979e014 MW	1	/*
	2	* Poly1305 authenticator algorithm, RFC7539
	3	*
	4	* Copyright (C) 2015 Martin Willi
	5	*
	6	* Based on public domain code by Andrew Moon and Daniel J. Bernstein.
	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License as published by
	10	* the Free Software Foundation; either version 2 of the License, or
	11	* (at your option) any later version.
	12	*/
	13
	14	#include <crypto/algapi.h>
	15	#include <crypto/internal/hash.h>
48ea8c6e	16	#include <crypto/internal/poly1305.h>
f979e014 MW	17	#include <linux/crypto.h>
	18	#include <linux/kernel.h>
	19	#include <linux/module.h>
109e23bd	20	#include <asm/unaligned.h>
f979e014	21
2546f811	22	int crypto_poly1305_init(struct shash_desc *desc)
f979e014 MW	23	{
	24	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
	25
1b6fd3d5	26	poly1305_core_init(&dctx->h);
f979e014	27	dctx->buflen = 0;
ad8f5b88	28	dctx->rset = 0;
c2b7b20a	29	dctx->sset = false;
f979e014 MW	30
	31	return 0;
	32	}
2546f811	33	EXPORT_SYMBOL_GPL(crypto_poly1305_init);
f979e014	34
48ea8c6e AB	35	static void poly1305_blocks(struct poly1305_desc_ctx dctx, const u8 src,
48ea8c6e AB	36	unsigned int srclen)
1b6fd3d5 EB	37	{
	38	unsigned int datalen;
	39
	40	if (unlikely(!dctx->sset)) {
	41	datalen = crypto_poly1305_setdesckey(dctx, src, srclen);
	42	src += srclen - datalen;
	43	srclen = datalen;
	44	}
	45
ad8f5b88	46	poly1305_core_blocks(&dctx->h, dctx->r, src,
48ea8c6e	47	srclen / POLY1305_BLOCK_SIZE, 1);
f979e014 MW	48	}
f979e014 MW	49
2546f811	50	int crypto_poly1305_update(struct shash_desc *desc,
f979e014 MW	51	const u8 *src, unsigned int srclen)
	52	{
	53	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
f979e014 MW	54	unsigned int bytes;
	55
	56	if (unlikely(dctx->buflen)) {
	57	bytes = min(srclen, POLY1305_BLOCK_SIZE - dctx->buflen);
	58	memcpy(dctx->buf + dctx->buflen, src, bytes);
	59	src += bytes;
	60	srclen -= bytes;
	61	dctx->buflen += bytes;
	62
	63	if (dctx->buflen == POLY1305_BLOCK_SIZE) {
c2b7b20a	64	poly1305_blocks(dctx, dctx->buf,
48ea8c6e	65	POLY1305_BLOCK_SIZE);
f979e014 MW	66	dctx->buflen = 0;
	67	}
	68	}
	69
	70	if (likely(srclen >= POLY1305_BLOCK_SIZE)) {
48ea8c6e	71	poly1305_blocks(dctx, src, srclen);
1b6fd3d5 EB	72	src += srclen - (srclen % POLY1305_BLOCK_SIZE);
1b6fd3d5 EB	73	srclen %= POLY1305_BLOCK_SIZE;
f979e014 MW	74	}
	75
	76	if (unlikely(srclen)) {
	77	dctx->buflen = srclen;
	78	memcpy(dctx->buf, src, srclen);
	79	}
	80
	81	return 0;
	82	}
2546f811	83	EXPORT_SYMBOL_GPL(crypto_poly1305_update);
f979e014	84
1b6fd3d5 EB	85	int crypto_poly1305_final(struct shash_desc desc, u8 dst)
	86	{
	87	struct poly1305_desc_ctx *dctx = shash_desc_ctx(desc);
	88	__le32 digest[4];
	89	u64 f = 0;
	90
	91	if (unlikely(!dctx->sset))
	92	return -ENOKEY;
	93
	94	if (unlikely(dctx->buflen)) {
	95	dctx->buf[dctx->buflen++] = 1;
	96	memset(dctx->buf + dctx->buflen, 0,
	97	POLY1305_BLOCK_SIZE - dctx->buflen);
ad8f5b88	98	poly1305_core_blocks(&dctx->h, dctx->r, dctx->buf, 1, 0);
1b6fd3d5 EB	99	}
	100
	101	poly1305_core_emit(&dctx->h, digest);
f979e014 MW	102
f979e014 MW	103	/* mac = (h + s) % (2^128) */
1b6fd3d5 EB	104	f = (f >> 32) + le32_to_cpu(digest[0]) + dctx->s[0];
	105	put_unaligned_le32(f, dst + 0);
	106	f = (f >> 32) + le32_to_cpu(digest[1]) + dctx->s[1];
	107	put_unaligned_le32(f, dst + 4);
	108	f = (f >> 32) + le32_to_cpu(digest[2]) + dctx->s[2];
	109	put_unaligned_le32(f, dst + 8);
	110	f = (f >> 32) + le32_to_cpu(digest[3]) + dctx->s[3];
	111	put_unaligned_le32(f, dst + 12);
f979e014 MW	112
	113	return 0;
	114	}
2546f811	115	EXPORT_SYMBOL_GPL(crypto_poly1305_final);
f979e014 MW	116
	117	static struct shash_alg poly1305_alg = {
	118	.digestsize = POLY1305_DIGEST_SIZE,
2546f811 MW	119	.init = crypto_poly1305_init,
	120	.update = crypto_poly1305_update,
	121	.final = crypto_poly1305_final,
f979e014 MW	122	.descsize = sizeof(struct poly1305_desc_ctx),
	123	.base = {
	124	.cra_name = "poly1305",
	125	.cra_driver_name = "poly1305-generic",
	126	.cra_priority = 100,
f979e014	127	.cra_blocksize = POLY1305_BLOCK_SIZE,
f979e014 MW	128	.cra_module = THIS_MODULE,
	129	},
	130	};
	131
	132	static int __init poly1305_mod_init(void)
	133	{
	134	return crypto_register_shash(&poly1305_alg);
	135	}
	136
	137	static void __exit poly1305_mod_exit(void)
	138	{
	139	crypto_unregister_shash(&poly1305_alg);
	140	}
	141
c4741b23	142	subsys_initcall(poly1305_mod_init);
f979e014 MW	143	module_exit(poly1305_mod_exit);
	144
	145	MODULE_LICENSE("GPL");
	146	MODULE_AUTHOR("Martin Willi <martin@strongswan.org>");
	147	MODULE_DESCRIPTION("Poly1305 authenticator");
	148	MODULE_ALIAS_CRYPTO("poly1305");
	149	MODULE_ALIAS_CRYPTO("poly1305-generic");